Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Florian Franzmann (0cd4495d9652e7c959d981e7190739704b0a281c)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Florian Franzmann <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Florian Franzmann (0cd4495d9652e7c959d981e7190739704b0a281c)
  • Date: Sun, 15 Apr 2018 10:39:05 +0000

GIT changes to master grimoire by Florian Franzmann
<siflfran AT hawo.stw.uni-erlangen.de>:

devel/perl/DETAILS | 2
devel/perl/HISTORY | 11 +
devel/perl/PRE_BUILD | 10 +
devel/perl/patches/fixes/CVE-2018-6797.diff | 56 +++++++++
devel/perl/patches/fixes/CVE-2018-6798/pt1.diff | 133 ++++++++++++++++++++++
devel/perl/patches/fixes/CVE-2018-6798/pt2.diff | 78 +++++++++++++
devel/perl/patches/fixes/CVE-2018-6798/pt3.diff | 31 +++++
devel/perl/patches/fixes/CVE-2018-6798/pt4.diff | 68 +++++++++++
devel/perl/patches/fixes/CVE-2018-6913.diff | 141
++++++++++++++++++++++++
devel/vala/DEPENDS | 5
devel/vala/HISTORY | 3
utils/dbus-python/DETAILS | 2
utils/dbus-python/HISTORY | 3
13 files changed, 539 insertions(+), 4 deletions(-)

New commits:
commit 0cd4495d9652e7c959d981e7190739704b0a281c
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

devel/perl: fix CVE-2018-6797, CVE-2018-6798, CVE-2018-6913

commit f86139b4a26af4e26559480aa65714eeb32a43c6
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

devel/vala: depend on graphviz

commit bbe213536df9a90e829e5629270f8db3fc23a971
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

utils/dbus-python: version 1.2.6

diff --git a/devel/perl/DETAILS b/devel/perl/DETAILS
index 84cae33..247ff78 100755
--- a/devel/perl/DETAILS
+++ b/devel/perl/DETAILS
@@ -1,7 +1,7 @@
SPELL=perl
VERSION=5.26.1
SOURCE_HASH=sha1:403bb1804cb41416153d908eea093f2be22a77f6:UPSTREAM_HASH
- SECURITY_PATCH=4
+ SECURITY_PATCH=5
SOURCE=$SPELL-$VERSION.tar.xz
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
SOURCE_URL[0]=http://www.cpan.org/src/5.0/$SOURCE
diff --git a/devel/perl/HISTORY b/devel/perl/HISTORY
index 2e3c442..af24ef8 100644
--- a/devel/perl/HISTORY
+++ b/devel/perl/HISTORY
@@ -1,3 +1,14 @@
+2018-04-15 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * PRE_BUILD,
+ patches/fixes/CVE-2018-6797.diff,
+ patches/fixes/CVE-2018-6798/pt1.diff,
+ patches/fixes/CVE-2018-6798/pt2.diff,
+ patches/fixes/CVE-2018-6798/pt3.diff,
+ patches/fixes/CVE-2018-6798/pt4.diff,
+ patches/fixes/CVE-2018-6913.diff: add fixes from Debian for
CVE-2018-6797,
+ CVE-2018-6798 and CVE-2018-6913
+ * DETAILS: SECURITY_PATCH++
+
2017-09-23 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS: version 5.26.1

diff --git a/devel/perl/PRE_BUILD b/devel/perl/PRE_BUILD
new file mode 100755
index 0000000..eb27896
--- /dev/null
+++ b/devel/perl/PRE_BUILD
@@ -0,0 +1,10 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6797.diff" &&
+patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt1.diff" &&
+patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt2.diff" &&
+patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt3.diff" &&
+patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt4.diff" &&
+patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6913.diff"
+
diff --git a/devel/perl/patches/fixes/CVE-2018-6797.diff
b/devel/perl/patches/fixes/CVE-2018-6797.diff
new file mode 100644
index 0000000..a4c9ced
--- /dev/null
+++ b/devel/perl/patches/fixes/CVE-2018-6797.diff
@@ -0,0 +1,56 @@
+From 1832958010691635c3346100ab10223bbfc05638 Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw AT cpan.org>
+Date: Fri, 2 Feb 2018 15:14:27 -0700
+Subject: (perl #132227) restart a node if we change to uni rules within the
+ node and encounter a sharp S
+
+This could lead to a buffer overflow.
