1
=== modified file 'debian/changelog'
2
--- debian/changelog	2009-12-22 02:56:21 +0000
3
+++ debian/changelog	2010-03-11 17:38:15 +0000
4
@@ -1,3 +1,10 @@
5
1
erlang (1:13.b.3-dfsg-2ubuntu2) lucid; urgency=low
6
2
7
3
  * CVE-2008-2371: outer level option with alternatives caused crash.
8
4
    (LP: #535090). 
9
5
10
6
 -- Ralf Doering <rdoering@netsys-it.de>  Thu, 11 Mar 2010 15:20:06 +0100
11
7
12
1
erlang (1:13.b.3-dfsg-2ubuntu1) lucid; urgency=low
8
erlang (1:13.b.3-dfsg-2ubuntu1) lucid; urgency=low
13
2
9
14
3
  * Merge with Debian testing; remaining Ubuntu changes:
10
  * Merge with Debian testing; remaining Ubuntu changes:
15
4
11
16
=== added file 'debian/patches/pcre-crash.patch'
17
--- debian/patches/pcre-crash.patch	1970-01-01 00:00:00 +0000
18
+++ debian/patches/pcre-crash.patch	2010-03-11 17:38:15 +0000
19
@@ -0,0 +1,68 @@
20
1
Origin: upstream http://github.com/erlang/otp/commit/bb6370a20be07e6bd0c9f6e89a3cd9719dccbfd3
21
2
Bug-Ubuntu: https://bugs.launchpad.net/bugs/535090 
22
3
Author: Michael Santos <michael.santos@gmail.com>
23
4
Date:   Wed Feb 10 15:19:48 2010 -0500
24
5
25
6
    Fix CVE-2008-2371 (outer level option with alternatives caused crash).
26
7
    
27
8
    The patch is from:
28
9
    http://vcs.pcre.org/viewvc?revision=360&view=revision
29
10
    
30
11
    Test case:
31
12
    re:compile(<<"(?i)[\xc3\xa9\xc3\xbd]|[\xc3\xa9\xc3\xbdA]">>, [unicode]).
32
13
    
33
14
    An option change at the start of a pattern that had top-level
34
15
    alternatives could cause overwriting and/or a crash.
35
16
    
36
17
    This potential security problem was recorded as CVE-2008-2371.
37
18
38
19
diff --git a/erts/emulator/pcre/pcre_compile.c b/erts/emulator/pcre/pcre_compile.c
39
20
index 235617f..2974336 100644
40
21
--- a/erts/emulator/pcre/pcre_compile.c
41
22
+++ b/erts/emulator/pcre/pcre_compile.c
42
23
@@ -4820,10 +4820,8 @@ we set the flag only if there is a literal "\r" or "\n" in the class. */
43
24
         both phases.
44
25
 
45
26
         If we are not at the pattern start, compile code to change the ims
46
27
-        options if this setting actually changes any of them. We also pass the
47
28
-        new setting back so that it can be put at the start of any following
48
29
-        branches, and when this group ends (if we are in a group), a resetting
49
30
-        item can be compiled. */
50
31
+        options if this setting actually changes any of them, and reset the
51
32
+        greedy defaults and the case value for firstbyte and reqbyte. */
52
33
 
53
34
         if (*ptr == ')')
54
35
           {
55
36
@@ -4831,7 +4829,6 @@ we set the flag only if there is a literal "\r" or "\n" in the class. */
56
37
                (lengthptr == NULL || *lengthptr == 2 + 2*LINK_SIZE))
57
38
             {
58
39
             cd->external_options = newoptions;
59
40
-            options = newoptions;
60
41
             }
61
42
          else
62
43
             {
63
44
@@ -4840,17 +4837,17 @@ we set the flag only if there is a literal "\r" or "\n" in the class. */
64
45
               *code++ = OP_OPT;
65
46
               *code++ = newoptions & PCRE_IMS;
66
47
               }
67
48
-
68
49
-            /* Change options at this level, and pass them back for use
69
50
-            in subsequent branches. Reset the greedy defaults and the case
70
51
-            value for firstbyte and reqbyte. */
71
52
-
72
53
-            *optionsptr = options = newoptions;
73
54
             greedy_default = ((newoptions & PCRE_UNGREEDY) != 0);
74
55
             greedy_non_default = greedy_default ^ 1;
75
56
-            req_caseopt = ((options & PCRE_CASELESS) != 0)? REQ_CASELESS : 0;
76
57
+            req_caseopt = ((newoptions & PCRE_CASELESS) != 0)? REQ_CASELESS : 0;
77
58
             }
78
59
 
79
60
+          /* Change options at this level, and pass them back for use
80
61
+          in subsequent branches. When not at the start of the pattern, this
81
62
+          information is also necessary so that a resetting item can be
82
63
+          compiled at the end of a group (if we are in a group). */
83
64
+
84
65
+          *optionsptr = options = newoptions;
85
66
           previous = NULL;       /* This item can't be repeated */
86
67
           continue;              /* It is complete */
87
68
           }
88
0
69
89
=== modified file 'debian/patches/series'
90
--- debian/patches/series	2009-12-22 02:56:21 +0000
91
+++ debian/patches/series	2010-03-11 17:38:15 +0000
92
@@ -8,3 +8,5 @@
93
8
docs.patch
8
docs.patch
94
9
#native.patch
9
#native.patch
95
10
build-options.patch
10
build-options.patch
96
11
pcre-crash.patch
97
12
Reviewer	Review Type	Date Requested	Status
Ubuntu branches		2010-03-11	Pending
Review via email: mp+21161@code.launchpad.net