From 0492f8ddbbb29edc3555440cb2b30647058e2f38 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Nov 28 2017 21:09:51 +0000
Subject: import procmail-3.22-36.el7_4.1


---

diff --git a/SOURCES/procmail-3.22-CVE-2017-16844.patch b/SOURCES/procmail-3.22-CVE-2017-16844.patch
new file mode 100644
index 0000000..5e610d7
--- /dev/null
+++ b/SOURCES/procmail-3.22-CVE-2017-16844.patch
@@ -0,0 +1,13 @@
+diff --git a/src/formisc.c b/src/formisc.c
+index 5c2869d..54fd013 100644
+--- a/src/formisc.c
++++ b/src/formisc.c
+@@ -103,7 +103,7 @@ void loadsaved(sp)const struct saved*const sp;	     /* load some saved text */
+ }
+ 							    /* append to buf */
+ void loadbuf(text,len)const char*const text;const size_t len;
+-{ if(buffilled+len>buflen)			  /* buf can't hold the text */
++{ while(buffilled+len>buflen)			  /* buf can't hold the text */
+      buf=realloc(buf,buflen+=Bsize);
+   tmemmove(buf+buffilled,text,len);buffilled+=len;
+ }
diff --git a/SPECS/procmail.spec b/SPECS/procmail.spec
index 6cd31b5..b29fedd 100644
--- a/SPECS/procmail.spec
+++ b/SPECS/procmail.spec
@@ -8,7 +8,7 @@
 Summary: Mail processing program
 Name: procmail
 Version: 3.22
-Release: 36%{?dist}
+Release: 36%{?dist}.1
 License: GPLv2+ or Artistic
 Group: Applications/Internet
 # Source: ftp://ftp.procmail.org/pub/procmail/procmail-%{version}.tar.gz
@@ -26,6 +26,7 @@ Patch5: procmail-3.22-ipv6.patch
 Patch6: procmail-3.22-getline.patch
 Patch7: procmail-3.22-CVE-2014-3618.patch
 Patch8: procmail-3.22-out-of-bounds-rw-fixes.patch
+Patch9: procmail-3.22-CVE-2017-16844.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 %description
@@ -46,6 +47,7 @@ forward certain incoming mail automatically to someone.
 %patch6 -p1 -b .getline
 %patch7 -p1 -b .CVE-2014-3618
 %patch8 -p1 -b .out-of-bounds-rw-fixes
+%patch9 -p1 -b .CVE-2017-16844
 
 find examples -type f | xargs chmod 644
 
@@ -81,6 +83,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_mandir}/man[15]/*
 
 %changelog
+* Tue Nov 21 2017 Jaroslav Škarvada <jskarvad@redhat.com> - 3.22-36.1
+- Fixed possible buffer overflow in loadbuf function
+  Resolves: CVE-2017-16844
+
 * Wed Mar 22 2017 Jaroslav Škarvada <jskarvad@redhat.com> - 3.22-36
 - Fixed several out of bounds RWs
   Resolves: rhbz#1138526