1
=== modified file 'debian/changelog'
2
--- debian/changelog	2009-02-15 16:42:52 +0000
3
+++ debian/changelog	2010-03-12 20:59:19 +0000
4
@@ -1,3 +1,16 @@
5
1
erlang (1:12.b.5-dfsg-2ubuntu0.1) jaunty-security; urgency=low
6
2
7
3
  * SECURITY UPDATE: denial of service via Heap-based buffer overflow in
8
4
    pcre_compile.c in the Perl-Compatible Regular Expression (PCRE)
9
5
    library (LP: #535090)
10
6
    - CVE-2008-2371
11
7
    - debian/patches/pcre-crash.patch is cherrypicked from upstream commit
12
8
      http://github.com/erlang/otp/commit/bb6370a2. The hunk for the
13
9
      testsuite does not apply cleanly and is not needed for the fix so was
14
10
      stripped. This fix is part of the current upstream OTP release R13B04.
15
11
16
12
 -- Ralf Doering <rdoering@netsys-it.de>  Fri, 12 Mar 2010 16:06:36 +0100
17
13
18
1
erlang (1:12.b.5-dfsg-2) unstable; urgency=low
14
erlang (1:12.b.5-dfsg-2) unstable; urgency=low
19
2
15
20
3
  * Upload to unstable after lenny is released.
16
  * Upload to unstable after lenny is released.
21
4
17
22
=== added file 'debian/patches/pcre-crash.patch'
23
--- debian/patches/pcre-crash.patch	1970-01-01 00:00:00 +0000
24
+++ debian/patches/pcre-crash.patch	2010-03-12 20:59:19 +0000
25
@@ -0,0 +1,68 @@
26
1
Origin: upstream http://github.com/erlang/otp/commit/bb6370a20be07e6bd0c9f6e89a3cd9719dccbfd3
27
2
Bug-Ubuntu: https://bugs.launchpad.net/bugs/535090 
28
3
Author: Michael Santos <michael.santos@gmail.com>
29
4
Date:   Wed Feb 10 15:19:48 2010 -0500
30
5
31
6
    Fix CVE-2008-2371 (outer level option with alternatives caused crash).
32
7
    
33
8
    The patch is from:
34
9
    http://vcs.pcre.org/viewvc?revision=360&view=revision
35
10
    
36
11
    Test case:
37
12
    re:compile(<<"(?i)[\xc3\xa9\xc3\xbd]|[\xc3\xa9\xc3\xbdA]">>, [unicode]).
38
13
    
39
14
    An option change at the start of a pattern that had top-level
40
15
    alternatives could cause overwriting and/or a crash.
41
16
    
42
17
    This potential security problem was recorded as CVE-2008-2371.
43
18
44
19
diff --git a/erts/emulator/pcre/pcre_compile.c b/erts/emulator/pcre/pcre_compile.c
45
20
index 235617f..2974336 100644
46
21
--- a/erts/emulator/pcre/pcre_compile.c
47
22
+++ b/erts/emulator/pcre/pcre_compile.c
48
23
@@ -4820,10 +4820,8 @@ we set the flag only if there is a literal "\r" or "\n" in the class. */
49
24
         both phases.
50
25
 
51
26
         If we are not at the pattern start, compile code to change the ims
52
27
-        options if this setting actually changes any of them. We also pass the
53
28
-        new setting back so that it can be put at the start of any following
54
29
-        branches, and when this group ends (if we are in a group), a resetting
55
30
-        item can be compiled. */
56
31
+        options if this setting actually changes any of them, and reset the
57
32
+        greedy defaults and the case value for firstbyte and reqbyte. */
58
33
 
59
34
         if (*ptr == ')')
60
35
           {
61
36
@@ -4831,7 +4829,6 @@ we set the flag only if there is a literal "\r" or "\n" in the class. */
62
37
                (lengthptr == NULL || *lengthptr == 2 + 2*LINK_SIZE))
63
38
             {
64
39
             cd->external_options = newoptions;
65
40
-            options = newoptions;
66
41
             }
67
42
          else
68
43
             {
69
44
@@ -4840,17 +4837,17 @@ we set the flag only if there is a literal "\r" or "\n" in the class. */
70
45
               *code++ = OP_OPT;
71
46
               *code++ = newoptions & PCRE_IMS;
72
47
               }
73
48
-
74
49
-            /* Change options at this level, and pass them back for use
75
50
-            in subsequent branches. Reset the greedy defaults and the case
76
51
-            value for firstbyte and reqbyte. */
77
52
-
78
53
-            *optionsptr = options = newoptions;
79
54
             greedy_default = ((newoptions & PCRE_UNGREEDY) != 0);
80
55
             greedy_non_default = greedy_default ^ 1;
81
56
-            req_caseopt = ((options & PCRE_CASELESS) != 0)? REQ_CASELESS : 0;
82
57
+            req_caseopt = ((newoptions & PCRE_CASELESS) != 0)? REQ_CASELESS : 0;
83
58
             }
84
59
 
85
60
+          /* Change options at this level, and pass them back for use
86
61
+          in subsequent branches. When not at the start of the pattern, this
87
62
+          information is also necessary so that a resetting item can be
88
63
+          compiled at the end of a group (if we are in a group). */
89
64
+
90
65
+          *optionsptr = options = newoptions;
91
66
           previous = NULL;       /* This item can't be repeated */
92
67
           continue;              /* It is complete */
93
68
           }
94
0
69
95
=== modified file 'debian/patches/series'
96
--- debian/patches/series	2009-02-15 16:42:52 +0000
97
+++ debian/patches/series	2010-03-12 20:59:19 +0000
98
@@ -7,3 +7,4 @@
99
7
sctp.patch
7
sctp.patch
100
8
m68k.patch
8
m68k.patch
101
9
#native.patch
9
#native.patch
102
10
pcre-crash.patch
Reviewer	Review Type	Date Requested	Status
Ubuntu branches		2010-03-12	Pending
Review via email: mp+21282@code.launchpad.net