me/guix
Archived
1
0
Fork 0
Code Activity

gnu: perl-dbd-mysql: Fix CVE-2017-10788.

Browse source 
* gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/databases.scm (perl-dbd-mysql)[source]: Use it.
This commit is contained in:
Kei Kebreau 2017-07-24 13:51:50 -04:00
parent bb0f6d7526
commit c7db7b86ce
No known key found for this signature in database
GPG key ID: E6A5EE3C19467A0D
3 changed files with 65 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
gnu/local.mk
View file

@ -904,6 +904,7 @@ dist_patch_DATA = \
%D%/packages/patches/pcre2-CVE-2017-8786.patch \
%D%/packages/patches/perl-file-path-CVE-2017-6512.patch \
%D%/packages/patches/perl-autosplit-default-time.patch \
%D%/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch \
%D%/packages/patches/perl-deterministic-ordering.patch \
%D%/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \
%D%/packages/patches/perl-gd-options-passthrough-and-fontconfig.patch \

3
gnu/packages/databases.scm
View file

@ -1015,7 +1015,8 @@ columns, primary keys, unique constraints and relationships.")
"DBD-mysql-" version ".tar.gz"))
(sha256
(base32
"16bg7l28n65ngi1abjxvwk906a80i2vd5vzjn812dx8phdg8d7v2"))))
"16bg7l28n65ngi1abjxvwk906a80i2vd5vzjn812dx8phdg8d7v2"))
(patches (search-patches "perl-dbd-mysql-CVE-2017-10788.patch"))))
(build-system perl-build-system)
;; Tests require running MySQL server
(arguments `(#:tests? #f))

62
gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch Normal file
View file

@ -0,0 +1,62 @@
Fix CVE-2017-10788:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10788
Patch written to match corrected documentation specifications:
Old: http://web.archive.org/web/20161220021610/https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-close.html
New: https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-close.html
The patch itself is from https://github.com/perl5-dbi/DBD-mysql/issues/120#issuecomment-312420660.
From 9ce10cfae7138c37c3a0cb2ba2a1d682482943d0 Mon Sep 17 00:00:00 2001
From: Pali <pali@cpan.org>
Date: Sun, 25 Jun 2017 10:07:39 +0200
Subject: [PATCH] Fix use-after-free after calling mysql_stmt_close()
Ignore return value from mysql_stmt_close() and also its error message
because it points to freed memory after mysql_stmt_close() was called.
---
dbdimp.c | 8 ++------
mysql.xs | 7 ++-----
2 files changed, 4 insertions(+), 11 deletions(-)
diff --git a/dbdimp.c b/dbdimp.c
index c60a5f6..a6410e5 100644
--- a/dbdimp.c
+++ b/dbdimp.c
@@ -4894,12 +4894,8 @@ void dbd_st_destroy(SV *sth, imp_sth_t *imp_sth) {
if (imp_sth->stmt)
{
- if (mysql_stmt_close(imp_sth->stmt))
- {
- do_error(DBIc_PARENT_H(imp_sth), mysql_stmt_errno(imp_sth->stmt),
- mysql_stmt_error(imp_sth->stmt),
- mysql_stmt_sqlstate(imp_sth->stmt));
- }
+ mysql_stmt_close(imp_sth->stmt);
+ imp_sth->stmt= NULL;
}
#endif
diff --git a/mysql.xs b/mysql.xs
index 55376e1..affde59 100644
--- a/mysql.xs
+++ b/mysql.xs
@@ -434,11 +434,8 @@ do(dbh, statement, attr=Nullsv, ...)
if (bind)
Safefree(bind);
- if(mysql_stmt_close(stmt))
- {
- fprintf(stderr, "\n failed while closing the statement");
- fprintf(stderr, "\n %s", mysql_stmt_error(stmt));
- }
+ mysql_stmt_close(stmt);
+ stmt= NULL;
if (retval == -2) /* -2 means error */
{
--
1.7.9.5