Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to devel-xorg-modular grimoire by Vlad Glagolev (48bccf19273995177d1468b5b749fe582917aaba)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to devel-xorg-modular grimoire by Vlad Glagolev (48bccf19273995177d1468b5b749fe582917aaba)
  • Date: Sat, 17 Nov 2012 07:06:11 -0600

GIT changes to devel-xorg-modular grimoire by Vlad Glagolev
<stealth AT sourcemage.org>:

ChangeLog | 3
e-17/e17/DEPENDS | 4
e-17/e17/HISTORY | 3
e-17/efl/CONFLICTS | 5
e-17/efl/DEPENDS | 8
e-17/efl/DETAILS | 20
e-17/efl/HISTORY | 2
e-17/efl/PREPARE | 2
e-17/efl/PRE_BUILD | 4
editors/scribus4/DETAILS | 4
editors/scribus4/HISTORY | 3
graphics-libs/tiff/CVE-2012-4564.patch | 29
graphics-libs/tiff/DETAILS | 2
graphics-libs/tiff/HISTORY | 5
graphics-libs/tiff/PRE_BUILD | 4
kernels/linux/HISTORY | 3
kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34 | 5
mail/exim/BUILD | 41
mail/exim/DETAILS | 6
mail/exim/FINAL | 3
mail/exim/HISTORY | 9
mail/exim/INSTALL | 5
mail/exim/PREPARE | 18
mail/mailx/BUILD | 4
mail/mailx/DEPENDS | 1
mail/mailx/HISTORY | 4
net/libproxy/BUILD | 2
net/libproxy/DETAILS | 5
net/libproxy/HISTORY | 9
net/libproxy/PRE_BUILD | 4
net/libproxy/unistd.patch | 39
python-pypi/roundup/DETAILS | 5
python-pypi/roundup/HISTORY | 3
utils/schroot/BUILD | 2
utils/schroot/HISTORY | 3
utils/xen/DETAILS | 2
utils/xen/HISTORY | 7
utils/xen/PRE_BUILD | 6
utils/xen/xsa-20.patch | 38
utils/xen/xsa-21.patch | 31
utils/xen/xsa-22.patch | 40
utils/xen/xsa-23.patch | 32
utils/xen/xsa-24.patch | 26
utils/xen/xsa-25.patch | 461
++++++++++
44 files changed, 819 insertions(+), 93 deletions(-)

New commits:
commit a4659cbe9c3b577ee7ad5261472a6e01f0e55804
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

mailx: fixed multijob build

commit 0ad79a45a7c2e6c4c3752e66d04b78d9957f9f68
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

mailx: added missing openssl dependency

commit 3ca7ca1ec8eb7292590fba85bf282e5e2876dafe
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

exim: => 4.80.1 (security)

commit 4b51ebd5b3c4a62df278a5e3ed598347550e059e
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

xen: security update

commit 8dec07e38ea380d0f1bf19f18061fcf14a056812
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

tiff: fixed CVE-2012-4564 (security)

commit c64071229575e42a5553c76226d6e5029dc54223
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

libproxy: security update

commit 36ecf941205ef888457b90cbd9479eae43ef332e
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

roundup: => 1.4.20 (security)

commit 03941634d87007ca5e6cbe8aa84c6ccc111fe23f
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

linux: => 3.2.34 (lts)

commit c9deb1ea4d0f99d6d687202752ec3717b052d71b
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

schroot: Fix OPTS

The space should be before, instead of after the string being appended.

commit 4965cb29506aa0934f221bffd586bdaf336f9009
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

libproxy: => 0.4.10

commit 162ad11937782ff77d46ffd0eab2c22c1cfd22ad
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Ladislav Hagara <hgr AT vabo.cz>

e17 now needs efl

other spells also need DEPENDS updated, no time now, tired...

commit 0068bd7278ee70d2eaa8d724f0567265cb09acd1
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Ladislav Hagara <hgr AT vabo.cz>

e-17/efl: new spell, collection of libraries

seems eina, eet, embryo, evas and eobj have been merged info efl
http://sourceforge.net/mailarchive/message.php?msg_id=30097726

commit 92ea033f2d9c20ad493570719f31a881704bd28b
Author: Andraž Levstik <ruskie+2054d253 AT codemages.net>
Commit: Andraž Levstik <ruskie+2054d253 AT codemages.net>

scribus4: removed oddly encoded unicode stuff

commit 5bb99589f0248fb1496d9440ed931a41cb45db85
Author: Pol Vinogradov <vin.public AT gmail.com>
Commit: Pol Vinogradov <vin.public AT gmail.com>

