TakeV/guix
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

gnu: tidy: Add fixes for CVE-2015-5522 and CVE-2015-5523.

Browse source 
* gnu/packages/patches/tidy-CVE-2015-5522+5523.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/web.scm (tidy)[source]: Add patch.
This commit is contained in:
Mark H Weaver 2015-07-20 23:32:30 -04:00
parent 247cdf53df
commit 4d85391059
3 changed files with 39 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
gnu-system.am
View file

@ -619,6 +619,7 @@ dist_patch_DATA = \
gnu/packages/patches/teckit-cstdio.patch \
gnu/packages/patches/texi2html-document-encoding.patch \
gnu/packages/patches/texi2html-i18n.patch \
gnu/packages/patches/tidy-CVE-2015-5522+5523.patch \
gnu/packages/patches/tvtime-gcc41.patch \
gnu/packages/patches/tvtime-pngoutput.patch \
gnu/packages/patches/tvtime-videodev2.patch \

36
gnu/packages/patches/tidy-CVE-2015-5522+5523.patch Normal file
View file

@ -0,0 +1,36 @@
Copied from Debian.
From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...
---
src/lexer.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
/* and prompts attributes unless --literal-attributes is set to yes */
/* #994841 - Whitespace is removed from value attributes */
- if (munge &&
+ /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+ if ((len > 0) && munge &&
TY_(tmbstrcasecmp)(name, "alt") &&
TY_(tmbstrcasecmp)(name, "title") &&
TY_(tmbstrcasecmp)(name, "value") &&
TY_(tmbstrcasecmp)(name, "prompt"))
{
- while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+ while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
--len;
- while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+ while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
{
++start;
--len;

3
gnu/packages/web.scm
View file

@ -381,7 +381,8 @@ (module "tidy")
(revision "2009-12-23")))
(sha256
(base32
"14dsnmirjcrvwsffqp3as70qr6bbfaig2fv3zvs5g7005jrsbvpb"))))
"14dsnmirjcrvwsffqp3as70qr6bbfaig2fv3zvs5g7005jrsbvpb"))
(patches (list (search-patch "tidy-CVE-2015-5522+5523.patch")))))
(build-system gnu-build-system)
(arguments
'(#:phases (alist-cons-after