pkgsrc-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[pkgsrc/trunk]: pkgsrc/devel/libosip Import security fixes for libosip2
details: https://anonhg.NetBSD.org/pkgsrc/rev/6e0fdb87e506
branches: trunk
changeset: 322506:6e0fdb87e506
user: khorben <khorben%pkgsrc.org@localhost>
date: Sun Apr 21 16:25:38 2019 +0000
description:
Import security fixes for libosip2
This adds patches for the following CVE entries:
- CVE-2016-10324
- CVE-2016-10325
- CVE-2016-10326
- CVE-2017-7853
All patches were obtained from Debian and verified to match upstream.
While there, rename and comment the previous patch.
Bumps PKGREVISION.
XXX pull-up
diffstat:
devel/libosip/Makefile | 3 +-
devel/libosip/distinfo | 8 +-
devel/libosip/patches/patch-aa | 37 ---------
devel/libosip/patches/patch-src_osip2_port__sema.c | 39 ++++++++++
devel/libosip/patches/patch-src_osipparser2_osip__body.c | 21 +++++
devel/libosip/patches/patch-src_osipparser2_osip__message__parse.c | 19 ++++
devel/libosip/patches/patch-src_osipparser2_osip__message__to__str.c | 20 +++++
devel/libosip/patches/patch-src_osipparser2_osip__port.c | 18 ++++
8 files changed, 125 insertions(+), 40 deletions(-)
diffs (208 lines):
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/Makefile
--- a/devel/libosip/Makefile Sun Apr 21 16:03:21 2019 +0000
+++ b/devel/libosip/Makefile Sun Apr 21 16:25:38 2019 +0000
@@ -1,7 +1,8 @@
-# $NetBSD: Makefile,v 1.19 2014/10/09 14:06:10 wiz Exp $
+# $NetBSD: Makefile,v 1.20 2019/04/21 16:25:38 khorben Exp $
#
DISTNAME= libosip2-4.1.0
+PKGREVISION= 1
CATEGORIES= devel
MASTER_SITES= ${MASTER_SITE_GNU:=osip/}
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/distinfo
--- a/devel/libosip/distinfo Sun Apr 21 16:03:21 2019 +0000
+++ b/devel/libosip/distinfo Sun Apr 21 16:25:38 2019 +0000
@@ -1,7 +1,11 @@
-$NetBSD: distinfo,v 1.15 2015/11/03 03:27:43 agc Exp $
+$NetBSD: distinfo,v 1.16 2019/04/21 16:25:38 khorben Exp $
SHA1 (libosip2-4.1.0.tar.gz) = 61459c9052ca2f5e77a6936c9b369e2b0602c080
RMD160 (libosip2-4.1.0.tar.gz) = 3f86bf7872cd382f331b49f5e03a6ddddd338afa
SHA512 (libosip2-4.1.0.tar.gz) = 8a04e047052aa6b970bb107aa8c0f94ed7c984defe69c3f2788f0b7677325812925a9386c1059499aa0940bb524ac1f724b5489f08e5b2210d190bad68271ee7
Size (libosip2-4.1.0.tar.gz) = 636382 bytes
-SHA1 (patch-aa) = ba19e1ad149d2e7f0b0b44c38b48b1f5031dc587
+SHA1 (patch-src_osip2_port__sema.c) = 690cc6204025566f605cfc58a1652b95afc8e65f
+SHA1 (patch-src_osipparser2_osip__body.c) = fcbbb11e6a1b87f46faa1742d75a1951342b4095
+SHA1 (patch-src_osipparser2_osip__message__parse.c) = 2f9fea6f6ebea18b1bccb685a731ddf2295728dd
+SHA1 (patch-src_osipparser2_osip__message__to__str.c) = 12d559f25566c2143c9a679befb4b28bd03c3a63
+SHA1 (patch-src_osipparser2_osip__port.c) = 3723661ad715531bebb4ba6af7dd2e056f205e93
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/patches/patch-aa
--- a/devel/libosip/patches/patch-aa Sun Apr 21 16:03:21 2019 +0000
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,37 +0,0 @@
-$NetBSD: patch-aa,v 1.7 2014/07/12 16:48:26 schwarz Exp $
-
---- src/osip2/port_sema.c.orig 2013-12-18 19:36:46.000000000 +0100
-+++ src/osip2/port_sema.c 2014-07-12 18:20:40.000000000 +0200
-@@ -305,7 +305,6 @@
- struct osip_sem *
- osip_sem_init (unsigned int value)
- {
-- union semun val;
- int i;
- osip_sem_t *sem = (osip_sem_t *) osip_malloc (sizeof (osip_sem_t));
-
-@@ -318,8 +317,7 @@
- osip_free (sem);
- return NULL;
- }
-- val.val = (int) value;
-- i = semctl (sem->semid, 0, SETVAL, val);
-+ i = semctl(sem->semid, 0, SETVAL, value);
- if (i != 0) {
- perror ("semctl error");
- osip_free (sem);
-@@ -331,13 +329,11 @@
- int
- osip_sem_destroy (struct osip_sem *_sem)
- {
-- union semun val;
- osip_sem_t *sem = (osip_sem_t *) _sem;
-
- if (sem == NULL)
- return OSIP_SUCCESS;
-- val.val = 0;
-- semctl (sem->semid, 0, IPC_RMID, val);
-+ semctl(sem->semid, 0, IPC_RMID, 0);
- osip_free (sem);
- return OSIP_SUCCESS;
- }
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/patches/patch-src_osip2_port__sema.c
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/devel/libosip/patches/patch-src_osip2_port__sema.c Sun Apr 21 16:25:38 2019 +0000
@@ -0,0 +1,39 @@
+$NetBSD: patch-src_osip2_port__sema.c,v 1.1 2019/04/21 16:25:38 khorben Exp $
+
+Fix the calls to semctl to make this package build on NetBSD 1.6
+
+--- src/osip2/port_sema.c.orig 2013-12-18 18:36:46.000000000 +0000
++++ src/osip2/port_sema.c
+@@ -305,7 +305,6 @@ osip_sem_trywait (struct osip_sem *_sem)
+ struct osip_sem *
+ osip_sem_init (unsigned int value)
+ {
+- union semun val;
+ int i;
+ osip_sem_t *sem = (osip_sem_t *) osip_malloc (sizeof (osip_sem_t));
+
+@@ -318,8 +317,7 @@ osip_sem_init (unsigned int value)
+ osip_free (sem);
+ return NULL;
+ }
+- val.val = (int) value;
+- i = semctl (sem->semid, 0, SETVAL, val);
++ i = semctl(sem->semid, 0, SETVAL, value);
+ if (i != 0) {
+ perror ("semctl error");
+ osip_free (sem);
+@@ -331,13 +329,11 @@ osip_sem_init (unsigned int value)
+ int
+ osip_sem_destroy (struct osip_sem *_sem)
+ {
+- union semun val;
+ osip_sem_t *sem = (osip_sem_t *) _sem;
+
+ if (sem == NULL)
+ return OSIP_SUCCESS;
+- val.val = 0;
+- semctl (sem->semid, 0, IPC_RMID, val);
++ semctl(sem->semid, 0, IPC_RMID, 0);
+ osip_free (sem);
+ return OSIP_SUCCESS;
+ }
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/patches/patch-src_osipparser2_osip__body.c
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/devel/libosip/patches/patch-src_osipparser2_osip__body.c Sun Apr 21 16:25:38 2019 +0000
@@ -0,0 +1,21 @@
+$NetBSD: patch-src_osipparser2_osip__body.c,v 1.1 2019/04/21 16:25:38 khorben Exp $
+
+Apply fix for CVE-2016-10326 (from Debian)
+
+--- src/osipparser2/osip_body.c.orig 2013-12-18 18:36:46.000000000 +0000
++++ src/osipparser2/osip_body.c
+@@ -417,6 +417,14 @@ osip_body_to_str (const osip_body_t * bo
+ }
+
+ if ((osip_list_size (body->headers) > 0) || (body->content_type != NULL)) {
++ if (length < tmp_body - ptr + 3) {
++ size_t len;
++
++ len = tmp_body - ptr;
