Created Quilt Patch and Debdiff with patch appended into
"debian-changes" patch file because of the source option
--single-debian-patch.
--- a/mcs/class/System.Web/System.Web.UI/Page.cs
+++ b/mcs/class/System.Web/System.Web.UI/Page.cs
@@ -1175,7 +1175,7 @@
void ProcessPostData (NameValueCollection data, bool second)
{
- NameValueCollection requestValues = _requestValueCollection == null ? new NameValueCollection () : _requestValueCollection;
+ NameValueCollection requestValues = _requestValueCollection == null ? new NameValueCollection (SecureHashCodeProvider.DefaultInvariant, CaseInsensitiveComparer.DefaultInvariant) : _requestValueCollection;
if (data != null && data.Count > 0) {
var used = new Dictionary <string, string> (StringComparer.Ordinal);
@@ -1210,7 +1210,7 @@
} else if (!second) {
if (secondPostData == null)
- secondPostData = new NameValueCollection ();
+ secondPostData = new NameValueCollection (SecureHashCodeProvider.DefaultInvariant, CaseInsensitiveComparer.DefaultInvariant);
secondPostData.Add (id, data [id]);
}
}
--- /dev/null
+++ b/mcs/class/System.Web/System.Web.Util/SecureHashCodeProvider.cs
@@ -0,0 +1,131 @@
+//
+// System.Collections.SecureHashCodeProvider.cs
+//
+// Authors:
+// Sergey Chaban (se...@wildwestsoftware.com)
+// Andreas Nahr (classdevelopm...@a-softtech.com)
+// Sebastien Pouliot <sebast...@ximian.com>
+//
+// Copyright (C) 2004-2005 Novell, Inc (http://www.novell.com)
+// Copyright 2012 Xamarin, Inc (http://xamarin.com)
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections;
+using System.Globalization;
+
+namespace System.Web.Util
+{
+ class SecureHashCodeProvider : IHashCodeProvider
+ {
+ static readonly SecureHashCodeProvider singletonInvariant = new SecureHashCodeProvider (CultureInfo.InvariantCulture);
+ static SecureHashCodeProvider singleton;
+ static readonly object sync = new object ();
+ static readonly int seed;
+
+ TextInfo m_text; // must match MS name for serialization
+
+ public static SecureHashCodeProvider Default {
+ get {
+ lock (sync) {
+ if (singleton == null) {
+ singleton = new SecureHashCodeProvider ();
+ } else if (singleton.m_text == null) {
+ if (!AreEqual (CultureInfo.CurrentCulture, CultureInfo.InvariantCulture))
+ singleton = new SecureHashCodeProvider ();
+ } else if (!AreEqual (singleton.m_text, CultureInfo.CurrentCulture)) {
+ singleton = new SecureHashCodeProvider ();
+ }
+ return singleton;
+ }
+ }
+ }
+
+ public static SecureHashCodeProvider DefaultInvariant {
+ get { return singletonInvariant; }
+ }
+
+ static SecureHashCodeProvider ()
+ {
+ // It should be enough to fend off the attack described in
+ // https://bugzilla.novell.com/show_bug.cgi?id=739119
+ // In order to predict value of the seed, the attacker would have to know the exact time when
+ // the server process started and since it's a remote attack, this is next to impossible.
