Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (9f1f3bf3e159a4361ec1dcc35f8a9d386a7990cf)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (9f1f3bf3e159a4361ec1dcc35f8a9d386a7990cf)
  • Date: Sat, 12 Nov 2016 12:46:46 +0000

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

libs/libxslt/DETAILS | 3 ++-
libs/libxslt/HISTORY | 5 +++++
libs/libxslt/PRE_BUILD | 4 ++++
libs/libxslt/numbers.patch | 31 +++++++++++++++++++++++++++++++
4 files changed, 42 insertions(+), 1 deletion(-)

New commits:
commit 9f1f3bf3e159a4361ec1dcc35f8a9d386a7990cf
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

libxslt: security update

(cherry picked from commit f60b156b893720e51acee1fea51ca9e71c596f5e)

diff --git a/libs/libxslt/DETAILS b/libs/libxslt/DETAILS
index a99a3eb..063d44c 100755
--- a/libs/libxslt/DETAILS
+++ b/libs/libxslt/DETAILS
@@ -1,11 +1,12 @@
SPELL=libxslt
VERSION=1.1.29
- SECURITY_PATCH=5
+ SECURITY_PATCH=6
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
SOURCE_URL[0]=ftp://xmlsoft.org/$SPELL/$SOURCE
# SOURCE_GPG=gurus.gpg:$SOURCE.sig

SOURCE_HASH=sha512:a1ce555a74a9dabe65e8f64bb66e27e77760fd76940d88f2d59f58dd63ca73c8ae59f3fcbd8e76c8f92ff992fb0c09328528c20ea38ccac83e63252106bf5f31
+ DOC_DIRS=""
LICENSE[0]=BSD
WEB_SITE=http://xmlsoft.org/
ENTERED=20011010
diff --git a/libs/libxslt/HISTORY b/libs/libxslt/HISTORY
index 506491d..8893b00 100644
--- a/libs/libxslt/HISTORY
+++ b/libs/libxslt/HISTORY
@@ -1,3 +1,8 @@
+2016-11-12 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++; do not duplicate docs
+ * PRE_BUILD: added, to apply patch
+ * numbers.patch: added, official patch to fix CVE-2016-4738
+
2016-09-24 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: SECURITY_PATCH++

diff --git a/libs/libxslt/PRE_BUILD b/libs/libxslt/PRE_BUILD
new file mode 100755
index 0000000..a77892e
--- /dev/null
+++ b/libs/libxslt/PRE_BUILD
@@ -0,0 +1,4 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+patch -p1 < "$SPELL_DIRECTORY/numbers.patch"
diff --git a/libs/libxslt/numbers.patch b/libs/libxslt/numbers.patch
new file mode 100644
index 0000000..8153f5e
--- /dev/null
+++ b/libs/libxslt/numbers.patch
@@ -0,0 +1,31 @@
+From eb1030de31165b68487f288308f9d1810fed6880 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer AT aevum.de>
+Date: Fri, 10 Jun 2016 14:23:58 +0200
+Subject: Fix heap overread in xsltFormatNumberConversion
+
+An empty decimal-separator could cause a heap overread. This can be
+exploited to leak a couple of bytes after the buffer that holds the
+pattern string.
+
+Found with afl-fuzz and ASan.
+---
+ libxslt/numbers.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libxslt/numbers.c b/libxslt/numbers.c
+index d1549b4..e78c46b 100644
+--- a/libxslt/numbers.c
++++ b/libxslt/numbers.c
+@@ -1090,7 +1090,8 @@ xsltFormatNumberConversion(xsltDecimalFormatPtr self,
+ }
+
+ /* We have finished the integer part, now work on fraction */
+- if (xsltUTF8Charcmp(the_format, self->decimalPoint) == 0) {
++ if ( (*the_format != 0) &&
++ (xsltUTF8Charcmp(the_format, self->decimalPoint) == 0) ) {
+ format_info.add_decimal = TRUE;
+ the_format += xsltUTF8Size(the_format); /* Skip over the decimal */
+ }
+--
+cgit v0.12
+



  • [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (9f1f3bf3e159a4361ec1dcc35f8a9d386a7990cf), Vlad Glagolev, 11/12/2016

Archive powered by MHonArc 2.6.24.

Top of Page