head	1.2;
access;
symbols
	pkgsrc-2015Q3:1.1.0.42
	pkgsrc-2015Q3-base:1.1
	pkgsrc-2015Q2:1.1.0.40
	pkgsrc-2015Q2-base:1.1
	pkgsrc-2015Q1:1.1.0.38
	pkgsrc-2015Q1-base:1.1
	pkgsrc-2014Q4:1.1.0.36
	pkgsrc-2014Q4-base:1.1
	pkgsrc-2014Q3:1.1.0.34
	pkgsrc-2014Q3-base:1.1
	pkgsrc-2014Q2:1.1.0.32
	pkgsrc-2014Q2-base:1.1
	pkgsrc-2014Q1:1.1.0.30
	pkgsrc-2014Q1-base:1.1
	pkgsrc-2013Q4:1.1.0.28
	pkgsrc-2013Q4-base:1.1
	pkgsrc-2013Q3:1.1.0.26
	pkgsrc-2013Q3-base:1.1
	pkgsrc-2013Q2:1.1.0.24
	pkgsrc-2013Q2-base:1.1
	pkgsrc-2013Q1:1.1.0.22
	pkgsrc-2013Q1-base:1.1
	pkgsrc-2012Q4:1.1.0.20
	pkgsrc-2012Q4-base:1.1
	pkgsrc-2012Q3:1.1.0.18
	pkgsrc-2012Q3-base:1.1
	pkgsrc-2012Q2:1.1.0.16
	pkgsrc-2012Q2-base:1.1
	pkgsrc-2012Q1:1.1.0.14
	pkgsrc-2012Q1-base:1.1
	pkgsrc-2011Q4:1.1.0.12
	pkgsrc-2011Q4-base:1.1
	pkgsrc-2011Q3:1.1.0.10
	pkgsrc-2011Q3-base:1.1
	pkgsrc-2011Q2:1.1.0.8
	pkgsrc-2011Q2-base:1.1
	pkgsrc-2011Q1:1.1.0.6
	pkgsrc-2011Q1-base:1.1
	pkgsrc-2010Q4:1.1.0.4
	pkgsrc-2010Q4-base:1.1
	pkgsrc-2010Q3:1.1.0.2;
locks; strict;
comment	@# @;


1.2
date	2015.11.06.17.07.23;	author adam;	state dead;
branches;
next	1.1;
commitid	QghX1smEXHEgr3Iy;

1.1
date	2010.11.23.11.30.50;	author tron;	state Exp;
branches
	1.1.2.1;
next	;

1.1.2.1
date	2010.11.23.11.30.50;	author spz;	state dead;
branches;
next	1.1.2.2;

1.1.2.2
date	2010.11.23.21.24.08;	author spz;	state Exp;
branches;
next	;


desc
@@


1.2
log
@Changes 0.5.0:
Bug fixes.
Updated MIBs.
@
text
@$NetBSD: patch-ae,v 1.1 2010/11/23 11:30:50 tron Exp $

Fix for CVE-2010-2891 taken from here:

http://git.debian.org/?p=collab-maint/libsmi.git;a=blob_plain;f=debian/patches/cve-2010-2891.patch;hb=1b460ead526610a66d032c75d191dd65bc5727f4

--- lib/smi.c.orig	2008-04-18 11:42:50.000000000 +0100
+++ lib/smi.c	2010-11-23 11:27:28.000000000 +0000
@@@@ -1314,10 +1314,15 @@@@
     }
 
     if (isdigit((int)node2[0])) {
-	for (oidlen = 0, p = strtok(node2, ". "); p;
+	for (oidlen = 0, p = strtok(node2, ". ");
+	     p && oidlen < sizeof(oid)/sizeof(oid[0]);
 	     oidlen++, p = strtok(NULL, ". ")) {
 	    oid[oidlen] = strtoul(p, NULL, 0);
 	}
+	if (p) {
+	    /* the numeric OID is too long */
+	    return NULL;
+	}
 	nodePtr = getNode(oidlen, oid);
 	if (nodePtr) {
 	    if (modulePtr) {
@


1.1
log
@Add fix for CVE-2010-2891 taken from Debian's GIT repository.
@
text
@d1 1
a1 1
$NetBSD$
@


1.1.2.1
log
@file patch-ae was added on branch pkgsrc-2010Q3 on 2010-11-23 21:24:08 +0000
@
text
@d1 25
@


1.1.2.2
log
@Pullup ticket 3281 - requested by tron
security fix

Revisions pulled up:
- pkgsrc/devel/libsmi/Makefile		1.17
- pkgsrc/devel/libsmi/distinfo		1.6

Files added:
pkgsrc/devel/libsmi/patches/patch-ae

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Tue Nov 23 11:30:50 UTC 2010

   Modified Files:
           pkgsrc/devel/libsmi: Makefile distinfo
   Added Files:
           pkgsrc/devel/libsmi/patches: patch-ae

   Log Message:
   Add fix for CVE-2010-2891 taken from Debian's GIT repository.


   To generate a diff of this commit:
   cvs rdiff -u -r1.16 -r1.17 pkgsrc/devel/libsmi/Makefile
   cvs rdiff -u -r1.5 -r1.6 pkgsrc/devel/libsmi/distinfo
   cvs rdiff -u -r0 -r1.1 pkgsrc/devel/libsmi/patches/patch-ae
@
text
@a0 25
$NetBSD: patch-ae,v 1.1 2010/11/23 11:30:50 tron Exp $

Fix for CVE-2010-2891 taken from here:

http://git.debian.org/?p=collab-maint/libsmi.git;a=blob_plain;f=debian/patches/cve-2010-2891.patch;hb=1b460ead526610a66d032c75d191dd65bc5727f4

--- lib/smi.c.orig	2008-04-18 11:42:50.000000000 +0100
+++ lib/smi.c	2010-11-23 11:27:28.000000000 +0000
@@@@ -1314,10 +1314,15 @@@@
     }
 
     if (isdigit((int)node2[0])) {
-	for (oidlen = 0, p = strtok(node2, ". "); p;
+	for (oidlen = 0, p = strtok(node2, ". ");
+	     p && oidlen < sizeof(oid)/sizeof(oid[0]);
 	     oidlen++, p = strtok(NULL, ". ")) {
 	    oid[oidlen] = strtoul(p, NULL, 0);
 	}
+	if (p) {
+	    /* the numeric OID is too long */
+	    return NULL;
+	}
 	nodePtr = getNode(oidlen, oid);
 	if (nodePtr) {
 	    if (modulePtr) {
@