http/lightspark: version 0.7.0

diff --git a/ChangeLog b/ChangeLog
index 5ff5373..4958a4c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+2012-11-15 Ladislav Hagara <hgr AT vabo.cz>
+ * e-17/efl: new spell, collection of libraries
+
2012-11-10 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* graphics/argyllcms: new spell, software for creating color profiles
for
devices
diff --git a/e-17/e17/DEPENDS b/e-17/e17/DEPENDS
index 137ec41..51a51ac 100755
--- a/e-17/e17/DEPENDS
+++ b/e-17/e17/DEPENDS
@@ -1,10 +1,8 @@
depends subversion &&
+depends efl &&
depends e_dbus &&
depends edje &&
-depends eet &&
depends efreet &&
-depends eina &&
-depends evas &&
depends imlib2 &&
depends libxcursor &&
depends libxdamage &&
diff --git a/e-17/e17/HISTORY b/e-17/e17/HISTORY
index 99d34fe..f16c795 100644
--- a/e-17/e17/HISTORY
+++ b/e-17/e17/HISTORY
@@ -1,3 +1,6 @@
+2012-11-15 Ladislav Hagara <hgr AT vabo.cz>
+ * DEPENDS: eet, eina, evas -> efl
+
2011-11-13 Robin Cook <rcook AT wyrms.net>
* BUILD: changed to add configure options
* CONFIGURE: added ask module queries
diff --git a/e-17/efl/CONFLICTS b/e-17/efl/CONFLICTS
new file mode 100755
index 0000000..855763f
--- /dev/null
+++ b/e-17/efl/CONFLICTS
@@ -0,0 +1,5 @@
+conflicts eina &&
+conflicts eet &&
+conflicts embryo &&
+conflicts evas &&
+conflicts eobj
diff --git a/e-17/efl/DEPENDS b/e-17/efl/DEPENDS
new file mode 100755
index 0000000..cc679b6
--- /dev/null
+++ b/e-17/efl/DEPENDS
@@ -0,0 +1,8 @@
+depends subversion &&
+
+optional_depends check "" "" "Use check?" &&
+
+optional_depends doxygen \
+ "--enable-doc" \
+ "--disable-doc" \
+ "Build documentation?"
diff --git a/e-17/efl/DETAILS b/e-17/efl/DETAILS
new file mode 100755
index 0000000..f4cbf8a
--- /dev/null
+++ b/e-17/efl/DETAILS
@@ -0,0 +1,20 @@
+ SPELL=efl
+if [[ $EFL_AUTOUPDATE == y ]]; then
+ VERSION=$(date +%Y%m%d)
+else
+ VERSION=svn
+fi
+ SOURCE=$SPELL-svn.tar.bz2
+SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-svn
+ SOURCE_URL[0]=svn_http://svn.enlightenment.org/svn/e/trunk/$SPELL:$SPELL
+ FORCE_DOWNLOAD=on
+ SOURCE_IGNORE=volatile
+ WEB_SITE=http://www.enlightenment.org/
+ ENTERED=20121115
+ LICENSE[0]=BSD
+ SHORT="collection of libraries"
+cat << EOF
+EFL is a collection of libraries for handling many common tasks a
+developer man have such as data structures, communication, rendering,
+widgets and more.
+EOF
diff --git a/e-17/efl/HISTORY b/e-17/efl/HISTORY
new file mode 100644
index 0000000..c5bcbd8
--- /dev/null
+++ b/e-17/efl/HISTORY
@@ -0,0 +1,2 @@
+2012-11-15 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS, DEPENDS, PREPARE, PRE_BUILD, CONFLICTS: spell created
diff --git a/e-17/efl/PREPARE b/e-17/efl/PREPARE
new file mode 100755
index 0000000..f8b7d7e
--- /dev/null
+++ b/e-17/efl/PREPARE
@@ -0,0 +1,2 @@
+. ${GRIMOIRE}/FUNCTIONS &&
+prepare_select_branch
diff --git a/e-17/efl/PRE_BUILD b/e-17/efl/PRE_BUILD
new file mode 100755
index 0000000..1af1b77
--- /dev/null
+++ b/e-17/efl/PRE_BUILD
@@ -0,0 +1,4 @@
+default_pre_build &&
+cd $SOURCE_DIRECTORY &&
+
+NOCONFIGURE=ON ./autogen.sh
diff --git a/editors/scribus4/DETAILS b/editors/scribus4/DETAILS
index b255a29..6a196c6 100755
--- a/editors/scribus4/DETAILS
+++ b/editors/scribus4/DETAILS
@@ -18,8 +18,8 @@ SOURCE_DIRECTORY=${BUILD_DIRECTORY}/Scribus
KEYWORDS="qt editors"
SHORT="Scribus is a desktop publishing program based on QT4"
cat << EOF
-Scribus is a Layout program for Linux�, similar to Adobe� PageMaker,
-QuarkXPress or Adobe� InDesign, except that it is published under the GNU
GPL.
+Scribus is a Layout program for Linux, similar to Adobe PageMaker,
+QuarkXPress or Adobe InDesign, except that it is published under the GNU GPL.
Scribus has the ability to layout newsletters, create corporate stationery,
small posters and other documents which need flexible layout and/or the
ability to output to professional quality imagesetting equipment. You can do
diff --git a/editors/scribus4/HISTORY b/editors/scribus4/HISTORY
index 9d4f43e..57e4c9d 100644
--- a/editors/scribus4/HISTORY
+++ b/editors/scribus4/HISTORY
@@ -1,3 +1,6 @@
+2012-11-15 Andraž "ruskie" Levstik <ruskie+f03a580f AT codemages.net>
+ * DETAILS: fixed corrupted utf chars
+
2012-05-07 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 1.4.1, gpg.sig -> asc, SOURCE_DIRECTORY updated
* F60166DA.gpg: removed
diff --git a/graphics-libs/tiff/CVE-2012-4564.patch
b/graphics-libs/tiff/CVE-2012-4564.patch
new file mode 100644
index 0000000..7b2f773
--- /dev/null
+++ b/graphics-libs/tiff/CVE-2012-4564.patch
@@ -0,0 +1,29 @@
+--- a/tools/ppm2tiff.c
++++ b/tools/ppm2tiff.c
+@@ -85,6 +85,7 @@
+ int c;
+ extern int optind;
+ extern char* optarg;
++ tmsize_t scanline_size;
+
+ if (argc < 2) {
+ fprintf(stderr, "%s: Too few arguments\n", argv[0]);
+@@ -233,8 +234,16 @@
+ }
+ if (TIFFScanlineSize(out) > linebytes)
+ buf = (unsigned char *)_TIFFmalloc(linebytes);
+- else
+- buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
++ else {
++ scanline_size = TIFFScanlineSize(out);
++ if (scanline_size != 0)
++ buf = (unsigned char
*)_TIFFmalloc(TIFFScanlineSize(out));
++ else {
++ fprintf(stderr, "%s: scanline size
overflow\n",infile);
++ (void) TIFFClose(out);
++ exit(-2);
++ }
++ }
+ if (resolution > 0) {
+ TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
+ TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);
diff --git a/graphics-libs/tiff/DETAILS b/graphics-libs/tiff/DETAILS
index 76b311d..f592b56 100755
--- a/graphics-libs/tiff/DETAILS
+++ b/graphics-libs/tiff/DETAILS
@@ -1,5 +1,6 @@
SPELL=tiff
VERSION=4.0.3
+ SECURITY_PATCH=6
PATCHLEVEL=1

SOURCE_HASH=sha512:d80e18b00e9e696a30b954c0d92e5f2f773fd9a7a0a944cf6cabb69c1798e671506580daa1cd2ebf493ae922000170c2491dfc6d4c0a9cd0b865684070595a73
SOURCE=$SPELL-$VERSION.tar.gz
@@ -7,7 +8,6 @@ SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
SOURCE_URL[0]=ftp://ftp.remotesensing.org/pub/libtiff/$SOURCE
WEB_SITE=http://www.remotesensing.org/libtiff/
ENTERED=20010922
- SECURITY_PATCH=5
LICENSE[0]=LGPL
KEYWORDS="graphics libs"
SHORT="tiff provides support for the Tag Image File Format."
diff --git a/graphics-libs/tiff/HISTORY b/graphics-libs/tiff/HISTORY
index 20ddde0..64f440f 100644
--- a/graphics-libs/tiff/HISTORY
+++ b/graphics-libs/tiff/HISTORY
@@ -1,3 +1,8 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++
+ * PRE_BUILD: added, to apply the patch
+ * CVE-2012-4564.patch: added, fixes CVE-2012-4564 security issue
+
2012-09-23 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 4.0.3
SECURITY_PATCH++ : fixes CVE-2012-3401
diff --git a/graphics-libs/tiff/PRE_BUILD b/graphics-libs/tiff/PRE_BUILD
new file mode 100755
index 0000000..af23332
--- /dev/null
+++ b/graphics-libs/tiff/PRE_BUILD
@@ -0,0 +1,4 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+patch -p1 < "$SPELL_DIRECTORY/CVE-2012-4564.patch"
diff --git a/kernels/linux/HISTORY b/kernels/linux/HISTORY
index 06e84a4..74bc11f 100644
--- a/kernels/linux/HISTORY
+++ b/kernels/linux/HISTORY
@@ -1,3 +1,6 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * info/patches/maintenance_patches_3/patch-3.2.34: added
+
2012-11-05 Vlad Glagolev <stealth AT sourcemage.org>
* info/patches/maintenance_patches_3/patch-3.4.18: added
* info/patches/maintenance_patches_3/patch-3.0.51: added
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34
new file mode 100755
index 0000000..7e174d4
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34
@@ -0,0 +1,5 @@
+appliedkernels="3.2"
+patchversion="${appliedkernels}.34"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="64f4dafc30a40f4ef52fc9dffcef2cbe23ad3386"
diff --git a/mail/exim/BUILD b/mail/exim/BUILD
index afbabb3..a36d28e 100755
--- a/mail/exim/BUILD
+++ b/mail/exim/BUILD
@@ -1,33 +1,18 @@
create_account exim &&
create_account mail &&

