Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (3dcd43396b0096114d7c1e1a45b2707ca03f5116)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Pavel Vinogradov <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (3dcd43396b0096114d7c1e1a45b2707ca03f5116)
  • Date: Sat, 20 Feb 2016 20:36:48 +0000

GIT changes to master grimoire by Pavel Vinogradov <public AT sourcemage.org>:

libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch |
51 --
libs/glibc/10_all_glibc-CVE-2015-7547.patch |
230 ----------
libs/glibc/DETAILS |
4
libs/glibc/HISTORY |
8
libs/glibc/PRE_BUILD |
2
5 files changed, 10 insertions(+), 285 deletions(-)

New commits:
commit 3dcd43396b0096114d7c1e1a45b2707ca03f5116
Author: Pavel Vinogradov <public AT sourcemage.org>
Commit: Pavel Vinogradov <public AT sourcemage.org>

libs/glibc: version 2.23, SECURITY_PATCHH++

diff --git
a/libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
b/libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
deleted file mode 100644
index 5a71075..0000000
--- a/libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 6a714e48586aa7f21d2eeef9195cee57c9ebaa60 Mon Sep 17 00:00:00 2001
-From: Thorsten Kukuk <kukuk AT suse.de>
-Date: Fri, 16 Aug 2013 14:54:23 -0400
-Subject: [PATCH 05/11] reload /etc/resolv.conf when it has changed
-
-if /etc/resolv.conf is updated, then make sure applications
-already running get the updated information.
-
-ripped from SuSE
-
-http://bugs.gentoo.org/177416
----
- resolv/res_libc.c | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/resolv/res_libc.c b/resolv/res_libc.c
-index ee3fa21..f30b3a9 100644
---- a/resolv/res_libc.c
-+++ b/resolv/res_libc.c
-@@ -22,6 +22,7 @@
- #include <arpa/nameser.h>
- #include <resolv.h>
- #include <bits/libc-lock.h>
-+#include <sys/stat.h>
-
-
- /* The following bit is copied from res_data.c (where it is #ifdef'ed
-@@ -95,6 +96,20 @@ int
- __res_maybe_init (res_state resp, int preinit)
- {
- if (resp->options & RES_INIT) {
-+ static time_t last_mtime, last_check;
-+ time_t now;
-+ struct stat statbuf;
-+
-+ time (&now);
-+ if (now != last_check) {
-+ last_check = now;
-+ if (stat (_PATH_RESCONF, &statbuf) == 0 && last_mtime
!= statbuf.st_mtime) {
-+ last_mtime = statbuf.st_mtime;
-+ atomicinclock (lock);
-+ atomicinc (__res_initstamp);
-+ atomicincunlock (lock);
-+ }
-+ }
- if (__res_initstamp != resp->_u._ext.initstamp) {
- if (resp->nscount > 0)
- __res_iclose (resp, true);
---
-1.8.5.4
-
diff --git a/libs/glibc/10_all_glibc-CVE-2015-7547.patch
b/libs/glibc/10_all_glibc-CVE-2015-7547.patch
deleted file mode 100644
index 87f45bc..0000000
--- a/libs/glibc/10_all_glibc-CVE-2015-7547.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-https://bugs.gentoo.org/574880
-https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
-
---- a/resolv/nss_dns/dns-host.c
-+++ b/resolv/nss_dns/dns-host.c
-@@ -1031,7 +1031,10 @@ gaih_getanswer_slice (const querybuf *answer, int
anslen, const char *qname,
- int h_namelen = 0;
-
- if (ancount == 0)
-- return NSS_STATUS_NOTFOUND;
-+ {
-+ *h_errnop = HOST_NOT_FOUND;
-+ return NSS_STATUS_NOTFOUND;
-+ }
-
- while (ancount-- > 0 && cp < end_of_message && had_error == 0)
- {
-@@ -1208,7 +1211,14 @@ gaih_getanswer_slice (const querybuf *answer, int
anslen, const char *qname,
- /* Special case here: if the resolver sent a result but it only
- contains a CNAME while we are looking for a T_A or T_AAAA record,
- we fail with NOTFOUND instead of TRYAGAIN. */
-- return canon == NULL ? NSS_STATUS_TRYAGAIN : NSS_STATUS_NOTFOUND;
-+ if (canon != NULL)
-+ {
-+ *h_errnop = HOST_NOT_FOUND;
-+ return NSS_STATUS_NOTFOUND;
-+ }
-+
-+ *h_errnop = NETDB_INTERNAL;
-+ return NSS_STATUS_TRYAGAIN;
- }
-
-
-@@ -1242,8 +1252,15 @@ gaih_getanswer (const querybuf *answer1, int anslen1,
const querybuf *answer2,
- &pat, &buffer, &buflen,
- errnop, h_errnop, ttlp,
- &first);
-+ /* Use the second response status in some cases. */
- if (status != NSS_STATUS_SUCCESS && status2 != NSS_STATUS_NOTFOUND)
- status = status2;
-+ /* Do not return a truncated second response (unless it was
-+ unavoidable e.g. unrecoverable TRYAGAIN). */
-+ if (status == NSS_STATUS_SUCCESS
-+ && (status2 == NSS_STATUS_TRYAGAIN
-+ && *errnop == ERANGE && *h_errnop != NO_RECOVERY))
-+ status = NSS_STATUS_TRYAGAIN;
- }
-
- return status;
---- a/resolv/res_query.c
-+++ b/resolv/res_query.c
-@@ -396,6 +396,7 @@ __libc_res_nsearch(res_state statp,
- {
- free (*answerp2);
- *answerp2 = NULL;
-+ *nanswerp2 = 0;
- *answerp2_malloced = 0;
- }
- }
-@@ -447,6 +448,7 @@ __libc_res_nsearch(res_state statp,
- {
- free (*answerp2);
- *answerp2 = NULL;
-+ *nanswerp2 = 0;
- *answerp2_malloced = 0;
- }
-
-@@ -521,6 +523,7 @@ __libc_res_nsearch(res_state statp,
- {
- free (*answerp2);
- *answerp2 = NULL;
-+ *nanswerp2 = 0;
- *answerp2_malloced = 0;
- }
- if (saved_herrno != -1)
---- a/resolv/res_send.c
-+++ b/resolv/res_send.c
-@@ -639,11 +639,7 @@ send_vc(res_state statp,
- {
- const HEADER *hp = (HEADER *) buf;
- const HEADER *hp2 = (HEADER *) buf2;
-- u_char *ans = *ansp;
-- int orig_anssizp = *anssizp;
-- // XXX REMOVE
-- // int anssiz = *anssizp;
-- HEADER *anhp = (HEADER *) ans;
-+ HEADER *anhp = (HEADER *) *ansp;
- struct sockaddr *nsap = get_nsaddr (statp, ns);
- int truncating, connreset, n;
- /* On some architectures compiler might emit a warning indicating
-@@ -767,35 +763,6 @@ send_vc(res_state statp,
- assert (anscp != NULL || ansp2 == NULL);
- thisresplenp = &resplen;
- } else {
-- if (*anssizp != MAXPACKET) {
-- /* No buffer allocated for the first
-- reply. We can try to use the rest
-- of the user-provided buffer. */
--#if __GNUC_PREREQ (4, 7)
-- DIAG_PUSH_NEEDS_COMMENT;
-- DIAG_IGNORE_NEEDS_COMMENT (5,
"-Wmaybe-uninitialized");
--#endif
--#if _STRING_ARCH_unaligned
-- *anssizp2 = orig_anssizp - resplen;
-- *ansp2 = *ansp + resplen;
--#else
-- int aligned_resplen
-- = ((resplen + __alignof__ (HEADER) - 1)
-- & ~(__alignof__ (HEADER) - 1));
-- *anssizp2 = orig_anssizp - aligned_resplen;
-- *ansp2 = *ansp + aligned_resplen;
--#endif
--#if __GNUC_PREREQ (4, 7)
-- DIAG_POP_NEEDS_COMMENT;
--#endif
-- } else {
-- /* The first reply did not fit into the
-- user-provided buffer. Maybe the second
-- answer will. */
-- *anssizp2 = orig_anssizp;
-- *ansp2 = *ansp;
-- }
--
- thisanssizp = anssizp2;
- thisansp = ansp2;
- thisresplenp = resplen2;
-@@ -804,10 +771,14 @@ send_vc(res_state statp,
- anhp = (HEADER *) *thisansp;
-
- *thisresplenp = rlen;
-- if (rlen > *thisanssizp) {
-- /* Yes, we test ANSCP here. If we have two buffers
-- both will be allocatable. */
-- if (__glibc_likely (anscp != NULL)) {
-+ /* Is the answer buffer too small? */
-+ if (*thisanssizp < rlen) {
-+ /* If the current buffer is not the the static
-+ user-supplied buffer then we can reallocate
-+ it. */
-+ if (thisansp != NULL && thisansp != ansp) {
-+ /* Always allocate MAXPACKET, callers expect
-+ this specific size. */
- u_char *newp = malloc (MAXPACKET);
- if (newp == NULL) {
- *terrno = ENOMEM;
-@@ -957,8 +928,6 @@ send_dg(res_state statp,
- {
- const HEADER *hp = (HEADER *) buf;
- const HEADER *hp2 = (HEADER *) buf2;
-- u_char *ans = *ansp;
-- int orig_anssizp = *anssizp;
- struct timespec now, timeout, finish;
- struct pollfd pfd[1];
- int ptimeout;
-@@ -1154,50 +1123,48 @@ send_dg(res_state statp,
- assert (anscp != NULL || ansp2 == NULL);
- thisresplenp = &resplen;
- } else {
-- if (*anssizp != MAXPACKET) {
-- /* No buffer allocated for the first
-- reply. We can try to use the rest
-- of the user-provided buffer. */
--#if _STRING_ARCH_unaligned
-- *anssizp2 = orig_anssizp - resplen;
-- *ansp2 = *ansp + resplen;
--#else
-- int aligned_resplen
-- = ((resplen + __alignof__ (HEADER) - 1)
-- & ~(__alignof__ (HEADER) - 1));
-- *anssizp2 = orig_anssizp - aligned_resplen;
-- *ansp2 = *ansp + aligned_resplen;
--#endif
-- } else {
-- /* The first reply did not fit into the
-- user-provided buffer. Maybe the second
-- answer will. */
-- *anssizp2 = orig_anssizp;
-- *ansp2 = *ansp;
-- }
--
- thisanssizp = anssizp2;
- thisansp = ansp2;
- thisresplenp = resplen2;
- }
-
- if (*thisanssizp < MAXPACKET
-- /* Yes, we test ANSCP here. If we have two buffers
-- both will be allocatable. */
-- && anscp
-+ /* If the current buffer is not the the static
-+ user-supplied buffer then we can reallocate
-+ it. */
-+ && (thisansp != NULL && thisansp != ansp)
- #ifdef FIONREAD
-+ /* Is the size too small? */
- && (ioctl (pfd[0].fd, FIONREAD, thisresplenp) < 0
- || *thisanssizp < *thisresplenp)
- #endif
- ) {
-+ /* Always allocate MAXPACKET, callers expect
-+ this specific size. */
- u_char *newp = malloc (MAXPACKET);
- if (newp != NULL) {
-- *anssizp = MAXPACKET;
-- *thisansp = ans = newp;
-+ *thisanssizp = MAXPACKET;
-+ *thisansp = newp;
- if (thisansp == ansp2)
- *ansp2_malloced = 1;
- }
- }
-+ /* We could end up with truncation if anscp was NULL
-+ (not allowed to change caller's buffer) and the
-+ response buffer size is too small. This isn't a
-+ reliable way to detect truncation because the ioctl
-+ may be an inaccurate report of the UDP message size.
-+ Therefore we use this only to issue debug output.
-+ To do truncation accurately with UDP we need
-+ MSG_TRUNC which is only available on Linux. We
-+ can abstract out the Linux-specific feature in the
-+ future to detect truncation. */
-+ if (__glibc_unlikely (*thisanssizp < *thisresplenp)) {
-+ Dprint(statp->options & RES_DEBUG,
-+ (stdout, ";; response may be truncated
(UDP)\n")
-+ );
-+ }
-+
- HEADER *anhp = (HEADER *) *thisansp;
- socklen_t fromlen = sizeof(struct sockaddr_in6);
- assert (sizeof(from) <= fromlen);
diff --git a/libs/glibc/DETAILS b/libs/glibc/DETAILS
index 33a141e..674aac8 100755
--- a/libs/glibc/DETAILS
+++ b/libs/glibc/DETAILS
@@ -29,7 +29,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-git
SOURCE_URL="git://sourceware.org/git/glibc.git:$SPELL-git"
SOURCE_IGNORE=volatile
else
- VERSION=2.22
+ VERSION=2.23
SOURCE=$SPELL-$VERSION.tar.xz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE2=$SOURCE.sig
@@ -37,7 +37,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
SOURCE_GPG=glibc.gpg:$SOURCE.sig:UPSTREAM_KEY
SOURCE2_IGNORE=signature
- SECURITY_PATCH=5
+ SECURITY_PATCH=6
fi
if [[ $GLIBC_SANITIZE_HEADERS == n ]]; then
HEADERS_VERSION=3.17.4
diff --git a/libs/glibc/HISTORY b/libs/glibc/HISTORY
index 30cf3f7..7dffb22 100644
--- a/libs/glibc/HISTORY
+++ b/libs/glibc/HISTORY
@@ -1,3 +1,11 @@
+2016-02-20 Pavel Vinogradov <public AT sourcemage.org>
+ * DETAILS: version 2.23, SECURITY_PATCH++, (CVE-2015-7547,
+ CVE-2015-8776, CVE-2015-8777, CVE-2015-8778, CVE-2015-8779,
+ CVE-2014-9761)
+ * PRE_BUILD, 10_all_glibc-CVE-2015-7547.patch,
+ 00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch:
removed,
+ fixed by upstream
+
2016-02-17 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DETAILS, PRE_BUILD, 10_all_glibc-CVE-2015-7547.patch: add patch from
gentoo to fix CVE-2015-7547, SECURITY_PATCH++
diff --git a/libs/glibc/PRE_BUILD b/libs/glibc/PRE_BUILD
index bf7935f..8a08cfc 100755
--- a/libs/glibc/PRE_BUILD
+++ b/libs/glibc/PRE_BUILD
@@ -90,9 +90,7 @@ patch -p0 < $SPELL_DIRECTORY/Makefile.patch &&
# no idea why or how this is missing from configure
patch -p0 < $SPELL_DIRECTORY/as_fn_executable_p.patch &&

-patch -p1 <
$SPELL_DIRECTORY/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
&&
patch -p1 <
$SPELL_DIRECTORY/00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch
&&
-patch -p1 < $SPELL_DIRECTORY/10_all_glibc-CVE-2015-7547.patch
&&
patch -p1 < $SPELL_DIRECTORY/glibc-2.20-fhs-1.patch
&&

# disabled libgd detection/building memusagestat for now until a better



  • [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (3dcd43396b0096114d7c1e1a45b2707ca03f5116), Pavel Vinogradov, 02/20/2016

Archive powered by MHonArc 2.6.24.

Top of Page