|
|
@@ -1,122 +0,0 @@
|
|
|
-Security Fix
|
|
|
-
|
|
|
-Index: libneon/ne_207.c
|
|
|
---- libneon/ne_207.c.orig 2003-07-23 23:48:21.000000000 +0200
|
|
|
-+++ libneon/ne_207.c 2004-04-16 18:26:08.000000000 +0200
|
|
|
-@@ -320,12 +320,12 @@
|
|
|
- if (ne_get_status(req)->code == 207) {
|
|
|
- if (!ne_xml_valid(p)) {
|
|
|
- /* The parse was invalid */
|
|
|
-- ne_set_error(sess, ne_xml_get_error(p));
|
|
|
-+ ne_set_error(sess, "%s", ne_xml_get_error(p));
|
|
|
- ret = NE_ERROR;
|
|
|
- } else if (ctx.is_error) {
|
|
|
- /* If we've actually got any error information
|
|
|
- * from the 207, then set that as the error */
|
|
|
-- ne_set_error(sess, ctx.buf->data);
|
|
|
-+ ne_set_error(sess, "%s", ctx.buf->data);
|
|
|
- ret = NE_ERROR;
|
|
|
- }
|
|
|
- } else if (ne_get_status(req)->klass != 2) {
|
|
|
-Index: libneon/ne_auth.c
|
|
|
---- libneon/ne_auth.c.orig 2003-07-24 00:16:18.000000000 +0200
|
|
|
-+++ libneon/ne_auth.c 2004-04-16 18:26:08.000000000 +0200
|
|
|
-@@ -1062,7 +1062,7 @@
|
|
|
- if (areq->auth_info_hdr != NULL &&
|
|
|
- verify_response(areq, sess, areq->auth_info_hdr)) {
|
|
|
- NE_DEBUG(NE_DBG_HTTPAUTH, "Response authentication invalid.\n");
|
|
|
-- ne_set_error(sess->sess, _(sess->spec->fail_msg));
|
|
|
-+ ne_set_error(sess->sess, "%s", _(sess->spec->fail_msg));
|
|
|
- ret = NE_ERROR;
|
|
|
- } else if (status->code == sess->spec->status_code &&
|
|
|
- areq->auth_hdr != NULL) {
|
|
|
-Index: libneon/ne_locks.c
|
|
|
---- libneon/ne_locks.c.orig 2003-06-19 00:10:58.000000000 +0200
|
|
|
-+++ libneon/ne_locks.c 2004-04-16 18:26:08.000000000 +0200
|
|
|
-@@ -734,7 +734,7 @@
|
|
|
- }
|
|
|
- else if (parse_failed) {
|
|
|
- ret = NE_ERROR;
|
|
|
-- ne_set_error(sess, ne_xml_get_error(parser));
|
|
|
-+ ne_set_error(sess, "%s", ne_xml_get_error(parser));
|
|
|
- }
|
|
|
- else if (ne_get_status(req)->code == 207) {
|
|
|
- ret = NE_ERROR;
|
|
|
-@@ -802,7 +802,7 @@
|
|
|
- if (ret == NE_OK && ne_get_status(req)->klass == 2) {
|
|
|
- if (parse_failed) {
|
|
|
- ret = NE_ERROR;
|
|
|
-- ne_set_error(sess, ne_xml_get_error(parser));
|
|
|
-+ ne_set_error(sess, "%s", ne_xml_get_error(parser));
|
|
|
- }
|
|
|
- else if (ne_get_status(req)->code == 207) {
|
|
|
- ret = NE_ERROR;
|
|
|
-Index: libneon/ne_props.c
|
|
|
---- libneon/ne_props.c.orig 2003-06-19 00:10:58.000000000 +0200
|
|
|
-+++ libneon/ne_props.c 2004-04-16 18:26:08.000000000 +0200
|
|
|
-@@ -142,7 +142,7 @@
