[PATCH 1/1] gnu: unrtf: Fix CVE-2016-10091.

[Leo Famulari]

* gnu/packages/patches/unrtf-CVE-2016-10091.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/unrtf.scm (unrtf)[source]: Use it.
---
 gnu/local.mk                                    |   1 +
 gnu/packages/patches/unrtf-CVE-2016-10091.patch | 224 ++++++++++++++++++++++++
 gnu/packages/unrtf.scm                          |   2 +
 3 files changed, 227 insertions(+)
 create mode 100644 gnu/packages/patches/unrtf-CVE-2016-10091.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 6ab1c1c48..58878e8e4 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -878,6 +878,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/tophat-build-with-later-seqan.patch     \
   %D%/packages/patches/totem-debug-format-fix.patch            \
   %D%/packages/patches/tuxpaint-stamps-path.patch              \
+  %D%/packages/patches/unrtf-CVE-2016-10091.patch              \
   %D%/packages/patches/unzip-CVE-2014-8139.patch               \
   %D%/packages/patches/unzip-CVE-2014-8140.patch               \
   %D%/packages/patches/unzip-CVE-2014-8141.patch               \
diff --git a/gnu/packages/patches/unrtf-CVE-2016-10091.patch 
b/gnu/packages/patches/unrtf-CVE-2016-10091.patch
new file mode 100644
index 000000000..0a58b40db
--- /dev/null
+++ b/gnu/packages/patches/unrtf-CVE-2016-10091.patch
@@ -0,0 +1,224 @@
+Fix CVE-2016-10091 (stack-based buffer overflows in cmd_* functions):
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10091
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849705
+http://seclists.org/oss-sec/2016/q4/787
+
+Patch copied from Debian:
+
+https://anonscm.debian.org/cgit/collab-maint/unrtf.git/commit/?h=jessie&id=7500a48fb0fbad3ab963fb17560b2f90a8a485c8
+
+The Debian patch adapts this upstream commit so that it can be applied
+to the 0.21.9 release tarball:
+
+http://hg.savannah.gnu.org/hgweb/unrtf/rev/3b16893a6406
+
+From 7dd568ed8a6a5acb6c04f2b40f457d63a00435f3 Mon Sep 17 00:00:00 2001
+From: Willi Mann <address@hidden>
+Date: Sat, 31 Dec 2016 20:31:38 +0100
+Subject: [PATCH] Add patch from upstream to fix CVE-2016-10091 (buffer
+ overflow in various cmd_ functions)
+
+closes: 849705
+---
+ ...-instances-of-sprintf-with-snprintf-and-a.patch | 179 +++++++++++++++++++++
+ debian/patches/series                              |   1 +
+ 2 files changed, 180 insertions(+)
+ create mode 100644 
debian/patches/0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch
+ create mode 100644 debian/patches/series
+
+diff --git 
a/debian/patches/0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch
 
b/debian/patches/0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch
+new file mode 100644
+index 0000000..2f3825a
+--- /dev/null
++++ 
b/debian/patches/0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch
+@@ -0,0 +1,179 @@
++From: Jean-Francois Dockes <address@hidden>
++Date: Sat, 31 Dec 2016 20:25:19 +0100
++Subject: Replace all instances of sprintf with snprintf and adjust size of
++ integer field in some cases
++
++This fixes CVE-2016-10091
++
++Bug-Debian: https://bugs.debian.org/849705
++---
++ src/attr.c    |  4 ++--
++ src/convert.c | 28 ++++++++++++++--------------
++ src/output.c  |  4 ++--
++ 3 files changed, 18 insertions(+), 18 deletions(-)
++
++diff --git a/src/attr.c b/src/attr.c
++index 02b5c81..e2951ea 100644
++--- a/src/attr.c
+++++ b/src/attr.c
++@@ -746,7 +746,7 @@ char *
++ assemble_string(char *string, int nr)
++ {
++ 
++-     char *s, tmp[12];/* Number of characters that can be in int type 
(including '\0') - AF */
+++     char *s, tmp[20];
++      int i = 0, j = 0;
++ 
++      if (string == NULL)
++@@ -762,7 +762,7 @@ assemble_string(char *string, int nr)
++              }
++ 
++              if (string[i] != '\0') {
++-                     sprintf(tmp, "%d", nr);
+++                     snprintf(tmp, 20, "%d", nr);
++                      strcpy(&s[j], tmp);
++                      j = j + strlen(tmp);
++              }
++diff --git a/src/convert.c b/src/convert.c
++index c76d7d6..8eacdcb 100644
++--- a/src/convert.c
+++++ b/src/convert.c
++@@ -472,7 +472,7 @@ static const int fcharsetparmtocp(int parm)
++ }
++ 
++ // Translate code page to encoding name hopefully suitable as iconv input
++-static char *cptoencoding(parm)
+++static char *cptoencoding(int parm)
++ {
++     // Note that CP0 is supposed to mean current system default, which does
++     // not make any sense as a stored value, we don't handle it.
