<div dir="ltr">hi,<br><br>I'm trying to update oldstable's librack-ruby to fix security issues.<div><br></div><div>I've cherry-picked upstream changes, but I'm not confident about my changes.</div><div>Would you review attached debdiff?</div>
<div><br></div><div>Notes:</div><div><br></div><div>CVE-2013-0183:</div><div>The squeeze version's code is different from which I assumed when writing forwarded mail.</div><div>So I try to hand port original code and spec.</div>
<div>I've confirmed that at least the spec I added doesn't report error.</div><div>(specrb -I ./lib test/rack_spec_utils.rb)</div><div><br></div><div>regards,</div><div>-- </div><div>KURASHIKI Satoru</div><div><br>
</div><div><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Satoru KURASHIKI</b> <span dir="ltr"><<a href="mailto:lurdan@gmail.com">lurdan@gmail.com</a>></span><br>
Date: Thu, Aug 29, 2013 at 8:59 PM<br>Subject: Re: [<a href="http://rt.debian.org">rt.debian.org</a> #4251] ruby-rack security bug<br>To: <a href="mailto:rt@rt.debian.org">rt@rt.debian.org</a><br>Cc: Nobuhiro Iwamatsu <<a href="mailto:iwamatsu@nigauri.org">iwamatsu@nigauri.org</a>>, Hideki Yamane <<a href="mailto:henrich@debian.or.jp">henrich@debian.or.jp</a>><br>
<br><br><div dir="ltr">hi,<br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 29, 2013 at 8:50 AM, Satoru KURASHIKI <span dir="ltr"><<a href="mailto:lurdan@gmail.com" target="_blank">lurdan@gmail.com</a>></span> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
CVE-2013-0183: As far I was gone, I saw that commit ... <span style="font-size:13px;font-family:arial,sans-serif">but similar code affected seems present,</span><span style="font-size:13px;font-family:arial,sans-serif"> </span></blockquote>
</div></div></div></div></blockquote><div><div><div><br></div><div>The point (similar code) is:</div><div><br></div><div> loop do</div><div> read_buffer = input.gets</div><div> break if read_buffer == boundary + EOL</div>
<div> end</div></div></div><div><br></div><div>So, I think that it may be changed to as:</div><div><br></div><div> loop do</div><div><div> content = input.read(bufsize)</div><div> raise EOFError, "bad content body" unless content<br>
</div><div> @buf << content</div><div><br></div><div> while @buf.gsub!(/\A([^\n]*\n)/, '')<br></div><div> read_buffer = $1</div><div> return if read_buffer == boundary + EOL</div>
<div> end<br></div><div><br></div><div> raise EOFError, "bad content body" if Utils.bytesize(@buf) >= bufsize</div><div> end<br></div></div><div><br></div><div>But unfortunately I'm neither a rubyist nor coding expert, so I can't write</div>
<div>test code for this change.</div><div>I will ask for reviewing this code to some of my friends...</div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
CVE-2012-6109:</blockquote></div></div></div></blockquote><div><br></div><div>This should be fixed IF we backport the "refactor of multipart module.</div><div>So, it should be considerd as "not affected".</div>
<div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">CVE-2011-5036:</blockquote></div></div></div></blockquote>
<div><br></div><div><div>We can pick this commit:</div></div><div><a href="https://github.com/rack/rack/commit/09c5e53f11a491c25bef873ed146842f3cd03228" target="_blank">https://github.com/rack/rack/commit/09c5e53f11a491c25bef873ed146842f3cd03228</a><br>
</div><div><br></div><div>regards,</div><span class="HOEnZb"><font color="#888888">
</font></span></div><span class="HOEnZb"><font color="#888888">-- <br>KURASHIKI Satoru
</font></span></div><div class="gmail_extra"><br></div></div></div></div></div>