|
|
|
- if (ret == NE_OK && ne_get_status(req)->klass != 2) {
|
|
|
- ret = NE_ERROR;
|
|
|
- } else if (!ne_xml_valid(handler->parser)) {
|
|
|
-- ne_set_error(handler->sess, ne_xml_get_error(handler->parser));
|
|
|
-+ ne_set_error(handler->sess, "%s", ne_xml_get_error(handler->parser));
|
|
|
- ret = NE_ERROR;
|
|
|
- }
|
|
|
-
|
|
|
-Index: libneon/ne_xml.c
|
|
|
---- libneon/ne_xml.c.orig 2003-05-10 18:05:59.000000000 +0200
|
|
|
-+++ libneon/ne_xml.c 2004-04-16 18:26:08.000000000 +0200
|
|
|
-@@ -538,7 +538,7 @@
|
|
|
-
|
|
|
- void ne_xml_set_error(ne_xml_parser *p, const char *msg)
|
|
|
- {
|
|
|
-- ne_snprintf(p->error, ERR_SIZE, msg);
|
|
|
-+ ne_snprintf(p->error, ERR_SIZE, "%s", msg);
|
|
|
- }
|
|
|
-
|
|
|
- #ifdef HAVE_LIBXML
|
|
|
-
|
|
|
------------------------------------------------------------------------------
|
|
|
-
|
|
|
-Security Fix
|
|
|
-OpenPKG-SA-2004.024-neon, CAN-2004-0398
|
|
|
-
|
|
|
-Index: libneon/ne_dates.c
|
|
|
---- libneon/ne_dates.c.orig 2003-04-07 21:01:46.000000000 +0200
|
|
|
-+++ libneon/ne_dates.c 2004-05-19 21:55:14.000000000 +0200
|
|
|
-@@ -47,7 +47,7 @@
|
|
|
- /* RFC1123: Sun, 06 Nov 1994 08:49:37 GMT */
|
|
|
- #define RFC1123_FORMAT "%3s, %02d %3s %4d %02d:%02d:%02d GMT"
|
|
|
- /* RFC850: Sunday, 06-Nov-94 08:49:37 GMT */
|
|
|
--#define RFC1036_FORMAT "%s %2d-%3s-%2d %2d:%2d:%2d GMT"
|
|
|
-+#define RFC1036_FORMAT "%10s %2d-%3s-%2d %2d:%2d:%2d GMT"
|
|
|
- /* asctime: Wed Jun 30 21:49:08 1993 */
|
|
|
- #define ASCTIME_FORMAT "%3s %3s %2d %2d:%2d:%2d %4d"
|
|
|
-
|
|
|
-@@ -133,7 +133,7 @@
|
|
|
- time_t ne_rfc1123_parse(const char *date)
|
|
|
- {
|
|
|
- struct tm gmt = {0};
|
|
|
-- static char wkday[4], mon[4];
|
|
|
-+ char wkday[4], mon[4];
|
|
|
- int n;
|
|
|
- /* it goes: Sun, 06 Nov 1994 08:49:37 GMT */
|
|
|
- n = sscanf(date, RFC1123_FORMAT,
|
|
|
-@@ -156,7 +156,7 @@
|
|
|
- {
|
|
|
- struct tm gmt = {0};
|
|
|
- int n;
|
|
|
-- static char wkday[10], mon[4];
|
|
|
-+ char wkday[11], mon[4];
|
|
|
- /* RFC850/1036 style dates: Sunday, 06-Nov-94 08:49:37 GMT */
|
|
|
- n = sscanf(date, RFC1036_FORMAT,
|
|
|
- wkday, &gmt.tm_mday, mon, &gmt.tm_year,
|
|
|
-@@ -189,7 +189,7 @@
|
|
|
- {
|
|
|
- struct tm gmt = {0};
|
|
|
- int n;
|
|
|
-- static char wkday[4], mon[4];
|
|
|
-+ char wkday[4], mon[4];
|
|
|
- n = sscanf(date, ASCTIME_FORMAT,
|
|
|
- wkday, mon, &gmt.tm_mday,
|
|
|
- &gmt.tm_hour, &gmt.tm_min, &gmt.tm_sec,
|