[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UPDATE: dillo-0.8.4



Hello,

attached is an update to dillo-0.8.4. This includes two security fixes:

  * Fixed a security bug with uncertain data and a_Interface_msg().
    CAN-2005-0012.

  * Fixed a possible attack (program abortion) by malicious web pages,
    which contain huge values for <table> attributes "colspan" and 
    "rowspan".

Full changelog: http://www.dillo.org/ChangeLog.html

Tested on i386 and sparc. Please test and comment.

Regards,
	Bernd
Index: Makefile
===================================================================
RCS file: /cvs/ports/www/dillo/Makefile,v
retrieving revision 1.20
diff -u -r1.20 Makefile
--- Makefile	11 Dec 2004 13:29:21 -0000	1.20
+++ Makefile	15 Apr 2005 11:22:57 -0000
@@ -2,8 +2,7 @@
 
 COMMENT=		"Fast and light gtk-based web browser"
 
-VERSION=		0.8.3
-DISTNAME=		dillo-${VERSION}
+DISTNAME=		dillo-0.8.4
 CATEGORIES=     	www
 
 HOMEPAGE=		http://www.dillo.org/
Index: distinfo
===================================================================
RCS file: /cvs/ports/www/dillo/distinfo,v
retrieving revision 1.10
diff -u -r1.10 distinfo
--- distinfo	5 Jan 2005 17:38:51 -0000	1.10
+++ distinfo	15 Apr 2005 11:22:57 -0000
@@ -1,4 +1,4 @@
-MD5 (dillo-0.8.3.tar.bz2) = be772ec9361bcc01515ae0da61de9bda
-RMD160 (dillo-0.8.3.tar.bz2) = f0426302c8462773f0e432c497c92a4aa3fbc16e
-SHA1 (dillo-0.8.3.tar.bz2) = c023eface4516c89ba9a2818cfd24f3ef5d24dae
-SIZE (dillo-0.8.3.tar.bz2) = 418714
+MD5 (dillo-0.8.4.tar.bz2) = ebf17d6cca1fccc8bc80acdf05e736a3
+RMD160 (dillo-0.8.4.tar.bz2) = 744b5484e813b111ff7c62fcc59213787c4c1df6
+SHA1 (dillo-0.8.4.tar.bz2) = 3af0091911be5c40ee6310980e607948d39f91df
+SIZE (dillo-0.8.4.tar.bz2) = 423106
Index: patches/patch-Makefile_in
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-Makefile_in,v
retrieving revision 1.2
diff -u -r1.2 patch-Makefile_in
--- patches/patch-Makefile_in	4 Dec 2004 20:44:27 -0000	1.2
+++ patches/patch-Makefile_in	15 Apr 2005 11:22:57 -0000
@@ -1,6 +1,6 @@
-$OpenBSD: patch-Makefile_in,v 1.2 2004/12/04 20:44:27 couderc Exp $
---- Makefile.in.orig	Mon Oct 25 13:12:09 2004
-+++ Makefile.in	Sat Dec  4 19:28:46 2004
+$OpenBSD$
+--- Makefile.in.orig	Fri Apr 15 13:05:36 2005
++++ Makefile.in	Fri Apr 15 13:06:03 2005
 @@ -234,12 +234,12 @@ distclean-hdr:
  uninstall-info-am:
  install-sysconfDATA: $(sysconf_DATA)
Index: patches/patch-dpid_Makefile_in
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-dpid_Makefile_in,v
retrieving revision 1.2
diff -u -r1.2 patch-dpid_Makefile_in
--- patches/patch-dpid_Makefile_in	4 Dec 2004 20:44:27 -0000	1.2
+++ patches/patch-dpid_Makefile_in	15 Apr 2005 11:22:57 -0000
@@ -1,6 +1,6 @@
-$OpenBSD: patch-dpid_Makefile_in,v 1.2 2004/12/04 20:44:27 couderc Exp $
---- dpid/Makefile.in.orig	Mon Oct 25 13:12:18 2004
-+++ dpid/Makefile.in	Sat Dec  4 21:20:12 2004
+$OpenBSD$
+--- dpid/Makefile.in.orig	Fri Apr 15 13:06:28 2005
++++ dpid/Makefile.in	Fri Apr 15 13:07:17 2005
 @@ -475,8 +475,8 @@ uninstall-am: uninstall-binPROGRAMS unin
  
