summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
Diffstat (limited to 'meta')
-rw-r--r--meta/classes/cve-check.bbclass181
-rw-r--r--meta/classes/populate_sdk_ext.bbclass6
-rw-r--r--meta/conf/distro/include/maintainers.inc2
-rw-r--r--meta/conf/distro/include/yocto-uninative.inc10
-rw-r--r--meta/files/toolchain-shar-extract.sh11
-rw-r--r--meta/lib/oe/sdk.py4
-rw-r--r--meta/lib/oe/utils.py2
-rw-r--r--meta/lib/oeqa/core/utils/concurrencytest.py2
-rw-r--r--meta/lib/oeqa/sdkext/testsdk.py7
-rw-r--r--meta/lib/oeqa/selftest/cases/signing.py4
-rw-r--r--meta/recipes-core/glibc/glibc-locale.inc3
-rw-r--r--meta/recipes-core/glibc/glibc-mtrace.inc3
-rw-r--r--meta/recipes-core/glibc/glibc-scripts.inc3
-rw-r--r--meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Make-relocatable-install-for-locales.patch33
-rw-r--r--meta/recipes-core/glibc/glibc/CVE-2016-10739.patch910
-rw-r--r--meta/recipes-core/meta/buildtools-extended-tarball.bb36
-rw-r--r--meta/recipes-core/meta/buildtools-tarball.bb6
-rw-r--r--meta/recipes-core/meta/cve-update-db-native.bb190
-rw-r--r--meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb3
-rw-r--r--meta/recipes-devtools/binutils/binutils/nativesdk-relocation.patch80
-rw-r--r--meta/recipes-devtools/binutils/binutils_2.31.bb5
-rw-r--r--meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb62
-rw-r--r--meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch50
-rw-r--r--meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch215
-rw-r--r--meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch135
-rw-r--r--meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch52
-rw-r--r--meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch51
-rw-r--r--meta/recipes-devtools/python/python3-testtools/no_traceback2.patch23
-rw-r--r--meta/recipes-devtools/python/python3-testtools_2.3.0.bb2
-rw-r--r--meta/recipes-devtools/python/python3/0001-main.c-if-OEPYTHON3HOME-is-set-use-instead-of-PYTHON.patch35
-rw-r--r--meta/recipes-devtools/python/python3_3.5.6.bb6
-rw-r--r--meta/recipes-devtools/qemu/qemu/0011-linux-user-remove-host-stime-syscall.patch62
-rw-r--r--meta/recipes-devtools/qemu/qemu_3.0.0.bb1
-rw-r--r--meta/recipes-extended/sudo/sudo/CVE-2019-14287_p1.patch170
-rw-r--r--meta/recipes-extended/sudo/sudo/CVE-2019-14287_p2.patch98
-rw-r--r--meta/recipes-extended/sudo/sudo_1.8.23.bb2
-rw-r--r--meta/recipes-extended/tar/tar/CVE-2018-20482.patch405
-rw-r--r--meta/recipes-extended/tar/tar_1.30.bb1
-rw-r--r--meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb6
-rw-r--r--meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb6
-rw-r--r--meta/recipes-kernel/linux/linux-yocto_4.14.bb20
-rw-r--r--meta/recipes-support/atk/at-spi2-core_2.28.0.bb2
-rw-r--r--meta/recipes-support/attr/attr_2.4.47.bb3
-rw-r--r--meta/recipes-support/iso-codes/iso-codes_4.1.bb2
-rw-r--r--meta/recipes-support/libgcrypt/files/CVE-2019-12904_p1.patch176
-rw-r--r--meta/recipes-support/libgcrypt/files/CVE-2019-12904_p2.patch330
-rw-r--r--meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb2
47 files changed, 2729 insertions, 689 deletions
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 743bc08a4f..19ed5548b3 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -26,7 +26,7 @@ CVE_PRODUCT ??= "${BPN}"
26CVE_VERSION ??= "${PV}" 26CVE_VERSION ??= "${PV}"
27 27
28CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" 28CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK"
29CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvd.db" 29CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_1.0.db"
30 30
31CVE_CHECK_LOG ?= "${T}/cve.log" 31CVE_CHECK_LOG ?= "${T}/cve.log"
32CVE_CHECK_TMP_FILE ?= "${TMPDIR}/cve_check" 32CVE_CHECK_TMP_FILE ?= "${TMPDIR}/cve_check"
@@ -37,39 +37,39 @@ CVE_CHECK_COPY_FILES ??= "1"
37CVE_CHECK_CREATE_MANIFEST ??= "1" 37CVE_CHECK_CREATE_MANIFEST ??= "1"
38 38
39# Whitelist for packages (PN) 39# Whitelist for packages (PN)
40CVE_CHECK_PN_WHITELIST = "\ 40CVE_CHECK_PN_WHITELIST ?= ""
41 glibc-locale \
42"
43 41
44# Whitelist for CVE and version of package 42# Whitelist for CVE. If a CVE is found, then it is considered patched.
45CVE_CHECK_CVE_WHITELIST = "{\ 43# The value is a string containing space separated CVE values:
46 'CVE-2014-2524': ('6.3','5.2',), \ 44#
47}" 45# CVE_CHECK_WHITELIST = 'CVE-2014-2524 CVE-2018-1234'
46#
47CVE_CHECK_WHITELIST ?= ""
48 48
49python do_cve_check () { 49python do_cve_check () {
50 """ 50 """
51 Check recipe for patched and unpatched CVEs 51 Check recipe for patched and unpatched CVEs
52 """ 52 """
53 53
54 if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")): 54 if os.path.exists(d.getVar("CVE_CHECK_DB_FILE")):
55 patched_cves = get_patches_cves(d) 55 patched_cves = get_patches_cves(d)
56 patched, unpatched = check_cves(d, patched_cves) 56 patched, unpatched = check_cves(d, patched_cves)
57 if patched or unpatched: 57 if patched or unpatched:
58 cve_data = get_cve_info(d, patched + unpatched) 58 cve_data = get_cve_info(d, patched + unpatched)
59 cve_write_data(d, patched, unpatched, cve_data) 59 cve_write_data(d, patched, unpatched, cve_data)
60 else: 60 else:
61 bb.note("Failed to update CVE database, skipping CVE check") 61 bb.note("No CVE database found, skipping CVE check")
62
62} 63}
63 64
64addtask cve_check after do_unpack before do_build 65addtask cve_check before do_build
65do_cve_check[depends] = "cve-check-tool-native:do_populate_sysroot cve-check-tool-native:do_populate_cve_db" 66do_cve_check[depends] = "cve-update-db-native:do_populate_cve_db"
66do_cve_check[nostamp] = "1" 67do_cve_check[nostamp] = "1"
67 68
68python cve_check_cleanup () { 69python cve_check_cleanup () {
69 """ 70 """
70 Delete the file used to gather all the CVE information. 71 Delete the file used to gather all the CVE information.
71 """ 72 """
72
73 bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE")) 73 bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE"))
74} 74}
75 75
@@ -163,89 +163,121 @@ def get_patches_cves(d):
163 163
164def check_cves(d, patched_cves): 164def check_cves(d, patched_cves):
165 """ 165 """
166 Run cve-check-tool looking for patched and unpatched CVEs. 166 Connect to the NVD database and find unpatched cves.
167 """ 167 """
168 from distutils.version import LooseVersion
168 169
169 import ast, csv, tempfile, subprocess, io
170
171 cves_patched = []
172 cves_unpatched = [] 170 cves_unpatched = []
173 bpn = d.getVar("CVE_PRODUCT") 171 # CVE_PRODUCT can contain more than one product (eg. curl/libcurl)
172 products = d.getVar("CVE_PRODUCT").split()
174 # If this has been unset then we're not scanning for CVEs here (for example, image recipes) 173 # If this has been unset then we're not scanning for CVEs here (for example, image recipes)
175 if not bpn: 174 if not products:
176 return ([], []) 175 return ([], [])
177 pv = d.getVar("CVE_VERSION").split("+git")[0] 176 pv = d.getVar("CVE_VERSION").split("+git")[0]
178 cves = " ".join(patched_cves)
179 cve_db_dir = d.getVar("CVE_CHECK_DB_DIR")
180 cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST"))
181 cve_cmd = "cve-check-tool"
182 cmd = [cve_cmd, "--no-html", "--skip-update", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir]
183 177
184 # If the recipe has been whitlisted we return empty lists 178 # If the recipe has been whitlisted we return empty lists
185 if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split(): 179 if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split():
186 bb.note("Recipe has been whitelisted, skipping check") 180 bb.note("Recipe has been whitelisted, skipping check")
187 return ([], []) 181 return ([], [])
188 182
189 try: 183 old_cve_whitelist = d.getVar("CVE_CHECK_CVE_WHITELIST")
190 # Write the faux CSV file to be used with cve-check-tool 184 if old_cve_whitelist:
191 fd, faux = tempfile.mkstemp(prefix="cve-faux-") 185 bb.warn("CVE_CHECK_CVE_WHITELIST is deprecated, please use CVE_CHECK_WHITELIST.")
192 with os.fdopen(fd, "w") as f: 186 cve_whitelist = d.getVar("CVE_CHECK_WHITELIST").split()
193 for pn in bpn.split(): 187
194 f.write("%s,%s,%s,\n" % (pn, pv, cves)) 188 import sqlite3
195 cmd.append(faux) 189 db_file = d.expand("file:${CVE_CHECK_DB_FILE}?mode=ro")
196 190 conn = sqlite3.connect(db_file, uri=True)
197 output = subprocess.check_output(cmd).decode("utf-8") 191
198 bb.debug(2, "Output of command %s:\n%s" % ("\n".join(cmd), output)) 192 # For each of the known product names (e.g. curl has CPEs using curl and libcurl)...
199 except subprocess.CalledProcessError as e: 193 for product in products:
200 bb.warn("Couldn't check for CVEs: %s (output %s)" % (e, e.output)) 194 if ":" in product:
201 finally: 195 vendor, product = product.split(":", 1)
202 os.remove(faux) 196 else:
203 197 vendor = "%"
204 for row in csv.reader(io.StringIO(output)): 198
205 # Third row has the unpatched CVEs 199 # Find all relevant CVE IDs.
206 if row[2]: 200 for cverow in conn.execute("SELECT DISTINCT ID FROM PRODUCTS WHERE PRODUCT IS ? AND VENDOR LIKE ?", (product, vendor)):
207 for cve in row[2].split(): 201 cve = cverow[0]
208 # Skip if the CVE has been whitlisted for the current version 202
209 if pv in cve_whitelist.get(cve,[]): 203 if cve in cve_whitelist:
210 bb.note("%s-%s has been whitelisted for %s" % (bpn, pv, cve)) 204 bb.note("%s-%s has been whitelisted for %s" % (product, pv, cve))
205 # TODO: this should be in the report as 'whitelisted'
206 patched_cves.add(cve)
207 continue
208 elif cve in patched_cves:
209 bb.note("%s has been patched" % (cve))
210 continue
211
212 vulnerable = False
213 for row in conn.execute("SELECT * FROM PRODUCTS WHERE ID IS ? AND PRODUCT IS ? AND VENDOR LIKE ?", (cve, product, vendor)):
214 (_, _, _, version_start, operator_start, version_end, operator_end) = row
215 #bb.debug(2, "Evaluating row " + str(row))
216
217 if (operator_start == '=' and pv == version_start):
218 vulnerable = True
211 else: 219 else:
220 if operator_start:
221 try:
222 vulnerable_start = (operator_start == '>=' and LooseVersion(pv) >= LooseVersion(version_start))
223 vulnerable_start |= (operator_start == '>' and LooseVersion(pv) > LooseVersion(version_start))
224 except:
225 bb.warn("%s: Failed to compare %s %s %s for %s" %
226 (product, pv, operator_start, version_start, cve))
227 vulnerable_start = False
228 else:
229 vulnerable_start = False
230
231 if operator_end:
232 try:
233 vulnerable_end = (operator_end == '<=' and LooseVersion(pv) <= LooseVersion(version_end))
234 vulnerable_end |= (operator_end == '<' and LooseVersion(pv) < LooseVersion(version_end))
235 except:
236 bb.warn("%s: Failed to compare %s %s %s for %s" %
237 (product, pv, operator_end, version_end, cve))
238 vulnerable_end = False
239 else:
240 vulnerable_end = False
241
242 if operator_start and operator_end:
243 vulnerable = vulnerable_start and vulnerable_end
244 else:
245 vulnerable = vulnerable_start or vulnerable_end
246
247 if vulnerable:
248 bb.note("%s-%s is vulnerable to %s" % (product, pv, cve))
212 cves_unpatched.append(cve) 249 cves_unpatched.append(cve)
213 bb.debug(2, "%s-%s is not patched for %s" % (bpn, pv, cve)) 250 break
214 # Fourth row has patched CVEs 251
215 if row[3]: 252 if not vulnerable:
216 for cve in row[3].split(): 253 bb.note("%s-%s is not vulnerable to %s" % (product, pv, cve))
217 cves_patched.append(cve) 254 # TODO: not patched but not vulnerable
218 bb.debug(2, "%s-%s is patched for %s" % (bpn, pv, cve)) 255 patched_cves.add(cve)
256
257 conn.close()
219 258
220 return (cves_patched, cves_unpatched) 259 return (list(patched_cves), cves_unpatched)
221 260
222def get_cve_info(d, cves): 261def get_cve_info(d, cves):
223 """ 262 """
224 Get CVE information from the database used by cve-check-tool. 263 Get CVE information from the database.
225
226 Unfortunately the only way to get CVE info is set the output to
227 html (hard to parse) or query directly the database.
228 """ 264 """
229 265
230 try: 266 import sqlite3
231 import sqlite3
232 except ImportError:
233 from pysqlite2 import dbapi2 as sqlite3
234 267
235 cve_data = {} 268 cve_data = {}
236 db_file = d.getVar("CVE_CHECK_DB_FILE") 269 conn = sqlite3.connect(d.getVar("CVE_CHECK_DB_FILE"))
237 placeholder = ",".join("?" * len(cves))
238 query = "SELECT * FROM NVD WHERE id IN (%s)" % placeholder
239 conn = sqlite3.connect(db_file)
240 cur = conn.cursor()
241 for row in cur.execute(query, tuple(cves)):
242 cve_data[row[0]] = {}
243 cve_data[row[0]]["summary"] = row[1]
244 cve_data[row[0]]["score"] = row[2]
245 cve_data[row[0]]["modified"] = row[3]
246 cve_data[row[0]]["vector"] = row[4]
247 conn.close()
248 270
271 for cve in cves:
272 for row in conn.execute("SELECT * FROM NVD WHERE ID IS ?", (cve,)):
273 cve_data[row[0]] = {}
274 cve_data[row[0]]["summary"] = row[1]
275 cve_data[row[0]]["scorev2"] = row[2]
276 cve_data[row[0]]["scorev3"] = row[3]
277 cve_data[row[0]]["modified"] = row[4]
278 cve_data[row[0]]["vector"] = row[5]
279
280 conn.close()
249 return cve_data 281 return cve_data
250 282
251def cve_write_data(d, patched, unpatched, cve_data): 283def cve_write_data(d, patched, unpatched, cve_data):
@@ -270,7 +302,8 @@ def cve_write_data(d, patched, unpatched, cve_data):
270 unpatched_cves.append(cve) 302 unpatched_cves.append(cve)
271 write_string += "CVE STATUS: Unpatched\n" 303 write_string += "CVE STATUS: Unpatched\n"
272 write_string += "CVE SUMMARY: %s\n" % cve_data[cve]["summary"] 304 write_string += "CVE SUMMARY: %s\n" % cve_data[cve]["summary"]
273 write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["score"] 305 write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["scorev2"]
306 write_string += "CVSS v3 BASE SCORE: %s\n" % cve_data[cve]["scorev3"]
274 write_string += "VECTOR: %s\n" % cve_data[cve]["vector"] 307 write_string += "VECTOR: %s\n" % cve_data[cve]["vector"]
275 write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve) 308 write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve)
276 309
diff --git a/meta/classes/populate_sdk_ext.bbclass b/meta/classes/populate_sdk_ext.bbclass
index 40b0375e0b..9bab54c6bd 100644
--- a/meta/classes/populate_sdk_ext.bbclass
+++ b/meta/classes/populate_sdk_ext.bbclass
@@ -574,8 +574,8 @@ sdk_ext_preinst() {
574 exit 1 574 exit 1
575 fi 575 fi
576 # The relocation script used by buildtools installer requires python 576 # The relocation script used by buildtools installer requires python
577 if ! command -v python > /dev/null; then 577 if ! command -v python3 > /dev/null; then
578 echo "ERROR: The installer requires python, please install it first" 578 echo "ERROR: The installer requires python3, please install it first"
579 exit 1 579 exit 1
580 fi 580 fi
581 missing_utils="" 581 missing_utils=""
@@ -634,7 +634,7 @@ sdk_ext_postinst() {
634 # current working directory when first ran, nor will it set $1 when 634 # current working directory when first ran, nor will it set $1 when
635 # sourcing a script. That is why this has to look so ugly. 635 # sourcing a script. That is why this has to look so ugly.
