01/01: gnu: httpd: Add fix for CVE-2016-8740.

[Efraim Flashner]

efraim pushed a commit to branch master
in repository guix.

commit 1ebe49f192d6c84bf55ac16188d7966f673f4388
Author: Efraim Flashner <address@hidden>
Date:   Tue Dec 6 15:36:59 2016 +0200

    gnu: httpd: Add fix for CVE-2016-8740.
    
    * gnu/packages/web.scm (httpd)[source]: Add patch for CVE-2016-8740.
    * gnu/packages/patches/httpd-CVE-2016-8740.patch: New file.
    * gnu/local.mk (dist_patch_DATA): Register it.
---
 gnu/local.mk                                   |    1 +
 gnu/packages/patches/httpd-CVE-2016-8740.patch |   36 ++++++++++++++++++++++++
 gnu/packages/web.scm                           |    4 ++-
 3 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/gnu/local.mk b/gnu/local.mk
index 9f8325d..bc9b06d 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -620,6 +620,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/hdf-eos5-fortrantests.patch             \
   %D%/packages/patches/higan-remove-march-native-flag.patch    \
   %D%/packages/patches/hop-linker-flags.patch                  \
+  %D%/packages/patches/httpd-CVE-2016-8740.patch                       \
   %D%/packages/patches/hydra-disable-darcs-test.patch          \
   %D%/packages/patches/hypre-doc-tables.patch                  \
   %D%/packages/patches/hypre-ldflags.patch                     \
diff --git a/gnu/packages/patches/httpd-CVE-2016-8740.patch 
b/gnu/packages/patches/httpd-CVE-2016-8740.patch
new file mode 100644
index 0000000..17ba323
--- /dev/null
+++ b/gnu/packages/patches/httpd-CVE-2016-8740.patch
@@ -0,0 +1,36 @@
+This patch applies against httpd-2.4.23 and shouldn't be needed in later 
releases
+http://openwall.com/lists/oss-security/2016/12/05/17
+Index: modules/http2/h2_stream.c
+===================================================================
+--- modules/http2/h2_stream.c  (revision 1771866)
++++ modules/http2/h2_stream.c  (working copy)
+@@ -322,18 +322,18 @@
+                                            
HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE);
+             }
+         }
+-    }
+-    
+-    if (h2_stream_is_scheduled(stream)) {
+-        return h2_request_add_trailer(stream->request, stream->pool,
+-                                      name, nlen, value, vlen);
+-    }
+-    else {
+-        if (!input_open(stream)) {
+-            return APR_ECONNRESET;
++        
++        if (h2_stream_is_scheduled(stream)) {
++            return h2_request_add_trailer(stream->request, stream->pool,
++                                          name, nlen, value, vlen);
+         }
+-        return h2_request_add_header(stream->request, stream->pool,
+-                                     name, nlen, value, vlen);
++        else {
++            if (!input_open(stream)) {
++                return APR_ECONNRESET;
++            }
++            return h2_request_add_header(stream->request, stream->pool,
++                                         name, nlen, value, vlen);
++        }
+     }
+ }
+ 
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 697bab8..8167638 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -92,7 +92,9 @@
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))))
+               "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))
+             (patches (search-patches "httpd-CVE-2016-8740.patch"))
+             (patch-flags '("-p0"))))
     (build-system gnu-build-system)
     (native-inputs `(("pcre" ,pcre "bin")))       ;for 'pcre-config'
     (inputs `(("apr" ,apr)