Received: by mail.netbsd.org (Postfix, from userid 605) id CB51B84E57; Tue, 13 Feb 2018 15:08:13 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 2C0A084D1F for ; Tue, 13 Feb 2018 15:08:13 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.netbsd.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id cnmF9k5Q8Dhm for ; Tue, 13 Feb 2018 15:08:11 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id C518A84D78 for ; Tue, 13 Feb 2018 15:08:11 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id B8E94FB40; Tue, 13 Feb 2018 15:08:11 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1518534491134140" MIME-Version: 1.0 Date: Tue, 13 Feb 2018 15:08:11 +0000 From: "Havard Eidnes" Subject: CVS commit: pkgsrc/net/ldns To: pkgsrc-changes@NetBSD.org Reply-To: he@netbsd.org X-Mailer: log_accum Message-Id: <20180213150811.B8E94FB40@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1518534491134140 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: he Date: Tue Feb 13 15:08:11 UTC 2018 Modified Files: pkgsrc/net/ldns: distinfo pkgsrc/net/ldns/patches: patch-parse.c Added Files: pkgsrc/net/ldns/patches: patch-str2host.c Log Message: Apply fix for CVE-2017-1000232 from https://git.nlnetlabs.nl/ldns/commit/?id=3bdeed02 Also correct previous CVE, it's CVE-2017-100231... Bump PKGREVISION. To generate a diff of this commit: cvs rdiff -u -r1.21 -r1.22 pkgsrc/net/ldns/distinfo cvs rdiff -u -r1.1 -r1.2 pkgsrc/net/ldns/patches/patch-parse.c cvs rdiff -u -r0 -r1.1 pkgsrc/net/ldns/patches/patch-str2host.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1518534491134140 Content-Disposition: inline Content-Length: 2375 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/net/ldns/distinfo diff -u pkgsrc/net/ldns/distinfo:1.21 pkgsrc/net/ldns/distinfo:1.22 --- pkgsrc/net/ldns/distinfo:1.21 Tue Feb 13 14:59:14 2018 +++ pkgsrc/net/ldns/distinfo Tue Feb 13 15:08:11 2018 @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.21 2018/02/13 14:59:14 he Exp $ +$NetBSD: distinfo,v 1.22 2018/02/13 15:08:11 he Exp $ SHA1 (ldns-1.6.17.tar.gz) = 4218897b3c002aadfc7280b3f40cda829e05c9a4 RMD160 (ldns-1.6.17.tar.gz) = 5382cfaafa7ec1fadcf390f804fbf14e04d7c03a @@ -6,4 +6,5 @@ SHA512 (ldns-1.6.17.tar.gz) = 5de42b4b86 Size (ldns-1.6.17.tar.gz) = 1315403 bytes SHA1 (patch-doc_doxyparse.pl) = 8d21d6f1c2e5e8d9ecc16a23dc7a462f0c54b5f7 SHA1 (patch-examples_ldns-keygen.c) = 12ab1cb2c74f09d763969298a21c9470b748d292 -SHA1 (patch-parse.c) = 206e12c806854b652a799e98efd86c5e15f8024d +SHA1 (patch-parse.c) = 3dbf4443b4a068f02e2799e820e8fcbf50abaa15 +SHA1 (patch-str2host.c) = 002e2f04059a9bc2479a8d66335595d4d7dd598f Index: pkgsrc/net/ldns/patches/patch-parse.c diff -u pkgsrc/net/ldns/patches/patch-parse.c:1.1 pkgsrc/net/ldns/patches/patch-parse.c:1.2 --- pkgsrc/net/ldns/patches/patch-parse.c:1.1 Tue Feb 13 14:59:15 2018 +++ pkgsrc/net/ldns/patches/patch-parse.c Tue Feb 13 15:08:11 2018 @@ -1,6 +1,6 @@ -$NetBSD: patch-parse.c,v 1.1 2018/02/13 14:59:15 he Exp $ +$NetBSD: patch-parse.c,v 1.2 2018/02/13 15:08:11 he Exp $ -Apply fix for CVE-2017-10002, via +Apply fix for CVE-2017-1000231, via https://git.nlnetlabs.nl/ldns/commit/?id=c8391790 --- parse.c.orig 2014-01-10 21:04:41.000000000 +0000 Added files: Index: pkgsrc/net/ldns/patches/patch-str2host.c diff -u /dev/null pkgsrc/net/ldns/patches/patch-str2host.c:1.1 --- /dev/null Tue Feb 13 15:08:11 2018 +++ pkgsrc/net/ldns/patches/patch-str2host.c Tue Feb 13 15:08:11 2018 @@ -0,0 +1,19 @@ +$NetBSD: patch-str2host.c,v 1.1 2018/02/13 15:08:11 he Exp $ + +Apply fix for CVE-2017-1000232 from +https://git.nlnetlabs.nl/ldns/commit/?id=3bdeed02 + +--- str2host.c.orig 2014-01-10 21:04:41.000000000 +0000 ++++ str2host.c +@@ -1458,7 +1458,10 @@ ldns_str2rdf_long_str(ldns_rdf **rd, con + if (! str) { + return LDNS_STATUS_SYNTAX_BAD_ESCAPE; + } +- length = (size_t)(dp - data); ++ if (!(length = (size_t)(dp - data))) { ++ LDNS_FREE(data); ++ return LDNS_STATUS_SYNTAX_EMPTY; ++ } + + /* Lose the overmeasure */ + data = LDNS_XREALLOC(dp = data, uint8_t, length); --_----------=_1518534491134140--