- rel 5; fix CVE-2009-0796; drop patches that weren't applied

Changed files:
    apache-mod_perl-CVE-2009-0796.patch -> 1.1
    apache-mod_perl-magic.patch -> 1.2
    apache-mod_perl-path_info_secfix.patch -> 1.2
    apache-mod_perl.spec -> 1.176

diff --git a/apache-mod_perl-CVE-2009-0796.patch b/apache-mod_perl-CVE-2009-0796.patch
new file mode 100644 (file)
index 0000000..c13db0d
--- /dev/null
+++ b/apache-mod_perl-CVE-2009-0796.patch
@@ -0,0 +1,47 @@
+--- perl/modperl/trunk/lib/Apache2/Status.pm   2007/12/31 08:05:11     607697
++++ perl/modperl/trunk/lib/Apache2/Status.pm   2009/04/01 15:39:56     760926
+@@ -29,7 +29,7 @@
+ 
+ use Apache2::Const -compile => qw(OK);
+ 
+-$Apache2::Status::VERSION = '4.00'; # mod_perl 2.0
++$Apache2::Status::VERSION = '4.01'; # mod_perl 2.0
+ 
+ use constant IS_WIN32 => ($^O eq "MSWin32");
+ 
+@@ -126,7 +126,7 @@
+         $r->print(symdump($r, $qs));
+     }
+     else {
+-        my $uri = $r->uri;
++        my $uri = $r->location;
+         $r->print('<p>');
+         $r->print(
+             map { qq[<a href="$uri?$_">$status{$_}</a><br />\n] } sort { lc $a cmp lc $b } keys %status
+@@ -198,7 +198,7 @@
+ sub status_inc {
+     my ($r) = @_;
+ 
+-    my $uri = $r->uri;
++    my $uri = $r->location;
+     my @retval = (
+         '<table border="1">',
+         "<tr>",
+@@ -289,7 +289,7 @@
+     my ($r) = @_;
+ 
+     local $_;
+-    my $uri = $r->uri;
++    my $uri = $r->location;
+     my $cache = __PACKAGE__->registry_cache;
+ 
+     my @retval = "<h2>Compiled registry scripts grouped by their handler</h2>";
+@@ -765,7 +765,7 @@
+     my ($self, $package, $r) = @_;
+ 
+     my @m = qw(<table>);
+-    my $uri = $r->uri;
++    my $uri = $r->location;
+     my $is_main = $package eq "main";
+ 
+     my $do_dump = has($r, "dumper");

diff --git a/apache-mod_perl-magic.patch b/apache-mod_perl-magic.patch
deleted file mode 100644 (file)
index c7f9ca1..0000000
--- a/apache-mod_perl-magic.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-Index: src/modules/perl/mod_perl.h
-===================================================================
---- src/modules/perl/mod_perl.h        (revision 607690)
-+++ src/modules/perl/mod_perl.h        (working copy)
-@@ -141,7 +141,8 @@
- /* betting on Perl*Handlers not using CvXSUBANY
-  * mod_perl reuses this field for handler attributes
-  */
--#define MP_CODE_ATTRS(cv) (CvXSUBANY((CV*)cv).any_i32)
-+U16 *mp_code_attrs(pTHX_ CV *cv);
-+#define MP_CODE_ATTRS(cv) (*mp_code_attrs(aTHX_ cv))
- 
- #define MgTypeExt(mg) (mg->mg_type == '~')
- 
-Index: src/modules/perl/modperl_mgv.c
-===================================================================
---- src/modules/perl/modperl_mgv.c     (revision 607694)
-+++ src/modules/perl/modperl_mgv.c     (working copy)
-@@ -271,7 +271,7 @@
-     }
-     else {
-         if ((cv = get_cv(name, FALSE))) {
--            handler->attrs = (U32)MP_CODE_ATTRS(cv);
-+            handler->attrs = MP_CODE_ATTRS(cv);
-             handler->mgv_cv =
-                 modperl_mgv_compile(aTHX_ p, HvNAME(GvSTASH(CvGV(cv))));
-             modperl_mgv_append(aTHX_ p, handler->mgv_cv, GvNAME(CvGV(cv)));
-@@ -334,7 +334,7 @@
-             modperl_mgv_new_name(handler->mgv_obj, p, name);
-         }
- 
--        handler->attrs = (U32)MP_CODE_ATTRS(cv);
-+        handler->attrs = MP_CODE_ATTRS(cv);
-         /* note: this is the real function after @ISA lookup */
-         handler->mgv_cv = modperl_mgv_compile(aTHX_ p, HvNAME(GvSTASH(gv)));
-         modperl_mgv_append(aTHX_ p, handler->mgv_cv, handler_name);
-Index: src/modules/perl/modperl_types.h
-===================================================================
---- src/modules/perl/modperl_types.h   (revision 607690)
-+++ src/modules/perl/modperl_types.h   (working copy)
-@@ -195,7 +195,7 @@
-     const char *name;
-     CV *cv;
-     U8 flags;
--    U32 attrs;
-+    U16 attrs;
-     modperl_handler_t *next;
- };
- 
-Index: src/modules/perl/modperl_util.c
-===================================================================
---- src/modules/perl/modperl_util.c    (revision 607694)
-+++ src/modules/perl/modperl_util.c    (working copy)
-Index: xs/Apache2/Filter/Apache2__Filter.h
-@@ -903,3 +903,13 @@
-     return retval ? SvREFCNT_inc(retval) : &PL_sv_undef;
- }
-  
-+U16 *mp_code_attrs(pTHX_ CV *cv) {
-+    MAGIC *mg;    
-+
-+    if (!SvMAGICAL(cv)) {
-+       sv_magic((SV*)cv, Nullsv, PERL_MAGIC_ext, NULL, -1); 
-+    }
-+
-+    mg = mg_find((SV*)cv, PERL_MAGIC_ext);
-+    return &(mg->mg_private);
-+}
-===================================================================
---- xs/Apache2/Filter/Apache2__Filter.h        (revision 607694)
-+++ xs/Apache2/Filter/Apache2__Filter.h        (working copy)
-@@ -86,9 +86,9 @@
-     return len;
- }
- 
--static MP_INLINE U32 *modperl_filter_attributes(SV *package, SV *cvrv)
-+static MP_INLINE U16 *modperl_filter_attributes(pTHX_ SV *package, SV *cvrv)
- {
--    return (U32 *)&MP_CODE_ATTRS(SvRV(cvrv));
-+    return &MP_CODE_ATTRS(SvRV(cvrv));
- }
- 
- #ifdef MP_TRACE
-@@ -118,7 +118,7 @@
- MP_STATIC XS(MPXS_modperl_filter_attributes)
- {
-     dXSARGS;
--    U32 *attrs = modperl_filter_attributes(ST(0), ST(1));
-+    U16 *attrs = modperl_filter_attributes(aTHX_ ST(0), ST(1));
-     I32 i;
- #ifdef MP_TRACE
-     HV *stash = gv_stashsv(ST(0), TRUE); 
-

diff --git a/apache-mod_perl-path_info_secfix.patch b/apache-mod_perl-path_info_secfix.patch
deleted file mode 100644 (file)
index fc64dd6..0000000
--- a/apache-mod_perl-path_info_secfix.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- ModPerl-Registry/lib/ModPerl/RegistryCooker.pm~    2006-11-20 00:31:41.000000000 +0100
-+++ ModPerl-Registry/lib/ModPerl/RegistryCooker.pm     2007-03-23 14:01:52.606187672 +0100
-@@ -337,7 +337,7 @@
-     my $self = shift;
- 
-     my $path_info = $self->{REQ}->path_info;
--    my $script_name = $path_info && $self->{URI} =~ /$path_info$/
-+    my $script_name = $path_info && $self->{URI} =~ /\Q$path_info\E$/
-         ? substr($self->{URI}, 0, length($self->{URI}) - length($path_info))
-         : $self->{URI};
- 

diff --git a/apache-mod_perl.spec b/apache-mod_perl.spec
index 702dab48a96aa17aea20357cb1e57bfca7287019..74a41dbe276f51a28fbd9d0117fc9f62e1f25031 100644 (file)
--- a/apache-mod_perl.spec
+++ b/apache-mod_perl.spec
@@ -31,7 +31,7 @@ Summary(zh_CN.UTF-8): 用于 Apache web 服务程序的 Perl 解释程序。
 Name:          apache-mod_perl
 %define        ver     2.0.4
 Version:       %{ver}
-Release:       4
+Release:       5
 Epoch:         1
 License:       Apache
 Group:         Networking/Daemons/HTTP
@@ -39,12 +39,8 @@ Source0:     http://perl.apache.org/dist/mod_perl-%{version}.tar.gz
 # Source0-md5: 1a05625ae6843085f985f5da8214502a
 Source1:       %{name}.conf
 Patch0:                %{name}-Makefile_PL.patch
-Patch1:                %{name}-path_info_secfix.patch
-Patch2:                %{name}-magic.patch
+Patch1:                %{name}-CVE-2009-0796.patch
 URL:           http://perl.apache.org/
-# Fix in svn:
-# http://svn.apache.org/viewvc/perl/modperl/trunk/lib/Apache2/Status.pm?view=log
-BuildRequires: security(CVE-2009-0796)
 BuildRequires: apache-devel >= 2.0.55-1
 BuildRequires: apr-util-devel >= 1:1.0.0
 BuildRequires: expat-devel
@@ -253,6 +249,7 @@ pomocnicze do testowania serwera Apache.
 %prep
 %setup -q -n mod_%{mod_name}-%{ver}
 %patch0 -p1
+%patch1 -p3
 
 %build
 %{__perl} Makefile.PL \