636 LOGFILE="$target_sdk_dir/preparing_build_system.log" 636 LOGFILE="$target_sdk_dir/preparing_build_system.log"
637 sh -c ". buildtools/environment-setup* > $LOGFILE && cd $target_sdk_dir/`dirname ${oe_init_build_env_path}` && set $target_sdk_dir && . $target_sdk_dir/${oe_init_build_env_path} $target_sdk_dir >> $LOGFILE && python $target_sdk_dir/ext-sdk-prepare.py $LOGFILE '${SDK_INSTALL_TARGETS}'" || { echo "printf 'ERROR: this SDK was not fully installed and needs reinstalling\n'" >> $env_setup_script ; exit 1 ; } 637 sh -c ". buildtools/environment-setup* > $LOGFILE && cd $target_sdk_dir/`dirname ${oe_init_build_env_path}` && set $target_sdk_dir && . $target_sdk_dir/${oe_init_build_env_path} $target_sdk_dir >> $LOGFILE && python3 $target_sdk_dir/ext-sdk-prepare.py $LOGFILE '${SDK_INSTALL_TARGETS}'" || { echo "printf 'ERROR: this SDK was not fully installed and needs reinstalling\n'" >> $env_setup_script ; exit 1 ; }
638 rm $target_sdk_dir/ext-sdk-prepare.py 638 rm $target_sdk_dir/ext-sdk-prepare.py
639 fi 639 fi
640 echo done 640 echo done
diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.inc
index 672f067792..8eb5e7a864 100644
--- a/meta/conf/distro/include/maintainers.inc
+++ b/meta/conf/distro/include/maintainers.inc
@@ -81,6 +81,7 @@ RECIPE_MAINTAINER_pn-build-appliance-image = "Richard Purdie <richard.purdie@lin
81RECIPE_MAINTAINER_pn-build-compare = "Paul Eggleton <paul.eggleton@linux.intel.com>" 81RECIPE_MAINTAINER_pn-build-compare = "Paul Eggleton <paul.eggleton@linux.intel.com>"
82RECIPE_MAINTAINER_pn-build-sysroots = "Richard Purdie <richard.purdie@linuxfoundation.org>" 82RECIPE_MAINTAINER_pn-build-sysroots = "Richard Purdie <richard.purdie@linuxfoundation.org>"
83RECIPE_MAINTAINER_pn-builder = "Richard Purdie <richard.purdie@linuxfoundation.org>" 83RECIPE_MAINTAINER_pn-builder = "Richard Purdie <richard.purdie@linuxfoundation.org>"
84RECIPE_MAINTAINER_pn-buildtools-extended-tarball = "Richard Purdie <richard.purdie@linuxfoundation.org>"
84RECIPE_MAINTAINER_pn-buildtools-tarball = "Richard Purdie <richard.purdie@linuxfoundation.org>" 85RECIPE_MAINTAINER_pn-buildtools-tarball = "Richard Purdie <richard.purdie@linuxfoundation.org>"
85RECIPE_MAINTAINER_pn-busybox = "Andrej Valek <andrej.valek@siemens.com>" 86RECIPE_MAINTAINER_pn-busybox = "Andrej Valek <andrej.valek@siemens.com>"
86RECIPE_MAINTAINER_pn-busybox-inittab = "Denys Dmytriyenko <denys@ti.com>" 87RECIPE_MAINTAINER_pn-busybox-inittab = "Denys Dmytriyenko <denys@ti.com>"
@@ -116,6 +117,7 @@ RECIPE_MAINTAINER_pn-cryptodev-tests = "Robert Yang <liezhi.yang@windriver.com>"
116RECIPE_MAINTAINER_pn-cups = "Chen Qi <Qi.Chen@windriver.com>" 117RECIPE_MAINTAINER_pn-cups = "Chen Qi <Qi.Chen@windriver.com>"
117RECIPE_MAINTAINER_pn-curl = "Armin Kuster <akuster808@gmail.com>" 118RECIPE_MAINTAINER_pn-curl = "Armin Kuster <akuster808@gmail.com>"
118RECIPE_MAINTAINER_pn-cve-check-tool = "Ross Burton <ross.burton@intel.com>" 119RECIPE_MAINTAINER_pn-cve-check-tool = "Ross Burton <ross.burton@intel.com>"
120RECIPE_MAINTAINER_pn-cve-update-db-native = "Ross Burton <ross.burton@intel.com>"
119RECIPE_MAINTAINER_pn-cwautomacros = "Ross Burton <ross.burton@intel.com>" 121RECIPE_MAINTAINER_pn-cwautomacros = "Ross Burton <ross.burton@intel.com>"
120RECIPE_MAINTAINER_pn-db = "Mark Hatle <mark.hatle@windriver.com>" 122RECIPE_MAINTAINER_pn-db = "Mark Hatle <mark.hatle@windriver.com>"
121RECIPE_MAINTAINER_pn-dbus = "Chen Qi <Qi.Chen@windriver.com>" 123RECIPE_MAINTAINER_pn-dbus = "Chen Qi <Qi.Chen@windriver.com>"
diff --git a/meta/conf/distro/include/yocto-uninative.inc b/meta/conf/distro/include/yocto-uninative.inc
index ad75d3e2a3..69b6edee5f 100644
--- a/meta/conf/distro/include/yocto-uninative.inc
+++ b/meta/conf/distro/include/yocto-uninative.inc
@@ -6,9 +6,9 @@
6# to the distro running on the build machine. 6# to the distro running on the build machine.
7# 7#
8 8
9UNINATIVE_MAXGLIBCVERSION = "2.30" 9UNINATIVE_MAXGLIBCVERSION = "2.32"
10 10
11UNINATIVE_URL ?= "http://downloads.yoctoproject.org/releases/uninative/2.7/" 11UNINATIVE_URL ?= "http://downloads.yoctoproject.org/releases/uninative/2.9/"
12UNINATIVE_CHECKSUM[aarch64] ?= "e76a45886ee8a0b3904b761c17ac8ff91edf9811ee455f1832d10763ba794dfc" 12UNINATIVE_CHECKSUM[aarch64] ?= "9f25a667aee225b1dd65c4aea73e01983e825b1cb9b56937932a1ee328b45f81"
13UNINATIVE_CHECKSUM[i686] ?= "810d027dfb1c7675226afbcec07808770516c969ee7378f6d8240281083f8924" 13UNINATIVE_CHECKSUM[i686] ?= "cae5d73245d95b07cf133b780ba3f6c8d0adca3ffc4e7e7fab999961d5e24d36"
14UNINATIVE_CHECKSUM[x86_64] ?= "9498d8bba047499999a7310ac2576d0796461184965351a56f6d32c888a1f216" 14UNINATIVE_CHECKSUM[x86_64] ?= "d07916b95c419c81541a19c8ef0ed8cbd78ae18437ff28a4c8a60ef40518e423"
diff --git a/meta/files/toolchain-shar-extract.sh b/meta/files/toolchain-shar-extract.sh
index 9eabd62630..6c4d14a038 100644
--- a/meta/files/toolchain-shar-extract.sh
+++ b/meta/files/toolchain-shar-extract.sh
@@ -1,13 +1,8 @@
1#!/bin/sh 1#!/bin/sh
2 2
3[ -z "$ENVCLEANED" ] && exec /usr/bin/env -i ENVCLEANED=1 HOME="$HOME" \ 3export LC_ALL=en_US.UTF-8
4 LC_ALL=en_US.UTF-8 \ 4# Remove invalid PATH elements first (maybe from a previously setup toolchain now deleted
5 TERM=$TERM \ 5PATH=`python3 -c 'import os; print(":".join(e for e in os.environ["PATH"].split(":") if os.path.exists(e)))'`
6 ICECC_PATH="$ICECC_PATH" \
7 http_proxy="$http_proxy" https_proxy="$https_proxy" ftp_proxy="$ftp_proxy" \
8 no_proxy="$no_proxy" all_proxy="$all_proxy" GIT_PROXY_COMMAND="$GIT_PROXY_COMMAND" "$0" "$@"
9[ -f /etc/environment ] && . /etc/environment
10export PATH=`echo "$PATH" | sed -e 's/:\.//' -e 's/::/:/'`
11 6
12tweakpath () { 7tweakpath () {
13 case ":${PATH}:" in 8 case ":${PATH}:" in
diff --git a/meta/lib/oe/sdk.py b/meta/lib/oe/sdk.py
index 153b07d76b..ef81f8cf60 100644
--- a/meta/lib/oe/sdk.py
+++ b/meta/lib/oe/sdk.py
@@ -84,10 +84,6 @@ class Sdk(object, metaclass=ABCMeta):
84 bb.warn("cannot remove SDK dir: %s" % path) 84 bb.warn("cannot remove SDK dir: %s" % path)
85 85
86 def install_locales(self, pm): 86 def install_locales(self, pm):
87 # This is only relevant for glibc
88 if self.d.getVar("TCLIBC") != "glibc":
89 return
90
91 linguas = self.d.getVar("SDKIMAGE_LINGUAS") 87 linguas = self.d.getVar("SDKIMAGE_LINGUAS")
92 if linguas: 88 if linguas:
93 import fnmatch 89 import fnmatch
diff --git a/meta/lib/oe/utils.py b/meta/lib/oe/utils.py
index 8a584d6ddd..96ebc36b8b 100644
--- a/meta/lib/oe/utils.py
+++ b/meta/lib/oe/utils.py
@@ -370,7 +370,7 @@ def host_gcc_version(d, taskcontextonly=False):
370 except subprocess.CalledProcessError as e: 370 except subprocess.CalledProcessError as e:
371 bb.fatal("Error running %s --version: %s" % (compiler, e.output.decode("utf-8"))) 371 bb.fatal("Error running %s --version: %s" % (compiler, e.output.decode("utf-8")))
372 372
373 match = re.match(".* (\d\.\d)\.\d.*", output.split('\n')[0]) 373 match = re.match(r".* (\d+\.\d+)\.\d+.*", output.split('\n')[0])
374 if not match: 374 if not match:
375 bb.fatal("Can't get compiler version from %s --version output" % compiler) 375 bb.fatal("Can't get compiler version from %s --version output" % compiler)
376 376
diff --git a/meta/lib/oeqa/core/utils/concurrencytest.py b/meta/lib/oeqa/core/utils/concurrencytest.py
index 1a58d35ba0..3e0e5d770c 100644
--- a/meta/lib/oeqa/core/utils/concurrencytest.py
+++ b/meta/lib/oeqa/core/utils/concurrencytest.py
@@ -194,7 +194,7 @@ def fork_for_tests(concurrency_num, suite):
194 oe.path.copytree(selftestdir, newselftestdir) 194 oe.path.copytree(selftestdir, newselftestdir)
195 195
196 for e in os.environ: 196 for e in os.environ:
197 if builddir in os.environ[e]: 197 if builddir + "/" in os.environ[e] or os.environ[e].endswith(builddir):
198 os.environ[e] = os.environ[e].replace(builddir, newbuilddir) 198 os.environ[e] = os.environ[e].replace(builddir, newbuilddir)
199 199
200 subprocess.check_output("git init; git add *; git commit -a -m 'initial'", cwd=newselftestdir, shell=True) 200 subprocess.check_output("git init; git add *; git commit -a -m 'initial'", cwd=newselftestdir, shell=True)
diff --git a/meta/lib/oeqa/sdkext/testsdk.py b/meta/lib/oeqa/sdkext/testsdk.py
index 57b2e0e03f..8ec5262d56 100644
--- a/meta/lib/oeqa/sdkext/testsdk.py
+++ b/meta/lib/oeqa/sdkext/testsdk.py
@@ -22,11 +22,8 @@ class TestSDKExt(TestSDKBase):
22 22
23 subprocesstweak.errors_have_output() 23 subprocesstweak.errors_have_output()
24 24
25 # extensible sdk can be contaminated if native programs are 25 # We need the original PATH for testing the eSDK, not with our manipulations
26 # in PATH, i.e. use perl-native instead of eSDK one. 26 os.environ['PATH'] = d.getVar("BB_ORIGENV", False).getVar("PATH")
27 paths_to_avoid = [d.getVar('STAGING_DIR'),
28 d.getVar('BASE_WORKDIR')]
29 os.environ['PATH'] = avoid_paths_in_environ(paths_to_avoid)
30 27
31 tcname = d.expand("${SDK_DEPLOY}/${TOOLCHAINEXT_OUTPUTNAME}.sh") 28 tcname = d.expand("${SDK_DEPLOY}/${TOOLCHAINEXT_OUTPUTNAME}.sh")
32 if not os.path.exists(tcname): 29 if not os.path.exists(tcname):
diff --git a/meta/lib/oeqa/selftest/cases/signing.py b/meta/lib/oeqa/selftest/cases/signing.py
index 4fa99acbc9..8d585430be 100644
--- a/meta/lib/oeqa/selftest/cases/signing.py
+++ b/meta/lib/oeqa/selftest/cases/signing.py
@@ -40,7 +40,9 @@ class Signing(OESelftestTestCase):
40 origenv = os.environ.copy() 40 origenv = os.environ.copy()
41 41
42 for e in os.environ: 42 for e in os.environ:
43 if builddir in os.environ[e]: 43 if builddir + "/" in os.environ[e]:
44 os.environ[e] = os.environ[e].replace(builddir + "/", newbuilddir + "/")
45 if os.environ[e].endswith(builddir):
44 os.environ[e] = os.environ[e].replace(builddir, newbuilddir) 46 os.environ[e] = os.environ[e].replace(builddir, newbuilddir)
45 47
46 os.chdir(newbuilddir) 48 os.chdir(newbuilddir)
diff --git a/meta/recipes-core/glibc/glibc-locale.inc b/meta/recipes-core/glibc/glibc-locale.inc
index 1b676dc26e..97d83cb856 100644
--- a/meta/recipes-core/glibc/glibc-locale.inc
+++ b/meta/recipes-core/glibc/glibc-locale.inc
@@ -95,3 +95,6 @@ do_install () {
95inherit libc-package 95inherit libc-package
96 96
97BBCLASSEXTEND = "nativesdk" 97BBCLASSEXTEND = "nativesdk"
98
99# Don't scan for CVEs as glibc will be scanned
100CVE_PRODUCT = ""
diff --git a/meta/recipes-core/glibc/glibc-mtrace.inc b/meta/recipes-core/glibc/glibc-mtrace.inc
index d703c14bdc..ef9d60ec23 100644
--- a/meta/recipes-core/glibc/glibc-mtrace.inc
+++ b/meta/recipes-core/glibc/glibc-mtrace.inc
@@ -11,3 +11,6 @@ do_install() {
11 install -d -m 0755 ${D}${bindir} 11 install -d -m 0755 ${D}${bindir}
12 install -m 0755 ${SRC}/mtrace ${D}${bindir}/ 12 install -m 0755 ${SRC}/mtrace ${D}${bindir}/
13} 13}
14
15# Don't scan for CVEs as glibc will be scanned
16CVE_PRODUCT = ""
diff --git a/meta/recipes-core/glibc/glibc-scripts.inc b/meta/recipes-core/glibc/glibc-scripts.inc
index 2a2b41507e..14a14e4512 100644
--- a/meta/recipes-core/glibc/glibc-scripts.inc
+++ b/meta/recipes-core/glibc/glibc-scripts.inc
@@ -18,3 +18,6 @@ do_install() {
18# sotruss script requires sotruss-lib.so (given by libsotruss package), 18# sotruss script requires sotruss-lib.so (given by libsotruss package),
19# to produce trace of the library calls. 19# to produce trace of the library calls.
