Final part of fix for SA40476, c.f. http://gna.org/bugs/?20003

5 files changed, 443 insertions, 2 deletions

diff --git a/games/freeciv-share/Makefile b/games/freeciv-share/Makefile
index ea71a484352..a0bbde5b3fa 100644
--- a/games/freeciv-share/Makefile
+++ b/games/freeciv-share/Makefile
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.21 2012/07/31 15:49:37 prlw1 Exp $
+# $NetBSD: Makefile,v 1.22 2012/08/17 18:42:43 prlw1 Exp $
 
 PKGNAME=	${DISTNAME:S/-/-share-/}
+PKGREVISION=	1
 COMMENT=	Machine independent files for Freeciv
 
 PKG_DESTDIR_SUPPORT=	user-destdir
diff --git a/games/freeciv-share/distinfo b/games/freeciv-share/distinfo
index 41db9ad91bc..04b0be7ad1b 100644
--- a/games/freeciv-share/distinfo
+++ b/games/freeciv-share/distinfo
@@ -1,7 +1,10 @@
-$NetBSD: distinfo,v 1.26 2012/08/03 12:03:13 prlw1 Exp $
+$NetBSD: distinfo,v 1.27 2012/08/17 18:42:43 prlw1 Exp $
 
 SHA1 (freeciv-2.3.2.tar.bz2) = e6267b5e0483cf9c29d01793d2f9433e73d62191
 RMD160 (freeciv-2.3.2.tar.bz2) = 63bea690cfd6953bfb30d320a3e3f7a69353b64c
 Size (freeciv-2.3.2.tar.bz2) = 30695128 bytes
 SHA1 (patch-aa) = bac3e05393c154defd288cc621606a3dbd7f00eb
+SHA1 (patch-common_dataio.c) = 6fd08d7185f953fbfdc2c554ad67c4e5c8f2be87
+SHA1 (patch-common_dataio.h) = 4a513230ee814269466959fcb977b1360a78ee53
+SHA1 (patch-common_generate__packets.py) = 0fb74f024d1ada9ad85f62b12099c385d1e972c7
 SHA1 (patch-common_packets.c) = 7ea66b3d0068a1255d818a9808bf7e581c95fb71
diff --git a/games/freeciv-share/patches/patch-common_dataio.c b/games/freeciv-share/patches/patch-common_dataio.c
new file mode 100644
index 00000000000..7070c7f13ed
--- /dev/null
+++ b/games/freeciv-share/patches/patch-common_dataio.c
@@ -0,0 +1,363 @@
+$NetBSD: patch-common_dataio.c,v 1.1 2012/08/17 18:42:44 prlw1 Exp $
+
+Fixes part 2 of http://secunia.com/advisories/40476/
+c.f. https://gna.org/bugs/?20003
+
+--- common/dataio.c.orig	2012-03-31 12:35:45.000000000 +0000
++++ common/dataio.c
+@@ -408,7 +408,7 @@ void dio_put_worklist(struct data_out *d
+  Receive uint8 value to dest. In case of failure, value stored to dest
+  will be zero. Note that zero is legal value even when there is no failure.
+ **************************************************************************/
+-void dio_get_uint8(struct data_in *din, int *dest)
++bool dio_get_uint8(struct data_in *din, int *dest)
+ {
+   if (enough_data(din, 1)) {
+     if (dest) {
+@@ -421,14 +421,18 @@ void dio_get_uint8(struct data_in *din, 
+     din->current++;
+   } else if (dest) {
+     *dest = 0;
++
++    return FALSE;
+   }
++
++  return TRUE;
+ }
+ 
+ /**************************************************************************
+  Receive uint16 value to dest. In case of failure, value stored to dest
+  will be zero. Note that zero is legal value even when there is no failure.
+ **************************************************************************/
+-void dio_get_uint16(struct data_in *din, int *dest)
++bool dio_get_uint16(struct data_in *din, int *dest)
+ {
+   if (enough_data(din, 2)) {
+     if (dest) {
+@@ -441,14 +445,18 @@ void dio_get_uint16(struct data_in *din,
+     din->current += 2;
+   } else if (dest) {
+     *dest = 0;
++
++    return FALSE;
+   }
++
++  return TRUE;
+ }
+ 
+ /**************************************************************************
+  Receive uint32 value to dest. In case of failure, value stored to dest
+  will be zero. Note that zero is legal value even when there is no failure.
+ **************************************************************************/
+-void dio_get_uint32(struct data_in *din, int *dest)
++bool dio_get_uint32(struct data_in *din, int *dest)
+ {
+   if (enough_data(din, 4)) {
+     if (dest) {
+@@ -461,17 +469,22 @@ void dio_get_uint32(struct data_in *din,
+     din->current += 4;
+   } else if (dest) {
+     *dest = 0;
++
++    return FALSE;
+   }
++
++  return TRUE;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_bool8(struct data_in *din, bool * dest)
++bool dio_get_bool8(struct data_in *din, bool * dest)
+ {
+   int ival;
++  bool retval;
+ 
+-  dio_get_uint8(din, &ival);
++  retval = dio_get_uint8(din, &ival);
+ 
+   if (ival != 0 && ival != 1) {
+     log_error("Received value isn't boolean: %d", ival);
+@@ -479,16 +492,19 @@ void dio_get_bool8(struct data_in *din, 
+   }
+ 
+   *dest = (ival != 0);
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_bool32(struct data_in *din, bool * dest)
++bool dio_get_bool32(struct data_in *din, bool * dest)
+ {
+   int ival = 0;
++  bool retval;
+ 
+-  dio_get_uint32(din, &ival);
++  retval = dio_get_uint32(din, &ival);
+ 
+   if (ival != 0 && ival != 1) {
+     log_error("Received value isn't boolean: %d", ival);
+@@ -496,57 +512,69 @@ void dio_get_bool32(struct data_in *din,
+   }
+ 
+   *dest = (ival != 0);
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_sint8(struct data_in *din, int *dest)
++bool dio_get_sint8(struct data_in *din, int *dest)
+ {
+   int tmp;
++  bool retval;
+ 
+-  dio_get_uint8(din, &tmp);
++  retval = dio_get_uint8(din, &tmp);
+   if (dest) {
+     if (tmp > 0x7f) {
+       tmp -= 0x100;
+     }
+     *dest = tmp;
+   }
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_sint16(struct data_in *din, int *dest)
++bool dio_get_sint16(struct data_in *din, int *dest)
+ {
+   int tmp = 0;
++  bool retval;
+ 
+-  dio_get_uint16(din, &tmp);
++  retval = dio_get_uint16(din, &tmp);
+   if (dest) {
+     if (tmp > 0x7fff) {
+       tmp -= 0x10000;
+     }
+     *dest = tmp;
+   }
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_memory(struct data_in *din, void *dest, size_t dest_size)
++bool dio_get_memory(struct data_in *din, void *dest, size_t dest_size)
+ {
+   if (enough_data(din, dest_size)) {
+     if (dest) {
+       memcpy(dest, ADD_TO_POINTER(din->src, din->current), dest_size);
+     }
+     din->current += dest_size;
++  } else {
++    return FALSE;
+   }
++
++  return TRUE;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_string(struct data_in *din, char *dest, size_t max_dest_size)
++bool dio_get_string(struct data_in *din, char *dest, size_t max_dest_size)
+ {
+   char *c;
+   size_t ps_len;		/* length in packet, not including null */
+@@ -556,7 +584,7 @@ void dio_get_string(struct data_in *din,
+ 
+   if (!enough_data(din, 1)) {
+     dest[0] = '\0';
+-    return;
++    return FALSE;
+   }
+ 
+   remaining = dio_input_remaining(din);
+@@ -582,37 +610,40 @@ void dio_get_string(struct data_in *din,
+   if (!din->too_short) {
+     din->current += (ps_len + 1);	/* past terminator */
+   }
++
++  return TRUE;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_bit_string(struct data_in *din, char *dest,
++bool dio_get_bit_string(struct data_in *din, char *dest,
+ 			size_t max_dest_size)
+ {
+   int npack = 0;		/* number claimed in packet */
+   int i;			/* iterate the bytes */
++  bool retval;
+ 
+   fc_assert(dest != NULL && max_dest_size > 0);
+ 
+   if (!enough_data(din, 1)) {
+     dest[0] = '\0';
+-    return;
++    return FALSE;
+   }
+ 
+-  dio_get_uint16(din, &npack);
++  retval = dio_get_uint16(din, &npack);
+   if (npack >= max_dest_size) {
+       log_error("Have size for %lu, got %d",
+                 (unsigned long) max_dest_size, npack);
+     din->bad_bit_string = TRUE;
+     dest[0] = '\0';
+-    return;
++    return FALSE;
+   }
+ 
+   for (i = 0; i < npack;) {
+     int bit, byte_value;
+ 
+-    dio_get_uint8(din, &byte_value);
++    retval = dio_get_uint8(din, &byte_value);
+     for (bit = 0; bit < 8 && i < npack; bit++, i++) {
+       if (TEST_BIT(byte_value, bit)) {
+ 	dest[i] = '1';
+@@ -627,17 +658,20 @@ void dio_get_bit_string(struct data_in *
+   if (din->too_short) {
+     din->bad_bit_string = TRUE;
+   }
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_tech_list(struct data_in *din, int *dest)
++bool dio_get_tech_list(struct data_in *din, int *dest)
+ {
+   int i;
++  bool retval;
+ 
+   for (i = 0; i < MAX_NUM_TECH_LIST; i++) {
+-    dio_get_uint8(din, &dest[i]);
++    retval = dio_get_uint8(din, &dest[i]);
+     if (dest[i] == A_LAST) {
+       break;
+     }
+@@ -646,56 +680,66 @@ void dio_get_tech_list(struct data_in *d
+   for (; i < MAX_NUM_TECH_LIST; i++) {
+     dest[i] = A_LAST;
+   }
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_worklist(struct data_in *din, struct worklist *pwl)
++bool dio_get_worklist(struct data_in *din, struct worklist *pwl)
+ {
+   int i, length;
++  bool retval;
+ 
+   worklist_init(pwl);
+ 
+-  dio_get_uint8(din, &length);
++  retval = dio_get_uint8(din, &length);
+   for (i = 0; i < length; i++) {
+     int identifier;
+     int kind;
+ 
+     dio_get_uint8(din, &kind);
+-    dio_get_uint8(din, &identifier);
++    retval = dio_get_uint8(din, &identifier);
+ 
+     worklist_append(pwl, universal_by_number(kind, identifier));
+   }
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+ ...
+ **************************************************************************/
+-void dio_get_uint8_vec8(struct data_in *din, int **values, int stop_value)
++bool dio_get_uint8_vec8(struct data_in *din, int **values, int stop_value)
+ {
+   int count, inx;
++  bool retval;
+ 
+-  dio_get_uint8(din, &count);
++  retval = dio_get_uint8(din, &count);
+   if (values) {
+     *values = fc_calloc((count + 1), sizeof(**values));
+   }
+   for (inx = 0; inx < count; inx++) {
+-    dio_get_uint8(din, values ? &((*values)[inx]) : NULL);
++    retval = dio_get_uint8(din, values ? &((*values)[inx]) : NULL);
+   }
+   if (values) {
+     (*values)[inx] = stop_value;
+   }
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+  Receive vector of uint6 values.
+ **************************************************************************/
+-void dio_get_uint16_vec8(struct data_in *din, int **values, int stop_value)
++bool dio_get_uint16_vec8(struct data_in *din, int **values, int stop_value)
+ {
+   int count, inx;
++  bool retval;
++
++  retval = dio_get_uint8(din, &count);
+ 
+-  dio_get_uint8(din, &count);
+   if (values) {
+     *values = fc_calloc((count + 1), sizeof(**values));
+   }
+@@ -705,23 +749,28 @@ void dio_get_uint16_vec8(struct data_in 
+   if (values) {
+     (*values)[inx] = stop_value;
+   }
++
++  return retval;
+ }
+ 
+ /**************************************************************************
+   De-serialize a requirement.