+ // Using milliseconds instead of ticks here would make it easier for the attackers since there
+ // would only be as many as 1000 possible values
+ seed = (int)DateTime.UtcNow.Ticks;
+ }
+
+ // Public instance constructor
+ public SecureHashCodeProvider ()
+ {
+ CultureInfo culture = CultureInfo.CurrentCulture;
+ if (!AreEqual (culture, CultureInfo.InvariantCulture))
+ m_text = CultureInfo.CurrentCulture.TextInfo;
+ }
+
+ public SecureHashCodeProvider (CultureInfo culture)
+ {
+ if (culture == null)
+ throw new ArgumentNullException ("culture");
+ if (!AreEqual (culture, CultureInfo.InvariantCulture))
+ m_text = culture.TextInfo;
+ }
+
+ static bool AreEqual (CultureInfo a, CultureInfo b)
+ {
+ return a.LCID == b.LCID;
+ }
+
+ static bool AreEqual (TextInfo info, CultureInfo culture)
+ {
+ return info.LCID == culture.LCID;
+ }
+
+ public int GetHashCode (object obj)
+ {
+ if (obj == null)
+ throw new ArgumentNullException ("obj");
+
+ string str = obj as string;
+
+ if (str == null)
+ return obj.GetHashCode ();
+
+ int h = seed;
+ char c;
+
+ if ((m_text != null) && !AreEqual (m_text, CultureInfo.InvariantCulture)) {
+ str = m_text.ToLower (str);
+ for (int i = 0; i < str.Length; i++) {
+ c = str [i];
+ h = h * 31 + c;
+ }
+ } else {
+ for (int i = 0; i < str.Length; i++) {
+ c = Char.ToLower (str [i], CultureInfo.InvariantCulture);
+ h = h * 31 + c;
+ }
+ }
+ return h;
+ }
+ }
+}
--- a/mcs/class/System.Web/System.Web.dll.sources
+++ b/mcs/class/System.Web/System.Web.dll.sources
@@ -1174,6 +1174,7 @@
System.Web.Util/MachineKeySectionUtils.cs
System.Web.Util/RuntimeHelpers.cs
System.Web.Util/SearchPattern.cs
+System.Web.Util/SecureHashCodeProvider.cs
System.Web.Util/SerializationHelper.cs
System.Web.Util/StrUtils.cs
System.Web.Util/TimeUtil.cs
--- a/mcs/class/System.Web/System.Web/WebROCollection.cs
+++ b/mcs/class/System.Web/System.Web/WebROCollection.cs
@@ -5,6 +5,7 @@
// Gonzalo Paniagua Javier (gonz...@novell.com)
//
// (c) 2005-2009 Novell, Inc. (http://www.novell.com)
+// Copyright 2012 Xamarin, Inc (http://xamarin.com)
//
//
// Permission is hereby granted, free of charge, to any person obtaining
@@ -26,8 +27,10 @@
// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
//
+using System.Collections;
using System.Collections.Specialized;
using System.Text;
+using System.Web.Util;
namespace System.Web
{
@@ -36,7 +39,7 @@
bool got_id;
int id;
- public WebROCollection () : base (StringComparer.OrdinalIgnoreCase) { }
+ public WebROCollection () : base (SecureHashCodeProvider.DefaultInvariant, CaseInsensitiveComparer.DefaultInvariant) { }
public bool GotID {
get { return got_id; }
}
diff -Nru mono-2.10.8.1/debian/changelog mono-2.10.8.1/debian/changelog
--- mono-2.10.8.1/debian/changelog 2012-08-27 12:27:24.000000000 -0400
+++ mono-2.10.8.1/debian/changelog 2012-11-20 07:10:37.000000000 -0500
@@ -1,3 +1,10 @@
+mono (2.10.8.1-6.1) UNRELEASED; urgency=high
+
+ * Non-maintainer upload.
+ * Add fix for CVE-2012-3543, hash collision denial of service attacks in
ASP.net. (Closes: #686562)
+
+ -- Adrian La Duca <alad...@summatus.net> Tue, 20 Nov 2012 07:10:01 -0500
+
mono (2.10.8.1-6) unstable; urgency=low
* [da2fc97] Remove armhf from list of supported architectures. It
diff -Nru mono-2.10.8.1/debian/patches/debian-changes
mono-2.10.8.1/debian/patches/debian-changes
--- mono-2.10.8.1/debian/patches/debian-changes 2012-08-27 12:29:22.000000000
-0400
+++ mono-2.10.8.1/debian/patches/debian-changes 2012-11-20 10:33:32.000000000
-0500
@@ -775,3 +775,197 @@
/* SAVE_CALL_CHAIN is supported if the code is compiled to save
*/
/* frame pointers by default, i.e. no -fomit-frame-pointer flag.
