# ------------------------------------------------------------------------------ # CHANGES | 11 +++++++---- # WWW/Library/Implementation/HTGopher.c | 1 + # WWW/Library/Implementation/HTMIME.c | 14 +++++++------- # configure | 2 +- # configure.in | 4 ++-- # lynx.cfg | 4 ++-- # src/LYMainLoop.c | 4 ++-- # src/LYOptions.c | 4 ++-- # src/LYStrings.c | 2 +- # userdefs.h | 4 ++-- # 10 files changed, 27 insertions(+), 23 deletions(-) # ------------------------------------------------------------------------------ Index: CHANGES --- 2.8.5rel.3/CHANGES Mon Oct 17 13:47:09 2005 +++ 2.8.5rel.4/CHANGES Tue Oct 25 17:40:26 2005 @@ -1,10 +1,13 @@ Changes since Lynx 2.8 release =============================================================================== -2004-10-17 (2.8.5rel.3 fixes from 2.8.6dev.14) -* eliminate fixed-size buffers in LYExpandHostForURL() to guard against - buffer overflow resulting from too-long domain prefix/suffix data from - lynx.cfg (report by Ulf Harnhammar, CAN-2005-3120) -TD +2005-10-25 (2.8.5rel.4 fixes from 2.8.6dev.14) +* fix error in rel.3 patch (report by Klaus Singvogel) + +2005-10-17 (2.8.5rel.3 fixes from 2.8.6dev.14) +* eliminate fixed-size buffers in HTrjis() and related functions to avoid + potential buffer overflow in nntp pages (report by Ulf Harnhammar, + CAN-2005-3120) -TD 2004-04-22 (2.8.5rel.2 fixes from 2.8.6dev.1) * correct ifdef in LYgetattrs() to ensure that getattrs() is used only if the Index: WWW/Library/Implementation/HTGopher.c --- 2.8.5rel.3/WWW/Library/Implementation/HTGopher.c Sun Apr 27 17:38:00 2003 +++ 2.8.5rel.4/WWW/Library/Implementation/HTGopher.c Tue Oct 25 17:40:26 2005 @@ -1117,6 +1117,7 @@ }; out = 0; + memset(&ctx, 0, sizeof(ctx)); ctx.host = host; ctx.seek = (char *) 0; ctx.port = port; Index: WWW/Library/Implementation/HTMIME.c Prereq: 0.2 --- 2.8.5rel.3/WWW/Library/Implementation/HTMIME.c Mon Oct 17 13:47:09 2005 +++ 2.8.5rel.4/WWW/Library/Implementation/HTMIME.c Tue Oct 25 17:40:26 2005 @@ -2155,8 +2155,8 @@ ** HTmmdecode for ISO-2022-JP - FM */ PUBLIC void HTmmdecode ARGS2( - char **, trg, - char *, str) + char **, target, + char *, source) { char *buf; char *mmbuf = NULL; @@ -2164,10 +2164,10 @@ char *s, *t, *u; int base64, quote; - if ((buf = malloc(strlen(str) + 1)) == 0) + if ((buf = malloc(strlen(source) + 1)) == 0) outofmem(__FILE__, "HTmmdecode"); - for (s = str, u = buf; *s;) { + for (s = source, u = buf; *s;) { if (!strncasecomp(s, "=?ISO-2022-JP?B?", 16)) { base64 = 1; } else { @@ -2181,12 +2181,12 @@ if (base64 || quote) { if (HTmmcont) { for (t = s - 1; - t >= str && (*t == ' ' || *t == '\t'); t--) { + t >= source && (*t == ' ' || *t == '\t'); t--) { u--; } } if (mmbuf == 0) /* allocate buffer big enough for source */ - StrAllocCopy(mmbuf, str); + StrAllocCopy(mmbuf, source); for (s += 16, t = mmbuf; *s; ) { if (s[0] == '?' && s[1] == '=') { break; @@ -2216,7 +2216,7 @@ } *u = '\0'; end: - StrAllocCopy(*t, buf); + StrAllocCopy(*target, buf); FREE(m2buf); FREE(mmbuf); FREE(buf); Index: configure --- 2.8.5rel.3/configure Wed Feb 4 04:07:09 2004 +++ 2.8.5rel.4/configure Wed Feb 4 04:07:09 2004 @@ -723,7 +723,7 @@ PACKAGE=lynx # $Format: "VERSION=$ProjectVersion$"$ -VERSION=2.8.5rel.3 +VERSION=2.8.5rel.4 