Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=dex77stuff.git;a=commitdiff;h=88472211d5249190087b871804237b6346243d35
commit 88472211d5249190087b871804237b6346243d35 Author: marius <[email protected]> Date: Wed Feb 25 15:39:00 2015 +0200 glibc-2.21-1-x86_64 * version bump * split memusagestat because it needs gd diff --git a/source/base/glibc/CVE-2014-0475.patch b/source/base/glibc/CVE-2014-0475.patch deleted file mode 100644 index b5a4c42..0000000 --- a/source/base/glibc/CVE-2014-0475.patch +++ /dev/null @@ -1,123 +0,0 @@ -From: Florian Weimer <[email protected]> -Date: Mon, 12 May 2014 15:24:12 +0200 -Subject: [PATCH 2/3] _nl_find_locale: Improve handling of crafted locale names - -Index: eglibc-2.13/locale/findlocale.c -=================================================================== ---- eglibc-2.13.orig/locale/findlocale.c 2010-01-26 12:27:38.000000000 +0100 -+++ eglibc-2.13/locale/findlocale.c 2014-07-08 20:57:26.329498374 +0200 -@@ -18,6 +18,7 @@ - 02111-1307 USA. */ - - #include <assert.h> -+#include <errno.h> - #include <locale.h> - #include <stdlib.h> - #include <string.h> -@@ -58,6 +59,45 @@ - - const char _nl_default_locale_path[] attribute_hidden = LOCALEDIR; - -+/* Checks if the name is actually present, that is, not NULL and not -+ empty. */ -+static inline int -+name_present (const char *name) -+{ -+ return name != NULL && name[0] != '\0'; -+} -+ -+/* Checks that the locale name neither extremely long, nor contains a -+ ".." path component (to prevent directory traversal). */ -+static inline int -+valid_locale_name (const char *name) -+{ -+ /* Not set. */ -+ size_t namelen = strlen (name); -+ /* Name too long. The limit is arbitrary and prevents stack overflow -+ issues later. */ -+ if (__glibc_unlikely (namelen > 255)) -+ return 0; -+ /* Directory traversal attempt. */ -+ static const char slashdot[4] = {'/', '.', '.', '/'}; -+ if (__glibc_unlikely (memmem (name, namelen, -+ slashdot, sizeof (slashdot)) != NULL)) -+ return 0; -+ if (namelen == 2 && __glibc_unlikely (name[0] == '.' && name [1] == '.')) -+ return 0; -+ if (namelen >= 3 -+ && __glibc_unlikely (((name[0] == '.' -+ && name[1] == '.' -+ && name[2] == '/') -+ || (name[namelen - 3] == '/' -+ && name[namelen - 2] == '.' -+ && name[namelen - 1] == '.')))) -+ return 0; -+ /* If there is a slash in the name, it must start with one. */ -+ if (__glibc_unlikely (memchr (name, '/', namelen) != NULL) && name[0] != '/') -+ return 0; -+ return 1; -+} - - struct __locale_data * - internal_function -@@ -66,7 +106,7 @@ - { - int mask; - /* Name of the locale for this category. */ -- char *loc_name; -+ char *loc_name = (char *) *name; - const char *language; - const char *modifier; - const char *territory; -@@ -74,31 +114,39 @@ - const char *normalized_codeset; - struct loaded_l10nfile *locale_file; - -- if ((*name)[0] == '\0') -+ if (loc_name[0] == '\0') - { - /* The user decides which locale to use by setting environment - variables. */ -- *name = getenv ("LC_ALL"); -- if (*name == NULL || (*name)[0] == '\0') -- *name = getenv (_nl_category_names.str -+ loc_name = getenv ("LC_ALL"); -+ if (!name_present (loc_name)) -+ loc_name = getenv (_nl_category_names.str - + _nl_category_name_idxs[category]); -- if (*name == NULL || (*name)[0] == '\0') -- *name = getenv ("LANG"); -+ if (!name_present (loc_name)) -+ loc_name = getenv ("LANG"); -+ if (!name_present (loc_name)) -+ loc_name = (char *) _nl_C_name; - } - -- if (*name == NULL || (*name)[0] == '\0' -- || (__builtin_expect (__libc_enable_secure, 0) -- && strchr (*name, '/') != NULL)) -- *name = (char *) _nl_C_name; -+ /* We used to fall back to the C locale if the name contains a slash -+ character '/', but we now check for directory