+
+Test case backported from the corresponding blead fix by Niko Tyni.
+
+Origin: backport
+Bug: https://rt.perl.org/Public/Bug/Display.html?id=132227
+Patch-Name: fixes/CVE-2018-6797.diff
+---
+ regcomp.c | 12 ++++++++++++
+ t/re/pat_advanced.t | 4 ++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/regcomp.c b/regcomp.c
+index 9641f03f4..4baf65c8c 100644
+--- a/regcomp.c
++++ b/regcomp.c
+@@ -13538,6 +13538,18 @@ S_regatom(pTHX_ RExC_state_t *pRExC_state, I32
*flagp, U32 depth)
+ * /u. This includes the multi-char fold SHARP S to
+ * 'ss' */
+ if (UNLIKELY(ender == LATIN_SMALL_LETTER_SHARP_S)) {
++
++ /* If the node started out having uni rules, we
++ * wouldn't have gotten here. So this means
++ * something in the middle has changed it, but
++ * didn't think it needed to reparse. But this
++ * sharp s now does indicate the need for
++ * reparsing. */
++ if (RExC_uni_semantics) {
++ p = oldp;
++ goto loopdone;
++ }
++
+ RExC_seen_unfolded_sharp_s = 1;
+ maybe_exactfu = FALSE;
+ }
+diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t
+index 5e5cc1f1f..27df5509e 100644
+--- a/t/re/pat_advanced.t
++++ b/t/re/pat_advanced.t
+@@ -2336,6 +2336,10 @@ EOF
+ unlike("s\N{U+DF}", qr/^\x{00DF}/i, "\"s\\N{U+DF}\",
qr/^\\x{00DF}/i");
+ }
+
++ { # Bug #132227, caused failed assertion
++
ok(qr/0b\N{U+41}\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF/i,
"No seqgfault [perl #132227]");
++ }
++
+ # User-defined Unicode properties to match above-Unicode code points
+ sub Is_32_Bit_Super { return "110000\tFFFFFFFF\n" }
+ sub Is_Portable_Super { return '!utf8::Any' } # Matches beyond 32 bits
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt1.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt1.diff
new file mode 100644
index 0000000..d87ba75
--- /dev/null
+++ b/devel/perl/patches/fixes/CVE-2018-6798/pt1.diff
@@ -0,0 +1,133 @@
+From b36a6ec67585c678241f7da4148e7ef89021d6d1 Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw AT cpan.org>
+Date: Tue, 6 Feb 2018 14:50:48 -0700
+Subject: Heap buffer overflow
+
+The proximal cause is several instances in regexec.c of the code
+assuming that the input was valid UTF-8, whereas the input was too short
+for what the start byte claimed it would be.
+
+I grepped through the core for any other similar uses, and did not find
+any.
+
+Origin: upstream
+Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
+Patch-Name: fixes/CVE-2018-6798/pt1.diff
+---
+ regexec.c | 33 ++++++++++++++++++---------------
+ t/lib/warnings/regexec | 7 +++++++
+ 2 files changed, 25 insertions(+), 15 deletions(-)
+
+diff --git a/regexec.c b/regexec.c
+index 134b196fc..fa888823b 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -1487,7 +1487,9 @@ Perl_re_intuit_start(pTHX_
+ ? trie_utf8_fold
\
+ : trie_latin_utf8_fold)))
+
+-#define REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap, uc, uscan, len,
uvc, charid, foldlen, foldbuf, uniflags) \
++/* 'uscan' is set to foldbuf, and incremented, so below the end of uscan is
++ * 'foldbuf+sizeof(foldbuf)' */
++#define REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap, uc, uc_end,
uscan, len, uvc, charid, foldlen, foldbuf, uniflags) \
+ STMT_START {
\
+ STRLEN skiplen;
\
+ U8 flags = FOLD_FLAGS_FULL;
\
+@@ -1495,7 +1497,7 @@ STMT_START {
+ case trie_flu8:
\
+ _CHECK_AND_WARN_PROBLEMATIC_LOCALE;
\
+ if (utf8_target && UTF8_IS_ABOVE_LATIN1(*uc)) {
\
+- _CHECK_AND_OUTPUT_WIDE_LOCALE_UTF8_MSG(uc, uc + UTF8SKIP(uc));
\
++ _CHECK_AND_OUTPUT_WIDE_LOCALE_UTF8_MSG(uc, uc_end - uc);
\
+ }
\
+ goto do_trie_utf8_fold;
\
+ case trie_utf8_exactfa_fold:
\
+@@ -1504,14 +1506,14 @@ STMT_START {
+ case trie_utf8_fold:
\
+ do_trie_utf8_fold:
\
+ if ( foldlen>0 ) {
\
+- uvc = utf8n_to_uvchr( (const U8*) uscan, UTF8_MAXLEN, &len,
uniflags ); \
++ uvc = utf8n_to_uvchr( (const U8*) uscan, foldlen, &len,
uniflags ); \
+ foldlen -= len;
\
+ uscan += len;
\
+ len=0;
\
+ } else {
\
+- len = UTF8SKIP(uc);
\
+- uvc = _toFOLD_utf8_flags( (const U8*) uc, uc + len, foldbuf,
&foldlen, \
++ uvc = _toFOLD_utf8_flags( (const U8*) uc, uc_end, foldbuf,
&foldlen, \
+
flags); \
++ len = UTF8SKIP(uc);
\
+ skiplen = UVCHR_SKIP( uvc );
\
+ foldlen -= skiplen;
\
+ uscan = foldbuf + skiplen;
\
+@@ -1522,7 +1524,7 @@ STMT_START {
+ /* FALLTHROUGH */
\
+ case trie_latin_utf8_fold:
\
+ if ( foldlen>0 ) {
\
+- uvc = utf8n_to_uvchr( (const U8*) uscan, UTF8_MAXLEN, &len,
uniflags ); \
++ uvc = utf8n_to_uvchr( (const U8*) uscan, foldlen, &len,
uniflags ); \
+ foldlen -= len;
\
+ uscan += len;
\
+ len=0;
\
+@@ -1541,7 +1543,7 @@ STMT_START {
+ }
\
+ /* FALLTHROUGH */
\
+ case trie_utf8:
\
+- uvc = utf8n_to_uvchr( (const U8*) uc, UTF8_MAXLEN, &len, uniflags
); \
++ uvc = utf8n_to_uvchr( (const U8*) uc, uc_end - uc, &len, uniflags
); \
+ break;
\
+ case trie_plain:
\
+ uvc = (UV)*uc;
\
+@@ -2623,10 +2625,10 @@ S_find_byclass(pTHX_ regexp * prog, const regnode
*c, char *s,
+ }
+ points[pointpos++ % maxlen]= uc;
+ if (foldlen || uc < (U8*)strend) {
+- REXEC_TRIE_READ_CHAR(trie_type, trie,
+- widecharmap, uc,
+- uscan, len, uvc, charid, foldlen,
+- foldbuf, uniflags);
++ REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap,
uc,
++ (U8 *) strend, uscan, len, uvc,
++ charid, foldlen, foldbuf,
++ uniflags);
+ DEBUG_TRIE_EXECUTE_r({
+ dump_exec_pos( (char *)uc, c, strend,
+ real_start, s, utf8_target, 0);
+@@ -5686,8 +5688,9 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char
*startpos, regnode *prog)
+ if ( base && (foldlen || uc < (U8*)(reginfo->strend))) {
+ I32 offset;
+ REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap, uc,
+- uscan, len, uvc, charid, foldlen,
+- foldbuf, uniflags);
++ (U8 *) reginfo->strend, uscan,
++ len, uvc, charid, foldlen,
++ foldbuf, uniflags);
+ charcount++;
+ if (foldlen>0)
+ ST.longfold = TRUE;
+@@ -5822,8 +5825,8 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char
*startpos, regnode *prog)
+ while (foldlen) {
+ if (!--chars)
+ break;
+- uvc = utf8n_to_uvchr(uscan, UTF8_MAXLEN, &len,
+- uniflags);
++ uvc = utf8n_to_uvchr(uscan, foldlen, &len,
++ uniflags);
+ uscan += len;
+ foldlen -= len;
+ }
+diff --git a/t/lib/warnings/regexec b/t/lib/warnings/regexec
+index 900dd6ee7..6635142de 100644
+--- a/t/lib/warnings/regexec
++++ b/t/lib/warnings/regexec
+@@ -260,3 +260,10 @@ setlocale(&POSIX::LC_CTYPE, $utf8_locale);
+ "k" =~ /(?[ \N{KELVIN SIGN} ])/i;
+ ":" =~ /(?[ \: ])/;
+ EXPECT
++########
++# NAME perl #132063, read beyond buffer end
++# OPTION fatal
++"\xff" =~ /(?il)\x{100}|\x{100}/;
++EXPECT
++Malformed UTF-8 character: \xff (too short; 1 byte available, need 13) in
pattern match (m//) at - line 2.
++Malformed UTF-8 character (fatal) at - line 2.
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt2.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt2.diff
new file mode 100644
index 0000000..ab6bb97
--- /dev/null
+++ b/devel/perl/patches/fixes/CVE-2018-6798/pt2.diff
@@ -0,0 +1,78 @@
+From 8c85016b620a661be615c2fe4e815e3882700294 Mon Sep 17 00:00:00 2001
+From: Yves Orton <demerphq AT gmail.com>
+Date: Tue, 13 Feb 2018 16:11:55 +1100
+Subject: 5.26.1: fix TRIE_READ_CHAR and DECL_TRIE_TYPE to account for
non-utf8
+ target
+
+Origin: upstream
+Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
+Patch-Name: fixes/CVE-2018-6798/pt2.diff
+---
+ regexec.c | 14 ++++++++++----
+ t/re/re_tests | 1 +
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/regexec.c b/regexec.c
+index fa888823b..cf81b07e3 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -1472,7 +1472,7 @@ Perl_re_intuit_start(pTHX_
+ #define DECL_TRIE_TYPE(scan) \
+ const enum { trie_plain, trie_utf8, trie_utf8_fold,
trie_latin_utf8_fold, \
+ trie_utf8_exactfa_fold, trie_latin_utf8_exactfa_fold,
\
+- trie_utf8l, trie_flu8 }
\
++ trie_utf8l, trie_flu8, trie_flu8_latin }
\
+ trie_type = ((scan->flags == EXACT)
\
+ ? (utf8_target ? trie_utf8 : trie_plain)
\
+ : (scan->flags == EXACTL)
\
+@@ -1482,10 +1482,12 @@ Perl_re_intuit_start(pTHX_
+ ? trie_utf8_exactfa_fold
\
+ : trie_latin_utf8_exactfa_fold)
\
+ : (scan->flags == EXACTFLU8
\
+- ? trie_flu8
\
++ ? (utf8_target
\
++ ? trie_flu8
\
++ : trie_flu8_latin)
\
+ : (utf8_target
\
+ ? trie_utf8_fold
\
+- : trie_latin_utf8_fold)))
++ : trie_latin_utf8_fold)))
+
+ /* 'uscan' is set to foldbuf, and incremented, so below the end of uscan is
+ * 'foldbuf+sizeof(foldbuf)' */
+@@ -1496,7 +1498,7 @@ STMT_START {
+ switch (trie_type) {
\
+ case trie_flu8:
\
+ _CHECK_AND_WARN_PROBLEMATIC_LOCALE;
\
+- if (utf8_target && UTF8_IS_ABOVE_LATIN1(*uc)) {
\
++ if (UTF8_IS_ABOVE_LATIN1(*uc)) {
\
+ _CHECK_AND_OUTPUT_WIDE_LOCALE_UTF8_MSG(uc, uc_end - uc);
\
+ }
\
+ goto do_trie_utf8_fold;
\
+@@ -1519,10 +1521,14 @@ STMT_START {
+ uscan = foldbuf + skiplen;
\
+ }
\
+ break;
\
++ case trie_flu8_latin:
\
++ _CHECK_AND_WARN_PROBLEMATIC_LOCALE;
\
++ goto do_trie_latin_utf8_fold;
\
+ case trie_latin_utf8_exactfa_fold:
\
+ flags |= FOLD_FLAGS_NOMIX_ASCII;
\
+ /* FALLTHROUGH */
\
+ case trie_latin_utf8_fold:
\
++ do_trie_latin_utf8_fold:
\
+ if ( foldlen>0 ) {
\
+ uvc = utf8n_to_uvchr( (const U8*) uscan, foldlen, &len,
uniflags ); \
+ foldlen -= len;
\
+diff --git a/t/re/re_tests b/t/re/re_tests
+index 410fceada..78baed6ff 100644
+--- a/t/re/re_tests
++++ b/t/re/re_tests
+@@ -1985,6 +1985,7 @@ AB\s+\x{100} AB \x{100}X y - -
+ /(?x)[a b]/xx \N{SPACE} yS $& # Note a space char
here
+ /(?xx)[a b]/x \N{SPACE} n - -
+ /(?-x:[a b])/xx \N{SPACE} yS $& # Note a
space char here
++(?il)\x{100}|\x{100}|\x{FF} \xFF y $& \xFF
+
+ # Keep these lines at the end of the file
+ # vim: softtabstop=0 noexpandtab
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt3.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt3.diff
new file mode 100644
index 0000000..8432f49
--- /dev/null
+++ b/devel/perl/patches/fixes/CVE-2018-6798/pt3.diff
@@ -0,0 +1,31 @@
+From b9ff660dc5b8aff8bfef2e243794139f30225d95 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony AT develop-help.com>
+Date: Mon, 19 Feb 2018 15:11:42 +1100
+Subject: (perl #132063) we should no longer warn for this code
+
+The first patch for 132063 prevented the buffer read overflow when
+dumping the warning but didn't fix the underlying problem.
+
+The next change treats the supplied buffer correctly, preventing the
+non-UTF-8 SV from being treated as UTF-8, preventing the warning.
+
+Origin: upstream
+Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
+Patch-Name: fixes/CVE-2018-6798/pt3.diff
+---
+ t/lib/warnings/regexec | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/t/lib/warnings/regexec b/t/lib/warnings/regexec
+index 6635142de..c370ddc3c 100644
+--- a/t/lib/warnings/regexec
++++ b/t/lib/warnings/regexec
+@@ -262,8 +262,5 @@ setlocale(&POSIX::LC_CTYPE, $utf8_locale);
+ EXPECT
+ ########
+ # NAME perl #132063, read beyond buffer end
+-# OPTION fatal
+ "\xff" =~ /(?il)\x{100}|\x{100}/;
+ EXPECT
+-Malformed UTF-8 character: \xff (too short; 1 byte available, need 13) in
pattern match (m//) at - line 2.
+-Malformed UTF-8 character (fatal) at - line 2.
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt4.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt4.diff
new file mode 100644
index 0000000..01affdc
--- /dev/null
+++ b/devel/perl/patches/fixes/CVE-2018-6798/pt4.diff
@@ -0,0 +1,68 @@
+From 49a88c56bf43c7c1142c694caf9499a967fca341 Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw AT cpan.org>
+Date: Tue, 13 Feb 2018 07:03:43 -0700
+Subject: utf8.c: Don't dump malformation past first NUL
+
+When a UTF-8 string contains a malformation, the bytes are dumped out as
+a debugging aid. One should exercise caution, however, and not dump out
+bytes that are actually past the end of the string. Commit 99a765e9e37
+from 2016 added the capability to signal to the dumping routines that
+we're not sure where the string ends, and to dump the minimal possible.
+
+It occurred to me that an additional safety measure can be easily added,
+which this commit does. And that is, in the dumping routines to stop at
+the first NUL. All strings automatically get a traiing NUL added, even
+if they contain embedded NULs. A NUL can never be part of a
+malformation, and so its presence likely signals the end of the string.
+
+Origin: upstream
+Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
+Patch-Name: fixes/CVE-2018-6798/pt4.diff
+---
+ utf8.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/utf8.c b/utf8.c
+index a3d5f61b6..61346f0cb 100644
+--- a/utf8.c
++++ b/utf8.c
+@@ -810,7 +810,7 @@ Perl__byte_dump_string(pTHX_ const U8 * s, const STRLEN
len, const bool format)
+ PERL_STATIC_INLINE char *
+ S_unexpected_non_continuation_text(pTHX_ const U8 * const s,
+
+- /* How many bytes to print */
++ /* Max number of bytes to print */
+ STRLEN print_len,
+
+ /* Which one is the
non-continuation */
+@@ -826,6 +826,8 @@ S_unexpected_non_continuation_text(pTHX_ const U8 *
const s,
+ ? "immediately"
+ : Perl_form(aTHX_ "%d bytes",
+ (int) non_cont_byte_pos);
++ const U8 * x = s + non_cont_byte_pos;
++ const U8 * e = s + print_len;
+
+ PERL_ARGS_ASSERT_UNEXPECTED_NON_CONTINUATION_TEXT;
+
+@@ -833,10 +835,20 @@ S_unexpected_non_continuation_text(pTHX_ const U8 *
const s,
+ * calculated, it's likely faster to pass it; verify under DEBUGGING */
+ assert(expect_len == UTF8SKIP(s));
+
++ /* As a defensive coding measure, don't output anything past a NUL.
Such
++ * bytes shouldn't be in the middle of a malformation, and could mark
the
++ * end of the allocated string, and what comes after is undefined */
++ for (; x < e; x++) {
++ if (*x == '\0') {
++ x++; /* Output this particular NUL */
++ break;
++ }
++ }
++
+ return Perl_form(aTHX_ "%s: %s (unexpected non-continuation byte
0x%02x,"
+ " %s after start byte 0x%02x; need %d bytes, got
%d)",
+ malformed_text,
+- _byte_dump_string(s, print_len, 0),
++ _byte_dump_string(s, x - s, 0),
+ *(s + non_cont_byte_pos),
+ where,
+ *s,
diff --git a/devel/perl/patches/fixes/CVE-2018-6913.diff
b/devel/perl/patches/fixes/CVE-2018-6913.diff
new file mode 100644
index 0000000..23a8599
--- /dev/null
+++ b/devel/perl/patches/fixes/CVE-2018-6913.diff
@@ -0,0 +1,141 @@
+From 5a4c71f68d92bbea9a01e5918b59e926b95d591a Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony AT develop-help.com>
+Date: Tue, 8 Aug 2017 09:32:58 +1000
+Subject: (perl #131844) fix various space calculation issues in pp_pack.c
+
+- for the originally reported case, if the start/cur pointer is in the
+ top 75% of the address space the add (cur) + glen addition would
+ overflow, resulting in the condition failing incorrectly.
+
+- the addition of the existing space used to the space needed could
+ overflow, resulting in too small an allocation and a buffer overflow.
+
+- the scaling for UTF8 could overflow.
+
+- the multiply to calculate the space needed for many items could
+ overflow.
+
+For the first case, do a space calculation without making new pointers.
+
+For the other cases, detect the overflow and croak if there's an
+overflow.
+
+Originally this used Size_t_MAX as the maximum size of a memory
+allocation, but for -DDEBUGGING builds realloc() throws a panic for
+allocations over half the address space in size, changing the error
+reported for the allocation.
+
+For non-DEBUGGING builds the Size_t_MAX limit has the small chance
+of finding a system that has 3GB of contiguous space available, and
+allocating that space, which could be a denial of servce in some cases.
+
+Unfortunately changing the limit to half the address space means that
+the exact case with the original issue can no longer occur, so the
+test is no longer testing against the address + length issue that
+caused the original problem, since the allocation is failing earlier.
+
+One option would be to change the test so the size request by pack is
+just under 2GB, but this has a higher (but still low) probability that
+the system has the address space available, and will actually try to
+allocate the memory, so let's not do that.
+
+Origin: upstream
+Bug: https://rt.perl.org/Public/Bug/Display.html?id=131844
+Patch-Name: fixes/CVE-2018-6913.diff
+---
+ pp_pack.c | 25 +++++++++++++++++++++----
+ t/op/pack.t | 24 +++++++++++++++++++++++-
+ 2 files changed, 44 insertions(+), 5 deletions(-)
+
+diff --git a/pp_pack.c b/pp_pack.c
+index 86d138bb0..485af0cfb 100644
+--- a/pp_pack.c
++++ b/pp_pack.c
+@@ -361,11 +361,28 @@ STMT_START {
\
+ } \
+ } STMT_END
+
++#define SAFE_UTF8_EXPAND(var) \
++STMT_START { \
++ if ((var) > SSize_t_MAX / UTF8_EXPAND) \
++ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
++ (var) = (var) * UTF8_EXPAND; \
++} STMT_END
++
++#define GROWING2(utf8, cat, start, cur, item_size, item_count) \
++STMT_START { \
++ if (SSize_t_MAX / (item_size) < (item_count)) \
++ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
++ GROWING((utf8), (cat), (start), (cur), (item_size) * (item_count)); \
++} STMT_END
++
+ #define GROWING(utf8, cat, start, cur, in_len) \
+ STMT_START { \
+ STRLEN glen = (in_len); \
+- if (utf8) glen *= UTF8_EXPAND; \
+- if ((cur) + glen >= (start) + SvLEN(cat)) { \
++ STRLEN catcur = (STRLEN)((cur) - (start)); \
++ if (utf8) SAFE_UTF8_EXPAND(glen); \
++ if (SSize_t_MAX - glen < catcur) \
++ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
++ if (catcur + glen >= SvLEN(cat)) { \
+ (start) = sv_exp_grow(cat, glen); \
+ (cur) = (start) + SvCUR(cat); \
+ } \
+@@ -375,7 +392,7 @@ STMT_START { \
+ STMT_START { \
+ const STRLEN glen = (in_len); \
+ STRLEN gl = glen; \
+- if (utf8) gl *= UTF8_EXPAND; \
++ if (utf8) SAFE_UTF8_EXPAND(gl); \
+ if ((cur) + gl >= (start) + SvLEN(cat)) { \
+ *cur = '\0'; \
+ SvCUR_set((cat), (cur) - (start)); \
+@@ -2135,7 +2152,7 @@ S_pack_rec(pTHX_ SV *cat, tempsym_t* symptr, SV
**beglist, SV **endlist )
+ if (props && !(props & PACK_SIZE_UNPREDICTABLE)) {
+ /* We can process this letter. */
+ STRLEN size = props & PACK_SIZE_MASK;
+- GROWING(utf8, cat, start, cur, (STRLEN) len * size);
++ GROWING2(utf8, cat, start, cur, size, (STRLEN)len);
+ }
+ }
+
+diff --git a/t/op/pack.t b/t/op/pack.t
+index 919e4c55c..745cd0d21 100644
+--- a/t/op/pack.t
++++ b/t/op/pack.t
+@@ -12,7 +12,7 @@ my $no_endianness = $] > 5.009 ? '' :
+ my $no_signedness = $] > 5.009 ? '' :
+ "Signed/unsigned pack modifiers not available on this perl";
+
+-plan tests => 14713;
++plan tests => 14717;
+
+ use strict;
+ use warnings qw(FATAL all);
+@@ -2059,3 +2059,25 @@ print pack("ucW", "0000", 0, 140737488355327) eq
"\$,#`P,```\n\0\x{7fffffffffff}
+ ? "ok\n" : "not ok\n";
+ EOS
+ }
++
++SKIP:
++{
++ # [perl #131844] pointer addition overflow
++ $Config{ptrsize} == 4
++ or skip "[perl #131844] need 32-bit build for this test", 4;
++ # prevent ASAN just crashing on the allocation failure
++ local $ENV{ASAN_OPTIONS} = $ENV{ASAN_OPTIONS};
++ $ENV{ASAN_OPTIONS} .= ",allocator_may_return_null=1";
++ fresh_perl_like('pack "f999999999"', qr/Out of memory during pack/, {
stderr => 1 },
++ "pointer addition overflow");
++
++ # integer (STRLEN) overflow from addition of glen to current length
++ fresh_perl_like('pack "c10f1073741823"', qr/Out of memory during pack/,
{ stderr => 1 },
++ "integer overflow calculating allocation (addition)");
++
++ fresh_perl_like('pack "W10f536870913", 256', qr/Out of memory during
pack/, { stderr => 1 },
++ "integer overflow calculating allocation (utf8)");
++
++ fresh_perl_like('pack "c10f1073741824"', qr/Out of memory during pack/,
{ stderr => 1 },
++ "integer overflow calculating allocation (multiply)");
++}
diff --git a/devel/vala/DEPENDS b/devel/vala/DEPENDS
index 9d23992..c55b63a 100755
--- a/devel/vala/DEPENDS
+++ b/devel/vala/DEPENDS
@@ -1,3 +1,4 @@
-depends glib2 &&
+depends bison &&
depends flex &&
-depends bison
+depends glib2 &&
+depends graphviz
diff --git a/devel/vala/HISTORY b/devel/vala/HISTORY
index 8952a82..66ce155 100644
--- a/devel/vala/HISTORY
+++ b/devel/vala/HISTORY
@@ -1,3 +1,6 @@
+2018-04-15 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * DEPENDS: add dependency on graphviz
+
2018-04-11 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DETAILS: stable version 0.40.3

diff --git a/utils/dbus-python/DETAILS b/utils/dbus-python/DETAILS
index a477efa..f5a22b9 100755
--- a/utils/dbus-python/DETAILS
+++ b/utils/dbus-python/DETAILS
@@ -1,5 +1,5 @@
SPELL=dbus-python
- VERSION=1.2.4
+ VERSION=1.2.6
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
SOURCE_URL[0]=https://dbus.freedesktop.org/releases/$SPELL/$SOURCE
diff --git a/utils/dbus-python/HISTORY b/utils/dbus-python/HISTORY
index 5eabf8e..a13713a 100644
--- a/utils/dbus-python/HISTORY
+++ b/utils/dbus-python/HISTORY
@@ -1,3 +1,6 @@
+2018-04-14 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * DETAILS: version 1.2.6
+
2017-02-28 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 1.2.4
* DETAILS: add gpg checking



  • [SM-Commit] GIT changes to master grimoire by Florian Franzmann (0cd4495d9652e7c959d981e7190739704b0a281c), Florian Franzmann, 04/15/2018

Archive powered by MHonArc 2.6.24.

Top of Page