diff options
author | pgowda <pgowda.cve@gmail.com> | 2022-01-22 03:15:13 -0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-01-31 21:56:01 +0000 |
commit | c10a1449a57e0ba73e99be06af064e83fcaf85c1 (patch) | |
tree | c46cac2744a987b9e94d5c25563a52961e9a8eed | |
parent | 8e1796eef4e6aae3ad0673583d505c47a5563c2a (diff) | |
download | poky-c10a1449a57e0ba73e99be06af064e83fcaf85c1.tar.gz |
glibc: upgrade glibc-2.33 to latest version
glibc-2.33 has been upgraded to latest version that includes many CVE and
other bug fixes.
(From OE-Core rev: f658889952dcccbd2eea415764b3e89ac738cde9)
Signed-off-by: pgowda <pgowda.cve@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-core/glibc/glibc-version.inc | 2 | ||||
-rw-r--r-- | meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch | 182 | ||||
-rw-r--r-- | meta/recipes-core/glibc/glibc_2.33.bb | 1 |
3 files changed, 1 insertions, 184 deletions
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index 4d69187961..63241ee951 100644 --- a/meta/recipes-core/glibc/glibc-version.inc +++ b/meta/recipes-core/glibc/glibc-version.inc | |||
@@ -1,6 +1,6 @@ | |||
1 | SRCBRANCH ?= "release/2.33/master" | 1 | SRCBRANCH ?= "release/2.33/master" |
2 | PV = "2.33" | 2 | PV = "2.33" |
3 | SRCREV_glibc ?= "6090cf1330faf2deb17285758f327cb23b89ebf1" | 3 | SRCREV_glibc ?= "55b99e9ed07688019609bd4dcd17d3ebf4572948" |
4 | SRCREV_localedef ?= "bd644c9e6f3e20c5504da1488448173c69c56c28" | 4 | SRCREV_localedef ?= "bd644c9e6f3e20c5504da1488448173c69c56c28" |
5 | 5 | ||
6 | GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git" | 6 | GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git" |
diff --git a/meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch b/meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch deleted file mode 100644 index 72fd68b302..0000000000 --- a/meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch +++ /dev/null | |||
@@ -1,182 +0,0 @@ | |||
1 | From ff012870b2c02a62598c04daa1e54632e020fd7d Mon Sep 17 00:00:00 2001 | ||
2 | From: Nikita Popov <npv1310@gmail.com> | ||
3 | Date: Tue, 2 Nov 2021 13:21:42 +0500 | ||
4 | Subject: [PATCH] gconv: Do not emit spurious NUL character in ISO-2022-JP-3 | ||
5 | (bug 28524) | ||
6 | |||
7 | Bugfix 27256 has introduced another issue: | ||
8 | In conversion from ISO-2022-JP-3 encoding, it is possible | ||
9 | to force iconv to emit extra NUL character on internal state reset. | ||
10 | To do this, it is sufficient to feed iconv with escape sequence | ||
11 | which switches active character set. | ||
12 | The simplified check 'data->__statep->__count != ASCII_set' | ||
13 | introduced by the aforementioned bugfix picks that case and | ||
14 | behaves as if '\0' character has been queued thus emitting it. | ||
15 | |||
16 | To eliminate this issue, these steps are taken: | ||
17 | * Restore original condition | ||
18 | '(data->__statep->__count & ~7) != ASCII_set'. | ||
19 | It is necessary since bits 0-2 may contain | ||
20 | number of buffered input characters. | ||
21 | * Check that queued character is not NUL. | ||
22 | Similar step is taken for main conversion loop. | ||
23 | |||
24 | Bundled test case follows following logic: | ||
25 | * Try to convert ISO-2022-JP-3 escape sequence | ||
26 | switching active character set | ||
27 | * Reset internal state by providing NULL as input buffer | ||
28 | * Ensure that nothing has been converted. | ||
29 | |||
30 | Signed-off-by: Nikita Popov <npv1310@gmail.com> | ||
31 | |||
32 | CVE: CVE-2021-43396 | ||
33 | Upstream-Status: Backport [ff012870b2c02a62598c04daa1e54632e020fd7d] | ||
34 | --- | ||
35 | iconvdata/Makefile | 5 +++- | ||
36 | iconvdata/bug-iconv15.c | 60 +++++++++++++++++++++++++++++++++++++++ | ||
37 | iconvdata/iso-2022-jp-3.c | 28 ++++++++++++------ | ||
38 | 3 files changed, 84 insertions(+), 9 deletions(-) | ||
39 | create mode 100644 iconvdata/bug-iconv15.c | ||
40 | |||
41 | diff --git a/iconvdata/bug-iconv15.c b/iconvdata/bug-iconv15.c | ||
42 | new file mode 100644 | ||
43 | --- /dev/null | ||
44 | +++ b/iconvdata/bug-iconv15.c | ||
45 | @@ -0,0 +1,60 @@ | ||
46 | +/* Bug 28524: Conversion from ISO-2022-JP-3 with iconv | ||
47 | + may emit spurious NUL character on state reset. | ||
48 | + Copyright (C) The GNU Toolchain Authors. | ||
49 | + This file is part of the GNU C Library. | ||
50 | + | ||
51 | + The GNU C Library is free software; you can redistribute it and/or | ||
52 | + modify it under the terms of the GNU Lesser General Public | ||
53 | + License as published by the Free Software Foundation; either | ||
54 | + version 2.1 of the License, or (at your option) any later version. | ||
55 | + | ||
56 | + The GNU C Library is distributed in the hope that it will be useful, | ||
57 | + but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
58 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
59 | + Lesser General Public License for more details. | ||
60 | + | ||
61 | + You should have received a copy of the GNU Lesser General Public | ||
62 | + License along with the GNU C Library; if not, see | ||
63 | + <https://www.gnu.org/licenses/>. */ | ||
64 | + | ||
65 | +#include <stddef.h> | ||
66 | +#include <iconv.h> | ||
67 | +#include <support/check.h> | ||
68 | + | ||
69 | +static int | ||
70 | +do_test (void) | ||
71 | +{ | ||
72 | + char in[] = "\x1b(I"; | ||
73 | + char *inbuf = in; | ||
74 | + size_t inleft = sizeof (in) - 1; | ||
75 | + char out[1]; | ||
76 | + char *outbuf = out; | ||
77 | + size_t outleft = sizeof (out); | ||
78 | + iconv_t cd; | ||
79 | + | ||
80 | + cd = iconv_open ("UTF8", "ISO-2022-JP-3"); | ||
81 | + TEST_VERIFY_EXIT (cd != (iconv_t) -1); | ||
82 | + | ||
83 | + /* First call to iconv should alter internal state. | ||
84 | + Now, JISX0201_Kana_set is selected and | ||
85 | + state value != ASCII_set. */ | ||
86 | + TEST_VERIFY (iconv (cd, &inbuf, &inleft, &outbuf, &outleft) != (size_t) -1); | ||
87 | + | ||
88 | + /* No bytes should have been added to | ||
89 | + the output buffer at this point. */ | ||
90 | + TEST_VERIFY (outbuf == out); | ||
91 | + TEST_VERIFY (outleft == sizeof (out)); | ||
92 | + | ||
93 | + /* Second call shall emit spurious NUL character in unpatched glibc. */ | ||
94 | + TEST_VERIFY (iconv (cd, NULL, NULL, &outbuf, &outleft) != (size_t) -1); | ||
95 | + | ||
96 | + /* No characters are expected to be produced. */ | ||
97 | + TEST_VERIFY (outbuf == out); | ||
98 | + TEST_VERIFY (outleft == sizeof (out)); | ||
99 | + | ||
100 | + TEST_VERIFY_EXIT (iconv_close (cd) != -1); | ||
101 | + | ||
102 | + return 0; | ||
103 | +} | ||
104 | + | ||
105 | +#include <support/test-driver.c> | ||
106 | diff --git a/iconvdata/iso-2022-jp-3.c b/iconvdata/iso-2022-jp-3.c | ||
107 | --- a/iconvdata/iso-2022-jp-3.c | ||
108 | +++ b/iconvdata/iso-2022-jp-3.c | ||
109 | @@ -1,5 +1,6 @@ | ||
110 | /* Conversion module for ISO-2022-JP-3. | ||
111 | Copyright (C) 1998-2021 Free Software Foundation, Inc. | ||
112 | + Copyright (C) The GNU Toolchain Authors. | ||
113 | This file is part of the GNU C Library. | ||
114 | Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998, | ||
115 | and Bruno Haible <bruno@clisp.org>, 2002. | ||
116 | @@ -81,20 +82,31 @@ enum | ||
117 | the output state to the initial state. This has to be done during the | ||
118 | flushing. */ | ||
119 | #define EMIT_SHIFT_TO_INIT \ | ||
