Sat Jun 29 12:08:51 2013 UTC ()
add patch from upstream to fix possible buffer overflow in URL parser
(CVE-2013-2174), bump PKGREV


(drochner)
diff -r1.128 -r1.129 pkgsrc/www/curl/Makefile
diff -r1.85 -r1.86 pkgsrc/www/curl/distinfo
diff -r0 -r1.1 pkgsrc/www/curl/patches/patch-CVE-2013-2174
cvs diff -r1.128 -r1.129 pkgsrc/www/curl/Makefile (expand / switch to unified diff)

--- pkgsrc/www/curl/Makefile 2013/05/31 12:42:31 1.128
+++ pkgsrc/www/curl/Makefile 2013/06/29 12:08:50 1.129
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.128 2013/05/31 12:42:31 wiz Exp $ 1# $NetBSD: Makefile,v 1.129 2013/06/29 12:08:50 drochner Exp $
2 2
3DISTNAME= curl-7.30.0 3DISTNAME= curl-7.30.0
4PKGREVISION= 1 4PKGREVISION= 2
5CATEGORIES= www 5CATEGORIES= www
6MASTER_SITES= http://curl.haxx.se/download/ \ 6MASTER_SITES= http://curl.haxx.se/download/ \
7 ftp://ftp.sunet.se/pub/www/utilities/curl/ 7 ftp://ftp.sunet.se/pub/www/utilities/curl/
8EXTRACT_SUFX= .tar.bz2 8EXTRACT_SUFX= .tar.bz2
9 9
10MAINTAINER= pkgsrc-users@NetBSD.org 10MAINTAINER= pkgsrc-users@NetBSD.org
11HOMEPAGE= http://curl.haxx.se/ 11HOMEPAGE= http://curl.haxx.se/
12COMMENT= Client that groks URLs 12COMMENT= Client that groks URLs
13# not completely, but near enough 13# not completely, but near enough
14LICENSE= mit 14LICENSE= mit
15 15
16PKG_INSTALLATION_TYPES= overwrite pkgviews 16PKG_INSTALLATION_TYPES= overwrite pkgviews
17 17
cvs diff -r1.85 -r1.86 pkgsrc/www/curl/distinfo (expand / switch to unified diff)

--- pkgsrc/www/curl/distinfo 2013/04/14 16:39:48 1.85
+++ pkgsrc/www/curl/distinfo 2013/06/29 12:08:50 1.86
@@ -1,7 +1,8 @@ @@ -1,7 +1,8 @@
1$NetBSD: distinfo,v 1.85 2013/04/14 16:39:48 wiz Exp $ 1$NetBSD: distinfo,v 1.86 2013/06/29 12:08:50 drochner Exp $
2 2
3SHA1 (curl-7.30.0.tar.bz2) = 23fdc215558023b943cea9dfab04b86020037b0d 3SHA1 (curl-7.30.0.tar.bz2) = 23fdc215558023b943cea9dfab04b86020037b0d
4RMD160 (curl-7.30.0.tar.bz2) = 858e772c17fc05d7114856f09fc34e696f1ef595 4RMD160 (curl-7.30.0.tar.bz2) = 858e772c17fc05d7114856f09fc34e696f1ef595
5Size (curl-7.30.0.tar.bz2) = 2625976 bytes 5Size (curl-7.30.0.tar.bz2) = 2625976 bytes
 6SHA1 (patch-CVE-2013-2174) = 30b9f66fbc1112ba1dc361002768a0597ac1456b
6SHA1 (patch-aa) = 07e12cd0576b87cfed74a6a2bf8dd42cb2f5a570 7SHA1 (patch-aa) = 07e12cd0576b87cfed74a6a2bf8dd42cb2f5a570
7SHA1 (patch-curl-config.in) = c685dd4fd85fc9d97c6e6ff8dbf871c35dd57046 8SHA1 (patch-curl-config.in) = c685dd4fd85fc9d97c6e6ff8dbf871c35dd57046
File Added: pkgsrc/www/curl/patches/Attic/patch-CVE-2013-2174
$NetBSD: patch-CVE-2013-2174,v 1.1 2013/06/29 12:08:50 drochner Exp $

see http://curl.haxx.se/docs/adv_20130622.html

--- lib/escape.c.orig	2013-01-16 22:05:56.000000000 +0000
+++ lib/escape.c
@@ -159,7 +159,8 @@ CURLcode Curl_urldecode(struct SessionHa
 
   while(--alloc > 0) {
     in = *string;
-    if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
+    if(('%' == in) && (alloc > 2) &&
+       ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
       /* this is two hexadecimal digits following a '%' */
       char hexstr[3];
       char *ptr;