diff options
Diffstat (limited to 'dev-lang/python/files/python-3.3-CVE-2014-4616.patch')
| -rw-r--r-- | dev-lang/python/files/python-3.3-CVE-2014-4616.patch | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/dev-lang/python/files/python-3.3-CVE-2014-4616.patch b/dev-lang/python/files/python-3.3-CVE-2014-4616.patch new file mode 100644 index 000000000000..c67b2e5feedc --- /dev/null +++ b/dev-lang/python/files/python-3.3-CVE-2014-4616.patch @@ -0,0 +1,52 @@ +# HG changeset patch +# User Benjamin Peterson <benjamin@python.org> +# Date 1397441438 14400 +# Node ID 50c07ed1743da9cd4540d83de0c30bd17aeb41b0 +# Parent 218e28a935ab4494d05215c243e2129625a71893 +in scan_once, prevent the reading of arbitrary memory when passed a negative index + +Bug reported by Guido Vranken. + +Index: Python-3.3.5/Lib/json/tests/test_decode.py +=================================================================== +--- Python-3.3.5.orig/Lib/test/test_json/test_decode.py 2014-06-26 18:40:10.825269130 +0200 ++++ Python-3.3.5/Lib/test/test_json/test_decode.py 2014-06-26 18:40:21.962323035 +0200 +@@ -60,5 +60,10 @@ + msg = 'escape' + self.assertRaisesRegexp(ValueError, msg, self.loads, s) + ++ def test_negative_index(self): ++ d = self.json.JSONDecoder() ++ self.assertRaises(ValueError, d.raw_decode, 'a'*42, -50000) ++ self.assertRaises(ValueError, d.raw_decode, u'a'*42, -50000) ++ + class TestPyDecode(TestDecode, PyTest): pass + class TestCDecode(TestDecode, CTest): pass +Index: Python-3.3.5/Misc/ACKS +=================================================================== +--- Python-3.3.5.orig/Misc/ACKS 2014-06-26 18:40:10.826269135 +0200 ++++ Python-3.3.5/Misc/ACKS 2014-06-26 18:40:21.962323035 +0200 +@@ -1085,6 +1085,7 @@ + Frank Visser + Johannes Vogel + Alex Volkov ++Guido Vranken + Martijn Vries + Niki W. Waibel + Wojtek Walczak +Index: Python-3.3.5/Modules/_json.c +=================================================================== +--- a/Modules/_json.c ++++ b/Modules/_json.c +@@ -975,7 +975,10 @@ scan_once_unicode(PyScannerObject *s, Py + kind = PyUnicode_KIND(pystr); + length = PyUnicode_GET_LENGTH(pystr); + +- if (idx >= length) { ++ if (idx < 0) ++ /* Compatibility with Python version. */ ++ idx += length; ++ if (idx < 0 || idx >= length) { + PyErr_SetNone(PyExc_StopIteration); + return NULL; + } |