summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Hammer <mueli@gentoo.org>2010-01-14 09:12:32 +0000
committerMichael Hammer <mueli@gentoo.org>2010-01-14 09:12:32 +0000
commit078e02e987eaf8b600dd913e180501e5dfdad6fa (patch)
tree9d2f0a650f4364026cb96c54dc88a5441e6ff55b /app-crypt
parentVersion Bump. (diff)
downloadhistorical-078e02e987eaf8b600dd913e180501e5dfdad6fa.tar.gz
historical-078e02e987eaf8b600dd913e180501e5dfdad6fa.tar.bz2
historical-078e02e987eaf8b600dd913e180501e5dfdad6fa.zip
added new revision to fix CVE-2009-4212
Package-Manager: portage-2.1.6.13/cvs/Linux x86_64
Diffstat (limited to 'app-crypt')
-rw-r--r--app-crypt/mit-krb5/ChangeLog10
-rw-r--r--app-crypt/mit-krb5/Manifest7
-rw-r--r--app-crypt/mit-krb5/files/1.6-CVE-2009-4212.patch268
-rw-r--r--app-crypt/mit-krb5/files/1.7-CVE-2009-4212.patch377
-rw-r--r--app-crypt/mit-krb5/mit-krb5-1.6.3-r7.ebuild109
-rw-r--r--app-crypt/mit-krb5/mit-krb5-1.7-r2.ebuild (renamed from app-crypt/mit-krb5/mit-krb5-1.7-r1.ebuild)3
6 files changed, 770 insertions, 4 deletions
diff --git a/app-crypt/mit-krb5/ChangeLog b/app-crypt/mit-krb5/ChangeLog
index c91457c58a36..4cabfa2e17bc 100644
--- a/app-crypt/mit-krb5/ChangeLog
+++ b/app-crypt/mit-krb5/ChangeLog
@@ -1,6 +1,14 @@
# ChangeLog for app-crypt/mit-krb5
# Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-crypt/mit-krb5/ChangeLog,v 1.214 2010/01/12 09:51:25 mueli Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-crypt/mit-krb5/ChangeLog,v 1.215 2010/01/14 09:12:31 mueli Exp $
+
+*mit-krb5-1.7-r2 (14 Jan 2010)
+*mit-krb5-1.6.3-r7 (14 Jan 2010)
+
+ 14 Jan 2010; Michael Hammer <mueli@gentoo.org> +mit-krb5-1.6.3-r7.ebuild,
+ -mit-krb5-1.7-r1.ebuild, +mit-krb5-1.7-r2.ebuild,
+ +files/1.6-CVE-2009-4212.patch, +files/1.7-CVE-2009-4212.patch:
+ added new revision to fix CVE-2009-4212
12 Jan 2010; Michael Hammer <mueli@gentoo.org> mit-krb5-1.7-r1.ebuild:
fixed bug 300574
diff --git a/app-crypt/mit-krb5/Manifest b/app-crypt/mit-krb5/Manifest
index a6a0542ceae2..e53647f25f3b 100644
--- a/app-crypt/mit-krb5/Manifest
+++ b/app-crypt/mit-krb5/Manifest
@@ -1,4 +1,6 @@
+AUX 1.6-CVE-2009-4212.patch 9565 RMD160 b7c67745305d80a70d8c1247a8448df3175a69c2 SHA1 5c18a4a4fc2a6289b3d52683c7eef7824168899e SHA256 c3b36f5ddc0fb7451055908781dfea3b43c6953032936883d5f5c0a8d7d98c53
AUX 1.6-MITKRB5-SA-2008-001.patch 11080 RMD160 12415f2329536352cd4d4aaa340951771b1e5114 SHA1 0cc2549ab6fd44180b3cdf4327efeaa6fe43b6e2 SHA256 0af6931dd33d9a2622714de3e06e68dde0d6e9215d9b08c478a441ce7fb6d7a6
+AUX 1.7-CVE-2009-4212.patch 13085 RMD160 98b9d7adab15a198cf6380458e9960e41385f2f9 SHA1 627c85e8764717248d5d86f70a1eb1a649035ef9 SHA256 c64a28f4fc9c7db2f0f98efea401b6e36d196f90d20f435b19c60259c348693b
AUX CVE-2009-0844+CVE-2009-0847.patch 2075 RMD160 eba543da0eafa13158a71947bf22783292d23951 SHA1 087e0dfcdff3dd08b9085fda47099c438871488d SHA256 abdff5ffb07b57d6156722ea6ee12a73ae3337ff05687e384a59989074ab4316
