From 36115e102859badb08cb5b2398de6b0ba45421d3 Mon Sep 17 00:00:00 2001
From: Jan Vcelak <jvcelak@redhat.com>
Date: Tue, 4 Nov 2014 14:36:47 +0100
Subject: [PATCH] various security fixes
CVE-2009-5044 (#709413)
CVE-2009-5080 (#720058)
CVE-2009-5081 (#720057)
Based on: http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff?rev=1.2;content-type=text%2Fplain
Resolves: #709415, #720060
Signed-off-by: Jan Vcelak <jvcelak@redhat.com>
---
contrib/eqn2graph/eqn2graph.sh | 2 ++
contrib/gdiffmk/tests/runtests.in | 5 +++--
contrib/grap2graph/grap2graph.sh | 2 ++
contrib/groffer/main_subs.pl | 10 +++++-----
contrib/groffer/roff2.pl | 2 +-
contrib/pdfmark/pdfroff.man | 5 +++--
contrib/pic2graph/pic2graph.sh | 2 ++
doc/fixinfo.sh | 5 +++--
doc/groff.info-2 | 6 +++---
doc/groff.texinfo | 6 +++---
gendef.sh | 10 +++-------
11 files changed, 30 insertions(+), 25 deletions(-)
diff --git a/contrib/eqn2graph/eqn2graph.sh b/contrib/eqn2graph/eqn2graph.sh
index ee7cc5f..13edf78 100644
--- a/contrib/eqn2graph/eqn2graph.sh
+++ b/contrib/eqn2graph/eqn2graph.sh
@@ -67,6 +67,8 @@ for d in "$GROFF_TMPDIR" "$TMPDIR" "$TMP" "$TEMP" /tmp; do
tmp=$d/eqn2graph$$-$RANDOM
(umask 077 && mkdir $tmp) 2> /dev/null && break
+
+ tmp=
done;
if test -z "$tmp"; then
echo "$0: cannot create temporary directory" >&2
diff --git a/contrib/gdiffmk/tests/runtests.in b/contrib/gdiffmk/tests/runtests.in
index 714ce48..40a35c4 100644
--- a/contrib/gdiffmk/tests/runtests.in
+++ b/contrib/gdiffmk/tests/runtests.in
@@ -56,8 +56,9 @@ function TestResult {
fi
}
-tmpfile=/tmp/$$
-trap 'rm -f ${tmpfile}' 0 1 2 3 15
+tmpfile="`mktemp -t gdiffmk-runtests.XXXXXXXXXX`" || exit
+trap 'rm -f -- "$tmpfile"' EXIT
+trap 'trap - EXIT; rm -f -- "$tmpfile"; exit 1' HUP INT QUIT TERM
# Run tests.
diff --git a/contrib/grap2graph/grap2graph.sh b/contrib/grap2graph/grap2graph.sh
index 58544e1..aeab832 100644
--- a/contrib/grap2graph/grap2graph.sh
+++ b/contrib/grap2graph/grap2graph.sh
@@ -63,6 +63,8 @@ for d in "$GROFF_TMPDIR" "$TMPDIR" "$TMP" "$TEMP" /tmp; do
tmp=$d/grap2graph$$-$RANDOM
(umask 077 && mkdir $tmp) 2> /dev/null && break
+
+ tmp=
done;
if test -z "$tmp"; then
echo "$0: cannot create temporary directory" >&2
diff --git a/contrib/groffer/main_subs.pl b/contrib/groffer/main_subs.pl
index 90627cc..76896cd 100644
--- a/contrib/groffer/main_subs.pl
+++ b/contrib/groffer/main_subs.pl
@@ -1239,7 +1239,7 @@ sub main_temp {
our $fh_stdin;
our $tmp_cat;
our $tmp_stdin;
- my $template = 'groffer_' . "$$" . '_XXXX';
+ my $template = 'groffer_' . "$$" . '_XXXXXXXXXX';
foreach ($ENV{'GROFF_TMPDIR'}, $ENV{'TMPDIR'}, $ENV{'TMP'}, $ENV{'TEMP'},
$ENV{'TEMPDIR'}, File::Spec->catfile($ENV{'HOME'}, 'tmp')) {
if ($_ && -d $_ && -w $_) {
@@ -1271,12 +1271,12 @@ sub main_temp {
# further argument: SUFFIX => '.sh'
if ($Debug{'KEEP'}) {
- ($fh_cat, $tmp_cat) = tempfile(',cat_XXXX', DIR => $tmpdir);
- ($fh_stdin, $tmp_stdin) = tempfile(',stdin_XXXX', DIR => $tmpdir);
+ ($fh_cat, $tmp_cat) = tempfile(',cat_XXXXXXXXXX', DIR => $tmpdir);
+ ($fh_stdin, $tmp_stdin) = tempfile(',stdin_XXXXXXXXXX', DIR => $tmpdir);
} else {
- ($fh_cat, $tmp_cat) = tempfile(',cat_XXXX', UNLINK => 1,
+ ($fh_cat, $tmp_cat) = tempfile(',cat_XXXXXXXXXX', UNLINK => 1,
DIR => $tmpdir);
- ($fh_stdin, $tmp_stdin) = tempfile(',stdin_XXXX', UNLINK => 1,
+ ($fh_stdin, $tmp_stdin) = tempfile(',stdin_XXXXXXXXXX', UNLINK => 1,
DIR => $tmpdir);
}
} # main_temp()
diff --git a/contrib/groffer/roff2.pl b/contrib/groffer/roff2.pl
index d8dad3f..f0ca9f2 100755
--- a/contrib/groffer/roff2.pl
+++ b/contrib/groffer/roff2.pl
@@ -123,7 +123,7 @@ if ($Has_Groffer) {
last;
}
}
- my $template = $Name . '_XXXX';
+ my $template = $Name . '_XXXXXXXXXX';
my ($fh, $stdin);
if ($tempdir) {
($fh, $stdin) = tempfile($template, UNLINK => 1, DIR => $tempdir) ||
diff --git a/contrib/pdfmark/pdfroff.man b/contrib/pdfmark/pdfroff.man
index ec412bb..faf2898 100644
--- a/contrib/pdfmark/pdfroff.man
+++ b/contrib/pdfmark/pdfroff.man
@@ -555,7 +555,7 @@ defaults to
.B GROFF_TMPDIR
Identifies the directory in which
.B pdfroff
-should create temporary files.
+should create a subdirectory for its temporary files.
.
If
.B \%GROFF_TMPDIR
@@ -568,7 +568,8 @@ and
.B TEMP
are considered in turn, as possible temporary file repositories.
If none of these are set, then temporary files are created
-in the current directory.
+in a subdirectory of
+.BR /tmp .
.
.TP
.B GROFF_GHOSTSCRIPT_INTERPRETER
diff --git a/contrib/pic2graph/pic2graph.sh b/contrib/pic2graph/pic2graph.sh
index 72c5477..6b3360d 100644
--- a/contrib/pic2graph/pic2graph.sh
+++ b/contrib/pic2graph/pic2graph.sh
@@ -78,6 +78,8 @@ for d in "$GROFF_TMPDIR" "$TMPDIR" "$TMP" "$TEMP" /tmp; do
tmp=$d/pic2graph$$-$RANDOM
(umask 077 && mkdir $tmp) 2> /dev/null \
&& break
+
+ tmp=
done;
if test -z "$tmp"; then
echo "$0: cannot create temporary directory" >&2
diff --git a/doc/fixinfo.sh b/doc/fixinfo.sh
index 2c853f8..6954e6a 100644
--- a/doc/fixinfo.sh
+++ b/doc/fixinfo.sh
@@ -22,8 +22,9 @@
# groff.texinfo macro code. Hopefully, a new texinfo version makes it
# unnecessary.
-t=${TMPDIR-.}/gro$$.tmp
-
+t="`mktemp -t groff-fixinfo.XXXXXXXXXX`" || exit
+trap 'rm -f -- "$t"' EXIT
+trap 'trap - EXIT; rm -f -- "$t"; exit 1' HUP INT QUIT TERM
cat $1 | sed '
1 {
N
diff --git a/doc/groff.info-2 b/doc/groff.info-2
index 7eaae86..e7dab72 100644
--- a/doc/groff.info-2
+++ b/doc/groff.info-2
@@ -1697,9 +1697,9 @@ not there, 'groff' would not know when to stop.
time into a document:
.sy perl -e 'printf ".nr H %d\\n.nr M %d\\n.nr S %d\\n",\
- (localtime(time))[2,1,0]' > /tmp/x\n[$$]
- .so /tmp/x\n[$$]
- .sy rm /tmp/x\n[$$]
+ (localtime(time))[2,1,0]' > timefile\n[$$]
+ .so timefile\n[$$]
+ .sy rm timefile\n[$$]
\nH:\nM:\nS
Note that this works by having the 'perl' script (run by 'sy')
diff --git a/doc/groff.texinfo b/doc/groff.texinfo
index 066b527..83684da 100644
--- a/doc/groff.texinfo
+++ b/doc/groff.texinfo
@@ -13736,9 +13736,9 @@ into a document:
@pindex perl
@Example
.sy perl -e 'printf ".nr H %d\\n.nr M %d\\n.nr S %d\\n",\
- (localtime(time))[2,1,0]' > /tmp/x\n[$$]
-.so /tmp/x\n[$$]
-.sy rm /tmp/x\n[$$]
+ (localtime(time))[2,1,0]' > timefile\n[$$]
++.so timefile\n[$$]
++.sy rm timefile\n[$$]
\nH:\nM:\nS
@endExample
diff --git a/gendef.sh b/gendef.sh
index 41a511b..050bcbe 100644
--- a/gendef.sh
+++ b/gendef.sh
@@ -33,11 +33,9 @@ do
#define $def"
done
-# Use $TMPDIR if defined. Default to cwd, for non-Unix systems
-# which don't have /tmp on each drive (we are going to remove
-# the file before we exit anyway). Put the PID in the basename,
-# since the extension can only hold 3 characters on MS-DOS.
-t=${TMPDIR-.}/gro$$.tmp
+t="`mktemp -t groff-gendef.XXXXXXXXXX`" || exit
+trap 'rm -f -- "$t"' EXIT
+trap 'trap - EXIT; rm -f -- "$t"; exit 1' HUP INT QUIT TERM
sed -e 's/=/ /' >$t <<EOF
$defs
@@ -45,8 +43,6 @@ EOF
test -r $file && cmp -s $t $file || cp $t $file
-rm -f $t
-
exit 0
# eof
--
1.9.3