Add patch for pear-MDB2 arbitrary file reading vulnerability (CVE-2007-5934).

4 files changed, 30 insertions, 6 deletions

diff --git a/databases/pear-MDB2_Driver_mysql/Makefile b/databases/pear-MDB2_Driver_mysql/Makefile
index b6c09874c4b..259f2a2e215 100644
--- a/databases/pear-MDB2_Driver_mysql/Makefile
+++ b/databases/pear-MDB2_Driver_mysql/Makefile
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.1.1.1 2008/04/30 21:05:16 adrianp Exp $
+# $NetBSD: Makefile,v 1.2 2008/07/13 17:55:38 tonnerre Exp $
 
 DISTNAME=	MDB2_Driver_mysql-1.4.1
+PKGREVISION=	1
 CATEGORIES=	databases
 
 MAINTAINER=	adrianp@NetBSD.org
diff --git a/databases/pear-MDB2_Driver_mysql/distinfo b/databases/pear-MDB2_Driver_mysql/distinfo
index 693be50242e..6f3f37e831f 100644
--- a/databases/pear-MDB2_Driver_mysql/distinfo
+++ b/databases/pear-MDB2_Driver_mysql/distinfo
@@ -1,6 +1,7 @@
-$NetBSD: distinfo,v 1.1.1.1 2008/04/30 21:05:16 adrianp Exp $
+$NetBSD: distinfo,v 1.2 2008/07/13 17:55:38 tonnerre Exp $
 
 SHA1 (pear/MDB2_Driver_mysql-1.4.1.tgz) = edbbc2e5e6074080650c5f6a21b7fe7fb8dededd
 RMD160 (pear/MDB2_Driver_mysql-1.4.1.tgz) = 872f6d4e9a8ba3be37dcafeaf2e5ae38e772e4e3
 Size (pear/MDB2_Driver_mysql-1.4.1.tgz) = 36481 bytes
-SHA1 (patch-aa) = 13ad6842a8635350edf4b82d20ee0bf7e3d3f901
+SHA1 (patch-aa) = a364e57d25e8501123df072016f062d444ca2def
+SHA1 (patch-ab) = 7d67850a37ccfaaadd4b2c260f5b64f664c8a51d
diff --git a/databases/pear-MDB2_Driver_mysql/patches/patch-aa b/databases/pear-MDB2_Driver_mysql/patches/patch-aa
index 0cf1356da70..ef0e6242e8c 100644
--- a/databases/pear-MDB2_Driver_mysql/patches/patch-aa
+++ b/databases/pear-MDB2_Driver_mysql/patches/patch-aa
@@ -1,7 +1,16 @@
-$NetBSD: patch-aa,v 1.1.1.1 2008/04/30 21:05:16 adrianp Exp $
+$NetBSD: patch-aa,v 1.2 2008/07/13 17:55:38 tonnerre Exp $
 
---- package.xml.orig	2007-05-03 20:05:23.000000000 +0100
-+++ package.xml
+--- ../package.xml.orig	2007-05-03 21:05:23.000000000 +0200
++++ ../package.xml
+@@ -59,7 +59,7 @@ open todo items:
+    <file baseinstalldir="/" md5sum="33df2e21f7c0e5d764adcf82b6294b38" name="MDB2/Driver/Reverse/mysql.php" role="php">
+     <tasks:replace from="@package_version@" to="version" type="package-info" />
+    </file>
+-   <file baseinstalldir="/" md5sum="de036c07e722213b95a793e2d5db683c" name="MDB2/Driver/mysql.php" role="php">
++   <file baseinstalldir="/" md5sum="c7c3c8ff80d001c9177920a6ee620b74" name="MDB2/Driver/mysql.php" role="php">
+     <tasks:replace from="@package_version@" to="version" type="package-info" />
+    </file>
+    <file baseinstalldir="/" md5sum="1766c43f50ce08418b524a6047462e4d" name="tests/MDB2_nonstandard_mysql.php" role="test" />
 @@ -79,9 +79,6 @@ open todo items:
      <channel>pear.php.net</channel>
      <min>2.4.1</min>
diff --git a/databases/pear-MDB2_Driver_mysql/patches/patch-ab b/databases/pear-MDB2_Driver_mysql/patches/patch-ab
new file mode 100644
index 00000000000..d4d29b37dc0
--- /dev/null
+++ b/databases/pear-MDB2_Driver_mysql/patches/patch-ab
@@ -0,0 +1,13 @@
+$NetBSD: patch-ab,v 1.1 2008/07/13 17:55:38 tonnerre Exp $
+
+--- MDB2/Driver/mysql.php	2007/05/02 22:00:08	1.182
++++ MDB2/Driver/mysql.php	2007/05/03 22:20:20	1.183
+@@ -1398,7 +1398,7 @@
+                 }
+                 $value = $this->values[$parameter];
+                 $type = array_key_exists($parameter, $this->types) ? $this->types[$parameter] : null;
+-                if (is_resource($value) || $type == 'clob' || $type == 'blob') {
++                if (is_resource($value) || $type == 'clob' || $type == 'blob' && $this->options['lob_allow_url_include']) {
+                     if (!is_resource($value) && preg_match('/^(\w+:\/\/)(.*)$/', $value, $match)) {
+                         if ($match[1] == 'file://') {
+                             $value = $match[2];