Source Mage code commit list

[Ismael Luceno <scm AT sourcemage.org>]

GIT changes to master grimoire by Ismael Luceno <ismael AT sourcemage.org>:

 libs/musl/DETAILS                                |    3 -
 libs/musl/HISTORY                                |    4 +
 libs/musl/patches/wcsnrtombs-cve-2020-28928.diff |   66 
+++++++++++++++++++++++
 3 files changed, 72 insertions(+), 1 deletion(-)

New commits:
commit 2e8d39643feee9f06619c1c5e481ac062abd4c2a
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

    musl: Fix CVE-2020-28928, SECURITY_PATCH++

commit 4274e730288951807ab9611a29894b2cb6a6a94e
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

    musl: Update website

diff --git a/libs/musl/DETAILS b/libs/musl/DETAILS
index 8ec35a9..5d53786 100755
--- a/libs/musl/DETAILS
+++ b/libs/musl/DETAILS
@@ -1,7 +1,8 @@
            SPELL=musl
          VERSION=1.2.1
+  SECURITY_PATCH=1
           SOURCE="$SPELL-$VERSION.tar.gz"
-        WEB_SITE="http://www.musl-libc.org";
+        WEB_SITE="https://musl.libc.org/";
    SOURCE_URL[0]="$WEB_SITE/releases/${SOURCE}"
      
SOURCE_HASH=sha512:455464ef47108a78457291bda2b1ea574987a1787f6001e9376956f20521593a4816bc215dab41c1a80292ae7ebd315accb4d4fa6a1210ff77d9a4d68239e960
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
diff --git a/libs/musl/HISTORY b/libs/musl/HISTORY
index 7df8511..cde6d52 100644
--- a/libs/musl/HISTORY
+++ b/libs/musl/HISTORY
@@ -1,3 +1,7 @@
+2020-11-20 Ismael Luceno <ismael AT sourcemage.org>
+       * DETAILS: updated website, SECURITY_PATCH++
+       * patches/wcsnrtombs-cve-2020-28928.diff: patch for CVE-2020-28928
+
 2020-08-05 Ismael Luceno <ismael AT sourcemage.org>
        * DETAILS: updated spell to 1.2.1
 
diff --git a/libs/musl/patches/wcsnrtombs-cve-2020-28928.diff 
b/libs/musl/patches/wcsnrtombs-cve-2020-28928.diff
new file mode 100644
index 0000000..ef6c07c
--- /dev/null
+++ b/libs/musl/patches/wcsnrtombs-cve-2020-28928.diff
@@ -0,0 +1,66 @@
+diff --git a/src/multibyte/wcsnrtombs.c b/src/multibyte/wcsnrtombs.c
+index 676932b5..95e25e70 100644
+--- a/src/multibyte/wcsnrtombs.c
++++ b/src/multibyte/wcsnrtombs.c
+@@ -1,41 +1,33 @@
+ #include <wchar.h>
++#include <limits.h>
++#include <string.h>
+ 
+ size_t wcsnrtombs(char *restrict dst, const wchar_t **restrict wcs, size_t 
wn, size_t n, mbstate_t *restrict st)
+ {
+-      size_t l, cnt=0, n2;
+-      char *s, buf[256];
+       const wchar_t *ws = *wcs;
+-      const wchar_t *tmp_ws;
+-
+-      if (!dst) s = buf, n = sizeof buf;
+-      else s = dst;
+-
+-      while ( ws && n && ( (n2=wn)>=n || n2>32 ) ) {
+-              if (n2>=n) n2=n;
+-              tmp_ws = ws;
+-              l = wcsrtombs(s, &ws, n2, 0);
+-              if (!(l+1)) {
+-                      cnt = l;
+-                      n = 0;
++      size_t cnt = 0;
++      if (!dst) n=0;
++      while (ws && wn) {
++              char tmp[MB_LEN_MAX];
++              size_t l = wcrtomb(n<MB_LEN_MAX ? tmp : dst, *ws, 0);
++              if (l==-1) {
++                      cnt = -1;
+                       break;
+               }
+-              if (s != buf) {
+-                      s += l;
++              if (dst) {
++                      if (n<MB_LEN_MAX) {
++                              if (l>n) break;
++                              memcpy(dst, tmp, l);
++                      }
++                      dst += l;
+                       n -= l;
+               }
+-              wn = ws ? wn - (ws - tmp_ws) : 0;
+-              cnt += l;
+-      }
+-      if (ws) while (n && wn) {
+-              l = wcrtomb(s, *ws, 0);
+-              if ((l+1)<=1) {
+-                      if (!l) ws = 0;
+-                      else cnt = l;
++              if (!*ws) {
++                      ws = 0;
+                       break;
+               }
+-              ws++; wn--;
+-              /* safe - this loop runs fewer than sizeof(buf) times */
+-              s+=l; n-=l;
++              ws++;
++              wn--;
+               cnt += l;
+       }
+       if (dst) *wcs = ws;
+