sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

[SM-Commit] GIT changes to master grimoire by Florian Franzmann (26db033cf63be482dec8378b9f7e5c74d9b1cc7b)

From: Florian Franzmann <scm AT sourcemage.org>
To: sm-commit AT lists.ibiblio.org
Subject: [SM-Commit] GIT changes to master grimoire by Florian Franzmann (26db033cf63be482dec8378b9f7e5c74d9b1cc7b)
Date: Tue, 11 Feb 2020 21:07:30 +0000

GIT changes to master grimoire by Florian Franzmann
<siflfran AT hawo.stw.uni-erlangen.de>:

kernels/linux/HISTORY | 4
kernels/linux/info/patches/maintenance_patches_5/patch-5.5.3 | 5
kernels/linux/latest.defaults | 2
libs/libexif/DETAILS | 2
libs/libexif/HISTORY | 6
libs/libexif/PRE_BUILD | 2
libs/libexif/patches/libexif-0.6.21-CVE-2017-7544.patch | 30 ++
libs/libexif/patches/libexif-0.6.21-CVE-2018-20030.patch | 117
+++++++++++
libs/libexif/patches/libexif-0.6.21-CVE-2019-9278.patch | 56 +++++
python-pypi/python-sphinx/DETAILS | 4
python-pypi/python-sphinx/HISTORY | 3
11 files changed, 227 insertions(+), 4 deletions(-)

New commits:
commit 26db033cf63be482dec8378b9f7e5c74d9b1cc7b
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

libs/libexif: fix three security issues

commit bed4b670cdbd777a73071f95d3201b53e2dcff67
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

kernels/linux: version 5.5.3

commit 8bc0f5a7be9afdf3d8d65bbe69d53c147ac45da2
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

python-pypi/python-sphinx: version 2.4.1

diff --git a/kernels/linux/HISTORY b/kernels/linux/HISTORY
index e05e76e..7183ee1 100644
--- a/kernels/linux/HISTORY
+++ b/kernels/linux/HISTORY
@@ -1,3 +1,7 @@
+2020-02-11 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * latest.defaults: LATEST_maintenance_patches_5=patch-5.5.3
+ * info/patches/maintenance_patches_5/patch-5.5.3: added
+
2020-02-06 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* latest.defaults: LATEST_maintenance_patches_5=patch-5.5.2
* info/patches/maintenance_patches_5/patch-5.5.2: added
diff --git a/kernels/linux/info/patches/maintenance_patches_5/patch-5.5.3
b/kernels/linux/info/patches/maintenance_patches_5/patch-5.5.3
new file mode 100755
index 0000000..4cb4af4
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_5/patch-5.5.3
@@ -0,0 +1,5 @@
+appliedkernels="5.5"
+patchversion="${appliedkernels}.3"
+source="patch-${patchversion}.xz"
+source_url="${KERNEL_URL}/pub/linux/kernel/v5.x/${source}"
+sha512sum="afd2a60710ea5d153611bc2b4cb523552cddc111ee06d1eb722467b46ed81038553c9643f847c7e16ca2d632c03c886ace60b6c6f755ea6ed5aca22cc0bc89cc"
diff --git a/kernels/linux/latest.defaults b/kernels/linux/latest.defaults
index f67ce29..2734aeb 100644
--- a/kernels/linux/latest.defaults
+++ b/kernels/linux/latest.defaults
@@ -1,2 +1,2 @@
LATEST_5=5.5
-LATEST_maintenance_patches_5=patch-5.5.2
+LATEST_maintenance_patches_5=patch-5.5.3
diff --git a/libs/libexif/DETAILS b/libs/libexif/DETAILS
index a92cab4..54c7b0b 100755
--- a/libs/libexif/DETAILS
+++ b/libs/libexif/DETAILS
@@ -7,7 +7,7 @@