*/
# define CAN_SAVE_CALL_ARGS
+--- mono-2.10.8.1.orig/mcs/class/System.Web/System.Web.UI/Page.cs
++++ mono-2.10.8.1/mcs/class/System.Web/System.Web.UI/Page.cs
+@@ -1175,7 +1175,7 @@ public partial class Page : TemplateCont
+
+ void ProcessPostData (NameValueCollection data, bool second)
+ {
+- NameValueCollection requestValues = _requestValueCollection ==
null ? new NameValueCollection () : _requestValueCollection;
++ NameValueCollection requestValues = _requestValueCollection ==
null ? new NameValueCollection (SecureHashCodeProvider.DefaultInvariant,
CaseInsensitiveComparer.DefaultInvariant) : _requestValueCollection;
+
+ if (data != null && data.Count > 0) {
+ var used = new Dictionary <string, string>
(StringComparer.Ordinal);
+@@ -1210,7 +1210,7 @@ public partial class Page : TemplateCont
+
+ } else if (!second) {
+ if (secondPostData == null)
+- secondPostData = new
NameValueCollection ();
++ secondPostData = new
NameValueCollection (SecureHashCodeProvider.DefaultInvariant,
CaseInsensitiveComparer.DefaultInvariant);
+ secondPostData.Add (id, data [id]);
+ }
+ }
+--- /dev/null
++++
mono-2.10.8.1/mcs/class/System.Web/System.Web.Util/SecureHashCodeProvider.cs
+@@ -0,0 +1,131 @@
++//
++// System.Collections.SecureHashCodeProvider.cs
++//
++// Authors:
++// Sergey Chaban (se...@wildwestsoftware.com)
++// Andreas Nahr (classdevelopm...@a-softtech.com)
++// Sebastien Pouliot <sebast...@ximian.com>
++//
++// Copyright (C) 2004-2005 Novell, Inc (http://www.novell.com)
++// Copyright 2012 Xamarin, Inc (http://xamarin.com)
++//
++// Permission is hereby granted, free of charge, to any person obtaining
++// a copy of this software and associated documentation files (the
++// "Software"), to deal in the Software without restriction, including
++// without limitation the rights to use, copy, modify, merge, publish,
++// distribute, sublicense, and/or sell copies of the Software, and to
++// permit persons to whom the Software is furnished to do so, subject to
++// the following conditions:
++//
++// The above copyright notice and this permission notice shall be
++// included in all copies or substantial portions of the Software.
++//
++// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
++// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
++// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
++// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
++// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
++//
++using System;
++using System.Collections;
++using System.Globalization;
++
++namespace System.Web.Util
++{
++ class SecureHashCodeProvider : IHashCodeProvider
++ {
++ static readonly SecureHashCodeProvider singletonInvariant = new
SecureHashCodeProvider (CultureInfo.InvariantCulture);
++ static SecureHashCodeProvider singleton;
++ static readonly object sync = new object ();
++ static readonly int seed;
++
++ TextInfo m_text; // must match MS name for serialization
++
++ public static SecureHashCodeProvider Default {
++ get {
++ lock (sync) {
++ if (singleton == null) {
++ singleton = new
SecureHashCodeProvider ();
++ } else if (singleton.m_text == null) {
++ if (!AreEqual
(CultureInfo.CurrentCulture, CultureInfo.InvariantCulture))
++ singleton = new
SecureHashCodeProvider ();
++ } else if (!AreEqual (singleton.m_text,
CultureInfo.CurrentCulture)) {
++ singleton = new
SecureHashCodeProvider ();
++ }
++ return singleton;
++ }
++ }
++ }
++
++ public static SecureHashCodeProvider DefaultInvariant {
++ get { return singletonInvariant; }
++ }
++
++ static SecureHashCodeProvider ()
++ {
++ // It should be enough to fend off the attack described
in
++ // https://bugzilla.novell.com/show_bug.cgi?id=739119
++ // In order to predict value of the seed, the attacker
would have to know the exact time when
++ // the server process started and since it's a remote
attack, this is next to impossible.
