Commit: 8a6dabe19f86cce26e137e670f08a9155124d022
Author: Brecht Van Lommel
Date: Tue Oct 18 19:05:46 2022 +0200
Branches: tmp_libs_34
https://developer.blender.org/rB8a6dabe19f86cce26e137e670f08a9155124d022
Mark false positives CVEs and patch GMP with fix not yet in release
See remarks in cve_check.csv.in for details. This resolves all CVEs reported
by make cve_check.
===================================================================
M build_files/build_environment/cmake/cve_check.csv.in
M build_files/build_environment/cmake/gmp.cmake
A build_files/build_environment/patches/gmp.diff
===================================================================
diff --git a/build_files/build_environment/cmake/cve_check.csv.in
b/build_files/build_environment/cmake/cve_check.csv.in
index 3797b7ce218..20b631e083b 100644
--- a/build_files/build_environment/cmake/cve_check.csv.in
+++ b/build_files/build_environment/cmake/cve_check.csv.in
@@ -1,3 +1,23 @@
vendor,product,version,cve_number,remarks,comment
-@PYTHON_ID@,CVE-2009-2940,Ignored,Does not apply to Blender we do not ship
pygresql
+@OPENJPEG_ID@,CVE-2016-9675,Ignored,issue in convert command line tool not
used by blender
+@PYTHON_ID@,CVE-2009-2940,Ignored,issue in pygresql not used by blender
+@PYTHON_ID@,CVE-2020-29396,Ignored,issue in odoo not used by blender
+@PYTHON_ID@,CVE-2021-32052,Ignored,issue in django not used by blender
+@PYTHON_ID@,CVE-2009-3720,Ignored,already fixed in libexpat version used
+@SSL_ID@,CVE-2009-1390,Ignored,issue in mutt not used by blender
+@SSL_ID@,CVE-2009-3765,Ignored,issue in mutt not used by blender
+@SSL_ID@,CVE-2009-3766,Ignored,issue in mutt not used by blender
+@SSL_ID@,CVE-2009-3767,Ignored,issue in ldap not used by blender
+@SSL_ID@,CVE-2019-0190,Ignored,issue in apache not used by blender
+@TIFF_ID@,CVE-2022-2056,Ignored,issue in tiff command line tool not used by
blender
+@TIFF_ID@,CVE-2022-2057,Ignored,issue in tiff command line tool not used by
blender
+@TIFF_ID@,CVE-2022-2058,Ignored,issue in tiff command line tool not used by
blender
+@TIFF_ID@,CVE-2022-2519,Ignored,issue in tiff command line tool not used by
blender
+@TIFF_ID@,CVE-2022-2520,Ignored,issue in tiff command line tool not used by
blender
+@TIFF_ID@,CVE-2022-2521,Ignored,issue in tiff command line tool not used by
blender
+@TIFF_ID@,CVE-2022-2953,Ignored,issue in tiff command line tool not used by
blender
+@TIFF_ID@,CVE-2022-34526,Ignored,issue in tiff command line tool not used by
blender
+@XML2_ID@,CVE-2016-3709,Ignored,not affecting blender and not considered a
security issue upstream
+@GMP_ID@,CVE-2021-43618,Ignored,patched using upstream commit 561a9c25298e
+@SQLITE_ID@,CVE-2022-35737,Ignored,only affects SQLITE_ENABLE_STAT4 compile
option not used by blender or python
@SBOMCONTENTS@
diff --git a/build_files/build_environment/cmake/gmp.cmake
b/build_files/build_environment/cmake/gmp.cmake
index e624778869e..ddfdba6662d 100644
--- a/build_files/build_environment/cmake/gmp.cmake
+++ b/build_files/build_environment/cmake/gmp.cmake
@@ -27,6 +27,7 @@ ExternalProject_Add(external_gmp
DOWNLOAD_DIR ${DOWNLOAD_DIR}
URL_HASH ${GMP_HASH_TYPE}=${GMP_HASH}
PREFIX ${BUILD_DIR}/gmp
+ PATCH_COMMAND ${PATCH_CMD} -p 1 -d ${BUILD_DIR}/gmp/src/external_gmp <
${PATCH_DIR}/gmp.diff
CONFIGURE_COMMAND ${CONFIGURE_ENV_NO_PERL} && cd
${BUILD_DIR}/gmp/src/external_gmp/ && ${CONFIGURE_COMMAND}
--prefix=${LIBDIR}/gmp ${GMP_OPTIONS} ${GMP_EXTRA_ARGS}
BUILD_COMMAND ${CONFIGURE_ENV_NO_PERL} && cd
${BUILD_DIR}/gmp/src/external_gmp/ && make -j${MAKE_THREADS}
INSTALL_COMMAND ${CONFIGURE_ENV_NO_PERL} && cd
${BUILD_DIR}/gmp/src/external_gmp/ && make install
diff --git a/build_files/build_environment/patches/gmp.diff
b/build_files/build_environment/patches/gmp.diff
new file mode 100644
index 00000000000..bf22f93bc4f
--- /dev/null
+++ b/build_files/build_environment/patches/gmp.diff
@@ -0,0 +1,15 @@
+--- a/mpz/inp_raw.c Tue Dec 22 23:49:51 2020 +0100
++++ b/mpz/inp_raw.c Thu Oct 21 19:06:49 2021 +0200
+@@ -88,8 +88,11 @@
+
+ abs_csize = ABS (csize);
+
++ if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8))
++ return 0; /* Bit size overflows */
++
+ /* round up to a multiple of limbs */
+- abs_xsize = BITS_TO_LIMBS (abs_csize*8);
++ abs_xsize = BITS_TO_LIMBS ((mp_bitcnt_t) abs_csize * 8);
+
+ if (abs_xsize != 0)
+ {
_______________________________________________
Bf-blender-cvs mailing list
Bf-blender-cvs@blender.org
List details, subscription details or unsubscribe:
https://lists.blender.org/mailman/listinfo/bf-blender-cvs
