On Thu, Jun 11, 2009 at 10:00:08AM +0200, Stefan Fritsch wrote:
> Package: perl
> Version: 5.10.0-19
> Severity: grave
> Tags: security
> Justification: user security hole
>
> A security vulnverability was found in Compress::Raw::Zlib:
>
> Compress::Raw::Zlib versions before 2.017 contain a buffer overflow in
> inflate(). A badly formed zlib-stream can trigger this buffer overflow and
> cause
> the perl process at least to hang or to crash.
>
> This causes a remote DoS in amavisd-new.
>
> The perl package in lenny and sid contains Compress::Raw::Zlib 2.008.
> There is also a separate package libcompress-raw-zlib-perl
>
> More information can be found at
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-1391
Thanks.
My preliminary understanding is that the minimal fix could be just this hunk:
--- Compress-Raw-Zlib-2.015/Zlib.xs 2008-09-03 22:42:10.000000000 +0100
+++ Compress-Raw-Zlib-2.017/Zlib.xs 2009-04-04 13:09:59.000000000 +0100
@@ -1322,7 +1322,7 @@ inflate (s, buf, output, eof=FALSE)
while (RETVAL == Z_OK) {
if (s->stream.avail_out == 0 ) {
/* out of space in the output buffer so make it bigger */
- Sv_Grow(output, SvLEN(output) + bufinc) ;
+ Sv_Grow(output, SvLEN(output) + bufinc +1) ;
cur_length += increment ;
s->stream.next_out = (Bytef*) SvPVbyte_nolen(output) + cur_length ;
increment = bufinc ;
but I'm not quite sure if we also need the "Only setup the stream output
pointers if there is spare capacity in the outout SV" part in
http://search.cpan.org/diff?from=Compress-Raw-Zlib-2.015&to=Compress-Raw-Zlib-2.017#Zlib.xs
This needs further investigation. Help would be welcome.
--
Niko Tyni nt...@debian.org
--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
