rpms/nagios-plugins/devel nagiosplugins-checksnmp-crash.patch, NONE, 1.1 nagios-plugins.spec, 1.29, 1.30

[Michael Patrick McGrath (mmcgrath)]

Author: mmcgrath

Update of /cvs/extras/rpms/nagios-plugins/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv2667

Modified Files:
	nagios-plugins.spec 
Added Files:
	nagiosplugins-checksnmp-crash.patch 
Log Message:
Fix for bug 348731

nagiosplugins-checksnmp-crash.patch:

--- NEW FILE nagiosplugins-checksnmp-crash.patch ---
--- plugins/check_snmp.c.old	2007-05-29 07:22:32.000000000 +0200
+++ plugins/check_snmp.c	2007-10-17 22:08:49.000000000 +0200
@@ -219,12 +219,16 @@ main (int argc, char **argv)
 
 	ptr = output;
 
-	strcat(perfstr, "| ");
+	strncat(perfstr, "| ", sizeof(perfstr)-strlen(perfstr)-1);
 	while (ptr) {
 		char *foo;
+		unsigned int copylen;
 
 		foo = strstr (ptr, delimiter);
-		strncat(perfstr, ptr, foo-ptr);
+		copylen = foo-ptr;
+		if (copylen > sizeof(perfstr)-strlen(perfstr)-1)
+			copylen = sizeof(perfstr)-strlen(perfstr)-1;
+		strncat(perfstr, ptr, copylen);
 		ptr = foo; 
 
 		if (ptr == NULL)
@@ -357,11 +361,11 @@ main (int argc, char **argv)
 
 		i++;
 
-		strcat(perfstr, "=");
-		strcat(perfstr, show);
+		strncat(perfstr, "=", sizeof(perfstr)-strlen(perfstr)-1);
+		strncat(perfstr, show, sizeof(perfstr)-strlen(perfstr)-1);
 		if (type)
-			strcat(perfstr, type);
-		strcat(perfstr, " ");
+			strncat(perfstr, type, sizeof(perfstr)-strlen(perfstr)-1);
+		strncat(perfstr, " ", sizeof(perfstr)-strlen(perfstr)-1);
 
 	}	/* end while (ptr) */
 


Index: nagios-plugins.spec
===================================================================
RCS file: /cvs/extras/rpms/nagios-plugins/devel/nagios-plugins.spec,v
retrieving revision 1.29
retrieving revision 1.30
diff -u -r1.29 -r1.30
--- nagios-plugins.spec	23 Aug 2007 02:16:57 -0000	1.29
+++ nagios-plugins.spec	26 Oct 2007 13:27:19 -0000	1.30
@@ -1,6 +1,6 @@
 Name: nagios-plugins
 Version: 1.4.8
-Release: 7%{?dist}
+Release: 8%{?dist}
 Summary: Host/service/network monitoring program plugins for Nagios
 
 Group: Applications/System
@@ -13,6 +13,7 @@
 Patch2: nagios-plugins-1.4.3-ntpd.patch
 Patch3: nagios-plugins-1.4.4-check_ide_smart.patch
 Patch4: check_smtp.recvline.diff.2
+Patch5: nagiosplugins-checksnmp-crash.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 BuildRequires: openldap-devel
@@ -507,6 +508,7 @@
 %patch2 -p0
 %patch3 -p1
 %patch4 -p0
+%patch5 -p0
 
 %build
 %configure \
@@ -787,6 +789,9 @@
 %{_libdir}/nagios/plugins/utils.sh
 
 %changelog
+* Fri Oct 26 2007 Mike McGrath <mmcgrath at redhat.com> 1.4.8-8
+- Fix for Bug 348731 and CVE-2007-5623
+
 * Wed Aug 22 2007 Mike McGrath <mmcgrath at redhat.com> 1.4.8-7
 - Rebuild for BuildID
 - License change