From 6c918ab6ed9e945ec2888717cc78abae2b79b215 Mon Sep 17 00:00:00 2001
From: Karel Klíč <kklic@fedoraproject.org>
Date: Feb 23 2010 10:09:01 +0000
Subject: disallow -S '' parameter in gunzip


---

diff --git a/gzip-1.3.13-noemptysuffix.patch b/gzip-1.3.13-noemptysuffix.patch
new file mode 100644
index 0000000..a4a37e1
--- /dev/null
+++ b/gzip-1.3.13-noemptysuffix.patch
@@ -0,0 +1,42 @@
+diff -up gzip-1.3.13/gzip.1.noemptysuffix gzip-1.3.13/gzip.1
+--- gzip-1.3.13/gzip.1.noemptysuffix	2009-09-26 20:43:28.000000000 +0200
++++ gzip-1.3.13/gzip.1	2010-02-22 14:29:54.828770607 +0100
+@@ -291,15 +291,14 @@ will descend into the directory and comp
+ ).
+ .TP
+ .B \-S .suf   --suffix .suf
+-Use suffix .suf instead of .gz. Any suffix can be given, but suffixes
++When compressing, use suffix .suf instead of .gz.
++Any non-empty suffix can be given, but suffixes
+ other than .z and .gz should be avoided to avoid confusion when files
+-are transferred to other systems.  A null suffix forces gunzip to  try
+-decompression on all given files regardless of suffix, as in:
++are transferred to other systems.
+ 
+-    gunzip -S "" *       (*.* for MSDOS)
++When decompressing, add .suf to the beginning of the list of
++suffixes to try, when deriving an output file name from an input file name.
+ 
+-Previous versions of gzip used
+-the .z suffix. This was changed to avoid a conflict with
+ .IR pack "(1)".
+ .TP
+ .B \-t --test
+diff -up gzip-1.3.13/gzip.c.noemptysuffix gzip-1.3.13/gzip.c
+--- gzip-1.3.13/gzip.c.noemptysuffix	2010-02-22 14:29:54.000000000 +0100
++++ gzip-1.3.13/gzip.c	2010-02-22 14:34:33.480895239 +0100
+@@ -547,11 +547,11 @@ int main (argc, argv)
+ 		program_name);
+     }
+ #endif
+-    if ((z_len == 0 && !decompress) || z_len > MAX_SUFFIX) {
+-        fprintf(stderr, "%s: incorrect suffix '%s'\n",
+-                program_name, z_suffix);
++    if (z_len == 0 || z_len > MAX_SUFFIX) {
++        fprintf(stderr, "%s: invalid suffix '%s'\n", program_name, z_suffix);
+         do_exit(ERROR);
+     }
++
+     if (do_lzw && !decompress) work = lzw;
+ 
+     /* Allocate all global buffers (for DYN_ALLOC option) */
diff --git a/gzip.spec b/gzip.spec
index 2f0a9c8..17bed6f 100644
--- a/gzip.spec
+++ b/gzip.spec
@@ -1,7 +1,7 @@
 Summary: The GNU data compression program
 Name: gzip
 Version: 1.3.12
-Release: 10%{?dist}
+Release: 11%{?dist}
 # info pages are under GFDL license
 License: GPLv2 and GFDL
 Group: Applications/File
@@ -19,6 +19,8 @@ Patch17: gzip-1.3.12-futimens.patch
 Patch18: gzip-1.3.12-zdiff.patch
 Patch19: gzip-1.3.12-cve-2009-2624.patch
 Patch20: gzip-1.3.12-cve-2010-0001.patch
+# Fixed in upstream
+Patch21: gzip-1.3.13-noemptysuffix.patch
 URL: http://www.gzip.org/
 Requires: /sbin/install-info
 Requires: mktemp less
@@ -47,6 +49,7 @@ very commonly used data compression program.
 %patch18 -p1 -b .ret
 %patch19 -p1 -b .cve-2009-2624
 %patch20 -p1 -b .cve-2010-0001
+%patch21 -p1 -b .noemptysuffix
 
 %build
 export DEFS="NO_ASM"
@@ -94,6 +97,9 @@ fi
 %{_infodir}/gzip.info*
 
 %changelog
+* Mon Feb 22 2010 Karel Klic <kklic@redhat.com> - 1.3.12-11
+- Added a patch to disallow -S '' parameter (noemptysuffix)
+
 * Tue Jan 19 2010 Karel Klic <kklic@redhat.com> - 1.3.12-10
 - fixes for CVE-2009-2624 and CVE-2010-0001
   Resolves: rhbz#557471