head 1.2; access; symbols pkgsrc-2013Q2:1.2.0.2 pkgsrc-2013Q2-base:1.2 pkgsrc-2013Q1:1.1.0.6 pkgsrc-2013Q1-base:1.1 pkgsrc-2012Q4:1.1.0.4 pkgsrc-2012Q4-base:1.1 pkgsrc-2012Q3:1.1.0.2; locks; strict; comment @# @; 1.2 date 2013.05.24.18.22.57; author wiz; state dead; branches; next 1.1; commitid 5RnqnW3EVb9TEUQw; 1.1 date 2012.11.23.16.41.01; author drochner; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2012.11.23.16.41.01; author tron; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2012.12.01.09.07.24; author tron; state Exp; branches; next ; desc @@ 1.2 log @Update to 0.4.11: New in version 0.4.11 ============================== * Build fixes with cmake 2.8.10+ * Quick release without built binaries / files (Address Bug #184) New in version 0.4.10 ============================== * Fix http chunk encoded PAC that was broken in previous release * Add HTTP client unit test * Fix more coding style issues New in version 0.4.9 ============================== * CVE-2012-4504 Fixed buffer overflow when downloading PAC * Fix infinit loop uppon network errors New in version 0.4.8 ============================== * Only support standalone mozjs185 as mozilla js engine. xulrunner being part of the now lightning fast moving firefox is impossible to be tracked as a dependency and it is not supported by Mozilla to be used in this scenario. * Support building with javascritpcoregtk 1.5 (got split out of webkitgtk). * Support sending multiple results. * Issues fixed: - #166: Libproxy does not parse NO_PROXY correct when the line contains spaces - #164: If gconf's value is an empty list, pxgconf will make /usr/bin/proxy wait forever - #60: use lib js for embedded solutions - #160: strdup and gethostbyname not declared on OSX 10.7 - #168: .pc file should be installed under OSX as well. - #170: Also check for "Transfer-Encoding: chunked". - #171: mozjs pacrunner: Fix parameters of dnsResolve_() - #172: Allow to forcibly build pacrunner as module (-DBIPR={ON,OFF}) - #173: Libproxy doesn't build with gcc 4.7 - #147: Use ${CMAKE_DL_LIBS} instead of assuming libdl is correct. - #176: python bindings: guard the destructor. - #177: Speed up importing of libproxy in python. - #179: CMAKE 2.8.8 does not define PKG_CONFIG_FOUND New in version 0.4.7 ============================== * Support/require xulrunner 2.0+ * Support linking againgst libwebkit-gtk3 (-DWITH_WEBKIT3=ON) * Port to gsettings for gnome3. (-DWITH_GNOME3=ON[default]) * Issues closed: - #149: always test for the right python noarch module path - #155: Cannot compile with Firefox 4 - #156: libproxy should build against webkitgtk-3.0 - #158: Won't compile w/ xulrunner 2.0 final - #159: libproxy fails with autoconfiguration "http://proxy.domain.com" - #131: GSettings-based GNOME plugin - #150: SUSE sysconfig/proxy config support New in version 0.4.6 ============================== * Fixed a crash in the URL parser * Fixed build issues with Visual Studio * Updated the INSTALL file * Install Python binding in prefix path if site-packages exists * Fixed compilation with Visual Studio New in version 0.4.5 =============================== * C# bindings are installable (-DWITH_DOTNET=ON) * C# bindings installation path can be changed using -DGAC_DIR= * Internal libmodman build fixed * Installation dirs are now all relative to CMAKE_INSTALL_PREFIX * Fixed test while using --as-needed linker flag * Fixed generation of libproxy-1.0.pc * Basic support for Mingw added (not yet 100% functional) * Ruby binding implemented (not yet in the build system) * Fixed modules not being found caused by relative LIBEXEC_INSTALL_DIR * Fixed bug with builtin plugins (Issue 133) * Vala bindings installation path can be changed using -DVAPI_DIR= * Python bindings installation path can be changed using -DPYTHON_SITEPKG_DIR= * Perl bindings can be installed in vendor directory (-DPERL_VENDORARCH=ON) * Perl bindings installation path can be change using -DPX_PERL_ARCH= * Unit test now builds on OSX New in version 0.4.4 =============================== * Add support for optionally building using a system libmodman * Rework build system to be cleaner * Fix two major build system bugs: 127, 128 New in version 0.4.3 =============================== * Test can now be out-compiled using BUILD_TESTING=OFF * Fixed python binding not handling NULL pointer * Pyhton binding now support Python version 3 * Rewrote URL parser to comply with unit test * Username and password are now URL encoded * Scheme comparison is now non-case sensitive * Fixed deadlock using WebKit has PAC runner * Fixed OS X compilation of