Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=e98e5fd3e80b2ef8283c81961601be9d72443874
commit e98e5fd3e80b2ef8283c81961601be9d72443874 Author: kikadf <[email protected]> Date: Mon Nov 24 09:04:15 2014 +0100 ruby-1.9.2-3arcturus1-x86_64 * Fix CVE-2014-4975, CVE-2014-8080, CVE-2014-8090 diff --git a/source/devel/ruby/CVE-2014-4975.patch b/source/devel/ruby/CVE-2014-4975.patch new file mode 100644 index 0000000..46272df --- /dev/null +++ b/source/devel/ruby/CVE-2014-4975.patch @@ -0,0 +1,44 @@ +Description: fix denial of service via buffer overrun in encodes function +Origin: backport, http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=46778 +Bug: https://bugs.ruby-lang.org/issues/10019 + +Index: ruby1.9.1-1.9.3.484/pack.c +=================================================================== +--- ruby1.9.1-1.9.3.484.orig/pack.c 2014-10-31 13:04:12.784966050 -0400 ++++ ruby1.9.1-1.9.3.484/pack.c 2014-10-31 13:04:12.780966019 -0400 +@@ -1068,7 +1068,8 @@ + static void + encodes(VALUE str, const char *s, long len, int type, int tail_lf) + { +- char buff[4096]; ++ enum {buff_size = 4096, encoded_unit = 4}; ++ char buff[buff_size + 1]; /* +1 for tail_lf */ + long i = 0; + const char *trans = type == 'u' ? uu_table : b64_table; + int padding; +@@ -1081,7 +1082,7 @@ + padding = '='; + } + while (len >= 3) { +- while (len >= 3 && sizeof(buff)-i >= 4) { ++ while (len >= 3 && buff_size-i >= encoded_unit) { + buff[i++] = trans[077 & (*s >> 2)]; + buff[i++] = trans[077 & (((*s << 4) & 060) | ((s[1] >> 4) & 017))]; + buff[i++] = trans[077 & (((s[1] << 2) & 074) | ((s[2] >> 6) & 03))]; +@@ -1089,7 +1090,7 @@ + s += 3; + len -= 3; + } +- if (sizeof(buff)-i < 4) { ++ if (buff_size-i < encoded_unit) { + rb_str_buf_cat(str, buff, i); + i = 0; + } +@@ -1109,6 +1110,7 @@ + } + if (tail_lf) buff[i++] = '\n'; + rb_str_buf_cat(str, buff, i); ++ if ((size_t)i > sizeof(buff)) rb_bug("encodes() buffer overrun"); + } + + static const char hex_table[] = "0123456789ABCDEF"; diff --git a/source/devel/ruby/CVE-2014-8080.patch b/source/devel/ruby/CVE-2014-8080.patch new file mode 100644 index 0000000..21a18e1 --- /dev/null +++ b/source/devel/ruby/CVE-2014-8080.patch @@ -0,0 +1,94 @@ +Description: fix denial of service via XML expansion +Origin: backport, http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=48161 + +Index: ruby1.9.1-1.9.3.484/lib/rexml/entity.rb +=================================================================== +--- ruby1.9.1-1.9.3.484.orig/lib/rexml/entity.rb 2014-11-19 15:21:08.260737462 -0500 ++++ ruby1.9.1-1.9.3.484/lib/rexml/entity.rb 2014-11-19 15:21:08.256737433 -0500 +@@ -138,8 +138,14 @@ + matches = @value.scan(PEREFERENCE_RE) + rv = @value.clone + if @parent ++ sum = 0 + matches.each do |entity_reference| + entity_value = @parent.entity( entity_reference[0] ) ++ if sum + entity_value.bytesize > REXML.entity_expansion_text_limit ++ raise "entity expansion has grown too large" ++ else ++ sum += entity_value.bytesize ++ end + rv.gsub!( /%#{entity_reference.join};/um, entity_value ) + end + end +Index: ruby1.9.1-1.9.3.484/test/rexml/test_document.rb +=================================================================== +--- ruby1.9.1-1.9.3.484.orig/test/rexml/test_document.rb 2014-11-19 15:21:08.260737462 -0500 ++++ ruby1.9.1-1.9.3.484/test/rexml/test_document.rb 2014-11-19 15:21:44.180993222 -0500 +@@ -47,6 +47,20 @@ + </member> + EOF + ++ XML_WITH_NESTED_PARAMETER_ENTITY = <<EOF ++<!DOCTYPE root [ ++ <!ENTITY % a "BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM."> ++ <!ENTITY % b "%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;"> ++ <!ENTITY % c "%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;"> ++ <!ENTITY % d "%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;"> ++ <!ENTITY % e "%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;"> ++ <!ENTITY % f "%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;"> ++ <!ENTITY % g "%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;"> ++ <!ENTITY test "test %g;"> ++]> ++<cd></cd> ++EOF ++ + XML_WITH_4_ENTITY_EXPANSION = <<EOF + <?xml version="1.0" encoding="UTF-8"?> + <!DOCTYPE member [ +@@ -83,6 +97,19 @@ + end + ensure + REXML::Document.entity_expansion_limit = 10000 ++ end ++ ++ def test_entity_expansion_limit_for_parameter_entity ++ assert_raise(REXML::ParseException) do ++ REXML::Document.new(XML_WITH_NESTED_PARAMETER_ENTITY) ++ end ++ REXML::Document.entity_expansion_limit = 100 ++ assert_equal(100, REXML::Document.entity_expansion_limit) ++ assert_raise(REXML::ParseException) do ++ REXML::Document.new(XML_WITH_NESTED_PARAMETER_ENTITY) ++ end ++ ensure ++ REXML::Document.entity_expansion_limit = 10000 + end + + def test_tag_in_cdata_with_not_ascii_only_but_ascii8bit_encoding_source +Index: ruby1.9.1-1.9.3.484/test/rexml/test_entity.rb +=================================================================== +--- ruby1.9.1-1.9.3.484.orig/test/rexml/test_entity.rb 2014-11-19 15:21:08.260737462 -0500 ++++ ruby1.9.1-1.9.3.484/test/rexml/test_entity.rb 2014-11-19 15:21:08.256737433 -0500 +@@ -122,6 +122,22 @@ + end + end + ++ def test_entity_string_limit_for_parameter_entity ++ template = '<!DOCTYPE bomb [ <!ENTITY % a "^" > <!ENTITY bomb "$" > ]><root/>' ++ len = 5120 # 5k per entity ++ template.sub!(/\^/, "B" * len) ++ ++ # 10k is OK ++ entities = '%a;' * 2 # 5k entity * 2 = 10k ++ REXML::Document.new(template.sub(/\$/, entities)) ++ ++ # above 10k explodes ++ entities = '%a;' * 3 # 5k entity * 2 = 15k ++ assert_raises(REXML::ParseException) do ++ REXML::Document.new(template.sub(/\$/, entities)) ++ end ++ end ++ + def test_raw + source = '<!DOCTYPE foo [ + <!ENTITY ent "replace"> diff --git a/source/devel/ruby/CVE-2014-8090.patch b/source/devel/ruby/CVE-2014-8090.patch new file mode 100644 index 0000000..755b866 --- /dev/null +++ b/source/devel/ruby/CVE-2014-8090.patch @@ -0,0 +1,113 @@ +Description: fix denial of service via XML expansion +Origin: backport, http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=48406 + +Index: ruby1.9.1-1.9.3.484/lib/rexml/document.rb +=================================================================== +--- ruby1.9.1-1.9.3.484.orig/lib/rexml/document.rb 2013-03-28 05:12:42.000000000 -0400 ++++ ruby1.9.1-1.9.3.484/lib/rexml/document.rb 2014-11-19 15:22:01.105113773 -0500 +@@ -240,6 +240,10 @@ + end + end + ++ def document ++ self ++ end ++ + private + def build( source ) + Parsers::TreeParser.new( source, self ).parse +Index: ruby1.9.1-1.9.3.484/lib/rexml/entity.rb +=================================================================== +--- ruby1.9.1-1.9.3.484.orig/lib/rexml/entity.rb 2014-11-19 15:21:52.781054477 -0500 ++++ ruby1.9.1-1.9.3.484/lib/rexml/entity.rb 2014-11-19 15:22:02.889126484 -0500 +@@ -157,6 +157,7 @@ + + # This is a set of entity constants -- the ones defined in the XML + # specification. These are +gt+, +lt+, +amp+, +quot+ and +apos+. ++ # CAUTION: these entities does not have parent and document + module EntityConst + # +>+ + GT = Entity.new( 'gt', '>' ) +Index: ruby1.9.1-1.9.3.484/test/rexml/test_document.rb +=================================================================== +--- ruby1.9.1-1.9.3.484.orig/test/rexml/test_document.rb 2014-11-19 15:21:52.781054477 -0500 ++++ ruby1.9.1-1.9.3.484/test/rexml/test_document.rb 2014-11-19 15:23:07.877589692 -0500 +@@ -47,6 +47,22 @@ + </member> + EOF + ++ XML_WITH_NESTED_EMPTY_ENTITY = <<EOF ++<?xml version="1.0" encoding="UTF-8"?> ++<!DOCTYPE member [ ++ <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;"> ++ <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;"> ++ <!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;"> ++ <!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;"> ++ <!ENTITY e "&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;"> ++ <!ENTITY f "&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;"> ++ <!ENTITY g ""> ++]> ++<member> ++&a; ++</member> ++EOF ++ + XML_WITH_NESTED_PARAMETER_ENTITY = <<EOF + <!DOCTYPE root [ + <!ENTITY % a "BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM."> +@@ -61,6 +77,20 @@ + <cd></cd> + EOF + ++ XML_WITH_NESTED_EMPTY_PARAMETER_ENTITY = <<EOF ++<!DOCTYPE root [ ++ <!ENTITY % a ""> ++ <!ENTITY % b "%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;"> ++ <!ENTITY % c "%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;"> ++ <!ENTITY % d "%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;"> ++ <!ENTITY % e "%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;"> ++ <!ENTITY % f "%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;"> ++ <!ENTITY % g "%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;"> ++ <!ENTITY test "test %g;"> ++]> ++<cd></cd> ++EOF ++ + XML_WITH_4_ENTITY_EXPANSION = <<EOF + <?xml version="1.0" encoding="UTF-8"?> + <!DOCTYPE member [ +@@ -87,6 +117,18 @@ + end + assert_equal(101, doc.entity_expansion_count) + ++ doc = REXML::Document.new(XML_WITH_NESTED_EMPTY_ENTITY) ++ assert_raise(RuntimeError) do ++ doc.root.children.first.value ++ end ++ REXML::Document.entity_expansion_limit = 100 ++ assert_equal(100, REXML::Document.entity_expansion_limit) ++ doc = REXML::Document.new(XML_WITH_NESTED_EMPTY_ENTITY) ++ assert_raise(RuntimeError) do ++ doc.root.children.first.value ++ end ++ assert_equal(101, doc.entity_expansion_count) ++ + REXML::Document.entity_expansion_limit = 4 + doc = REXML::Document.new(XML_WITH_4_ENTITY_EXPANSION) + assert_equal("\na\na a\n<\n", doc.root.children.first.value) +@@ -95,6 +137,15 @@ + assert_raise(RuntimeError) do + doc.root.children.first.value + end ++ ++ assert_raise(REXML::ParseException) do ++ REXML::Document.new(XML_WITH_NESTED_EMPTY_PARAMETER_ENTITY) ++ end ++ REXML::Document.entity_expansion_limit = 100 ++ assert_equal(100, REXML::Document.entity_expansion_limit) ++ assert_raise(REXML::ParseException) do ++ REXML::Document.new(XML_WITH_NESTED_EMPTY_PARAMETER_ENTITY) ++ end + ensure + REXML::Document.entity_expansion_limit = 10000 + end diff --git a/source/devel/ruby/FrugalBuild b/source/devel/ruby/FrugalBuild index 648dd94..4b7173a 100644 --- a/source/devel/ruby/FrugalBuild +++ b/source/devel/ruby/FrugalBuild @@ -4,8 +4,8 @@ pkgname=ruby pkgver=1.9.2 -pkgpatch=180 -pkgrel=2 +pkgpatch=320 +pkgrel=3arcturus1 pkgdesc="An object-oriented programming language." url="http://www.ruby-lang.org/"; depends=('libxml2>=2.7.8' 'zlib' 'db>=4.7.25-2' 'readline' 'openssl>=1.0.0' 'gdbm>=1.10') @@ -14,11 +14,19 @@ groups=('devel') archs=('i686' 'x86_64' 'arm') up2date="lynx -dump http://www.ruby-lang.org/en/downloads/|sed 's/-p$pkgpatch//' |Flasttar" source=(ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-${pkgver}-p$pkgpatch.tar.bz2) -sha1sums=('10824b44c8060c7b9b5afc0b3519a1e9f02f7fe5') +sha1sums=('f4892311ea4ca2a6c979c9fd3a03c8e473998315') replaces=('rake' 'rubygems' 'eruby') provides=('rake' 'rubygems') conflicts=('rake' 'rubygems') + +# FSA fix *** +source=(${source[@]} CVE-2014-4975.patch CVE-2014-8080.patch CVE-2014-8090.patch) +sha1sums=(${sha1sums[@]} '6e6464e622d6ff6e30a8964e29f6ce473a2ac8b9' \ + '96d5e99d94b37607e5563b80a3ba84144ee382b3' \ + 'b5611e44b111963809cca57f8795e6338ae24ab9') +# *********** + build() { Fcd ruby-$pkgver-p$pkgpatch Fbuild --enable-shared --enable-pthread _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