120 | - if (data->__statep->__count != ASCII_set) \ | ||
121 | + if ((data->__statep->__count & ~7) != ASCII_set) \ | ||
122 | { \ | ||
123 | if (FROM_DIRECTION) \ | ||
124 | { \ | ||
125 | - if (__glibc_likely (outbuf + 4 <= outend)) \ | ||
126 | + uint32_t ch = data->__statep->__count >> 6; \ | ||
127 | + \ | ||
128 | + if (__glibc_unlikely (ch != 0)) \ | ||
129 | { \ | ||
130 | - /* Write out the last character. */ \ | ||
131 | - *((uint32_t *) outbuf) = data->__statep->__count >> 6; \ | ||
132 | - outbuf += sizeof (uint32_t); \ | ||
133 | - data->__statep->__count = ASCII_set; \ | ||
134 | + if (__glibc_likely (outbuf + 4 <= outend)) \ | ||
135 | + { \ | ||
136 | + /* Write out the last character. */ \ | ||
137 | + put32u (outbuf, ch); \ | ||
138 | + outbuf += 4; \ | ||
139 | + data->__statep->__count &= 7; \ | ||
140 | + data->__statep->__count |= ASCII_set; \ | ||
141 | + } \ | ||
142 | + else \ | ||
143 | + /* We don't have enough room in the output buffer. */ \ | ||
144 | + status = __GCONV_FULL_OUTPUT; \ | ||
145 | } \ | ||
146 | else \ | ||
147 | - /* We don't have enough room in the output buffer. */ \ | ||
148 | - status = __GCONV_FULL_OUTPUT; \ | ||
149 | + { \ | ||
150 | + data->__statep->__count &= 7; \ | ||
151 | + data->__statep->__count |= ASCII_set; \ | ||
152 | + } \ | ||
153 | } \ | ||
154 | else \ | ||
155 | { \ | ||
156 | diff --git a/iconvdata/Makefile b/iconvdata/Makefile | ||
157 | --- a/iconvdata/Makefile | ||
158 | +++ b/iconvdata/Makefile | ||
159 | @@ -1,4 +1,5 @@ | ||
160 | # Copyright (C) 1997-2021 Free Software Foundation, Inc. | ||
161 | +# Copyright (C) The GNU Toolchain Authors. | ||
162 | # This file is part of the GNU C Library. | ||
163 | |||
164 | # The GNU C Library is free software; you can redistribute it and/or | ||
165 | @@ -74,7 +75,7 @@ ifeq (yes,$(build-shared)) | ||
166 | tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \ | ||
167 | tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \ | ||
168 | bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \ | ||
169 | - bug-iconv13 bug-iconv14 | ||
170 | + bug-iconv13 bug-iconv14 bug-iconv15 | ||
171 | ifeq ($(have-thread-library),yes) | ||
172 | tests += bug-iconv3 | ||
173 | endif | ||
174 | @@ -324,6 +325,8 @@ $(objpfx)bug-iconv12.out: $(objpfx)gconv | ||
175 | $(addprefix $(objpfx),$(modules.so)) | ||
176 | $(objpfx)bug-iconv14.out: $(objpfx)gconv-modules \ | ||
177 | $(addprefix $(objpfx),$(modules.so)) | ||
178 | +$(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \ | ||
179 | + $(addprefix $(objpfx),$(modules.so)) | ||
180 | |||
181 | $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \ | ||
182 | $(addprefix $(objpfx),$(modules.so)) \ | ||
diff --git a/meta/recipes-core/glibc/glibc_2.33.bb b/meta/recipes-core/glibc/glibc_2.33.bb index b7736359b1..a1e9eb3a16 100644 --- a/meta/recipes-core/glibc/glibc_2.33.bb +++ b/meta/recipes-core/glibc/glibc_2.33.bb | |||
@@ -56,7 +56,6 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ | |||
56 | file://0028-readlib-Add-OECORE_KNOWN_INTERPRETER_NAMES-to-known-.patch \ | 56 | file://0028-readlib-Add-OECORE_KNOWN_INTERPRETER_NAMES-to-known-.patch \ |
57 | file://0029-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch \ | 57 | file://0029-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch \ |
58 | file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \ | 58 | file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \ |
59 | file://0031-CVE-2021-43396.patch \ | ||
60 | " | 59 | " |
61 | S = "${WORKDIR}/git" | 60 | S = "${WORKDIR}/git" |
62 | B = "${WORKDIR}/build-${TARGET_SYS}" | 61 | B = "${WORKDIR}/build-${TARGET_SYS}" |