Bug#774158: wheezy-pu: package netcfg/1.108+deb7u3

[Cyril Brulebois <kibi@debian.org>]

Package: release.debian.org
Severity: normal
Tags: wheezy
User: release.debian.org@packages.debian.org
Usertags: pu

Hello,

please allow the following upload to wheezy-pu:
| netcfg (1.108+deb7u3) wheezy; urgency=low
| 
|   * Fix missing bounds check on nameserver array iteration, leading to a
|     crash when 4 (or more) nameservers are available (Closes: #768218).
|     Thanks, Kjell Braden, for the bug report, patch, and tests!
| 
|  -- Cyril Brulebois <kibi@debian.org>  Thu, 06 Nov 2014 12:13:40 +0100

Thanks for your time.

Mraw,
KiBi.

diff -Nru netcfg-1.108+deb7u2/debian/changelog netcfg-1.108+deb7u3/debian/changelog
--- netcfg-1.108+deb7u2/debian/changelog	2014-09-28 17:15:56.000000000 +0200
+++ netcfg-1.108+deb7u3/debian/changelog	2014-12-29 18:36:19.000000000 +0100
@@ -1,3 +1,11 @@
+netcfg (1.108+deb7u3) wheezy; urgency=low
+
+  * Fix missing bounds check on nameserver array iteration, leading to a
+    crash when 4 (or more) nameservers are available (Closes: #768218).
+    Thanks, Kjell Braden, for the bug report, patch, and tests!
+
+ -- Cyril Brulebois <kibi@debian.org>  Mon, 29 Dec 2014 18:36:19 +0100
+
 netcfg (1.108+deb7u2) wheezy; urgency=low
 
   * Fix support for entering an ESSID manually, it was previously
diff -Nru netcfg-1.108+deb7u2/nm-conf.c netcfg-1.108+deb7u3/nm-conf.c
--- netcfg-1.108+deb7u2/nm-conf.c	2012-11-22 00:36:15.000000000 +0100
+++ netcfg-1.108+deb7u3/nm-conf.c	2014-12-29 18:34:27.000000000 +0100
@@ -88,7 +88,8 @@
     /* Get DNS in printable format. */
     memset(buffer, 0, NM_MAX_LEN_BUF);
 
-    for (i = 0; !empty_str(ipvx.nameservers[i]); i++) {
+    for (i = 0; (i < NETCFG_NAMESERVERS_MAX) &&
+               (!empty_str(ipvx.nameservers[i])); i++) {
         strcat(buffer, ipvx.nameservers[i]);
         strcat(buffer, ";");
     }