AUX CVE-2009-0846.patch 1682 RMD160 80292c97735b2e45eb450d2c8f6c30e6b0dbf199 SHA1 4bde9e943f4604bfde41cb91f923c123716add71 SHA256 71914affe6f8623b44f3b8ac9c98a83783e41200f8965ea5d68e7fb8a4bc3088
AUX MITKRB5-SA-2008-002.patch 1505 RMD160 35bb24ae802b532836810588e13c775ef8522cc1 SHA1 70fb0d83da33eb3e00355a11894c37f7c9d2b9aa SHA256 8e84a55080461f117f61501550c364f9ac25d9079601281a0d413bff664fc386
@@ -10,6 +12,7 @@ DIST krb5-1.7-signed.tar 12226560 RMD160 1fe0efd07bb525620e821a7b3a98cafd416d017
DIST mit-krb5-1.6.3-patches-0.5.tar.bz2 5317 RMD160 423c728e6f399fb4605373495a36480147a35e8c SHA1 ec3327acc45ce29cfd4179adf23fbde52eefb774 SHA256 46538d6b59d6fd1756b9ed0f3002886578a90cf5366e2be1d6fd0ffffeea7d3e
DIST mit-krb5-1.7-patches-0.6.tar.bz2 707 RMD160 8849cc7c663cd1cfed35af9647197af8ce214a0e SHA1 056834d3068e04e8d636d242d38ae580bebb7cd5 SHA256 ea66d5a10fbb30adeaef9de73d77a7a034cc2ff1dcc82aa52bde21b370c574f6
EBUILD mit-krb5-1.6.3-r6.ebuild 2816 RMD160 d9207dc3a1d6aa54eaad45c04092704631743b43 SHA1 436537036eabe1f3eeff5ab28d7b37c63e12353f SHA256 00b60f4ef14978fc41a60cee257f7b2e2265ffc5a7c754fe075ff0c1dcbb35d0
-EBUILD mit-krb5-1.7-r1.ebuild 2598 RMD160 55c1481305bc54a48248c313b88fb4c80a605475 SHA1 5e64b2b240a17f7763375d8045a13e9c5f16dccb SHA256 b3e674bf38355d8836e985e5cb2547fca259ea367d00b00ce4c868aeee924aab
-MISC ChangeLog 34660 RMD160 7eba42b9ed33b69b802b8076e2754c76ca628c7c SHA1 443a103a3ae48b2868e7d1ca12bb4cd2f7e24380 SHA256 45fcdf4c3774001a06f05b49f76ab9ec6194f3ff40da196eb0bbf859a3d2b5f7
+EBUILD mit-krb5-1.6.3-r7.ebuild 2874 RMD160 e9ad37cd27b80b94296226c279431a58dd8d799e SHA1 2706e5949d6d5a32734aa63988c74b2f9b324239 SHA256 c4ca4f284cf02a6e11bde53f39a550af444c75de7ea3f9a131ad40aa41c29f78
+EBUILD mit-krb5-1.7-r2.ebuild 2644 RMD160 44ca6704cff27f8a18d2769af001972bbe87cc45 SHA1 40b2d880d86a70e5b4b6dccb84eee95856284f21 SHA256 e61f5835d96fafb5fe99fa5e42eb5e069f4f5b6927ac069744e89855e56925d5
+MISC ChangeLog 34962 RMD160 b64c1bd0c3ca530b7259a96d57df99be0cede752 SHA1 49921d0124608ab37e1fe058dcc84694a6ff5d5b SHA256 5216d30c509d9bc60884a04447e7497718ea74eace4728bb28e72d20d838ed01
MISC metadata.xml 639 RMD160 5e0f0a281fd7c2db9cef027d510f4f65fe769e2e SHA1 5ff055ed4d8a80384cba07293c41dd10983d2792 SHA256 fe666e55cb89f0dda7aa81fefe167f1cf2934053c83f1ee147781c34b7f28595
diff --git a/app-crypt/mit-krb5/files/1.6-CVE-2009-4212.patch b/app-crypt/mit-krb5/files/1.6-CVE-2009-4212.patch
new file mode 100644
index 000000000000..7ed2e9967e2d
--- /dev/null
+++ b/app-crypt/mit-krb5/files/1.6-CVE-2009-4212.patch
@@ -0,0 +1,268 @@
+Index: src/lib/crypto/Makefile.in
+===================================================================
+--- src/lib/crypto/Makefile.in (revision 23398)
++++ src/lib/crypto/Makefile.in (working copy)
+@@ -22,6 +22,7 @@
+ $(srcdir)/t_hmac.c \
+ $(srcdir)/t_pkcs5.c \
+ $(srcdir)/t_cts.c \
++ $(srcdir)/t_short.c \
+ $(srcdir)/vectors.c
+
+ ##DOSBUILDTOP = ..\..
