<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[148304] trunk/dports/sysutils/tardiff</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="https://trac.macports.org/changeset/148304">148304</a></dd>
<dt>Author</dt> <dd>raimue@macports.org</dd>
<dt>Date</dt> <dd>2016-05-03 07:43:01 -0700 (Tue, 03 May 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>sysutils/tardiff:
Add patches for CVE-2015-0857, CVE-2015-0858, and other bugs, closes #51292</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkdportssysutilstardiffPortfile">trunk/dports/sysutils/tardiff/Portfile</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkdportssysutilstardifffilespatchCVE20150857diff">trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0857.diff</a></li>
<li><a href="#trunkdportssysutilstardifffilespatchCVE20150858diff">trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0858.diff</a></li>
<li><a href="#trunkdportssysutilstardifffilespatchfixstatisticdiff">trunk/dports/sysutils/tardiff/files/patch-fix-statistic.diff</a></li>
<li><a href="#trunkdportssysutilstardifffilespatchfixuniqueuniquebasediff">trunk/dports/sysutils/tardiff/files/patch-fix-unique-uniquebase.diff</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkdportssysutilstardiffPortfile"></a>
<div class="modfile"><h4>Modified: trunk/dports/sysutils/tardiff/Portfile (148303 => 148304)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/dports/sysutils/tardiff/Portfile 2016-05-03 13:23:58 UTC (rev 148303)
+++ trunk/dports/sysutils/tardiff/Portfile 2016-05-03 14:43:01 UTC (rev 148304)
</span><span class="lines">@@ -5,11 +5,12 @@
</span><span class="cx">
</span><span class="cx"> name tardiff
</span><span class="cx"> version 0.1
</span><del>-revision 3
</del><ins>+revision 4
</ins><span class="cx"> categories sysutils textproc devel archivers
</span><span class="cx"> license GPL
</span><span class="cx"> platforms darwin
</span><del>-maintainers ryandesign
</del><ins>+maintainers ryandesign \
+ openmaintainer
</ins><span class="cx"> supported_archs noarch
</span><span class="cx">
</span><span class="cx"> description compares the contents of two tarballs
</span><span class="lines">@@ -38,7 +39,11 @@
</span><span class="cx"> copy ${distpath}/${name} ${worksrcpath}
</span><span class="cx"> }
</span><span class="cx">
</span><del>-patchfiles patch-tardiff.diff
</del><ins>+patchfiles patch-tardiff.diff \
+ patch-fix-statistic.diff \
+ patch-fix-unique-uniquebase.diff \
+ patch-CVE-2015-0857.diff \
+ patch-CVE-2015-0858.diff
</ins><span class="cx">
</span><span class="cx"> use_configure no
</span><span class="cx">
</span></span></pre></div>
<a id="trunkdportssysutilstardifffilespatchCVE20150857diff"></a>
<div class="addfile"><h4>Added: trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0857.diff (0 => 148304)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0857.diff (rev 0)
+++ trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0857.diff 2016-05-03 14:43:01 UTC (rev 148304)
</span><span class="lines">@@ -0,0 +1,44 @@
</span><ins>+Upstream: https://anonscm.debian.org/cgit/collab-maint/tardiff.git/tree/debian/patches/CVE-2015-0857.diff
+Edit: gnutar instead of tar
+
+Description: Fix local code execution when calling diff (CVE-2015-0857)
+ Reported by Rainer Müller <raimue@codingfarm.de>. Implemented using
+ Text::Diff instead of diff and backticks.
