commit 5a5cd3aa3307659e471d7d7d030d287d74f23f24
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Fri Sep 27 15:10:19 2013 +0200
Do not use algorithm name as regular expression
- Resolves: rhbz#959454
...-use-algorithm-name-as-regular-expression.patch | 47 ++++++++++++++++++++
plexus-digest.spec | 8 +++-
2 files changed, 54 insertions(+), 1 deletions(-)
---
diff --git a/0001-Do-not-use-algorithm-name-as-regular-expression.patch
b/0001-Do-not-use-algorithm-name-as-regular-expression.patch
new file mode 100644
index 0000000..0b9223f
--- /dev/null
+++ b/0001-Do-not-use-algorithm-name-as-regular-expression.patch
@@ -0,0 +1,47 @@
+From 10955c0d72fc11324cebcb2bd8fe4bf56f0f8887 Mon Sep 17 00:00:00 2001
+From: Mikolaj Izdebski <mizdebsk(a)redhat.com>
+Date: Fri, 27 Sep 2013 12:49:53 +0200
+Subject: [PATCH] Do not use algorithm name as regular expression
+
+In org.codehaus.plexus.digest.DigestUtils.cleanChecksum(String,
+String, String), the second parameter is used as part of the regular
+expression. Compiling the resulting regular expression can result in
+a VM error with a crafted algorithm name. The regular expression
+should be a constant, with a capture group for the algorithm name, and
+the name should be checked after matching.
+
+Originally reported by Florian Weimer in:
+https://bugzilla.redhat.com/show_bug.cgi?id=959454
+---
+ src/main/java/org/codehaus/plexus/digest/DigestUtils.java | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/main/java/org/codehaus/plexus/digest/DigestUtils.java
b/src/main/java/org/codehaus/plexus/digest/DigestUtils.java
+index a54a8c0..430c3a8 100644
+--- a/src/main/java/org/codehaus/plexus/digest/DigestUtils.java
++++ b/src/main/java/org/codehaus/plexus/digest/DigestUtils.java
+@@ -51,16 +51,17 @@ public class DigestUtils
+ String trimmedChecksum = checksum.replace( '\n', ' ' ).trim();
+
+ // Free-BSD / openssl
+- String regex = algorithm.replaceAll( "-", "" ) +
"\\s*\\((.*?)\\)\\s*=\\s*([a-fA-F0-9]+)";
++ algorithm = algorithm.replaceAll( "-", "" );
++ String regex = "(.{" + algorithm.length() +
"})\\s*\\((.*?)\\)\\s*=\\s*([a-fA-F0-9]+)";
+ Matcher m = Pattern.compile( regex ).matcher( trimmedChecksum );
+- if ( m.matches() )
++ if ( m.matches() && m.group( 1 ).equals( algorithm ) )
+ {
+- String filename = m.group( 1 );
++ String filename = m.group( 2 );
+ if ( !isValidChecksumPattern( filename, path ) )
+ {
+ throw new DigesterException( "Supplied checksum does not match
checksum pattern" );
+ }
+- trimmedChecksum = m.group( 2 );
++ trimmedChecksum = m.group( 3 );
+ }
+ else
+ {
+--
+1.8.3.1
+
diff --git a/plexus-digest.spec b/plexus-digest.spec
index 5d9512f..43112ad 100644
--- a/plexus-digest.spec
+++ b/plexus-digest.spec
@@ -33,7 +33,7 @@
Name: plexus-digest
Version: 1.1
-Release: 13%{?dist}
+Release: 14%{?dist}
Epoch: 0
Summary: Plexus Digest / Hashcode Components
License: ASL 2.0
@@ -45,6 +45,7 @@ Source0: %{name}-%{version}-src.tar.gz
Patch0: %{name}-migration-to-component-metadata.patch
Patch1: %{name}-fix-test-dependencies.patch
+Patch2: 0001-Do-not-use-algorithm-name-as-regular-expression.patch
BuildArch: noarch
@@ -82,6 +83,7 @@ Javadoc for %{name}.
%setup -q -n %{name}
%patch0 -p1
%patch1 -p1
+%patch2 -p1
%build
%mvn_file : %{parent}/%{subname}
@@ -95,6 +97,10 @@ Javadoc for %{name}.
%files javadoc -f .mfiles-javadoc
%changelog
+* Fri Sep 27 2013 Mikolaj Izdebski <mizdebsk(a)redhat.com> - 0:1.1-14
+- Do not use algorithm name as regular expression
+- Resolves: rhbz#959454
+
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0:1.1-13
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild