svn commit: r403807 - in head/devel/subversion17: . files

[Olli Hauer]

Author: ohauer
Date: Tue Dec 15 20:57:59 2015
New Revision: 403807
URL: https://svnweb.freebsd.org/changeset/ports/403807

Log:
  - backport patch for CVE-2015-5343 [1]
  - sync 220_subversion.conf.sample.in with subversion 1.8/1.9
  - bump PORTREVISION
  
  [1]  http://subversion.apache.org/security/CVE-2015-5343-advisory.txt
  
  MFH:		2015Q4

Added:
  head/devel/subversion17/files/patch-subversion__mod_dav_svn__util.c   (contents, props changed)
Modified:
  head/devel/subversion17/Makefile.common
  head/devel/subversion17/files/220_subversion.conf.sample.in
  head/devel/subversion17/files/pkg-message.in

Modified: head/devel/subversion17/Makefile.common
==============================================================================
--- head/devel/subversion17/Makefile.common	Tue Dec 15 20:42:56 2015	(r403806)
+++ head/devel/subversion17/Makefile.common	Tue Dec 15 20:57:59 2015	(r403807)
@@ -3,7 +3,7 @@
 
 PORTNAME=	subversion
 PORTVERSION=	1.7.22
-PORTREVISION?=	0
+PORTREVISION?=	1
 CATEGORIES+=	devel
 MASTER_SITES=	APACHE/subversion
 DIST_SUBDIR=	subversion17

Modified: head/devel/subversion17/files/220_subversion.conf.sample.in
==============================================================================
--- head/devel/subversion17/files/220_subversion.conf.sample.in	Tue Dec 15 20:42:56 2015	(r403806)
+++ head/devel/subversion17/files/220_subversion.conf.sample.in	Tue Dec 15 20:57:59 2015	(r403807)
@@ -57,6 +57,11 @@
 ##
 ##<IfModule dav_svn_module>
 ##<Location /svn/>
+##	<ifModule mime_module>
+##		RemoveEncoding  .gz .tgz .Z
+##		RemoveType      .gz .tgz .Z
+##	</ifModule>
+##
 ##	# Enable Subversion
 ##	DAV svn
 ##

Added: head/devel/subversion17/files/patch-subversion__mod_dav_svn__util.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/devel/subversion17/files/patch-subversion__mod_dav_svn__util.c	Tue Dec 15 20:57:59 2015	(r403807)
@@ -0,0 +1,18 @@
+http://subversion.apache.org/security/CVE-2015-5343-advisory.txt
+================================================================
+--- subversion/mod_dav_svn/util.c.orig	2013-11-14 21:11:33 UTC
++++ subversion/mod_dav_svn/util.c
+@@ -753,7 +753,12 @@ request_body_to_string(svn_string_t **re
+ 
+   if (content_length)
+     {
+-      buf = svn_stringbuf_create_ensure(content_length, pool);
++      /* Do not allocate more than 1 MB until we receive request body. */
++      apr_size_t alloc_len = 1 * 1024 *1024;
++      if (content_length < alloc_len)
++        alloc_len = (apr_size_t) content_length;
++
++      buf = svn_stringbuf_create_ensure(alloc_len, pool);
+     }
+   else
+     {

Modified: head/devel/subversion17/files/pkg-message.in
==============================================================================
--- head/devel/subversion17/files/pkg-message.in	Tue Dec 15 20:42:56 2015	(r403806)
+++ head/devel/subversion17/files/pkg-message.in	Tue Dec 15 20:57:59 2015	(r403807)
@@ -1,2 +1,6 @@
 The subversion dav modules are no longer activated in httpd.conf!
 There is now a dedicated modules file in %%APACHEETCDIR%%/modules.d
+
+Attention:
+subversion17 is deprecated and scheduled for removal!
+Please consider updating to subversion 1.8/1.9