nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-02 04:50:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

libressl_3_2: add patch for CVE-2021-41581

Browse Source 
(cherry picked & modified from commit 01cc988d96)
This commit is contained in:
Robert Scott
2021-10-03 16:00:33 +01:00
parent 0d05030c80
commit ea8e7d2377
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
pkgs/development/libraries/libressl/CVE-2021-41581.patch Normal file
View File

@@ -0,0 +1,53 @@
Based on upstream https://github.com/openbsd/src/commit/62ceddea5b1d64a1a362bbb7071d9e15adcde6b1
with paths switched to apply to libressl-portable and CVS header
hunk removed.
--- a/crypto/x509/x509_constraints.c
+++ b/crypto/x509/x509_constraints.c
@@ -339,16 +339,16 @@
if (c == '.')
goto bad;
}
- if (wi > DOMAIN_PART_MAX_LEN)
- goto bad;
if (accept) {
+ if (wi >= DOMAIN_PART_MAX_LEN)
+ goto bad;
working[wi++] = c;
accept = 0;
continue;
}
if (candidate_local != NULL) {
/* We are looking for the domain part */
- if (wi > DOMAIN_PART_MAX_LEN)
+ if (wi >= DOMAIN_PART_MAX_LEN)
goto bad;
working[wi++] = c;
if (i == len - 1) {
@@ -363,7 +363,7 @@
continue;
}
/* We are looking for the local part */
- if (wi > LOCAL_PART_MAX_LEN)
+ if (wi >= LOCAL_PART_MAX_LEN)
break;
if (quoted) {
@@ -383,6 +383,8 @@
*/
if (c == 9)
goto bad;
+ if (wi >= LOCAL_PART_MAX_LEN)
+ goto bad;
working[wi++] = c;
continue; /* all's good inside our quoted string */
}
@@ -412,6 +414,8 @@
}
if (!local_part_ok(c))
goto bad;
+ if (wi >= LOCAL_PART_MAX_LEN)
+ goto bad;
working[wi++] = c;
}
if (candidate_local == NULL || candidate_domain == NULL)

3
pkgs/development/libraries/libressl/default.nix
View File

@@ -71,5 +71,8 @@ in {
libressl_3_2 = generic {
version = "3.2.5";
sha256 = "1zkwrs3b19s1ybz4q9hrb7pqsbsi8vxcs44qanfy11fkc7ynb2kr";
patches = [
./CVE-2021-41581.patch
];
};
}