Description: Fix CVE-2015-3406, CVE-2015-3407 and CVE-2015-3408
 CVE-2015-3406: Module::Signature parses the unsigned portion of the
 SIGNATURE file as the signed portion due to incorrect handling of PGP
 signature boundaries.
 .
 CVE-2015-3407: Module::Signature incorrectly handles files that are not
 listed in the SIGNATURE file. This includes some files in the t/
 directory that would execute when tests are run.
 .
 CVE-2015-3408: Module::Signature uses two argument open() calls to read
 the files when generating checksums from the signed manifest, allowing
 to embed arbitrary shell commands into the SIGNATURE file that would
 execute during the signature verification process.
Origin: upstream, https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
Bug-Debian: https://bugs.debian.org/783451
Forwarded: not-needed
Author: Audrey Tang <audreyt@audreyt.org>
Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
Last-Update: 2015-05-12
Applied-Upstream: 0.75

--- a/Makefile.PL
+++ b/Makefile.PL
@@ -9,6 +9,7 @@ readme_from     'lib/Module/Signature.pm
 repository      'http://github.com/audreyt/module-signature';
 install_script  'script/cpansign';
 build_requires  'Test::More', 0, 'IPC::Run', 0;
+requires        'File::Temp';
 
 # On Win32 (excluding cygwin) we know that IO::Socket::INET,
 # which is needed for keyserver stuff, doesn't work. In fact
--- a/lib/Module/Signature.pm
+++ b/lib/Module/Signature.pm
@@ -57,6 +57,8 @@ sub _cipher_map {
     my @lines = split /\015?\012/, $sigtext;
     my %map;
     for my $line (@lines) {
+        last if $line eq '-----BEGIN PGP SIGNATURE-----';
+        next if $line =~ /^---/ .. $line eq '';
         my($cipher,$digest,$file) = split " ", $line, 3;
         return unless defined $file;
         $map{$file} = [$cipher, $digest];
@@ -65,7 +67,7 @@ sub _cipher_map {
 }
 
 sub verify {
-    my %args = ( skip => 1, @_ );
+    my %args = ( @_ );
     my $rv;
 
     (-r $SIGNATURE) or do {
@@ -177,6 +179,11 @@ sub _fullcheck {
         ($mani, $file) = ExtUtils::Manifest::fullcheck();
     }
     else {
+        my $_maniskip = &ExtUtils::Manifest::maniskip;
+        local *ExtUtils::Manifest::maniskip = sub { sub {
+            return unless $skip;
+            return $_maniskip->(@_);
+        } };
         ($mani, $file) = ExtUtils::Manifest::fullcheck();
     }
 
@@ -222,6 +229,11 @@ sub _verify_gpg {
 
     my $keyserver = _keyserver($version);
 
+    require File::Temp;
+    my $fh = File::Temp->new();
+    print $fh $sigtext;
+    close $fh;
+
     my @quiet = $Verbose ? () : qw(-q --logger-fd=1);
     my @cmd = (
         qw(gpg --verify --batch --no-tty), @quiet, ($KeyServer ? (
@@ -229,7 +241,7 @@ sub _verify_gpg {
             ($AutoKeyRetrieve and $version ge '1.0.7')
                 ? '--keyserver-options=auto-key-retrieve'
                 : ()
-        ) : ()), $SIGNATURE
+        ) : ()), $fh->filename
     );
 
     my $output = '';
@@ -241,6 +253,7 @@ sub _verify_gpg {
         my $cmd = join ' ', @cmd;
         $output = `$cmd`;
     }
+    unlink $fh->filename;
 
     if( $? ) {
         print STDERR $output;
@@ -269,7 +282,7 @@ sub _verify_crypt_openpgp {
     my $pgp = Crypt::OpenPGP->new(
         ($KeyServer) ? ( KeyServer => $KeyServer, AutoKeyRetrieve => $AutoKeyRetrieve ) : (),
     );
-    my $rv = $pgp->handle( Filename => $SIGNATURE )
+    my $rv = $pgp->handle( Data => $sigtext )
         or die $pgp->errstr;
 
     return SIGNATURE_BAD if (!$rv->{Validity} and $AutoKeyRetrieve);
@@ -292,32 +305,35 @@ sub _read_sigfile {
     my $well_formed;
 
     local *D;
-    open D, $sigfile or die "Could not open $sigfile: $!";
+    open D, "< $sigfile" or die "Could not open $sigfile: $!";
 
     if ($] >= 5.006 and <D> =~ /\r/) {
         close D;
-        open D, $sigfile or die "Could not open $sigfile: $!";
+        open D, '<', $sigfile or die "Could not open $sigfile: $!";
         binmode D, ':crlf';
     } else {
         close D;
-        open D, $sigfile or die "Could not open $sigfile: $!";
+        open D, "< $sigfile" or die "Could not open $sigfile: $!";
     }
 
+    my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
+    my $end = "-----END PGP SIGNATURE-----\n";
     while (<D>) {
-        next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
-        last if /^-----BEGIN PGP SIGNATURE/;
-
+        next if (1 .. ($_ eq $begin));
         $signature .= $_;
+        return "$begin$signature" if $_ eq $end;
     }
 
-    return ((split(/\n+/, $signature, 2))[1]);
+    return;
 }
 
 sub _compare {
     my ($str1, $str2, $ok) = @_;
 
     # normalize all linebreaks
+    $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
     $str1 =~ s/[^\S ]+/\n/g; $str2 =~ s/[^\S ]+/\n/g;
+    $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
 
     return $ok if $str1 eq $str2;
 
@@ -328,7 +344,7 @@ sub _compare {
     }
     else {
         local (*D, *S);
-        open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
+        open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
         open D, "| diff -u $SIGNATURE -" or (warn "Could not call diff: $!", return SIGNATURE_MISMATCH);
         while (<S>) {
             print D $_ if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
@@ -391,9 +407,9 @@ sub _sign_gpg {
         die "Cannot find $sigfile.tmp, signing aborted.\n";
     };
 
-    open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
+    open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
 
-    open S, ">$sigfile" or do {
+    open S, "> $sigfile" or do {
         unlink "$sigfile.tmp";
         die "Could not write to $sigfile: $!";
     };
@@ -576,7 +592,7 @@ sub _mkdigest_files {
         }
         else {
             local *F;
-            open F, $file or die "Cannot open $file for reading: $!";
+            open F, "< $file" or die "Cannot open $file for reading: $!";
             if (-B $file) {
                 binmode(F);
                 $obj->addfile(*F);