From: Michael Vogt Date: Tue, 28 Aug 2012 09:57:51 +0000 (+0200) Subject: merged loginsize fix from lp:~mvo/apt/mvo X-Git-Tag: 0.9.13.exp1ubuntu1~55 X-Git-Url: https://git.saurik.com/apt.git/commitdiff_plain/4e5e7371044be194c545dc31c8a1d03ed1b659b4?hp=-c merged loginsize fix from lp:~mvo/apt/mvo --- 4e5e7371044be194c545dc31c8a1d03ed1b659b4 diff --combined apt-pkg/contrib/netrc.cc index 56e59d84b,06059dfc1..2321ef063 --- a/apt-pkg/contrib/netrc.cc +++ b/apt-pkg/contrib/netrc.cc @@@ -15,6 -15,7 +15,7 @@@ #include #include + #include #include #include @@@ -39,8 -40,8 +40,8 @@@ enum }; /* make sure we have room for at least this size: */ - #define LOGINSIZE 64 - #define PASSWORDSIZE 64 + #define LOGINSIZE 256 + #define PASSWORDSIZE 256 #define NETRC DOT_CHAR "netrc" /* returns -1 on failure, 0 if the host is found, 1 is the host isn't found */ @@@ -68,7 -69,8 +69,7 @@@ int parsenetrc (char *host, char *login if (!home) return -1; - asprintf (&netrcfile, "%s%s%s", home, DIR_CHAR, NETRC); - if(!netrcfile) + if (asprintf (&netrcfile, "%s%s%s", home, DIR_CHAR, NETRC) == -1 || netrcfile == NULL) return -1; else netrc_alloc = true; @@@ -122,11 -124,21 +123,21 @@@ if (specific_login) state_our_login = !strcasecmp (login, tok); else + { + if (strlen(tok) > LOGINSIZE) + _error->Error("login token too long %i (max: %i)", + strlen(tok), LOGINSIZE); strncpy (login, tok, LOGINSIZE - 1); + } state_login = 0; } else if (state_password) { - if (state_our_login || !specific_login) + if (state_our_login || !specific_login) + { + if (strlen(tok) > PASSWORDSIZE) + _error->Error("password token too long %i (max %i)", + strlen(tok), PASSWORDSIZE); strncpy (password, tok, PASSWORDSIZE - 1); + } state_password = 0; } else if (!strcasecmp ("login", tok)) state_login = 1; @@@ -162,8 -174,8 +173,8 @@@ void maybe_add_auth (URI &Uri, string N { if (NetRCFile.empty () == false) { - char login[64] = ""; - char password[64] = ""; + char login[LOGINSIZE] = ""; + char password[PASSWORDSIZE] = ""; char *netrcfile = strdup(NetRCFile.c_str()); // first check for a generic host based netrc entry diff --combined debian/changelog index 101119141,50d6ea3ce..c08596bec --- a/debian/changelog +++ b/debian/changelog @@@ -1,429 -1,13 +1,438 @@@ -apt (0.8.16~exp15) unstable; urgency=low ++apt (0.9.7.1ubuntu3) quantal; urgency=low + ++ [ TJ ] ++ * apt-pkg/contrib/netrc.cc: ++ - increase LOGINSIZE/PASSWORDSIZE limits and add proper error ++ if the limits are reached (LP: #1008289) ++ ++ -- Michael Vogt Tue, 28 Aug 2012 11:57:22 +0200 ++ +apt (0.9.7.1ubuntu2) quantal; urgency=low + + * ftparchive/override.cc: + - Double maximum override line length to 1000 (LP: #1038961). + + -- Colin Watson Mon, 20 Aug 2012 12:04:30 +0100 + +apt (0.9.7.1ubuntu1) quantal; urgency=low + + * merged from the debian-sid branch + + -- Michael Vogt Fri, 29 Jun 2012 15:33:42 +0200 + +apt (0.9.7.1) unstable; urgency=low + + [ Program translation updates ] + * Bulgarian (Damyan Ivanov) (Closes: #678983) + * Hungarian (Gabor Kelemen) + * Italian (Milo Casagrande) + * Slovenian (Andrej Znidarsic) + * German (Holger Wansing) (Closes: #679314) + * Slovak (Ivan Masár) (Closes: #679448) + + [ David Kalnischkies ] + * cmdline/apt-internal-solver.cc, cmdline/apt-mark.cc: + - typo fixes and unfuzzy translations + * debian/control: + - libapt-{pkg,inst} packages should be in section 'libs' instead + of 'admin' as by ftp-master override request in #677596 + - demote debiandoc-sgml to Build-Depends-Indep + * doc/makefile: + - separate translation building of debiandoc from manpages + so that we don't need to build debiandoc for binary packages + + -- Michael Vogt Fri, 29 Jun 2012 14:26:32 +0200 + +apt (0.9.7) unstable; urgency=low + + [ Julian Andres Klode ] + * apt-pkg/contrib/mmap.cc: + - Fix the Fallback option to work correctly, by not calling + realloc() on a map mapped by mmap(), and by using malloc + and friends instead of new[]. + - Zero out the new memory allocated with realloc(). + + [ Daniel Hartwig ] + * apt-pkg/pkgcachegen.cc: + - always reset _error->StackCount in MakeStatusCache (Closes: #677175) + + [ David Kalnischkies ] + * apt-pkg/deb/deblistparser.cc: + - ensure that mixed positive/negative architecture wildcards + are handled in the same way as dpkg handles them + - use PackageArchitectureMatchesSpecification filter + * apt-pkg/cachefilter.cc: + - add PackageArchitectureMatchesSpecification (Closes: #672603) + * apt-pkg/cacheset.cc: + - add PackageContainerInterface::FromGroup