Bug 225706 - www/uwsgi: Fix potential stack overflow in uwsgi_expand_path()
Summary: www/uwsgi: Fix potential stack overflow in uwsgi_expand_path()
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-ports-bugs (Nobody)
URL: https://github.com/unbit/uwsgi/commit...
Keywords: patch, security
Depends on:
Blocks:
 
Reported: 2018-02-06 18:36 UTC by VK
Modified: 2018-02-13 10:30 UTC (History)
3 users (show)

See Also:
bugzilla: maintainer-feedback? (eugene)
vlad-fbsd: merge-quarterly?

Attachments
Fix potential stack overflow in uwsgi_expand_path() (1.41 KB, patch)
2018-02-06 18:36 UTC, VK 		vlad-fbsd: maintainer-approval? (eugene)
 Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description VK 2018-02-06 18:36:15 UTC 
Created attachment 190363 [details]
Fix potential stack overflow in uwsgi_expand_path()

A stack overflow situation has been found and fixed in uwsgi with the following commit:

https://github.com/unbit/uwsgi/commit/cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfe

Attached is the ported patch. Builds with Poudriere 11.1 amd64, run-time tested in production.

New release of uwsgi (2.0.16) is pending any day now, which will probably include this, but I've filed this PR anyway for your consideration to include it earlier.
Comment 1 VK 2018-02-10 12:33:39 UTC 
2.0.16 got released today. Includes fix for this. This report should be closed once uwsgi is upgraded. However, please consider applying the fix just to 2018Q1 branch.

* https://github.com/unbit/uwsgi-docs/blob/master/Changelog-2.0.16.rst
Comment 2 Vsevolod Stakhov freebsd_committer freebsd_triage 2018-02-13 10:25:14 UTC 
Fixed by 225858.

*** This bug has been marked as a duplicate of bug 225858 ***
Comment 3 VK 2018-02-13 10:30:20 UTC 
This is not a duplicate of bug #225858, if anything it's the other way around. Thanks for fixing it, though.