summarylogtreecommitdiffstats
path: root/CVE-2014-9705.patch
diff options
context:
space:
mode:
authorFelix Yan2015-07-23 19:55:08 +0800
committerFelix Yan2015-07-23 19:55:08 +0800
commit46328e7f9a997f2080d9b01ea32910302ca1fbb2 (patch)
treeab71f43b4093ed44f201782a09e3b55a9aea3e32 /CVE-2014-9705.patch
downloadaur-46328e7f9a997f2080d9b01ea32910302ca1fbb2.tar.gz
addpkg: php53 5.3.29-4
Diffstat (limited to 'CVE-2014-9705.patch')
-rw-r--r--CVE-2014-9705.patch46
1 files changed, 46 insertions, 0 deletions
diff --git a/CVE-2014-9705.patch b/CVE-2014-9705.patch
new file mode 100644
index 00000000000..12f834b8c2d
--- /dev/null
+++ b/CVE-2014-9705.patch
@@ -0,0 +1,46 @@
+From bdfe457a2c1b47209e32783b3a6447e81baf179a Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Mon, 16 Feb 2015 06:50:10 +0100
+Subject: [PATCH] Port for for bug #68552
+
+---
+ NEWS | 6 ++++++
+ ext/enchant/enchant.c | 7 +++----
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+Index: php5-5.3.10/ext/enchant/enchant.c
+===================================================================
+--- php5-5.3.10.orig/ext/enchant/enchant.c 2015-03-16 13:42:36.063819735 -0400
++++ php5-5.3.10/ext/enchant/enchant.c 2015-03-16 13:42:36.059819705 -0400
+@@ -545,13 +545,12 @@
+
+ d = enchant_broker_request_dict(pbroker->pbroker, (const char *)tag);
+ if (d) {
++ pos = pbroker->dictcnt++;
+ if (pbroker->dictcnt) {
+ pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
+- pos = pbroker->dictcnt++;
+ } else {
+ pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
+ pos = 0;
+- pbroker->dictcnt++;
+ }
+
+ dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
+@@ -606,14 +605,14 @@
+
+ d = enchant_broker_request_pwl_dict(pbroker->pbroker, (const char *)pwl);
+ if (d) {
++ pos = pbroker->dictcnt++;
+ if (pbroker->dictcnt) {
+- pos = pbroker->dictcnt++;
+ pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
+ } else {
+ pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
+ pos = 0;
+- pbroker->dictcnt++;
+ }
++
+ dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
+ dict->id = pos;
+ dict->pbroker = pbroker;