Added patch for Buffer Overflow in ARC2 module. Bug #258049. CVE-2009-0544

Package-Manager: portage-2.2_rc16/cvs/Linux 2.6.18-gentoo-r3 i686

4 files changed, 95 insertions, 5 deletions

diff --git a/dev-python/pycrypto/ChangeLog b/dev-python/pycrypto/ChangeLog
index 2031efecfa56..905dd71664d5 100644
--- a/dev-python/pycrypto/ChangeLog
+++ b/dev-python/pycrypto/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for dev-python/pycrypto
 # Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-python/pycrypto/ChangeLog,v 1.64 2009/03/01 08:24:02 neurogeek Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-python/pycrypto/ChangeLog,v 1.65 2009/03/04 04:44:45 neurogeek Exp $
+
+*pycrypto-2.0.1-r8 (04 Mar 2009)
+
+  04 Mar 2009; Jesus Rivero <neurogeek@gentoo.org>
+  +files/pycrypto-2.0.1-CVE-2009-0544.patch, +pycrypto-2.0.1-r8.ebuild:
+  Added patch for Buffer Overflow in ARC2 module. Bug #258049. CVE-2009-0544
 
 *pycrypto-2.0.1-r7 (01 Mar 2009)
 
diff --git a/dev-python/pycrypto/Manifest b/dev-python/pycrypto/Manifest
index d66a127c5855..599b3231d5a2 100644
--- a/dev-python/pycrypto/Manifest
+++ b/dev-python/pycrypto/Manifest
@@ -2,6 +2,7 @@
 Hash: SHA1
 
 AUX pycrypto-2.0.1-2.6_hashlib.patch 2814 RMD160 e7279be6ed13476eb3a124c765557ccae11c54b7 SHA1 b1f1307d4b428eb8da0283cc8c87096cef08e746 SHA256 cfbebb94fcc932e9dd6246f3285f6f6654f60a0b88594fd9c7c598a62c02946e
+AUX pycrypto-2.0.1-CVE-2009-0544.patch 571 RMD160 c5d62d442b24416a9bee9d9eb11820446fc3e792 SHA1 949fe75044260673b481bc9f8ac099599b024ece SHA256 0e3586c984c3e36969a02cc47ed41dc26a734f8814ceb1d60fed6922647793c2
 AUX pycrypto-2.0.1-bindist.patch 1561 RMD160 b0064385698a1cb9ed741b2e68ed682b4d395a61 SHA1 e3169e49281a1fca0ef5154bdb3b48ccc50e809d SHA256 c95a6b3628d5472f749004c5d9a95a812d1b9c1fc7bfa5a538fa64210a021d9a
 AUX pycrypto-2.0.1-gmp.patch 644 RMD160 33c7f7e435a1b9e76729d2083fa203a2ec040d83 SHA1 f434fea5dfacf9d95e96ba8adea2a5ce4491594f SHA256 c20f8d91ee74c4c0347957386c60b38a510c368e3778ae80f015af68c963d29d
 AUX pycrypto-2.0.1-ia64.patch 442 RMD160 c027362c20b414ec07e7eda9ee0002d4c75c78c4 SHA1 3cb5e684f38bac54138aaae4e13b02e2f649d38f SHA256 7ccfa05d0b5ebe9bc9a9edc40226f6bc8adbff27aaae0da70881f53afdaf506c
@@ -13,12 +14,13 @@ DIST pycrypto-2.0.1.tar.gz 154292 RMD160 5ce938a24f77f414e42680c17ef9b6dc8de94a2
 EBUILD pycrypto-2.0.1-r5.ebuild 1501 RMD160 23fcf75215bacac43de0e254d216768a14aca7aa SHA1 882cfa951483f6c304984c75f541ef8488906fda SHA256 e1cfce80ae28225522ba830ed9062123a71fe8279f31ce9096d994f34a55d3b8
 EBUILD pycrypto-2.0.1-r6.ebuild 1532 RMD160 b96b870eceb138401f61bba45ef8021366da2e1c SHA1 d63f0abf22a9d3f59332e73a33fa3e1b03e7e5dc SHA256 d9fe3eac30683401eae64384b52653926c57c57945ad12ca59aba516e8fc5187
 EBUILD pycrypto-2.0.1-r7.ebuild 1623 RMD160 2029374d352250b8665f54f74401665ef47e2018 SHA1 1296e5fe4b93e1ce3cacc29538ddf7dc8172a47b SHA256 0483f888ea5a5fcbad467276315ca1ce2d0126f452acd4e4e983bf02954271b3
-MISC ChangeLog 8564 RMD160 497e19761dbef5900bccb6090457e3046fd7c1cb SHA1 2e5bdee2bb4d5b17d00f608e403ca346f97b39c4 SHA256 b948022b6947ba610321a7a8f036a375bbd182f75905512da9af15565067a0c4
+EBUILD pycrypto-2.0.1-r8.ebuild 1704 RMD160 156e2ee52e50170a6545598d8ac309fe7ad87d55 SHA1 5df260b2b846653ed7d15c83af742bf4a08d24d6 SHA256 da367f65b149bad44cda8cd36bf78d7e46398fc7b3f86e171ea1a407637df5e2
+MISC ChangeLog 8799 RMD160 5f850bdc706ec98730504ab7eb2f11e78aa1c351 SHA1 5c7c5f592881cdbf6bd2f26d6f0bf486a6f099ba SHA256 c29462daaa80a32159f7e3ad8d71096854485c534ef0a482e1c9f3bef39b4b05
 MISC metadata.xml 1774 RMD160 b0aeda4d69c1dc4ec798f05f617a2d0ddf8c29ab SHA1 00da4a85672688868003fecd52b3a9497a3c433c SHA256 b4fe5bcbed977469f626a33c8b9c16d860e53e16b02f78ce931f6afa67c98ac2
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.9 (GNU/Linux)
 
