summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--recipes-connectivity/openssl/openssl/CVE-2018-0732-reject-excessively-large-primes-in-DH-key-generation.patch50
-rw-r--r--recipes-connectivity/openssl/openssl/CVE-2018-0737-ensure-BN_mod_inverse-and-BN_mod_exp_mont-both-get-called.patch36
-rw-r--r--recipes-connectivity/openssl/openssl/CVE-2018-0739-limit-ASN.1-constructed-types-recursive-definition-depth.patch237
-rw-r--r--recipes-connectivity/openssl/openssl_1.0.2n.bbappend7
-rw-r--r--recipes-core/busybox/busybox/CVE-2018-1000517--wget-check-chunk-length-for-overflowing-off_t.patch59
-rw-r--r--recipes-core/busybox/busybox_1.24.1.bbappend (renamed from recipes-core/busybox/busybox_%.bbappend)7
-rw-r--r--recipes-core/glibc/glibc/CVE-2017-12133-sunrpc-Avoid-use-after-free-read-access-in-clntudp_c.patch164
-rw-r--r--recipes-core/glibc/glibc/CVE-2017-16997-Check-for-empty-tokens-before-dynamic-string-tok.patch150
-rw-r--r--recipes-core/glibc/glibc/CVE-2018-6551-Fix-integer-overflows-in-internal-memalign-and-malloc-functions.patch401
-rw-r--r--recipes-core/glibc/glibc_%.bbappend8
-rw-r--r--recipes-core/glibc/glibc_2.25.bbappend11
-rw-r--r--recipes-core/libxml/libxml2/CVE-2017-16932-detect-infinite-recursion-in-parameter-entities.patch106
-rw-r--r--recipes-core/libxml/libxml2/CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch66
-rw-r--r--recipes-core/libxml/libxml2/CVE-2017-7375-Prevent-unwanted-external-entity-reference.patch40
-rw-r--r--recipes-core/libxml/libxml2/CVE-2017-7376-Increase-buffer-space-for-port-in-HTTP-redirect-supp.patch36
-rw-r--r--recipes-core/libxml/libxml2_2.9.4.bbappend9
-rw-r--r--recipes-devtools/perl/perl/CVE-2018-6913-perl-131844-fix-various-space-calculation-issues-in-.patch148
-rw-r--r--recipes-devtools/perl/perl_5.24.1.bbappend6
-rw-r--r--recipes-devtools/python/python/CVE-2017-1000158-2.7-bpo-30657-Check-prevent-integer-overflow-in-PySt.patch62
-rw-r--r--recipes-devtools/python/python/CVE-2018-1060-CVE-2018-1061-2.7-bpo-32981-Fix-catastrophic-backtracking-vulns-GH.patch161
-rw-r--r--recipes-devtools/python/python_2.7.13.bbappend7
-rw-r--r--recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2017-6311.patch109
-rw-r--r--recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.36.5.bbappend6
-rw-r--r--recipes-graphics/xorg-lib/libxcursor/CVE-2017-16612-Fix-heap-overflows-when-parsing-malicious-files.patch78
-rw-r--r--recipes-graphics/xorg-lib/libxcursor_1.1.14.bbappend6
-rw-r--r--recipes-support/curl/curl/CVE-2018-1000120-FTP-reject-path-components-with-control-codes.patch119
-rw-r--r--recipes-support/curl/curl/CVE-2018-1000121-openldap-check-ldap_get_attribute_ber-results-for-NU.patch47
-rw-r--r--recipes-support/curl/curl/CVE-2018-1000122-readwrite-make-sure-excess-reads-don-t-go-beyond-buf.patch43
-rw-r--r--recipes-support/curl/curl/CVE-2018-1000301-http-restore-buffer-pointer-when-bad-response-line-i.patch48
-rw-r--r--recipes-support/curl/curl_%.bbappend12
-rw-r--r--recipes-support/curl/curl_7.53.1.bbappend17
-rw-r--r--recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch47
-rw-r--r--recipes-support/libcroco/libcroco_0.6.11.bbappend6
33 files changed, 2289 insertions, 20 deletions
diff --git a/recipes-connectivity/openssl/openssl/CVE-2018-0732-reject-excessively-large-primes-in-DH-key-generation.patch b/recipes-connectivity/openssl/openssl/CVE-2018-0732-reject-excessively-large-primes-in-DH-key-generation.patch
new file mode 100644
index 0000000..e3da5f3
--- /dev/null
+++ b/recipes-connectivity/openssl/openssl/CVE-2018-0732-reject-excessively-large-primes-in-DH-key-generation.patch
@@ -0,0 +1,50 @@
1From: Guido Vranken <guidovranken@gmail.com>
2Date: Mon, 11 Jun 2018 17:38:54 +0000 (+0200)
3Subject: Reject excessively large primes in DH key generation.
4X-Git-Tag: OpenSSL_1_0_2p~40
5X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=3984ef0b72831da8b3ece4745cac4f8575b19098
6
7Reject excessively large primes in DH key generation.
8
9CVE-2018-0732
10
11Signed-off-by: Guido Vranken <guidovranken@gmail.com>
12
13(cherry picked from commit 91f7361f47b082ae61ffe1a7b17bb2adf213c7fe)
14
15Reviewed-by: Tim Hudson <tjh@openssl.org>
16Reviewed-by: Matt Caswell <matt@openssl.org>
17(Merged from https://github.com/openssl/openssl/pull/6457)
18
19CVE: CVE-2018-0732
20Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=3984ef0b72831da8b3ece4745cac4f8575b19098]
21
22Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
23---
24 crypto/dh/dh_key.c | 7 ++++++-
25 1 file changed, 6 insertions(+), 1 deletion(-)
26
27diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
28index 387558f..f235e0d 100644
29--- a/crypto/dh/dh_key.c
30+++ b/crypto/dh/dh_key.c
31@@ -130,10 +130,15 @@ static int generate_key(DH *dh)
32 int ok = 0;
33 int generate_new_key = 0;
34 unsigned l;
35- BN_CTX *ctx;
36+ BN_CTX *ctx = NULL;
37 BN_MONT_CTX *mont = NULL;
38 BIGNUM *pub_key = NULL, *priv_key = NULL;
39
40+ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
41+ DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
42+ return 0;
43+ }
44+
45 ctx = BN_CTX_new();
46 if (ctx == NULL)
47 goto err;
48--
492.7.4
50
diff --git a/recipes-connectivity/openssl/openssl/CVE-2018-0737-ensure-BN_mod_inverse-and-BN_mod_exp_mont-both-get-called.patch b/recipes-connectivity/openssl/openssl/CVE-2018-0737-ensure-BN_mod_inverse-and-BN_mod_exp_mont-both-get-called.patch
new file mode 100644
index 0000000..aa92d75
--- /dev/null
+++ b/recipes-connectivity/openssl/openssl/CVE-2018-0737-ensure-BN_mod_inverse-and-BN_mod_exp_mont-both-get-called.patch
@@ -0,0 +1,36 @@
1From 337da9779c4ef107a4b7bbaaa198824a489a10ed Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 12:43:16 +0200
4Subject: RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont both get called with...
5X-Git-Tag: OpenSSL_1_0_2p~87
6X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=349a41da1ad88ad87825414752a8ff5fdd6a6c3f
7
8RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont both get called with BN_FLG_CONSTTIME flag set.
9
10CVE-2018-0737
11
12Reviewed-by: Rich Salz <rsalz@openssl.org>
13Reviewed-by: Matt Caswell <matt@openssl.org>
14(cherry picked from commit 6939eab03a6e23d2bd2c3f5e34fe1d48e542e787)
15
16CVE: CVE-2018-0737
17Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=349a41da1ad88ad87825414752a8ff5fdd6a6c3f]
18
19Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
20---
21 crypto/rsa/rsa_gen.c | 2 ++
22 1 file changed, 2 insertions(+)
23
24diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
25index a85493d..f5914c0 100644
26--- a/crypto/rsa/rsa_gen.c
27+++ b/crypto/rsa/rsa_gen.c
28@@ -155,6 +155,8 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
29 if (BN_copy(rsa->e, e_value) == NULL)
30 goto err;
31
32+ BN_set_flags(rsa->p, BN_FLG_CONSTTIME);
33+ BN_set_flags(rsa->q, BN_FLG_CONSTTIME);
34 /* generate p and q */
35 for (;;) {
36 if (!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL, NULL, cb))
diff --git a/recipes-connectivity/openssl/openssl/CVE-2018-0739-limit-ASN.1-constructed-types-recursive-definition-depth.patch b/recipes-connectivity/openssl/openssl/CVE-2018-0739-limit-ASN.1-constructed-types-recursive-definition-depth.patch
new file mode 100644
index 0000000..8062031
--- /dev/null
+++ b/recipes-connectivity/openssl/openssl/CVE-2018-0739-limit-ASN.1-constructed-types-recursive-definition-depth.patch
@@ -0,0 +1,237 @@
1From 9310d45087ae546e27e61ddf8f6367f29848220d Mon Sep 17 00:00:00 2001
2From: Matt Caswell <matt@openssl.org>
3Date: Thu, 22 Mar 2018 10:05:40 +0000
4Subject: [PATCH] Limit ASN.1 constructed types recursive definition depth
5
6Constructed types with a recursive definition (such as can be found in
7PKCS7) could eventually exceed the stack given malicious input with
8excessive recursion. Therefore we limit the stack depth.
9
10CVE-2018-0739
11Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=9310d45087ae546e27e61ddf8f6367f29848220d]
12
13Credit to OSSFuzz for finding this issue.
14
15Reviewed-by: Rich Salz <rsalz@openssl.org>
16Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
17---
18 crypto/asn1/asn1.h | 1 +
19 crypto/asn1/asn1_err.c | 3 ++-
20 crypto/asn1/tasn_dec.c | 62 +++++++++++++++++++++++++++++++++-----------------
21 3 files changed, 44 insertions(+), 22 deletions(-)
22
23diff --git a/crypto/asn1/asn1.h b/crypto/asn1/asn1.h
24index 68e791f..35a2b2a 100644
25--- a/crypto/asn1/asn1.h
26+++ b/crypto/asn1/asn1.h
27@@ -1365,6 +1365,7 @@ void ERR_load_ASN1_strings(void);
28 # define ASN1_R_MSTRING_NOT_UNIVERSAL 139
29 # define ASN1_R_MSTRING_WRONG_TAG 140
30 # define ASN1_R_NESTED_ASN1_STRING 197
31+# define ASN1_R_NESTED_TOO_DEEP 219
32 # define ASN1_R_NON_HEX_CHARACTERS 141
33 # define ASN1_R_NOT_ASCII_FORMAT 190
34 # define ASN1_R_NOT_ENOUGH_DATA 142
35diff --git a/crypto/asn1/asn1_err.c b/crypto/asn1/asn1_err.c
36index fd4ac8d..cfc1512 100644
37--- a/crypto/asn1/asn1_err.c
38+++ b/crypto/asn1/asn1_err.c
39@@ -1,6 +1,6 @@
40 /* crypto/asn1/asn1_err.c */
41 /* ====================================================================
42- * Copyright (c) 1999-2014 The OpenSSL Project. All rights reserved.
43+ * Copyright (c) 1999-2018 The OpenSSL Project. All rights reserved.
44 *
45 * Redistribution and use in source and binary forms, with or without
46 * modification, are permitted provided that the following conditions
47@@ -279,6 +279,7 @@ static ERR_STRING_DATA ASN1_str_reasons[] = {
48 {ERR_REASON(ASN1_R_MSTRING_NOT_UNIVERSAL), "mstring not universal"},
49 {ERR_REASON(ASN1_R_MSTRING_WRONG_TAG), "mstring wrong tag"},
50 {ERR_REASON(ASN1_R_NESTED_ASN1_STRING), "nested asn1 string"},
51+ {ERR_REASON(ASN1_R_NESTED_TOO_DEEP), "nested too deep"},
52 {ERR_REASON(ASN1_R_NON_HEX_CHARACTERS), "non hex characters"},
53 {ERR_REASON(ASN1_R_NOT_ASCII_FORMAT), "not ascii format"},
54 {ERR_REASON(ASN1_R_NOT_ENOUGH_DATA), "not enough data"},
55diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c
56index d49a5d5..78126e9 100644
57--- a/crypto/asn1/tasn_dec.c
58+++ b/crypto/asn1/tasn_dec.c
59@@ -65,6 +65,14 @@
60 #include <openssl/buffer.h>
61 #include <openssl/err.h>
62
63+/*
64+ * Constructed types with a recursive definition (such as can be found in PKCS7)
65+ * could eventually exceed the stack given malicious input with excessive
66+ * recursion. Therefore we limit the stack depth. This is the maximum number of
67+ * recursive invocations of asn1_item_embed_d2i().