Index: configure.in --- 2.8.5rel.3/configure.in Wed Feb 4 04:07:09 2004 +++ 2.8.5rel.4/configure.in Wed Feb 4 04:07:09 2004 @@ -5,7 +5,7 @@ dnl dnl ask PRCS to plug-in the project-version for the configure-script. dnl $Format: "AC_REVISION($ProjectVersion$)"$ -AC_REVISION(2.8.5rel.3) +AC_REVISION(2.8.5rel.4) # Save the original $CFLAGS so we can distinguish whether the user set those # in the environment, or whether autoconf added -O and -g options: @@ -33,7 +33,7 @@ PACKAGE=lynx dnl ask PRCS to plug-in the project-version for the packages. # $Format: "VERSION=$ProjectVersion$"$ -VERSION=2.8.5rel.3 +VERSION=2.8.5rel.4 AC_SUBST(PACKAGE) AC_SUBST(VERSION) AC_SUBST(DESTDIR) Index: lynx.cfg --- 2.8.5rel.3/lynx.cfg Wed Jan 28 11:30:38 2004 +++ 2.8.5rel.4/lynx.cfg Wed Jan 28 11:30:38 2004 @@ -3,10 +3,10 @@ # or Lynx_Dir:lynx.cfg (VMS) # # $Format: "#PRCS LYNX_VERSION \"$ProjectVersion$\""$ -#PRCS LYNX_VERSION "2.8.5rel.3" +#PRCS LYNX_VERSION "2.8.5rel.4" # # $Format: "#PRCS LYNX_DATE \"$ProjectDate$\""$ -#PRCS LYNX_DATE "Mon, 17 Oct 2005 13:47:09 -0700" +#PRCS LYNX_DATE "Tue, 25 Oct 2005 17:40:26 -0700" # # Definition pairs are of the form VARIABLE:DEFINITION # NO spaces are allowed between the pair items. Index: src/LYMainLoop.c --- 2.8.5rel.3/src/LYMainLoop.c Wed Jan 28 11:30:38 2004 +++ 2.8.5rel.4/src/LYMainLoop.c Tue Oct 25 17:40:26 2005 @@ -5207,8 +5207,8 @@ char cfile[128]; FILE *cfp; char *cp; - int ch, recall; - int URLTotal; + int ch = 0, recall = 0; + int URLTotal = 0; int URLNum; BOOLEAN FirstURLRecall = TRUE; char *temp = NULL; Index: src/LYOptions.c --- 2.8.5rel.3/src/LYOptions.c Wed Jan 28 11:30:38 2004 +++ 2.8.5rel.4/src/LYOptions.c Tue Oct 25 17:40:26 2005 @@ -2488,7 +2488,7 @@ PostPair *data = 0; DocAddress WWWDoc; /* need on exit */ int i; - int code; + int code = 0; BOOLEAN save_all = FALSE; int display_char_set_old = current_char_set; BOOLEAN raw_mode_old = LYRawMode; @@ -2642,7 +2642,7 @@ /* Keypad Mode: SELECT */ if (!strcmp(data[i].tag, keypad_mode_string)) { - int newval; + int newval = 0; if (GetOptValues(keypad_mode_values, data[i].value, &newval) && keypad_mode != newval) { keypad_mode = newval; Index: src/LYStrings.c --- 2.8.5rel.3/src/LYStrings.c Mon Feb 2 12:02:28 2004 +++ 2.8.5rel.4/src/LYStrings.c Tue Oct 25 17:40:26 2005 @@ -1046,7 +1046,7 @@ BOOLEAN ok = FALSE; if (*src == SQUOTE) { - int keysym; + int keysym = 0; unescaped_char(src, &keysym); if (keysym >= 0) { dst[0] = keysym; Index: userdefs.h --- 2.8.5rel.3/userdefs.h Mon Feb 2 12:02:28 2004 +++ 2.8.5rel.4/userdefs.h Mon Feb 2 12:02:28 2004 @@ -1360,11 +1360,11 @@ * the version definition with the Project Version on checkout. Just * ignore it. - kw */ /* $Format: "#define LYNX_VERSION \"$ProjectVersion$\""$ */ -#define LYNX_VERSION "2.8.5rel.3" +#define LYNX_VERSION "2.8.5rel.4" #define LYNX_WWW_HOME "http://lynx.isc.org/" #define LYNX_WWW_DIST "http://lynx.isc.org/current/" /* $Format: "#define LYNX_DATE \"$ProjectDate$\""$ */ -#define LYNX_DATE "Mon, 17 Oct 2005 13:47:09 -0700" +#define LYNX_DATE "Tue, 25 Oct 2005 17:40:26 -0700" #define LYNX_DATE_OFF 5 /* truncate the automatically-generated date */ #define LYNX_DATE_LEN 11 /* truncate the automatically-generated date */