mirror of
https://git.yoctoproject.org/poky
synced 2026-05-01 15:32:12 +02:00
ab6c3223a6
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1846 The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1847 (From OE-Core rev: 3962b76185194fa56be7f1689204a1188ea44737) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
54 lines
2.2 KiB
Diff
54 lines
2.2 KiB
Diff
Upstream-Status: Backport
|
|
|
|
Index: subversion/mod_dav_svn/lock.c
|
|
===================================================================
|
|
--- a/subversion/mod_dav_svn/lock.c (revision 1459696)
|
|
+++ b/subversion/mod_dav_svn/lock.c (working copy)
|
|
@@ -634,7 +634,20 @@ append_locks(dav_lockdb *lockdb,
|
|
svn_lock_t *slock;
|
|
svn_error_t *serr;
|
|
dav_error *derr;
|
|
+ dav_svn_repos *repos = resource->info->repos;
|
|
+
|
|
+ /* We don't allow anonymous locks */
|
|
+ if (! repos->username)
|
|
+ return dav_new_error(resource->pool, HTTP_UNAUTHORIZED,
|
|
+ DAV_ERR_LOCK_SAVE_LOCK,
|
|
+ "Anonymous lock creation is not allowed.");
|
|
|
|
+ /* Not a path in the repository so can't lock it. */
|
|
+ if (! resource->info->repos_path)
|
|
+ return dav_new_error(resource->pool, HTTP_BAD_REQUEST,
|
|
+ DAV_ERR_LOCK_SAVE_LOCK,
|
|
+ "Attempted to lock path not in repository.");
|
|
+
|
|
/* If the resource's fs path is unreadable, we don't allow a lock to
|
|
be created on it. */
|
|
if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
|
|
@@ -657,7 +670,6 @@ append_locks(dav_lockdb *lockdb,
|
|
svn_fs_txn_t *txn;
|
|
svn_fs_root_t *txn_root;
|
|
const char *conflict_msg;
|
|
- dav_svn_repos *repos = resource->info->repos;
|
|
apr_hash_t *revprop_table = apr_hash_make(resource->pool);
|
|
apr_hash_set(revprop_table, SVN_PROP_REVISION_AUTHOR,
|
|
APR_HASH_KEY_STRING, svn_string_create(repos->username,
|
|
@@ -734,7 +746,7 @@ append_locks(dav_lockdb *lockdb,
|
|
|
|
/* Convert the dav_lock into an svn_lock_t. */
|
|
derr = dav_lock_to_svn_lock(&slock, lock, resource->info->repos_path,
|
|
- info, resource->info->repos->is_svn_client,
|
|
+ info, repos->is_svn_client,
|
|
resource->pool);
|
|
if (derr)
|
|
return derr;
|
|
@@ -741,7 +753,7 @@ append_locks(dav_lockdb *lockdb,
|
|
|
|
/* Now use the svn_lock_t to actually perform the lock. */
|
|
serr = svn_repos_fs_lock(&slock,
|
|
- resource->info->repos->repos,
|
|
+ repos->repos,
|
|
slock->path,
|
|
slock->token,
|
|
slock->comment,
|