04/07: gnu: cracklib: Update to 2.9.7.

[guix-commits]

nckx pushed a commit to branch master
in repository guix.

commit 9081333bcd3ff0d6d7cc2f357f56cc2a39bfef50
Author: Tobias Geerinckx-Rice <address@hidden>
Date:   Mon Mar 18 23:04:31 2019 +0100

    gnu: cracklib: Update to 2.9.7.
    
    * gnu/packages/password-utils.scm (cracklib): Update to 2.9.7.
    [source]: Remove patches.
    * gnu/packages/patches/cracklib-CVE-2016-6318.patch,
    gnu/packages/patches/cracklib-fix-buffer-overflow.patch: Delete file.
    * gnu/local.mk (dist_patch_DATA): Remove them.
---
 gnu/local.mk                                       |  2 -
 gnu/packages/password-utils.scm                    | 22 +++--
 gnu/packages/patches/cracklib-CVE-2016-6318.patch  | 95 ----------------------
 .../patches/cracklib-fix-buffer-overflow.patch     | 39 ---------
 4 files changed, 10 insertions(+), 148 deletions(-)

diff --git a/gnu/local.mk b/gnu/local.mk
index 49537e1..0a7e9bb 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -706,8 +706,6 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/combinatorial-blas-io-fix.patch         \
   %D%/packages/patches/cpio-CVE-2016-2037.patch                        \
   %D%/packages/patches/cpufrequtils-fix-aclocal.patch          \
-  %D%/packages/patches/cracklib-CVE-2016-6318.patch            \
-  %D%/packages/patches/cracklib-fix-buffer-overflow.patch      \
   %D%/packages/patches/crawl-upgrade-saves.patch               \
   %D%/packages/patches/crda-optional-gcrypt.patch              \
   %D%/packages/patches/clucene-contribs-lib.patch               \
diff --git a/gnu/packages/password-utils.scm b/gnu/packages/password-utils.scm
index 9fd5a6f..ad89cee 100644
--- a/gnu/packages/password-utils.scm
+++ b/gnu/packages/password-utils.scm
@@ -9,7 +9,7 @@
 ;;; Copyright © 2016 Alex Griffin <address@hidden>
 ;;; Copyright © 2017 Leo Famulari <address@hidden>
 ;;; Copyright © 2017, 2018 Clément Lassieur <address@hidden>
-;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <address@hidden>
+;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <address@hidden>
 ;;; Copyright © 2017 Jelle Licht <address@hidden>
 ;;; Copyright © 2017 Eric Bavier <address@hidden>
 ;;; Copyright © 2017 Nicolas Goaziou <address@hidden>
@@ -295,17 +295,15 @@ and vice versa.")
 (define-public cracklib
   (package
     (name "cracklib")
-    (version "2.9.6")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/cracklib/cracklib/";
-                                  "releases/download/" name "-" version "/"
-                                  name "-" version ".tar.gz"))
-              (patches (search-patches "cracklib-CVE-2016-6318.patch"
-                                       "cracklib-fix-buffer-overflow.patch"))
-              (sha256
-               (base32
-                "0hrkb0prf7n92w6rxgq0ilzkk6rkhpys2cfqkrbzswp27na7dkqp"))))
+    (version "2.9.7")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/cracklib/cracklib/";
+                           "releases/download/v" version "/"
+                           "cracklib-" version ".tar.bz2"))
+       (sha256
+        (base32 "1rimpjsdnmw8f5b7k558cic41p2qy2n2yrlqp5vh7mp4162hk0py"))))
     (build-system gnu-build-system)
     (synopsis "Password checking library")
     (home-page "https://github.com/cracklib/cracklib";)
diff --git a/gnu/packages/patches/cracklib-CVE-2016-6318.patch 
b/gnu/packages/patches/cracklib-CVE-2016-6318.patch
deleted file mode 100644
index 4806eca..0000000
--- a/gnu/packages/patches/cracklib-CVE-2016-6318.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-Fix CVE-2016-6318.
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6318
-
-Patch copied from Red Hat:
-
-https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6318
-https://bugzilla.redhat.com/attachment.cgi?id=1188599&action=diff
-
-It is not safe to pass words longer than STRINGSIZE further to cracklib
-so the longbuffer cannot be longer than STRINGSIZE.
-diff -up cracklib-2.9.0/lib/fascist.c.longgecos cracklib-2.9.0/lib/fascist.c
---- cracklib-2.9.0/lib/fascist.c.longgecos     2014-02-06 16:03:59.000000000 
+0100
-+++ cracklib-2.9.0/lib/fascist.c       2016-08-08 12:05:40.279235815 +0200
-@@ -515,7 +515,7 @@ FascistGecosUser(char *password, const c
