diff options
Diffstat (limited to 'meta/recipes-devtools/perl/perl-5.20.0/perl-5.14.3-fix-CVE-2010-4777.patch')
| -rw-r--r-- | meta/recipes-devtools/perl/perl-5.20.0/perl-5.14.3-fix-CVE-2010-4777.patch | 45 |
1 files changed, 0 insertions, 45 deletions
diff --git a/meta/recipes-devtools/perl/perl-5.20.0/perl-5.14.3-fix-CVE-2010-4777.patch b/meta/recipes-devtools/perl/perl-5.20.0/perl-5.14.3-fix-CVE-2010-4777.patch deleted file mode 100644 index e0dcf412bb..0000000000 --- a/meta/recipes-devtools/perl/perl-5.20.0/perl-5.14.3-fix-CVE-2010-4777.patch +++ /dev/null | |||
| @@ -1,45 +0,0 @@ | |||
| 1 | perl:fix for CVE-2010-4777 | ||
| 2 | |||
| 3 | Upstream-Status: Backport | ||
| 4 | |||
| 5 | The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, | ||
| 6 | 5.14.0, and other versions, when running with debugging enabled, | ||
| 7 | allows context-dependent attackers to cause a denial of service | ||
| 8 | (assertion failure and application exit) via crafted input that | ||
| 9 | is not properly handled when using certain regular expressions, | ||
| 10 | as demonstrated by causing SpamAssassin and OCSInventory to | ||
| 11 | crash. | ||
| 12 | |||
| 13 | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4777 | ||
| 14 | |||
| 15 | Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> | ||
| 16 | --- a/regcomp.c | ||
| 17 | +++ b/regcomp.c | ||
| 18 | @@ -11868,8 +11868,25 @@ Perl_save_re_context(pTHX) | ||
| 19 | |||
| 20 | if (gvp) { | ||
| 21 | GV * const gv = *gvp; | ||
| 22 | - if (SvTYPE(gv) == SVt_PVGV && GvSV(gv)) | ||
| 23 | - save_scalar(gv); | ||
| 24 | + if (SvTYPE(gv) == SVt_PVGV && GvSV(gv)) { | ||
| 25 | + /* this is a copy of save_scalar() without the GETMAGIC call, RT#76538 */ | ||
| 26 | + SV ** const sptr = &GvSVn(gv); | ||
| 27 | + SV * osv = *sptr; | ||
| 28 | + SV * nsv = newSV(0); | ||
| 29 | + save_pushptrptr(SvREFCNT_inc_simple(gv), | ||
| 30 | + SvREFCNT_inc(osv), SAVEt_SV); | ||
| 31 | + if (SvTYPE(osv) >= SVt_PVMG && SvMAGIC(osv) && | ||
| 32 | + SvTYPE(osv) != SVt_PVGV) { | ||
| 33 | + if (SvGMAGICAL(osv)) { | ||
| 34 | + const bool oldtainted = PL_tainted; | ||
| 35 | + SvFLAGS(osv) |= (SvFLAGS(osv) & | ||
| 36 | + (SVp_IOK|SVp_NOK|SVp_POK)) >> PRIVSHIFT; | ||
| 37 | + PL_tainted = oldtainted; | ||
| 38 | + } | ||
| 39 | + mg_localize(osv, nsv, 1); | ||
| 40 | + } | ||
| 41 | + *sptr = nsv; | ||
| 42 | + } | ||
| 43 | } | ||
| 44 | } | ||
| 45 | } | ||