+@@ -184,12 +185,13 @@
+
+ clean-unix:: clean-liblinks clean-libs clean-libobjs
+
+-check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac t_pkcs5
++check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac t_pkcs5 t_short
+ $(RUN_SETUP) $(VALGRIND) ./t_nfold
+ $(RUN_SETUP) $(VALGRIND) ./t_encrypt
+ $(RUN_SETUP) $(VALGRIND) ./t_prng <$(srcdir)/t_prng.seed >t_prng.output && \
+ diff t_prng.output $(srcdir)/t_prng.expected
+ $(RUN_SETUP) $(VALGRIND) ./t_hmac
++ $(RUN_SETUP) $(VALGRIND) ./t_short
+
+ # $(RUN_SETUP) $(VALGRIND) ./t_pkcs5
+
+@@ -218,10 +220,14 @@
+ $(CC_LINK) -o $@ t_cts.$(OBJEXT) \
+ $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB)
+
++t_short$(EXEEXT): t_short.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPORT_DEPLIB)
++ $(CC_LINK) -o $@ t_short.$(OBJEXT) \
++ $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB)
+
+ clean::
+ $(RM) t_nfold.o t_nfold t_encrypt t_encrypt.o t_prng.o t_prng \
+- t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o
++ t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o \
++ t_short t_short.o
+ -$(RM) t_prng.output
+
+ all-windows::
+@@ -761,6 +767,15 @@
+ $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
+ $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+ $(srcdir)/hash_provider/hash_provider.h t_cts.c
++t_short.so t_short.po $(OUTPRE)t_short.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
++ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
++ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h \
++ $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
++ $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
++ $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
++ $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
++ $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
++ t_short.c
+ vectors.so vectors.po $(OUTPRE)vectors.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h \
+Index: src/lib/crypto/arcfour/arcfour.c
+===================================================================
+--- src/lib/crypto/arcfour/arcfour.c (revision 23398)
++++ src/lib/crypto/arcfour/arcfour.c (working copy)
+@@ -203,6 +203,12 @@
+ keylength = enc->keylength;
+ hashsize = hash->hashsize;
+
++ /* Verify input and output lengths. */
++ if (input->length < hashsize + CONFOUNDERLENGTH)
++ return KRB5_BAD_MSIZE;
++ if (output->length < input->length - hashsize - CONFOUNDERLENGTH)
++ return KRB5_BAD_MSIZE;
++
+ d1.length=keybytes;
+ d1.data=malloc(d1.length);
+ if (d1.data == NULL)
+Index: src/lib/crypto/enc_provider/aes.c
+===================================================================
+--- src/lib/crypto/enc_provider/aes.c (revision 23398)
++++ src/lib/crypto/enc_provider/aes.c (working copy)
+@@ -94,9 +94,11 @@
+ nblocks = (input->length + BLOCK_SIZE - 1) / BLOCK_SIZE;
+
+ if (nblocks == 1) {
+- /* XXX Used for DK function. */
++ /* Used when deriving keys. */
++ if (input->length < BLOCK_SIZE)
++ return KRB5_BAD_MSIZE;
+ enc(output->data, input->data, &ctx);
+- } else {
++ } else if (nblocks > 1) {
+ unsigned int nleft;
+
+ for (blockno = 0; blockno < nblocks - 2; blockno++) {
+@@ -149,9 +151,9 @@
+
+ if (nblocks == 1) {
+ if (input->length < BLOCK_SIZE)
+- abort();
++ return KRB5_BAD_MSIZE;
+ dec(output->data, input->data, &ctx);
+- } else {
++ } else if (nblocks > 1) {
+
+ for (blockno = 0; blockno < nblocks - 2; blockno++) {
+ dec(tmp2, input->data + blockno * BLOCK_SIZE, &ctx);
+Index: src/lib/crypto/dk/dk_decrypt.c
+===================================================================
+--- src/lib/crypto/dk/dk_decrypt.c (revision 23398)
++++ src/lib/crypto/dk/dk_decrypt.c (working copy)
+@@ -89,6 +89,12 @@
+ else if (hmacsize > hashsize)
+ return KRB5KRB_AP_ERR_BAD_INTEGRITY;
+
++ /* Verify input and output lengths. */
++ if (input->length < blocksize + hmacsize)
++ return KRB5_BAD_MSIZE;
++ if (output->length < input->length - blocksize - hmacsize)
++ return KRB5_BAD_MSIZE;
++
+ enclen = input->length - hmacsize;
+
+ if ((kedata = (unsigned char *) malloc(keylength)) == NULL)
+Index: src/lib/crypto/raw/raw_decrypt.c
+===================================================================
+--- src/lib/crypto/raw/raw_decrypt.c (revision 23398)
++++ src/lib/crypto/raw/raw_decrypt.c (working copy)
+@@ -34,5 +34,7 @@
+ const krb5_data *ivec, const krb5_data *input,
+ krb5_data *output)
+ {
++ if (output->length < input->length)
++ return KRB5_BAD_MSIZE;
+ return((*(enc->decrypt))(key, ivec, input, output));
+ }
+Index: src/lib/crypto/t_short.c
+===================================================================
+--- src/lib/crypto/t_short.c (revision 0)
++++ src/lib/crypto/t_short.c (revision 0)
+@@ -0,0 +1,112 @@
++/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
++/*
++ * lib/crypto/crypto_tests/t_short.c
++ *
++ * Copyright (C) 2009 by the Massachusetts Institute of Technology.
++ * All rights reserved.
++ *
++ * Export of this software from the United States of America may
++ * require a specific license from the United States Government.
++ * It is the responsibility of any person or organization contemplating
++ * export to obtain such a license before exporting.
++ *
++ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
++ * distribute this software and its documentation for any purpose and
++ * without fee is hereby granted, provided that the above copyright
++ * notice appear in all copies and that both that copyright notice and
++ * this permission notice appear in supporting documentation, and that
++ * the name of M.I.T. not be used in advertising or publicity pertaining
++ * to distribution of the software without specific, written prior
++ * permission. Furthermore if you modify this software you must label
++ * your software as modified software and not distribute it in such a
++ * fashion that it might be confused with the original M.I.T. software.
++ * M.I.T. makes no representations about the suitability of
++ * this software for any purpose. It is provided "as is" without express
++ * or implied warranty.
++ *
++ * Tests the outcome of decrypting overly short tokens. This program can be
++ * run under a tool like valgrind to detect bad memory accesses; when run
++ * normally by the test suite, it verifies that each operation returns
++ * KRB5_BAD_MSIZE.
++ */
++
++#include "k5-int.h"
++
++krb5_enctype interesting_enctypes[] = {
++ ENCTYPE_DES_CBC_CRC,
++ ENCTYPE_DES_CBC_MD4,
++ ENCTYPE_DES_CBC_MD5,
++ ENCTYPE_DES3_CBC_SHA1,
++ ENCTYPE_ARCFOUR_HMAC,
++ ENCTYPE_ARCFOUR_HMAC_EXP,
++ ENCTYPE_AES256_CTS_HMAC_SHA1_96,
++ ENCTYPE_AES128_CTS_HMAC_SHA1_96,
++ 0
++};
++
++/* Abort if an operation unexpectedly fails. */
++static void
++x(krb5_error_code code)
++{
++ if (code != 0)
++ abort();
++}
++
++/* Abort if a decrypt operation doesn't have the expected result. */
++static void
++check_decrypt_result(krb5_error_code code, size_t len, size_t min_len)
++{
++ if (len < min_len) {
++ /* Undersized tokens should always result in BAD_MSIZE. */
++ if (code != KRB5_BAD_MSIZE)
++ abort();
++ } else {
++ /* Min-size tokens should succeed or fail the integrity check. */
++ if (code != 0 && code != KRB5KRB_AP_ERR_BAD_INTEGRITY)
++ abort();
++ }
++}
++
++static void
++test_enctype(krb5_enctype enctype)
++{
++ krb5_error_code ret;
++ krb5_keyblock keyblock;
++ krb5_enc_data input;
++ krb5_data output;
++ size_t min_len, len;
++
++ printf("Testing enctype %d\n", (int) enctype);
++ x(krb5_c_encrypt_length(NULL, enctype, 0, &min_len));
++ x(krb5_c_make_random_key(NULL, enctype, &keyblock));
++ input.enctype = enctype;
++
++ /* Try each length up to the minimum length. */
++ for (len = 0; len <= min_len; len++) {
++ input.ciphertext.data = calloc(len, 1);
++ input.ciphertext.length = len;
++ output.data = calloc(len, 1);
++ output.length = len;
++
++ /* Attempt a normal decryption. */
++ ret = krb5_c_decrypt(NULL, &keyblock, 0, NULL, &input, &output);
++ check_decrypt_result(ret, len, min_len);
++
++ free(input.ciphertext.data);
++ free(output.data);
++ }
++}
++
++int
++main(int argc, char **argv)
++{
++ int i;
++ krb5_data notrandom;
++
++ notrandom.data = "notrandom";
++ notrandom.length = 9;
++ krb5_c_random_seed(NULL, &notrandom);
++ for (i = 0; interesting_enctypes[i]; i++)
++ test_enctype(interesting_enctypes[i]);
++ return 0;
++}
+Index: src/lib/crypto/old/old_decrypt.c
+===================================================================
+--- src/lib/crypto/old/old_decrypt.c (revision 23398)
++++ src/lib/crypto/old/old_decrypt.c (working copy)
+@@ -45,8 +45,10 @@
+ blocksize = enc->block_size;
+ hashsize = hash->hashsize;
+
++ /* Verify input and output lengths. */
++ if (input->length < blocksize + hashsize || input->length % blocksize != 0)
++ return(KRB5_BAD_MSIZE);
+ plainsize = input->length - blocksize - hashsize;
+-
+ if (arg_output->length < plainsize)
+ return(KRB5_BAD_MSIZE);
+
diff --git a/app-crypt/mit-krb5/files/1.7-CVE-2009-4212.patch b/app-crypt/mit-krb5/files/1.7-CVE-2009-4212.patch
new file mode 100644
index 000000000000..df2edcade240
--- /dev/null
+++ b/app-crypt/mit-krb5/files/1.7-CVE-2009-4212.patch
@@ -0,0 +1,377 @@
+Index: src/lib/crypto/Makefile.in
+===================================================================
+--- src/lib/crypto/Makefile.in (revision 23398)
++++ src/lib/crypto/Makefile.in (working copy)
+@@ -18,6 +18,7 @@
+ $(srcdir)/t_nfold.c \
+ $(srcdir)/t_cf2.c \
+ $(srcdir)/t_encrypt.c \
++ $(srcdir)/t_short.c \
+ $(srcdir)/t_prf.c \
+ $(srcdir)/t_prng.c \
+ $(srcdir)/t_hmac.c \
+@@ -206,7 +207,7 @@
+
+ clean-unix:: clean-liblinks clean-libs clean-libobjs
+
+-check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac t_pkcs5 t_cf2
++check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac t_pkcs5 t_cf2 t_short
+ $(RUN_SETUP) $(VALGRIND) ./t_nfold
+ $(RUN_SETUP) $(VALGRIND) ./t_encrypt
+ $(RUN_SETUP) $(VALGRIND) ./t_prng <$(srcdir)/t_prng.seed >t_prng.output && \
+@@ -216,6 +217,7 @@
+ diff t_prf.output $(srcdir)/t_prf.expected