20RDEPENDS_${PN} += "libsotruss" 20RDEPENDS_${PN} += "libsotruss"
21
22# Don't scan for CVEs as glibc will be scanned
23CVE_PRODUCT = ""
diff --git a/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Make-relocatable-install-for-locales.patch b/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Make-relocatable-install-for-locales.patch
index b53f2ef2e2..a5c2992f2e 100644
--- a/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Make-relocatable-install-for-locales.patch
+++ b/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Make-relocatable-install-for-locales.patch
@@ -65,3 +65,36 @@ index 68822a6319..537bc35149 100644
65 65
66 /* Load the locale data for CATEGORY from the file specified by *NAME. 66 /* Load the locale data for CATEGORY from the file specified by *NAME.
67 If *NAME is "", use environment variables as specified by POSIX, and 67 If *NAME is "", use environment variables as specified by POSIX, and
68Index: git/locale/programs/locale.c
69===================================================================
70--- git.orig/locale/programs/locale.c
71+++ git/locale/programs/locale.c
72@@ -632,6 +632,7 @@ nameentcmp (const void *a, const void *b
73 ((const struct nameent *) b)->name);
74 }
75
76+static char _write_archive_locales_path[4096] attribute_hidden __attribute__ ((section (".gccrelocprefix"))) = ARCHIVE_NAME;
77
78 static int
79 write_archive_locales (void **all_datap, char *linebuf)
80@@ -645,7 +646,7 @@ write_archive_locales (void **all_datap,
81 int fd, ret = 0;
82 uint32_t cnt;
83
84- fd = open64 (ARCHIVE_NAME, O_RDONLY);
85+ fd = open64 (_write_archive_locales_path, O_RDONLY);
86 if (fd < 0)
87 return 0;
88
89@@ -700,8 +701,8 @@ write_archive_locales (void **all_datap,
90 if (cnt)
91 putchar_unlocked ('\n');
92
93- printf ("locale: %-15.15s archive: " ARCHIVE_NAME "\n%s\n",
94- names[cnt].name, linebuf);
95+ printf ("locale: %-15.15s archive: %s\n%s\n",
96+ names[cnt].name, _write_archive_locales_path, linebuf);
97
98 locrec = (struct locrecent *) (addr + names[cnt].locrec_offset);
99
100
diff --git a/meta/recipes-core/glibc/glibc/CVE-2016-10739.patch b/meta/recipes-core/glibc/glibc/CVE-2016-10739.patch
index 7eb55d6663..7dc842887c 100644
--- a/meta/recipes-core/glibc/glibc/CVE-2016-10739.patch
+++ b/meta/recipes-core/glibc/glibc/CVE-2016-10739.patch
@@ -5,12 +5,12 @@ Signed-off-by: Ross Burton <ross.burton@intel.com>
5From 8e92ca5dd7a7e38a4dddf1ebc4e1e8f0cb27e4aa Mon Sep 17 00:00:00 2001 5From 8e92ca5dd7a7e38a4dddf1ebc4e1e8f0cb27e4aa Mon Sep 17 00:00:00 2001
6From: Florian Weimer <fweimer@redhat.com> 6From: Florian Weimer <fweimer@redhat.com>
7Date: Mon, 21 Jan 2019 08:59:42 +0100 7Date: Mon, 21 Jan 2019 08:59:42 +0100
8Subject: [PATCH] resolv: Reformat inet_addr, inet_aton to GNU style 8Subject: [PATCH 1/4] resolv: Reformat inet_addr, inet_aton to GNU style
9 9
10(cherry picked from commit 5e30b8ef0758763effa115634e0ed7d8938e4bc0) 10(cherry picked from commit 5e30b8ef0758763effa115634e0ed7d8938e4bc0)
11--- 11---
12 ChangeLog | 5 ++ 12 ChangeLog | 5 ++
13 resolv/inet_addr.c | 192 ++++++++++++++++++++++++++++------------------------- 13 resolv/inet_addr.c | 192 ++++++++++++++++++++++++---------------------
14 2 files changed, 106 insertions(+), 91 deletions(-) 14 2 files changed, 106 insertions(+), 91 deletions(-)
15 15
16diff --git a/resolv/inet_addr.c b/resolv/inet_addr.c 16diff --git a/resolv/inet_addr.c b/resolv/inet_addr.c
@@ -229,4 +229,908 @@ index 022f7ea084..32f58b0e13 100644
229 weak_alias (__inet_aton, inet_aton) 229 weak_alias (__inet_aton, inet_aton)
230 libc_hidden_def (__inet_aton) 230 libc_hidden_def (__inet_aton)
231-- 231--
2322.11.0 2322.20.1
233
234
235From 37edf1d3f8ab9adefb61cc466ac52b53114fbd5b Mon Sep 17 00:00:00 2001
236From: Florian Weimer <fweimer@redhat.com>
237Date: Mon, 21 Jan 2019 09:26:41 +0100
238Subject: [PATCH 2/4] resolv: Do not send queries for non-host-names in nss_dns
239 [BZ #24112]
240
241Before this commit, nss_dns would send a query which did not contain a
242host name as the query name (such as invalid\032name.example.com) and
243then reject the answer in getanswer_r and gaih_getanswer_slice, using
244a check based on res_hnok. With this commit, no query is sent, and a
245host-not-found error is returned to NSS without network interaction.
246
247(cherry picked from commit 6ca53a2453598804a2559a548a08424fca96434a)
248---
249 ChangeLog | 9 +++++++++
250 resolv/nss_dns/dns-host.c | 24 ++++++++++++++++++++++--
251 2 files changed, 31 insertions(+), 2 deletions(-)
252
253diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
254index 5dc2829cd1..99c3b61e1c 100644
255--- a/resolv/nss_dns/dns-host.c
256+++ b/resolv/nss_dns/dns-host.c
257@@ -274,11 +274,26 @@ gethostbyname3_context (struct resolv_context *ctx,
258 return status;
259 }
260
261+/* Verify that the name looks like a host name. There is no point in
262+ sending a query which will not produce a usable name in the
263+ response. */
264+static enum nss_status
265+check_name (const char *name, int *h_errnop)
266+{
267+ if (res_hnok (name))
268+ return NSS_STATUS_SUCCESS;
269+ *h_errnop = HOST_NOT_FOUND;
270+ return NSS_STATUS_NOTFOUND;
271+}
272+
273 enum nss_status
274 _nss_dns_gethostbyname2_r (const char *name, int af, struct hostent *result,
275 char *buffer, size_t buflen, int *errnop,
276 int *h_errnop)
277 {
278+ enum nss_status status = check_name (name, h_errnop);
279+ if (status != NSS_STATUS_SUCCESS)
280+ return status;
281 return _nss_dns_gethostbyname3_r (name, af, result, buffer, buflen, errnop,
282 h_errnop, NULL, NULL);
283 }
284@@ -289,6 +304,9 @@ _nss_dns_gethostbyname_r (const char *name, struct hostent *result,
285 char *buffer, size_t buflen, int *errnop,
286 int *h_errnop)
287 {
288+ enum nss_status status = check_name (name, h_errnop);
289+ if (status != NSS_STATUS_SUCCESS)
290+ return status;
291 struct resolv_context *ctx = __resolv_context_get ();
292 if (ctx == NULL)
293 {
294@@ -296,7 +314,7 @@ _nss_dns_gethostbyname_r (const char *name, struct hostent *result,
295 *h_errnop = NETDB_INTERNAL;
296 return NSS_STATUS_UNAVAIL;
297 }
298- enum nss_status status = NSS_STATUS_NOTFOUND;
299+ status = NSS_STATUS_NOTFOUND;
300 if (res_use_inet6 ())
301 status = gethostbyname3_context (ctx, name, AF_INET6, result, buffer,
302 buflen, errnop, h_errnop, NULL, NULL);
303@@ -313,6 +331,9 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
304 char *buffer, size_t buflen, int *errnop,
305 int *herrnop, int32_t *ttlp)
306 {
307+ enum nss_status status = check_name (name, herrnop);
308+ if (status != NSS_STATUS_SUCCESS)
309+ return status;
310 struct resolv_context *ctx = __resolv_context_get ();
311 if (ctx == NULL)
312 {
313@@ -347,7 +368,6 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
314 int ans2p_malloced = 0;
315
316 int olderr = errno;
317- enum nss_status status;
318 int n = __res_context_search (ctx, name, C_IN, T_QUERY_A_AND_AAAA,
319 host_buffer.buf->buf, 2048, &host_buffer.ptr,
320 &ans2p, &nans2p, &resplen2, &ans2p_malloced);
321--
3222.20.1
323
324
325From 2373941bd73cb288c8a42a33e23e7f7bb81151e7 Mon Sep 17 00:00:00 2001
326From: Florian Weimer <fweimer@redhat.com>
327Date: Mon, 21 Jan 2019 21:26:03 +0100
328Subject: [PATCH 3/4] CVE-2016-10739: getaddrinfo: Fully parse IPv4 address
329 strings [BZ #20018]
330
331The IPv4 address parser in the getaddrinfo function is changed so that
332it does not ignore trailing whitespace and all characters after it.
333For backwards compatibility, the getaddrinfo function still recognizes
334legacy name syntax, such as 192.000.002.010 interpreted as 192.0.2.8
335(octal).
336
337This commit does not change the behavior of inet_addr and inet_aton.
338gethostbyname already had additional sanity checks (but is switched
339over to the new __inet_aton_exact function for completeness as well).
340
341To avoid sending the problematic query names over DNS, commit
3426ca53a2453598804a2559a548a08424fca96434a ("resolv: Do not send queries
343for non-host-names in nss_dns [BZ #24112]") is needed.
344
345(cherry picked from commit 108bc4049f8ae82710aec26a92ffdb4b439c83fd)
346---
347 ChangeLog | 33 ++++++++
348 NEWS | 4 +
349 include/arpa/inet.h | 6 +-
350 nscd/gai.c | 1 -
351 nscd/gethstbynm3_r.c | 2 -
352 nss/digits_dots.c | 3 +-
353 resolv/Makefile | 7 ++
354 resolv/Versions | 1 +
355 resolv/inet_addr.c | 62 ++++++++++-----
356 resolv/res_init.c | 17 ++--
357 resolv/tst-aton.c | 35 +++++++--
358 resolv/tst-inet_aton_exact.c | 47 +++++++++++
359 resolv/tst-resolv-nondecimal.c | 139 +++++++++++++++++++++++++++++++++
360 resolv/tst-resolv-trailing.c | 136 ++++++++++++++++++++++++++++++++
361 sysdeps/posix/getaddrinfo.c | 2 +-
362 15 files changed, 455 insertions(+), 40 deletions(-)
363 create mode 100644 resolv/tst-inet_aton_exact.c
364 create mode 100644 resolv/tst-resolv-nondecimal.c
365 create mode 100644 resolv/tst-resolv-trailing.c
366
367diff --git a/include/arpa/inet.h b/include/arpa/inet.h
368index c3f28f2baa..19aec74275 100644
369--- a/include/arpa/inet.h
370+++ b/include/arpa/inet.h
371@@ -1,10 +1,10 @@
372 #include <inet/arpa/inet.h>
373
374 #ifndef _ISOMAC
375-extern int __inet_aton (const char *__cp, struct in_addr *__inp);
376-libc_hidden_proto (__inet_aton)
377+/* Variant of inet_aton which rejects trailing garbage. */
378+extern int __inet_aton_exact (const char *__cp, struct in_addr *__inp);
379+libc_hidden_proto (__inet_aton_exact)
380
381-libc_hidden_proto (inet_aton)
382 libc_hidden_proto (inet_ntop)
383 libc_hidden_proto (inet_pton)
384 extern __typeof (inet_pton) __inet_pton;
385diff --git a/nscd/gai.c b/nscd/gai.c
386index 24bdfee1db..f57f396f57 100644
387--- a/nscd/gai.c
388+++ b/nscd/gai.c
389@@ -19,7 +19,6 @@
390
391 /* This file uses the getaddrinfo code but it compiles it without NSCD
392 support. We just need a few symbol renames. */
393-#define __inet_aton inet_aton
394 #define __ioctl ioctl
395 #define __getsockname getsockname
396 #define __socket socket
397diff --git a/nscd/gethstbynm3_r.c b/nscd/gethstbynm3_r.c
398index 7beb9dce9f..f792c4fcd0 100644
399--- a/nscd/gethstbynm3_r.c
400+++ b/nscd/gethstbynm3_r.c
401@@ -38,8 +38,6 @@
402 #define HAVE_LOOKUP_BUFFER 1
403 #define HAVE_AF 1
404
405-#define __inet_aton inet_aton
406-
407 /* We are nscd, so we don't want to be talking to ourselves. */
408 #undef USE_NSCD
409
410diff --git a/nss/digits_dots.c b/nss/digits_dots.c
411index 39bff38865..5441bce16e 100644
412--- a/nss/digits_dots.c
413+++ b/nss/digits_dots.c
414@@ -29,7 +29,6 @@
415 #include "nsswitch.h"
416
417 #ifdef USE_NSCD
418-# define inet_aton __inet_aton
419 # include <nscd/nscd_proto.h>
420 #endif
421
422@@ -160,7 +159,7 @@ __nss_hostname_digits_dots_context (struct resolv_context *ctx,
423 255.255.255.255? The test below will succeed
424 spuriously... ??? */
425 if (af == AF_INET)
426- ok = __inet_aton (name, (struct in_addr *) host_addr);
427+ ok = __inet_aton_exact (name, (struct in_addr *) host_addr);
428 else
429 {
430 assert (af == AF_INET6);
431diff --git a/resolv/Makefile b/resolv/Makefile
432index ea395ac3eb..d36eedd34a 100644
433--- a/resolv/Makefile
434+++ b/resolv/Makefile
435@@ -34,6 +34,9 @@ routines := herror inet_addr inet_ntop inet_pton nsap_addr res_init \
436 tests = tst-aton tst-leaks tst-inet_ntop
437 xtests = tst-leaks2
438
439+tests-internal += tst-inet_aton_exact
440+
441+
442 generate := mtrace-tst-leaks.out tst-leaks.mtrace tst-leaks2.mtrace
443
444 extra-libs := libresolv libnss_dns
445@@ -54,8 +57,10 @@ tests += \
446 tst-resolv-binary \
447 tst-resolv-edns \
448 tst-resolv-network \
449+ tst-resolv-nondecimal \
450 tst-resolv-res_init-multi \
451 tst-resolv-search \
452+ tst-resolv-trailing \
453
454 # These tests need libdl.
455 ifeq (yes,$(build-shared))
456@@ -190,9 +195,11 @@ $(objpfx)tst-resolv-res_init-multi: $(objpfx)libresolv.so \
457 $(shared-thread-library)
458 $(objpfx)tst-resolv-res_init-thread: $(libdl) $(objpfx)libresolv.so \
459 $(shared-thread-library)
460+$(objpfx)tst-resolv-nondecimal: $(objpfx)libresolv.so $(shared-thread-library)
461 $(objpfx)tst-resolv-qtypes: $(objpfx)libresolv.so $(shared-thread-library)
462 $(objpfx)tst-resolv-rotate: $(objpfx)libresolv.so $(shared-thread-library)
463 $(objpfx)tst-resolv-search: $(objpfx)libresolv.so $(shared-thread-library)
464+$(objpfx)tst-resolv-trailing: $(objpfx)libresolv.so $(shared-thread-library)
465 $(objpfx)tst-resolv-threads: \
466 $(libdl) $(objpfx)libresolv.so $(shared-thread-library)
467 $(objpfx)tst-resolv-canonname: \
468diff --git a/resolv/Versions b/resolv/Versions
469index b05778d965..9a82704af7 100644
470--- a/resolv/Versions
471+++ b/resolv/Versions
472@@ -27,6 +27,7 @@ libc {
473 __h_errno; __resp;
474
475 __res_iclose;
476+ __inet_aton_exact;
477 __inet_pton_length;
478 __resolv_context_get;
479 __resolv_context_get_preinit;
480diff --git a/resolv/inet_addr.c b/resolv/inet_addr.c
481index 32f58b0e13..41b6166a5b 100644
482--- a/resolv/inet_addr.c
483+++ b/resolv/inet_addr.c
484@@ -96,26 +96,14 @@
485 #include <limits.h>
486 #include <errno.h>
487
488-/* ASCII IPv4 Internet address interpretation routine. The value
489- returned is in network order. */
490-in_addr_t
491-__inet_addr (const char *cp)
492-{
493- struct in_addr val;
494-
495- if (__inet_aton (cp, &val))
496- return val.s_addr;
497- return INADDR_NONE;
498-}
499-weak_alias (__inet_addr, inet_addr)
500-
501 /* Check whether "cp" is a valid ASCII representation of an IPv4
502 Internet address and convert it to a binary address. Returns 1 if
503 the address is valid, 0 if not. This replaces inet_addr, the
504 return value from which cannot distinguish between failure and a
505- local broadcast address. */
506-int
507-__inet_aton (const char *cp, struct in_addr *addr)
508+ local broadcast address. Write a pointer to the first
509+ non-converted character to *endp. */
510+static int
511+inet_aton_end (const char *cp, struct in_addr *addr, const char **endp)
512 {
513 static const in_addr_t max[4] = { 0xffffffff, 0xffffff, 0xffff, 0xff };
514 in_addr_t val;
515@@ -180,6 +168,7 @@ __inet_aton (const char *cp, struct in_addr *addr)
516
517 if (addr != NULL)
518 addr->s_addr = res.word | htonl (val);
519+ *endp = cp;
520
521 __set_errno (saved_errno);
522 return 1;
523@@ -188,6 +177,41 @@ __inet_aton (const char *cp, struct in_addr *addr)
524 __set_errno (saved_errno);
525 return 0;
526 }
527-weak_alias (__inet_aton, inet_aton)
528-libc_hidden_def (__inet_aton)
529-libc_hidden_weak (inet_aton)
530+
531+int
532+__inet_aton_exact (const char *cp, struct in_addr *addr)
533+{
534+ struct in_addr val;
535+ const char *endp;
536+ /* Check that inet_aton_end parsed the entire string. */
537+ if (inet_aton_end (cp, &val, &endp) != 0 && *endp == 0)
538+ {
539+ *addr = val;
540+ return 1;
541+ }
542+ else
543+ return 0;
544+}
545+libc_hidden_def (__inet_aton_exact)
546+
547+/* inet_aton ignores trailing garbage. */
548+int
549+__inet_aton_ignore_trailing (const char *cp, struct in_addr *addr)
550+{
551+ const char *endp;
552+ return inet_aton_end (cp, addr, &endp);
553+}
554+weak_alias (__inet_aton_ignore_trailing, inet_aton)
555+
556+/* ASCII IPv4 Internet address interpretation routine. The value
557+ returned is in network order. */
558+in_addr_t
559+__inet_addr (const char *cp)
560+{
561+ struct in_addr val;
562+ const char *endp;
563+ if (inet_aton_end (cp, &val, &endp))
564+ return val.s_addr;
565+ return INADDR_NONE;
566+}
567+weak_alias (__inet_addr, inet_addr)
568diff --git a/resolv/res_init.c b/resolv/res_init.c
569index f5e52cbbb9..94743a252e 100644
570--- a/resolv/res_init.c
571+++ b/resolv/res_init.c
572@@ -399,8 +399,16 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
573 cp = parser->buffer + sizeof ("nameserver") - 1;
574 while (*cp == ' ' || *cp == '\t')
575 cp++;
576+
577+ /* Ignore trailing contents on the name server line. */
578+ {
579+ char *el;
580+ if ((el = strpbrk (cp, " \t\n")) != NULL)
581+ *el = '\0';
582+ }
583+
584 struct sockaddr *sa;
585- if ((*cp != '\0') && (*cp != '\n') && __inet_aton (cp, &a))
586+ if ((*cp != '\0') && (*cp != '\n') && __inet_aton_exact (cp, &a))
587 {
588 sa = allocate_address_v4 (a, NAMESERVER_PORT);
589 if (sa == NULL)
590@@ -410,9 +418,6 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
591 {
592 struct in6_addr a6;
593 char *el;
594-
595- if ((el = strpbrk (cp, " \t\n")) != NULL)
596- *el = '\0';
597 if ((el = strchr (cp, SCOPE_DELIMITER)) != NULL)
598 *el = '\0';
599 if ((*cp != '\0') && (__inet_pton (AF_INET6, cp, &a6) > 0))
600@@ -472,7 +477,7 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
601 char separator = *cp;
602 *cp = 0;
603 struct resolv_sortlist_entry e;
604- if (__inet_aton (net, &a))
605+ if (__inet_aton_exact (net, &a))
606 {
607 e.addr = a;
608 if (is_sort_mask (separator))
609@@ -484,7 +489,7 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
610 cp++;
611 separator = *cp;
612 *cp = 0;
613- if (__inet_aton (net, &a))
614+ if (__inet_aton_exact (net, &a))
615 e.mask = a.s_addr;
616 else
617 e.mask = net_mask (e.addr);
618diff --git a/resolv/tst-aton.c b/resolv/tst-aton.c
619index 08110a007a..eb734d7758 100644
620--- a/resolv/tst-aton.c
621+++ b/resolv/tst-aton.c
622@@ -1,11 +1,29 @@
623+/* Test legacy IPv4 text-to-address function inet_aton.
624+ Copyright (C) 1998-2019 Free Software Foundation, Inc.
625+ This file is part of the GNU C Library.
626+
627+ The GNU C Library is free software; you can redistribute it and/or
628+ modify it under the terms of the GNU Lesser General Public
629+ License as published by the Free Software Foundation; either
630+ version 2.1 of the License, or (at your option) any later version.
631+
632+ The GNU C Library is distributed in the hope that it will be useful,
633+ but WITHOUT ANY WARRANTY; without even the implied warranty of
634+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
635+ Lesser General Public License for more details.
636+
637+ You should have received a copy of the GNU Lesser General Public
638+ License along with the GNU C Library; if not, see
639+ <http://www.gnu.org/licenses/>. */
640+
641+#include <array_length.h>
642 #include <stdio.h>
643 #include <stdint.h>
644 #include <sys/socket.h>
645 #include <netinet/in.h>
646 #include <arpa/inet.h>
647
648-
649-static struct tests
650+static const struct tests
651 {
652 const char *input;
653 int valid;
654@@ -16,6 +34,7 @@ static struct tests
655 { "-1", 0, 0 },
656 { "256", 1, 0x00000100 },
657 { "256.", 0, 0 },
658+ { "255a", 0, 0 },
659 { "256a", 0, 0 },
660 { "0x100", 1, 0x00000100 },
661 { "0200.0x123456", 1, 0x80123456 },
662@@ -40,7 +59,12 @@ static struct tests
663 { "1.2.256.4", 0, 0 },
664 { "1.2.3.0x100", 0, 0 },
665 { "323543357756889", 0, 0 },
666- { "10.1.2.3.4", 0, 0},
667+ { "10.1.2.3.4", 0, 0 },
668+ { "192.0.2.1", 1, 0xc0000201 },
669+ { "192.0.2.2\nX", 1, 0xc0000202 },
670+ { "192.0.2.3 Y", 1, 0xc0000203 },
671+ { "192.0.2.3Z", 0, 0 },
672+ { "192.000.002.010", 1, 0xc0000208 },
673 };
674
675
676@@ -50,7 +74,7 @@ do_test (void)
677 int result = 0;
678 size_t cnt;
679
680- for (cnt = 0; cnt < sizeof (tests) / sizeof (tests[0]); ++cnt)
681+ for (cnt = 0; cnt < array_length (tests); ++cnt)
682 {
683 struct in_addr addr;
684
685@@ -73,5 +97,4 @@ do_test (void)
686 return result;
687 }
688
689-#define TEST_FUNCTION do_test ()
690-#include "../test-skeleton.c"
691+#include <support/test-driver.c>
692diff --git a/resolv/tst-inet_aton_exact.c b/resolv/tst-inet_aton_exact.c
693new file mode 100644
694index 0000000000..0fdfa3d6aa
695--- /dev/null
696+++ b/resolv/tst-inet_aton_exact.c
697@@ -0,0 +1,47 @@
698+/* Test internal legacy IPv4 text-to-address function __inet_aton_exact.
699+ Copyright (C) 2019 Free Software Foundation, Inc.
700+ This file is part of the GNU C Library.
701+
702+ The GNU C Library is free software; you can redistribute it and/or
703+ modify it under the terms of the GNU Lesser General Public
704+ License as published by the Free Software Foundation; either
705+ version 2.1 of the License, or (at your option) any later version.
706+
707+ The GNU C Library is distributed in the hope that it will be useful,
708+ but WITHOUT ANY WARRANTY; without even the implied warranty of
709+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
710+ Lesser General Public License for more details.
711+
712+ You should have received a copy of the GNU Lesser General Public
713+ License along with the GNU C Library; if not, see
714+ <http://www.gnu.org/licenses/>. */
715+
716+#include <arpa/inet.h>
717+#include <support/check.h>
718+
719+static int
720+do_test (void)
721+{
722+ struct in_addr addr = { };
723+
724+ TEST_COMPARE (__inet_aton_exact ("192.0.2.1", &addr), 1);
725+ TEST_COMPARE (ntohl (addr.s_addr), 0xC0000201);
726+
727+ TEST_COMPARE (__inet_aton_exact ("192.000.002.010", &addr), 1);
728+ TEST_COMPARE (ntohl (addr.s_addr), 0xC0000208);
729+ TEST_COMPARE (__inet_aton_exact ("0xC0000234", &addr), 1);
730+ TEST_COMPARE (ntohl (addr.s_addr), 0xC0000234);
731+
732+ /* Trailing content is not accepted. */
733+ TEST_COMPARE (__inet_aton_exact ("192.0.2.2X", &addr), 0);
734+ TEST_COMPARE (__inet_aton_exact ("192.0.2.3 Y", &addr), 0);
735+ TEST_COMPARE (__inet_aton_exact ("192.0.2.4\nZ", &addr), 0);
736+ TEST_COMPARE (__inet_aton_exact ("192.0.2.5\tT", &addr), 0);
737+ TEST_COMPARE (__inet_aton_exact ("192.0.2.6 Y", &addr), 0);
738+ TEST_COMPARE (__inet_aton_exact ("192.0.2.7\n", &addr), 0);
739+ TEST_COMPARE (__inet_aton_exact ("192.0.2.8\t", &addr), 0);
740+
741+ return 0;
742+}
743+
744+#include <support/test-driver.c>
745diff --git a/resolv/tst-resolv-nondecimal.c b/resolv/tst-resolv-nondecimal.c
746new file mode 100644
747index 0000000000..a0df6f332a
748--- /dev/null
749+++ b/resolv/tst-resolv-nondecimal.c
750@@ -0,0 +1,139 @@
751+/* Test name resolution behavior for octal, hexadecimal IPv4 addresses.
752+ Copyright (C) 2019 Free Software Foundation, Inc.
753+ This file is part of the GNU C Library.
754+
755+ The GNU C Library is free software; you can redistribute it and/or
756+ modify it under the terms of the GNU Lesser General Public
757+ License as published by the Free Software Foundation; either
758+ version 2.1 of the License, or (at your option) any later version.
759+
760+ The GNU C Library is distributed in the hope that it will be useful,
761+ but WITHOUT ANY WARRANTY; without even the implied warranty of
762+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
763+ Lesser General Public License for more details.
