Pull up security fixes to the pkgsrc-2003Q4 branch, requested by Sorenpkgsrc-2003Q4

Jacobsen.

	Module Name:    pkgsrc
	Committed By:   snj
	Date:           Sat Feb 28 18:36:38 UTC 2004

	Modified Files:
		pkgsrc/games/xboing: Makefile distinfo
		pkgsrc/games/xboing/patches: patch-ad
	Added Files:
		pkgsrc/games/xboing/patches: patch-ae patch-af patch-ag patch-ah
		    patch-ai

	Log Message:
	strcpy and sprintf are evil, don't use them.  Inspired by similar changes
	in Debian.  This fixes several locally exploitable vulnerabilities.

5 files changed, 119 insertions, 0 deletions

diff --git a/games/xboing/patches/patch-ae b/games/xboing/patches/patch-ae
new file mode 100644
index 00000000000..587ecf38da6
--- /dev/null
+++ b/games/xboing/patches/patch-ae
@@ -0,0 +1,13 @@
+$NetBSD: patch-ae,v 1.1.2.2 2004/03/08 17:44:16 agc Exp $
+
+--- demo.c.orig	2004-02-28 10:06:20.000000000 -0800
++++ demo.c	2004-02-28 10:06:41.000000000 -0800
+@@ -154,7 +154,7 @@ static void DoBlocks(display, window)
+ 
+     /* Construct the demo level filename */
+     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
+-        sprintf(levelPath, "%s/demo.data", str);
++        snprintf(levelPath, sizeof(levelPath), "%s/demo.data", str);
+     else
+         sprintf(levelPath, "%s/demo.data", LEVEL_INSTALL_DIR);
+ 
diff --git a/games/xboing/patches/patch-af b/games/xboing/patches/patch-af
new file mode 100644
index 00000000000..d69bf8a040d
--- /dev/null
+++ b/games/xboing/patches/patch-af
@@ -0,0 +1,31 @@
+$NetBSD: patch-af,v 1.1.2.2 2004/03/08 17:44:16 agc Exp $
+
+--- editor.c.orig	2004-02-28 10:06:52.000000000 -0800
++++ editor.c	2004-02-28 10:10:24.000000000 -0800
+@@ -213,7 +213,7 @@ static void DoLoadLevel(display, window)
+ 
+     /* Construct the Edit level filename */
+     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
+-        sprintf(levelPath, "%s/editor.data", str);
++        snprintf(levelPath, sizeof(levelPath), "%s/editor.data", str);
+     else
+         sprintf(levelPath, "%s/editor.data", LEVEL_INSTALL_DIR);
+ 
+@@ -959,7 +959,7 @@ static void LoadALevel(display)
+     {
+ 	    /* Construct the Edit level filename */
+    	 	if ((str2 = getenv("XBOING_LEVELS_DIR")) != NULL)
+-        	sprintf(levelPath, "%s/level%02ld.data", str2, (u_long) num);
++        	snprintf(levelPath, sizeof(levelPath), "%s/level%02ld.data", str2, (u_long) num);
+     	else
+         	sprintf(levelPath, "%s/level%02ld.data", 
+ 				LEVEL_INSTALL_DIR, (u_long) num);
+@@ -1019,7 +1019,7 @@ static void SaveALevel(display)
+     {
+ 	    /* Construct the Edit level filename */
+    	 	if ((str2 = getenv("XBOING_LEVELS_DIR")) != NULL)
+-        	sprintf(levelPath, "%s/level%02ld.data", str2, (u_long) num);
++        	snprintf(levelPath, sizeof(levelPath), "%s/level%02ld.data", str2, (u_long) num);
+     	else
+         	sprintf(levelPath, "%s/level%02ld.data", 
+ 				LEVEL_INSTALL_DIR, (u_long) num);
diff --git a/games/xboing/patches/patch-ag b/games/xboing/patches/patch-ag
new file mode 100644
index 00000000000..af2d9468db0
--- /dev/null
+++ b/games/xboing/patches/patch-ag
@@ -0,0 +1,49 @@
+$NetBSD: patch-ag,v 1.1.2.2 2004/03/08 17:44:16 agc Exp $
+
+--- file.c.orig	2004-02-28 10:10:55.000000000 -0800
++++ file.c	2004-02-28 10:12:50.000000000 -0800
+@@ -139,7 +139,7 @@ void SetupStage(display, window)
+ 
+     /* Construct the level filename */