+ $(RUN_SETUP) $(VALGRIND) ./t_cf2 <$(srcdir)/t_cf2.in >t_cf2.output
+ diff t_cf2.output $(srcdir)/t_cf2.expected
++ $(RUN_SETUP) $(VALGRIND) ./t_short
+
+
+ # $(RUN_SETUP) $(VALGRIND) ./t_pkcs5
+@@ -249,10 +251,15 @@
+ $(CC_LINK) -o $@ t_cts.$(OBJEXT) \
+ $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB)
+
++t_short$(EXEEXT): t_short.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPORT_DEPLIB)
++ $(CC_LINK) -o $@ t_short.$(OBJEXT) \
++ $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB)
+
++
+ clean::
+ $(RM) t_nfold.o t_nfold t_encrypt t_encrypt.o t_prng.o t_prng \
+- t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o t_cf2 t_cf2.o
++ t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o \
++ t_cf2 t_cf2.o t_short t_short.o
+ -$(RM) t_prng.output
+
+ all-windows::
+Index: src/lib/crypto/arcfour/arcfour.c
+===================================================================
+--- src/lib/crypto/arcfour/arcfour.c (revision 23398)
++++ src/lib/crypto/arcfour/arcfour.c (working copy)
+@@ -199,6 +199,12 @@
+ keylength = enc->keylength;
+ hashsize = hash->hashsize;
+
++ /* Verify input and output lengths. */
++ if (input->length < hashsize + CONFOUNDERLENGTH)
++ return KRB5_BAD_MSIZE;
++ if (output->length < input->length - hashsize - CONFOUNDERLENGTH)
++ return KRB5_BAD_MSIZE;
++
+ d1.length=keybytes;
+ d1.data=malloc(d1.length);
+ if (d1.data == NULL)
+Index: src/lib/crypto/enc_provider/aes.c
+===================================================================
+--- src/lib/crypto/enc_provider/aes.c (revision 23398)
++++ src/lib/crypto/enc_provider/aes.c (working copy)
+@@ -105,9 +105,11 @@
+ nblocks = (input->length + BLOCK_SIZE - 1) / BLOCK_SIZE;
+
+ if (nblocks == 1) {
+- /* XXX Used for DK function. */
++ /* Used when deriving keys. */
++ if (input->length < BLOCK_SIZE)
++ return KRB5_BAD_MSIZE;
+ enc(output->data, input->data, &ctx);
+- } else {
++ } else if (nblocks > 1) {
+ unsigned int nleft;
+
+ for (blockno = 0; blockno < nblocks - 2; blockno++) {
+@@ -160,9 +162,9 @@
+
+ if (nblocks == 1) {
+ if (input->length < BLOCK_SIZE)
+- abort();
++ return KRB5_BAD_MSIZE;
+ dec(output->data, input->data, &ctx);
+- } else {
++ } else if (nblocks > 1) {
+
+ for (blockno = 0; blockno < nblocks - 2; blockno++) {
+ dec(tmp2, input->data + blockno * BLOCK_SIZE, &ctx);
+@@ -208,6 +210,7 @@
+ char tmp[BLOCK_SIZE], tmp2[BLOCK_SIZE];
+ int nblocks = 0, blockno;
+ size_t input_length, i;
++ struct iov_block_state input_pos, output_pos;
+
+ if (aes_enc_key(key->contents, key->length, &ctx) != aes_good)
+ abort();
+@@ -224,18 +227,20 @@
+ input_length += iov->data.length;
+ }
+
++ IOV_BLOCK_STATE_INIT(&input_pos);
++ IOV_BLOCK_STATE_INIT(&output_pos);
++
+ nblocks = (input_length + BLOCK_SIZE - 1) / BLOCK_SIZE;
+-
+- assert(nblocks > 1);
+-
+- {
++ if (nblocks == 1) {
++ krb5int_c_iov_get_block((unsigned char *)tmp, BLOCK_SIZE,
++ data, num_data, &input_pos);
++ enc(tmp2, tmp, &ctx);
++ krb5int_c_iov_put_block(data, num_data, (unsigned char *)tmp2,
++ BLOCK_SIZE, &output_pos);
++ } else if (nblocks > 1) {
+ char blockN2[BLOCK_SIZE]; /* second last */
+ char blockN1[BLOCK_SIZE]; /* last block */
+- struct iov_block_state input_pos, output_pos;
+
+- IOV_BLOCK_STATE_INIT(&input_pos);
+- IOV_BLOCK_STATE_INIT(&output_pos);
+-
+ for (blockno = 0; blockno < nblocks - 2; blockno++) {
+ char blockN[BLOCK_SIZE];
+
+@@ -288,6 +293,7 @@
+ char tmp[BLOCK_SIZE], tmp2[BLOCK_SIZE], tmp3[BLOCK_SIZE];
+ int nblocks = 0, blockno, i;
+ size_t input_length;
++ struct iov_block_state input_pos, output_pos;
+
+ CHECK_SIZES;
+
+@@ -306,18 +312,20 @@
+ input_length += iov->data.length;
+ }
+
++ IOV_BLOCK_STATE_INIT(&input_pos);
++ IOV_BLOCK_STATE_INIT(&output_pos);
++
+ nblocks = (input_length + BLOCK_SIZE - 1) / BLOCK_SIZE;
+-
+- assert(nblocks > 1);
+-
+- {
++ if (nblocks == 1) {
++ krb5int_c_iov_get_block((unsigned char *)tmp, BLOCK_SIZE,
++ data, num_data, &input_pos);
++ dec(tmp2, tmp, &ctx);
++ krb5int_c_iov_put_block(data, num_data, (unsigned char *)tmp2,
++ BLOCK_SIZE, &output_pos);
++ } else if (nblocks > 1) {
+ char blockN2[BLOCK_SIZE]; /* second last */