-     char gbuffer[STRINGSIZE];
-     char tbuffer[STRINGSIZE];
-     char *uwords[STRINGSIZE];
--    char longbuffer[STRINGSIZE * 2];
-+    char longbuffer[STRINGSIZE];
- 
-     if (gecos == NULL)
-       gecos = "";
-@@ -596,38 +596,47 @@ FascistGecosUser(char *password, const c
-     {
-       for (i = 0; i < j; i++)
-       {
--          strcpy(longbuffer, uwords[i]);
--          strcat(longbuffer, uwords[j]);
--
--          if (GTry(longbuffer, password))
-+          if (strlen(uwords[i]) + strlen(uwords[j]) < STRINGSIZE)
-           {
--              return _("it is derived from your password entry");
--          }
--
--          strcpy(longbuffer, uwords[j]);
--          strcat(longbuffer, uwords[i]);
-+              strcpy(longbuffer, uwords[i]);
-+              strcat(longbuffer, uwords[j]);
- 
--          if (GTry(longbuffer, password))
--          {
--              return _("it's derived from your password entry");
-+              if (GTry(longbuffer, password))
-+              {
-+                  return _("it is derived from your password entry");
-+              }
-+
-+              strcpy(longbuffer, uwords[j]);
-+              strcat(longbuffer, uwords[i]);
-+
-+              if (GTry(longbuffer, password))
-+              {
-+                 return _("it's derived from your password entry");
-+              }
-           }
- 
--          longbuffer[0] = uwords[i][0];
--          longbuffer[1] = '\0';
--          strcat(longbuffer, uwords[j]);
--
--          if (GTry(longbuffer, password))
-+          if (strlen(uwords[j]) < STRINGSIZE - 1)
-           {
--              return _("it is derivable from your password entry");
-+              longbuffer[0] = uwords[i][0];
-+              longbuffer[1] = '\0';
-+              strcat(longbuffer, uwords[j]);
-+
-+              if (GTry(longbuffer, password))
-+              {
-+                  return _("it is derivable from your password entry");
-+              }
-           }
- 
--          longbuffer[0] = uwords[j][0];
--          longbuffer[1] = '\0';
--          strcat(longbuffer, uwords[i]);
--
--          if (GTry(longbuffer, password))
-+          if (strlen(uwords[i]) < STRINGSIZE - 1)
-           {
--              return _("it's derivable from your password entry");
-+              longbuffer[0] = uwords[j][0];
-+              longbuffer[1] = '\0';
-+              strcat(longbuffer, uwords[i]);
-+
-+              if (GTry(longbuffer, password))
-+              {
-+                  return _("it's derivable from your password entry");
-+              }
-           }
-       }
-     }
diff --git a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch 
b/gnu/packages/patches/cracklib-fix-buffer-overflow.patch
deleted file mode 100644
index b1c990f..0000000
--- a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-Fix buffer overflow processing long words in Mangle().
-
-Patch adpated from upstream commit, omitting changes to 'NEWS':
-
-https://github.com/cracklib/cracklib/commit/33d7fa4585247cd2247a1ffa032ad245836c6edb
-
-From 33d7fa4585247cd2247a1ffa032ad245836c6edb Mon Sep 17 00:00:00 2001
-From: Jan Dittberner <address@hidden>
-Date: Thu, 25 Aug 2016 17:17:53 +0200
-Subject: [PATCH] Fix a buffer overflow processing long words
-
-A buffer overflow processing long words has been discovered. This commit
-applies the patch from
-https://build.opensuse.org/package/view_file/Base:System/cracklib/0004-overflow-processing-long-words.patch
-by Howard Guo.
-
-See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835386 and
-http://www.openwall.com/lists/oss-security/2016/08/23/8
----
- src/NEWS        | 1 +
- src/lib/rules.c | 5 ++---
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/lib/rules.c b/src/lib/rules.c
-index d193cc0..3a2aa46 100644
---- a/lib/rules.c
-+++ b/lib/rules.c
-@@ -434,9 +434,8 @@ Mangle(input, control)             /* returns a pointer to 
a controlled Mangle */
- {
-     int limit;
-     register char *ptr;
--    static char area[STRINGSIZE];
--    char area2[STRINGSIZE];
--    area[0] = '\0';
-+    static char area[STRINGSIZE * 2] = {0};
-+    char area2[STRINGSIZE * 2] = {0};
-     strcpy(area, input);
- 
-     for (ptr = control; *ptr; ptr++)