+Author: Axel Beckert <abe@debian.org>
+Bug-CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0857
+
+Index: tardiff
+===================================================================
+--- tardiff 2016-04-28 19:19:02.194646937 +0200
++++ tardiff 2016-04-28 19:36:41.253948109 +0200
+@@ -6,6 +6,7 @@
+ # Published under GNU GPL conditions
+
+ use strict;
++use Text::Diff;
+
+ my $VERSION = '0.1';
+
+@@ -73,7 +74,12 @@
+ $flag = "-j";
+ }
+
+- my $list = `gnutar -C $tempdir $flag -xvf $tarball 2>/dev/null`;
++ open(TARLIST, '-|', qw(gnutar -C), $tempdir, $flag, qw(-xvf), $tarball)
++ or die "Can't call tar as expected: $!";
++ local $/ = undef; # slurp mode
++ my $list = <TARLIST> or die "Couldn't read from tar";
++ close(TARLIST) or warn "tar exited with non-zero exit code";
++
+ return $list;
+ }
+
+@@ -116,7 +122,7 @@
+ if(-d $file1 and -d $file2){
+ return 0;
+ }elsif(-f $file1 and -f $file2){
+- my $diff = `diff $file1 $file2`;
++ my $diff = diff $file1, $file2, { STYLE => "OldStyle" };
+ if($diff){
+ if($opt_stats){
+ my $plus = 0;
</ins></span></pre></div>
<a id="trunkdportssysutilstardifffilespatchCVE20150858diff"></a>
<div class="addfile"><h4>Added: trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0858.diff (0 => 148304)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0858.diff (rev 0)
+++ trunk/dports/sysutils/tardiff/files/patch-CVE-2015-0858.diff 2016-05-03 14:43:01 UTC (rev 148304)
</span><span class="lines">@@ -0,0 +1,49 @@
</span><ins>+Upstream: https://anonscm.debian.org/cgit/collab-maint/tardiff.git/tree/debian/patches/CVE-2015-0858.diff
+
+Description: Fix race condition when creating temporary files (CVE-2015-0858)
+ Reported by Florian Weimer <fw@deneb.enyo.de>. Implemented using
+ File::Temp instead of just using the process ID inside the directory
+ name as suggested by Florian.
+Author: Axel Beckert <abe@debian.org>
+Bug-CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0858
+
+Index: tardiff
+===================================================================
+--- tardiff 2016-04-28 20:24:06.913565891 +0200
++++ tardiff 2016-04-28 20:24:06.909565907 +0200
+@@ -7,12 +7,13 @@
+
+ use strict;
+ use Text::Diff;
++use File::Temp qw(tempdir);
+
+ my $VERSION = '0.1';
+
+ my ($tarball1, $tarball2);
+ my ($opt_list, $opt_modified, $opt_autoskip, $opt_stats);
+-my $tempdir;
++my $tempdir = tempdir( CLEANUP => 1 );
+
+ $SIG{'__DIE__'} = 'cleanup';
+ $SIG{'TERM'} = 'cleanup';
+@@ -173,9 +174,6 @@
+ sub tardiff{
+ my $error = 0;
+
+- $tempdir = "/tmp/tardiff-$$";
+- mkdir $tempdir;
+-
+ my $filelist1 = untar($tarball1) or die "Error: Could not unpack $tarball1.";
+ my $filelist2 = untar($tarball2) or die "Error: Could not unpack $tarball2.";
+
+@@ -216,10 +214,6 @@
+ sub cleanup{
+ my $handler = shift(@_);
+
+- if($tempdir){
+- system("rm -rf $tempdir");
+- }
+-
+ if($handler eq "INT" or $handler eq "TERM"){
+ exit 1;
+ }
</ins></span></pre></div>
<a id="trunkdportssysutilstardifffilespatchfixstatisticdiff"></a>
<div class="addfile"><h4>Added: trunk/dports/sysutils/tardiff/files/patch-fix-statistic.diff (0 => 148304)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/dports/sysutils/tardiff/files/patch-fix-statistic.diff (rev 0)
+++ trunk/dports/sysutils/tardiff/files/patch-fix-statistic.diff 2016-05-03 14:43:01 UTC (rev 148304)
</span><span class="lines">@@ -0,0 +1,31 @@
</span><ins>+Upstream: https://anonscm.debian.org/cgit/collab-maint/tardiff.git/tree/debian/patches/fix-statistic.diff
+
+Description: Fix calculation of statistics (option -s)
+ Using normal instead of unique diff is far easier to parse
+ unambiguously.