++ length = length + 3 + body->length; /* add body->length, to avoid calling realloc often */
++ ptr = osip_realloc (ptr, length);
++ tmp_body = ptr + len;
++ }
+ tmp_body = osip_strn_append (tmp_body, CRLF, 2);
+ }
+ if (length < tmp_body - ptr + body->length + 4) {
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/patches/patch-src_osipparser2_osip__message__parse.c
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/devel/libosip/patches/patch-src_osipparser2_osip__message__parse.c Sun Apr 21 16:25:38 2019 +0000
@@ -0,0 +1,19 @@
+$NetBSD: patch-src_osipparser2_osip__message__parse.c,v 1.1 2019/04/21 16:25:38 khorben Exp $
+
+Apply fix for CVE-2017-7853 (from Debian)
+
+--- src/osipparser2/osip_message_parse.c.orig 2013-12-18 18:36:46.000000000 +0000
++++ src/osipparser2/osip_message_parse.c
+@@ -812,6 +812,12 @@ msg_osip_body_parse (osip_message_t * si
+ if ('\n' == start_of_body[0] || '\r' == start_of_body[0])
+ start_of_body++;
+
++ /* if message body is empty or contains a single CR/LF */
++ if (end_of_body <= start_of_body) {
++ osip_free (sep_boundary);
++ return OSIP_SYNTAXERROR;
++ }
++
+ body_len = end_of_body - start_of_body;
+
+ /* Skip CR before end boundary. */
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/patches/patch-src_osipparser2_osip__message__to__str.c
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/devel/libosip/patches/patch-src_osipparser2_osip__message__to__str.c Sun Apr 21 16:25:38 2019 +0000
@@ -0,0 +1,20 @@
+$NetBSD: patch-src_osipparser2_osip__message__to__str.c,v 1.1 2019/04/21 16:25:38 khorben Exp $
+
+Apply fix for CVE-2016-10325 (from Debian)
+
+--- src/osipparser2/osip_message_to_str.c.orig 2013-12-18 18:36:46.000000000 +0000
++++ src/osipparser2/osip_message_to_str.c
+@@ -378,6 +378,13 @@ _osip_message_to_str (osip_message_t * s
+ /* A start-line isn't required for message/sipfrag parts. */
+ }
+ else {
++ size_t message_len = strlen(tmp);
++ if (_osip_message_realloc (&message, dest, message_len + 3, &malloc_size) < 0) {
++ osip_free (tmp);
++ *dest = NULL;
++ return OSIP_NOMEM;
++ }
++
+ message = osip_str_append (message, tmp);
+ osip_free (tmp);
+ message = osip_strn_append (message, CRLF, 2);
diff -r fe02b182191a -r 6e0fdb87e506 devel/libosip/patches/patch-src_osipparser2_osip__port.c
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/devel/libosip/patches/patch-src_osipparser2_osip__port.c Sun Apr 21 16:25:38 2019 +0000
@@ -0,0 +1,18 @@
+$NetBSD: patch-src_osipparser2_osip__port.c,v 1.1 2019/04/21 16:25:38 khorben Exp $
+
+Apply fix for CVE-2016-10324 (from Debian)
+
+--- src/osipparser2/osip_port.c.orig 2013-12-18 18:36:46.000000000 +0000
++++ src/osipparser2/osip_port.c
+@@ -1462,8 +1462,10 @@ osip_clrncpy (char *dst, const char *src
+ char *p;
+ size_t spaceless_length;
+
+- if (src == NULL)
++ if (src == NULL || len == 0) {
++ *dst = '\0';
+ return NULL;
++ }
+
+ /* find the start of relevant text */
+ pbeg = src;
Home |
Main Index |
Thread Index |
Old Index