+ char blockN1[BLOCK_SIZE]; /* last block */
+- struct iov_block_state input_pos, output_pos;
+
+- IOV_BLOCK_STATE_INIT(&input_pos);
+- IOV_BLOCK_STATE_INIT(&output_pos);
+-
+ for (blockno = 0; blockno < nblocks - 2; blockno++) {
+ char blockN[BLOCK_SIZE];
+
+Index: src/lib/crypto/dk/dk_aead.c
+===================================================================
+--- src/lib/crypto/dk/dk_aead.c (revision 23398)
++++ src/lib/crypto/dk/dk_aead.c (working copy)
+@@ -248,7 +248,7 @@
+ for (i = 0; i < num_data; i++) {
+ const krb5_crypto_iov *iov = &data[i];
+
+- if (ENCRYPT_DATA_IOV(iov))
++ if (ENCRYPT_IOV(iov))
+ cipherlen += iov->data.length;
+ }
+
+Index: src/lib/crypto/dk/dk_decrypt.c
+===================================================================
+--- src/lib/crypto/dk/dk_decrypt.c (revision 23398)
++++ src/lib/crypto/dk/dk_decrypt.c (working copy)
+@@ -89,6 +89,12 @@
+ else if (hmacsize > hashsize)
+ return KRB5KRB_AP_ERR_BAD_INTEGRITY;
+
++ /* Verify input and output lengths. */
++ if (input->length < blocksize + hmacsize)
++ return KRB5_BAD_MSIZE;
++ if (output->length < input->length - blocksize - hmacsize)
++ return KRB5_BAD_MSIZE;
++
+ enclen = input->length - hmacsize;
+
+ if ((kedata = (unsigned char *) malloc(keylength)) == NULL)
+Index: src/lib/crypto/raw/raw_decrypt.c
+===================================================================
+--- src/lib/crypto/raw/raw_decrypt.c (revision 23398)
++++ src/lib/crypto/raw/raw_decrypt.c (working copy)
+@@ -34,5 +34,7 @@
+ const krb5_data *ivec, const krb5_data *input,
+ krb5_data *output)
+ {
++ if (output->length < input->length)
++ return KRB5_BAD_MSIZE;
+ return((*(enc->decrypt))(key, ivec, input, output));
+ }
+Index: src/lib/crypto/deps
+===================================================================
+--- src/lib/crypto/deps (revision 23398)
++++ src/lib/crypto/deps (working copy)
+@@ -463,6 +463,16 @@
+ $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+ $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+ $(SRCTOP)/include/socket-utils.h etypes.h t_encrypt.c
++t_short.so t_short.po $(OUTPRE)t_short.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
++ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
++ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
++ $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
++ $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
++ $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
++ $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
++ $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
++ $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
++ t_short.c
+ t_prf.so t_prf.po $(OUTPRE)t_prf.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
+Index: src/lib/crypto/t_short.c
+===================================================================
+--- src/lib/crypto/t_short.c (revision 0)
++++ src/lib/crypto/t_short.c (revision 0)
+@@ -0,0 +1,126 @@
++/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
++/*
++ * lib/crypto/crypto_tests/t_short.c
++ *
++ * Copyright (C) 2009 by the Massachusetts Institute of Technology.
++ * All rights reserved.
++ *
++ * Export of this software from the United States of America may
++ * require a specific license from the United States Government.
++ * It is the responsibility of any person or organization contemplating
++ * export to obtain such a license before exporting.
++ *
++ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
++ * distribute this software and its documentation for any purpose and
++ * without fee is hereby granted, provided that the above copyright
++ * notice appear in all copies and that both that copyright notice and
++ * this permission notice appear in supporting documentation, and that
++ * the name of M.I.T. not be used in advertising or publicity pertaining
++ * to distribution of the software without specific, written prior
++ * permission. Furthermore if you modify this software you must label
++ * your software as modified software and not distribute it in such a
++ * fashion that it might be confused with the original M.I.T. software.