-iEYEARECAAYFAkmqRkYACgkQdIssYB9vBoNs4QCfXmEIbHD3+bwJQgPrbpGxVOpD
-Q+AAmweR1DdNiXEbu2Y4uUuNP1Vu/1Ak
-=SHVa
+iEYEARECAAYFAkmuB0sACgkQdIssYB9vBoO/nQCeM5dpgjs0BtXHBaoVrxZHj3jG
+/MsAnRwuFBSMl6WxOLLcG69LLjSzr3Ki
+=LNIw
 -----END PGP SIGNATURE-----
diff --git a/dev-python/pycrypto/files/pycrypto-2.0.1-CVE-2009-0544.patch b/dev-python/pycrypto/files/pycrypto-2.0.1-CVE-2009-0544.patch
new file mode 100644
index 000000000000..9a4734cf608d
--- /dev/null
+++ b/dev-python/pycrypto/files/pycrypto-2.0.1-CVE-2009-0544.patch
@@ -0,0 +1,23 @@
+--- src/ARC2.c.orig	2009-03-03 23:53:08.000000000 -0430
++++ src/ARC2.c	2009-03-03 23:53:08.000000000 -0430
+@@ -11,6 +11,7 @@
+  */
+ 
+ #include <string.h>  
++#include "Python.h"
+ 
+ #define MODULE_NAME ARC2
+ #define BLOCK_SIZE 8
+@@ -146,6 +147,12 @@
+ 	   We'll hardwire it to 1024. */
+ #define bits 1024
+ 
++    if ((U32)keylength > sizeof(self->xkey)) {
++       PyErr_SetString(PyExc_ValueError,
++               "ARC2 key length must be less than 128 bytes");
++       return;
++    }
++
+ 	memcpy(self->xkey, key, keylength);
+   
+ 	/* Phase 1: Expand input key to 128 bytes */
diff --git a/dev-python/pycrypto/pycrypto-2.0.1-r8.ebuild b/dev-python/pycrypto/pycrypto-2.0.1-r8.ebuild
new file mode 100644
index 000000000000..a02b5891373a
--- /dev/null
+++ b/dev-python/pycrypto/pycrypto-2.0.1-r8.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-python/pycrypto/pycrypto-2.0.1-r8.ebuild,v 1.1 2009/03/04 04:44:45 neurogeek Exp $
+
+NEED_PYTHON=2.5
+inherit distutils toolchain-funcs flag-o-matic
+
+DESCRIPTION="Python Cryptography Toolkit"
+HOMEPAGE="http://www.amk.ca/python/code/crypto.html"
+SRC_URI="http://www.amk.ca/files/python/crypto/${P}.tar.gz"
+
+LICENSE="freedist"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+IUSE="bindist gmp test"
+
+RDEPEND="virtual/python
+	gmp? ( dev-libs/gmp )"
+DEPEND="${RDEPEND}
+	test? ( =dev-python/sancho-0.11-r1 )"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	use bindist && epatch "${FILESDIR}"/${P}-bindist.patch
+	epatch "${FILESDIR}"/${P}-sha256.patch
+	epatch "${FILESDIR}"/${P}-sha256-2.patch
+	epatch "${FILESDIR}"/${P}-gmp.patch
+	epatch "${FILESDIR}"/${P}-uint32.patch
+	epatch "${FILESDIR}"/${P}-sancho-package-rename.patch
+	epatch "${FILESDIR}"/${P}-2.6_hashlib.patch
+	#ARC2 buffer overlow. Bug 258049
+	epatch "${FILESDIR}"/${P}-CVE-2009-0544.patch
+}
+
+src_compile() {
+	use gmp \
+		&& export USE_GMP=1 \
+		|| export USE_GMP=0
+	# sha256 hashes occasionally trigger ssp when built with
+	# -finline-functions (implied by -O3).
+	gcc-specs-ssp && append-flags -fno-inline-functions
+	distutils_src_compile
+	python_need_rebuild
+}
+
+src_test() {
+	export PYTHONPATH=$(ls -d "${S}"/build/lib.*/)
+	python ./test.py || die "test failed"
+	if use test ; then
+		local x
+		cd test
+		for x in test_*.py ; do
+			python ${x} || die "${x} failed"
+		done
+	fi
+}
+
+DOCS="ACKS ChangeLog PKG-INFO README TODO Doc/pycrypt.tex"