CentOS Sources
2 years ago
committed by
MSVSphere Packaging Team
parent
a16abaa37f
commit
c2ed8129fd
@ -1,6 +1,6 @@
|
||||
SOURCES/cjs-module-lexer-1.2.2.tar.gz
|
||||
SOURCES/icu4c-71_1-src.tgz
|
||||
SOURCES/node-v16.18.1-stripped.tar.gz
|
||||
SOURCES/undici-5.10.0.tar.gz
|
||||
SOURCES/node-v16.19.1-stripped.tar.gz
|
||||
SOURCES/undici-5.19.1.tar.gz
|
||||
SOURCES/wasi-sdk-wasi-sdk-11.tar.gz
|
||||
SOURCES/wasi-sdk-wasi-sdk-14.tar.gz
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
b0a91341ecf6c68a9d59a1c57d000fbbcc771679 SOURCES/cjs-module-lexer-1.2.2.tar.gz
|
||||
406b0c8635288b772913b6ff646451e69748878a SOURCES/icu4c-71_1-src.tgz
|
||||
71f2019e8d646be20ec962859e6a356b13663313 SOURCES/node-v16.18.1-stripped.tar.gz
|
||||
a2668423c8ed5321e39ce08e239141b084563bb5 SOURCES/undici-5.10.0.tar.gz
|
||||
b841e32cfbbb8147f84ab25feb5e7a82f8fa1065 SOURCES/node-v16.19.1-stripped.tar.gz
|
||||
4ba08daec56f2571fc8af493b3a2628d290f9390 SOURCES/undici-5.19.1.tar.gz
|
||||
8979d177dd62e3b167a6fd7dc7185adb0128c439 SOURCES/wasi-sdk-wasi-sdk-11.tar.gz
|
||||
900a50a32f0079d53c299db92b88bb3c5d2022b8 SOURCES/wasi-sdk-wasi-sdk-14.tar.gz
|
||||
|
||||
@ -0,0 +1,45 @@
|
||||
From df574e2999dc6c2c38138bd0c3ec61dfafe9c929 Mon Sep 17 00:00:00 2001
|
||||
From: Kornel <kornel@geekhood.net>
|
||||
Date: Fri, 27 Jan 2023 01:20:38 +0000
|
||||
Subject: [PATCH] deps(http-cache-semantics): Don't use regex to trim
|
||||
whitespace
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
deps/npm/node_modules/http-cache-semantics/index.js | 6 +++---
|
||||
deps/npm/node_modules/http-cache-semantics/package.json | 2 +-
|
||||
2 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/deps/npm/node_modules/http-cache-semantics/index.js b/deps/npm/node_modules/http-cache-semantics/index.js
|
||||
index 4f6c2f3..39d58a7 100644
|
||||
--- a/deps/npm/node_modules/http-cache-semantics/index.js
|
||||
+++ b/deps/npm/node_modules/http-cache-semantics/index.js
|
||||
@@ -79,10 +79,10 @@ function parseCacheControl(header) {
|
||||
|
||||
// TODO: When there is more than one value present for a given directive (e.g., two Expires header fields, multiple Cache-Control: max-age directives),
|
||||
// the directive's value is considered invalid. Caches are encouraged to consider responses that have invalid freshness information to be stale
|
||||
- const parts = header.trim().split(/\s*,\s*/); // TODO: lame parsing
|
||||
+ const parts = header.trim().split(/,/);
|
||||
for (const part of parts) {
|
||||
- const [k, v] = part.split(/\s*=\s*/, 2);
|
||||
- cc[k] = v === undefined ? true : v.replace(/^"|"$/g, ''); // TODO: lame unquoting
|
||||
+ const [k, v] = part.split(/=/, 2);
|
||||
+ cc[k.trim()] = v === undefined ? true : v.trim().replace(/^"|"$/g, '');
|
||||
}
|
||||
|
||||
return cc;
|
||||
diff --git a/deps/npm/node_modules/http-cache-semantics/package.json b/deps/npm/node_modules/http-cache-semantics/package.json
|
||||
index 897798d..79c020a 100644
|
||||
--- a/deps/npm/node_modules/http-cache-semantics/package.json
|
||||
+++ b/deps/npm/node_modules/http-cache-semantics/package.json
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "http-cache-semantics",
|
||||
- "version": "4.1.0",
|
||||
+ "version": "4.1.1",
|
||||
"description": "Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies",
|
||||
"repository": "https://github.com/kornelski/http-cache-semantics.git",
|
||||
"main": "index.js",
|
||||
--
|
||||
2.39.2
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
From 9872b897d6a9a39e3392c39bca70cfd9dd084558 Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Mon, 26 Sep 2022 16:02:39 +0200
|
||||
Subject: [PATCH] install: keep installing dtrace and systemtap files
|
||||
|
||||
Partly reverts commit e27e709d3ca93b3e7036ddc4f4d28dfde228bfb6.