SOURCE_URL[0]=https://github.com/libexif/libexif/archive/libexif-$XVERSION-release.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$SPELL-$XVERSION-release
LICENSE[0]=LGPL
- SECURITY_PATCH=2
+ SECURITY_PATCH=5
WEB_SITE=https://libexif.github.io/
ENTERED=20030325
KEYWORDS="libs"
diff --git a/libs/libexif/HISTORY b/libs/libexif/HISTORY
index ad6459e..843ff88 100644
--- a/libs/libexif/HISTORY
+++ b/libs/libexif/HISTORY
@@ -1,3 +1,9 @@
+2020-02-11 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * patches/{libexif-0.6.21-CVE-2017-7544.patch,
+ libexif-0.6.21-CVE-2018-20030.patch,
+ libexif-0.6.21-CVE-2019-9278.patch}, PRE_BUILD: fix security issues,
+ patches from gentoo and lfs
+
2020-01-01 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DETAILS: fix WEB_SITE
* DETAILS, DEPENDS, PRE_BUILD: fetch source from github
diff --git a/libs/libexif/PRE_BUILD b/libs/libexif/PRE_BUILD
index 70c9a7a..a9f07bc 100755
--- a/libs/libexif/PRE_BUILD
+++ b/libs/libexif/PRE_BUILD
@@ -1,6 +1,8 @@
default_pre_build &&
cd "$SOURCE_DIRECTORY" &&

+apply_patch_dir patches &&
+
autoreconf -fi &&

sedit 's!maybe_os in$!& linux-musl*|\\!' config.sub
diff --git a/libs/libexif/patches/libexif-0.6.21-CVE-2017-7544.patch
b/libs/libexif/patches/libexif-0.6.21-CVE-2017-7544.patch
new file mode 100644
index 0000000..5348174
--- /dev/null
+++ b/libs/libexif/patches/libexif-0.6.21-CVE-2017-7544.patch
@@ -0,0 +1,30 @@
+From c39acd1692023b26290778a02a9232c873f9d71a Mon Sep 17 00:00:00 2001
+From: Marcus Meissner <marcus AT jet.franken.de>
+Date: Tue, 25 Jul 2017 23:38:56 +0200
+Subject: [PATCH] On saving makernotes, make sure the makernote container tags
+ has a type with 1 byte components.
+
+Fixes (at least):
+ https://sourceforge.net/p/libexif/bugs/130
+ https://sourceforge.net/p/libexif/bugs/129
+---
+ libexif/exif-data.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libexif/exif-data.c b/libexif/exif-data.c
+index 67df4db..91f4c33 100644
+--- a/libexif/exif-data.c
++++ b/libexif/exif-data.c
+@@ -255,6 +255,12 @@ exif_data_save_data_entry (ExifData *data, ExifEntry *e,
+ exif_mnote_data_set_offset (data->priv->md, *ds - 6);
+ exif_mnote_data_save (data->priv->md, &e->data,
&e->size);
+ e->components = e->size;
++ if (exif_format_get_size (e->format) != 1) {
++ /* e->format is taken from input code,
++ * but we need to make sure it is a 1 byte
++ * entity due to the multiplication below. */
++ e->format = EXIF_FORMAT_UNDEFINED;
++ }
+ }
+ }
+
diff --git a/libs/libexif/patches/libexif-0.6.21-CVE-2018-20030.patch
b/libs/libexif/patches/libexif-0.6.21-CVE-2018-20030.patch
new file mode 100644
index 0000000..08179f8
--- /dev/null
+++ b/libs/libexif/patches/libexif-0.6.21-CVE-2018-20030.patch
@@ -0,0 +1,117 @@
+From 6aa11df549114ebda520dde4cdaea2f9357b2c89 Mon Sep 17 00:00:00 2001
+From: Dan Fandrich <dan AT coneharvesters.com>
+Date: Fri, 12 Oct 2018 16:01:45 +0200
+Subject: [PATCH] Improve deep recursion detection in
+ exif_data_load_data_content.
+
+The existing detection was still vulnerable to pathological cases
+causing DoS by wasting CPU. The new algorithm takes the number of tags
+into account to make it harder to abuse by cases using shallow recursion
+but with a very large number of tags. This improves on commit 5d28011c
+which wasn't sufficient to counter this kind of case.
+
+The limitation in the previous fix was discovered by Laurent Delosieres,
+Secunia Research at Flexera (Secunia Advisory SA84652) and is assigned
+the identifier CVE-2018-20030.
+
+Adjusted for missing
https://github.com/libexif/libexif/commit/5d28011c40ec86cf52cffad541093d37c263898a
+
+---
+ libexif/exif-data.c | 45 +++++++++++++++++++++++++++++++++++++--------
+ 2 files changed, 38 insertions(+), 8 deletions(-)
+
+diff --git a/libexif/exif-data.c b/libexif/exif-data.c
+index e35403d..a6f9c94 100644
+--- a/libexif/exif-data.c
++++ b/libexif/exif-data.c
+@@ -35,6 +35,7 @@
+ #include <libexif/olympus/exif-mnote-data-olympus.h>
+ #include <libexif/pentax/exif-mnote-data-pentax.h>
+
++#include <math.h>
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+@@ -350,6 +351,20 @@ if (data->ifd[(i)]->count) {
\
+ break; \
+ }
+
++/*! Calculate the recursion cost added by one level of IFD loading.
++ *
++ * The work performed is related to the cost in the exponential relation
++ * work=1.1**cost
++ */
++static unsigned int
++level_cost(unsigned int n)
++{
++ static const double log_1_1 = 0.09531017980432493;
++
++ /* Adding 0.1 protects against the case where n==1 */
++ return ceil(log(n + 0.1)/log_1_1);
++}
++
+ /*! Load data for an IFD.
+ *
+ * \param[in,out] data #ExifData
+@@ -357,13 +372,13 @@ if (data->ifd[(i)]->count) {
\
+ * \param[in] d pointer to buffer containing raw IFD data
+ * \param[in] ds size of raw data in buffer at \c d
+ * \param[in] offset offset into buffer at \c d at which IFD starts
+- * \param[in] recursion_depth number of times this function has been
+- * recursively called without returning
++ * \param[in] recursion_cost factor indicating how expensive this recursive
++ * call could be
+ */
+ static void
+ exif_data_load_data_content (ExifData *data, ExifIfd ifd,
+ const unsigned char *d,
+- unsigned int ds, unsigned int offset, unsigned
int recursion_depth)
++ unsigned int ds, unsigned int offset, unsigned
int recursion_cost)
+ {
+ ExifLong o, thumbnail_offset = 0, thumbnail_length = 0;
+ ExifShort n;
+@@ -378,9 +393,20 @@ exif_data_load_data_content (ExifData *data, ExifIfd
ifd,
+ if ((((int)ifd) < 0) || ( ((int)ifd) >= EXIF_IFD_COUNT))
+ return;
+
+- if (recursion_depth > 30) {
++ if (recursion_cost > 170) {
++ /*
++ * recursion_cost is a logarithmic-scale indicator of how
expensive this
++ * recursive call might end up being. It is an indicator of
the depth of
++ * recursion as well as the potential for worst-case future
recursive
++ * calls. Since it's difficult to tell ahead of time how
often recursion
++ * will occur, this assumes the worst by assuming every tag
could end up
++ * causing recursion.
