Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (cd0a25524ee38df798dd1f4cb05d66d1035be620)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (cd0a25524ee38df798dd1f4cb05d66d1035be620)
  • Date: Mon, 21 Mar 2016 02:25:34 +0000

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch |
51 ++
libs/glibc/10_all_glibc-CVE-2015-7547.patch |
230 ++++++++++
libs/glibc/DETAILS |
4
libs/glibc/HISTORY |
8
libs/glibc/PRE_BUILD |
2
5 files changed, 285 insertions(+), 10 deletions(-)

New commits:
commit cd0a25524ee38df798dd1f4cb05d66d1035be620
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

Revert "libs/glibc: version 2.23, SECURITY_PATCHH++"

This reverts commit e81df303e0bddfec0a73a8ad19079ec926519c46.

Reason: incompatible with gcc 4.6

diff --git
a/libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
b/libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
new file mode 100644
index 0000000..5a71075
--- /dev/null
+++ b/libs/glibc/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
@@ -0,0 +1,51 @@
+From 6a714e48586aa7f21d2eeef9195cee57c9ebaa60 Mon Sep 17 00:00:00 2001
+From: Thorsten Kukuk <kukuk AT suse.de>
+Date: Fri, 16 Aug 2013 14:54:23 -0400
+Subject: [PATCH 05/11] reload /etc/resolv.conf when it has changed
+
+if /etc/resolv.conf is updated, then make sure applications
+already running get the updated information.
+
+ripped from SuSE
+
+http://bugs.gentoo.org/177416
+---
+ resolv/res_libc.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/resolv/res_libc.c b/resolv/res_libc.c
+index ee3fa21..f30b3a9 100644
+--- a/resolv/res_libc.c
++++ b/resolv/res_libc.c
+@@ -22,6 +22,7 @@
+ #include <arpa/nameser.h>
+ #include <resolv.h>
+ #include <bits/libc-lock.h>
++#include <sys/stat.h>
+
+
+ /* The following bit is copied from res_data.c (where it is #ifdef'ed
+@@ -95,6 +96,20 @@ int
+ __res_maybe_init (res_state resp, int preinit)
+ {
+ if (resp->options & RES_INIT) {
++ static time_t last_mtime, last_check;
++ time_t now;
++ struct stat statbuf;
++
++ time (&now);
++ if (now != last_check) {
++ last_check = now;
++ if (stat (_PATH_RESCONF, &statbuf) == 0 && last_mtime
!= statbuf.st_mtime) {
++ last_mtime = statbuf.st_mtime;
++ atomicinclock (lock);
++ atomicinc (__res_initstamp);
++ atomicincunlock (lock);
++ }
++ }
+ if (__res_initstamp != resp->_u._ext.initstamp) {
+ if (resp->nscount > 0)
+ __res_iclose (resp, true);
+--
+1.8.5.4
+
diff --git a/libs/glibc/10_all_glibc-CVE-2015-7547.patch
b/libs/glibc/10_all_glibc-CVE-2015-7547.patch
new file mode 100644
index 0000000..87f45bc
--- /dev/null
+++ b/libs/glibc/10_all_glibc-CVE-2015-7547.patch
@@ -0,0 +1,230 @@
+https://bugs.gentoo.org/574880
+https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
+
+--- a/resolv/nss_dns/dns-host.c
++++ b/resolv/nss_dns/dns-host.c
+@@ -1031,7 +1031,10 @@ gaih_getanswer_slice (const querybuf *answer, int
anslen, const char *qname,
+ int h_namelen = 0;
+
+ if (ancount == 0)
+- return NSS_STATUS_NOTFOUND;
++ {
++ *h_errnop = HOST_NOT_FOUND;
++ return NSS_STATUS_NOTFOUND;
++ }
+
+ while (ancount-- > 0 && cp < end_of_message && had_error == 0)
+ {
+@@ -1208,7 +1211,14 @@ gaih_getanswer_slice (const querybuf *answer, int
anslen, const char *qname,
+ /* Special case here: if the resolver sent a result but it only
+ contains a CNAME while we are looking for a T_A or T_AAAA record,
+ we fail with NOTFOUND instead of TRYAGAIN. */
+- return canon == NULL ? NSS_STATUS_TRYAGAIN : NSS_STATUS_NOTFOUND;
++ if (canon != NULL)
++ {
++ *h_errnop = HOST_NOT_FOUND;
++ return NSS_STATUS_NOTFOUND;
++ }
++
++ *h_errnop = NETDB_INTERNAL;
++ return NSS_STATUS_TRYAGAIN;
+ }
+
+
+@@ -1242,8 +1252,15 @@ gaih_getanswer (const querybuf *answer1, int anslen1,
const querybuf *answer2,
+ &pat, &buffer, &buflen,
+ errnop, h_errnop, ttlp,
+ &first);
++ /* Use the second response status in some cases. */
+ if (status != NSS_STATUS_SUCCESS && status2 != NSS_STATUS_NOTFOUND)
+ status = status2;
++ /* Do not return a truncated second response (unless it was
++ unavoidable e.g. unrecoverable TRYAGAIN). */
++ if (status == NSS_STATUS_SUCCESS
++ && (status2 == NSS_STATUS_TRYAGAIN
++ && *errnop == ERANGE && *h_errnop != NO_RECOVERY))
++ status = NSS_STATUS_TRYAGAIN;
+ }
+
+ return status;
+--- a/resolv/res_query.c
++++ b/resolv/res_query.c
+@@ -396,6 +396,7 @@ __libc_res_nsearch(res_state statp,
+ {
+ free (*answerp2);
+ *answerp2 = NULL;
++ *nanswerp2 = 0;
+ *answerp2_malloced = 0;
+ }
+ }
+@@ -447,6 +448,7 @@ __libc_res_nsearch(res_state statp,
+ {
+ free (*answerp2);
+ *answerp2 = NULL;
++ *nanswerp2 = 0;
+ *answerp2_malloced = 0;
+ }
+
+@@ -521,6 +523,7 @@ __libc_res_nsearch(res_state statp,
+ {
+ free (*answerp2);
+ *answerp2 = NULL;
++ *nanswerp2 = 0;
+ *answerp2_malloced = 0;
+ }
+ if (saved_herrno != -1)
+--- a/resolv/res_send.c
++++ b/resolv/res_send.c
+@@ -639,11 +639,7 @@ send_vc(res_state statp,
+ {
+ const HEADER *hp = (HEADER *) buf;
+ const HEADER *hp2 = (HEADER *) buf2;
+- u_char *ans = *ansp;
+- int orig_anssizp = *anssizp;
+- // XXX REMOVE
+- // int anssiz = *anssizp;
+- HEADER *anhp = (HEADER *) ans;
++ HEADER *anhp = (HEADER *) *ansp;
+ struct sockaddr *nsap = get_nsaddr (statp, ns);
+ int truncating, connreset, n;
+ /* On some architectures compiler might emit a warning indicating
+@@ -767,35 +763,6 @@ send_vc(res_state statp,
+ assert (anscp != NULL || ansp2 == NULL);
+ thisresplenp = &resplen;
+ } else {
+- if (*anssizp != MAXPACKET) {
+- /* No buffer allocated for the first
+- reply. We can try to use the rest
+- of the user-provided buffer. */
+-#if __GNUC_PREREQ (4, 7)
+- DIAG_PUSH_NEEDS_COMMENT;
+- DIAG_IGNORE_NEEDS_COMMENT (5,
"-Wmaybe-uninitialized");
+-#endif
+-#if _STRING_ARCH_unaligned
+- *anssizp2 = orig_anssizp - resplen;
+- *ansp2 = *ansp + resplen;
+-#else
+- int aligned_resplen
+- = ((resplen + __alignof__ (HEADER) - 1)
+- & ~(__alignof__ (HEADER) - 1));
+- *anssizp2 = orig_anssizp - aligned_resplen;
+- *ansp2 = *ansp + aligned_resplen;
+-#endif
+-#if __GNUC_PREREQ (4, 7)
+- DIAG_POP_NEEDS_COMMENT;
+-#endif
+- } else {
+- /* The first reply did not fit into the
+- user-provided buffer. Maybe the second
+- answer will. */
+- *anssizp2 = orig_anssizp;
+- *ansp2 = *ansp;
+- }
+-
+ thisanssizp = anssizp2;
+ thisansp = ansp2;
+ thisresplenp = resplen2;
+@@ -804,10 +771,14 @@ send_vc(res_state statp,
+ anhp = (HEADER *) *thisansp;
+
+ *thisresplenp = rlen;
+- if (rlen > *thisanssizp) {
+- /* Yes, we test ANSCP here. If we have two buffers
+- both will be allocatable. */
+- if (__glibc_likely (anscp != NULL)) {
++ /* Is the answer buffer too small? */
++ if (*thisanssizp < rlen) {
++ /* If the current buffer is not the the static
++ user-supplied buffer then we can reallocate
++ it. */
++ if (thisansp != NULL && thisansp != ansp) {
++ /* Always allocate MAXPACKET, callers expect
++ this specific size. */
+ u_char *newp = malloc (MAXPACKET);
+ if (newp == NULL) {
+ *terrno = ENOMEM;
+@@ -957,8 +928,6 @@ send_dg(res_state statp,
+ {
+ const HEADER *hp = (HEADER *) buf;
+ const HEADER *hp2 = (HEADER *) buf2;
+- u_char *ans = *ansp;
+- int orig_anssizp = *anssizp;
+ struct timespec now, timeout, finish;
+ struct pollfd pfd[1];
+ int ptimeout;
+@@ -1154,50 +1123,48 @@ send_dg(res_state statp,
+ assert (anscp != NULL || ansp2 == NULL);
+ thisresplenp = &resplen;
+ } else {
+- if (*anssizp != MAXPACKET) {
+- /* No buffer allocated for the first
+- reply. We can try to use the rest
+- of the user-provided buffer. */
+-#if _STRING_ARCH_unaligned
+- *anssizp2 = orig_anssizp - resplen;
+- *ansp2 = *ansp + resplen;
+-#else
+- int aligned_resplen
+- = ((resplen + __alignof__ (HEADER) - 1)
+- & ~(__alignof__ (HEADER) - 1));
+- *anssizp2 = orig_anssizp - aligned_resplen;
+- *ansp2 = *ansp + aligned_resplen;
+-#endif
+- } else {
+- /* The first reply did not fit into the
+- user-provided buffer. Maybe the second
+- answer will. */
+- *anssizp2 = orig_anssizp;
+- *ansp2 = *ansp;
+- }
+-
+ thisanssizp = anssizp2;
+ thisansp = ansp2;
+ thisresplenp = resplen2;
+ }
+
+ if (*thisanssizp < MAXPACKET
+- /* Yes, we test ANSCP here. If we have two buffers
+- both will be allocatable. */
+- && anscp
++ /* If the current buffer is not the the static
++ user-supplied buffer then we can reallocate
++ it. */
++ && (thisansp != NULL && thisansp != ansp)
+ #ifdef FIONREAD
++ /* Is the size too small? */
+ && (ioctl (pfd[0].fd, FIONREAD, thisresplenp) < 0
+ || *thisanssizp < *thisresplenp)
+ #endif
+ ) {
++ /* Always allocate MAXPACKET, callers expect
++ this specific size. */
+ u_char *newp = malloc (MAXPACKET);
+ if (newp != NULL) {
+- *anssizp = MAXPACKET;
+- *thisansp = ans = newp;
++ *thisanssizp = MAXPACKET;
++ *thisansp = newp;
+ if (thisansp == ansp2)
+ *ansp2_malloced = 1;
+ }
+ }
++ /* We could end up with truncation if anscp was NULL
++ (not allowed to change caller's buffer) and the
++ response buffer size is too small. This isn't a
++ reliable way to detect truncation because the ioctl
++ may be an inaccurate report of the UDP message size.
++ Therefore we use this only to issue debug output.
++ To do truncation accurately with UDP we need
++ MSG_TRUNC which is only available on Linux. We
++ can abstract out the Linux-specific feature in the
++ future to detect truncation. */
++ if (__glibc_unlikely (*thisanssizp < *thisresplenp)) {
++ Dprint(statp->options & RES_DEBUG,
++ (stdout, ";; response may be truncated
(UDP)\n")
++ );
++ }
++
+ HEADER *anhp = (HEADER *) *thisansp;
+ socklen_t fromlen = sizeof(struct sockaddr_in6);
+ assert (sizeof(from) <= fromlen);
diff --git a/libs/glibc/DETAILS b/libs/glibc/DETAILS
index 674aac8..33a141e 100755
--- a/libs/glibc/DETAILS
+++ b/libs/glibc/DETAILS
@@ -29,7 +29,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-git
SOURCE_URL="git://sourceware.org/git/glibc.git:$SPELL-git"
SOURCE_IGNORE=volatile
else
- VERSION=2.23
+ VERSION=2.22
SOURCE=$SPELL-$VERSION.tar.xz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE2=$SOURCE.sig
@@ -37,7 +37,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
SOURCE_GPG=glibc.gpg:$SOURCE.sig:UPSTREAM_KEY
SOURCE2_IGNORE=signature
- SECURITY_PATCH=6
+ SECURITY_PATCH=5
fi
if [[ $GLIBC_SANITIZE_HEADERS == n ]]; then
HEADERS_VERSION=3.17.4
diff --git a/libs/glibc/HISTORY b/libs/glibc/HISTORY
index 52f7d05..9ee1a02 100644
--- a/libs/glibc/HISTORY
+++ b/libs/glibc/HISTORY
@@ -1,11 +1,3 @@
-2016-02-20 Pavel Vinogradov <public AT sourcemage.org>
- * DETAILS: version 2.23, SECURITY_PATCH++, (CVE-2015-7547,
- CVE-2015-8776, CVE-2015-8777, CVE-2015-8778, CVE-2015-8779,
- CVE-2014-9761)
- * PRE_BUILD, 10_all_glibc-CVE-2015-7547.patch,
- 00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch:
removed,
- fixed by upstream
-
2016-02-17 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DETAILS, PRE_BUILD, 10_all_glibc-CVE-2015-7547.patch: add patch from
gentoo to fix CVE-2015-7547, SECURITY_PATCH++
diff --git a/libs/glibc/PRE_BUILD b/libs/glibc/PRE_BUILD
index 8a08cfc..bf7935f 100755
--- a/libs/glibc/PRE_BUILD
+++ b/libs/glibc/PRE_BUILD
@@ -90,7 +90,9 @@ patch -p0 < $SPELL_DIRECTORY/Makefile.patch &&
# no idea why or how this is missing from configure
patch -p0 < $SPELL_DIRECTORY/as_fn_executable_p.patch &&

+patch -p1 <
$SPELL_DIRECTORY/00_all_0005-reload-etc-resolv.conf-when-it-has-changed.patch
&&
patch -p1 <
$SPELL_DIRECTORY/00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch
&&
+patch -p1 < $SPELL_DIRECTORY/10_all_glibc-CVE-2015-7547.patch
&&
patch -p1 < $SPELL_DIRECTORY/glibc-2.20-fhs-1.patch
&&

# disabled libgd detection/building memusagestat for now until a better




Archive powered by MHonArc 2.6.24.

Top of Page