to support + architecture specifications with wildcards on the commandline + * apt-pkg/pkgcache.cc: + - do a string comparision for architecture checking in IsMultiArchImplicit + as 'unique' strings in the pkgcache aren't unique (Closes: #677454) + * buildlib/configure.mak: + - print a message detailing how to get config.guess and config.sub + in case they are not in /usr/share/misc (Closes: #677312) + * cmdline/apt-get.cc: + - print a friendly message in 'download' if a package can't be + downloaded (Closes: #677887) + + -- Michael Vogt Tue, 19 Jun 2012 16:42:43 +0200 + +apt (0.9.6ubuntu3) quantal; urgency=low + + * SECURITY UPDATE: Disable apt-key net-update for now, as validation + code is still insecure + - cmdline/apt-key: exit 1 immediately in net_update() + - CVE-2012-0954 + - LP: #1013639 + + -- Jamie Strandboge Fri, 15 Jun 2012 08:03:17 -0500 + +apt (0.9.6ubuntu2) quantal; urgency=low + + * adjust apt-key to ensure no collisions on subkeys too. Patch thanks to + Marc Deslauriers. (LP: #1013128) + + -- Jamie Strandboge Thu, 14 Jun 2012 11:29:48 -0500 + +apt (0.9.6ubuntu1) quantal; urgency=low + + [ Michael Vogt ] + * merged from Debian, remaining changes: + - use ubuntu keyring and ubuntu archive keyring in apt-key + - run update-apt-xapian-index in apt.cron + - support apt-key net-update and verify keys against master-keyring + - run apt-key net-update in cron.daily + - different example sources.list + - APT::pkgPackageManager::MaxLoopCount set to 5000 + - apport pkgfailure handling + - ubuntu changelog download handling + - patch for apt cross-building, see http://bugs.debian.org/666772 + + [ Steve Langasek ] + * Drop upgrade handling for obsolete conffile /etc/apt/apt.conf.d/01ubuntu, + removed in previous LTS. + * prepare-release: declare the packages needed as source build deps. + + -- Steve Langasek Mon, 11 Jun 2012 22:36:16 +0000 + +apt (0.9.6) unstable; urgency=low + + [ David Kalnischkies ] + * apt-pkg/cdrom.cc: + - fix regression from 0.9.3 which dumped the main configuration + _config instead of the cdrom settings (Cnf) as identified and + tested by Milan Kupcevic, thanks! (Closes: #674100) + * cmdline/apt-get.cc: + - do not show 'list of broken packages' header if no package + is broken as it happens e.g. for external resolver errors + - print URIs for all changelogs in case of --print-uris, + thanks to Daniel Hartwig for the patch! (Closes: #674897) + - show 'bzr branch' as 'bzr get' is deprecated (LP: #1011032) + - check build-dep candidate if install is forbidden + * debian/apt-utils.links: + - the internal resolver 'apt' is now directly installed in + /usr/lib/apt/solvers, so don't instruct dh to create a broken link + * doc/apt-verbatim.ent: + - APT doesn't belong to the product 'Linux', so use 'APT' instead + as after all APT is a big suite of applications + * doc/examples/sources.list: + - use the codename instead of 'stable' in the examples sources.list + as we do in the manpage and as the debian-installer does + * doc/apt-get.8.xml: + - use apt-utils as package example instead of libc6 + * apt-pkg/contrib/cmdline.cc: + - apply patch from Daniel Hartwig to fix a segfault in case + the LongOpt is empty (Closes: #676331) + - fix segfault with empty LongOpt in --no-* branch + * ftparchive/apt-ftparchive.cc: + - default to putting the Contents-* files below $(SECTION) as apt-file + expects them there - thanks Martin-Éric Racine! (Closes: #675827) + * apt-pkg/deb/deblistparser.cc: + - set pkgCacheGen::Essential to "all" again (Closes: #675449) + * apt-pkg/algorithms.cc: + - force install only for one essential package out of a group + * apt-pkg/aptconfiguration.cc: + - if APT::Languages=none save "none" in allCodes so that the detected + configuration is cached as intended (Closes: #674690, LP: #1004947) + * apt-pkg/cacheiterators.h: + - add an IsMultiArchImplicit() method for Dep- and PrvIterator + + [ Justin B Rye ] + * doc/apt-cdrom.8.xml: + - replace CDROM with the proper CD-ROM in text + - correct disc vs. disk issues + * doc/apt-extracttemplates.1.xml: + - debconf is not DebConf + * doc/apt-get.8.xml: + - move dselect-upgrade below dist-upgrade + - review and fix spelling issues + * doc/apt-ftparchive.8.xml, doc/apt-config.8.xml, + doc/apt-key.8.xml, doc/apt-mark.8.xml, + doc/apt_preferences.5.xml, doc/apt-secure.8.xml, + doc/apt-sortpkgs.1.xml, sources.list.5.xml: + - review and fix typo, grammar and style issues + * doc/apt.conf.5.xml: + - review and fix typo, grammar and style