++ * M.I.T. makes no representations about the suitability of
++ * this software for any purpose. It is provided "as is" without express
++ * or implied warranty.
++ *
++ * Tests the outcome of decrypting overly short tokens. This program can be
++ * run under a tool like valgrind to detect bad memory accesses; when run
++ * normally by the test suite, it verifies that each operation returns
++ * KRB5_BAD_MSIZE.
++ */
++
++#include "k5-int.h"
++
++krb5_enctype interesting_enctypes[] = {
++ ENCTYPE_DES_CBC_CRC,
++ ENCTYPE_DES_CBC_MD4,
++ ENCTYPE_DES_CBC_MD5,
++ ENCTYPE_DES3_CBC_SHA1,
++ ENCTYPE_ARCFOUR_HMAC,
++ ENCTYPE_ARCFOUR_HMAC_EXP,
++ ENCTYPE_AES256_CTS_HMAC_SHA1_96,
++ ENCTYPE_AES128_CTS_HMAC_SHA1_96,
++ 0
++};
++
++/* Abort if an operation unexpectedly fails. */
++static void
++x(krb5_error_code code)
++{
++ if (code != 0)
++ abort();
++}
++
++/* Abort if a decrypt operation doesn't have the expected result. */
++static void
++check_decrypt_result(krb5_error_code code, size_t len, size_t min_len)
++{
++ if (len < min_len) {
++ /* Undersized tokens should always result in BAD_MSIZE. */
++ if (code != KRB5_BAD_MSIZE)
++ abort();
++ } else {
++ /* Min-size tokens should succeed or fail the integrity check. */
++ if (code != 0 && code != KRB5KRB_AP_ERR_BAD_INTEGRITY)
++ abort();
++ }
++}
++
++static void
++test_enctype(krb5_enctype enctype)
++{
++ krb5_error_code ret;
++ krb5_keyblock keyblock;
++ krb5_enc_data input;
++ krb5_data output;
++ krb5_crypto_iov iov[2];
++ unsigned int dummy;
++ size_t min_len, len;
++
++ printf("Testing enctype %d\n", (int) enctype);
++ x(krb5_c_encrypt_length(NULL, enctype, 0, &min_len));
++ x(krb5_c_make_random_key(NULL, enctype, &keyblock));
++ input.enctype = enctype;
++
++ /* Try each length up to the minimum length. */
++ for (len = 0; len <= min_len; len++) {
++ input.ciphertext.data = calloc(len, 1);
++ input.ciphertext.length = len;
++ output.data = calloc(len, 1);
++ output.length = len;
++
++ /* Attempt a normal decryption. */
++ ret = krb5_c_decrypt(NULL, &keyblock, 0, NULL, &input, &output);
++ check_decrypt_result(ret, len, min_len);
++
++ if (krb5_c_crypto_length(NULL, enctype, KRB5_CRYPTO_TYPE_HEADER,
++ &dummy) == 0) {
++ /* Attempt an IOV stream decryption. */
++ iov[0].flags = KRB5_CRYPTO_TYPE_STREAM;
++ iov[0].data = input.ciphertext;
++ iov[1].flags = KRB5_CRYPTO_TYPE_DATA;
++ iov[1].data.data = NULL;
++ iov[1].data.length = 0;
++ ret = krb5_c_decrypt_iov(NULL, &keyblock, 0, NULL, iov, 2);
++ check_decrypt_result(ret, len, min_len);
++ }
++
++ free(input.ciphertext.data);
++ free(output.data);
++ }
++}
++
++int
++main(int argc, char **argv)
++{
++ int i;
++ krb5_data notrandom;
++
++ notrandom.data = "notrandom";
++ notrandom.length = 9;
++ krb5_c_random_seed(NULL, &notrandom);
++ for (i = 0; interesting_enctypes[i]; i++)
++ test_enctype(interesting_enctypes[i]);
++ return 0;
++}
+Index: src/lib/crypto/old/old_decrypt.c
+===================================================================
+--- src/lib/crypto/old/old_decrypt.c (revision 23398)
++++ src/lib/crypto/old/old_decrypt.c (working copy)
+@@ -45,8 +45,10 @@
+ blocksize = enc->block_size;
+ hashsize = hash->hashsize;
+
++ /* Verify input and output lengths. */
++ if (input->length < blocksize + hashsize || input->length % blocksize != 0)
++ return(KRB5_BAD_MSIZE);
+ plainsize = input->length - blocksize - hashsize;
+-
+ if (arg_output->length < plainsize)
+ return(KRB5_BAD_MSIZE);
+
diff --git a/app-crypt/mit-krb5/mit-krb5-1.6.3-r7.ebuild b/app-crypt/mit-krb5/mit-krb5-1.6.3-r7.ebuild
new file mode 100644
index 000000000000..7876a32ed4b3
--- /dev/null
+++ b/app-crypt/mit-krb5/mit-krb5-1.6.3-r7.ebuild
