freebsd-ports/lang/python34/files/patch-Modules_zipimport.c
Ruslan Makhmatkhanov 5643ed620a lang/python[xx]: backport upstream fix for CVE-2016-5636
Add patch for integer overflow in zipimport module to all our python ports.

While I'm here, get rid of -f flag in ${RM} invocation, because ${RM} already
expands to rm -f, so in result we are getting something like:

/bin/rm -f -f /wrkdirs/usr/ports/lang/python35/work/stage/usr/local/lib/libpython3.so

PR:		210325
Submitted by:	 Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	1d0f6852-33d8-11e6-a671-60a44ce6887b
With hat:	python
2016-06-17 17:09:04 +00:00

17 lines
473 B
C

Bug: http://bugs.python.org/issue26171
--- Modules/zipimport.c.orig 2015-12-21 06:01:04 UTC
+++ Modules/zipimport.c
@@ -1111,6 +1111,11 @@ get_data(PyObject *archive, PyObject *to
}
file_offset += l; /* Start of file data */
+ if (data_size > LONG_MAX - 1) {
+ fclose(fp);
+ PyErr_NoMemory();
+ return NULL;
+ }
bytes_size = compress == 0 ? data_size : data_size + 1;
if (bytes_size == 0)
bytes_size++;