diff options
| author |   Sergey Popov <pinkbyte@gentoo.org> | 2014-07-29 07:53:03 +0000 |
|---|---|---|
| committer | Sergey Popov <pinkbyte@gentoo.org> | 2014-07-29 07:53:03 +0000 |
| commit | 45219ee5ed760acf0b0b0ad0a92cf91854088f20 (patch) | |
| tree | 4d278a369b74973028e5a1b3057e29393b1a076a /dev-lang | |
| parent | New virtual version wrt #518416 for package managers with no proper in-place ... (diff) | |
| download | gentoo-2-45219ee5ed760acf0b0b0ad0a92cf91854088f20.tar.gz gentoo-2-45219ee5ed760acf0b0b0ad0a92cf91854088f20.tar.bz2 gentoo-2-45219ee5ed760acf0b0b0ad0a92cf91854088f20.zip | |
Revision bump: backport patch for CVE-2014-1912, bug #500518. Drop old revision. Acked by Python team
(Portage version: 2.2.10/cvs/Linux x86_64, signed Manifest commit with key 0x1F357D42)
Diffstat (limited to 'dev-lang')
| -rw-r--r-- | dev-lang/python/ChangeLog | 9 | ||||
| -rw-r--r-- | dev-lang/python/files/python-3.2-CVE-2014-1912.patch | 51 | ||||
| -rw-r--r-- | dev-lang/python/python-3.2.5-r6.ebuild (renamed from dev-lang/python/python-3.2.5-r5.ebuild) | 4 |
3 files changed, 62 insertions, 2 deletions
diff --git a/dev-lang/python/ChangeLog b/dev-lang/python/ChangeLog index 662a4034477a..23260d30d3c0 100644 --- a/dev-lang/python/ChangeLog +++ b/dev-lang/python/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for dev-lang/python # Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/ChangeLog,v 1.765 2014/07/29 07:19:13 pinkbyte Exp $ +# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/ChangeLog,v 1.766 2014/07/29 07:53:03 pinkbyte Exp $ + +*python-3.2.5-r6 (29 Jul 2014) + + 29 Jul 2014; Sergey Popov <pinkbyte@gentoo.org> -python-3.2.5-r5.ebuild, + +python-3.2.5-r6.ebuild, +files/python-3.2-CVE-2014-1912.patch: + Revision bump: backport patch for CVE-2014-1912, bug #500518. Drop old + revision. Acked by Python team *python-3.3.5-r1 (29 Jul 2014) *python-3.2.5-r5 (29 Jul 2014) diff --git a/dev-lang/python/files/python-3.2-CVE-2014-1912.patch b/dev-lang/python/files/python-3.2-CVE-2014-1912.patch new file mode 100644 index 000000000000..0e095074a259 --- /dev/null +++ b/dev-lang/python/files/python-3.2-CVE-2014-1912.patch @@ -0,0 +1,51 @@ +# HG changeset patch +# User Benjamin Peterson <benjamin@python.org> +# Date 1389671978 18000 +# Node ID 9c56217e5c793685eeaf0ee224848c402bdf1e4c +# Parent 2b5cd6d4d149dea6c6941b7e07ada248b29fc9f6 +complain when nbytes > buflen to fix possible buffer overflow (closes #20246) + +diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py +--- a/Lib/test/test_socket.py ++++ b/Lib/test/test_socket.py +@@ -1968,6 +1968,14 @@ class BufferIOTest(SocketConnectedTest): + + _testRecvFromIntoMemoryview = _testRecvFromIntoArray + ++ def testRecvFromIntoSmallBuffer(self): ++ # See issue #20246. ++ buf = bytearray(8) ++ self.assertRaises(ValueError, self.cli_conn.recvfrom_into, buf, 1024) ++ ++ def _testRecvFromIntoSmallBuffer(self): ++ self.serv_conn.send(MSG*2048) ++ + + TIPC_STYPE = 2000 + TIPC_LOWER = 200 +diff --git a/Misc/ACKS b/Misc/ACKS +--- a/Misc/ACKS ++++ b/Misc/ACKS +@@ -1020,6 +1020,7 @@ Eric V. Smith + Christopher Smith + Gregory P. Smith + Roy Smith ++Ryan Smith-Roberts + Rafal Smotrzyk + Dirk Soede + Paul Sokolovsky +diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c +--- a/Modules/socketmodule.c ++++ b/Modules/socketmodule.c +@@ -2598,6 +2598,11 @@ sock_recvfrom_into(PySocketSockObject *s + if (recvlen == 0) { + /* If nbytes was not specified, use the buffer's length */ + recvlen = buflen; ++ } else if (recvlen > buflen) { ++ PyBuffer_Release(&pbuf); ++ PyErr_SetString(PyExc_ValueError, ++ "nbytes is greater than the length of the buffer"); ++ return NULL; + } + + readlen = sock_recvfrom_guts(s, buf, recvlen, flags, &addr); diff --git a/dev-lang/python/python-3.2.5-r5.ebuild b/dev-lang/python/python-3.2.5-r6.ebuild index 68cee4a007da..4c91995f8a61 100644 --- a/dev-lang/python/python-3.2.5-r5.ebuild +++ b/dev-lang/python/python-3.2.5-r6.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2014 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/python-3.2.5-r5.ebuild,v 1.1 2014/07/29 07:19:13 pinkbyte Exp $ +# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/python-3.2.5-r6.ebuild,v 1.1 2014/07/29 07:53:03 pinkbyte Exp $ EAPI="4" WANT_AUTOMAKE="none" @@ -98,6 +98,8 @@ src_prepare() { # bug #514686 epatch "${FILESDIR}/${PN}-3.2-CVE-2014-4616.patch" + # bug #500518 + epatch "${FILESDIR}/${PN}-3.2-CVE-2014-1912.patch" epatch_user |