764+
765+ You should have received a copy of the GNU Lesser General Public
766+ License along with the GNU C Library; if not, see
767+ <http://www.gnu.org/licenses/>. */
768+
769+#include <netdb.h>
770+#include <stdlib.h>
771+#include <support/check.h>
772+#include <support/check_nss.h>
773+#include <support/resolv_test.h>
774+#include <support/support.h>
775+
776+static void
777+response (const struct resolv_response_context *ctx,
778+ struct resolv_response_builder *b,
779+ const char *qname, uint16_t qclass, uint16_t qtype)
780+{
781+ /* The tests are not supposed send any DNS queries. */
782+ FAIL_EXIT1 ("unexpected DNS query for %s/%d/%d", qname, qclass, qtype);
783+}
784+
785+static void
786+run_query_addrinfo (const char *query, const char *address)
787+{
788+ char *quoted_query = support_quote_string (query);
789+
790+ struct addrinfo *ai;
791+ struct addrinfo hints =
792+ {
793+ .ai_socktype = SOCK_STREAM,
794+ .ai_protocol = IPPROTO_TCP,
795+ };
796+
797+ char *context = xasprintf ("getaddrinfo \"%s\" AF_INET", quoted_query);
798+ char *expected = xasprintf ("address: STREAM/TCP %s 80\n", address);
799+ hints.ai_family = AF_INET;
800+ int ret = getaddrinfo (query, "80", &hints, &ai);
801+ check_addrinfo (context, ai, ret, expected);
802+ if (ret == 0)
803+ freeaddrinfo (ai);
804+ free (context);
805+
806+ context = xasprintf ("getaddrinfo \"%s\" AF_UNSPEC", quoted_query);
807+ hints.ai_family = AF_UNSPEC;
808+ ret = getaddrinfo (query, "80", &hints, &ai);
809+ check_addrinfo (context, ai, ret, expected);
810+ if (ret == 0)
811+ freeaddrinfo (ai);
812+ free (expected);
813+ free (context);
814+
815+ context = xasprintf ("getaddrinfo \"%s\" AF_INET6", quoted_query);
816+ expected = xasprintf ("flags: AI_V4MAPPED\n"
817+ "address: STREAM/TCP ::ffff:%s 80\n",
818+ address);
819+ hints.ai_family = AF_INET6;
820+ hints.ai_flags = AI_V4MAPPED;
821+ ret = getaddrinfo (query, "80", &hints, &ai);
822+ check_addrinfo (context, ai, ret, expected);
823+ if (ret == 0)
824+ freeaddrinfo (ai);
825+ free (expected);
826+ free (context);
827+
828+ free (quoted_query);
829+}
830+
831+static void
832+run_query (const char *query, const char *address)
833+{
834+ char *quoted_query = support_quote_string (query);
835+ char *context = xasprintf ("gethostbyname (\"%s\")", quoted_query);
836+ char *expected = xasprintf ("name: %s\n"
837+ "address: %s\n", query, address);
838+ check_hostent (context, gethostbyname (query), expected);
839+ free (context);
840+
841+ context = xasprintf ("gethostbyname_r \"%s\"", quoted_query);
842+ struct hostent storage;
843+ char buf[4096];
844+ struct hostent *e = NULL;
845+ TEST_COMPARE (gethostbyname_r (query, &storage, buf, sizeof (buf),
846+ &e, &h_errno), 0);
847+ check_hostent (context, e, expected);
848+ free (context);
849+
850+ context = xasprintf ("gethostbyname2 (\"%s\", AF_INET)", quoted_query);
851+ check_hostent (context, gethostbyname2 (query, AF_INET), expected);
852+ free (context);
853+
854+ context = xasprintf ("gethostbyname2_r \"%s\" AF_INET", quoted_query);
855+ e = NULL;
856+ TEST_COMPARE (gethostbyname2_r (query, AF_INET, &storage, buf, sizeof (buf),
857+ &e, &h_errno), 0);
858+ check_hostent (context, e, expected);
859+ free (context);
860+ free (expected);
861+
862+ free (quoted_query);
863+
864+ /* The gethostbyname tests are always valid for getaddrinfo, but not
865+ vice versa. */
866+ run_query_addrinfo (query, address);
867+}
868+
869+static int
870+do_test (void)
871+{
872+ struct resolv_test *aux = resolv_test_start
873+ ((struct resolv_redirect_config)
874+ {
875+ .response_callback = response,
876+ });
877+
878+ run_query ("192.000.002.010", "192.0.2.8");
879+
880+ /* Hexadecimal numbers are not accepted by gethostbyname. */
881+ run_query_addrinfo ("0xc0000210", "192.0.2.16");
882+ run_query_addrinfo ("192.0x234", "192.0.2.52");
883+
884+ resolv_test_end (aux);
885+
886+ return 0;
887+}
888+
889+#include <support/test-driver.c>
890diff --git a/resolv/tst-resolv-trailing.c b/resolv/tst-resolv-trailing.c
891new file mode 100644
892index 0000000000..7504bdae57
893--- /dev/null
894+++ b/resolv/tst-resolv-trailing.c
895@@ -0,0 +1,136 @@
896+/* Test name resolution behavior with trailing characters.
897+ Copyright (C) 2019 Free Software Foundation, Inc.
898+ This file is part of the GNU C Library.
899+
900+ The GNU C Library is free software; you can redistribute it and/or
901+ modify it under the terms of the GNU Lesser General Public
902+ License as published by the Free Software Foundation; either
903+ version 2.1 of the License, or (at your option) any later version.
904+
905+ The GNU C Library is distributed in the hope that it will be useful,
906+ but WITHOUT ANY WARRANTY; without even the implied warranty of
907+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
908+ Lesser General Public License for more details.
909+
910+ You should have received a copy of the GNU Lesser General Public
911+ License along with the GNU C Library; if not, see
912+ <http://www.gnu.org/licenses/>. */
913+
914+#include <array_length.h>
915+#include <netdb.h>
916+#include <support/check.h>
917+#include <support/check_nss.h>
918+#include <support/resolv_test.h>
919+#include <support/support.h>
920+
921+static void
922+response (const struct resolv_response_context *ctx,
923+ struct resolv_response_builder *b,
924+ const char *qname, uint16_t qclass, uint16_t qtype)
925+{
926+ /* The tests are not supposed send any DNS queries. */
927+ FAIL_EXIT1 ("unexpected DNS query for %s/%d/%d", qname, qclass, qtype);
928+}
929+
930+static int
931+do_test (void)
932+{
933+ struct resolv_test *aux = resolv_test_start
934+ ((struct resolv_redirect_config)
935+ {
936+ .response_callback = response,
937+ });
938+
939+ static const char *const queries[] =
940+ {
941+ "192.0.2.1 ",
942+ "192.0.2.2\t",
943+ "192.0.2.3\n",
944+ "192.0.2.4 X",
945+ "192.0.2.5\tY",
946+ "192.0.2.6\nZ",
947+ "192.0.2. ",
948+ "192.0.2.\t",
949+ "192.0.2.\n",
950+ "192.0.2. X",
951+ "192.0.2.\tY",
952+ "192.0.2.\nZ",
953+ "2001:db8::1 ",
954+ "2001:db8::2\t",
955+ "2001:db8::3\n",
956+ "2001:db8::4 X",
957+ "2001:db8::5\tY",
958+ "2001:db8::6\nZ",
959+ };
960+ for (size_t query_idx = 0; query_idx < array_length (queries); ++query_idx)
961+ {
962+ const char *query = queries[query_idx];
963+ struct hostent storage;
964+ char buf[4096];
965+ struct hostent *e;
966+
967+ h_errno = 0;
968+ TEST_VERIFY (gethostbyname (query) == NULL);
969+ TEST_COMPARE (h_errno, HOST_NOT_FOUND);
970+
971+ h_errno = 0;
972+ e = NULL;
973+ TEST_COMPARE (gethostbyname_r (query, &storage, buf, sizeof (buf),
974+ &e, &h_errno), 0);
975+ TEST_VERIFY (e == NULL);
976+ TEST_COMPARE (h_errno, HOST_NOT_FOUND);
977+
978+ h_errno = 0;
979+ TEST_VERIFY (gethostbyname2 (query, AF_INET) == NULL);
980+ TEST_COMPARE (h_errno, HOST_NOT_FOUND);
981+
982+ h_errno = 0;
983+ e = NULL;
984+ TEST_COMPARE (gethostbyname2_r (query, AF_INET,
985+ &storage, buf, sizeof (buf),
986+ &e, &h_errno), 0);
987+ TEST_VERIFY (e == NULL);
988+ TEST_COMPARE (h_errno, HOST_NOT_FOUND);
989+
990+ h_errno = 0;
991+ TEST_VERIFY (gethostbyname2 (query, AF_INET6) == NULL);
992+ TEST_COMPARE (h_errno, HOST_NOT_FOUND);
993+
994+ h_errno = 0;
995+ e = NULL;
996+ TEST_COMPARE (gethostbyname2_r (query, AF_INET6,
997+ &storage, buf, sizeof (buf),
998+ &e, &h_errno), 0);
999+ TEST_VERIFY (e == NULL);
1000+ TEST_COMPARE (h_errno, HOST_NOT_FOUND);
1001+
1002+ static const int gai_flags[] =
1003+ {
1004+ 0,
1005+ AI_ADDRCONFIG,
1006+ AI_NUMERICHOST,
1007+ AI_IDN,
1008+ AI_IDN | AI_NUMERICHOST,
1009+ AI_V4MAPPED,
1010+ AI_V4MAPPED | AI_NUMERICHOST,
1011+ };
1012+ for (size_t gai_flags_idx; gai_flags_idx < array_length (gai_flags);
1013+ ++gai_flags_idx)
1014+ {
1015+ struct addrinfo hints = { .ai_flags = gai_flags[gai_flags_idx], };
1016+ struct addrinfo *ai;
1017+ hints.ai_family = AF_INET;
1018+ TEST_COMPARE (getaddrinfo (query, "80", &hints, &ai), EAI_NONAME);
1019+ hints.ai_family = AF_INET6;
1020+ TEST_COMPARE (getaddrinfo (query, "80", &hints, &ai), EAI_NONAME);
1021+ hints.ai_family = AF_UNSPEC;
1022+ TEST_COMPARE (getaddrinfo (query, "80", &hints, &ai), EAI_NONAME);
1023+ }
1024+ };
1025+
1026+ resolv_test_end (aux);
1027+
1028+ return 0;
1029+}
1030+
1031+#include <support/test-driver.c>
1032diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
1033index 553833d1f2..c91b281e31 100644
1034--- a/sysdeps/posix/getaddrinfo.c
1035+++ b/sysdeps/posix/getaddrinfo.c
1036@@ -488,7 +488,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
1037 malloc_name = true;
1038 }
1039
1040- if (__inet_aton (name, (struct in_addr *) at->addr) != 0)
1041+ if (__inet_aton_exact (name, (struct in_addr *) at->addr) != 0)
1042 {
1043 if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET)
1044 at->family = AF_INET;
1045--
10462.20.1
1047
1048
1049From c533244b8e00ae701583ec50aeb43377d292452d Mon Sep 17 00:00:00 2001
1050From: Florian Weimer <fweimer@redhat.com>
1051Date: Mon, 4 Feb 2019 20:07:18 +0100
1052Subject: [PATCH 4/4] nscd: Do not use __inet_aton_exact@GLIBC_PRIVATE [BZ
1053 #20018]
1054
1055This commit avoids referencing the __inet_aton_exact@GLIBC_PRIVATE
1056symbol from nscd. In master, the separately-compiled getaddrinfo
1057implementation in nscd needs it, however such an internal ABI change
1058is not desirable on a release branch if it can be avoided.
1059---
1060 ChangeLog | 10 ++++++++++
1061 nscd/Makefile | 2 +-
1062 nscd/gai.c | 6 ++++++
1063 nscd/nscd-inet_addr.c | 32 ++++++++++++++++++++++++++++++++
1064 4 files changed, 49 insertions(+), 1 deletion(-)
1065 create mode 100644 nscd/nscd-inet_addr.c
1066
1067diff --git a/nscd/Makefile b/nscd/Makefile
1068index b713a84c49..eb23c01a39 100644
1069--- a/nscd/Makefile
1070+++ b/nscd/Makefile
1071@@ -36,7 +36,7 @@ nscd-modules := nscd connections pwdcache getpwnam_r getpwuid_r grpcache \
1072 getsrvbynm_r getsrvbypt_r servicescache \
1073 dbg_log nscd_conf nscd_stat cache mem nscd_setup_thread \
1074 xmalloc xstrdup aicache initgrcache gai res_hconf \
1075- netgroupcache
1076+ netgroupcache nscd-inet_addr
1077
1078 ifeq ($(build-nscd)$(have-thread-library),yesyes)
1079
1080diff --git a/nscd/gai.c b/nscd/gai.c
1081index f57f396f57..68a4abd30e 100644
1082--- a/nscd/gai.c
1083+++ b/nscd/gai.c
1084@@ -33,6 +33,12 @@
1085 #define __getifaddrs getifaddrs
1086 #define __freeifaddrs freeifaddrs
1087
1088+/* We do not want to export __inet_aton_exact. Get the prototype and
1089+ change its visibility to hidden. */
1090+#include <arpa/inet.h>
1091+__typeof__ (__inet_aton_exact) __inet_aton_exact
1092+ __attribute__ ((visibility ("hidden")));
1093+
1094 /* We are nscd, so we don't want to be talking to ourselves. */
1095 #undef USE_NSCD
1096
1097diff --git a/nscd/nscd-inet_addr.c b/nscd/nscd-inet_addr.c
1098new file mode 100644
1099index 0000000000..f366b9567d
1100--- /dev/null
1101+++ b/nscd/nscd-inet_addr.c
1102@@ -0,0 +1,32 @@
1103+/* Legacy IPv4 text-to-address functions. Version for nscd.
1104+ Copyright (C) 2019 Free Software Foundation, Inc.
1105+ This file is part of the GNU C Library.
1106+
1107+ The GNU C Library is free software; you can redistribute it and/or
1108+ modify it under the terms of the GNU Lesser General Public
1109+ License as published by the Free Software Foundation; either
1110+ version 2.1 of the License, or (at your option) any later version.
1111+
1112+ The GNU C Library is distributed in the hope that it will be useful,
1113+ but WITHOUT ANY WARRANTY; without even the implied warranty of
1114+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
1115+ Lesser General Public License for more details.
1116+
1117+ You should have received a copy of the GNU Lesser General Public
1118+ License along with the GNU C Library; if not, see
1119+ <http://www.gnu.org/licenses/>. */
1120+
1121+#include <arpa/inet.h>
1122+
1123+/* We do not want to export __inet_aton_exact. Get the prototype and
1124+ change the visibility to hidden. */
1125+#include <arpa/inet.h>
1126+__typeof__ (__inet_aton_exact) __inet_aton_exact
1127+ __attribute__ ((visibility ("hidden")));
1128+
1129+/* Do not provide definitions of the public symbols exported from
1130+ libc. */
1131+#undef weak_alias
1132+#define weak_alias(from, to)
1133+
1134+#include <resolv/inet_addr.c>
1135--
11362.20.1
diff --git a/meta/recipes-core/meta/buildtools-extended-tarball.bb b/meta/recipes-core/meta/buildtools-extended-tarball.bb
new file mode 100644
index 0000000000..94ed57585b
--- /dev/null
+++ b/meta/recipes-core/meta/buildtools-extended-tarball.bb
@@ -0,0 +1,36 @@
1require recipes-core/meta/buildtools-tarball.bb
2
3DESCRIPTION = "SDK type target for building a standalone tarball containing build-essentials, python3, chrpath, \
4 make, git and tar. The tarball can be used to run bitbake builds on systems which don't meet the \
5 usual version requirements and have ancient compilers."
6SUMMARY = "Standalone tarball for running builds on systems with inadequate software and ancient compilers"
7LICENSE = "MIT"
8
9# Add nativesdk equivalent of build-essentials
10TOOLCHAIN_HOST_TASK += "\
11 nativesdk-automake \
12 nativesdk-autoconf \
13 nativesdk-binutils \
14 nativesdk-binutils-symlinks \
15 nativesdk-cpp \
16 nativesdk-cpp-symlinks \
17 nativesdk-gcc \
18 nativesdk-gcc-symlinks \
19 nativesdk-g++ \
20 nativesdk-g++-symlinks \
21 nativesdk-gettext \
22 nativesdk-libatomic \
23 nativesdk-libgcc \
24 nativesdk-libstdc++ \
25 nativesdk-libstdc++-dev \
26 nativesdk-libstdc++-staticdev \
27 nativesdk-libtool \
28 nativesdk-pkgconfig \
29 nativesdk-glibc-utils \
30 nativesdk-python \
31 nativesdk-libxcrypt-dev \
32 "
33
34TOOLCHAIN_OUTPUTNAME = "${SDK_ARCH}-buildtools-extended-nativesdk-standalone-${DISTRO_VERSION}"
35
36SDK_TITLE = "Extended Build tools"
diff --git a/meta/recipes-core/meta/buildtools-tarball.bb b/meta/recipes-core/meta/buildtools-tarball.bb
index 91df6f1ae9..aba10b4cd6 100644
--- a/meta/recipes-core/meta/buildtools-tarball.bb
+++ b/meta/recipes-core/meta/buildtools-tarball.bb
@@ -72,7 +72,13 @@ create_sdk_files_append () {
72 toolchain_create_sdk_version ${SDK_OUTPUT}/${SDKPATH}/version-${SDK_SYS} 72 toolchain_create_sdk_version ${SDK_OUTPUT}/${SDKPATH}/version-${SDK_SYS}
73 73
74 echo 'export GIT_SSL_CAINFO="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script 74 echo 'export GIT_SSL_CAINFO="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script
75 echo 'export SSL_CERT_FILE="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script
76 echo 'export OPENSSL_CONF="${SDKPATHNATIVE}${sysconfdir}/ssl/openssl.cnf"' >>$script
75 77
78 mkdir -p ${SDK_OUTPUT}/${SDKPATHNATIVE}${sysconfdir}/
79 echo '${SDKPATHNATIVE}${libdir}
80${SDKPATHNATIVE}${base_libdir}
81include /etc/ld.so.conf' > ${SDK_OUTPUT}/${SDKPATHNATIVE}${sysconfdir}/ld.so.conf
76 if [ "${SDKMACHINE}" = "i686" ]; then 82 if [ "${SDKMACHINE}" = "i686" ]; then
77 echo 'export NO32LIBS="0"' >>$script 83 echo 'export NO32LIBS="0"' >>$script
78 echo 'echo "$BB_ENV_EXTRAWHITE" | grep -q "NO32LIBS"' >>$script 84 echo 'echo "$BB_ENV_EXTRAWHITE" | grep -q "NO32LIBS"' >>$script
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
new file mode 100644
index 0000000000..e9a023e9bd
--- /dev/null
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -0,0 +1,190 @@
1SUMMARY = "Updates the NVD CVE database"
2LICENSE = "MIT"
3
4INHIBIT_DEFAULT_DEPS = "1"
5
6inherit native
7
8deltask do_unpack
9deltask do_patch
10deltask do_configure
11deltask do_compile
12deltask do_install
13deltask do_populate_sysroot
14
15python () {
16 if not d.getVar("CVE_CHECK_DB_FILE"):
17 raise bb.parse.SkipRecipe("Skip recipe when cve-check class is not loaded.")
18}
19
20python do_populate_cve_db() {
21 """
22 Update NVD database with json data feed
23 """
24 import bb.utils
25 import sqlite3, urllib, urllib.parse, shutil, gzip
26 from datetime import date
27
28 bb.utils.export_proxies(d)
29
30 BASE_URL = "https://nvd.nist.gov/feeds/json/cve/1.0/nvdcve-1.0-"
31 YEAR_START = 2002
32
33 db_file = d.getVar("CVE_CHECK_DB_FILE")
34 db_dir = os.path.dirname(db_file)
35 json_tmpfile = os.path.join(db_dir, 'nvd.json.gz')
36
37 # Don't refresh the database more than once an hour
38 try:
39 import time
40 if time.time() - os.path.getmtime(db_file) < (60*60):
41 return
42 except OSError:
43 pass
44
45 cve_f = open(os.path.join(d.getVar("TMPDIR"), 'cve_check'), 'a')
46
47 if not os.path.isdir(db_dir):
48 os.mkdir(db_dir)
49
50 # Connect to database
51 conn = sqlite3.connect(db_file)
52 c = conn.cursor()
53
54 initialize_db(c)
55
56 for year in range(YEAR_START, date.today().year + 1):
57 year_url = BASE_URL + str(year)
58 meta_url = year_url + ".meta"
59 json_url = year_url + ".json.gz"
60
61 # Retrieve meta last modified date
62 response = urllib.request.urlopen(meta_url)
63 if response:
64 for l in response.read().decode("utf-8").splitlines():
65 key, value = l.split(":", 1)
66 if key == "lastModifiedDate":
67 last_modified = value
68 break
69 else:
70 bb.warn("Cannot parse CVE metadata, update failed")
71 return
72
73 # Compare with current db last modified date
74 c.execute("select DATE from META where YEAR = ?", (year,))
75 meta = c.fetchone()
76 if not meta or meta[0] != last_modified:
77 # Clear products table entries corresponding to current year
78 c.execute("delete from PRODUCTS where ID like ?", ('CVE-%d%%' % year,))
79
80 # Update db with current year json file
81 try:
82 response = urllib.request.urlopen(json_url)
83 if response:
84 update_db(c, gzip.decompress(response.read()).decode('utf-8'))
85 c.execute("insert or replace into META values (?, ?)", [year, last_modified])
86 except urllib.error.URLError as e:
87 cve_f.write('Warning: CVE db update error, CVE data is outdated.\n\n')
88 bb.warn("Cannot parse CVE data (%s), update failed" % e.reason)
89 return
90
91 # Update success, set the date to cve_check file.
92 if year == date.today().year:
93 cve_f.write('CVE database update : %s\n\n' % date.today())
94
95 cve_f.close()
96 conn.commit()
97 conn.close()
98}
99
100def initialize_db(c):
101 c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)")
102
103 c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \
104 SCOREV2 TEXT, SCOREV3 TEXT, MODIFIED INTEGER, VECTOR TEXT)")
105
106 c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \
107 VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \
108 VERSION_END TEXT, OPERATOR_END TEXT)")
109 c.execute("CREATE INDEX IF NOT EXISTS PRODUCT_ID_IDX on PRODUCTS(ID);")
110
111def parse_node_and_insert(c, node, cveId):
112 # Parse children node if needed
113 for child in node.get('children', ()):
114 parse_node_and_insert(c, child, cveId)
115
116 def cpe_generator():
117 for cpe in node.get('cpe_match', ()):
118 if not cpe['vulnerable']:
119 return
120 cpe23 = cpe['cpe23Uri'].split(':')
121 vendor = cpe23[3]
122 product = cpe23[4]
123 version = cpe23[5]
124
125 if version != '*':
126 # Version is defined, this is a '=' match
127 yield [cveId, vendor, product, version, '=', '', '']
128 else:
129 # Parse start version, end version and operators
130 op_start = ''
131 op_end = ''
132 v_start = ''
133 v_end = ''
134
135 if 'versionStartIncluding' in cpe:
136 op_start = '>='
137 v_start = cpe['versionStartIncluding']
138
139 if 'versionStartExcluding' in cpe:
140 op_start = '>'
141 v_start = cpe['versionStartExcluding']
142
143 if 'versionEndIncluding' in cpe:
144 op_end = '<='
145 v_end = cpe['versionEndIncluding']
146
147 if 'versionEndExcluding' in cpe:
148 op_end = '<'
149 v_end = cpe['versionEndExcluding']
150
151 yield [cveId, vendor, product, v_start, op_start, v_end, op_end]
152
153 c.executemany("insert into PRODUCTS values (?, ?, ?, ?, ?, ?, ?)", cpe_generator())
154
155def update_db(c, jsondata):
156 import json
157 root = json.loads(jsondata)
158
159 for elt in root['CVE_Items']:
160 if not elt['impact']:
161 continue
162
163 accessVector = None
164 cveId = elt['cve']['CVE_data_meta']['ID']
165 cveDesc = elt['cve']['description']['description_data'][0]['value']
166 date = elt['lastModifiedDate']
167 try:
168 accessVector = elt['impact']['baseMetricV2']['cvssV2']['accessVector']
169 cvssv2 = elt['impact']['baseMetricV2']['cvssV2']['baseScore']
170 except KeyError:
171 cvssv2 = 0.0
172 try:
173 accessVector = accessVector or elt['impact']['baseMetricV3']['cvssV3']['attackVector']
174 cvssv3 = elt['impact']['baseMetricV3']['cvssV3']['baseScore']
175 except KeyError:
176 accessVector = accessVector or "UNKNOWN"
177 cvssv3 = 0.0
178
179 c.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?)",
180 [cveId, cveDesc, cvssv2, cvssv3, date, accessVector])
181
182 configurations = elt['configurations']['nodes']
183 for config in configurations:
184 parse_node_and_insert(c, config, cveId)
185
186
187addtask do_populate_cve_db before do_fetch
188do_populate_cve_db[nostamp] = "1"
189
190EXCLUDE_FROM_WORLD = "1"
diff --git a/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb b/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb
index 6a8748acdf..ee7d7cd660 100644
--- a/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb
+++ b/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb
@@ -15,12 +15,15 @@ DUMMYPROVIDES = "\
15 nativesdk-perl-module-file-find \ 15 nativesdk-perl-module-file-find \
16 nativesdk-perl-module-file-glob \ 16 nativesdk-perl-module-file-glob \
17 nativesdk-perl-module-file-path \ 17 nativesdk-perl-module-file-path \
18 nativesdk-perl-module-file-spec \
18 nativesdk-perl-module-file-stat \ 19 nativesdk-perl-module-file-stat \
19 nativesdk-perl-module-getopt-long \ 20 nativesdk-perl-module-getopt-long \
20 nativesdk-perl-module-io-file \ 21 nativesdk-perl-module-io-file \
22 nativesdk-perl-module-overloading \
21 nativesdk-perl-module-posix \ 23 nativesdk-perl-module-posix \
22 nativesdk-perl-module-thread-queue \ 24 nativesdk-perl-module-thread-queue \
23 nativesdk-perl-module-threads \ 25 nativesdk-perl-module-threads \
26 nativesdk-perl-module-warnings \
24 /usr/bin/perl \ 27 /usr/bin/perl \
25 " 28 "
26 29
diff --git a/meta/recipes-devtools/binutils/binutils/nativesdk-relocation.patch b/meta/recipes-devtools/binutils/binutils/nativesdk-relocation.patch
new file mode 100644
index 0000000000..408f7d18b7
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/nativesdk-relocation.patch
@@ -0,0 +1,80 @@
1We need binutils to look at our ld.so.conf file within the SDK to ensure
2we search the SDK's libdirs as well as those from the host system.
3
4We therefore pass in the directory to the code using a define, then add
5it to a section we relocate in a similar way to the way we relocate the
6gcc internal paths. This ensures that ld works correctly in our buildtools
7tarball.
8
9Standard sysroot relocation doesn't work since we're not in a sysroot,
10we want to use both the host system and SDK libs.
11
12Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
132020/1/17
14Upstream-Status: Inappropriate [OE specific tweak]
15
16Index: git/ld/Makefile.am
17===================================================================
18--- git.orig/ld/Makefile.am
19+++ git/ld/Makefile.am
20@@ -36,7 +36,8 @@ am__skipyacc =
21
22 ELF_CLFAGS=-DELF_LIST_OPTIONS=@elf_list_options@ \
23 -DELF_SHLIB_LIST_OPTIONS=@elf_shlib_list_options@ \
24- -DELF_PLT_UNWIND_LIST_OPTIONS=@elf_plt_unwind_list_options@
25+ -DELF_PLT_UNWIND_LIST_OPTIONS=@elf_plt_unwind_list_options@ \
26+ -DSYSCONFDIR="\"$(sysconfdir)\""
27 WARN_CFLAGS = @WARN_CFLAGS@
28 NO_WERROR = @NO_WERROR@
29 AM_CFLAGS = $(WARN_CFLAGS) $(ELF_CLFAGS)
30Index: git/ld/Makefile.in
31===================================================================
32--- git.orig/ld/Makefile.in
33+++ git/ld/Makefile.in
34@@ -546,7 +546,8 @@ am__skiplex =
35 am__skipyacc =
36 ELF_CLFAGS = -DELF_LIST_OPTIONS=@elf_list_options@ \
37 -DELF_SHLIB_LIST_OPTIONS=@elf_shlib_list_options@ \
38- -DELF_PLT_UNWIND_LIST_OPTIONS=@elf_plt_unwind_list_options@
39+ -DELF_PLT_UNWIND_LIST_OPTIONS=@elf_plt_unwind_list_options@ \
40+ -DSYSCONFDIR="\"$(sysconfdir)\""
41
42 AM_CFLAGS = $(WARN_CFLAGS) $(ELF_CLFAGS)
43 @ENABLE_PLUGINS_FALSE@PLUGIN_C =
44Index: git/ld/emultempl/elf32.em
45===================================================================
46--- git.orig/ld/emultempl/elf32.em
47+++ git/ld/emultempl/elf32.em
48@@ -1024,7 +1024,7 @@ gld${EMULATION_NAME}_check_ld_so_conf (c
49
50 info.path = NULL;
51 info.len = info.alloc = 0;
52- tmppath = concat (ld_sysroot, "${prefix}/etc/ld.so.conf",
53+ tmppath = concat (ld_sysconfdir, "/ld.so.conf",
54 (const char *) NULL);
55 if (!gld${EMULATION_NAME}_parse_ld_so_conf (&info, tmppath))
56 {
57Index: git/ld/ldmain.c
58===================================================================
59--- git.orig/ld/ldmain.c
60+++ git/ld/ldmain.c
61@@ -68,6 +68,7 @@ char *program_name;
62
63 /* The prefix for system library directories. */
64 const char *ld_sysroot;
65+char ld_sysconfdir[4096] __attribute__ ((section (".gccrelocprefix"))) = SYSCONFDIR;
66
67 /* The canonical representation of ld_sysroot. */
68 char *ld_canon_sysroot;
69Index: git/ld/ldmain.h
70===================================================================
71--- git.orig/ld/ldmain.h
72+++ git/ld/ldmain.h
73@@ -23,6 +23,7 @@
74
75 extern char *program_name;
76 extern const char *ld_sysroot;
77+extern char ld_sysconfdir[4096];
78 extern char *ld_canon_sysroot;
79 extern int ld_canon_sysroot_len;
80 extern FILE *saved_script_handle;
diff --git a/meta/recipes-devtools/binutils/binutils_2.31.bb b/meta/recipes-devtools/binutils/binutils_2.31.bb
index 51a9748906..625e18c787 100644
--- a/meta/recipes-devtools/binutils/binutils_2.31.bb
+++ b/meta/recipes-devtools/binutils/binutils_2.31.bb
@@ -46,4 +46,9 @@ do_install_class-native () {
46PACKAGE_BEFORE_PN += "libbfd" 46PACKAGE_BEFORE_PN += "libbfd"
47FILES_libbfd = "${libdir}/libbfd-*.so" 47FILES_libbfd = "${libdir}/libbfd-*.so"
48 48
49SRC_URI_append_class-nativesdk = "file://nativesdk-relocation.patch"
50
51USE_ALTERNATIVES_FOR_class-nativesdk = ""
52FILES_${PN}_append_class-nativesdk = " ${bindir}"
53
49BBCLASSEXTEND = "native nativesdk" 54BBCLASSEXTEND = "native nativesdk"
diff --git a/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb b/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb
deleted file mode 100644
index 1c84fb1cf2..0000000000
--- a/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb
+++ /dev/null
@@ -1,62 +0,0 @@
1SUMMARY = "cve-check-tool"
2DESCRIPTION = "cve-check-tool is a tool for checking known (public) CVEs.\
3The tool will identify potentially vunlnerable software packages within Linux distributions through version matching."
