[med-svn] r18771 - trunk/packages/rcsb-core-wrapper/trunk/debian/patches

[Andreas Tille]

Author: tille
Date: 2015-02-14 16:55:17 +0000 (Sat, 14 Feb 2015)
New Revision: 18771

Added:
   trunk/packages/rcsb-core-wrapper/trunk/debian/patches/regcomp_cert_fix.patch
Modified:
   trunk/packages/rcsb-core-wrapper/trunk/debian/patches/series
Log:
Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability


Added: trunk/packages/rcsb-core-wrapper/trunk/debian/patches/regcomp_cert_fix.patch
===================================================================
--- trunk/packages/rcsb-core-wrapper/trunk/debian/patches/regcomp_cert_fix.patch	                        (rev 0)
+++ trunk/packages/rcsb-core-wrapper/trunk/debian/patches/regcomp_cert_fix.patch	2015-02-14 16:55:17 UTC (rev 18771)
@@ -0,0 +1,42 @@
+Author: Andreas Tille <tille at debian.org>
+Last-Update: Sat, 14 Feb 2015 17:51:06 +0100
+Origin: https://gitweb.dragonflybsd.org/dragonfly.git/blobdiff_plain/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c
+Bug-Debian: http://bugs.debian.org/778397
+Description: Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability
+ This patch adapts the patch found at Origin (see above) to the
+ regex code found in librcsb-core-wrapper.
+
+--- librcsb-core-wrapper-1.005.orig/regex/src/regcomp.c
++++ librcsb-core-wrapper-1.005/regex/src/regcomp.c
+@@ -93,6 +93,7 @@ int cflags;
+ 	register struct parse *p = &pa;
+ 	register int i;
+ 	register size_t len;
++	register size_t maxlen;
+ #ifdef REDEBUG
+ #	define	GOODFLAGS(f)	(f)
+ #else
+@@ -115,7 +116,23 @@ int cflags;
+ 							(NC-1)*sizeof(cat_t));
+ 	if (g == NULL)
+ 		return(REG_ESPACE);
++	/*
++	 * Limit the pattern space to avoid a 32-bit overflow on buffer
++	 * extension.  Also avoid any signed overflow in case of conversion
++	 * so make the real limit based on a 31-bit overflow.
++	 *
++	 * Likely not applicable on 64-bit systems but handle the case
++	 * generically (who are we to stop people from using ~715MB+
++	 * patterns?).
++	 */
++	maxlen = ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3;
++	if (len >= maxlen) {
++		free((char *)g);
++		return(REG_ESPACE);
++	}
+ 	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
++	assert(p->ssize >= len);
++
+ 	p->strip = (sop *)malloc(p->ssize * sizeof(sop));
+ 	p->slen = 0;
+ 	if (p->strip == NULL) {

Modified: trunk/packages/rcsb-core-wrapper/trunk/debian/patches/series
===================================================================
--- trunk/packages/rcsb-core-wrapper/trunk/debian/patches/series	2015-02-14 07:50:58 UTC (rev 18770)
+++ trunk/packages/rcsb-core-wrapper/trunk/debian/patches/series	2015-02-14 16:55:17 UTC (rev 18771)
@@ -11,3 +11,4 @@
 spelling
 exit-in-shlib
 make_test_target
+regcomp_cert_fix.patch