68+ */
69+#define ASN1_MAX_CONSTRUCTED_NEST 30
70+
71 static int asn1_check_eoc(const unsigned char **in, long len);
72 static int asn1_find_end(const unsigned char **in, long len, char inf);
73
74@@ -81,11 +89,11 @@ static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
75 static int asn1_template_ex_d2i(ASN1_VALUE **pval,
76 const unsigned char **in, long len,
77 const ASN1_TEMPLATE *tt, char opt,
78- ASN1_TLC *ctx);
79+ ASN1_TLC *ctx, int depth);
80 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
81 const unsigned char **in, long len,
82 const ASN1_TEMPLATE *tt, char opt,
83- ASN1_TLC *ctx);
84+ ASN1_TLC *ctx, int depth);
85 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
86 const unsigned char **in, long len,
87 const ASN1_ITEM *it,
88@@ -154,17 +162,16 @@ int ASN1_template_d2i(ASN1_VALUE **pval,
89 {
90 ASN1_TLC c;
91 asn1_tlc_clear_nc(&c);
92- return asn1_template_ex_d2i(pval, in, len, tt, 0, &c);
93+ return asn1_template_ex_d2i(pval, in, len, tt, 0, &c, 0);
94 }
95
96 /*
97 * Decode an item, taking care of IMPLICIT tagging, if any. If 'opt' set and
98 * tag mismatch return -1 to handle OPTIONAL
99 */
100-
101-int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
102- const ASN1_ITEM *it,
103- int tag, int aclass, char opt, ASN1_TLC *ctx)
104+static int asn1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in,
105+ long len, const ASN1_ITEM *it, int tag, int aclass,
106+ char opt, ASN1_TLC *ctx, int depth)
107 {
108 const ASN1_TEMPLATE *tt, *errtt = NULL;
109 const ASN1_COMPAT_FUNCS *cf;
110@@ -189,6 +196,11 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
111 else
112 asn1_cb = 0;
113
114+ if (++depth > ASN1_MAX_CONSTRUCTED_NEST) {
115+ ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_NESTED_TOO_DEEP);
116+ goto err;
117+ }
118+
119 switch (it->itype) {
120 case ASN1_ITYPE_PRIMITIVE:
121 if (it->templates) {
122@@ -204,7 +216,7 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
123 goto err;
124 }
125 return asn1_template_ex_d2i(pval, in, len,
126- it->templates, opt, ctx);
127+ it->templates, opt, ctx, depth);
128 }
129 return asn1_d2i_ex_primitive(pval, in, len, it,
130 tag, aclass, opt, ctx);
131@@ -326,7 +338,7 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
132 /*
133 * We mark field as OPTIONAL so its absence can be recognised.
134 */
135- ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx);
136+ ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth);
137 /* If field not present, try the next one */
138 if (ret == -1)
139 continue;
140@@ -444,7 +456,8 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
141 * attempt to read in field, allowing each to be OPTIONAL
142 */
143
144- ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx);
145+ ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx,
146+ depth);
147 if (!ret) {
148 errtt = seqtt;
149 goto err;
150@@ -514,6 +527,13 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
151 return 0;
152 }
153
154+int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
155+ const ASN1_ITEM *it,
156+ int tag, int aclass, char opt, ASN1_TLC *ctx)
157+{
158+ return asn1_item_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0);
159+}
160+
161 /*
162 * Templates are handled with two separate functions. One handles any
163 * EXPLICIT tag and the other handles the rest.
164@@ -522,7 +542,7 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
165 static int asn1_template_ex_d2i(ASN1_VALUE **val,
166 const unsigned char **in, long inlen,
167 const ASN1_TEMPLATE *tt, char opt,
168- ASN1_TLC *ctx)
169+ ASN1_TLC *ctx, int depth)
170 {
171 int flags, aclass;
172 int ret;
173@@ -557,7 +577,7 @@ static int asn1_template_ex_d2i(ASN1_VALUE **val,
174 return 0;
175 }
176 /* We've found the field so it can't be OPTIONAL now */
177- ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx);
178+ ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx, depth);
179 if (!ret) {
180 ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
181 return 0;
182@@ -581,7 +601,7 @@ static int asn1_template_ex_d2i(ASN1_VALUE **val,
183 }
184 }
185 } else
186- return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx);
187+ return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx, depth);
188
189 *in = p;
190 return 1;
191@@ -594,7 +614,7 @@ static int asn1_template_ex_d2i(ASN1_VALUE **val,
192 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
193 const unsigned char **in, long len,
194 const ASN1_TEMPLATE *tt, char opt,
195- ASN1_TLC *ctx)
196+ ASN1_TLC *ctx, int depth)
197 {
198 int flags, aclass;
199 int ret;
200@@ -665,8 +685,8 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
201 break;
202 }
203 skfield = NULL;
204- if (!ASN1_item_ex_d2i(&skfield, &p, len,
205- ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx)) {
206+ if (!asn1_item_ex_d2i(&skfield, &p, len, ASN1_ITEM_ptr(tt->item),
207+ -1, 0, 0, ctx, depth)) {
208 ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
209 ERR_R_NESTED_ASN1_ERROR);
210 goto err;
211@@ -684,9 +704,8 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
212 }
213 } else if (flags & ASN1_TFLG_IMPTAG) {
214 /* IMPLICIT tagging */
215- ret = ASN1_item_ex_d2i(val, &p, len,
216- ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt,
217- ctx);
218+ ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), tt->tag,
219+ aclass, opt, ctx, depth);
220 if (!ret) {
221 ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR);
222 goto err;
223@@ -694,8 +713,9 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
224 return -1;
225 } else {
226 /* Nothing special */
227- ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
228- -1, tt->flags & ASN1_TFLG_COMBINE, opt, ctx);
229+ ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
230+ -1, tt->flags & ASN1_TFLG_COMBINE, opt, ctx,
231+ depth);
232 if (!ret) {
233 ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR);
234 goto err;
235--
2361.9.1
237
diff --git a/recipes-connectivity/openssl/openssl_1.0.2n.bbappend b/recipes-connectivity/openssl/openssl_1.0.2n.bbappend
new file mode 100644
index 0000000..6f2625f
--- /dev/null
+++ b/recipes-connectivity/openssl/openssl_1.0.2n.bbappend
@@ -0,0 +1,7 @@
1FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
2
3SRC_URI += " \
4 file://CVE-2018-0732-reject-excessively-large-primes-in-DH-key-generation.patch \
5 file://CVE-2018-0737-ensure-BN_mod_inverse-and-BN_mod_exp_mont-both-get-called.patch \
6 file://CVE-2018-0739-limit-ASN.1-constructed-types-recursive-definition-depth.patch \
7 "
diff --git a/recipes-core/busybox/busybox/CVE-2018-1000517--wget-check-chunk-length-for-overflowing-off_t.patch b/recipes-core/busybox/busybox/CVE-2018-1000517--wget-check-chunk-length-for-overflowing-off_t.patch
new file mode 100644
index 0000000..c05c75b
--- /dev/null
+++ b/recipes-core/busybox/busybox/CVE-2018-1000517--wget-check-chunk-length-for-overflowing-off_t.patch
@@ -0,0 +1,59 @@
1From 7935de14ce61f5a5c1c845925873379ae2e2f45a Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 13:13:07 +0200
4Subject: [PATCH] wget: check chunk length for overflowing off_t
5
6function old new delta
7retrieve_file_data 428 465 +37
8wget_main 2386 2389 +3
9------------------------------------------------------------------------------
10(add/remove: 0/0 grow/shrink: 2/0 up/down: 40/0) Total: 40 bytes
11
12CVE: CVE-2018-1000517
13Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e]
14
15Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
16Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
17---
18 networking/wget.c | 16 ++++++++++++----
19 1 file changed, 12 insertions(+), 4 deletions(-)
20
21diff --git a/networking/wget.c b/networking/wget.c
22index d4a9c0c..b525d6a 100644
23--- a/networking/wget.c
24+++ b/networking/wget.c
25@@ -566,7 +566,7 @@ static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_
26 if (ftpcmd("SIZE ", target->path, sfp) == 213) {
27 G.content_len = BB_STRTOOFF(G.wget_buf + 4, NULL, 10);
28 if (G.content_len < 0 || errno) {
29- bb_error_msg_and_die("SIZE value is garbage");
30+ bb_error_msg_and_die("bad SIZE value '%s'", G.wget_buf + 4);
31 }
32 G.got_clen = 1;
33 }
34@@ -821,12 +821,20 @@ static void NOINLINE retrieve_file_data(FILE *dfp)
35 #endif
36 if (!G.chunked)
37 break;
38-
39- fgets_and_trim(dfp); /* Eat empty line */
40+
41+ /* Each chunk ends with "\r\n" - eat it */
42+ fgets_and_trim(dfp);
43 get_clen:
44+ /* chunk size format is "HEXNUM[;name[=val]]\r\n" */
45 fgets_and_trim(dfp);
46+ errno = 0;
47 G.content_len = STRTOOFF(G.wget_buf, NULL, 16);
48- /* FIXME: error check? */
49+ /*
50+ * Had a bug with inputs like "ffffffff0001f400"
51+ * smashing the heap later. Ensure >= 0.
52+ */
53+ if (G.content_len < 0 || errno)
54+ bb_error_msg_and_die("bad chunk length '%s'", G.wget_buf);
55 if (G.content_len == 0)
56 break; /* all done! */
57 G.got_clen = 1;
58
59
diff --git a/recipes-core/busybox/busybox_%.bbappend b/recipes-core/busybox/busybox_1.24.1.bbappend
index 7b61cf9..6be3e59 100644
--- a/recipes-core/busybox/busybox_%.bbappend
+++ b/recipes-core/busybox/busybox_1.24.1.bbappend
@@ -1,3 +1,10 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2018-1000517--wget-check-chunk-length-for-overflowing-off_t.patch \
6 "
7
1do_prepare_config_append () { 8do_prepare_config_append () {
2 sed -i -e 's/# CONFIG_CHRT is not set/CONFIG_CHRT=y/' .config 9 sed -i -e 's/# CONFIG_CHRT is not set/CONFIG_CHRT=y/' .config
3 sed -i -e 's/# CONFIG_TASKSET is not set/CONFIG_TASKSET=y/' .config 10 sed -i -e 's/# CONFIG_TASKSET is not set/CONFIG_TASKSET=y/' .config
diff --git a/recipes-core/glibc/glibc/CVE-2017-12133-sunrpc-Avoid-use-after-free-read-access-in-clntudp_c.patch b/recipes-core/glibc/glibc/CVE-2017-12133-sunrpc-Avoid-use-after-free-read-access-in-clntudp_c.patch
new file mode 100644
index 0000000..8f88096
--- /dev/null
+++ b/recipes-core/glibc/glibc/CVE-2017-12133-sunrpc-Avoid-use-after-free-read-access-in-clntudp_c.patch
@@ -0,0 +1,164 @@
1From bd43c78956040a5d419d5034cdddd4b62c5dd53e Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 10:37:02 +0200
4Subject: [PATCH] sunrpc: Avoid use-after-free read access in clntudp_call [BZ #21115]
5
6After commit bc779a1a5b3035133024b21e2f339fe4219fb11c
7(CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call
8[BZ #20112]), ancillary data is stored on the heap,
9but it is accessed after it has been freed.
10
11The test case must be run under a heap debugger such as valgrind
12to observe the invalid access. A malloc implementation which
13immediately calls munmap on free would catch this bug as well.
14
15This patch is for CVE-2017-12133.
16(cherry picked from commit d42eed4a044e5e10dfb885cf9891c2518a72a491)
17
18CVE: CVE-2017-12133
19Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d42eed4a044e5e10dfb885cf9891c2518a72a491]
20
21Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
22---
23 ChangeLog | 8 +++++++
24 NEWS | 1 +
25 sunrpc/Makefile | 3 ++-
26 sunrpc/clnt_udp.c | 2 +-
27 sunrpc/tst-udp-error.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++
28 5 files changed, 74 insertions(+), 2 deletions(-)
29 create mode 100644 sunrpc/tst-udp-error.c
30
31diff --git a/ChangeLog b/ChangeLog
32index 48b095b..097ab5c 100644
33--- a/ChangeLog
34+++ b/ChangeLog
35@@ -1,3 +1,11 @@
36+2017-02-27 Florian Weimer <fweimer@redhat.com>
37+
38+ [BZ #21115]
39+ * sunrpc/clnt_udp.c (clntudp_call): Free ancillary data later.
40+ * sunrpc/Makefile (tests): Add tst-udp-error.
41+ (tst-udp-error): Link against libc.so explicitly.
42+ * sunrpc/tst-udp-error: New file.
43+
44 2018-01-18 Arjun Shankar <arjun@redhat.com>
45
46 [BZ #22343]
47diff --git a/NEWS b/NEWS
48index 5134f34..4765e1b 100644
49--- a/NEWS
50+++ b/NEWS
51@@ -376,6 +376,7 @@ The following bugs are resolved with this release:
52 [21081] string: Missing vzeroupper in memset-vec-unaligned-erms.S
53 [22343] malloc: Integer overflow in posix_memalign (CVE-2018-6485)
54 [22774] malloc: Integer overflow in malloc (CVE-2018-6551)
55+ [21115] sunrpc: Use-after-free in error path in clntudp_call
56
57 Version 2.24
58
59diff --git a/sunrpc/Makefile b/sunrpc/Makefile
60index 12ec2e7..8b9f25f 100644
61--- a/sunrpc/Makefile
62+++ b/sunrpc/Makefile
63@@ -93,7 +93,7 @@ rpcgen-objs = rpc_main.o rpc_hout.o rpc_cout.o rpc_parse.o \
64 extra-objs = $(rpcgen-objs) $(addprefix cross-,$(rpcgen-objs))
65 others += rpcgen
66
67-tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-xdrmem3
68+tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-xdrmem3 tst-udp-error
69 xtests := tst-getmyaddr
70
71 tests-special += $(objpfx)mtrace-tst-xdrmem3.out
72@@ -163,6 +163,7 @@ $(objpfx)tst-getmyaddr: $(common-objpfx)linkobj/libc.so
73 $(objpfx)tst-xdrmem: $(common-objpfx)linkobj/libc.so
74 $(objpfx)tst-xdrmem2: $(common-objpfx)linkobj/libc.so
75 (objpfx)tst-xdrmem2: $(common-objpfx)linkobj/libc.so
76+$(objpfx)tst-udp-error: $(common-objpfx)linkobj/libc.so
77
78 $(objpfx)rpcgen: $(addprefix $(objpfx),$(rpcgen-objs))
79
80diff --git a/sunrpc/clnt_udp.c b/sunrpc/clnt_udp.c
81index 4d9acb1..1de25cb 100644
82--- a/sunrpc/clnt_udp.c
83+++ b/sunrpc/clnt_udp.c
84@@ -421,9 +421,9 @@ send_again:
85 cmsg = CMSG_NXTHDR (&msg, cmsg))
86 if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVERR)
87 {
88- free (cbuf);
89 e = (struct sock_extended_err *) CMSG_DATA(cmsg);
90 cu->cu_error.re_errno = e->ee_errno;
91+ free (cbuf);
92 return (cu->cu_error.re_status = RPC_CANTRECV);
93 }
94 free (cbuf);
95diff --git a/sunrpc/tst-udp-error.c b/sunrpc/tst-udp-error.c
96new file mode 100644
97index 0000000..1efc02f
98--- /dev/null
99+++ b/sunrpc/tst-udp-error.c
100@@ -0,0 +1,62 @@
101+/* Check for use-after-free in clntudp_call (bug 21115).
