diff --git a/0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch b/0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch new file mode 100644 index 0000000..10d4bb2 --- /dev/null +++ b/0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch @@ -0,0 +1,203 @@ +From 0f8c89a42fd87ca8c17660c50f114a5f68a1e21e Mon Sep 17 00:00:00 2001 +From: Jean-Francois Dockes +Date: Fri, 8 Jun 2018 13:48:40 -0600 +Subject: [PATCH] Replace all instances of sprintf with snprintf and adjust + size of integer field in some cases + +Rebased on 0.21.9 by Ken Dreyer + +Resolves: CVE-2016-10091 +--- + src/attr.c | 4 ++-- + src/convert.c | 44 ++++++++++++++++++++++---------------------- + src/output.c | 4 ++-- + 3 files changed, 26 insertions(+), 26 deletions(-) + +diff --git a/src/attr.c b/src/attr.c +index 02b5c81..e2951ea 100644 +--- a/src/attr.c ++++ b/src/attr.c +@@ -746,7 +746,7 @@ char * + assemble_string(char *string, int nr) + { + +- char *s, tmp[12];/* Number of characters that can be in int type (including '\0') - AF */ ++ char *s, tmp[20]; + int i = 0, j = 0; + + if (string == NULL) +@@ -762,7 +762,7 @@ assemble_string(char *string, int nr) + } + + if (string[i] != '\0') { +- sprintf(tmp, "%d", nr); ++ snprintf(tmp, 20, "%d", nr); + strcpy(&s[j], tmp); + j = j + strlen(tmp); + } +diff --git a/src/convert.c b/src/convert.c +index c76d7d6..6979365 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -472,7 +472,7 @@ static const int fcharsetparmtocp(int parm) + } + + // Translate code page to encoding name hopefully suitable as iconv input +-static char *cptoencoding(parm) ++static char *cptoencoding(int parm) + { + // Note that CP0 is supposed to mean current system default, which does + // not make any sense as a stored value, we don't handle it. +@@ -964,10 +964,10 @@ cmd_cf (Word *w, int align, char has_param, int num) + } + else + { +- sprintf(str,"#%02x%02x%02x", +- color_table[num].r, +- color_table[num].g, +- color_table[num].b); ++ snprintf(str, 40, "#%02x%02x%02x", ++ color_table[num].r, ++ color_table[num].g, ++ color_table[num].b); + attr_push(ATTR_FOREGROUND,str); + } + return FALSE; +@@ -993,10 +993,10 @@ cmd_cb (Word *w, int align, char has_param, int num) + } + else + { +- sprintf(str,"#%02x%02x%02x", +- color_table[num].r, +- color_table[num].g, +- color_table[num].b); ++ snprintf(str, 40, "#%02x%02x%02x", ++ color_table[num].r, ++ color_table[num].g, ++ color_table[num].b); + attr_push(ATTR_BACKGROUND,str); + } + return FALSE; +@@ -1018,7 +1018,7 @@ cmd_fs (Word *w, int align, char has_param, int points) { + /* Note, fs20 means 10pt */ + points /= 2; + +- sprintf(str,"%d",points); ++ snprintf(str, 20, "%d", points); + attr_push(ATTR_FONTSIZE,str); + + return FALSE; +@@ -1166,7 +1166,7 @@ cmd_f (Word *w, int align, char has_param, int num) + { + // TOBEDONE: WHAT'S THIS ??? + name = my_malloc(12); +- sprintf(name, "%d", num); ++ snprintf(name, 12, "%d", num); + } + + /* we are going to output entities, so should not output font */ +@@ -1218,7 +1218,7 @@ cmd_highlight (Word *w, int align, char has_param, int num) + } + else + { +- sprintf(str,"#%02x%02x%02x", ++ snprintf(str, 40, "#%02x%02x%02x", + color_table[num].r, + color_table[num].g, + color_table[num].b); +@@ -1373,9 +1373,9 @@ cmd_ftech (Word *w, int align, char has_param, int param) { + + static int + cmd_expand (Word *w, int align, char has_param, int param) { +- char str[10]; ++ char str[20]; + if (has_param) { +- sprintf(str, "%d", param/4); ++ snprintf(str, 20, "%d", param / 4); + if (!param) + attr_pop(ATTR_EXPAND); + else +@@ -1394,7 +1394,7 @@ cmd_expand (Word *w, int align, char has_param, int param) { + + static int + cmd_emboss (Word *w, int align, char has_param, int param) { +- char str[10]; ++ char str[20]; + if (has_param && !param) + #ifdef SUPPORT_UNNESTED + attr_find_pop(ATTR_EMBOSS); +@@ -1403,7 +1403,7 @@ cmd_emboss (Word *w, int align, char has_param, int param) { + #endif + else + { +- sprintf(str, "%d", param); ++ snprintf(str, 20, "%d", param); + attr_push(ATTR_EMBOSS, str); + } + return FALSE; +@@ -1419,12 +1419,12 @@ cmd_emboss (Word *w, int align, char has_param, int param) { + + static int + cmd_engrave (Word *w, int align, char has_param, int param) { +- char str[10]; ++ char str[20]; + if (has_param && !param) + attr_pop(ATTR_ENGRAVE); + else + { +- sprintf(str, "%d", param); ++ snprintf(str, 20, "%d", param); + attr_push(ATTR_ENGRAVE, str); + } + return FALSE; +@@ -1976,7 +1976,7 @@ static int cmd_u (Word *w, int align, char has_param, int param) { + + short done=0; + long unicode_number = (long) param; /* On 16bit architectures int is too small to store unicode characters. - AF */ +- char tmp[12]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */ ++ char tmp[20]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */ + const char *alias; + #define DEBUG 0 + #if DEBUG +@@ -2006,7 +2006,7 @@ static int cmd_u (Word *w, int align, char has_param, int param) { + /* RTF spec: Unicode values beyond 32767 are represented by negative numbers */ + unicode_number += 65536; + } +- sprintf(tmp, "%ld", unicode_number); ++ snprintf(tmp, 20, "%ld", unicode_number); + + if (safe_printf(1, op->unisymbol_print, tmp)) fprintf(stderr, TOO_MANY_ARGS, "unisymbol_print"); + done++; +@@ -3369,8 +3369,8 @@ word_print_core (Word *w, int groupdepth) + case PICT_PM: ext="pmm"; break; /* OS/2 metafile=??? */ + case PICT_EMF: ext="emf"; break; /* Enhanced MetaFile */ + } +- sprintf(picture_path, "pict%03d.%s", +- picture_file_number++,ext); ++ snprintf(picture_path, 255, "pict%03d.%s", ++ picture_file_number++, ext); + pictfile=fopen(picture_path,"wb"); + } + +diff --git a/src/output.c b/src/output.c +index 86d8b5c..4cdbfa6 100644 +--- a/src/output.c ++++ b/src/output.c +@@ -320,7 +320,7 @@ op_begin_std_fontsize (OutputPersonality *op, int size) + if (!found_std_expr) { + if (op->fontsize_begin) { + char expr[16]; +- sprintf (expr, "%d", size); ++ snprintf(expr, 16, "%d", size); + if (safe_printf (1, op->fontsize_begin, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_begin"); + } else { + /* If we cannot write out a change for the exact +@@ -440,7 +440,7 @@ op_end_std_fontsize (OutputPersonality *op, int size) + if (!found_std_expr) { + if (op->fontsize_end) { + char expr[16]; +- sprintf (expr, "%d", size); ++ snprintf(expr, 16, "%d", size); + if (safe_printf(1, op->fontsize_end, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_end"); + } else { + /* If we cannot write out a change for the exact diff --git a/unrtf-0.21.9.tar.gz b/unrtf-0.21.9.tar.gz new file mode 100644 index 0000000..11cf91a Binary files /dev/null and b/unrtf-0.21.9.tar.gz differ diff --git a/unrtf.spec b/unrtf.spec new file mode 100644 index 0000000..74f2022 --- /dev/null +++ b/unrtf.spec @@ -0,0 +1,46 @@ +Name: unrtf +Summary: RTF (Rich Text Format) to other formats converter +Version: 0.21.9 +Release: 1 +License: GPLv3+ +URL: https://www.gnu.org/software/unrtf/unrtf.html +Source0: http://ftp.gnu.org/gnu/unrtf/unrtf-%{version}.tar.gz +# http://hg.savannah.gnu.org/hgweb/unrtf/rev/3b16893a6406 +Patch0001: 0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch +BuildRequires: gcc automake +%description +UnRTF is a command-line program written in C which converts documents in +Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself. +Converting to HTML, it supports a number of features of Rich Text Format: + * Changes in the text's font, size, weight (bold), and slant (italic) + * Underlines and strikethroughs + * Partial support for text shadowing, outlining, embossing, or engraving + * Capitalizations + * Superscripts and subscripts + * Expanded and condensed text + * Changes in the foreground and background colors + * Conversion of special characters to HTML entities + +%prep +%autosetup -p1 + +%build +./bootstrap +%configure +make %{?_smp_mflags} + +%install +%make_install + +%check +make check + +%files +%doc README ChangeLog COPYING AUTHORS NEWS +%{_bindir}/%{name} +%{_mandir}/man1/* +%{_datadir}/%{name}/ + +%changelog +* Mon Aug 3 2020 fanjiachen - 0.21.9-1 +- package init diff --git a/unrtf.yaml b/unrtf.yaml new file mode 100644 index 0000000..9442faa --- /dev/null +++ b/unrtf.yaml @@ -0,0 +1,4 @@ +version_control: hg +src_repo: http://hg.savannah.gnu.org/hgweb/unrtf +tag_prefix: "release_" +separator: "."