Merge lp:~jtaylor/ubuntu/oneiric/subversion/sasl-crash-881862 into lp:ubuntu/oneiric/subversion

[Julian Taylor]

picked the sasl-mem-handling patch from 1.6.17dfsg-2 to fix crashes on repos using sasl auth, see the associated bugs.

[Micah Gersten (micahg)]

Thank you for working on this. It seems like you're missing the DEP-3 headers in the patch (http://dep.debian.net/deps/dep3/), as well as a test case in the bug. Otherwise, this looks fine (though I haven't test built it yet).

review: Needs Fixing

[lp:~jtaylor/ubuntu/oneiric/subversion/sasl-crash-881862]

55. By Julian Taylor on 2011-12-11

add dep3 patch headers to sasl patch

[Julian Taylor (jtaylor)]

sorry about that, added headers and updated the bug.

[Serge Hallyn (serge-hallyn)]

Thanks, Julian, the updates look good. I'm waiting for the test build, and then will hit Approve and (seek someone to) upload.

Thank you for working on this.

[Serge Hallyn (serge-hallyn)]

Merged source builds, and tests passed for me.

review: Approve

[Evan Broder (broder)]

I've uploaded this to oneiric-proposed, but can't adjust the branch status

=== modified file 'debian/changelog'
--- debian/changelog	2011-08-05 10:53:00 +0000
+++ debian/changelog	2011-12-11 14:45:29 +0000
@@ -1,3 +1,10 @@
+subversion (1.6.12dfsg-4ubuntu5.1) oneiric-proposed; urgency=low
+
+  * patches/sasl-mem-handling: patch from 1.6.17dfsg-2 to fix a crash with
+    svn:// URLs and SASL authentication.  (LP: #881862)
+
+ -- Julian Taylor <[e-mail]>  Sat, 10 Dec 2011 16:45:12 +0100
+
 subversion (1.6.12dfsg-4ubuntu5) oneiric; urgency=low
 
   * SECURITY UPDATE: denial of service via baselined WebDAV resource

=== added file 'debian/patches/sasl-mem-handling'
--- debian/patches/sasl-mem-handling	1970-01-01 00:00:00 +0000
+++ debian/patches/sasl-mem-handling	2011-12-11 14:45:29 +0000
@@ -0,0 +1,34 @@
+Subject: Fix a memory lifetime issue with sasl
+ causes SASL auth with svn:// URLs to crash.
+Origin: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_ra_svn/cyrus_auth.c?r1=1160604&r2=1166678
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/881862
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631765
+Applied-Upstream: r1166555, r1166678
+
+--- a/subversion/libsvn_ra_svn/cyrus_auth.c
++++ b/subversion/libsvn_ra_svn/cyrus_auth.c
+@@ -730,9 +730,7 @@ svn_ra_svn__do_cyrus_auth(svn_ra_svn__se
+   const char *mechstring = "", *last_err = "", *realmstring;
+   const char *local_addrport = NULL, *remote_addrport = NULL;
+   svn_boolean_t success;
+-  /* Reserve space for 3 callbacks (for the username, password and the
+-     array terminator). */
+-  sasl_callback_t callbacks[3];
++  sasl_callback_t *callbacks;
+   cred_baton_t cred_baton;
+   int i;
+ 
+@@ -768,6 +766,13 @@ svn_ra_svn__do_cyrus_auth(svn_ra_svn__se
+   cred_baton.realmstring = realmstring;
+   cred_baton.pool = pool;
+ 
++  /* Reserve space for 3 callbacks (for the username, password and the
++     array terminator).  These structures must persist until the
++     disposal of the SASL context at pool cleanup, however the
++     callback functions will not be invoked outside this function so
++     other structures can have a shorter lifetime. */
++  callbacks = apr_palloc(sess->conn->pool, sizeof(*callbacks) * 3);
++
+   /* Initialize the callbacks array. */
+ 
+   /* The username callback. */

=== modified file 'debian/patches/series'
--- debian/patches/series	2011-08-05 10:53:00 +0000
+++ debian/patches/series	2011-12-11 14:45:29 +0000
@@ -30,3 +30,4 @@
 CVE-2011-1752.patch
 CVE-2011-1783.patch
 CVE-2011-1921.patch
+sasl-mem-handling