[patch] Fixes format string vulnerabilities in internal neon, replace current neon.patch

neon.patch (text/plain), 11.94 KB, created by schaedpq on 2004-04-15 08:00:51 UTC

*** misc/neon-0.23.5/src/config.h	2004-04-05 12:38:37.751430529 -0400
--- misc/build/neon-0.23.5/src/config.h	2004-04-05 12:21:47.809143944 -0400
***************
*** 1 ****
! dummy
--- 1,130 ----
! 
! /* Define to be the neon version string */
! #define NEON_VERSION "0.23.5"
! 
! /* Define to be major number of neon version */
! #define NEON_VERSION_MAJOR (0)
! 
! /* Define to be minor number of neon version */
! #define NEON_VERSION_MINOR (23)
! 
! /* Define to empty if the keyword does not work.  */
! /* #undef const */
! 
! /* Define as __inline if that's what the C compiler calls it.  */
! #ifdef UNX
! #define inline
! #endif
! 
! /* Define if you need to in order for stat and other things to work.  */
! /* #undef _POSIX_SOURCE */
! 
! /* Define if you have the ANSI C header files.  */
! #define STDC_HEADERS 1
! 
! /* Unconditionally define _GNU_SOURCE */
! #ifndef _GNU_SOURCE
! # define _GNU_SOURCE 1
! #endif
! 
! /* Define if you have the strcasecmp function.  */
! #ifdef UNX
! #define HAVE_STRCASECMP 1
! #endif
! 
! /* Define if you have the <arpa/inet.h> header file.  */
! #ifdef UNX
! #define HAVE_ARPA_INET_H
! #endif
! 
! /* Define if you have the <limits.h> header file.  */
! #define HAVE_LIMITS_H 1
! 
! /* Define if you have the <errno.h> header file.  */
! #define HAVE_ERRNO_H 1
! 
! /* Define if you have the <regex.h> header file.  */
! #define HAVE_REGEX_H 1
! 
! /* Define if you have the <stdarg.h> header file.  */
! #define HAVE_STDARG_H 1
! 
! /* Define if you have the <stdlib.h> header file.  */
! #define HAVE_STDLIB_H 1
! 
! /* Define if you have the <string.h> header file.  */
! #define HAVE_STRING_H 1
! 
! /* Define if you have the <strings.h> header file.  */
! #ifdef UNX
! #define HAVE_STRINGS_H 1
! #endif
! 
! /* Define if you have the <sys/select.h> header file.  */
! #ifdef UNX
! #define HAVE_SYS_SELECT_H 1
! #endif
! 
! /* Define if you have the <sys/time.h> header file.  */
! #ifdef UNX
! #define HAVE_SYS_TIME_H 1
! #endif
! 
! /* Define if you have the <sys/socket.h> header file.  */
! #ifdef UNX
! #define HAVE_SYS_SOCKET_H 1
! #endif
! 
! /* Define if you have the <unistd.h> header file.  */
! #ifdef UNX
! #define HAVE_UNISTD_H 1
! #endif
! 
! /* Define when building neon as a library */
! #define NEON_IS_LIBRARY 1
! 
! /* Support WebDAV locking through the library */
! #define USE_DAV_LOCKS 1
! 
! /* Define to enable debugging */
! /*#define DEBUGGING 1*/
! 
! /* Define to enable OpenSSL support */
! /*#define ENABLE_SSL 1*/
! 
! /* Define if you have expat */
! #define HAVE_EXPAT 1
! #define HAVE_OLD_EXPAT 1
! 
! /* Define to 1 if you have the <xmlparse.h> header file. */
! #define HAVE_XMLPARSE_H 1
! 
! /* Define if you have libxml */
! /* #define HAVE_LIBXML */
! 
! /* Define if you have snprintf */
! #ifdef UNX
! #define HAVE_SNPRINTF 1
! #endif
! 
! #define NE_FMT_SIZE_T "u"
! #define NE_FMT_SSIZE_T "d"
! #define NE_FMT_OFF_T "ld"
! 
! #ifdef WIN32
! 
! /* #define HAVE_MEMCPY */
! 
! /* Win32 uses a underscore, so we use a macro to eliminate that. */
! #define snprintf			_snprintf
! #define vsnprintf			_vsnprintf
! #define strcasecmp			strcmpi
! #define strncasecmp			strnicmp
! #define ssize_t				int
! #define inline              __inline
! #define off_t               _off_t
! 
! #include <io.h>
! #define read _read
! 
! #endif
*** misc/neon-0.23.5/src/makefile.mk	2004-04-05 12:38:37.706437510 -0400
--- misc/build/neon-0.23.5/src/makefile.mk	2004-04-05 12:21:47.810143789 -0400
***************
*** 1 ****
! dummy
--- 1,49 ----
! PRJ=..$/..$/..$/..$/..
! 
! PRJNAME=external
! TARGET=neon
! LIBTARGET=NO
! 
! # --- Settings -----------------------------------------------------
! 
! .INCLUDE :  svpre.mk
! .INCLUDE :  settings.mk
! .INCLUDE :  sv.mk
! 
! # --- Files --------------------------------------------------------
! 
! CFLAGS+=-I$(SOLARINCDIR)$/external$/expat
! 
! CDEFS+=-DHAVE_CONFIG_H
! 
! SLOFILES= \
!         $(SLO)$/ne_207.obj \
!         $(SLO)$/ne_acl.obj \
!         $(SLO)$/ne_alloc.obj \
!         $(SLO)$/ne_auth.obj \
!         $(SLO)$/ne_basic.obj \
!         $(SLO)$/ne_compress.obj \
!         $(SLO)$/ne_cookies.obj \
!         $(SLO)$/ne_dates.obj \
!         $(SLO)$/ne_i18n.obj \
!         $(SLO)$/ne_locks.obj \
!         $(SLO)$/ne_md5.obj \
!         $(SLO)$/ne_props.obj \
!         $(SLO)$/ne_redirect.obj \
!         $(SLO)$/ne_request.obj \
!         $(SLO)$/ne_session.obj \
!         $(SLO)$/ne_socket.obj \
!         $(SLO)$/ne_string.obj \
!         $(SLO)$/ne_uri.obj \
!         $(SLO)$/ne_utils.obj \
!         $(SLO)$/ne_xml.obj
! 
! #        $(SLO)$/sslcerts.obj \
! 
! LIB1TARGET=$(SLB)$/$(TARGET).lib
! LIB1ARCHIV=$(LB)$/lib$(TARGET).a
! LIB1OBJFILES=$(SLOFILES)
! 
! # --- Targets ------------------------------------------------------
! 
! .INCLUDE :  target.mk
