Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=83b14eeae18c29bf7218acec73ba2a08480ab31a
commit 83b14eeae18c29bf7218acec73ba2a08480ab31a Author: kikadf <[email protected]> Date: Sat Jul 19 09:28:55 2014 +0200 transmission-cli-2.81-2arcturus1-x86_64 * Fix CVE-2014-4909 diff --git a/source/apps-extra/transmission-cli/CVE-2014-4909.patch b/source/apps-extra/transmission-cli/CVE-2014-4909.patch new file mode 100644 index 0000000..9dada24 --- /dev/null +++ b/source/apps-extra/transmission-cli/CVE-2014-4909.patch @@ -0,0 +1,107 @@ +Description: fix denial of service and possible code execution via + overflow in tr_bitfieldEnsureNthBitAlloced +Origin: upstream, https://trac.transmissionbt.com/changeset/14303 + +Index: transmission-2.82/libtransmission/bitfield.c +=================================================================== +--- transmission-2.82.orig/libtransmission/bitfield.c 2013-08-08 22:45:45.094416272 -0400 ++++ transmission-2.82/libtransmission/bitfield.c 2014-07-11 14:06:27.012968716 -0400 +@@ -170,7 +170,7 @@ + static size_t + get_bytes_needed (size_t bit_count) + { +- return (bit_count + 7u) / 8u; ++ return (bit_count >> 3) + (bit_count & 7 ? 1 : 0); + } + + static void +@@ -231,11 +231,16 @@ + } + } + +-static void ++static bool + tr_bitfieldEnsureNthBitAlloced (tr_bitfield * b, size_t nth) + { + /* count is zero-based, so we need to allocate nth+1 bits before setting the nth */ ++ ++ if (nth == SIZE_MAX) ++ return false; ++ + tr_bitfieldEnsureBitsAlloced (b, nth + 1); ++ return true; + } + + static void +@@ -368,9 +373,8 @@ + void + tr_bitfieldAdd (tr_bitfield * b, size_t nth) + { +- if (!tr_bitfieldHas (b, nth)) ++ if (!tr_bitfieldHas (b, nth) && tr_bitfieldEnsureNthBitAlloced (b, nth)) + { +- tr_bitfieldEnsureNthBitAlloced (b, nth); + b->bits[nth >> 3u] |= (0x80 >> (nth & 7u)); + tr_bitfieldIncTrueCount (b, 1); + } +@@ -396,7 +400,9 @@ + eb = end >> 3; + em = 0xff << (7 - (end & 7)); + +- tr_bitfieldEnsureNthBitAlloced (b, end); ++ if (!tr_bitfieldEnsureNthBitAlloced (b, end)) ++ return; ++ + if (sb == eb) + { + b->bits[sb] |= (sm & em); +@@ -417,9 +423,8 @@ + { + assert (tr_bitfieldIsValid (b)); + +- if (!tr_bitfieldHas (b, nth)) ++ if (!tr_bitfieldHas (b, nth) && tr_bitfieldEnsureNthBitAlloced (b, nth)) + { +- tr_bitfieldEnsureNthBitAlloced (b, nth); + b->bits[nth >> 3u] &= (0xff7f >> (nth & 7u)); + tr_bitfieldIncTrueCount (b, -1); + } +@@ -446,7 +451,9 @@ + eb = end >> 3; + em = ~ (0xff << (7 - (end & 7))); + +- tr_bitfieldEnsureNthBitAlloced (b, end); ++ if (!tr_bitfieldEnsureNthBitAlloced (b, end)) ++ return; ++ + if (sb == eb) + { + b->bits[sb] &= (sm | em); +Index: transmission-2.82/libtransmission/peer-msgs.c +=================================================================== +--- transmission-2.82.orig/libtransmission/peer-msgs.c 2013-08-08 22:45:40.294416158 -0400 ++++ transmission-2.82/libtransmission/peer-msgs.c 2014-07-11 14:06:27.016968716 -0400 +@@ -36,6 +36,10 @@ + #include "variant.h" + #include "version.h" + ++#ifndef EBADMSG ++ #define EBADMSG EINVAL ++#endif ++ + /** + *** + **/ +@@ -1696,6 +1700,12 @@ + assert (msgs); + assert (req); + ++ if (!requestIsValid (msgs, req)) { ++ dbgmsg (msgs, "dropping invalid block %u:%u->%u", ++ req->index, req->offset, req->length); ++ return EBADMSG; ++ } ++ + if (req->length != tr_torBlockCountBytes (msgs->torrent, block)) { + dbgmsg (msgs, "wrong block size -- expected %u, got %d", + tr_torBlockCountBytes (msgs->torrent, block), req->length); diff --git a/source/apps-extra/transmission-cli/FrugalBuild b/source/apps-extra/transmission-cli/FrugalBuild index a7c46fe..b486369 100644 --- a/source/apps-extra/transmission-cli/FrugalBuild +++ b/source/apps-extra/transmission-cli/FrugalBuild @@ -5,7 +5,7 @@ options+=('asneeded') pkgname=transmission-cli pkgver=2.81 -pkgrel=1 +pkgrel=2arcturus1 pkgdesc="A free, lightweight BitTorrent Client. (CLI based)" url="http://www.transmissionbt.com/"; depends=('curl>=7.26.0' 'libevent>=2.0.17') @@ -37,6 +37,12 @@ subgroups=("${subgroups[@]}" 'xapps-extra') subarchs=("${subarchs[@]}" 'i686 x86_64') subreplaces=("${subreplaces[@]}" '') + +# FSA fix *** +source=(${source[@]} CVE-2014-4909.patch) +sha1sums=(${sha1sums[@]} '360db206700518511c5374d76b889c838709cd1b') +# *********** + build() { Fcd _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
