rpms/ctags
6
0
Fork 0
Code Issues Pull Requests Releases Activity

CVE-2014-7204, denial of service issue

Browse Source
This commit is contained in:
Than Ngo 2014-09-30 14:50:40 +02:00
parent 2091b7b0ff
commit 482acb0680
2 changed files with 95 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

89
ctags-CVE-2014-7204.patch Normal file
View File

@ -0,0 +1,89 @@
--- ctags/jscript.c.orig 2008-10-13 00:27:38.000000000 +0200
+++ ctags/jscript.c 2014-09-30 13:49:34.837349283 +0200
@@ -1,5 +1,5 @@
/*
- * $Id: jscript.c 666 2008-05-15 17:47:31Z dfishburn $
+ * $Id: jscript.c 791 2012-10-24 01:13:13Z dfishburn $
*
* Copyright (c) 2003, Darren Hiebert
*
@@ -215,6 +215,7 @@
* Tag generation functions
*/
+/*
static void makeConstTag (tokenInfo *const token, const jsKind kind)
{
if (JsKinds [kind].enabled && ! token->ignoreTag )
@@ -238,12 +239,13 @@
if (JsKinds [kind].enabled && ! token->ignoreTag )
{
- /*
+ *
* If a scope has been added to the token, change the token
* string to include the scope when making the tag.
- */
+ *
if ( vStringLength(token->scope) > 0 )
{
+ *
fulltag = vStringNew ();
vStringCopy(fulltag, token->scope);
vStringCatS (fulltag, ".");
@@ -251,8 +253,54 @@
vStringTerminate(fulltag);
vStringCopy(token->string, fulltag);
vStringDelete (fulltag);
+ *
+ jsKind parent_kind = JSTAG_CLASS;
+
+ *
+ * if we're creating a function (and not a method),
+ * guess we're inside another function
+ *
+ if (kind == JSTAG_FUNCTION)
+ parent_kind = JSTAG_FUNCTION;
+
+ e.extensionFields.scope[0] = JsKinds [parent_kind].name;
+ e.extensionFields.scope[1] = vStringValue (token->scope);
}
- makeConstTag (token, kind);
+ * makeConstTag (token, kind); *
+ makeTagEntry (&e);
+ }
+}
+*/
+
+static void makeJsTag (tokenInfo *const token, const jsKind kind)
+{
+ if (JsKinds [kind].enabled && ! token->ignoreTag )
+ {
+ const char *const name = vStringValue (token->string);
+ tagEntryInfo e;
+ initTagEntry (&e, name);
+
+ e.lineNumber = token->lineNumber;
+ e.filePosition = token->filePosition;
+ e.kindName = JsKinds [kind].name;
+ e.kind = JsKinds [kind].letter;
+
+ if ( vStringLength(token->scope) > 0 )
+ {
+ jsKind parent_kind = JSTAG_CLASS;
+
+ /*
+ * If we're creating a function (and not a method),
+ * guess we're inside another function
+ */
+ if (kind == JSTAG_FUNCTION)
+ parent_kind = JSTAG_FUNCTION;
+
+ e.extensionFields.scope[0] = JsKinds [parent_kind].name;
+ e.extensionFields.scope[1] = vStringValue (token->scope);
+ }
+
+ makeTagEntry (&e);
}
}

7
ctags.spec
View File

@ -1,7 +1,7 @@
Summary: A C programming language indexing and/or cross-reference tool
Name: ctags
Version: 5.8
Release: 15%{?dist}
Release: 16%{?dist}
License: GPLv2+ and LGPLv2+ and Public Domain
Group: Development/Tools
URL: http://ctags.sourceforge.net/
@ -13,6 +13,7 @@ Patch3: ctags-5.8-ocaml-crash.patch
Patch4: ctags-5.8-cssparse.patch
Patch5: ctags-5.8-memmove.patch
Patch6: ctags-5.8-format-security.patch
Patch7: ctags-CVE-2014-7204.patch
Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
%description
@ -53,6 +54,7 @@ Note: some command line options is not compatible with GNU etags.
%patch4 -p1 -b .cssparse-crash
%patch5 -p1 -b .memmove
%patch6 -p1 -b .fmt-sec
%patch7 -p1 -b .CVE-2014-7204
%build
%configure
@ -95,6 +97,9 @@ rm -rf %{buildroot}
%{_mandir}/man1/etags.%{name}.1*
%changelog
* Tue Sep 30 2014 Than Ngo <than@redhat.com> - 5.8-16
- CVE-2014-7204, denial of service issue
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.8-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild