main/lighttpd: security fix for CVE-2015-3200

The upstream patch does not apply without applying lot other stuff so we
simply apply all since 1.4.35 release.

ref #4329

1 files changed, 49 insertions, 0 deletions

diff --git a/main/lighttpd/0027-fix-error-message-for-T_CONFIG_ARRAY-config-values-i.patch b/main/lighttpd/0027-fix-error-message-for-T_CONFIG_ARRAY-config-values-i.patch
new file mode 100644
index 0000000000..c11a695e72
--- /dev/null
+++ b/main/lighttpd/0027-fix-error-message-for-T_CONFIG_ARRAY-config-values-i.patch
@@ -0,0 +1,49 @@
+From df87b3ef98711b6a4ca4cefb1fceec022ddcdc13 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20B=C3=BChler?= <stbuehler@web.de>
+Date: Thu, 14 May 2015 09:38:30 +0000
+Subject: [PATCH 27/29] fix error message for T_CONFIG_ARRAY config values if
+ an entry value is not a string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Bühler <stbuehler@web.de>
+
+git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2987 152afb58-edef-0310-8abb-c4023f1b3aa9
+---
+ NEWS                  | 1 +
+ src/configfile-glue.c | 6 +++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/NEWS b/NEWS
+index 59fd4f6..4d19144 100644
+--- a/NEWS
++++ b/NEWS
+@@ -17,6 +17,7 @@ NEWS
+   * print backtrace in assert logging with libunwind
+   * major refactoring of internal buffer/chunk handling
+   * [mod_auth] use crypt_r instead of crypt if available
++  * fix error message for T_CONFIG_ARRAY config values if an entry value is not a string
+ 
+ - 1.4.35 - 2014-03-12
+   * [network/ssl] fix build error if TLSEXT is disabled
+diff --git a/src/configfile-glue.c b/src/configfile-glue.c
+index f411d72..807e307 100644
+--- a/src/configfile-glue.c
++++ b/src/configfile-glue.c
+@@ -56,9 +56,9 @@ int config_insert_values_internal(server *srv, array *ca, const config_values_t
+ 
+ 						array_insert_unique(cv[i].destination, (data_unset *)ds);
+ 					} else {
+-						log_error_write(srv, __FILE__, __LINE__, "sssd",
+-								"the key of an array can only be a string or a integer, variable:",
+-								cv[i].key, "type:", da->value->data[j]->type);
++						log_error_write(srv, __FILE__, __LINE__, "sssbsd",
++								"the value of an array can only be a string, variable:",
++								cv[i].key, "[", da->value->data[j]->key, "], type:", da->value->data[j]->type);
+ 
+ 						return -1;
+ 					}
+-- 
+2.4.5
+