4HOMEPAGE = "https://github.com/ikeydoherty/cve-check-tool"
5SECTION = "Development/Tools"
6LICENSE = "GPL-2.0+"
7LIC_FILES_CHKSUM = "file://LICENSE;md5=e8c1458438ead3c34974bc0be3a03ed6"
8
9SRC_URI = "https://github.com/ikeydoherty/${BPN}/releases/download/v${PV}/${BP}.tar.xz \
10 file://check-for-malloc_trim-before-using-it.patch \
11 file://0001-print-progress-in-percent-when-downloading-CVE-db.patch \
12 file://0001-curl-allow-overriding-default-CA-certificate-file.patch \
13 file://0001-update-Compare-computed-vs-expected-sha256-digit-str.patch \
14 file://0001-Fix-freeing-memory-allocated-by-sqlite.patch \
15 "
16
17SRC_URI[md5sum] = "c5f4247140fc9be3bf41491d31a34155"
18SRC_URI[sha256sum] = "b8f283be718af8d31232ac1bfc10a0378fb958aaaa49af39168f8acf501e6a5b"
19
20UPSTREAM_CHECK_URI = "https://github.com/ikeydoherty/cve-check-tool/releases"
21
22DEPENDS = "libcheck glib-2.0 json-glib curl libxml2 sqlite3 openssl ca-certificates"
23
24RDEPENDS_${PN} = "ca-certificates"
25
26inherit pkgconfig autotools
27
28EXTRA_OECONF = "--disable-coverage --enable-relative-plugins"
29CFLAGS_append = " -Wno-error=pedantic"
30
31do_populate_cve_db() {
32 if [ "${BB_NO_NETWORK}" = "1" ] ; then
33 bbwarn "BB_NO_NETWORK is set; Can't update cve-check-tool database, new CVEs won't be detected"
34 return
35 fi
36
37 # In case we don't inherit cve-check class, use default values defined in the class.
38 cve_dir="${CVE_CHECK_DB_DIR}"
39 cve_file="${CVE_CHECK_TMP_FILE}"
40
41 [ -z "${cve_dir}" ] && cve_dir="${DL_DIR}/CVE_CHECK"
42 [ -z "${cve_file}" ] && cve_file="${TMPDIR}/cve_check"
43
44 unused="${@bb.utils.export_proxies(d)}"
45 bbdebug 2 "Updating cve-check-tool database located in $cve_dir"
46 # --cacert works around curl-native not finding the CA bundle
47 if cve-check-update --cacert ${sysconfdir}/ssl/certs/ca-certificates.crt -d "$cve_dir" ; then
48 printf "CVE database was updated on %s UTC\n\n" "$(LANG=C date --utc +'%F %T')" > "$cve_file"
49 else
50 bbwarn "Error in executing cve-check-update"
51 if [ "${@'1' if bb.data.inherits_class('cve-check', d) else '0'}" -ne 0 ] ; then
52 bbwarn "Failed to update cve-check-tool database, CVEs won't be checked"
53 fi
54 fi
55}
56
57addtask populate_cve_db after do_populate_sysroot
58do_populate_cve_db[depends] = "cve-check-tool-native:do_populate_sysroot"
59do_populate_cve_db[nostamp] = "1"
60do_populate_cve_db[progress] = "percent"
61
62BBCLASSEXTEND = "native nativesdk"
diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch b/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch
deleted file mode 100644
index 4a82cf2dde..0000000000
--- a/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch
+++ /dev/null
@@ -1,50 +0,0 @@
1From a3353429652f83bb8b0316500faa88fa2555542d Mon Sep 17 00:00:00 2001
2From: Peter Marko <peter.marko@siemens.com>
3Date: Thu, 13 Apr 2017 23:09:52 +0200
4Subject: [PATCH] Fix freeing memory allocated by sqlite
5
6Upstream-Status: Backport
7Signed-off-by: Peter Marko <peter.marko@siemens.com>
8---
9 src/core.c | 8 ++++----
10 1 file changed, 4 insertions(+), 4 deletions(-)
11
12diff --git a/src/core.c b/src/core.c
13index 6263031..6788f16 100644
14--- a/src/core.c
15+++ b/src/core.c
16@@ -82,7 +82,7 @@ static bool ensure_table(CveDB *self)
17 rc = sqlite3_exec(self->db, query, NULL, NULL, &err);
18 if (rc != SQLITE_OK) {
19 fprintf(stderr, "ensure_table(): %s\n", err);
20- free(err);
21+ sqlite3_free(err);
22 return false;
23 }
24
25@@ -91,7 +91,7 @@ static bool ensure_table(CveDB *self)
26 rc = sqlite3_exec(self->db, query, NULL, NULL, &err);
27 if (rc != SQLITE_OK) {
28 fprintf(stderr, "ensure_table(): %s\n", err);
29- free(err);
30+ sqlite3_free(err);
31 return false;
32 }
33
34@@ -99,11 +99,11 @@ static bool ensure_table(CveDB *self)
35 rc = sqlite3_exec(self->db, query, NULL, NULL, &err);
36 if (rc != SQLITE_OK) {
37 fprintf(stderr, "ensure_table(): %s\n", err);
38- free(err);
39+ sqlite3_free(err);
40 return false;
41 }
42 if (err) {
43- free(err);
44+ sqlite3_free(err);
45 }
46
47 return true;
48--
492.1.4
50
diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch b/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch
deleted file mode 100644
index 3d8ebd1bd2..0000000000
--- a/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch
+++ /dev/null
@@ -1,215 +0,0 @@
1From 825a9969dea052b02ba868bdf39e676349f10dce Mon Sep 17 00:00:00 2001
2From: Jussi Kukkonen <jussi.kukkonen@intel.com>
3Date: Thu, 9 Feb 2017 14:51:28 +0200
4Subject: [PATCH] curl: allow overriding default CA certificate file
5
6Similar to curl, --cacert can now be used in cve-check-tool and
7cve-check-update to override the default CA certificate file. Useful
8in cases where the system default is unsuitable (for example,
9out-dated) or broken (as in OE's current native libcurl, which embeds
10a path string from one build host and then uses it on another although
11the right path may have become something different).
12
13Upstream-Status: Submitted [https://github.com/ikeydoherty/cve-check-tool/pull/45]
14
15Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
16
17
18Took Patrick Ohlys original patch from meta-security-isafw, rebased
19on top of other patches.
20
21Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
22---
23 src/library/cve-check-tool.h | 1 +
24 src/library/fetch.c | 10 +++++++++-
25 src/library/fetch.h | 3 ++-
26 src/main.c | 5 ++++-
27 src/update-main.c | 4 +++-
28 src/update.c | 12 +++++++-----
29 src/update.h | 2 +-
30 7 files changed, 27 insertions(+), 10 deletions(-)
31
32diff --git a/src/library/cve-check-tool.h b/src/library/cve-check-tool.h
33index e4bb5b1..f89eade 100644
34--- a/src/library/cve-check-tool.h
35+++ b/src/library/cve-check-tool.h
36@@ -43,6 +43,7 @@ typedef struct CveCheckTool {
37 bool bugs; /**<Whether bug tracking is enabled */
38 GHashTable *mapping; /**<CVE Mapping */
39 const char *output_file; /**<Output file, if any */
40+ const char *cacert_file; /**<Non-default SSL certificate file, if any */
41 } CveCheckTool;
42
43 /**
44diff --git a/src/library/fetch.c b/src/library/fetch.c
45index 0fe6d76..8f998c3 100644
46--- a/src/library/fetch.c
47+++ b/src/library/fetch.c
48@@ -60,7 +60,8 @@ static int progress_callback_new(void *ptr, curl_off_t dltotal, curl_off_t dlnow
49 }
50
51 FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
52- unsigned int start_percent, unsigned int end_percent)
53+ unsigned int start_percent, unsigned int end_percent,
54+ const char *cacert_file)
55 {
56 FetchStatus ret = FETCH_STATUS_FAIL;
57 CURLcode res;
58@@ -74,6 +75,13 @@ FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
59 return ret;
60 }
61
62+ if (cacert_file) {
63+ res = curl_easy_setopt(curl, CURLOPT_CAINFO, cacert_file);
64+ if (res != CURLE_OK) {
65+ goto bail;
66+ }
67+ }
68+
69 if (stat(target, &st) == 0) {
70 res = curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
71 if (res != CURLE_OK) {
72diff --git a/src/library/fetch.h b/src/library/fetch.h
73index 4cce5d1..836c7d7 100644
74--- a/src/library/fetch.h
75+++ b/src/library/fetch.h
76@@ -29,7 +29,8 @@ typedef enum {
77 * @return A FetchStatus, indicating the operation taken
78 */
79 FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
80- unsigned int this_percent, unsigned int next_percent);
81+ unsigned int this_percent, unsigned int next_percent,
82+ const char *cacert_file);
83
84 /**
85 * Attempt to extract the given gzipped file
86diff --git a/src/main.c b/src/main.c
87index 8e6f158..ae69d47 100644
88--- a/src/main.c
89+++ b/src/main.c
90@@ -280,6 +280,7 @@ static bool csv_mode = false;
91 static char *modified_stamp = NULL;
92 static gchar *mapping_file = NULL;
93 static gchar *output_file = NULL;
94+static gchar *cacert_file = NULL;
95
96 static GOptionEntry _entries[] = {
97 { "not-patched", 'n', 0, G_OPTION_ARG_NONE, &hide_patched, "Hide patched/addressed CVEs", NULL },
98@@ -294,6 +295,7 @@ static GOptionEntry _entries[] = {
99 { "csv", 'c', 0, G_OPTION_ARG_NONE, &csv_mode, "Output CSV formatted data only", NULL },
100 { "mapping", 'M', 0, G_OPTION_ARG_STRING, &mapping_file, "Path to a mapping file", NULL},
101 { "output-file", 'o', 0, G_OPTION_ARG_STRING, &output_file, "Path to the output file (output plugin specific)", NULL},
102+ { "cacert", 'C', 0, G_OPTION_ARG_STRING, &cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL},
103 { .short_name = 0 }
104 };
105
106@@ -492,6 +494,7 @@ int main(int argc, char **argv)
107
108 quiet = csv_mode || !no_html;
109 self->output_file = output_file;
110+ self->cacert_file = cacert_file;
111
112 if (!csv_mode && self->output_file) {
113 quiet = false;
114@@ -530,7 +533,7 @@ int main(int argc, char **argv)
115 if (status) {
116 fprintf(stderr, "Update of db forced\n");
117 cve_db_unlock();
118- if (!update_db(quiet, db_path->str)) {
119+ if (!update_db(quiet, db_path->str, self->cacert_file)) {
120 fprintf(stderr, "DB update failure\n");
121 goto cleanup;
122 }
123diff --git a/src/update-main.c b/src/update-main.c
124index 2379cfa..c52d9d0 100644
125--- a/src/update-main.c
126+++ b/src/update-main.c
127@@ -43,11 +43,13 @@ the Free Software Foundation; either version 2 of the License, or\n\
128 static gchar *nvds = NULL;
129 static bool _show_version = false;
130 static bool _quiet = false;
131+static const char *_cacert_file = NULL;
132
133 static GOptionEntry _entries[] = {
134 { "nvd-dir", 'd', 0, G_OPTION_ARG_STRING, &nvds, "NVD directory in filesystem", NULL },
135 { "version", 'v', 0, G_OPTION_ARG_NONE, &_show_version, "Show version", NULL },
136 { "quiet", 'q', 0, G_OPTION_ARG_NONE, &_quiet, "Run silently", NULL },
137+ { "cacert", 'C', 0, G_OPTION_ARG_STRING, &_cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL},
138 { .short_name = 0 }
139 };
140
141@@ -88,7 +90,7 @@ int main(int argc, char **argv)
142 goto end;
143 }
144
145- if (update_db(_quiet, db_path->str)) {
146+ if (update_db(_quiet, db_path->str, _cacert_file)) {
147 ret = EXIT_SUCCESS;
148 } else {
149 fprintf(stderr, "Failed to update database\n");
150diff --git a/src/update.c b/src/update.c
151index 070560a..8cb4a39 100644
152--- a/src/update.c
153+++ b/src/update.c
154@@ -267,7 +267,8 @@ static inline void update_end(int fd, const char *update_fname, bool ok)
155
156 static int do_fetch_update(int year, const char *db_dir, CveDB *cve_db,
157 bool db_exist, bool verbose,
158- unsigned int this_percent, unsigned int next_percent)
159+ unsigned int this_percent, unsigned int next_percent,
160+ const char *cacert_file)
161 {
162 const char nvd_uri[] = URI_PREFIX;
163 autofree(cve_string) *uri_meta = NULL;
164@@ -331,14 +332,14 @@ refetch:
165 }
166
167 /* Fetch NVD META file */
168- st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent);
169+ st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent, cacert_file);
170 if (st == FETCH_STATUS_FAIL) {
171 fprintf(stderr, "Failed to fetch %s\n", uri_meta->str);
172 return -1;
173 }
174
175 /* Fetch NVD XML file */
176- st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent);
177+ st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent, cacert_file);
178 switch (st) {
179 case FETCH_STATUS_FAIL:
180 fprintf(stderr, "Failed to fetch %s\n", uri_data_gz->str);
181@@ -391,7 +392,7 @@ refetch:
182 return 0;
183 }
184
185-bool update_db(bool quiet, const char *db_file)
186+bool update_db(bool quiet, const char *db_file, const char *cacert_file)
187 {
188 autofree(char) *db_dir = NULL;
189 autofree(CveDB) *cve_db = NULL;
190@@ -466,7 +467,8 @@ bool update_db(bool quiet, const char *db_file)
191 if (!quiet)
192 fprintf(stderr, "completed: %u%%\r", start_percent);
193 rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet,
194- start_percent, end_percent);
195+ start_percent, end_percent,
196+ cacert_file);
197 switch (rc) {
198 case 0:
199 if (!quiet)
200diff --git a/src/update.h b/src/update.h
201index b8e9911..ceea0c3 100644
202--- a/src/update.h
203+++ b/src/update.h
204@@ -15,7 +15,7 @@ cve_string *get_db_path(const char *path);
205
206 int update_required(const char *db_file);
207
208-bool update_db(bool quiet, const char *db_file);
209+bool update_db(bool quiet, const char *db_file, const char *cacert_file);
210
211
212 /*
213--
2142.1.4
215
diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch b/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch
deleted file mode 100644
index 8ea6f686e3..0000000000
--- a/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch
+++ /dev/null
@@ -1,135 +0,0 @@
1From e9ed26cde63f8ca7607a010a518329339f8c02d3 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <git@andred.net>
3Date: Mon, 26 Sep 2016 12:12:41 +0100
4Subject: [PATCH] print progress in percent when downloading CVE db
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9Upstream-Status: Pending
10Signed-off-by: André Draszik <git@andred.net>
11---
12 src/library/fetch.c | 28 +++++++++++++++++++++++++++-
13 src/library/fetch.h | 3 ++-
14 src/update.c | 16 ++++++++++++----
15 3 files changed, 41 insertions(+), 6 deletions(-)
16
17diff --git a/src/library/fetch.c b/src/library/fetch.c
18index 06d4b30..0fe6d76 100644
19--- a/src/library/fetch.c
20+++ b/src/library/fetch.c
21@@ -37,13 +37,37 @@ static size_t write_func(void *ptr, size_t size, size_t nmemb, struct fetch_t *f
22 return fwrite(ptr, size, nmemb, f->f);
23 }
24
25-FetchStatus fetch_uri(const char *uri, const char *target, bool verbose)
26+struct percent_t {
27+ unsigned int start;
28+ unsigned int end;
29+};
30+
31+static int progress_callback_new(void *ptr, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow)
32+{
33+ (void) ultotal;
34+ (void) ulnow;
35+
36+ struct percent_t *percent = (struct percent_t *) ptr;
37+
38+ if (dltotal && percent && percent->end >= percent->start) {
39+ unsigned int diff = percent->end - percent->start;
40+ if (diff) {
41+ fprintf(stderr,"completed: %"CURL_FORMAT_CURL_OFF_T"%%\r", percent->start + (diff * dlnow / dltotal));
42+ }
43+ }
44+
45+ return 0;
46+}
47+
48+FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
49+ unsigned int start_percent, unsigned int end_percent)
50 {
51 FetchStatus ret = FETCH_STATUS_FAIL;
52 CURLcode res;
53 struct stat st;
54 CURL *curl = NULL;
55 struct fetch_t *f = NULL;
56+ struct percent_t percent = { .start = start_percent, .end = end_percent };
57
58 curl = curl_easy_init();
59 if (!curl) {
60@@ -67,6 +91,8 @@ FetchStatus fetch_uri(const char *uri, const char *target, bool verbose)
61 }
62 if (verbose) {
63 (void)curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
64+ (void)curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &percent);
65+ (void)curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_callback_new);
66 }
67 res = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)write_func);
68 if (res != CURLE_OK) {
69diff --git a/src/library/fetch.h b/src/library/fetch.h
70index 70c3779..4cce5d1 100644
71--- a/src/library/fetch.h
72+++ b/src/library/fetch.h
73@@ -28,7 +28,8 @@ typedef enum {
74 * @param verbose Whether to be verbose
75 * @return A FetchStatus, indicating the operation taken
76 */
77-FetchStatus fetch_uri(const char *uri, const char *target, bool verbose);
78+FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
79+ unsigned int this_percent, unsigned int next_percent);
80
81 /**
82 * Attempt to extract the given gzipped file
83diff --git a/src/update.c b/src/update.c
84index 30fbe96..eaeeefd 100644
85--- a/src/update.c
86+++ b/src/update.c
87@@ -266,7 +266,8 @@ static inline void update_end(int fd, const char *update_fname, bool ok)
88 }
89
90 static int do_fetch_update(int year, const char *db_dir, CveDB *cve_db,
91- bool db_exist, bool verbose)
92+ bool db_exist, bool verbose,
93+ unsigned int this_percent, unsigned int next_percent)
94 {
95 const char nvd_uri[] = URI_PREFIX;
96 autofree(cve_string) *uri_meta = NULL;
97@@ -330,14 +331,14 @@ refetch:
98 }
99
100 /* Fetch NVD META file */
101- st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose);
102+ st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent);
103 if (st == FETCH_STATUS_FAIL) {
104 fprintf(stderr, "Failed to fetch %s\n", uri_meta->str);
105 return -1;
106 }
107
108 /* Fetch NVD XML file */
109- st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose);
110+ st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent);
111 switch (st) {
112 case FETCH_STATUS_FAIL:
113 fprintf(stderr, "Failed to fetch %s\n", uri_data_gz->str);
114@@ -459,10 +460,17 @@ bool update_db(bool quiet, const char *db_file)
115 for (int i = YEAR_START; i <= year+1; i++) {
116 int y = i > year ? -1 : i;
117 int rc;
118+ unsigned int start_percent = ((i+0 - YEAR_START) * 100) / (year+2 - YEAR_START);
119+ unsigned int end_percent = ((i+1 - YEAR_START) * 100) / (year+2 - YEAR_START);
120
121- rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet);
122+ if (!quiet)
123+ fprintf(stderr, "completed: %u%%\r", start_percent);
124+ rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet,
125+ start_percent, end_percent);
126 switch (rc) {
127 case 0:
128+ if (!quiet)
129+ fprintf(stderr,"completed: %u%%\r", end_percent);
130 continue;
131 case ENOMEM:
132 goto oom;
133--
1342.9.3
135
diff --git a/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch b/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch
deleted file mode 100644
index 458c0cc84e..0000000000
--- a/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch
+++ /dev/null
@@ -1,52 +0,0 @@
1From b0426e63c9ac61657e029f689bcb8dd051e752c6 Mon Sep 17 00:00:00 2001
2From: Sergey Popovich <popovich_sergei@mail.ua>
3Date: Fri, 21 Apr 2017 07:32:23 -0700
4Subject: [PATCH] update: Compare computed vs expected sha256 digit string
5 ignoring case
6
7We produce sha256 digest string using %x snprintf()
8qualifier for each byte of digest which uses alphabetic
9characters from "a" to "f" in lower case to represent
10integer values from 10 to 15.