++ // Using milliseconds instead of ticks here would make
it easier for the attackers since there
++ // would only be as many as 1000 possible values
++ seed = (int)DateTime.UtcNow.Ticks;
++ }
++
++ // Public instance constructor
++ public SecureHashCodeProvider ()
++ {
++ CultureInfo culture = CultureInfo.CurrentCulture;
++ if (!AreEqual (culture, CultureInfo.InvariantCulture))
++ m_text = CultureInfo.CurrentCulture.TextInfo;
++ }
++
++ public SecureHashCodeProvider (CultureInfo culture)
++ {
++ if (culture == null)
++ throw new ArgumentNullException ("culture");
++ if (!AreEqual (culture, CultureInfo.InvariantCulture))
++ m_text = culture.TextInfo;
++ }
++
++ static bool AreEqual (CultureInfo a, CultureInfo b)
++ {
++ return a.LCID == b.LCID;
++ }
++
++ static bool AreEqual (TextInfo info, CultureInfo culture)
++ {
++ return info.LCID == culture.LCID;
++ }
++
++ public int GetHashCode (object obj)
++ {
++ if (obj == null)
++ throw new ArgumentNullException ("obj");
++
++ string str = obj as string;
++
++ if (str == null)
++ return obj.GetHashCode ();
++
++ int h = seed;
++ char c;
++
++ if ((m_text != null) && !AreEqual (m_text,
CultureInfo.InvariantCulture)) {
++ str = m_text.ToLower (str);
++ for (int i = 0; i < str.Length; i++) {
++ c = str [i];
++ h = h * 31 + c;
++ }
++ } else {
++ for (int i = 0; i < str.Length; i++) {
++ c = Char.ToLower (str [i],
CultureInfo.InvariantCulture);
++ h = h * 31 + c;
++ }
++ }
++ return h;
++ }
++ }
++}
+--- mono-2.10.8.1.orig/mcs/class/System.Web/System.Web.dll.sources
++++ mono-2.10.8.1/mcs/class/System.Web/System.Web.dll.sources
+@@ -1174,6 +1174,7 @@ System.Web.Util/IWebPropertyAccessor.cs
+ System.Web.Util/MachineKeySectionUtils.cs
+ System.Web.Util/RuntimeHelpers.cs
+ System.Web.Util/SearchPattern.cs
++System.Web.Util/SecureHashCodeProvider.cs
+ System.Web.Util/SerializationHelper.cs
+ System.Web.Util/StrUtils.cs
+ System.Web.Util/TimeUtil.cs
+--- mono-2.10.8.1.orig/mcs/class/System.Web/System.Web/WebROCollection.cs
++++ mono-2.10.8.1/mcs/class/System.Web/System.Web/WebROCollection.cs
+@@ -5,6 +5,7 @@
+ // Gonzalo Paniagua Javier (gonz...@novell.com)
+ //
+ // (c) 2005-2009 Novell, Inc. (http://www.novell.com)
++// Copyright 2012 Xamarin, Inc (http://xamarin.com)
+ //
+ //
+ // Permission is hereby granted, free of charge, to any person obtaining
+@@ -26,8 +27,10 @@
+ // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ //
++using System.Collections;
+ using System.Collections.Specialized;
+ using System.Text;
++using System.Web.Util;
+
+ namespace System.Web
+ {
+@@ -36,7 +39,7 @@ namespace System.Web
+ bool got_id;
+ int id;
+
+- public WebROCollection () : base
(StringComparer.OrdinalIgnoreCase) { }
++ public WebROCollection () : base
(SecureHashCodeProvider.DefaultInvariant,
CaseInsensitiveComparer.DefaultInvariant) { }
+ public bool GotID {
+ get { return got_id; }
+ }
