From 12330eff7a63f0f0295070fd4cf8e10cff681300 Mon Sep 17 00:00:00 2001
From: thoger <thoger@fedoraproject.org>
Date: Fri, 4 Jul 2008 16:05:48 +0000
Subject: [PATCH] Add patch for CVE-2008-2371 reported by Tavis Ormandy.

---
 pcre-7.3-CVE-2008-2371.patch | 16 ++++++++++++++++
 pcre.spec                    |  9 ++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 pcre-7.3-CVE-2008-2371.patch

diff --git a/pcre-7.3-CVE-2008-2371.patch b/pcre-7.3-CVE-2008-2371.patch
new file mode 100644
index 0000000..f2af92a
--- /dev/null
+++ b/pcre-7.3-CVE-2008-2371.patch
@@ -0,0 +1,16 @@
+Patch for CVE-2008-2371:
+
+Fix propsed by the reporter of the issue - Tavis Ormandy.
+Reviewed by upstream, but not yet in upstream SVN as of 2008-07-04.
+
+--- pcre-7.3/pcre_compile.c.orig	2008-07-04 16:19:28.000000000 +0200
++++ pcre-7.3/pcre_compile.c	2008-07-04 16:20:19.000000000 +0200
+@@ -4709,7 +4709,7 @@ for (;; ptr++)
+                (lengthptr == NULL || *lengthptr == 2 + 2*LINK_SIZE))
+             {
+             cd->external_options = newoptions;
+-            options = newoptions;
++            *optionsptr = options = newoptions;
+             }
+          else
+             {
diff --git a/pcre.spec b/pcre.spec
index 1cc92f8..5458929 100644
--- a/pcre.spec
+++ b/pcre.spec
@@ -1,11 +1,12 @@
 Name: pcre
 Version: 7.3
-Release: 3%{?dist}
+Release: 4%{?dist}
 Summary: Perl-compatible regular expression library
 URL: http://www.pcre.org/
 Source: ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/%{name}-%{version}.tar.bz2
 Patch0: pcre-7.3-multilib.patch
 Patch1: pcre-7.3-CVE-2008-0674.patch
+Patch2: pcre-7.3-CVE-2008-2371.patch
 License: BSD
 Group: System Environment/Libraries
 BuildRoot:      %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
@@ -29,7 +30,10 @@ Development files (Headers, libraries for static linking, etc) for %{name}.
 %prep
 %setup -q
 %patch0 -p1 -b .multilib
+# backport from the upstream 7.6
 %patch1 -p1 -b .CVE-2008-0674
+# not yet applied in upstream SVN (2008-07-04)
+%patch2 -p1 -b .CVE-2008-2371
 
 %build
 %configure --enable-utf8 --enable-unicode-properties
@@ -84,6 +88,9 @@ rm -rf %{buildroot}
 
 
 %changelog
+* Fri Jul  4 2008 Tomas Hoger <thoger@redhat.com> - 7.3-4
+- Apply Tavis Ormandy's patch for CVE-2008-2371.
+
 * Tue Feb 12 2008 Tomas Hoger <thoger@redhat.com> - 7.3-3
 - Backport patch from upstream pcre 7.6 to address buffer overflow
   caused by "a character class containing a very large number of