SOURCES/001-review-of-CWE-170-CWE-772.patch

@@ -0,0 +1,57 @@
+From 4bbfd43121e4c1f59074b1b0def9804c1890b2dc Mon Sep 17 00:00:00 2001
+From: Jan Macku <jamacku@redhat.com>
+Date: Mon, 19 Jul 2021 09:48:19 +0200
+Subject: [PATCH] review of CWE-170, CWE-772
+
+Resolves: #1938887
+---
+ libsupp/clif.c          | 2 ++
+ traceroute/traceroute.c | 7 ++++++-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/libsupp/clif.c b/libsupp/clif.c
+index 4ef20e4..60ec291 100644
+--- a/libsupp/clif.c
++++ b/libsupp/clif.c
+@@ -229,10 +229,12 @@ static void err_bad_arg (const CLIF_option *optn, char c, int n) {
+ 
+ 	if (c) {
+ 	    s = show_short (&tmp);	/*  always without arg...  */
++	    /* coverity[buffer_size_warning] - not a bug, s ends with '\0', see line 97 */
+ 	    strncpy (ss, s, sizeof (ss));
+ 	    s = show_short (optn);
+ 	} else {
+ 	    s = show_long (&tmp);	/*  always without arg...  */
++	    /* coverity[buffer_size_warning] - not a bug, s ends with '\0', see line 97 */
+ 	    strncpy (ss, s, sizeof (ss));
+ 	    s = show_long (optn);
+ 	}
+diff --git a/traceroute/traceroute.c b/traceroute/traceroute.c
+index 4be9b24..0a29e36 100644
+--- a/traceroute/traceroute.c
++++ b/traceroute/traceroute.c
+@@ -217,8 +217,12 @@ static int getaddr (const char *name, sockaddr_any *addr) {
+ 	}
+ 	if (!ai)  ai = res;	/*  anything...  */
+ 
+-	if (ai->ai_addrlen > sizeof (*addr))
++	if (ai->ai_addrlen > sizeof (*addr)) {
++		/* Avoid of leaking res (CWE-772) */
++		freeaddrinfo (res);
+ 		return -1;	/*  paranoia   */
++	}
++
+ 	memcpy (addr, ai->ai_addr, ai->ai_addrlen);
+ 
+ 	freeaddrinfo (res);
+@@ -244,6 +248,7 @@ static void make_fd_used (int fd) {
+ 	    close (nfd);
+ 	}
+ 
++	/* coverity[leaked_handle] - not a bug, see line 665 */
+ 	return;
+ }
+ 
+-- 
+2.31.1
+

SPECS/traceroute.spec

@@ -2,15 +2,19 @@ Summary: Traces the route taken by packets over an IPv4/IPv6 network
 Name: traceroute
 Epoch: 3
 Version: 2.1.0
-Release: 6%{?dist}
-Group: Applications/Internet
+Release: 16%{?dist}
 License: GPLv2+
 URL:  http://traceroute.sourceforge.net
-Source0: http://downloads.sourceforge.net/project/traceroute/traceroute/traceroute-%{version}/traceroute-%{version}.tar.gz
+Source0: https://downloads.sourceforge.net/project/traceroute/traceroute/traceroute-%{version}/traceroute-%{version}.tar.gz
+
+Patch001: 001-review-of-CWE-170-CWE-772.patch
 
 Provides: tcptraceroute = 1.5-1
 Obsoletes: tcptraceroute < 1.5-1
 
+BuildRequires: make
+BuildRequires: gcc
+
 
 %description
 The traceroute utility displays the route used by IP packets on their
@@ -27,38 +31,65 @@ problems.
 %prep
 %setup -q
 
+%patch001 -p1
+
 
 %build
-make %{?_smp_mflags} CFLAGS="$RPM_OPT_FLAGS" LDFLAGS="$RPM_LD_FLAGS"
+%make_build CFLAGS="$RPM_OPT_FLAGS" LDFLAGS="$RPM_LD_FLAGS"
 
 
 %install
-
-install -d $RPM_BUILD_ROOT/bin
-install -m755 traceroute/traceroute $RPM_BUILD_ROOT/bin
-pushd $RPM_BUILD_ROOT/bin
-ln -s traceroute traceroute6
-popd
-
-install -d $RPM_BUILD_ROOT%{_bindir}
-install -m755 wrappers/tcptraceroute $RPM_BUILD_ROOT%{_bindir}
-
-install -d $RPM_BUILD_ROOT%{_mandir}/man8
-install -p -m644 traceroute/traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8
-pushd $RPM_BUILD_ROOT%{_mandir}/man8
-ln -s traceroute.8 traceroute6.8
-ln -s traceroute.8 tcptraceroute.8
-popd
+install -D -p -m755 traceroute/traceroute $RPM_BUILD_ROOT%{_bindir}/traceroute
+ln -s traceroute $RPM_BUILD_ROOT%{_bindir}/traceroute6
+install -D -p -m755 wrappers/tcptraceroute $RPM_BUILD_ROOT%{_bindir}/tcptraceroute
+install -D -p -m644 traceroute/traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8/traceroute.8
+ln -s traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8/traceroute6.8
+ln -s traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8/tcptraceroute.8
 
 
 %files
-%doc COPYING README TODO CREDITS
-/bin/*
+%license COPYING
+%doc README TODO CREDITS
 %{_bindir}/*
 %{_mandir}/*/*
 
 
 %changelog
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 3:2.1.0-16
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Mon Jul 19 2021 Jan Macku <jamacku@redhat.com> - 3:2.1.0-15
+- review of CWE-170 and CWE-772 (#1938887)
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3:2.1.0-14
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jan 13 2021 Dmitry Butskoy <Dmitry@Butskoy.name> - 3:2.1.0-13
+- Install into %{_bindir} (#1915614)
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 3:2.1.0-11
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild