unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed

blob 6d1c3e7c2c0534dd114ec21ab9ccd6d5bbcffb41 795 bytes (raw)
name: gnu/packages/patches/mit-krb5-CVE-2015-8629.patch 	 # note: path name is non-authoritative(*)

Fix CVE-2015-8629 (xdr_nullstring() doesn't check for terminating null
character).

From upstream git repository, commit
df17a1224a3406f57477bcd372c61e04c0e5a5bb.

diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
index 2bef858..ba67084 100644
--- a/src/lib/kadm5/kadm_rpc_xdr.c
+++ b/src/lib/kadm5/kadm_rpc_xdr.c
@@ -64,7 +64,14 @@ bool_t xdr_nullstring(XDR *xdrs, char **objp)
 		    return FALSE;
 	       }
 	  }
-	  return (xdr_opaque(xdrs, *objp, size));
+	  if (!xdr_opaque(xdrs, *objp, size))
+		  return FALSE;
+	  /* Check that the unmarshalled bytes are a C string. */
+	  if ((*objp)[size - 1] != '\0')
+		  return FALSE;
+	  if (memchr(*objp, '\0', size - 1) != NULL)
+		  return FALSE;
+	  return TRUE;
 
      case XDR_ENCODE:
 	  if (size != 0)
-- 
2.6.3

debug log:

solving 6d1c3e7 ...
found 6d1c3e7 in https://yhetil.org/guix-devel/c9f6ee38995916f6f7864d83e3a7915cd8c53cf4.1454633096.git.leo@famulari.name/

applying [1/1] https://yhetil.org/guix-devel/c9f6ee38995916f6f7864d83e3a7915cd8c53cf4.1454633096.git.leo@famulari.name/
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-8629.patch b/gnu/packages/patches/mit-krb5-CVE-2015-8629.patch
new file mode 100644
index 0000000..6d1c3e7

1:18: space before tab in indent.
 		    return FALSE;
1:19: space before tab in indent.
 	       }
1:20: space before tab in indent.
 	  }
1:30: trailing whitespace.
 
1:32: space before tab in indent.
 	  if (size != 0)
Checking patch gnu/packages/patches/mit-krb5-CVE-2015-8629.patch...
Applied patch gnu/packages/patches/mit-krb5-CVE-2015-8629.patch cleanly.
warning: squelched 2 whitespace errors
warning: 7 lines add whitespace errors.

index at:
100644 6d1c3e7c2c0534dd114ec21ab9ccd6d5bbcffb41	gnu/packages/patches/mit-krb5-CVE-2015-8629.patch

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).