apply fix for CVE-2012-0845 to other Python versions too

(2.4 is not affected)

9 files changed, 66 insertions, 9 deletions

diff --git a/lang/python25/Makefile b/lang/python25/Makefile
index 8e908374e1b..fb81d0f8f04 100644
--- a/lang/python25/Makefile
+++ b/lang/python25/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.36 2012/01/18 13:59:50 adam Exp $
+# $NetBSD: Makefile,v 1.37 2012/02/15 16:08:25 drochner Exp $
 
 .include "dist.mk"
 
 PKGNAME=	python25-${PY_DISTVERSION}
-PKGREVISION=	1
+PKGREVISION=	2
 CATEGORIES=	lang python
 
 MAINTAINER=	pkgsrc-users@NetBSD.org
diff --git a/lang/python25/distinfo b/lang/python25/distinfo
index d1f5773d4c6..3db36db88e0 100644
--- a/lang/python25/distinfo
+++ b/lang/python25/distinfo
@@ -1,8 +1,9 @@
-$NetBSD: distinfo,v 1.21 2011/12/16 17:04:17 hans Exp $
+$NetBSD: distinfo,v 1.22 2012/02/15 16:08:25 drochner Exp $
 
 SHA1 (Python-2.5.6.tar.bz2) = 29f6dd41bf09c5e04311b367cbb7604fa016e699
 RMD160 (Python-2.5.6.tar.bz2) = 92f0a955971f187a7d50c6422168202ec551bf22
 Size (Python-2.5.6.tar.bz2) = 9821788 bytes
+SHA1 (patch-CVE-2012-0845) = 1c0a8d7224b6b5cb65b24d38ac0967f8f8fb2da9
 SHA1 (patch-SA43463) = df776e171f1794bae52b6e98bc71ae63734b7693
 SHA1 (patch-aa) = d44e67645dc86ff14f5daf5705de02c6f330cc48
 SHA1 (patch-ab) = d35025df83e70d129f9fbcd277652b0eea83b026
diff --git a/lang/python25/patches/patch-CVE-2012-0845 b/lang/python25/patches/patch-CVE-2012-0845
new file mode 100644
index 00000000000..e086a0b233e
--- /dev/null
+++ b/lang/python25/patches/patch-CVE-2012-0845
@@ -0,0 +1,18 @@
+$NetBSD: patch-CVE-2012-0845,v 1.1 2012/02/15 16:08:26 drochner Exp $
+
+see python bug #14001
+
+--- Lib/SimpleXMLRPCServer.py.orig	2009-04-05 21:34:15.000000000 +0000
++++ Lib/SimpleXMLRPCServer.py
+@@ -459,7 +459,10 @@ class SimpleXMLRPCRequestHandler(BaseHTT
+             L = []
+             while size_remaining:
+                 chunk_size = min(size_remaining, max_chunk_size)
+-                L.append(self.rfile.read(chunk_size))
++                chunk = self.rfile.read(chunk_size)
++                if not chunk:
++                    break
++                L.append(chunk)
+                 size_remaining -= len(L[-1])
+             data = ''.join(L)
+ 
diff --git a/lang/python27/Makefile b/lang/python27/Makefile
index db003c74439..b77ba876547 100644
--- a/lang/python27/Makefile
+++ b/lang/python27/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.10 2012/01/18 14:00:30 adam Exp $
+# $NetBSD: Makefile,v 1.11 2012/02/15 16:08:26 drochner Exp $
 
 .include "dist.mk"
 
 PKGNAME=	python27-${PY_DISTVERSION}
-PKGREVISION=	1
+PKGREVISION=	2
 CATEGORIES=	lang python
 
 MAINTAINER=	pkgsrc-users@NetBSD.org
diff --git a/lang/python27/distinfo b/lang/python27/distinfo
index 86b4b2fccaf..56309c3aad7 100644
--- a/lang/python27/distinfo
+++ b/lang/python27/distinfo
@@ -1,8 +1,9 @@
-$NetBSD: distinfo,v 1.14 2011/12/16 17:04:18 hans Exp $
+$NetBSD: distinfo,v 1.15 2012/02/15 16:08:26 drochner Exp $
 
