svn commit: r448360 - in branches/2017Q3/devel/libsoup: . files
Koop Mast
kwm at FreeBSD.org
Sun Aug 20 07:59:28 UTC 2017
Author: kwm
Date: Sun Aug 20 07:59:26 2017
New Revision: 448360
URL: https://svnweb.freebsd.org/changeset/ports/448360
Log:
MFH: r448358
Fix CVE-2017-2885
Obtained from: libsoup upstream
Security: 8e7bbddd-8338-11e7-867f-b499baebfeaf
Approved by: ports-secteam@ (delphij@)
Added:
branches/2017Q3/devel/libsoup/files/patch-libsoup_soup-filter-input-stream.c
- copied unchanged from r448358, head/devel/libsoup/files/patch-libsoup_soup-filter-input-stream.c
Modified:
branches/2017Q3/devel/libsoup/Makefile
Directory Properties:
branches/2017Q3/ (props changed)
Modified: branches/2017Q3/devel/libsoup/Makefile
==============================================================================
--- branches/2017Q3/devel/libsoup/Makefile Sun Aug 20 07:54:09 2017 (r448359)
+++ branches/2017Q3/devel/libsoup/Makefile Sun Aug 20 07:59:26 2017 (r448360)
@@ -3,6 +3,7 @@
PORTNAME= libsoup
PORTVERSION= 2.52.2
+PORTREVISION= 1
CATEGORIES= devel gnome
MASTER_SITES= GNOME
DIST_SUBDIR= gnome2
Copied: branches/2017Q3/devel/libsoup/files/patch-libsoup_soup-filter-input-stream.c (from r448358, head/devel/libsoup/files/patch-libsoup_soup-filter-input-stream.c)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ branches/2017Q3/devel/libsoup/files/patch-libsoup_soup-filter-input-stream.c Sun Aug 20 07:59:26 2017 (r448360, copy of r448358, head/devel/libsoup/files/patch-libsoup_soup-filter-input-stream.c)
@@ -0,0 +1,58 @@
+From 03c91c76daf70ee227f38304c5e45a155f45073d Mon Sep 17 00:00:00 2001
+From: Dan Winship <danw at gnome.org>
+Date: Thu, 3 Aug 2017 09:56:43 -0400
+Subject: Fix chunked decoding buffer overrun (CVE-2017-2885)
+
+https://bugzilla.gnome.org/show_bug.cgi?id=785774
+---
+ libsoup/soup-filter-input-stream.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/libsoup/soup-filter-input-stream.c b/libsoup/soup-filter-input-stream.c
+index cde4d12..2c30bf9 100644
+--- libsoup/soup-filter-input-stream.c
++++ libsoup/soup-filter-input-stream.c
+@@ -198,7 +198,7 @@ soup_filter_input_stream_read_until (SoupFilterInputStream *fstream,
+ GCancellable *cancellable,
+ GError **error)
+ {
+- gssize nread;
++ gssize nread, read_length;
+ guint8 *p, *buf, *end;
+ gboolean eof = FALSE;
+ GError *my_error = NULL;
+@@ -251,10 +251,11 @@ soup_filter_input_stream_read_until (SoupFilterInputStream *fstream,
+ } else
+ buf = fstream->priv->buf->data;
+
+- /* Scan for the boundary */
+- end = buf + fstream->priv->buf->len;
+- if (!eof)
+- end -= boundary_length;
++ /* Scan for the boundary within the range we can possibly return. */
++ if (include_boundary)
++ end = buf + MIN (fstream->priv->buf->len, length) - boundary_length;
++ else
++ end = buf + MIN (fstream->priv->buf->len - boundary_length, length);
+ for (p = buf; p <= end; p++) {
+ if (*p == *(guint8*)boundary &&
+ !memcmp (p, boundary, boundary_length)) {
+@@ -268,10 +269,9 @@ soup_filter_input_stream_read_until (SoupFilterInputStream *fstream,
+ if (!*got_boundary && fstream->priv->buf->len < length && !eof)
+ goto fill_buffer;
+
+- /* Return everything up to 'p' (which is either just after the boundary if
+- * include_boundary is TRUE, just before the boundary if include_boundary is
+- * FALSE, @boundary_len - 1 bytes before the end of the buffer, or end-of-
+- * file).
+- */
+- return read_from_buf (fstream, buffer, p - buf);
++ if (eof && !*got_boundary)
++ read_length = MIN (fstream->priv->buf->len, length);
++ else
++ read_length = p - buf;
++ return read_from_buf (fstream, buffer, read_length);
+ }
+--
+cgit v0.12
+
More information about the svn-ports-branches
mailing list