++@@ -964,7 +964,7 @@ cmd_cf (Word *w, int align, char has_param, int num)
++      }
++      else
++      {
++-             sprintf(str,"#%02x%02x%02x",
+++             snprintf(str, 40, "#%02x%02x%02x",
++                      color_table[num].r,
++                      color_table[num].g,
++                      color_table[num].b);
++@@ -993,7 +993,7 @@ cmd_cb (Word *w, int align, char has_param, int num)
++      }
++      else
++      {
++-             sprintf(str,"#%02x%02x%02x",
+++             snprintf(str, 40, "#%02x%02x%02x",
++                      color_table[num].r,
++                      color_table[num].g,
++                      color_table[num].b);
++@@ -1018,7 +1018,7 @@ cmd_fs (Word *w, int align, char has_param, int points) 
{
++      /* Note, fs20 means 10pt */
++      points /= 2;
++ 
++-     sprintf(str,"%d",points);
+++     snprintf(str, 20, "%d", points);
++      attr_push(ATTR_FONTSIZE,str);
++ 
++      return FALSE;
++@@ -1166,7 +1166,7 @@ cmd_f (Word *w, int align, char has_param, int num)
++         {
++             // TOBEDONE: WHAT'S THIS ???
++             name = my_malloc(12);
++-            sprintf(name, "%d", num);
+++                     snprintf(name, 12, "%d", num);
++         }
++ 
++         /* we are going to output entities, so should not output font */
++@@ -1218,7 +1218,7 @@ cmd_highlight (Word *w, int align, char has_param, int 
num)
++      }
++      else
++      {
++-             sprintf(str,"#%02x%02x%02x",
+++             snprintf(str, 40, "#%02x%02x%02x",
++                      color_table[num].r,
++                      color_table[num].g,
++                      color_table[num].b);
++@@ -1373,9 +1373,9 @@ cmd_ftech (Word *w, int align, char has_param, int 
param) {
++ 
++ static int 
++ cmd_expand (Word *w, int align, char has_param, int param) {
++-     char str[10];
+++     char str[20];
++      if (has_param) {
++-             sprintf(str, "%d", param/4);
+++             snprintf(str, 20, "%d", param / 4);
++              if (!param) 
++                      attr_pop(ATTR_EXPAND);
++              else 
++@@ -1394,7 +1394,7 @@ cmd_expand (Word *w, int align, char has_param, int 
param) {
++ 
++ static int 
++ cmd_emboss (Word *w, int align, char has_param, int param) {
++-     char str[10];
+++     char str[20];
++      if (has_param && !param)
++ #ifdef SUPPORT_UNNESTED
++              attr_find_pop(ATTR_EMBOSS);
++@@ -1403,7 +1403,7 @@ cmd_emboss (Word *w, int align, char has_param, int 
param) {
++ #endif
++      else
++      {
++-             sprintf(str, "%d", param);
+++             snprintf(str, 20, "%d", param);
++              attr_push(ATTR_EMBOSS, str);
++      }
++      return FALSE;
++@@ -1419,12 +1419,12 @@ cmd_emboss (Word *w, int align, char has_param, int 
param) {
++ 
++ static int 
++ cmd_engrave (Word *w, int align, char has_param, int param) {
++-     char str[10];
+++     char str[20];
++      if (has_param && !param) 
++              attr_pop(ATTR_ENGRAVE);
++      else
++      {
++-             sprintf(str, "%d", param);
+++             snprintf(str, 20, "%d", param);
++              attr_push(ATTR_ENGRAVE, str);
++      }
++      return FALSE;
++@@ -1976,7 +1976,7 @@ static int cmd_u (Word *w, int align, char has_param, 
