From de2ebfe3ec5c6ade369db32e2a226b3d5931532d166e8a5f2d44c4a2c7862669 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Chv=C3=A1tal?= <tomas.chvatal@gmail.com>
Date: Tue, 24 Feb 2015 14:52:29 +0000
Subject: [PATCH] - Udate filter patch to work as expected:   from fedora.
 bnc#900326 bnc#915522 CVE-2015-1419

OBS-URL: https://build.opensuse.org/package/show/network/vsftpd?expand=0&rev=72
---
 vsftpd-2.1.0-filter.patch | 82 +++++++++++++++++++--------------------
 vsftpd.changes            |  4 +-
 2 files changed, 41 insertions(+), 45 deletions(-)

diff --git a/vsftpd-2.1.0-filter.patch b/vsftpd-2.1.0-filter.patch
index 5405f53..c9d622e 100644
--- a/vsftpd-2.1.0-filter.patch
+++ b/vsftpd-2.1.0-filter.patch
@@ -2,72 +2,68 @@ Index: vsftpd-3.0.2/ls.c
 ===================================================================
 --- vsftpd-3.0.2.orig/ls.c
 +++ vsftpd-3.0.2/ls.c
-@@ -117,16 +117,6 @@ vsf_ls_populate_dir_list(struct mystr_li
-     {
-       continue;
-     }
--    /* If we have an ls option which is a filter, apply it */
--    if (!str_isempty(p_filter_str))
--    {
--      unsigned int iters = 0;
--      if (!vsf_filename_passes_filter(&s_next_filename_str, p_filter_str,
--                                      &iters))
--      {
--        continue;
--      }
--    }
-     /* Calculate the full path (relative to CWD) for lstat() and
-      * output purposes
-      */
-@@ -144,6 +134,16 @@ vsf_ls_populate_dir_list(struct mystr_li
-         continue;
-       }
-     }
-+    /* If we have an ls option which is a filter, apply it */
-+    if (!str_isempty(p_filter_str))
-+    {
-+      unsigned int iters = 0;
-+      if (!vsf_filename_passes_filter(&s_next_path_and_filename_str, p_filter_str,
-+                                      &iters))
-+      {
-+        continue;
-+      }
-+    }
-     if (is_verbose)
-     {
-       static struct mystr s_final_file_str;
-@@ -246,8 +246,30 @@ vsf_filename_passes_filter(const struct
+@@ -7,6 +7,7 @@
+  * Would you believe, code to handle directory listing.
+  */
+ 
++#include <stdlib.h>
+ #include "ls.h"
+ #include "access.h"
+ #include "defs.h"
+@@ -243,11 +244,42 @@ vsf_filename_passes_filter(const struct
+   struct mystr temp_str = INIT_MYSTR;
+   struct mystr brace_list_str = INIT_MYSTR;
+   struct mystr new_filter_str = INIT_MYSTR;
++  struct mystr normalize_filename_str = INIT_MYSTR;
++  const char *normname;
++  const char *path;
    int ret = 0;
    char last_token = 0;
    int must_match_at_current_pos = 1;
-+
 +
    str_copy(&filter_remain_str, p_filter_str);
 -  str_copy(&name_remain_str, p_filename_str);
 +
-+  if (!str_isempty (&filter_remain_str) && !str_isempty(p_filename_str)) {
++  /* normalize filepath */
++  path = str_strdup(p_filename_str);
++  normname = realpath(path, NULL);
++  if (normname == NULL)
++     goto out;
++  str_alloc_text(&normalize_filename_str, normname);
++
++  if (!str_isempty (&filter_remain_str) && !str_isempty(&normalize_filename_str)) {
 +    if (str_get_char_at(p_filter_str, 0) == '/') {
-+      if (str_get_char_at(p_filename_str, 0) != '/') {
++      if (str_get_char_at(&normalize_filename_str, 0) != '/') {
 +        str_getcwd (&name_remain_str);
 +
 +        if (str_getlen(&name_remain_str) > 1) /* cwd != root dir */
 +          str_append_char (&name_remain_str, '/');
 +
-+        str_append_str (&name_remain_str, p_filename_str);
++        str_append_str (&name_remain_str, &normalize_filename_str);
 +      }
 +      else
-+       str_copy (&name_remain_str, p_filename_str);
++       str_copy (&name_remain_str, &normalize_filename_str);
 +    } else {
 +      if (str_get_char_at(p_filter_str, 0) != '{')
-+        str_basename (&name_remain_str, p_filename_str);
++        str_basename (&name_remain_str, &normalize_filename_str);
 +      else
-+        str_copy (&name_remain_str, p_filename_str);
++        str_copy (&name_remain_str, &normalize_filename_str);
 +    }
 +  } else
-+    str_copy(&name_remain_str, p_filename_str);
++    str_copy(&name_remain_str, &normalize_filename_str);
  
    while (!str_isempty(&filter_remain_str) && *iters < VSFTP_MATCHITERS_MAX)
    {
+@@ -360,6 +392,9 @@ vsf_filename_passes_filter(const struct
+     ret = 0;
+   }
+ out:
++  free(normname);
++  free(path);
++  str_free(&normalize_filename_str);
+   str_free(&filter_remain_str);
+   str_free(&name_remain_str);
+   str_free(&temp_str);
 Index: vsftpd-3.0.2/str.c
 ===================================================================
 --- vsftpd-3.0.2.orig/str.c
diff --git a/vsftpd.changes b/vsftpd.changes
index 7ea736c..a644eb4 100644
--- a/vsftpd.changes
+++ b/vsftpd.changes
@@ -2,14 +2,14 @@
 Fri Feb 20 12:13:42 UTC 2015 - tchvatal@suse.com
 
 - Add service calls for other unit files too
-- WIP udate filter patch to work as expected:
+- Udate filter patch to work as expected:
   * vsftpd-2.1.0-filter.patch
 
 -------------------------------------------------------------------
 Fri Jan  2 10:32:53 UTC 2015 - tchvatal@suse.com
 
 - Try to fix deny_file parsing to do more what is expected. Taken
-  from fedora. bnc#900326
+  from fedora. bnc#900326 bnc#915522 CVE-2015-1419
   * vsftpd-2.1.0-filter.patch
 
 -------------------------------------------------------------------