*** misc/neon-0.23.5/src/ne_207.c	2002-06-23 10:04:36.000000000 -0400
--- misc/build/neon-0.23.5/src/ne_207.c	2004-04-05 12:38:18.221460697 -0400
***************
*** 1,6 ****
  /* 
     WebDAV 207 multi-status response handling
!    Copyright (C) 1999-2002, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
--- 1,6 ----
  /* 
     WebDAV 207 multi-status response handling
!    Copyright (C) 1999-2004, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
***************
*** 358,369 ****
  	if (ne_get_status(req)->code == 207) {
  	    if (!ne_xml_valid(p)) { 
  		/* The parse was invalid */
! 		ne_set_error(sess, ne_xml_get_error(p));
  		ret = NE_ERROR;
  	    } else if (ctx.is_error) {
  		/* If we've actually got any error information
  		 * from the 207, then set that as the error */
! 		ne_set_error(sess, ctx.buf->data);
  		ret = NE_ERROR;
  	    }
  	} else if (ne_get_status(req)->klass != 2) {
--- 358,369 ----
  	if (ne_get_status(req)->code == 207) {
  	    if (!ne_xml_valid(p)) { 
  		/* The parse was invalid */
! 		ne_set_error(sess, "%s", ne_xml_get_error(p));
  		ret = NE_ERROR;
  	    } else if (ctx.is_error) {
  		/* If we've actually got any error information
  		 * from the 207, then set that as the error */
! 		ne_set_error(sess, "%s", ctx.buf->data);
  		ret = NE_ERROR;
  	    }
  	} else if (ne_get_status(req)->klass != 2) {
*** misc/neon-0.23.5/src/ne_auth.c	2002-10-07 16:33:17.000000000 -0400
--- misc/build/neon-0.23.5/src/ne_auth.c	2004-04-05 12:38:18.223460387 -0400
***************
*** 908,914 ****
      if (areq->auth_info_hdr != NULL && 
  	verify_response(areq, sess, areq->auth_info_hdr)) {
  	NE_DEBUG(NE_DBG_HTTPAUTH, "Response authentication invalid.\n");
! 	ne_set_error(sess->sess, _(sess->spec->fail_msg));
  	ret = NE_ERROR;
      } else if (status->code == sess->spec->status_code && 
  	       areq->auth_hdr != NULL) {
--- 908,914 ----
      if (areq->auth_info_hdr != NULL && 
  	verify_response(areq, sess, areq->auth_info_hdr)) {
  	NE_DEBUG(NE_DBG_HTTPAUTH, "Response authentication invalid.\n");
! 	ne_set_error(sess->sess, "%s", _(sess->spec->fail_msg));
  	ret = NE_ERROR;
      } else if (status->code == sess->spec->status_code && 
  	       areq->auth_hdr != NULL) {
*** misc/neon-0.23.5/src/ne_compress.c	2002-09-18 16:50:34.000000000 -0400
--- misc/build/neon-0.23.5/src/ne_compress.c	2004-04-05 12:38:18.225460077 -0400
***************
*** 1,6 ****
  /* 
     Handling of compressed HTTP responses
!    Copyright (C) 2001-2002, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
--- 1,6 ----
  /* 
     Handling of compressed HTTP responses
!    Copyright (C) 2001-2004, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
***************
*** 252,258 ****
  	     * doesn't work, and this does, but I have no idea why..
  	     * Google showed me the way. */
  	    if (inflateInit2(&ctx->zstr, -MAX_WBITS) != Z_OK) {
! 		ne_set_error(ctx->session, ctx->zstr.msg);
  		ctx->state = NE_Z_ERROR;
  		return;
  	    }
--- 252,258 ----
  	     * doesn't work, and this does, but I have no idea why..
  	     * Google showed me the way. */
  	    if (inflateInit2(&ctx->zstr, -MAX_WBITS) != Z_OK) {
! 		ne_set_error(ctx->session, "%s", ctx->zstr.msg);
  		ctx->state = NE_Z_ERROR;
  		return;
  	    }
*** misc/neon-0.23.5/src/ne_locks.c	2002-08-05 16:10:53.000000000 -0400
--- misc/build/neon-0.23.5/src/ne_locks.c	2004-04-05 12:38:18.227459766 -0400
***************
*** 723,729 ****
  	}
  	else if (parse_failed) {
  	    ret = NE_ERROR;
! 	    ne_set_error(sess, ne_xml_get_error(parser));
  	}
  	else if (ne_get_status(req)->code == 207) {
  	    ret = NE_ERROR;
--- 723,729 ----
  	}
  	else if (parse_failed) {
  	    ret = NE_ERROR;
! 	    ne_set_error(sess, "%s", ne_xml_get_error(parser));
  	}
  	else if (ne_get_status(req)->code == 207) {
  	    ret = NE_ERROR;
***************
*** 792,798 ****
      if (ret == NE_OK && ne_get_status(req)->klass == 2) {
  	if (parse_failed) {
  	    ret = NE_ERROR;
! 	    ne_set_error(sess, ne_xml_get_error(parser));
  	}
  	else if (ne_get_status(req)->code == 207) {
  	    ret = NE_ERROR;
--- 792,798 ----
      if (ret == NE_OK && ne_get_status(req)->klass == 2) {
  	if (parse_failed) {
  	    ret = NE_ERROR;
! 	    ne_set_error(sess, "%s", ne_xml_get_error(parser));
  	}
  	else if (ne_get_status(req)->code == 207) {
  	    ret = NE_ERROR;
*** misc/neon-0.23.5/src/ne_props.c	2002-07-14 07:18:06.000000000 -0400
--- misc/build/neon-0.23.5/src/ne_props.c	2004-04-05 12:38:27.458027606 -0400
***************
*** 1,6 ****
  /* 
     WebDAV property manipulation
!    Copyright (C) 2000-2002, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
--- 1,6 ----
  /* 
     WebDAV property manipulation
!    Copyright (C) 2000-2004, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
***************
*** 136,142 ****
      if (ret == NE_OK && ne_get_status(req)->klass != 2) {
  	ret = NE_ERROR;
      } else if (!ne_xml_valid(handler->parser)) {
! 	ne_set_error(handler->sess, ne_xml_get_error(handler->parser));
  	ret = NE_ERROR;
      }
  
