[patch] readline-6.3-CVE-2014-2524.patch

readline-6.3-CVE-2014-2524.patch (text/plain), 796 bytes, created by Andrey Ovcharov on 2014-07-29 06:41:48 UTC

			   READLINE PATCH REPORT
			   =====================

Readline-Release: 6.3
Patch-ID: readline63-003

Bug-Reported-by:
Bug-Reference-ID:
Bug-Reference-URL:

Bug-Description:

There are debugging functions in the readline release that are theoretically
exploitable as security problems.  They are not public functions, but have
global linkage.

--- util.c.orig	2014-06-10 10:07:35.348027155 -0400
+++ util.c	2014-06-10 10:07:38.248035226 -0400
@@ -476,6 +476,7 @@ _rl_savestring (s)
   return (strcpy ((char *)xmalloc (1 + (int)strlen (s)), (s)));
 }
 
+#if defined (DEBUG)
 #if defined (USE_VARARGS)
 static FILE *_rl_tracefp;
 
@@ -538,6 +539,7 @@ _rl_settracefp (fp)
   _rl_tracefp = fp;
 }
 #endif
+#endif /* DEBUG */
 
 
 #if HAVE_DECL_AUDIT_USER_TTY && defined (ENABLE_TTY_AUDIT_SUPPORT)