 SHA1 (Python-2.7.2.tar.bz2) = 417bdeea77abfaf1b9257fc6b4a04aaa209f4547
 RMD160 (Python-2.7.2.tar.bz2) = c3bf4f09b7c429a4d9f4cc251c795304cd5232c5
 Size (Python-2.7.2.tar.bz2) = 11754834 bytes
+SHA1 (patch-CVE-2012-0845) = 1c0a8d7224b6b5cb65b24d38ac0967f8f8fb2da9
 SHA1 (patch-Mac_Modules_fm___Fmmodule.c) = b9314bccb51b4fe672b81559068f7a79d2965f94
 SHA1 (patch-Mac_Modules_qd___Qdmodule.c) = 45c748b15b9436d45ba137460389638aa7108c8d
 SHA1 (patch-Mac_Modules_qdoffs___Qdoffsmodule.c) = 9994f0c1a908f18f1f3df3f05b184f082c018365
diff --git a/lang/python27/patches/patch-CVE-2012-0845 b/lang/python27/patches/patch-CVE-2012-0845
new file mode 100644
index 00000000000..e086a0b233e
--- /dev/null
+++ b/lang/python27/patches/patch-CVE-2012-0845
@@ -0,0 +1,18 @@
+$NetBSD: patch-CVE-2012-0845,v 1.1 2012/02/15 16:08:26 drochner Exp $
+
+see python bug #14001
+
+--- Lib/SimpleXMLRPCServer.py.orig	2009-04-05 21:34:15.000000000 +0000
++++ Lib/SimpleXMLRPCServer.py
+@@ -459,7 +459,10 @@ class SimpleXMLRPCRequestHandler(BaseHTT
+             L = []
+             while size_remaining:
+                 chunk_size = min(size_remaining, max_chunk_size)
+-                L.append(self.rfile.read(chunk_size))
++                chunk = self.rfile.read(chunk_size)
++                if not chunk:
++                    break
++                L.append(chunk)
+                 size_remaining -= len(L[-1])
+             data = ''.join(L)
+ 
diff --git a/lang/python31/Makefile b/lang/python31/Makefile
index 3a466d2fd18..7b22bdc0cc3 100644
--- a/lang/python31/Makefile
+++ b/lang/python31/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.5 2012/01/18 14:00:42 adam Exp $
+# $NetBSD: Makefile,v 1.6 2012/02/15 16:08:26 drochner Exp $
 
 .include "dist.mk"
 
 PKGNAME=	python31-${PY_DISTVERSION}
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	lang python
 
 MAINTAINER=	pkgsrc-users@NetBSD.org
diff --git a/lang/python31/distinfo b/lang/python31/distinfo
index a89f4afaddb..cf7430a3c70 100644
--- a/lang/python31/distinfo
+++ b/lang/python31/distinfo
@@ -1,8 +1,9 @@
-$NetBSD: distinfo,v 1.7 2011/12/16 17:04:18 hans Exp $
+$NetBSD: distinfo,v 1.8 2012/02/15 16:08:26 drochner Exp $
 
 SHA1 (Python-3.1.4.tar.bz2) = 043d0240247f289205deeb0e620d799005202b3c
 RMD160 (Python-3.1.4.tar.bz2) = d537706808b00989a636418b6b6a06357b6bb94b
 Size (Python-3.1.4.tar.bz2) = 9887870 bytes
+SHA1 (patch-CVE-2012-0845) = 747ee5649e0f4062f4c5b6bfb9a7fce24d6e3647
 SHA1 (patch-aa) = ae156c486007cfd14d378dd211108d3af4b841b1
 SHA1 (patch-ab) = 7d4d6aa9239f53f1ce9ecd377890d71557c58ca4
 SHA1 (patch-ah) = f93c0aab7b0d5e8e9f80433dda5ed5a22861f6b9
diff --git a/lang/python31/patches/patch-CVE-2012-0845 b/lang/python31/patches/patch-CVE-2012-0845
new file mode 100644
index 00000000000..614105802ad
--- /dev/null
+++ b/lang/python31/patches/patch-CVE-2012-0845
@@ -0,0 +1,18 @@
+$NetBSD: patch-CVE-2012-0845,v 1.1 2012/02/15 16:08:26 drochner Exp $
+
+see python bug #14001
+
+--- Lib/xmlrpc/server.py.orig	2011-06-11 15:48:51.000000000 +0000
++++ Lib/xmlrpc/server.py
+@@ -449,7 +449,10 @@ class SimpleXMLRPCRequestHandler(BaseHTT
+             L = []
+             while size_remaining:
+                 chunk_size = min(size_remaining, max_chunk_size)
+-                L.append(self.rfile.read(chunk_size))
++                chunk = self.rfile.read(chunk_size)
++                if not chunk:
++                    break
++                L.append(chunk)
+                 size_remaining -= len(L[-1])
+             data = b''.join(L)
+