# HG changeset patch
# User Pascal Bellard <pascal.bellard@slitaz.org>
# Date 1422526455 -3600
# Node ID 6f704cecf2c46e7aabaf48d2218efe347486ef2e
# Parent  30d223dc104ff37e22150a5318298d035d5b816e
glibc: CVE-2015-0235 fix

diff -r 30d223dc104f -r 6f704cecf2c4 glibc/receipt
--- a/glibc/receipt	Tue Jan 27 17:35:53 2015 +0100
+++ b/glibc/receipt	Thu Jan 29 11:14:15 2015 +0100
@@ -26,7 +26,9 @@
 	# Glibc Bug Sort Relocatable Objects Patch
 	patch -Np1 -i $stuff/glibc-2.14.1-sort-1.patch
 	# Fix a bug that prevents Glibc from building with GCC-4.6.2
-	patch -Np1 -i stuff/glibc-2.14.1-gcc_fix-1.patch
+	patch -Np1 -i $stuff/glibc-2.14.1-gcc_fix-1.patch
+	# GHOST
+	patch -Np1 -i $stuff/glibc-2.14.1-CVE-2015-0235.patch
 
 	# Build in a separate directory.
 	mkdir ../glibc-build && cd ../glibc-build
@@ -92,6 +94,8 @@
 	patch -Np1 -i $stuff/glibc-2.14-reexport-rpc-interface.patch
 	# http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=bdd816a3 (only fedora branch...)
 	patch -Np1 -i $stuff/glibc-2.14-reinstall-nis-rpc-headers.patch
+	# GHOST
+	patch -Np1 -i $stuff/glibc-2.14.1-CVE-2015-0235.patch
 
 	# Fix a stack imbalance that occurs under some conditions:
 	sed -i '195,213 s/PRIVATE_FUTEX/FUTEX_CLOCK_REALTIME/' \
diff -r 30d223dc104f -r 6f704cecf2c4 glibc/stuff/glibc-2.14.1-CVE-2015-0235.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/glibc/stuff/glibc-2.14.1-CVE-2015-0235.patch	Thu Jan 29 11:14:15 2015 +0100
@@ -0,0 +1,137 @@
+CVE-2015-0235 GHOST
+From https://sourceware.org/git/?p=glibc.git;a=commit;h=d5dd6189d506068ed11c8bfa1e1e9bffde04decd
+--- glibc-2.14.1/nss/digits_dots.c
++++ glibc-2.14.1/nss/digits_dots.c
+@@ -47,7 +47,10 @@
+     {
+       if (h_errnop)
+ 	*h_errnop = NETDB_INTERNAL;
+-      *result = NULL;
++      if (buffer_size == NULL)
++        *status = NSS_STATUS_TRYAGAIN;
++      else
++        *result = NULL;
+       return -1;
+     }
+ 
+@@ -84,14 +87,16 @@
+ 	}
+ 
+       size_needed = (sizeof (*host_addr)
+-		     + sizeof (*h_addr_ptrs) + strlen (name) + 1);
++		     sizeof (*h_addr_ptrs)
++		     + sizeof (*h_allias_ptr) + strlen (name) + 1);
+ 
+       if (buffer_size == NULL)
+         {
+ 	  if (buflen < size_needed)
+ 	    {
++	      *status = NSS_STATUS_TRYAGAIN;
+ 	      if (h_errnop != NULL)
+-		*h_errnop = TRY_AGAIN;
++		*h_errnop = NETDB_INTERNAL;
+ 	      __set_errno (ERANGE);
+ 	      goto done;
+ 	    }
+@@ -110,7 +115,7 @@
+ 	      *buffer_size = 0;
+ 	      __set_errno (save);
+ 	      if (h_errnop != NULL)
+-		*h_errnop = TRY_AGAIN;
++		*h_errnop = NETDB_INTERNAL;
+ 	      *result = NULL;
+ 	      goto done;
+ 	    }
+@@ -150,7 +155,9 @@
+ 		  if (! ok)
+ 		    {
+ 		      *h_errnop = HOST_NOT_FOUND;
+-		      if (buffer_size)
++		      if (buffer_size == NULL)
++		        *status = NSS_STATUS_NOTFOUND:
++		      else
+ 			*result = NULL;
+ 		      goto done;
+ 		    }
+@@ -202,15 +209,6 @@
+ 
+       if ((isxdigit (name[0]) && strchr (name, ':') != NULL) || name[0] == ':')
+ 	{
+-	  const char *cp;
+-	  char *hostname;
+-	  typedef unsigned char host_addr_t[16];
+-	  host_addr_t *host_addr;
+-	  typedef char *host_addr_list_t[2];
+-	  host_addr_list_t *h_addr_ptrs;
+-	  size_t size_needed;
+-	  int addr_size;
+-
+ 	  switch (af)
+ 	    {
+ 	    default:
+@@ -226,7 +224,10 @@
+ 	      /* This is not possible.  We cannot represent an IPv6 address
+ 		 in an `struct in_addr' variable.  */
+ 	      *h_errnop = HOST_NOT_FOUND;
+-	      *result = NULL;
++	      if (buffer_size == NULL)
++	        *status = NSS_STATUS_NOTFOUND;
++	      else
++	        *result = NULL;
+ 	      goto done;
+ 
+ 	    case AF_INET6:
+@@ -234,42 +235,6 @@
+ 	      break;
+ 	    }
+ 
+-	  size_needed = (sizeof (*host_addr)
+-			 + sizeof (*h_addr_ptrs) + strlen (name) + 1);
+-
+-	  if (buffer_size == NULL && buflen < size_needed)
+-	    {
+-	      if (h_errnop != NULL)
+-		*h_errnop = TRY_AGAIN;
+-	      __set_errno (ERANGE);
+-	      goto done;
+-	    }
+-	  else if (buffer_size != NULL && *buffer_size < size_needed)
+-	    {
+-	      char *new_buf;
+-	      *buffer_size = size_needed;
+-	      new_buf = realloc (*buffer, *buffer_size);
+-
+-	      if (new_buf == NULL)
+-		{
+-		  save = errno;
+-		  free (*buffer);
+-		  __set_errno (save);
+-		  *buffer = NULL;
+-		  *buffer_size = 0;
+-		  *result = NULL;
+-		  goto done;
+-		}
+-	      *buffer = new_buf;
+-	    }
+-
+-	  memset (*buffer, '\0', size_needed);
+-
+-	  host_addr = (host_addr_t *) *buffer;
+-	  h_addr_ptrs = (host_addr_list_t *)
+-	    ((char *) host_addr + sizeof (*host_addr));
+-	  hostname = (char *) h_addr_ptrs + sizeof (*h_addr_ptrs);
+-
+ 	  for (cp = name;; ++cp)
+ 	    {
+ 	      if (!*cp)
+@@ -282,7 +247,9 @@
+ 		  if (inet_pton (AF_INET6, name, host_addr) <= 0)
+ 		    {
+ 		      *h_errnop = HOST_NOT_FOUND;
+-		      if (buffer_size)
++		      if (buffer_size == NULL)
++		        *status = NSS_STATUS_NOTFOUND:
++		      else
+ 			*result = NULL;
+ 		      goto done;
+ 		    }