+Author: Axel Beckert <abe@debian.org>
+Bug-Debian: https://bugs.debian.org/802098
+
+Index: tardiff
+===================================================================
+--- tardiff 2015-10-17 16:37:09.675959837 +0200
++++ tardiff 2015-10-17 16:40:07.739438492 +0200
+@@ -116,15 +116,15 @@
+ if(-d $file1 and -d $file2){
+ return 0;
+ }elsif(-f $file1 and -f $file2){
+- my $diff = `diff -u $file1 $file2`;
++ my $diff = `diff $file1 $file2`;
+ if($diff){
+ if($opt_stats){
+ my $plus = 0;
+ my $minus = 0;
+ foreach my $line(split(/\n/, $diff)){
+- if($line =~ /^+\ /){
++ if($line =~ /^>/){
+ $plus++;
+- }elsif($line =~ /^-\ /){
++ }elsif($line =~ /^</){
+ $minus++;
+ }
+ }
</ins></span></pre></div>
<a id="trunkdportssysutilstardifffilespatchfixuniqueuniquebasediff"></a>
<div class="addfile"><h4>Added: trunk/dports/sysutils/tardiff/files/patch-fix-unique-uniquebase.diff (0 => 148304)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/dports/sysutils/tardiff/files/patch-fix-unique-uniquebase.diff (rev 0)
+++ trunk/dports/sysutils/tardiff/files/patch-fix-unique-uniquebase.diff 2016-05-03 14:43:01 UTC (rev 148304)
</span><span class="lines">@@ -0,0 +1,58 @@
</span><ins>+Upstream: https://anonscm.debian.org/cgit/collab-maint/tardiff.git/tree/debian/patches/fix-unique-uniquebase.diff
+
+Patch to allow to compare to tar balls with the same base
+directory. Also fixes an issue with listing a directory as present in
+the wrong tar ball.
+
+Author: Axel Beckert <abe@debian.org>
+
+Index: tardiff
+===================================================================
+--- tardiff 2005-05-17 14:52:27.000000000 +0200
++++ tardiff 2011-12-01 21:56:59.000000000 +0100
+@@ -80,6 +80,7 @@
+ sub analyzetar{
+ my $filelist = shift(@_);
+ my $filehash = shift(@_);
++ my $tarball = shift(@_);
+
+ my %files = %{$filehash};
+
+@@ -92,12 +93,12 @@
+ if(!$uniquebase){
+ $uniquebase = $base;
+ }else{
+- ($base eq $uniquebase) or die "$tarball1 contains different base dirs: $base and $uniquebase";
++ ($base eq $uniquebase) or die "$tarball contains different base dirs: $base and $uniquebase";
+ }
+ if($files{$remainder}){
+ $files{$remainder} = "__both";
+ }else{
+- $files{$remainder} = "$uniquebase";
++ $files{$remainder} = "$tarball";
+ }
+ }
+
+@@ -174,8 +175,8 @@
+
+ my %files;
+
+- my ($base1, %files) = analyzetar($filelist1, \%files);
+- my ($base2, %files) = analyzetar($filelist2, \%files);
++ my ($base1, %files) = analyzetar($filelist1, \%files, $tarball1);
++ my ($base2, %files) = analyzetar($filelist2, \%files, $tarball2);
+
+ foreach my $file(sort(keys(%files))){
+ next if $file eq "";
+@@ -196,9 +197,9 @@
+ if($opt_list and not $modified){
+ print " $file\n";
+ }
+- }elsif($base eq $base1){
++ }elsif($base eq $tarball1){
+ print "- $file\n";
+- }elsif($base eq $base2){
++ }elsif($base eq $tarball2){
+ print "+ $file\n";
+ }else{
+ print "? $file\n";
</ins></span></pre>
</div>
</div>
</body>
</html>