me/guix
Archived
1
0
Fork 0
Code Activity

gnu: httpd: Add fix for CVE-2016-8740.

Browse source 
* gnu/packages/web.scm (httpd)[source]: Add patch for CVE-2016-8740.
* gnu/packages/patches/httpd-CVE-2016-8740.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
This commit is contained in:
Efraim Flashner 2016-12-06 15:36:59 +02:00
parent 3a735ecf0e
commit 1ebe49f192
No known key found for this signature in database
GPG key ID: F4C1D3917EACEE93
3 changed files with 40 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
gnu/local.mk
View file

@ -620,6 +620,7 @@ dist_patch_DATA = \
%D%/packages/patches/hdf-eos5-fortrantests.patch \ %D%/packages/patches/hdf-eos5-fortrantests.patch \
%D%/packages/patches/higan-remove-march-native-flag.patch \ %D%/packages/patches/higan-remove-march-native-flag.patch \
%D%/packages/patches/hop-linker-flags.patch \ %D%/packages/patches/hop-linker-flags.patch \
%D%/packages/patches/httpd-CVE-2016-8740.patch \
%D%/packages/patches/hydra-disable-darcs-test.patch \ %D%/packages/patches/hydra-disable-darcs-test.patch \
%D%/packages/patches/hypre-doc-tables.patch \ %D%/packages/patches/hypre-doc-tables.patch \
%D%/packages/patches/hypre-ldflags.patch \ %D%/packages/patches/hypre-ldflags.patch \

36
gnu/packages/patches/httpd-CVE-2016-8740.patch Normal file
View file

@ -0,0 +1,36 @@
This patch applies against httpd-2.4.23 and shouldn't be needed in later releases
http://openwall.com/lists/oss-security/2016/12/05/17
Index: modules/http2/h2_stream.c
===================================================================
--- modules/http2/h2_stream.c (revision 1771866)
+++ modules/http2/h2_stream.c (working copy)
@@ -322,18 +322,18 @@
HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE);
}
}
- }
-
- if (h2_stream_is_scheduled(stream)) {
- return h2_request_add_trailer(stream->request, stream->pool,
- name, nlen, value, vlen);
- }
- else {
- if (!input_open(stream)) {
- return APR_ECONNRESET;
+
+ if (h2_stream_is_scheduled(stream)) {
+ return h2_request_add_trailer(stream->request, stream->pool,
+ name, nlen, value, vlen);
}
- return h2_request_add_header(stream->request, stream->pool,
- name, nlen, value, vlen);
+ else {
+ if (!input_open(stream)) {
+ return APR_ECONNRESET;
+ }
+ return h2_request_add_header(stream->request, stream->pool,
+ name, nlen, value, vlen);
+ }
}
}

4
gnu/packages/web.scm
View file

@ -92,7 +92,9 @@
version ".tar.bz2")) version ".tar.bz2"))
(sha256 (sha256
(base32 (base32
"0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc")))) "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))
(patches (search-patches "httpd-CVE-2016-8740.patch"))
(patch-flags '("-p0"))))
(build-system gnu-build-system) (build-system gnu-build-system)
(native-inputs `(("pcre" ,pcre "bin"))) ;for 'pcre-config' (native-inputs `(("pcre" ,pcre "bin"))) ;for 'pcre-config'
(inputs `(("apr" ,apr) (inputs `(("apr" ,apr)