ruby/ruby-1.8.4-fix-insecure-regexp-modification.patch
Akira TAGOH f0df5e45d5 - security fixes.
- ruby-1.8.4-fix-insecure-dir-operation.patch:
- ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure
    operations in the certain safe-level restrictions. (#199538)
- ruby-1.8.4-fix-alias-safe-level.patch: fixed to not bypass the certain
    safe-level restrictions. (#199543)
2006-07-20 11:06:45 +00:00

67 lines
1.9 KiB
Diff

diff -ruN ruby-1.8.4.orig/re.c ruby-1.8.4/re.c
--- ruby-1.8.4.orig/re.c 2005-12-13 12:27:51.000000000 +0900
+++ ruby-1.8.4/re.c 2006-07-19 18:07:59.000000000 +0900
@@ -70,10 +70,11 @@
#endif
int
-rb_memcicmp(p1, p2, len)
- char *p1, *p2;
+rb_memcicmp(x, y, len)
+ const void *x, *y;
long len;
{
+ const unsigned char *p1 = x, *p2 = y;
int tmp;
while (len--) {
@@ -85,7 +86,7 @@
int
rb_memcmp(p1, p2, len)
- char *p1, *p2;
+ const void *p1, *p2;
long len;
{
if (!ruby_ignorecase) {
@@ -96,11 +97,11 @@
long
rb_memsearch(x0, m, y0, n)
- char *x0, *y0;
+ const void *x0, *y0;
long m, n;
{
- unsigned char *x = (unsigned char *)x0, *y = (unsigned char *)y0;
- unsigned char *s, *e;
+ const unsigned char *x = (unsigned char *)x0, *y = (unsigned char *)y0;
+ const unsigned char *s, *e;
long i;
int d;
unsigned long hx, hy;
@@ -1332,6 +1333,8 @@
{
struct RRegexp *re = RREGEXP(obj);
+ if (!OBJ_TAINTED(obj) && rb_safe_level() >= 4)
+ rb_raise(rb_eSecurityError, "Insecure: can't modify regexp");
if (re->ptr) re_free_pattern(re->ptr);
if (re->str) free(re->str);
re->ptr = 0;
diff -ruN ruby-1.8.4.orig/intern.h ruby-1.8.4/intern.h
--- ruby-1.8.4.orig/intern.h 2006-07-19 18:13:49.000000000 +0900
+++ ruby-1.8.4/intern.h 2006-07-19 18:20:34.000000000 +0900
@@ -353,9 +353,9 @@
VALUE rb_range_beg_len _((VALUE, long*, long*, long, int));
VALUE rb_length_by_each _((VALUE));
/* re.c */
-int rb_memcmp _((char*,char*,long));
-int rb_memcicmp _((char*,char*,long));
-long rb_memsearch _((char*,long,char*,long));
+int rb_memcmp _((const void*,const void*,long));
+int rb_memcicmp _((const void*,const void*,long));
+long rb_memsearch _((const void*,long,const void*,long));
VALUE rb_reg_nth_defined _((int, VALUE));
VALUE rb_reg_nth_match _((int, VALUE));
VALUE rb_reg_last_match _((VALUE));