← Back to branch summary

~ubuntu-branches/ubuntu/raring/subversion/raring-security

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2013-1845.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2013-06-21 13:08:20 UTC
  • Revision ID: package-import@ubuntu.com-20130621130820-6edx772ic4t1aki6
Tags: 1.7.5-1ubuntu3.1
* SECURITY UPDATE: denial of service in mod_dav_svn
  - debian/patches/CVE-2013-1845.patch: handle multiple calls in
    subversion/mod_dav_svn/deadprops.c.
  - CVE-2013-1845
* SECURITY UPDATE: denial of service in mod_dav_svn via LOCK
  - debian/patches/CVE-2013-1846_1847.patch: properly validate locks in
    subversion/mod_dav_svn/lock.c.
  - CVE-2013-1846
  - CVE-2013-1847
* SECURITY UPDATE: denial of service in mod_dav_svn via PROPFIND
  - debian/patches/CVE-2013-1849.patch: validate type in
    subversion/mod_dav_svn/liveprops.c.
  - CVE-2013-1849
* SECURITY UPDATE: denial of service in mod_dav_svn via log REPORT
  - debian/patches/CVE-2013-1884.patch: fix error handling in
    subversion/mod_dav_svn/reports/log.c.
  - CVE-2013-1884
* SECURITY UPDATE: repo corruption via newline chars in filenames
  - debian/patches/CVE-2013-1968.patch: properly escape paths in
    subversion/libsvn_fs_fs/tree.c, added test to
    subversion/tests/libsvn_fs/fs-test.c.
  - CVE-2013-1968
* SECURITY UPDATE: denial of service via closed connection
  - debian/patches/CVE-2013-2112.patch: check for closed connections in
    subversion/svnserve/main.c.
  - CVE-2013-2112

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2013-1845.patch
 
1
Description: fix denial of service in mod_dav_svn
 
2
Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=1454237
 
3
 
 
4
Index: subversion-1.7.5/subversion/mod_dav_svn/deadprops.c
 
5
===================================================================
 
6
--- subversion-1.7.5.orig/subversion/mod_dav_svn/deadprops.c    2010-12-30 15:46:50.000000000 -0500
 
7
+++ subversion-1.7.5/subversion/mod_dav_svn/deadprops.c 2013-06-21 13:05:32.326538918 -0400
 
8
@@ -168,6 +168,7 @@
 
9
   const char *propname;
 
10
   svn_error_t *serr;
 
11
   const dav_resource *resource = db->resource;
 
12
+  apr_pool_t *subpool;
 
13
 
 
14
   /* get the repos-local name */
 
15
   get_repos_propname(db, name, &propname);
 
16
@@ -202,13 +203,16 @@
 
17
 
 
18
   */
 
19
 
 
20
+  /* A subpool to cope with mod_dav making multiple calls, e.g. during
 
21
+     PROPPATCH with multiple values. */
 
22
+  subpool = svn_pool_create(db->resource->pool);
 
23
   if (db->resource->baselined)
 
24
     {
 
25
       if (db->resource->working)
 
26
         {
 
27
           serr = svn_repos_fs_change_txn_prop(resource->info->root.txn,
 
28
                                               propname, value,
 
29
-                                              resource->pool);
 
30
+                                              subpool);
 
31
         }
 
32
       else
 
33
         {
 
34
@@ -219,7 +223,7 @@
 
35
                                                TRUE, TRUE,
 
36
                                                db->authz_read_func,
 
37
                                                db->authz_read_baton,
 
38
-                                               resource->pool);
 
39
+                                               subpool);
 
40
 
 
41
           /* Prepare any hook failure message to get sent over the wire */
 
42
           if (serr)
 
43
@@ -242,20 +246,21 @@
 
44
           dav_svn__operational_log(resource->info,
 
45
                                    svn_log__change_rev_prop(
 
46
                                       resource->info->root.rev,
 
47
-                                      propname, resource->pool));
 
48
+                                      propname, subpool));
 
49
         }
 
50
     }
 
51
   else if (resource->info->restype == DAV_SVN_RESTYPE_TXN_COLLECTION)
 
52
     {
 
53
       serr = svn_repos_fs_change_txn_prop(resource->info->root.txn,
 
54
-                                          propname, value, resource->pool);
 
55
+                                          propname, value, subpool);
 
56
     }
 
57
   else
 
58
     {
 
59
       serr = svn_repos_fs_change_node_prop(resource->info->root.root,
 
60
                                            get_repos_path(resource->info),
 
61
-                                           propname, value, resource->pool);
 
62
+                                           propname, value, subpool);
 
63
     }
 
64
+  svn_pool_destroy(subpool);
 
65
 
 
66
   if (serr != NULL)
 
67
     return dav_svn__convert_err(serr, HTTP_INTERNAL_SERVER_ERROR,
 
68
@@ -540,6 +545,7 @@
 
69
 {
 
70
   svn_error_t *serr;
 
71
   const char *propname;
 
72
+  apr_pool_t *subpool;
 
73
 
 
74
   /* get the repos-local name */
 
75
   get_repos_propname(db, name, &propname);
 
76
@@ -548,11 +554,15 @@
 
77
   if (propname == NULL)
 
78
     return NULL;
 
79
 
 
80
+  /* A subpool to cope with mod_dav making multiple calls, e.g. during
 
81
+     PROPPATCH with multiple values. */
 
82
+  subpool = svn_pool_create(db->resource->pool);
 
83
+
 
84
   /* Working Baseline or Working (Version) Resource */
 
85
   if (db->resource->baselined)
 
86
     if (db->resource->working)
 
87
       serr = svn_repos_fs_change_txn_prop(db->resource->info->root.txn,
 
88
-                                          propname, NULL, db->resource->pool);
 
89
+                                          propname, NULL, subpool);
 
90
     else
 
91
       /* ### VIOLATING deltaV: you can't proppatch a baseline, it's
 
92
          not a working resource!  But this is how we currently
 
93
@@ -564,11 +574,12 @@
 
94
                                            propname, NULL, NULL, TRUE, TRUE,
 
95
                                            db->authz_read_func,
 
96
                                            db->authz_read_baton,
 
97
-                                           db->resource->pool);
 
98
+                                           subpool);
 
99
   else
 
100
     serr = svn_repos_fs_change_node_prop(db->resource->info->root.root,
 
101
                                          get_repos_path(db->resource->info),
 
102
-                                         propname, NULL, db->resource->pool);
 
103
+                                         propname, NULL, subpool);
 
104
+  svn_pool_destroy(subpool);
 
105
   if (serr != NULL)
 
106
     return dav_svn__convert_err(serr, HTTP_INTERNAL_SERVER_ERROR,
 
107
                                 "could not remove a property",