From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: cracklib: Fix buffer overflow Date: Tue, 10 Jan 2017 15:33:31 -0500 Message-ID: <20170110203331.GA9807@jasmine> References: <20160915153646.GA31020@jasmine> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="lrZ03NoBR/3+SXJZ" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:34641) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cR374-0002KY-LD for guix-devel@gnu.org; Tue, 10 Jan 2017 15:33:47 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cR36z-00016S-Na for guix-devel@gnu.org; Tue, 10 Jan 2017 15:33:46 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:60596) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cR36z-00015O-Ha for guix-devel@gnu.org; Tue, 10 Jan 2017 15:33:41 -0500 Received: from localhost (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 2CC307E8D9 for ; Tue, 10 Jan 2017 15:33:38 -0500 (EST) Content-Disposition: inline In-Reply-To: <20160915153646.GA31020@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org --lrZ03NoBR/3+SXJZ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Sep 15, 2016 at 11:36:46AM -0400, Leo Famulari wrote: > This patch cherry-picks an upstream commit to fix a buffer overflow in > cracklib. Please see the patch file for more information about the bug. > From 62f8f1763ba1766e92e8dc05686bd9353eaf2ad5 Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Thu, 15 Sep 2016 11:34:49 -0400 > Subject: [PATCH] gnu: cracklib: Fix buffer overflow. >=20 > * gnu/packages/patches/cracklib-fix-buffer-overflow.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/password-utils.scm (cracklib)[source]: Use it. I forgot about this patch. Debian applied it: https://anonscm.debian.org/cgit/pkg-cracklib/pkg-cracklib.git/tree/debian/p= atches/overflow-processing-long-words.patch I'll push it today if I hear no objections. --lrZ03NoBR/3+SXJZ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlh1RRsACgkQJkb6MLrK fwgA7BAA2lOLKDplKwk1DBSf7MF+vSwng7uNuZoEWg4Hdr3bKeggGKGeSzncld9l 9JYGiXTwmUT+fQfNY68Gd8nQSdRnTBLfoSnCO4tu0OSywgQ5WdnEVWF6be9uOCil nxnc9x3SvN9u5AlS6TAxMTpZWCBYeRWf/nKuJDExfMsi06jKd3eM0b5zIKcRIrvS 6aMvbERXXCHda5h+wQN7zmz8Kw1fPEUsQwadkZtcWGkDHp08mUeyMhu6RW+4p+Kh rGm6QZe+lxNNrC9m62kXBLRw2cxmS3Do+svVO3/bT2M0wtd3NPP1A0c0Dj9c7xBO wfYjUj+LPIX+PqC3U462CN1rt8yU7t0lo7JUdBiZxURA8nyJ73r64oggKAIGI2NP ea0YUlWRSa5XN5lJ9QTou3OsjjqrPe9sOiaQ2iUrkRzOAZGGHdB9qRMxc8ERJ14U ojvUhzg5POYq6pFbejBLh0x+wHrZyX25ZAEtoaBHuIDt2zQDtuY/r4EfoVkIzQfC 45SVYZHqAhoeteu+/RXUd6lrTtF83lzSh4kiR+YPfKAt7tmv+EXmMwHI0HqurtfD jAAXgKCCXMgxxBE5rukk++81sCR644+Z/MyWOStUGZJCP/QZugCCLkpGDXwNmBU6 qIix6CQd9jlcupqker8CKnUOHDjdHtpv00eIJh8TyW4oNcmKkG4= =+W9b -----END PGP SIGNATURE----- --lrZ03NoBR/3+SXJZ--