Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Florian Franzmann (08be7a665f8675dc73108413f2e32009eba3dd77)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Florian Franzmann <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Florian Franzmann (08be7a665f8675dc73108413f2e32009eba3dd77)
  • Date: Sun, 15 Apr 2018 18:12:23 +0000

GIT changes to master grimoire by Florian Franzmann
<siflfran AT hawo.stw.uni-erlangen.de>:

devel/perl/DETAILS | 4
devel/perl/HISTORY | 3
devel/perl/PRE_BUILD | 10 -
devel/perl/patches/fixes/CVE-2018-6797.diff | 56 ---------
devel/perl/patches/fixes/CVE-2018-6798/pt1.diff | 133 ----------------------
devel/perl/patches/fixes/CVE-2018-6798/pt2.diff | 78 -------------
devel/perl/patches/fixes/CVE-2018-6798/pt3.diff | 31 -----
devel/perl/patches/fixes/CVE-2018-6798/pt4.diff | 68 -----------
devel/perl/patches/fixes/CVE-2018-6913.diff | 141
------------------------
9 files changed, 5 insertions(+), 519 deletions(-)

New commits:
commit 08be7a665f8675dc73108413f2e32009eba3dd77
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

devel/perl: version 5.26.2

diff --git a/devel/perl/DETAILS b/devel/perl/DETAILS
index 247ff78..7433b02 100755
--- a/devel/perl/DETAILS
+++ b/devel/perl/DETAILS
@@ -1,6 +1,6 @@
SPELL=perl
- VERSION=5.26.1
- SOURCE_HASH=sha1:403bb1804cb41416153d908eea093f2be22a77f6:UPSTREAM_HASH
+ VERSION=5.26.2
+ SOURCE_HASH=sha1:bfa5c7921ed7bf5e035dbf2f7ff81367b81e372c:UPSTREAM_HASH
SECURITY_PATCH=5
SOURCE=$SPELL-$VERSION.tar.xz
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
diff --git a/devel/perl/HISTORY b/devel/perl/HISTORY
index af24ef8..f2bee46 100644
--- a/devel/perl/HISTORY
+++ b/devel/perl/HISTORY
@@ -9,6 +9,9 @@
CVE-2018-6798 and CVE-2018-6913
* DETAILS: SECURITY_PATCH++

+ * DETAILS: version 5.26.2
+ * patches/*, PRE_BUILD: removed
+
2017-09-23 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS: version 5.26.1

diff --git a/devel/perl/PRE_BUILD b/devel/perl/PRE_BUILD
deleted file mode 100755
index eb27896..0000000
--- a/devel/perl/PRE_BUILD
+++ /dev/null
@@ -1,10 +0,0 @@
-default_pre_build &&
-cd "$SOURCE_DIRECTORY" &&
-
-patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6797.diff" &&
-patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt1.diff" &&
-patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt2.diff" &&
-patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt3.diff" &&
-patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6798/pt4.diff" &&
-patch -p1 < "$SPELL_DIRECTORY/patches/fixes/CVE-2018-6913.diff"
-
diff --git a/devel/perl/patches/fixes/CVE-2018-6797.diff
b/devel/perl/patches/fixes/CVE-2018-6797.diff
deleted file mode 100644
index a4c9ced..0000000
--- a/devel/perl/patches/fixes/CVE-2018-6797.diff
+++ /dev/null
@@ -1,56 +0,0 @@
-From 1832958010691635c3346100ab10223bbfc05638 Mon Sep 17 00:00:00 2001
-From: Karl Williamson <khw AT cpan.org>
-Date: Fri, 2 Feb 2018 15:14:27 -0700
-Subject: (perl #132227) restart a node if we change to uni rules within the
- node and encounter a sharp S
-
-This could lead to a buffer overflow.
-
-Test case backported from the corresponding blead fix by Niko Tyni.
-
-Origin: backport
-Bug: https://rt.perl.org/Public/Bug/Display.html?id=132227
-Patch-Name: fixes/CVE-2018-6797.diff
----
- regcomp.c | 12 ++++++++++++
- t/re/pat_advanced.t | 4 ++++
- 2 files changed, 16 insertions(+)
-
-diff --git a/regcomp.c b/regcomp.c
-index 9641f03f4..4baf65c8c 100644
---- a/regcomp.c
-+++ b/regcomp.c
-@@ -13538,6 +13538,18 @@ S_regatom(pTHX_ RExC_state_t *pRExC_state, I32
*flagp, U32 depth)
- * /u. This includes the multi-char fold SHARP S to
- * 'ss' */
- if (UNLIKELY(ender == LATIN_SMALL_LETTER_SHARP_S)) {
-+
-+ /* If the node started out having uni rules, we
-+ * wouldn't have gotten here. So this means
-+ * something in the middle has changed it, but
-+ * didn't think it needed to reparse. But this
-+ * sharp s now does indicate the need for
-+ * reparsing. */
-+ if (RExC_uni_semantics) {
-+ p = oldp;
-+ goto loopdone;
-+ }
-+
- RExC_seen_unfolded_sharp_s = 1;
- maybe_exactfu = FALSE;
- }
-diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t
-index 5e5cc1f1f..27df5509e 100644
---- a/t/re/pat_advanced.t
-+++ b/t/re/pat_advanced.t
-@@ -2336,6 +2336,10 @@ EOF
- unlike("s\N{U+DF}", qr/^\x{00DF}/i, "\"s\\N{U+DF}\",
qr/^\\x{00DF}/i");
- }
-
-+ { # Bug #132227, caused failed assertion
-+
ok(qr/0b\N{U+41}\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xDF/i,
"No seqgfault [perl #132227]");
-+ }
-+
- # User-defined Unicode properties to match above-Unicode code points
- sub Is_32_Bit_Super { return "110000\tFFFFFFFF\n" }
- sub Is_Portable_Super { return '!utf8::Any' } # Matches beyond 32 bits
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt1.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt1.diff
deleted file mode 100644
index d87ba75..0000000
--- a/devel/perl/patches/fixes/CVE-2018-6798/pt1.diff
+++ /dev/null
@@ -1,133 +0,0 @@
-From b36a6ec67585c678241f7da4148e7ef89021d6d1 Mon Sep 17 00:00:00 2001
-From: Karl Williamson <khw AT cpan.org>
-Date: Tue, 6 Feb 2018 14:50:48 -0700
-Subject: Heap buffer overflow
-
-The proximal cause is several instances in regexec.c of the code
-assuming that the input was valid UTF-8, whereas the input was too short
-for what the start byte claimed it would be.
-
-I grepped through the core for any other similar uses, and did not find
-any.
-
-Origin: upstream
-Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
-Patch-Name: fixes/CVE-2018-6798/pt1.diff
----
- regexec.c | 33 ++++++++++++++++++---------------
- t/lib/warnings/regexec | 7 +++++++
- 2 files changed, 25 insertions(+), 15 deletions(-)
-
-diff --git a/regexec.c b/regexec.c
-index 134b196fc..fa888823b 100644
---- a/regexec.c
-+++ b/regexec.c
-@@ -1487,7 +1487,9 @@ Perl_re_intuit_start(pTHX_
- ? trie_utf8_fold
\
- : trie_latin_utf8_fold)))
-
--#define REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap, uc, uscan, len,
uvc, charid, foldlen, foldbuf, uniflags) \
-+/* 'uscan' is set to foldbuf, and incremented, so below the end of uscan is
-+ * 'foldbuf+sizeof(foldbuf)' */
-+#define REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap, uc, uc_end,
uscan, len, uvc, charid, foldlen, foldbuf, uniflags) \
- STMT_START {
\
- STRLEN skiplen;
\
- U8 flags = FOLD_FLAGS_FULL;
\
-@@ -1495,7 +1497,7 @@ STMT_START {
- case trie_flu8:
\
- _CHECK_AND_WARN_PROBLEMATIC_LOCALE;
\
- if (utf8_target && UTF8_IS_ABOVE_LATIN1(*uc)) {
\
-- _CHECK_AND_OUTPUT_WIDE_LOCALE_UTF8_MSG(uc, uc + UTF8SKIP(uc));
\
-+ _CHECK_AND_OUTPUT_WIDE_LOCALE_UTF8_MSG(uc, uc_end - uc);
\
- }
\
- goto do_trie_utf8_fold;
\
- case trie_utf8_exactfa_fold:
\
-@@ -1504,14 +1506,14 @@ STMT_START {
- case trie_utf8_fold:
\
- do_trie_utf8_fold:
\
- if ( foldlen>0 ) {
\
-- uvc = utf8n_to_uvchr( (const U8*) uscan, UTF8_MAXLEN, &len,
uniflags ); \
-+ uvc = utf8n_to_uvchr( (const U8*) uscan, foldlen, &len,
uniflags ); \
- foldlen -= len;
\
- uscan += len;
\
- len=0;
\
- } else {
\
-- len = UTF8SKIP(uc);
\
-- uvc = _toFOLD_utf8_flags( (const U8*) uc, uc + len, foldbuf,
&foldlen, \
-+ uvc = _toFOLD_utf8_flags( (const U8*) uc, uc_end, foldbuf,
&foldlen, \
-
flags); \
-+ len = UTF8SKIP(uc);
\
- skiplen = UVCHR_SKIP( uvc );
\
- foldlen -= skiplen;
\
- uscan = foldbuf + skiplen;
\
-@@ -1522,7 +1524,7 @@ STMT_START {
- /* FALLTHROUGH */
\
- case trie_latin_utf8_fold:
\
- if ( foldlen>0 ) {
\
-- uvc = utf8n_to_uvchr( (const U8*) uscan, UTF8_MAXLEN, &len,
uniflags ); \
-+ uvc = utf8n_to_uvchr( (const U8*) uscan, foldlen, &len,
uniflags ); \
- foldlen -= len;
\
- uscan += len;
\
- len=0;
\
-@@ -1541,7 +1543,7 @@ STMT_START {
- }
\
- /* FALLTHROUGH */
\
- case trie_utf8:
\
-- uvc = utf8n_to_uvchr( (const U8*) uc, UTF8_MAXLEN, &len, uniflags
); \
-+ uvc = utf8n_to_uvchr( (const U8*) uc, uc_end - uc, &len, uniflags
); \
- break;
\
- case trie_plain:
\
- uvc = (UV)*uc;
\
-@@ -2623,10 +2625,10 @@ S_find_byclass(pTHX_ regexp * prog, const regnode
*c, char *s,
- }
- points[pointpos++ % maxlen]= uc;
- if (foldlen || uc < (U8*)strend) {
-- REXEC_TRIE_READ_CHAR(trie_type, trie,
-- widecharmap, uc,
-- uscan, len, uvc, charid, foldlen,
-- foldbuf, uniflags);
-+ REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap,
uc,
-+ (U8 *) strend, uscan, len, uvc,
-+ charid, foldlen, foldbuf,
-+ uniflags);
- DEBUG_TRIE_EXECUTE_r({
- dump_exec_pos( (char *)uc, c, strend,
- real_start, s, utf8_target, 0);
-@@ -5686,8 +5688,9 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char
*startpos, regnode *prog)
- if ( base && (foldlen || uc < (U8*)(reginfo->strend))) {
- I32 offset;
- REXEC_TRIE_READ_CHAR(trie_type, trie, widecharmap, uc,
-- uscan, len, uvc, charid, foldlen,
-- foldbuf, uniflags);
-+ (U8 *) reginfo->strend, uscan,
-+ len, uvc, charid, foldlen,
-+ foldbuf, uniflags);
- charcount++;
- if (foldlen>0)
- ST.longfold = TRUE;
-@@ -5822,8 +5825,8 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char
*startpos, regnode *prog)
- while (foldlen) {
- if (!--chars)
- break;
-- uvc = utf8n_to_uvchr(uscan, UTF8_MAXLEN, &len,
-- uniflags);
-+ uvc = utf8n_to_uvchr(uscan, foldlen, &len,
-+ uniflags);
- uscan += len;
- foldlen -= len;
- }
-diff --git a/t/lib/warnings/regexec b/t/lib/warnings/regexec
-index 900dd6ee7..6635142de 100644
---- a/t/lib/warnings/regexec
-+++ b/t/lib/warnings/regexec
-@@ -260,3 +260,10 @@ setlocale(&POSIX::LC_CTYPE, $utf8_locale);
- "k" =~ /(?[ \N{KELVIN SIGN} ])/i;
- ":" =~ /(?[ \: ])/;
- EXPECT
-+########
-+# NAME perl #132063, read beyond buffer end
-+# OPTION fatal
-+"\xff" =~ /(?il)\x{100}|\x{100}/;
-+EXPECT
-+Malformed UTF-8 character: \xff (too short; 1 byte available, need 13) in
pattern match (m//) at - line 2.
-+Malformed UTF-8 character (fatal) at - line 2.
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt2.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt2.diff
deleted file mode 100644
index ab6bb97..0000000
--- a/devel/perl/patches/fixes/CVE-2018-6798/pt2.diff
+++ /dev/null
@@ -1,78 +0,0 @@
-From 8c85016b620a661be615c2fe4e815e3882700294 Mon Sep 17 00:00:00 2001
-From: Yves Orton <demerphq AT gmail.com>
-Date: Tue, 13 Feb 2018 16:11:55 +1100
-Subject: 5.26.1: fix TRIE_READ_CHAR and DECL_TRIE_TYPE to account for
non-utf8
- target
-
-Origin: upstream
-Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
-Patch-Name: fixes/CVE-2018-6798/pt2.diff
----
- regexec.c | 14 ++++++++++----
- t/re/re_tests | 1 +
- 2 files changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/regexec.c b/regexec.c
-index fa888823b..cf81b07e3 100644
---- a/regexec.c
-+++ b/regexec.c
-@@ -1472,7 +1472,7 @@ Perl_re_intuit_start(pTHX_
- #define DECL_TRIE_TYPE(scan) \
- const enum { trie_plain, trie_utf8, trie_utf8_fold,
trie_latin_utf8_fold, \
- trie_utf8_exactfa_fold, trie_latin_utf8_exactfa_fold,
\
-- trie_utf8l, trie_flu8 }
\
-+ trie_utf8l, trie_flu8, trie_flu8_latin }
\
- trie_type = ((scan->flags == EXACT)
\
- ? (utf8_target ? trie_utf8 : trie_plain)
\
- : (scan->flags == EXACTL)
\
-@@ -1482,10 +1482,12 @@ Perl_re_intuit_start(pTHX_
- ? trie_utf8_exactfa_fold
\
- : trie_latin_utf8_exactfa_fold)
\
- : (scan->flags == EXACTFLU8
\
-- ? trie_flu8
\
-+ ? (utf8_target
\
-+ ? trie_flu8
\
-+ : trie_flu8_latin)
\
- : (utf8_target
\
- ? trie_utf8_fold
\
-- : trie_latin_utf8_fold)))
-+ : trie_latin_utf8_fold)))
-
- /* 'uscan' is set to foldbuf, and incremented, so below the end of uscan is
- * 'foldbuf+sizeof(foldbuf)' */
-@@ -1496,7 +1498,7 @@ STMT_START {
- switch (trie_type) {
\
- case trie_flu8:
\
- _CHECK_AND_WARN_PROBLEMATIC_LOCALE;
\
-- if (utf8_target && UTF8_IS_ABOVE_LATIN1(*uc)) {
\
-+ if (UTF8_IS_ABOVE_LATIN1(*uc)) {
\
- _CHECK_AND_OUTPUT_WIDE_LOCALE_UTF8_MSG(uc, uc_end - uc);
\
- }
\
- goto do_trie_utf8_fold;
\
-@@ -1519,10 +1521,14 @@ STMT_START {
- uscan = foldbuf + skiplen;
\
- }
\
- break;
\
-+ case trie_flu8_latin:
\
-+ _CHECK_AND_WARN_PROBLEMATIC_LOCALE;
\
-+ goto do_trie_latin_utf8_fold;
\
- case trie_latin_utf8_exactfa_fold:
\
- flags |= FOLD_FLAGS_NOMIX_ASCII;
\
- /* FALLTHROUGH */
\
- case trie_latin_utf8_fold:
\
-+ do_trie_latin_utf8_fold:
\
- if ( foldlen>0 ) {
\
- uvc = utf8n_to_uvchr( (const U8*) uscan, foldlen, &len,
uniflags ); \
- foldlen -= len;
\
-diff --git a/t/re/re_tests b/t/re/re_tests
-index 410fceada..78baed6ff 100644
---- a/t/re/re_tests
-+++ b/t/re/re_tests
-@@ -1985,6 +1985,7 @@ AB\s+\x{100} AB \x{100}X y - -
- /(?x)[a b]/xx \N{SPACE} yS $& # Note a space char
here
- /(?xx)[a b]/x \N{SPACE} n - -
- /(?-x:[a b])/xx \N{SPACE} yS $& # Note a
space char here
-+(?il)\x{100}|\x{100}|\x{FF} \xFF y $& \xFF
-
- # Keep these lines at the end of the file
- # vim: softtabstop=0 noexpandtab
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt3.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt3.diff
deleted file mode 100644
index 8432f49..0000000
--- a/devel/perl/patches/fixes/CVE-2018-6798/pt3.diff
+++ /dev/null
@@ -1,31 +0,0 @@
-From b9ff660dc5b8aff8bfef2e243794139f30225d95 Mon Sep 17 00:00:00 2001
-From: Tony Cook <tony AT develop-help.com>
-Date: Mon, 19 Feb 2018 15:11:42 +1100
-Subject: (perl #132063) we should no longer warn for this code
-
-The first patch for 132063 prevented the buffer read overflow when
-dumping the warning but didn't fix the underlying problem.
-
-The next change treats the supplied buffer correctly, preventing the
-non-UTF-8 SV from being treated as UTF-8, preventing the warning.
-
-Origin: upstream
-Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
-Patch-Name: fixes/CVE-2018-6798/pt3.diff
----
- t/lib/warnings/regexec | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/t/lib/warnings/regexec b/t/lib/warnings/regexec
-index 6635142de..c370ddc3c 100644
---- a/t/lib/warnings/regexec
-+++ b/t/lib/warnings/regexec
-@@ -262,8 +262,5 @@ setlocale(&POSIX::LC_CTYPE, $utf8_locale);
- EXPECT
- ########
- # NAME perl #132063, read beyond buffer end
--# OPTION fatal
- "\xff" =~ /(?il)\x{100}|\x{100}/;
- EXPECT
--Malformed UTF-8 character: \xff (too short; 1 byte available, need 13) in
pattern match (m//) at - line 2.
--Malformed UTF-8 character (fatal) at - line 2.
diff --git a/devel/perl/patches/fixes/CVE-2018-6798/pt4.diff
b/devel/perl/patches/fixes/CVE-2018-6798/pt4.diff
deleted file mode 100644
index 01affdc..0000000
--- a/devel/perl/patches/fixes/CVE-2018-6798/pt4.diff
+++ /dev/null
@@ -1,68 +0,0 @@
-From 49a88c56bf43c7c1142c694caf9499a967fca341 Mon Sep 17 00:00:00 2001
-From: Karl Williamson <khw AT cpan.org>
-Date: Tue, 13 Feb 2018 07:03:43 -0700
-Subject: utf8.c: Don't dump malformation past first NUL
-
-When a UTF-8 string contains a malformation, the bytes are dumped out as
-a debugging aid. One should exercise caution, however, and not dump out
-bytes that are actually past the end of the string. Commit 99a765e9e37
-from 2016 added the capability to signal to the dumping routines that
-we're not sure where the string ends, and to dump the minimal possible.
-
-It occurred to me that an additional safety measure can be easily added,
-which this commit does. And that is, in the dumping routines to stop at
-the first NUL. All strings automatically get a traiing NUL added, even
-if they contain embedded NULs. A NUL can never be part of a
-malformation, and so its presence likely signals the end of the string.
-
-Origin: upstream
-Bug: https://rt.perl.org/Public/Bug/Display.html?id=132063
-Patch-Name: fixes/CVE-2018-6798/pt4.diff
----
- utf8.c | 16 ++++++++++++++--
- 1 file changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/utf8.c b/utf8.c
-index a3d5f61b6..61346f0cb 100644
---- a/utf8.c
-+++ b/utf8.c
-@@ -810,7 +810,7 @@ Perl__byte_dump_string(pTHX_ const U8 * s, const STRLEN
len, const bool format)
- PERL_STATIC_INLINE char *
- S_unexpected_non_continuation_text(pTHX_ const U8 * const s,
-
-- /* How many bytes to print */
-+ /* Max number of bytes to print */
- STRLEN print_len,
-
- /* Which one is the
non-continuation */
-@@ -826,6 +826,8 @@ S_unexpected_non_continuation_text(pTHX_ const U8 *
const s,
- ? "immediately"
- : Perl_form(aTHX_ "%d bytes",
- (int) non_cont_byte_pos);
-+ const U8 * x = s + non_cont_byte_pos;
-+ const U8 * e = s + print_len;
-
- PERL_ARGS_ASSERT_UNEXPECTED_NON_CONTINUATION_TEXT;
-
-@@ -833,10 +835,20 @@ S_unexpected_non_continuation_text(pTHX_ const U8 *
const s,
- * calculated, it's likely faster to pass it; verify under DEBUGGING */
- assert(expect_len == UTF8SKIP(s));
-
-+ /* As a defensive coding measure, don't output anything past a NUL.
Such
-+ * bytes shouldn't be in the middle of a malformation, and could mark
the
-+ * end of the allocated string, and what comes after is undefined */
-+ for (; x < e; x++) {
-+ if (*x == '\0') {
-+ x++; /* Output this particular NUL */
-+ break;
-+ }
-+ }
-+
- return Perl_form(aTHX_ "%s: %s (unexpected non-continuation byte
0x%02x,"
- " %s after start byte 0x%02x; need %d bytes, got
%d)",
- malformed_text,
-- _byte_dump_string(s, print_len, 0),
-+ _byte_dump_string(s, x - s, 0),
- *(s + non_cont_byte_pos),
- where,
- *s,
diff --git a/devel/perl/patches/fixes/CVE-2018-6913.diff
b/devel/perl/patches/fixes/CVE-2018-6913.diff
deleted file mode 100644
index 23a8599..0000000
--- a/devel/perl/patches/fixes/CVE-2018-6913.diff
+++ /dev/null
@@ -1,141 +0,0 @@
-From 5a4c71f68d92bbea9a01e5918b59e926b95d591a Mon Sep 17 00:00:00 2001
-From: Tony Cook <tony AT develop-help.com>
-Date: Tue, 8 Aug 2017 09:32:58 +1000
-Subject: (perl #131844) fix various space calculation issues in pp_pack.c
-
-- for the originally reported case, if the start/cur pointer is in the
- top 75% of the address space the add (cur) + glen addition would
- overflow, resulting in the condition failing incorrectly.
-
-- the addition of the existing space used to the space needed could
- overflow, resulting in too small an allocation and a buffer overflow.
-
-- the scaling for UTF8 could overflow.
-
-- the multiply to calculate the space needed for many items could
- overflow.
-
-For the first case, do a space calculation without making new pointers.
-
-For the other cases, detect the overflow and croak if there's an
-overflow.
-
-Originally this used Size_t_MAX as the maximum size of a memory
-allocation, but for -DDEBUGGING builds realloc() throws a panic for
-allocations over half the address space in size, changing the error
-reported for the allocation.
-
-For non-DEBUGGING builds the Size_t_MAX limit has the small chance
-of finding a system that has 3GB of contiguous space available, and
-allocating that space, which could be a denial of servce in some cases.
-
-Unfortunately changing the limit to half the address space means that
-the exact case with the original issue can no longer occur, so the
-test is no longer testing against the address + length issue that
-caused the original problem, since the allocation is failing earlier.
-
-One option would be to change the test so the size request by pack is
-just under 2GB, but this has a higher (but still low) probability that
-the system has the address space available, and will actually try to
-allocate the memory, so let's not do that.
-
-Origin: upstream
-Bug: https://rt.perl.org/Public/Bug/Display.html?id=131844
-Patch-Name: fixes/CVE-2018-6913.diff
----
- pp_pack.c | 25 +++++++++++++++++++++----
- t/op/pack.t | 24 +++++++++++++++++++++++-
- 2 files changed, 44 insertions(+), 5 deletions(-)
-
-diff --git a/pp_pack.c b/pp_pack.c
-index 86d138bb0..485af0cfb 100644
---- a/pp_pack.c
-+++ b/pp_pack.c
-@@ -361,11 +361,28 @@ STMT_START {
\
- } \
- } STMT_END
-
-+#define SAFE_UTF8_EXPAND(var) \
-+STMT_START { \
-+ if ((var) > SSize_t_MAX / UTF8_EXPAND) \
-+ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
-+ (var) = (var) * UTF8_EXPAND; \
-+} STMT_END
-+
-+#define GROWING2(utf8, cat, start, cur, item_size, item_count) \
-+STMT_START { \
-+ if (SSize_t_MAX / (item_size) < (item_count)) \
-+ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
-+ GROWING((utf8), (cat), (start), (cur), (item_size) * (item_count)); \
-+} STMT_END
-+
- #define GROWING(utf8, cat, start, cur, in_len) \
- STMT_START { \
- STRLEN glen = (in_len); \
-- if (utf8) glen *= UTF8_EXPAND; \
-- if ((cur) + glen >= (start) + SvLEN(cat)) { \
-+ STRLEN catcur = (STRLEN)((cur) - (start)); \
-+ if (utf8) SAFE_UTF8_EXPAND(glen); \
-+ if (SSize_t_MAX - glen < catcur) \
-+ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
-+ if (catcur + glen >= SvLEN(cat)) { \
- (start) = sv_exp_grow(cat, glen); \
- (cur) = (start) + SvCUR(cat); \
- } \
-@@ -375,7 +392,7 @@ STMT_START { \
- STMT_START { \
- const STRLEN glen = (in_len); \
- STRLEN gl = glen; \
-- if (utf8) gl *= UTF8_EXPAND; \
-+ if (utf8) SAFE_UTF8_EXPAND(gl); \
- if ((cur) + gl >= (start) + SvLEN(cat)) { \
- *cur = '\0'; \
- SvCUR_set((cat), (cur) - (start)); \
-@@ -2135,7 +2152,7 @@ S_pack_rec(pTHX_ SV *cat, tempsym_t* symptr, SV
**beglist, SV **endlist )
- if (props && !(props & PACK_SIZE_UNPREDICTABLE)) {
- /* We can process this letter. */
- STRLEN size = props & PACK_SIZE_MASK;
-- GROWING(utf8, cat, start, cur, (STRLEN) len * size);
-+ GROWING2(utf8, cat, start, cur, size, (STRLEN)len);
- }
- }
-
-diff --git a/t/op/pack.t b/t/op/pack.t
-index 919e4c55c..745cd0d21 100644
---- a/t/op/pack.t
-+++ b/t/op/pack.t
-@@ -12,7 +12,7 @@ my $no_endianness = $] > 5.009 ? '' :
- my $no_signedness = $] > 5.009 ? '' :
- "Signed/unsigned pack modifiers not available on this perl";
-
--plan tests => 14713;
-+plan tests => 14717;
-
- use strict;
- use warnings qw(FATAL all);
-@@ -2059,3 +2059,25 @@ print pack("ucW", "0000", 0, 140737488355327) eq
"\$,#`P,```\n\0\x{7fffffffffff}
- ? "ok\n" : "not ok\n";
- EOS
- }
-+
-+SKIP:
-+{
-+ # [perl #131844] pointer addition overflow
-+ $Config{ptrsize} == 4
-+ or skip "[perl #131844] need 32-bit build for this test", 4;
-+ # prevent ASAN just crashing on the allocation failure
-+ local $ENV{ASAN_OPTIONS} = $ENV{ASAN_OPTIONS};
-+ $ENV{ASAN_OPTIONS} .= ",allocator_may_return_null=1";
-+ fresh_perl_like('pack "f999999999"', qr/Out of memory during pack/, {
stderr => 1 },
-+ "pointer addition overflow");
-+
-+ # integer (STRLEN) overflow from addition of glen to current length
-+ fresh_perl_like('pack "c10f1073741823"', qr/Out of memory during pack/,
{ stderr => 1 },
-+ "integer overflow calculating allocation (addition)");
-+
-+ fresh_perl_like('pack "W10f536870913", 256', qr/Out of memory during
pack/, { stderr => 1 },
-+ "integer overflow calculating allocation (utf8)");
-+
-+ fresh_perl_like('pack "c10f1073741824"', qr/Out of memory during pack/,
{ stderr => 1 },
-+ "integer overflow calculating allocation (multiply)");
-+}



  • [SM-Commit] GIT changes to master grimoire by Florian Franzmann (08be7a665f8675dc73108413f2e32009eba3dd77), Florian Franzmann, 04/15/2018

Archive powered by MHonArc 2.6.24.

Top of Page