@@ -0,0 +1,109 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-crypt/mit-krb5/mit-krb5-1.6.3-r7.ebuild,v 1.1 2010/01/14 09:12:31 mueli Exp $
+
+inherit eutils flag-o-matic versionator autotools
+
+PATCHV="0.5"
+MY_P=${P/mit-}
+P_DIR=$(get_version_component_range 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="http://web.mit.edu/kerberos/www/"
+SRC_URI="http://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}-signed.tar
+ mirror://gentoo/${P}-patches-${PATCHV}.tar.bz2"
+
+LICENSE="as-is"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="krb4 doc"
+
+RDEPEND="!virtual/krb5
+ >=sys-libs/e2fsprogs-libs-1.41.0"
+DEPEND="${RDEPEND}
+ doc? ( virtual/latex-base )"
+
+S=${WORKDIR}/${MY_P}/src
+
+PROVIDE="virtual/krb5"
+
+src_unpack() {
+ unpack ${A}
+ unpack ./${MY_P}.tar.gz
+ cd "${S}"
+ EPATCH_SOURCE="${WORKDIR}/patch" EPATCH_SUFFIX="patch" epatch
+ epatch "${FILESDIR}/CVE-2009-0844+CVE-2009-0847.patch"
+ epatch "${FILESDIR}/CVE-2009-0846.patch"
+ epatch "${FILESDIR}/1.6-CVE-2009-4212.patch"
+ einfo "Regenerating configure scripts (be patient)"
+ local subdir
+ for subdir in $(find . -name configure.in \
+ | xargs grep -l 'AC_CONFIG_SUBDIRS' \
+ | sed 's@/configure\.in$@@'); do
+ ebegin "Regenerating configure script in ${subdir}"
+ cd "${S}"/${subdir}
+ eautoconf --force -I "${S}"
+ eend $?
+ done
+}
+
+src_compile() {
+ # needed to work with sys-libs/e2fsprogs-libs <- should be removed!!
+ append-flags "-I/usr/include/et"
+ econf \
+ $(use_with krb4) \
+ --enable-shared \
+ --with-system-et --with-system-ss \
+ --enable-dns-for-realm \
+ --enable-kdc-replay-cache || die
+
+ emake -j1 || die
+
+ if use doc ; then
+ cd ../doc
+ for dir in api implement ; do
+ make -C "${dir}" || die
+ done
+ fi
+}
+
+src_test() {
+ einfo "Tests do not run in sandbox, have a lot of dependencies and are therefore completely disabled."
+}
+
+src_install() {
+ emake \
+ DESTDIR="${D}" \
+ EXAMPLEDIR=/usr/share/doc/${PF}/examples \
+ install || die
+
+ keepdir /var/lib/krb5kdc
+
+ cd ..
+ dodoc README
+ dodoc doc/*.ps
+ doinfo doc/*.info*
+ dohtml -r doc/*
+
+ use doc && dodoc doc/{api,implement}/*.ps
+
+ for i in {telnetd,ftpd} ; do
+ mv "${D}"/usr/share/man/man8/${i}.8 "${D}"/usr/share/man/man8/k${i}.8
+ mv "${D}"/usr/sbin/${i} "${D}"/usr/sbin/k${i}
+ done
+
+ for i in {rcp,rlogin,rsh,telnet,ftp} ; do
+ mv "${D}"/usr/share/man/man1/${i}.1 "${D}"/usr/share/man/man1/k${i}.1
+ mv "${D}"/usr/bin/${i} "${D}"/usr/bin/k${i}
+ done
+
+ newinitd "${FILESDIR}"/mit-krb5kadmind.initd mit-krb5kadmind
+ newinitd "${FILESDIR}"/mit-krb5kdc.initd mit-krb5kdc
+
+ insinto /etc
+ newins "${D}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+ newins "${D}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+}
+
+pkg_postinst() {
+ elog "See /usr/share/doc/${PF}/html/krb5-admin.html for documentation."
+}
diff --git a/app-crypt/mit-krb5/mit-krb5-1.7-r1.ebuild b/app-crypt/mit-krb5/mit-krb5-1.7-r2.ebuild
index 21a6a96d25cf..bd232e4d720b 100644
--- a/app-crypt/mit-krb5/mit-krb5-1.7-r1.ebuild
+++ b/app-crypt/mit-krb5/mit-krb5-1.7-r2.ebuild
@@ -1,6 +1,6 @@
# Copyright 1999-2010 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-crypt/mit-krb5/mit-krb5-1.7-r1.ebuild,v 1.3 2010/01/12 09:51:25 mueli Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-crypt/mit-krb5/mit-krb5-1.7-r2.ebuild,v 1.1 2010/01/14 09:12:31 mueli Exp $
inherit eutils flag-o-matic versionator autotools
@@ -30,6 +30,7 @@ src_unpack() {
unpack ${A}
unpack ./${MY_P}.tar.gz
cd "${S}"
+ epatch "${FILESDIR}/1.7-CVE-2009-4212.patch"
EPATCH_SOURCE="${WORKDIR}/patch" \
EPATCH_EXCLUDE="0001_all_lazyldflags.patch" \
EPATCH_SUFFIX="patch" epatch