-mkdir -p $INSTALL_ROOT/var/spool/mail &&
-chmod 1777 $INSTALL_ROOT/var/spool/mail &&
-chown exim:exim $INSTALL_ROOT/var/spool/mail &&
+# always correct permissions for older setups
+install -vm 2775 -d -o exim -g mail "$INSTALL_ROOT/var/spool/mail" &&

-if [[ -e $INSTALL_ROOT/var/spool/mail/db ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/db
-fi &&
-
-if [[ -e $INSTALL_ROOT/var/spool/mail/input ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/input
-fi &&
-
-if [[ -e $INSTALL_ROOT/var/spool/mail/log ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/log
-fi &&
-
-if [[ -e $INSTALL_ROOT/var/spool/mail/msglog ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/msglog
-fi &&
-
-chgrp -R exim $INSTALL_ROOT/var/spool/mail &&
+for maildir in db input msglog; do
+ if [[ -e $INSTALL_ROOT/var/spool/mail/$maildir ]]; then
+ chown -R exim:exim "$INSTALL_ROOT/var/spool/mail/$maildir"
+ else
+ install -vm 770 -d -o exim -g exim
"$INSTALL_ROOT/var/spool/mail/$maildir"
+ fi
+done &&

-mkdir -p Local &&
+mkdir -vp Local &&

if list_find "$OPTS" '--enable-x11-monitor'; then
cp src/EDITME Local/Makefile &&
@@ -191,5 +176,7 @@ echo "EXIM_GROUP=exim" >>
Local/Makefile &&
echo "PCRE_LIBS=-lpcre" >> Local/Makefile &&

sedit 's:tail \-1:tail \-n 1:' scripts/Configure-config.h &&
-make_single &&
-make
+
+make_single &&
+make &&
+make_normal
diff --git a/mail/exim/DETAILS b/mail/exim/DETAILS
index 6797df4..48f1354 100755
--- a/mail/exim/DETAILS
+++ b/mail/exim/DETAILS
@@ -1,12 +1,12 @@
SPELL=exim
- VERSION=4.77
- SECURITY_PATCH=6
+ VERSION=4.80.1
+ SECURITY_PATCH=7
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE2=$SOURCE.asc
SOURCE_GPG="exim.gpg:$SOURCE2:VERIFIED_UPSTREAM_KEY"
SOURCE2_IGNORE=signature
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
- SOURCE_SUBURI="exim/exim4/old"
+ SOURCE_SUBURI="exim/exim4"
if [[ "$EXIM_MIRRORS" == "austria" ]]; then
SOURCE_URL[0]=ftp://exim.inode.at/$SOURCE_SUBURI/$SOURCE
SOURCE2_URL[0]=ftp://exim.inode.at/$SOURCE_SUBURI/$SOURCE2
diff --git a/mail/exim/FINAL b/mail/exim/FINAL
index 801e9f7..d3bf9fe 100755
--- a/mail/exim/FINAL
+++ b/mail/exim/FINAL
@@ -1,6 +1,3 @@
-chgrp -R mail $INSTALL_ROOT/var/spool/mail &&
-chmod -R g+rw $INSTALL_ROOT/var/spool/mail &&
-
EXIM_SCHEDULE="0 * * * * /usr/sbin/exim -q" &&

if [ "$FCRON" == "y" ]
diff --git a/mail/exim/HISTORY b/mail/exim/HISTORY
index 6c899d9..345683d 100644
--- a/mail/exim/HISTORY
+++ b/mail/exim/HISTORY
@@ -1,3 +1,12 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 4.80.1; SECURITY_PATCH++; updated source
uri
+ * PREPARE: added query for 4.80 migration
+ * INSTALL: use 'default_install', corrected typo
+ * FINAL: dropped recursive permission changes
+ * BUILD: moved 'make_normal' here, verbosity++; simplified permission
+ changes for exim-only dirs; changed default permissions on
+ /var/spool/mail from 1777 to safer 2775 for basic security reasons
+
2012-09-20 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS, PREPARE: fixed urls, dropped outdated & broken; quoting
paths

diff --git a/mail/exim/INSTALL b/mail/exim/INSTALL
index 07e1def..98275e0 100755
--- a/mail/exim/INSTALL
+++ b/mail/exim/INSTALL
@@ -1,7 +1,6 @@
-make_normal &&
-make install &&
+default_install &&

-# copy usefull convert tool
+# copy useful convert tool
message "Look @ /usr/doc/exim/doc for convert tools..." &&
cp -v src/convert*.src doc/ &&

diff --git a/mail/exim/PREPARE b/mail/exim/PREPARE
index b0bab5c..7ad2d99 100755
--- a/mail/exim/PREPARE
+++ b/mail/exim/PREPARE
@@ -1,3 +1,21 @@
+. "$GRIMOIRE/FUNCTIONS" &&
+
+local OLD_SPELL_VERSION="" &&
+if spell_ok $SPELL; then
+ OLD_SPELL_VERSION="$(installed_version $SPELL)"
+ if is_version_less "${OLD_SPELL_VERSION}" "4.80"; then
+ message "${PROBLEM_COLOR}" &&
+ message "This is backwards-incompatible update of Exim." &&
+ message "You need to check README.UPDATING file and ChangeLog of Exim
4.80"
+ message "carefully before continuing." &&
+ message "${DEFAULT_COLOR}" &&
+
+ if ! query "Do you wish to upgrade Exim now?" n; then
+ return 1
+ fi
+ fi
+fi &&
+
config_query_list EXIM_MIRRORS \
"Which group of exim mirrors would you like to use?" \
"austria" \
diff --git a/mail/mailx/BUILD b/mail/mailx/BUILD
index 08e266f..79cfd89 100755
--- a/mail/mailx/BUILD
+++ b/mail/mailx/BUILD
@@ -1 +1,3 @@
-make PREFIX="$INSTALL_ROOT/usr" SENDMAIL="$INSTALL_ROOT/usr/sbin/sendmail"
+make_single &&
+make PREFIX="$INSTALL_ROOT/usr" SENDMAIL="$INSTALL_ROOT/usr/sbin/sendmail" &&
+make_normal
diff --git a/mail/mailx/DEPENDS b/mail/mailx/DEPENDS
new file mode 100755
index 0000000..ed472ed
--- /dev/null
+++ b/mail/mailx/DEPENDS
@@ -0,0 +1 @@
+depends openssl
diff --git a/mail/mailx/HISTORY b/mail/mailx/HISTORY
index dbe5962..14fe434 100644
--- a/mail/mailx/HISTORY
+++ b/mail/mailx/HISTORY
@@ -1,3 +1,7 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DEPENDS: added, for openssl required dependency
+ * BUILD: fixed multijob build
+
2010-04-16 Vlad Glagolev <stealth AT sourcemage.org>
* PRE_BUILD: added, to apply the patch
* openssl-1.patch: added, to fix compilation with openssl 1
diff --git a/net/libproxy/BUILD b/net/libproxy/BUILD
index 1a1ed52..3bed602 100755
--- a/net/libproxy/BUILD
+++ b/net/libproxy/BUILD
@@ -1,5 +1,5 @@
if [ "$LIBPROXY_WEBKIT" == "none" ]; then
- OPTS="-DWITH_WEBKIT=0 $OPTS"
+ OPTS="-DWITH_WEBKIT=0 $OPTS"
fi &&

cmake_build
diff --git a/net/libproxy/DETAILS b/net/libproxy/DETAILS
index 1df398a..119376b 100755
--- a/net/libproxy/DETAILS
+++ b/net/libproxy/DETAILS
@@ -1,6 +1,7 @@
SPELL=libproxy
- VERSION=0.4.7
-
SOURCE_HASH=sha512:a0a5f4f8faa2724ca88fb52f3f683f7270235536151089bfb34dd0f4164923abc586c7b621eb70bf0f53a0bf5a9807d3b31061803a0891c70d8e6dad1bbfe48d
+ VERSION=0.4.10
+ SECURITY_PATCH=1
+
SOURCE_HASH=sha512:d7400740290bffb66ced317692f6b6fdb3e9973e48af1287df51dd3813706164ac6ee6970bde0f7b28beed4a6b6086bf957d85ec8c543e4c0af7044defb88e82
SOURCE="${SPELL}-${VERSION}.tar.gz"
SOURCE_URL[0]=http://libproxy.googlecode.com/files/${SOURCE}
SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
diff --git a/net/libproxy/HISTORY b/net/libproxy/HISTORY
index ca6cc98..16dd4cb 100644
--- a/net/libproxy/HISTORY
+++ b/net/libproxy/HISTORY
@@ -1,3 +1,12 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: this was a security update (at least CVE-2012-4504);
+ SECURITY_PATCH=1
+ * BUILD: cleaned up
+
+2012-11-16 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 0.4.10
+ * PRE_BUILD, unistd.patch: deleted
+
2012-09-09 Robin Cook <rcook AT wyrms.net>
* DEPENDS: added optional depends network-manager, gconf2
* BUILD: set option for none on webkitgtk
diff --git a/net/libproxy/PRE_BUILD b/net/libproxy/PRE_BUILD
deleted file mode 100755
index 6fd1407..0000000
--- a/net/libproxy/PRE_BUILD
+++ /dev/null
@@ -1,4 +0,0 @@
-default_pre_build &&
-cd $SOURCE_DIRECTORY &&
-
-patch -p1 < $SPELL_DIRECTORY/unistd.patch
diff --git a/net/libproxy/unistd.patch b/net/libproxy/unistd.patch
deleted file mode 100644
index 9d5ccd3..0000000
--- a/net/libproxy/unistd.patch
+++ /dev/null
@@ -1,39 +0,0 @@
---- libproxy-0.4.7/libproxy/url.cpp.orig 2012-02-28 21:05:15.572948027
+0000
-+++ libproxy-0.4.7/libproxy/url.cpp 2012-02-28 21:05:45.635937474 +0000
-@@ -27,6 +27,7 @@
- #define close _close
- #endif
- #include <fcntl.h> // For ::open()
-+#include <unistd.h> // For ::read() and ::close()
- #include <cstring> // For memcpy()
- #include <sstream> // For int/string conversion (using stringstream)
- #include <cstdio> // For sscanf()
---- libproxy-0.4.7/libproxy/modules/config_sysconfig.cpp.orig 2012-02-28
21:06:01.552943358 +0000
-+++ libproxy-0.4.7/libproxy/modules/config_sysconfig.cpp 2012-02-28
21:11:21.429953982 +0000
-@@ -18,6 +18,7 @@
-
******************************************************************************/
-
- #include <sys/stat.h>
-+#include <unistd.h>
- #include <cstdlib>
- #include <map>
- #include <fstream>
---- libproxy-0.4.7/libproxy/modules/pacrunner_mozjs.cpp.orig 2012-02-28
21:06:11.637943033 +0000
-+++ libproxy-0.4.7/libproxy/modules/pacrunner_mozjs.cpp 2012-02-28
21:11:46.560961409 +0000
-@@ -17,6 +17,7 @@
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
-
******************************************************************************/
-
-+#include <unistd.h> // for ::gethostname()
- #include <cstring> // ?
-
- #include "../extension_pacrunner.hpp"
---- libproxy-0.4.7/libproxy/modules/pacrunner_webkit.cpp.orig 2012-02-28
21:06:29.615943614 +0000
-+++ libproxy-0.4.7/libproxy/modules/pacrunner_webkit.cpp 2012-02-28
21:12:35.530965553 +0000
-@@ -17,6 +17,7 @@
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
-
******************************************************************************/
-
-+#include <unistd.h> // for ::gethostname()
- #include "../extension_pacrunner.hpp"
- using namespace libproxy;
diff --git a/python-pypi/roundup/DETAILS b/python-pypi/roundup/DETAILS
index 5b77700..dcfa844 100755
--- a/python-pypi/roundup/DETAILS
+++ b/python-pypi/roundup/DETAILS
@@ -1,8 +1,9 @@
SPELL=roundup
- VERSION=1.4.19
+ VERSION=1.4.20
+ SECURITY_PATCH=1
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_URL[0]=http://pypi.python.org/packages/source/r/$SPELL/$SOURCE
-
SOURCE_HASH=sha512:497cad23e1074e535cf2729d52f07ec2103c89e5c0927be678f02299c036dac6dc262fe909310e066588f00144151b98b55a7dfd8c1df28680f99fecc255236e
+
SOURCE_HASH=sha512:62a1ca744afb7e17a4e165d695e1623d73810a3d3e6c374a4b73d010fcc3e93756ca0bfb6dc4cf7937acd1156c4b938e881e2e9ffd9b0c8e4c4366b730cc43b1
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
WEB_SITE=http://roundup.sourceforge.net/
LICENSE[0]=PYTHON
diff --git a/python-pypi/roundup/HISTORY b/python-pypi/roundup/HISTORY
index 3c1016e..ac65baf 100644
--- a/python-pypi/roundup/HISTORY
+++ b/python-pypi/roundup/HISTORY
@@ -1,3 +1,6 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 1.4.20; SECURITY_PATCH++
+
2011-07-16 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 1.4.19

diff --git a/utils/schroot/BUILD b/utils/schroot/BUILD
index 61d03a7..10f70e0 100755
--- a/utils/schroot/BUILD
+++ b/utils/schroot/BUILD
@@ -1,2 +1,2 @@
-OPTS+='--enable-shared ' &&
+OPTS+=' --enable-shared' &&
default_build
diff --git a/utils/schroot/HISTORY b/utils/schroot/HISTORY
index c505ebc..264fce6 100644
--- a/utils/schroot/HISTORY
+++ b/utils/schroot/HISTORY
@@ -1,3 +1,6 @@
+2012-11-16 Ismael Luceno <ismael.luceno AT gmail.com>
+ * BUILD: Fixed OPTS
+
2012-08-13 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 1.5.3
* DEPENDS: linux-pam is optional, add e2fsprogs, doxygen
diff --git a/utils/xen/DETAILS b/utils/xen/DETAILS
index e04dcd6..b6a56f2 100755
--- a/utils/xen/DETAILS
+++ b/utils/xen/DETAILS
@@ -1,6 +1,6 @@
SPELL=xen
VERSION=4.1.3
- SECURITY_PATCH=2
+ SECURITY_PATCH=3
SOURCE=${SPELL}-${VERSION}.tar.gz
SOURCE2=$SOURCE.sig
SOURCE2_IGNORE=signature
diff --git a/utils/xen/HISTORY b/utils/xen/HISTORY
index 7ce226d..72ba730 100644
--- a/utils/xen/HISTORY
+++ b/utils/xen/HISTORY
@@ -1,3 +1,10 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++
+ * PRE_BUILD: apply patches
+ * xsa-{20-25}.patch: added, to fix CVE-2012-4535, CVE-2012-4536,
+ CVE-2012-4537, CVE-2012-4538, CVE-2012-4539, CVE-2012-4544,
+ CVE-2012-2625
+
2012-08-19 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: SECURITY_PATCH++
* xsa-19.patch: added, to fix CVE-2012-4411
diff --git a/utils/xen/PRE_BUILD b/utils/xen/PRE_BUILD
index 4a7ade4..ec73184 100755
--- a/utils/xen/PRE_BUILD
+++ b/utils/xen/PRE_BUILD
@@ -2,6 +2,12 @@ default_pre_build &&
cd ${SOURCE_DIRECTORY} &&

patch -p0 < "$SPELL_DIRECTORY/xsa-19.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-20.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-21.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-22.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-23.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-24.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-25.patch" &&

if [[ $XEN_UPINIT != y ]]; then
sedit "s:all install-initd:all:" tools/hotplug/Linux/Makefile
diff --git a/utils/xen/xsa-20.patch b/utils/xen/xsa-20.patch
new file mode 100644
index 0000000..bedd318
--- /dev/null
+++ b/utils/xen/xsa-20.patch
@@ -0,0 +1,38 @@
+VCPU/timers: Prevent overflow in calculations, leading to DoS vulnerability
+
+The timer action for a vcpu periodic timer is to calculate the next
+expiry time, and to reinsert itself into the timer queue. If the
+deadline ends up in the past, Xen never leaves __do_softirq(). The
+affected PCPU will stay in an infinite loop until Xen is killed by the
+watchdog (if enabled).
+
+This is a security problem, XSA-20 / CVE-2012-4535.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 478ba3f146df xen/common/domain.c
+--- a/xen/common/domain.c
++++ b/xen/common/domain.c
+@@ -903,6 +903,9 @@ long do_vcpu_op(int cmd, int vcpuid, XEN
+ if ( set.period_ns < MILLISECS(1) )
+ return -EINVAL;
+
++ if ( set.period_ns > STIME_DELTA_MAX )
++ return -EINVAL;
++
+ v->periodic_period = set.period_ns;
+ vcpu_force_reschedule(v);
+
+diff -r 478ba3f146df xen/include/xen/time.h
+--- a/xen/include/xen/time.h
++++ b/xen/include/xen/time.h
+@@ -55,6 +55,8 @@ struct tm gmtime(unsigned long t);
+ #define MILLISECS(_ms) ((s_time_t)((_ms) * 1000000ULL))
+ #define MICROSECS(_us) ((s_time_t)((_us) * 1000ULL))
+ #define STIME_MAX ((s_time_t)((uint64_t)~0ull>>1))
++/* Chosen so (NOW() + delta) wont overflow without an uptime of 200 years */
++#define STIME_DELTA_MAX ((s_time_t)((uint64_t)~0ull>>2))
+
+ extern void update_vcpu_system_time(struct vcpu *v);
+ extern void update_domain_wallclock_time(struct domain *d);
diff --git a/utils/xen/xsa-21.patch b/utils/xen/xsa-21.patch
new file mode 100644
index 0000000..14158ef
--- /dev/null
+++ b/utils/xen/xsa-21.patch
@@ -0,0 +1,31 @@
+x86/physdev: Range check pirq parameter from guests
+
+Otherwise Xen will read beyond either end of the struct
+domain.arch.pirq_emuirq array, usually resulting in a fatal page fault.
+
+This vulnerability was introduced by c/s 23241:d21100f1d00e, which adds
+a call to domain_pirq_to_emuirq() which uses the guest provided pirq
+value before range checking it, and was fixed by c/s 23573:584c2e5e03d9
+which changed the behaviour of the domain_pirq_to_emuirq() macro to use
+radix trees instead of a flat array.
+
+This is XSA-21 / CVE-2012-4536.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 7a401a73d86d xen/arch/x86/physdev.c
+--- a/xen/arch/x86/physdev.c
++++ b/xen/arch/x86/physdev.c
+@@ -234,6 +234,10 @@ static int physdev_unmap_pirq(struct phy
+ if ( ret )
+ return ret;
+
++ ret = -EINVAL;
++ if ( unmap->pirq < 0 || unmap->pirq >= d->nr_pirqs )
++ goto free_domain;
++
+ if ( is_hvm_domain(d) )
+ {
+ spin_lock(&d->event_lock);
diff --git a/utils/xen/xsa-22.patch b/utils/xen/xsa-22.patch
new file mode 100644
index 0000000..bb2b88e
--- /dev/null
+++ b/utils/xen/xsa-22.patch
@@ -0,0 +1,40 @@
+x86/physmap: Prevent incorrect updates of m2p mappings
+
+In certain conditions, such as low memory, set_p2m_entry() can fail.
+Currently, the p2m and m2p tables will get out of sync because we still
+update the m2p table after the p2m update has failed.
+
+If that happens, subsequent guest-invoked memory operations can cause
+BUG()s and ASSERT()s to kill Xen.
+
+This is fixed by only updating the m2p table iff the p2m was
+successfully updated.
+
+This is a security problem, XSA-22 / CVE-2012-4537.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+diff -r 3a27f4e44b6a xen/arch/x86/mm/p2m.c
+--- a/xen/arch/x86/mm/p2m.c
++++ b/xen/arch/x86/mm/p2m.c
+@@ -2558,7 +2558,10 @@ guest_physmap_add_entry(struct p2m_domai
+ if ( mfn_valid(_mfn(mfn)) )
+ {
+ if ( !set_p2m_entry(p2m, gfn, _mfn(mfn), page_order, t,
p2m->default_access) )
++ {
+ rc = -EINVAL;
++ goto out; /* Failed to update p2m, bail without updating m2p. */
++ }
+ if ( !p2m_is_grant(t) )
+ {
+ for ( i = 0; i < (1UL << page_order); i++ )
+@@ -2579,6 +2582,7 @@ guest_physmap_add_entry(struct p2m_domai
+ }
+ }
+
++out:
+ audit_p2m(p2m, 1);
+ p2m_unlock(p2m);
+
diff --git a/utils/xen/xsa-23.patch b/utils/xen/xsa-23.patch
new file mode 100644
index 0000000..82cb8b9
--- /dev/null
+++ b/utils/xen/xsa-23.patch
@@ -0,0 +1,32 @@
+xen/mm/shadow: check toplevel pagetables are present before unhooking them.
+
+If the guest has not fully populated its top-level PAE entries when it calls
+HVMOP_pagetable_dying, the shadow code could try to unhook entries from
+MFN 0. Add a check to avoid that case.
+
+This issue was introduced by c/s 21239:b9d2db109cf5.
+
+This is a security problem, XSA-23 / CVE-2012-4538.
+
+Signed-off-by: Tim Deegan <tim AT xen.org>
+Tested-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r bfd22d40db06 xen/arch/x86/mm/shadow/multi.c
+--- a/xen/arch/x86/mm/shadow/multi.c
++++ b/xen/arch/x86/mm/shadow/multi.c
+@@ -4737,8 +4737,12 @@ static void sh_pagetable_dying(struct vc
+ }
+ for ( i = 0; i < 4; i++ )
+ {
+- if ( fast_path )
+- smfn = _mfn(pagetable_get_pfn(v->arch.shadow_table[i]));
++ if ( fast_path ) {
++ if ( pagetable_is_null(v->arch.shadow_table[i]) )
++ smfn = _mfn(INVALID_MFN);
++ else
++ smfn = _mfn(pagetable_get_pfn(v->arch.shadow_table[i]));
++ }
+ else
+ {
+ /* retrieving the l2s */
diff --git a/utils/xen/xsa-24.patch b/utils/xen/xsa-24.patch
new file mode 100644
index 0000000..e46f513
--- /dev/null
+++ b/utils/xen/xsa-24.patch
@@ -0,0 +1,26 @@
+compat/gnttab: Prevent infinite loop in compat code
+
+c/s 20281:95ea2052b41b, which introduces Grant Table version 2
+hypercalls introduces a vulnerability whereby the compat hypercall
+handler can fall into an infinite loop.
+
+If the watchdog is enabled, Xen will die after the timeout.
+
+This is a security problem, XSA-24 / CVE-2012-4539.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+diff -r bac883cf805a xen/common/compat/grant_table.c
+--- a/xen/common/compat/grant_table.c
++++ b/xen/common/compat/grant_table.c
+@@ -318,6 +318,8 @@ int compat_grant_table_op(unsigned int c
+ #undef XLAT_gnttab_get_status_frames_HNDL_frame_list
+ if ( unlikely(__copy_to_guest(cmp_uop, &cmp.get_status, 1))
)
+ rc = -EFAULT;
++ else
++ i = 1;
+ }
+ break;
+ }
diff --git a/utils/xen/xsa-25.patch b/utils/xen/xsa-25.patch
new file mode 100644
index 0000000..f8a9be2
--- /dev/null
+++ b/utils/xen/xsa-25.patch
@@ -0,0 +1,461 @@
+libxc: builder: limit maximum size of kernel/ramdisk.
+
+Allowing user supplied kernels of arbitrary sizes, especially during
+decompression, can swallow up dom0 memory leading to either virtual
+address space exhaustion in the builder process or allocation
+failures/OOM killing of both toolstack and unrelated processes.
+
+We disable these checks when building in a stub domain for pvgrub
+since this uses the guest's own memory and is isolated.
+
+Decompression of gzip compressed kernels and ramdisks has been safe
+since 14954:58205257517d (Xen 3.1.0 onwards).
+
+This is XSA-25 / CVE-2012-4544.
+
+Also make explicit checks for buffer overflows in various
+decompression routines. These were already ruled out due to other
+properties of the code but check them as a belt-and-braces measure.
+
+Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+[ Includes 25589:60f09d1ab1fe for CVE-2012-2625 ]
+
+diff --git a/stubdom/grub/kexec.c b/stubdom/grub/kexec.c
+index 06bef52..b21c91a 100644
+--- a/stubdom/grub/kexec.c
++++ b/stubdom/grub/kexec.c
+@@ -137,6 +137,10 @@ void kexec(void *kernel, long kernel_size, void
*module, long module_size, char
+ dom = xc_dom_allocate(xc_handle, cmdline, features);
+ dom->allocate = kexec_allocate;
+
++ /* We are using guest owned memory, therefore no limits. */
++ xc_dom_kernel_max_size(dom, 0);
++ xc_dom_ramdisk_max_size(dom, 0);
++
+ dom->kernel_blob = kernel;
+ dom->kernel_size = kernel_size;
+
+diff --git a/tools/libxc/xc_dom.h b/tools/libxc/xc_dom.h
+index e72f066..7043f96 100644
+--- a/tools/libxc/xc_dom.h
++++ b/tools/libxc/xc_dom.h
+@@ -52,6 +52,9 @@ struct xc_dom_image {
+ void *ramdisk_blob;
+ size_t ramdisk_size;
+
++ size_t max_kernel_size;
++ size_t max_ramdisk_size;
++
+ /* arguments and parameters */
+ char *cmdline;
+ uint32_t f_requested[XENFEAT_NR_SUBMAPS];
+@@ -175,6 +178,23 @@ void xc_dom_release_phys(struct xc_dom_image *dom);
+ void xc_dom_release(struct xc_dom_image *dom);
+ int xc_dom_mem_init(struct xc_dom_image *dom, unsigned int mem_mb);
+
++/* Set this larger if you have enormous ramdisks/kernels. Note that
++ * you should trust all kernels not to be maliciously large (e.g. to
++ * exhaust all dom0 memory) if you do this (see CVE-2012-4544 /
++ * XSA-25). You can also set the default independently for
++ * ramdisks/kernels in xc_dom_allocate() or call
++ * xc_dom_{kernel,ramdisk}_max_size.
++ */
++#ifndef XC_DOM_DECOMPRESS_MAX
++#define XC_DOM_DECOMPRESS_MAX (1024*1024*1024) /* 1GB */
++#endif
++
++int xc_dom_kernel_check_size(struct xc_dom_image *dom, size_t sz);
++int xc_dom_kernel_max_size(struct xc_dom_image *dom, size_t sz);
++
++int xc_dom_ramdisk_check_size(struct xc_dom_image *dom, size_t sz);
++int xc_dom_ramdisk_max_size(struct xc_dom_image *dom, size_t sz);
++
+ size_t xc_dom_check_gzip(xc_interface *xch,
+ void *blob, size_t ziplen);
+ int xc_dom_do_gunzip(xc_interface *xch,
+@@ -224,7 +244,8 @@ void xc_dom_log_memory_footprint(struct xc_dom_image
*dom);
+ void *xc_dom_malloc(struct xc_dom_image *dom, size_t size);
+ void *xc_dom_malloc_page_aligned(struct xc_dom_image *dom, size_t size);
+ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
+- const char *filename, size_t * size);
++ const char *filename, size_t * size,
++ const size_t max_size);
+ char *xc_dom_strdup(struct xc_dom_image *dom, const char *str);
+
+ /* --- alloc memory pool ------------------------------------------- */
+diff --git a/tools/libxc/xc_dom_bzimageloader.c
b/tools/libxc/xc_dom_bzimageloader.c
+index 9852e67..73cfad1 100644
+--- a/tools/libxc/xc_dom_bzimageloader.c
++++ b/tools/libxc/xc_dom_bzimageloader.c
+@@ -47,13 +47,19 @@ static int xc_try_bzip2_decode(
+ char *out_buf;
+ char *tmp_buf;
+ int retval = -1;
+- int outsize;
++ unsigned int outsize;
+ uint64_t total;
+
+ stream.bzalloc = NULL;
+ stream.bzfree = NULL;
+ stream.opaque = NULL;
+
++ if ( dom->kernel_size == 0)
++ {
++ DOMPRINTF("BZIP2: Input is 0 size");
++ return -1;
++ }
++
+ ret = BZ2_bzDecompressInit(&stream, 0, 0);
+ if ( ret != BZ_OK )
+ {
+@@ -66,6 +72,17 @@ static int xc_try_bzip2_decode(
+ * the input buffer to start, and we'll realloc as needed.
+ */
+ outsize = dom->kernel_size;
++
++ /*
++ * stream.avail_in and outsize are unsigned int, while kernel_size
++ * is a size_t. Check we aren't overflowing.
++ */
++ if ( outsize != dom->kernel_size )
++ {
++ DOMPRINTF("BZIP2: Input too large");
++ goto bzip2_cleanup;
++ }
++
+ out_buf = malloc(outsize);
+ if ( out_buf == NULL )
+ {
+@@ -98,13 +115,20 @@ static int xc_try_bzip2_decode(
+ if ( stream.avail_out == 0 )
+ {
+ /* Protect against output buffer overflow */
+- if ( outsize > INT_MAX / 2 )
++ if ( outsize > UINT_MAX / 2 )
+ {
+ DOMPRINTF("BZIP2: output buffer overflow");
+ free(out_buf);
+ goto bzip2_cleanup;
+ }
+
++ if ( xc_dom_kernel_check_size(dom, outsize * 2) )
++ {
++ DOMPRINTF("BZIP2: output too large");
++ free(out_buf);
++ goto bzip2_cleanup;
++ }
++
+ tmp_buf = realloc(out_buf, outsize * 2);
+ if ( tmp_buf == NULL )
+ {
+@@ -172,9 +196,15 @@ static int xc_try_lzma_decode(
+ unsigned char *out_buf;
+ unsigned char *tmp_buf;
+ int retval = -1;
+- int outsize;
++ size_t outsize;
+ const char *msg;
+
++ if ( dom->kernel_size == 0)
++ {
++ DOMPRINTF("LZMA: Input is 0 size");
++ return -1;
++ }
++
+ ret = lzma_alone_decoder(&stream, 128*1024*1024);
+ if ( ret != LZMA_OK )
+ {
+@@ -251,13 +281,20 @@ static int xc_try_lzma_decode(
+ if ( stream.avail_out == 0 )
+ {
+ /* Protect against output buffer overflow */
+- if ( outsize > INT_MAX / 2 )
++ if ( outsize > SIZE_MAX / 2 )
+ {
+ DOMPRINTF("LZMA: output buffer overflow");
+ free(out_buf);
+ goto lzma_cleanup;
+ }
+
++ if ( xc_dom_kernel_check_size(dom, outsize * 2) )
++ {
++ DOMPRINTF("LZMA: output too large");
++ free(out_buf);
++ goto lzma_cleanup;
++ }
++
+ tmp_buf = realloc(out_buf, outsize * 2);
+ if ( tmp_buf == NULL )
+ {
+@@ -327,6 +364,12 @@ static int xc_try_lzo1x_decode(
+ 0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
+ };
+
++ /*
++ * lzo_uint should match size_t. Check that this is the case to be
++ * sure we won't overflow various lzo_uint fields.
++ */
++ XC_BUILD_BUG_ON(sizeof(lzo_uint) != sizeof(size_t));
++
+ ret = lzo_init();
+ if ( ret != LZO_E_OK )
+ {
+@@ -406,6 +449,14 @@ static int xc_try_lzo1x_decode(
+ if ( src_len <= 0 || src_len > dst_len || src_len > left )
+ break;
+
++ msg = "Output buffer overflow";
++ if ( *size > SIZE_MAX - dst_len )
++ break;
++
++ msg = "Decompressed image too large";
++ if ( xc_dom_kernel_check_size(dom, *size + dst_len) )
++ break;
++
+ msg = "Failed to (re)alloc memory";
+ tmp_buf = realloc(out_buf, *size + dst_len);
+ if ( tmp_buf == NULL )
+diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
+index fea9de5..2a01d7c 100644
+--- a/tools/libxc/xc_dom_core.c
++++ b/tools/libxc/xc_dom_core.c
+@@ -159,7 +159,8 @@ void *xc_dom_malloc_page_aligned(struct xc_dom_image
*dom, size_t size)
+ }
+
+ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
+- const char *filename, size_t * size)
++ const char *filename, size_t * size,
++ const size_t max_size)
+ {
+ struct xc_dom_mem *block = NULL;
+ int fd = -1;
+@@ -171,6 +172,13 @@ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
+ lseek(fd, 0, SEEK_SET);
+ *size = lseek(fd, 0, SEEK_END);
+
++ if ( max_size && *size > max_size )
++ {
++ xc_dom_panic(dom->xch, XC_OUT_OF_MEMORY,
++ "tried to map file which is too large");
++ goto err;
++ }
++
+ block = malloc(sizeof(*block));
+ if ( block == NULL )
+ goto err;
+@@ -222,6 +230,40 @@ char *xc_dom_strdup(struct xc_dom_image *dom, const
char *str)
+ }
+
+ /* ------------------------------------------------------------------------
*/
++/* decompression buffer sizing
*/
++int xc_dom_kernel_check_size(struct xc_dom_image *dom, size_t sz)
++{
++ /* No limit */
++ if ( !dom->max_kernel_size )
++ return 0;
++
++ if ( sz > dom->max_kernel_size )
++ {
++ xc_dom_panic(dom->xch, XC_INVALID_KERNEL,
++ "kernel image too large");
++ return 1;
++ }
++
++ return 0;
++}
++
++int xc_dom_ramdisk_check_size(struct xc_dom_image *dom, size_t sz)
++{
++ /* No limit */
++ if ( !dom->max_ramdisk_size )
++ return 0;
++
++ if ( sz > dom->max_ramdisk_size )
++ {
++ xc_dom_panic(dom->xch, XC_INVALID_KERNEL,
++ "ramdisk image too large");
++ return 1;
++ }
++
++ return 0;
++}
++
++/* ------------------------------------------------------------------------
*/
+ /* read files, copy memory blocks, with transparent gunzip
*/
+
+ size_t xc_dom_check_gzip(xc_interface *xch, void *blob, size_t ziplen)
+@@ -235,7 +277,7 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob,
size_t ziplen)
+
+ gzlen = blob + ziplen - 4;
+ unziplen = gzlen[3] << 24 | gzlen[2] << 16 | gzlen[1] << 8 | gzlen[0];
+- if ( (unziplen < 0) || (unziplen > (1024*1024*1024)) ) /* 1GB limit */
++ if ( (unziplen < 0) || (unziplen > XC_DOM_DECOMPRESS_MAX) )
+ {
+ xc_dom_printf
+ (xch,
+@@ -288,6 +330,9 @@ int xc_dom_try_gunzip(struct xc_dom_image *dom, void
**blob, size_t * size)
+ if ( unziplen == 0 )
+ return 0;
+
++ if ( xc_dom_kernel_check_size(dom, unziplen) )
++ return 0;
++
+ unzip = xc_dom_malloc(dom, unziplen);
+ if ( unzip == NULL )
+ return -1;
+@@ -588,6 +633,9 @@ struct xc_dom_image *xc_dom_allocate(xc_interface *xch,
+ memset(dom, 0, sizeof(*dom));
+ dom->xch = xch;
+
++ dom->max_kernel_size = XC_DOM_DECOMPRESS_MAX;
++ dom->max_ramdisk_size = XC_DOM_DECOMPRESS_MAX;
++
+ if ( cmdline )
+ dom->cmdline = xc_dom_strdup(dom, cmdline);
+ if ( features )
+@@ -608,10 +656,25 @@ struct xc_dom_image *xc_dom_allocate(xc_interface *xch,
+ return NULL;
+ }
+
++int xc_dom_kernel_max_size(struct xc_dom_image *dom, size_t sz)
++{
++ DOMPRINTF("%s: kernel_max_size=%zx", __FUNCTION__, sz);
++ dom->max_kernel_size = sz;
++ return 0;
++}
++
++int xc_dom_ramdisk_max_size(struct xc_dom_image *dom, size_t sz)
++{
++ DOMPRINTF("%s: ramdisk_max_size=%zx", __FUNCTION__, sz);
++ dom->max_ramdisk_size = sz;
++ return 0;
++}
++
+ int xc_dom_kernel_file(struct xc_dom_image *dom, const char *filename)
+ {
+ DOMPRINTF("%s: filename=\"%s\"", __FUNCTION__, filename);
+- dom->kernel_blob = xc_dom_malloc_filemap(dom, filename,
&dom->kernel_size);
++ dom->kernel_blob = xc_dom_malloc_filemap(dom, filename,
&dom->kernel_size,
++ dom->max_kernel_size);
+ if ( dom->kernel_blob == NULL )
+ return -1;
+ return xc_dom_try_gunzip(dom, &dom->kernel_blob, &dom->kernel_size);
+@@ -621,7 +684,9 @@ int xc_dom_ramdisk_file(struct xc_dom_image *dom, const
char *filename)
+ {
+ DOMPRINTF("%s: filename=\"%s\"", __FUNCTION__, filename);
+ dom->ramdisk_blob =
+- xc_dom_malloc_filemap(dom, filename, &dom->ramdisk_size);
++ xc_dom_malloc_filemap(dom, filename, &dom->ramdisk_size,
++ dom->max_ramdisk_size);
++
+ if ( dom->ramdisk_blob == NULL )
+ return -1;
+ // return xc_dom_try_gunzip(dom, &dom->ramdisk_blob, &dom->ramdisk_size);
+@@ -781,7 +846,11 @@ int xc_dom_build_image(struct xc_dom_image *dom)
+ void *ramdiskmap;
+
+ unziplen = xc_dom_check_gzip(dom->xch, dom->ramdisk_blob,
dom->ramdisk_size);
++ if ( xc_dom_ramdisk_check_size(dom, unziplen) != 0 )
++ unziplen = 0;
++
+ ramdisklen = unziplen ? unziplen : dom->ramdisk_size;
++
+ if ( xc_dom_alloc_segment(dom, &dom->ramdisk_seg, "ramdisk", 0,
+ ramdisklen) != 0 )
+ goto err;
+diff --git a/tools/pygrub/src/pygrub b/tools/pygrub/src/pygrub
+index 17c0083..1a3c1c3 100644
+--- a/tools/pygrub/src/pygrub
++++ b/tools/pygrub/src/pygrub
+@@ -28,6 +28,7 @@ import grub.LiloConf
+ import grub.ExtLinuxConf
+
+ PYGRUB_VER = 0.6
++FS_READ_MAX = 1024 * 1024
+
+ def enable_cursor(ison):
+ if ison:
+@@ -421,7 +422,8 @@ class Grub:
+ if self.__dict__.get('cf', None) is None:
+ raise RuntimeError, "couldn't find bootloader config file in
the image provided."
+ f = fs.open_file(self.cf.filename)
+- buf = f.read()
++ # limit read size to avoid pathological cases
++ buf = f.read(FS_READ_MAX)
+ del f
+ self.cf.parse(buf)
+
+@@ -670,6 +672,37 @@ if __name__ == "__main__":
+ def usage():
+ print >> sys.stderr, "Usage: %s [-q|--quiet] [-i|--interactive]
[-n|--not-really] [--output=] [--kernel=] [--ramdisk=] [--args=] [--entry=]
[--output-directory=] [--output-format=sxp|simple|simple0] <image>"
%(sys.argv[0],)
+
++ def copy_from_image(fs, file_to_read, file_type, output_directory,
++ not_really):
++ if not_really:
++ if fs.file_exists(file_to_read):
++ return "<%s:%s>" % (file_type, file_to_read)
++ else:
++ sys.exit("The requested %s file does not exist" % file_type)
++ try:
++ datafile = fs.open_file(file_to_read)
++ except Exception, e:
++ print >>sys.stderr, e
++ sys.exit("Error opening %s in guest" % file_to_read)
++ (tfd, ret) = tempfile.mkstemp(prefix="boot_"+file_type+".",
++ dir=output_directory)
++ dataoff = 0
++ while True:
++ data = datafile.read(FS_READ_MAX, dataoff)
++ if len(data) == 0:
++ os.close(tfd)
++ del datafile
++ return ret
++ try:
++ os.write(tfd, data)
++ except Exception, e:
++ print >>sys.stderr, e
++ os.close(tfd)
++ os.unlink(ret)
++ del datafile
++ sys.exit("Error writing temporary copy of "+file_type)
++ dataoff += len(data)
++
+ try:
+ opts, args = getopt.gnu_getopt(sys.argv[1:], 'qinh::',
+ ["quiet", "interactive", "not-really",
"help",
+@@ -786,24 +819,18 @@ if __name__ == "__main__":
+ if not fs:
+ raise RuntimeError, "Unable to find partition containing kernel"
+
+- if not_really:
+- bootcfg["kernel"] = "<kernel:%s>" % chosencfg["kernel"]
+- else:
+- data = fs.open_file(chosencfg["kernel"]).read()
+- (tfd, bootcfg["kernel"]) = tempfile.mkstemp(prefix="boot_kernel.",
+- dir=output_directory)
+- os.write(tfd, data)
+- os.close(tfd)
++ bootcfg["kernel"] = copy_from_image(fs, chosencfg["kernel"], "kernel",
++ output_directory, not_really)
+
+ if chosencfg["ramdisk"]:
+- if not_really:
+- bootcfg["ramdisk"] = "<ramdisk:%s>" % chosencfg["ramdisk"]
+- else:
+- data = fs.open_file(chosencfg["ramdisk"],).read()
+- (tfd, bootcfg["ramdisk"]) = tempfile.mkstemp(
+- prefix="boot_ramdisk.", dir=output_directory)
+- os.write(tfd, data)
+- os.close(tfd)
++ try:
++ bootcfg["ramdisk"] = copy_from_image(fs, chosencfg["ramdisk"],
++ "ramdisk",
output_directory,
++ not_really)
++ except:
++ if not not_really:
++ os.unlink(bootcfg["kernel"])
++ raise
+ else:
+ initrd = None
+



  • [SM-Commit] GIT changes to devel-xorg-modular grimoire by Vlad Glagolev (48bccf19273995177d1468b5b749fe582917aaba), Vlad Glagolev, 11/17/2012

Archive powered by MHonArc 2.6.24.

Top of Page