[Pkg-net-snmp-commits] [pkg-net-snmp] 02/05: fix CVE-2014-2285 for squeeze

[Hideki Yamane]

This is an automated email from the git hooks/post-receive script.

henrich pushed a commit to branch squeeze
in repository pkg-net-snmp.

commit d42523790701b48f724b5a007ca8c95e8e0369e5
Author: Hideki Yamane <henrich at debian.org>
Date:   Sun Mar 30 20:20:13 2014 +0900

    fix CVE-2014-2285 for squeeze
---
 debian/changelog                  |  8 ++++++++
 debian/patches/TrapReceiver.patch | 31 +++++++++++++++++++++++++++++++
 debian/patches/series             |  1 +
 3 files changed, 40 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 56f1b7b..f962835 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+net-snmp (5.4.3~dfsg-2+squeeze2) oldstable-proposed-updates; urgency=high
+
+  * Team upload.
+  * debian/patches
+    - add TrapReceiver.patch to fix CVE-2014-2285
+
+ -- Hideki Yamane <henrich at debian.org>  Sun, 04 May 2014 12:49:22 +0900
+
 net-snmp (5.4.3~dfsg-2+squeeze1) stable-proposed-updates; urgency=high
 
   * Non-Maintainer upload.
diff --git a/debian/patches/TrapReceiver.patch b/debian/patches/TrapReceiver.patch
new file mode 100644
index 0000000..0973f83
--- /dev/null
+++ b/debian/patches/TrapReceiver.patch
@@ -0,0 +1,31 @@
+Description: Fixes Perl Trap Handler Segfault with old Perl (e.g. Perl 5.8.8) (CVE-2014-2285)
+Origin: upstream
+Bug: http://sourceforge.net/p/net-snmp/code/ci/76e8d6d100320629d8a23be4b0128619600c919d/
+Last-Update: 2014-03-30
+
+--- net-snmp-5.7.2.1~dfsg.orig/perl/TrapReceiver/TrapReceiver.xs
++++ net-snmp-5.7.2.1~dfsg/perl/TrapReceiver/TrapReceiver.xs
+@@ -81,18 +81,18 @@ int   perl_trapd_handler( netsnmp_pdu
+         STOREPDUi("securitymodel", pdu->securityModel);
+         STOREPDUi("securitylevel", pdu->securityLevel);
+         STOREPDU("contextName",
+-                 newSVpv(pdu->contextName, pdu->contextNameLen));
++                 newSVpv(pdu->contextName ? pdu->contextName : "", pdu->contextNameLen));
+         STOREPDU("contextEngineID",
+-                 newSVpv((char *) pdu->contextEngineID,
++                 newSVpv(pdu->contextEngineID ? (char *) pdu->contextEngineID : "",
+                                     pdu->contextEngineIDLen));
+         STOREPDU("securityEngineID",
+-                 newSVpv((char *) pdu->securityEngineID,
++                 newSVpv(pdu->securityEngineID ? (char *) pdu->securityEngineID : "",
+                                     pdu->securityEngineIDLen));
+         STOREPDU("securityName",
+-                 newSVpv((char *) pdu->securityName, pdu->securityNameLen));
++                 newSVpv(pdu->securityName ? (char *) pdu->securityName : "", pdu->securityNameLen));
+     } else {
+         STOREPDU("community",
+-                 newSVpv((char *) pdu->community, pdu->community_len));
++                 newSVpv(pdu->community ? (char *) pdu->community : "", pdu->community_len));
+     }
+ 
+     if (transport && transport->f_fmtaddr) {
diff --git a/debian/patches/series b/debian/patches/series
index db3892d..6ab8d00 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,4 @@
 61_vacm_missing_dependency_check.patch
 62_add_lib_cflags.patch
 CVE-2012-2141.patch
+TrapReceiver.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-net-snmp/pkg-net-snmp.git