102+ Copyright (C) 2017 Free Software Foundation, Inc.
103+ This file is part of the GNU C Library.
104+
105+ The GNU C Library is free software; you can redistribute it and/or
106+ modify it under the terms of the GNU Lesser General Public
107+ License as published by the Free Software Foundation; either
108+ version 2.1 of the License, or (at your option) any later version.
109+
110+ The GNU C Library is distributed in the hope that it will be useful,
111+ but WITHOUT ANY WARRANTY; without even the implied warranty of
112+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
113+ Lesser General Public License for more details.
114+
115+ You should have received a copy of the GNU Lesser General Public
116+ License along with the GNU C Library; if not, see
117+ <http://www.gnu.org/licenses/>. */
118+
119+#include <netinet/in.h>
120+#include <rpc/clnt.h>
121+#include <rpc/svc.h>
122+#include <support/check.h>
123+#include <support/namespace.h>
124+#include <support/xsocket.h>
125+#include <unistd.h>
126+
127+static int
128+do_test (void)
129+{
130+ support_become_root ();
131+ support_enter_network_namespace ();
132+
133+ /* Obtain a likely-unused port number. */
134+ struct sockaddr_in sin =
135+ {
136+ .sin_family = AF_INET,
137+ .sin_addr.s_addr = htonl (INADDR_LOOPBACK),
138+ };
139+ {
140+ int fd = xsocket (AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
141+ xbind (fd, (struct sockaddr *) &sin, sizeof (sin));
142+ socklen_t sinlen = sizeof (sin);
143+ xgetsockname (fd, (struct sockaddr *) &sin, &sinlen);
144+ /* Close the socket, so that we will receive an error below. */
145+ close (fd);
146+ }
147+
148+ int sock = RPC_ANYSOCK;
149+ CLIENT *clnt = clntudp_create
150+ (&sin, 1, 2, (struct timeval) { 1, 0 }, &sock);
151+ TEST_VERIFY_EXIT (clnt != NULL);
152+ TEST_VERIFY (clnt_call (clnt, 3,
153+ (xdrproc_t) xdr_void, NULL,
154+ (xdrproc_t) xdr_void, NULL,
155+ ((struct timeval) { 3, 0 }))
156+ == RPC_CANTRECV);
157+ clnt_destroy (clnt);
158+
159+ return 0;
160+}
161+
162+#include <support/test-driver.c>
163
164
diff --git a/recipes-core/glibc/glibc/CVE-2017-16997-Check-for-empty-tokens-before-dynamic-string-tok.patch b/recipes-core/glibc/glibc/CVE-2017-16997-Check-for-empty-tokens-before-dynamic-string-tok.patch
new file mode 100644
index 0000000..6401734
--- /dev/null
+++ b/recipes-core/glibc/glibc/CVE-2017-16997-Check-for-empty-tokens-before-dynamic-string-tok.patch
@@ -0,0 +1,150 @@
1From 24ee2a5b63d15cf45c43ec598f11fe59878982a8 Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 11:17:18 +0200
4Subject: [PATCH] elf: Check for empty tokens before dynamic string token expansion [BZ #22625]
5
6The fillin_rpath function in elf/dl-load.c loops over each RPATH or
7RUNPATH tokens and interprets empty tokens as the current directory
8("./"). In practice the check for empty token is done *after* the
9dynamic string token expansion. The expansion process can return an
10empty string for the $ORIGIN token if __libc_enable_secure is set
11or if the path of the binary can not be determined (/proc not mounted).
12
13Fix that by moving the check for empty tokens before the dynamic string
14token expansion. In addition, check for NULL pointer or empty strings
15return by expand_dynamic_string_token.
16
17The above changes highlighted a bug in decompose_rpath, an empty array
18is represented by the first element being NULL at the fillin_rpath
19level, but by using a -1 pointer in decompose_rpath and other functions.
20
21Changelog:
22 [BZ #22625]
23 * elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic
24 string token expansion. Check for NULL pointer or empty string possibly
25 returned by expand_dynamic_string_token.
26 (decompose_rpath): Check for empty path after dynamic string
27 token expansion.
28(cherry picked from commit 3e3c904daef69b8bf7d5cc07f793c9f07c3553ef)
29
30CVE: CVE-2017-16997
31Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=21c5d14bfb4e08bee86f94fd815535d3be2c3869]
32
33Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
34---
35 ChangeLog | 10 ++++++++++
36 NEWS | 4 ++++
37 elf/dl-load.c | 49 +++++++++++++++++++++++++++++++++----------------
38 3 files changed, 47 insertions(+), 16 deletions(-)
39
40diff --git a/ChangeLog b/ChangeLog
41index a0c2f51..ad380fd 100644
42--- a/ChangeLog
43+++ b/ChangeLog
44@@ -1,3 +1,13 @@
45+2017-12-30 Aurelien Jarno <aurelien@aurel32.net>
46+ Dmitry V. Levin <ldv@altlinux.org>
47+
48+ [BZ #22625]
49+ * elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic
50+ string token expansion. Check for NULL pointer or empty string possibly
51+ returned by expand_dynamic_string_token.
52+ (decompose_rpath): Check for empty path after dynamic string
53+ token expansion.
54+
55 2017-04-13 Florian Weimer <fweimer@redhat.com>
56
57 [BZ #21361]
58diff --git a/NEWS b/NEWS
59index 29e795a..195c06d 100644
60--- a/NEWS
61+++ b/NEWS
62@@ -214,6 +214,10 @@ Security related changes:
63 * The xdr_bytes and xdr_string routines free the internally allocated buffer
64 if deserialization of the buffer contents fails for any reason.
65
66+ CVE-2017-16997: Incorrect handling of RPATH or RUNPATH containing $ORIGIN
67+ for AT_SECURE or SUID binaries could be used to load libraries from the
68+ current directory.
69+
70 The following bugs are resolved with this release:
71
72 [4099] stdio: Overly agressive caching by stream i/o functions.
73diff --git a/elf/dl-load.c b/elf/dl-load.c
74index a5318f9..bdb4484 100644
75--- a/elf/dl-load.c
76+++ b/elf/dl-load.c
77@@ -433,31 +433,40 @@ fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,
78 {
79 char *cp;
80 size_t nelems = 0;
81- char *to_free;
82
83 while ((cp = __strsep (&rpath, sep)) != NULL)
84 {
85 struct r_search_path_elem *dirp;
86+ char *to_free = NULL;
87+ size_t len = 0;
88
89- to_free = cp = expand_dynamic_string_token (l, cp, 1);
90+ /* `strsep' can pass an empty string. */
91+ if (*cp != '\0')
92+ {
93+ to_free = cp = expand_dynamic_string_token (l, cp, 1);
94
95- size_t len = strlen (cp);
96+ /* expand_dynamic_string_token can return NULL in case of empty
97+ path or memory allocation failure. */
98+ if (cp == NULL)
99+ continue;
100
101- /* `strsep' can pass an empty string. This has to be
102- interpreted as `use the current directory'. */
103- if (len == 0)
104- {
105- static const char curwd[] = "./";
106- cp = (char *) curwd;
107- }
108+ /* Compute the length after dynamic string token expansion and
109+ ignore empty paths. */
110+ len = strlen (cp);
111+ if (len == 0)
112+ {
113+ free (to_free);
114+ continue;
115+ }
116
117- /* Remove trailing slashes (except for "/"). */
118- while (len > 1 && cp[len - 1] == '/')
119- --len;
120+ /* Remove trailing slashes (except for "/"). */
121+ while (len > 1 && cp[len - 1] == '/')
122+ --len;
123
124- /* Now add one if there is none so far. */
125- if (len > 0 && cp[len - 1] != '/')
126- cp[len++] = '/';
127+ /* Now add one if there is none so far. */
128+ if (len > 0 && cp[len - 1] != '/')
129+ cp[len++] = '/';
130+ }
131
132 /* Make sure we don't use untrusted directories if we run SUID. */
133 if (__glibc_unlikely (check_trusted) && !is_trusted_path (cp, len))
134@@ -621,6 +630,14 @@ decompose_rpath (struct r_search_path_struct *sps,
135 necessary. */
136 free (copy);
137
138+ /* There is no path after expansion. */
139+ if (result[0] == NULL)
140+ {
141+ free (result);
142+ sps->dirs = (struct r_search_path_elem **) -1;
143+ return false;
144+ }
145+
146 sps->dirs = result;
147 /* The caller will change this value if we haven't used a real malloc. */
148 sps->malloced = 1;
149
150
diff --git a/recipes-core/glibc/glibc/CVE-2018-6551-Fix-integer-overflows-in-internal-memalign-and-malloc-functions.patch b/recipes-core/glibc/glibc/CVE-2018-6551-Fix-integer-overflows-in-internal-memalign-and-malloc-functions.patch
new file mode 100644
index 0000000..cb766c4
--- /dev/null
+++ b/recipes-core/glibc/glibc/CVE-2018-6551-Fix-integer-overflows-in-internal-memalign-and-malloc-functions.patch
@@ -0,0 +1,401 @@
1From 5d7411e9ec03cae8e9bb5df4b515744e5065a64c Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 13:54:54 +0200
4Subject: [PATCH] Fix integer overflows in internal memalign and malloc [BZ #22343] [BZ #22774]
5
6When posix_memalign is called with an alignment less than MALLOC_ALIGNMENT
7and a requested size close to SIZE_MAX, it falls back to malloc code
8(because the alignment of a block returned by malloc is sufficient to
9satisfy the call). In this case, an integer overflow in _int_malloc leads
10to posix_memalign incorrectly returning successfully.
11
12Upon fixing this and writing a somewhat thorough regression test, it was
13discovered that when posix_memalign is called with an alignment larger than
14MALLOC_ALIGNMENT (so it uses _int_memalign instead) and a requested size
15close to SIZE_MAX, a different integer overflow in _int_memalign leads to
16posix_memalign incorrectly returning successfully.
17
18Both integer overflows affect other memory allocation functions that use
19_int_malloc (one affected malloc in x86) or _int_memalign as well.
20
21This commit fixes both integer overflows. In addition to this, it adds a
22regression test to guard against false successful allocations by the
23following memory allocation functions when called with too-large allocation
24sizes and, where relevant, various valid alignments:
25malloc, realloc, calloc, memalign, posix_memalign, aligned_alloc, valloc,
26and pvalloc.
27
28(cherry picked from commit 8e448310d74b283c5cd02b9ed7fb997b47bf9b22)
29
30CVE: CVE-2018-6551
31Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=patch;h=8e448310d74b283c5cd02b9ed7fb997b47bf9b22]
32
33Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
34---
35 ChangeLog | 13 +++
36 NEWS | 11 ++
37 malloc/Makefile | 1 +
38 malloc/malloc.c | 30 ++++--
39 malloc/tst-malloc-too-large.c | 237 ++++++++++++++++++++++++++++++++++++++++++
40 5 files changed, 284 insertions(+), 8 deletions(-)
41 create mode 100644 malloc/tst-malloc-too-large.c
42
43diff --git a/ChangeLog b/ChangeLog
44index ad380fd..48b095b 100644
45--- a/ChangeLog
46+++ b/ChangeLog
47@@ -1,3 +1,16 @@
48+2018-01-18 Arjun Shankar <arjun@redhat.com>
49+
50+ [BZ #22343]
51+ [BZ #22774]
52+ CVE-2018-6485
53+ CVE-2018-6551
54+ * malloc/malloc.c (checked_request2size): call REQUEST_OUT_OF_RANGE
55+ after padding.
56+ (_int_memalign): check for integer overflow before calling
57+ _int_malloc.
58+ * malloc/tst-malloc-too-large.c: New test.
59+ * malloc/Makefile: Add tst-malloc-too-large.
60+
61 2017-12-30 Aurelien Jarno <aurelien@aurel32.net>
62 Dmitry V. Levin <ldv@altlinux.org>
63
64diff --git a/NEWS b/NEWS
65index 195c06d..5134f34 100644
66--- a/NEWS
67+++ b/NEWS
68@@ -1,3 +1,4 @@
69+
70 GNU C Library NEWS -- history of user-visible changes.
71 Copyright (C) 1992-2017 Free Software Foundation, Inc.
72 See the end for copying conditions.
73@@ -218,6 +219,14 @@ Security related changes:
74 for AT_SECURE or SUID binaries could be used to load libraries from the
75 current directory.
76
77+ CVE-2018-6485: The posix_memalign and memalign functions, when called with
78+ an object size near the value of SIZE_MAX, would return a pointer to a
79+ buffer which is too small, instead of NULL. Reported by Jakub Wilk.
