From 519fc0a478a19c3e62c2a516cba3ed5fe92e1769 Mon Sep 17 00:00:00 2001
From: Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
Date: Wed, 27 Mar 2019 19:23:34 +0000
Subject: Fix CVE-2019-5010

- Bump PORTREVISION for package change

Obtained from:	https://github.com/python/cpython/commit/216a4d83c3b72f4fdcd81b588dc3f42cc461739a
Reference:	https://bugs.python.org/issue35746
Security:	d74371d2-4fee-11e9-a5cd-1df8a848de3d
MFH:		2019Q1
---
 lang/python36/Makefile             |  1 +
 lang/python36/files/patch-bpo35746 | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 lang/python36/files/patch-bpo35746

diff --git a/lang/python36/Makefile b/lang/python36/Makefile
index e4d9e671d219..c97febabb7fe 100644
--- a/lang/python36/Makefile
+++ b/lang/python36/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	python
 PORTVERSION=	${PYTHON_PORTVERSION}
+PORTREVISION=	1
 CATEGORIES=	lang python ipv6
 MASTER_SITES=	PYTHON/ftp/python/${PORTVERSION}
 PKGNAMESUFFIX=	${PYTHON_SUFFIX}
diff --git a/lang/python36/files/patch-bpo35746 b/lang/python36/files/patch-bpo35746
new file mode 100644
index 000000000000..6428afba06e5
--- /dev/null
+++ b/lang/python36/files/patch-bpo35746
@@ -0,0 +1,21 @@
+Obtained from:	https://github.com/python/cpython/commit/216a4d83c3b72f4fdcd81b588dc3f42cc461739a
+
+bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (GH-11573)
+
+Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
+distribution points with empty DP or URI correctly. A malicious or buggy
+certificate can result into segfault.
+
+--- Modules/_ssl.c.orig
++++ Modules/_ssl.c
+@@ -1338,6 +1338,10 @@ _get_crl_dp(X509 *certificate) {
+         STACK_OF(GENERAL_NAME) *gns;
+ 
+         dp = sk_DIST_POINT_value(dps, i);
++        if (dp->distpoint == NULL) {
++            /* Ignore empty DP value, CVE-2019-5010 */
++            continue;
++        }
+         gns = dp->distpoint->name.fullname;
+ 
+         for (j=0; j < sk_GENERAL_NAME_num(gns); j++) {
-- 
cgit v1.2.3