From: Hongli Lai <hongli@...>
Date: 2008-06-23T22:38:40+09:00
Subject: Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix)

Igal Koshevoy wrote:
> Thanks for the quick response and for publishing the patch. However, are 
> you sure you got all the files? Your patch is the most comprehensive 
> I've seen, but isn't it missing the fixes to things like eval.c, file.c 
> and bignum.c?

Now that you mention it, Keita Yamaguchi sent me an eval.c security 
patch a while back. Upon closer inspection it seems that this patch is 
not included in the FreeBSD patch set, and neither is bignum.c.

I've made an updated patch set:
http://blog.phusion.nl/assets/r8ee-security-patch-20080623-2.txt

Was file.c vulnerable? I see a number of Windows fixes for file.c, but 
it's not immediately clear whether the changes also include security 
fixes.


> As far as I can tell, you and Stas at FreeBSD were patching different 
> files. E.g., you patched io.c, while he didn't seem to. However, I feel 
> like I don't understand how to use the FreeBSD website because I can 
> only see find his patches to string.c and sprintf.c, but none of the 
> others, so if someone can explain how to find the rest, that'd be great.

I grabbed the patches from the FreeBSD ports tree. Here's a tarball with 
all the patches in FreeBSD's ruby18 port: 
http://blog.phusion.nl/assets/freebsd-ruby18-patches.tar.gz

I excluded some irrelevant (i.e. FreeBSD-specific) patches from my patch 
set.

> PS: And many thanks for the awesome work on Phusion Passenger and Ruby 
> EE.

Thanks. :)
-- 
Posted via http://www.ruby-forum.com/.