Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| d21fbda06f | |||
| 6c07a89588 | |||
| f089d492df | |||
| dd5694ce5e |
@@ -0,0 +1,36 @@
|
||||
From 30db6ce78e7c4b96b977320e4d16555a93401c8d Mon Sep 17 00:00:00 2001
|
||||
From: "jan.nijtmans" <nijtmans@users.sourceforge.net>
|
||||
Date: Tue, 22 Jun 2021 09:02:00 +0000
|
||||
Subject: [PATCH] Fix [bad6cc213d]: A format string vulnerability in Tcl
|
||||
nmakehelp.c allows code execution via a crated file. Also change a memcpy()
|
||||
to a memmove(), because the range could be overlapping
|
||||
|
||||
---
|
||||
win/nmakehlp.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/win/nmakehlp.c b/win/nmakehlp.c
|
||||
index 7536ede..4021346 100644
|
||||
--- a/win/nmakehlp.c
|
||||
+++ b/win/nmakehlp.c
|
||||
@@ -537,7 +537,7 @@ GetVersionFromFile(
|
||||
++q;
|
||||
}
|
||||
|
||||
- memcpy(szBuffer, p, q - p);
|
||||
+ memmove(szBuffer, p, q - p);
|
||||
szBuffer[q-p] = 0;
|
||||
szResult = szBuffer;
|
||||
break;
|
||||
@@ -674,7 +674,7 @@ SubstituteFile(
|
||||
memcpy(szBuffer, szCopy, sizeof(szCopy));
|
||||
}
|
||||
}
|
||||
- printf(szBuffer);
|
||||
+ printf("%s", szBuffer);
|
||||
}
|
||||
|
||||
list_free(&substPtr);
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
Name: tcl
|
||||
Version: 8.6.10
|
||||
Release: 3
|
||||
Release: 5
|
||||
Epoch: 1
|
||||
Summary: The Tool Command Language implementation
|
||||
License: BSD
|
||||
@@ -26,6 +26,7 @@ Patch8: Improved-overflow-prevention-1.patch
|
||||
Patch9: Improved-overflow-prevention-2.patch
|
||||
Patch10: fix-exec-test-error.patch
|
||||
Patch11: File-not-found-should-be-ignored-silently.patch
|
||||
Patch12: Fix-bad6cc213d-A-format-string-vulnerability-in-Tcl-.patch
|
||||
|
||||
%description
|
||||
Tcl(Tool Command Language) provides a powerful platform for creating integration applications
|
||||
@@ -58,7 +59,11 @@ The development files for tcl.
|
||||
cd unix
|
||||
autoconf
|
||||
%configure --enable-threads --enable-symbols --enable-shared --enable-dtrace
|
||||
%ifnarch loongarch64
|
||||
%make_build CFLAGS="%{optflags}" TCL_LIBRARY=%{_datadir}/%{name}%{MAJOR}
|
||||
%else
|
||||
%make_build CFLAGS="-Wl,--whole-archive -lpthread -Wl,--no-whole-archive" TCL_LIBRARY=%{_datadir}/%{name}%{MAJOR}
|
||||
%endif
|
||||
|
||||
%install
|
||||
cd unix
|
||||
@@ -127,6 +132,15 @@ make test
|
||||
%{_mandir}/mann/*
|
||||
|
||||
%changelog
|
||||
* Tue Nov 15 2022 huajingyun <huajingyun@loongson.cn> - 1:8.6.10-5
|
||||
- add build flags for weak symbols on loongarch64
|
||||
|
||||
* Wed Jun 15 2022 zhangruifang <zhangruifang1@h-partners.com> - 1:8.6.10-4
|
||||
- Type:cve
|
||||
- ID:NA
|
||||
- SUG:NA
|
||||
- DESC: Fix cve-2021-35331
|
||||
|
||||
* Fri May 28 2021 yangzhuangzhuang <yangzhuangzhaung1@huawei.com> - 1:8.6.10-3
|
||||
- Type:bugfix
|
||||
- ID:NA
|
||||
|
||||
Reference in New Issue
Block a user