From 44838c21e4044ab98e550a8ea849b2fab08b5fcf Mon Sep 17 00:00:00 2001 From: Michal Vasilek Date: Fri, 12 Nov 2021 18:09:39 +0100 Subject: [PATCH] cyrus-sasl: patch CVE-2019-19906 Signed-off-by: Michal Vasilek (cherry picked from commit f7717bd382d4f03c6353beaaf198d29a34c8e6ab) --- libs/cyrus-sasl/Makefile | 2 +- libs/cyrus-sasl/patches/CVE-2019-19906.patch | 23 ++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 libs/cyrus-sasl/patches/CVE-2019-19906.patch diff --git a/libs/cyrus-sasl/Makefile b/libs/cyrus-sasl/Makefile index f0ae3c21851b6..5904373dad35b 100644 --- a/libs/cyrus-sasl/Makefile +++ b/libs/cyrus-sasl/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=cyrus-sasl PKG_VERSION:=2.1.27 -PKG_RELEASE:=3 +PKG_RELEASE:=4 PKG_MAINTAINER:=W. Michael Petullo diff --git a/libs/cyrus-sasl/patches/CVE-2019-19906.patch b/libs/cyrus-sasl/patches/CVE-2019-19906.patch new file mode 100644 index 0000000000000..1b9fdfa8fdbea --- /dev/null +++ b/libs/cyrus-sasl/patches/CVE-2019-19906.patch @@ -0,0 +1,23 @@ +From dcc9f51cbd4ed622cfb0f9b1c141eb2ffe3b12f1 Mon Sep 17 00:00:00 2001 +From: Quanah Gibson-Mount +Date: Tue, 18 Feb 2020 19:05:12 +0000 +Subject: [PATCH] Fix #587 + +Off by one error in common.c, CVE-2019-19906. + +Thanks to Stephan Zeisberg for reporting +--- + lib/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/common.c ++++ b/lib/common.c +@@ -190,7 +190,7 @@ int _sasl_add_string(char **out, size_t + + if (add==NULL) add = "(null)"; + +- addlen=strlen(add); /* only compute once */ ++ addlen=strlen(add)+1; /* only compute once */ + if (_buf_alloc(out, alloclen, (*outlen)+addlen)!=SASL_OK) + return SASL_NOMEM; +