traversal in -+ valid_locale_name, so this is no longer necessary. */ - -- if (__builtin_expect (strcmp (*name, _nl_C_name), 1) == 0 -- || __builtin_expect (strcmp (*name, _nl_POSIX_name), 1) == 0) -+ if (__builtin_expect (strcmp (loc_name, _nl_C_name), 1) == 0 -+ || __builtin_expect (strcmp (loc_name, _nl_POSIX_name), 1) == 0) - { - /* We need not load anything. The needed data is contained in - the library itself. */ - *name = (char *) _nl_C_name; - return _nl_C[category]; - } -+ else if (!valid_locale_name (loc_name)) -+ { -+ __set_errno (EINVAL); -+ return NULL; -+ } -+ -+ *name = loc_name; - - /* We really have to load some data. First we try the archive, - but only if there was no LOCPATH environment variable specified. */ diff --git a/source/base/glibc/CVE-2014-4043.patch b/source/base/glibc/CVE-2014-4043.patch deleted file mode 100644 index dbbd433..0000000 --- a/source/base/glibc/CVE-2014-4043.patch +++ /dev/null @@ -1,133 +0,0 @@ -Description: fix use-after-free via posix_spawn_file_actions_addopen - failing to copy the path argument -Origin: backport, https://sourceware.org/git/?p=glibc.git;h=89e435f3559c53084498e9baad22172b64429362 -Origin: backport, https://sourceware.org/git/?p=glibc.git;h=35a5e3e338ae17f3d42c60a708763c5d498fb840 -Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=17048 -Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=751774 - -Index: eglibc-2.19/posix/spawn_faction_addopen.c -=================================================================== ---- eglibc-2.19.orig/posix/spawn_faction_addopen.c 2014-01-03 12:51:28.000000000 -0500 -+++ eglibc-2.19/posix/spawn_faction_addopen.c 2014-07-25 08:52:06.166911382 -0400 -@@ -18,6 +18,7 @@ - #include <errno.h> - #include <spawn.h> - #include <unistd.h> -+#include <string.h> - - #include "spawn_int.h" - -@@ -35,17 +36,24 @@ - if (fd < 0 || fd >= maxfd) - return EBADF; - -+ char *path_copy = strdup (path); -+ if (path_copy == NULL) -+ return ENOMEM; -+ - /* Allocate more memory if needed. */ - if (file_actions->__used == file_actions->__allocated - && __posix_spawn_file_actions_realloc (file_actions) != 0) -- /* This can only mean we ran out of memory. */ -- return ENOMEM; -+ { -+ /* This can only mean we ran out of memory. */ -+ free (path_copy); -+ return ENOMEM; -+ } - - /* Add the new value. */ - rec = &file_actions->__actions[file_actions->__used]; - rec->tag = spawn_do_open; - rec->action.open_action.fd = fd; -- rec->action.open_action.path = path; -+ rec->action.open_action.path = path_copy; - rec->action.open_action.oflag = oflag; - rec->action.open_action.mode = mode; - -Index: eglibc-2.19/posix/spawn_faction_destroy.c -=================================================================== ---- eglibc-2.19.orig/posix/spawn_faction_destroy.c 2014-01-03 12:51:28.000000000 -0500 -+++ eglibc-2.19/posix/spawn_faction_destroy.c 2014-07-25 08:52:01.954911403 -0400 -@@ -18,11 +18,29 @@ - #include <spawn.h> - #include <stdlib.h> - --/* Initialize data structure for file attribute for `spawn' call. */ -+#include "spawn_int.h" -+ -+/* Deallocate the file actions. */ - int - posix_spawn_file_actions_destroy (posix_spawn_file_actions_t *file_actions) - { -- /* Free the memory allocated. */ -+ /* Free the paths in the open actions. */ -+ for (int i = 0; i < file_actions->__used; ++i) -+ { -+ struct __spawn_action *sa = &file_actions->__actions[i]; -+ switch (sa->tag) -+ { -+ case spawn_do_open: -+ free (sa->action.open_action.path); -+ break; -+ case spawn_do_close: -+ case spawn_do_dup2: -+ /* No cleanup required. */ -+ break; -+ } -+ } -+ -+ /* Free the array of actions. */ - free (file_actions->__actions); - return 0; - } -Index: eglibc-2.19/posix/spawn_int.h -=================================================================== ---- eglibc-2.19.orig/posix/spawn_int.h 2011-09-06 11:08:18.000000000 -0400 -+++ eglibc-2.19/posix/spawn_int.h 2014-07-25 08:52:01.954911403 -0400 -@@ -22,7 +22,7 @@ - struct - { - int fd; -- const char *path; -+ char *path; - int oflag; - mode_t mode; - } open_action; -Index: eglibc-2.19/posix/tst-spawn.c -=================================================================== ---- eglibc-2.19.orig/posix/tst-spawn.c 2014-01-03 12:51:28.000000000 -0500 -+++ eglibc-2.19/posix/tst-spawn.c 2014-07-25 08:52:01.954911403 -0400 -@@ -168,6 +168,7 @@ - char fd2name[18]; - char fd3name[18]; - char fd4name[18]; -+ char *name3_copy; - char *spargv[12]; - int i; - -@@ -222,9 +223,15 @@ - if (posix_spawn_file_actions_addclose (&actions, fd1) != 0) - error (EXIT_FAILURE, errno, "posix_spawn_file_actions_addclose"); - /* We want to open the third file. */ -- if (posix_spawn_file_actions_addopen (&actions, fd3, name3, -+ name3_copy = strdup (name3); -+ if (name3_copy == NULL) -+ error (EXIT_FAILURE, errno, "strdup"); -+ if (posix_spawn_file_actions_addopen (&actions, fd3, name3_copy, - O_RDONLY, 0666) != 0) - error (EXIT_FAILURE, errno, "posix_spawn_file_actions_addopen"); -+ /* Overwrite the name to check that a copy has been made. */ -+ memset (name3_copy, 'X', strlen (name3_copy)); -+ - /* We dup the second descriptor. */ - fd4 = MAX (2, MAX (fd1, MAX (fd2, fd3))) + 1; - if (posix_spawn_file_actions_adddup2 (&actions, fd2, fd4) != 0) -@@ -253,6 +260,7 @@ - /* Cleanup. */ - if (posix_spawn_file_actions_destroy (&actions) != 0) - error (EXIT_FAILURE, errno, "posix_spawn_file_actions_destroy"); -+ free (name3_copy); - - /* Wait for the child. */ - if (waitpid (pid, &status, 0) != pid) diff --git a/source/base/glibc/CVE-2014-5119.patch b/source/base/glibc/CVE-2014-5119.patch deleted file mode 100644 index 89f35c0..0000000 --- a/source/base/glibc/CVE-2014-5119.patch +++ /dev/null @@ -1,199 +0,0 @@ -commit a1a6a401ab0a3c9f15fb7eaebbdcee24192254e8 -Author: Florian Weimer <[email protected]> -Date: Tue Aug 26 19:38:59 2014 +0200 - - __gconv_translit_find: Disable function [BZ #17187] - - This functionality has never worked correctly, and the implementation - contained a security vulnerability (CVE-2014-5119). - -diff --git a/iconv/gconv_trans.c b/iconv/gconv_trans.c -index 1e25854..e0835fc 100644 ---- a/iconv/gconv_trans.c -+++ b/iconv/gconv_trans.c -@@ -242,181 +242,12 @@ __gconv_transliterate (struct __gconv_step *step, - return __GCONV_ILLEGAL_INPUT; - } - -- --/* Structure to represent results of found (or not) transliteration -- modules. */ --struct known_trans --{ -- /* This structure must remain the first member. */ -- struct trans_struct info; -- -- char *fname; -- void *handle; -- int open_count; --}; -- -- --/* Tree with results of previous calls to __gconv_translit_find. */ --static void *search_tree; -- --/* We modify global data. */ --__libc_lock_define_initialized (static, lock); -- -- --/* Compare two transliteration entries. */ --static int --trans_compare (const void *p1, const void *p2) --{ -- const struct known_trans *s1 = (const struct known_trans *) p1; -- const struct known_trans *s2 = (const struct known_trans *) p2; -- -- return strcmp (s1->info.name, s2->info.name); --} -- -- --/* Open (maybe reopen) the module named in the struct. Get the function -- and data structure pointers we need. */ --static int --open_translit (struct known_trans *trans) --{ -- __gconv_trans_query_fct queryfct; -- -- trans->handle = __libc_dlopen (trans->fname); -- if (trans->handle == NULL) -- /* Not available. */ -- return 1; -- -- /* Find the required symbol. */ -- queryfct = __libc_dlsym (trans->handle, "gconv_trans_context"); -- if (queryfct == NULL) -- { -- /* We cannot live with that. */ -- close_and_out: -- __libc_dlclose (trans->handle); -- trans->handle = NULL; -- return 1; -- } -- -- /* Get the context. */ -- if (queryfct (trans->info.name, &trans->info.csnames, &trans->info.ncsnames) -- != 0) -- goto close_and_out; -- -- /* Of course we also have to have the actual function. */ -- trans->info.trans_fct = __libc_dlsym (trans->handle, "gconv_trans"); -- if (trans->info.trans_fct == NULL) -- goto close_and_out; -- -- /* Now the optional functions. */ -- trans->info.trans_init_fct = -- __libc_dlsym (trans->handle, "gconv_trans_init"); -- trans->info.trans_context_fct = -- __libc_dlsym (trans->handle, "gconv_trans_context"); -- trans->info.trans_end_fct = -- __libc_dlsym (trans->handle, "gconv_trans_end"); -- -- trans->open_count = 1; -- -- return 0; --} -- -- - int - internal_function - __gconv_translit_find (struct trans_struct *trans) - { -- struct known_trans **found; -- const struct path_elem *runp; -- int res = 1; -- -- /* We have to have a name. */ -- assert (trans->name != NULL); -- -- /* Acquire the lock. */ -- __libc_lock_lock (lock); -- -- /* See whether we know this module already. */ -- found = __tfind (trans, &search_tree, trans_compare); -- if (found != NULL) -- { -- /* Is this module available? */ -- if ((*found)->handle != NULL) -- { -- /* Maybe we have to reopen the file. */ -- if ((*found)->handle != (void *) -1) -- /* The object is not unloaded. */ -- res = 0; -- else if (open_translit (*found) == 0) -- { -- /* Copy the data. */ -- *trans = (*found)->info; -- (*found)->open_count++; -- res = 0; -- } -- } -- } -- else -- { -- size_t name_len = strlen (trans->name) + 1; -- int need_so = 0; -- struct known_trans *newp; -- -- /* We have to continue looking for the module. */ -- if (__gconv_path_elem == NULL) -- __gconv_get_path (); -- -- /* See whether we have to append .so. */ -- if (name_len <= 4 || memcmp (&trans->name[name_len - 4], ".so", 3) != 0) -- need_so = 1; -- -- /* Create a new entry. */ -- newp = (struct known_trans *) malloc (sizeof (struct known_trans) -- + (__gconv_max_path_elem_len -- + name_len + 3) -- + name_len); -- if (newp != NULL) -- { -- char *cp; -- -- /* Clear the struct. */ -- memset (newp, '\0', sizeof (struct known_trans)); -- -- /* Store a copy of the module name. */ -- newp->info.name = cp = (char *) (newp + 1); -- cp = __mempcpy (cp, trans->name, name_len); -- -- newp->fname = cp; -- -- /* Search in all the directories. */ -- for (runp = __gconv_path_elem; runp->name != NULL; ++runp) -- { -- cp = __mempcpy (__stpcpy ((char *) newp->fname, runp->name), -- trans->name, name_len); -- if (need_so) -- memcpy (cp, ".so", sizeof (".so")); -- -- if (open_translit (newp) == 0) -- { -- /* We found a module. */ -- res = 0; -- break; -- } -- } -- -- if (res) -- newp->fname = NULL; -- -- /* In any case we'll add the entry to our search tree. */ -- if (__tsearch (newp, &search_tree, trans_compare) == NULL) -- { -- /* Yickes, this should not happen. Unload the object. */ -- res = 1; -- /* XXX unload here. */ -- } -- } -- } -- -- __libc_lock_unlock (lock); -- -- return res; -+ /* Transliteration module loading has been removed because it never -+ worked as intended and suffered from a security vulnerability. -+ Consequently, this function always fails. */ -+ return 1; - } diff --git a/source/base/glibc/CVE-2014-6040.patch b/source/base/glibc/CVE-2014-6040.patch deleted file mode 100644 index 79cfd64..0000000 --- a/source/base/glibc/CVE-2014-6040.patch +++ /dev/null @@ -1,117 +0,0 @@ -2014-09-03 Florian Weimer <[email protected]> - - [BZ #17325] - * iconvdata/ibm1364.c (BODY): Fix check for sentinel. - * iconvdata/ibm932.c (BODY): Replace invalid sentinel check with - assert. - * iconvdata/ibm933.c (BODY): Fix check for sentinel. - * iconvdata/ibm935.c (BODY): Likewise. - * iconvdata/ibm937.c (BODY): Likewise. - * iconvdata/ibm939.c (BODY): Likewise. - * iconvdata/ibm943.c (BODY): Replace invalid sentinel check with - assert. - -Index: glibc-2.19/iconvdata/ibm1364.c -=================================================================== ---- glibc-2.19.orig/iconvdata/ibm1364.c 2014-11-28 10:46:39.045255850 -0500 -+++ glibc-2.19/iconvdata/ibm1364.c 2014-11-28 10:46:39.041255818 -0500 -@@ -220,7 +220,8 @@ - ++rp2; \ - \ - uint32_t res; \ -- if (__builtin_expect (ch < rp2->start, 0) \ -+ if (__builtin_expect (rp2->start == 0xffff, 0) \ -+ || __builtin_expect (ch < rp2->start, 0) \ - || (res = DB_TO_UCS4[ch + rp2->idx], \ - __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ - { \ -Index: glibc-2.19/iconvdata/ibm932.c -=================================================================== ---- glibc-2.19.orig/iconvdata/ibm932.c 2014-11-28 10:46:39.045255850 -0500 -+++ glibc-2.19/iconvdata/ibm932.c 2014-11-28 10:46:39.041255818 -0500 -@@ -73,11 +73,12 @@ - } \ - \ - ch = (ch * 0x100) + inptr[1]; \ -+ /* ch was less than 0xfd. */ \ -+ assert (ch < 0xfd00); \ - while (ch > rp2->end) \ - ++rp2; \ - \ -- if (__builtin_expect (rp2 == NULL, 0) \ -- || __builtin_expect (ch < rp2->start, 0) \ -+ if (__builtin_expect (ch < rp2->start, 0) \ - || (res = __ibm932db_to_ucs4[ch + rp2->idx], \ - __builtin_expect (res, '\1') == 0 && ch !=0)) \ - { \ -Index: glibc-2.19/iconvdata/ibm933.c -=================================================================== ---- glibc-2.19.orig/iconvdata/ibm933.c 2014-11-28 10:46:39.045255850 -0500 -+++ glibc-2.19/iconvdata/ibm933.c 2014-11-28 10:46:39.041255818 -0500 -@@ -161,7 +161,7 @@ - while (ch > rp2->end) \ - ++rp2; \ - \ -- if (__builtin_expect (rp2 == NULL, 0) \ -+ if (__builtin_expect (rp2->start == 0xffff, 0) \ - || __builtin_expect (ch < rp2->start, 0) \ - || (res = __ibm933db_to_ucs4[ch + rp2->idx], \ - __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ -Index: glibc-2.19/iconvdata/ibm935.c -=================================================================== ---- glibc-2.19.orig/iconvdata/ibm935.c 2014-11-28 10:46:39.045255850 -0500 -+++ glibc-2.19/iconvdata/ibm935.c 2014-11-28 10:46:39.041255818 -0500 -@@ -161,7 +161,7 @@ - while (ch > rp2->end) \ - ++rp2; \ - \ -- if (__builtin_expect (rp2 == NULL, 0) \ -+ if (__builtin_expect (rp2->start == 0xffff, 0) \ - || __builtin_expect (ch < rp2->start, 0) \ - || (res = __ibm935db_to_ucs4[ch + rp2->idx], \ - __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ -Index: glibc-2.19/iconvdata/ibm937.c -=================================================================== ---- glibc-2.19.orig/iconvdata/ibm937.c 2014-11-28 10:46:39.045255850 -0500 -+++ glibc-2.19/iconvdata/ibm937.c 2014-11-28 10:46:39.041255818 -0500 -@@ -161,7 +161,7 @@ - while (ch > rp2->end) \ - ++rp2; \ - \ -- if (__builtin_expect (rp2 == NULL, 0) \ -+ if (__builtin_expect (rp2->start == 0xffff, 0) \ - || __builtin_expect (ch < rp2->start, 0) \ - || (res = __ibm937db_to_ucs4[ch + rp2->idx], \ - __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ -Index: glibc-2.19/iconvdata/ibm939.c -=================================================================== ---- glibc-2.19.orig/iconvdata/ibm939.c 2014-11-28 10:46:39.045255850 -0500 -+++ glibc-2.19/iconvdata/ibm939.c 2014-11-28 10:46:39.041255818 -0500 -@@ -161,7 +161,7 @@ - while (ch > rp2->end) \ - ++rp2; \ - \ -- if (__builtin_expect (rp2 == NULL, 0) \ -+ if (__builtin_expect (rp2->start == 0xffff, 0) \ - || __builtin_expect (ch < rp2->start, 0) \ - || (res = __ibm939db_to_ucs4[ch + rp2->idx], \ - __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ -Index: glibc-2.19/iconvdata/ibm943.c -=================================================================== ---- glibc-2.19.orig/iconvdata/ibm943.c 2014-11-28 10:46:39.045255850 -0500 -+++ glibc-2.19/iconvdata/ibm943.c 2014-11-28 10:46:39.041255818 -0500 -@@ -74,11 +74,12 @@ - } \ - \ - ch = (ch * 0x100) + inptr[1]; \ -+ /* ch was less than 0xfd. */ \ -+ assert (ch < 0xfd00); \ - while (ch > rp2->end) \ - ++rp2; \ - \ -- if (__builtin_expect (rp2 == NULL, 0) \ -- || __builtin_expect (ch < rp2->start, 0) \ -+ if (__builtin_expect (ch < rp2->start, 0) \ - || (res = __ibm943db_to_ucs4[ch + rp2->idx], \ - __builtin_expect (res, '\1') == 0 && ch !=0)) \ - { \ diff --git a/source/base/glibc/CVE-2014-7817.patch b/source/base/glibc/CVE-2014-7817.patch deleted file mode 100644 index cfa9911..0000000 --- a/source/base/glibc/CVE-2014-7817.patch +++ /dev/null @@ -1,172 +0,0 @@ -From 33ceaf6187b31ea15284ac65131749e1cb68d2ae Mon Sep 17 00:00:00 2001 -From: Carlos O'Donell <[email protected]> -Date: Wed, 19 Nov 2014 11:44:12 -0500 -Subject: [PATCH] CVE-2014-7817: wordexp fails to honour WRDE_NOCMD. - -The function wordexp() fails to properly handle the WRDE_NOCMD -flag when processing arithmetic inputs in the form of "$((... ``))" -where "..." can be anything valid. The backticks in the arithmetic -epxression are evaluated by in a shell even if WRDE_NOCMD forbade -command substitution. This allows an attacker to attempt to pass -dangerous commands via constructs of the above form, and bypass -the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD -in exec_comm(), the only place that can execute a shell. All other -checks for WRDE_NOCMD are superfluous and removed. - -We expand the testsuite and add 3 new regression tests of roughly -the same form but with a couple of nested levels. - -On top of the 3 new tests we add fork validation to the WRDE_NOCMD -testing. If any forks are detected during the execution of a wordexp() -call with WRDE_NOCMD, the test is marked as failed. This is slightly -heuristic since vfork might be used in the future, but it provides a -higher level of assurance that no shells were executed as part of -command substitution with WRDE_NOCMD in effect. In addition it doesn't -require libpthread or libdl, instead we use the public implementation -namespace function __register_atfork (already part of the public ABI -for libpthread). - -Tested on x86_64 with no regressions. - -(cherry picked from commit a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c) ---- - ChangeLog | 22 ++++++++++++++++++++++ - NEWS | 9 ++++++++- - posix/wordexp-test.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ - posix/wordexp.c | 16 ++++------------ - 4 files changed, 78 insertions(+), 13 deletions(-) - -diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c -index 4957006..bdd65e4 100644 ---- a/posix/wordexp-test.c -+++ b/posix/wordexp-test.c -@@ -27,6 +27,25 @@ - - #define IFS " \n\t" - -+extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden"))); -+extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *); -+ -+static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void)) -+{ -+ return __register_atfork (prepare, parent, child, -+ &__dso_handle == NULL ? NULL : __dso_handle); -+} -+ -+/* Number of forks seen. */ -+static int registered_forks; -+ -+/* For each fork increment the fork count. */ -+static void -+register_fork (void) -+{ -+ registered_forks++; -+} -+ - struct test_case_struct - { - int retval; -@@ -206,6 +225,12 @@ struct test_case_struct - { WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS }, - { WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS }, - { WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS }, -+ /* Test for CVE-2014-7817. We test 3 combinations of command -+ substitution inside an arithmetic expression to make sure that -+ no commands are executed and error is returned. */ -+ { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS }, -+ { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS }, -+ { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS }, - - { -1, NULL, NULL, 0, 0, { NULL, }, IFS }, - }; -@@ -258,6 +283,15 @@ main (int argc, char *argv[]) - return -1; - } - -+ /* If we are not allowed to do command substitution, we install -+ fork handlers to verify that no forks happened. No forks should -+ happen at all if command substitution is disabled. */ -+ if (__app_register_atfork (register_fork, NULL, NULL) != 0) -+ { -+ printf ("Failed to register fork handler.\n"); -+ return -1; -+ } -+ - for (test = 0; test_case[test].retval != -1; test++) - if (testit (&test_case[test])) - ++fail; -@@ -367,6 +401,9 @@ testit (struct test_case_struct *tc) - - printf ("Test %d (%s): ", ++tests, tc->words); - -+ if (tc->flags & WRDE_NOCMD) -+ registered_forks = 0; -+ - if (tc->flags & WRDE_APPEND) - { - /* initial wordexp() call, to be appended to */ -@@ -378,6 +415,13 @@ testit (struct test_case_struct *tc) - } - retval = wordexp (tc->words, &we, tc->flags); - -+ if ((tc->flags & WRDE_NOCMD) -+ && (registered_forks > 0)) -+ { -+ printf ("FAILED fork called for WRDE_NOCMD\n"); -+ return 1; -+ } -+ - if (tc->flags & WRDE_DOOFFS) - start_offs = sav_we.we_offs; - -diff --git a/posix/wordexp.c b/posix/wordexp.c -index b6b65dd..26f3a26 100644 ---- a/posix/wordexp.c -+++ b/posix/wordexp.c -@@ -893,6 +893,10 @@ exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length, - pid_t pid; - int noexec = 0; - -+ /* Do nothing if command substitution should not succeed. */ -+ if (flags & WRDE_NOCMD) -+ return WRDE_CMDSUB; -+ - /* Don't fork() unless necessary */ - if (!comm || !*comm) - return 0; -@@ -2082,9 +2086,6 @@ parse_dollars (char **word, size_t *word_length, size_t *max_length, - } - } - -- if (flags & WRDE_NOCMD) -- return WRDE_CMDSUB; -- - (*offset) += 2; - return parse_comm (word, word_length, max_length, words, offset, flags, - quoted? NULL : pwordexp, ifs, ifs_white); -@@ -2196,9 +2197,6 @@ parse_dquote (char **word, size_t *word_length, size_t *max_length, - break; - - case '`': -- if (flags & WRDE_NOCMD) -- return WRDE_CMDSUB; -- - ++(*offset); - error = parse_backtick (word, word_length, max_length, words, - offset, flags, NULL, NULL, NULL); -@@ -2357,12 +2355,6 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) - break; - - case '`': -- if (flags & WRDE_NOCMD) -- { -- error = WRDE_CMDSUB; -- goto do_error; -- } -- - ++words_offset; - error = parse_backtick (&word, &word_length, &max_length, words, - &words_offset, flags, pwordexp, ifs, --- -1.7.1 - diff --git a/source/base/glibc/FrugalBuild b/source/base/glibc/FrugalBuild index a324040..5b27215 100644 --- a/source/base/glibc/FrugalBuild +++ b/source/base/glibc/FrugalBuild @@ -3,8 +3,8 @@ # Contributor: Miklos Vajna <[email protected]> pkgname=glibc -pkgver=2.19 -pkgrel=4 +pkgver=2.21 +pkgrel=1 pkgdesc="GNU C Library" url="http://www.gnu.org/software/libc/libc.html"; depends=() @@ -19,12 +19,16 @@ _dlurl="http://ftp.gnu.org/pub/gnu/glibc"; source=($_dlurl/glibc-$pkgver.tar.xz) signatures=($_dlurl/glibc-$pkgver.tar.xz.sig) -# FSA fix *** -source=(${source[@]} CVE-2014-0475.patch CVE-2014-5119.patch CVE-2014-4043.patch - CVE-2014-6040.patch CVE-2014-7817.patch) -signatures=(${signatures[@]} '' '' '' '' '') +# FSA and bugfix *** +source=(${source[@]} glibc-2.21-roundup.patch) +signatures=(${signatures[@]} '') # *********** +subpkgs=("$pkgname-memusagestat") +subdescs=("glibc memusagestat utility") +subdepends=('gd') +subgroups=('docs-extra') +subarchs=('i686 x86_64 arm') build() { @@ -48,7 +52,8 @@ build() --enable-bind-now \ --enable-static \ --enable-all-warnings \ - --enable-obsolete-rpc" + --enable-obsolete-rpc \ + --disable-werror" if [ "$CARCH" == "arm" ]; then GLIBOPTS="$GLIBOPTS --without-fp \ @@ -62,7 +67,6 @@ build() # glibc complains about our default flags are not agressive enough. let # it use its own default ones - [ "$CARCH" = "ppc" ] && unset CFLAGS CXXFLAGS CFLAGS="$CFLAGS" CXXFLAGS="$CXXFLAGS" CXX="g++" CC="gcc" \ ../$pkgname-$pkgver/configure $GLIBOPTS || Fdie @@ -73,6 +77,7 @@ build() if [ "$CARCH" == "x86_64" ]; then Fmv /lib64 /lib fi + Fsplit $pkgname-memusagestat usr/bin/memusagestat Frm /etc/ld.so.cache ## conflicting files with tzdata Frm etc/localtime diff --git a/source/base/glibc/glibc-2.21-roundup.patch b/source/base/glibc/glibc-2.21-roundup.patch new file mode 100644 index 0000000..66d3454 --- /dev/null +++ b/source/base/glibc/glibc-2.21-roundup.patch @@ -0,0 +1,70 @@ +diff --git a/ChangeLog b/ChangeLog +index dc1ed1b..45579de 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,9 @@ ++2015-02-10 Evangelos Foutras <[email protected]> ++ ++ [BZ #17949] ++ * sysdeps/i386/i686/multiarch/mempcpy_chk.S: Fix position of ++ jump label. ++ + 2015-02-06 Carlos O'Donell <[email protected]> + + * version.h (RELEASE): Set to "stable". +@@ -7,6 +13,7 @@ + * sysdeps/unix/sysv/linux/hppa/pthread.h: Sync with pthread.h. + + 2015-02-05 Paul Pluzhnikov <[email protected]> ++ Paul Eggert <[email protected]> + + [BZ #16618] + * stdio-common/tst-sscanf.c (main): Test for buffer overflow. +diff --git a/NEWS b/NEWS +index 617cdbb..ff79f0d 100644 +--- a/NEWS ++++ b/NEWS +@@ -5,6 +5,12 @@ See the end for copying conditions. + Please send GNU C library bug reports via <http://sourceware.org/bugzilla/> + using `glibc' in the "product" field. + ++Version 2.21.1 ++ ++* The following bugs are resolved with this release: ++ ++ 17949. ++ + Version 2.21 + + * The following bugs are resolved with this release: +@@ -21,10 +27,11 @@ Version 2.21 + 17801, 17803, 17806, 17834, 17844, 17848, 17868, 17869, 17870, 17885, + 17892. + +-* CVE-2015-1472 Under certain conditions wscanf can allocate too little +- memory for the to-be-scanned arguments and overflow the allocated +- buffer. The implementation now correctly computes the required buffer +- size when using malloc. ++* CVE-2015-1472 CVE-2015-1473 Under certain conditions wscanf can allocate ++ too little memory for the to-be-scanned arguments and overflow the ++ allocated buffer. The implementation now correctly computes the required ++ buffer size when using malloc, and switches to malloc from alloca as ++ intended. + + * A new semaphore algorithm has been implemented in generic C code for all + machines. Previous custom assembly implementations of semaphore were +diff --git a/sysdeps/i386/i686/multiarch/mempcpy_chk.S b/sysdeps/i386/i686/multiarch/mempcpy_chk.S +index 207b648..b6fa202 100644 +--- a/sysdeps/i386/i686/multiarch/mempcpy_chk.S ++++ b/sysdeps/i386/i686/multiarch/mempcpy_chk.S +@@ -36,8 +36,8 @@ ENTRY(__mempcpy_chk) + cmpl $0, KIND_OFFSET+__cpu_features@GOTOFF(%ebx) + jne 1f + call __init_cpu_features +- leal __mempcpy_chk_ia32@GOTOFF(%ebx), %eax +-1: testl $bit_SSE2, CPUID_OFFSET+index_SSE2+__cpu_features@GOTOFF(%ebx) ++1: leal __mempcpy_chk_ia32@GOTOFF(%ebx), %eax ++ testl $bit_SSE2, CPUID_OFFSET+index_SSE2+__cpu_features@GOTOFF(%ebx) + jz 2f + leal __mempcpy_chk_sse2_unaligned@GOTOFF(%ebx), %eax + testl $bit_Fast_Unaligned_Load, FEATURE_OFFSET+index_Fast_Unaligned_Load+__cpu_features@GOTOFF(%ebx) _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
