Browse code
Patch for CVE-2018-16845
Change-Id: I4e14ae1b64f55e292afdea30fd2d625d9d46c439
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6752
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Tested-by: Anish Swaminathan <anishs@vmware.com>
smaliakkal authored on 2019/02/16 09:41:16Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,17 @@ |
| 0 |
+diff -ru a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c |
|
| 1 |
+--- a/src/http/modules/ngx_http_mp4_module.c 2018-03-20 15:58:32.000000000 +0000 |
|
| 2 |
+@@ -942,6 +942,13 @@ |
|
| 3 |
+ atom_size = ngx_mp4_get_64value(atom_header + 8); |
|
| 4 |
+ atom_header_size = sizeof(ngx_mp4_atom_header64_t); |
|
| 5 |
+ |
|
| 6 |
++ if (atom_size < sizeof(ngx_mp4_atom_header64_t)) {
|
|
| 7 |
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, |
|
| 8 |
++ "\"%s\" mp4 atom is too small:%uL", |
|
| 9 |
++ mp4->file.name.data, atom_size); |
|
| 10 |
++ return NGX_ERROR; |
|
| 11 |
++ } |
|
| 12 |
++ |
|
| 13 |
+ } else {
|
|
| 14 |
+ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, |
|
| 15 |
+ "\"%s\" mp4 atom is too small:%uL", |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: High-performance HTTP server and reverse proxy |
| 2 | 2 |
Name: nginx |
| 3 | 3 |
Version: 1.13.10 |
| 4 |
-Release: 1%{?dist}
|
|
| 4 |
+Release: 2%{?dist}
|
|
| 5 | 5 |
License: BSD-2-Clause |
| 6 | 6 |
URL: http://nginx.org/download/nginx-%{version}.tar.gz
|
| 7 | 7 |
Group: Applications/System |
| ... | ... |
@@ -14,6 +14,7 @@ Source2: nginx-njs-0.2.1.tar.gz |
| 14 | 14 |
%define sha1 nginx-njs=fd8c3f2d219f175be958796e3beaa17f3b465126 |
| 15 | 15 |
Patch0: nginx-CVE-2018-16843.patch |
| 16 | 16 |
Patch1: nginx-CVE-2018-16844.patch |
| 17 |
+Patch2: nginx-CVE-2018-16845.patch |
|
| 17 | 18 |
BuildRequires: openssl-devel |
| 18 | 19 |
BuildRequires: pcre-devel |
| 19 | 20 |
BuildRequires: which |
| ... | ... |
@@ -24,6 +25,7 @@ NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as |
| 24 | 24 |
%setup -q |
| 25 | 25 |
%patch0 -p1 |
| 26 | 26 |
%patch1 -p1 |
| 27 |
+%patch2 -p1 |
|
| 27 | 28 |
pushd ../ |
| 28 | 29 |
mkdir nginx-njs |
| 29 | 30 |
tar -C nginx-njs -xf %{SOURCE2}
|
| ... | ... |
@@ -77,6 +79,8 @@ install -p -m 0644 %{SOURCE1} %{buildroot}/usr/lib/systemd/system/nginx.service
|
| 77 | 77 |
%dir %{_var}/log/nginx
|
| 78 | 78 |
|
| 79 | 79 |
%changelog |
| 80 |
+* Fri Feb 15 2019 Siju Maliakkal <smaliakkal@vmware.com> 1.13.10-2 |
|
| 81 |
+- Patch for CVE-2018-16845 |
|
| 80 | 82 |
* Mon Jan 28 2019 Keerthana K <keerthanak@vmware.com> 1.13.10-1 |
| 81 | 83 |
- Update to version 1.13.10 |
| 82 | 84 |
* Thu Jan 17 2019 Keerthana K <keerthanak@vmware.com> 1.13.8-7 |