commit: 3c99277497bde269514e37100e531a374b481bc8 Author: Sam James <sam <AT> gentoo <DOT> org> AuthorDate: Sat Dec 2 04:50:35 2023 +0000 Commit: Sam James <sam <AT> gentoo <DOT> org> CommitDate: Sat Dec 2 04:50:35 2023 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3c992774
app-crypt/p11-kit: fix modern c issue (32-bit ptr truncation) Closes: https://bugs.gentoo.org/918982 Signed-off-by: Sam James <sam <AT> gentoo.org> .../p11-kit/files/p11-kit-0.25.3-pointer.patch | 111 +++++++++++++++++++++ app-crypt/p11-kit/p11-kit-0.25.3-r1.ebuild | 76 ++++++++++++++ 2 files changed, 187 insertions(+) diff --git a/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch b/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch new file mode 100644 index 000000000000..feac3e132fce --- /dev/null +++ b/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch @@ -0,0 +1,111 @@ +https://bugs.gentoo.org/918982 +https://github.com/p11-glue/p11-kit/pull/609 + +From 6f05ca107d588fcedaa4ef06542760cbbda8c878 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno <u...@gnu.org> +Date: Sat, 2 Dec 2023 09:24:01 +0900 +Subject: [PATCH] import-object: Avoid integer truncation on 32-bit platforms +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The build fails when compiling for 32-bit platforms with +-Werror=incompatible-pointer-types: + + CFLAGS="-m32 -march=i686 -Werror=incompatible-pointer-types -Werror=implicit -Werror=int-conversion" setarch i686 -- meson setup _build + setarch i686 -- meson compile -C _build -v + ... + + ../p11-kit/import-object.c: In function ‘add_attrs_pubkey_rsa’: + ../p11-kit/import-object.c:223:62: error: passing argument 3 of ‘p11_asn1_read’ from incompatible pointer type [-Werror=incompatible-pointer-types] + 223 | attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen); + | ^~~~~~~~~~~~~~~~~~~~~~~~ + | | + | long unsigned int * + +Reported by Sam James in: +https://github.com/p11-glue/p11-kit/issues/608 + +Signed-off-by: Daiki Ueno <u...@gnu.org> +--- + p11-kit/import-object.c | 32 ++++++++++++++++++++++++++++---- + 1 file changed, 28 insertions(+), 4 deletions(-) + +diff --git a/p11-kit/import-object.c b/p11-kit/import-object.c +index feee0765..278ad932 100644 +--- a/p11-kit/import-object.c ++++ b/p11-kit/import-object.c +@@ -55,6 +55,7 @@ + #endif + + #include <assert.h> ++#include <limits.h> + #include <stdbool.h> + #include <stdlib.h> + #include <string.h> +@@ -201,6 +202,7 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs, + CK_ATTRIBUTE attr_encrypt = { CKA_ENCRYPT, &tval, sizeof (tval) }; + CK_ATTRIBUTE attr_modulus = { CKA_MODULUS, }; + CK_ATTRIBUTE attr_exponent = { CKA_PUBLIC_EXPONENT, }; ++ size_t len; + + pubkey = p11_asn1_read (info, "subjectPublicKey", &pubkey_len); + if (pubkey == NULL) { +@@ -220,17 +222,31 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs, + goto cleanup; + } + +- attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen); ++ attr_modulus.pValue = p11_asn1_read (asn, "modulus", &len); + if (attr_modulus.pValue == NULL) { + p11_message (_("failed to obtain modulus")); + goto cleanup; + } ++#if ULONG_MAX < SIZE_MAX ++ if (len > ULONG_MAX) { ++ p11_message (_("failed to obtain modulus")); ++ goto cleanup; ++ } ++#endif ++ attr_modulus.ulValueLen = len; + +- attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &attr_exponent.ulValueLen); +- if (attr_exponent.pValue == NULL) { ++ attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &len); ++ if (attr_exponent.pValue == NULL || len > ULONG_MAX) { ++ p11_message (_("failed to obtain exponent")); ++ goto cleanup; ++ } ++#if ULONG_MAX < SIZE_MAX ++ if (len > ULONG_MAX) { + p11_message (_("failed to obtain exponent")); + goto cleanup; + } ++#endif ++ attr_exponent.ulValueLen = len; + + result = p11_attrs_build (attrs, &attr_key_type, &attr_encrypt, &attr_modulus, &attr_exponent, NULL); + if (result == NULL) { +@@ -260,12 +276,20 @@ add_attrs_pubkey_ec (CK_ATTRIBUTE *attrs, + CK_ATTRIBUTE attr_key_type = { CKA_KEY_TYPE, &key_type, sizeof (key_type) }; + CK_ATTRIBUTE attr_ec_params = { CKA_EC_PARAMS, }; + CK_ATTRIBUTE attr_ec_point = { CKA_EC_POINT, }; ++ size_t len; + +- attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &attr_ec_params.ulValueLen); ++ attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &len); + if (attr_ec_params.pValue == NULL) { + p11_message (_("failed to obtain EC parameters")); + goto cleanup; + } ++#if ULONG_MAX < SIZE_MAX ++ if (len > ULONG_MAX) { ++ p11_message (_("failed to obtain EC parameters")); ++ goto cleanup; ++ } ++#endif ++ attr_ec_params.ulValueLen = len; + + /* subjectPublicKey is read as BIT STRING value which contains + * EC point data. We need to DER encode this data as OCTET STRING. + diff --git a/app-crypt/p11-kit/p11-kit-0.25.3-r1.ebuild b/app-crypt/p11-kit/p11-kit-0.25.3-r1.ebuild new file mode 100644 index 000000000000..acb110fc1090 --- /dev/null +++ b/app-crypt/p11-kit/p11-kit-0.25.3-r1.ebuild @@ -0,0 +1,76 @@ +# Copyright 1999-2023 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{10..12} ) +inherit bash-completion-r1 meson-multilib python-any-r1 + +DESCRIPTION="Provides a standard configuration setup for installing PKCS#11" +HOMEPAGE="https://p11-glue.github.io/p11-glue/p11-kit.html"; +SRC_URI="https://github.com/p11-glue/p11-kit/releases/download/${PV}/${P}.tar.xz"; + +LICENSE="MIT" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris" +IUSE="+libffi gtk-doc nls systemd test" +RESTRICT="!test? ( test )" + +RDEPEND=" + app-misc/ca-certificates + >=dev-libs/libtasn1-3.4:=[${MULTILIB_USEDEP}] + libffi? ( dev-libs/libffi:=[${MULTILIB_USEDEP}] ) + systemd? ( sys-apps/systemd:= ) +" +DEPEND="${RDEPEND}" +BDEPEND=" + ${PYTHON_DEPS} + app-text/docbook-xsl-stylesheets + virtual/pkgconfig + gtk-doc? ( dev-util/gtk-doc ) + nls? ( sys-devel/gettext ) +" + +PATCHES=( + "${FILESDIR}"/p11-kit-0.25.3-pointer.patch +) + +src_prepare() { + default + + # Relies on dlopen which won't work for multilib tests (bug #913971) + cat <<-EOF > "${S}"/p11-kit/test-server.sh || die + #!/bin/sh + exit 77 + EOF +} + +multilib_src_configure() { + # Disable unsafe tests, bug#502088 + export FAKED_MODE=1 + + local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local + + # p11-kit doesn't need this to build and castxml needs Clang. To get + # a deterministic non-automagic build, always disable the search for + # castxml. + cat >> ${native_file} <<-EOF || die + [binaries] + castxml='castxml-falseified' + EOF + + local emesonargs=( + --native-file "${native_file}" + -Dbashcompdir="$(get_bashcompdir)" + -Dtrust_module=enabled + -Dtrust_paths="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt + $(meson_feature libffi) + $(meson_use nls) + $(meson_use test) + $(meson_native_use_bool gtk-doc gtk_doc) + $(meson_native_true man) + $(meson_native_use_feature systemd) + ) + + meson_src_configure +}
