[gentoo-commits] gentoo-x86 commit in mail-client/mutt/files: mutt-1.5.20-ssl-CVE-2009-3765-dc09812e63a3.patch

[Fabian Groffen (grobian)]

grobian     09/10/27 09:20:25

  Added:                mutt-1.5.20-ssl-CVE-2009-3765-dc09812e63a3.patch
  Log:
  Add patch to fix ssl security issue CVE-2009-3765, bug #290660
  (Portage version: 2.2.00.14724-prefix/cvs/SunOS i386)

Revision  Changes    Path
1.1                  mail-client/mutt/files/mutt-1.5.20-ssl-CVE-2009-3765-dc09812e63a3.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/mail-client/mutt/files/mutt-1.5.20-ssl-CVE-2009-3765-dc09812e63a3.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/mail-client/mutt/files/mutt-1.5.20-ssl-CVE-2009-3765-dc09812e63a3.patch?rev=1.1&content-type=text/plain

Index: mutt-1.5.20-ssl-CVE-2009-3765-dc09812e63a3.patch
===================================================================
http://bugs.gentoo.org/show_bug.cgi?id=290660
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3765
http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c

Index: mutt_ssl.c
===================================================================
--- mutt_ssl.c (revision 5870:dc9ec900c657)
+++ mutt_ssl.c (revision 6016:dc09812e63a3)
@@ -682,5 +682,6 @@
       if (subj_alt_name->type == GEN_DNS)
       {
-	if ((match_found = hostname_match(hostname_ascii,
+	if (mutt_strlen(subj_alt_name) == subj_alt_name->d.ia5->length  &&
+	    (match_found = hostname_match(hostname_ascii,
 					  (char *)(subj_alt_name->d.ia5->data))))
 	{
@@ -712,5 +713,7 @@
       goto out;
     }
-    match_found = hostname_match(hostname_ascii, buf);
+    if (mutt_strlen(buf) == bufsize - 1) {
+      match_found = hostname_match(hostname_ascii, buf);
+    }
   }