80+
81+ CVE-2018-6551: The malloc function, when called with an object size near
82+ the value of SIZE_MAX, would return a pointer to a buffer which is too
83+ small, instead of NULL.
84+
85 The following bugs are resolved with this release:
86
87 [4099] stdio: Overly agressive caching by stream i/o functions.
88@@ -365,6 +374,8 @@ The following bugs are resolved with this release:
89 [21073] libc: tunables: insecure environment variables passed to
90 subprocesses with AT_SECURE
91 [21081] string: Missing vzeroupper in memset-vec-unaligned-erms.S
92+ [22343] malloc: Integer overflow in posix_memalign (CVE-2018-6485)
93+ [22774] malloc: Integer overflow in malloc (CVE-2018-6551)
94
95 Version 2.24
96
97diff --git a/malloc/Makefile b/malloc/Makefile
98index e93b83b..ab9e795 100644
99--- a/malloc/Makefile
100+++ b/malloc/Makefile
101@@ -33,6 +33,7 @@ tests := mallocbug tst-malloc tst-valloc tst-calloc tst-obstack \
102 tst-mallocfork2 \
103 tst-interpose-nothread \
104 tst-interpose-thread \
105+ tst-malloc-too-large \
106
107 tests-static := \
108 tst-interpose-static-nothread \
109diff --git a/malloc/malloc.c b/malloc/malloc.c
110index 4885793..a82555d 100644
111--- a/malloc/malloc.c
112+++ b/malloc/malloc.c
113@@ -1202,14 +1202,21 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
114 MINSIZE : \
115 ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)
116
117-/* Same, except also perform argument check */
118-
119-#define checked_request2size(req, sz) \
120- if (REQUEST_OUT_OF_RANGE (req)) { \
121- __set_errno (ENOMEM); \
122- return 0; \
123- } \
124- (sz) = request2size (req);
125+/* Same, except also perform an argument and result check. First, we check
126+ that the padding done by request2size didn't result in an integer
127+ overflow. Then we check (using REQUEST_OUT_OF_RANGE) that the resulting
128+ size isn't so large that a later alignment would lead to another integer
129+ overflow. */
130+#define checked_request2size(req, sz) \
131+({ \
132+ (sz) = request2size (req); \
133+ if (((sz) < (req)) \
134+ || REQUEST_OUT_OF_RANGE (sz)) \
135+ { \
136+ __set_errno (ENOMEM); \
137+ return 0; \
138+ } \
139+})
140
141 /*
142 --------------- Physical chunk operations ---------------
143@@ -4423,6 +4430,13 @@ _int_memalign (mstate av, size_t alignment, size_t bytes)
144 */
145
146
147+ /* Check for overflow. */
148+ if (nb > SIZE_MAX - alignment - MINSIZE)
149+ {
150+ __set_errno (ENOMEM);
151+ return 0;
152+ }
153+
154 /* Call malloc with worst case padding to hit alignment. */
155
156 m = (char *) (_int_malloc (av, nb + alignment + MINSIZE));
157diff --git a/malloc/tst-malloc-too-large.c b/malloc/tst-malloc-too-large.c
158new file mode 100644
159index 0000000..1f7bf29
160--- /dev/null
161+++ b/malloc/tst-malloc-too-large.c
162@@ -0,0 +1,237 @@
163+/* Test and verify that too-large memory allocations fail with ENOMEM.
164+ Copyright (C) 2018 Free Software Foundation, Inc.
165+ This file is part of the GNU C Library.
166+
167+ The GNU C Library is free software; you can redistribute it and/or
168+ modify it under the terms of the GNU Lesser General Public
169+ License as published by the Free Software Foundation; either
170+ version 2.1 of the License, or (at your option) any later version.
171+
172+ The GNU C Library is distributed in the hope that it will be useful,
173+ but WITHOUT ANY WARRANTY; without even the implied warranty of
174+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
175+ Lesser General Public License for more details.
176+
177+ You should have received a copy of the GNU Lesser General Public
178+ License along with the GNU C Library; if not, see
179+ <http://www.gnu.org/licenses/>. */
180+
181+/* Bug 22375 reported a regression in malloc where if after malloc'ing then
182+ free'ing a small block of memory, malloc is then called with a really
183+ large size argument (close to SIZE_MAX): instead of returning NULL and
184+ setting errno to ENOMEM, malloc incorrectly returns the previously
185+ allocated block instead. Bug 22343 reported a similar case where
186+ posix_memalign incorrectly returns successfully when called with an with
187+ a really large size argument.
188+
189+ Both of these were caused by integer overflows in the allocator when it
190+ was trying to pad the requested size to allow for book-keeping or
191+ alignment. This test guards against such bugs by repeatedly allocating
192+ and freeing small blocks of memory then trying to allocate various block
193+ sizes larger than the memory bus width of 64-bit targets, or almost
194+ as large as SIZE_MAX on 32-bit targets supported by glibc. In each case,
195+ it verifies that such impossibly large allocations correctly fail. */
196+
197+
198+#include <stdlib.h>
199+#include <malloc.h>
200+#include <errno.h>
201+#include <stdint.h>
202+#include <sys/resource.h>
203+#include <libc-internal.h>
204+#include <support/check.h>
205+#include <unistd.h>
206+#include <sys/param.h>
207+
208+
209+/* This function prepares for each 'too-large memory allocation' test by
210+ performing a small successful malloc/free and resetting errno prior to
211+ the actual test. */
212+static void
213+test_setup (void)
214+{
215+ void *volatile ptr = malloc (16);
216+ TEST_VERIFY_EXIT (ptr != NULL);
217+ free (ptr);
218+ errno = 0;
219+}
220+
221+
222+/* This function tests each of:
223+ - malloc (SIZE)
224+ - realloc (PTR_FOR_REALLOC, SIZE)
225+ - for various values of NMEMB:
226+ - calloc (NMEMB, SIZE/NMEMB)
227+ - calloc (SIZE/NMEMB, NMEMB)
228+ and precedes each of these tests with a small malloc/free before it. */
229+static void
230+test_large_allocations (size_t size)
231+{
232+ void * ptr_to_realloc;
233+
234+ test_setup ();
235+ TEST_VERIFY (malloc (size) == NULL);
236+ TEST_VERIFY (errno == ENOMEM);
237+
238+ ptr_to_realloc = malloc (16);
239+ TEST_VERIFY_EXIT (ptr_to_realloc != NULL);
240+ test_setup ();
241+ TEST_VERIFY (realloc (ptr_to_realloc, size) == NULL);
242+ TEST_VERIFY (errno == ENOMEM);
243+ free (ptr_to_realloc);
244+
245+ for (size_t nmemb = 1; nmemb <= 8; nmemb *= 2)
246+ if ((size % nmemb) == 0)
247+ {
248+ test_setup ();
249+ TEST_VERIFY (calloc (nmemb, size / nmemb) == NULL);
250+ TEST_VERIFY (errno == ENOMEM);
251+
252+ test_setup ();
253+ TEST_VERIFY (calloc (size / nmemb, nmemb) == NULL);
254+ TEST_VERIFY (errno == ENOMEM);
255+ }
256+ else
257+ break;
258+}
259+
260+
261+static long pagesize;
262+
263+/* This function tests the following aligned memory allocation functions
264+ using several valid alignments and precedes each allocation test with a
265+ small malloc/free before it:
266+ memalign, posix_memalign, aligned_alloc, valloc, pvalloc. */
267+static void
268+test_large_aligned_allocations (size_t size)
269+{
270+ /* ptr stores the result of posix_memalign but since all those calls
271+ should fail, posix_memalign should never change ptr. We set it to
272+ NULL here and later on we check that it remains NULL after each
273+ posix_memalign call. */
274+ void * ptr = NULL;
275+
276+ size_t align;
277+
278+ /* All aligned memory allocation functions expect an alignment that is a
279+ power of 2. Given this, we test each of them with every valid
280+ alignment from 1 thru PAGESIZE. */
281+ for (align = 1; align <= pagesize; align *= 2)
282+ {
283+ test_setup ();
284+ TEST_VERIFY (memalign (align, size) == NULL);
285+ TEST_VERIFY (errno == ENOMEM);
286+
287+ /* posix_memalign expects an alignment that is a power of 2 *and* a
288+ multiple of sizeof (void *). */
289+ if ((align % sizeof (void *)) == 0)
290+ {
291+ test_setup ();
292+ TEST_VERIFY (posix_memalign (&ptr, align, size) == ENOMEM);
293+ TEST_VERIFY (ptr == NULL);
294+ }
295+
296+ /* aligned_alloc expects a size that is a multiple of alignment. */
297+ if ((size % align) == 0)
298+ {
299+ test_setup ();
300+ TEST_VERIFY (aligned_alloc (align, size) == NULL);
301+ TEST_VERIFY (errno == ENOMEM);
302+ }
303+ }
304+
305+ /* Both valloc and pvalloc return page-aligned memory. */
306+
307+ test_setup ();
308+ TEST_VERIFY (valloc (size) == NULL);
309+ TEST_VERIFY (errno == ENOMEM);
310+
311+ test_setup ();
312+ TEST_VERIFY (pvalloc (size) == NULL);
313+ TEST_VERIFY (errno == ENOMEM);
314+}
315+
316+
317+#define FOURTEEN_ON_BITS ((1UL << 14) - 1)
318+#define FIFTY_ON_BITS ((1UL << 50) - 1)
319+
320+
321+static int
322+do_test (void)
323+{
324+
325+#if __WORDSIZE >= 64
326+
327+ /* This test assumes that none of the supported targets have an address
328+ bus wider than 50 bits, and that therefore allocations for sizes wider
329+ than 50 bits will fail. Here, we ensure that the assumption continues
330+ to be true in the future when we might have address buses wider than 50
331+ bits. */
332+
333+ struct rlimit alloc_size_limit
334+ = {
335+ .rlim_cur = FIFTY_ON_BITS,
336+ .rlim_max = FIFTY_ON_BITS
337+ };
338+
339+ setrlimit (RLIMIT_AS, &alloc_size_limit);
340+
341+#endif /* __WORDSIZE >= 64 */
342+
343+ DIAG_PUSH_NEEDS_COMMENT;
344+#if __GNUC_PREREQ (7, 0)
345+ /* GCC 7 warns about too-large allocations; here we want to test
346+ that they fail. */
347+ DIAG_IGNORE_NEEDS_COMMENT (7, "-Walloc-size-larger-than=");
348+#endif
349+
350+ /* Aligned memory allocation functions need to be tested up to alignment
351+ size equivalent to page size, which should be a power of 2. */
352+ pagesize = sysconf (_SC_PAGESIZE);
353+ TEST_VERIFY_EXIT (powerof2 (pagesize));
354+
355+ /* Loop 1: Ensure that all allocations with SIZE close to SIZE_MAX, i.e.
356+ in the range (SIZE_MAX - 2^14, SIZE_MAX], fail.
357+
358+ We can expect that this range of allocation sizes will always lead to
359+ an allocation failure on both 64 and 32 bit targets, because:
360+
361+ 1. no currently supported 64-bit target has an address bus wider than
362+ 50 bits -- and (2^64 - 2^14) is much wider than that;
363+
364+ 2. on 32-bit targets, even though 2^32 is only 4 GB and potentially
365+ addressable, glibc itself is more than 2^14 bytes in size, and
366+ therefore once glibc is loaded, less than (2^32 - 2^14) bytes remain
367+ available. */
368+
369+ for (size_t i = 0; i <= FOURTEEN_ON_BITS; i++)
370+ {
371+ test_large_allocations (SIZE_MAX - i);
372+ test_large_aligned_allocations (SIZE_MAX - i);
373+ }
374+
375+#if __WORDSIZE >= 64
376+ /* On 64-bit targets, we need to test a much wider range of too-large
377+ sizes, so we test at intervals of (1 << 50) that allocation sizes
378+ ranging from SIZE_MAX down to (1 << 50) fail:
379+ The 14 MSBs are decremented starting from "all ON" going down to 1,
380+ the 50 LSBs are "all ON" and then "all OFF" during every iteration. */
381+ for (size_t msbs = FOURTEEN_ON_BITS; msbs >= 1; msbs--)
382+ {
383+ size_t size = (msbs << 50) | FIFTY_ON_BITS;
384+ test_large_allocations (size);
385+ test_large_aligned_allocations (size);
386+
387+ size = msbs << 50;
388+ test_large_allocations (size);
389+ test_large_aligned_allocations (size);
390+ }
391+#endif /* __WORDSIZE >= 64 */
392+
393+ DIAG_POP_NEEDS_COMMENT;
394+
395+ return 0;
396+}
397+
398+
399+#include <support/test-driver.c>
400
401
diff --git a/recipes-core/glibc/glibc_%.bbappend b/recipes-core/glibc/glibc_%.bbappend
deleted file mode 100644
index f2c9a31..0000000
--- a/recipes-core/glibc/glibc_%.bbappend
+++ /dev/null
@@ -1,8 +0,0 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += "file://CVE-2017-1000366.patch \
5 file://CVE-2017-12132.patch \
6 file://CVE-2017-8804.patch \
7 "
8
diff --git a/recipes-core/glibc/glibc_2.25.bbappend b/recipes-core/glibc/glibc_2.25.bbappend
new file mode 100644
index 0000000..bbd2585
--- /dev/null
+++ b/recipes-core/glibc/glibc_2.25.bbappend
@@ -0,0 +1,11 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2017-1000366.patch \
6 file://CVE-2017-12132.patch \
7 file://CVE-2017-8804.patch \
8 file://CVE-2017-16997-Check-for-empty-tokens-before-dynamic-string-tok.patch \
9 file://CVE-2018-6551-Fix-integer-overflows-in-internal-memalign-and-malloc-functions.patch \
10 file://CVE-2017-12133-sunrpc-Avoid-use-after-free-read-access-in-clntudp_c.patch \
11 "
diff --git a/recipes-core/libxml/libxml2/CVE-2017-16932-detect-infinite-recursion-in-parameter-entities.patch b/recipes-core/libxml/libxml2/CVE-2017-16932-detect-infinite-recursion-in-parameter-entities.patch
new file mode 100644
index 0000000..9a94344
--- /dev/null
+++ b/recipes-core/libxml/libxml2/CVE-2017-16932-detect-infinite-recursion-in-parameter-entities.patch
@@ -0,0 +1,106 @@
1From 899a5d9f0ed13b8e32449a08a361e0de127dd961 Mon Sep 17 00:00:00 2001
2From: Nick Wellnhofer <wellnhofer@aevum.de>
3Date: Tue, 25 Jul 2017 14:59:49 +0200
4Subject: [PATCH] Detect infinite recursion in parameter entities
5
6When expanding a parameter entity in a DTD, infinite recursion could
7lead to an infinite loop or memory exhaustion.
