mirror of
https://git.yoctoproject.org/poky
synced 2026-09-24 13:36:22 +02:00
e73deac6dc
Changed: - The Copying has no change, except the company address. - pick patches from debian http://ftp.de.debian.org/debian/pool/main/p/perl/perl_5.20.0-1.debian.tar.xz - Not used by oe: deprecate-with-apt.diff patchlevel.diff fakeroot.diff - Create/Update perl-rdepends_${PV}.inc by the hardcode script; - Update config.sh by: 1) Copy the Perl 5.20.0 source code onto your TARGET machine linux qemuarm 3.14.5-yocto-standard from OE-Core rev: f506d0660c9949485268a92724ac770b5457b0ca 2) Execute sh Configure as normal and configure as required, do not "make"; 3) Compare with the old config.sh files, and update; - perl-ptest.inc 1) Copy the souce code to ptest since almost 112 test cases failed with the reason that no souce code found; 2) Add two patches to fix test case issue; - perl-native Reference perl (5.20.0-1) in debian to update perl shared library headers https://packages.debian.org/experimental/i386/perl/filelist Obsolete: - 09_fix_installperl.patch The dead code was removed from installperl http://perl5.git.perl.org/perl.git/commit/236818e0b9d9fe874831086b4d0b94dc6f245dfd - perl-build-in-t-dir.patch The upstream has fix it. The issue description: Perl cannot cross build in a path containing a directory that has the name of "t". As an example, you can make the perl build fail with "mkdir -p /tmp/build/t", go to the directory, unpack the sources, configure and cross build. - 0001-Fix-misparsing-of-maketext-strings.patch as they are part of the upstream code now: http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8 - 0001-Prevent-premature-hsplit-calls-and-only-trigger-REHA.patch the hash function changed: http://perl5.git.perl.org/perl.git/commit/7dc8663964c66a698d31bbdc8e8abed69bddeec3 (From OE-Core rev: c7ac82415efc42ff7a93c6df163f88f2dde00d26) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
46 lines
1.4 KiB
Diff
46 lines
1.4 KiB
Diff
perl:fix for CVE-2010-4777
|
|
|
|
Upstream-Status: Backport
|
|
|
|
The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0,
|
|
5.14.0, and other versions, when running with debugging enabled,
|
|
allows context-dependent attackers to cause a denial of service
|
|
(assertion failure and application exit) via crafted input that
|
|
is not properly handled when using certain regular expressions,
|
|
as demonstrated by causing SpamAssassin and OCSInventory to
|
|
crash.
|
|
|
|
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4777
|
|
|
|
Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
|
|
--- a/regcomp.c
|
|
+++ b/regcomp.c
|
|
@@ -11868,8 +11868,25 @@ Perl_save_re_context(pTHX)
|
|
|
|
if (gvp) {
|
|
GV * const gv = *gvp;
|
|
- if (SvTYPE(gv) == SVt_PVGV && GvSV(gv))
|
|
- save_scalar(gv);
|
|
+ if (SvTYPE(gv) == SVt_PVGV && GvSV(gv)) {
|
|
+ /* this is a copy of save_scalar() without the GETMAGIC call, RT#76538 */
|
|
+ SV ** const sptr = &GvSVn(gv);
|
|
+ SV * osv = *sptr;
|
|
+ SV * nsv = newSV(0);
|
|
+ save_pushptrptr(SvREFCNT_inc_simple(gv),
|
|
+ SvREFCNT_inc(osv), SAVEt_SV);
|
|
+ if (SvTYPE(osv) >= SVt_PVMG && SvMAGIC(osv) &&
|
|
+ SvTYPE(osv) != SVt_PVGV) {
|
|
+ if (SvGMAGICAL(osv)) {
|
|
+ const bool oldtainted = PL_tainted;
|
|
+ SvFLAGS(osv) |= (SvFLAGS(osv) &
|
|
+ (SVp_IOK|SVp_NOK|SVp_POK)) >> PRIVSHIFT;
|
|
+ PL_tainted = oldtainted;
|
|
+ }
|
|
+ mg_localize(osv, nsv, 1);
|
|
+ }
|
|
+ *sptr = nsv;
|
|
+ }
|
|
}
|
|
}
|
|
}
|