- added patch for CVE-2012-2122

- rel 3; STBR

Changed files:
    mysql-CVE-2012-2122.patch -> 1.1
    mysql.spec -> 1.572

diff --git a/mysql-CVE-2012-2122.patch b/mysql-CVE-2012-2122.patch
new file mode 100644 (file)
index 0000000..afca95e
--- /dev/null
+++ b/mysql-CVE-2012-2122.patch
@@ -0,0 +1,11 @@
+--- mysql-5.5.21.orig/sql/password.c   2012-01-31 12:28:14.000000000 +0100
++++ mysql-5.5.21/sql/password.c        2012-06-11 18:33:31.712820746 +0200
+@@ -531,7 +531,7 @@
+   mysql_sha1_reset(&sha1_context);
+   mysql_sha1_input(&sha1_context, buf, SHA1_HASH_SIZE);
+   mysql_sha1_result(&sha1_context, hash_stage2_reassured);
+-  return memcmp(hash_stage2, hash_stage2_reassured, SHA1_HASH_SIZE);
++  return test(memcmp(hash_stage2, hash_stage2_reassured, SHA1_HASH_SIZE));
+ }
+ 
+ 

diff --git a/mysql.spec b/mysql.spec
index b0c36d7f5f444384b4d3d3d513dfc5ee22734566..617aab9604c08888c87b1ff672c7c7c8eb47941d 100644 (file)
--- a/mysql.spec
+++ b/mysql.spec
@@ -36,7 +36,7 @@ Summary(uk.UTF-8):    MySQL - швидкий SQL-сервер
 Summary(zh_CN.UTF-8):  MySQL数据库服务器
 Name:          mysql
 Version:       5.5.21
-Release:       2
+Release:       3
 License:       GPL + MySQL FLOSS Exception
 Group:         Applications/Databases
 # Source0Download: http://dev.mysql.com/downloads/mysql/5.5.html#downloads
@@ -74,6 +74,7 @@ Patch18:      %{name}-sphinx.patch
 Patch19:       %{name}-chain-certs.patch
 # from fedora
 Patch20:       %{name}-dubious-exports.patch
+Patch21:       %{name}-CVE-2012-2122.patch
 # <percona patches, updated with percona.sh>
 Patch100:      bug933969.patch
 Patch101:      microsec_process.patch
@@ -573,6 +574,7 @@ mv sphinx-*/mysqlse storage/sphinx
 %patch14 -p0
 %patch19 -p1
 %patch20 -p1
+%patch21 -p1
 # <percona %patches>
 %patch100 -p1
 %patch101 -p1