+     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
+-        sprintf(levelPath, "%s/level%02ld.data", str, newLevel);
++        snprintf(levelPath, sizeof(levelPath), "%s/level%02ld.data", str, newLevel);
+     else
+         sprintf(levelPath, "%s/level%02ld.data", LEVEL_INSTALL_DIR, newLevel);
+ 
+@@ -177,7 +177,7 @@ int LoadSavedGame(display, window)
+     static int bgrnd = 1;
+ 
+ 	/* Save the file in home directory - construct path */
+-	sprintf(levelPath, "%s/.xboing-saveinfo", GetHomeDir());
++	snprintf(levelPath, sizeof(levelPath), "%s/.xboing-saveinfo", GetHomeDir());
+ 
+     /* Open the save file info for reading */
+     if ((saveFile = fopen(levelPath, "r+")) == NULL)
+@@ -239,7 +239,7 @@ int LoadSavedGame(display, window)
+     DisplayLevelInfo(display, levelWindow, level);
+ 
+ 	/* Load the saved file in home directory - construct path */
+-	sprintf(levelPath, "%s/.xboing-savelevel", GetHomeDir());
++	snprintf(levelPath, sizeof(levelPath), "%s/.xboing-savelevel", GetHomeDir());
+ 
+ 	/* Read in the saved level data */
+     if (ReadNextLevel(display, window, levelPath, True) == False)
+@@ -283,7 +283,7 @@ int SaveCurrentGame(display, window)
+ 	saveGame.numBullets	= GetNumberBullets();
+ 
+ 	/* Save the file in home directory - construct path */
+-	sprintf(levelPath, "%s/.xboing-saveinfo", GetHomeDir());
++	snprintf(levelPath, sizeof(levelPath), "%s/.xboing-saveinfo", GetHomeDir());
+ 
+     /* Open the save file info for writing */
+     if ((saveFile = fopen(levelPath, "w+")) == NULL)
+@@ -309,7 +309,7 @@ int SaveCurrentGame(display, window)
+     	WarningMessage("Cannot close save game info file.");
+ 
+ 	/* Save the file in home directory - construct path */
+-	sprintf(levelPath, "%s/.xboing-savelevel", GetHomeDir());
++	snprintf(levelPath, sizeof(levelPath), "%s/.xboing-savelevel", GetHomeDir());
+ 
+ 	if (SaveLevelDataFile(display, levelPath) == True)
+ 	{
diff --git a/games/xboing/patches/patch-ah b/games/xboing/patches/patch-ah
new file mode 100644
index 00000000000..261d5b9057f
--- /dev/null
+++ b/games/xboing/patches/patch-ah
@@ -0,0 +1,13 @@
+$NetBSD: patch-ah,v 1.1.2.2 2004/03/08 17:44:16 agc Exp $
+
+--- init.c.orig	2004-02-28 10:13:29.000000000 -0800
++++ init.c	2004-02-28 10:14:17.000000000 -0800
+@@ -438,7 +438,7 @@ static void HandleDisplayErrors(displayN
+ 		WarningMessage("Your X Window system display variable is not set.");
+ 	else
+ 	{
+-		sprintf(string, "Cannot connect to display called <%s>.", displayName);
++		snprintf(string, sizeof(string), "Cannot connect to display called <%s>.", displayName);
+ 		WarningMessage(string);
+ 	}
+ }
diff --git a/games/xboing/patches/patch-ai b/games/xboing/patches/patch-ai
new file mode 100644
index 00000000000..c02c08b7565
--- /dev/null
+++ b/games/xboing/patches/patch-ai
@@ -0,0 +1,13 @@
+$NetBSD: patch-ai,v 1.1.2.2 2004/03/08 17:44:17 agc Exp $
+
+--- preview.c.orig	2004-02-28 10:19:15.000000000 -0800
++++ preview.c	2004-02-28 10:19:31.000000000 -0800
+@@ -139,7 +139,7 @@ static void DoLoadLevel(display, window)
+ 
+     /* Construct the Preview level filename */
+     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
+-        sprintf(levelPath, "%s/level%02d.data", str, lnum);
++        snprintf(levelPath, sizeof(levelPath), "%s/level%02d.data", str, lnum);
+     else
+         sprintf(levelPath, "%s/level%02d.data", LEVEL_INSTALL_DIR, lnum);
+