1
0
mirror of https://git.FreeBSD.org/ports.git synced 2024-10-20 20:09:11 +00:00

- Fix zlib crash from zlib.decompressobj().flush(val)

when val was not positive. It tried to allocate negative
  or zero memory.  That fails.
- Bump PORTREVISION

PR:		123153
Submitted by:	Nick Barkas <snb@threerings.net>
Security:	http://www.vuxml.org/freebsd/ec41c3e2-129c-11dd-bab7-0016179b2dd5.html
This commit is contained in:
Martin Wilke 2008-04-28 07:39:59 +00:00
parent 17e7e0c3c0
commit a90aa21ef5
Notes: svn2git 2021-03-31 03:12:20 +00:00
svn path=/head/; revision=212137
6 changed files with 56 additions and 0 deletions

View File

@ -7,6 +7,7 @@
PORTNAME= python23
PORTVERSION= 2.3.6
PORTREVISION= 1
CATEGORIES= lang python ipv6
MASTER_SITES= ${PYTHON_MASTER_SITES}
MASTER_SITE_SUBDIR= ${PYTHON_MASTER_SITE_SUBDIR}

View File

@ -0,0 +1,14 @@
--- Lib/test/test_zlib.py 2008/04/08 23:47:30 62234
+++ Lib/test/test_zlib.py 2008/04/09 00:25:17 62235
@@ -83,6 +83,11 @@
# verify failure on building decompress object with bad params
self.assertRaises(ValueError, zlib.decompressobj, 0)
+ def test_decompressobj_badflush(self):
+ # verify failure on calling decompressobj.flush with bad params
+ self.assertRaises(ValueError, zlib.decompressobj().flush, 0)
+ self.assertRaises(ValueError, zlib.decompressobj().flush, -1)
+
class CompressTestCase(unittest.TestCase):

View File

@ -0,0 +1,13 @@
--- Modules/zlibmodule.c.orig 2008-04-25 01:47:26.000000000 +0200
+++ Modules/zlibmodule.c 2008-04-25 01:48:17.000000000 +0200
@@ -774,6 +774,10 @@
if (!PyArg_ParseTuple(args, "|i:flush", &length))
return NULL;
+ if (length <= 0) {
+ PyErr_SetString(PyExc_ValueError, "length must be greater than zero");
+ return NULL;
+ }
if (!(retval = PyString_FromStringAndSize(NULL, length)))
return NULL;

View File

@ -7,6 +7,7 @@
PORTNAME= python24
PORTVERSION= 2.4.5
PORTREVSION= 1
CATEGORIES= lang python ipv6
MASTER_SITES= ${PYTHON_MASTER_SITES}
MASTER_SITE_SUBDIR= ${PYTHON_MASTER_SITE_SUBDIR}

View File

@ -0,0 +1,14 @@
--- Lib/test/test_zlib.py 2008/04/08 23:47:30 62234
+++ Lib/test/test_zlib.py 2008/04/09 00:25:17 62235
@@ -83,6 +83,11 @@
# verify failure on building decompress object with bad params
self.assertRaises(ValueError, zlib.decompressobj, 0)
+ def test_decompressobj_badflush(self):
+ # verify failure on calling decompressobj.flush with bad params
+ self.assertRaises(ValueError, zlib.decompressobj().flush, 0)
+ self.assertRaises(ValueError, zlib.decompressobj().flush, -1)
+
class CompressTestCase(unittest.TestCase):

View File

@ -0,0 +1,13 @@
--- Modules/zlibmodule.c.orig 2008-04-25 01:47:26.000000000 +0200
+++ Modules/zlibmodule.c 2008-04-25 01:48:17.000000000 +0200
@@ -774,6 +774,10 @@
if (!PyArg_ParseTuple(args, "|i:flush", &length))
return NULL;
+ if (length <= 0) {
+ PyErr_SetString(PyExc_ValueError, "length must be greater than zero");
+ return NULL;
+ }
if (!(retval = PyString_FromStringAndSize(NULL, length)))
return NULL;