Fix CVE-2017-7853: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7853 https://savannah.gnu.org/support/index.php?109265 Patch copied from upstream source repository: https://git.savannah.gnu.org/cgit/osip.git/commit/?id=1ae06daf3b2375c34af23083394a6f010be24a45 From 1ae06daf3b2375c34af23083394a6f010be24a45 Mon Sep 17 00:00:00 2001 From: Aymeric Moizard Date: Tue, 21 Feb 2017 17:16:26 +0100 Subject: [PATCH] * fix bug report: sr #109265: SIP message body length underflow in libosip2-4.1.0 https://savannah.gnu.org/support/?109265 also applicable to current latest version --- src/osipparser2/osip_message_parse.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/osipparser2/osip_message_parse.c b/src/osipparser2/osip_message_parse.c index 1628c60..aa35446 100644 --- a/src/osipparser2/osip_message_parse.c +++ b/src/osipparser2/osip_message_parse.c @@ -784,6 +784,12 @@ msg_osip_body_parse (osip_message_t * sip, const char *start_of_buf, const char if ('\n' == start_of_body[0] || '\r' == start_of_body[0]) start_of_body++; + /* if message body is empty or contains a single CR/LF */ + if (end_of_body <= start_of_body) { + osip_free (sep_boundary); + return OSIP_SYNTAXERROR; + } + body_len = end_of_body - start_of_body; /* Skip CR before end boundary. */ -- 2.13.1 .scm?id=6c17422eace097aceac4b5994f0343bcbed6e3ab'>commitdiff
path: root/build-aux/build-self.scm
AgeCommit message (Expand)Author
2016-11-27pull: Hack to allow compilation with older Guile-SSH packages....Reported by iyzsong@member.fsf.org (宋文武) at <https://lists.gnu.org/archive/html/guix-devel/2016-11/msg01045.html>. * build-aux/build-self.scm (build): Set 'LTDL_LIBRARY_PATH' when GUILE-SSH has a "0.9." version prefix. Ludovic Courtès
2016-11-26pull: Add guile-ssh to the dependencies....Fix regression introduced in 9e76eed. * build-aux/build-self.scm (guile-ssh): New variable. (build)[builder]: Add 'guile-ssh' to %load-path and %load-compiled-path. 宋文武
2016-07-20pull: Update the version string....Fixes <http://bugs.gnu.org/19278>. Reported by Tomáš Čech <tcech@suse.cz>. This allows 'guix --version' to return something that better represents what version is being used. * build-aux/build-self.scm (date-version-string): New procedure. (build): Add #:version. [builder]: Pass it to 'build-guix' as #:package-version. Ludovic Courtès
2016-07-20pull: Install (guix config) module to override the user's one....* build-aux/build-self.scm (zlib, gzip, bzip2, xz): New variables. (build)[storedir, localstatedir, sysconfdir, sbindir]: New variables. [builder]: Pass them to 'build-guix'. * guix/build/pull.scm (build-guix): Add #:system, #:storedir, #:localstatedir, #:sysconfdir, #:sbindir, #:package-name, #:package-version, #:bug-report-address, #:home-page-url, #:libgcrypt, #:zlib, #:gzip, #:bzip2, and #:xz. Remove #:gcrypt. Instantiate all the substitution variables in (guix config). Remove code to delete OUT/guix/config.{scm,go}. * guix/config.scm.in: Add note about (guix script pull). Ludovic Courtès
2014-11-09pull: Use the build procedure provided by the newly-downloaded Guix....Fixes <http://bugs.gnu.org/18534>. * guix/scripts/pull.scm (with-environment-variable, with-PATH): New macros. (temporary-directory, first-directory, interned-then-deleted): New procedures. (unpack): Rewrite to do the unpacking in the current process rather than as a separate derivation. (%self-build-file): New variable. (build-from-source): New procedure. (build-and-install): Use it. * guix/build/pull.scm (build-guix): Rename 'tarball' argument to 'source'. Remove #:tar and #:gzip parameters, as well as 'tar' invocation. Remove 'scandir' invocation. Wrap body in 'with-directory-excursion'. * build-aux/build-self.scm: New file. * Makefile.am (EXTRA_DIST): Add it. Ludovic Courtès