sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-05-31 18:36:28 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update gcab to 0.5.

Browse source 
- add gcab_cabinet_get_signature()
- translation updates
- build warning fixes
This commit is contained in:
Koop Mast 2015-03-09 16:20:30 +00:00
parent f06704ea69
commit b0c884e2e7
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=380863
4 changed files with 20 additions and 52 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
archivers/gcab/Makefile
View file

@ -2,7 +2,7 @@
# $FreeBSD$
PORTNAME= gcab
PORTVERSION= 0.4
PORTVERSION= 0.5
CATEGORIES= archivers gnome
MASTER_SITES= GNOME

4
archivers/gcab/distinfo
View file

@ -1,2 +1,2 @@
SHA256 (gcab-0.4.tar.xz) = f907b16f1246fbde9397363d9c4ad2291f2a8a53dcd4f5979d3912bb856991b8
SIZE (gcab-0.4.tar.xz) = 294684
SHA256 (gcab-0.5.tar.xz) = 9b127e7f5976045f22d4d37ff1a52599e06ed15fda1c9ddf4f499bb9cf123d52
SIZE (gcab-0.5.tar.xz) = 311752

49
archivers/gcab/files/patch-libgcab_gcab-folder.c
View file

@ -1,49 +0,0 @@
From 0ccdf564b6a3e26522a8eb1858f1828844fa3536 Mon Sep 17 00:00:00 2001
From: Stephen Kitt <steve@sk2.org>
Date: Mon, 5 Jan 2015 06:28:00 +0000
Subject: Avoid path traversal
gcab suffers from a directory traversal bug: it doesn't filter leading
slashes from paths in CAB files.
(see https://bugs.debian.org/774580)
The attached patch fixes this, at the cost of ugly paths when faced with
relative traversals. At least all the CAB's contents can be extracted,
without overwriting anything outside the extraction path.
https://bugzilla.gnome.org/show_bug.cgi?id=742331
diff --git a/libgcab/gcab-folder.c b/libgcab/gcab-folder.c
index a140e2c..9510cf3 100644
--- libgcab/gcab-folder.c
+++ libgcab/gcab-folder.c
@@ -362,9 +362,25 @@ gcab_folder_extract (GCabFolder *self,
fname[i] = '/';
GFile *gfile = g_file_resolve_relative_path (path, fname);
- GFile *parent = g_file_get_parent (gfile);
g_free (fname);
+ if (!g_file_has_prefix (gfile, path)) {
+ // "Rebase" the file in the given path, to ensure we never escape it
+ char *rawpath = g_file_get_path (gfile);
+ if (rawpath != NULL) {
+ char *newpath = rawpath;
+ while (*newpath != 0 && *newpath == G_DIR_SEPARATOR) {
+ newpath++;
+ }
+ GFile *newgfile = g_file_resolve_relative_path (path, newpath);
+ g_free (rawpath);
+ g_object_unref (gfile);
+ gfile = newgfile;
+ }
+ }
+
+ GFile *parent = g_file_get_parent (gfile);
+
if (!g_file_make_directory_with_parents (parent, cancellable, &my_error)) {
if (g_error_matches (my_error, G_IO_ERROR, G_IO_ERROR_EXISTS))
g_clear_error (&my_error);
--
cgit v0.10.2

17
archivers/gcab/pkg-plist
View file

@ -23,16 +23,33 @@ share/gtk-doc/html/gcab/gcab.devhelp2
share/gtk-doc/html/gcab/home.png
share/gtk-doc/html/gcab/index.html
share/gtk-doc/html/gcab/index.sgml
share/gtk-doc/html/gcab/left-insensitive.png
share/gtk-doc/html/gcab/left.png
share/gtk-doc/html/gcab/object-tree.html
share/gtk-doc/html/gcab/right-insensitive.png
share/gtk-doc/html/gcab/right.png
share/gtk-doc/html/gcab/style.css
share/gtk-doc/html/gcab/up-insensitive.png
share/gtk-doc/html/gcab/up.png
share/locale/cs/LC_MESSAGES/gcab.mo
share/locale/de/LC_MESSAGES/gcab.mo
share/locale/el/LC_MESSAGES/gcab.mo
share/locale/es/LC_MESSAGES/gcab.mo
share/locale/eu/LC_MESSAGES/gcab.mo
share/locale/fr/LC_MESSAGES/gcab.mo
share/locale/gl/LC_MESSAGES/gcab.mo
share/locale/hu/LC_MESSAGES/gcab.mo
share/locale/id/LC_MESSAGES/gcab.mo
share/locale/lt/LC_MESSAGES/gcab.mo
share/locale/lv/LC_MESSAGES/gcab.mo
share/locale/nb/LC_MESSAGES/gcab.mo
share/locale/pl/LC_MESSAGES/gcab.mo
share/locale/pt_BR/LC_MESSAGES/gcab.mo
share/locale/ru/LC_MESSAGES/gcab.mo
share/locale/sl/LC_MESSAGES/gcab.mo
share/locale/sr/LC_MESSAGES/gcab.mo
share/locale/sr@latin/LC_MESSAGES/gcab.mo
share/locale/tg/LC_MESSAGES/gcab.mo
share/locale/tr/LC_MESSAGES/gcab.mo
share/locale/zh_CN/LC_MESSAGES/gcab.mo
share/vala/vapi/libgcab-1.0.vapi