← Back to branch summary

~ubuntu-branches/ubuntu/saucy/apache2/saucy

« back to all changes in this revision

Viewing changes to debian/patches/032_CAN-2004-0786.patch

  • Committer: Bazaar Package Importer
  • Author(s): Thom May
  • Date: 2004-10-13 19:46:10 UTC
  • Revision ID: james.westby@ubuntu.com-20041013194610-ccvqcz8vflh5zqrm
Tags: 2.0.50-12ubuntu4
Security Release. Patch from upstream for the following:
CAN-2004-0885SSLCypherSuite can be bypassed during renegotiation.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/032_CAN-2004-0786.patch
 
1
--- 2.0/srclib/apr-util/test/testuri.c
 
2
+++ build-tree/apache2/srclib/apr-util/test/testuri.c
 
3
@@ -36,6 +37,10 @@
 
4
 
 
5
 struct aup_test aup_tests[] =
 
6
 {
 
7
+    { "http://[/::1]/index.html", APR_EGENERAL },
 
8
+    { "http://[", APR_EGENERAL },
 
9
+    { "http://[?::1]/index.html", APR_EGENERAL },
 
10
+
 
11
     {
 
12
         "http://127.0.0.1:9999/asdf.html",
 
13
         0, "http", "127.0.0.1:9999", NULL, NULL, "127.0.0.1", "9999", "/asdf.html", NULL, NULL, 9999
 
14
--- 2.0/srclib/apr-util/uri/apr_uri.c
 
15
+++ build-tree/apache2/srclib/apr-util/uri/apr_uri.c
 
16
@@ -307,11 +307,11 @@
 
17
         if (*hostinfo == '[') {
 
18
             v6_offset1 = 1;
 
19
             v6_offset2 = 2;
 
20
-            s = uri;
 
21
-            do {
 
22
-                --s;
 
23
-            } while (s >= hostinfo && *s != ':' && *s != ']');
 
24
-            if (s < hostinfo || *s == ']') {
 
25
+            s = memchr(hostinfo, ']', uri - hostinfo);
 
26
+            if (s == NULL) {
 
27
+                return APR_EGENERAL;
 
28
+            }
 
29
+            if (*++s != ':') {
 
30
                 s = NULL; /* no port */
 
31
             }
 
32
         }