+ **************************************************************************/
+-void dio_get_requirement(struct data_in *din, struct requirement *preq)
++bool dio_get_requirement(struct data_in *din, struct requirement *preq)
+ {
+   int type, range, value;
+   bool survives, negated;
++  bool retval;
+ 
+   dio_get_uint8(din, &type);
+   dio_get_sint32(din, &value);
+   dio_get_uint8(din, &range);
+   dio_get_bool8(din, &survives);
+-  dio_get_bool8(din, &negated);
++  retval = dio_get_bool8(din, &negated);
+ 
+   *preq = req_from_values(type, range, survives, negated, value);
++
++  return retval;
+ }
+ 
+ /**************************************************************************
diff --git a/games/freeciv-share/patches/patch-common_dataio.h b/games/freeciv-share/patches/patch-common_dataio.h
new file mode 100644
index 00000000000..c1fccb315a7
--- /dev/null
+++ b/games/freeciv-share/patches/patch-common_dataio.h
@@ -0,0 +1,50 @@
+$NetBSD: patch-common_dataio.h,v 1.1 2012/08/17 18:42:44 prlw1 Exp $
+
+Fixes part 2 of http://secunia.com/advisories/40476/
+c.f. https://gna.org/bugs/?20003
+
+--- common/dataio.h.orig	2012-03-31 12:35:45.000000000 +0000
++++ common/dataio.h
+@@ -53,27 +53,27 @@ size_t dio_input_remaining(struct data_i
+ 
+ /* gets */
+ 
+-void dio_get_uint8(struct data_in *din, int *dest);
+-void dio_get_uint16(struct data_in *din, int *dest);
+-void dio_get_uint32(struct data_in *din, int *dest);
++bool dio_get_uint8(struct data_in *din, int *dest);
++bool dio_get_uint16(struct data_in *din, int *dest);
++bool dio_get_uint32(struct data_in *din, int *dest);
+ 
+-void dio_get_sint8(struct data_in *din, int *dest);
+-void dio_get_sint16(struct data_in *din, int *dest);
++bool dio_get_sint8(struct data_in *din, int *dest);
++bool dio_get_sint16(struct data_in *din, int *dest);
+ #define dio_get_sint32(d,v) dio_get_uint32(d,v)
+ 
+ 
+-void dio_get_bool8(struct data_in *din, bool *dest);
+-void dio_get_bool32(struct data_in *din, bool *dest);
+-void dio_get_memory(struct data_in *din, void *dest, size_t dest_size);
+-void dio_get_string(struct data_in *din, char *dest, size_t max_dest_size);
+-void dio_get_bit_string(struct data_in *din, char *dest,
++bool dio_get_bool8(struct data_in *din, bool *dest);
++bool dio_get_bool32(struct data_in *din, bool *dest);
++bool dio_get_memory(struct data_in *din, void *dest, size_t dest_size);
++bool dio_get_string(struct data_in *din, char *dest, size_t max_dest_size);
++bool dio_get_bit_string(struct data_in *din, char *dest,
+ 			size_t max_dest_size);
+-void dio_get_tech_list(struct data_in *din, int *dest);
+-void dio_get_worklist(struct data_in *din, struct worklist *pwl);
+-void dio_get_requirement(struct data_in *din, struct requirement *preq);
++bool dio_get_tech_list(struct data_in *din, int *dest);
++bool dio_get_worklist(struct data_in *din, struct worklist *pwl);
++bool dio_get_requirement(struct data_in *din, struct requirement *preq);
+ 
+-void dio_get_uint8_vec8(struct data_in *din, int **values, int stop_value);
+-void dio_get_uint16_vec8(struct data_in *din, int **values, int stop_value);
++bool dio_get_uint8_vec8(struct data_in *din, int **values, int stop_value);
++bool dio_get_uint16_vec8(struct data_in *din, int **values, int stop_value);
+ 
+ /* Should be a function but we need some macro magic. */
+ #define DIO_BV_GET(pdin, bv) \
diff --git a/games/freeciv-share/patches/patch-common_generate__packets.py b/games/freeciv-share/patches/patch-common_generate__packets.py
new file mode 100644
index 00000000000..21e44f40289
--- /dev/null
+++ b/games/freeciv-share/patches/patch-common_generate__packets.py
@@ -0,0 +1,24 @@
+$NetBSD: patch-common_generate__packets.py,v 1.1 2012/08/17 18:42:44 prlw1 Exp $
+
+Fixes part 2 of http://secunia.com/advisories/40476/
+c.f. https://gna.org/bugs/?20003
+
+--- common/generate_packets.py.orig	2012-08-01 17:10:51.000000000 +0000
++++ common/generate_packets.py
+@@ -546,11 +546,13 @@ class Field:
+ for (;;) {
+   int i;
+ 
+-  dio_get_uint8(&din, &i);
+-  if(i == 255) {
++  if (!dio_get_uint8(&din, &i)) {
+     break;
+   }
+-  if(i > %(array_size_u)s) {
++  if (i == 255) {
++    break;
++  }
++  if (i > %(array_size_u)s) {
+     log_error("packets_gen.c: WARNING: ignoring intra array diff");
+   } else {
+     %(c)s