Merge lp:~kamalmostafa/ubuntu/lucid/ax25-tools/fix-353219-crash into lp:ubuntu/lucid/ax25-tools

[Kamal Mostafa]

[Iulian Udrea (iulian)]

Looks good. Please let Debian know about this issue as well.

Thank you.

review: Approve

=== modified file 'ax25/beacon.c'
--- ax25/beacon.c	2001-12-22 23:07:26 +0000
+++ ax25/beacon.c	2010-02-02 19:41:13 +0000
@@ -43,7 +43,7 @@
 	struct full_sockaddr_ax25 dest;
 	struct full_sockaddr_ax25 src;
 	int s, n, dlen, len, interval = 30;
-	char addr[20], *port, *message, *portcall;
+	char *addr, *port, *message, *portcall;
 	char *srccall = NULL, *destcall = NULL;
 	
 	while ((n = getopt(argc, argv, "c:d:lmst:v")) != -1) {
@@ -100,27 +100,36 @@
 		return 1;
 	}
 
+	addr = NULL;
 	if (mail)
-		strcpy(addr, "MAIL");
+		addr = strdup("MAIL");
 	else if (destcall != NULL)
-		strcpy(addr, destcall);
+		addr = strdup(destcall);
 	else
-		strcpy(addr, "IDENT");
+		addr = strdup("IDENT");
+	if (addr == NULL)
+	  return 1;
 
 	if ((dlen = ax25_aton(addr, &dest)) == -1) {
 		fprintf(stderr, "beacon: unable to convert callsign '%s'\n", addr);
 		return 1;
 	}
+	if (addr != NULL) free(addr); addr = NULL;
 
-	if (srccall != NULL && strcmp(srccall, portcall) != 0)
+	if (srccall != NULL && strcmp(srccall, portcall) != 0) {
+		if ((addr = (char *) malloc(strlen(srccall) + 1 + strlen(portcall) + 1)) == NULL)
+			return 1;
 		sprintf(addr, "%s %s", srccall, portcall);
-	else
-		strcpy(addr, portcall);
+	} else {
+		if ((addr = strdup(portcall)) == NULL)
+			return 1;
+	}
 
 	if ((len = ax25_aton(addr, &src)) == -1) {
 		fprintf(stderr, "beacon: unable to convert callsign '%s'\n", addr);
 		return 1;
 	}
+	if (addr != NULL) free(addr); addr = NULL;
 
 	if (!single) {
 		if (!daemon_start(FALSE)) {

=== modified file 'debian/changelog'
--- debian/changelog	2009-11-10 10:12:01 +0000
+++ debian/changelog	2010-02-02 19:41:13 +0000
@@ -1,3 +1,12 @@
+ax25-tools (0.0.8-13.1ubuntu1) lucid; urgency=low
+
+  * Fix beacon -d <longstring> crash (LP: #353219):
+    - Cherry-pick fix from upstream ax25_tools_0_0_10_rc1 (www.linux-ax25.org):
+      ax25/beacon.c (CVS rev 1.2): important security fix:
+        char addr[20] was static and strcpy(addr,.argv[n]) of variable length.
+
+ -- Kamal Mostafa <[e-mail]>  Tue, 02 Feb 2010 11:36:32 -0800
+
 ax25-tools (0.0.8-13.1) unstable; urgency=low
 
   * Retiring - remove myself from the uploaders list.

=== modified file 'debian/control'
--- debian/control	2009-11-10 10:12:01 +0000
+++ debian/control	2010-02-02 19:41:13 +0000
@@ -1,7 +1,8 @@
 Source: ax25-tools
 Section: hamradio
 Priority: extra
-Maintainer: Debian Hamradio Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Hamradio Maintainers <[e-mail]>
 Uploaders: Jaime Robles <[e-mail]>, Patrick Ouellette <[e-mail]>, Hamish Moffatt <[e-mail]>, Ramakrishnan Muthukrishnan <[e-mail]>
 Build-Depends: debhelper (>> 4) , libncurses5-dev, zlib1g-dev, libfltk1.1-dev (>= 1.1.2-2), libxext-dev, libx11-dev, libax25-dev, libxt-dev
 Standards-Version: 3.7.3