|
[-]
[+]
|
Changed |
csync2.changes
|
|
|
|
[-]
[+]
|
Changed |
csync2.spec
^
|
|
|
|
[-]
[+]
|
Added |
rsync-default-strong-len.patch
^
|
| @@ -0,0 +1,24 @@
+X-Git-Url: http://git.linbit.com/csync2.git/blobdiff_plain/cf835a7aeea46ea0b0a01c3db7deb226dbc6a811..8f8c88922298ce1e2fef1b8acff12e3acdfb06b5:/rsync.c
+
+diff --git a/rsync.c b/rsync.c
+index 52fc389..28038eb 100644
+--- a/rsync.c
++++ b/rsync.c
+@@ -461,7 +461,17 @@ int csync_rs_sigfile(const char *filename, FILE **sig_file_out)
+ goto out;
+
+ csync_debug(3, "Running rs_sig_file() from librsync....\n");
++/* see upstream
++ * https://github.com/librsync/librsync/commit/152323729ac831727032daf50a10c1448b48f252
++ * as reaction to SECURITY: CVE-2014-8242
++ */
++#ifdef RS_DEFAULT_STRONG_LEN
+ result = rs_sig_file(basis_file, sig_file, RS_DEFAULT_BLOCK_LEN, RS_DEFAULT_STRONG_LEN, &stats);
++#else
++ /* For backward compatibility, for now hardcode RS_MD4_SIG_MAGIC.
++ * TODO: allow changing to RS_BLAKE2_SIG_MAGIC. */
++ result = rs_sig_file(basis_file, sig_file, RS_DEFAULT_BLOCK_LEN, 0, RS_MD4_SIG_MAGIC, &stats);
++#endif
+ *sig_file_out = sig_file;
+ sig_file = NULL;
+ if (result != RS_DONE)
|
|
|
Added |
csync2-2.0.tar.gz
^
|
|
|
Added |
csync2-git20160401.tar.bz2
^
|
