Browse code

Ruby: Update to version 2.4.2. [CVE-2017-0898, CVE-2017-14033]

Change-Id: I62e04ee4a72cf5a862abce81c402d96980bf5d88
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3910
Reviewed-by: Sharath George
Tested-by: Sharath George

xiaolin-vmware authored on 2017/10/03 22:41:24
Showing 2 changed files
1 1
deleted file mode 100644
... ...
@@ -1,70 +0,0 @@
1
-diff --git a/ext/json/generator/generator.c b/ext/json/generator/generator.c
2
-index a135e28348..2cdca5685f 100644
3
-+++ b/ext/json/generator/generator.c
4
-@@ -301,7 +301,7 @@ static char *fstrndup(const char *ptr, unsigned long len) {
5
-   char *result;
6
-   if (len <= 0) return NULL;
7
-   result = ALLOC_N(char, len);
8
--  memccpy(result, ptr, 0, len);
9
-+  memcpy(result, ptr, len);
10
-   return result;
11
- }
12
- 
13
-@@ -1055,7 +1055,7 @@ static VALUE cState_indent_set(VALUE self, VALUE indent)
14
-         }
15
-     } else {
16
-         if (state->indent) ruby_xfree(state->indent);
17
--        state->indent = strdup(RSTRING_PTR(indent));
18
-+        state->indent = fstrndup(RSTRING_PTR(indent), len);
19
-         state->indent_len = len;
20
-     }
21
-     return Qnil;
22
-@@ -1093,7 +1093,7 @@ static VALUE cState_space_set(VALUE self, VALUE space)
23
-         }
24
-     } else {
25
-         if (state->space) ruby_xfree(state->space);
26
--        state->space = strdup(RSTRING_PTR(space));
27
-+        state->space = fstrndup(RSTRING_PTR(space), len);
28
-         state->space_len = len;
29
-     }
30
-     return Qnil;
31
-@@ -1129,7 +1129,7 @@ static VALUE cState_space_before_set(VALUE self, VALUE space_before)
32
-         }
33
-     } else {
34
-         if (state->space_before) ruby_xfree(state->space_before);
35
--        state->space_before = strdup(RSTRING_PTR(space_before));
36
-+        state->space_before = fstrndup(RSTRING_PTR(space_before), len);
37
-         state->space_before_len = len;
38
-     }
39
-     return Qnil;
40
-@@ -1166,7 +1166,7 @@ static VALUE cState_object_nl_set(VALUE self, VALUE object_nl)
41
-         }
42
-     } else {
43
-         if (state->object_nl) ruby_xfree(state->object_nl);
44
--        state->object_nl = strdup(RSTRING_PTR(object_nl));
45
-+        state->object_nl = fstrndup(RSTRING_PTR(object_nl), len);
46
-         state->object_nl_len = len;
47
-     }
48
-     return Qnil;
49
-@@ -1201,7 +1201,7 @@ static VALUE cState_array_nl_set(VALUE self, VALUE array_nl)
50
-         }
51
-     } else {
52
-         if (state->array_nl) ruby_xfree(state->array_nl);
53
--        state->array_nl = strdup(RSTRING_PTR(array_nl));
54
-+        state->array_nl = fstrndup(RSTRING_PTR(array_nl), len);
55
-         state->array_nl_len = len;
56
-     }
57
-     return Qnil;
58
-diff --git ext/json/generator/generator.h ext/json/generator/generator.h
59
-index 298c0a4965..6bbf817b7d 100644
60
-+++ b/ext/json/generator/generator.h
61
-@@ -1,7 +1,6 @@
62
- #ifndef _GENERATOR_H_
63
- #define _GENERATOR_H_
64
- 
65
--#include <string.h>
66
- #include <math.h>
67
- #include <ctype.h>
68
- 
... ...
@@ -1,29 +1,27 @@
1
-Summary:    Ruby
2
-Name:       ruby
3
-Version:    2.4.1
4
-Release:    5%{?dist}
5
-License:    BSDL
6
-URL:        https://www.ruby-lang.org/en/
7
-Group:      System Environment/Security
8
-Vendor:     VMware, Inc.
9
-Distribution: Photon
10
-Source0:    http://cache.ruby-lang.org/pub/ruby/%{name}-%{version}.tar.gz
11
-%define sha1 ruby=47909a0f77ea900573f027d27746960ad6d07d15
12
-Patch0:     ruby-CVE-2017-9224.patch
13
-Patch1:     ruby-CVE-2017-9226.patch
14
-Patch2:     ruby-CVE-2017-9227.patch
15
-Patch3:     ruby-CVE-2017-9229.patch
16
-Patch4:     ruby-CVE-2017-9228.patch
17
-#https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85
18
-Patch5:     ruby-CVE-2017-14064.patch
1
+Summary:        Ruby
2
+Name:           ruby
3
+Version:        2.4.2
4
+Release:        1%{?dist}
5
+License:        BSDL
6
+URL:            https://www.ruby-lang.org/en/
7
+Group:          System Environment/Security
8
+Vendor:         VMware, Inc.
9
+Distribution:   Photon
10
+Source0:        http://cache.ruby-lang.org/pub/ruby/%{name}-%{version}.tar.xz
11
+%define sha1    ruby=8373e32c63bba2180799da091b572664aa9faf6f
12
+Patch0:         ruby-CVE-2017-9224.patch
13
+Patch1:         ruby-CVE-2017-9226.patch
14
+Patch2:         ruby-CVE-2017-9227.patch
15
+Patch3:         ruby-CVE-2017-9229.patch
16
+Patch4:         ruby-CVE-2017-9228.patch
19 17
 BuildRequires:  openssl-devel
20 18
 BuildRequires:  ca-certificates
21 19
 BuildRequires:  readline-devel
22 20
 BuildRequires:  readline
23 21
 BuildRequires:  tzdata
24
-Requires:   ca-certificates
25
-Requires:   openssl
26
-Requires:   gmp
22
+Requires:       ca-certificates
23
+Requires:       openssl
24
+Requires:       gmp
27 25
 %description
28 26
 The Ruby package contains the Ruby development environment.
29 27
 This is useful for object-oriented scripting.
... ...
@@ -35,7 +33,6 @@ This is useful for object-oriented scripting.
35 35
 %patch2 -p1
36 36
 %patch3 -p1
37 37
 %patch4 -p1
38
-%patch5 -p1
39 38
 %build
40 39
 ./configure \
41 40
     --prefix=%{_prefix}   \
... ...
@@ -66,6 +63,8 @@ rm -rf %{buildroot}/*
66 66
 %{_docdir}/%{name}-%{version}
67 67
 %{_mandir}/man1/*
68 68
 %changelog
69
+*   Fri Sep 29 2017 Xiaolin Li <xiaolinl@vmware.com> 2.4.2-1
70
+-   Update to version 2.4.2
69 71
 *   Fri Sep 15 2017 Xiaolin Li <xiaolinl@vmware.com> 2.4.1-5
70 72
 -   [security] CVE-2017-14064
71 73
 *   Tue Sep 05 2017 Chang Lee <changlee@vmware.com> 2.4.1-4