Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-2.0.git;a=commitdiff;h=a2ee4cbc529a7e8628977ff7f4fb1de36ac00521
commit a2ee4cbc529a7e8628977ff7f4fb1de36ac00521 Author: kikadf <[email protected]> Date: Sat Feb 28 08:34:20 2015 +0100 file-5.14-7rigel1-x86_64 * Fix CVE-2014-8116, CVE-2014-8117 diff --git a/source/base/file/CVE-2014-8116.patch b/source/base/file/CVE-2014-8116.patch new file mode 100644 index 0000000..2b0016a --- /dev/null +++ b/source/base/file/CVE-2014-8116.patch @@ -0,0 +1,130 @@ +Description: fix DoS in ELF parser +Origin: backport, https://github.com/file/file/commit/b4c01141e5367f247b84dcaf6aefbb4e741842b8 +Origin: backport, https://github.com/file/file/commit/d7cdad007c507e6c79f51f058dd77fab70ceb9f6 +Origin: backport, https://github.com/file/file/commit/8a905717660395b38ec4966493f6f1cf2f33946c +Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773148 + +Index: file-5.14/src/elfclass.h +=================================================================== +--- file-5.14.orig/src/elfclass.h 2015-01-27 09:17:38.357062176 -0500 ++++ file-5.14/src/elfclass.h 2015-01-27 09:17:38.353062145 -0500 +@@ -35,10 +35,12 @@ + switch (type) { + #ifdef ELFCORE + case ET_CORE: ++ phnum = elf_getu16(swap, elfhdr.e_phnum); ++ if (phnum > MAX_PHNUM) ++ return toomany(ms, "program", phnum); + flags |= FLAGS_IS_CORE; + if (dophn_core(ms, clazz, swap, fd, +- (off_t)elf_getu(swap, elfhdr.e_phoff), +- elf_getu16(swap, elfhdr.e_phnum), ++ (off_t)elf_getu(swap, elfhdr.e_phoff), phnum, + (size_t)elf_getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) + return -1; +@@ -46,18 +48,24 @@ + #endif + case ET_EXEC: + case ET_DYN: ++ phnum = elf_getu16(swap, elfhdr.e_phnum); ++ if (phnum > MAX_PHNUM) ++ return toomany(ms, "program", phnum); ++ shnum = elf_getu16(swap, elfhdr.e_shnum); ++ if (shnum > MAX_SHNUM) ++ return toomany(ms, "section", shnum); + if (dophn_exec(ms, clazz, swap, fd, +- (off_t)elf_getu(swap, elfhdr.e_phoff), +- elf_getu16(swap, elfhdr.e_phnum), ++ (off_t)elf_getu(swap, elfhdr.e_phoff), phnum, + (size_t)elf_getu16(swap, elfhdr.e_phentsize), +- fsize, &flags, elf_getu16(swap, elfhdr.e_shnum)) +- == -1) ++ fsize, &flags, shnum) == -1) + return -1; + /*FALLTHROUGH*/ + case ET_REL: ++ shnum = elf_getu16(swap, elfhdr.e_shnum); ++ if (shnum > MAX_SHNUM) ++ return toomany(ms, "section", shnum); + if (doshn(ms, clazz, swap, fd, +- (off_t)elf_getu(swap, elfhdr.e_shoff), +- elf_getu16(swap, elfhdr.e_shnum), ++ (off_t)elf_getu(swap, elfhdr.e_shoff), shnum, + (size_t)elf_getu16(swap, elfhdr.e_shentsize), + fsize, &flags, elf_getu16(swap, elfhdr.e_machine), + (int)elf_getu16(swap, elfhdr.e_shstrndx)) == -1) +Index: file-5.14/src/readelf.c +=================================================================== +--- file-5.14.orig/src/readelf.c 2015-01-27 09:17:38.357062176 -0500 ++++ file-5.14/src/readelf.c 2015-01-27 09:17:38.353062145 -0500 +@@ -60,6 +60,18 @@ + private uint32_t getu32(int, uint32_t); + private uint64_t getu64(int, uint64_t); + ++#define MAX_PHNUM 128 ++#define MAX_SHNUM 32768 ++ ++private int ++toomany(struct magic_set *ms, const char *name, uint16_t num) ++{ ++ if (file_printf(ms, ", too many %s header sections (%u)", name, num ++ ) == -1) ++ return -1; ++ return 0; ++} ++ + private uint16_t + getu16(int swap, uint16_t value) + { +@@ -379,13 +391,13 @@ + if (namesz & 0x80000000) { + (void)file_printf(ms, ", bad note name size 0x%lx", + (unsigned long)namesz); +- return offset; ++ return 0; + } + + if (descsz & 0x80000000) { + (void)file_printf(ms, ", bad note description size 0x%lx", + (unsigned long)descsz); +- return offset; ++ return 0; + } + + +@@ -847,6 +859,7 @@ + Elf32_Shdr sh32; + Elf64_Shdr sh64; + int stripped = 1; ++ size_t nbadcap = 0; + void *nbuf; + off_t noff, coff, name_off; + uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilites */ +@@ -935,6 +948,8 @@ + goto skip; + } + ++ if (nbadcap > 5) ++ break; + if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) { + file_badseek(ms); + return -1; +@@ -970,6 +985,8 @@ + (unsigned long long)xcap_tag, + (unsigned long long)xcap_val) == -1) + return -1; ++ if (nbadcap++ > 2) ++ coff = xsh_size; + break; + } + } +@@ -1150,7 +1167,7 @@ + int flags = 0; + Elf32_Ehdr elf32hdr; + Elf64_Ehdr elf64hdr; +- uint16_t type; ++ uint16_t type, phnum, shnum; + + if (ms->flags & (MAGIC_MIME|MAGIC_APPLE)) + return 0; diff --git a/source/base/file/CVE-2014-8117.patch b/source/base/file/CVE-2014-8117.patch new file mode 100644 index 0000000..b64888d --- /dev/null +++ b/source/base/file/CVE-2014-8117.patch @@ -0,0 +1,394 @@ +Description: fix DoS via missing recursion limits +Origin: backport, https://github.com/file/file/commit/6f737ddfadb596d7d4a993f7ed2141ffd664a81c +Origin: backport, https://github.com/file/file/commit/90018fe22ff8b74a22fcd142225b0a00f3f12677 +Origin: backport, https://github.com/file/file/commit/5063ca3a2e00c5499789ccaa1ae2a41611377b77 +Origin: backport, https://github.com/file/file/commit/6bf45271eb8e0e6577b92042ce2003ba998d1686 +Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773148 + +Index: file-5.14/doc/file.man +=================================================================== +--- file-5.14.orig/doc/file.man 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/doc/file.man 2015-01-27 09:22:34.415335137 -0500 +@@ -16,6 +16,7 @@ + .Op Fl F Ar separator + .Op Fl f Ar namefile + .Op Fl m Ar magicfiles ++.Op Fl R Ar maxrecursion + .Ar + .Ek + .Nm +@@ -301,6 +302,11 @@ + Normally + .Nm + translates unprintable characters to their octal representation. ++.It Fl R , Fl Fl recursion Ar maxlevel ++Set the maximum recursion level for indirect type magic or name/use entry ++invocations. ++The default is ++.Dv 15 . + .It Fl s , Fl Fl special-files + Normally, + .Nm +Index: file-5.14/doc/libmagic.man +=================================================================== +--- file-5.14.orig/doc/libmagic.man 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/doc/libmagic.man 2015-01-27 09:22:34.419335168 -0500 +@@ -39,6 +39,9 @@ + .Nm magic_compile , + .Nm magic_list , + .Nm magic_load , ++.Nm magic_load_buffers , ++.Nm magic_setparam , ++.Nm magic_getparam , + .Nm magic_version + .Nd Magic number recognition library + .Sh LIBRARY +@@ -70,6 +73,10 @@ + .Ft int + .Fn magic_load "magic_t cookie" "const char *filename" + .Ft int ++.Fn magic_getparam "magic_t cookie" "int param" "void *value" ++.Ft int ++.Fn magic_setparam "magic_t cookie" "int param" "const void *value" ++.Ft int + .Fn magic_version "void" + .Sh DESCRIPTION + These functions +@@ -252,6 +259,21 @@ + to the database filename as appropriate. + .Pp + The ++.Fn magic_getparam ++and ++.Fn magic_setparam ++allow getting and setting various limits related to the the magic ++library. ++.Bl -column "MAGIC_PARAM_MAX_RECURSION" "size_t" "Default" -offset indent ++.It Sy "Parameter" Ta Sy "Type" Ta Sy "Default ++.It Li MAGIC_PARAM_MAX_RECURSION Ta size_t Ta 15 ++.El ++The ++.Dv MAGIC_PARAM_MAX_RECURSION ++parameter controls how many levels of recursion will be followed for ++indirect magic entries or for name/use calls. ++.Pp ++The + .Fn magic_version + command returns the version number of this library which is compiled into + the shared library using the constant +Index: file-5.14/src/apprentice.c +=================================================================== +--- file-5.14.orig/src/apprentice.c 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/apprentice.c 2015-01-27 09:22:34.419335168 -0500 +@@ -493,6 +493,7 @@ + ms->mlist[i] = NULL; + ms->file = "unknown"; + ms->line = 0; ++ ms->max_recursion = FILE_MAX_RECURSION; + return ms; + free: + free(ms); +Index: file-5.14/src/file.c +=================================================================== +--- file-5.14.orig/src/file.c 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/file.c 2015-01-27 09:22:42.579397795 -0500 +@@ -101,7 +101,7 @@ + #undef OPT_LONGONLY + {0, 0, NULL, 0} + }; +-#define OPTSTRING "bcCde:f:F:hiklLm:nNprsvz0" ++#define OPTSTRING "bcCde:f:F:hiklLm:nNprR:svz0" + + private const struct { + const char *name; +@@ -140,6 +140,7 @@ + size_t i; + int action = 0, didsomefiles = 0, errflg = 0; + int flags = 0, e = 0; ++ size_t max_recursion = 0; + struct magic_set *magic = NULL; + int longindex; + const char *magicfile = NULL; /* where the magic is */ +@@ -243,6 +244,9 @@ + case 'r': + flags |= MAGIC_RAW; + break; ++ case 'R': ++ max_recursion = atoi(optarg); ++ break; + case 's': + flags |= MAGIC_DEVICES; + break; +@@ -295,6 +299,8 @@ + strerror(errno)); + return 1; + } ++ ++ + switch(action) { + case FILE_CHECK: + c = magic_check(magic, magicfile); +@@ -318,6 +324,15 @@ + if (magic == NULL) + if ((magic = load(magicfile, flags)) == NULL) + return 1; ++ if (max_recursion) { ++ if (magic_setparam(magic, MAGIC_PARAM_MAX_RECURSION, ++ &max_recursion) == -1) { ++ (void)fprintf(stderr, ++ "%s: Can't set recurision %s\n", progname, ++ strerror(errno)); ++ return 1; ++ } ++ } + break; + } + +Index: file-5.14/src/file.h +=================================================================== +--- file-5.14.orig/src/file.h 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/file.h 2015-01-27 09:22:34.419335168 -0500 +@@ -401,6 +401,8 @@ + /* FIXME: Make the string dynamically allocated so that e.g. + strings matched in files can be longer than MAXstring */ + union VALUETYPE ms_value; /* either number or string */ ++ size_t max_recursion; ++#define FILE_MAX_RECURSION 15 + }; + + /* Type for Unicode characters */ +@@ -469,6 +471,14 @@ + #endif /* __EMX__ */ + + ++typedef struct { ++ char *buf; ++ uint32_t offset; ++} file_pushbuf_t; ++ ++protected file_pushbuf_t *file_push_buffer(struct magic_set *); ++protected char *file_pop_buffer(struct magic_set *, file_pushbuf_t *); ++ + #ifndef COMPILE_ONLY + extern const char *file_names[]; + extern const size_t file_nnames; +Index: file-5.14/src/file_opts.h +=================================================================== +--- file-5.14.orig/src/file_opts.h 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/file_opts.h 2015-01-27 09:22:34.419335168 -0500 +@@ -44,6 +44,7 @@ + OPT('p', "preserve-date", 0, " preserve access times on files\n") + #endif + OPT('r', "raw", 0, " don't translate unprintable chars to \\ooo\n") ++OPT('R', "recursion", 0, " set maximum recursion level\n") + OPT('s', "special-files", 0, " treat special (block/char devices) files as\n" + " ordinary ones\n") + OPT('C', "compile", 0, " compile file specified by -m\n") +Index: file-5.14/src/funcs.c +=================================================================== +--- file-5.14.orig/src/funcs.c 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/funcs.c 2015-01-27 09:22:34.419335168 -0500 +@@ -459,3 +459,43 @@ + return nm; + } + } ++ ++protected file_pushbuf_t * ++file_push_buffer(struct magic_set *ms) ++{ ++ file_pushbuf_t *pb; ++ ++ if (ms->event_flags & EVENT_HAD_ERR) ++ return NULL; ++ ++ if ((pb = (CAST(file_pushbuf_t *, malloc(sizeof(*pb))))) == NULL) ++ return NULL; ++ ++ pb->buf = ms->o.buf; ++ pb->offset = ms->offset; ++ ++ ms->o.buf = NULL; ++ ms->offset = 0; ++ ++ return pb; ++} ++ ++protected char * ++file_pop_buffer(struct magic_set *ms, file_pushbuf_t *pb) ++{ ++ char *rbuf; ++ ++ if (ms->event_flags & EVENT_HAD_ERR) { ++ free(pb->buf); ++ free(pb); ++ return NULL; ++ } ++ ++ rbuf = ms->o.buf; ++ ++ ms->o.buf = pb->buf; ++ ms->offset = pb->offset; ++ ++ free(pb); ++ return rbuf; ++} +Index: file-5.14/src/magic.c +=================================================================== +--- file-5.14.orig/src/magic.c 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/magic.c 2015-01-27 09:22:34.419335168 -0500 +@@ -483,3 +483,29 @@ + { + return MAGIC_VERSION; + } ++ ++public int ++magic_setparam(struct magic_set *ms, int param, const void *val) ++{ ++ switch (param) { ++ case MAGIC_PARAM_MAX_RECURSION: ++ ms->max_recursion = *(const size_t *)val; ++ return 0; ++ default: ++ errno = EINVAL; ++ return -1; ++ } ++} ++ ++public int ++magic_getparam(struct magic_set *ms, int param, void *val) ++{ ++ switch (param) { ++ case MAGIC_PARAM_MAX_RECURSION: ++ *(size_t *)val = ms->max_recursion; ++ return 0; ++ default: ++ errno = EINVAL; ++ return -1; ++ } ++} +Index: file-5.14/src/magic.h.in +=================================================================== +--- file-5.14.orig/src/magic.h.in 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/magic.h.in 2015-01-27 09:22:34.419335168 -0500 +@@ -100,6 +100,10 @@ + int magic_list(magic_t, const char *); + int magic_errno(magic_t); + ++#define MAGIC_PARAM_MAX_RECURSION 0 ++int magic_setparam(magic_t, int, const void *); ++int magic_getparam(magic_t, int, void *); ++ + #ifdef __cplusplus + }; + #endif +Index: file-5.14/src/softmagic.c +=================================================================== +--- file-5.14.orig/src/softmagic.c 2015-01-27 09:22:34.419335168 -0500 ++++ file-5.14/src/softmagic.c 2015-01-27 09:22:34.419335168 -0500 +@@ -43,10 +43,10 @@ + + + private int match(struct magic_set *, struct magic *, uint32_t, +- const unsigned char *, size_t, size_t, int, int, int, int, int *, int *, ++ const unsigned char *, size_t, size_t, int, int, int, size_t, int *, int *, + int *); + private int mget(struct magic_set *, const unsigned char *, +- struct magic *, size_t, size_t, unsigned int, int, int, int, int, int *, ++ struct magic *, size_t, size_t, unsigned int, int, int, int, size_t, int *, + int *, int *); + private int magiccheck(struct magic_set *, struct magic *); + private int32_t mprint(struct magic_set *, struct magic *); +@@ -63,6 +63,7 @@ + private void cvt_64(union VALUETYPE *, const struct magic *); + + #define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o))) ++ + /* + * softmagic - lookup one file in parsed, in-memory copy of database + * Passed the name and FILE * of one file to be typed. +@@ -113,8 +114,8 @@ + private int + match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, + const unsigned char *s, size_t nbytes, size_t offset, int mode, int text, +- int flip, int recursion_level, int *printed_something, int *need_separator, +- int *returnval) ++ int flip, size_t recursion_level, int *printed_something, ++ int *need_separator, int *returnval) + { + uint32_t magindex = 0; + unsigned int cont_level = 0; +@@ -1153,17 +1154,19 @@ + private int + mget(struct magic_set *ms, const unsigned char *s, struct magic *m, + size_t nbytes, size_t o, unsigned int cont_level, int mode, int text, +- int flip, int recursion_level, int *printed_something, ++ int flip, size_t recursion_level, int *printed_something, + int *need_separator, int *returnval) + { +- uint32_t soffset, offset = ms->offset; ++ uint32_t offset = ms->offset; ++ file_pushbuf_t *pb; + int rv, oneed_separator; +- char *sbuf, *rbuf; ++ char *rbuf; + union VALUETYPE *p = &ms->ms_value; + struct mlist ml; + +- if (recursion_level >= 20) { +- file_error(ms, 0, "recursion nesting exceeded"); ++ if (recursion_level >= ms->max_recursion) { ++ file_error(ms, 0, "recursion nesting (%zu) exceeded", ++ recursion_level); + return -1; + } + +@@ -1735,19 +1738,23 @@ + case FILE_INDIRECT: + if (offset == 0) + return 0; ++ + if (OFFSET_OOB(nbytes, offset, 0)) + return 0; +- sbuf = ms->o.buf; +- soffset = ms->offset; +- ms->o.buf = NULL; +- ms->offset = 0; ++ ++ if ((pb = file_push_buffer(ms)) == NULL) ++ return -1; ++ + rv = file_softmagic(ms, s + offset, nbytes - offset, + recursion_level, BINTEST, text); ++ + if ((ms->flags & MAGIC_DEBUG) != 0) + fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv); +- rbuf = ms->o.buf; +- ms->o.buf = sbuf; +- ms->offset = soffset; ++ ++ rbuf = file_pop_buffer(ms, pb); ++ if (rbuf == NULL && ms->event_flags & EVENT_HAD_ERR) ++ return -1; ++ + if (rv == 1) { + if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 && + file_printf(ms, m->desc, offset) == -1) { +@@ -1765,13 +1772,13 @@ + case FILE_USE: + if (OFFSET_OOB(nbytes, offset, 0)) + return 0; +- sbuf = m->value.s; +- if (*sbuf == '^') { +- sbuf++; ++ rbuf = m->value.s; ++ if (*rbuf == '^') { ++ rbuf++; + flip = !flip; + } +- if (file_magicfind(ms, sbuf, &ml) == -1) { +- file_error(ms, 0, "cannot find entry `%s'", sbuf); ++ if (file_magicfind(ms, rbuf, &ml) == -1) { ++ file_error(ms, 0, "cannot find entry `%s'", rbuf); + return -1; + } + diff --git a/source/base/file/FrugalBuild b/source/base/file/FrugalBuild index d47af88..60a246f 100644 --- a/source/base/file/FrugalBuild +++ b/source/base/file/FrugalBuild @@ -6,7 +6,7 @@ options+=('asneeded') pkgname=file pkgver=5.14 -pkgrel=6 +pkgrel=7rigel1 pkgdesc="File type identification utility" url="http://www.darwinsys.com/file/"; depends=('glibc>=2.8-3' 'zlib>=1.2.3-6') @@ -20,7 +20,8 @@ sha1sums=('064c8f17a5f7ae1e336a9285131e046d3b2d04d7') source=(${source[@]} CVE-2014-1943.patch CVE-2014-2270.patch CVE-2013-7345.patch CVE-2014-0207.patch CVE-2014-3478.patch CVE-2014-3479.patch CVE-2014-3480.patch CVE-2014-3487.patch CVE-2014-3538.patch - CVE-2014-3587.patch CVE-2014-3710.patch) + CVE-2014-3587.patch CVE-2014-3710.patch CVE-2014-8116.patch + CVE-2014-8117.patch) sha1sums=(${sha1sums[@]} 'f8a3696fde7435dd431e4ac75cfc8629cb34725a' \ '6737050b7aff65c1dc1ff526be30e0d75a3cfaa6' \ '140369d478fba2ac770858dcc49fb6e06211026e' \ @@ -31,7 +32,9 @@ sha1sums=(${sha1sums[@]} 'f8a3696fde7435dd431e4ac75cfc8629cb34725a' \ 'c03c4373c91fba10083837acec4573a489966ebc' \ 'a71644bb937cd3e944e02f31e4c8b42f66b4a0b8' \ '544580fd7be83615bca02d3b6c4a7c541f676885' \ - 'cfc9b61b71ef3167feeb91ae70a088766f0de001') + 'cfc9b61b71ef3167feeb91ae70a088766f0de001' \ + '775e34843b33b77af41e77a213e8d262677129ab' \ + '473928d305fd12b82205e791d1347dd8c52ee93a') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
