$OpenBSD: patch-src_fr-command-rpm_c,v 1.4 2011/05/23 17:58:11 jasper Exp $

From 2899c092f249a4fa822a896baf128b6c8c75b634 Mon Sep 17 00:00:00 2001
From: Jasper Lievisse Adriaanse <jasper@humppa.nl>
Date: Mon, 23 May 2011 11:11:30 +0000
Subject: Prevent a NULL pointer deref in mktime_from_string().

It's possible to call mktime_from_string() with NULL arguments for day,
month and year. This would in turn lead to calling atoi(NULL),
which leads to a crash.
So instead fill in any NULL values with the corresponding unit from Jan 1st 1970.

--- src/fr-command-rpm.c.orig	Tue Apr 26 16:29:35 2011
+++ src/fr-command-rpm.c	Mon May 23 19:54:51 2011
@@ -62,23 +62,32 @@ mktime_from_string (char *month,
 				tm.tm_mon = i;
 				break;
 			}
-	}
-	tm.tm_mday = atoi (mday);
-	if (strchr (year, ':') != NULL) {
-		char **fields = g_strsplit (year, ":", 2);
-        	if (n_fields (fields) == 2) {
-	        	time_t      now;
-        		struct tm  *now_tm;
+	} else
+		tm.tm_mon = 0;
 
-	  		tm.tm_hour = atoi (fields[0]);
-	  		tm.tm_min = atoi (fields[1]);
+	if (mday != NULL) 
+		tm.tm_mday = atoi (mday);
+	else
+		tm.tm_mday = 1;
 
-	  		now = time(NULL);
-	  		now_tm = localtime (&now);
-	  		tm.tm_year = now_tm->tm_year;
-        	}
+	if (year != NULL) {
+		if (strchr (year, ':') != NULL) {
+			char **fields = g_strsplit (year, ":", 2);
+	        	if (n_fields (fields) == 2) {
+		        	time_t      now;
+	        		struct tm  *now_tm;
+
+		  		tm.tm_hour = atoi (fields[0]);
+		  		tm.tm_min = atoi (fields[1]);
+
+		  		now = time(NULL);
+		  		now_tm = localtime (&now);
+		  		tm.tm_year = now_tm->tm_year;
+	        	}
+		} else
+			tm.tm_year = atoi (year) - 1900;
 	} else
-		tm.tm_year = atoi (year) - 1900;
+		tm.tm_year = 70;
 
 	return mktime (&tm);
 }
@@ -233,7 +242,7 @@ fr_command_rpm_get_capabilities (FrCommand  *comm,
 	FrCommandCap capabilities;
 
 	capabilities = FR_COMMAND_CAN_ARCHIVE_MANY_FILES;
-	if (is_program_available ("cpio", check_command))
+	if (is_program_available ("gcpio", check_command))
 		capabilities |= FR_COMMAND_CAN_READ;
 
 	return capabilities;
@@ -244,7 +253,7 @@ static const char *
 fr_command_rpm_get_packages (FrCommand  *comm,
 			     const char *mime_type)
 {
-	return PACKAGES ("cpio,rpm");
+	return PACKAGES ("gcpio,rpm");
 }
 
 
