#! /bin/sh /usr/share/dpatch/dpatch-run
## bug#364872.dpatch.dpatch by  <rstuart@ras.pc.brisbane.lube>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Fix Debian bug #364872

@DPATCH@
diff -Nur cpio-2.6/src/extern.h cpio-2.6.new/src/extern.h
--- cpio-2.6/src/extern.h	2006-03-28 12:45:02.000000000 +1000
+++ cpio-2.6.new/src/extern.h	2006-04-26 20:21:54.000000000 +1000
@@ -158,7 +158,7 @@
 void write_out_tar_header P_((struct new_cpio_header *file_hdr, int out_des));
 int null_block P_((long *block, int size));
 void read_in_tar_header P_((struct new_cpio_header *file_hdr, int in_des));
-int otoa P_((char *s, unsigned long *n));
+void otoa P_((char *s, int maxsize, unsigned long *n));
 int is_tar_header P_((char *buf));
 int is_tar_filename_too_long P_((char *name));
 
diff -Nur cpio-2.6/src/tar.c cpio-2.6.new/src/tar.c
--- cpio-2.6/src/tar.c	2006-03-28 12:45:02.000000000 +1000
+++ cpio-2.6.new/src/tar.c	2006-04-26 20:21:02.000000000 +1000
@@ -302,7 +302,7 @@
 
   while (1)
     {
-      otoa (tar_hdr->chksum, &file_hdr->c_chksum);
+      otoa (tar_hdr->chksum, sizeof(tar_hdr->chksum), &file_hdr->c_chksum);
 
       if (file_hdr->c_chksum != tar_checksum (tar_hdr))
 	{
@@ -331,7 +331,7 @@
       else
 	file_hdr->c_name = stash_tar_filename (tar_hdr->prefix, tar_hdr->name);
       file_hdr->c_nlink = 1;
-      otoa (tar_hdr->mode, &file_hdr->c_mode);
+      otoa (tar_hdr->mode, sizeof(tar_hdr->mode), &file_hdr->c_mode);
       file_hdr->c_mode = file_hdr->c_mode & 07777;
   /* Debian hack: This version of cpio uses the -n flag also to extract
      tar archives using the numeric UID/GID instead of the user/group
@@ -340,17 +340,17 @@
 	  && (uidp = getuidbyname (tar_hdr->uname)))
 	file_hdr->c_uid = *uidp;
       else
-	otoa (tar_hdr->uid, &file_hdr->c_uid);
+	otoa (tar_hdr->uid, sizeof(tar_hdr->uid), &file_hdr->c_uid);
 
       if (archive_format == arf_ustar && !numeric_uid
 	  && (gidp = getgidbyname (tar_hdr->gname)))
 	file_hdr->c_gid = *gidp;
       else
-	otoa (tar_hdr->gid, &file_hdr->c_gid);
-      otoa (tar_hdr->size, &file_hdr->c_filesize);
-      otoa (tar_hdr->mtime, &file_hdr->c_mtime);
-      otoa (tar_hdr->devmajor, (unsigned long *) &file_hdr->c_rdev_maj);
-      otoa (tar_hdr->devminor, (unsigned long *) &file_hdr->c_rdev_min);
+	otoa (tar_hdr->gid, sizeof(tar_hdr->gid), &file_hdr->c_gid);
+      otoa (tar_hdr->size, sizeof(tar_hdr->size), &file_hdr->c_filesize);
+      otoa (tar_hdr->mtime, sizeof(tar_hdr->mtime), &file_hdr->c_mtime);
+      otoa (tar_hdr->devmajor, sizeof(tar_hdr->devmajor), (unsigned long *) &file_hdr->c_rdev_maj);
+      otoa (tar_hdr->devminor, sizeof(tar_hdr->devminor), (unsigned long *) &file_hdr->c_rdev_min);
       file_hdr->c_tar_linkname = NULL;
 
       switch (tar_hdr->typeflag)
@@ -422,23 +422,18 @@
 }
 
 /* Convert the string of octal digits S into a number and store
-   it in *N.  Return nonzero if the whole string was converted,
-   zero if there was something after the number.
-   Skip leading and trailing spaces.  */
+   it in *N.  */
 
-int
-otoa (char *s, unsigned long *n)
+void
+otoa (char *s, int maxsize, unsigned long *n)
 {
   unsigned long val = 0;
 
-  while (*s == ' ')
+  while (*s == ' ' && maxsize-- > 0)
     ++s;
-  while (*s >= '0' && *s <= '7')
+  while (*s >= '0' && *s <= '7' && maxsize-- > 0)
     val = 8 * val + *s++ - '0';
-  while (*s == ' ')
-    ++s;
   *n = val;
-  return *s == '\0';
 }
 
 /* Return
@@ -453,7 +448,7 @@
   struct tar_header *tar_hdr = (struct tar_header *) buf;
   unsigned long chksum;
 
-  otoa (tar_hdr->chksum, &chksum);
+  otoa (tar_hdr->chksum, sizeof(tar_hdr->chksum), &chksum);
 
   if (chksum != tar_checksum (tar_hdr))
     return 0;