++ * The value of 170 was chosen to limit typical EXIF
structures to a
++ * recursive depth of about 6, but pathological ones (those
with very
++ * many tags) to only 2.
++ */
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
"ExifData",
+- "Deep recursion detected!");
++ "Deep/expensive recursion detected!");
+ return;
+ }
+
+@@ -422,15 +448,18 @@ exif_data_load_data_content (ExifData *data, ExifIfd
ifd,
+ switch (tag) {
+ case EXIF_TAG_EXIF_IFD_POINTER:
+ CHECK_REC (EXIF_IFD_EXIF);
+- exif_data_load_data_content (data,
EXIF_IFD_EXIF, d, ds, o, recursion_depth + 1);
++ exif_data_load_data_content (data,
EXIF_IFD_EXIF, d, ds, o,
++ recursion_cost + level_cost(n));
+ break;
+ case EXIF_TAG_GPS_INFO_IFD_POINTER:
+ CHECK_REC (EXIF_IFD_GPS);
+- exif_data_load_data_content (data,
EXIF_IFD_GPS, d, ds, o, recursion_depth + 1);
++ exif_data_load_data_content (data,
EXIF_IFD_GPS, d, ds, o,
++ recursion_cost + level_cost(n));
+ break;
+ case EXIF_TAG_INTEROPERABILITY_IFD_POINTER:
+ CHECK_REC (EXIF_IFD_INTEROPERABILITY);
+- exif_data_load_data_content (data,
EXIF_IFD_INTEROPERABILITY, d, ds, o, recursion_depth + 1);
++ exif_data_load_data_content (data,
EXIF_IFD_INTEROPERABILITY, d, ds, o,
++ recursion_cost + level_cost(n));
+ break;
+ case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
+ thumbnail_offset = o;
diff --git a/libs/libexif/patches/libexif-0.6.21-CVE-2019-9278.patch
b/libs/libexif/patches/libexif-0.6.21-CVE-2019-9278.patch
new file mode 100644
index 0000000..3f99818
--- /dev/null
+++ b/libs/libexif/patches/libexif-0.6.21-CVE-2019-9278.patch
@@ -0,0 +1,56 @@
+Submitted By: Douglas R. Reno <renodr at linuxfromscratch dot org>
+Date: 2020-02-10
+Initial Package Version: 0.6.21
+Origin: Upstream
(https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566)
+Description: Fixes CVE-2019-9278, an integer overflow caused by
+ unsafe integer overflow checking constructs. Now, it
+ checks for the actual sizes. This patch was rebased
to
+ allow it to apply cleanly to our version of libexif.
+
+diff -Naurp libexif-0.6.21.old/libexif/exif-data.c
libexif-0.6.21/libexif/exif-data.c
+--- libexif-0.6.21.old/libexif/exif-data.c 2012-07-12 13:31:56.000000000
-0500
++++ libexif-0.6.21/libexif/exif-data.c 2020-02-10 16:02:02.212402636 -0600
+@@ -191,9 +191,15 @@ exif_data_load_data_entry (ExifData *dat
+ doff = offset + 8;
+
+ /* Sanity checks */
+- if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) {
++ if (doff >= size) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+- "Tag data past end of buffer (%u > %u)",
doff+s, size);
++ "Tag starts past end of buffer (%u > %u)",
doff, size);
++ return 0;
++ }
++
++ if (s > size - doff) {
++ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
++ "Tag data goes past end of buffer (%u > %u)",
doff+s, size);
+ return 0;
+ }
+
+@@ -308,10 +314,12 @@ exif_data_load_data_thumbnail (ExifData
+ unsigned int ds, ExifLong o, ExifLong s)
+ {
+ /* Sanity checks */
+- if ((o + s < o) || (o + s < s) || (o + s > ds) || (o > ds)) {
+- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+- "Bogus thumbnail offset (%u) or size (%u).",
+- o, s);
++ if (o >= ds) {
++ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus
thumbnail offset (%u).",o);
++ return;
++ }
++ if (s > ds - o) {
++ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus
thumbnail size (%u), max would be %u.", s, ds-o);
+ return;
+ }
+
+@@ -921,7 +929,7 @@ exif_data_load_data (ExifData *data, con
+ "IFD 1 at %i.", (int) offset);
+
+ /* Sanity check. */
+- if (offset > ds || offset + 6 > ds) {
++ if (offset > ds - 6) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
+ "ExifData", "Bogus offset of IFD1.");
+ } else {
diff --git a/python-pypi/python-sphinx/DETAILS
b/python-pypi/python-sphinx/DETAILS
index e298b8f..92aaa3c 100755
--- a/python-pypi/python-sphinx/DETAILS
+++ b/python-pypi/python-sphinx/DETAILS
@@ -1,8 +1,8 @@
SPELL=python-sphinx
- VERSION=2.4.0
+ VERSION=2.4.1
SOURCE="Sphinx-${VERSION}.tar.gz"
SOURCE_URL[0]=http://pypi.python.org/packages/source/S/Sphinx/${SOURCE}
-
SOURCE_HASH=sha512:b35ecbca9488cf21eb643bd2d679b33fee98d262b7a144d214b027fef590bd568b87b370ebcd10f4a44864b698b2285543c45a39bf3b9bb3c132c96c823dea15
+
SOURCE_HASH=sha512:dc741e6b0604151134b1680fb3c7a29bea62a0d5607b11696926bf1fad0bdb863243de323c5f004c8f98a4d62a4325c233c555b193884c54902653e2a086e51b
SOURCE_DIRECTORY="${BUILD_DIRECTORY}/Sphinx-${VERSION}"
WEB_SITE="https://www.sphinx-doc.org";
LICENSE[0]=PYTHON
diff --git a/python-pypi/python-sphinx/HISTORY
b/python-pypi/python-sphinx/HISTORY
index 7aafb5b..c96a208 100644
--- a/python-pypi/python-sphinx/HISTORY
+++ b/python-pypi/python-sphinx/HISTORY
@@ -1,3 +1,6 @@
+2020-02-11 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * DETAILS: version 2.4.1
+
2020-02-09 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DETAILS: version 2.4.0

[SM-Commit] GIT changes to master grimoire by Florian Franzmann (26db033cf63be482dec8378b9f7e5c74d9b1cc7b), Florian Franzmann, 02/11/2020