2014-08-11 13:27:10 +02:00

98 lines
3.8 KiB
Plaintext

$NetBSD: patch-ap,v 1.4 2014/02/09 13:47:10 drochner Exp $
Fix vulnerability reported in SA56624. Patch taken from here:
http://hg.python.org/cpython/rev/87673659d8f7
--- Modules/socketmodule.c.orig 2014-02-09 12:58:52.000000000 +0000
+++ Modules/socketmodule.c
@@ -379,7 +379,7 @@ const char *inet_ntop(int af, const void
#define SOCKETCLOSE close
#endif
-#if defined(HAVE_BLUETOOTH_H) || defined(HAVE_BLUETOOTH_BLUETOOTH_H) && !defined(__NetBSD__)
+#if defined(HAVE_BLUETOOTH_H) || defined(HAVE_BLUETOOTH_BLUETOOTH_H) && !defined(__NetBSD__) && !defined(__DragonFly__)
#define USE_BLUETOOTH 1
#if defined(__FreeBSD__)
#define BTPROTO_L2CAP BLUETOOTH_PROTO_L2CAP
@@ -393,11 +393,13 @@ const char *inet_ntop(int af, const void
#define _BT_L2_MEMB(sa, memb) ((sa)->l2cap_##memb)
#define _BT_RC_MEMB(sa, memb) ((sa)->rfcomm_##memb)
#define _BT_HCI_MEMB(sa, memb) ((sa)->hci_##memb)
-#elif defined(__NetBSD__)
+#elif defined(__NetBSD__) || defined(__DragonFly__)
#define sockaddr_l2 sockaddr_bt
#define sockaddr_rc sockaddr_bt
#define sockaddr_hci sockaddr_bt
#define sockaddr_sco sockaddr_bt
+#define SOL_HCI BTPROTO_HCI
+#define HCI_DATA_DIR SO_HCI_DIRECTION
#define _BT_L2_MEMB(sa, memb) ((sa)->bt_##memb)
#define _BT_RC_MEMB(sa, memb) ((sa)->bt_##memb)
#define _BT_HCI_MEMB(sa, memb) ((sa)->bt_##memb)
@@ -1076,9 +1078,13 @@ makesockaddr(int sockfd, struct sockaddr
case BTPROTO_HCI:
{
struct sockaddr_hci *a = (struct sockaddr_hci *) addr;
+#if defined(__NetBSD__) || defined(__DragonFly__)
+ return makebdaddr(&_BT_HCI_MEMB(a, bdaddr));
+#else
PyObject *ret = NULL;
ret = Py_BuildValue("i", _BT_HCI_MEMB(a, dev));
return ret;
+#endif
}
#if !defined(__FreeBSD__)
@@ -1350,12 +1356,25 @@ getsockaddrarg(PySocketSockObject *s, Py
case BTPROTO_HCI:
{
struct sockaddr_hci *addr = (struct sockaddr_hci *)addr_ret;
+#if defined(__NetBSD__) || defined(__DragonFly__)
+ char *straddr = PyString_AsString(args);
+
+ _BT_HCI_MEMB(addr, family) = AF_BLUETOOTH;
+ if (straddr == NULL) {
+ PyErr_SetString(socket_error, "getsockaddrarg: "
+ "wrong format");
+ return 0;
+ }
+ if (setbdaddr(straddr, &_BT_HCI_MEMB(addr, bdaddr)) < 0)
+ return 0;
+#else
_BT_HCI_MEMB(addr, family) = AF_BLUETOOTH;
if (!PyArg_ParseTuple(args, "i", &_BT_HCI_MEMB(addr, dev))) {
PyErr_SetString(socket_error, "getsockaddrarg: "
"wrong format");
return 0;
}
+#endif
*len_ret = sizeof *addr;
return 1;
}
@@ -2625,6 +2644,10 @@ sock_recvfrom_into(PySocketSockObject *s
if (recvlen == 0) {
/* If nbytes was not specified, use the buffer's length */
recvlen = buflen;
+ } else if (recvlen > buflen) {
+ PyErr_SetString(PyExc_ValueError,
+ "nbytes is greater than the length of the buffer");
+ return NULL;
}
readlen = sock_recvfrom_guts(s, buf, recvlen, flags, &addr);
@@ -4588,9 +4611,13 @@ init_socket(void)
PyModule_AddIntConstant(m, "BTPROTO_L2CAP", BTPROTO_L2CAP);
PyModule_AddIntConstant(m, "BTPROTO_HCI", BTPROTO_HCI);
PyModule_AddIntConstant(m, "SOL_HCI", SOL_HCI);
+#if !defined(__NetBSD__) && !defined(__DragonFly__)
PyModule_AddIntConstant(m, "HCI_FILTER", HCI_FILTER);
+#endif
#if !defined(__FreeBSD__)
+#if !defined(__NetBSD__) && !defined(__DragonFly__)
PyModule_AddIntConstant(m, "HCI_TIME_STAMP", HCI_TIME_STAMP);
+#endif
PyModule_AddIntConstant(m, "HCI_DATA_DIR", HCI_DATA_DIR);
PyModule_AddIntConstant(m, "BTPROTO_SCO", BTPROTO_SCO);
#endif