From: Elan Ruusamäe Date: Fri, 14 Apr 2006 11:11:40 +0000 (+0000) Subject: - probably outdated X-Git-Tag: auto/ac/Canna-3_7-p3_1~3 X-Git-Url: http://git.pld-linux.org/?p=packages%2FCanna.git;a=commitdiff_plain;h=78d9e7c60bdc8ff9eb08dd8b1c290f23214ab75f - probably outdated Changed files: Canna-fixes.patch -> 1.2 Canna-multivul.patch -> 1.2 Canna-wconv.patch -> 1.2 --- diff --git a/Canna-fixes.patch b/Canna-fixes.patch deleted file mode 100644 index c8f514c..0000000 --- a/Canna-fixes.patch +++ /dev/null @@ -1,35 +0,0 @@ ---- Canna35b2/dic/ideo/pubdic/pod.c.orig 2004-08-22 14:34:33.278457000 +0200 -+++ Canna35b2/dic/ideo/pubdic/pod.c 2004-08-22 14:54:04.397488547 +0200 -@@ -25,6 +25,8 @@ - #endif - - #include -+#include -+#include - - #define bzero(a, c) memset(a, 0, c) - -@@ -92,6 +94,7 @@ - # define WCG3 0x8000 - # define WCMSK 0x8080 - -+int - Mbstowcs(d, ss, n) - Wchar *d; - char *ss; -@@ -1187,6 +1190,7 @@ - } - } - -+void - shrinkargs(argv, n, count) - char **argv; - int n, count; -@@ -1369,6 +1373,7 @@ - (Wchar)'k', (Wchar)'i', (Wchar)'h', (Wchar)'o', (Wchar)'n', (Wchar)0, - }; - -+int - main(argc, argv) - int argc; - char *argv[]; diff --git a/Canna-multivul.patch b/Canna-multivul.patch deleted file mode 100644 index 9fde890..0000000 --- a/Canna-multivul.patch +++ /dev/null @@ -1,410 +0,0 @@ -diff -ruN Canna35b2.orig/server/convert.c Canna35b2/server/convert.c ---- Canna35b2.orig/server/convert.c Mon Dec 2 20:01:34 1996 -+++ Canna35b2/server/convert.c Mon Nov 11 19:59:52 2002 -@@ -53,6 +53,8 @@ - #define ACK2 2 - #define ACK3 3 - #define CHECK_ACK_BUF_SIZE (ACK_BUFSIZE + (SIZEOFLONG * 2) ) -+#define IR_INT_MAX 32767 -+#define IR_INT_INVAL(x) ((unsigned int)x > IR_INT_MAX) - - extern int errno; - -@@ -1778,6 +1780,8 @@ - return( needsize ) ; - - req->namelen = (int)L4TOL(buf + SIZE4); -+ if( IR_INT_INVAL(req->namelen) ) -+ return( -1 ); - ir_debug( Dmsg(10,"req->namelen =%d\n", req->namelen ); ) - - if( (needsize = SIZE8 + req->namelen - size) > 0 ) -@@ -1785,6 +1789,8 @@ - - if( req->namelen > 0 ){ - req->name = buf + SIZE8 ; -+ if( req->name[req->namelen - 1] != 0 ) -+ return( -1 ); - } - ir_debug( Dmsg(10,"req->namelen =%d\n", req->namelen ); ) - ir_debug( Dmsg(10,"req->name =%s\n", req->name ); ) -diff -ruN Canna35b2.orig/server/util.c Canna35b2/server/util.c ---- Canna35b2.orig/server/util.c Wed Nov 6 19:09:47 1996 -+++ Canna35b2/server/util.c Mon Nov 11 19:59:52 2002 -@@ -217,6 +217,19 @@ - return res; - } - -+const Ushort * -+ushortmemchr(ws, ch, len) -+const Ushort *ws; -+int ch; -+size_t len; -+{ -+ const Ushort *p, *end; -+ for (p = ws, end = ws + len; p < end; ++p) -+ if (*p == (Ushort)ch) -+ return p; -+ return NULL; -+} -+ - int - ushortstrcpy(wd, ws) - Ushort *wd, *ws; -diff -ruN Canna35b2.orig/server/wconvert.c Canna35b2/server/wconvert.c ---- Canna35b2.orig/server/wconvert.c Mon Nov 11 19:42:07 2002 -+++ Canna35b2/server/wconvert.c Mon Nov 11 19:59:52 2002 -@@ -100,6 +100,7 @@ - #endif - - extern void DispDebug() ; -+extern const Ushort *ushortmemchr pro((const Ushort *, int, size_t)); - extern int canna_server_hi ; - extern int canna_server_lo ; - #ifdef DEBUG -@@ -1322,7 +1323,10 @@ - char *dirname, *dirnamelong = (char *)0; - int cxnum = Request.type18.context, stat = -1; - int requestsize = Request.type18.size, retval; -+ size_t datasize = Request.type18.datalen - SIZEOFSHORT * 2; - -+ if (datasize == 0 || req->data[datasize - 1] != 0) -+ goto protoerr; - if (validcontext(cxnum, client, wListDictionary)) { - if (requestsize <= sizeof(local_buffer) || - (dicnames = malloc(requestsize))) { -@@ -1359,6 +1363,7 @@ - } - } - -+protoerr: - retval = SendType6Reply(client, wListDictionary, EXTPROTO, stat, - dicnames, namesize(dicnames, stat)); - if (dicnames != (char *)local_buffer) free(dicnames); -@@ -1470,10 +1475,15 @@ - char *dicname, *dirname, *dirnamelong = (char *)0; - int cxnum = Request.type18.context, stat = BADCONT; - int dirlen, requestsize = Request.type18.size, retval; -+ size_t datasize = Request.type18.datalen - SIZEOFSHORT * 2; - -+ if (datasize == 0 || req->data[datasize - 1] != 0) -+ goto protoerr; - if (validcontext(cxnum, client, wGetWordTextDictionary)) { - dirname = req->data ; - dirlen = strlen(dirname) + 1 ; -+ if (dirlen == datasize) -+ goto protoerr; - dicname = &(req->data[dirlen]) ; - if (dirlen > 1) { - if (!dirname || dirname[0] != ':' || -@@ -1515,6 +1525,7 @@ - free(dirnamelong); - } - } -+protoerr: - retval = SendType7Reply(client, wGetWordTextDictionary, EXTPROTO, - stat, stat > 0 ? stat + 1 : 0, infobuf); - if (infobuf != (Ushort *)local_buffer) free((char *)infobuf); -@@ -2296,6 +2307,9 @@ - { - ir_debug( Dmsg(10, "ProcWideReq1 start!!\n") ); - -+ if (Request.type1.datalen != 0) -+ return( -1 ); -+ - return( 0 ) ; - } - -@@ -2305,6 +2319,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq2 start!!\n") ); - -+ if (Request.type2.datalen != SIZEOFSHORT) -+ return( -1 ); - buf += HEADER_SIZE; Request.type2.context = S2TOS(buf); - ir_debug( Dmsg(10, "req->context =%d\n", Request.type2.context) ); - -@@ -2317,6 +2333,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq3 start!!\n") ); - -+ if (Request.type3.datalen != SIZEOFSHORT * 2) -+ return( -1 ); - buf += HEADER_SIZE; Request.type3.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type3.buflen = S2TOS(buf); - ir_debug( Dmsg(10, "req->context =%d\n", Request.type3.context) ); -@@ -2334,12 +2352,18 @@ - - ir_debug( Dmsg(10, "ProcWideReq4 start!!\n") ); - -+ if (Request.type4.datalen < SIZEOFSHORT * 4) -+ return( -1 ); - buf += HEADER_SIZE; Request.type4.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type4.begin = S2TOS(buf); - buf += SIZEOFSHORT; Request.type4.end = S2TOS(buf); - buf += SIZEOFSHORT; Request.type4.yomilen = S2TOS(buf); - Request.type4.yomi = (Ushort *)(buf += SIZEOFSHORT) ; -- len = Request.type4.datalen - SIZEOFSHORT * 4; -+ len = Request.type4.yomilen + 1; -+ if (Request.type4.datalen != SIZEOFSHORT * (4 + len) -+ || len == 0 -+ || Request.type4.yomi[len - 1] != 0) -+ return( -1 ); - for (data = Request.type4.yomi, i = 0; i < len; i++, data++) - *data = ntohs((unsigned short)*data); /* ¤Á¤ç¤Ã¤È¤ä¤À¤Ê¤¢ */ - ir_debug( Dmsg(10, "req->context =%d\n", Request.type4.context) ); -@@ -2359,6 +2383,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq5 start!!\n") ); - -+ if (Request.type5.datalen != SIZEOFSHORT * 2 + SIZEOFINT) -+ return( -1 ); - buf += HEADER_SIZE; Request.type5.