diff options
| author | Micxjo Funkcio <micxjo@fastmail.com> | 2016-04-08 13:29:28 -0700 |
|---|---|---|
| committer | Nikolay Amiantov <ab@fmap.me> | 2016-04-09 02:43:41 +0300 |
| commit | 1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45 (patch) | |
| tree | 70e31278e06947abaff05decd1d7e3d88056c1d5 /pkgs/development/libraries/pcre | |
| parent | c55cfe0cb3425fb926219cf7dde8714f3d143744 (diff) | |
| download | nixlib-1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45.tar nixlib-1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45.tar.gz nixlib-1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45.tar.bz2 nixlib-1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45.tar.lz nixlib-1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45.tar.xz nixlib-1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45.tar.zst nixlib-1e2fe7e07dda9b354a1aacb7b9b2ce05045c7b45.zip | |
pcre: patch CVE-2016-1283
This fixes CVE-2016-1283, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283
Diffstat (limited to 'pkgs/development/libraries/pcre')
| -rw-r--r-- | pkgs/development/libraries/pcre/CVE-2016-1283.patch | 18 | ||||
| -rw-r--r-- | pkgs/development/libraries/pcre/default.nix | 5 |
2 files changed, 21 insertions, 2 deletions
diff --git a/pkgs/development/libraries/pcre/CVE-2016-1283.patch b/pkgs/development/libraries/pcre/CVE-2016-1283.patch new file mode 100644 index 000000000000..2c2dad29e929 --- /dev/null +++ b/pkgs/development/libraries/pcre/CVE-2016-1283.patch @@ -0,0 +1,18 @@ +Index: pcre_compile.c +=================================================================== +--- a/pcre_compile.c (revision 1635) ++++ b/pcre_compile.c (revision 1636) +@@ -7311,7 +7311,12 @@ + so far in order to get the number. If the name is not found, leave + the value of recno as 0 for a forward reference. */ + +- else ++ /* This patch (removing "else") fixes a problem when a reference is ++ to multiple identically named nested groups from within the nest. ++ Once again, it is not the "proper" fix, and it results in an ++ over-allocation of memory. */ ++ ++ /* else */ + { + ng = cd->named_groups; + for (i = 0; i < cd->names_found; i++, ng++) diff --git a/pkgs/development/libraries/pcre/default.nix b/pkgs/development/libraries/pcre/default.nix index afeffae3e5fa..5ae79e91b922 100644 --- a/pkgs/development/libraries/pcre/default.nix +++ b/pkgs/development/libraries/pcre/default.nix @@ -22,8 +22,9 @@ in stdenv.mkDerivation rec { sha256 = "1pvra19ljkr5ky35y2iywjnsckrs9ch2anrf5b0dc91hw8v2vq5r"; }; - patches = - [ ]; + patches = [ + ./CVE-2016-1283.patch + ]; outputs = [ "out" "doc" "man" ]; |