8
9Thanks to Wei Lei for the first of many reports.
10
11Fixes bug 759579.
12
13CVE: CVE-2017-16932
14Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961]
15
16Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
17---
18 parser.c | 11 ++++++++++-
19 result/errors/759579.xml | 0
20 result/errors/759579.xml.err | 6 ++++++
21 result/errors/759579.xml.str | 7 +++++++
22 test/errors/759579.xml | 11 +++++++++++
23 5 files changed, 34 insertions(+), 1 deletion(-)
24 create mode 100644 result/errors/759579.xml
25 create mode 100644 result/errors/759579.xml.err
26 create mode 100644 result/errors/759579.xml.str
27 create mode 100644 test/errors/759579.xml
28
29diff --git a/parser.c b/parser.c
30index 6286cad..51452a2 100644
31--- a/parser.c
32+++ b/parser.c
33@@ -2250,6 +2250,13 @@ xmlPushInput(xmlParserCtxtPtr ctxt, xmlParserInputPtr input) {
34 xmlGenericError(xmlGenericErrorContext,
35 "Pushing input %d : %.30s\n", ctxt->inputNr+1, input->cur);
36 }
37+ if (((ctxt->inputNr > 40) && ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
38+ (ctxt->inputNr > 1024)) {
39+ xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
40+ while (ctxt->inputNr > 1)
41+ xmlFreeInputStream(inputPop(ctxt));
42+ return(-1);
43+ }
44 ret = inputPush(ctxt, input);
45 if (ctxt->instate == XML_PARSER_EOF)
46 return(-1);
47@@ -7916,8 +7923,10 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
48 * c.f. http://www.w3.org/TR/REC-xml#as-PE
49 */
50 input = xmlNewEntityInputStream(ctxt, entity);
51- if (xmlPushInput(ctxt, input) < 0)
52+ if (xmlPushInput(ctxt, input) < 0) {
53+ xmlFreeInputStream(input);
54 return;
55+ }
56 if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
57 (CMP5(CUR_PTR, '<', '?', 'x', 'm', 'l')) &&
58 (IS_BLANK_CH(NXT(5)))) {
59diff --git a/result/errors/759579.xml b/result/errors/759579.xml
60new file mode 100644
61index 0000000..e69de29
62diff --git a/result/errors/759579.xml.err b/result/errors/759579.xml.err
63new file mode 100644
64index 0000000..288026e
65--- /dev/null
66+++ b/result/errors/759579.xml.err
67@@ -0,0 +1,6 @@
68+Entity: line 2: parser error : Detected an entity reference loop
69+ %z; %z; %z; %z; %z;
70+ ^
71+Entity: line 2:
72+ %z; %z; %z; %z; %z;
73+ ^
74diff --git a/result/errors/759579.xml.str b/result/errors/759579.xml.str
75new file mode 100644
76index 0000000..09408f5
77--- /dev/null
78+++ b/result/errors/759579.xml.str
79@@ -0,0 +1,7 @@
80+Entity: line 2: parser error : Detected an entity reference loop
81+ %z; %z; %z; %z; %z;
82+ ^
83+Entity: line 2:
84+ %z; %z; %z; %z; %z;
85+ ^
86+./test/errors/759579.xml : failed to parse
87diff --git a/test/errors/759579.xml b/test/errors/759579.xml
88new file mode 100644
89index 0000000..7fadd70
90--- /dev/null
91+++ b/test/errors/759579.xml
92@@ -0,0 +1,11 @@
93+<!DOCTYPE doc [
94+ <!ENTITY % z '
95+ &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
96+ &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
97+ &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
98+ &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
99+ &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
100+ '>
101+ %z;
102+]>
103+<doc/>
104--
1052.7.4
106
diff --git a/recipes-core/libxml/libxml2/CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch b/recipes-core/libxml/libxml2/CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch
new file mode 100644
index 0000000..e072ef1
--- /dev/null
+++ b/recipes-core/libxml/libxml2/CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch
@@ -0,0 +1,66 @@
1From 897dffbae322b46b83f99a607d527058a72c51ed Mon Sep 17 00:00:00 2001
2From: Nick Wellnhofer <wellnhofer@aevum.de>
3Date: Tue, 6 Jun 2017 13:21:14 +0200
4Subject: [PATCH] Check for integer overflow in memory debug code
5
6Fixes bug 783026.
7
8Thanks to Pranjal Jumde for the report.
9
10CVE: CVE-2017-5130
11Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/897dffbae322b46b83f99a607d527058a72c51ed]
12
13Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
14---
15 xmlmemory.c | 21 +++++++++++++++++++++
16 1 file changed, 21 insertions(+)
17
18diff --git a/xmlmemory.c b/xmlmemory.c
19index f08c8c3..c53141f 100644
20--- a/xmlmemory.c
21+++ b/xmlmemory.c
22@@ -172,6 +172,13 @@ xmlMallocLoc(size_t size, const char * file, int line)
23
24 TEST_POINT
25
26+ if (size > (MAX_SIZE_T - RESERVE_SIZE)) {
27+ xmlGenericError(xmlGenericErrorContext,
28+ "xmlMallocLoc : Unsigned overflow\n");
29+ xmlMemoryDump();
30+ return(NULL);
31+ }
32+
33 p = (MEMHDR *) malloc(RESERVE_SIZE+size);
34
35 if (!p) {
36@@ -352,6 +359,13 @@ xmlReallocLoc(void *ptr,size_t size, const char * file, int line)
37 #endif
38 xmlMutexUnlock(xmlMemMutex);
39
40+ if (size > (MAX_SIZE_T - RESERVE_SIZE)) {
41+ xmlGenericError(xmlGenericErrorContext,
42+ "xmlMallocLoc : Unsigned overflow\n");
43+ xmlMemoryDump();
44+ return(NULL);
45+ }
46+
47 tmp = (MEMHDR *) realloc(p,RESERVE_SIZE+size);
48 if (!tmp) {
49 free(p);
50@@ -499,6 +513,13 @@ xmlMemStrdupLoc(const char *str, const char *file, int line)
51 if (!xmlMemInitialized) xmlInitMemory();
52 TEST_POINT
53
54+ if (size > (MAX_SIZE_T - RESERVE_SIZE)) {
55+ xmlGenericError(xmlGenericErrorContext,
56+ "xmlMallocLoc : Unsigned overflow\n");
57+ xmlMemoryDump();
58+ return(NULL);
59+ }
60+
61 p = (MEMHDR *) malloc(RESERVE_SIZE+size);
62 if (!p) {
63 goto error;
64--
652.7.4
66
diff --git a/recipes-core/libxml/libxml2/CVE-2017-7375-Prevent-unwanted-external-entity-reference.patch b/recipes-core/libxml/libxml2/CVE-2017-7375-Prevent-unwanted-external-entity-reference.patch
new file mode 100644
index 0000000..252929c
--- /dev/null
+++ b/recipes-core/libxml/libxml2/CVE-2017-7375-Prevent-unwanted-external-entity-reference.patch
@@ -0,0 +1,40 @@
1From 90ccb58242866b0ba3edbef8fe44214a101c2b3e Mon Sep 17 00:00:00 2001
2From: Neel Mehta <nmehta@google.com>
3Date: Fri, 7 Apr 2017 17:43:02 +0200
4Subject: [PATCH] Prevent unwanted external entity reference
5
6For https://bugzilla.gnome.org/show_bug.cgi?id=780691
7
8* parser.c: add a specific check to avoid PE reference
9
10CVE: CVE-2018-7375
11Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/90ccb58242866b0ba3edbef8fe44214a101c2b3e]
12
13Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
14---
15 parser.c | 9 +++++++++
16 1 file changed, 9 insertions(+)
17
18diff --git a/parser.c b/parser.c
19index 609a270..c2c812d 100644
20--- a/parser.c
21+++ b/parser.c
22@@ -8123,6 +8123,15 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
23 if (xmlPushInput(ctxt, input) < 0)
24 return;
25 } else {
26+ if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
27+ ((ctxt->options & XML_PARSE_NOENT) == 0) &&
28+ ((ctxt->options & XML_PARSE_DTDVALID) == 0) &&
29+ ((ctxt->options & XML_PARSE_DTDLOAD) == 0) &&
30+ ((ctxt->options & XML_PARSE_DTDATTR) == 0) &&
31+ (ctxt->replaceEntities == 0) &&
32+ (ctxt->validate == 0))
33+ return;
34+
35 /*
36 * TODO !!!
37 * handle the extra spaces added before and after
38--
392.7.4
40
diff --git a/recipes-core/libxml/libxml2/CVE-2017-7376-Increase-buffer-space-for-port-in-HTTP-redirect-supp.patch b/recipes-core/libxml/libxml2/CVE-2017-7376-Increase-buffer-space-for-port-in-HTTP-redirect-supp.patch
new file mode 100644
index 0000000..aae956d
--- /dev/null
+++ b/recipes-core/libxml/libxml2/CVE-2017-7376-Increase-buffer-space-for-port-in-HTTP-redirect-supp.patch
@@ -0,0 +1,36 @@
1From 5dca9eea1bd4263bfa4d037ab2443de1cd730f7e Mon Sep 17 00:00:00 2001
2From: Daniel Veillard <veillard@redhat.com>
3Date: Fri, 7 Apr 2017 17:13:28 +0200
4Subject: [PATCH] Increase buffer space for port in HTTP redirect support
5
6For https://bugzilla.gnome.org/show_bug.cgi?id=780690
7
8nanohttp.c: the code wrongly assumed a short int port value.
9
10CVE: CVE-2017-7376
11Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/5dca9eea1bd4263bfa4d037ab2443de1cd730f7e]
12
13Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
14---
15 nanohttp.c | 4 ++--
16 1 file changed, 2 insertions(+), 2 deletions(-)
17
18diff --git a/nanohttp.c b/nanohttp.c
19index e109ad7..373425d 100644
20--- a/nanohttp.c
21+++ b/nanohttp.c
22@@ -1423,9 +1423,9 @@ retry:
23 if (ctxt->port != 80) {
24 /* reserve space for ':xxxxx', incl. potential proxy */
25 if (proxy)
26- blen += 12;
27+ blen += 17;
28 else
29- blen += 6;
30+ blen += 11;
31 }
32 bp = (char*)xmlMallocAtomic(blen);
33 if ( bp == NULL ) {
34--
352.7.4
36
diff --git a/recipes-core/libxml/libxml2_2.9.4.bbappend b/recipes-core/libxml/libxml2_2.9.4.bbappend
new file mode 100644
index 0000000..dbf9709
--- /dev/null
+++ b/recipes-core/libxml/libxml2_2.9.4.bbappend
@@ -0,0 +1,9 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2017-7376-Increase-buffer-space-for-port-in-HTTP-redirect-supp.patch \
6 file://CVE-2017-7375-Prevent-unwanted-external-entity-reference.patch \
7 file://CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch \
8 file://CVE-2017-16932-detect-infinite-recursion-in-parameter-entities.patch \
9 "
diff --git a/recipes-devtools/perl/perl/CVE-2018-6913-perl-131844-fix-various-space-calculation-issues-in-.patch b/recipes-devtools/perl/perl/CVE-2018-6913-perl-131844-fix-various-space-calculation-issues-in-.patch
new file mode 100644
index 0000000..cb73e21
--- /dev/null
+++ b/recipes-devtools/perl/perl/CVE-2018-6913-perl-131844-fix-various-space-calculation-issues-in-.patch
@@ -0,0 +1,148 @@
1From a9d5c6e11891b48be06d4e06eeed18642bc98527 Mon Sep 17 00:00:00 2001
2From: Tony Cook <tony@develop-help.com>
3Date: Tue, 8 Aug 2017 09:32:58 +1000
4Subject: [PATCH] (perl #131844) fix various space calculation issues in
5 pp_pack.c
6
7- for the originally reported case, if the start/cur pointer is in the
8 top 75% of the address space the add (cur) + glen addition would
9 overflow, resulting in the condition failing incorrectly.
10
11- the addition of the existing space used to the space needed could
12 overflow, resulting in too small an allocation and a buffer overflow.
13
14- the scaling for UTF8 could overflow.
15
16- the multiply to calculate the space needed for many items could
17 overflow.
18
19For the first case, do a space calculation without making new pointers.
20
21For the other cases, detect the overflow and croak if there's an
22overflow.
23
24Originally this used Size_t_MAX as the maximum size of a memory
25allocation, but for -DDEBUGGING builds realloc() throws a panic for
26allocations over half the address space in size, changing the error
27reported for the allocation.
