aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEfraim Flashner <efraim@flashner.co.il>2016-12-06 15:36:59 +0200
committerEfraim Flashner <efraim@flashner.co.il>2016-12-06 15:39:25 +0200
commit1ebe49f192d6c84bf55ac16188d7966f673f4388 (patch)
treeb9a2fc8878be7d0208e0ee00b414acab8bab921e
parent3a735ecf0e501b573a29d273d6b8e2ace5a2c431 (diff)
downloadguix-1ebe49f192d6c84bf55ac16188d7966f673f4388.tar
guix-1ebe49f192d6c84bf55ac16188d7966f673f4388.tar.gz
gnu: httpd: Add fix for CVE-2016-8740.
* gnu/packages/web.scm (httpd)[source]: Add patch for CVE-2016-8740. * gnu/packages/patches/httpd-CVE-2016-8740.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it.
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/packages/patches/httpd-CVE-2016-8740.patch36
-rw-r--r--gnu/packages/web.scm4
3 files changed, 40 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index 9f8325d833..bc9b06da63 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -620,6 +620,7 @@ dist_patch_DATA = \
%D%/packages/patches/hdf-eos5-fortrantests.patch \
%D%/packages/patches/higan-remove-march-native-flag.patch \
%D%/packages/patches/hop-linker-flags.patch \
+ %D%/packages/patches/httpd-CVE-2016-8740.patch \
%D%/packages/patches/hydra-disable-darcs-test.patch \
%D%/packages/patches/hypre-doc-tables.patch \
%D%/packages/patches/hypre-ldflags.patch \
diff --git a/gnu/packages/patches/httpd-CVE-2016-8740.patch b/gnu/packages/patches/httpd-CVE-2016-8740.patch
new file mode 100644
index 0000000000..17ba323ccf
--- /dev/null
+++ b/gnu/packages/patches/httpd-CVE-2016-8740.patch
@@ -0,0 +1,36 @@
+This patch applies against httpd-2.4.23 and shouldn't be needed in later releases
+http://openwall.com/lists/oss-security/2016/12/05/17
+Index: modules/http2/h2_stream.c
+===================================================================
+--- modules/http2/h2_stream.c (revision 1771866)
++++ modules/http2/h2_stream.c (working copy)
+@@ -322,18 +322,18 @@
+ HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE);
+ }
+ }
+- }
+-
+- if (h2_stream_is_scheduled(stream)) {
+- return h2_request_add_trailer(stream->request, stream->pool,
+- name, nlen, value, vlen);
+- }
+- else {
+- if (!input_open(stream)) {
+- return APR_ECONNRESET;
++
++ if (h2_stream_is_scheduled(stream)) {
++ return h2_request_add_trailer(stream->request, stream->pool,
++ name, nlen, value, vlen);
+ }
+- return h2_request_add_header(stream->request, stream->pool,
+- name, nlen, value, vlen);
++ else {
++ if (!input_open(stream)) {
++ return APR_ECONNRESET;
++ }
++ return h2_request_add_header(stream->request, stream->pool,
++ name, nlen, value, vlen);
++ }
+ }
+ }
+
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 697bab8e56..81676386a0 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -92,7 +92,9 @@
version ".tar.bz2"))
(sha256
(base32
- "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))))
+ "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))
+ (patches (search-patches "httpd-CVE-2016-8740.patch"))
+ (patch-flags '("-p0"))))
(build-system gnu-build-system)
(native-inputs `(("pcre" ,pcre "bin"))) ;for 'pcre-config'
(inputs `(("apr" ,apr)