diff options
| author | Francesco Colista <fcolista@alpinelinux.org> | 2017-08-09 10:21:01 +0000 |
|---|---|---|
| committer | Francesco Colista <fcolista@alpinelinux.org> | 2017-08-09 10:21:05 +0000 |
| commit | 925330ee890cc038d238a8eb8b6220e83b9858e4 (patch) | |
| tree | fe400a582bd3ab37cba5043e945e246438321595 /main | |
| parent | b929a198bb2bf41d2d7ca692fd917fcf99cad9c6 (diff) | |
main/memcached: fix for CVE-2017-9951. Fixes #7644
Diffstat (limited to 'main')
| -rw-r--r-- | main/memcached/APKBUILD | 18 | ||||
| -rw-r--r-- | main/memcached/CVE-2017-9951.patch | 36 |
2 files changed, 49 insertions, 5 deletions
diff --git a/main/memcached/APKBUILD b/main/memcached/APKBUILD index 41fce02bf87..c60c10281da 100644 --- a/main/memcached/APKBUILD +++ b/main/memcached/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=memcached pkgver=1.4.33 -pkgrel=0 +pkgrel=1 pkgdesc="Distributed memory object caching system" url="http://memcached.org" arch="all" @@ -14,10 +14,15 @@ install="$pkgname.pre-install" subpackages="$pkgname-dev $pkgname-doc" source="http://www.memcached.org/files/memcached-$pkgver.tar.gz $pkgname.confd - $pkgname.initd" + $pkgname.initd + CVE-2017-9951.patch" _builddir="$srcdir/$pkgname-$pkgver" +# secfixes: +# 1.4.33-r1: +# - CVE-2017-9951 + prepare() { local i cd "$_builddir" @@ -49,10 +54,13 @@ package() { md5sums="2d7f6476283cd36e21e521d901d37a8f memcached-1.4.33.tar.gz a7aa37e91d4237448124b79bd99a2649 memcached.confd -220c0331832edcef6a72601143d3172d memcached.initd" +220c0331832edcef6a72601143d3172d memcached.initd +6ff37b9735924f7b9ff58fc53be0276c CVE-2017-9951.patch" sha256sums="83726c8d68258c56712373072abb25a449c257398075a39ec0867fd8ba69771d memcached-1.4.33.tar.gz c8f03585eeeb0e0acf4e8bb3c0f7062c2c7da5f89e763cf91a856bec4991a2c7 memcached.confd -da8a0e9a580d2df053941f01ce430aa5b678270891b481c710758b81fb4d831c memcached.initd" +da8a0e9a580d2df053941f01ce430aa5b678270891b481c710758b81fb4d831c memcached.initd +faa5d3b1026262db00340469abe4ba066b11f2558c85b6e8be1f4265444812c7 CVE-2017-9951.patch" sha512sums="00af5a2f46702fb8e606b1035cdaad125445d8eb701927a3ccccd7cd6c12e0811efb3ad917e3118043fd993b5c313f1aa0c4b2a471218e971a21fed7c896e136 memcached-1.4.33.tar.gz 31bd788433b8021ed332f86d291e7f03222ae234520e52ba673b581d5da2adf5656e8f73e8b985df73258dea9b2a1b8ef36195163fe47a92fda59825deedfed4 memcached.confd -9615769b14175a25b50c9871b48c0635b5397ebe45231b43ee29a603eceb7b16bfc5ac744017b89b19082209c09597b3038a03ed0d5d9b45c60454d5b2717a55 memcached.initd" +9615769b14175a25b50c9871b48c0635b5397ebe45231b43ee29a603eceb7b16bfc5ac744017b89b19082209c09597b3038a03ed0d5d9b45c60454d5b2717a55 memcached.initd +6ad923b7753011272f8d8389e1e14d6193a13777a5919e3e183eb81fa5b6e9555f19ce88d0c4af3affc0ea4dd4c824924f8d4aad1460037a3c1d22707d409ed0 CVE-2017-9951.patch" diff --git a/main/memcached/CVE-2017-9951.patch b/main/memcached/CVE-2017-9951.patch new file mode 100644 index 00000000000..a6f27365e49 --- /dev/null +++ b/main/memcached/CVE-2017-9951.patch @@ -0,0 +1,36 @@ +From 328629445c71e6c17074f6e9e0e3ef585b58f167 Mon Sep 17 00:00:00 2001 +From: dormando <dormando@rydia.net> +Date: Tue, 4 Jul 2017 00:32:39 -0700 +Subject: [PATCH] sanity check + +--- + items.c | 2 ++ + memcached.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/items.c b/items.c +index 637e5e745..83a2ea37d 100644 +--- a/items.c ++++ b/items.c +@@ -368,6 +368,8 @@ void item_free(item *it) { + bool item_size_ok(const size_t nkey, const int flags, const int nbytes) { + char prefix[40]; + uint8_t nsuffix; ++ if (nbytes < 2) ++ return false; + + size_t ntotal = item_make_header(nkey + 1, flags, nbytes, + prefix, &nsuffix); +diff --git a/memcached.c b/memcached.c +index 0f0335795..a89df965d 100644 +--- a/memcached.c ++++ b/memcached.c +@@ -4967,7 +4967,7 @@ static void drive_machine(conn *c) { + + case conn_swallow: + /* we are reading sbytes and throwing them away */ +- if (c->sbytes == 0) { ++ if (c->sbytes <= 0) { + conn_set_state(c, conn_new_cmd); + break; + } |