main/vsftpd: security fix for CVE-2015-1419

fixes #3906

2 files changed, 112 insertions, 1 deletions

diff --git a/main/vsftpd/APKBUILD b/main/vsftpd/APKBUILD
index ef353ee3e6..06478225d0 100644
--- a/main/vsftpd/APKBUILD
+++ b/main/vsftpd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=vsftpd
 pkgver=3.0.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Very secure ftpd"
 url="http://vsftpd.beasts.org"
 arch="all"
@@ -14,6 +14,7 @@ install="$pkgname.pre-install"
 source="https://security.appspot.com/downloads/vsftpd-${pkgver}.tar.gz
 	vsftpd-enable-ssl.patch
 	vsftpd-gnu-source.patch
+	CVE-2015-1419.patch
 	vsftpd.initd
 	vsftpd.confd"
 
@@ -50,5 +51,18 @@ package() {
 md5sums="8b00c749719089401315bd3c44dddbb2  vsftpd-3.0.2.tar.gz
 f3cbaf364cd3c46a2a03b00de9d7e184  vsftpd-enable-ssl.patch
 f2245efcc271356743805f38d6c5aea3  vsftpd-gnu-source.patch
+9ee92ccdf8e9a7db7e668617dc269def  CVE-2015-1419.patch
 b48784af42b0f787e55276fc20476aa2  vsftpd.initd
 9e495776096c78c3f9d9e6756a8c3003  vsftpd.confd"
+sha256sums="be46f0e2c5528fe021fafc8dab1ecfea0c1f183063a06977f8537fcd0b195e56  vsftpd-3.0.2.tar.gz
+79fa4d1a78d5ec408f02b331c5ecb8dc25f94606f5a9c902624c545154323607  vsftpd-enable-ssl.patch
+9ac07b8bf589a5632403c99c95aa2dd01c9c068c36e303868d08f459b17e0c9b  vsftpd-gnu-source.patch
+fb50d1e24ee65bab005007179b8d128ca84decc93222f790ab3fd6eca5237180  CVE-2015-1419.patch
+78d79b46017accf34d64f02e22d2f1d7bd58c78d8bc5cb6f692c139d285a562a  vsftpd.initd
+5ed45cbe507676fd1252427016047e02b775acfb3dd0f3e44fe61410a8e7a1ba  vsftpd.confd"
+sha512sums="d5b978e07d8b0a623b79a531824666fb9b970ad5989a8c34c21b545b62ba07cde4bfe3d77b40a8b6e92d17890c37cae209231af8f106da3404f6548e217bd023  vsftpd-3.0.2.tar.gz
+7968c77d6eb03caa2b085bd09008c2953ec80e2b8ea836a39103bb7c2e54fba1a241607a118ea8a55d718a9efe46c1f017bcc22fce20ebd8f7e9a71e79b583e9  vsftpd-enable-ssl.patch
+4fbf8bb953dec220ea5dc2f2ecd1f275dae27b24a06b17f437eea493cd94e05e95fd78910a81e7ebf27b84e60251c4db6780d4741da62ecc056a2f78a5a3c3a6  vsftpd-gnu-source.patch
+73023176872a60a60ea72dc370c13617b5113ff9eb8df8f56c4efc709ca9f7752aed4c7e19530927ea6fe9ccb52dbd8ec128ec898cc8177c6d62ad41c4f281f1  CVE-2015-1419.patch
+23c9b66f2463b16d54f9ec5f03134f893692700f269dc9baa57f4659599b2afe04c5b0f302a610deee763656447b50a4ef082fc8551241c399122fc4c1a9431e  vsftpd.initd
+7bd138cf66356db55d00796f99b327e9aedf45a48b6fc9b464801fd17a69949ca1296131513c289b0293d27b29c1add08e601068501591108ed7fb13efeeacf3  vsftpd.confd"
diff --git a/main/vsftpd/CVE-2015-1419.patch b/main/vsftpd/CVE-2015-1419.patch
new file mode 100644
index 0000000000..b0662b4580
--- /dev/null
+++ b/main/vsftpd/CVE-2015-1419.patch
@@ -0,0 +1,97 @@
+Index: vsftpd-3.0.2/ls.c
+===================================================================
+--- vsftpd-3.0.2.orig/ls.c
++++ vsftpd-3.0.2/ls.c
+@@ -7,6 +7,7 @@
+  * Would you believe, code to handle directory listing.
+  */
+ 
++#include <stdlib.h>
+ #include "ls.h"
+ #include "access.h"
+ #include "defs.h"
+@@ -243,11 +244,42 @@ vsf_filename_passes_filter(const struct
+   struct mystr temp_str = INIT_MYSTR;
+   struct mystr brace_list_str = INIT_MYSTR;
+   struct mystr new_filter_str = INIT_MYSTR;
++  struct mystr normalize_filename_str = INIT_MYSTR;
++  const char *normname;
++  const char *path;
+   int ret = 0;
+   char last_token = 0;
+   int must_match_at_current_pos = 1;
++
+   str_copy(&filter_remain_str, p_filter_str);
+-  str_copy(&name_remain_str, p_filename_str);
++
++  /* normalize filepath */
++  path = str_strdup(p_filename_str);
++  normname = realpath(path, NULL);
++  if (normname == NULL)
++     goto out;
++  str_alloc_text(&normalize_filename_str, normname);
++
++  if (!str_isempty (&filter_remain_str) && !str_isempty(&normalize_filename_str)) {
++    if (str_get_char_at(p_filter_str, 0) == '/') {
++      if (str_get_char_at(&normalize_filename_str, 0) != '/') {
++        str_getcwd (&name_remain_str);
++
++        if (str_getlen(&name_remain_str) > 1) /* cwd != root dir */
++          str_append_char (&name_remain_str, '/');
++
++        str_append_str (&name_remain_str, &normalize_filename_str);
++      }
++      else
++       str_copy (&name_remain_str, &normalize_filename_str);
++    } else {
++      if (str_get_char_at(p_filter_str, 0) != '{')
++        str_basename (&name_remain_str, &normalize_filename_str);
++      else
++        str_copy (&name_remain_str, &normalize_filename_str);
++    }
++  } else
++    str_copy(&name_remain_str, &normalize_filename_str);
+ 
+   while (!str_isempty(&filter_remain_str) && *iters < VSFTP_MATCHITERS_MAX)
+   {
+@@ -360,6 +392,9 @@ vsf_filename_passes_filter(const struct
+     ret = 0;
+   }
+ out:
++  free(normname);
++  free(path);
++  str_free(&normalize_filename_str);
+   str_free(&filter_remain_str);
+   str_free(&name_remain_str);
+   str_free(&temp_str);
+Index: vsftpd-3.0.2/str.c
+===================================================================
+--- vsftpd-3.0.2.orig/str.c
++++ vsftpd-3.0.2/str.c
+@@ -770,3 +770,14 @@ str_replace_unprintable(struct mystr* p_
+   }
+ }
+ 
++void
++str_basename (struct mystr* d_str, const struct mystr* path)
++{
++  static struct mystr tmp;
++
++  str_copy (&tmp, path);
++  str_split_char_reverse(&tmp, d_str, '/');
++
++  if (str_isempty(d_str))
++   str_copy (d_str, path);
++}
+Index: vsftpd-3.0.2/str.h
+===================================================================
+--- vsftpd-3.0.2.orig/str.h
++++ vsftpd-3.0.2/str.h
+@@ -101,6 +101,7 @@ void str_replace_unprintable(struct myst
+ int str_atoi(const struct mystr* p_str);
+ filesize_t str_a_to_filesize_t(const struct mystr* p_str);
+ unsigned int str_octal_to_uint(const struct mystr* p_str);
++void str_basename (struct mystr* d_str, const struct mystr* path);
+ 
+ /* PURPOSE: Extract a line of text (delimited by \n or EOF) from a string
+  * buffer, starting at character position 'p_pos'. The extracted line will