subversion: add patch for CVE-2020-17525

This commit is contained in:
Robert Scott 2021-04-24 20:31:07 +01:00
parent 0ca4f6b739
commit c94fa93440
2 changed files with 18 additions and 2 deletions

View file

@ -0,0 +1,15 @@
Patch included in advisory @ https://subversion.apache.org/security/CVE-2020-17525-advisory.txt
--- a/subversion/libsvn_repos/config_file.c
+++ b/subversion/libsvn_repos/config_file.c
@@ -237,6 +237,10 @@ get_repos_config(svn_stream_t **stream,
{
/* Search for a repository in the full path. */
repos_root_dirent = svn_repos_find_root_path(dirent, scratch_pool);
+ if (repos_root_dirent == NULL)
+ return svn_error_trace(handle_missing_file(stream, checksum, access,
+ url, must_exist,
+ svn_node_none));
/* Attempt to open a repository at repos_root_dirent. */
SVN_ERR(svn_repos_open3(&access->repos, repos_root_dirent, NULL,

View file

@ -17,7 +17,7 @@ assert javahlBindings -> jdk != null && perl != null;
let
common = { version, sha256 }: stdenv.mkDerivation (rec {
common = { version, sha256, extraPatches ? [ ] }: stdenv.mkDerivation (rec {
inherit version;
pname = "subversion";
@ -35,7 +35,7 @@ let
++ lib.optional perlBindings perl
++ lib.optional saslSupport sasl;
patches = [ ./apr-1.patch ];
patches = [ ./apr-1.patch ] ++ extraPatches;
# We are hitting the following issue even with APR 1.6.x
# -> https://issues.apache.org/jira/browse/SVN-4813
@ -118,5 +118,6 @@ in {
subversion = common {
version = "1.12.2";
sha256 = "0wgpw3kzsiawzqk4y0xgh1z93kllxydgv4lsviim45y5wk4bbl1v";
extraPatches = [ ./CVE-2020-17525.patch ];
};
}