MFH: r380498

Add a patch to fix buffer overrun (CVE-2015-2063)
Bump port revision
Take the port maintenership

PR:		198314
Submitted by:	rodrigo
Obtained from:	debian
Security:	CVE-2015-2063
Approved by:	ports-secteam

2 files changed, 90 insertions, 2 deletions

diff --git a/archivers/unace/Makefile b/archivers/unace/Makefile
index 3aad8cf66824..b7f30c88b46f 100644
--- a/archivers/unace/Makefile
+++ b/archivers/unace/Makefile
@@ -3,12 +3,12 @@
 
 PORTNAME=	unace
 PORTVERSION=	1.2b
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	archivers
 MASTER_SITES=	${MASTER_SITE_SUNSITE}
 MASTER_SITE_SUBDIR=	utils/compress
 
-MAINTAINER=	ports@FreeBSD.org
+MAINTAINER=	rodrigo@FreeBSD.org
 COMMENT=	Extract, view & test ACE archives
 
 MAKE_JOBS_UNSAFE=	yes
diff --git a/archivers/unace/files/patch-CVE-2015-2063 b/archivers/unace/files/patch-CVE-2015-2063
new file mode 100644
index 000000000000..72c0fb38e707
--- /dev/null
+++ b/archivers/unace/files/patch-CVE-2015-2063
@@ -0,0 +1,88 @@
+Description: Fixes a buffer overflow when reading bogus file headers
+ The header parser was not checking if it had read enough data when trying
+ to parse the header from memory, causing it to accept files with headers
+ smaller than expected.
+ .
+ Fixes CVE-2015-2063.
+Author: Guillem Jover <guillem@debian.org>
+Origin: vendor
+Bug-Debian: https://bugs.debian.org/775003
+Forwarded: no
+Last-Update: 2015-02-24
+
+---
+ unace.c |   25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- unace.c
++++ unace.c
+@@ -113,6 +113,7 @@ INT  read_header(INT print_err)
+ {
+    USHORT rd,
+         head_size,
++        need_size,
+         crc_ok;
+    LONG crc;
+    UCHAR *tp=readbuf;
+@@ -128,6 +129,9 @@ INT  read_header(INT print_err)
+ #endif
+                                         // read size_headrdb bytes into 
+    head_size = head.HEAD_SIZE;          // header structure 
++   need_size = 3;
++   if (need_size > head.HEAD_SIZE)
++      return 0;
+    rd = (head_size > size_headrdb) ? size_headrdb : head_size;
+    if (read(archan, readbuf, rd) < rd)
+       return 0;
+@@ -147,7 +151,12 @@ INT  read_header(INT print_err)
+    head.HEAD_FLAGS=BUFP2WORD(tp);
+ 
+    if (head.HEAD_FLAGS & ACE_ADDSIZE)
++   {
++      need_size += 4;
++      if (need_size > head.HEAD_SIZE)
++         return 0;
+       skipsize = head.ADDSIZE = BUF2LONG(tp);   // get ADDSIZE
++   }
+    else
+       skipsize = 0;
+ 
+@@ -158,6 +167,9 @@ INT  read_header(INT print_err)
+    switch (head.HEAD_TYPE)              // specific buffer to head conversion
+    {
+       case MAIN_BLK:
++         need_size += 24;
++         if (need_size > head.HEAD_SIZE)
++            return 0;
+          memcpy(mhead.ACESIGN, tp, acesign_len); tp+=acesign_len;
+          mhead.VER_MOD=*tp++;
+          mhead.VER_CR =*tp++;
+@@ -168,9 +180,15 @@ INT  read_header(INT print_err)
+          mhead.RES2   =BUFP2WORD(tp);
+          mhead.RES    =BUFP2LONG(tp);
+          mhead.AV_SIZE=*tp++;
+-         memcpy(mhead.AV, tp, rd-(USHORT)(tp-readbuf));
++         if (mhead.AV_SIZE > sizeof(mhead.AV) ||
++             mhead.AV_SIZE + need_size > head.HEAD_SIZE)
++            return 0;
++         memcpy(mhead.AV, tp, mhead.AV_SIZE);
+          break;
+       case FILE_BLK:
++         need_size += 28;
++         if (need_size > head.HEAD_SIZE)
++            return 0;
+          fhead.PSIZE     =BUFP2LONG(tp);
+          fhead.SIZE      =BUFP2LONG(tp);
+          fhead.FTIME     =BUFP2LONG(tp);
+@@ -181,7 +199,10 @@ INT  read_header(INT print_err)
+          fhead.TECH.PARM =BUFP2WORD(tp);
+          fhead.RESERVED  =BUFP2WORD(tp);
+          fhead.FNAME_SIZE=BUFP2WORD(tp);
+-         memcpy(fhead.FNAME, tp, rd-(USHORT)(tp-readbuf));
++         if (fhead.FNAME_SIZE > sizeof(fhead.FNAME) ||
++             fhead.FNAME_SIZE + need_size > head.HEAD_SIZE)
++            return 0;
++         memcpy(fhead.FNAME, tp, fhead.FNAME_SIZE);
+          break;
+ //    default: (REC_BLK and future things): 
+ //              do nothing 'cause isn't needed for extraction