From: Stanislav Sedov <stas@...>
Date: 2008-06-23T22:37:07+09:00
Subject: Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix)

--Signature=_Mon__23_Jun_2008_17_38_43_+0400_lEZ4j6JdHr_+xznE
Content-Type: text/plain; charset=US-ASCII
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, 23 Jun 2008 21:23:01 +0900
Igal Koshevoy <igal@pragmaticraft.com> mentioned:

> Stanislav Sedov wrote:
> > All the relevant changes were in array.cand string.c sources, I've back=
ported both.
> According to=20
> http://www.freebsd.org/cgi/cvsweb.cgi/ports/lang/ruby18/files/ you only=20
> patched sprintf.c and string.c but not array.c, which was specifically=20
> mentioned in the changelog as having a vulnerability. Furthermore, Zed=20
> Shaw mentioned many other files that seemed affected by security fixes=20
> at http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html

All the files you see at this dir are applied to ruby during packages
building and port install. The fresh ones are array.c and string.c.
sprintf.c patch is required for correct string.c operation as it
adds the required function backported from 1.9.
The file in question is availble at
http://www.freebsd.org/cgi/cvsweb.cgi/ports/lang/ruby18/files/patch-array.c=
?rev=3D1.1;content-type=3Dtext%2Fplain


> I did. The text fields read "1.1" and "1.2". These fields are wrong, the=
=20
> first should be something like "1.0" or "initial", and the second should=
=20
> be "1.1". Setting the first field to "1.0" fails because this is a=20
> forbidden field in your version control system, and version "1.2"=20
> doesn't exist. I see no way to get a diff by clicking the "Get diffs"=20
> button, therefore it doesn't work. Either don't show the button for=20
> newly imported files, or provide sensible behavior, like displaying the=20
> initial version so that the user doesn't get confused.
>=20

The GUI only reflects what CVS has. The file is question is of 1.1
revision (first in CVS) and you obvously can't get a diff between
nothing and first. CVS tracks only files, not the entire repository.

--=20
Stanislav Sedov
ST4096-RIPE

--Signature=_Mon__23_Jun_2008_17_38_43_+0400_lEZ4j6JdHr_+xznE
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)

iEYEARECAAYFAkhfp2kACgkQK/VZk+smlYEIBgCfSgO6YPDswtVsPS38KxXQxACP
mt8AnRyy+nqqPFWFekGrhgBm2NexTb4l
=QRqR
-----END PGP SIGNATURE-----

--Signature=_Mon__23_Jun_2008_17_38_43_+0400_lEZ4j6JdHr_+xznE--