diff options
Diffstat (limited to 'meta/recipes-devtools')
88 files changed, 5214 insertions, 1051 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.31.inc b/meta/recipes-devtools/binutils/binutils-2.31.inc index 62acec500e..c9a3610e72 100644 --- a/meta/recipes-devtools/binutils/binutils-2.31.inc +++ b/meta/recipes-devtools/binutils/binutils-2.31.inc @@ -46,6 +46,12 @@ SRC_URI = "\ file://CVE-2018-18605.patch \ file://CVE-2018-18606.patch \ file://CVE-2018-18607.patch \ + file://CVE-2019-14444.patch \ + file://CVE-2019-12972.patch \ + file://CVE-2018-20623.patch \ + file://CVE-2018-20651.patch \ + file://CVE-2018-20671.patch \ + file://CVE-2018-1000876.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-1000876.patch b/meta/recipes-devtools/binutils/binutils/CVE-2018-1000876.patch new file mode 100644 index 0000000000..ff853511f9 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-1000876.patch @@ -0,0 +1,180 @@ +From efec0844fcfb5692f5a78f4082994d63e420ecd9 Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Sun, 16 Dec 2018 23:02:50 +1030 +Subject: [PATCH] PR23994, libbfd integer overflow + + PR 23994 + * aoutx.h: Include limits.h. + (get_reloc_upper_bound): Detect long overflow and return a file + too big error if it occurs. + * elf.c: Include limits.h. + (_bfd_elf_get_symtab_upper_bound): Detect long overflow and return + a file too big error if it occurs. + (_bfd_elf_get_dynamic_symtab_upper_bound): Likewise. + (_bfd_elf_get_dynamic_reloc_upper_bound): Likewise. + +CVE: CVE-2018-1000876 +Upstream-Status: Backport +[https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=3a551c7a1b80fca579461774860574eabfd7f18f] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + bfd/aoutx.h | 40 +++++++++++++++++++++------------------- + bfd/elf.c | 32 ++++++++++++++++++++++++-------- + 2 files changed, 45 insertions(+), 27 deletions(-) + +diff --git a/bfd/aoutx.h b/bfd/aoutx.h +index 023843b0be..78eaa9c503 100644 +--- a/bfd/aoutx.h ++++ b/bfd/aoutx.h +@@ -117,6 +117,7 @@ DESCRIPTION + #define KEEPIT udata.i + + #include "sysdep.h" ++#include <limits.h> + #include "bfd.h" + #include "safe-ctype.h" + #include "bfdlink.h" +@@ -2491,6 +2492,8 @@ NAME (aout, canonicalize_reloc) (bfd *abfd, + long + NAME (aout, get_reloc_upper_bound) (bfd *abfd, sec_ptr asect) + { ++ bfd_size_type count; ++ + if (bfd_get_format (abfd) != bfd_object) + { + bfd_set_error (bfd_error_invalid_operation); +@@ -2498,26 +2501,25 @@ NAME (aout, get_reloc_upper_bound) (bfd *abfd, sec_ptr asect) + } + + if (asect->flags & SEC_CONSTRUCTOR) +- return sizeof (arelent *) * (asect->reloc_count + 1); +- +- if (asect == obj_datasec (abfd)) +- return sizeof (arelent *) +- * ((exec_hdr (abfd)->a_drsize / obj_reloc_entry_size (abfd)) +- + 1); +- +- if (asect == obj_textsec (abfd)) +- return sizeof (arelent *) +- * ((exec_hdr (abfd)->a_trsize / obj_reloc_entry_size (abfd)) +- + 1); +- +- if (asect == obj_bsssec (abfd)) +- return sizeof (arelent *); +- +- if (asect == obj_bsssec (abfd)) +- return 0; ++ count = asect->reloc_count; ++ else if (asect == obj_datasec (abfd)) ++ count = exec_hdr (abfd)->a_drsize / obj_reloc_entry_size (abfd); ++ else if (asect == obj_textsec (abfd)) ++ count = exec_hdr (abfd)->a_trsize / obj_reloc_entry_size (abfd); ++ else if (asect == obj_bsssec (abfd)) ++ count = 0; ++ else ++ { ++ bfd_set_error (bfd_error_invalid_operation); ++ return -1; ++ } + +- bfd_set_error (bfd_error_invalid_operation); +- return -1; ++ if (count >= LONG_MAX / sizeof (arelent *)) ++ { ++ bfd_set_error (bfd_error_file_too_big); ++ return -1; ++ } ++ return (count + 1) * sizeof (arelent *); + } + + long +diff --git a/bfd/elf.c b/bfd/elf.c +index 828241d48a..10037176a3 100644 +--- a/bfd/elf.c ++++ b/bfd/elf.c +@@ -35,6 +35,7 @@ SECTION + /* For sparc64-cross-sparc32. */ + #define _SYSCALL32 + #include "sysdep.h" ++#include <limits.h> + #include "bfd.h" + #include "bfdlink.h" + #include "libbfd.h" +@@ -8114,11 +8115,16 @@ error_return: + long + _bfd_elf_get_symtab_upper_bound (bfd *abfd) + { +- long symcount; ++ bfd_size_type symcount; + long symtab_size; + Elf_Internal_Shdr *hdr = &elf_tdata (abfd)->symtab_hdr; + + symcount = hdr->sh_size / get_elf_backend_data (abfd)->s->sizeof_sym; ++ if (symcount >= LONG_MAX / sizeof (asymbol *)) ++ { ++ bfd_set_error (bfd_error_file_too_big); ++ return -1; ++ } + symtab_size = (symcount + 1) * (sizeof (asymbol *)); + if (symcount > 0) + symtab_size -= sizeof (asymbol *); +@@ -8129,7 +8135,7 @@ _bfd_elf_get_symtab_upper_bound (bfd *abfd) + long + _bfd_elf_get_dynamic_symtab_upper_bound (bfd *abfd) + { +- long symcount; ++ bfd_size_type symcount; + long symtab_size; + Elf_Internal_Shdr *hdr = &elf_tdata (abfd)->dynsymtab_hdr; + +@@ -8140,6 +8146,11 @@ _bfd_elf_get_dynamic_symtab_upper_bound (bfd *abfd) + } + + symcount = hdr->sh_size / get_elf_backend_data (abfd)->s->sizeof_sym; ++ if (symcount >= LONG_MAX / sizeof (asymbol *)) ++ { ++ bfd_set_error (bfd_error_file_too_big); ++ return -1; ++ } + symtab_size = (symcount + 1) * (sizeof (asymbol *)); + if (symcount > 0) + symtab_size -= sizeof (asymbol *); +@@ -8209,7 +8220,7 @@ _bfd_elf_canonicalize_dynamic_symtab (bfd *abfd, + long + _bfd_elf_get_dynamic_reloc_upper_bound (bfd *abfd) + { +- long ret; ++ bfd_size_type count; + asection *s; + + if (elf_dynsymtab (abfd) == 0) +@@ -8218,15 +8229,20 @@ _bfd_elf_get_dynamic_reloc_upper_bound (bfd *abfd) + return -1; + } + +- ret = sizeof (arelent *); ++ count = 1; + for (s = abfd->sections; s != NULL; s = s->next) + if (elf_section_data (s)->this_hdr.sh_link == elf_dynsymtab (abfd) + && (elf_section_data (s)->this_hdr.sh_type == SHT_REL + || elf_section_data (s)->this_hdr.sh_type == SHT_RELA)) +- ret += ((s->size / elf_section_data (s)->this_hdr.sh_entsize) +- * sizeof (arelent *)); +- +- return ret; ++ { ++ count += s->size / elf_section_data (s)->this_hdr.sh_entsize; ++ if (count > LONG_MAX / sizeof (arelent *)) ++ { ++ bfd_set_error (bfd_error_file_too_big); ++ return -1; ++ } ++ } ++ return count * sizeof (arelent *); + } + + /* Canonicalize the dynamic relocation entries. Note that we return the +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch b/meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch new file mode 100644 index 0000000000..b44d448fce --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch @@ -0,0 +1,74 @@ +From 90cce28d4b59f86366d4f562d01a8d439d514234 Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Wed, 9 Jan 2019 12:25:16 +0000 +Subject: [PATCH] Fix a heap use after free memory access fault when displaying + error messages about malformed archives. + + PR 14049 + * readelf.c (process_archive): Use arch.file_name in error + messages until the qualified name is available. + +CVE: CVE-2018-20623 +Upstream-Status: Backport +[https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=28e817cc440bce73691c03e01860089a0954a837] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + binutils/readelf.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/binutils/readelf.c b/binutils/readelf.c +index f4df697a7d..280023d8de 100644 +--- a/binutils/readelf.c ++++ b/binutils/readelf.c +@@ -19061,7 +19061,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) + /* Read the next archive header. */ + if (fseek (filedata->handle, arch.next_arhdr_offset, SEEK_SET) != 0) + { +- error (_("%s: failed to seek to next archive header\n"), filedata->file_name); ++ error (_("%s: failed to seek to next archive header\n"), arch.file_name); + return FALSE; + } + got = fread (&arch.arhdr, 1, sizeof arch.arhdr, filedata->handle); +@@ -19069,7 +19069,10 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) + { + if (got == 0) + break; +- error (_("%s: failed to read archive header\n"), filedata->file_name); ++ /* PR 24049 - we cannot use filedata->file_name as this will ++ have already been freed. */ ++ error (_("%s: failed to read archive header\n"), arch.file_name); ++ + ret = FALSE; + break; + } +@@ -19089,7 +19092,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) + name = get_archive_member_name (&arch, &nested_arch); + if (name == NULL) + { +- error (_("%s: bad archive file name\n"), filedata->file_name); ++ error (_("%s: bad archive file name\n"), arch.file_name); + ret = FALSE; + break; + } +@@ -19098,7 +19101,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) + qualified_name = make_qualified_name (&arch, &nested_arch, name); + if (qualified_name == NULL) + { +- error (_("%s: bad archive file name\n"), filedata->file_name); ++ error (_("%s: bad archive file name\n"), arch.file_name); + ret = FALSE; + break; + } +@@ -19144,7 +19147,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) + if (nested_arch.file == NULL) + { + error (_("%s: contains corrupt thin archive: %s\n"), +- filedata->file_name, name); ++ qualified_name, name); + ret = FALSE; + break; + } +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-20651.patch b/meta/recipes-devtools/binutils/binutils/CVE-2018-20651.patch new file mode 100644 index 0000000000..24fb031223 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-20651.patch @@ -0,0 +1,35 @@ +From 6a29d95602b09bb83d2c82b45ed935157fb780aa Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Mon, 31 Dec 2018 15:40:08 +1030 +Subject: [PATCH] PR24041, Invalid Memory Address Dereference in + elf_link_add_object_symbols + + PR 24041 + * elflink.c (elf_link_add_object_symbols): Don't segfault on + crafted ET_DYN with no program headers. + +CVE: CVE-2018-20651 +Upstream-Status: Backport +[https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=54025d5812ff100f5f0654eb7e1ffd50f2e37f5f] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + bfd/elflink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bfd/elflink.c b/bfd/elflink.c +index 46091b6341..557c550082 100644 +--- a/bfd/elflink.c ++++ b/bfd/elflink.c +@@ -4178,7 +4178,7 @@ error_free_dyn: + all sections contained fully therein. This makes relro + shared library sections appear as they will at run-time. */ + phdr = elf_tdata (abfd)->phdr + elf_elfheader (abfd)->e_phnum; +- while (--phdr >= elf_tdata (abfd)->phdr) ++ while (phdr-- > elf_tdata (abfd)->phdr) + if (phdr->p_type == PT_GNU_RELRO) + { + for (s = abfd->sections; s != NULL; s = s->next) +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch b/meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch new file mode 100644 index 0000000000..9bd9207bb5 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch @@ -0,0 +1,49 @@ +From 8a5f4f2ebe7f35ac5646060fa51e3332f6ef388c Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Fri, 4 Jan 2019 13:44:34 +0000 +Subject: [PATCH] Fix a possible integer overflow problem when examining + corrupt binaries using a 32-bit binutil. + + PR 24005 + * objdump.c (load_specific_debug_section): Check for integer + overflow before attempting to allocate contents. + +CVE: CVE-2018-20671 +Upstream-Status: Backport +[https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=11fa9f134fd658075c6f74499c780df045d9e9ca] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + binutils/objdump.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/binutils/objdump.c b/binutils/objdump.c +index f468fcdb59..89ca688938 100644 +--- a/binutils/objdump.c ++++ b/binutils/objdump.c +@@ -2503,12 +2503,19 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, + section->reloc_info = NULL; + section->num_relocs = 0; + section->address = bfd_get_section_vma (abfd, sec); ++ section->user_data = sec; + section->size = bfd_get_section_size (sec); + amt = section->size + 1; ++ if (amt == 0 || amt > bfd_get_file_size (abfd)) ++ { ++ section->start = NULL; ++ free_debug_section (debug); ++ printf (_("\nSection '%s' has an invalid size: %#llx.\n"), ++ section->name, (unsigned long long) section->size); ++ return FALSE; ++ } + section->start = contents = malloc (amt); +- section->user_data = sec; +- if (amt == 0 +- || section->start == NULL ++ if (section->start == NULL + || !bfd_get_full_section_contents (abfd, sec, &contents)) + { + free_debug_section (debug); +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2019-12972.patch b/meta/recipes-devtools/binutils/binutils/CVE-2019-12972.patch new file mode 100644 index 0000000000..3e95b9221a --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2019-12972.patch @@ -0,0 +1,39 @@ +From 890f750a3b053532a4b839a2dd6243076de12031 Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Fri, 21 Jun 2019 11:51:38 +0930 +Subject: [PATCH] PR24689, string table corruption + +The testcase in the PR had a e_shstrndx section of type SHT_GROUP. +hdr->contents were initialized by setup_group rather than being read +from the file, thus last byte was not zero and string dereference ran +off the end of the buffer. + + PR 24689 + * elfcode.h (elf_object_p): Check type of e_shstrndx section. + +Upstream-Status: Backport +https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=890f750a3b053532a4b839a2dd6243076de12031 + +CVE: CVE-2019-12972 +Affects: <= 2.23.0 +Dropped Changelog +Signed-off-by Armin Kuster <akuster@mvista.com> +--- + bfd/ChangeLog | 5 +++++ + bfd/elfcode.h | 3 ++- + 2 files changed, 7 insertions(+), 1 deletion(-) + +Index: git/bfd/elfcode.h +=================================================================== +--- git.orig/bfd/elfcode.h ++++ git/bfd/elfcode.h +@@ -747,7 +747,8 @@ elf_object_p (bfd *abfd) + /* A further sanity check. */ + if (i_ehdrp->e_shnum != 0) + { +- if (i_ehdrp->e_shstrndx >= elf_numsections (abfd)) ++ if (i_ehdrp->e_shstrndx >= elf_numsections (abfd) ++ || i_shdrp[i_ehdrp->e_shstrndx].sh_type != SHT_STRTAB) + { + /* PR 2257: + We used to just goto got_wrong_format_error here diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2019-14444.patch b/meta/recipes-devtools/binutils/binutils/CVE-2019-14444.patch new file mode 100644 index 0000000000..499cf0e046 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2019-14444.patch @@ -0,0 +1,33 @@ +From e17869db99195849826eaaf5d2d0eb2cfdd7a2a7 Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Mon, 5 Aug 2019 10:40:35 +0100 +Subject: [PATCH] Catch potential integer overflow in readelf when processing + corrupt binaries. + + PR 24829 + * readelf.c (apply_relocations): Catch potential integer overflow + whilst checking reloc location against section size. + +Upstream-Status: Backport +https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e17869db99195849826eaaf5d2d0eb2cfdd7a2a7 +CVE: CVE-2019-14444 +Dropped changelog +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + binutils/readelf.c | 2 +- + 2 files changed, 7 insertions(+), 1 deletion(-) + +Index: git/binutils/readelf.c +=================================================================== +--- git.orig/binutils/readelf.c ++++ git/binutils/readelf.c +@@ -13113,7 +13113,7 @@ apply_relocations (Filedata * + } + + rloc = start + rp->r_offset; +- if ((rloc + reloc_size) > end || (rloc < start)) ++ if (rloc >= end || (rloc + reloc_size) > end || (rloc < start)) + { + warn (_("skipping invalid relocation offset 0x%lx in section %s\n"), + (unsigned long) rp->r_offset, diff --git a/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb b/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb deleted file mode 100644 index 1c84fb1cf2..0000000000 --- a/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb +++ /dev/null @@ -1,62 +0,0 @@ -SUMMARY = "cve-check-tool" -DESCRIPTION = "cve-check-tool is a tool for checking known (public) CVEs.\ -The tool will identify potentially vunlnerable software packages within Linux distributions through version matching." -HOMEPAGE = "https://github.com/ikeydoherty/cve-check-tool" -SECTION = "Development/Tools" -LICENSE = "GPL-2.0+" -LIC_FILES_CHKSUM = "file://LICENSE;md5=e8c1458438ead3c34974bc0be3a03ed6" - -SRC_URI = "https://github.com/ikeydoherty/${BPN}/releases/download/v${PV}/${BP}.tar.xz \ - file://check-for-malloc_trim-before-using-it.patch \ - file://0001-print-progress-in-percent-when-downloading-CVE-db.patch \ - file://0001-curl-allow-overriding-default-CA-certificate-file.patch \ - file://0001-update-Compare-computed-vs-expected-sha256-digit-str.patch \ - file://0001-Fix-freeing-memory-allocated-by-sqlite.patch \ - " - -SRC_URI[md5sum] = "c5f4247140fc9be3bf41491d31a34155" -SRC_URI[sha256sum] = "b8f283be718af8d31232ac1bfc10a0378fb958aaaa49af39168f8acf501e6a5b" - -UPSTREAM_CHECK_URI = "https://github.com/ikeydoherty/cve-check-tool/releases" - -DEPENDS = "libcheck glib-2.0 json-glib curl libxml2 sqlite3 openssl ca-certificates" - -RDEPENDS_${PN} = "ca-certificates" - -inherit pkgconfig autotools - -EXTRA_OECONF = "--disable-coverage --enable-relative-plugins" -CFLAGS_append = " -Wno-error=pedantic" - -do_populate_cve_db() { - if [ "${BB_NO_NETWORK}" = "1" ] ; then - bbwarn "BB_NO_NETWORK is set; Can't update cve-check-tool database, new CVEs won't be detected" - return - fi - - # In case we don't inherit cve-check class, use default values defined in the class. - cve_dir="${CVE_CHECK_DB_DIR}" - cve_file="${CVE_CHECK_TMP_FILE}" - - [ -z "${cve_dir}" ] && cve_dir="${DL_DIR}/CVE_CHECK" - [ -z "${cve_file}" ] && cve_file="${TMPDIR}/cve_check" - - unused="${@bb.utils.export_proxies(d)}" - bbdebug 2 "Updating cve-check-tool database located in $cve_dir" - # --cacert works around curl-native not finding the CA bundle - if cve-check-update --cacert ${sysconfdir}/ssl/certs/ca-certificates.crt -d "$cve_dir" ; then - printf "CVE database was updated on %s UTC\n\n" "$(LANG=C date --utc +'%F %T')" > "$cve_file" - else - bbwarn "Error in executing cve-check-update" - if [ "${@'1' if bb.data.inherits_class('cve-check', d) else '0'}" -ne 0 ] ; then - bbwarn "Failed to update cve-check-tool database, CVEs won't be checked" - fi - fi -} - -addtask populate_cve_db after do_populate_sysroot -do_populate_cve_db[depends] = "cve-check-tool-native:do_populate_sysroot" -do_populate_cve_db[nostamp] = "1" -do_populate_cve_db[progress] = "percent" - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch b/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch deleted file mode 100644 index 4a82cf2dde..0000000000 --- a/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch +++ /dev/null @@ -1,50 +0,0 @@ -From a3353429652f83bb8b0316500faa88fa2555542d Mon Sep 17 00:00:00 2001 -From: Peter Marko <peter.marko@siemens.com> -Date: Thu, 13 Apr 2017 23:09:52 +0200 -Subject: [PATCH] Fix freeing memory allocated by sqlite - -Upstream-Status: Backport -Signed-off-by: Peter Marko <peter.marko@siemens.com> ---- - src/core.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/src/core.c b/src/core.c -index 6263031..6788f16 100644 ---- a/src/core.c -+++ b/src/core.c -@@ -82,7 +82,7 @@ static bool ensure_table(CveDB *self) - rc = sqlite3_exec(self->db, query, NULL, NULL, &err); - if (rc != SQLITE_OK) { - fprintf(stderr, "ensure_table(): %s\n", err); -- free(err); -+ sqlite3_free(err); - return false; - } - -@@ -91,7 +91,7 @@ static bool ensure_table(CveDB *self) - rc = sqlite3_exec(self->db, query, NULL, NULL, &err); - if (rc != SQLITE_OK) { - fprintf(stderr, "ensure_table(): %s\n", err); -- free(err); -+ sqlite3_free(err); - return false; - } - -@@ -99,11 +99,11 @@ static bool ensure_table(CveDB *self) - rc = sqlite3_exec(self->db, query, NULL, NULL, &err); - if (rc != SQLITE_OK) { - fprintf(stderr, "ensure_table(): %s\n", err); -- free(err); -+ sqlite3_free(err); - return false; - } - if (err) { -- free(err); -+ sqlite3_free(err); - } - - return true; --- -2.1.4 - diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch b/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch deleted file mode 100644 index 3d8ebd1bd2..0000000000 --- a/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch +++ /dev/null @@ -1,215 +0,0 @@ -From 825a9969dea052b02ba868bdf39e676349f10dce Mon Sep 17 00:00:00 2001 -From: Jussi Kukkonen <jussi.kukkonen@intel.com> -Date: Thu, 9 Feb 2017 14:51:28 +0200 -Subject: [PATCH] curl: allow overriding default CA certificate file - -Similar to curl, --cacert can now be used in cve-check-tool and -cve-check-update to override the default CA certificate file. Useful -in cases where the system default is unsuitable (for example, -out-dated) or broken (as in OE's current native libcurl, which embeds -a path string from one build host and then uses it on another although -the right path may have become something different). - -Upstream-Status: Submitted [https://github.com/ikeydoherty/cve-check-tool/pull/45] - -Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> - - -Took Patrick Ohlys original patch from meta-security-isafw, rebased -on top of other patches. - -Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> ---- - src/library/cve-check-tool.h | 1 + - src/library/fetch.c | 10 +++++++++- - src/library/fetch.h | 3 ++- - src/main.c | 5 ++++- - src/update-main.c | 4 +++- - src/update.c | 12 +++++++----- - src/update.h | 2 +- - 7 files changed, 27 insertions(+), 10 deletions(-) - -diff --git a/src/library/cve-check-tool.h b/src/library/cve-check-tool.h -index e4bb5b1..f89eade 100644 ---- a/src/library/cve-check-tool.h -+++ b/src/library/cve-check-tool.h -@@ -43,6 +43,7 @@ typedef struct CveCheckTool { - bool bugs; /**<Whether bug tracking is enabled */ - GHashTable *mapping; /**<CVE Mapping */ - const char *output_file; /**<Output file, if any */ -+ const char *cacert_file; /**<Non-default SSL certificate file, if any */ - } CveCheckTool; - - /** -diff --git a/src/library/fetch.c b/src/library/fetch.c -index 0fe6d76..8f998c3 100644 ---- a/src/library/fetch.c -+++ b/src/library/fetch.c -@@ -60,7 +60,8 @@ static int progress_callback_new(void *ptr, curl_off_t dltotal, curl_off_t dlnow - } - - FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, -- unsigned int start_percent, unsigned int end_percent) -+ unsigned int start_percent, unsigned int end_percent, -+ const char *cacert_file) - { - FetchStatus ret = FETCH_STATUS_FAIL; - CURLcode res; -@@ -74,6 +75,13 @@ FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, - return ret; - } - -+ if (cacert_file) { -+ res = curl_easy_setopt(curl, CURLOPT_CAINFO, cacert_file); -+ if (res != CURLE_OK) { -+ goto bail; -+ } -+ } -+ - if (stat(target, &st) == 0) { - res = curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE); - if (res != CURLE_OK) { -diff --git a/src/library/fetch.h b/src/library/fetch.h -index 4cce5d1..836c7d7 100644 ---- a/src/library/fetch.h -+++ b/src/library/fetch.h -@@ -29,7 +29,8 @@ typedef enum { - * @return A FetchStatus, indicating the operation taken - */ - FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, -- unsigned int this_percent, unsigned int next_percent); -+ unsigned int this_percent, unsigned int next_percent, -+ const char *cacert_file); - - /** - * Attempt to extract the given gzipped file -diff --git a/src/main.c b/src/main.c -index 8e6f158..ae69d47 100644 ---- a/src/main.c -+++ b/src/main.c -@@ -280,6 +280,7 @@ static bool csv_mode = false; - static char *modified_stamp = NULL; - static gchar *mapping_file = NULL; - static gchar *output_file = NULL; -+static gchar *cacert_file = NULL; - - static GOptionEntry _entries[] = { - { "not-patched", 'n', 0, G_OPTION_ARG_NONE, &hide_patched, "Hide patched/addressed CVEs", NULL }, -@@ -294,6 +295,7 @@ static GOptionEntry _entries[] = { - { "csv", 'c', 0, G_OPTION_ARG_NONE, &csv_mode, "Output CSV formatted data only", NULL }, - { "mapping", 'M', 0, G_OPTION_ARG_STRING, &mapping_file, "Path to a mapping file", NULL}, - { "output-file", 'o', 0, G_OPTION_ARG_STRING, &output_file, "Path to the output file (output plugin specific)", NULL}, -+ { "cacert", 'C', 0, G_OPTION_ARG_STRING, &cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL}, - { .short_name = 0 } - }; - -@@ -492,6 +494,7 @@ int main(int argc, char **argv) - - quiet = csv_mode || !no_html; - self->output_file = output_file; -+ self->cacert_file = cacert_file; - - if (!csv_mode && self->output_file) { - quiet = false; -@@ -530,7 +533,7 @@ int main(int argc, char **argv) - if (status) { - fprintf(stderr, "Update of db forced\n"); - cve_db_unlock(); -- if (!update_db(quiet, db_path->str)) { -+ if (!update_db(quiet, db_path->str, self->cacert_file)) { - fprintf(stderr, "DB update failure\n"); - goto cleanup; - } -diff --git a/src/update-main.c b/src/update-main.c -index 2379cfa..c52d9d0 100644 ---- a/src/update-main.c -+++ b/src/update-main.c -@@ -43,11 +43,13 @@ the Free Software Foundation; either version 2 of the License, or\n\ - static gchar *nvds = NULL; - static bool _show_version = false; - static bool _quiet = false; -+static const char *_cacert_file = NULL; - - static GOptionEntry _entries[] = { - { "nvd-dir", 'd', 0, G_OPTION_ARG_STRING, &nvds, "NVD directory in filesystem", NULL }, - { "version", 'v', 0, G_OPTION_ARG_NONE, &_show_version, "Show version", NULL }, - { "quiet", 'q', 0, G_OPTION_ARG_NONE, &_quiet, "Run silently", NULL }, -+ { "cacert", 'C', 0, G_OPTION_ARG_STRING, &_cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL}, - { .short_name = 0 } - }; - -@@ -88,7 +90,7 @@ int main(int argc, char **argv) - goto end; - } - -- if (update_db(_quiet, db_path->str)) { -+ if (update_db(_quiet, db_path->str, _cacert_file)) { - ret = EXIT_SUCCESS; - } else { - fprintf(stderr, "Failed to update database\n"); -diff --git a/src/update.c b/src/update.c -index 070560a..8cb4a39 100644 ---- a/src/update.c -+++ b/src/update.c -@@ -267,7 +267,8 @@ static inline void update_end(int fd, const char *update_fname, bool ok) - - static int do_fetch_update(int year, const char *db_dir, CveDB *cve_db, - bool db_exist, bool verbose, -- unsigned int this_percent, unsigned int next_percent) -+ unsigned int this_percent, unsigned int next_percent, -+ const char *cacert_file) - { - const char nvd_uri[] = URI_PREFIX; - autofree(cve_string) *uri_meta = NULL; -@@ -331,14 +332,14 @@ refetch: - } - - /* Fetch NVD META file */ -- st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent); -+ st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent, cacert_file); - if (st == FETCH_STATUS_FAIL) { - fprintf(stderr, "Failed to fetch %s\n", uri_meta->str); - return -1; - } - - /* Fetch NVD XML file */ -- st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent); -+ st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent, cacert_file); - switch (st) { - case FETCH_STATUS_FAIL: - fprintf(stderr, "Failed to fetch %s\n", uri_data_gz->str); -@@ -391,7 +392,7 @@ refetch: - return 0; - } - --bool update_db(bool quiet, const char *db_file) -+bool update_db(bool quiet, const char *db_file, const char *cacert_file) - { - autofree(char) *db_dir = NULL; - autofree(CveDB) *cve_db = NULL; -@@ -466,7 +467,8 @@ bool update_db(bool quiet, const char *db_file) - if (!quiet) - fprintf(stderr, "completed: %u%%\r", start_percent); - rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet, -- start_percent, end_percent); -+ start_percent, end_percent, -+ cacert_file); - switch (rc) { - case 0: - if (!quiet) -diff --git a/src/update.h b/src/update.h -index b8e9911..ceea0c3 100644 ---- a/src/update.h -+++ b/src/update.h -@@ -15,7 +15,7 @@ cve_string *get_db_path(const char *path); - - int update_required(const char *db_file); - --bool update_db(bool quiet, const char *db_file); -+bool update_db(bool quiet, const char *db_file, const char *cacert_file); - - - /* --- -2.1.4 - diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch b/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch deleted file mode 100644 index 8ea6f686e3..0000000000 --- a/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch +++ /dev/null @@ -1,135 +0,0 @@ -From e9ed26cde63f8ca7607a010a518329339f8c02d3 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <git@andred.net> -Date: Mon, 26 Sep 2016 12:12:41 +0100 -Subject: [PATCH] print progress in percent when downloading CVE db -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream-Status: Pending -Signed-off-by: André Draszik <git@andred.net> ---- - src/library/fetch.c | 28 +++++++++++++++++++++++++++- - src/library/fetch.h | 3 ++- - src/update.c | 16 ++++++++++++---- - 3 files changed, 41 insertions(+), 6 deletions(-) - -diff --git a/src/library/fetch.c b/src/library/fetch.c -index 06d4b30..0fe6d76 100644 ---- a/src/library/fetch.c -+++ b/src/library/fetch.c -@@ -37,13 +37,37 @@ static size_t write_func(void *ptr, size_t size, size_t nmemb, struct fetch_t *f - return fwrite(ptr, size, nmemb, f->f); - } - --FetchStatus fetch_uri(const char *uri, const char *target, bool verbose) -+struct percent_t { -+ unsigned int start; -+ unsigned int end; -+}; -+ -+static int progress_callback_new(void *ptr, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow) -+{ -+ (void) ultotal; -+ (void) ulnow; -+ -+ struct percent_t *percent = (struct percent_t *) ptr; -+ -+ if (dltotal && percent && percent->end >= percent->start) { -+ unsigned int diff = percent->end - percent->start; -+ if (diff) { -+ fprintf(stderr,"completed: %"CURL_FORMAT_CURL_OFF_T"%%\r", percent->start + (diff * dlnow / dltotal)); -+ } -+ } -+ -+ return 0; -+} -+ -+FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, -+ unsigned int start_percent, unsigned int end_percent) - { - FetchStatus ret = FETCH_STATUS_FAIL; - CURLcode res; - struct stat st; - CURL *curl = NULL; - struct fetch_t *f = NULL; -+ struct percent_t percent = { .start = start_percent, .end = end_percent }; - - curl = curl_easy_init(); - if (!curl) { -@@ -67,6 +91,8 @@ FetchStatus fetch_uri(const char *uri, const char *target, bool verbose) - } - if (verbose) { - (void)curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L); -+ (void)curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &percent); -+ (void)curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_callback_new); - } - res = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)write_func); - if (res != CURLE_OK) { -diff --git a/src/library/fetch.h b/src/library/fetch.h -index 70c3779..4cce5d1 100644 ---- a/src/library/fetch.h -+++ b/src/library/fetch.h -@@ -28,7 +28,8 @@ typedef enum { - * @param verbose Whether to be verbose - * @return A FetchStatus, indicating the operation taken - */ --FetchStatus fetch_uri(const char *uri, const char *target, bool verbose); -+FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, -+ unsigned int this_percent, unsigned int next_percent); - - /** - * Attempt to extract the given gzipped file -diff --git a/src/update.c b/src/update.c -index 30fbe96..eaeeefd 100644 ---- a/src/update.c -+++ b/src/update.c -@@ -266,7 +266,8 @@ static inline void update_end(int fd, const char *update_fname, bool ok) - } - - static int do_fetch_update(int year, const char *db_dir, CveDB *cve_db, -- bool db_exist, bool verbose) -+ bool db_exist, bool verbose, -+ unsigned int this_percent, unsigned int next_percent) - { - const char nvd_uri[] = URI_PREFIX; - autofree(cve_string) *uri_meta = NULL; -@@ -330,14 +331,14 @@ refetch: - } - - /* Fetch NVD META file */ -- st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose); -+ st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent); - if (st == FETCH_STATUS_FAIL) { - fprintf(stderr, "Failed to fetch %s\n", uri_meta->str); - return -1; - } - - /* Fetch NVD XML file */ -- st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose); -+ st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent); - switch (st) { - case FETCH_STATUS_FAIL: - fprintf(stderr, "Failed to fetch %s\n", uri_data_gz->str); -@@ -459,10 +460,17 @@ bool update_db(bool quiet, const char *db_file) - for (int i = YEAR_START; i <= year+1; i++) { - int y = i > year ? -1 : i; - int rc; -+ unsigned int start_percent = ((i+0 - YEAR_START) * 100) / (year+2 - YEAR_START); -+ unsigned int end_percent = ((i+1 - YEAR_START) * 100) / (year+2 - YEAR_START); - -- rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet); -+ if (!quiet) -+ fprintf(stderr, "completed: %u%%\r", start_percent); -+ rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet, -+ start_percent, end_percent); - switch (rc) { - case 0: -+ if (!quiet) -+ fprintf(stderr,"completed: %u%%\r", end_percent); - continue; - case ENOMEM: - goto oom; --- -2.9.3 - diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch b/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch deleted file mode 100644 index 458c0cc84e..0000000000 --- a/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch +++ /dev/null @@ -1,52 +0,0 @@ -From b0426e63c9ac61657e029f689bcb8dd051e752c6 Mon Sep 17 00:00:00 2001 -From: Sergey Popovich <popovich_sergei@mail.ua> -Date: Fri, 21 Apr 2017 07:32:23 -0700 -Subject: [PATCH] update: Compare computed vs expected sha256 digit string - ignoring case - -We produce sha256 digest string using %x snprintf() -qualifier for each byte of digest which uses alphabetic -characters from "a" to "f" in lower case to represent -integer values from 10 to 15. - -Previously all of the NVD META files supply sha256 -digest string for corresponding XML file in lower case. - -However due to some reason this changed recently to -provide digest digits in upper case causing fetched -data consistency checks to fail. This prevents database -from being updated periodically. - -While commit c4f6e94 (update: Do not treat sha256 failure -as fatal if requested) adds useful option to skip -digest validation at all and thus provides workaround for -this situation, it might be unacceptable for some -deployments where we need to ensure that downloaded -data is consistent before start parsing it and update -SQLite database. - -Use strcasecmp() to compare two digest strings case -insensitively and addressing this case. - -Upstream-Status: Backport -Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> ---- - src/update.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/update.c b/src/update.c -index 8588f38..3cc6b67 100644 ---- a/src/update.c -+++ b/src/update.c -@@ -187,7 +187,7 @@ static bool nvdcve_data_ok(const char *meta, const char *data) - snprintf(&csum_data[idx], len, "%02hhx", digest[i]); - } - -- ret = streq(csum_meta, csum_data); -+ ret = !strcasecmp(csum_meta, csum_data); - - err_unmap: - munmap(buffer, length); --- -2.11.0 - diff --git a/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch b/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch deleted file mode 100644 index 0774ad946a..0000000000 --- a/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch +++ /dev/null @@ -1,51 +0,0 @@ -From ce64633b9733e962b8d8482244301f614d8b5845 Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@gmail.com> -Date: Mon, 22 Aug 2016 22:54:24 -0700 -Subject: [PATCH] Check for malloc_trim before using it - -malloc_trim is gnu specific and not all libc -implement it, threfore write a configure check -to poke for it first and use the define to -guard its use. - -Helps in compiling on musl based systems - -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- -Upstream-Status: Submitted [https://github.com/ikeydoherty/cve-check-tool/pull/48] - configure.ac | 2 ++ - src/core.c | 4 ++-- - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/configure.ac b/configure.ac -index d3b66ce..79c3542 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -19,6 +19,8 @@ m4_define([json_required_version], [0.16.0]) - m4_define([openssl_required_version],[1.0.0]) - # TODO: Set minimum sqlite - -+AC_CHECK_FUNCS_ONCE(malloc_trim) -+ - PKG_CHECK_MODULES(CVE_CHECK_TOOL, - [ - glib-2.0 >= glib_required_version, -diff --git a/src/core.c b/src/core.c -index 6263031..0d5df29 100644 ---- a/src/core.c -+++ b/src/core.c -@@ -498,9 +498,9 @@ bool cve_db_load(CveDB *self, const char *fname) - } - - b = true; -- -+#ifdef HAVE_MALLOC_TRIM - malloc_trim(0); -- -+#endif - xmlFreeTextReader(r); - if (fd) { - close(fd); --- -2.9.3 - diff --git a/meta/recipes-devtools/elfutils/elfutils_0.175.bb b/meta/recipes-devtools/elfutils/elfutils_0.175.bb index b0b9ddc736..862a9b6c98 100644 --- a/meta/recipes-devtools/elfutils/elfutils_0.175.bb +++ b/meta/recipes-devtools/elfutils/elfutils_0.175.bb @@ -27,6 +27,12 @@ SRC_URI = "https://sourceware.org/elfutils/ftp/${PV}/${BP}.tar.bz2 \ file://debian/hurd_path.patch \ file://debian/ignore_strmerge.diff \ file://debian/disable_werror.patch \ + file://CVE-2019-7149.patch \ + file://CVE-2019-7150.patch \ + file://CVE-2019-7146_p1.patch \ + file://CVE-2019-7146_p2.patch \ + file://CVE-2019-7664.patch \ + file://CVE-2019-7665.patch \ " SRC_URI_append_libc-musl = " file://0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch" diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7146_p1.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7146_p1.patch new file mode 100644 index 0000000000..b6cd29af1a --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7146_p1.patch @@ -0,0 +1,52 @@ +From 012018907ca05eb0ab51d424a596ef38fc87cae1 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Wed, 16 Jan 2019 11:57:35 +0100 +Subject: [PATCH] libebl: Check GNU property note pr_datasz fits inside note + description. + +Before printing the data values, make sure pr_datasz doesn't go beyond +the end of the note description data. + +https://sourceware.org/bugzilla/show_bug.cgi?id=24075 + +Signed-off-by: Mark Wielaard <mark@klomp.org> + +Upstream-Status: Backport +CVE: CVE-2019-7146 patch #1 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + libebl/ChangeLog | 4 ++++ + libebl/eblobjnote.c | 7 +++++++ + 2 files changed, 11 insertions(+) + +Index: elfutils-0.175/libebl/eblobjnote.c +=================================================================== +--- elfutils-0.175.orig/libebl/eblobjnote.c ++++ elfutils-0.175/libebl/eblobjnote.c +@@ -350,6 +350,13 @@ ebl_object_note (Ebl *ebl, uint32_t name + desc += 8; + descsz -= 8; + ++ if (prop.pr_datasz > descsz) ++ { ++ printf ("BAD property datasz: %" PRId32 "\n", ++ prop.pr_datasz); ++ return; ++ } ++ + int elfclass = gelf_getclass (ebl->elf); + char *elfident = elf_getident (ebl->elf, NULL); + GElf_Ehdr ehdr; +Index: elfutils-0.175/libebl/ChangeLog +=================================================================== +--- elfutils-0.175.orig/libebl/ChangeLog ++++ elfutils-0.175/libebl/ChangeLog +@@ -1,3 +1,7 @@ ++2019-01-16 Mark Wielaard <mark@klomp.org> ++ ++ * eblobjnte.c (ebl_object_note): Check pr_datasz isn't too large. ++ + 2018-11-15 Mark Wielaard <mark@klomp.org> + + * eblobjnotetypename.c (ebl_object_note_type_name): Don't update diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7146_p2.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7146_p2.patch new file mode 100644 index 0000000000..4434b36579 --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7146_p2.patch @@ -0,0 +1,65 @@ +From cd7ded3df43f655af945c869976401a602e46fcd Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Wed, 30 Jan 2019 00:04:11 +0100 +Subject: [PATCH] libebl: Check GNU property note data padding fits inside + note. + +The GNU property note data is padded. Make sure the extra padding +still fits in the note description. + +https://sourceware.org/bugzilla/show_bug.cgi?id=24075 + +Signed-off-by: Mark Wielaard <mark@klomp.org> + +Upstream-Status: Backport +CVE: CVE-2019-7146 patch #2 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + libebl/ChangeLog | 5 +++++ + libebl/eblobjnote.c | 17 +++++++++-------- + 2 files changed, 14 insertions(+), 8 deletions(-) + +Index: elfutils-0.175/libebl/ChangeLog +=================================================================== +--- elfutils-0.175.orig/libebl/ChangeLog ++++ elfutils-0.175/libebl/ChangeLog +@@ -1,3 +1,8 @@ ++2019-01-29 Mark Wielaard <mark@klomp.org> ++ ++ * eblobjnote.c (ebl_object_note): Check pr_datasz padding doesn't ++ overflow descsz. ++ + 2019-01-16 Mark Wielaard <mark@klomp.org> + + * eblobjnte.c (ebl_object_note): Check pr_datasz isn't too large. +Index: elfutils-0.175/libebl/eblobjnote.c +=================================================================== +--- elfutils-0.175.orig/libebl/eblobjnote.c ++++ elfutils-0.175/libebl/eblobjnote.c +@@ -486,16 +486,17 @@ ebl_object_note (Ebl *ebl, uint32_t name + printf ("%02" PRIx8 "\n", (uint8_t) desc[i]); + } + } ++ + if (elfclass == ELFCLASS32) +- { +- desc += NOTE_ALIGN4 (prop.pr_datasz); +- descsz -= NOTE_ALIGN4 (prop.pr_datasz); +- } ++ prop.pr_datasz = NOTE_ALIGN4 (prop.pr_datasz); + else +- { +- desc += NOTE_ALIGN8 (prop.pr_datasz); +- descsz -= NOTE_ALIGN8 (prop.pr_datasz); +- } ++ prop.pr_datasz = NOTE_ALIGN8 (prop.pr_datasz); ++ ++ desc += prop.pr_datasz; ++ if (descsz > prop.pr_datasz) ++ descsz -= prop.pr_datasz; ++ else ++ descsz = 0; + } + } + break; diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch new file mode 100644 index 0000000000..215a1715bf --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch @@ -0,0 +1,148 @@ +From 2562759d6fe5b364fe224852e64e8bda39eb2e35 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Sun, 20 Jan 2019 22:10:18 +0100 +Subject: [PATCH] libdw: Check terminating NUL byte in dwarf_getsrclines for + dir/file table. + +For DWARF version < 5 the .debug_line directory and file tables consist +of a terminating NUL byte after all strings. The code used to just skip +this without checking it actually existed. This could case a spurious +read past the end of data. + +Fix the same issue in readelf. + +https://sourceware.org/bugzilla/show_bug.cgi?id=24102 + +Signed-off-by: Mark Wielaard <mark@klomp.org> + +Upstream-Status: Backport +CVE: CVE-2019-7149 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + libdw/ChangeLog | 5 +++++ + libdw/dwarf_getsrclines.c | 11 ++++++++--- + src/ChangeLog | 5 +++++ + src/readelf.c | 8 ++++++-- + 4 files changed, 24 insertions(+), 5 deletions(-) + +Index: elfutils-0.175/libdw/dwarf_getsrclines.c +=================================================================== +--- elfutils-0.175.orig/libdw/dwarf_getsrclines.c ++++ elfutils-0.175/libdw/dwarf_getsrclines.c +@@ -315,7 +315,7 @@ read_srclines (Dwarf *dbg, + if (version < 5) + { + const unsigned char *dirp = linep; +- while (*dirp != 0) ++ while (dirp < lineendp && *dirp != 0) + { + uint8_t *endp = memchr (dirp, '\0', lineendp - dirp); + if (endp == NULL) +@@ -323,6 +323,8 @@ read_srclines (Dwarf *dbg, + ++ndirs; + dirp = endp + 1; + } ++ if (dirp >= lineendp || *dirp != '\0') ++ goto invalid_data; + ndirs = ndirs + 1; /* There is always the "unknown" dir. */ + } + else +@@ -392,11 +394,12 @@ read_srclines (Dwarf *dbg, + { + dirarray[n].dir = (char *) linep; + uint8_t *endp = memchr (linep, '\0', lineendp - linep); +- assert (endp != NULL); ++ assert (endp != NULL); // Checked above when calculating ndirlist. + dirarray[n].len = endp - linep; + linep = endp + 1; + } + /* Skip the final NUL byte. */ ++ assert (*linep == '\0'); // Checked above when calculating ndirlist. + ++linep; + } + else +@@ -471,7 +474,7 @@ read_srclines (Dwarf *dbg, + { + if (unlikely (linep >= lineendp)) + goto invalid_data; +- while (*linep != 0) ++ while (linep < lineendp && *linep != '\0') + { + struct filelist *new_file = NEW_FILE (); + +@@ -527,6 +530,8 @@ read_srclines (Dwarf *dbg, + goto invalid_data; + get_uleb128 (new_file->info.length, linep, lineendp); + } ++ if (linep >= lineendp || *linep != '\0') ++ goto invalid_data; + /* Skip the final NUL byte. */ + ++linep; + } +Index: elfutils-0.175/src/readelf.c +=================================================================== +--- elfutils-0.175.orig/src/readelf.c ++++ elfutils-0.175/src/readelf.c +@@ -8444,7 +8444,7 @@ print_debug_line_section (Dwfl_Module *d + } + else + { +- while (*linep != 0) ++ while (linep < lineendp && *linep != 0) + { + unsigned char *endp = memchr (linep, '\0', lineendp - linep); + if (unlikely (endp == NULL)) +@@ -8454,6 +8454,8 @@ print_debug_line_section (Dwfl_Module *d + + linep = endp + 1; + } ++ if (linep >= lineendp || *linep != 0) ++ goto invalid_unit; + /* Skip the final NUL byte. */ + ++linep; + } +@@ -8523,7 +8525,7 @@ print_debug_line_section (Dwfl_Module *d + else + { + puts (gettext (" Entry Dir Time Size Name")); +- for (unsigned int cnt = 1; *linep != 0; ++cnt) ++ for (unsigned int cnt = 1; linep < lineendp && *linep != 0; ++cnt) + { + /* First comes the file name. */ + char *fname = (char *) linep; +@@ -8553,6 +8555,8 @@ print_debug_line_section (Dwfl_Module *d + printf (" %-5u %-5u %-9u %-9u %s\n", + cnt, diridx, mtime, fsize, fname); + } ++ if (linep >= lineendp || *linep != '\0') ++ goto invalid_unit; + /* Skip the final NUL byte. */ + ++linep; + } +Index: elfutils-0.175/libdw/ChangeLog +=================================================================== +--- elfutils-0.175.orig/libdw/ChangeLog ++++ elfutils-0.175/libdw/ChangeLog +@@ -1,3 +1,8 @@ ++2019-01-20 Mark Wielaard <mark@klomp.org> ++ ++ * dwarf_getsrclines.c (read_srclines): Check terminating NUL byte ++ for dir and file lists. ++ + 2018-10-20 Mark Wielaard <mark@klomp.org> + + * libdw.map (ELFUTILS_0.175): New section. Add dwelf_elf_begin. +Index: elfutils-0.175/src/ChangeLog +=================================================================== +--- elfutils-0.175.orig/src/ChangeLog ++++ elfutils-0.175/src/ChangeLog +@@ -1,3 +1,8 @@ ++2019-01-20 Mark Wielaard <mark@klomp.org> ++ ++ * readelf.c (print_debug_line_section): Check terminating NUL byte ++ for dir and file tables. ++ + 2018-11-10 Mark Wielaard <mark@klomp.org> + + * elflint.c (check_program_header): Allow PT_GNU_EH_FRAME segment diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7150.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7150.patch new file mode 100644 index 0000000000..01a4fb1562 --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7150.patch @@ -0,0 +1,51 @@ +From da5c5336a1eaf519de246f7d9f0f5585e1d4ac59 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Sun, 20 Jan 2019 23:05:56 +0100 +Subject: [PATCH] libdwfl: Sanity check partial core file dyn data read. + +When reading the dyn data from the core file check if we got everything, +or just part of the data. + +https://sourceware.org/bugzilla/show_bug.cgi?id=24103 + +Signed-off-by: Mark Wielaard <mark@klomp.org> + +Upstream-Status: Backport +CVE: CVE-2019-7150 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + libdwfl/ChangeLog | 5 +++++ + libdwfl/dwfl_segment_report_module.c | 6 ++++++ + 2 files changed, 11 insertions(+) + +Index: elfutils-0.175/libdwfl/dwfl_segment_report_module.c +=================================================================== +--- elfutils-0.175.orig/libdwfl/dwfl_segment_report_module.c ++++ elfutils-0.175/libdwfl/dwfl_segment_report_module.c +@@ -783,6 +783,12 @@ dwfl_segment_report_module (Dwfl *dwfl, + if (dyn_filesz != 0 && dyn_filesz % dyn_entsize == 0 + && ! read_portion (&dyn_data, &dyn_data_size, dyn_vaddr, dyn_filesz)) + { ++ /* dyn_data_size will be zero if we got everything from the initial ++ buffer, otherwise it will be the size of the new buffer that ++ could be read. */ ++ if (dyn_data_size != 0) ++ dyn_filesz = dyn_data_size; ++ + void *dyns = malloc (dyn_filesz); + Elf32_Dyn (*d32)[dyn_filesz / sizeof (Elf32_Dyn)] = dyns; + Elf64_Dyn (*d64)[dyn_filesz / sizeof (Elf64_Dyn)] = dyns; +Index: elfutils-0.175/libdwfl/ChangeLog +=================================================================== +--- elfutils-0.175.orig/libdwfl/ChangeLog ++++ elfutils-0.175/libdwfl/ChangeLog +@@ -1,3 +1,8 @@ ++2019-01-20 Mark Wielaard <mark@klomp.org> ++ ++ * dwfl_segment_report_module.c (dwfl_segment_report_module): Check ++ dyn_filesz vs dyn_data_size after read_portion call. ++ + 2018-10-20 Mark Wielaard <mark@klomp.org> + + * libdwflP.h (__libdw_open_elf): New internal function declaration. diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7664.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7664.patch new file mode 100644 index 0000000000..e55dc5a054 --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7664.patch @@ -0,0 +1,65 @@ +From 3ed05376e7b2c96c1d6eb24d2842cc25b79a4f07 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Wed, 16 Jan 2019 12:25:57 +0100 +Subject: [PATCH] CVE: CVE-2019-7664 + +Upstream-Status: Backport +libelf: Correct overflow check in note_xlate. + +We want to make sure the note_len doesn't overflow and becomes shorter +than the note header. But the namesz and descsz checks got the note header +size wrong). Replace the wrong constant (8) with a sizeof cvt_Nhdr (12). + +https://sourceware.org/bugzilla/show_bug.cgi?id=24084 + +Signed-off-by: Mark Wielaard <mark@klomp.org> +Signed-off-by: Ubuntu <lisa@shuagr-yocto-build.mdn4q2lr1oauhmizmzsslly3ad.xx.internal.cloudapp.net> +--- + libelf/ChangeLog | 13 +++++++++++++ + libelf/note_xlate.h | 4 ++-- + 2 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/libelf/ChangeLog b/libelf/ChangeLog +index 68c4fbd..892e6e7 100644 +--- a/libelf/ChangeLog ++++ b/libelf/ChangeLog +@@ -1,3 +1,16 @@ ++<<<<<<< HEAD ++======= ++2019-01-16 Mark Wielaard <mark@klomp.org> ++ ++ * note_xlate.h (elf_cvt_note): Check n_namesz and n_descsz don't ++ overflow note_len into note header. ++ ++2018-11-17 Mark Wielaard <mark@klomp.org> ++ ++ * elf32_updatefile.c (updatemmap): Make sure to call convert ++ function on a properly aligned destination. ++ ++>>>>>>> e65d91d... libelf: Correct overflow check in note_xlate. + 2018-11-16 Mark Wielaard <mark@klomp.org> + + * libebl.h (__elf32_msize): Mark with const attribute. +diff --git a/libelf/note_xlate.h b/libelf/note_xlate.h +index 9bdc3e2..bc9950f 100644 +--- a/libelf/note_xlate.h ++++ b/libelf/note_xlate.h +@@ -46,13 +46,13 @@ elf_cvt_note (void *dest, const void *src, size_t len, int encode, + /* desc needs to be aligned. */ + note_len += n->n_namesz; + note_len = nhdr8 ? NOTE_ALIGN8 (note_len) : NOTE_ALIGN4 (note_len); +- if (note_len > len || note_len < 8) ++ if (note_len > len || note_len < sizeof *n) + break; + + /* data as a whole needs to be aligned. */ + note_len += n->n_descsz; + note_len = nhdr8 ? NOTE_ALIGN8 (note_len) : NOTE_ALIGN4 (note_len); +- if (note_len > len || note_len < 8) ++ if (note_len > len || note_len < sizeof *n) + break; + + /* Copy or skip the note data. */ +-- +2.7.4 + diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7665.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7665.patch new file mode 100644 index 0000000000..a1bb30979d --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7665.patch @@ -0,0 +1,154 @@ +From 4323d46c4a369b614aa1f574805860b3434552df Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Wed, 16 Jan 2019 15:41:31 +0100 +Subject: [PATCH] CVE: CVE-2019-7665 + +Upstream-Status: Backport + +Sign off: Shubham Agrawal <shuagr@microsoft.com> + +libebl: Check NT_PLATFORM core notes contain a zero terminated string. + +Most strings in core notes are fixed size. But NT_PLATFORM contains just +a variable length string. Check that it is actually zero terminated +before passing to readelf to print. + +https://sourceware.org/bugzilla/show_bug.cgi?id=24089 + +Signed-off-by: Mark Wielaard <mark@klomp.org> +Signed-off-by: Ubuntu <lisa@shuagr-yocto-build.mdn4q2lr1oauhmizmzsslly3ad.xx.internal.cloudapp.net> +--- + libdwfl/linux-core-attach.c | 9 +++++---- + libebl/eblcorenote.c | 39 +++++++++++++++++++-------------------- + libebl/libebl.h | 3 ++- + src/readelf.c | 2 +- + 4 files changed, 27 insertions(+), 26 deletions(-) + +diff --git a/libdwfl/linux-core-attach.c b/libdwfl/linux-core-attach.c +index 6c99b9e..c0f1b0d 100644 +--- a/libdwfl/linux-core-attach.c ++++ b/libdwfl/linux-core-attach.c +@@ -137,7 +137,7 @@ core_next_thread (Dwfl *dwfl __attribute__ ((unused)), void *dwfl_arg, + const Ebl_Register_Location *reglocs; + size_t nitems; + const Ebl_Core_Item *items; +- if (! ebl_core_note (core_arg->ebl, &nhdr, name, ++ if (! ebl_core_note (core_arg->ebl, &nhdr, name, desc, + ®s_offset, &nregloc, ®locs, &nitems, &items)) + { + /* This note may be just not recognized, skip it. */ +@@ -191,8 +191,9 @@ core_set_initial_registers (Dwfl_Thread *thread, void *thread_arg_voidp) + const Ebl_Register_Location *reglocs; + size_t nitems; + const Ebl_Core_Item *items; +- int core_note_err = ebl_core_note (core_arg->ebl, &nhdr, name, ®s_offset, +- &nregloc, ®locs, &nitems, &items); ++ int core_note_err = ebl_core_note (core_arg->ebl, &nhdr, name, desc, ++ ®s_offset, &nregloc, ®locs, ++ &nitems, &items); + /* __libdwfl_attach_state_for_core already verified the note is there. */ + assert (core_note_err != 0); + assert (nhdr.n_type == NT_PRSTATUS); +@@ -383,7 +384,7 @@ dwfl_core_file_attach (Dwfl *dwfl, Elf *core) + const Ebl_Register_Location *reglocs; + size_t nitems; + const Ebl_Core_Item *items; +- if (! ebl_core_note (ebl, &nhdr, name, ++ if (! ebl_core_note (ebl, &nhdr, name, desc, + ®s_offset, &nregloc, ®locs, &nitems, &items)) + { + /* This note may be just not recognized, skip it. */ +diff --git a/libebl/eblcorenote.c b/libebl/eblcorenote.c +index 783f981..7fab397 100644 +--- a/libebl/eblcorenote.c ++++ b/libebl/eblcorenote.c +@@ -36,11 +36,13 @@ + #include <inttypes.h> + #include <stdio.h> + #include <stddef.h> ++#include <string.h> + #include <libeblP.h> + + + int + ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, const char *name, ++ const char *desc, + GElf_Word *regs_offset, size_t *nregloc, + const Ebl_Register_Location **reglocs, size_t *nitems, + const Ebl_Core_Item **items) +@@ -51,28 +53,25 @@ ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, const char *name, + { + /* The machine specific function did not know this type. */ + +- *regs_offset = 0; +- *nregloc = 0; +- *reglocs = NULL; +- switch (nhdr->n_type) ++ /* NT_PLATFORM is kind of special since it needs a zero terminated ++ string (other notes often have a fixed size string). */ ++ static const Ebl_Core_Item platform[] = + { +-#define ITEMS(type, table) \ +- case type: \ +- *items = table; \ +- *nitems = sizeof table / sizeof table[0]; \ +- result = 1; \ +- break ++ { ++ .name = "Platform", ++ .type = ELF_T_BYTE, .count = 0, .format = 's' ++ } ++ }; + +- static const Ebl_Core_Item platform[] = +- { +- { +- .name = "Platform", +- .type = ELF_T_BYTE, .count = 0, .format = 's' +- } +- }; +- ITEMS (NT_PLATFORM, platform); +- +-#undef ITEMS ++ if (nhdr->n_type == NT_PLATFORM ++ && memchr (desc, '\0', nhdr->n_descsz) != NULL) ++ { ++ *regs_offset = 0; ++ *nregloc = 0; ++ *reglocs = NULL; ++ *items = platform; ++ *nitems = 1; ++ result = 1; + } + } + +diff --git a/libebl/libebl.h b/libebl/libebl.h +index ca9b9fe..24922eb 100644 +--- a/libebl/libebl.h ++++ b/libebl/libebl.h +@@ -319,7 +319,8 @@ typedef struct + + /* Describe the format of a core file note with the given header and NAME. + NAME is not guaranteed terminated, it's NHDR->n_namesz raw bytes. */ +-extern int ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, const char *name, ++extern int ebl_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, ++ const char *name, const char *desc, + GElf_Word *regs_offset, size_t *nregloc, + const Ebl_Register_Location **reglocs, + size_t *nitems, const Ebl_Core_Item **items) +diff --git a/src/readelf.c b/src/readelf.c +index 3a73710..71651e0 100644 +--- a/src/readelf.c ++++ b/src/readelf.c +@@ -12153,7 +12153,7 @@ handle_core_note (Ebl *ebl, const GElf_Nhdr *nhdr, + size_t nitems; + const Ebl_Core_Item *items; + +- if (! ebl_core_note (ebl, nhdr, name, ++ if (! ebl_core_note (ebl, nhdr, name, desc, + ®s_offset, &nregloc, ®locs, &nitems, &items)) + return; + +-- +2.7.4 + diff --git a/meta/recipes-devtools/file/file/CVE-2019-8904.patch b/meta/recipes-devtools/file/file/CVE-2019-8904.patch new file mode 100644 index 0000000000..5c3d6f73a4 --- /dev/null +++ b/meta/recipes-devtools/file/file/CVE-2019-8904.patch @@ -0,0 +1,30 @@ +From 94b7501f48e134e77716e7ebefc73d6bbe72ba55 Mon Sep 17 00:00:00 2001 +From: Christos Zoulas <christos@zoulas.com> +Date: Mon, 18 Feb 2019 17:30:41 +0000 +Subject: [PATCH] PR/62: spinpx: Avoid non-nul-terminated string read. + +Upstream-Status: Backport +CVE: CVE-2019-8904 +Affects < 5.36 +[Fixup for thud context] +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + src/readelf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +Index: git/src/readelf.c +=================================================================== +--- git.orig/src/readelf.c ++++ git/src/readelf.c +@@ -558,8 +558,8 @@ do_bid_note(struct magic_set *ms, unsign + } + if (namesz == 4 && strcmp((char *)&nbuf[noff], "Go") == 0 && + type == NT_GO_BUILD_ID && descsz < 128) { +- if (file_printf(ms, ", Go BuildID=%s", +- (char *)&nbuf[doff]) == -1) ++ if (file_printf(ms, ", Go BuildID=%.*s", ++ CAST(int, descsz), CAST(char *, &nbuf[doff])) == -1) + return 1; + return 1; + } diff --git a/meta/recipes-devtools/file/file/CVE-2019-8905_CVE-2019-8907.patch b/meta/recipes-devtools/file/file/CVE-2019-8905_CVE-2019-8907.patch new file mode 100644 index 0000000000..a55b94c61a --- /dev/null +++ b/meta/recipes-devtools/file/file/CVE-2019-8905_CVE-2019-8907.patch @@ -0,0 +1,120 @@ +From d65781527c8134a1202b2649695d48d5701ac60b Mon Sep 17 00:00:00 2001 +From: Christos Zoulas <christos@zoulas.com> +Date: Mon, 18 Feb 2019 17:46:56 +0000 +Subject: [PATCH] PR/62: spinpx: limit size of file_printable. + +Upstream-Status: Backport +CVE: CVE-2019-8905 +CVE: CVE-2019-8907 +affects < 5.36 + +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + src/file.h | 4 ++-- + src/funcs.c | 9 +++++---- + src/readelf.c | 7 ++++--- + src/softmagic.c | 14 ++++++++------ + 4 files changed, 19 insertions(+), 15 deletions(-) + +Index: git/src/file.h +=================================================================== +--- git.orig/src/file.h ++++ git/src/file.h +@@ -501,7 +501,7 @@ protected int file_looks_utf8(const unsi + size_t *); + protected size_t file_pstring_length_size(const struct magic *); + protected size_t file_pstring_get_length(const struct magic *, const char *); +-protected char * file_printable(char *, size_t, const char *); ++protected char * file_printable(char *, size_t, const char *, size_t); + #ifdef __EMX__ + protected int file_os2_apptype(struct magic_set *, const char *, const void *, + size_t); +Index: git/src/funcs.c +=================================================================== +--- git.orig/src/funcs.c ++++ git/src/funcs.c +@@ -595,12 +595,13 @@ file_pop_buffer(struct magic_set *ms, fi + * convert string to ascii printable format. + */ + protected char * +-file_printable(char *buf, size_t bufsiz, const char *str) ++file_printable(char *buf, size_t bufsiz, const char *str, size_t slen) + { +- char *ptr, *eptr; ++ char *ptr, *eptr = buf + bufsiz - 1; + const unsigned char *s = (const unsigned char *)str; ++ const unsigned char *es = s + slen; + +- for (ptr = buf, eptr = ptr + bufsiz - 1; ptr < eptr && *s; s++) { ++ for (ptr = buf; ptr < eptr && s < es && *s; s++) { + if (isprint(*s)) { + *ptr++ = *s; + continue; +Index: git/src/readelf.c +=================================================================== +--- git.orig/src/readelf.c ++++ git/src/readelf.c +@@ -750,7 +750,7 @@ do_core_note(struct magic_set *ms, unsig + if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, " + "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)", + file_printable(sbuf, sizeof(sbuf), +- CAST(char *, pi.cpi_name)), ++ CAST(char *, pi.cpi_name), sizeof(pi.cpi_name)), + elf_getu32(swap, (uint32_t)pi.cpi_pid), + elf_getu32(swap, pi.cpi_euid), + elf_getu32(swap, pi.cpi_egid), +@@ -1655,7 +1655,8 @@ dophn_exec(struct magic_set *ms, int cla + return -1; + if (interp[0]) + if (file_printf(ms, ", interpreter %s", +- file_printable(ibuf, sizeof(ibuf), interp)) == -1) ++ file_printable(ibuf, sizeof(ibuf), interp, sizeof(interp))) ++ == -1) + return -1; + return 0; + } +Index: git/src/softmagic.c +=================================================================== +--- git.orig/src/softmagic.c ++++ git/src/softmagic.c +@@ -616,8 +616,8 @@ mprint(struct magic_set *ms, struct magi + case FILE_LESTRING16: + if (m->reln == '=' || m->reln == '!') { + if (file_printf(ms, F(ms, desc, "%s"), +- file_printable(sbuf, sizeof(sbuf), m->value.s)) +- == -1) ++ file_printable(sbuf, sizeof(sbuf), m->value.s, ++ sizeof(m->value.s))) == -1) + return -1; + t = ms->offset + m->vallen; + } +@@ -644,7 +644,8 @@ mprint(struct magic_set *ms, struct magi + } + + if (file_printf(ms, F(ms, desc, "%s"), +- file_printable(sbuf, sizeof(sbuf), str)) == -1) ++ file_printable(sbuf, sizeof(sbuf), str, ++ sizeof(p->s) - (str - p->s))) == -1) + return -1; + + if (m->type == FILE_PSTRING) +@@ -750,7 +751,7 @@ mprint(struct magic_set *ms, struct magi + return -1; + } + rval = file_printf(ms, F(ms, desc, "%s"), +- file_printable(sbuf, sizeof(sbuf), cp)); ++ file_printable(sbuf, sizeof(sbuf), cp, ms->search.rm_len)); + free(cp); + + if (rval == -1) +@@ -777,7 +778,8 @@ mprint(struct magic_set *ms, struct magi + break; + case FILE_DER: + if (file_printf(ms, F(ms, desc, "%s"), +- file_printable(sbuf, sizeof(sbuf), ms->ms_value.s)) == -1) ++ file_printable(sbuf, sizeof(sbuf), ms->ms_value.s, ++ sizeof(ms->ms_value.s))) == -1) + return -1; + t = ms->offset; + break; diff --git a/meta/recipes-devtools/file/file/CVE-2019-8906.patch b/meta/recipes-devtools/file/file/CVE-2019-8906.patch new file mode 100644 index 0000000000..1079ac6675 --- /dev/null +++ b/meta/recipes-devtools/file/file/CVE-2019-8906.patch @@ -0,0 +1,27 @@ +From 2858eaf99f6cc5aae129bcbf1e24ad160240185f Mon Sep 17 00:00:00 2001 +From: Christos Zoulas <christos@zoulas.com> +Date: Wed, 2 Jan 2019 19:44:14 +0000 +Subject: [PATCH] Avoid OOB read (found by ASAN reported by F. Alonso) + +Upstream-Status: Backport +CVE: CVE-2019-8906 +Affects < 5.36 +[Fixup for thud context] +Signed-off-by: Armin Kuster <akuster@mvista.com> +--- + src/readelf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +Index: git/src/readelf.c +=================================================================== +--- git.orig/src/readelf.c ++++ git/src/readelf.c +@@ -745,7 +745,7 @@ do_core_note(struct magic_set *ms, unsig + char sbuf[512]; + struct NetBSD_elfcore_procinfo pi; + memset(&pi, 0, sizeof(pi)); +- memcpy(&pi, nbuf + doff, descsz); ++ memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi))); + + if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, " + "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)", diff --git a/meta/recipes-devtools/file/file_5.34.bb b/meta/recipes-devtools/file/file_5.34.bb index 5d92913cb0..cb19642ff1 100644 --- a/meta/recipes-devtools/file/file_5.34.bb +++ b/meta/recipes-devtools/file/file_5.34.bb @@ -16,6 +16,9 @@ UPSTREAM_CHECK_GITTAGREGEX = "FILE(?P<pver>(?!6_23).+)" SRC_URI = "git://github.com/file/file.git \ file://debian-742262.patch \ + file://CVE-2019-8906.patch \ + file://CVE-2019-8904.patch \ + file://CVE-2019-8905_CVE-2019-8907.patch \ " SRCREV = "315cef2f699da3c31a54bd3c6c6070680fbaf1f5" diff --git a/meta/recipes-devtools/gcc/gcc-8.2.inc b/meta/recipes-devtools/gcc/gcc-8.2.inc index 866a77558b..bd95ccda09 100644 --- a/meta/recipes-devtools/gcc/gcc-8.2.inc +++ b/meta/recipes-devtools/gcc/gcc-8.2.inc @@ -73,6 +73,7 @@ SRC_URI = "\ ${BACKPORTS} \ " BACKPORTS = "\ + file://CVE-2019-14250.patch \ " SRC_URI[md5sum] = "4ab282f414676496483b3e1793d07862" SRC_URI[sha256sum] = "196c3c04ba2613f893283977e6011b2345d1cd1af9abeac58e916b1aab3e0080" diff --git a/meta/recipes-devtools/gcc/gcc-8.2/CVE-2019-14250.patch b/meta/recipes-devtools/gcc/gcc-8.2/CVE-2019-14250.patch new file mode 100644 index 0000000000..e327684e16 --- /dev/null +++ b/meta/recipes-devtools/gcc/gcc-8.2/CVE-2019-14250.patch @@ -0,0 +1,44 @@ +From a4f1b58eb48b349a5f353bc69c30be553506d33b Mon Sep 17 00:00:00 2001 +From: rguenth <rguenth@138bc75d-0d04-0410-961f-82ee72b054a4> +Date: Thu, 25 Jul 2019 10:48:26 +0000 +Subject: [PATCH] 2019-07-25 Richard Biener <rguenther@suse.de> + + PR lto/90924 + Backport from mainline + 2019-07-12 Ren Kimura <rkx1209dev@gmail.com> + + * simple-object-elf.c (simple_object_elf_match): Check zero value + shstrndx. + + +git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-8-branch@273794 138bc75d-0d04-0410-961f-82ee72b054a4 + +Upstream-Status: Backport +Affectes: < 9.2 +CVE: CVE-2019-14250 +Dropped changelog +Signed-off-by: Armin Kuster <Akustre@mvista.com> + +--- + libiberty/simple-object-elf.c | 8 ++++++++ + 2 files changed, 17 insertions(+) + +Index: gcc-8.2.0/libiberty/simple-object-elf.c +=================================================================== +--- gcc-8.2.0.orig/libiberty/simple-object-elf.c ++++ gcc-8.2.0/libiberty/simple-object-elf.c +@@ -549,6 +549,14 @@ simple_object_elf_match (unsigned char h + return NULL; + } + ++ if (eor->shstrndx == 0) ++ { ++ *errmsg = "invalid ELF shstrndx == 0"; ++ *err = 0; ++ XDELETE (eor); ++ return NULL; ++ } ++ + return (void *) eor; + } + diff --git a/meta/recipes-devtools/go/go-1.11.inc b/meta/recipes-devtools/go/go-1.11.inc index d626514ae6..90d40376c5 100644 --- a/meta/recipes-devtools/go/go-1.11.inc +++ b/meta/recipes-devtools/go/go-1.11.inc @@ -1,7 +1,7 @@ require go-common.inc GO_BASEVERSION = "1.11" -GO_MINOR = ".1" +GO_MINOR = ".13" PV .= "${GO_MINOR}" FILESEXTRAPATHS_prepend := "${FILE_DIRNAME}/go-${GO_BASEVERSION}:" @@ -17,8 +17,7 @@ SRC_URI += "\ file://0007-cmd-go-make-GOROOT-precious-by-default.patch \ file://0008-use-GOBUILDMODE-to-set-buildmode.patch \ " - SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" -SRC_URI[main.md5sum] = "eb9e9792247143705a7aacea9398cde0" -SRC_URI[main.sha256sum] = "558f8c169ae215e25b81421596e8de7572bd3ba824b79add22fba6e284db1117" +SRC_URI[main.md5sum] = "32e71746981695517387a2149eb541ef" +SRC_URI[main.sha256sum] = "5032095fd3f641cafcce164f551e5ae873785ce7b07ca7c143aecd18f7ba4076" diff --git a/meta/recipes-devtools/go/go-1.11/0007-cmd-go-make-GOROOT-precious-by-default.patch b/meta/recipes-devtools/go/go-1.11/0007-cmd-go-make-GOROOT-precious-by-default.patch index f317e48a33..29ef947abd 100644 --- a/meta/recipes-devtools/go/go-1.11/0007-cmd-go-make-GOROOT-precious-by-default.patch +++ b/meta/recipes-devtools/go/go-1.11/0007-cmd-go-make-GOROOT-precious-by-default.patch @@ -65,8 +65,8 @@ Index: go/src/cmd/go/internal/work/exec.go =================================================================== --- go.orig/src/cmd/go/internal/work/exec.go +++ go/src/cmd/go/internal/work/exec.go -@@ -440,6 +440,23 @@ func (b *Builder) build(a *Action) (err - return fmt.Errorf("module requires Go %s", p.Module.GoVersion) +@@ -436,6 +436,23 @@ func (b *Builder) build(a *Action) (err + return fmt.Errorf("missing or invalid binary-only package; expected file %q", a.Package.Target) } + if goRootPrecious && (a.Package.Standard || a.Package.Goroot) { @@ -89,7 +89,7 @@ Index: go/src/cmd/go/internal/work/exec.go if err := b.Mkdir(a.Objdir); err != nil { return err } -@@ -1435,6 +1452,14 @@ func BuildInstallFunc(b *Builder, a *Act +@@ -1438,6 +1455,14 @@ func BuildInstallFunc(b *Builder, a *Act return nil } diff --git a/meta/recipes-devtools/go/go-1.11/0008-use-GOBUILDMODE-to-set-buildmode.patch b/meta/recipes-devtools/go/go-1.11/0008-use-GOBUILDMODE-to-set-buildmode.patch index b6ab504335..225cf439c5 100644 --- a/meta/recipes-devtools/go/go-1.11/0008-use-GOBUILDMODE-to-set-buildmode.patch +++ b/meta/recipes-devtools/go/go-1.11/0008-use-GOBUILDMODE-to-set-buildmode.patch @@ -18,11 +18,11 @@ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> src/cmd/go/internal/work/build.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -diff --git a/src/cmd/go/internal/work/build.go b/src/cmd/go/internal/work/build.go -index 145b875..595d703 100644 ---- a/src/cmd/go/internal/work/build.go -+++ b/src/cmd/go/internal/work/build.go -@@ -218,7 +218,11 @@ func AddBuildFlags(cmd *base.Command) { +Index: go/src/cmd/go/internal/work/build.go +=================================================================== +--- go.orig/src/cmd/go/internal/work/build.go ++++ go/src/cmd/go/internal/work/build.go +@@ -223,7 +223,11 @@ func AddBuildFlags(cmd *base.Command) { cmd.Flag.Var(&load.BuildAsmflags, "asmflags", "") cmd.Flag.Var(buildCompiler{}, "compiler", "") @@ -35,6 +35,3 @@ index 145b875..595d703 100644 cmd.Flag.Var(&load.BuildGcflags, "gcflags", "") cmd.Flag.Var(&load.BuildGccgoflags, "gccgoflags", "") cmd.Flag.StringVar(&cfg.BuildMod, "mod", "", "") --- -2.7.4 - diff --git a/meta/recipes-devtools/go/go-crosssdk.inc b/meta/recipes-devtools/go/go-crosssdk.inc index 4391b32424..94f6fb8eb7 100644 --- a/meta/recipes-devtools/go/go-crosssdk.inc +++ b/meta/recipes-devtools/go/go-crosssdk.inc @@ -1,7 +1,7 @@ inherit crosssdk DEPENDS = "go-native virtual/${TARGET_PREFIX}gcc-crosssdk virtual/nativesdk-${TARGET_PREFIX}compilerlibs virtual/${TARGET_PREFIX}binutils-crosssdk" -PN = "go-crosssdk-${TARGET_ARCH}" +PN = "go-crosssdk-${SDK_SYS}" PROVIDES = "virtual/${TARGET_PREFIX}go-crosssdk" export GOHOSTOS = "${BUILD_GOOS}" diff --git a/meta/recipes-devtools/go/go-target.inc b/meta/recipes-devtools/go/go-target.inc index c229ab2f8d..379f87b498 100644 --- a/meta/recipes-devtools/go/go-target.inc +++ b/meta/recipes-devtools/go/go-target.inc @@ -40,7 +40,7 @@ do_install() { for f in ${B}/${GO_BUILD_BINDIR}/*; do name=`basename $f` install -m 0755 $f ${D}${libdir}/go/bin/ - ln -sf ../${BASELIB}/go/bin/$name ${D}${bindir}/ + ln -sf ../${baselib}/go/bin/$name ${D}${bindir}/ done } diff --git a/meta/recipes-devtools/json-c/json-c_0.13.1.bb b/meta/recipes-devtools/json-c/json-c_0.13.1.bb index 5b10e68297..e6a38995cb 100644 --- a/meta/recipes-devtools/json-c/json-c_0.13.1.bb +++ b/meta/recipes-devtools/json-c/json-c_0.13.1.bb @@ -20,8 +20,6 @@ RPROVIDES_${PN} = "libjson" inherit autotools -EXTRA_OECONF = "--enable-rdrand" - do_configure_prepend() { # Clean up autoconf cruft that should not be in the tarball rm -f ${S}/config.status diff --git a/meta/recipes-devtools/libcomps/libcomps/CVE-2019-3817.patch b/meta/recipes-devtools/libcomps/libcomps/CVE-2019-3817.patch new file mode 100644 index 0000000000..b8cfb3c4db --- /dev/null +++ b/meta/recipes-devtools/libcomps/libcomps/CVE-2019-3817.patch @@ -0,0 +1,97 @@ +From cea10cd1f2ef6bb4edaac0c1d46d47bf237c42b8 Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone <rschiron@redhat.com> +Date: Mon, 21 Jan 2019 18:11:42 +0100 +Subject: [PATCH] Fix UAF in comps_objmrtree_unite function + +The added field is not used at all in many places and it is probably the +left-over of some copy-paste. + +Upstream-Status: Backport +[https://github.com/rpm-software-management/libcomps/commit +/e3a5d056633677959ad924a51758876d415e7046] + +CVE: CVE-2019-3817 + +Signed-off-by: Kevin Weng <t-keweng@microsoft.com> +--- + libcomps/src/comps_mradix.c | 2 -- + libcomps/src/comps_objmradix.c | 2 -- + libcomps/src/comps_objradix.c | 2 -- + libcomps/src/comps_radix.c | 1 - + 4 files changed, 7 deletions(-) + +diff --git a/libcomps/src/comps_mradix.c b/libcomps/src/comps_mradix.c +index 338cb07..6ceb7c9 100644 +--- a/libcomps/src/comps_mradix.c ++++ b/libcomps/src/comps_mradix.c +@@ -177,7 +177,6 @@ void comps_mrtree_unite(COMPS_MRTree *rt1, COMPS_MRTree *rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +@@ -195,7 +194,6 @@ void comps_mrtree_unite(COMPS_MRTree *rt1, COMPS_MRTree *rt2) { + parent_pair = (struct Pair*) it->data; + free(it); + +- pair->added = 0; + for (it = tmp_subnodes->first; it != NULL; it=it->next) { + pair = malloc(sizeof(struct Pair)); + pair->subnodes = ((COMPS_MRTreeData*)it->data)->subnodes; +diff --git a/libcomps/src/comps_objmradix.c b/libcomps/src/comps_objmradix.c +index 9be6648..8771c89 100644 +--- a/libcomps/src/comps_objmradix.c ++++ b/libcomps/src/comps_objmradix.c +@@ -285,7 +285,6 @@ void comps_objmrtree_unite(COMPS_ObjMRTree *rt1, COMPS_ObjMRTree *rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +@@ -303,7 +302,6 @@ void comps_objmrtree_unite(COMPS_ObjMRTree *rt1, COMPS_ObjMRTree *rt2) { + parent_pair = (struct Pair*) it->data; + free(it); + +- pair->added = 0; + for (it = tmp_subnodes->first; it != NULL; it=it->next) { + pair = malloc(sizeof(struct Pair)); + pair->subnodes = ((COMPS_ObjMRTreeData*)it->data)->subnodes; +diff --git a/libcomps/src/comps_objradix.c b/libcomps/src/comps_objradix.c +index a790270..0ebaf22 100644 +--- a/libcomps/src/comps_objradix.c ++++ b/libcomps/src/comps_objradix.c +@@ -692,7 +692,6 @@ void comps_objrtree_unite(COMPS_ObjRTree *rt1, COMPS_ObjRTree *rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +@@ -711,7 +710,6 @@ void comps_objrtree_unite(COMPS_ObjRTree *rt1, COMPS_ObjRTree *rt2) { + //printf("key-part:%s\n", parent_pair->key); + free(it); + +- //pair->added = 0; + for (it = tmp_subnodes->first; it != NULL; it=it->next) { + pair = malloc(sizeof(struct Pair)); + pair->subnodes = ((COMPS_ObjRTreeData*)it->data)->subnodes; +diff --git a/libcomps/src/comps_radix.c b/libcomps/src/comps_radix.c +index ada4fda..05dcaf2 100644 +--- a/libcomps/src/comps_radix.c ++++ b/libcomps/src/comps_radix.c +@@ -529,7 +529,6 @@ void comps_rtree_unite(COMPS_RTree *rt1, COMPS_RTree *rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +-- +2.22.0 + diff --git a/meta/recipes-devtools/libcomps/libcomps_git.bb b/meta/recipes-devtools/libcomps/libcomps_git.bb index e69bf67729..b657f3377c 100644 --- a/meta/recipes-devtools/libcomps/libcomps_git.bb +++ b/meta/recipes-devtools/libcomps/libcomps_git.bb @@ -6,6 +6,7 @@ SRC_URI = "git://github.com/rpm-software-management/libcomps.git \ file://0001-Do-not-set-PYTHON_INSTALL_DIR-by-running-python.patch \ file://0002-Set-library-installation-path-correctly.patch \ file://0001-Make-__comps_objmrtree_all-static-inline.patch \ + file://CVE-2019-3817.patch \ " PV = "0.1.8+git${SRCPV}" diff --git a/meta/recipes-devtools/opkg/opkg/0001-libopkg-add-add-ignore-recommends-option.patch b/meta/recipes-devtools/opkg/opkg/0001-libopkg-add-add-ignore-recommends-option.patch new file mode 100644 index 0000000000..11954e9032 --- /dev/null +++ b/meta/recipes-devtools/opkg/opkg/0001-libopkg-add-add-ignore-recommends-option.patch @@ -0,0 +1,260 @@ +From 2eca28b6a37be92e4e835c51872c7df34ec6dedd Mon Sep 17 00:00:00 2001 +From: Quentin Schulz <quentin.schulz@streamunlimited.com> +Date: Fri, 31 May 2019 17:30:40 +0200 +Subject: [PATCH] [PATCH] libopkg: add --add-ignore-recommends option + +Add option to ignore specific recommended packages. On the libsolv +backed, this feature will only work on libsolv version > 0.7.2 [1]. + +[1] https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_openSUSE_libsolv_issues_254&d=DwIBaQ&c=I_0YwoKy7z5LMTVdyO6YCiE2uzI1jjZZuIPelcSjixA&r=wNcrL2akRn6jfxhHaKavUrJB_C9JAMXtynjLd8ZzgXQ&m=GObNHzFJpWpf_PripIrf-K2RhsktYdAUEieAJexXOKw&s=3G-meChUqClFggFPqsrAxIZBfLnRKIHm62Uuy1X6nQQ&e= + +Signed-off-by: Alejandro del Castillo <alejandro.delcastillo@ni.com> +Signed-off-by: Quentin Schulz <quentin.schulz@streamunlimited.com> + +Upstream-Status: Backport +--- + libopkg/opkg_conf.c | 2 + + libopkg/opkg_conf.h | 1 + + .../solvers/internal/pkg_depends_internal.c | 3 +- + libopkg/solvers/libsolv/opkg_solver_libsolv.c | 21 ++++++- + man/opkg.1.in | 3 + + src/opkg.c | 6 ++ + tests/Makefile | 1 + + tests/core/43_add_ignore_recommends.py | 62 +++++++++++++++++++ + 8 files changed, 97 insertions(+), 2 deletions(-) + create mode 100644 tests/core/43_add_ignore_recommends.py + +diff --git a/libopkg/opkg_conf.c b/libopkg/opkg_conf.c +index 06880a1..f2330cd 100644 +--- a/libopkg/opkg_conf.c ++++ b/libopkg/opkg_conf.c +@@ -597,6 +597,7 @@ int opkg_conf_init(void) + pkg_dest_list_init(&opkg_config->tmp_dest_list); + nv_pair_list_init(&opkg_config->arch_list); + str_list_init(&opkg_config->exclude_list); ++ str_list_init(&opkg_config->ignore_recommends_list); + + return 0; + } +@@ -938,6 +939,7 @@ void opkg_conf_deinit(void) + pkg_dest_list_deinit(&opkg_config->pkg_dest_list); + nv_pair_list_deinit(&opkg_config->arch_list); + str_list_deinit(&opkg_config->exclude_list); ++ str_list_deinit(&opkg_config->ignore_recommends_list); + + if (opkg_config->verbosity >= DEBUG) { + hash_print_stats(&opkg_config->pkg_hash); +diff --git a/libopkg/opkg_conf.h b/libopkg/opkg_conf.h +index dc11516..fc42de3 100644 +--- a/libopkg/opkg_conf.h ++++ b/libopkg/opkg_conf.h +@@ -61,6 +61,7 @@ typedef struct opkg_conf { + pkg_dest_list_t tmp_dest_list; + nv_pair_list_t arch_list; + str_list_t exclude_list; ++ str_list_t ignore_recommends_list; + + int restrict_to_default_dest; + pkg_dest_t *default_dest; +diff --git a/libopkg/solvers/internal/pkg_depends_internal.c b/libopkg/solvers/internal/pkg_depends_internal.c +index cd56d84..5deee70 100644 +--- a/libopkg/solvers/internal/pkg_depends_internal.c ++++ b/libopkg/solvers/internal/pkg_depends_internal.c +@@ -228,7 +228,8 @@ int pkg_hash_fetch_unsatisfied_dependencies(pkg_t *pkg, + || compound_depend->type == SUGGEST) + && (satisfying_pkg->state_want == SW_DEINSTALL + || satisfying_pkg->state_want == SW_PURGE +- || opkg_config->no_install_recommends); ++ || opkg_config->no_install_recommends ++ || str_list_contains(&opkg_config->ignore_recommends_list, satisfying_pkg->name)); + if (ignore) { + opkg_msg(NOTICE, + "%s: ignoring recommendation for " +diff --git a/libopkg/solvers/libsolv/opkg_solver_libsolv.c b/libopkg/solvers/libsolv/opkg_solver_libsolv.c +index bf0b72c..ea00a37 100644 +--- a/libopkg/solvers/libsolv/opkg_solver_libsolv.c ++++ b/libopkg/solvers/libsolv/opkg_solver_libsolv.c +@@ -484,6 +484,7 @@ static void pkg2solvable(pkg_t *pkg, Solvable *solvable_out) + static void populate_installed_repo(libsolv_solver_t *libsolv_solver) + { + int i; ++ Id what; + + pkg_vec_t *installed_pkgs = pkg_vec_alloc(); + +@@ -507,6 +508,15 @@ static void populate_installed_repo(libsolv_solver_t *libsolv_solver) + /* set solvable attributes */ + pkg2solvable(pkg, solvable); + ++ /* if the package is in ignore-recommends-list, disfavor installation */ ++ if (str_list_contains(&opkg_config->ignore_recommends_list, pkg->name)) { ++ opkg_message(NOTICE, "Disfavor package: %s\n", ++ pkg->name); ++ what = pool_str2id(libsolv_solver->pool, pkg->name, 1); ++ queue_push2(&libsolv_solver->solver_jobs, SOLVER_SOLVABLE_NAME ++ | SOLVER_DISFAVOR, what); ++ } ++ + /* if the package is not autoinstalled, mark it as user installed */ + if (!pkg->auto_installed) + queue_push2(&libsolv_solver->solver_jobs, SOLVER_SOLVABLE +@@ -533,7 +543,7 @@ static void populate_available_repos(libsolv_solver_t *libsolv_solver) + { + int i; + Solvable *solvable; +- Id solvable_id; ++ Id solvable_id, what; + + pkg_vec_t *available_pkgs = pkg_vec_alloc(); + +@@ -602,6 +612,15 @@ static void populate_available_repos(libsolv_solver_t *libsolv_solver) + solvable = pool_id2solvable(libsolv_solver->pool, solvable_id); + pkg2solvable(pkg, solvable); + ++ /* if the package is in ignore-recommends-list, disfavor installation */ ++ if (str_list_contains(&opkg_config->ignore_recommends_list, pkg->name)) { ++ opkg_message(NOTICE, "Disfavor package: %s\n", ++ pkg->name); ++ what = pool_str2id(libsolv_solver->pool, pkg->name, 1); ++ queue_push2(&libsolv_solver->solver_jobs, SOLVER_SOLVABLE_NAME ++ | SOLVER_DISFAVOR, what); ++ } ++ + /* if the --force-depends option is specified make dependencies weak */ + if (opkg_config->force_depends) + queue_push2(&libsolv_solver->solver_jobs, SOLVER_SOLVABLE +diff --git a/man/opkg.1.in b/man/opkg.1.in +index 026fb15..c0d4bf3 100644 +--- a/man/opkg.1.in ++++ b/man/opkg.1.in +@@ -143,6 +143,9 @@ conjunction with \fB\--dest\fP + \fB\--add-arch <\fIarch\fP>:<\fIprio\fP>\fR + Register the package architecture \fIarch\fP with the numeric + priority \fIprio\fP. Lower priorities take precedence. ++.TP ++\fB\--add-ignore-recommends <\fIname\fP>\fR ++Register package to be ignored as a recomendee + .SS FORCE OPTIONS + .TP + \fB\--force-depends \fR +diff --git a/src/opkg.c b/src/opkg.c +index f23467d..5181065 100644 +--- a/src/opkg.c ++++ b/src/opkg.c +@@ -51,6 +51,7 @@ enum { + ARGS_OPT_ADD_DEST, + ARGS_OPT_SIZE, + ARGS_OPT_ADD_EXCLUDE, ++ ARGS_OPT_ADD_IGNORE_RECOMMENDS, + ARGS_OPT_NOACTION, + ARGS_OPT_DOWNLOAD_ONLY, + ARGS_OPT_NODEPS, +@@ -110,6 +111,7 @@ static struct option long_options[] = { + {"add-dest", 1, 0, ARGS_OPT_ADD_DEST}, + {"size", 0, 0, ARGS_OPT_SIZE}, + {"add-exclude", 1, 0, ARGS_OPT_ADD_EXCLUDE}, ++ {"add-ignore-recommends", 1, 0, ARGS_OPT_ADD_IGNORE_RECOMMENDS}, + {"test", 0, 0, ARGS_OPT_NOACTION}, + {"tmp-dir", 1, 0, 't'}, + {"tmp_dir", 1, 0, 't'}, +@@ -235,6 +237,9 @@ static int args_parse(int argc, char *argv[]) + case ARGS_OPT_ADD_EXCLUDE: + str_list_append(&opkg_config->exclude_list, optarg); + break; ++ case ARGS_OPT_ADD_IGNORE_RECOMMENDS: ++ str_list_append(&opkg_config->ignore_recommends_list, optarg); ++ break; + case ARGS_OPT_SIZE: + opkg_config->size = 1; + break; +@@ -335,6 +340,7 @@ static void usage() + printf("\t--add-arch <arch>:<prio> Register architecture with given priority\n"); + printf("\t--add-dest <name>:<path> Register destination with given path\n"); + printf("\t--add-exclude <name> Register package to be excluded from install\n"); ++ printf("\t--add-ignore-recommends <name> Register package to be ignored as a recomendee\n"); + printf("\t--prefer-arch-to-version Use the architecture priority package rather\n"); + printf("\t than the higher version one if more\n"); + printf("\t than one candidate is found.\n"); +diff --git a/tests/Makefile b/tests/Makefile +index 148c844..ddf027f 100644 +--- a/tests/Makefile ++++ b/tests/Makefile +@@ -38,6 +38,7 @@ REGRESSION_TESTS := core/01_install.py \ + core/37_globs.py \ + core/38_install_constrained_version.py \ + core/39_distupgrade.py \ ++ core/43_add_ignore_recommends.py \ + regress/issue26.py \ + regress/issue31.py \ + regress/issue32.py \ +diff --git a/tests/core/43_add_ignore_recommends.py b/tests/core/43_add_ignore_recommends.py +new file mode 100644 +index 0000000..7da0096 +--- /dev/null ++++ b/tests/core/43_add_ignore_recommends.py +@@ -0,0 +1,62 @@ ++#! /usr/bin/env python3 ++# ++# Create package 'a' (1.0) which Recommends 'c'. ++# Install 'a' with --add-ignore-recommends 'c'. ++# Check that only 'a' (1.0) is installed. ++# Create package 'b' which Depends on 'c'. ++# Install 'a' & 'b', with --add-ignore-recommends 'c'. ++# Verify that 'a','b' & 'c' are installed. ++# Uninstall 'b' & 'c'. ++# Create package 'a' (2.0), which Recommends 'c'. ++# Upgrade 'a' with --add-ignore-recommends 'c' ++# Verify that only 'a' (2.0) is installed ++# ++ ++import os ++import opk, cfg, opkgcl ++ ++opk.regress_init() ++o = opk.OpkGroup() ++ ++o.add(Package='a', Recommends='c', Version='1.0') ++o.add(Package='b', Depends='c') ++o.add(Package='c') ++o.write_opk() ++o.write_list() ++ ++opkgcl.update() ++ ++opkgcl.install('a', '--add-ignore-recommends c') ++ ++if not opkgcl.is_installed('a'): ++ opk.fail("Package 'a' installed but reports as not installed.") ++ ++if opkgcl.is_installed('c'): ++ opk.xfail("[libsolv<0.7.3] Package 'c' should not have been installed since it was in --add-ignore-recommends.") ++ ++opkgcl.remove('a') ++opkgcl.install('a b', '--add-ignore-recommends c') ++ ++if not opkgcl.is_installed('a'): ++ opk.fail("Package 'a' installed but reports as not installed.") ++ ++if not opkgcl.is_installed('b'): ++ opk.fail("Package 'b' installed but reports as not installed.") ++ ++if not opkgcl.is_installed('c'): ++ opk.fail("Package 'c' should have been installed since 'b' depends on it.") ++ ++opkgcl.remove('b c', '--force-depends') ++o.add(Package='a', Recommends='c', Version='2.0') ++o.write_opk() ++o.write_list() ++ ++opkgcl.update() ++ ++opkgcl.upgrade('a', '--add-ignore-recommends c') ++ ++if not opkgcl.is_installed('a', '2.0'): ++ opk.fail("Package 'a (2.0)' installed but reports as not installed.") ++ ++if opkgcl.is_installed('c'): ++ opk.fail("Package 'c' should not have been installed since it was in --add-ignore-recommends.") +-- +2.17.1 + diff --git a/meta/recipes-devtools/opkg/opkg_0.3.6.bb b/meta/recipes-devtools/opkg/opkg_0.3.6.bb index 6ebd58b967..b26d30b571 100644 --- a/meta/recipes-devtools/opkg/opkg_0.3.6.bb +++ b/meta/recipes-devtools/opkg/opkg_0.3.6.bb @@ -15,6 +15,7 @@ SRC_URI = "http://downloads.yoctoproject.org/releases/${BPN}/${BPN}-${PV}.tar.gz file://opkg.conf \ file://0001-opkg_conf-create-opkg.lock-in-run-instead-of-var-run.patch \ file://0001-remove_maintainer_scripts-use-strict-matching.patch \ + file://0001-libopkg-add-add-ignore-recommends-option.patch \ " SRC_URI[md5sum] = "79e04307f6f54db431c251772d7d987c" diff --git a/meta/recipes-devtools/patch/patch/0001-Don-t-leak-temporary-file-on-failed-ed-style-patch.patch b/meta/recipes-devtools/patch/patch/0001-Don-t-leak-temporary-file-on-failed-ed-style-patch.patch new file mode 100644 index 0000000000..9891526e4e --- /dev/null +++ b/meta/recipes-devtools/patch/patch/0001-Don-t-leak-temporary-file-on-failed-ed-style-patch.patch @@ -0,0 +1,93 @@ +From 7f770b9c20da1a192dad8cb572a6391f2773285a Mon Sep 17 00:00:00 2001 +From: Jean Delvare <jdelvare@suse.de> +Date: Thu, 3 May 2018 14:31:55 +0200 +Subject: [PATCH 1/2] Don't leak temporary file on failed ed-style patch + +Now that we write ed-style patches to a temporary file before we +apply them, we need to ensure that the temporary file is removed +before we leave, even on fatal error. + +* src/pch.c (do_ed_script): Use global TMPEDNAME instead of local + tmpname. Don't unlink the file directly, instead tag it for removal + at exit time. +* src/patch.c (cleanup): Unlink TMPEDNAME at exit. + +This closes bug #53820: +https://savannah.gnu.org/bugs/index.php?53820 + +Fixes: 123eaff0d5d1 ("Fix arbitrary command execution in ed-style patches (CVE-2018-1000156)") + +Upstream-Status: Backport [http://git.savannah.gnu.org/cgit/patch.git/commit/?id=19599883ffb6a450d2884f081f8ecf68edbed7ee] +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- + src/common.h | 2 ++ + src/pch.c | 12 +++++------- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/src/common.h b/src/common.h +index ec50b40..22238b5 100644 +--- a/src/common.h ++++ b/src/common.h +@@ -94,10 +94,12 @@ XTERN char const *origsuff; + XTERN char const * TMPINNAME; + XTERN char const * TMPOUTNAME; + XTERN char const * TMPPATNAME; ++XTERN char const * TMPEDNAME; + + XTERN bool TMPINNAME_needs_removal; + XTERN bool TMPOUTNAME_needs_removal; + XTERN bool TMPPATNAME_needs_removal; ++XTERN bool TMPEDNAME_needs_removal; + + #ifdef DEBUGGING + XTERN int debug; +diff --git a/src/pch.c b/src/pch.c +index 16e001a..c1a62cf 100644 +--- a/src/pch.c ++++ b/src/pch.c +@@ -2392,7 +2392,6 @@ do_ed_script (char const *inname, char const *outname, + file_offset beginning_of_this_line; + size_t chars_read; + FILE *tmpfp = 0; +- char const *tmpname; + int tmpfd; + pid_t pid; + +@@ -2404,12 +2403,13 @@ do_ed_script (char const *inname, char const *outname, + invalid commands and treats the next line as a new command, which + can lead to arbitrary command execution. */ + +- tmpfd = make_tempfile (&tmpname, 'e', NULL, O_RDWR | O_BINARY, 0); ++ tmpfd = make_tempfile (&TMPEDNAME, 'e', NULL, O_RDWR | O_BINARY, 0); + if (tmpfd == -1) +- pfatal ("Can't create temporary file %s", quotearg (tmpname)); ++ pfatal ("Can't create temporary file %s", quotearg (TMPEDNAME)); ++ TMPEDNAME_needs_removal = true; + tmpfp = fdopen (tmpfd, "w+b"); + if (! tmpfp) +- pfatal ("Can't open stream for file %s", quotearg (tmpname)); ++ pfatal ("Can't open stream for file %s", quotearg (TMPEDNAME)); + } + + for (;;) { +@@ -2449,8 +2449,7 @@ do_ed_script (char const *inname, char const *outname, + write_fatal (); + + if (lseek (tmpfd, 0, SEEK_SET) == -1) +- pfatal ("Can't rewind to the beginning of file %s", quotearg (tmpname)); +- ++ pfatal ("Can't rewind to the beginning of file %s", quotearg (TMPEDNAME)); + if (! dry_run && ! skip_rest_of_patch) { + int exclusive = *outname_needs_removal ? 0 : O_EXCL; + *outname_needs_removal = true; +@@ -2482,7 +2481,6 @@ do_ed_script (char const *inname, char const *outname, + } + + fclose (tmpfp); +- safe_unlink (tmpname); + + if (ofp) + { +-- +2.17.0 + diff --git a/meta/recipes-devtools/patch/patch/0001-Don-t-leak-temporary-file-on-failed-multi-file-ed.patch b/meta/recipes-devtools/patch/patch/0001-Don-t-leak-temporary-file-on-failed-multi-file-ed.patch new file mode 100644 index 0000000000..d6a219a1b1 --- /dev/null +++ b/meta/recipes-devtools/patch/patch/0001-Don-t-leak-temporary-file-on-failed-multi-file-ed.patch @@ -0,0 +1,80 @@ +From 369dcccdfa6336e5a873d6d63705cfbe04c55727 Mon Sep 17 00:00:00 2001 +From: Jean Delvare <jdelvare@suse.de> +Date: Mon, 7 May 2018 15:14:45 +0200 +Subject: Don't leak temporary file on failed multi-file ed-style patch + +The previous fix worked fine with single-file ed-style patches, but +would still leak temporary files in the case of multi-file ed-style +patch. Fix that case as well, and extend the test case to check for +it. + +* src/patch.c (main): Unlink TMPEDNAME if needed before moving to + the next file in a patch. + +This closes bug #53820: +https://savannah.gnu.org/bugs/index.php?53820 + +Fixes: 123eaff0d5d1 ("Fix arbitrary command execution in ed-style patches (CVE-2018-1000156)") +Fixes: 19599883ffb6 ("Don't leak temporary file on failed ed-style patch") + +Upstream-Status: Backport [http://git.savannah.gnu.org/cgit/patch.git/commit/?id=369dcccdfa6336e5a873d6d63705cfbe04c55727] +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- + src/patch.c | 1 + + tests/ed-style | 31 +++++++++++++++++++++++++++++++ + 2 files changed, 32 insertions(+) + +diff --git a/src/patch.c b/src/patch.c +index 9146597..81c7a02 100644 +--- a/src/patch.c ++++ b/src/patch.c +@@ -236,6 +236,7 @@ main (int argc, char **argv) + } + remove_if_needed (TMPOUTNAME, &TMPOUTNAME_needs_removal); + } ++ remove_if_needed (TMPEDNAME, &TMPEDNAME_needs_removal); + + if (! skip_rest_of_patch && ! file_type) + { +diff --git a/tests/ed-style b/tests/ed-style +index 6b6ef9d..504e6e5 100644 +--- a/tests/ed-style ++++ b/tests/ed-style +@@ -38,3 +38,34 @@ EOF + check 'cat foo' <<EOF + foo + EOF ++ ++# Test the case where one ed-style patch modifies several files ++ ++cat > ed3.diff <<EOF ++--- foo +++++ foo ++1c ++bar ++. ++--- baz +++++ baz ++0a ++baz ++. ++EOF ++ ++# Apparently we can't create a file with such a patch, while it works fine ++# when the file name is provided on the command line ++cat > baz <<EOF ++EOF ++ ++check 'patch -e -i ed3.diff' <<EOF ++EOF ++ ++check 'cat foo' <<EOF ++bar ++EOF ++ ++check 'cat baz' <<EOF ++baz ++EOF +-- +cgit v1.0-41-gc330 + diff --git a/meta/recipes-devtools/patch/patch/0001-Invoke-ed-directly-instead-of-using-the-shell.patch b/meta/recipes-devtools/patch/patch/0001-Invoke-ed-directly-instead-of-using-the-shell.patch new file mode 100644 index 0000000000..f60dfe879a --- /dev/null +++ b/meta/recipes-devtools/patch/patch/0001-Invoke-ed-directly-instead-of-using-the-shell.patch @@ -0,0 +1,44 @@ +From 3fcd042d26d70856e826a42b5f93dc4854d80bf0 Mon Sep 17 00:00:00 2001 +From: Andreas Gruenbacher <agruen@gnu.org> +Date: Fri, 6 Apr 2018 19:36:15 +0200 +Subject: [PATCH] Invoke ed directly instead of using the shell + +* src/pch.c (do_ed_script): Invoke ed directly instead of using a shell +command to avoid quoting vulnerabilities. + +CVE: CVE-2019-13638 +Upstream-Status: Backport[https://git.savannah.gnu.org/cgit/patch.git/patch/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0] +Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> + +--- + src/pch.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + + +diff --git a/src/pch.c b/src/pch.c +index 4fd5a05..16e001a 100644 +--- a/src/pch.c ++++ b/src/pch.c +@@ -2459,9 +2459,6 @@ do_ed_script (char const *inname, char const *outname, + *outname_needs_removal = true; + copy_file (inname, outname, 0, exclusive, instat.st_mode, true); + } +- sprintf (buf, "%s %s%s", editor_program, +- verbosity == VERBOSE ? "" : "- ", +- outname); + fflush (stdout); + + pid = fork(); +@@ -2470,7 +2467,8 @@ do_ed_script (char const *inname, char const *outname, + else if (pid == 0) + { + dup2 (tmpfd, 0); +- execl ("/bin/sh", "sh", "-c", buf, (char *) 0); ++ assert (outname[0] != '!' && outname[0] != '-'); ++ execlp (editor_program, editor_program, "-", outname, (char *) NULL); + _exit (2); + } + else +-- +2.7.4 + diff --git a/meta/recipes-devtools/patch/patch/CVE-2019-13636.patch b/meta/recipes-devtools/patch/patch/CVE-2019-13636.patch new file mode 100644 index 0000000000..9f8b6db0b9 --- /dev/null +++ b/meta/recipes-devtools/patch/patch/CVE-2019-13636.patch @@ -0,0 +1,113 @@ +From dce4683cbbe107a95f1f0d45fabc304acfb5d71a Mon Sep 17 00:00:00 2001 +From: Andreas Gruenbacher <agruen@gnu.org> +Date: Mon, 15 Jul 2019 16:21:48 +0200 +Subject: Don't follow symlinks unless --follow-symlinks is given + +* src/inp.c (plan_a, plan_b), src/util.c (copy_to_fd, copy_file, +append_to_file): Unless the --follow-symlinks option is given, open files with +the O_NOFOLLOW flag to avoid following symlinks. So far, we were only doing +that consistently for input files. +* src/util.c (create_backup): When creating empty backup files, (re)create them +with O_CREAT | O_EXCL to avoid following symlinks in that case as well. + +CVE: CVE-2019-13636 +Upstream-Status: Backport[https://git.savannah.gnu.org/cgit/patch.git/patch/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a] +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> + +--- + src/inp.c | 12 ++++++++++-- + src/util.c | 14 +++++++++++--- + 2 files changed, 21 insertions(+), 5 deletions(-) + +diff --git a/src/inp.c b/src/inp.c +index 32d0919..22d7473 100644 +--- a/src/inp.c ++++ b/src/inp.c +@@ -238,8 +238,13 @@ plan_a (char const *filename) + { + if (S_ISREG (instat.st_mode)) + { +- int ifd = safe_open (filename, O_RDONLY|binary_transput, 0); ++ int flags = O_RDONLY | binary_transput; + size_t buffered = 0, n; ++ int ifd; ++ ++ if (! follow_symlinks) ++ flags |= O_NOFOLLOW; ++ ifd = safe_open (filename, flags, 0); + if (ifd < 0) + pfatal ("can't open file %s", quotearg (filename)); + +@@ -340,6 +345,7 @@ plan_a (char const *filename) + static void + plan_b (char const *filename) + { ++ int flags = O_RDONLY | binary_transput; + int ifd; + FILE *ifp; + int c; +@@ -353,7 +359,9 @@ plan_b (char const *filename) + + if (instat.st_size == 0) + filename = NULL_DEVICE; +- if ((ifd = safe_open (filename, O_RDONLY | binary_transput, 0)) < 0 ++ if (! follow_symlinks) ++ flags |= O_NOFOLLOW; ++ if ((ifd = safe_open (filename, flags, 0)) < 0 + || ! (ifp = fdopen (ifd, binary_transput ? "rb" : "r"))) + pfatal ("Can't open file %s", quotearg (filename)); + if (TMPINNAME_needs_removal) +diff --git a/src/util.c b/src/util.c +index 1cc08ba..fb38307 100644 +--- a/src/util.c ++++ b/src/util.c +@@ -388,7 +388,7 @@ create_backup (char const *to, const struct stat *to_st, bool leave_original) + + try_makedirs_errno = ENOENT; + safe_unlink (bakname); +- while ((fd = safe_open (bakname, O_CREAT | O_WRONLY | O_TRUNC, 0666)) < 0) ++ while ((fd = safe_open (bakname, O_CREAT | O_EXCL | O_WRONLY | O_TRUNC, 0666)) < 0) + { + if (errno != try_makedirs_errno) + pfatal ("Can't create file %s", quotearg (bakname)); +@@ -579,10 +579,13 @@ create_file (char const *file, int open_flags, mode_t mode, + static void + copy_to_fd (const char *from, int tofd) + { ++ int from_flags = O_RDONLY | O_BINARY; + int fromfd; + ssize_t i; + +- if ((fromfd = safe_open (from, O_RDONLY | O_BINARY, 0)) < 0) ++ if (! follow_symlinks) ++ from_flags |= O_NOFOLLOW; ++ if ((fromfd = safe_open (from, from_flags, 0)) < 0) + pfatal ("Can't reopen file %s", quotearg (from)); + while ((i = read (fromfd, buf, bufsize)) != 0) + { +@@ -625,6 +628,8 @@ copy_file (char const *from, char const *to, struct stat *tost, + else + { + assert (S_ISREG (mode)); ++ if (! follow_symlinks) ++ to_flags |= O_NOFOLLOW; + tofd = create_file (to, O_WRONLY | O_BINARY | to_flags, mode, + to_dir_known_to_exist); + copy_to_fd (from, tofd); +@@ -640,9 +645,12 @@ copy_file (char const *from, char const *to, struct stat *tost, + void + append_to_file (char const *from, char const *to) + { ++ int to_flags = O_WRONLY | O_APPEND | O_BINARY; + int tofd; + +- if ((tofd = safe_open (to, O_WRONLY | O_BINARY | O_APPEND, 0)) < 0) ++ if (! follow_symlinks) ++ to_flags |= O_NOFOLLOW; ++ if ((tofd = safe_open (to, to_flags, 0)) < 0) + pfatal ("Can't reopen file %s", quotearg (to)); + copy_to_fd (from, tofd); + if (close (tofd) != 0) +-- +cgit v1.0-41-gc330 + diff --git a/meta/recipes-devtools/patch/patch_2.7.6.bb b/meta/recipes-devtools/patch/patch_2.7.6.bb index 85b0db7333..5d7f55f8dc 100644 --- a/meta/recipes-devtools/patch/patch_2.7.6.bb +++ b/meta/recipes-devtools/patch/patch_2.7.6.bb @@ -6,6 +6,10 @@ SRC_URI += "file://0001-Unset-need_charset_alias-when-building-for-musl.patch \ file://0003-Allow-input-files-to-be-missing-for-ed-style-patches.patch \ file://0004-Fix-arbitrary-command-execution-in-ed-style-patches-.patch \ file://0001-Fix-swapping-fake-lines-in-pch_swap.patch \ + file://CVE-2019-13636.patch \ + file://0001-Invoke-ed-directly-instead-of-using-the-shell.patch \ + file://0001-Don-t-leak-temporary-file-on-failed-ed-style-patch.patch \ + file://0001-Don-t-leak-temporary-file-on-failed-multi-file-ed.patch \ " SRC_URI[md5sum] = "4c68cee989d83c87b00a3860bcd05600" diff --git a/meta/recipes-devtools/perl/perl/CVE-2018-18311.patch b/meta/recipes-devtools/perl/perl/CVE-2018-18311.patch new file mode 100644 index 0000000000..ba8cf151fd --- /dev/null +++ b/meta/recipes-devtools/perl/perl/CVE-2018-18311.patch @@ -0,0 +1,183 @@ +From 4706b65d7c835c0bb219db160fbcdbcd98efab2d Mon Sep 17 00:00:00 2001 +From: David Mitchell <davem@iabyn.com> +Date: Fri, 29 Jun 2018 13:37:03 +0100 +Subject: [PATCH] Perl_my_setenv(); handle integer wrap + +RT #133204 + +Wean this function off int/I32 and onto UV/Size_t. +Also, replace all malloc-ish calls with a wrapper that does +overflow checks, + +In particular, it was doing (nlen + vlen + 2) which could wrap when +the combined length of the environment variable name and value +exceeded around 0x7fffffff. + +The wrapper check function is probably overkill, but belt and braces... + +NB this function has several variant parts, #ifdef'ed by platform +type; I have blindly changed the parts that aren't compiled under linux. + +(cherry picked from commit 34716e2a6ee2af96078d62b065b7785c001194be) + +CVE: CVE-2018-18311 +Upstream-Status: Backport +[https://perl5.git.perl.org/perl.git/commit/5737d31aac51360cc1eb412ef059e36147c9d6d6] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + util.c | 76 ++++++++++++++++++++++++++++++++++++++++------------------ + 1 file changed, 53 insertions(+), 23 deletions(-) + +diff --git a/util.c b/util.c +index 7c3d271f51..27f4eddf3b 100644 +--- a/util.c ++++ b/util.c +@@ -2160,8 +2160,40 @@ Perl_new_warnings_bitfield(pTHX_ STRLEN *buffer, const char *const bits, + *(s+(nlen+1+vlen)) = '\0' + + #ifdef USE_ENVIRON_ARRAY +- /* VMS' my_setenv() is in vms.c */ ++ ++/* small wrapper for use by Perl_my_setenv that mallocs, or reallocs if ++ * 'current' is non-null, with up to three sizes that are added together. ++ * It handles integer overflow. ++ */ ++static char * ++S_env_alloc(void *current, Size_t l1, Size_t l2, Size_t l3, Size_t size) ++{ ++ void *p; ++ Size_t sl, l = l1 + l2; ++ ++ if (l < l2) ++ goto panic; ++ l += l3; ++ if (l < l3) ++ goto panic; ++ sl = l * size; ++ if (sl < l) ++ goto panic; ++ ++ p = current ++ ? safesysrealloc(current, sl) ++ : safesysmalloc(sl); ++ if (p) ++ return (char*)p; ++ ++ panic: ++ croak_memory_wrap(); ++} ++ ++ ++/* VMS' my_setenv() is in vms.c */ + #if !defined(WIN32) && !defined(NETWARE) ++ + void + Perl_my_setenv(pTHX_ const char *nam, const char *val) + { +@@ -2177,28 +2209,27 @@ Perl_my_setenv(pTHX_ const char *nam, const char *val) + #ifndef PERL_USE_SAFE_PUTENV + if (!PL_use_safe_putenv) { + /* most putenv()s leak, so we manipulate environ directly */ +- I32 i; +- const I32 len = strlen(nam); +- int nlen, vlen; ++ UV i; ++ Size_t vlen, nlen = strlen(nam); + + /* where does it go? */ + for (i = 0; environ[i]; i++) { +- if (strnEQ(environ[i],nam,len) && environ[i][len] == '=') ++ if (strnEQ(environ[i], nam, nlen) && environ[i][nlen] == '=') + break; + } + + if (environ == PL_origenviron) { /* need we copy environment? */ +- I32 j; +- I32 max; ++ UV j, max; + char **tmpenv; + + max = i; + while (environ[max]) + max++; +- tmpenv = (char**)safesysmalloc((max+2) * sizeof(char*)); ++ /* XXX shouldn't that be max+1 rather than max+2 ??? - DAPM */ ++ tmpenv = (char**)S_env_alloc(NULL, max, 2, 0, sizeof(char*)); + for (j=0; j<max; j++) { /* copy environment */ +- const int len = strlen(environ[j]); +- tmpenv[j] = (char*)safesysmalloc((len+1)*sizeof(char)); ++ const Size_t len = strlen(environ[j]); ++ tmpenv[j] = S_env_alloc(NULL, len, 1, 0, 1); + Copy(environ[j], tmpenv[j], len+1, char); + } + tmpenv[max] = NULL; +@@ -2217,15 +2248,15 @@ Perl_my_setenv(pTHX_ const char *nam, const char *val) + #endif + } + if (!environ[i]) { /* does not exist yet */ +- environ = (char**)safesysrealloc(environ, (i+2) * sizeof(char*)); ++ environ = (char**)S_env_alloc(environ, i, 2, 0, sizeof(char*)); + environ[i+1] = NULL; /* make sure it's null terminated */ + } + else + safesysfree(environ[i]); +- nlen = strlen(nam); ++ + vlen = strlen(val); + +- environ[i] = (char*)safesysmalloc((nlen+vlen+2) * sizeof(char)); ++ environ[i] = S_env_alloc(NULL, nlen, vlen, 2, 1); + /* all that work just for this */ + my_setenv_format(environ[i], nam, nlen, val, vlen); + } else { +@@ -2250,22 +2281,21 @@ Perl_my_setenv(pTHX_ const char *nam, const char *val) + if (environ) /* old glibc can crash with null environ */ + (void)unsetenv(nam); + } else { +- const int nlen = strlen(nam); +- const int vlen = strlen(val); +- char * const new_env = +- (char*)safesysmalloc((nlen + vlen + 2) * sizeof(char)); ++ const Size_t nlen = strlen(nam); ++ const Size_t vlen = strlen(val); ++ char * const new_env = S_env_alloc(NULL, nlen, vlen, 2, 1); + my_setenv_format(new_env, nam, nlen, val, vlen); + (void)putenv(new_env); + } + # else /* ! HAS_UNSETENV */ + char *new_env; +- const int nlen = strlen(nam); +- int vlen; ++ const Size_t nlen = strlen(nam); ++ Size_t vlen; + if (!val) { + val = ""; + } + vlen = strlen(val); +- new_env = (char*)safesysmalloc((nlen + vlen + 2) * sizeof(char)); ++ new_env = S_env_alloc(NULL, nlen, vlen, 2, 1); + /* all that work just for this */ + my_setenv_format(new_env, nam, nlen, val, vlen); + (void)putenv(new_env); +@@ -2288,14 +2318,14 @@ Perl_my_setenv(pTHX_ const char *nam, const char *val) + { + dVAR; + char *envstr; +- const int nlen = strlen(nam); +- int vlen; ++ const Size_t nlen = strlen(nam); ++ Size_t vlen; + + if (!val) { + val = ""; + } + vlen = strlen(val); +- Newx(envstr, nlen+vlen+2, char); ++ envstr = S_env_alloc(NULL, nlen, vlen, 2, 1); + my_setenv_format(envstr, nam, nlen, val, vlen); + (void)PerlEnv_putenv(envstr); + Safefree(envstr); +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/perl/perl/CVE-2018-18312.patch b/meta/recipes-devtools/perl/perl/CVE-2018-18312.patch Binary files differnew file mode 100644 index 0000000000..1c3426542d --- /dev/null +++ b/meta/recipes-devtools/perl/perl/CVE-2018-18312.patch diff --git a/meta/recipes-devtools/perl/perl/CVE-2018-18313.patch b/meta/recipes-devtools/perl/perl/CVE-2018-18313.patch new file mode 100644 index 0000000000..540aa073fb --- /dev/null +++ b/meta/recipes-devtools/perl/perl/CVE-2018-18313.patch @@ -0,0 +1,60 @@ +From 3458f6115ca8e8d11779948c12b7e1cc5803358c Mon Sep 17 00:00:00 2001 +From: Karl Williamson <khw@cpan.org> +Date: Sat, 25 Mar 2017 15:00:22 -0600 +Subject: [PATCH 2/3] regcomp.c: Convert some strchr to memchr + +This allows things to work properly in the face of embedded NULs. +See the branch merge message for more information. + +(cherry picked from commit 43b2f4ef399e2fd7240b4eeb0658686ad95f8e62) + +CVE: CVE-2018-18313 +Upstream-Status: Backport +[https://perl5.git.perl.org/perl.git/commit/c1c28ce6ba90ee05aa96b11ad551a6063680f3b9] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + regcomp.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/regcomp.c b/regcomp.c +index 00d26d9290..2688979882 100644 +--- a/regcomp.c ++++ b/regcomp.c +@@ -11783,8 +11783,9 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pRExC_state, + + RExC_parse++; /* Skip past the '{' */ + +- if (! (endbrace = strchr(RExC_parse, '}')) /* no trailing brace */ +- || ! (endbrace == RExC_parse /* nothing between the {} */ ++ endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse); ++ if ((! endbrace) /* no trailing brace */ ++ || ! (endbrace == RExC_parse /* nothing between the {} */ + || (endbrace - RExC_parse >= 2 /* U+ (bad hex is checked... */ + && strnEQ(RExC_parse, "U+", 2)))) /* ... below for a better + error msg) */ +@@ -12483,9 +12484,11 @@ S_regatom(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth) + else { + STRLEN length; + char name = *RExC_parse; +- char * endbrace; ++ char * endbrace = NULL; + RExC_parse += 2; +- endbrace = strchr(RExC_parse, '}'); ++ if (RExC_parse < RExC_end) { ++ endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse); ++ } + + if (! endbrace) { + vFAIL2("Missing right brace on \\%c{}", name); +@@ -15939,7 +15942,7 @@ S_regclass(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth, + vFAIL2("Empty \\%c", (U8)value); + if (*RExC_parse == '{') { + const U8 c = (U8)value; +- e = strchr(RExC_parse, '}'); ++ e = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse); + if (!e) { + RExC_parse++; + vFAIL2("Missing right brace on \\%c{}", c); +-- +2.22.0.vfs.1.1.57.gbaf16c8 diff --git a/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch b/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch new file mode 100644 index 0000000000..e84e7bc4e4 --- /dev/null +++ b/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch @@ -0,0 +1,271 @@ +From 6a2d07f43ae7cfcb2eb30cf39751f2f7fed7ecc1 Mon Sep 17 00:00:00 2001 +From: Yves Orton <demerphq@gmail.com> +Date: Mon, 26 Jun 2017 13:19:55 +0200 +Subject: [PATCH 3/3] fix #131649 - extended charclass can trigger assert + +The extended charclass parser makes some assumptions during the +first pass which are only true on well structured input, and it +does not properly catch various errors. later on the code assumes +that things the first pass will let through are valid, when in +fact they should trigger errors. + +(cherry picked from commit 19a498a461d7c81ae3507c450953d1148efecf4f) + +CVE: CVE-2018-18314 +Upstream-Status: Backport +[https://perl5.git.perl.org/perl.git/commit/dabe076af345ab4512ea80245b4e4cd7ec0996cd] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + pod/perldiag.pod | 27 ++++++++++++++++++++++++++- + pod/perlrecharclass.pod | 4 ++-- + regcomp.c | 23 +++++++++++++---------- + t/lib/warnings/regcomp | 6 +++--- + t/re/reg_mesg.t | 29 ++++++++++++++++------------- + t/re/regex_sets.t | 6 +++--- + 6 files changed, 63 insertions(+), 32 deletions(-) + +diff --git a/pod/perldiag.pod b/pod/perldiag.pod +index 737d3633f6..644b814008 100644 +--- a/pod/perldiag.pod ++++ b/pod/perldiag.pod +@@ -5777,7 +5777,7 @@ yourself. + a perl4 interpreter, especially if the next 2 tokens are "use strict" + or "my $var" or "our $var". + +-=item Syntax error in (?[...]) in regex m/%s/ ++=item Syntax error in (?[...]) in regex; marked by <-- HERE in m/%s/ + + (F) Perl could not figure out what you meant inside this construct; this + notifies you that it is giving up trying. +@@ -6153,6 +6153,31 @@ for example, + (F) The unexec() routine failed for some reason. See your local FSF + representative, who probably put it there in the first place. + ++=item Unexpected ']' with no following ')' in (?[... in regex; marked by <-- HERE in m/%s/ ++ ++(F) While parsing an extended character class a ']' character was encountered ++at a point in the definition where the only legal use of ']' is to close the ++character class definition as part of a '])', you may have forgotten the close ++paren, or otherwise confused the parser. ++ ++=item Expecting close paren for nested extended charclass in regex; marked by <-- HERE in m/%s/ ++ ++(F) While parsing a nested extended character class like: ++ ++ (?[ ... (?flags:(?[ ... ])) ... ]) ++ ^ ++ ++we expected to see a close paren ')' (marked by ^) but did not. ++ ++=item Expecting close paren for wrapper for nested extended charclass in regex; marked by <-- HERE in m/%s/ ++ ++(F) While parsing a nested extended character class like: ++ ++ (?[ ... (?flags:(?[ ... ])) ... ]) ++ ^ ++ ++we expected to see a close paren ')' (marked by ^) but did not. ++ + =item Unexpected binary operator '%c' with no preceding operand in regex; + marked by S<<-- HERE> in m/%s/ + +diff --git a/pod/perlrecharclass.pod b/pod/perlrecharclass.pod +index 89f4a7ef3f..a557cc0384 100644 +--- a/pod/perlrecharclass.pod ++++ b/pod/perlrecharclass.pod +@@ -1101,8 +1101,8 @@ hence both of the following work: + Any contained POSIX character classes, including things like C<\w> and C<\D> + respect the C<E<sol>a> (and C<E<sol>aa>) modifiers. + +-C<< (?[ ]) >> is a regex-compile-time construct. Any attempt to use +-something which isn't knowable at the time the containing regular ++Note that C<< (?[ ]) >> is a regex-compile-time construct. Any attempt ++to use something which isn't knowable at the time the containing regular + expression is compiled is a fatal error. In practice, this means + just three limitations: + +diff --git a/regcomp.c b/regcomp.c +index 2688979882..cb8409ed27 100644 +--- a/regcomp.c ++++ b/regcomp.c +@@ -14609,8 +14609,9 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, + TRUE /* Force /x */ ); + + switch (*RExC_parse) { +- case '?': +- if (RExC_parse[1] == '[') depth++, RExC_parse++; ++ case '(': ++ if (RExC_parse[1] == '?' && RExC_parse[2] == '[') ++ depth++, RExC_parse+=2; + /* FALLTHROUGH */ + default: + break; +@@ -14667,9 +14668,9 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, + } + + case ']': +- if (depth--) break; +- RExC_parse++; +- if (*RExC_parse == ')') { ++ if (RExC_parse[1] == ')') { ++ RExC_parse++; ++ if (depth--) break; + node = reganode(pRExC_state, ANYOF, 0); + RExC_size += ANYOF_SKIP; + nextchar(pRExC_state); +@@ -14681,20 +14682,20 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, + + return node; + } +- goto no_close; ++ RExC_parse++; ++ vFAIL("Unexpected ']' with no following ')' in (?[..."); + } + + RExC_parse += UTF ? UTF8SKIP(RExC_parse) : 1; + } + +- no_close: + /* We output the messages even if warnings are off, because we'll fail + * the very next thing, and these give a likely diagnosis for that */ + if (posix_warnings && av_tindex_nomg(posix_warnings) >= 0) { + output_or_return_posix_warnings(pRExC_state, posix_warnings, NULL); + } + +- FAIL("Syntax error in (?[...])"); ++ vFAIL("Syntax error in (?[...])"); + } + + /* Pass 2 only after this. */ +@@ -14868,12 +14869,14 @@ redo_curchar: + * inversion list, and RExC_parse points to the trailing + * ']'; the next character should be the ')' */ + RExC_parse++; +- assert(UCHARAT(RExC_parse) == ')'); ++ if (UCHARAT(RExC_parse) != ')') ++ vFAIL("Expecting close paren for nested extended charclass"); + + /* Then the ')' matching the original '(' handled by this + * case: statement */ + RExC_parse++; +- assert(UCHARAT(RExC_parse) == ')'); ++ if (UCHARAT(RExC_parse) != ')') ++ vFAIL("Expecting close paren for wrapper for nested extended charclass"); + + RExC_flags = save_flags; + goto handle_operand; +diff --git a/t/lib/warnings/regcomp b/t/lib/warnings/regcomp +index 08cb27b00f..367276d0fc 100644 +--- a/t/lib/warnings/regcomp ++++ b/t/lib/warnings/regcomp +@@ -59,21 +59,21 @@ Unmatched [ in regex; marked by <-- HERE in m/abc[ <-- HERE fi[.00./ at - line + qr/(?[[[:word]]])/; + EXPECT + Assuming NOT a POSIX class since there is no terminating ':' in regex; marked by <-- HERE in m/(?[[[:word <-- HERE ]]])/ at - line 2. +-syntax error in (?[...]) in regex m/(?[[[:word]]])/ at - line 2. ++Unexpected ']' with no following ')' in (?[... in regex; marked by <-- HERE in m/(?[[[:word]] <-- HERE ])/ at - line 2. + ######## + # NAME qr/(?[ [[:digit: ])/ + # OPTION fatal + qr/(?[[[:digit: ])/; + EXPECT + Assuming NOT a POSIX class since no blanks are allowed in one in regex; marked by <-- HERE in m/(?[[[:digit: ] <-- HERE )/ at - line 2. +-syntax error in (?[...]) in regex m/(?[[[:digit: ])/ at - line 2. ++syntax error in (?[...]) in regex; marked by <-- HERE in m/(?[[[:digit: ]) <-- HERE / at - line 2. + ######## + # NAME qr/(?[ [:digit: ])/ + # OPTION fatal + qr/(?[[:digit: ])/ + EXPECT + Assuming NOT a POSIX class since no blanks are allowed in one in regex; marked by <-- HERE in m/(?[[:digit: ] <-- HERE )/ at - line 2. +-syntax error in (?[...]) in regex m/(?[[:digit: ])/ at - line 2. ++syntax error in (?[...]) in regex; marked by <-- HERE in m/(?[[:digit: ]) <-- HERE / at - line 2. + ######## + # NAME [perl #126141] + # OPTION fatal +diff --git a/t/re/reg_mesg.t b/t/re/reg_mesg.t +index 658397ac27..08a3688e1d 100644 +--- a/t/re/reg_mesg.t ++++ b/t/re/reg_mesg.t +@@ -202,8 +202,9 @@ my @death = + '/\b{gc}/' => "'gc' is an unknown bound type {#} m/\\b{gc{#}}/", + '/\B{gc}/' => "'gc' is an unknown bound type {#} m/\\B{gc{#}}/", + +- '/(?[[[::]]])/' => "Syntax error in (?[...]) in regex m/(?[[[::]]])/", +- '/(?[[[:w:]]])/' => "Syntax error in (?[...]) in regex m/(?[[[:w:]]])/", ++ ++ '/(?[[[::]]])/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[[[::]]{#}])/", ++ '/(?[[[:w:]]])/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[[[:w:]]{#}])/", + '/(?[[:w:]])/' => "", + '/[][[:alpha:]]' => "", # [perl #127581] + '/([.].*)[.]/' => "", # [perl #127582] +@@ -227,11 +228,12 @@ my @death = + '/(?[ \p{foo} ])/' => 'Can\'t find Unicode property definition "foo" {#} m/(?[ \p{foo}{#} ])/', + '/(?[ \p{ foo = bar } ])/' => 'Can\'t find Unicode property definition "foo = bar" {#} m/(?[ \p{ foo = bar }{#} ])/', + '/(?[ \8 ])/' => 'Unrecognized escape \8 in character class {#} m/(?[ \8{#} ])/', +- '/(?[ \t ]/' => 'Syntax error in (?[...]) in regex m/(?[ \t ]/', +- '/(?[ [ \t ]/' => 'Syntax error in (?[...]) in regex m/(?[ [ \t ]/', +- '/(?[ \t ] ]/' => 'Syntax error in (?[...]) in regex m/(?[ \t ] ]/', +- '/(?[ [ ] ]/' => 'Syntax error in (?[...]) in regex m/(?[ [ ] ]/', +- '/(?[ \t + \e # This was supposed to be a comment ])/' => 'Syntax error in (?[...]) in regex m/(?[ \t + \e # This was supposed to be a comment ])/', ++ '/(?[ \t ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[ \\t ]{#}/", ++ '/(?[ [ \t ]/' => "Syntax error in (?[...]) {#} m/(?[ [ \\t ]{#}/", ++ '/(?[ \t ] ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[ \\t ]{#} ]/", ++ '/(?[ [ ] ]/' => "Syntax error in (?[...]) {#} m/(?[ [ ] ]{#}/", ++ '/(?[ \t + \e # This was supposed to be a comment ])/' => ++ "Syntax error in (?[...]) {#} m/(?[ \\t + \\e # This was supposed to be a comment ]){#}/", + '/(?[ ])/' => 'Incomplete expression within \'(?[ ])\' {#} m/(?[ {#}])/', + 'm/(?[[a-\d]])/' => 'False [] range "a-\d" {#} m/(?[[a-\d{#}]])/', + 'm/(?[[\w-x]])/' => 'False [] range "\w-" {#} m/(?[[\w-{#}x]])/', +@@ -410,10 +412,10 @@ my @death_utf8 = mark_as_utf8( + + '/ネ\p{}ネ/' => 'Empty \p{} {#} m/ネ\p{{#}}ネ/', + +- '/ネ(?[[[:ネ]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ]]])ネ/", +- '/ネ(?[[[:ネ: ])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ: ])ネ/", +- '/ネ(?[[[::]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[::]]])ネ/", +- '/ネ(?[[[:ネ:]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ:]]])ネ/", ++ '/ネ(?[[[:ネ]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[:ネ]]{#}])ネ/", ++ '/ネ(?[[[:ネ: ])ネ/' => "Syntax error in (?[...]) {#} m/ネ(?[[[:ネ: ])ネ{#}/", ++ '/ネ(?[[[::]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[::]]{#}])ネ/", ++ '/ネ(?[[[:ネ:]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[:ネ:]]{#}])ネ/", + '/ネ(?[[:ネ:]])ネ/' => "", + '/ネ(?[ネ])ネ/' => 'Unexpected character {#} m/ネ(?[ネ{#}])ネ/', + '/ネ(?[ + [ネ] ])/' => 'Unexpected binary operator \'+\' with no preceding operand {#} m/ネ(?[ +{#} [ネ] ])/', +@@ -426,8 +428,9 @@ my @death_utf8 = mark_as_utf8( + '/(?[ \x{ネ} ])ネ/' => 'Non-hex character {#} m/(?[ \x{ネ{#}} ])ネ/', + '/(?[ \p{ネ} ])/' => 'Can\'t find Unicode property definition "ネ" {#} m/(?[ \p{ネ}{#} ])/', + '/(?[ \p{ ネ = bar } ])/' => 'Can\'t find Unicode property definition "ネ = bar" {#} m/(?[ \p{ ネ = bar }{#} ])/', +- '/ネ(?[ \t ]/' => 'Syntax error in (?[...]) in regex m/ネ(?[ \t ]/', +- '/(?[ \t + \e # ネ This was supposed to be a comment ])/' => 'Syntax error in (?[...]) in regex m/(?[ \t + \e # ネ This was supposed to be a comment ])/', ++ '/ネ(?[ \t ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[ \\t ]{#}/", ++ '/(?[ \t + \e # ネ This was supposed to be a comment ])/' => ++ "Syntax error in (?[...]) {#} m/(?[ \\t + \\e # ネ This was supposed to be a comment ]){#}/", + 'm/(*ネ)ネ/' => q<Unknown verb pattern 'ネ' {#} m/(*ネ){#}ネ/>, + '/\cネ/' => "Character following \"\\c\" must be printable ASCII", + '/\b{ネ}/' => "'ネ' is an unknown bound type {#} m/\\b{ネ{#}}/", +diff --git a/t/re/regex_sets.t b/t/re/regex_sets.t +index 92875677be..60a126ba3c 100644 +--- a/t/re/regex_sets.t ++++ b/t/re/regex_sets.t +@@ -157,13 +157,13 @@ for my $char ("٠", "٥", "٩") { + eval { $_ = '/(?[(\c]) /'; qr/$_/ }; + like($@, qr/^Syntax error/, '/(?[(\c]) / should not panic'); + eval { $_ = '(?[\c#]' . "\n])"; qr/$_/ }; +- like($@, qr/^Syntax error/, '/(?[(\c]) / should not panic'); ++ like($@, qr/^Unexpected/, '/(?[(\c]) / should not panic'); + eval { $_ = '(?[(\c])'; qr/$_/ }; + like($@, qr/^Syntax error/, '/(?[(\c])/ should be a syntax error'); + eval { $_ = '(?[(\c]) ]\b'; qr/$_/ }; +- like($@, qr/^Syntax error/, '/(?[(\c]) ]\b/ should be a syntax error'); ++ like($@, qr/^Unexpected/, '/(?[(\c]) ]\b/ should be a syntax error'); + eval { $_ = '(?[\c[]](])'; qr/$_/ }; +- like($@, qr/^Syntax error/, '/(?[\c[]](])/ should be a syntax error'); ++ like($@, qr/^Unexpected/, '/(?[\c[]](])/ should be a syntax error'); + like("\c#", qr/(?[\c#])/, '\c# should match itself'); + like("\c[", qr/(?[\c[])/, '\c[ should match itself'); + like("\c\ ", qr/(?[\c\])/, '\c\ should match itself'); +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/perl/perl_5.24.4.bb b/meta/recipes-devtools/perl/perl_5.24.4.bb index a644970192..2f27749c53 100644 --- a/meta/recipes-devtools/perl/perl_5.24.4.bb +++ b/meta/recipes-devtools/perl/perl_5.24.4.bb @@ -65,6 +65,10 @@ SRC_URI += " \ file://perl-5.26.1-guard_old_libcrypt_fix.patch \ file://CVE-2018-12015.patch \ file://0001-ExtUtils-MM_Unix.pm-fix-race-issues.patch \ + file://CVE-2018-18311.patch \ + file://CVE-2018-18312.patch \ + file://CVE-2018-18313.patch \ + file://CVE-2018-18314.patch \ " # Fix test case issues diff --git a/meta/recipes-devtools/python/python-native_2.7.15.bb b/meta/recipes-devtools/python/python-native_2.7.16.bb index 26d67df6b8..b7442800d9 100644 --- a/meta/recipes-devtools/python/python-native_2.7.15.bb +++ b/meta/recipes-devtools/python/python-native_2.7.16.bb @@ -1,7 +1,6 @@ require python.inc EXTRANATIVEPATH += "bzip2-native" DEPENDS = "openssl-native bzip2-replacement-native zlib-native readline-native sqlite3-native expat-native gdbm-native db-native" -PR = "${INC_PR}.1" SRC_URI += "\ file://05-enable-ctypes-cross-build.patch \ @@ -17,7 +16,6 @@ SRC_URI += "\ file://parallel-makeinst-create-bindir.patch \ file://revert_use_of_sysconfigdata.patch \ file://0001-python-native-fix-one-do_populate_sysroot-warning.patch \ - file://0001-2.7-bpo-34623-Use-XML_SetHashSalt-in-_elementtree-GH.patch \ " S = "${WORKDIR}/Python-${PV}" diff --git a/meta/recipes-devtools/python/python.inc b/meta/recipes-devtools/python/python.inc index 66923678b1..e5f1981ab8 100644 --- a/meta/recipes-devtools/python/python.inc +++ b/meta/recipes-devtools/python/python.inc @@ -5,18 +5,12 @@ SECTION = "devel/python" # bump this on every change in contrib/python/generate-manifest-2.7.py INC_PR = "r1" -LIC_FILES_CHKSUM = "file://LICENSE;md5=f257cc14f81685691652a3d3e1b5d754" - -SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ - file://0001-bpo-33570-TLS-1.3-ciphers-for-OpenSSL-1.1.1-GH-6976-.patch \ - file://0002-bpo-34818-Add-missing-closing-wrapper-in-test_tls1_3.patch \ - file://0003-bpo-34834-Fix-test_ssl.test_options-to-account-for-O.patch \ - file://0004-bpo-34836-fix-test_default_ecdh_curve-needs-no-tlsv1.patch \ - file://0001-bpo-33354-Fix-test_ssl-when-a-filename-cannot-be-enc.patch \ - " - -SRC_URI[md5sum] = "a80ae3cc478460b922242f43a1b4094d" -SRC_URI[sha256sum] = "22d9b1ac5b26135ad2b8c2901a9413537e08749a753356ee913c84dbd2df5574" +LIC_FILES_CHKSUM = "file://LICENSE;md5=e466242989bd33c1bd2b6a526a742498" + +SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz" + +SRC_URI[md5sum] = "30157d85a2c0479c09ea2cbe61f2aaf5" +SRC_URI[sha256sum] = "f222ef602647eecb6853681156d32de4450a2c39f4de93bd5b20235f2e660ed7" # python recipe is actually python 2.x # also, exclude pre-releases for both python 2.x and 3.x diff --git a/meta/recipes-devtools/python/python/0001-bpo-33354-Fix-test_ssl-when-a-filename-cannot-be-enc.patch b/meta/recipes-devtools/python/python/0001-bpo-33354-Fix-test_ssl-when-a-filename-cannot-be-enc.patch deleted file mode 100644 index 4c0b3577b2..0000000000 --- a/meta/recipes-devtools/python/python/0001-bpo-33354-Fix-test_ssl-when-a-filename-cannot-be-enc.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 19f6bd06af3c7fc0db5f96878aaa68f5589ff13e Mon Sep 17 00:00:00 2001 -From: Pablo Galindo <Pablogsal@gmail.com> -Date: Thu, 24 May 2018 23:20:44 +0100 -Subject: [PATCH] bpo-33354: Fix test_ssl when a filename cannot be encoded - (GH-6613) - -Skip test_load_dh_params() of test_ssl when Python filesystem encoding -cannot encode the provided path. - -Upstream-Status: Backport [https://github.com/python/cpython/commit/19f6bd06af3c7fc0db5f96878aaa68f5589ff13e] -Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> ---- - Lib/test/test_ssl.py | 9 ++++++++- - .../next/Tests/2018-04-26-22-39-17.bpo-33354.g35-44.rst | 2 ++ - 2 files changed, 10 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Tests/2018-04-26-22-39-17.bpo-33354.g35-44.rst - -diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py -index b59fe73f04..7ced90fdf6 100644 ---- a/Lib/test/test_ssl.py -+++ b/Lib/test/test_ssl.py -@@ -989,6 +989,13 @@ class ContextTests(unittest.TestCase): - - - def test_load_dh_params(self): -+ filename = u'dhpäräm.pem' -+ fs_encoding = sys.getfilesystemencoding() -+ try: -+ filename.encode(fs_encoding) -+ except UnicodeEncodeError: -+ self.skipTest("filename %r cannot be encoded to the filesystem encoding %r" % (filename, fs_encoding)) -+ - ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) - ctx.load_dh_params(DHFILE) - if os.name != 'nt': -@@ -1001,7 +1008,7 @@ class ContextTests(unittest.TestCase): - with self.assertRaises(ssl.SSLError) as cm: - ctx.load_dh_params(CERTFILE) - with support.temp_dir() as d: -- fname = os.path.join(d, u'dhpäräm.pem') -+ fname = os.path.join(d, filename) - shutil.copy(DHFILE, fname) - ctx.load_dh_params(fname) - -diff --git a/Misc/NEWS.d/next/Tests/2018-04-26-22-39-17.bpo-33354.g35-44.rst b/Misc/NEWS.d/next/Tests/2018-04-26-22-39-17.bpo-33354.g35-44.rst -new file mode 100644 -index 0000000000..c66cecac32 ---- /dev/null -+++ b/Misc/NEWS.d/next/Tests/2018-04-26-22-39-17.bpo-33354.g35-44.rst -@@ -0,0 +1,2 @@ -+Skip ``test_ssl.test_load_dh_params`` when Python filesystem encoding cannot encode the -+provided path. --- -2.17.1 - diff --git a/meta/recipes-devtools/python/python/0001-bpo-33570-TLS-1.3-ciphers-for-OpenSSL-1.1.1-GH-6976-.patch b/meta/recipes-devtools/python/python/0001-bpo-33570-TLS-1.3-ciphers-for-OpenSSL-1.1.1-GH-6976-.patch deleted file mode 100644 index 1f70562fc0..0000000000 --- a/meta/recipes-devtools/python/python/0001-bpo-33570-TLS-1.3-ciphers-for-OpenSSL-1.1.1-GH-6976-.patch +++ /dev/null @@ -1,120 +0,0 @@ -From a333351592f097220fc862911b34d3a300f0985e Mon Sep 17 00:00:00 2001 -From: Christian Heimes <christian@python.org> -Date: Wed, 15 Aug 2018 09:07:28 +0200 -Subject: [PATCH 1/4] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976) - (GH-8760) - -Change TLS 1.3 cipher suite settings for compatibility with OpenSSL -1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by -default. - -Also update multissltests to test with latest OpenSSL. - -Signed-off-by: Christian Heimes <christian@python.org>. -(cherry picked from commit 3e630c541b35c96bfe5619165255e559f577ee71) - -Co-authored-by: Christian Heimes <christian@python.org> - -Upstream-Status: Accepted [https://github.com/python/cpython/pull/8771] - -Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> ---- - Doc/library/ssl.rst | 8 ++-- - Lib/test/test_ssl.py | 37 +++++++++++-------- - .../2018-05-18-21-50-47.bpo-33570.7CZy4t.rst | 3 ++ - 3 files changed, 27 insertions(+), 21 deletions(-) - create mode 100644 Misc/NEWS.d/next/Library/2018-05-18-21-50-47.bpo-33570.7CZy4t.rst - -diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst -index 0421031772..7c7c85b833 100644 ---- a/Doc/library/ssl.rst -+++ b/Doc/library/ssl.rst -@@ -294,11 +294,6 @@ purposes. - - 3DES was dropped from the default cipher string. - -- .. versionchanged:: 2.7.15 -- -- TLS 1.3 cipher suites TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, -- and TLS_CHACHA20_POLY1305_SHA256 were added to the default cipher string. -- - .. function:: _https_verify_certificates(enable=True) - - Specifies whether or not server certificates are verified when creating -@@ -1179,6 +1174,9 @@ to speed up repeated connections from the same clients. - when connected, the :meth:`SSLSocket.cipher` method of SSL sockets will - give the currently selected cipher. - -+ OpenSSL 1.1.1 has TLS 1.3 cipher suites enabled by default. The suites -+ cannot be disabled with :meth:`~SSLContext.set_ciphers`. -+ - .. method:: SSLContext.set_alpn_protocols(protocols) - - Specify which protocols the socket should advertise during the SSL/TLS -diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py -index dc14e22ad1..f51572e319 100644 ---- a/Lib/test/test_ssl.py -+++ b/Lib/test/test_ssl.py -@@ -2772,19 +2772,24 @@ else: - sock.do_handshake() - self.assertEqual(cm.exception.errno, errno.ENOTCONN) - -- def test_default_ciphers(self): -- context = ssl.SSLContext(ssl.PROTOCOL_SSLv23) -- try: -- # Force a set of weak ciphers on our client context -- context.set_ciphers("DES") -- except ssl.SSLError: -- self.skipTest("no DES cipher available") -- with ThreadedEchoServer(CERTFILE, -- ssl_version=ssl.PROTOCOL_SSLv23, -- chatty=False) as server: -- with closing(context.wrap_socket(socket.socket())) as s: -- with self.assertRaises(ssl.SSLError): -- s.connect((HOST, server.port)) -+ def test_no_shared_ciphers(self): -+ server_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23) -+ server_context.load_cert_chain(SIGNED_CERTFILE) -+ client_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23) -+ client_context.verify_mode = ssl.CERT_REQUIRED -+ client_context.check_hostname = True -+ -+ # OpenSSL enables all TLS 1.3 ciphers, enforce TLS 1.2 for test -+ client_context.options |= ssl.OP_NO_TLSv1_3 -+ # Force different suites on client and master -+ client_context.set_ciphers("AES128") -+ server_context.set_ciphers("AES256") -+ with ThreadedEchoServer(context=server_context) as server: -+ s = client_context.wrap_socket( -+ socket.socket(), -+ server_hostname="localhost") -+ with self.assertRaises(ssl.SSLError): -+ s.connect((HOST, server.port)) - self.assertIn("no shared cipher", str(server.conn_errors[0])) - - def test_version_basic(self): -@@ -2815,9 +2820,9 @@ else: - with context.wrap_socket(socket.socket()) as s: - s.connect((HOST, server.port)) - self.assertIn(s.cipher()[0], [ -- 'TLS13-AES-256-GCM-SHA384', -- 'TLS13-CHACHA20-POLY1305-SHA256', -- 'TLS13-AES-128-GCM-SHA256', -+ 'TLS_AES_256_GCM_SHA384', -+ 'TLS_CHACHA20_POLY1305_SHA256', -+ 'TLS_AES_128_GCM_SHA256', - ]) - - @unittest.skipUnless(ssl.HAS_ECDH, "test requires ECDH-enabled OpenSSL") -diff --git a/Misc/NEWS.d/next/Library/2018-05-18-21-50-47.bpo-33570.7CZy4t.rst b/Misc/NEWS.d/next/Library/2018-05-18-21-50-47.bpo-33570.7CZy4t.rst -new file mode 100644 -index 0000000000..bd719a47e8 ---- /dev/null -+++ b/Misc/NEWS.d/next/Library/2018-05-18-21-50-47.bpo-33570.7CZy4t.rst -@@ -0,0 +1,3 @@ -+Change TLS 1.3 cipher suite settings for compatibility with OpenSSL -+1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by -+default. --- -2.17.1 - diff --git a/meta/recipes-devtools/python/python/0001-closes-bpo-34540-Convert-shutil._call_external_zip-t.patch b/meta/recipes-devtools/python/python/0001-closes-bpo-34540-Convert-shutil._call_external_zip-t.patch deleted file mode 100644 index 125db8512a..0000000000 --- a/meta/recipes-devtools/python/python/0001-closes-bpo-34540-Convert-shutil._call_external_zip-t.patch +++ /dev/null @@ -1,67 +0,0 @@ -From c7e692c61dc091d07dee573f5f424b6b427ff056 Mon Sep 17 00:00:00 2001 -From: Benjamin Peterson <benjamin@python.org> -Date: Wed, 29 Aug 2018 21:59:21 -0700 -Subject: [PATCH] closes bpo-34540: Convert shutil._call_external_zip to use - subprocess rather than distutils.spawn. (GH-8985) - -Upstream-Status: Backport -CVE: CVE-2018-1000802 -Signed-off-by: Chen Qi <Qi.Chen@windriver.com> ---- - Lib/shutil.py | 16 ++++++++++------ - .../Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst | 3 +++ - 2 files changed, 13 insertions(+), 6 deletions(-) - create mode 100644 Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst - -diff --git a/Lib/shutil.py b/Lib/shutil.py -index 3462f7c..0ab1a06 100644 ---- a/Lib/shutil.py -+++ b/Lib/shutil.py -@@ -413,17 +413,21 @@ def _make_tarball(base_name, base_dir, compress="gzip", verbose=0, dry_run=0, - - return archive_name - --def _call_external_zip(base_dir, zip_filename, verbose=False, dry_run=False): -+def _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger): - # XXX see if we want to keep an external call here - if verbose: - zipoptions = "-r" - else: - zipoptions = "-rq" -- from distutils.errors import DistutilsExecError -- from distutils.spawn import spawn -+ cmd = ["zip", zipoptions, zip_filename, base_dir] -+ if logger is not None: -+ logger.info(' '.join(cmd)) -+ if dry_run: -+ return -+ import subprocess - try: -- spawn(["zip", zipoptions, zip_filename, base_dir], dry_run=dry_run) -- except DistutilsExecError: -+ subprocess.check_call(cmd) -+ except subprocess.CalledProcessError: - # XXX really should distinguish between "couldn't find - # external 'zip' command" and "zip failed". - raise ExecError, \ -@@ -458,7 +462,7 @@ def _make_zipfile(base_name, base_dir, verbose=0, dry_run=0, logger=None): - zipfile = None - - if zipfile is None: -- _call_external_zip(base_dir, zip_filename, verbose, dry_run) -+ _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger) - else: - if logger is not None: - logger.info("creating '%s' and adding '%s' to it", -diff --git a/Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst b/Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst -new file mode 100644 -index 0000000..4f68696 ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst -@@ -0,0 +1,3 @@ -+When ``shutil.make_archive`` falls back to the external ``zip`` problem, it -+uses :mod:`subprocess` to invoke it rather than :mod:`distutils.spawn`. This -+closes a possible shell injection vector. --- -2.7.4 - diff --git a/meta/recipes-devtools/python/python/0002-bpo-34818-Add-missing-closing-wrapper-in-test_tls1_3.patch b/meta/recipes-devtools/python/python/0002-bpo-34818-Add-missing-closing-wrapper-in-test_tls1_3.patch deleted file mode 100644 index 96882712e9..0000000000 --- a/meta/recipes-devtools/python/python/0002-bpo-34818-Add-missing-closing-wrapper-in-test_tls1_3.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 0e1f3856a7e1511fb64d99646c54ddf3897cd444 Mon Sep 17 00:00:00 2001 -From: Dimitri John Ledkov <xnox@ubuntu.com> -Date: Fri, 28 Sep 2018 14:15:52 +0100 -Subject: [PATCH 2/4] bpo-34818: Add missing closing() wrapper in test_tls1_3. - -Python 2.7 socket classes do not implement context manager protocol, -hence closing() is required around it. Resolves testcase error -traceback. - -Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com> - -https://bugs.python.org/issue34818 - -Patch taken from Ubuntu. - -Upstream-Status: Submitted [https://github.com/python/cpython/pull/9622] -Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> ---- - Lib/test/test_ssl.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py -index f51572e319..7a14053cee 100644 ---- a/Lib/test/test_ssl.py -+++ b/Lib/test/test_ssl.py -@@ -2817,7 +2817,7 @@ else: - ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1 | ssl.OP_NO_TLSv1_2 - ) - with ThreadedEchoServer(context=context) as server: -- with context.wrap_socket(socket.socket()) as s: -+ with closing(context.wrap_socket(socket.socket())) as s: - s.connect((HOST, server.port)) - self.assertIn(s.cipher()[0], [ - 'TLS_AES_256_GCM_SHA384', --- -2.17.1 - diff --git a/meta/recipes-devtools/python/python/0003-bpo-34834-Fix-test_ssl.test_options-to-account-for-O.patch b/meta/recipes-devtools/python/python/0003-bpo-34834-Fix-test_ssl.test_options-to-account-for-O.patch deleted file mode 100644 index 77016cb430..0000000000 --- a/meta/recipes-devtools/python/python/0003-bpo-34834-Fix-test_ssl.test_options-to-account-for-O.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 8b06d56d26eee289fec22b9b72ab4c7cc3d6c482 Mon Sep 17 00:00:00 2001 -From: Dimitri John Ledkov <xnox@ubuntu.com> -Date: Fri, 28 Sep 2018 16:34:16 +0100 -Subject: [PATCH 3/4] bpo-34834: Fix test_ssl.test_options to account for - OP_ENABLE_MIDDLEBOX_COMPAT. - -Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com> - -https://bugs.python.org/issue34834 - -Patch taken from Ubuntu. -Upstream-Status: Submitted [https://github.com/python/cpython/pull/9624] - -Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> ---- - Lib/test/test_ssl.py | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py -index 7a14053cee..efc906a5ba 100644 ---- a/Lib/test/test_ssl.py -+++ b/Lib/test/test_ssl.py -@@ -777,6 +777,11 @@ class ContextTests(unittest.TestCase): - default = (ssl.OP_ALL | ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3) - if not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 0): - default |= ssl.OP_NO_COMPRESSION -+ if not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 1): -+ # define MIDDLEBOX constant, as python2.7 does not know about it -+ # but it is used by default. -+ OP_ENABLE_MIDDLEBOX_COMPAT = 1048576L -+ default |= OP_ENABLE_MIDDLEBOX_COMPAT - self.assertEqual(default, ctx.options) - ctx.options |= ssl.OP_NO_TLSv1 - self.assertEqual(default | ssl.OP_NO_TLSv1, ctx.options) --- -2.17.1 - diff --git a/meta/recipes-devtools/python/python/0004-bpo-34836-fix-test_default_ecdh_curve-needs-no-tlsv1.patch b/meta/recipes-devtools/python/python/0004-bpo-34836-fix-test_default_ecdh_curve-needs-no-tlsv1.patch deleted file mode 100644 index 39e1bcfc86..0000000000 --- a/meta/recipes-devtools/python/python/0004-bpo-34836-fix-test_default_ecdh_curve-needs-no-tlsv1.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 946a7969345c6697697effd226ec396d3fea05b7 Mon Sep 17 00:00:00 2001 -From: Dimitri John Ledkov <xnox@ubuntu.com> -Date: Fri, 28 Sep 2018 17:30:19 +0100 -Subject: [PATCH 4/4] bpo-34836: fix test_default_ecdh_curve, needs no tlsv1.3. - -Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com> - -https://bugs.python.org/issue34836 - -Patch taken from Ubuntu. -Upstream-Status: Submitted [https://github.com/python/cpython/pull/9626] - -Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> ---- - Lib/test/test_ssl.py | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py -index efc906a5ba..4a3286cd5f 100644 ---- a/Lib/test/test_ssl.py -+++ b/Lib/test/test_ssl.py -@@ -2836,6 +2836,9 @@ else: - # should be enabled by default on SSL contexts. - context = ssl.SSLContext(ssl.PROTOCOL_SSLv23) - context.load_cert_chain(CERTFILE) -+ # TLSv1.3 defaults to PFS key agreement and no longer has KEA in -+ # cipher name. -+ context.options |= ssl.OP_NO_TLSv1_3 - # Prior to OpenSSL 1.0.0, ECDH ciphers have to be enabled - # explicitly using the 'ECCdraft' cipher alias. Otherwise, - # our default cipher list should prefer ECDH-based ciphers --- -2.17.1 - diff --git a/meta/recipes-devtools/python/python/bpo-30458-cve-2019-9740.patch b/meta/recipes-devtools/python/python/bpo-30458-cve-2019-9740.patch new file mode 100644 index 0000000000..f4c56bb828 --- /dev/null +++ b/meta/recipes-devtools/python/python/bpo-30458-cve-2019-9740.patch @@ -0,0 +1,219 @@ +From 39815ee5bb7f2f9ca1f0d5e9f51e27a2877ec35b Mon Sep 17 00:00:00 2001 +From: Victor Stinner <victor.stinner@gmail.com> +Date: Tue, 21 May 2019 15:12:33 +0200 +Subject: [PATCH] bpo-30458: Disallow control chars in http URLs (GH-12755) + (GH-13154) (GH-13315) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Disallow control chars in http URLs in urllib2.urlopen. This +addresses a potential security problem for applications that do not +sanity check their URLs where http request headers could be injected. + +Disable https related urllib tests on a build without ssl (GH-13032) +These tests require an SSL enabled build. Skip these tests when +python is built without SSL to fix test failures. + +Use httplib.InvalidURL instead of ValueError as the new error case's +exception. (GH-13044) + +Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz> + +(cherry picked from commit 7e200e0763f5b71c199aaf98bd5588f291585619) + +Notes on backport to Python 2.7: + +* test_urllib tests urllib.urlopen() which quotes the URL and so is + not vulerable to HTTP Header Injection. +* Add tests to test_urllib2 on urllib2.urlopen(). +* Reject non-ASCII characters: range 0x80-0xff. + +CVE: CVE-2019-9740 CVE-2019-9747 +Upstream-Status: Accepted + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + Lib/httplib.py | 16 ++++++ + Lib/test/test_urllib.py | 25 +++++++++ + Lib/test/test_urllib2.py | 51 ++++++++++++++++++- + Lib/test/test_xmlrpc.py | 8 ++- + .../2019-04-10-08-53-30.bpo-30458.51E-DA.rst | 1 + + 5 files changed, 99 insertions(+), 2 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst + +diff --git a/Lib/httplib.py b/Lib/httplib.py +index 60a8fb4e35..1b41c346e0 100644 +--- a/Lib/httplib.py ++++ b/Lib/httplib.py +@@ -247,6 +247,16 @@ _MAXHEADERS = 100 + _is_legal_header_name = re.compile(r'\A[^:\s][^:\r\n]*\Z').match + _is_illegal_header_value = re.compile(r'\n(?![ \t])|\r(?![ \t\n])').search + ++# These characters are not allowed within HTTP URL paths. ++# See https://tools.ietf.org/html/rfc3986#section-3.3 and the ++# https://tools.ietf.org/html/rfc3986#appendix-A pchar definition. ++# Prevents CVE-2019-9740. Includes control characters such as \r\n. ++# Restrict non-ASCII characters above \x7f (0x80-0xff). ++_contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f-\xff]') ++# Arguably only these _should_ allowed: ++# _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$") ++# We are more lenient for assumed real world compatibility purposes. ++ + # We always set the Content-Length header for these methods because some + # servers will otherwise respond with a 411 + _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'} +@@ -927,6 +937,12 @@ class HTTPConnection: + self._method = method + if not url: + url = '/' ++ # Prevent CVE-2019-9740. ++ match = _contains_disallowed_url_pchar_re.search(url) ++ if match: ++ raise InvalidURL("URL can't contain control characters. %r " ++ "(found at least %r)" ++ % (url, match.group())) + hdr = '%s %s %s' % (method, url, self._http_vsn_str) + + self._output(hdr) +diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py +index 1ce9201c06..d7778d4194 100644 +--- a/Lib/test/test_urllib.py ++++ b/Lib/test/test_urllib.py +@@ -257,6 +257,31 @@ class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin): + finally: + self.unfakehttp() + ++ def test_url_with_control_char_rejected(self): ++ for char_no in range(0, 0x21) + range(0x7f, 0x100): ++ char = chr(char_no) ++ schemeless_url = "//localhost:7777/test%s/" % char ++ self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.") ++ try: ++ # urllib quotes the URL so there is no injection. ++ resp = urllib.urlopen("http:" + schemeless_url) ++ self.assertNotIn(char, resp.geturl()) ++ finally: ++ self.unfakehttp() ++ ++ def test_url_with_newline_header_injection_rejected(self): ++ self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.") ++ host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123" ++ schemeless_url = "//" + host + ":8080/test/?test=a" ++ try: ++ # urllib quotes the URL so there is no injection. ++ resp = urllib.urlopen("http:" + schemeless_url) ++ self.assertNotIn(' ', resp.geturl()) ++ self.assertNotIn('\r', resp.geturl()) ++ self.assertNotIn('\n', resp.geturl()) ++ finally: ++ self.unfakehttp() ++ + def test_read_bogus(self): + # urlopen() should raise IOError for many error codes. + self.fakehttp('''HTTP/1.1 401 Authentication Required +diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py +index 6d24d5ddf8..9531818e16 100644 +--- a/Lib/test/test_urllib2.py ++++ b/Lib/test/test_urllib2.py +@@ -15,6 +15,9 @@ try: + except ImportError: + ssl = None + ++from test.test_urllib import FakeHTTPMixin ++ ++ + # XXX + # Request + # CacheFTPHandler (hard to write) +@@ -1262,7 +1265,7 @@ class HandlerTests(unittest.TestCase): + self.assertEqual(len(http_handler.requests), 1) + self.assertFalse(http_handler.requests[0].has_header(auth_header)) + +-class MiscTests(unittest.TestCase): ++class MiscTests(unittest.TestCase, FakeHTTPMixin): + + def test_build_opener(self): + class MyHTTPHandler(urllib2.HTTPHandler): pass +@@ -1317,6 +1320,52 @@ class MiscTests(unittest.TestCase): + "Unsupported digest authentication algorithm 'invalid'" + ) + ++ @unittest.skipUnless(ssl, "ssl module required") ++ def test_url_with_control_char_rejected(self): ++ for char_no in range(0, 0x21) + range(0x7f, 0x100): ++ char = chr(char_no) ++ schemeless_url = "//localhost:7777/test%s/" % char ++ self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.") ++ try: ++ # We explicitly test urllib.request.urlopen() instead of the top ++ # level 'def urlopen()' function defined in this... (quite ugly) ++ # test suite. They use different url opening codepaths. Plain ++ # urlopen uses FancyURLOpener which goes via a codepath that ++ # calls urllib.parse.quote() on the URL which makes all of the ++ # above attempts at injection within the url _path_ safe. ++ escaped_char_repr = repr(char).replace('\\', r'\\') ++ InvalidURL = httplib.InvalidURL ++ with self.assertRaisesRegexp( ++ InvalidURL, "contain control.*" + escaped_char_repr): ++ urllib2.urlopen("http:" + schemeless_url) ++ with self.assertRaisesRegexp( ++ InvalidURL, "contain control.*" + escaped_char_repr): ++ urllib2.urlopen("https:" + schemeless_url) ++ finally: ++ self.unfakehttp() ++ ++ @unittest.skipUnless(ssl, "ssl module required") ++ def test_url_with_newline_header_injection_rejected(self): ++ self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.") ++ host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123" ++ schemeless_url = "//" + host + ":8080/test/?test=a" ++ try: ++ # We explicitly test urllib2.urlopen() instead of the top ++ # level 'def urlopen()' function defined in this... (quite ugly) ++ # test suite. They use different url opening codepaths. Plain ++ # urlopen uses FancyURLOpener which goes via a codepath that ++ # calls urllib.parse.quote() on the URL which makes all of the ++ # above attempts at injection within the url _path_ safe. ++ InvalidURL = httplib.InvalidURL ++ with self.assertRaisesRegexp( ++ InvalidURL, r"contain control.*\\r.*(found at least . .)"): ++ urllib2.urlopen("http:" + schemeless_url) ++ with self.assertRaisesRegexp(InvalidURL, r"contain control.*\\n"): ++ urllib2.urlopen("https:" + schemeless_url) ++ finally: ++ self.unfakehttp() ++ ++ + + class RequestTests(unittest.TestCase): + +diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py +index 36b3be67fd..90ccb30716 100644 +--- a/Lib/test/test_xmlrpc.py ++++ b/Lib/test/test_xmlrpc.py +@@ -659,7 +659,13 @@ class SimpleServerTestCase(BaseServerTestCase): + def test_partial_post(self): + # Check that a partial POST doesn't make the server loop: issue #14001. + conn = httplib.HTTPConnection(ADDR, PORT) +- conn.request('POST', '/RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nbye') ++ conn.send('POST /RPC2 HTTP/1.0\r\n' ++ 'Content-Length: 100\r\n\r\n' ++ 'bye HTTP/1.1\r\n' ++ 'Host: %s:%s\r\n' ++ 'Accept-Encoding: identity\r\n' ++ 'Content-Length: 0\r\n\r\n' ++ % (ADDR, PORT)) + conn.close() + + class SimpleServerEncodingTestCase(BaseServerTestCase): +diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst +new file mode 100644 +index 0000000000..47cb899df1 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst +@@ -0,0 +1 @@ ++Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an httplib.InvalidURL exception to be raised. +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/python/python/bpo-35121-cve-2018-20852.patch b/meta/recipes-devtools/python/python/bpo-35121-cve-2018-20852.patch new file mode 100644 index 0000000000..7ce7b1f9e0 --- /dev/null +++ b/meta/recipes-devtools/python/python/bpo-35121-cve-2018-20852.patch @@ -0,0 +1,127 @@ +From 1bd50d351e508b8947e5813c5f925eb4b61c8d76 Mon Sep 17 00:00:00 2001 +From: Xtreak <tir.karthi@gmail.com> +Date: Sat, 15 Jun 2019 20:59:43 +0530 +Subject: [PATCH] [2.7] bpo-35121: prefix dot in domain for proper subdomain + validation (GH-10258) (GH-13426) + +This is a manual backport of ca7fe5063593958e5efdf90f068582837f07bd14 since 2.7 has `http.cookiejar` in `cookielib` + +https://bugs.python.org/issue35121 + +CVE: CVE-2018-20852 +Upstream-Status: Accepted + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + Lib/cookielib.py | 13 ++++++-- + Lib/test/test_cookielib.py | 30 +++++++++++++++++++ + .../2019-05-20-00-35-12.bpo-35121.RRi-HU.rst | 4 +++ + 3 files changed, 45 insertions(+), 2 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst + +diff --git a/Lib/cookielib.py b/Lib/cookielib.py +index 2dd7c48728..0b471a42f2 100644 +--- a/Lib/cookielib.py ++++ b/Lib/cookielib.py +@@ -1139,6 +1139,11 @@ class DefaultCookiePolicy(CookiePolicy): + req_host, erhn = eff_request_host(request) + domain = cookie.domain + ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't + if (cookie.version == 0 and + (self.strict_ns_domain & self.DomainStrictNonDomain) and +@@ -1151,7 +1156,7 @@ class DefaultCookiePolicy(CookiePolicy): + _debug(" effective request-host name %s does not domain-match " + "RFC 2965 cookie domain %s", erhn, domain) + return False +- if cookie.version == 0 and not ("."+erhn).endswith(domain): ++ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): + _debug(" request-host %s does not match Netscape cookie domain " + "%s", req_host, domain) + return False +@@ -1165,7 +1170,11 @@ class DefaultCookiePolicy(CookiePolicy): + req_host = "."+req_host + if not erhn.startswith("."): + erhn = "."+erhn +- if not (req_host.endswith(domain) or erhn.endswith(domain)): ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): + #_debug(" request domain %s does not match cookie domain %s", + # req_host, domain) + return False +diff --git a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py +index f2dd9727d1..7f7ff614d6 100644 +--- a/Lib/test/test_cookielib.py ++++ b/Lib/test/test_cookielib.py +@@ -368,6 +368,7 @@ class CookieTests(TestCase): + ("http://foo.bar.com/", ".foo.bar.com", True), + ("http://foo.bar.com/", "foo.bar.com", True), + ("http://foo.bar.com/", ".bar.com", True), ++ ("http://foo.bar.com/", "bar.com", True), + ("http://foo.bar.com/", "com", True), + ("http://foo.com/", "rhubarb.foo.com", False), + ("http://foo.com/", ".foo.com", True), +@@ -378,6 +379,8 @@ class CookieTests(TestCase): + ("http://foo/", "foo", True), + ("http://foo/", "foo.local", True), + ("http://foo/", ".local", True), ++ ("http://barfoo.com", ".foo.com", False), ++ ("http://barfoo.com", "foo.com", False), + ]: + request = urllib2.Request(url) + r = pol.domain_return_ok(domain, request) +@@ -938,6 +941,33 @@ class CookieTests(TestCase): + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + ++ c.clear() ++ ++ pol.set_blocked_domains([]) ++ req = Request("http://acme.com/") ++ res = FakeResponse(headers, "http://acme.com/") ++ cookies = c.make_cookies(res, req) ++ c.extract_cookies(res, req) ++ self.assertEqual(len(c), 1) ++ ++ req = Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertTrue(req.has_header("Cookie")) ++ ++ req = Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(pol.return_ok(cookies[0], req)) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ p = pol.set_blocked_domains(["acme.com"]) ++ req = Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ req = Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ + def test_secure(self): + from cookielib import CookieJar, DefaultCookiePolicy + +diff --git a/Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst b/Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst +new file mode 100644 +index 0000000000..7725180616 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst +@@ -0,0 +1,4 @@ ++Don't send cookies of domain A without Domain attribute to domain B when ++domain A is a suffix match of domain B while using a cookiejar with ++:class:`cookielib.DefaultCookiePolicy` policy. Patch by Karthikeyan ++Singaravelan. +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948-fix.patch b/meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948-fix.patch new file mode 100644 index 0000000000..b267237018 --- /dev/null +++ b/meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948-fix.patch @@ -0,0 +1,55 @@ +From 179a5f75f1121dab271fe8f90eb35145f9dcbbda Mon Sep 17 00:00:00 2001 +From: Sihoon Lee <push0ebp@gmail.com> +Date: Fri, 17 May 2019 02:41:06 +0900 +Subject: [PATCH] Update test_urllib.py and urllib.py\nchange assertEqual into + assertRasies in DummyURLopener test, and simplify mitigation + +Upstream-Status: Submitted https://github.com/python/cpython/pull/11842 + +CVE: CVE-2019-9948 + +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- + Lib/test/test_urllib.py | 11 +++-------- + Lib/urllib.py | 4 ++-- + 2 files changed, 5 insertions(+), 10 deletions(-) + +diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py +index e5f210e62a18..1e23dfb0bb16 100644 +--- a/Lib/test/test_urllib.py ++++ b/Lib/test/test_urllib.py +@@ -1027,14 +1027,9 @@ def test_local_file_open(self): + class DummyURLopener(urllib.URLopener): + def open_local_file(self, url): + return url +- self.assertEqual(DummyURLopener().open( +- 'local-file://example'), '//example') +- self.assertEqual(DummyURLopener().open( +- 'local_file://example'), '//example') +- self.assertRaises(IOError, urllib.urlopen, +- 'local-file://example') +- self.assertRaises(IOError, urllib.urlopen, +- 'local_file://example') ++ for url in ('local_file://example', 'local-file://example'): ++ self.assertRaises(IOError, DummyURLopener().open, url) ++ self.assertRaises(IOError, urllib.urlopen, url) + + # Just commented them out. + # Can't really tell why keep failing in windows and sparc. +diff --git a/Lib/urllib.py b/Lib/urllib.py +index a24e9a5c68fb..39b834054e9e 100644 +--- a/Lib/urllib.py ++++ b/Lib/urllib.py +@@ -203,10 +203,10 @@ def open(self, fullurl, data=None): + name = 'open_' + urltype + self.type = urltype + name = name.replace('-', '_') +- ++ + # bpo-35907: # disallow the file reading with the type not allowed + if not hasattr(self, name) or \ +- (self == _urlopener and name == 'open_local_file'): ++ getattr(self, name) == self.open_local_file: + if proxy: + return self.open_unknown_proxy(proxy, fullurl, data) + else: diff --git a/meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948.patch b/meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948.patch new file mode 100644 index 0000000000..f4c225d2fc --- /dev/null +++ b/meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948.patch @@ -0,0 +1,55 @@ +From 8f99cc799e4393bf1112b9395b2342f81b3f45ef Mon Sep 17 00:00:00 2001 +From: push0ebp <push0ebp@shl-MacBook-Pro.local> +Date: Thu, 14 Feb 2019 02:05:46 +0900 +Subject: [PATCH] bpo-35907: Avoid file reading as disallowing the unnecessary + URL scheme in urllib + +Upstream-Status: Submitted https://github.com/python/cpython/pull/11842 + +CVE: CVE-2019-9948 + +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- + Lib/test/test_urllib.py | 12 ++++++++++++ + Lib/urllib.py | 5 ++++- + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py +index 1ce9201c0693..e5f210e62a18 100644 +--- a/Lib/test/test_urllib.py ++++ b/Lib/test/test_urllib.py +@@ -1023,6 +1023,18 @@ def open_spam(self, url): + "spam://c:|windows%/:=&?~#+!$,;'@()*[]|/path/"), + "//c:|windows%/:=&?~#+!$,;'@()*[]|/path/") + ++ def test_local_file_open(self): ++ class DummyURLopener(urllib.URLopener): ++ def open_local_file(self, url): ++ return url ++ self.assertEqual(DummyURLopener().open( ++ 'local-file://example'), '//example') ++ self.assertEqual(DummyURLopener().open( ++ 'local_file://example'), '//example') ++ self.assertRaises(IOError, urllib.urlopen, ++ 'local-file://example') ++ self.assertRaises(IOError, urllib.urlopen, ++ 'local_file://example') + + # Just commented them out. + # Can't really tell why keep failing in windows and sparc. +diff --git a/Lib/urllib.py b/Lib/urllib.py +index d85504a5cb7e..a24e9a5c68fb 100644 +--- a/Lib/urllib.py ++++ b/Lib/urllib.py +@@ -203,7 +203,10 @@ def open(self, fullurl, data=None): + name = 'open_' + urltype + self.type = urltype + name = name.replace('-', '_') +- if not hasattr(self, name): ++ ++ # bpo-35907: # disallow the file reading with the type not allowed ++ if not hasattr(self, name) or \ ++ (self == _urlopener and name == 'open_local_file'): + if proxy: + return self.open_unknown_proxy(proxy, fullurl, data) + else: diff --git a/meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636-fix.patch b/meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636-fix.patch new file mode 100644 index 0000000000..2ce4d2cde7 --- /dev/null +++ b/meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636-fix.patch @@ -0,0 +1,28 @@ +From 06b5ee585d6e76bdbb4002f642d864d860cbbd2b Mon Sep 17 00:00:00 2001 +From: Steve Dower <steve.dower@python.org> +Date: Tue, 12 Mar 2019 08:23:33 -0700 +Subject: [PATCH] bpo-36216: Only print test messages when verbose + +CVE: CVE-2019-9636 + +Upstream-Status: Backport https://github.com/python/cpython/pull/12291/commits/06b5ee585d6e76bdbb4002f642d864d860cbbd2b + +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- + Lib/test/test_urlparse.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py +index 73b0228ea8e3..1830d0b28688 100644 +--- a/Lib/test/test_urlparse.py ++++ b/Lib/test/test_urlparse.py +@@ -644,7 +644,8 @@ def test_urlsplit_normalization(self): + for scheme in [u"http", u"https", u"ftp"]: + for c in denorm_chars: + url = u"{}://netloc{}false.netloc/path".format(scheme, c) +- print "Checking %r" % url ++ if test_support.verbose: ++ print "Checking %r" % url + with self.assertRaises(ValueError): + urlparse.urlsplit(url) + diff --git a/meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636.patch b/meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636.patch new file mode 100644 index 0000000000..352b13ba9b --- /dev/null +++ b/meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636.patch @@ -0,0 +1,111 @@ +From 3e3669c9c41a27e1466e2c28b3906e3dd0ce3e7e Mon Sep 17 00:00:00 2001 +From: Steve Dower <steve.dower@python.org> +Date: Thu, 7 Mar 2019 08:25:22 -0800 +Subject: [PATCH] bpo-36216: Add check for characters in netloc that normalize + to separators (GH-12201) + +CVE: CVE-2019-9636 + +Upstream-Status: Backport https://github.com/python/cpython/pull/12216/commits/3e3669c9c41a27e1466e2c28b3906e3dd0ce3e7e + +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- + Doc/library/urlparse.rst | 20 ++++++++++++++++ + Lib/test/test_urlparse.py | 24 +++++++++++++++++++ + Lib/urlparse.py | 17 +++++++++++++ + .../2019-03-06-09-38-40.bpo-36216.6q1m4a.rst | 3 +++ + 4 files changed, 64 insertions(+) + create mode 100644 Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst + +diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py +index 4e1ded73c266..73b0228ea8e3 100644 +--- a/Lib/test/test_urlparse.py ++++ b/Lib/test/test_urlparse.py +@@ -1,4 +1,6 @@ + from test import test_support ++import sys ++import unicodedata + import unittest + import urlparse + +@@ -624,6 +626,28 @@ def test_portseparator(self): + self.assertEqual(urlparse.urlparse("http://www.python.org:80"), + ('http','www.python.org:80','','','','')) + ++ def test_urlsplit_normalization(self): ++ # Certain characters should never occur in the netloc, ++ # including under normalization. ++ # Ensure that ALL of them are detected and cause an error ++ illegal_chars = u'/:#?@' ++ hex_chars = {'{:04X}'.format(ord(c)) for c in illegal_chars} ++ denorm_chars = [ ++ c for c in map(unichr, range(128, sys.maxunicode)) ++ if (hex_chars & set(unicodedata.decomposition(c).split())) ++ and c not in illegal_chars ++ ] ++ # Sanity check that we found at least one such character ++ self.assertIn(u'\u2100', denorm_chars) ++ self.assertIn(u'\uFF03', denorm_chars) ++ ++ for scheme in [u"http", u"https", u"ftp"]: ++ for c in denorm_chars: ++ url = u"{}://netloc{}false.netloc/path".format(scheme, c) ++ print "Checking %r" % url ++ with self.assertRaises(ValueError): ++ urlparse.urlsplit(url) ++ + def test_main(): + test_support.run_unittest(UrlParseTestCase) + +diff --git a/Lib/urlparse.py b/Lib/urlparse.py +index f7c2b032b097..54eda08651ab 100644 +--- a/Lib/urlparse.py ++++ b/Lib/urlparse.py +@@ -165,6 +165,21 @@ def _splitnetloc(url, start=0): + delim = min(delim, wdelim) # use earliest delim position + return url[start:delim], url[delim:] # return (domain, rest) + ++def _checknetloc(netloc): ++ if not netloc or not isinstance(netloc, unicode): ++ return ++ # looking for characters like \u2100 that expand to 'a/c' ++ # IDNA uses NFKC equivalence, so normalize for this check ++ import unicodedata ++ netloc2 = unicodedata.normalize('NFKC', netloc) ++ if netloc == netloc2: ++ return ++ _, _, netloc = netloc.rpartition('@') # anything to the left of '@' is okay ++ for c in '/?#@:': ++ if c in netloc2: ++ raise ValueError("netloc '" + netloc2 + "' contains invalid " + ++ "characters under NFKC normalization") ++ + def urlsplit(url, scheme='', allow_fragments=True): + """Parse a URL into 5 components: + <scheme>://<netloc>/<path>?<query>#<fragment> +@@ -193,6 +208,7 @@ def urlsplit(url, scheme='', allow_fragments=True): + url, fragment = url.split('#', 1) + if '?' in url: + url, query = url.split('?', 1) ++ _checknetloc(netloc) + v = SplitResult(scheme, netloc, url, query, fragment) + _parse_cache[key] = v + return v +@@ -216,6 +232,7 @@ def urlsplit(url, scheme='', allow_fragments=True): + url, fragment = url.split('#', 1) + if '?' in url: + url, query = url.split('?', 1) ++ _checknetloc(netloc) + v = SplitResult(scheme, netloc, url, query, fragment) + _parse_cache[key] = v + return v +diff --git a/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst b/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst +new file mode 100644 +index 000000000000..1e1ad92c6feb +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst +@@ -0,0 +1,3 @@ ++Changes urlsplit() to raise ValueError when the URL contains characters that ++decompose under IDNA encoding (NFKC-normalization) into characters that ++affect how the URL is parsed. +\ No newline at end of file diff --git a/meta/recipes-devtools/python/python/0001-2.7-bpo-34623-Use-XML_SetHashSalt-in-_elementtree-GH.patch b/meta/recipes-devtools/python/python3/CVE-2018-14647.patch index 3c0d662296..c1f21f826c 100644 --- a/meta/recipes-devtools/python/python/0001-2.7-bpo-34623-Use-XML_SetHashSalt-in-_elementtree-GH.patch +++ b/meta/recipes-devtools/python/python3/CVE-2018-14647.patch @@ -1,36 +1,35 @@ -From 3ffc80959f01f9fde548f1632694b9f950c2dd7c Mon Sep 17 00:00:00 2001 -From: Christian Heimes <christian@python.org> -Date: Tue, 18 Sep 2018 15:13:09 +0200 -Subject: [PATCH] [2.7] bpo-34623: Use XML_SetHashSalt in _elementtree - (GH-9146) (GH-9394) +From 610b4b0dbaedd3099ab76acf678e9cc845d99a76 Mon Sep 17 00:00:00 2001 +From: stratakis <cstratak@redhat.com> +Date: Mon, 25 Feb 2019 22:04:09 +0100 +Subject: [PATCH] [3.5] bpo-34623: Use XML_SetHashSalt in _elementtree (#9933) + +* bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146) The C accelerated _elementtree module now initializes hash randomization salt from _Py_HashSecret instead of libexpat's default CPRNG. Signed-off-by: Christian Heimes <christian@python.org> -https://bugs.python.org/issue34623. +https://bugs.python.org/issue34623 (cherry picked from commit cb5778f00ce48631c7140f33ba242496aaf7102b) Co-authored-by: Christian Heimes <christian@python.org> - - -https://bugs.python.org/issue34623 - -Upstream-Status: Backport CVE: CVE-2018-14647 -Signed-off-by: Chen Qi <Qi.Chen@windriver.com> +Upstream-Status: Backport +[https://github.com/python/cpython/commit/41b48e71ac8a71f56694b548f118bd20ce203410] + +Signed-off-by: Dan Tran <dantran@microsoft.com> --- - Include/pyexpat.h | 4 +++- - Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst | 2 ++ - Modules/_elementtree.c | 5 +++++ - Modules/pyexpat.c | 5 +++++ + Include/pyexpat.h | 4 +++- + .../next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst | 2 ++ + Modules/_elementtree.c | 5 +++++ + Modules/pyexpat.c | 5 +++++ 4 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst diff --git a/Include/pyexpat.h b/Include/pyexpat.h -index 5340ef5..3fc5fa5 100644 +index 44259bf6d7..07020b5dc9 100644 --- a/Include/pyexpat.h +++ b/Include/pyexpat.h @@ -3,7 +3,7 @@ @@ -41,11 +40,11 @@ index 5340ef5..3fc5fa5 100644 +#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" - struct PyExpat_CAPI -@@ -43,6 +43,8 @@ struct PyExpat_CAPI - XML_Parser parser, XML_UnknownEncodingHandler handler, - void *encodingHandlerData); - void (*SetUserData)(XML_Parser parser, void *userData); + struct PyExpat_CAPI +@@ -48,6 +48,8 @@ struct PyExpat_CAPI + enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *encoding); + int (*DefaultUnknownEncodingHandler)( + void *encodingHandlerData, const XML_Char *name, XML_Encoding *info); + /* might be none for expat < 2.1.0 */ + int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); /* always add new stuff to the end! */ @@ -53,36 +52,36 @@ index 5340ef5..3fc5fa5 100644 diff --git a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst new file mode 100644 -index 0000000..31ad92e +index 0000000000..cbaa4b7506 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst @@ -0,0 +1,2 @@ -+The C accelerated _elementtree module now initializes hash randomization -+salt from _Py_HashSecret instead of libexpat's default CSPRNG. ++CVE-2018-14647: The C accelerated _elementtree module now initializes hash ++randomization salt from _Py_HashSecret instead of libexpat's default CSPRNG. diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c -index 1d316a1..a19cbf7 100644 +index 5dba9f70a9..90c6daf64a 100644 --- a/Modules/_elementtree.c +++ b/Modules/_elementtree.c -@@ -2574,6 +2574,11 @@ xmlparser(PyObject* self_, PyObject* args, PyObject* kw) +@@ -3282,6 +3282,11 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *html, PyErr_NoMemory(); - return NULL; + return -1; } + /* expat < 2.1.0 has no XML_SetHashSalt() */ + if (EXPAT(SetHashSalt) != NULL) { + EXPAT(SetHashSalt)(self->parser, -+ (unsigned long)_Py_HashSecret.prefix); ++ (unsigned long)_Py_HashSecret.expat.hashsalt); + } - ALLOC(sizeof(XMLParserObject), "create expatparser"); - + if (target) { + Py_INCREF(target); diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c -index 2b4d312..1f8c0d7 100644 +index adc9b6cde8..948ab1b703 100644 --- a/Modules/pyexpat.c +++ b/Modules/pyexpat.c -@@ -2042,6 +2042,11 @@ MODULE_INITFUNC(void) - capi.SetProcessingInstructionHandler = XML_SetProcessingInstructionHandler; - capi.SetUnknownEncodingHandler = XML_SetUnknownEncodingHandler; - capi.SetUserData = XML_SetUserData; +@@ -1882,6 +1882,11 @@ MODULE_INITFUNC(void) + capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler; + capi.SetEncoding = XML_SetEncoding; + capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler; +#if XML_COMBINED_VERSION >= 20100 + capi.SetHashSalt = XML_SetHashSalt; +#else @@ -92,5 +91,5 @@ index 2b4d312..1f8c0d7 100644 /* export using capsule */ capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); -- -2.7.4 +2.22.0.vfs.1.1.57.gbaf16c8 diff --git a/meta/recipes-devtools/python/python3/CVE-2018-20406.patch b/meta/recipes-devtools/python/python3/CVE-2018-20406.patch new file mode 100644 index 0000000000..b69e0c4d6b --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2018-20406.patch @@ -0,0 +1,217 @@ +From 3c7fd2b2729e3ebcf7877e7a32b3bbabf907a38d Mon Sep 17 00:00:00 2001 +From: Victor Stinner <vstinner@redhat.com> +Date: Tue, 26 Feb 2019 01:42:39 +0100 +Subject: [PATCH] closes bpo-34656: Avoid relying on signed overflow in _pickle + memos. (GH-9261) (#11869) + +(cherry picked from commit a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd) + +CVE: CVE-2018-20406 +Upstream-Status: Backport +[https://github.com/python/cpython/commit/ef33dd6036aafbd3f06c1d56e2b1a81dae3da63c] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + Modules/_pickle.c | 63 ++++++++++++++++++++++++----------------------- + 1 file changed, 32 insertions(+), 31 deletions(-) + +diff --git a/Modules/_pickle.c b/Modules/_pickle.c +index 0f62b1c019..fcb9e87899 100644 +--- a/Modules/_pickle.c ++++ b/Modules/_pickle.c +@@ -527,9 +527,9 @@ typedef struct { + } PyMemoEntry; + + typedef struct { +- Py_ssize_t mt_mask; +- Py_ssize_t mt_used; +- Py_ssize_t mt_allocated; ++ size_t mt_mask; ++ size_t mt_used; ++ size_t mt_allocated; + PyMemoEntry *mt_table; + } PyMemoTable; + +@@ -573,8 +573,8 @@ typedef struct UnpicklerObject { + /* The unpickler memo is just an array of PyObject *s. Using a dict + is unnecessary, since the keys are contiguous ints. */ + PyObject **memo; +- Py_ssize_t memo_size; /* Capacity of the memo array */ +- Py_ssize_t memo_len; /* Number of objects in the memo */ ++ size_t memo_size; /* Capacity of the memo array */ ++ size_t memo_len; /* Number of objects in the memo */ + + PyObject *pers_func; /* persistent_load() method, can be NULL. */ + +@@ -658,7 +658,6 @@ PyMemoTable_New(void) + static PyMemoTable * + PyMemoTable_Copy(PyMemoTable *self) + { +- Py_ssize_t i; + PyMemoTable *new = PyMemoTable_New(); + if (new == NULL) + return NULL; +@@ -675,7 +674,7 @@ PyMemoTable_Copy(PyMemoTable *self) + PyErr_NoMemory(); + return NULL; + } +- for (i = 0; i < self->mt_allocated; i++) { ++ for (size_t i = 0; i < self->mt_allocated; i++) { + Py_XINCREF(self->mt_table[i].me_key); + } + memcpy(new->mt_table, self->mt_table, +@@ -721,7 +720,7 @@ _PyMemoTable_Lookup(PyMemoTable *self, PyObject *key) + { + size_t i; + size_t perturb; +- size_t mask = (size_t)self->mt_mask; ++ size_t mask = self->mt_mask; + PyMemoEntry *table = self->mt_table; + PyMemoEntry *entry; + Py_hash_t hash = (Py_hash_t)key >> 3; +@@ -743,22 +742,24 @@ _PyMemoTable_Lookup(PyMemoTable *self, PyObject *key) + + /* Returns -1 on failure, 0 on success. */ + static int +-_PyMemoTable_ResizeTable(PyMemoTable *self, Py_ssize_t min_size) ++_PyMemoTable_ResizeTable(PyMemoTable *self, size_t min_size) + { + PyMemoEntry *oldtable = NULL; + PyMemoEntry *oldentry, *newentry; +- Py_ssize_t new_size = MT_MINSIZE; +- Py_ssize_t to_process; ++ size_t new_size = MT_MINSIZE; ++ size_t to_process; + + assert(min_size > 0); + +- /* Find the smallest valid table size >= min_size. */ +- while (new_size < min_size && new_size > 0) +- new_size <<= 1; +- if (new_size <= 0) { ++ if (min_size > PY_SSIZE_T_MAX) { + PyErr_NoMemory(); + return -1; + } ++ ++ /* Find the smallest valid table size >= min_size. */ ++ while (new_size < min_size) { ++ new_size <<= 1; ++ } + /* new_size needs to be a power of two. */ + assert((new_size & (new_size - 1)) == 0); + +@@ -808,6 +809,7 @@ static int + PyMemoTable_Set(PyMemoTable *self, PyObject *key, Py_ssize_t value) + { + PyMemoEntry *entry; ++ size_t desired_size; + + assert(key != NULL); + +@@ -831,10 +833,12 @@ PyMemoTable_Set(PyMemoTable *self, PyObject *key, Py_ssize_t value) + * Very large memo tables (over 50K items) use doubling instead. + * This may help applications with severe memory constraints. + */ +- if (!(self->mt_used * 3 >= (self->mt_mask + 1) * 2)) ++ if (SIZE_MAX / 3 >= self->mt_used && self->mt_used * 3 < self->mt_allocated * 2) { + return 0; +- return _PyMemoTable_ResizeTable(self, +- (self->mt_used > 50000 ? 2 : 4) * self->mt_used); ++ } ++ // self->mt_used is always < PY_SSIZE_T_MAX, so this can't overflow. ++ desired_size = (self->mt_used > 50000 ? 2 : 4) * self->mt_used; ++ return _PyMemoTable_ResizeTable(self, desired_size); + } + + #undef MT_MINSIZE +@@ -1273,9 +1277,9 @@ _Unpickler_Readline(UnpicklerObject *self, char **result) + /* Returns -1 (with an exception set) on failure, 0 on success. The memo array + will be modified in place. */ + static int +-_Unpickler_ResizeMemoList(UnpicklerObject *self, Py_ssize_t new_size) ++_Unpickler_ResizeMemoList(UnpicklerObject *self, size_t new_size) + { +- Py_ssize_t i; ++ size_t i; + + assert(new_size > self->memo_size); + +@@ -1292,9 +1296,9 @@ _Unpickler_ResizeMemoList(UnpicklerObject *self, Py_ssize_t new_size) + + /* Returns NULL if idx is out of bounds. */ + static PyObject * +-_Unpickler_MemoGet(UnpicklerObject *self, Py_ssize_t idx) ++_Unpickler_MemoGet(UnpicklerObject *self, size_t idx) + { +- if (idx < 0 || idx >= self->memo_size) ++ if (idx >= self->memo_size) + return NULL; + + return self->memo[idx]; +@@ -1303,7 +1307,7 @@ _Unpickler_MemoGet(UnpicklerObject *self, Py_ssize_t idx) + /* Returns -1 (with an exception set) on failure, 0 on success. + This takes its own reference to `value`. */ + static int +-_Unpickler_MemoPut(UnpicklerObject *self, Py_ssize_t idx, PyObject *value) ++_Unpickler_MemoPut(UnpicklerObject *self, size_t idx, PyObject *value) + { + PyObject *old_item; + +@@ -4194,14 +4198,13 @@ static PyObject * + _pickle_PicklerMemoProxy_copy_impl(PicklerMemoProxyObject *self) + /*[clinic end generated code: output=bb83a919d29225ef input=b73043485ac30b36]*/ + { +- Py_ssize_t i; + PyMemoTable *memo; + PyObject *new_memo = PyDict_New(); + if (new_memo == NULL) + return NULL; + + memo = self->pickler->memo; +- for (i = 0; i < memo->mt_allocated; ++i) { ++ for (size_t i = 0; i < memo->mt_allocated; ++i) { + PyMemoEntry entry = memo->mt_table[i]; + if (entry.me_key != NULL) { + int status; +@@ -6620,7 +6623,7 @@ static PyObject * + _pickle_UnpicklerMemoProxy_copy_impl(UnpicklerMemoProxyObject *self) + /*[clinic end generated code: output=e12af7e9bc1e4c77 input=97769247ce032c1d]*/ + { +- Py_ssize_t i; ++ size_t i; + PyObject *new_memo = PyDict_New(); + if (new_memo == NULL) + return NULL; +@@ -6771,8 +6774,7 @@ static int + Unpickler_set_memo(UnpicklerObject *self, PyObject *obj) + { + PyObject **new_memo; +- Py_ssize_t new_memo_size = 0; +- Py_ssize_t i; ++ size_t new_memo_size = 0; + + if (obj == NULL) { + PyErr_SetString(PyExc_TypeError, +@@ -6789,7 +6791,7 @@ Unpickler_set_memo(UnpicklerObject *self, PyObject *obj) + if (new_memo == NULL) + return -1; + +- for (i = 0; i < new_memo_size; i++) { ++ for (size_t i = 0; i < new_memo_size; i++) { + Py_XINCREF(unpickler->memo[i]); + new_memo[i] = unpickler->memo[i]; + } +@@ -6837,8 +6839,7 @@ Unpickler_set_memo(UnpicklerObject *self, PyObject *obj) + + error: + if (new_memo_size) { +- i = new_memo_size; +- while (--i >= 0) { ++ for (size_t i = new_memo_size - 1; i != SIZE_MAX; i--) { + Py_XDECREF(new_memo[i]); + } + PyMem_FREE(new_memo); +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/python/python3/CVE-2018-20852.patch b/meta/recipes-devtools/python/python3/CVE-2018-20852.patch new file mode 100644 index 0000000000..82a114f29d --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2018-20852.patch @@ -0,0 +1,129 @@ +From 31c16d62fc762ab87e66e7f47e36dbfcfc8b5224 Mon Sep 17 00:00:00 2001 +From: Xtreak <tir.karthi@gmail.com> +Date: Sun, 17 Mar 2019 05:33:39 +0530 +Subject: [PATCH] [3.5] bpo-35121: prefix dot in domain for proper subdomain + validation (GH-10258) (#12281) + +Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan. +(cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14) + +Co-authored-by: Xtreak <tir.karthi@gmail.com> + +CVE: CVE-2018-20852 +Upstream-Status: Backport +[https://github.com/python/cpython/commit/4749f1b69000259e23b4cc6f63c542a9bdc62f1b] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + Lib/http/cookiejar.py | 13 ++++++-- + Lib/test/test_http_cookiejar.py | 30 +++++++++++++++++++ + .../2018-10-31-15-39-17.bpo-35121.EgHv9k.rst | 4 +++ + 3 files changed, 45 insertions(+), 2 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst + +diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py +index 6d4572af03..1cc9378ae4 100644 +--- a/Lib/http/cookiejar.py ++++ b/Lib/http/cookiejar.py +@@ -1148,6 +1148,11 @@ class DefaultCookiePolicy(CookiePolicy): + req_host, erhn = eff_request_host(request) + domain = cookie.domain + ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't + if (cookie.version == 0 and + (self.strict_ns_domain & self.DomainStrictNonDomain) and +@@ -1160,7 +1165,7 @@ class DefaultCookiePolicy(CookiePolicy): + _debug(" effective request-host name %s does not domain-match " + "RFC 2965 cookie domain %s", erhn, domain) + return False +- if cookie.version == 0 and not ("."+erhn).endswith(domain): ++ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): + _debug(" request-host %s does not match Netscape cookie domain " + "%s", req_host, domain) + return False +@@ -1174,7 +1179,11 @@ class DefaultCookiePolicy(CookiePolicy): + req_host = "."+req_host + if not erhn.startswith("."): + erhn = "."+erhn +- if not (req_host.endswith(domain) or erhn.endswith(domain)): ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): + #_debug(" request domain %s does not match cookie domain %s", + # req_host, domain) + return False +diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py +index 49c01ae489..e67e6ae780 100644 +--- a/Lib/test/test_http_cookiejar.py ++++ b/Lib/test/test_http_cookiejar.py +@@ -417,6 +417,7 @@ class CookieTests(unittest.TestCase): + ("http://foo.bar.com/", ".foo.bar.com", True), + ("http://foo.bar.com/", "foo.bar.com", True), + ("http://foo.bar.com/", ".bar.com", True), ++ ("http://foo.bar.com/", "bar.com", True), + ("http://foo.bar.com/", "com", True), + ("http://foo.com/", "rhubarb.foo.com", False), + ("http://foo.com/", ".foo.com", True), +@@ -427,6 +428,8 @@ class CookieTests(unittest.TestCase): + ("http://foo/", "foo", True), + ("http://foo/", "foo.local", True), + ("http://foo/", ".local", True), ++ ("http://barfoo.com", ".foo.com", False), ++ ("http://barfoo.com", "foo.com", False), + ]: + request = urllib.request.Request(url) + r = pol.domain_return_ok(domain, request) +@@ -961,6 +964,33 @@ class CookieTests(unittest.TestCase): + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + ++ c.clear() ++ ++ pol.set_blocked_domains([]) ++ req = urllib.request.Request("http://acme.com/") ++ res = FakeResponse(headers, "http://acme.com/") ++ cookies = c.make_cookies(res, req) ++ c.extract_cookies(res, req) ++ self.assertEqual(len(c), 1) ++ ++ req = urllib.request.Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertTrue(req.has_header("Cookie")) ++ ++ req = urllib.request.Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(pol.return_ok(cookies[0], req)) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ p = pol.set_blocked_domains(["acme.com"]) ++ req = urllib.request.Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ req = urllib.request.Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ + def test_secure(self): + for ns in True, False: + for whitespace in " ", "": +diff --git a/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst +new file mode 100644 +index 0000000000..d2eb8f1f35 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst +@@ -0,0 +1,4 @@ ++Don't send cookies of domain A without Domain attribute to domain B ++when domain A is a suffix match of domain B while using a cookiejar ++with :class:`http.cookiejar.DefaultCookiePolicy` policy. Patch by ++Karthikeyan Singaravelan. +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/python/python3/CVE-2019-9636.patch b/meta/recipes-devtools/python/python3/CVE-2019-9636.patch new file mode 100644 index 0000000000..ce8eb666cf --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2019-9636.patch @@ -0,0 +1,154 @@ +From b0305339567b64e07df87620e97e4cb99332aef6 Mon Sep 17 00:00:00 2001 +From: Steve Dower <steve.dower@microsoft.com> +Date: Sun, 10 Mar 2019 21:59:24 -0700 +Subject: [PATCH] bpo-36216: Add check for characters in netloc that normalize + to separators (GH-12201) (#12223) + +CVE: CVE-2019-9636 +Upstream-Status: Backport +[https://github.com/python/cpython/commit/c0d95113b070799679bcb9dc49d4960d82e8bb08] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + Doc/library/urllib.parse.rst | 18 +++++++++++++++ + Lib/test/test_urlparse.py | 23 +++++++++++++++++++ + Lib/urllib/parse.py | 17 ++++++++++++++ + .../2019-03-06-09-38-40.bpo-36216.6q1m4a.rst | 3 +++ + 4 files changed, 61 insertions(+) + create mode 100644 Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst + +diff --git a/Doc/library/urllib.parse.rst b/Doc/library/urllib.parse.rst +index 6f722a8897..a4c6b6726e 100644 +--- a/Doc/library/urllib.parse.rst ++++ b/Doc/library/urllib.parse.rst +@@ -120,6 +120,11 @@ or on combining URL components into a URL string. + Unmatched square brackets in the :attr:`netloc` attribute will raise a + :exc:`ValueError`. + ++ Characters in the :attr:`netloc` attribute that decompose under NFKC ++ normalization (as used by the IDNA encoding) into any of ``/``, ``?``, ++ ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is ++ decomposed before parsing, no error will be raised. ++ + .. versionchanged:: 3.2 + Added IPv6 URL parsing capabilities. + +@@ -128,6 +133,10 @@ or on combining URL components into a URL string. + false), in accordance with :rfc:`3986`. Previously, a whitelist of + schemes that support fragments existed. + ++ .. versionchanged:: 3.5.7 ++ Characters that affect netloc parsing under NFKC normalization will ++ now raise :exc:`ValueError`. ++ + + .. function:: parse_qs(qs, keep_blank_values=False, strict_parsing=False, encoding='utf-8', errors='replace') + +@@ -236,6 +245,15 @@ or on combining URL components into a URL string. + Unmatched square brackets in the :attr:`netloc` attribute will raise a + :exc:`ValueError`. + ++ Characters in the :attr:`netloc` attribute that decompose under NFKC ++ normalization (as used by the IDNA encoding) into any of ``/``, ``?``, ++ ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is ++ decomposed before parsing, no error will be raised. ++ ++ .. versionchanged:: 3.5.7 ++ Characters that affect netloc parsing under NFKC normalization will ++ now raise :exc:`ValueError`. ++ + + .. function:: urlunsplit(parts) + +diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py +index e2cf1b7e0f..d0420b0e74 100644 +--- a/Lib/test/test_urlparse.py ++++ b/Lib/test/test_urlparse.py +@@ -1,3 +1,5 @@ ++import sys ++import unicodedata + import unittest + import urllib.parse + +@@ -970,6 +972,27 @@ class UrlParseTestCase(unittest.TestCase): + expected.append(name) + self.assertCountEqual(urllib.parse.__all__, expected) + ++ def test_urlsplit_normalization(self): ++ # Certain characters should never occur in the netloc, ++ # including under normalization. ++ # Ensure that ALL of them are detected and cause an error ++ illegal_chars = '/:#?@' ++ hex_chars = {'{:04X}'.format(ord(c)) for c in illegal_chars} ++ denorm_chars = [ ++ c for c in map(chr, range(128, sys.maxunicode)) ++ if (hex_chars & set(unicodedata.decomposition(c).split())) ++ and c not in illegal_chars ++ ] ++ # Sanity check that we found at least one such character ++ self.assertIn('\u2100', denorm_chars) ++ self.assertIn('\uFF03', denorm_chars) ++ ++ for scheme in ["http", "https", "ftp"]: ++ for c in denorm_chars: ++ url = "{}://netloc{}false.netloc/path".format(scheme, c) ++ with self.subTest(url=url, char='{:04X}'.format(ord(c))): ++ with self.assertRaises(ValueError): ++ urllib.parse.urlsplit(url) + + class Utility_Tests(unittest.TestCase): + """Testcase to test the various utility functions in the urllib.""" +diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py +index 62e8ddf04b..7ba2b445f5 100644 +--- a/Lib/urllib/parse.py ++++ b/Lib/urllib/parse.py +@@ -327,6 +327,21 @@ def _splitnetloc(url, start=0): + delim = min(delim, wdelim) # use earliest delim position + return url[start:delim], url[delim:] # return (domain, rest) + ++def _checknetloc(netloc): ++ if not netloc or not any(ord(c) > 127 for c in netloc): ++ return ++ # looking for characters like \u2100 that expand to 'a/c' ++ # IDNA uses NFKC equivalence, so normalize for this check ++ import unicodedata ++ netloc2 = unicodedata.normalize('NFKC', netloc) ++ if netloc == netloc2: ++ return ++ _, _, netloc = netloc.rpartition('@') # anything to the left of '@' is okay ++ for c in '/?#@:': ++ if c in netloc2: ++ raise ValueError("netloc '" + netloc2 + "' contains invalid " + ++ "characters under NFKC normalization") ++ + def urlsplit(url, scheme='', allow_fragments=True): + """Parse a URL into 5 components: + <scheme>://<netloc>/<path>?<query>#<fragment> +@@ -356,6 +371,7 @@ def urlsplit(url, scheme='', allow_fragments=True): + url, fragment = url.split('#', 1) + if '?' in url: + url, query = url.split('?', 1) ++ _checknetloc(netloc) + v = SplitResult(scheme, netloc, url, query, fragment) + _parse_cache[key] = v + return _coerce_result(v) +@@ -379,6 +395,7 @@ def urlsplit(url, scheme='', allow_fragments=True): + url, fragment = url.split('#', 1) + if '?' in url: + url, query = url.split('?', 1) ++ _checknetloc(netloc) + v = SplitResult(scheme, netloc, url, query, fragment) + _parse_cache[key] = v + return _coerce_result(v) +diff --git a/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst b/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst +new file mode 100644 +index 0000000000..5546394157 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst +@@ -0,0 +1,3 @@ ++Changes urlsplit() to raise ValueError when the URL contains characters that ++decompose under IDNA encoding (NFKC-normalization) into characters that ++affect how the URL is parsed. +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/python/python3/CVE-2019-9740.patch b/meta/recipes-devtools/python/python3/CVE-2019-9740.patch new file mode 100644 index 0000000000..8370901696 --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2019-9740.patch @@ -0,0 +1,155 @@ +From afe3a4975cf93c97e5d6eb8800e48f368011d37a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz> +Date: Sun, 14 Jul 2019 11:07:11 +0200 +Subject: [PATCH] bpo-30458: Disallow control chars in http URLs. (GH-12755) + (#13207) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. + +Disable https related urllib tests on a build without ssl (GH-13032) +These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. + +Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044) + +Co-Authored-By: Miro Hrončok <miro@hroncok.cz> +Upstream-Status: Backport[https://github.com/python/cpython/commit/afe3a4975cf93c97e5d6eb8800e48f368011d37a] +CVE: CVE-2019-9740 +CVE: CVE-2019-9947 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- + Lib/http/client.py | 16 ++++++ + Lib/test/test_urllib.py | 55 +++++++++++++++++++ + Lib/test/test_xmlrpc.py | 8 ++- + .../2019-04-10-08-53-30.bpo-30458.51E-DA.rst | 1 + + 4 files changed, 79 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst + +diff --git a/Lib/http/client.py b/Lib/http/client.py +index 352c1017adce..76b9be69a374 100644 +--- a/Lib/http/client.py ++++ b/Lib/http/client.py +@@ -141,6 +141,16 @@ + _is_legal_header_name = re.compile(rb'[^:\s][^:\r\n]*').fullmatch + _is_illegal_header_value = re.compile(rb'\n(?![ \t])|\r(?![ \t\n])').search + ++# These characters are not allowed within HTTP URL paths. ++# See https://tools.ietf.org/html/rfc3986#section-3.3 and the ++# https://tools.ietf.org/html/rfc3986#appendix-A pchar definition. ++# Prevents CVE-2019-9740. Includes control characters such as \r\n. ++# We don't restrict chars above \x7f as putrequest() limits us to ASCII. ++_contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f]') ++# Arguably only these _should_ allowed: ++# _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$") ++# We are more lenient for assumed real world compatibility purposes. ++ + # We always set the Content-Length header for these methods because some + # servers will otherwise respond with a 411 + _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'} +@@ -978,6 +988,12 @@ def putrequest(self, method, url, skip_host=False, + self._method = method + if not url: + url = '/' ++ # Prevent CVE-2019-9740. ++ match = _contains_disallowed_url_pchar_re.search(url) ++ if match: ++ raise InvalidURL("URL can't contain control characters. {!r} " ++ "(found at least {!r})".format(url, ++ match.group())) + request = '%s %s %s' % (method, url, self._http_vsn_str) + + # Non-ASCII characters should have been eliminated earlier +diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py +index 3afb1312de32..1e2c622e29fd 100644 +--- a/Lib/test/test_urllib.py ++++ b/Lib/test/test_urllib.py +@@ -330,6 +330,61 @@ def test_willclose(self): + finally: + self.unfakehttp() + ++ @unittest.skipUnless(ssl, "ssl module required") ++ def test_url_with_control_char_rejected(self): ++ for char_no in list(range(0, 0x21)) + [0x7f]: ++ char = chr(char_no) ++ schemeless_url = "//localhost:7777/test{}/".format(char) ++ self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.") ++ try: ++ # We explicitly test urllib.request.urlopen() instead of the top ++ # level 'def urlopen()' function defined in this... (quite ugly) ++ # test suite. They use different url opening codepaths. Plain ++ # urlopen uses FancyURLOpener which goes via a codepath that ++ # calls urllib.parse.quote() on the URL which makes all of the ++ # above attempts at injection within the url _path_ safe. ++ escaped_char_repr = repr(char).replace('\\', r'\\') ++ InvalidURL = http.client.InvalidURL ++ with self.assertRaisesRegex( ++ InvalidURL, ++ "contain control.*{}".format(escaped_char_repr)): ++ urllib.request.urlopen("http:{}".format(schemeless_url)) ++ with self.assertRaisesRegex( ++ InvalidURL, ++ "contain control.*{}".format(escaped_char_repr)): ++ urllib.request.urlopen("https:{}".format(schemeless_url)) ++ # This code path quotes the URL so there is no injection. ++ resp = urlopen("http:{}".format(schemeless_url)) ++ self.assertNotIn(char, resp.geturl()) ++ finally: ++ self.unfakehttp() ++ ++ @unittest.skipUnless(ssl, "ssl module required") ++ def test_url_with_newline_header_injection_rejected(self): ++ self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.") ++ host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123" ++ schemeless_url = "//" + host + ":8080/test/?test=a" ++ try: ++ # We explicitly test urllib.request.urlopen() instead of the top ++ # level 'def urlopen()' function defined in this... (quite ugly) ++ # test suite. They use different url opening codepaths. Plain ++ # urlopen uses FancyURLOpener which goes via a codepath that ++ # calls urllib.parse.quote() on the URL which makes all of the ++ # above attempts at injection within the url _path_ safe. ++ InvalidURL = http.client.InvalidURL ++ with self.assertRaisesRegex( ++ InvalidURL, r"contain control.*\\r.*(found at least . .)"): ++ urllib.request.urlopen("http:{}".format(schemeless_url)) ++ with self.assertRaisesRegex(InvalidURL, r"contain control.*\\n"): ++ urllib.request.urlopen("https:{}".format(schemeless_url)) ++ # This code path quotes the URL so there is no injection. ++ resp = urlopen("http:{}".format(schemeless_url)) ++ self.assertNotIn(' ', resp.geturl()) ++ self.assertNotIn('\r', resp.geturl()) ++ self.assertNotIn('\n', resp.geturl()) ++ finally: ++ self.unfakehttp() ++ + def test_read_0_9(self): + # "0.9" response accepted (but not "simple responses" without + # a status line) +diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py +index c2de057ecbfa..99e510fcee86 100644 +--- a/Lib/test/test_xmlrpc.py ++++ b/Lib/test/test_xmlrpc.py +@@ -896,7 +896,13 @@ def test_unicode_host(self): + def test_partial_post(self): + # Check that a partial POST doesn't make the server loop: issue #14001. + conn = http.client.HTTPConnection(ADDR, PORT) +- conn.request('POST', '/RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nbye') ++ conn.send('POST /RPC2 HTTP/1.0\r\n' ++ 'Content-Length: 100\r\n\r\n' ++ 'bye HTTP/1.1\r\n' ++ 'Host: {}:{}\r\n' ++ 'Accept-Encoding: identity\r\n' ++ 'Content-Length: 0\r\n\r\n' ++ .format(ADDR, PORT).encode('ascii')) + conn.close() + + def test_context_manager(self): +diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst +new file mode 100644 +index 000000000000..ed8027fb4d64 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst +@@ -0,0 +1 @@ ++Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. diff --git a/meta/recipes-devtools/python/python3_3.5.6.bb b/meta/recipes-devtools/python/python3_3.5.6.bb index 6aa6df658c..b2f8a3d034 100644 --- a/meta/recipes-devtools/python/python3_3.5.6.bb +++ b/meta/recipes-devtools/python/python3_3.5.6.bb @@ -43,6 +43,11 @@ SRC_URI += "\ file://0004-bpo-33570-TLS-1.3-ciphers-for-OpenSSL-1.1.1-GH-6976.patch \ file://0005-bpo-30714-ALPN-changes-for-OpenSSL-1.1.0f-2305.patch \ file://run-ptest \ + file://CVE-2019-9740.patch \ + file://CVE-2018-14647.patch \ + file://CVE-2018-20406.patch \ + file://CVE-2018-20852.patch \ + file://CVE-2019-9636.patch \ " inherit multilib_header python3native update-alternatives qemu ptest diff --git a/meta/recipes-devtools/python/python_2.7.15.bb b/meta/recipes-devtools/python/python_2.7.16.bb index 3f361ae7c4..16b1744704 100644 --- a/meta/recipes-devtools/python/python_2.7.15.bb +++ b/meta/recipes-devtools/python/python_2.7.16.bb @@ -31,8 +31,12 @@ SRC_URI += "\ file://pass-missing-libraries-to-Extension-for-mul.patch \ file://support_SOURCE_DATE_EPOCH_in_py_compile_2.7.patch \ file://float-endian.patch \ - file://0001-closes-bpo-34540-Convert-shutil._call_external_zip-t.patch \ - file://0001-2.7-bpo-34623-Use-XML_SetHashSalt-in-_elementtree-GH.patch \ + file://bpo-35907-cve-2019-9948.patch \ + file://bpo-35907-cve-2019-9948-fix.patch \ + file://bpo-36216-cve-2019-9636.patch \ + file://bpo-36216-cve-2019-9636-fix.patch \ + file://bpo-35121-cve-2018-20852.patch \ + file://bpo-30458-cve-2019-9740.patch \ " S = "${WORKDIR}/Python-${PV}" diff --git a/meta/recipes-devtools/qemu/qemu/0001-linux-user-assume-__NR_gettid-always-exists.patch b/meta/recipes-devtools/qemu/qemu/0001-linux-user-assume-__NR_gettid-always-exists.patch new file mode 100644 index 0000000000..767b200ba0 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0001-linux-user-assume-__NR_gettid-always-exists.patch @@ -0,0 +1,49 @@ +From 184943d827ce09375284e6fbb9fd5eeb9e369529 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com> +Date: Wed, 20 Mar 2019 16:18:41 +0000 +Subject: [PATCH] linux-user: assume __NR_gettid always exists +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The gettid syscall was introduced in Linux 2.4.11. This is old enough +that we can assume it always exists and thus not bother with the +conditional backcompat logic. + +Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> +Reviewed-by: Richard Henderson <richard.henderson@linaro.org> +Reviewed-by: Laurent Vivier <laurent@vivier.eu> +Message-Id: <20190320161842.13908-2-berrange@redhat.com> +Signed-off-by: Laurent Vivier <laurent@vivier.eu> + +Upstream-Status: Backport +dependancy patch for fix + +Signed-off-by: Armin Kuster <akuster808@gmail.com> + +--- + + + linux-user/syscall.c | 8 -------- + 1 file changed, 8 deletions(-) + +Index: qemu-3.0.0/linux-user/syscall.c +=================================================================== +--- qemu-3.0.0.orig/linux-user/syscall.c ++++ qemu-3.0.0/linux-user/syscall.c +@@ -251,15 +251,7 @@ static type name (type1 arg1,type2 arg2, + #define TARGET_NR__llseek TARGET_NR_llseek + #endif + +-#ifdef __NR_gettid + _syscall0(int, gettid) +-#else +-/* This is a replacement for the host gettid() and must return a host +- errno. */ +-static int gettid(void) { +- return -ENOSYS; +-} +-#endif + + /* For the 64-bit guest on 32-bit host case we must emulate + * getdents using getdents64, because otherwise the host diff --git a/meta/recipes-devtools/qemu/qemu/0001-linux-user-rename-gettid-to-sys_gettid-to-avoid-clas.patch b/meta/recipes-devtools/qemu/qemu/0001-linux-user-rename-gettid-to-sys_gettid-to-avoid-clas.patch new file mode 100644 index 0000000000..ab3b71d7c6 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0001-linux-user-rename-gettid-to-sys_gettid-to-avoid-clas.patch @@ -0,0 +1,95 @@ +From 71ba74f67eaca21b0cc9d96f534ad3b9a7161400 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com> +Date: Wed, 20 Mar 2019 16:18:42 +0000 +Subject: [PATCH] linux-user: rename gettid() to sys_gettid() to avoid clash + with glibc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The glibc-2.29.9000-6.fc31.x86_64 package finally includes the gettid() +function as part of unistd.h when __USE_GNU is defined. This clashes +with linux-user code which unconditionally defines this function name +itself. + +/home/berrange/src/virt/qemu/linux-user/syscall.c:253:16: error: static declaration of ‘gettid’ follows non-static declaration + 253 | _syscall0(int, gettid) + | ^~~~~~ +/home/berrange/src/virt/qemu/linux-user/syscall.c:184:13: note: in definition of macro ‘_syscall0’ + 184 | static type name (void) \ + | ^~~~ +In file included from /usr/include/unistd.h:1170, + from /home/berrange/src/virt/qemu/include/qemu/osdep.h:107, + from /home/berrange/src/virt/qemu/linux-user/syscall.c:20: +/usr/include/bits/unistd_ext.h:34:16: note: previous declaration of ‘gettid’ was here + 34 | extern __pid_t gettid (void) __THROW; + | ^~~~~~ + CC aarch64-linux-user/linux-user/signal.o +make[1]: *** [/home/berrange/src/virt/qemu/rules.mak:69: linux-user/syscall.o] Error 1 +make[1]: *** Waiting for unfinished jobs.... +make: *** [Makefile:449: subdir-aarch64-linux-user] Error 2 + +While we could make our definition conditional and rely on glibc's impl, +this patch simply renames our definition to sys_gettid() which is a +common pattern in this file. + +Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> +Reviewed-by: Richard Henderson <richard.henderson@linaro.org> +Reviewed-by: Laurent Vivier <laurent@vivier.eu> +Message-Id: <20190320161842.13908-3-berrange@redhat.com> +Signed-off-by: Laurent Vivier <laurent@vivier.eu> + +Upstream-status: Backport + +Fixes issue found on tumbleweed-ty-1 +Yocto bug: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13577 +Signed-off-by: Armin Kuster <akuster808@gmail.com> + +--- + linux-user/syscall.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +Index: qemu-3.0.0/linux-user/syscall.c +=================================================================== +--- qemu-3.0.0.orig/linux-user/syscall.c ++++ qemu-3.0.0/linux-user/syscall.c +@@ -251,7 +251,8 @@ static type name (type1 arg1,type2 arg2, + #define TARGET_NR__llseek TARGET_NR_llseek + #endif + +-_syscall0(int, gettid) ++#define __NR_sys_gettid __NR_gettid ++_syscall0(int, sys_gettid) + + /* For the 64-bit guest on 32-bit host case we must emulate + * getdents using getdents64, because otherwise the host +@@ -6483,7 +6484,7 @@ static void *clone_func(void *arg) + cpu = ENV_GET_CPU(env); + thread_cpu = cpu; + ts = (TaskState *)cpu->opaque; +- info->tid = gettid(); ++ info->tid = sys_gettid(); + task_settid(ts); + if (info->child_tidptr) + put_user_u32(info->tid, info->child_tidptr); +@@ -6628,9 +6629,9 @@ static int do_fork(CPUArchState *env, un + mapping. We can't repeat the spinlock hack used above because + the child process gets its own copy of the lock. */ + if (flags & CLONE_CHILD_SETTID) +- put_user_u32(gettid(), child_tidptr); ++ put_user_u32(sys_gettid(), child_tidptr); + if (flags & CLONE_PARENT_SETTID) +- put_user_u32(gettid(), parent_tidptr); ++ put_user_u32(sys_gettid(), parent_tidptr); + ts = (TaskState *)cpu->opaque; + if (flags & CLONE_SETTLS) + cpu_set_tls (env, newtls); +@@ -11876,7 +11877,7 @@ abi_long do_syscall(void *cpu_env, int n + break; + #endif + case TARGET_NR_gettid: +- ret = get_errno(gettid()); ++ ret = get_errno(sys_gettid()); + break; + #ifdef TARGET_NR_readahead + case TARGET_NR_readahead: diff --git a/meta/recipes-devtools/qemu/qemu/0013-cpus.c-Add-error-messages-when-qemi_cpu_kick_thread-.patch b/meta/recipes-devtools/qemu/qemu/0013-cpus.c-Add-error-messages-when-qemi_cpu_kick_thread-.patch index 8a9141acde..03ec2c90e1 100644 --- a/meta/recipes-devtools/qemu/qemu/0013-cpus.c-Add-error-messages-when-qemi_cpu_kick_thread-.patch +++ b/meta/recipes-devtools/qemu/qemu/0013-cpus.c-Add-error-messages-when-qemi_cpu_kick_thread-.patch @@ -18,11 +18,11 @@ Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> 2 files changed, 29 insertions(+) create mode 100644 custom_debug.h -diff --git a/cpus.c b/cpus.c -index 38eba8bff3..b84a60a4f3 100644 ---- a/cpus.c -+++ b/cpus.c -@@ -1690,6 +1690,8 @@ static void *qemu_tcg_cpu_thread_fn(void *arg) +Index: qemu-3.0.0/cpus.c +=================================================================== +--- qemu-3.0.0.orig/cpus.c ++++ qemu-3.0.0/cpus.c +@@ -1693,6 +1693,8 @@ static void *qemu_tcg_cpu_thread_fn(void return NULL; } @@ -31,7 +31,7 @@ index 38eba8bff3..b84a60a4f3 100644 static void qemu_cpu_kick_thread(CPUState *cpu) { #ifndef _WIN32 -@@ -1702,6 +1704,9 @@ static void qemu_cpu_kick_thread(CPUState *cpu) +@@ -1705,6 +1707,9 @@ static void qemu_cpu_kick_thread(CPUStat err = pthread_kill(cpu->thread->thread, SIG_IPI); if (err) { fprintf(stderr, "qemu:%s: %s", __func__, strerror(err)); @@ -41,11 +41,10 @@ index 38eba8bff3..b84a60a4f3 100644 exit(1); } #else /* _WIN32 */ -diff --git a/custom_debug.h b/custom_debug.h -new file mode 100644 -index 0000000000..f029e45547 +Index: qemu-3.0.0/custom_debug.h +=================================================================== --- /dev/null -+++ b/custom_debug.h ++++ qemu-3.0.0/custom_debug.h @@ -0,0 +1,24 @@ +#include <execinfo.h> +#include <stdio.h> diff --git a/meta/recipes-devtools/qemu/qemu/0014-linux-user-fix-to-handle-variably-sized-SIOCGSTAMP-w.patch b/meta/recipes-devtools/qemu/qemu/0014-linux-user-fix-to-handle-variably-sized-SIOCGSTAMP-w.patch new file mode 100644 index 0000000000..31a7c9485d --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0014-linux-user-fix-to-handle-variably-sized-SIOCGSTAMP-w.patch @@ -0,0 +1,336 @@ +From 8104018ba4c66e568d2583a3a0ee940851ee7471 Mon Sep 17 00:00:00 2001 +From: Daniel P. Berrangé <berrange@redhat.com> +Date: Tue, 23 Jul 2019 17:50:00 +0200 +Subject: [PATCH] linux-user: fix to handle variably sized SIOCGSTAMP with new + kernels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The SIOCGSTAMP symbol was previously defined in the +asm-generic/sockios.h header file. QEMU sees that header +indirectly via sys/socket.h + +In linux kernel commit 0768e17073dc527ccd18ed5f96ce85f9985e9115 +the asm-generic/sockios.h header no longer defines SIOCGSTAMP. +Instead it provides only SIOCGSTAMP_OLD, which only uses a +32-bit time_t on 32-bit architectures. + +The linux/sockios.h header then defines SIOCGSTAMP using +either SIOCGSTAMP_OLD or SIOCGSTAMP_NEW as appropriate. If +SIOCGSTAMP_NEW is used, then the tv_sec field is 64-bit even +on 32-bit architectures + +To cope with this we must now convert the old and new type from +the target to the host one. + +Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> +Signed-off-by: Laurent Vivier <laurent@vivier.eu> +Reviewed-by: Arnd Bergmann <arnd@arndb.de> +Message-Id: <20190718130641.15294-1-laurent@vivier.eu> +Signed-off-by: Laurent Vivier <laurent@vivier.eu> +Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> +--- +Uptream-status: Backport (upstream commit: 6d5d5dde9adb5acb32e6b8e3dfbf47fff0f308d2) + + linux-user/ioctls.h | 21 +++++- + linux-user/syscall.c | 140 +++++++++++++++++++++++++++++-------- + linux-user/syscall_defs.h | 30 +++++++- + linux-user/syscall_types.h | 6 -- + 4 files changed, 159 insertions(+), 38 deletions(-) + +Index: qemu-3.0.0/linux-user/ioctls.h +=================================================================== +--- qemu-3.0.0.orig/linux-user/ioctls.h ++++ qemu-3.0.0/linux-user/ioctls.h +@@ -173,8 +173,25 @@ + IOCTL(SIOCGRARP, IOC_R, MK_PTR(MK_STRUCT(STRUCT_arpreq))) + IOCTL(SIOCGIWNAME, IOC_W | IOC_R, MK_PTR(MK_STRUCT(STRUCT_char_ifreq))) + IOCTL(SIOCGPGRP, IOC_R, MK_PTR(TYPE_INT)) /* pid_t */ +- IOCTL(SIOCGSTAMP, IOC_R, MK_PTR(MK_STRUCT(STRUCT_timeval))) +- IOCTL(SIOCGSTAMPNS, IOC_R, MK_PTR(MK_STRUCT(STRUCT_timespec))) ++ ++ /* ++ * We can't use IOCTL_SPECIAL() because it will set ++ * host_cmd to XXX_OLD and XXX_NEW and these macros ++ * are not defined with kernel prior to 5.2. ++ * We must set host_cmd to the same value as in target_cmd ++ * otherwise the consistency check in syscall_init() ++ * will trigger an error. ++ * host_cmd is ignored by the do_ioctl_XXX() helpers. ++ * FIXME: create a macro to define this kind of entry ++ */ ++ { TARGET_SIOCGSTAMP_OLD, TARGET_SIOCGSTAMP_OLD, ++ "SIOCGSTAMP_OLD", IOC_R, do_ioctl_SIOCGSTAMP }, ++ { TARGET_SIOCGSTAMPNS_OLD, TARGET_SIOCGSTAMPNS_OLD, ++ "SIOCGSTAMPNS_OLD", IOC_R, do_ioctl_SIOCGSTAMPNS }, ++ { TARGET_SIOCGSTAMP_NEW, TARGET_SIOCGSTAMP_NEW, ++ "SIOCGSTAMP_NEW", IOC_R, do_ioctl_SIOCGSTAMP }, ++ { TARGET_SIOCGSTAMPNS_NEW, TARGET_SIOCGSTAMPNS_NEW, ++ "SIOCGSTAMPNS_NEW", IOC_R, do_ioctl_SIOCGSTAMPNS }, + + IOCTL(RNDGETENTCNT, IOC_R, MK_PTR(TYPE_INT)) + IOCTL(RNDADDTOENTCNT, IOC_W, MK_PTR(TYPE_INT)) +Index: qemu-3.0.0/linux-user/syscall.c +=================================================================== +--- qemu-3.0.0.orig/linux-user/syscall.c ++++ qemu-3.0.0/linux-user/syscall.c +@@ -37,6 +37,7 @@ + #include <sched.h> + #include <sys/timex.h> + #include <sys/socket.h> ++#include <linux/sockios.h> + #include <sys/un.h> + #include <sys/uio.h> + #include <poll.h> +@@ -1391,8 +1392,9 @@ static inline abi_long copy_from_user_ti + { + struct target_timeval *target_tv; + +- if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) ++ if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) { + return -TARGET_EFAULT; ++ } + + __get_user(tv->tv_sec, &target_tv->tv_sec); + __get_user(tv->tv_usec, &target_tv->tv_usec); +@@ -1407,8 +1409,26 @@ static inline abi_long copy_to_user_time + { + struct target_timeval *target_tv; + +- if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) ++ if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) { ++ return -TARGET_EFAULT; ++ } ++ ++ __put_user(tv->tv_sec, &target_tv->tv_sec); ++ __put_user(tv->tv_usec, &target_tv->tv_usec); ++ ++ unlock_user_struct(target_tv, target_tv_addr, 1); ++ ++ return 0; ++} ++ ++static inline abi_long copy_to_user_timeval64(abi_ulong target_tv_addr, ++ const struct timeval *tv) ++{ ++ struct target__kernel_sock_timeval *target_tv; ++ ++ if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) { + return -TARGET_EFAULT; ++ } + + __put_user(tv->tv_sec, &target_tv->tv_sec); + __put_user(tv->tv_usec, &target_tv->tv_usec); +@@ -1418,6 +1438,48 @@ static inline abi_long copy_to_user_time + return 0; + } + ++static inline abi_long target_to_host_timespec(struct timespec *host_ts, ++ abi_ulong target_addr) ++{ ++ struct target_timespec *target_ts; ++ ++ if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) { ++ return -TARGET_EFAULT; ++ } ++ __get_user(host_ts->tv_sec, &target_ts->tv_sec); ++ __get_user(host_ts->tv_nsec, &target_ts->tv_nsec); ++ unlock_user_struct(target_ts, target_addr, 0); ++ return 0; ++} ++ ++static inline abi_long host_to_target_timespec(abi_ulong target_addr, ++ struct timespec *host_ts) ++{ ++ struct target_timespec *target_ts; ++ ++ if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) { ++ return -TARGET_EFAULT; ++ } ++ __put_user(host_ts->tv_sec, &target_ts->tv_sec); ++ __put_user(host_ts->tv_nsec, &target_ts->tv_nsec); ++ unlock_user_struct(target_ts, target_addr, 1); ++ return 0; ++} ++ ++static inline abi_long host_to_target_timespec64(abi_ulong target_addr, ++ struct timespec *host_ts) ++{ ++ struct target__kernel_timespec *target_ts; ++ ++ if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) { ++ return -TARGET_EFAULT; ++ } ++ __put_user(host_ts->tv_sec, &target_ts->tv_sec); ++ __put_user(host_ts->tv_nsec, &target_ts->tv_nsec); ++ unlock_user_struct(target_ts, target_addr, 1); ++ return 0; ++} ++ + static inline abi_long copy_from_user_timezone(struct timezone *tz, + abi_ulong target_tz_addr) + { +@@ -5733,6 +5795,54 @@ static abi_long do_ioctl_kdsigaccept(con + return get_errno(safe_ioctl(fd, ie->host_cmd, sig)); + } + ++static abi_long do_ioctl_SIOCGSTAMP(const IOCTLEntry *ie, uint8_t *buf_temp, ++ int fd, int cmd, abi_long arg) ++{ ++ struct timeval tv; ++ abi_long ret; ++ ++ ret = get_errno(safe_ioctl(fd, SIOCGSTAMP, &tv)); ++ if (is_error(ret)) { ++ return ret; ++ } ++ ++ if (cmd == (int)TARGET_SIOCGSTAMP_OLD) { ++ if (copy_to_user_timeval(arg, &tv)) { ++ return -TARGET_EFAULT; ++ } ++ } else { ++ if (copy_to_user_timeval64(arg, &tv)) { ++ return -TARGET_EFAULT; ++ } ++ } ++ ++ return ret; ++} ++ ++static abi_long do_ioctl_SIOCGSTAMPNS(const IOCTLEntry *ie, uint8_t *buf_temp, ++ int fd, int cmd, abi_long arg) ++{ ++ struct timespec ts; ++ abi_long ret; ++ ++ ret = get_errno(safe_ioctl(fd, SIOCGSTAMPNS, &ts)); ++ if (is_error(ret)) { ++ return ret; ++ } ++ ++ if (cmd == (int)TARGET_SIOCGSTAMPNS_OLD) { ++ if (host_to_target_timespec(arg, &ts)) { ++ return -TARGET_EFAULT; ++ } ++ } else{ ++ if (host_to_target_timespec64(arg, &ts)) { ++ return -TARGET_EFAULT; ++ } ++ } ++ ++ return ret; ++} ++ + #ifdef TIOCGPTPEER + static abi_long do_ioctl_tiocgptpeer(const IOCTLEntry *ie, uint8_t *buf_temp, + int fd, int cmd, abi_long arg) +@@ -7106,32 +7216,6 @@ static inline abi_long target_ftruncate6 + } + #endif + +-static inline abi_long target_to_host_timespec(struct timespec *host_ts, +- abi_ulong target_addr) +-{ +- struct target_timespec *target_ts; +- +- if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) +- return -TARGET_EFAULT; +- __get_user(host_ts->tv_sec, &target_ts->tv_sec); +- __get_user(host_ts->tv_nsec, &target_ts->tv_nsec); +- unlock_user_struct(target_ts, target_addr, 0); +- return 0; +-} +- +-static inline abi_long host_to_target_timespec(abi_ulong target_addr, +- struct timespec *host_ts) +-{ +- struct target_timespec *target_ts; +- +- if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) +- return -TARGET_EFAULT; +- __put_user(host_ts->tv_sec, &target_ts->tv_sec); +- __put_user(host_ts->tv_nsec, &target_ts->tv_nsec); +- unlock_user_struct(target_ts, target_addr, 1); +- return 0; +-} +- + static inline abi_long target_to_host_itimerspec(struct itimerspec *host_itspec, + abi_ulong target_addr) + { +Index: qemu-3.0.0/linux-user/syscall_defs.h +=================================================================== +--- qemu-3.0.0.orig/linux-user/syscall_defs.h ++++ qemu-3.0.0/linux-user/syscall_defs.h +@@ -203,16 +203,34 @@ struct target_ip_mreq_source { + uint32_t imr_sourceaddr; + }; + ++#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32) ++struct target_timeval { ++ abi_long tv_sec; ++ abi_int tv_usec; ++}; ++#define target__kernel_sock_timeval target_timeval ++#else + struct target_timeval { + abi_long tv_sec; + abi_long tv_usec; + }; + ++struct target__kernel_sock_timeval { ++ abi_llong tv_sec; ++ abi_llong tv_usec; ++}; ++#endif ++ + struct target_timespec { + abi_long tv_sec; + abi_long tv_nsec; + }; + ++struct target__kernel_timespec { ++ abi_llong tv_sec; ++ abi_llong tv_nsec; ++}; ++ + struct target_timezone { + abi_int tz_minuteswest; + abi_int tz_dsttime; +@@ -738,8 +756,16 @@ struct target_pollfd { + #define TARGET_SIOCATMARK 0x8905 + #define TARGET_SIOCGPGRP 0x8904 + #endif +-#define TARGET_SIOCGSTAMP 0x8906 /* Get stamp (timeval) */ +-#define TARGET_SIOCGSTAMPNS 0x8907 /* Get stamp (timespec) */ ++#if defined(TARGET_SH4) ++#define TARGET_SIOCGSTAMP_OLD TARGET_IOR('s', 100, struct target_timeval) ++#define TARGET_SIOCGSTAMPNS_OLD TARGET_IOR('s', 101, struct target_timespec) ++#else ++#define TARGET_SIOCGSTAMP_OLD 0x8906 ++#define TARGET_SIOCGSTAMPNS_OLD 0x8907 ++#endif ++ ++#define TARGET_SIOCGSTAMP_NEW TARGET_IOR(0x89, 0x06, abi_llong[2]) ++#define TARGET_SIOCGSTAMPNS_NEW TARGET_IOR(0x89, 0x07, abi_llong[2]) + + /* Networking ioctls */ + #define TARGET_SIOCADDRT 0x890B /* add routing table entry */ +Index: qemu-3.0.0/linux-user/syscall_types.h +=================================================================== +--- qemu-3.0.0.orig/linux-user/syscall_types.h ++++ qemu-3.0.0/linux-user/syscall_types.h +@@ -14,12 +14,6 @@ STRUCT(serial_icounter_struct, + STRUCT(sockaddr, + TYPE_SHORT, MK_ARRAY(TYPE_CHAR, 14)) + +-STRUCT(timeval, +- MK_ARRAY(TYPE_LONG, 2)) +- +-STRUCT(timespec, +- MK_ARRAY(TYPE_LONG, 2)) +- + STRUCT(rtentry, + TYPE_ULONG, MK_STRUCT(STRUCT_sockaddr), MK_STRUCT(STRUCT_sockaddr), MK_STRUCT(STRUCT_sockaddr), + TYPE_SHORT, TYPE_SHORT, TYPE_ULONG, TYPE_PTRVOID, TYPE_SHORT, TYPE_PTRVOID, diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-10839.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-10839.patch index 7e1e442a41..81607c9505 100644 --- a/meta/recipes-devtools/qemu/qemu/CVE-2018-10839.patch +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-10839.patch @@ -19,7 +19,7 @@ Signed-off-by: Jason Wang <jasowang@redhat.com> Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commitdiff ;h=fdc89e90fac40c5ca2686733df17b6423fb8d8fb#patch1] -CVE: CVE-2018-10839 +CVE: CVE-2018-10839 CVE-2018-17958 Signed-off-by: Changqing Li <changqing.li@windriver.com> --- diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-16867.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-16867.patch new file mode 100644 index 0000000000..644459e5af --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-16867.patch @@ -0,0 +1,49 @@ +From 61f87388af0af72ad61dee00ddd267b8047049f2 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann <kraxel@redhat.com> +Date: Mon, 3 Dec 2018 11:10:45 +0100 +Subject: [PATCH] usb-mtp: outlaw slashes in filenames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Slash is unix directory separator, so they are not allowed in filenames. +Note this also stops the classic escape via "../". + +Fixes: CVE-2018-16867 +Reported-by: Michael Hanselmann <public@hansmi.ch> +Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> +Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> +Message-id: 20181203101045.27976-3-kraxel@redhat.com +(cherry picked from commit c52d46e041b42bb1ee6f692e00a0abe37a9659f6) +Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> + +Upstream-Status: Backport +CVE: CVE-2018-16867 +Affects: < 3.1.0 + +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + hw/usb/dev-mtp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c +index 1ded7ac..899c8a3 100644 +--- a/hw/usb/dev-mtp.c ++++ b/hw/usb/dev-mtp.c +@@ -1667,6 +1667,12 @@ static void usb_mtp_write_metadata(MTPState *s) + + utf16_to_str(dataset->length, dataset->filename, filename); + ++ if (strchr(filename, '/')) { ++ usb_mtp_queue_result(s, RES_PARAMETER_NOT_SUPPORTED, d->trans, ++ 0, 0, 0, 0); ++ return; ++ } ++ + o = usb_mtp_object_lookup_name(p, filename, dataset->length); + if (o != NULL) { + next_handle = o->handle; +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-16872.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-16872.patch new file mode 100644 index 0000000000..9f2c5d3ec1 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-16872.patch @@ -0,0 +1,89 @@ +From 7347a04da35ec6284ce83e8bcd72dc4177d17b10 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann <kraxel@redhat.com> +Date: Thu, 13 Dec 2018 13:25:11 +0100 +Subject: [PATCH] usb-mtp: use O_NOFOLLOW and O_CLOEXEC. + +Open files and directories with O_NOFOLLOW to avoid symlinks attacks. +While being at it also add O_CLOEXEC. + +usb-mtp only handles regular files and directories and ignores +everything else, so users should not see a difference. + +Because qemu ignores symlinks, carrying out a successful symlink attack +requires swapping an existing file or directory below rootdir for a +symlink and winning the race against the inotify notification to qemu. + +Fixes: CVE-2018-16872 +Cc: Prasad J Pandit <ppandit@redhat.com> +Cc: Bandan Das <bsd@redhat.com> +Reported-by: Michael Hanselmann <public@hansmi.ch> +Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> +Reviewed-by: Michael Hanselmann <public@hansmi.ch> +Message-id: 20181213122511.13853-1-kraxel@redhat.com +(cherry picked from commit bab9df35ce73d1c8e19a37e2737717ea1c984dc1) +Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> + +Upstream-Status: Backport +CVE: CVE-2018-16872 +Affects: < 3.1.0 + +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + hw/usb/dev-mtp.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c +index 899c8a3..f4223fb 100644 +--- a/hw/usb/dev-mtp.c ++++ b/hw/usb/dev-mtp.c +@@ -649,13 +649,18 @@ static void usb_mtp_object_readdir(MTPState *s, MTPObject *o) + { + struct dirent *entry; + DIR *dir; ++ int fd; + + if (o->have_children) { + return; + } + o->have_children = true; + +- dir = opendir(o->path); ++ fd = open(o->path, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW); ++ if (fd < 0) { ++ return; ++ } ++ dir = fdopendir(fd); + if (!dir) { + return; + } +@@ -1003,7 +1008,7 @@ static MTPData *usb_mtp_get_object(MTPState *s, MTPControl *c, + + trace_usb_mtp_op_get_object(s->dev.addr, o->handle, o->path); + +- d->fd = open(o->path, O_RDONLY); ++ d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW); + if (d->fd == -1) { + usb_mtp_data_free(d); + return NULL; +@@ -1027,7 +1032,7 @@ static MTPData *usb_mtp_get_partial_object(MTPState *s, MTPControl *c, + c->argv[1], c->argv[2]); + + d = usb_mtp_data_alloc(c); +- d->fd = open(o->path, O_RDONLY); ++ d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW); + if (d->fd == -1) { + usb_mtp_data_free(d); + return NULL; +@@ -1608,7 +1613,7 @@ static void usb_mtp_write_data(MTPState *s) + 0, 0, 0, 0); + goto done; + } +- d->fd = open(path, O_CREAT | O_WRONLY, mask); ++ d->fd = open(path, O_CREAT | O_WRONLY | O_CLOEXEC | O_NOFOLLOW, mask); + if (d->fd == -1) { + usb_mtp_queue_result(s, RES_STORE_FULL, d->trans, + 0, 0, 0, 0); +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-17958.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-17958.patch deleted file mode 100644 index af40ff275a..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2018-17958.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 06e88ca78d056ea4de885e3a1496805179dc47bc Mon Sep 17 00:00:00 2001 -From: Changqing Li <changqing.li@windriver.com> -Date: Mon, 15 Oct 2018 16:33:04 +0800 -Subject: [PATCH] ne2000: fix possible out of bound access in ne2000_receive - -In ne2000_receive(), we try to assign size_ to size which converts -from size_t to integer. This will cause troubles when size_ is greater -INT_MAX, this will lead a negative value in size and it can then pass -the check of size < MIN_BUF_SIZE which may lead out of bound access of -for both buf and buf1. - -Fixing by converting the type of size to size_t. - -CC: address@hidden -Reported-by: Daniel Shapira <address@hidden> -Reviewed-by: Michael S. Tsirkin <address@hidden> -Signed-off-by: Jason Wang <address@hidden> - -Upstream-Status: Backport [https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03273.html] - -CVE: CVE-2018-17958 - -Signed-off-by: Changqing Li <changqing.li@windriver.com> ---- - hw/net/ne2000.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c -index 07d79e3..869518e 100644 ---- a/hw/net/ne2000.c -+++ b/hw/net/ne2000.c -@@ -174,7 +174,7 @@ static int ne2000_buffer_full(NE2000State *s) - ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_) - { - NE2000State *s = qemu_get_nic_opaque(nc); -- int size = size_; -+ size_t size = size_; - uint8_t *p; - unsigned int total_len, next, avail, len, index, mcast_idx; - uint8_t buf1[60]; -@@ -182,7 +182,7 @@ ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_) - { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; - - #if defined(DEBUG_NE2000) -- printf("NE2000: received len=%d\n", size); -+ printf("NE2000: received len=%zu\n", size); - #endif - - if (s->cmd & E8390_STOP || ne2000_buffer_full(s)) --- -2.7.4 - diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-18849.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-18849.patch new file mode 100644 index 0000000000..b632512e8b --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-18849.patch @@ -0,0 +1,86 @@ +From bd6dd4eaa6f7fe0c4d797d4e59803d295313b7a7 Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Sat, 27 Oct 2018 01:13:14 +0530 +Subject: [PATCH] lsi53c895a: check message length value is valid + +While writing a message in 'lsi_do_msgin', message length value +in 'msg_len' could be invalid due to an invalid migration stream. +Add an assertion to avoid an out of bounds access, and reject +the incoming migration data if it contains an invalid message +length. + +Discovered by Deja vu Security. Reported by Oracle. + +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Message-Id: <20181026194314.18663-1-ppandit@redhat.com> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> +(cherry picked from commit e58ccf039650065a9442de43c9816f81e88f27f6) +*CVE-2018-18849 +*avoid context dep. on c921370b22c +Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> + +Upstream-Status: Backport +Affects: < 3.1.0 +CVE: CVE-2018-18849 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + hw/scsi/lsi53c895a.