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type5.size = S2TOS(buf); - buf += SIZEOFSHORT; Request.type5.mode = L4TOL(buf); -@@ -2375,6 +2401,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq6 start!!\n") ); - -+ if (Request.type6.datalen != SIZEOFSHORT * 3) -+ return( -1 ); - buf += HEADER_SIZE; Request.type6.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type6.number = S2TOS(buf); - buf += SIZEOFSHORT; Request.type6.buflen = S2TOS(buf); -@@ -2391,6 +2419,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq7 start!!\n") ); - -+ if (Request.type7.datalen != SIZEOFSHORT * 3) -+ return( -1 ); - buf += HEADER_SIZE; Request.type7.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type7.number = S2TOS(buf); - buf += SIZEOFSHORT; Request.type7.yomilen = (short)S2TOS(buf); -@@ -2407,6 +2437,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq8 start!!\n") ); - -+ if (Request.type8.datalen != SIZEOFSHORT * 4) -+ return( -1 ); - buf += HEADER_SIZE; Request.type8.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type8.curbun = S2TOS(buf); - buf += SIZEOFSHORT; Request.type8.curkouho = S2TOS(buf); -@@ -2425,6 +2457,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq9 start!!\n") ); - -+ if (Request.type9.datalen != SIZEOFSHORT * 4) -+ return( -1 ); - buf += HEADER_SIZE; Request.type9.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type9.number = S2TOS(buf); - buf += SIZEOFSHORT; Request.type9.kouho = S2TOS(buf); -@@ -2442,9 +2476,13 @@ - BYTE *buf ; - { - register int i ; -+ int rest; - - ir_debug( Dmsg(10, "ProcWideReq10 start!!\n") ); - -+ rest = Request.type10.datalen - (SIZEOFSHORT * 2 + SIZEOFINT); -+ if (rest < 0) -+ return( -1 ); - buf += HEADER_SIZE; Request.type10.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type10.number = S2TOS(buf); - buf += SIZEOFSHORT; Request.type10.mode = L4TOL(buf); -@@ -2452,6 +2490,8 @@ - ir_debug( Dmsg(10, "req->number =%d\n", Request.type10.number) ); - ir_debug( Dmsg(10, "req->mode =%d\n", Request.type10.mode) ); - -+ if (rest != Request.type10.number * SIZEOFSHORT) -+ return( -1 ); - buf += SIZEOFINT; Request.type10.kouho = (short *)buf; /* short? */ - for (i = 0; i < Request.type10.number; i++) { - Request.type10.kouho[i] = S2TOS(buf); buf += SIZEOFSHORT; -@@ -2468,12 +2508,18 @@ - register Ushort *data; - int i, len ; - -- ir_debug( Dmsg(10, "ProcWideReq10 start!!\n") ); -+ ir_debug( Dmsg(10, "ProcWideReq11 start!!\n") ); - -+ if (Request.type11.datalen < SIZEOFSHORT * 2) -+ return( -1 ); - buf += HEADER_SIZE; Request.type11.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type11.curbun = S2TOS(buf); - buf += SIZEOFSHORT; Request.type11.yomi = (Ushort *)buf; -+ if (Request.type11.datalen % SIZEOFSHORT != 0) -+ return( -1 ); - len = ((int)Request.type11.datalen - SIZEOFSHORT * 2) / SIZEOFSHORT ; -+ if (len == 0 || Request.type11.yomi[len - 1] != 0) -+ return( -1 ); - for (data = Request.type11.yomi, i = 0; i < len; i++, data++) - *data = ntohs( *data ); /* ¤Ê¤ó¤«¤ä¤À */ - ir_debug( Dmsg(10, "req->context =%d\n", Request.type11.context) ); -@@ -2490,16 +2536,26 @@ - BYTE *buf ; - { - register Ushort *data; -- int i, len ; -+ int i, len, rest; - - ir_debug( Dmsg(10, "ProcWideReq12 start!!\n") ); - -+ rest = Request.type12.datalen - SIZEOFSHORT; -+ if (rest < 0) -+ return( -1 ); - buf += HEADER_SIZE; Request.type12.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type12.datainfo = (Ushort *)buf; -+ if (!ushortmemchr((Ushort *)buf, 0, rest / SIZEOFSHORT)) -+ return( -1 ); - len = ushortstrlen((Ushort *)buf) + 1; -+ rest -= len * SIZEOFSHORT; -+ if (rest <= 0) -+ return( -1 ); - for( data = Request.type12.datainfo, i = 0; i < len; i++, data++ ) - *data = ntohs( *data ); /* ¤Ê¤ó¤«¤ä¤À */ - buf += len * SIZEOFSHORT; -+ if (buf[rest - 1] != '\0') -+ return( -1 ); - Request.type12.dicname = (char *)buf; - ir_debug( Dmsg(10, "req->context =%d\n", Request.type12.context) ); - ir_debug( Dmsg(10, "req->datainfo =%s\n", -@@ -2517,24 +2573,37 @@ - BYTE *buf ; - { - register Ushort *data; -- int i ,len ; -+ int i ,len, rest; - - ir_debug( Dmsg(10, "ProcWideReq13 start!!\n") ); - -+ rest = Request.type13.datalen - SIZEOFSHORT; -+ if (rest < 0) -+ return( -1 ); - buf += HEADER_SIZE; Request.type13.context = S2TOS(buf); - len = SIZEOFSHORT ; - buf += len; - Request.type13.dicname = (char *)buf; -+ if (!memchr(buf, 0, rest)) -+ return( -1 ); - len = strlen( (char *)buf ) + 1; -+ rest -= len; -+ if (rest % SIZEOFSHORT -+ || rest < SIZEOFSHORT * 3) -+ return( -1 ); - buf += len; - Request.type13.yomi = (Ushort *)buf; - len = ((int)Request.type13.datalen - len - SIZEOFSHORT * 4) / SIZEOFSHORT; -+ if (ushortmemchr((Ushort *)buf, 0, len) != (Ushort *)buf + len - 1) -+ return( -1 ); - for( data = Request.type13.yomi, i = 0; i < len; i++, data++) - *data = ntohs( *data ); -- buf += (ushortstrlen((Ushort *)buf) + 1) * SIZEOFSHORT; -+ buf += len * SIZEOFSHORT; - Request.type13.yomilen = S2TOS(buf); - buf += SIZEOFSHORT; Request.type13.kouhosize = S2TOS(buf); - buf += SIZEOFSHORT; Request.type13.hinshisize = S2TOS(buf); -+ if (Request.type13.yomilen != len - 1) -+ return( -1 ); - ir_debug( Dmsg(10, "req->context =%d\n", Request.type13.context) ); - ir_debug( Dmsg(10, "req->dicname =%s\n", Request.type13.dicname) ); - ir_debug( Dmsg(10, "req->yomi =%s\n", -@@ -2556,11 +2625,16 @@ - - ir_debug( Dmsg(10, "ProcWideReq14 start!!\n") ); - -+ if (Request.type14.datalen <= SIZEOFINT + SIZEOFSHORT -+ || Request.type14.datalen % SIZEOFSHORT) -+ return( -1 ); - buf += HEADER_SIZE; Request.type14.mode = L4TOL(buf); - buf += SIZEOFINT; Request.type14.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type14.yomi = (Ushort *)buf; - len = ((int)Request.type14.datalen - SIZEOFSHORT - SIZEOFINT) - / SIZEOFSHORT; -+ if (Request.type14.yomi[len - 1] != 0) -+ return( -1 ); - for (data = Request.type14.yomi, i = 0; i < len; i++, data++) - *data = ntohs( *data ); /* ¤Ê¤ó¤«¤ä¤À */ - -@@ -2577,11 +2651,17 @@ - ProcWideReq15(buf) - BYTE *buf ; - { -+ int rest; - ir_debug( Dmsg(10, "ProcWideReq15 start!!\n") ); - -+ rest = Request.type15.datalen - (SIZEOFINT + SIZEOFSHORT); -+ if (rest <= 0) -+ return( -1 ); - buf += HEADER_SIZE; Request.type15.mode = L4TOL(buf); - buf += SIZEOFINT; Request.type15.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type15.dicname = (char *)buf; -+ if (buf[rest - 1] != 0) -+ return( -1 ); - ir_debug( Dmsg(10, "req->mode =%d\n", Request.type15.mode) ); - ir_debug( Dmsg(10, "req->context =%d\n", Request.type15.context) ); - ir_debug( Dmsg(10, "req->dicname =%s\n", -@@ -2597,6 +2677,9 @@ - ir_debug( Dmsg(10, "ProcWideReq17 start!!\n") ); - - buf += HEADER_SIZE; -+ if (Request.type17.datalen < SIZEOFCHAR * 2 -+ || buf[Request.type17.datalen - SIZEOFCHAR * 2] != 0) -+ return( -1 ); - Request.type17.dicname = (char *)buf; - Request.type17.mode = (char)*(buf + Request.type17.datalen - SIZEOFCHAR) ; - ir_debug( Dmsg(10, "req->dicname =%s\n", -@@ -2613,6 +2696,8 @@ - { - ir_debug( Dmsg(10, "ProcWideReq18 start!!\n") ); - -+ if (Request.type18.datalen < SIZEOFSHORT * 2) -+ return( -1 ); - buf += HEADER_SIZE; Request.type18.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type18.data = (char *)buf; - buf += Request.type18.datalen - SIZEOFSHORT * 2; -@@ -2630,12 +2715,18 @@ - ProcWideReq19(buf) - BYTE *buf ; - { -+ int rest; - ir_debug( Dmsg(10, "ProcWideReq19 start!!\n") ); - -+ rest = Request.type20.datalen - (SIZEOFSHORT + SIZEOFINT * 2); -+ if (rest < 0) -+ return( -1 ); - buf += HEADER_SIZE; Request.type20.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type20.command = L4TOL(buf); - buf += SIZEOFINT; Request.type20.bufsize = L4TOL(buf); - buf += SIZEOFINT; Request.type20.buf = (char *)buf; -+ if (Request.type20.bufsize != rest) -+ return( -1 ); - ir_debug( Dmsg(10, "req->context =%d\n", Request.type20.context) ); - ir_debug( Dmsg(10, "req->command =%d\n", Request.type20.command) ); - ir_debug( Dmsg(10, "req->bufsize =%d\n", Request.type20.bufsize) ); -@@ -2647,15 +2738,25 @@ - ProcWideReq20(buf) - BYTE *buf ; - { -+ BYTE *bufend; - ir_debug( Dmsg(10, "ProcWideReq20 start!!\n") ); - -+ if (Request.type21.datalen < SIZEOFINT + SIZEOFSHORT) -+ return( -1 ); - buf += HEADER_SIZE; Request.type21.mode = L4TOL(buf); -+ bufend = buf + Request.type21.datalen; - buf += SIZEOFINT; Request.type21.context = S2TOS(buf); - buf += SIZEOFSHORT; Request.type21.dirname = (char *)buf; -+ if (!memchr(buf, 0, bufend - buf)) -+ return( -1 ); - buf += strlen((char *)buf) + 1; - Request.type21.srcdic = (char *)buf; -+ if (!memchr(buf, 0, bufend - buf)) -+ return( -1 ); - buf += strlen((char *)buf) + 1; - Request.type21.dstdic = (char *)buf; -+ if (*(bufend - 1) != 0) -+ return( -1 ); - - ir_debug( Dmsg(10, "req->mode =%d\n", Request.type21.mode) ); - ir_debug( Dmsg(10, "req->context =%d\n", Request.type21.context) ); diff --git a/Canna-wconv.patch b/Canna-wconv.patch deleted file mode 100644 index b9e26a2..0000000 --- a/Canna-wconv.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- Canna35b2/server/wconvert.c.orig 2002-11-01 17:21:49.000000000 +0900 -+++ Canna35b2/server/wconvert.c 2002-11-01 17:23:25.000000000 +0900 -@@ -2096,12 +2096,12 @@ - char *buf = (char *)0; - - if (validcontext(cxnum, client, wThrough)) { -- buf = malloc((int)Request.type20.bufsize); -+ content_size = Request.type20.datalen - (SIZEOFINT * 2 + SIZEOFSHORT); -+ buf = malloc(content_size); - if (buf) { -- content_size = Request.type20.datalen - (SIZEOFINT * 2 + SIZEOFSHORT); - bcopy(Request.type20.buf, buf, content_size); - stat = size = RkThrough(cxnum, Request.type20.command, -- buf, content_size, (int)Request.type20.bufsize); -+ buf, content_size, content_size); - } - } - retval = SendType6Reply(client, wThrough, EXTPROTO, stat, buf, size);