diff options
| author | Sergey Lukin <sergej.lukin@gmail.com> | 2017-04-05 05:35:21 +0000 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2017-04-05 08:22:51 +0000 |
| commit | b486f3ca57ec74aab683dc6ee3e940a7f4746a60 (patch) | |
| tree | d570a7484a562167e4b6bb5a7de20bc8e10111ae /main | |
| parent | 84a0c4253e3fd75c63ec30bbb96032ab71d2a3c5 (diff) | |
| download | aports-b486f3ca57ec74aab683dc6ee3e940a7f4746a60.tar.bz2 aports-b486f3ca57ec74aab683dc6ee3e940a7f4746a60.tar.xz | |
main/pcre: security upgrade (CVE-2017-7186) ref #7068
Diffstat (limited to 'main')
| -rw-r--r-- | main/pcre/APKBUILD | 15 | ||||
| -rw-r--r-- | main/pcre/CVE-2017-7186.patch | 57 |
2 files changed, 69 insertions, 3 deletions
diff --git a/main/pcre/APKBUILD b/main/pcre/APKBUILD index f4cf6bf4aa..123eda15bb 100644 --- a/main/pcre/APKBUILD +++ b/main/pcre/APKBUILD @@ -1,7 +1,8 @@ +# Contributor: Sergei Lukin <sergej.lukin@gmail.com> # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=pcre pkgver=8.40 -pkgrel=1 +pkgrel=2 pkgdesc="Perl-compatible regular expression library" url="http://pcre.sourceforge.net" arch="all" @@ -10,7 +11,14 @@ depends= makedepends="" subpackages="$pkgname-dev $pkgname-doc $pkgname-tools libpcrecpp libpcre16 libpcre32" -source="ftp://ftp.csx.cam.ac.uk/pub/software/programming/$pkgname/$pkgname-$pkgver.tar.bz2" +source="ftp://ftp.csx.cam.ac.uk/pub/software/programming/$pkgname/$pkgname-$pkgver.tar.bz2 + CVE-2017-7186.patch + " + +# secfixes: +# 8.40-r2: +# - CVE-2017-7186.patch + builddir="$srcdir/$pkgname-$pkgver" build() { @@ -63,4 +71,5 @@ tools() { mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ } -sha512sums="b4c27eafbdf33bd7a1384655b1936f4be3bc6745c072347eb26e988896c52664bd85ac42444da1be78b6e20f45b6c7e5921f5f20f5b0741b5bd3d9844e5bd4e2 pcre-8.40.tar.bz2" +sha512sums="b4c27eafbdf33bd7a1384655b1936f4be3bc6745c072347eb26e988896c52664bd85ac42444da1be78b6e20f45b6c7e5921f5f20f5b0741b5bd3d9844e5bd4e2 pcre-8.40.tar.bz2 +3644a2d9895a974192dfe778e5dcdbf0eacc592ccedeb37caf3d9426668ee8fda5fc16f87e38c112943e619d1b35a498ccbf4b4a1c2da58821198bbcc180be31 CVE-2017-7186.patch" diff --git a/main/pcre/CVE-2017-7186.patch b/main/pcre/CVE-2017-7186.patch new file mode 100644 index 0000000000..256325b563 --- /dev/null +++ b/main/pcre/CVE-2017-7186.patch @@ -0,0 +1,57 @@ +Patch source: +https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date +https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date + +--- a/pcre_internal.h 2016/05/21 13:34:44 1649 ++++ b/pcre_internal.h 2017/02/24 17:30:30 1688 +@@ -2772,6 +2772,9 @@ + extern const pcre_uint16 PRIV(ucd_stage2)[]; + extern const pcre_uint32 PRIV(ucp_gentype)[]; + extern const pcre_uint32 PRIV(ucp_gbtable)[]; ++#ifdef COMPILE_PCRE32 ++extern const ucd_record PRIV(dummy_ucd_record)[]; ++#endif + #ifdef SUPPORT_JIT + extern const int PRIV(ucp_typerange)[]; + #endif +@@ -2780,9 +2783,15 @@ + /* UCD access macros */ + + #define UCD_BLOCK_SIZE 128 +-#define GET_UCD(ch) (PRIV(ucd_records) + \ ++#define REAL_GET_UCD(ch) (PRIV(ucd_records) + \ + PRIV(ucd_stage2)[PRIV(ucd_stage1)[(int)(ch) / UCD_BLOCK_SIZE] * \ + UCD_BLOCK_SIZE + (int)(ch) % UCD_BLOCK_SIZE]) ++ ++#ifdef COMPILE_PCRE32 ++#define GET_UCD(ch) ((ch > 0x10ffff)? PRIV(dummy_ucd_record) : REAL_GET_UCD(ch)) ++#else ++#define GET_UCD(ch) REAL_GET_UCD(ch) ++#endif + + #define UCD_CHARTYPE(ch) GET_UCD(ch)->chartype + #define UCD_SCRIPT(ch) GET_UCD(ch)->script + +--- a/pcre_ucd.c 2014/06/19 07:51:39 1490 ++++ a/pcre_ucd.c 2017/02/24 17:30:30 1688 +@@ -38,6 +38,20 @@ + const pcre_uint32 PRIV(ucd_caseless_sets)[] = {0}; + #else + ++/* If the 32-bit library is run in non-32-bit mode, character values ++greater than 0x10ffff may be encountered. For these we set up a ++special record. */ ++ ++#ifdef COMPILE_PCRE32 ++const ucd_record PRIV(dummy_ucd_record)[] = {{ ++ ucp_Common, /* script */ ++ ucp_Cn, /* type unassigned */ ++ ucp_gbOther, /* grapheme break property */ ++ 0, /* case set */ ++ 0, /* other case */ ++ }}; ++#endif ++ + /* When recompiling tables with a new Unicode version, please check the + types in this structure definition from pcre_internal.h (the actual + field names will be different): |