summary refs log tree commit diff
path: root/gnu/packages
diff options
context:
space:
mode:
authorEric Bavier <bavier@member.fsf.org>2020-08-20 15:27:33 -0500
committerEric Bavier <bavier@member.fsf.org>2020-08-20 15:28:13 -0500
commit1cc75fef122db08dd30a86a8074e7ac10fbc00c0 (patch)
treef7100df464b23dd0c3a88a30eacbd05b58b6061f /gnu/packages
parentc6443c2c8f5112cab6cf7a8d017229c81111ccae (diff)
downloadguix-1cc75fef122db08dd30a86a8074e7ac10fbc00c0.tar.gz
gnu: libmhash: Fix use-after-free in tests.
* gnu/packages/patches/libmhash-hmac-fix-uaf.patch: New patch.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/mcrypt.scm (libmhash)[source]: Use it.
Diffstat (limited to 'gnu/packages')
-rw-r--r--gnu/packages/mcrypt.scm5
-rw-r--r--gnu/packages/patches/libmhash-hmac-fix-uaf.patch22
2 files changed, 25 insertions, 2 deletions
diff --git a/gnu/packages/mcrypt.scm b/gnu/packages/mcrypt.scm
index fb5529382e..d0cfb8f7a3 100644
--- a/gnu/packages/mcrypt.scm
+++ b/gnu/packages/mcrypt.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014 Eric Bavier <bavier@member.fsf.org>
+;;; Copyright © 2014, 2020 Eric Bavier <bavier@posteo.net>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -94,7 +94,8 @@ XTEA, 3WAY, TWOFISH, BLOWFISH, ARCFOUR, WAKE and more.")
       (sha256
        (base32
         "1w7yiljan8gf1ibiypi6hm3r363imm3sxl1j8hapjdq3m591qljn"))
-      (patches (search-patches "mhash-keygen-test-segfault.patch"))))
+      (patches (search-patches "mhash-keygen-test-segfault.patch"
+                               "libmhash-hmac-fix-uaf.patch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("perl" ,perl)))                 ;for tests
diff --git a/gnu/packages/patches/libmhash-hmac-fix-uaf.patch b/gnu/packages/patches/libmhash-hmac-fix-uaf.patch
new file mode 100644
index 0000000000..76f937f4f6
--- /dev/null
+++ b/gnu/packages/patches/libmhash-hmac-fix-uaf.patch
@@ -0,0 +1,22 @@
+--- mhash-0.9.9.9/src/hmac_test.c	2020-08-20 14:53:06.628995733 -0500
++++ mhash-0.9.9.9/src/hmac_test.c	2020-08-20 14:53:39.424885862 -0500
+@@ -72,8 +72,6 @@
+ 		return(MUTILS_INVALID_RESULT);
+ 	}
+ 
+-	mutils_free(tmp);
+-
+ 	/* Test No 2 */	
+ 	
+ 	mutils_memset(tmp, 0, sizeof(tmp));
+--- mhash-0.9.9.9/src/keygen_test.c	2020-08-20 14:53:12.940974589 -0500
++++ mhash-0.9.9.9/src/keygen_test.c	2020-08-20 14:53:59.736817812 -0500
+@@ -94,8 +94,6 @@
+ 		return(MUTILS_INVALID_RESULT);
+ 	}
+ 
+-	mutils_free(tmp);
+-
+ 	passlen = sizeof(PASSWORD2);
+ 	password = (mutils_word8 *) mutils_malloc(passlen + 1);
+ 	mutils_strncpy(password, (mutils_word8 *) PASSWORD2, passlen);