28
29For non-DEBUGGING builds the Size_t_MAX limit has the small chance
30of finding a system that has 3GB of contiguous space available, and
31allocating that space, which could be a denial of servce in some cases.
32
33Unfortunately changing the limit to half the address space means that
34the exact case with the original issue can no longer occur, so the
35test is no longer testing against the address + length issue that
36caused the original problem, since the allocation is failing earlier.
37
38One option would be to change the test so the size request by pack is
39just under 2GB, but this has a higher (but still low) probability that
40the system has the address space available, and will actually try to
41allocate the memory, so let's not do that.
42
43(cherry picked from commit f5506feddde8546eabb69d71569d856c7e9c615b)
44
45CVE: CVE-2018-131844
46Upstream-Status: Backport [https://rt.perl.org/Public/Ticket/Attachment/1480002/799836/0001-perl-131844-fix-various-space-calculation-issues-in-.patch]
47
48Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
49---
50 pp_pack.c | 25 +++++++++++++++++++++----
51 t/op/pack.t | 24 +++++++++++++++++++++++-
52 2 files changed, 44 insertions(+), 5 deletions(-)
53
54diff --git a/pp_pack.c b/pp_pack.c
55index f6964c3..c0de5ab 100644
56--- a/pp_pack.c
57+++ b/pp_pack.c
58@@ -358,11 +358,28 @@ STMT_START { \
59 } \
60 } STMT_END
61
62+#define SAFE_UTF8_EXPAND(var) \
63+STMT_START { \
64+ if ((var) > SSize_t_MAX / UTF8_EXPAND) \
65+ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
66+ (var) = (var) * UTF8_EXPAND; \
67+} STMT_END
68+
69+#define GROWING2(utf8, cat, start, cur, item_size, item_count) \
70+STMT_START { \
71+ if (SSize_t_MAX / (item_size) < (item_count)) \
72+ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
73+ GROWING((utf8), (cat), (start), (cur), (item_size) * (item_count)); \
74+} STMT_END
75+
76 #define GROWING(utf8, cat, start, cur, in_len) \
77 STMT_START { \
78 STRLEN glen = (in_len); \
79- if (utf8) glen *= UTF8_EXPAND; \
80- if ((cur) + glen >= (start) + SvLEN(cat)) { \
81+ STRLEN catcur = (STRLEN)((cur) - (start)); \
82+ if (utf8) SAFE_UTF8_EXPAND(glen); \
83+ if (SSize_t_MAX - glen < catcur) \
84+ Perl_croak(aTHX_ "%s", "Out of memory during pack()"); \
85+ if (catcur + glen >= SvLEN(cat)) { \
86 (start) = sv_exp_grow(cat, glen); \
87 (cur) = (start) + SvCUR(cat); \
88 } \
89@@ -372,7 +389,7 @@ STMT_START { \
90 STMT_START { \
91 const STRLEN glen = (in_len); \
92 STRLEN gl = glen; \
93- if (utf8) gl *= UTF8_EXPAND; \
94+ if (utf8) SAFE_UTF8_EXPAND(gl); \
95 if ((cur) + gl >= (start) + SvLEN(cat)) { \
96 *cur = '\0'; \
97 SvCUR_set((cat), (cur) - (start)); \
98@@ -2126,7 +2143,7 @@ S_pack_rec(pTHX_ SV *cat, tempsym_t* symptr, SV **beglist, SV **endlist )
99 if (props && !(props & PACK_SIZE_UNPREDICTABLE)) {
100 /* We can process this letter. */
101 STRLEN size = props & PACK_SIZE_MASK;
102- GROWING(utf8, cat, start, cur, (STRLEN) len * size);
103+ GROWING2(utf8, cat, start, cur, size, (STRLEN)len);
104 }
105 }
106
107diff --git a/t/op/pack.t b/t/op/pack.t
108index a2da636..a480c3a 100644
109--- a/t/op/pack.t
110+++ b/t/op/pack.t
111@@ -12,7 +12,7 @@ my $no_endianness = $] > 5.009 ? '' :
112 my $no_signedness = $] > 5.009 ? '' :
113 "Signed/unsigned pack modifiers not available on this perl";
114
115-plan tests => 14712;
116+plan tests => 14716;
117
118 use strict;
119 use warnings qw(FATAL all);
120@@ -2044,3 +2044,25 @@ ok(1, "argument underflow did not crash");
121 is(pack("H40", $up_nul), $twenty_nuls,
122 "check pack H zero fills (utf8 source)");
123 }
124+
125+SKIP:
126+{
127+ # [perl #131844] pointer addition overflow
128+ $Config{ptrsize} == 4
129+ or skip "[perl #131844] need 32-bit build for this test", 4;
130+ # prevent ASAN just crashing on the allocation failure
131+ local $ENV{ASAN_OPTIONS} = $ENV{ASAN_OPTIONS};
132+ $ENV{ASAN_OPTIONS} .= ",allocator_may_return_null=1";
133+ fresh_perl_like('pack "f999999999"', qr/Out of memory during pack/, { stderr => 1 },
134+ "pointer addition overflow");
135+
136+ # integer (STRLEN) overflow from addition of glen to current length
137+ fresh_perl_like('pack "c10f1073741823"', qr/Out of memory during pack/, { stderr => 1 },
138+ "integer overflow calculating allocation (addition)");
139+
140+ fresh_perl_like('pack "W10f536870913", 256', qr/Out of memory during pack/, { stderr => 1 },
141+ "integer overflow calculating allocation (utf8)");
142+
143+ fresh_perl_like('pack "c10f1073741824"', qr/Out of memory during pack/, { stderr => 1 },
144+ "integer overflow calculating allocation (multiply)");
145+}
146--
1472.7.4
148
diff --git a/recipes-devtools/perl/perl_5.24.1.bbappend b/recipes-devtools/perl/perl_5.24.1.bbappend
new file mode 100644
index 0000000..10cfbca
--- /dev/null
+++ b/recipes-devtools/perl/perl_5.24.1.bbappend
@@ -0,0 +1,6 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2018-6913-perl-131844-fix-various-space-calculation-issues-in-.patch \
6 "
diff --git a/recipes-devtools/python/python/CVE-2017-1000158-2.7-bpo-30657-Check-prevent-integer-overflow-in-PySt.patch b/recipes-devtools/python/python/CVE-2017-1000158-2.7-bpo-30657-Check-prevent-integer-overflow-in-PySt.patch
new file mode 100644
index 0000000..b94ae06
--- /dev/null
+++ b/recipes-devtools/python/python/CVE-2017-1000158-2.7-bpo-30657-Check-prevent-integer-overflow-in-PySt.patch
@@ -0,0 +1,62 @@
1From cab6444ff39a91084bdac08d0ae66734cea943f6 Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 10:13:00 +0200
4Subject: [PATCH] [2.7] bpo-30657: Check & prevent integer overflow in PyString_DecodeEscape (#2174)
5
6CVE: CVE-2017-1000158
7Upstream-Status: Backport [https://github.com/python/cpython/commit/c3c9db89273fabc62ea1b48389d9a3000c1c03ae]
8
9Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
10---
11 Misc/ACKS | 1 +
12 Misc/NEWS | 3 +++
13 Objects/stringobject.c | 8 +++++++-
14 3 files changed, 11 insertions(+), 1 deletion(-)
15
16diff --git a/Misc/ACKS b/Misc/ACKS
17index 952d6dd..6ea6639 100644
18--- a/Misc/ACKS
19+++ b/Misc/ACKS
20@@ -151,6 +151,7 @@ Gregory Bond
21 Matias Bordese
22 Jonas Borgström
23 Jurjen Bos
24+Jay Bosamiya
25 Peter Bosch
26 Dan Boswell
27 Eric Bouck
28diff --git a/Misc/NEWS b/Misc/NEWS
29index b779e82..ab0b687 100644
30--- a/Misc/NEWS
31+++ b/Misc/NEWS
32@@ -21,6 +21,9 @@ What's New in Python 2.7.13 release candidate 1?
33 Core and Builtins
34 -----------------
35
36+- bpo-30657: Fixed possible integer overflow in PyString_DecodeEscape.
37+ Patch by Jay Bosamiya.
38+
39 - Issue #28847: dumbdbm no longer writes the index file in when it is not
40 changed and supports reading read-only files.
41
42diff --git a/Objects/stringobject.c b/Objects/stringobject.c
43index 4e38735..6c31c5b 100644
44--- a/Objects/stringobject.c
45+++ b/Objects/stringobject.c
46@@ -612,7 +612,13 @@ PyObject *PyString_DecodeEscape(const char *s,
47 char *p, *buf;
48 const char *end;
49 PyObject *v;
50- Py_ssize_t newlen = recode_encoding ? 4*len:len;
51+ Py_ssize_t newlen;
52+ /* Check for integer overflow */
53+ if (recode_encoding && (len > PY_SSIZE_T_MAX / 4)) {
54+ PyErr_SetString(PyExc_OverflowError, "string is too large");
55+ return NULL;
56+ }
57+ newlen = recode_encoding ? 4*len:len;
58 v = PyString_FromStringAndSize((char *)NULL, newlen);
59 if (v == NULL)
60 return NULL;
61
62
diff --git a/recipes-devtools/python/python/CVE-2018-1060-CVE-2018-1061-2.7-bpo-32981-Fix-catastrophic-backtracking-vulns-GH.patch b/recipes-devtools/python/python/CVE-2018-1060-CVE-2018-1061-2.7-bpo-32981-Fix-catastrophic-backtracking-vulns-GH.patch
new file mode 100644
index 0000000..6239503
--- /dev/null
+++ b/recipes-devtools/python/python/CVE-2018-1060-CVE-2018-1061-2.7-bpo-32981-Fix-catastrophic-backtracking-vulns-GH.patch
@@ -0,0 +1,161 @@
1From fbfdc20005366facc079675ee7e217a0993ef2f9 Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 13:44:16 +0200
4Subject: [PATCH] [2.7] bpo-32981: Fix catastrophic backtracking vulns
5 (GH-5955)
6
7* Prevent low-grade poplib REDOS (CVE-2018-1060)
8
9The regex to test a mail server's timestamp is susceptible to
10catastrophic backtracking on long evil responses from the server.
11
12Happily, the maximum length of malicious inputs is 2K thanks
13to a limit introduced in the fix for CVE-2013-1752.
14
15A 2KB evil response from the mail server would result in small slowdowns
16(milliseconds vs. microseconds) accumulated over many apop calls.
17This is a potential DOS vector via accumulated slowdowns.
18
19Replace it with a similar non-vulnerable regex.
20
21The new regex is RFC compliant.
22The old regex was non-compliant in edge cases.
23
24* Prevent difflib REDOS (CVE-2018-1061)
25
26The default regex for IS_LINE_JUNK is susceptible to
27catastrophic backtracking.
28This is a potential DOS vector.
29
30Replace it with an equivalent non-vulnerable regex.
31
32Also introduce unit and REDOS tests for difflib.
33
34CVE: CVE-2018-1060
35CVE: CVE-2018-1061
36Upstream-Status: Backport [https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b]
37
38Co-authored-by: Tim Peters <tim.peters@gmail.com>
39Co-authored-by: Christian Heimes <christian@python.org>.
40(cherry picked from commit 0e6c8ee2358a2e23117501826c008842acb835ac)
41Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
42---
43 Lib/difflib.py | 2 +-
44 Lib/poplib.py | 2 +-
45 Lib/test/test_difflib.py | 22 +++++++++++++++++++++-
46 Lib/test/test_poplib.py | 10 ++++++++++
47 Misc/ACKS | 1 +
48 .../2018-03-02-10-24-52.bpo-32981.O_qDyj.rst | 4 ++++
49 6 files changed, 38 insertions(+), 3 deletions(-)
50 create mode 100644 Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst
51
52diff --git a/Lib/difflib.py b/Lib/difflib.py
53index 1c6fbdb..788a92d 100644
54--- a/Lib/difflib.py
55+++ b/Lib/difflib.py
56@@ -1103,7 +1103,7 @@ class Differ:
57
58 import re
59
60-def IS_LINE_JUNK(line, pat=re.compile(r"\s*#?\s*$").match):
61+def IS_LINE_JUNK(line, pat=re.compile(r"\s*(?:#\s*)?$").match):
62 r"""
63 Return 1 for ignorable line: iff `line` is blank or contains a single '#'.
64
65diff --git a/Lib/poplib.py b/Lib/poplib.py
66index b91e5f7..a238510 100644
67--- a/Lib/poplib.py
68+++ b/Lib/poplib.py
69@@ -274,7 +274,7 @@ class POP3:
70 return self._shortcmd('RPOP %s' % user)
71
72
73- timestamp = re.compile(r'\+OK.*(<[^>]+>)')
74+ timestamp = re.compile(br'\+OK.[^<]*(<.*>)')
75
76 def apop(self, user, secret):
77 """Authorisation
78diff --git a/Lib/test/test_difflib.py b/Lib/test/test_difflib.py
79index 35f2c36..d8277b7 100644
80--- a/Lib/test/test_difflib.py
81+++ b/Lib/test/test_difflib.py
82@@ -269,13 +269,33 @@ class TestOutputFormat(unittest.TestCase):
83 self.assertEqual(fmt(3,6), '4,6')
84 self.assertEqual(fmt(0,0), '0')
85
86+class TestJunkAPIs(unittest.TestCase):
87+ def test_is_line_junk_true(self):
88+ for line in ['#', ' ', ' #', '# ', ' # ', '']:
89+ self.assertTrue(difflib.IS_LINE_JUNK(line), repr(line))
90+
91+ def test_is_line_junk_false(self):
92+ for line in ['##', ' ##', '## ', 'abc ', 'abc #', 'Mr. Moose is up!']:
93+ self.assertFalse(difflib.IS_LINE_JUNK(line), repr(line))
94+
95+ def test_is_line_junk_REDOS(self):
96+ evil_input = ('\t' * 1000000) + '##'
97+ self.assertFalse(difflib.IS_LINE_JUNK(evil_input))
98+
99+ def test_is_character_junk_true(self):
100+ for char in [' ', '\t']:
101+ self.assertTrue(difflib.IS_CHARACTER_JUNK(char), repr(char))
102+
103+ def test_is_character_junk_false(self):
104+ for char in ['a', '#', '\n', '\f', '\r', '\v']:
105+ self.assertFalse(difflib.IS_CHARACTER_JUNK(char), repr(char))
106
107 def test_main():
108 difflib.HtmlDiff._default_prefix = 0
109 Doctests = doctest.DocTestSuite(difflib)
110 run_unittest(
111 TestWithAscii, TestAutojunk, TestSFpatches, TestSFbugs,
112- TestOutputFormat, Doctests)
113+ TestOutputFormat, TestJunkAPIs)
114
115 if __name__ == '__main__':
116 test_main()
117diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
118index 23d6887..d214375 100644
119--- a/Lib/test/test_poplib.py
120+++ b/Lib/test/test_poplib.py
121@@ -211,6 +211,16 @@ class TestPOP3Class(TestCase):
122 def test_rpop(self):
123 self.assertOK(self.client.rpop('foo'))
124
125+ def test_apop_REDOS(self):
126+ # Replace welcome with very long evil welcome.
