Hi,

this is the diff to fix this security issue: http://bugs.python.org/issue20246 
in 5.4 -release.

I just tested on amd64, could be good to be tested on other archs.

Are you ok?

Cheers,

Remi.
Index: 2.7/Makefile
===================================================================
RCS file: /cvs/ports/lang/python/2.7/Makefile,v
retrieving revision 1.26
diff -u -p -r1.26 Makefile
--- 2.7/Makefile        22 May 2013 12:39:30 -0000      1.26
+++ 2.7/Makefile        9 Feb 2014 10:18:47 -0000
@@ -2,6 +2,7 @@
 
 VERSION =              2.7
 PATCHLEVEL =           .5
+REVISION =             0
 SHARED_LIBS =          python2.7 0.0
 VERSION_SPEC =         >=2.7,<2.8
 
Index: 2.7/patches/patch-Lib_test_test_socket_py
===================================================================
RCS file: 2.7/patches/patch-Lib_test_test_socket_py
diff -N 2.7/patches/patch-Lib_test_test_socket_py
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ 2.7/patches/patch-Lib_test_test_socket_py   9 Feb 2014 10:18:47 -0000
@@ -0,0 +1,19 @@
+$OpenBSD$
+security fix: http://bugs.python.org/issue20246
+
+--- Lib/test/test_socket.py.orig
++++ Lib/test/test_socket.py
+@@ -1620,6 +1620,16 @@ class BufferIOTest(SocketConnectedTest):
+ 
+     _testRecvFromIntoMemoryview = _testRecvFromIntoArray
+ 
++    def testRecvFromIntoSmallBuffer(self):
++        # See issue #20246.
++        buf = bytearray(8)
++        self.assertRaises(ValueError, self.cli_conn.recvfrom_into, buf, 1024)
++
++    def _testRecvFromIntoSmallBuffer(self):
++        with test_support.check_py3k_warnings():
++            buf = buffer(MSG)
++        self.serv_conn.send(buf)
++
Index: 2.7/patches/patch-Modules_socketmodule_c
===================================================================
RCS file: 2.7/patches/patch-Modules_socketmodule_c
diff -N 2.7/patches/patch-Modules_socketmodule_c
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ 2.7/patches/patch-Modules_socketmodule_c    9 Feb 2014 10:18:47 -0000
@@ -0,0 +1,16 @@
+$OpenBSD$
+security fix: http://bugs.python.org/issue20246
+
+--- Modules/socketmodule.c.orig
++++ Modules/socketmodule.c
+@@ -2742,6 +2742,10 @@ sock_recvfrom_into(PySocketSockObject *s
+     if (recvlen == 0) {
+         /* If nbytes was not specified, use the buffer's length */
+         recvlen = buflen;
++    } else if (recvlen > buflen) {
++        PyErr_SetString(PyExc_ValueError,
++                        "nbytes is greater than the length of the buffer");
++        goto error;
+     }
+ 
+     readlen = sock_recvfrom_guts(s, buf.buf, recvlen, flags, &addr);
Index: 3.3/Makefile
===================================================================
RCS file: /cvs/ports/lang/python/3.3/Makefile,v
retrieving revision 1.5
diff -u -p -r1.5 Makefile
--- 3.3/Makefile        22 May 2013 12:37:05 -0000      1.5
+++ 3.3/Makefile        9 Feb 2014 10:18:47 -0000
@@ -2,6 +2,7 @@
 
 VERSION =              3.3
 PATCHLEVEL =           .2
+REVISION =             0
 SHARED_LIBS =          python3.3m 0.0
 VERSION_SPEC =         >=3.3,<3.4
 
Index: 3.3/patches/patch-Lib_test_test_socket_py
===================================================================
RCS file: 3.3/patches/patch-Lib_test_test_socket_py
diff -N 3.3/patches/patch-Lib_test_test_socket_py
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ 3.3/patches/patch-Lib_test_test_socket_py   9 Feb 2014 10:18:47 -0000
@@ -0,0 +1,17 @@
+$OpenBSD$
+security fix: http://bugs.python.org/issue20246
+
+--- Lib/test/test_socket.py
++++ Lib/test/test_socket.py
+@@ -4538,6 +4538,14 @@ class BufferIOTest(SocketConnectedTest):
+ 
+     _testRecvFromIntoMemoryview = _testRecvFromIntoArray
+ 
++    def testRecvFromIntoSmallBuffer(self):
++        # See issue #20246.
++        buf = bytearray(8)
++        self.assertRaises(ValueError, self.cli_conn.recvfrom_into, buf, 1024)
++
++    def _testRecvFromIntoSmallBuffer(self):
++        self.serv_conn.send(MSG)
++
Index: 3.3/patches/patch-Modules_socketmodule_c
===================================================================
RCS file: 3.3/patches/patch-Modules_socketmodule_c
diff -N 3.3/patches/patch-Modules_socketmodule_c
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ 3.3/patches/patch-Modules_socketmodule_c    9 Feb 2014 10:18:47 -0000
@@ -0,0 +1,17 @@
+$OpenBSD$
+security fix: http://bugs.python.org/issue20246
+
+--- Modules/socketmodule.c.orig
++++ Modules/socketmodule.c
+@@ -2935,6 +2935,11 @@ sock_recvfrom_into(PySocketSockObject *s
+     if (recvlen == 0) {
+         /* If nbytes was not specified, use the buffer's length */
+         recvlen = buflen;
++    } else if (recvlen > buflen) {
++        PyBuffer_Release(&pbuf);
++        PyErr_SetString(PyExc_ValueError,
++                        "nbytes is greater than the length of the buffer");
++        return NULL;
+     }
+ 
+     readlen = sock_recvfrom_guts(s, buf, recvlen, flags, &addr);

Reply via email to