Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (b0da637d584f5aac99a5f1c2ec2375139513ff5d)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Pavel Vinogradov <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (b0da637d584f5aac99a5f1c2ec2375139513ff5d)
  • Date: Fri, 2 Feb 2018 21:16:07 +0000

GIT changes to master grimoire by Pavel Vinogradov <public AT sourcemage.org>:

libs/glibc/00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch | 28
--
libs/glibc/DETAILS | 5
libs/glibc/HISTORY | 10
libs/glibc/PRE_BUILD | 14 -
libs/glibc/getcwd.patch | 58
-----
libs/glibc/glibc.gpg |binary
libs/glibc/glob.patch | 56
-----
libs/glibc/pthread-longjmp.patch | 111
----------
8 files changed, 13 insertions(+), 269 deletions(-)

New commits:
commit b0da637d584f5aac99a5f1c2ec2375139513ff5d
Author: Pavel Vinogradov <public AT sourcemage.org>
Commit: Pavel Vinogradov <public AT sourcemage.org>

libs/glibc: version 2.27, SECURITY_PATCH++

diff --git
a/libs/glibc/00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch
b/libs/glibc/00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch
deleted file mode 100644
index a3523a6..0000000
--- a/libs/glibc/00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 2a6098d40483e825eebc18f74203b0b1d1c6e6c8 Mon Sep 17 00:00:00 2001
-From: Guy Martin <gmsoft AT tuxicoman.be>
-Date: Fri, 16 Aug 2013 15:00:05 -0400
-Subject: [PATCH 07/11] rtld: do not ignore arch-specific CFLAGS
-
-https://bugs.gentoo.org/452184
-http://sourceware.org/bugzilla/show_bug.cgi?id=15005
-http://sourceware.org/ml/libc-alpha/2013-01/msg00247.html
----
- elf/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/elf/Makefile b/elf/Makefile
-index 4c58fc9..56900d2 100644
---- a/elf/Makefile
-+++ b/elf/Makefile
-@@ -421,7 +421,7 @@ CFLAGS-ldconfig.c = $(SYSCONF-FLAGS)
-D'LIBDIR="$(libdir)"' \
- -D'SLIBDIR="$(slibdir)"' -DIS_IN_ldconfig=1
- CFLAGS-dl-cache.c = $(SYSCONF-FLAGS)
- CFLAGS-cache.c = $(SYSCONF-FLAGS)
--CFLAGS-rtld.c = $(SYSCONF-FLAGS)
-+CFLAGS-rtld.c += $(SYSCONF-FLAGS)
-
- CPPFLAGS-.os += $(if $(filter $(@F),$(patsubst
%,%.os,$(all-rtld-routines))),\
- -DNOT_IN_libc=1 -DIS_IN_rtld=1 -DIN_LIB=rtld)
---
-1.8.5.4
-
diff --git a/libs/glibc/DETAILS b/libs/glibc/DETAILS
index 7d0f4fe..65f507a 100755
--- a/libs/glibc/DETAILS
+++ b/libs/glibc/DETAILS
@@ -29,7 +29,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-git
SOURCE_URL="git://sourceware.org/git/glibc.git:$SPELL-git"
SOURCE_IGNORE=volatile
else
- VERSION=2.26
+ VERSION=2.27
SOURCE=$SPELL-$VERSION.tar.xz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE2=$SOURCE.sig
@@ -37,8 +37,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
SOURCE_GPG=glibc.gpg:$SOURCE.sig:UPSTREAM_KEY
SOURCE2_IGNORE=signature
- SECURITY_PATCH=11
- PATCHLEVEL=1
+ SECURITY_PATCH=12
fi
if [[ $GLIBC_SANITIZE_HEADERS == n ]]; then
HEADERS_VERSION=3.17.4
diff --git a/libs/glibc/HISTORY b/libs/glibc/HISTORY
index 52a6857..8a387ed 100644
--- a/libs/glibc/HISTORY
+++ b/libs/glibc/HISTORY
@@ -1,3 +1,13 @@
+2018-02-02 Pavel Vinogradov <public AT sourcemage.org>
+ * DETAILS: version 2.27, SECURITY_PATCH++,
+ (CVE-2009-5064, CVE-2017-15671, CVE-2017-15804, CVE-2017-17426,
+ CVE-2017-1000408, CVE-2017-1000409, CVE-2017-16997, CVE-2018-6485)
+ * PRE_BUILD, getcwd.patch, glob.patch, pthread-longjmp.patch,
+ 00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch: removed,
+ fixed by upstream
+ * glibx.gpg: added new key, A25340F8,
+ Carlos O'Donell <carlos AT systemhalted.org>
+
2018-01-13 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS, PRE_BUILD, getcwd.patch: SECURITY_PATCH++,
(CVE-2018-1000001)
diff --git a/libs/glibc/PRE_BUILD b/libs/glibc/PRE_BUILD
index 6703da5..ac7b376 100755
--- a/libs/glibc/PRE_BUILD
+++ b/libs/glibc/PRE_BUILD
@@ -53,12 +53,7 @@ if [ "$GLIBC_NPTL" = "y" ]; then
return 1
fi
fi &&
- make mrproper &&
- # A fix from git that avoids linking breakage with pthread and longjmp.
- if ! [[ "${GLIBC_BRANCH}" == "scm" ]]; then
- (cd "$SOURCE_DIRECTORY" &&
- patch -Np1 < "$SCRIPT_DIRECTORY/pthread-longjmp.patch")
- fi
+ make mrproper
else
cd $SOURCE_DIRECTORY &&
#
@@ -95,15 +90,8 @@ patch -p0 < $SPELL_DIRECTORY/Makefile.patch &&
# no idea why or how this is missing from configure
patch -p0 < $SPELL_DIRECTORY/as_fn_executable_p.patch &&

-patch -p1 <
$SPELL_DIRECTORY/00_all_0007-rtld-do-not-ignore-arch-specific-CFLAGS.patch
&&
patch -p1 < $SPELL_DIRECTORY/glibc-2.20-fhs-1.patch
&&

-# CVE-2017-15670 fix
-patch -p1 < "${SPELL_DIRECTORY}/glob.patch"
&&
-
-# CVE-2018-1000001 fix
-patch -p1 < "${SPELL_DIRECTORY}/getcwd.patch"
&&
-
# disabled libgd detection/building memusagestat for now until a better
# fix has been found, bug #8277
#sedit 's/LIBGD=yes/LIBGD=no/' $SOURCE_DIRECTORY/configure &&
diff --git a/libs/glibc/getcwd.patch b/libs/glibc/getcwd.patch
deleted file mode 100644
index 41ce286..0000000
--- a/libs/glibc/getcwd.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: Dmitry V. Levin <ldv AT altlinux.org>
-Date: Sun, 7 Jan 2018 02:03:41 +0000 (+0000)
-Subject: linux: make getcwd(3) fail if it cannot obtain an absolute path [BZ
#22679]
-X-Git-Url:
https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=52a713fdd0a30e1bd79818e2e3c4ab44ddca1a94
-
-linux: make getcwd(3) fail if it cannot obtain an absolute path [BZ #22679]
-
-Currently getcwd(3) can succeed without returning an absolute path
-because the underlying getcwd syscall, starting with linux commit
-v2.6.36-rc1~96^2~2, may succeed without returning an absolute path.
-
-This is a conformance issue because "The getcwd() function shall
-place an absolute pathname of the current working directory
-in the array pointed to by buf, and return buf".
-
-This is also a security issue because a non-absolute path returned
-by getcwd(3) causes a buffer underflow in realpath(3).
-
-Fix this by checking the path returned by getcwd syscall and falling
-back to generic_getcwd if the path is not absolute, effectively making
-getcwd(3) fail with ENOENT. The error code is chosen for consistency
-with the case when the current directory is unlinked.
-
-[BZ #22679]
-CVE-2018-1000001
-* sysdeps/unix/sysv/linux/getcwd.c (__getcwd): Fall back to
-generic_getcwd if the path returned by getcwd syscall is not absolute.
-* io/tst-getcwd-abspath.c: New test.
-* io/Makefile (tests): Add tst-getcwd-abspath.
----
-
-diff --git a/sysdeps/unix/sysv/linux/getcwd.c
b/sysdeps/unix/sysv/linux/getcwd.c
-index f545106..866b9d2 100644 (file)
---- a/sysdeps/unix/sysv/linux/getcwd.c
-+++ b/sysdeps/unix/sysv/linux/getcwd.c
-@@ -76,7 +76,7 @@ __getcwd (char *buf, size_t size)
- int retval;
-
- retval = INLINE_SYSCALL (getcwd, 2, path, alloc_size);
-- if (retval >= 0)
-+ if (retval > 0 && path[0] == '/')
- {
- #ifndef NO_ALLOCATION
- if (buf == NULL && size == 0)
-@@ -92,10 +92,10 @@ __getcwd (char *buf, size_t size)
- return buf;
- }
-
-- /* The system call cannot handle paths longer than a page.
-- Neither can the magic symlink in /proc/self. Just use the
-+ /* The system call either cannot handle paths longer than a page
-+ or can succeed without returning an absolute path. Just use the
- generic implementation right away. */
-- if (errno == ENAMETOOLONG)
-+ if (retval >= 0 || errno == ENAMETOOLONG)
- {
- #ifndef NO_ALLOCATION
- if (buf == NULL && size == 0)
diff --git a/libs/glibc/glibc.gpg b/libs/glibc/glibc.gpg
index 6eae4d7..94ba371 100644