127+ # NB The upper bound on welcome length is currently 2048.
128+ # At this length, evil input makes each apop call take
129+ # on the order of milliseconds instead of microseconds.
130+ evil_welcome = b'+OK' + (b'<' * 1000000)
131+ with test_support.swap_attr(self.client, 'welcome', evil_welcome):
132+ # The evil welcome is invalid, so apop should throw.
133+ self.assertRaises(poplib.error_proto, self.client.apop, 'a', 'kb')
134+
135 def test_top(self):
136 expected = ('+OK 116 bytes',
137 ['From: postmaster@python.org', 'Content-Type: text/plain',
138diff --git a/Misc/ACKS b/Misc/ACKS
139index 9cbc230..952d6dd 100644
140--- a/Misc/ACKS
141+++ b/Misc/ACKS
142@@ -314,6 +314,7 @@ Kushal Das
143 Jonathan Dasteel
144 Pierre-Yves David
145 A. Jesse Jiryu Davis
146+Jamie (James C.) Davis
147 Merlijn van Deen
148 John DeGood
149 Ned Deily
150diff --git a/Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst b/Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst
151new file mode 100644
152index 0000000..9ebabb4
153--- /dev/null
154+++ b/Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst
155@@ -0,0 +1,4 @@
156+Regexes in difflib and poplib were vulnerable to catastrophic backtracking.
157+These regexes formed potential DOS vectors (REDOS). They have been
158+refactored. This resolves CVE-2018-1060 and CVE-2018-1061.
159+Patch by Jamie Davis.
160
161
diff --git a/recipes-devtools/python/python_2.7.13.bbappend b/recipes-devtools/python/python_2.7.13.bbappend
new file mode 100644
index 0000000..d7ec5e2
--- /dev/null
+++ b/recipes-devtools/python/python_2.7.13.bbappend
@@ -0,0 +1,7 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2017-1000158-2.7-bpo-30657-Check-prevent-integer-overflow-in-PySt.patch \
6 file://CVE-2018-1060-CVE-2018-1061-2.7-bpo-32981-Fix-catastrophic-backtracking-vulns-GH.patch \
7 "
diff --git a/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2017-6311.patch b/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2017-6311.patch
new file mode 100644
index 0000000..25d55ad
--- /dev/null
+++ b/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2017-6311.patch
@@ -0,0 +1,109 @@
1From 725afb9a926553b664a1cb1270d38de133f659e1 Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 12:21:56 +0200
4Subject: [PATCH] ico: Return an error when the ICO didn't load
5
6If we don't even read enough data to fill the header, return an
7error. This doesn't cover everything that could go wrong with
8the ICO incremental loader, but this is a good first throw.
9
10Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/commit/7586553]
11
12thumbnailer: Update skeleton to fix a possible crash
13
14If the loader returns a NULL pixbuf without returning an
15error, the skeleton would crash trying to print the error.
16Print that the thumbnailer is broken instead.
17
18https://bugzilla.gnome.org/show_bug.cgi?id=778204
19
20Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/commit/57362ed]
21
22CVE: CVE-2017-6311
23Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
24---
25 gdk-pixbuf/io-ico.c | 11 ++++++++++-
26 thumbnailer/gnome-thumbnailer-skeleton.c | 14 ++++++++++++--
27 2 files changed, 22 insertions(+), 3 deletions(-)
28
29diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c
30index 2b0441f..68295a3 100644
31--- a/gdk-pixbuf/io-ico.c
32+++ b/gdk-pixbuf/io-ico.c
33@@ -605,6 +605,7 @@ gdk_pixbuf__ico_image_stop_load(gpointer data,
34 {
35 struct ico_progressive_state *context =
36 (struct ico_progressive_state *) data;
37+ gboolean ret = TRUE;
38
39 /* FIXME this thing needs to report errors if
40 * we have unused image data
41@@ -612,8 +613,16 @@ gdk_pixbuf__ico_image_stop_load(gpointer data,
42
43 g_return_val_if_fail(context != NULL, TRUE);
44
45+ if (context->HeaderDone < context->HeaderSize) {
46+ g_set_error_literal (error,
47+ GDK_PIXBUF_ERROR,
48+ GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
49+ _("ICO image was truncated or incomplete."));
50+ ret = FALSE;
51+ }
52+
53 context_free (context);
54- return TRUE;
55+ return ret;
56 }
57
58 static void
59diff --git a/thumbnailer/gnome-thumbnailer-skeleton.c b/thumbnailer/gnome-thumbnailer-skeleton.c
60index d686432..73da53e 100644
61--- a/thumbnailer/gnome-thumbnailer-skeleton.c
62+++ b/thumbnailer/gnome-thumbnailer-skeleton.c
63@@ -37,6 +37,7 @@ static int output_size = 256;
64 static gboolean g_fatal_warnings = FALSE;
65 static char **filenames = NULL;
66
67+#if !GDK_PIXBUF_CHECK_VERSION(2,36,5)
68 /**
69 * gnome_desktop_thumbnail_scale_down_pixbuf:
70 * @pixbuf: a #GdkPixbuf
71@@ -178,6 +179,7 @@ gnome_desktop_thumbnail_scale_down_pixbuf (GdkPixbuf *pixbuf,
72
73 return dest_pixbuf;
74 }
75+#endif
76
77 static char *
78 get_target_uri (GFile *file)
79@@ -291,9 +293,16 @@ int main (int argc, char **argv)
80
81 scale = (double)output_size / MAX (width, height);
82
83+#if !GDK_PIXBUF_CHECK_VERSION(2,36,5)
84 scaled = gnome_desktop_thumbnail_scale_down_pixbuf (pixbuf,
85 floor (width * scale + 0.5),
86 floor (height * scale + 0.5));
87+#else
88+ scaled = gdk_pixbuf_scale_simple (pixbuf,
89+ floor (width * scale + 0.5),
90+ floor (height * scale + 0.5),
91+ GDK_INTERP_HYPER);
92+#endif
93 gdk_pixbuf_copy_options (pixbuf, scaled);
94 g_object_unref (pixbuf);
95 pixbuf = scaled;
96@@ -316,8 +325,9 @@ int main (int argc, char **argv)
97 g_free (input_filename);
98
99 if (!pixbuf) {
100- g_warning ("Could not thumbnail '%s': %s", filenames[0], error->message);
101- g_error_free (error);
102+ g_warning ("Could not thumbnail '%s': %s", filenames[0],
103+ error ? error->message : "Thumbnailer failed without returning an error");
104+ g_clear_error (&error);
105 g_strfreev (filenames);
106 return 1;
107 }
108
109
diff --git a/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.36.5.bbappend b/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.36.5.bbappend
new file mode 100644
index 0000000..370bb73
--- /dev/null
+++ b/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.36.5.bbappend
@@ -0,0 +1,6 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2017-6311.patch \
6 "
diff --git a/recipes-graphics/xorg-lib/libxcursor/CVE-2017-16612-Fix-heap-overflows-when-parsing-malicious-files.patch b/recipes-graphics/xorg-lib/libxcursor/CVE-2017-16612-Fix-heap-overflows-when-parsing-malicious-files.patch
new file mode 100644
index 0000000..9cad31e
--- /dev/null
+++ b/recipes-graphics/xorg-lib/libxcursor/CVE-2017-16612-Fix-heap-overflows-when-parsing-malicious-files.patch
@@ -0,0 +1,78 @@
1From 4794b5dd34688158fb51a2943032569d3780c4b8 Mon Sep 17 00:00:00 2001
2From: Tobias Stoeckmann <tobias@stoeckmann.org>
3Date: Sat, 21 Oct 2017 23:47:52 +0200
4Subject: [PATCH] Fix heap overflows when parsing malicious files.
5 (CVE-2017-16612)
6
7It is possible to trigger heap overflows due to an integer overflow
8while parsing images and a signedness issue while parsing comments.
9
10The integer overflow occurs because the chosen limit 0x10000 for
11dimensions is too large for 32 bit systems, because each pixel takes
124 bytes. Properly chosen values allow an overflow which in turn will
13lead to less allocated memory than needed for subsequent reads.
14
15The signedness bug is triggered by reading the length of a comment
16as unsigned int, but casting it to int when calling the function
17XcursorCommentCreate. Turning length into a negative value allows the
18check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
19addition of sizeof (XcursorComment) + 1 makes it possible to allocate
20less memory than needed for subsequent reads.
21
22CVE: CVE-2017-16612
23Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8]
24
25Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
26Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
27Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
28---
29 src/file.c | 12 ++++++++++--
30 1 file changed, 10 insertions(+), 2 deletions(-)
31
32diff --git a/src/file.c b/src/file.c
33index 43163c2..da16277 100644
34--- a/src/file.c
35+++ b/src/file.c
36@@ -29,6 +29,11 @@ XcursorImageCreate (int width, int height)
37 {
38 XcursorImage *image;
39
40+ if (width < 0 || height < 0)
41+ return NULL;
42+ if (width > XCURSOR_IMAGE_MAX_SIZE || height > XCURSOR_IMAGE_MAX_SIZE)
43+ return NULL;
44+
45 image = malloc (sizeof (XcursorImage) +
46 width * height * sizeof (XcursorPixel));
47 if (!image)
48@@ -101,7 +106,7 @@ XcursorCommentCreate (XcursorUInt comment_type, int length)
49 {
50 XcursorComment *comment;
51
52- if (length > XCURSOR_COMMENT_MAX_LEN)
53+ if (length < 0 || length > XCURSOR_COMMENT_MAX_LEN)
54 return NULL;
55
56 comment = malloc (sizeof (XcursorComment) + length + 1);
57@@ -448,7 +453,8 @@ _XcursorReadImage (XcursorFile *file,
58 if (!_XcursorReadUInt (file, &head.delay))
59 return NULL;
60 /* sanity check data */
61- if (head.width >= 0x10000 || head.height > 0x10000)
62+ if (head.width > XCURSOR_IMAGE_MAX_SIZE ||
63+ head.height > XCURSOR_IMAGE_MAX_SIZE)
64 return NULL;
65 if (head.width == 0 || head.height == 0)
66 return NULL;
67@@ -457,6 +463,8 @@ _XcursorReadImage (XcursorFile *file,
68
69 /* Create the image and initialize it */
70 image = XcursorImageCreate (head.width, head.height);
71+ if (image == NULL)
72+ return NULL;
73 if (chunkHeader.version < image->version)
74 image->version = chunkHeader.version;
75 image->size = chunkHeader.subtype;
76--
772.7.4
78
diff --git a/recipes-graphics/xorg-lib/libxcursor_1.1.14.bbappend b/recipes-graphics/xorg-lib/libxcursor_1.1.14.bbappend
new file mode 100644
index 0000000..0f67cec
--- /dev/null
+++ b/recipes-graphics/xorg-lib/libxcursor_1.1.14.bbappend
@@ -0,0 +1,6 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2017-16612-Fix-heap-overflows-when-parsing-malicious-files.patch \
6 "
diff --git a/recipes-support/curl/curl/CVE-2018-1000120-FTP-reject-path-components-with-control-codes.patch b/recipes-support/curl/curl/CVE-2018-1000120-FTP-reject-path-components-with-control-codes.patch
new file mode 100644
index 0000000..cd44efb
--- /dev/null
+++ b/recipes-support/curl/curl/CVE-2018-1000120-FTP-reject-path-components-with-control-codes.patch
@@ -0,0 +1,119 @@
1From 257f0d14893a491786bccb34ecc847f74edd47c6 Mon Sep 17 00:00:00 2001
2From: Andreas Wellving <andreas.wellving@enea.com>
3Date: Mon, 22 Oct 2018 13:01:11 +0200
4Subject: [PATCH] FTP: reject path components with control codes
5
6Refuse to operate when given path components featuring byte values lower
7than 32.
8
9Previously, inserting a %00 sequence early in the directory part when
10using the 'singlecwd' ftp method could make curl write a zero byte
11outside of the allocated buffer.
12
13Test case 340 verifies.
