diff -Nru apt-1.3.1/apt-pkg/contrib/gpgv.cc apt-1.3.2/apt-pkg/contrib/gpgv.cc --- apt-1.3.1/apt-pkg/contrib/gpgv.cc 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/apt-pkg/contrib/gpgv.cc 2016-12-08 15:22:30.000000000 +0100 @@ -244,6 +244,20 @@ } /*}}}*/ // SplitClearSignedFile - split message into data/signature /*{{{*/ +static int GetLineErrno(char **lineptr, size_t *n, FILE *stream, std::string const &InFile) +{ + int result; + + errno = 0; + result = getline(lineptr, n, stream); + if (errno != 0) + { + _error->Errno("getline", "Could not read from %s", InFile.c_str()); + return -1; + } + + return result; +} bool SplitClearSignedFile(std::string const &InFile, FileFd * const ContentFile, std::vector * const ContentHeader, FileFd * const SignatureFile) { @@ -259,7 +273,8 @@ char *buf = NULL; size_t buf_size = 0; - while (getline(&buf, &buf_size, in) != -1) + _error->PushToStack(); + while (GetLineErrno(&buf, &buf_size, in, InFile) != -1) { _strrstrip(buf); if (found_message_start == false) @@ -323,6 +338,18 @@ if (buf != NULL) free(buf); + // Flush the files. Errors will be checked below. + if (SignatureFile != nullptr) + SignatureFile->Flush(); + if (ContentFile != nullptr) + ContentFile->Flush(); + + // An error occured during reading - propagate it up + bool const hasErrored = _error->PendingError(); + _error->MergeWithStack(); + if (hasErrored) + return false; + if (found_signature == true) return _error->Error("Signature in file %s wasn't closed", InFile.c_str()); diff -Nru apt-1.3.1/CMakeLists.txt apt-1.3.2/CMakeLists.txt --- apt-1.3.1/CMakeLists.txt 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/CMakeLists.txt 2016-12-08 15:22:30.000000000 +0100 @@ -170,7 +170,7 @@ # Configure some variables like package, version and architecture. set(PACKAGE ${PROJECT_NAME}) set(PACKAGE_MAIL "APT Development Team ") -set(PACKAGE_VERSION "1.3.1") +set(PACKAGE_VERSION "1.3.2") if (NOT DEFINED COMMON_ARCH) execute_process(COMMAND dpkg-architecture -qDEB_HOST_ARCH diff -Nru apt-1.3.1/debian/changelog apt-1.3.2/debian/changelog --- apt-1.3.1/debian/changelog 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/debian/changelog 2016-12-08 15:22:30.000000000 +0100 @@ -1,3 +1,13 @@ +apt (1.3.2) yakkety-security; urgency=high + + * Hack around Ubuntu rejecting symlink copyright + * SECURITY UPDATE: gpgv: Check for errors when splitting files (CVE-2016-1252) + Thanks to Jann Horn, Google Project Zero for reporting the issue + (LP: #1647467) + * gpgv: Flush the files before checking for errors + + -- Julian Andres Klode Thu, 08 Dec 2016 15:22:30 +0100 + apt (1.3.1) unstable; urgency=medium [ Julian Andres Klode ] diff -Nru apt-1.3.1/debian/copyright apt-1.3.2/debian/copyright --- apt-1.3.1/debian/copyright 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/debian/copyright 2016-12-08 15:22:30.000000000 +0100 @@ -20,3 +20,4 @@ See /usr/share/common-licenses/GPL-2, or for the terms of the latest version of the GNU General Public License. + diff -Nru apt-1.3.1/debian/gbp.conf apt-1.3.2/debian/gbp.conf --- apt-1.3.1/debian/gbp.conf 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/debian/gbp.conf 2016-12-08 15:22:30.000000000 +0100 @@ -3,7 +3,7 @@ ;preexport = ./prepare-release pre-export prebuild = ./prepare-release pre-build postbuild = ./prepare-release post-build -debian-branch = master +debian-branch = 1.3.y debian-tag = %(version)s export-dir = ../build-area sign-tags = True diff -Nru apt-1.3.1/doc/apt-cache.8.xml apt-1.3.2/doc/apt-cache.8.xml --- apt-1.3.1/doc/apt-cache.8.xml 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/apt-cache.8.xml 2016-12-08 15:22:30.000000000 +0100 @@ -14,7 +14,7 @@ &apt-email; &apt-product; - 2016-09-20T00:00:00Z + 2016-10-04T00:00:00Z diff -Nru apt-1.3.1/doc/apt.conf.5.xml apt-1.3.2/doc/apt.conf.5.xml --- apt-1.3.1/doc/apt.conf.5.xml 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/apt.conf.5.xml 2016-12-08 15:22:30.000000000 +0100 @@ -19,7 +19,7 @@ &apt-email; &apt-product; - 2016-09-20T00:00:00Z + 2016-10-04T00:00:00Z diff -Nru apt-1.3.1/doc/apt-get.8.xml apt-1.3.2/doc/apt-get.8.xml --- apt-1.3.1/doc/apt-get.8.xml 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/apt-get.8.xml 2016-12-08 15:22:30.000000000 +0100 @@ -14,7 +14,7 @@ &apt-email; &apt-product; - 2016-09-20T00:00:00Z + 2016-10-04T00:00:00Z diff -Nru apt-1.3.1/doc/apt-verbatim.ent apt-1.3.2/doc/apt-verbatim.ent --- apt-1.3.1/doc/apt-verbatim.ent 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/apt-verbatim.ent 2016-12-08 15:22:30.000000000 +0100 @@ -239,7 +239,7 @@ "> - + diff -Nru apt-1.3.1/doc/po/apt-doc.pot apt-1.3.2/doc/po/apt-doc.pot --- apt-1.3.1/doc/po/apt-doc.pot 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/apt-doc.pot 2016-12-08 15:22:30.000000000 +0100 @@ -5,9 +5,9 @@ #, fuzzy msgid "" msgstr "" -"Project-Id-Version: apt-doc 1.3.1\n" +"Project-Id-Version: apt-doc 1.3.2\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" diff -Nru apt-1.3.1/doc/po/de.po apt-1.3.2/doc/po/de.po --- apt-1.3.1/doc/po/de.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/de.po 2016-12-08 15:22:30.000000000 +0100 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.0.8\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2014-09-14 14:46+0200\n" "Last-Translator: Chris Leick \n" "Language-Team: German \n" diff -Nru apt-1.3.1/doc/po/es.po apt-1.3.2/doc/po/es.po --- apt-1.3.1/doc/po/es.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/es.po 2016-12-08 15:22:30.000000000 +0100 @@ -38,7 +38,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.0.5\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2014-07-04 01:31+0200\n" "Last-Translator: Omar Campagne \n" "Language-Team: Debian l10n Spanish \n" diff -Nru apt-1.3.1/doc/po/fr.po apt-1.3.2/doc/po/fr.po --- apt-1.3.1/doc/po/fr.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/fr.po 2016-12-08 15:22:30.000000000 +0100 @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.0.5\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2014-11-15 17:26+0100\n" "Last-Translator: Jean-Pierre Giraud \n" "Language-Team: French \n" diff -Nru apt-1.3.1/doc/po/it.po apt-1.3.2/doc/po/it.po --- apt-1.3.1/doc/po/it.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/it.po 2016-12-08 15:22:30.000000000 +0100 @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.0.5\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2015-12-27 21:26+0200\n" "Last-Translator: Beatrice Torracca \n" "Language-Team: Italian \n" diff -Nru apt-1.3.1/doc/po/ja.po apt-1.3.2/doc/po/ja.po --- apt-1.3.1/doc/po/ja.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/ja.po 2016-12-08 15:22:30.000000000 +0100 @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.3\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2016-09-03 03:30+0900\n" "Last-Translator: Takuma Yamada \n" "Language-Team: Japanese \n" diff -Nru apt-1.3.1/doc/po/nl.po apt-1.3.2/doc/po/nl.po --- apt-1.3.1/doc/po/nl.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/nl.po 2016-12-08 15:22:30.000000000 +0100 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.1.10-nl\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2016-02-01 16:17+0100\n" "Last-Translator: Frans Spiesschaert \n" "Language-Team: Debian Dutch l10n Team \n" diff -Nru apt-1.3.1/doc/po/pl.po apt-1.3.2/doc/po/pl.po --- apt-1.3.1/doc/po/pl.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/pl.po 2016-12-08 15:22:30.000000000 +0100 @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.0.5\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2014-07-04 02:13+0200\n" "Last-Translator: Robert Luberda \n" "Language-Team: Polish \n" diff -Nru apt-1.3.1/doc/po/pt_BR.po apt-1.3.2/doc/po/pt_BR.po --- apt-1.3.1/doc/po/pt_BR.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/pt_BR.po 2016-12-08 15:22:30.000000000 +0100 @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.0.5\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2004-09-20 17:02+0000\n" "Last-Translator: André Luís Lopes \n" "Language-Team: \n" diff -Nru apt-1.3.1/doc/po/pt.po apt-1.3.2/doc/po/pt.po --- apt-1.3.1/doc/po/pt.po 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/po/pt.po 2016-12-08 15:22:30.000000000 +0100 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: apt-doc 1.0.7\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: 2014-08-29 00:34+0100\n" "Last-Translator: Américo Monteiro \n" "Language-Team: Portuguese \n" diff -Nru apt-1.3.1/doc/sources.list.5.xml apt-1.3.2/doc/sources.list.5.xml --- apt-1.3.1/doc/sources.list.5.xml 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/doc/sources.list.5.xml 2016-12-08 15:22:30.000000000 +0100 @@ -14,7 +14,7 @@ &apt-email; &apt-product; - 2016-09-20T00:00:00Z + 2016-10-04T00:00:00Z diff -Nru apt-1.3.1/po/apt-all.pot apt-1.3.2/po/apt-all.pot --- apt-1.3.1/po/apt-all.pot 2016-10-04 19:43:35.000000000 +0200 +++ apt-1.3.2/po/apt-all.pot 2016-12-08 15:22:30.000000000 +0100 @@ -5,9 +5,9 @@ #, fuzzy msgid "" msgstr "" -"Project-Id-Version: apt 1.3.1\n" +"Project-Id-Version: apt 1.3.2\n" "Report-Msgid-Bugs-To: APT Development Team \n" -"POT-Creation-Date: 2016-10-04 19:44+0200\n" +"POT-Creation-Date: 2016-12-08 15:22+0100\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n"