Binary files a/libs/glibc/glibc.gpg and b/libs/glibc/glibc.gpg differ
diff --git a/libs/glibc/glob.patch b/libs/glibc/glob.patch
deleted file mode 100644
index 55864eb..0000000
--- a/libs/glibc/glob.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From c369d66e5426a30e4725b100d5cd28e372754f90 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert AT cs.ucla.edu>
-Date: Fri, 20 Oct 2017 18:41:14 +0200
-Subject: [PATCH] CVE-2017-15670: glob: Fix one-byte overflow [BZ #22320]
-
----
- ChangeLog | 6 ++++++
- NEWS | 4 ++++
- posix/glob.c | 2 +-
- 3 files changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/ChangeLog b/ChangeLog
-index f0512c5..43f5bfa 100644
---- a/ChangeLog
-+++ b/ChangeLog
-@@ -1,3 +1,9 @@
-+2017-10-20 Paul Eggert <eggert AT cs.ucla.edu>
-+
-+ [BZ #22320]
-+ CVE-2017-15670
-+ * posix/glob.c (__glob): Fix one-byte overflow.
-+
- 2017-08-02 Siddhesh Poyarekar <siddhesh AT sourceware.org>
-
- * version.h (RELEASE): Set to "stable"
-iff --git a/NEWS b/NEWS
-index ad680db..e0e5056 100644
---- a/NEWS
-+++ b/NEWS
-@@ -72,6 +72,10 @@ Security related changes:
- vulnerability; only trusted binaries must be examined using the ldd
- script.)
-
-+ CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
-+ from a one-byte overflow during ~ operator processing (either on the stack
-+ or the heap, depending on the length of the user name).
-+
- The following bugs are resolved with this release:
-
- [The release manager will add the list generated by
-diff --git a/posix/glob.c b/posix/glob.c
-index 076ab2b..15a6c0c 100644
---- a/posix/glob.c
-+++ b/posix/glob.c
-@@ -790,7 +790,7 @@ __glob (const char *pattern, int flags, int (*errfunc)
(const char *, int),
- *p = '\0';
- }
- else
-- *((char *) mempcpy (newp, dirname + 1, end_name - dirname))
-+ *((char *) mempcpy (newp, dirname + 1, end_name - dirname -
1))
- = '\0';
- user_name = newp;
- }
---
-2.9.3
-
diff --git a/libs/glibc/pthread-longjmp.patch
b/libs/glibc/pthread-longjmp.patch
deleted file mode 100644
index 9d16a0c..0000000
--- a/libs/glibc/pthread-longjmp.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From fc5ad7024c620cdfe9b76e94638aac83b99c5bf8 Mon Sep 17 00:00:00 2001
-From: Andreas Schwab <schwab AT suse.de>
-Date: Tue, 8 Aug 2017 16:21:58 +0200
-Subject: [PATCH 1/1] Don't use IFUNC resolver for longjmp or system in
- libpthread (bug 21041)
-
-Unlike the vfork forwarder and like the fork forwarder as in bug 19861,
-there won't be a problem when the compiler does not turn this into a tail
-call.
----
- ChangeLog | 6 ++++++
- nptl/pt-longjmp.c | 31 ++++++++++---------------------
- nptl/pt-system.c | 24 ++++++++----------------
- 3 files changed, 24 insertions(+), 37 deletions(-)
-
-diff --git a/nptl/pt-longjmp.c b/nptl/pt-longjmp.c
-index 2ef757e..8f3c6b3 100644
---- a/nptl/pt-longjmp.c
-+++ b/nptl/pt-longjmp.c
-@@ -25,21 +25,14 @@
- symbol in libpthread, but the historical ABI requires it. For static
- linking, there is no need to provide anything here--the libc version
- will be linked in. For shared library ABI compatibility, there must be
-- longjmp and siglongjmp symbols in libpthread.so; so we define them using
-- IFUNC to redirect to the libc function. */
-+ longjmp and siglongjmp symbols in libpthread.so.
-
--#if SHLIB_COMPAT (libpthread, GLIBC_2_0, GLIBC_2_22)
--
--# if HAVE_IFUNC
--
--# undef INIT_ARCH
--# define INIT_ARCH()
--# define DEFINE_LONGJMP(name) libc_ifunc (name, &__libc_longjmp)
--
--extern __typeof(longjmp) longjmp_ifunc;
--extern __typeof(siglongjmp) siglongjmp_ifunc;
-+ With an IFUNC resolver, it would be possible to avoid the indirection,
-+ but the IFUNC resolver might run before the __libc_longjmp symbol has
-+ been relocated, in which case the IFUNC resolver would not be able to
-+ provide the correct address. */
-
--# else /* !HAVE_IFUNC */
-+#if SHLIB_COMPAT (libpthread, GLIBC_2_0, GLIBC_2_22)
-
- static void __attribute__ ((noreturn, used))
- longjmp_compat (jmp_buf env, int val)
-@@ -47,14 +40,10 @@ longjmp_compat (jmp_buf env, int val)
- __libc_longjmp (env, val);
- }
-
--# define DEFINE_LONGJMP(name) strong_alias (longjmp_compat, name)
--
--# endif /* HAVE_IFUNC */
--
--DEFINE_LONGJMP (longjmp_ifunc)
--compat_symbol (libpthread, longjmp_ifunc, longjmp, GLIBC_2_0);
-+strong_alias (longjmp_compat, longjmp_alias)
-+compat_symbol (libpthread, longjmp_alias, longjmp, GLIBC_2_0);
-
--strong_alias (longjmp_ifunc, siglongjmp_ifunc)
--compat_symbol (libpthread, siglongjmp_ifunc, siglongjmp, GLIBC_2_0);
-+strong_alias (longjmp_alias, siglongjmp_alias)
-+compat_symbol (libpthread, siglongjmp_alias, siglongjmp, GLIBC_2_0);
-
- #endif
-diff --git a/nptl/pt-system.c b/nptl/pt-system.c
-index f8ca6ba..b30ddf2 100644
---- a/nptl/pt-system.c
-+++ b/nptl/pt-system.c
-@@ -25,29 +25,21 @@
- libpthread, but the historical ABI requires it. For static linking,
- there is no need to provide anything here--the libc version will be
- linked in. For shared library ABI compatibility, there must be a
-- 'system' symbol in libpthread.so; so we define it using IFUNC to
-- redirect to the libc function. */
-+ 'system' symbol in libpthread.so.
-
--#if SHLIB_COMPAT (libpthread, GLIBC_2_0, GLIBC_2_22)
--
--# if HAVE_IFUNC
--
--extern __typeof(system) system_ifunc;
--# undef INIT_ARCH
--# define INIT_ARCH()
--libc_ifunc (system_ifunc, &__libc_system)
-+ With an IFUNC resolver, it would be possible to avoid the indirection,
-+ but the IFUNC resolver might run before the __libc_system symbol has
-+ been relocated, in which case the IFUNC resolver would not be able to
-+ provide the correct address. */
-
--# else /* !HAVE_IFUNC */
-+#if SHLIB_COMPAT (libpthread, GLIBC_2_0, GLIBC_2_22)
-
- static int __attribute__ ((used))
- system_compat (const char *line)
- {
- return __libc_system (line);
- }
--strong_alias (system_compat, system_ifunc)
--
--# endif /* HAVE_IFUNC */
--
--compat_symbol (libpthread, system_ifunc, system, GLIBC_2_0);
-+strong_alias (system_compat, system_alias)
-+compat_symbol (libpthread, system_alias, system, GLIBC_2_0);
-
- #endif
---
-2.9.3
-



  • [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (b0da637d584f5aac99a5f1c2ec2375139513ff5d), Pavel Vinogradov, 02/02/2018

Archive powered by MHonArc 2.6.24.

Top of Page