  
Index: patches/patch-dpid_main_c
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-dpid_main_c,v
retrieving revision 1.2
diff -u -r1.2 patch-dpid_main_c
--- patches/patch-dpid_main_c	4 Dec 2004 20:44:27 -0000	1.2
+++ patches/patch-dpid_main_c	15 Apr 2005 11:22:57 -0000
@@ -1,7 +1,7 @@
-$OpenBSD: patch-dpid_main_c,v 1.2 2004/12/04 20:44:27 couderc Exp $
---- dpid/main.c.orig	Fri May 21 16:13:49 2004
-+++ dpid/main.c	Wed Aug 18 17:47:53 2004
-@@ -67,7 +67,7 @@ int start_filter_plugin(struct dp dpi_at
+$OpenBSD$
+--- dpid/main.c.orig	Fri Apr 15 13:07:30 2005
++++ dpid/main.c	Fri Apr 15 13:08:05 2005
+@@ -68,7 +68,7 @@ static int start_filter_plugin(struct dp
     }
     if ( pid == 0) {
        /* Child, start plugin */
@@ -10,7 +10,7 @@
           ERRMSG("start_plugin", "execl", errno);
           fprintf(stderr, "ERROR in child proc for %s\n", dpi_attr.path);
           exit(1);
-@@ -99,7 +99,7 @@ void start_server_plugin(struct dp dpi_a
+@@ -100,7 +100,7 @@ static void start_server_plugin(struct d
        fprintf(stderr, "ERROR in child proc for %s\n", dpi_attr.path);
        exit(1);
     }
Index: patches/patch-src_IO_dpi_c
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-src_IO_dpi_c,v
retrieving revision 1.6
diff -u -r1.6 patch-src_IO_dpi_c
--- patches/patch-src_IO_dpi_c	4 Dec 2004 20:44:27 -0000	1.6
+++ patches/patch-src_IO_dpi_c	15 Apr 2005 11:22:57 -0000
@@ -1,15 +1,15 @@
-$OpenBSD: patch-src_IO_dpi_c,v 1.6 2004/12/04 20:44:27 couderc Exp $
---- src/IO/dpi.c.orig	Thu Jul 15 15:37:28 2004
-+++ src/IO/dpi.c	Sat Dec  4 19:28:46 2004
-@@ -339,9 +339,9 @@ static gint Dpi_start_dpid()
+$OpenBSD$
+--- src/IO/dpi.c.orig	Fri Apr 15 13:08:33 2005
++++ src/IO/dpi.c	Fri Apr 15 13:08:56 2005
+@@ -351,9 +351,9 @@ static gint Dpi_start_dpid(void)
        /* This is the child process.  Execute the command. */
        gchar *path1 = a_Misc_prepend_user_home(".dillo/dpid");
-       close(st_pipe[0]);
+       Dpi_close_fd(st_pipe[0]);
 -      if (execl(path1, "dpid", NULL) == -1) {
 +      if (execl(path1, "dpid", (void *)NULL) == -1) {
           g_free(path1);
 -         if (execlp("dpid", "dpid", NULL) == -1) {
 +         if (execlp("dpid", "dpid", (void *)NULL) == -1) {
              DEBUG_MSG(4, "Dpi_start_dpid (child): %s\n", g_strerror(errno));
-             write(st_pipe[1], "ERROR", 5);
-             close(st_pipe[1]);
+             do
+                n = write(st_pipe[1], "ERROR", 5);
Index: patches/patch-src_IO_http_c
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-src_IO_http_c,v
retrieving revision 1.9
diff -u -r1.9 patch-src_IO_http_c
--- patches/patch-src_IO_http_c	4 Dec 2004 20:44:27 -0000	1.9
+++ patches/patch-src_IO_http_c	15 Apr 2005 11:22:57 -0000
@@ -1,13 +1,13 @@
-$OpenBSD: patch-src_IO_http_c,v 1.9 2004/12/04 20:44:27 couderc Exp $
---- src/IO/http.c.orig	Wed Oct  6 19:09:44 2004
-+++ src/IO/http.c	Sat Dec  4 19:28:46 2004
+$OpenBSD$
+--- src/IO/http.c.orig	Fri Apr 15 13:09:11 2005
++++ src/IO/http.c	Fri Apr 15 13:09:59 2005
 @@ -316,6 +316,7 @@ static int Http_connect_socket(ChainLink
        struct sockaddr_in *sin = (struct sockaddr_in *)&name;
        socket_len = sizeof(struct sockaddr_in);
        sin->sin_family = dh->af;
 +      sin->sin_len = socket_len;
        sin->sin_port = S->port ? htons(S->port) : htons(DILLO_URL_HTTP_PORT);
-       memcpy(&sin->sin_addr, dh->data, dh->alen);
+       memcpy(&sin->sin_addr, dh->data, (size_t)dh->alen);
        if (a_Web_valid(S->web) && (S->web->flags & WEB_RootUrl))
 @@ -330,6 +331,7 @@ static int Http_connect_socket(ChainLink
        socket_len = sizeof(struct sockaddr_in6);
Index: patches/patch-src_cookies_c
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-src_cookies_c,v
retrieving revision 1.4
diff -u -r1.4 patch-src_cookies_c
--- patches/patch-src_cookies_c	4 Dec 2004 20:44:27 -0000	1.4
+++ patches/patch-src_cookies_c	15 Apr 2005 11:22:57 -0000
@@ -1,7 +1,7 @@
-$OpenBSD: patch-src_cookies_c,v 1.4 2004/12/04 20:44:27 couderc Exp $
---- src/cookies.c.orig	Fri May 21 16:13:07 2004
-+++ src/cookies.c	Wed Aug 18 17:46:55 2004
-@@ -32,7 +32,6 @@
+$OpenBSD$
+--- src/cookies.c.orig	Fri Apr 15 13:10:21 2005
++++ src/cookies.c	Fri Apr 15 13:10:35 2005
+@@ -33,7 +33,6 @@
  #include "list.h"
  #include "cookies.h"
  
Index: patches/patch-src_dillo_c
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-src_dillo_c,v
retrieving revision 1.6
diff -u -r1.6 patch-src_dillo_c
--- patches/patch-src_dillo_c	4 Dec 2004 20:44:27 -0000	1.6
+++ patches/patch-src_dillo_c	15 Apr 2005 11:22:57 -0000
@@ -1,7 +1,7 @@
-$OpenBSD: patch-src_dillo_c,v 1.6 2004/12/04 20:44:27 couderc Exp $
---- src/dillo.c.orig	Thu Jun 10 17:22:55 2004
-+++ src/dillo.c	Wed Aug 18 17:46:45 2004
-@@ -48,6 +48,7 @@
+$OpenBSD$
+--- src/dillo.c.orig	Fri Apr 15 13:10:50 2005
++++ src/dillo.c	Fri Apr 15 13:11:04 2005
+@@ -49,6 +49,7 @@
  #include "interface.h"
  #include "dw.h"
  #include "cookies.h"
Index: patches/patch-src_dns_c
===================================================================
RCS file: /cvs/ports/www/dillo/patches/patch-src_dns_c,v
retrieving revision 1.8
diff -u -r1.8 patch-src_dns_c
--- patches/patch-src_dns_c	4 Dec 2004 20:44:27 -0000	1.8
+++ patches/patch-src_dns_c	15 Apr 2005 11:22:57 -0000
@@ -1,6 +1,6 @@
-$OpenBSD: patch-src_dns_c,v 1.8 2004/12/04 20:44:27 couderc Exp $
---- src/dns.c.orig	Fri May 21 16:13:07 2004
-+++ src/dns.c	Wed Aug 18 17:46:09 2004
+$OpenBSD$
+--- src/dns.c.orig	Fri Apr 15 13:11:19 2005
++++ src/dns.c	Fri Apr 15 13:11:39 2005
 @@ -31,14 +31,13 @@
  #include "dns.h"
  #include "list.h"