Perl bindings New in version 0.4.2 =============================== * Fixed python binding that failed on missing px_free symbole * Workaround cmake bug with dynamic libraries in non-standard folders New in version 0.4.1 =============================== * Perl bindings have been integrated into the CMake Build System * Vala bindings are installed if -DWITH_VALA=yes is passed to cmake * All extensions can be disabled using WITH_*=OFF cmake options * socks5:// and socks4:// can now be returned * Many bugfixes New in version 0.4.0 =============================== * C++ rewrite * Small API change (px_proxy_factory_get_proxy() can now return NULL) * SOVERSION bump * libmodman is now a seperate library * Migrate to cmake * Windows support (config_w32reg, ignore_hostname; VC++ support) * MacOSX support (config_macosx, ignore_hostname) * Built-in modules support * Support for chunked encoding * Move to hidden visibility by default * KDE's KConfig symantics are fully supported * Removeal of all PX_* env variables (no longer needed) * Symbol based detection of relevant pacrunner * Reworked config_gnome to not suck (its *much* faster) * Many other things I can't remember @ text @$NetBSD: patch-CVE-2012-4505,v 1.1 2012/11/23 16:41:01 drochner Exp $ see https://bugzilla.redhat.com/show_bug.cgi?id=864612 --- src/lib/pac.c.orig 2009-09-29 19:52:50.000000000 +0000 +++ src/lib/pac.c @@@@ -35,6 +35,9 @@@@ #define PAC_MIME_TYPE "application/x-ns-proxy-autoconfig" +// This is the maximum pac size (to avoid memory attacks) +#define PAC_MAX_SIZE 102400 + /** * ProxyAutoConfig object. All fields are private. */ @@@@ -159,12 +162,15 @@@@ px_pac_reload(pxPAC *self) } /* Get content */ - if (!content_length || !correct_mime_type) goto error; + if (content_length == 0 || content_length > PAC_MAX_SIZE || !correct_mime_type) goto error; px_free(line); line = NULL; px_free(self->cache); self->cache = px_malloc0(content_length+1); - for (int recvd=0 ; recvd != content_length ; ) - recvd += recv(sock, self->cache + recvd, content_length - recvd, 0); + for (int recvd=0 ; recvd != content_length ; ) { + int r = recv(sock, self->cache + recvd, content_length - recvd, 0); + if (r <= 0) goto error; + recvd += r; + } } else { /* file:// url */ @ 1.1 log @add the patch @ text @d1 1 a1 1 $NetBSD$ @ 1.1.2.1 log @file patch-CVE-2012-4505 was added on branch pkgsrc-2012Q3 on 2012-12-01 09:07:24 +0000 @ text @d1 35 @ 1.1.2.2 log @Pullup ticket #3974 - requested by drochner www/libproxy: security patch Revisions pulled up: - www/libproxy/Makefile 1.14-1.15 - www/libproxy/distinfo 1.8-1.10 - www/libproxy/patches/patch-CVE-2012-4505 1.1 - www/libproxy/patches/patch-ac 1.3-1.4 --- Module Name: pkgsrc Committed By: drochner Date: Fri Nov 23 16:40:41 UTC 2012 Modified Files: pkgsrc/www/libproxy: Makefile distinfo Log Message: add patch from Redhat to fix buffer overflow on pac load (CVE-2012-4505) bump PKGREV --- Module Name: pkgsrc Committed By: drochner Date: Fri Nov 23 16:41:01 UTC 2012 Added Files: pkgsrc/www/libproxy/patches: patch-CVE-2012-4505 Log Message: add the patch --- Module Name: pkgsrc Committed By: drochner Date: Tue Nov 27 11:26:23 UTC 2012 Modified Files: pkgsrc/www/libproxy: Makefile distinfo Added Files: pkgsrc/www/libproxy/patches: patch-ac Log Message: pull in upstream rev.475 to fix format string problem in the "proxy" debug tool, bump PKGREV --- Module Name: pkgsrc Committed By: drochner Date: Wed Nov 28 12:20:38 UTC 2012 Modified Files: pkgsrc/www/libproxy: distinfo pkgsrc/www/libproxy/patches: patch-ac Log Message: a CVE# was assigned @ text @a0 35 $NetBSD$ see https://bugzilla.redhat.com/show_bug.cgi?id=864612 --- src/lib/pac.c.orig 2009-09-29 19:52:50.000000000 +0000 +++ src/lib/pac.c @@@@ -35,6 +35,9 @@@@ #define PAC_MIME_TYPE "application/x-ns-proxy-autoconfig" +// This is the maximum pac size (to avoid memory attacks) +#define PAC_MAX_SIZE 102400 + /** * ProxyAutoConfig object. All fields are private. */ @@@@ -159,12 +162,15 @@@@ px_pac_reload(pxPAC *self) } /* Get content */ - if (!content_length || !correct_mime_type) goto error; + if (content_length == 0 || content_length > PAC_MAX_SIZE || !correct_mime_type) goto error; px_free(line); line = NULL; px_free(self->cache); self->cache = px_malloc0(content_length+1); - for (int recvd=0 ; recvd != content_length ; ) - recvd += recv(sock, self->cache + recvd, content_length - recvd, 0); + for (int recvd=0 ; recvd != content_length ; ) { + int r = recv(sock, self->cache + recvd, content_length - recvd, 0); + if (r <= 0) goto error; + recvd += r; + } } else { /* file:// url */ @