Add patch for CVE-2008-2371 reported by Tavis Ormandy.

pcre-7.3-CVE-2008-2371.patch

@@ -0,0 +1,16 @@
+Patch for CVE-2008-2371:
+
+Fix propsed by the reporter of the issue - Tavis Ormandy.
+Reviewed by upstream, but not yet in upstream SVN as of 2008-07-04.
+
+--- pcre-7.3/pcre_compile.c.orig	2008-07-04 16:19:28.000000000 +0200
++++ pcre-7.3/pcre_compile.c	2008-07-04 16:20:19.000000000 +0200
+@@ -4709,7 +4709,7 @@ for (;; ptr++)
+                (lengthptr == NULL || *lengthptr == 2 + 2*LINK_SIZE))
+             {
+             cd->external_options = newoptions;
+-            options = newoptions;
++            *optionsptr = options = newoptions;
+             }
+          else
+             {

pcre.spec

@@ -1,11 +1,12 @@
 Name: pcre
 Version: 7.3
-Release: 3%{?dist}
+Release: 4%{?dist}
 Summary: Perl-compatible regular expression library
 URL: http://www.pcre.org/
 Source: ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/%{name}-%{version}.tar.bz2
 Patch0: pcre-7.3-multilib.patch
 Patch1: pcre-7.3-CVE-2008-0674.patch
+Patch2: pcre-7.3-CVE-2008-2371.patch
 License: BSD
 Group: System Environment/Libraries
 BuildRoot:      %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
@@ -29,7 +30,10 @@ Development files (Headers, libraries for static linking, etc) for %{name}.
 %prep
 %setup -q
 %patch0 -p1 -b .multilib
+# backport from the upstream 7.6
 %patch1 -p1 -b .CVE-2008-0674
+# not yet applied in upstream SVN (2008-07-04)
+%patch2 -p1 -b .CVE-2008-2371
 
 %build
 %configure --enable-utf8 --enable-unicode-properties
@@ -84,6 +88,9 @@ rm -rf %{buildroot}
 
 
 %changelog
+* Fri Jul  4 2008 Tomas Hoger <thoger@redhat.com> - 7.3-4
+- Apply Tavis Ormandy's patch for CVE-2008-2371.
+
 * Tue Feb 12 2008 Tomas Hoger <thoger@redhat.com> - 7.3-3
 - Backport patch from upstream pcre 7.6 to address buffer overflow
   caused by "a character class containing a very large number of