Matej Cepl
88ffffeead
- bsc#1130847 (CVE-2019-9948) add CVE-2019-9948-avoid_local-file.patch
removing unnecessary (and potentially harmful) URL scheme
local-file://.
- bsc#1129346: add CVE-2019-9636-netloc-no-decompose-characters.patch
Characters in the netloc attribute that decompose under NFKC
normalization (as used by the IDNA encoding) into any of ``/``,
``?``, ``#``, ``@``, or ``:`` will raise a ValueError. If the
URL is decomposed before parsing, or is not a Unicode string,
no error will be raised.
Upstream commits e37ef41 and 507bd8c.
- Update to 2.7.16:
* bugfix-only release: complete list of changes on
https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.16rc1.rst
* Removed openssl-111.patch and CVE-2018-1000802-shutil_use_subprocess_no_spawn.patch
which are fully included in the tarball.
* Updated patches to apply cleanly:
CVE-2019-5010-null-defer-x509-cert-DOS.patch
bpo36160-init-sysconfig_vars.patch
do-not-use-non-ascii-in-test_ssl.patch
openssl-111-middlebox-compat.patch
openssl-111-ssl_options.patch
python-2.5.1-sqlite.patch
python-2.6-gettext-plurals.patch
python-2.7-dirs.patch
python-2.7.2-fix_date_time_compiler.patch
python-2.7.4-canonicalize2.patch
python-2.7.5-multilib.patch
python-2.7.9-ssl_ca_path.patch
OBS-URL: https://build.opensuse.org/request/show/692400
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=241
80 lines
2.8 KiB
Diff
80 lines
2.8 KiB
Diff
--- a/Python/sysmodule.c
|
|
+++ b/Python/sysmodule.c
|
|
@@ -1638,7 +1638,20 @@ PySys_SetArgvEx(int argc, char **argv, i
|
|
char *p = NULL;
|
|
Py_ssize_t n = 0;
|
|
PyObject *a;
|
|
-#ifdef HAVE_READLINK
|
|
+#ifdef HAVE_CANONICALIZE_FILE_NAME
|
|
+ int errnum;
|
|
+
|
|
+ if (argc > 0 && argv0 != NULL && strcmp(argv0, "-c") != 0) {
|
|
+ argv0 = canonicalize_file_name(argv0);
|
|
+ if (argv0 == NULL) argv0 = strdup(argv[0]);
|
|
+ }
|
|
+#elif defined(HAVE_REALPATH)
|
|
+ if (argc > 0 && argv0 != NULL && strcmp(argv0, "-c") != 0) {
|
|
+ if (realpath(argv0, fullpath)) {
|
|
+ argv0 = fullpath;
|
|
+ }
|
|
+ }
|
|
+#elif defined(HAVE_READLINK)
|
|
char link[MAXPATHLEN+1];
|
|
char argv0copy[2*MAXPATHLEN+1];
|
|
int nr = 0;
|
|
@@ -1665,7 +1678,8 @@ PySys_SetArgvEx(int argc, char **argv, i
|
|
}
|
|
}
|
|
}
|
|
-#endif /* HAVE_READLINK */
|
|
+#endif /* resolve method selection */
|
|
+
|
|
#if SEP == '\\' /* Special case for MS filename syntax */
|
|
if (argc > 0 && argv0 != NULL && strcmp(argv0, "-c") != 0) {
|
|
char *q;
|
|
@@ -1694,11 +1708,6 @@ PySys_SetArgvEx(int argc, char **argv, i
|
|
}
|
|
#else /* All other filename syntaxes */
|
|
if (argc > 0 && argv0 != NULL && strcmp(argv0, "-c") != 0) {
|
|
-#if defined(HAVE_REALPATH)
|
|
- if (realpath(argv0, fullpath)) {
|
|
- argv0 = fullpath;
|
|
- }
|
|
-#endif
|
|
p = strrchr(argv0, SEP);
|
|
}
|
|
if (p != NULL) {
|
|
@@ -1716,6 +1725,9 @@ PySys_SetArgvEx(int argc, char **argv, i
|
|
a = PyString_FromStringAndSize(argv0, n);
|
|
if (a == NULL)
|
|
Py_FatalError("no mem for sys.path insertion");
|
|
+#ifdef HAVE_CANONICALIZE_FILE_NAME
|
|
+ if (argc > 0 && argv0 != NULL && strcmp(argv0, "-c") != 0) free(argv0);
|
|
+#endif /* HAVE_CANONICALIZE_FILE_NAME */
|
|
if (PyList_Insert(path, 0, a) < 0)
|
|
Py_FatalError("sys.path.insert(0) failed");
|
|
Py_DECREF(a);
|
|
--- a/pyconfig.h.in
|
|
+++ b/pyconfig.h.in
|
|
@@ -109,6 +109,9 @@
|
|
/* Define to 1 if you have the 'chflags' function. */
|
|
#undef HAVE_CHFLAGS
|
|
|
|
+/* Define to 1 if you have the `canonicalize_file_name' function. */
|
|
+#undef HAVE_CANONICALIZE_FILE_NAME
|
|
+
|
|
/* Define to 1 if you have the `chown' function. */
|
|
#undef HAVE_CHOWN
|
|
|
|
--- a/configure.ac
|
|
+++ b/configure.ac
|
|
@@ -3159,7 +3159,7 @@ AC_CHECK_FUNCS(alarm setitimer getitimer
|
|
getpriority getresuid getresgid getpwent getspnam getspent getsid getwd \
|
|
initgroups kill killpg lchown lstat mkfifo mknod mktime mmap \
|
|
mremap nice pathconf pause plock poll pthread_init \
|
|
- putenv readlink realpath \
|
|
+ putenv readlink realpath canonicalize_file_name \
|
|
select sem_open sem_timedwait sem_getvalue sem_unlink setegid seteuid \
|
|
setgid \
|
|
setlocale setregid setreuid setsid setpgid setpgrp setuid setvbuf snprintf \
|