[Reproducible-commits] [dpkg] 31/32: Dpkg::Source::Patch: Outright reject C-style filenames in patches

[Holger Levsen]

This is an automated email from the git hooks/post-receive script.

holger pushed a commit to annotated tag 1.15.10
in repository dpkg.

commit 2389c7542534e2f44ed3b8b2ad3fded559e8ca26
Author: Guillem Jover <guillem at debian.org>
Date:   Wed Apr 30 02:28:45 2014 +0200

    Dpkg::Source::Patch: Outright reject C-style filenames in patches
    
    Cherry picked from commit d49704f7fd699e809aead799a1dd4d20d969665a.
    
    Because patch only started recognizing C-style filenames in diffs
    in version 2.7, it's not safe to assume one behaviour or the other,
    as the system might or might not have a recent enough version, or
    a GNU patch program at all. There's also no reason we should be
    supporting this kind of strange encoded filenames in patches, when
    we have not done so up to now.
    
    Let's just ban these types of diffs and be done with it.
    
    Fixes: CVE-2014-0471
    Closes: #746306
---
 debian/changelog             |  8 ++++++++
 scripts/Dpkg/Source/Patch.pm | 32 +-------------------------------
 2 files changed, 9 insertions(+), 31 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 242a02b..14fbf2f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+dpkg (1.15.10) UNRELEASED; urgency=low
+
+  [ Guillem Jover ]
+  * Do not allow patch files with C-style encoded filenames. Closes: #746306
+    Unconditionally fixes CVE-2014-0471.
+
+ -- Guillem Jover <guillem at debian.org>  Wed, 30 Apr 2014 15:14:11 +0200
+
 dpkg (1.15.9) squeeze-security; urgency=high
 
   * Correctly parse C-style diff filenames in Dpkg::Source::Patch, to avoid
diff --git a/scripts/Dpkg/Source/Patch.pm b/scripts/Dpkg/Source/Patch.pm
index 55d93b9..db10ac4 100644
--- a/scripts/Dpkg/Source/Patch.pm
+++ b/scripts/Dpkg/Source/Patch.pm
@@ -280,31 +280,6 @@ sub _fail_not_same_type {
     $self->register_error();
 }
 
-my %ESCAPE = ((
-    'a' => "\a",
-    'b' => "\b",
-    'f' => "\f",
-    'n' => "\n",
-    'r' => "\r",
-    't' => "\t",
-    'v' => "\cK",
-    '\\' => "\\",
-    '"' => "\"",
-), (
-    map { sprintf('%03o', $_) => chr($_) } (0..255)
-));
-
-sub _unescape {
-    my ($diff, $str) = @_;
-
-    if (exists $ESCAPE{$str}) {
-        return $ESCAPE{$str};
-    } else {
-        error(_g("diff %s patches file with unknown escape sequence \\%s"),
-              $diff, $str);
-    }
-}
-
 # Fetch the header filename ignoring the optional timestamp
 sub _fetch_filename {
     my ($diff, $header) = @_;
@@ -314,12 +289,7 @@ sub _fetch_filename {
 
     # Is it a C-style string?
     if ($header =~ m/^"/) {
-        $header =~ m/^"((?:[^\\"]|\\.)*)"/;
-        error(_g('diff %s patches file with unbalanced quote'), $diff)
-            unless defined $1;
-
-        $header = $1;
-        $header =~ s/\\([0-3][0-7]{2}|.)/_unescape($diff, $1)/eg;
+        error(_g('diff %s patches file with C-style encoded filename'), $diff);
     } else {
         # Tab is the official separator, it's always used when
         # filename contain spaces. Try it first, otherwise strip on space

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/reproducible/dpkg.git