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c +index 160657f..3758635 100644 +--- a/hw/scsi/lsi53c895a.c ++++ b/hw/scsi/lsi53c895a.c +@@ -865,10 +865,11 @@ static void lsi_do_status(LSIState *s) + + static void lsi_do_msgin(LSIState *s) + { +- int len; ++ uint8_t len; + DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len); + s->sfbr = s->msg[0]; + len = s->msg_len; ++ assert(len > 0 && len <= LSI_MAX_MSGIN_LEN); + if (len > s->dbc) + len = s->dbc; + pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len); +@@ -1703,8 +1704,10 @@ static uint8_t lsi_reg_readb(LSIState *s, int offset) + break; + case 0x58: /* SBDL */ + /* Some drivers peek at the data bus during the MSG IN phase. */ +- if ((s->sstat1 & PHASE_MASK) == PHASE_MI) ++ if ((s->sstat1 & PHASE_MASK) == PHASE_MI) { ++ assert(s->msg_len > 0); + return s->msg[0]; ++ } + ret = 0; + break; + case 0x59: /* SBDL high */ +@@ -2096,11 +2099,23 @@ static int lsi_pre_save(void *opaque) + return 0; + } + ++static int lsi_post_load(void *opaque, int version_id) ++{ ++ LSIState *s = opaque; ++ ++ if (s->msg_len < 0 || s->msg_len > LSI_MAX_MSGIN_LEN) { ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static const VMStateDescription vmstate_lsi_scsi = { + .name = "lsiscsi", + .version_id = 0, + .minimum_version_id = 0, + .pre_save = lsi_pre_save, ++ .post_load = lsi_post_load, + .fields = (VMStateField[]) { + VMSTATE_PCI_DEVICE(parent_obj, LSIState), + +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch new file mode 100644 index 0000000000..9fe136455f --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch @@ -0,0 +1,50 @@ +From 3c9fd43da473a324f6cc7a0d3db58f651a2d262c Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Fri, 26 Oct 2018 18:03:58 +0530 +Subject: [PATCH] ppc/pnv: check size before data buffer access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +While performing PowerNV memory r/w operations, the access length +'sz' could exceed the data[4] buffer size. Add check to avoid OOB +access. + +Reported-by: Moguofang <moguofang@huawei.com> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Reviewed-by: Cédric Le Goater <clg@kaod.org> +Signed-off-by: David Gibson <david@gibson.dropbear.id.au> + +CVE: CVE-2018-18954 +Upstream-Status: Backport +[https://git.qemu.org/?p=qemu.git;a=commit;h=d07945e78eb6b593cd17a4640c1fc9eb35e3245d] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + hw/ppc/pnv_lpc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/hw/ppc/pnv_lpc.c b/hw/ppc/pnv_lpc.c +index d7721320a2..172a915cfc 100644 +--- a/hw/ppc/pnv_lpc.c ++++ b/hw/ppc/pnv_lpc.c +@@ -155,9 +155,15 @@ static void pnv_lpc_do_eccb(PnvLpcController *lpc, uint64_t cmd) + /* XXX Check for magic bits at the top, addr size etc... */ + unsigned int sz = (cmd & ECCB_CTL_SZ_MASK) >> ECCB_CTL_SZ_LSH; + uint32_t opb_addr = cmd & ECCB_CTL_ADDR_MASK; +- uint8_t data[4]; ++ uint8_t data[8]; + bool success; + ++ if (sz > sizeof(data)) { ++ qemu_log_mask(LOG_GUEST_ERROR, ++ "ECCB: invalid operation at @0x%08x size %d\n", opb_addr, sz); ++ return; ++ } ++ + if (cmd & ECCB_CTL_READ) { + success = opb_read(lpc, opb_addr, data, sz); + if (success) { +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-19364_p1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-19364_p1.patch new file mode 100644 index 0000000000..1d77af4e83 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-19364_p1.patch @@ -0,0 +1,51 @@ +From 5b76ef50f62079a2389ba28cacaf6cce68b1a0ed Mon Sep 17 00:00:00 2001 +From: Greg Kurz <groug@kaod.org> +Date: Wed, 7 Nov 2018 01:00:04 +0100 +Subject: [PATCH] 9p: write lock path in v9fs_co_open2() + +The assumption that the fid cannot be used by any other operation is +wrong. At least, nothing prevents a misbehaving client to create a +file with a given fid, and to pass this fid to some other operation +at the same time (ie, without waiting for the response to the creation +request). The call to v9fs_path_copy() performed by the worker thread +after the file was created can race with any access to the fid path +performed by some other thread. This causes use-after-free issues that +can be detected by ASAN with a custom 9p client. + +Unlike other operations that only read the fid path, v9fs_co_open2() +does modify it. It should hence take the write lock. + +Cc: P J P <ppandit@redhat.com> +Reported-by: zhibin hu <noirfate@gmail.com> +Signed-off-by: Greg Kurz <groug@kaod.org> + +Upstream-status: Backport +Affects: < 3.1.0 +CVE: CVE-2018-19364 patch #1 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + hw/9pfs/cofile.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/hw/9pfs/cofile.c b/hw/9pfs/cofile.c +index 88791bc..9c22837 100644 +--- a/hw/9pfs/cofile.c ++++ b/hw/9pfs/cofile.c +@@ -140,10 +140,10 @@ int coroutine_fn v9fs_co_open2(V9fsPDU *pdu, V9fsFidState *fidp, + cred.fc_gid = gid; + /* + * Hold the directory fid lock so that directory path name +- * don't change. Read lock is fine because this fid cannot +- * be used by any other operation. ++ * don't change. Take the write lock to be sure this fid ++ * cannot be used by another operation. + */ +- v9fs_path_read_lock(s); ++ v9fs_path_write_lock(s); + v9fs_co_run_in_worker( + { + err = s->ops->open2(&s->ctx, &fidp->path, +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-19364_p2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-19364_p2.patch new file mode 100644 index 0000000000..b8d094c0b4 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-19364_p2.patch @@ -0,0 +1,115 @@ +From 5b3c77aa581ebb215125c84b0742119483571e55 Mon Sep 17 00:00:00 2001 +From: Greg Kurz <groug@kaod.org> +Date: Tue, 20 Nov 2018 13:00:35 +0100 +Subject: [PATCH] 9p: take write lock on fid path updates (CVE-2018-19364) + +Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could +possibly overwrite a fid path with v9fs_path_copy() while it is being +accessed by some other thread, ie, use-after-free that can be detected +by ASAN with a custom 9p client. + +It turns out that the same can happen at several locations where +v9fs_path_copy() is used to set the fid path. The fix is again to +take the write lock. + +Fixes CVE-2018-19364. + +Cc: P J P <ppandit@redhat.com> +Reported-by: zhibin hu <noirfate@gmail.com> +Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> +Signed-off-by: Greg Kurz <groug@kaod.org> + +Upstream-status: Backport +Affects: < 3.1.0 +CVE: CVE-2018-19364 patch #2 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + hw/9pfs/9p.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c +index eef289e..267a255 100644 +--- a/hw/9pfs/9p.c ++++ b/hw/9pfs/9p.c +@@ -1391,7 +1391,9 @@ static void coroutine_fn v9fs_walk(void *opaque) + err = -EINVAL; + goto out; + } ++ v9fs_path_write_lock(s); + v9fs_path_copy(&fidp->path, &path); ++ v9fs_path_unlock(s); + } else { + newfidp = alloc_fid(s, newfid); + if (newfidp == NULL) { +@@ -2160,6 +2162,7 @@ static void coroutine_fn v9fs_create(void *opaque) + V9fsString extension; + int iounit; + V9fsPDU *pdu = opaque; ++ V9fsState *s = pdu->s; + + v9fs_path_init(&path); + v9fs_string_init(&name); +@@ -2200,7 +2203,9 @@ static void coroutine_fn v9fs_create(void *opaque) + if (err < 0) { + goto out; + } ++ v9fs_path_write_lock(s); + v9fs_path_copy(&fidp->path, &path); ++ v9fs_path_unlock(s); + err = v9fs_co_opendir(pdu, fidp); + if (err < 0) { + goto out; +@@ -2216,7 +2221,9 @@ static void coroutine_fn v9fs_create(void *opaque) + if (err < 0) { + goto out; + } ++ v9fs_path_write_lock(s); + v9fs_path_copy(&fidp->path, &path); ++ v9fs_path_unlock(s); + } else if (perm & P9_STAT_MODE_LINK) { + int32_t ofid = atoi(extension.data); + V9fsFidState *ofidp = get_fid(pdu, ofid); +@@ -2234,7 +2241,9 @@ static void coroutine_fn v9fs_create(void *opaque) + fidp->fid_type = P9_FID_NONE; + goto out; + } ++ v9fs_path_write_lock(s); + v9fs_path_copy(&fidp->path, &path); ++ v9fs_path_unlock(s); + err = v9fs_co_lstat(pdu, &fidp->path, &stbuf); + if (err < 0) { + fidp->fid_type = P9_FID_NONE; +@@ -2272,7 +2281,9 @@ static void coroutine_fn v9fs_create(void *opaque) + if (err < 0) { + goto out; + } ++ v9fs_path_write_lock(s); + v9fs_path_copy(&fidp->path, &path); ++ v9fs_path_unlock(s); + } else if (perm & P9_STAT_MODE_NAMED_PIPE) { + err = v9fs_co_mknod(pdu, fidp, &name, fidp->uid, -1, + 0, S_IFIFO | (perm & 0777), &stbuf); +@@ -2283,7 +2294,9 @@ static void coroutine_fn v9fs_create(void *opaque) + if (err < 0) { + goto out; + } ++ v9fs_path_write_lock(s); + v9fs_path_copy(&fidp->path, &path); ++ v9fs_path_unlock(s); + } else if (perm & P9_STAT_MODE_SOCKET) { + err = v9fs_co_mknod(pdu, fidp, &name, fidp->uid, -1, + 0, S_IFSOCK | (perm & 0777), &stbuf); +@@ -2294,7 +2307,9 @@ static void coroutine_fn v9fs_create(void *opaque) + if (err < 0) { + goto out; + } ++ v9fs_path_write_lock(s); + v9fs_path_copy(&fidp->path, &path); ++ v9fs_path_unlock(s); + } else { + err = v9fs_co_open2(pdu, fidp, &name, -1, + omode_to_uflags(mode)|O_CREAT, perm, &stbuf); +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-19489.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-19489.patch new file mode 100644 index 0000000000..7619e2a8ca --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-19489.patch @@ -0,0 +1,83 @@ +From 1d20398694a3b67a388d955b7a945ba4aa90a8a8 Mon Sep 17 00:00:00 2001 +From: Greg Kurz <groug@kaod.org> +Date: Fri, 23 Nov 2018 13:28:03 +0100 +Subject: [PATCH] 9p: fix QEMU crash when renaming files + +When using the 9P2000.u version of the protocol, the following shell +command line in the guest can cause QEMU to crash: + + while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done + +With 9P2000.u, file renaming is handled by the WSTAT command. The +v9fs_wstat() function calls v9fs_complete_rename(), which calls +v9fs_fix_path() for every fid whose path is affected by the change. +The involved calls to v9fs_path_copy() may race with any other access +to the fid path performed by some worker thread, causing a crash like +shown below: + +Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. +0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, + flags=65536, mode=0) at hw/9pfs/9p-local.c:59 +59 while (*path && fd != -1) { +(gdb) bt +#0 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, + path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 +#1 0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8, + path=0x0) at hw/9pfs/9p-local.c:92 +#2 0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8, + fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185 +#3 0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498, + path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53 +#4 0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498) + at hw/9pfs/9p.c:1083 +#5 0x0000555555e060a2 in coroutine_trampoline (i0=-669165424, i1=32767) + at util/coroutine-ucontext.c:116 +#6 0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6 +#7 0x0000000000000000 in () +(gdb) + +The fix is to take the path write lock when calling v9fs_complete_rename(), +like in v9fs_rename(). + +Impact: DoS triggered by unprivileged guest users. + +Fixes: CVE-2018-19489 +Cc: P J P <ppandit@redhat.com> +Reported-by: zhibin hu <noirfate@gmail.com> +Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> +Signed-off-by: Greg Kurz <groug@kaod.org> + +Upstream-Status: Backport +Affects: < 4.0.0 +CVE: CVE-2018-19489 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + hw/9pfs/9p.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c +index 267a255..bdf7919 100644 +--- a/hw/9pfs/9p.c ++++ b/hw/9pfs/9p.c +@@ -2855,6 +2855,7 @@ static void coroutine_fn v9fs_wstat(void *opaque) + struct stat stbuf; + V9fsFidState *fidp; + V9fsPDU *pdu = opaque; ++ V9fsState *s = pdu->s; + + v9fs_stat_init(&v9stat); + err = pdu_unmarshal(pdu, offset, "dwS", &fid, &unused, &v9stat); +@@ -2920,7 +2921,9 @@ static void coroutine_fn v9fs_wstat(void *opaque) + } + } + if (v9stat.name.size != 0) { ++ v9fs_path_write_lock(s); + err = v9fs_complete_rename(pdu, fidp, -1, &v9stat.name); ++ v9fs_path_unlock(s); + if (err < 0) { + goto out; + } +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-20815_p1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-20815_p1.patch new file mode 100644 index 0000000000..c3a5981488 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-20815_p1.patch @@ -0,0 +1,42 @@ +From da885fe1ee8b4589047484bd7fa05a4905b52b17 Mon Sep 17 00:00:00 2001 +From: Peter Maydell <peter.maydell@linaro.org> +Date: Fri, 14 Dec 2018 13:30:52 +0000 +Subject: [PATCH] device_tree.c: Don't use load_image() + +The load_image() function is deprecated, as it does not let the +caller specify how large the buffer to read the file into is. +Instead use load_image_size(). + +Signed-off-by: Peter Maydell <peter.maydell@linaro.org> +Reviewed-by: Richard Henderson <richard.henderson@linaro.org> +Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> +Reviewed-by: Michael S. Tsirkin <mst@redhat.com> +Reviewed-by: Eric Blake <eblake@redhat.com> +Message-id: 20181130151712.2312-9-peter.maydell@linaro.org + +Upstream-Status: Backport +CVE: CVE-2018-20815 +affects <= 3.0.1 + +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + device_tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/device_tree.c b/device_tree.c +index 6d9c972..296278e 100644 +--- a/device_tree.c ++++ b/device_tree.c +@@ -91,7 +91,7 @@ void *load_device_tree(const char *filename_path, int *sizep) + /* First allocate space in qemu for device tree */ + fdt = g_malloc0(dt_size); + +- dt_file_load_size = load_image(filename_path, fdt); ++ dt_file_load_size = load_image_size(filename_path, fdt, dt_size); + if (dt_file_load_size < 0) { + error_report("Unable to open device tree file '%s'", + filename_path); +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-20815_p2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-20815_p2.patch new file mode 100644 index 0000000000..d01e874473 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-20815_p2.patch @@ -0,0 +1,52 @@ +From 065e6298a75164b4347682b63381dbe752c2b156 Mon Sep 17 00:00:00 2001 +From: Markus Armbruster <armbru@redhat.com> +Date: Tue, 9 Apr 2019 19:40:18 +0200 +Subject: [PATCH] device_tree: Fix integer overflowing in load_device_tree() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If the value of get_image_size() exceeds INT_MAX / 2 - 10000, the +computation of @dt_size overflows to a negative number, which then +gets converted to a very large size_t for g_malloc0() and +load_image_size(). In the (fortunately improbable) case g_malloc0() +succeeds and load_image_size() survives, we'd assign the negative +number to *sizep. What that would do to the callers I can't say, but +it's unlikely to be good. + +Fix by rejecting images whose size would overflow. + +Reported-by: Kurtis Miller <kurtis.miller@nccgroup.com> +Signed-off-by: Markus Armbruster <armbru@redhat.com> +Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> +Signed-off-by: Alistair Francis <alistair.francis@wdc.com> +Message-Id: <20190409174018.25798-1-armbru@redhat.com> + +Upstream-Status: Backport +CVE: CVE-2018-20815 +affects <= 3.0.1 + +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + device_tree.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/device_tree.c b/device_tree.c +index 296278e..f8b46b3 100644 +--- a/device_tree.c ++++ b/device_tree.c +@@ -84,6 +84,10 @@ void *load_device_tree(const char *filename_path, int *sizep) + filename_path); + goto fail; + } ++ if (dt_size > INT_MAX / 2 - 10000) { ++ error_report("Device tree file '%s' is too large", filename_path); ++ goto fail; ++ } + + /* Expand to 2x size to give enough room for manipulation. */ + dt_size += 10000; +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2019-12155.patch b/meta/recipes-devtools/qemu/qemu/CVE-2019-12155.patch new file mode 100644 index 0000000000..8a5ece51f6 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2019-12155.patch @@ -0,0 +1,38 @@ +From d52680fc932efb8a2f334cc6993e705ed1e31e99 Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Thu, 25 Apr 2019 12:05:34 +0530 +Subject: [PATCH] qxl: check release info object + +When releasing spice resources in release_resource() routine, +if release info object 'ext.info' is null, it leads to null +pointer dereference. Add check to avoid it. + +Reported-by: Bugs SysSec <bugs-syssec@rub.de> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Message-id: 20190425063534.32747-1-ppandit@redhat.com +Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> + +Upstream-Status: Backport +https://git.qemu.org/?p=qemu.git;a=commit;h=d52680fc932efb8a2f334cc6993e705ed1e31e99 + +CVE: CVE-2019-12155 +Affects: <= 4.0.0 +Signed-off-by: Armin Kuster <akuster@mvistra.com> +--- + hw/display/qxl.c | 3 +++ + 1 file changed, 3 insertions(+) + +Index: qemu-3.0.0/hw/display/qxl.c +=================================================================== +--- qemu-3.0.0.orig/hw/display/qxl.c ++++ qemu-3.0.0/hw/display/qxl.c +@@ -764,6 +764,9 @@ static void interface_release_resource(Q + QXLReleaseRing *ring; + uint64_t *item, id; + ++ if (!ext.info) { ++ return; ++ } + if (ext.group_id == MEMSLOT_GROUP_HOST) { + /* host group -> vga mode update request */ + QXLCommandExt *cmdext = (void *)(intptr_t)(ext.info->id); diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2019-3812.patch b/meta/recipes-devtools/qemu/qemu/CVE-2019-3812.patch new file mode 100644 index 0000000000..0e11ad288c --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2019-3812.patch @@ -0,0 +1,39 @@ +From b664d9d003d1a98642dcfb8e6fceef6dbf3d52d8 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann <kraxel@redhat.com> +Date: Tue, 8 Jan 2019 11:23:01 +0100 +Subject: [PATCH] i2c-ddc: fix oob read +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Suggested-by: Michael Hanselmann <public@hansmi.ch> +Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> +Reviewed-by: Michael Hanselmann <public@hansmi.ch> +Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> +Message-id: 20190108102301.1957-1-kraxel@redhat.com + +CVE: CVE-2019-3812 +Upstream-Status: Backport +[https://git.qemu.org/?p=qemu.git;a=commit;h=b05b267840515730dbf6753495d5b7bd8b04ad1c] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + hw/i2c/i2c-ddc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/i2c/i2c-ddc.c b/hw/i2c/i2c-ddc.c +index bec0c91e2d..89e659288e 100644 +--- a/hw/i2c/i2c-ddc.c ++++ b/hw/i2c/i2c-ddc.c +@@ -247,7 +247,7 @@ static int i2c_ddc_rx(I2CSlave *i2c) + I2CDDCState *s = I2CDDC(i2c); + + int value; +- value = s->edid_blob[s->reg]; ++ value = s->edid_blob[s->reg % sizeof(s->edid_blob)]; + s->reg++; + return value; + } +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2019-6778.patch b/meta/recipes-devtools/qemu/qemu/CVE-2019-6778.patch new file mode 100644 index 0000000000..5b14596042 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2019-6778.patch @@ -0,0 +1,41 @@ +From b6c0fa3b435375918714e107b22de2ef13a41c26 Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Sun, 13 Jan 2019 23:29:48 +0530 +Subject: [PATCH] slirp: check data length while emulating ident function + +While emulating identification protocol, tcp_emu() does not check +available space in the 'sc_rcv->sb_data' buffer. It could lead to +heap buffer overflow issue. Add check to avoid it. + +Reported-by: Kira <864786842@qq.com> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> + +CVE: CVE-2019-6778 +Upstream-Status: Backport +[https://git.qemu.org/?p=qemu.git;a=commit;h=a7104eda7dab99d0cdbd3595c211864cba415905] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + slirp/tcp_subr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c +index 8d0f94b75f..7277aadfdf 100644 +--- a/slirp/tcp_subr.c ++++ b/slirp/tcp_subr.c +@@ -640,6 +640,11 @@ tcp_emu(struct socket *so, struct mbuf *m) + socklen_t addrlen = sizeof(struct sockaddr_in); + struct sbuf *so_rcv = &so->so_rcv; + ++ if (m->m_len > so_rcv->sb_datalen ++ - (so_rcv->sb_wptr - so_rcv->sb_data)) { ++ return 1; ++ } ++ + memcpy(so_rcv->sb_wptr, m->m_data, m->m_len); + so_rcv->sb_wptr += m->m_len; + so_rcv->sb_rptr += m->m_len; +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2019-8934.patch b/meta/recipes-devtools/qemu/qemu/CVE-2019-8934.patch new file mode 100644 index 0000000000..db3201c505 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2019-8934.patch @@ -0,0 +1,215 @@ +From 13e153f01b4f2a3e199202b34a247d83c176f21a Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Mon, 18 Feb 2019 23:43:49 +0530 +Subject: [PATCH] ppc: add host-serial and host-model machine attributes + (CVE-2019-8934) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +On ppc hosts, hypervisor shares following system attributes + + - /proc/device-tree/system-id + - /proc/device-tree/model + +with a guest. This could lead to information leakage and misuse.[*] +Add machine attributes to control such system information exposure +to a guest. + +[*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028 + +Reported-by: Daniel P. Berrangé <berrange@redhat.com> +Fix-suggested-by: Daniel P. Berrangé <berrange@redhat.com> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Message-Id: <20190218181349.23885-1-ppandit@redhat.com> +Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> +Reviewed-by: Greg Kurz <groug@kaod.org> +Signed-off-by: David Gibson <david@gibson.dropbear.id.au> + +CVE: CVE-2019-8934 +Upstream-Status: Backport +[https://github.com/qemu/qemu/commit/27461d69a0f108dea756419251acc3ea65198f1b] + +Signed-off-by: Dan Tran <dantran@microsoft.com> +--- + hw/ppc/spapr.c | 128 ++++++++++++++++++++++++++++++++++++++--- + include/hw/ppc/spapr.h | 2 + + 2 files changed, 123 insertions(+), 7 deletions(-) + +diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c +index 421b2dd09b..069d678ee0 100644 +--- a/hw/ppc/spapr.c ++++ b/hw/ppc/spapr.c +@@ -1266,13 +1266,30 @@ static void *spapr_build_fdt(sPAPRMachineState *spapr, + * Add info to guest to indentify which host is it being run on + * and what is the uuid of the guest + */ +- if (kvmppc_get_host_model(&buf)) { +- _FDT(fdt_setprop_string(fdt, 0, "host-model", buf)); +- g_free(buf); ++ if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) { ++ if (g_str_equal(spapr->host_model, "passthrough")) { ++ /* -M host-model=passthrough */ ++ if (kvmppc_get_host_model(&buf)) { ++ _FDT(fdt_setprop_string(fdt, 0, "host-model", buf)); ++ g_free(buf); ++ } ++ } else { ++ /* -M host-model=<user-string> */ ++ _FDT(fdt_setprop_string(fdt, 0, "host-model", spapr->host_model)); ++ } + } +- if (kvmppc_get_host_serial(&buf)) { +- _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf)); +- g_free(buf); ++ ++ if (spapr->host_serial && !g_str_equal(spapr->host_serial, "none")) { ++ if (g_str_equal(spapr->host_serial, "passthrough")) { ++ /* -M host-serial=passthrough */ ++ if (kvmppc_get_host_serial(&buf)) { ++ _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf)); ++ g_free(buf); ++ } ++ } else { ++ /* -M host-serial=<user-string> */ ++ _FDT(fdt_setprop_string(fdt, 0, "host-serial", spapr->host_serial)); ++ } + } + + buf = qemu_uuid_unparse_strdup(&qemu_uuid); +@@ -3027,6 +3044,73 @@ static void spapr_set_vsmt(Object *obj, Visitor *v, const char *name, + visit_type_uint32(v, name, (uint32_t *)opaque, errp); + } + ++static char *spapr_get_ic_mode(Object *obj, Error **errp) ++{ ++ sPAPRMachineState *spapr = SPAPR_MACHINE(obj); ++ ++ if (spapr->irq == &spapr_irq_xics_legacy) { ++ return g_strdup("legacy"); ++ } else if (spapr->irq == &spapr_irq_xics) { ++ return g_strdup("xics"); ++ } else if (spapr->irq == &spapr_irq_xive) { ++ return g_strdup("xive"); ++ } else if (spapr->irq == &spapr_irq_dual) { ++ return g_strdup("dual"); ++ } ++ g_assert_not_reached(); ++} ++ ++static void spapr_set_ic_mode(Object *obj, const char *value, Error **errp) ++{ ++ sPAPRMachineState *spapr = SPAPR_MACHINE(obj); ++ ++ if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) { ++ error_setg(errp, "This machine only uses the legacy XICS backend, don't pass ic-mode"); ++ return; ++ } ++ ++ /* The legacy IRQ backend can not be set */ ++ if (strcmp(value, "xics") == 0) { ++ spapr->irq = &spapr_irq_xics; ++ } else if (strcmp(value, "xive") == 0) { ++ spapr->irq = &spapr_irq_xive; ++ } else if (strcmp(value, "dual") == 0) { ++ spapr->irq = &spapr_irq_dual; ++ } else { ++ error_setg(errp, "Bad value for \"ic-mode\" property"); ++ } ++} ++ ++static char *spapr_get_host_model(Object *obj, Error **errp) ++{ ++ sPAPRMachineState *spapr = SPAPR_MACHINE(obj); ++ ++ return g_strdup(spapr->host_model); ++} ++ ++static void spapr_set_host_model(Object *obj, const char *value, Error **errp) ++{ ++ sPAPRMachineState *spapr = SPAPR_MACHINE(obj); ++ ++ g_free(spapr->host_model); ++ spapr->host_model = g_strdup(value); ++} ++ ++static char *spapr_get_host_serial(Object *obj, Error **errp) ++{ ++ sPAPRMachineState *spapr = SPAPR_MACHINE(obj); ++ ++ return g_strdup(spapr->host_serial); ++} ++ ++static void spapr_set_host_serial(Object *obj, const char *value, Error **errp) ++{ ++ sPAPRMachineState *spapr = SPAPR_MACHINE(obj); ++ ++ g_free(spapr->host_serial); ++ spapr->host_serial = g_strdup(value); ++} ++ + static void spapr_instance_init(Object *obj) + { + sPAPRMachineState *spapr = SPAPR_MACHINE(obj); +@@ -3063,6 +3147,25 @@ static void spapr_instance_init(Object *obj) + " the host's SMT mode", &error_abort); + object_property_add_bool(obj, "vfio-no-msix-emulation", + spapr_get_msix_emulation, NULL, NULL); ++ ++ /* The machine class defines the default interrupt controller mode */ ++ spapr->irq = smc->irq; ++ object_property_add_str(obj, "ic-mode", spapr_get_ic_mode, ++ spapr_set_ic_mode, NULL); ++ object_property_set_description(obj, "ic-mode", ++ "Specifies the interrupt controller mode (xics, xive, dual)", ++ NULL); ++ ++ object_property_add_str(obj, "host-model", ++ spapr_get_host_model, spapr_set_host_model, ++ &error_abort); ++ object_property_set_description(obj, "host-model", ++ "Set host's model-id to use - none|passthrough|string", &error_abort); ++ object_property_add_str(obj, "host-serial", ++ spapr_get_host_serial, spapr_set_host_serial, ++ &error_abort); ++ object_property_set_description(obj, "host-serial", ++ "Set host's system-id to use - none|passthrough|string", &error_abort); + } + + static void spapr_machine_finalizefn(Object *obj) +@@ -4067,7 +4170,18 @@ static void spapr_machine_3_0_instance_options(MachineState *machine) + + static void spapr_machine_3_0_class_options(MachineClass *mc) + { +- /* Defaults for the latest behaviour inherited from the base class */ ++ sPAPRMachineClass *smc = SPAPR_MACHINE_CLASS(mc); ++ static GlobalProperty compat[] = { ++ { TYPE_SPAPR_MACHINE, "host-model", "passthrough" }, ++ { TYPE_SPAPR_MACHINE, "host-serial", "passthrough" }, ++ }; ++ ++ spapr_machine_4_0_class_options(mc); ++ compat_props_add(mc->compat_props, hw_compat_3_1, hw_compat_3_1_len); ++ compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat)); ++ ++ mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power8_v2.0"); ++ smc->update_dt_enabled = false; + } + + DEFINE_SPAPR_MACHINE(3_0, "3.0", true); +diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h +index 7e5de1a6fd..4c69a55374 100644 +--- a/include/hw/ppc/spapr.h ++++ b/include/hw/ppc/spapr.h +@@ -165,6 +165,8 @@ struct sPAPRMachineState { + + /*< public >*/ + char *kvm_type; ++ char *host_model; ++ char *host_serial; + + const char *icp_type; + +-- +2.22.0.vfs.1.1.57.gbaf16c8 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2019-9824.patch b/meta/recipes-devtools/qemu/qemu/CVE-2019-9824.patch new file mode 100644 index 0000000000..7f8300672b --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2019-9824.patch @@ -0,0 +1,47 @@ +From d3222975c7d6cda9e25809dea05241188457b113 Mon Sep 17 00:00:00 2001 +From: William Bowling <will@wbowling.info> +Date: Fri, 1 Mar 2019 21:45:56 +0000 +Subject: [PATCH 1/1] slirp: check sscanf result when emulating ident +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf8 +Content-Transfer-Encoding: 8bit + +When emulating ident in tcp_emu, if the strchr checks passed but the +sscanf check failed, two uninitialized variables would be copied and +sent in the reply, so move this code inside the if(sscanf()) clause. + +Signed-off-by: William Bowling <will@wbowling.info> +Cc: qemu-stable@nongnu.org +Cc: secalert@redhat.com +Message-Id: <1551476756-25749-1-git-send-email-will@wbowling.info> +Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> +Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> + +Upstream-Status: Backport +https://git.qemu.org/?p=qemu.git;a=commitdiff;h=d3222975c7d6cda9e25809dea05241188457b113;hp=6c419a1e06c21c4568d5a12a9c5cafcdb00f6aa8 +CVE: CVE-2019-9824 +affects < 4.0.0 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +Index: qemu-3.0.0/slirp/tcp_subr.c +=================================================================== +--- qemu-3.0.0.orig/slirp/tcp_subr.c ++++ qemu-3.0.0/slirp/tcp_subr.c +@@ -662,12 +662,12 @@ tcp_emu(struct socket *so, struct mbuf * + break; + } + } ++ so_rcv->sb_cc = snprintf(so_rcv->sb_data, ++ so_rcv->sb_datalen, ++ "%d,%d\r\n", n1, n2); ++ so_rcv->sb_rptr = so_rcv->sb_data; ++ so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc; + } +- so_rcv->sb_cc = snprintf(so_rcv->sb_data, +- so_rcv->sb_datalen, +- "%d,%d\r\n", n1, n2); +- so_rcv->sb_rptr = so_rcv->sb_data; +- so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc; + } + m_free(m); + return 0; diff --git a/meta/recipes-devtools/qemu/qemu_3.0.0.bb b/meta/recipes-devtools/qemu/qemu_3.0.0.bb index 776548b05a..e483acab55 100644 --- a/meta/recipes-devtools/qemu/qemu_3.0.0.bb +++ b/meta/recipes-devtools/qemu/qemu_3.0.0.bb @@ -21,10 +21,27 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://0009-apic-fixup-fallthrough-to-PIC.patch \ file://0010-linux-user-Fix-webkitgtk-hangs-on-32-bit-x86-target.patch \ file://0011-Revert-linux-user-fix-mmap-munmap-mprotect-mremap-sh.patch \ + file://CVE-2018-10839.patch\ file://CVE-2018-15746.patch \ - file://CVE-2018-17958.patch \ file://CVE-2018-17962.patch \ file://CVE-2018-17963.patch \ + file://CVE-2018-16867.patch \ + file://CVE-2018-16872.patch \ + file://CVE-2018-18849.patch \ + file://CVE-2018-19364_p1.patch \ + file://CVE-2018-19364_p2.patch \ + file://CVE-2018-19489.patch \ + file://CVE-2019-12155.patch \ + file://CVE-2018-20815_p1.patch \ + file://CVE-2018-20815_p2.patch \ + file://CVE-2019-9824.patch \ + file://0014-linux-user-fix-to-handle-variably-sized-SIOCGSTAMP-w.patch \ + file://CVE-2018-18954.patch \ + file://CVE-2019-3812.patch \ + file://CVE-2019-6778.patch \ + file://CVE-2019-8934.patch \ + file://0001-linux-user-assume-__NR_gettid-always-exists.patch \ + file://0001-linux-user-rename-gettid-to-sys_gettid-to-avoid-clas.patch \ " UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |