OpenPKG CVS Repository http://cvs.openpkg.org/ ____________________________________________________________________________
Server: cvs.openpkg.org Name: Michael Schloh Root: /e/openpkg/cvs Email: [EMAIL PROTECTED] Module: openpkg-src Date: 16-Apr-2004 16:08:30 Branch: OPENPKG_1_3_SOLID Handle: 2004041615082900 Added files: (Branch: OPENPKG_1_3_SOLID) openpkg-src/neon neon.patch Modified files: (Branch: OPENPKG_1_3_SOLID) openpkg-src/neon neon.spec Log: add patchcode to remove vulnerabilities in format string handling as described in OpenPKG-SA-2004.016 (CAN-2004-0179) Summary: Revision Changes Path 1.1.2.2.2.1 +142 -0 openpkg-src/neon/neon.patch 1.27.2.3.2.2+3 -1 openpkg-src/neon/neon.spec ____________________________________________________________________________ patch -p0 <<'@@ .' Index: openpkg-src/neon/neon.patch ============================================================================ $ cvs diff -u -r0 -r1.1.2.2.2.1 neon.patch --- /dev/null 2004-04-16 16:08:30.000000000 +0200 +++ neon.patch 2004-04-16 16:08:30.000000000 +0200 @@ -0,0 +1,142 @@ +diff -Nau src/ne_207.c.orig src/ne_207.c +--- src/ne_207.c.orig 2003-04-21 19:18:06.000000000 +0200 ++++ src/ne_207.c 2004-04-16 14:36:07.000000000 +0200 +@@ -320,12 +320,12 @@ + if (ne_get_status(req)->code == 207) { + if (!ne_xml_valid(p)) { + /* The parse was invalid */ +- ne_set_error(sess, ne_xml_get_error(p)); ++ ne_set_error(sess, "%s", ne_xml_get_error(p)); + ret = NE_ERROR; + } else if (ctx.is_error) { + /* If we've actually got any error information + * from the 207, then set that as the error */ +- ne_set_error(sess, ctx.buf->data); ++ ne_set_error(sess, "%s", ctx.buf->data); + ret = NE_ERROR; + } + } else if (ne_get_status(req)->klass != 2) { +diff -Nau src/ne_auth.c.orig src/ne_auth.c +--- src/ne_auth.c.orig 2003-03-09 12:10:02.000000000 +0100 ++++ src/ne_auth.c 2004-04-16 14:36:07.000000000 +0200 +@@ -950,7 +950,7 @@ + if (areq->auth_info_hdr != NULL && + verify_response(areq, sess, areq->auth_info_hdr)) { + NE_DEBUG(NE_DBG_HTTPAUTH, "Response authentication invalid.\n"); +- ne_set_error(sess->sess, _(sess->spec->fail_msg)); ++ ne_set_error(sess->sess, "%s", _(sess->spec->fail_msg)); + ret = NE_ERROR; + } else if (status->code == sess->spec->status_code && + areq->auth_hdr != NULL) { +diff -Nau src/ne_locks.c.orig src/ne_locks.c +--- src/ne_locks.c.orig 2003-06-19 00:10:58.000000000 +0200 ++++ src/ne_locks.c 2004-04-16 14:36:07.000000000 +0200 +@@ -734,7 +734,7 @@ + } + else if (parse_failed) { + ret = NE_ERROR; +- ne_set_error(sess, ne_xml_get_error(parser)); ++ ne_set_error(sess, "%s", ne_xml_get_error(parser)); + } + else if (ne_get_status(req)->code == 207) { + ret = NE_ERROR; +@@ -802,7 +802,7 @@ + if (ret == NE_OK && ne_get_status(req)->klass == 2) { + if (parse_failed) { + ret = NE_ERROR; +- ne_set_error(sess, ne_xml_get_error(parser)); ++ ne_set_error(sess, "%s", ne_xml_get_error(parser)); + } + else if (ne_get_status(req)->code == 207) { + ret = NE_ERROR; +diff -Nau src/ne_props.c.orig src/ne_props.c +--- src/ne_props.c.orig 2003-06-19 00:10:58.000000000 +0200 ++++ src/ne_props.c 2004-04-16 14:36:07.000000000 +0200 +@@ -142,7 +142,7 @@ + if (ret == NE_OK && ne_get_status(req)->klass != 2) { + ret = NE_ERROR; + } else if (!ne_xml_valid(handler->parser)) { +- ne_set_error(handler->sess, ne_xml_get_error(handler->parser)); ++ ne_set_error(handler->sess, "%s", ne_xml_get_error(handler->parser)); + ret = NE_ERROR; + } + +diff -Nau src/ne_xml.c.orig src/ne_xml.c +--- src/ne_xml.c.orig 2003-05-10 18:05:59.000000000 +0200 ++++ src/ne_xml.c 2004-04-16 14:36:07.000000000 +0200 +@@ -538,7 +538,7 @@ + + void ne_xml_set_error(ne_xml_parser *p, const char *msg) + { +- ne_snprintf(p->error, ERR_SIZE, msg); ++ ne_snprintf(p->error, ERR_SIZE, "%s", msg); + } + + #ifdef HAVE_LIBXML +diff -Nau test/props.c.orig test/props.c +--- test/props.c.orig 2003-04-22 16:13:56.000000000 +0200 ++++ test/props.c 2004-04-16 14:37:48.000000000 +0200 +@@ -81,6 +81,14 @@ + "<D:propstat/>" + "<D:status>HTTP/1.1 404 Not Found</D:status>" + "</D:multistatus>", ++ ++ /* format string handling with neon <= 0.24.4 */ ++ RESP207 "<?xml version=\"1.0\"?><D:multistatus xmlns:D=\"DAV:\">" ++ "<D:response><D:href>/foo/</D:href>" ++ "<D:propstat/>" ++ "<D:status>%s%s%s%s</D:status>" ++ "</D:response></D:multistatus>", ++ + NULL, + }; + ne_session *sess; +@@ -96,6 +104,40 @@ + return OK; + } + ++static int patch_regress(void) ++{ ++ static const char *bodies[] = { ++ /* format string handling bugs with neon <= 0.24.4 */ ++ RESP207 "<?xml version=\"1.0\"?><D:multistatus xmlns:D=\"DAV:\">" ++ "<D:response><D:href>/foo/</D:href>" ++ "<D:status>HTTP/1.1 500 Bad Voodoo</D:status>" ++ "<D:responsedescription>%s%s%s%s</D:responsedescription>" ++ "</D:response></D:multistatus>", ++ ++ RESP207 "<?xml version=\"1.0\"?><D:multistatus xmlns:D=\"DAV:\">" ++ "<D:response><D:href>/foo/</D:href>" ++ "<D:status>HTTP/1.1 %s%s%s%s</D:status>", ++ ++ NULL ++ }; ++ ne_session *sess; ++ int n; ++ static const ne_propname pn = { "DAV:", "foobar" }; ++ ne_proppatch_operation pops[] = { ++ { &pn, ne_propset, "fish" }, ++ { NULL, ne_propset, NULL } ++ }; ++ ++ for (n = 0; bodies[n] != NULL; n++) { ++ CALL(make_session(&sess, single_serve_string, (void *)bodies[n])); ++ ne_proppatch(sess, "/", pops); ++ ne_session_destroy(sess); ++ CALL(await_server()); ++ } ++ ++ return OK; ++} ++ + static int pstat_count; + + /* tos_*: set of 207 callbacks which serialize the data back into a +@@ -503,6 +545,7 @@ + T(patch_simple), + T(pfind_simple), + T(regress), ++ T(patch_regress), + T(NULL) + }; + @@ . patch -p0 <<'@@ .' Index: openpkg-src/neon/neon.spec ============================================================================ $ cvs diff -u -r1.27.2.3.2.1 -r1.27.2.3.2.2 neon.spec --- openpkg-src/neon/neon.spec 29 Jul 2003 15:00:10 -0000 1.27.2.3.2.1 +++ openpkg-src/neon/neon.spec 16 Apr 2004 14:08:29 -0000 1.27.2.3.2.2 @@ -33,10 +33,11 @@ Group: Web License: LGPL Version: 0.24.0 -Release: 1.3.0 +Release: 1.3.1 # list of sources Source0: http://www.webdav.org/neon/neon-%{version}.tar.gz +Patch0: neon.patch # build information Prefix: %{l_prefix} @@ -54,6 +55,7 @@ %prep %setup -q + %patch -p0 %build CC="%{l_cc}" \ @@ . ______________________________________________________________________ The OpenPKG Project www.openpkg.org CVS Repository Commit List [EMAIL PROTECTED]