diff options
| author |   Thomas Deutschmann <whissi@gentoo.org> | 2019-12-23 22:34:38 +0100 |
|---|---|---|
| committer | Thomas Deutschmann <whissi@gentoo.org> | 2019-12-23 22:34:54 +0100 |
| commit | ec41e92e4aec19aa605f5d410ba06cc86e7b48f0 (patch) | |
| tree | 3036c550890adb3d3915cf0415a8fb3b8a7fb7af /dev-libs/cyrus-sasl/files | |
| parent | gnome-extra/evolution-data-server: remove old (diff) | |
| download | gentoo-ec41e92e4aec19aa605f5d410ba06cc86e7b48f0.tar.gz gentoo-ec41e92e4aec19aa605f5d410ba06cc86e7b48f0.tar.bz2 gentoo-ec41e92e4aec19aa605f5d410ba06cc86e7b48f0.zip | |
dev-libs/cyrus-sasl: fix CVE-2019-19906
Bug: https://bugs.gentoo.org/703628
Package-Manager: Portage-2.3.82, Repoman-2.3.20
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
Diffstat (limited to 'dev-libs/cyrus-sasl/files')
| -rw-r--r-- | dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.27-CVE-2019-19906.patch | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.27-CVE-2019-19906.patch b/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.27-CVE-2019-19906.patch new file mode 100644 index 000000000000..82b9e1fb6dbe --- /dev/null +++ b/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.27-CVE-2019-19906.patch @@ -0,0 +1,20 @@ +Description: CVE-2019-19906: Off-by-one in _sasl_add_string function +Origin: vendor +Bug: https://github.com/cyrusimap/cyrus-sasl/issues/587 +Bug-Debian: https://bugs.debian.org/947043 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-19906 +Author: Stephan Zeisberg <stephan@srlabs.de> +Reviewed-by: Salvatore Bonaccorso <carnil@debian.org> +Last-Update: 2019-12-19 + +--- a/lib/common.c ++++ b/lib/common.c +@@ -190,7 +190,7 @@ int _sasl_add_string(char **out, size_t + + if (add==NULL) add = "(null)"; + +- addlen=strlen(add); /* only compute once */ ++ addlen=strlen(add)+1; /* only compute once */ + if (_buf_alloc(out, alloclen, (*outlen)+addlen)!=SASL_OK) + return SASL_NOMEM; + |