int param) {
++ 
++      short   done=0;
++      long unicode_number = (long) param; /* On 16bit architectures int is 
too small to store unicode characters. - AF */
++-     char tmp[12]; /* Number of characters that can be in int type 
(including '\0'). If int size is greater than 4 bytes change this value. - AF */
+++     char tmp[20]; /* Number of characters that can be in int type 
(including '\0'). If int size is greater than 4 bytes change this value. - AF */
++      const char *alias;
++ #define DEBUG 0
++ #if DEBUG
++@@ -2006,7 +2006,7 @@ static int cmd_u (Word *w, int align, char has_param, 
int param) {
++                             /* RTF spec: Unicode values beyond 32767 are 
represented by negative numbers */
++                              unicode_number += 65536;
++                      }
++-                     sprintf(tmp, "%ld", unicode_number);
+++                     snprintf(tmp, 20, "%ld", unicode_number);
++ 
++                      if (safe_printf(1, op->unisymbol_print, tmp)) 
fprintf(stderr, TOO_MANY_ARGS, "unisymbol_print");
++                      done++;
++diff --git a/src/output.c b/src/output.c
++index 86d8b5c..4cdbfa6 100644
++--- a/src/output.c
+++++ b/src/output.c
++@@ -320,7 +320,7 @@ op_begin_std_fontsize (OutputPersonality *op, int size)
++      if (!found_std_expr) {
++              if (op->fontsize_begin) {
++                      char expr[16];
++-                     sprintf (expr, "%d", size);
+++                     snprintf(expr, 16, "%d", size);
++                      if (safe_printf (1, op->fontsize_begin, expr)) 
fprintf(stderr, TOO_MANY_ARGS, "fontsize_begin");
++              } else {
++                      /* If we cannot write out a change for the exact
++@@ -440,7 +440,7 @@ op_end_std_fontsize (OutputPersonality *op, int size)
++      if (!found_std_expr) {
++              if (op->fontsize_end) {
++                      char expr[16];
++-                     sprintf (expr, "%d", size);
+++                     snprintf(expr, 16, "%d", size);
++                      if (safe_printf(1, op->fontsize_end, expr)) 
fprintf(stderr, TOO_MANY_ARGS, "fontsize_end");
++              } else {
++                      /* If we cannot write out a change for the exact
+diff --git a/debian/patches/series b/debian/patches/series
+new file mode 100644
+index 0000000..7868249
+--- /dev/null
++++ b/debian/patches/series
+@@ -0,0 +1 @@
++0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch
+-- 
+2.11.0
+
diff --git a/gnu/packages/unrtf.scm b/gnu/packages/unrtf.scm
index 162dec752..e11c9445c 100644
--- a/gnu/packages/unrtf.scm
+++ b/gnu/packages/unrtf.scm
@@ -23,6 +23,7 @@
   #:use-module (guix download)
   #:use-module (guix build-system gnu)
   #:use-module (guix gexp)
+  #:use-module (gnu packages)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages m4)
   #:use-module (gnu packages base))
@@ -35,6 +36,7 @@
              (method url-fetch)
              (uri (string-append "mirror://gnu/unrtf/unrtf-"
                                  version ".tar.gz"))
+             (patches (search-patches "unrtf-CVE-2016-10091.patch"))
              (sha256
               (base32
                "1pcdzf2h1prn393dkvg93v80vh38q0v817xnbwrlwxbdz4k7i8r2"))
-- 
2.11.0