From 57c5fcaa8442c19fbef0fe6110fc4d9de14a64bc904748530b374d72418ba8bc Mon Sep 17 00:00:00 2001
From: Marcus Meissner <meissner@suse.com>
Date: Fri, 7 Oct 2016 07:27:33 +0000
Subject: [PATCH] Accepting request 433580 from
 home:msmeissn:branches:server:irc

- irssi-0.8.20-buf.pl.patch: Fixed a information disclosure in buf.pl
  (CVE-2016-7553 bsc#1001215)

OBS-URL: https://build.opensuse.org/request/show/433580
OBS-URL: https://build.opensuse.org/package/show/server:irc/irssi?expand=0&rev=74
---
 irssi-0.8.20-buf.pl.patch | 100 ++++++++++++++++++++++++++++++++++++++
 irssi.changes             |   6 +++
 irssi.spec                |   4 +-
 3 files changed, 109 insertions(+), 1 deletion(-)
 create mode 100644 irssi-0.8.20-buf.pl.patch

diff --git a/irssi-0.8.20-buf.pl.patch b/irssi-0.8.20-buf.pl.patch
new file mode 100644
index 0000000..b0d5826
--- /dev/null
+++ b/irssi-0.8.20-buf.pl.patch
@@ -0,0 +1,100 @@
+--- irssi/scripts/buf.pl	2016-08-11 14:59:21.000000000 +0200
++++ irssi/scripts/buf.pl	2016-10-06 13:27:20.747016000 +0200
+@@ -5,7 +5,7 @@
+              settings_get_str settings_get_bool channels windows
+ 	     settings_add_str settings_add_bool get_irssi_dir
+ 	     window_find_refnum signal_stop);
+-$VERSION = '2.13';
++$VERSION = '2.20';
+ %IRSSI = (
+     authors	=> 'Juerd',
+     contact	=> 'juerd@juerd.nl',
+@@ -13,10 +13,8 @@
+     description	=> 'Saves the buffer for /upgrade, so that no information is lost',
+     license	=> 'Public Domain',
+     url		=> 'http://juerd.nl/irssi/',
+-    changed	=> 'Mon May 13 19:41 CET 2002',
+-    changes	=> 'Severe formatting bug removed * oops, I ' .
+-                   'exposed Irssi to ircII foolishness * sorry ' .
+-		   '** removed logging stuff (this is a fix)',
++    changed	=> 'Thu Sep 22 01:37 CEST 2016',
++    changes	=> 'Fixed file permissions (leaked everything via filesystem)',
+     note1	=> 'This script HAS TO BE in your scripts/autorun!',
+     note2	=> 'Perl support must be static or in startup',
+ );
+@@ -39,9 +37,15 @@
+ 
+ my %suppress;
+ 
++sub _filename { sprintf '%s/scrollbuffer', get_irssi_dir }
++
+ sub upgrade {
+-    open BUF, q{>}, sprintf('%s/scrollbuffer', get_irssi_dir) or die $!;
+-    print BUF join("\0", map $_->{server}->{address} . $_->{name}, channels), "\n";
++    my $fn = _filename;
++    my $old_umask = umask 0077;
++    open my $fh, q{>}, $fn or die "open $fn: $!";
++    umask $old_umask;
++
++    print $fh join("\0", map $_->{server}->{address} . $_->{name}, channels), "\n";
+     for my $window (windows) {
+ 	next unless defined $window;
+ 	next if $window->{name} eq 'status';
+@@ -57,36 +61,39 @@
+ 		redo if defined $line;
+ 	    }
+ 	}
+-	printf BUF "%s:%s\n%s", $window->{refnum}, $lines, $buf;
++	printf $fh "%s:%s\n%s", $window->{refnum}, $lines, $buf;
+     }
+-    close BUF;
++    close $fh;
+     unlink sprintf("%s/sessionconfig", get_irssi_dir);
+     command 'layout save';
+     command 'save';
+ }
+ 
+ sub restore {
+-    open BUF, q{<}, sprintf('%s/scrollbuffer', get_irssi_dir) or die $!;
+-    my @suppress = split /\0/, <BUF>;
++    my $fn = _filename;
++    open my $fh, q{<}, $fn or die "open $fn: $!";
++    unlink $fn or warn "unlink $fn: $!";
++
++    my @suppress = split /\0/, readline $fh;
+     if (settings_get_bool 'upgrade_suppress_join') {
+ 	chomp $suppress[-1];
+ 	@suppress{@suppress} = (2) x @suppress;
+     }
+     active_win->command('^window scroll off');
+-    while (my $bla = <BUF>){
++    while (my $bla = readline $fh){
+ 	chomp $bla;
+ 	my ($refnum, $lines) = split /:/, $bla;
+ 	next unless $lines;
+ 	my $window = window_find_refnum $refnum;
+ 	unless (defined $window){
+-	    <BUF> for 1..$lines;
++	    readline $fh for 1..$lines;
+ 	    next;
+ 	}
+ 	my $view = $window->view;
+ 	$view->remove_all_lines();
+ 	$view->redraw();
+ 	my $buf = '';
+-	$buf .= <BUF> for 1..$lines;
++	$buf .= readline $fh for 1..$lines;
+ 	my $sep = settings_get_str 'upgrade_separator';
+ 	$sep .= "\n" if $sep ne '';
+ 	$window->gui_printtext_after(undef, MSGLEVEL_CLIENTNOTICE, "$buf\cO$sep");
+@@ -119,3 +126,10 @@
+ unless (-f sprintf('%s/scripts/autorun/buf.pl', get_irssi_dir)) {
+     Irssi::print('PUT THIS SCRIPT IN ~/.irssi/scripts/autorun/ BEFORE /UPGRADING!!');
+ }
++
++# Remove any left-over file. If 'session' doesn't exist (created by irssi
++# during /UPGRADE), neither should our file.
++unless (-e sprintf('%s/session', get_irssi_dir)) {
++    my $fn = _filename;
++    unlink $fn or warn "unlink $fn: $!" if -e $fn;
++}
diff --git a/irssi.changes b/irssi.changes
index fcad5ba..476cd6f 100644
--- a/irssi.changes
+++ b/irssi.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Oct  6 11:31:53 UTC 2016 - meissner@suse.com
+
+- irssi-0.8.20-buf.pl.patch: Fixed a information disclosure in buf.pl
+  (CVE-2016-7553 bsc#1001215)
+
 -------------------------------------------------------------------
 Wed Sep 21 22:24:11 UTC 2016 - mrueckert@suse.de
 
diff --git a/irssi.spec b/irssi.spec
index dd8f0cc..f60d3d5 100644
--- a/irssi.spec
+++ b/irssi.spec
@@ -50,6 +50,8 @@ Source3:        https://github.com/irssi/irssi/releases/download/%{version}/irss
 Source4:        %{name}.keyring
 Source99:       irssi-rpmlintrc
 Patch:          irssi-0.8.15_ssl_proxy.patch
+# PATCH-FIX-UPSTREAM irssi-0.8.20-buf.pl.patch 1001215 CVE-2016-7553:
+Patch1:         irssi-0.8.20-buf.pl.patch
 # PATCH-FIX-OPENSUSE irssi-0.8.16_missing_prototype_warnings.patch
 Patch2:         irssi-0.8.16_missing_prototype_warnings.patch
 #
@@ -99,7 +101,7 @@ Authors:
 
 %prep
 %setup -q
-#patch
+%patch1 -p1
 %patch2
 
 %build