From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51516) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dZiAD-00046o-PM for guix-patches@gnu.org; Mon, 24 Jul 2017 14:33:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dZiAA-0007My-9m for guix-patches@gnu.org; Mon, 24 Jul 2017 14:33:05 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:51964) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dZiAA-0007Mu-6N for guix-patches@gnu.org; Mon, 24 Jul 2017 14:33:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1dZiAA-0006MX-0b for guix-patches@gnu.org; Mon, 24 Jul 2017 14:33:02 -0400 Subject: [bug#27805] [PATCH] gnu: perl-dbd-mysql: Fix CVE-2017-10788. Resent-Message-ID: Received: from eggs.gnu.org ([2001:4830:134:3::10]:51354) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dZi9F-0003Lc-08 for guix-patches@gnu.org; Mon, 24 Jul 2017 14:32:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dZi9B-0007B3-G8 for guix-patches@gnu.org; Mon, 24 Jul 2017 14:32:05 -0400 Received: from lb1.openmailbox.org ([5.79.108.160]:38212 helo=mail.openmailbox.org) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dZi9B-0007AQ-3z for guix-patches@gnu.org; Mon, 24 Jul 2017 14:32:01 -0400 From: Kei Kebreau Date: Mon, 24 Jul 2017 14:31:44 -0400 Message-Id: <20170724183144.18241-1-kei@openmailbox.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 27805@debbugs.gnu.org Cc: Kei Kebreau * gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/databases.scm (perl-dbd-mysql)[source]: Use it. --- gnu/local.mk | 1 + gnu/packages/databases.scm | 3 +- .../patches/perl-dbd-mysql-CVE-2017-10788.patch | 51 ++++++++++++++++++++++ 3 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch diff --git a/gnu/local.mk b/gnu/local.mk index 3eccc879b..4292d705c 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -902,6 +902,7 @@ dist_patch_DATA = \ %D%/packages/patches/pcre2-CVE-2017-8786.patch \ %D%/packages/patches/perl-file-path-CVE-2017-6512.patch \ %D%/packages/patches/perl-autosplit-default-time.patch \ + %D%/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch \ %D%/packages/patches/perl-deterministic-ordering.patch \ %D%/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \ %D%/packages/patches/perl-gd-options-passthrough-and-fontconfig.patch \ diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm index ee340505e..7e62452ea 100644 --- a/gnu/packages/databases.scm +++ b/gnu/packages/databases.scm @@ -1015,7 +1015,8 @@ columns, primary keys, unique constraints and relationships.") "DBD-mysql-" version ".tar.gz")) (sha256 (base32 - "16bg7l28n65ngi1abjxvwk906a80i2vd5vzjn812dx8phdg8d7v2")))) + "16bg7l28n65ngi1abjxvwk906a80i2vd5vzjn812dx8phdg8d7v2")) + (patches (search-patches "perl-dbd-mysql-CVE-2017-10788.patch")))) (build-system perl-build-system) ;; Tests require running MySQL server (arguments `(#:tests? #f)) diff --git a/gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch b/gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch new file mode 100644 index 000000000..344f2d803 --- /dev/null +++ b/gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch @@ -0,0 +1,51 @@ +From 9ce10cfae7138c37c3a0cb2ba2a1d682482943d0 Mon Sep 17 00:00:00 2001 +From: Pali +Date: Sun, 25 Jun 2017 10:07:39 +0200 +Subject: [PATCH] Fix use-after-free after calling mysql_stmt_close() + +Ignore return value from mysql_stmt_close() and also its error message +because it points to freed memory after mysql_stmt_close() was called. +--- + dbdimp.c | 8 ++------ + mysql.xs | 7 ++----- + 2 files changed, 4 insertions(+), 11 deletions(-) + +diff --git a/dbdimp.c b/dbdimp.c +index c60a5f6..a6410e5 100644 +--- a/dbdimp.c ++++ b/dbdimp.c +@@ -4894,12 +4894,8 @@ void dbd_st_destroy(SV *sth, imp_sth_t *imp_sth) { + + if (imp_sth->stmt) + { +- if (mysql_stmt_close(imp_sth->stmt)) +- { +- do_error(DBIc_PARENT_H(imp_sth), mysql_stmt_errno(imp_sth->stmt), +- mysql_stmt_error(imp_sth->stmt), +- mysql_stmt_sqlstate(imp_sth->stmt)); +- } ++ mysql_stmt_close(imp_sth->stmt); ++ imp_sth->stmt= NULL; + } + #endif + +diff --git a/mysql.xs b/mysql.xs +index 55376e1..affde59 100644 +--- a/mysql.xs ++++ b/mysql.xs +@@ -434,11 +434,8 @@ do(dbh, statement, attr=Nullsv, ...) + if (bind) + Safefree(bind); + +- if(mysql_stmt_close(stmt)) +- { +- fprintf(stderr, "\n failed while closing the statement"); +- fprintf(stderr, "\n %s", mysql_stmt_error(stmt)); +- } ++ mysql_stmt_close(stmt); ++ stmt= NULL; + + if (retval == -2) /* -2 means error */ + { +-- +1.7.9.5 -- 2.13.3