issues + - rephrase APT::Immediate-Configuration and many others + + [ Sebastian Heinlein ] + * cmdline/apt-key: + - do not hardcode /etc but use Dir::Etc instead + + [ Robert Luberda ] + * Polish manpage translation update (Closes: #675603) + * doc/apt-mark.8.xml: + - in hold, the option name is --file not --filename + + [ Christian Perrier ] + * French program and manpage translation update + * Danish program translation by Joe Hansen. Closes: #675605 + + [ Thibaut Girka ] + * cmdline/apt-get.cc: + - complain correctly about :any build-dep on M-A:none packages + * apt-pkg/deb/deblistparser.cc: + - add support for arch-specific qualifiers in dependencies + + -- Michael Vogt Mon, 11 Jun 2012 16:21:53 +0200 + +apt (0.9.5.1) unstable; urgency=low + + [ David Kalnischkies ] + * apt-pkg/contrib/fileutl.cc: + - dup() given compressed fd in OpenDescriptor if AutoClose + is disabled as otherwise gzclose() and co will close it + * doc/*.xml: + - mark even more stuff as untranslateable and improve the + markup here and there (no real text change) + - use docbook DTD 4.5 instead of 4.2 to have valid docs + + [ Justin B Rye ] + * doc/*.xml: + - remove 'GNU/Linux' from 'Debian systems' strings as Debian + has more systems than just GNU/Linux nowadays + * doc/apt-cache.8.xml: + - fix a typo as well as adding missing literal markup + - three small rewordings for better english sentences + + -- Michael Vogt Thu, 24 May 2012 17:16:34 +0200 + +apt (0.9.5) unstable; urgency=low + + [ Chris Leick ] + * proofreading of the manpage pot + * German manpage translation update (Closes: #673294) + + [ David Kalnischkies ] + * buildlib/podomain.mak: + - ensure that all sources end up in the srclist so that we don't + forget to extract half of the translation strings + * buildlib/inttypes.h.in: + - remove inttypes.h compatibility as providing such a c99 types + compatibility conflicts with the usage of c99 type long long + * apt-pkg/contrib/mmap.cc: + - have a dummy SyncToFd around in case of ReadOnly access to a + compressed file as we otherwise on Close() do not delete[] the + char buffer but munmap() it… (Closes: #673815) + * debian/control: + - moving debiandoc-sgml to Build-Depends-Indep was one step too much + for the buildds as we still build two sgml files in arch:any + * debian/rules: + - move internal-solver as 'apt' to his friend dump-solver in + /usr/lib/apt/solvers to avoid writing a manpage for it + + -- Michael Vogt Tue, 22 May 2012 16:14:22 +0200 + +apt (0.9.4) unstable; urgency=low + + [ David Kalnischkies ] + * methods/http.cc: + - after many years of pointless discussions disable http/1.1 pipelining + by default as many webservers and proxies seem to be unable to conform + to specification must's (rfc2616 section 8.1.2.2) (LP: #996151) + - add spaces around PACKAGE_VERSION to fix FTBFS with -std=c++11 + * apt-pkg/pkgcachegen.cc: + - make IsDuplicatedDescription static so that it is really private + as we don't need a symbol for it as it is not in a header + * Makefile, buildlib/*.mak: + - reshuffle dependencies so that parallel building seems to work + - separate manpages from the rest of the doc building + * prepare-release: + - apt-inst version isn't apt versions, so don't override variable + * debian/rules: + - apt-utils packages manpages, so it should depend on build-doc + - make apt and apt-utils packages depend on manpages instead of full doc + * debian/control: + - move doxygen and debiandoc-sgml to Build-Depends-Indep as docs + are no longer build in the same target as the manpages + * apt-pkg/acquire-methods.cc: + - factor out into private Dequeue() to fix access to deleted pointer + * apt-pkg/contrib/fileutl.cc: + - ensure that we close compressed fds, wait for forks and such even if + the FileFd itself is set to not autoclose the given Fd + * cmdline/apt-get.cc: + - use the host architecture, not the build architecture for matching + of [architecture restrictions] in Build-Depends (Closes: #672927) + * doc/makefile: + - build manpages with the correct l10n.gentext.default.language setting + to get the correct section titles provided by docbook + * doc/po/de.po: + - updated german manpage translation by Chris Leick, thanks! + * apt-pkg/packagemanager.cc: + - do not run into loop on new-pre-depends-breaks (Closes: #673536) + * doc/*.xml: + - add a few translator notes and reword some paragraphs to ensure that + translators and users alike can better understand them (Closes: #669409) + - in mark all options with