1.8.6.287-7

import.log

@@ -1,2 +1,3 @@
 ruby-1_8_6_287-4_fc10:HEAD:ruby-1.8.6.287-4.fc10.src.rpm:1237096558
 ruby-1_8_6_287-5_fc10:HEAD:ruby-1.8.6.287-5.fc10.src.rpm:1237096677
+ruby-1_8_6_287-7_fc11:HEAD:ruby-1.8.6.287-7.fc11.src.rpm:1237351812

ruby-1.8.6-rexml-CVE-2008-3790.patch

@@ -12,7 +12,7 @@ diff -pruN ruby-1.8.6-p287.orig/lib/rexml/document.rb ruby-1.8.6-p287/lib/rexml/
 @@ -200,6 +201,27 @@ module REXML
  			Parsers::StreamParser.new( source, listener ).parse
  		end
- 
+
 +    @@entity_expansion_limit = 10_000
 +
 +    # Set the entity expansion limit. By defualt the limit is set to 10000.
@@ -26,7 +26,7 @@ diff -pruN ruby-1.8.6-p287.orig/lib/rexml/document.rb ruby-1.8.6-p287/lib/rexml/
 +    end
 +
 +    attr_reader :entity_expansion_count
-+    
++
 +    def record_entity_expansion
 +      @entity_expansion_count += 1
 +      if @entity_expansion_count > @@entity_expansion_limit
@@ -44,7 +44,7 @@ diff -pruN ruby-1.8.6-p287.orig/lib/rexml/entity.rb ruby-1.8.6-p287/lib/rexml/en
  		# all entities -- both %ent; and &ent; entities.  This differs from
  		# +value()+ in that +value+ only replaces %ent; entities.
  		def unnormalized
-+      document.record_entity_expansion
++      document.record_entity_expansion unless document.nil?
  			v = value()
  			return nil if v.nil?
  			@unnormalized = Text::unnormalize(v, parent)

ruby.spec

@@ -12,7 +12,7 @@
 
 Name:		ruby
 Version:	%{rubyver}%{?dotpatchlevel}
-Release:	6%{?dist}
+Release:	7%{?dist}
 License:	Ruby or GPLv2
 URL:		http://www.ruby-lang.org/
 BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -512,6 +512,9 @@ rm -rf tmp-ruby-docs
 %{_datadir}/emacs/site-lisp/site-start.d/ruby-mode-init.el
 
 %changelog
+* Wed Mar 18 2009 Jeroen van Meeuwen <j.van.meeuwen@ogd.nl> - 1.8.6.287-7
+- Fix regression in CVE-2008-3790 (#485383)
+
 * Mon Mar 16 2009 Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.287-6
 - Again use -O2 optimization level
 - i586 should search i386-linux directory