← Back to branch summary

~ubuntu-branches/ubuntu/dapper/apache2/dapper-security

« back to all changes in this revision

Viewing changes to debian/patches/112_CVE-2009-1956.patch

  • Committer: Bazaar Package Importer
  • Author(s): Jamie Strandboge
  • Date: 2009-06-10 22:01:23 UTC
  • Revision ID: james.westby@ubuntu.com-20090610220123-v48896k90jy4q1jk
Tags: 2.0.55-4ubuntu2.5
* SECURITY UPDATE: Fix underflow in apr_strmatch_precompile
  - debian/patches/110_CVE-2009-0023.dpatch: adjust
    srclib/apr-util/strmatch/apr_strmatch.c to properly evaluate strings as
    unsigned char rather than int
  - CVE-2009-0023
* SECURITY UPDATE: Prevent "billion laughs" attack against expat
  - debian/patches/111_CVE-2009-1955.dpatch: adjust
    srclib/apr-util/xml/apr_xml.c to disable internal entity expansion
  - CVE-2009-1955
* SECURITY UPDATE: Fix off by one overflow in apr_brigade_vprintf
  - debian/patches/112_CVE-2009-1956.dpatch: don't add null terminator to
    vd.vbuff.curpos in srclib/apr-util/buckets/apr_brigade.c
  - CVE-2009-1956

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/112_CVE-2009-1956.patch
 
1
diff -ruN -x configure -x '*~' -x build-tree.orig -x '*.rej' build-tree.orig/httpd-2.0.55/srclib/apr-util/buckets/apr_brigade.c build-tree/httpd-2.0.55/srclib/apr-util/buckets/apr_brigade.c
 
2
--- build-tree.orig/httpd-2.0.55/srclib/apr-util/buckets/apr_brigade.c  2005-02-04 14:39:09.000000000 -0600
 
3
+++ build-tree/httpd-2.0.55/srclib/apr-util/buckets/apr_brigade.c       2009-06-10 21:59:47.877057611 -0500
 
4
@@ -653,9 +653,6 @@
 
5
       return -1;
 
6
     }
 
7
 
 
8
-    /* tack on null terminator to remaining string */
 
9
-    *(vd.vbuff.curpos) = '\0';
 
10
-
 
11
     /* write out what remains in the buffer */
 
12
     return apr_brigade_write(b, flush, ctx, buf, vd.vbuff.curpos - buf);
 
13
 }