OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Ralf S. Engelschall
Root: /v/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-src Date: 05-Sep-2005 17:01:09
Branch: HEAD Handle: 2005090516010900
Added files:
openpkg-src/str str.patch
Modified files:
openpkg-src/str str.spec
Log:
apply Security Fix (CAN-2005-2491, partially)
Summary:
Revision Changes Path
1.1 +27 -0 openpkg-src/str/str.patch
1.33 +3 -1 openpkg-src/str/str.spec
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-src/str/str.patch
============================================================================
$ cvs diff -u -r0 -r1.1 str.patch
--- /dev/null 2005-09-05 17:01:09 +0200
+++ str.patch 2005-09-05 17:01:09 +0200
@@ -0,0 +1,27 @@
+Security Fix (CAN-2005-2491, partially only)
+
+Index: str_pcre.c
+--- str_pcre.c.orig 2003-01-28 10:10:39 +0100
++++ str_pcre.c 2005-09-05 16:22:43 +0200
+@@ -674,6 +674,10 @@
+
+ while ((cd->ctypes[*p] & ctype_digit) != 0)
+ min = min * 10 + *p++ - '0';
++ if (min < 0 || min > 65535) {
++ *errorptr = ERR5;
++ return p;
++ }
+
+ if (*p == '}')
+ max = min;
+@@ -682,6 +686,10 @@
+ max = 0;
+ while ((cd->ctypes[*p] & ctype_digit) != 0)
+ max = max * 10 + *p++ - '0';
++ if (max < 0 || max > 65535) {
++ *errorptr = ERR5;
++ return p;
++ }
+ if (max < min) {
+ *errorptr = ERR4;
+ return p;
@@ .
patch -p0 <<'@@ .'
Index: openpkg-src/str/str.spec
============================================================================
$ cvs diff -u -r1.32 -r1.33 str.spec
--- openpkg-src/str/str.spec 15 Jun 2005 14:01:33 -0000 1.32
+++ openpkg-src/str/str.spec 5 Sep 2005 15:01:09 -0000 1.33
@@ -33,10 +33,11 @@
Group: Text
License: MIT/BSD-style
Version: 0.9.10
-Release: 20050615
+Release: 20050905
# list of sources
Source0: ftp://ftp.ossp.org/pkg/lib/str/str-%{version}.tar.gz
+Patch0: str.patch
# build information
Prefix: %{l_prefix}
@@ -62,6 +63,7 @@
%prep
%setup -q
+ %patch -p0
cp %{l_shtool} .
%build
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List [email protected]