14
15CVE-2018-1000120
16Upstream-Status: Backport [https://curl.haxx.se/CVE-2018-1000120.patch]
17
18Reported-by: Duy Phan Thanh
19Bug: https://curl.haxx.se/docs/adv_2018-9cd6.html
20
21Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
22---
23 lib/ftp.c | 6 +++---
24 tests/data/Makefile.inc | 1 +
25 tests/data/test340 | 40 ++++++++++++++++++++++++++++++++++++++++
26 3 files changed, 44 insertions(+), 3 deletions(-)
27 create mode 100644 tests/data/test340
28
29diff --git a/lib/ftp.c b/lib/ftp.c
30index cab3699..0e28059 100644
31--- a/lib/ftp.c
32+++ b/lib/ftp.c
33@@ -3236,7 +3236,7 @@ static CURLcode ftp_done(struct connectdata *conn, CURLcode status,
34
35 if(!result)
36 /* get the "raw" path */
37- result = Curl_urldecode(data, path_to_use, 0, &path, NULL, FALSE);
38+ result = Curl_urldecode(data, path_to_use, 0, &path, NULL, TRUE);
39 if(result) {
40 /* We can limp along anyway (and should try to since we may already be in
41 * the error path) */
42@@ -4242,7 +4242,7 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
43 result = Curl_urldecode(conn->data, slash_pos ? cur_pos : "/",
44 slash_pos ? dirlen : 1,
45 &ftpc->dirs[0], NULL,
46- FALSE);
47+ TRUE);
48 if(result) {
49 freedirs(ftpc);
50 return result;
51@@ -4350,7 +4350,7 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
52 size_t dlen;
53 char *path;
54 CURLcode result =
55- Curl_urldecode(conn->data, data->state.path, 0, &path, &dlen, FALSE);
56+ Curl_urldecode(conn->data, data->state.path, 0, &path, &dlen, TRUE);
57 if(result) {
58 freedirs(ftpc);
59 return result;
60diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
61index 135ba06..31e026f 100644
62--- a/tests/data/Makefile.inc
63+++ b/tests/data/Makefile.inc
64@@ -57,6 +57,7 @@ test298 test299 test300 test301 test302 test303 test304 test305 test306 \
65 test307 test308 test309 test310 test311 test312 test313 \
66 test320 test321 test322 test323 test324 \
67 test325 \
68+test340 \
69 test350 test351 test352 test353 test354 \
70 \
71 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
72diff --git a/tests/data/test340 b/tests/data/test340
73new file mode 100644
74index 0000000..d834d76
75--- /dev/null
76+++ b/tests/data/test340
77@@ -0,0 +1,40 @@
78+<testcase>
79+<info>
80+<keywords>
81+FTP
82+PASV
83+CWD
84+--ftp-method
85+singlecwd
86+</keywords>
87+</info>
88+#
89+# Server-side
90+<reply>
91+</reply>
92+
93+# Client-side
94+<client>
95+<server>
96+ftp
97+</server>
98+ <name>
99+FTP using %00 in path with singlecwd
100+ </name>
101+ <command>
102+--ftp-method singlecwd ftp://%HOSTIP:%FTPPORT/%00first/second/third/340
103+</command>
104+</client>
105+
106+# Verify data after the test has been "shot"
107+<verify>
108+<protocol>
109+USER anonymous
110+PASS ftp@example.com
111+PWD
112+</protocol>
113+<errorcode>
114+3
115+</errorcode>
116+</verify>
117+</testcase>
118
119
diff --git a/recipes-support/curl/curl/CVE-2018-1000121-openldap-check-ldap_get_attribute_ber-results-for-NU.patch b/recipes-support/curl/curl/CVE-2018-1000121-openldap-check-ldap_get_attribute_ber-results-for-NU.patch
new file mode 100644
index 0000000..488d457
--- /dev/null
+++ b/recipes-support/curl/curl/CVE-2018-1000121-openldap-check-ldap_get_attribute_ber-results-for-NU.patch
@@ -0,0 +1,47 @@
1From 9889db043393092e9d4b5a42720bba0b3d58deba Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Tue, 6 Mar 2018 23:02:16 +0100
4Subject: [PATCH] openldap: check ldap_get_attribute_ber() results for NULL
5 before using
6
7CVE-2018-1000121
8Reported-by: Dario Weisser
9Bug: https://curl.haxx.se/docs/adv_2018-97a2.html
10
11CVE: CVE-2018-1000121
12Upstream-Status: Backport [https://curl.haxx.se/CVE-2018-1000121.patch]
13
14Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
15---
16 lib/openldap.c | 8 ++++----
17 1 file changed, 4 insertions(+), 4 deletions(-)
18
19diff --git a/lib/openldap.c b/lib/openldap.c
20index f2ffdfe..6927275 100644
21--- a/lib/openldap.c
22+++ b/lib/openldap.c
23@@ -473,7 +473,7 @@ static ssize_t ldap_recv(struct connectdata *conn, int sockindex, char *buf,
24
25 for(ent = ldap_first_message(li->ld, msg); ent;
26 ent = ldap_next_message(li->ld, ent)) {
27- struct berval bv, *bvals, **bvp = &bvals;
28+ struct berval bv, *bvals;
29 int binary = 0, msgtype;
30 CURLcode writeerr;
31
32@@ -535,9 +535,9 @@ static ssize_t ldap_recv(struct connectdata *conn, int sockindex, char *buf,
33 }
34 data->req.bytecount += bv.bv_len + 5;
35
36- for(rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, bvp);
37- rc == LDAP_SUCCESS;
38- rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, bvp)) {
39+ for(rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, &bvals);
40+ (rc == LDAP_SUCCESS) && bvals;
41+ rc = ldap_get_attribute_ber(li->ld, ent, ber, &bv, &bvals)) {
42 int i;
43
44 if(bv.bv_val == NULL) break;
45--
462.7.4
47
diff --git a/recipes-support/curl/curl/CVE-2018-1000122-readwrite-make-sure-excess-reads-don-t-go-beyond-buf.patch b/recipes-support/curl/curl/CVE-2018-1000122-readwrite-make-sure-excess-reads-don-t-go-beyond-buf.patch
new file mode 100644
index 0000000..488d2fb
--- /dev/null
+++ b/recipes-support/curl/curl/CVE-2018-1000122-readwrite-make-sure-excess-reads-don-t-go-beyond-buf.patch
@@ -0,0 +1,43 @@
1From d52dc4760f6d9ca1937eefa2093058a952465128 Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Thu, 8 Mar 2018 10:33:16 +0100
4Subject: [PATCH] readwrite: make sure excess reads don't go beyond buffer end
5
6CVE-2018-1000122
7Bug: https://curl.haxx.se/docs/adv_2018-b047.html
8
9Detected by OSS-fuzz
10
11CVE: CVE-2018-1000122
12Upstream-Status: Backport [https://curl.haxx.se/CVE-2018-1000122.patch]
13
14Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
15---
16 lib/transfer.c | 9 +++++++--
17 1 file changed, 7 insertions(+), 2 deletions(-)
18
19diff --git a/lib/transfer.c b/lib/transfer.c
20index c46ac25..fd9af31 100644
21--- a/lib/transfer.c
22+++ b/lib/transfer.c
23@@ -808,10 +808,15 @@ static CURLcode readwrite_data(struct Curl_easy *data,
24
25 } /* if(!header and data to read) */
26
27- if(conn->handler->readwrite &&
28- (excess > 0 && !conn->bits.stream_was_rewound)) {
29+ if(conn->handler->readwrite && excess && !conn->bits.stream_was_rewound) {
30 /* Parse the excess data */
31 k->str += nread;
32+
33+ if(&k->str[excess] > &k->buf[data->set.buffer_size]) {
34+ /* the excess amount was too excessive(!), make sure
35+ it doesn't read out of buffer */
36+ excess = &k->buf[data->set.buffer_size] - k->str;
37+ }
38 nread = (ssize_t)excess;
39
40 result = conn->handler->readwrite(data, conn, &nread, &readmore);
41--
422.7.4
43
diff --git a/recipes-support/curl/curl/CVE-2018-1000301-http-restore-buffer-pointer-when-bad-response-line-i.patch b/recipes-support/curl/curl/CVE-2018-1000301-http-restore-buffer-pointer-when-bad-response-line-i.patch
new file mode 100644
index 0000000..cf5a596
--- /dev/null
+++ b/recipes-support/curl/curl/CVE-2018-1000301-http-restore-buffer-pointer-when-bad-response-line-i.patch
@@ -0,0 +1,48 @@
1From 8c7b3737d29ed5c0575bf592063de8a51450812d Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Sat, 24 Mar 2018 23:47:41 +0100
4Subject: [PATCH] http: restore buffer pointer when bad response-line is parsed
5
6... leaving the k->str could lead to buffer over-reads later on.
7
8Assisted-by: Max Dymond
9
10Detected by OSS-Fuzz.
11Bug: https://curl.haxx.se/docs/adv_2018-b138.html
12Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105
13
14CVE: CVE-2018-1000301
15Upstream-Status: Backport [https://curl.haxx.se/CVE-2018-1000301.patch]
16
17Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
18---
19 lib/http.c | 6 +++++-
20 1 file changed, 5 insertions(+), 1 deletion(-)
21
22diff --git a/lib/http.c b/lib/http.c
23index 1a313b4..e080ae5 100644
24--- a/lib/http.c
25+++ b/lib/http.c
26@@ -3014,6 +3014,8 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
27 {
28 CURLcode result;
29 struct SingleRequest *k = &data->req;
30+ ssize_t onread = *nread;
31+ char *ostr = k->str;
32
33 /* header line within buffer loop */
34 do {
35@@ -3078,7 +3080,9 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
36 else {
37 /* this was all we read so it's all a bad header */
38 k->badheader = HEADER_ALLBAD;
39- *nread = (ssize_t)rest_length;
40+ *nread = onread;
41+ k->str = ostr;
42+ return CURLE_OK;
43 }
44 break;
45 }
46--
472.7.4
48
diff --git a/recipes-support/curl/curl_%.bbappend b/recipes-support/curl/curl_%.bbappend
deleted file mode 100644
index 3727bea..0000000
--- a/recipes-support/curl/curl_%.bbappend
+++ /dev/null
@@ -1,12 +0,0 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += "file://CVE-2017-7407.patch \
5 file://CVE-2017-7468.patch \
6 file://CVE-2017-9502.patch \
7 file://CVE-2017-1000254.patch \
8 file://CVE-2017-1000257.patch \
9 file://CVE-2017-8816.patch \
10 file://CVE-2017-8817.patch \
11 file://CVE-2018-1000005.patch \
12 "
diff --git a/recipes-support/curl/curl_7.53.1.bbappend b/recipes-support/curl/curl_7.53.1.bbappend
new file mode 100644
index 0000000..ad7241c
--- /dev/null
+++ b/recipes-support/curl/curl_7.53.1.bbappend
@@ -0,0 +1,17 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2017-7407.patch \
6 file://CVE-2017-7468.patch \
7 file://CVE-2017-9502.patch \
8 file://CVE-2017-1000254.patch \
9 file://CVE-2017-1000257.patch \
10 file://CVE-2017-8816.patch \
11 file://CVE-2017-8817.patch \
12 file://CVE-2018-1000005.patch \
13 file://CVE-2018-1000120-FTP-reject-path-components-with-control-codes.patch \
14 file://CVE-2018-1000301-http-restore-buffer-pointer-when-bad-response-line-i.patch \
15 file://CVE-2018-1000122-readwrite-make-sure-excess-reads-don-t-go-beyond-buf.patch \
16 file://CVE-2018-1000121-openldap-check-ldap_get_attribute_ber-results-for-NU.patch \
17 "
diff --git a/recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch b/recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch
new file mode 100644
index 0000000..520a52d
--- /dev/null
+++ b/recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch
@@ -0,0 +1,47 @@
1From 9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 Mon Sep 17 00:00:00 2001
2From: Ignacio Casal Quinteiro <qignacio@amazon.com>
3Date: Sun, 16 Apr 2017 13:56:09 +0200
4Subject: [PATCH] tknzr: support only max long rgb values
5
6This fixes a possible out of bound when reading rgbs which
7are longer than the support MAXLONG
8
9CVE: CVE-2017-7961
10Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libcroco/commit/9ad72875e9f08e4c519ef63d44cdbd94aa9504f7]
11
12Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
13---
14 src/cr-tknzr.c | 10 ++++++++++
15 1 file changed, 10 insertions(+)
16
17diff --git a/src/cr-tknzr.c b/src/cr-tknzr.c
18index 1a7cfeb..1548c35 100644
19--- a/src/cr-tknzr.c
20+++ b/src/cr-tknzr.c
21@@ -1279,6 +1279,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
22 status = cr_tknzr_parse_num (a_this, &num);
23 ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
24
25+ if (num->val > G_MAXLONG) {
26+ status = CR_PARSING_ERROR;
27+ goto error;
28+ }
29+
30 red = num->val;
31 cr_num_destroy (num);
32 num = NULL;
33@@ -1298,6 +1303,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
34 status = cr_tknzr_parse_num (a_this, &num);
35 ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
36
37+ if (num->val > G_MAXLONG) {
38+ status = CR_PARSING_ERROR;
39+ goto error;
40+ }
41+
42 PEEK_BYTE (a_this, 1, &next_bytes[0]);
43 if (next_bytes[0] == '%') {
44 SKIP_CHARS (a_this, 1);
45--
462.7.4
47
diff --git a/recipes-support/libcroco/libcroco_0.6.11.bbappend b/recipes-support/libcroco/libcroco_0.6.11.bbappend
new file mode 100644
index 0000000..c1b3b6c
--- /dev/null
+++ b/recipes-support/libcroco/libcroco_0.6.11.bbappend
@@ -0,0 +1,6 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += " \
5 file://CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch \
6 "
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-04-27 14:34:06 +0000