1 files changed, 108 insertions, 0 deletions
diff --git a/chat/centericq/patches/patch-az b/chat/centericq/patches/patch-az
new file mode 100644
index 00000000000..c17a7fa1491
--- /dev/null
+++ b/chat/centericq/patches/patch-az
@@ -0,0 +1,108 @@
+$NetBSD: patch-az,v 1.1 2007/07/19 00:43:43 lkundrak Exp $
+
+Part of a fix for CVE-2007-3713.
+
+--- src/hooks/yahoohook.cc.orig	2007-07-19 02:24:38.000000000 +0200
++++ src/hooks/yahoohook.cc
+@@ -47,6 +47,8 @@
+ #define PERIOD_REFRESH          60
+ #define PERIOD_CLOSE            6
+ 
++#define NOTIFBUF 512
++
+ int yahoohook::yfd::connection_tags = 0;
+ 
+ char pager_host[255], pager_port[255], filetransfer_host[255],
+@@ -844,7 +846,7 @@ void yahoohook::got_conf_invite(int id, 
+     icqconf::imaccount acc = conf.getourid(yahoo);
+     string confname = (string) "#" + room, inviter, text;
+     vector<string>::iterator ic;
+-    char buf[1024];
++    char buf[NOTIFBUF];
+     int i;
+ 
+     imcontact cont(confname, yahoo);
+@@ -856,10 +858,11 @@ void yahoohook::got_conf_invite(int id, 
+ 	inviter.erase(i);
+     }
+ 
+-    sprintf(buf, _("The user %s has invited you to the %s conference, the topic there is: %s"),
++    snprintf(buf, NOTIFBUF, _("The user %s has invited you to the %s conference, the topic there is: %s"),
+ 	yhook.rusconv("wk", inviter).c_str(),
+ 	yhook.rusconv("wk", room).c_str(),
+ 	yhook.rusconv("wk", msg).c_str());
++    buf[NOTIFBUF-1] = '\0';
+ 
+     text = (string) buf + "\n\n" + _("Current conference members are: ");
+     yhook.confmembers[room].push_back(inviter);
+@@ -888,20 +891,22 @@ void yahoohook::got_conf_invite(int id, 
+ 
+ void yahoohook::conf_userdecline(int id, char *who, char *room, char *msg) {
+     icqcontact *c = clist.get(imcontact((string) "#" + room, yahoo));
+-    char buf[512];
++    char buf[NOTIFBUF];
+ 
+     if(c) {
+-	sprintf(buf, _("The user %s has declined your invitation to join the conference"), who);
++	snprintf(buf, NOTIFBUF, _("The user %s has declined your invitation to join the conference"), who);
++	buf[NOTIFBUF-1] = '\0';
+ 	em.store(imnotification(c, buf));
+     }
+ }
+ 
+ void yahoohook::conf_userjoin(int id, char *who, char *room) {
+     icqcontact *c = clist.get(imcontact((string) "#" + room, yahoo));
+-    char buf[512];
++    char buf[NOTIFBUF];
+ 
+     if(c) {
+-	sprintf(buf, _("The user %s has joined the conference"), who);
++	snprintf(buf, NOTIFBUF, _("The user %s has joined the conference"), who);
++	buf[NOTIFBUF-1] = '\0';
+ 
+ 	if(find(yhook.confmembers[room].begin(), yhook.confmembers[room].end(), who) == yhook.confmembers[room].end())
+ 	    yhook.confmembers[room].push_back(who);
+@@ -912,11 +917,12 @@ void yahoohook::conf_userjoin(int id, ch
+ 
+ void yahoohook::conf_userleave(int id, char *who, char *room) {
+     icqcontact *c = clist.get(imcontact((string) "#" + room, yahoo));
+-    char buf[512];
++    char buf[NOTIFBUF];
+     vector<string>::iterator im;
+ 
+     if(c) {
+-	sprintf(buf, _("The user %s has left the conference"), who);
++	snprintf(buf, NOTIFBUF, _("The user %s has left the conference"), who);
++	buf[NOTIFBUF-1] = '\0';
+ 	em.store(imnotification(c, buf));
+ 
+ 	im = find(yhook.confmembers[room].begin(), yhook.confmembers[room].end(), who);
+@@ -981,10 +987,11 @@ void yahoohook::game_notify(int id, char
+ }
+ 
+ void yahoohook::mail_notify(int id, char *from, char *subj, int cnt) {
+-    char buf[1024];
++    char buf[NOTIFBUF];
+ 
+     if(from && subj) {
+-	sprintf(buf, _("+ [yahoo] e-mail from %s, %s"), from, subj);
++	snprintf(buf, NOTIFBUF, _("+ [yahoo] e-mail from %s, %s"), from, subj);
++	buf[NOTIFBUF-1] = '\0';
+ 	face.log(buf);
+ 	clist.get(contactroot)->playsound(imevent::email);
+     }
+@@ -1138,11 +1145,12 @@ void yahoohook::webcam_data_request(int 
+ 
+ int yahoohook::ylog(char *fmt, ...) {
+     if(conf.getdebug()) {
+-	char buf[512];
++	char buf[NOTIFBUF];
+ 	va_list ap;
+ 
+ 	va_start(ap, fmt);
+-	vsprintf(buf, fmt, ap);
++	vsnprintf(buf, NOTIFBUF, fmt, ap);
++	buf[NOTIFBUF-1] = '\0';
+ 	va_end(ap);
+ 
+ 	face.log(buf);