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
tools/install.py | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/tools/install.py b/tools/install.py
|
||||
index 4b01d67..dc16797 100755
|
||||
--- a/tools/install.py
|
||||
+++ b/tools/install.py
|
||||
@@ -178,6 +178,11 @@ def files(action):
|
||||
output_lib = 'libnode.' + variables.get('shlib_suffix')
|
||||
action([output_prefix + output_lib], variables.get('libdir') + '/' + output_lib)
|
||||
|
||||
+ if 'true' == variables.get('node_use_dtrace'):
|
||||
+ action(['out/Release/node.d'], variables.get('libdir') + '/dtrace/node.d')
|
||||
+
|
||||
+ action(['src/node.stp'], 'share/systemtap/tapset/')
|
||||
+
|
||||
action(['deps/v8/tools/gdbinit'], 'share/doc/node/')
|
||||
action(['deps/v8/tools/lldb_commands.py'], 'share/doc/node/')
|
||||
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -0,0 +1,53 @@
|
||||
From 2c06dc63aa864be8648758e71fa70e3d3f47e06f Mon Sep 17 00:00:00 2001
|
||||
From: hopper-vul <118949689+hopper-vul@users.noreply.github.com>
|
||||
Date: Wed, 18 Jan 2023 22:14:26 +0800
|
||||
Subject: [PATCH] deps(cares): Add str len check in config_sortlist to avoid
|
||||
stack overflow (#497)
|
||||
|
||||
In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse
|
||||
the input str and initialize a sortlist configuration.
|
||||
|
||||
However, ares_set_sortlist has not any checks about the validity of the input str.
|
||||
It is very easy to create an arbitrary length stack overflow with the unchecked
|
||||
`memcpy(ipbuf, str, q-str);` and `memcpy(ipbufpfx, str, q-str);`
|
||||
statements in the config_sortlist call, which could potentially cause severe
|
||||
security impact in practical programs.
|
||||
|
||||
This commit add necessary check for `ipbuf` and `ipbufpfx` which avoid the
|
||||
potential stack overflows.
|
||||
|
||||
fixes #496
|
||||
|
||||
Fix By: @hopper-vul
|
||||
Resolves: CVE-2022-4904
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
deps/cares/src/lib/ares_init.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/deps/cares/src/lib/ares_init.c b/deps/cares/src/lib/ares_init.c
|
||||
index de5d86c..d5858f6 100644
|
||||
--- a/deps/cares/src/lib/ares_init.c
|
||||
+++ b/deps/cares/src/lib/ares_init.c
|
||||
@@ -2243,6 +2243,8 @@ static int config_sortlist(struct apattern **sortlist, int *nsort,
|
||||
q = str;
|
||||
while (*q && *q != '/' && *q != ';' && !ISSPACE(*q))
|
||||
q++;
|
||||
+ if (q-str >= 16)
|
||||
+ return ARES_EBADSTR;
|
||||
memcpy(ipbuf, str, q-str);
|
||||
ipbuf[q-str] = '\0';
|
||||
/* Find the prefix */
|
||||
@@ -2251,6 +2253,8 @@ static int config_sortlist(struct apattern **sortlist, int *nsort,
|
||||
const char *str2 = q+1;
|
||||
while (*q && *q != ';' && !ISSPACE(*q))
|
||||
q++;
|
||||
+ if (q-str >= 32)
|
||||
+ return ARES_EBADSTR;
|
||||
memcpy(ipbufpfx, str, q-str);
|
||||
ipbufpfx[q-str] = '\0';
|
||||
str = str2;
|
||||
--
|
||||
2.39.2
|
||||
|
||||
Loading…
Reference in new issue