python37: fix CVE-2020-14422 using upstream patch

Bump PKGREVISION.

4 files changed, 57 insertions, 2 deletions

diff --git a/lang/python37/Makefile b/lang/python37/Makefile
index fd943b35f0a..59502b581e9 100644
--- a/lang/python37/Makefile
+++ b/lang/python37/Makefile
@@ -1,8 +1,9 @@
-# $NetBSD: Makefile,v 1.17 2020/05/21 17:25:13 leot Exp $
+# $NetBSD: Makefile,v 1.18 2020/08/03 11:11:33 wiz Exp $
 
 .include "dist.mk"
 
 PKGNAME=	python37-${PY_DISTVERSION}
+PKGREVISION=	1
 CATEGORIES=	lang python
 
 MAINTAINER=	pkgsrc-users@NetBSD.org
diff --git a/lang/python37/distinfo b/lang/python37/distinfo
index e60ea36833d..80d561695d5 100644
--- a/lang/python37/distinfo
+++ b/lang/python37/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2020/06/30 05:56:02 adam Exp $
+$NetBSD: distinfo,v 1.17 2020/08/03 11:11:33 wiz Exp $
 
 SHA1 (Python-3.7.8.tar.xz) = ecfc1d291ab35bb7cc3a352dd9451450266f5974
 RMD160 (Python-3.7.8.tar.xz) = 67af3c8cbdfbadd49bbbb56690b3da90799dc687
@@ -8,7 +8,9 @@ SHA1 (patch-Lib_ctypes_util.py) = 032cc99ebad93ddddfd89073c60424a952e3faa3
 SHA1 (patch-Lib_distutils_command_install.py) = 6fc6f5d918b7581fc62cd0fe55857ee932c3a341
 SHA1 (patch-Lib_distutils_sysconfig.py) = 6822eafb4dfded86d7f7353831816aeb8119e6cf
 SHA1 (patch-Lib_distutils_unixccompiler.py) = 2e65a8dd5dd3fe25957206c062106fa7a6fc4e69
+SHA1 (patch-Lib_ipaddress.py) = cf3a5f76567875e74461fd87d6089494000611dc
 SHA1 (patch-Lib_sysconfig.py) = a4f009ed73ebbd9d9c4bf7e12b7981182ed8fd7c
+SHA1 (patch-Lib_test_test__ipaddress.py) = b7b5cf9445c5fb1e20d957e7a271802ad4854ab1
 SHA1 (patch-Makefile.pre.in) = 1393dac225c5a7edcb7947eb707b4526ea884f95
 SHA1 (patch-Modules_makesetup) = a06786eebffadecedba5e3a50a9785fb47613567
 SHA1 (patch-Modules_nismodule.c) = 1bafe9b06359586d027a77011b103877590d947d
diff --git a/lang/python37/patches/patch-Lib_ipaddress.py b/lang/python37/patches/patch-Lib_ipaddress.py
new file mode 100644
index 00000000000..7ac6476afa9
--- /dev/null
+++ b/lang/python37/patches/patch-Lib_ipaddress.py
@@ -0,0 +1,26 @@
+$NetBSD: patch-Lib_ipaddress.py,v 1.1 2020/08/03 11:11:33 wiz Exp $
+
+Fix for CVE-2020-14422
+
+https://github.com/python/cpython/commit/b98e7790c77a4378ec4b1c71b84138cb930b69b7
+
+--- Lib/ipaddress.py.orig	2020-06-27 08:35:53.000000000 +0000
++++ Lib/ipaddress.py
+@@ -1442,7 +1442,7 @@ class IPv4Interface(IPv4Address):
+             return False
+ 
+     def __hash__(self):
+-        return self._ip ^ self._prefixlen ^ int(self.network.network_address)
++        return hash((self._ip, self._prefixlen, int(self.network.network_address)))
+ 
+     __reduce__ = _IPAddressBase.__reduce__
+ 
+@@ -2088,7 +2088,7 @@ class IPv6Interface(IPv6Address):
+             return False
+ 
+     def __hash__(self):
+-        return self._ip ^ self._prefixlen ^ int(self.network.network_address)
++        return hash((self._ip, self._prefixlen, int(self.network.network_address)))
+ 
+     __reduce__ = _IPAddressBase.__reduce__
+ 
diff --git a/lang/python37/patches/patch-Lib_test_test__ipaddress.py b/lang/python37/patches/patch-Lib_test_test__ipaddress.py
new file mode 100644
index 00000000000..69227a03c97
--- /dev/null
+++ b/lang/python37/patches/patch-Lib_test_test__ipaddress.py
@@ -0,0 +1,26 @@
+$NetBSD: patch-Lib_test_test__ipaddress.py,v 1.1 2020/08/03 11:11:33 wiz Exp $
+
+Fix for CVE-2020-14422
+
+https://github.com/python/cpython/commit/b98e7790c77a4378ec4b1c71b84138cb930b69b7
+
+--- Lib/test/test_ipaddress.py.orig	2020-06-27 08:35:53.000000000 +0000
++++ Lib/test/test_ipaddress.py
+@@ -2091,6 +2091,17 @@ class IpaddrUnitTest(unittest.TestCase):
+                          sixtofouraddr.sixtofour)
+         self.assertFalse(bad_addr.sixtofour)
+ 
++    # issue41004 Hash collisions in IPv4Interface and IPv6Interface
++    def testV4HashIsNotConstant(self):
++        ipv4_address1 = ipaddress.IPv4Interface("1.2.3.4")
++        ipv4_address2 = ipaddress.IPv4Interface("2.3.4.5")
++        self.assertNotEqual(ipv4_address1.__hash__(), ipv4_address2.__hash__())
++
++    # issue41004 Hash collisions in IPv4Interface and IPv6Interface
++    def testV6HashIsNotConstant(self):
++        ipv6_address1 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:1")
++        ipv6_address2 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:2")
++        self.assertNotEqual(ipv6_address1.__hash__(), ipv6_address2.__hash__())
+ 
+ if __name__ == '__main__':
+     unittest.main()