--- 136,142 ----
      if (ret == NE_OK && ne_get_status(req)->klass != 2) {
  	ret = NE_ERROR;
      } else if (!ne_xml_valid(handler->parser)) {
! 	ne_set_error(handler->sess, "%s", ne_xml_get_error(handler->parser));
  	ret = NE_ERROR;
      }
  
***************
*** 457,462 ****
--- 457,465 ----
  {
      struct propstat *pstat = pstat_v;
  
+     /* Nothing to do if no status was given. */
+     if (!status) return;
+     
      /* If we get a non-2xx response back here, we wipe the value for
       * each of the properties in this propstat, so the caller knows to
       * look at the status instead. It's annoying, since for each prop
*** misc/neon-0.23.5/src/ne_xml.c	2002-10-08 15:11:31.000000000 -0400
--- misc/build/neon-0.23.5/src/ne_xml.c	2004-04-05 12:38:18.232458991 -0400
***************
*** 1,6 ****
  /* 
     Higher Level Interface to XML Parsers.
!    Copyright (C) 1999-2002, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
--- 1,6 ----
  /* 
     Higher Level Interface to XML Parsers.
!    Copyright (C) 1999-2004, Joe Orton <[e-mail]>
  
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
***************
*** 860,866 ****
  
  void ne_xml_set_error(ne_xml_parser *p, const char *msg)
  {
!     ne_snprintf(p->error, ERR_SIZE, msg);
  }
  
  #ifdef HAVE_LIBXML
--- 860,866 ----
  
  void ne_xml_set_error(ne_xml_parser *p, const char *msg)
  {
!     ne_snprintf(p->error, ERR_SIZE, "%s", msg);
  }
  
  #ifdef HAVE_LIBXML