aboutsummaryrefslogtreecommitdiffstats
path: root/www
diff options
context:
space:
mode:
authornectar <nectar@FreeBSD.org>2002-03-24 03:34:54 +0800
committernectar <nectar@FreeBSD.org>2002-03-24 03:34:54 +0800
commit27848c9e72bc241a0272c87bace45d68a8e99af2 (patch)
tree0fab6fdc63872ac4c4d8aea75c3b3911cf2c3ad1 /www
parent602de9b131fc317559bee01c5780de00fc9837ec (diff)
downloadfreebsd-ports-gnome-27848c9e72bc241a0272c87bace45d68a8e99af2.tar.gz
freebsd-ports-gnome-27848c9e72bc241a0272c87bace45d68a8e99af2.tar.zst
freebsd-ports-gnome-27848c9e72bc241a0272c87bace45d68a8e99af2.zip
Patch buffer overflow described in
<URL:http://www.apache-ssl.org/advisory-20020301.txt>.
Diffstat (limited to 'www')
-rw-r--r--www/apache13-ssl/Makefile4
-rw-r--r--www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c27
2 files changed, 28 insertions, 3 deletions
diff --git a/www/apache13-ssl/Makefile b/www/apache13-ssl/Makefile
index b9de43c55e1b..46edcd603054 100644
--- a/www/apache13-ssl/Makefile
+++ b/www/apache13-ssl/Makefile
@@ -9,6 +9,7 @@
PORTNAME= apache+ssl
PORTVERSION= ${APACHE_VERSION}.${APACHE_SSL_VERSION}
+PORTREVISION= 1
CATEGORIES= www security
MASTER_SITES= http://www.apache.org/dist/ \
ftp://ftp.ox.ac.uk/pub/crypto/SSL/Apache-SSL/ \
@@ -86,9 +87,6 @@ CONFIGURE_ENV+= EXTRA_SSL_LIBS="-L${OPENSSLLIB} -L${LOCALBASE}/lib"
MAN1= dbmmanage.1 htdigest.1 htpasswd.1
MAN8= ab.8 httpsdctl.8 apxs.8 httpsd.8 logresolve.8 rotatelogs.8
-FORBIDDEN= contains unpatched vulnerabilities: CAN-2001-0729, 0730, 0731 \
- and SSL vulnerability
-
post-extract:
@cd ${WRKSRC} && tar xzf ${DISTDIR}/apache_${APACHE_VERSION}+ssl_${APACHE_SSL_VERSION}${EXTRACT_SUFX}
diff --git a/www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c b/www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c
new file mode 100644
index 000000000000..6ed9f3ad0dd9
--- /dev/null
+++ b/www/apache13-ssl/files/patch-src::modules::ssl::apache_ssl.c
@@ -0,0 +1,27 @@
+--- src/modules/ssl/apache_ssl.c Wed Dec 5 08:24:16 2001
++++ src/modules/ssl/apache_ssl.c Mon Mar 4 04:17:11 2002
+@@ -1254,7 +1254,6 @@
+ static void SendSessionToServer(SSL_SESSION *pSession,
+ conn_rec *pCurrentConnection)
+ {
+- uchar buf[MAX_SESSION_DER];
+ Cache *p;
+ uchar *t;
+ int nLength;
+@@ -1273,13 +1272,13 @@
+ memcpy(t,pSession->session_id,pSession->session_id_length);
+ p=LocalCacheAdd(t,pSession->session_id_length,tExpiresAt);
+
+- t=buf;
+- nLength=i2d_SSL_SESSION(pSession,&t);
++ nLength=i2d_SSL_SESSION(pSession,NULL);
+ assert(nLength > 0);
+ assert(nLength <= MAX_SESSION_DER);
+
+ p->aucData=malloc(nLength);
+- memcpy(p->aucData,buf,nLength);
++ t=p->aucData;
++ nLength=i2d_SSL_SESSION(pSession,&t);
+ p->nData=nLength;
+
+ GlobalCacheAdd(p->aucKey,p->nKey,p->aucData,p->nData,tExpiresAt);