11
12Previously all of the NVD META files supply sha256
13digest string for corresponding XML file in lower case.
14
15However due to some reason this changed recently to
16provide digest digits in upper case causing fetched
17data consistency checks to fail. This prevents database
18from being updated periodically.
19
20While commit c4f6e94 (update: Do not treat sha256 failure
21as fatal if requested) adds useful option to skip
22digest validation at all and thus provides workaround for
23this situation, it might be unacceptable for some
24deployments where we need to ensure that downloaded
25data is consistent before start parsing it and update
26SQLite database.
27
28Use strcasecmp() to compare two digest strings case
29insensitively and addressing this case.
30
31Upstream-Status: Backport
32Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua>
33---
34 src/update.c | 2 +-
35 1 file changed, 1 insertion(+), 1 deletion(-)
36
37diff --git a/src/update.c b/src/update.c
38index 8588f38..3cc6b67 100644
39--- a/src/update.c
40+++ b/src/update.c
41@@ -187,7 +187,7 @@ static bool nvdcve_data_ok(const char *meta, const char *data)
42 snprintf(&csum_data[idx], len, "%02hhx", digest[i]);
43 }
44
45- ret = streq(csum_meta, csum_data);
46+ ret = !strcasecmp(csum_meta, csum_data);
47
48 err_unmap:
49 munmap(buffer, length);
50--
512.11.0
52
diff --git a/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch b/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch
deleted file mode 100644
index 0774ad946a..0000000000
--- a/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch
+++ /dev/null
@@ -1,51 +0,0 @@
1From ce64633b9733e962b8d8482244301f614d8b5845 Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com>
3Date: Mon, 22 Aug 2016 22:54:24 -0700
4Subject: [PATCH] Check for malloc_trim before using it
5
6malloc_trim is gnu specific and not all libc
7implement it, threfore write a configure check
8to poke for it first and use the define to
9guard its use.
10
11Helps in compiling on musl based systems
12
13Signed-off-by: Khem Raj <raj.khem@gmail.com>
14---
15Upstream-Status: Submitted [https://github.com/ikeydoherty/cve-check-tool/pull/48]
16 configure.ac | 2 ++
17 src/core.c | 4 ++--
18 2 files changed, 4 insertions(+), 2 deletions(-)
19
20diff --git a/configure.ac b/configure.ac
21index d3b66ce..79c3542 100644
22--- a/configure.ac
23+++ b/configure.ac
24@@ -19,6 +19,8 @@ m4_define([json_required_version], [0.16.0])
25 m4_define([openssl_required_version],[1.0.0])
26 # TODO: Set minimum sqlite
27
28+AC_CHECK_FUNCS_ONCE(malloc_trim)
29+
30 PKG_CHECK_MODULES(CVE_CHECK_TOOL,
31 [
32 glib-2.0 >= glib_required_version,
33diff --git a/src/core.c b/src/core.c
34index 6263031..0d5df29 100644
35--- a/src/core.c
36+++ b/src/core.c
37@@ -498,9 +498,9 @@ bool cve_db_load(CveDB *self, const char *fname)
38 }
39
40 b = true;
41-
42+#ifdef HAVE_MALLOC_TRIM
43 malloc_trim(0);
44-
45+#endif
46 xmlFreeTextReader(r);
47 if (fd) {
48 close(fd);
49--
502.9.3
51
diff --git a/meta/recipes-devtools/python/python3-testtools/no_traceback2.patch b/meta/recipes-devtools/python/python3-testtools/no_traceback2.patch
new file mode 100644
index 0000000000..594510342b
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-testtools/no_traceback2.patch
@@ -0,0 +1,23 @@
1traceback2 adds traceback for python2. Rather than depend on traceback2, we're
2python3 only so just use traceback.
3This caused breakage in oe-selftest -j which uses testtools on the autobuilder
4using buildtools-tarball.
5
6Upstream-Status: Inappropriate [Our recipe is python3 specific]
7(Once py2 is EOL upstream probably could/should take this)
8Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9
10Index: testtools-2.3.0/testtools/content.py
11===================================================================
12--- testtools-2.3.0.orig/testtools/content.py
13+++ testtools-2.3.0/testtools/content.py
14@@ -19,8 +19,7 @@ import os
15 import sys
16
17 from extras import try_import
18-# To let setup.py work, make this a conditional import.
19-traceback = try_import('traceback2')
20+import traceback
21
22 from testtools.compat import (
23 _b,
diff --git a/meta/recipes-devtools/python/python3-testtools_2.3.0.bb b/meta/recipes-devtools/python/python3-testtools_2.3.0.bb
index 896ecee65c..a254b90a75 100644
--- a/meta/recipes-devtools/python/python3-testtools_2.3.0.bb
+++ b/meta/recipes-devtools/python/python3-testtools_2.3.0.bb
@@ -1,2 +1,4 @@
1inherit setuptools3 1inherit setuptools3
2require python-testtools.inc 2require python-testtools.inc
3
4SRC_URI += "file://no_traceback2.patch"
diff --git a/meta/recipes-devtools/python/python3/0001-main.c-if-OEPYTHON3HOME-is-set-use-instead-of-PYTHON.patch b/meta/recipes-devtools/python/python3/0001-main.c-if-OEPYTHON3HOME-is-set-use-instead-of-PYTHON.patch
new file mode 100644
index 0000000000..48d4f73e9c
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/0001-main.c-if-OEPYTHON3HOME-is-set-use-instead-of-PYTHON.patch
@@ -0,0 +1,35 @@
1From ffe7797637f08cd6ee4c82e2d67462c5e194d30a Mon Sep 17 00:00:00 2001
2From: Jaewon Lee <jaewon.lee@xilinx.com>
3Date: Thu, 25 Apr 2019 15:34:26 -0700
4Subject: [PATCH] main.c: if OEPYTHON3HOME is set use instead of PYTHONHOME
5
6There is one variable PYTHONHOME to determine where libraries are coming
7from for both python2 and python3. This becomes an issue if only one has
8libraries in the specified PYTHONHOME path, but they are using the same
9PYTHONHOME. Creating another variable OEPYTHON3HOME to allow for a way
10to set a different path for python3
11
12Signed-off-by: Jaewon Lee <jaewon.lee@xilinx.com>
13RP: Backported to 3.5.6 (code totally different to original path for
14later python versions)
15Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
16
17---
18 Modules/main.c | 17 +++++++++++++----
19 1 file changed, 13 insertions(+), 4 deletions(-)
20
21Index: Python-3.5.6/Python/pylifecycle.c
22===================================================================
23--- Python-3.5.6.orig/Python/pylifecycle.c
24+++ Python-3.5.6/Python/pylifecycle.c
25@@ -864,7 +864,9 @@ Py_GetPythonHome(void)
26 {
27 wchar_t *home = default_home;
28 if (home == NULL && !Py_IgnoreEnvironmentFlag) {
29- char* chome = Py_GETENV("PYTHONHOME");
30+ char* chome = Py_GETENV("OEPYTHON3HOME");
31+ if (!chome)
32+ chome = Py_GETENV("PYTHONHOME");
33 if (chome) {
34 size_t size = Py_ARRAY_LENGTH(env_home);
35 size_t r = mbstowcs(env_home, chome, size);
diff --git a/meta/recipes-devtools/python/python3_3.5.6.bb b/meta/recipes-devtools/python/python3_3.5.6.bb
index b2f8a3d034..4633a3d239 100644
--- a/meta/recipes-devtools/python/python3_3.5.6.bb
+++ b/meta/recipes-devtools/python/python3_3.5.6.bb
@@ -50,6 +50,10 @@ SRC_URI += "\
50 file://CVE-2019-9636.patch \ 50 file://CVE-2019-9636.patch \
51 " 51 "
52 52
53SRC_URI_append_class-nativesdk = " \
54 file://0001-main.c-if-OEPYTHON3HOME-is-set-use-instead-of-PYTHON.patch \
55 "
56
53inherit multilib_header python3native update-alternatives qemu ptest 57inherit multilib_header python3native update-alternatives qemu ptest
54 58
55MULTILIB_SUFFIX = "${@d.getVar('base_libdir',1).split('/')[-1]}" 59MULTILIB_SUFFIX = "${@d.getVar('base_libdir',1).split('/')[-1]}"
@@ -184,7 +188,7 @@ do_install() {
184} 188}
185 189
186do_install_append_class-nativesdk () { 190do_install_append_class-nativesdk () {
187 create_wrapper ${D}${bindir}/python${PYTHON_MAJMIN} PYTHONHOME='${prefix}' TERMINFO_DIRS='${sysconfdir}/terminfo:/etc/terminfo:/usr/share/terminfo:/usr/share/misc/terminfo:/lib/terminfo' PYTHONNOUSERSITE='1' 191 create_wrapper ${D}${bindir}/python${PYTHON_MAJMIN} OEPYTHON3HOME='${prefix}' TERMINFO_DIRS='${sysconfdir}/terminfo:/etc/terminfo:/usr/share/terminfo:/usr/share/misc/terminfo:/lib/terminfo' PYTHONNOUSERSITE='1'
188} 192}
189 193
190SSTATE_SCAN_FILES += "Makefile" 194SSTATE_SCAN_FILES += "Makefile"
diff --git a/meta/recipes-devtools/qemu/qemu/0011-linux-user-remove-host-stime-syscall.patch b/meta/recipes-devtools/qemu/qemu/0011-linux-user-remove-host-stime-syscall.patch
new file mode 100644
index 0000000000..618ebcdc81
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0011-linux-user-remove-host-stime-syscall.patch
@@ -0,0 +1,62 @@
1From 0f1f2d4596aee037d3ccbcf10592466daa54107f Mon Sep 17 00:00:00 2001
2From: Laurent Vivier <laurent@vivier.eu>
3Date: Tue, 12 Nov 2019 15:25:56 +0100
4Subject: [PATCH] linux-user: remove host stime() syscall
5
6stime() has been withdrawn from glibc
7(12cbde1dae6f "Use clock_settime to implement stime; withdraw stime.")
8
9Implement the target stime() syscall using host
10clock_settime(CLOCK_REALTIME, ...) as it is done internally in glibc.
11
12Tested qemu-ppc/x86_64 with:
13
14 #include <time.h>
15 #include <stdio.h>
16
17 int main(void)
18 {
19 time_t t;
20 int ret;
21
22 /* date -u -d"2019-11-12T15:11:00" "+%s" */
23 t = 1573571460;
24 ret = stime(&t);
25 printf("ret %d\n", ret);
26 return 0;
27 }
28
29 # date; ./stime; date
30 Tue Nov 12 14:18:32 UTC 2019
31 ret 0
32 Tue Nov 12 15:11:00 UTC 2019
33
34Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=0f1f2d4596aee037d3ccbcf10592466daa54107f]
35Buglink: https://bugs.launchpad.net/qemu/+bug/1852115
36Reported-by: Cole Robinson <crobinso@redhat.com>
37Signed-off-by: Laurent Vivier <laurent@vivier.eu>
38Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
39Message-Id: <20191112142556.6335-1-laurent@vivier.eu>
40---
41 linux-user/syscall.c | 8 +++++---
42 1 file changed, 5 insertions(+), 3 deletions(-)
43
44Index: qemu-3.0.0/linux-user/syscall.c
45===================================================================
46--- qemu-3.0.0.orig/linux-user/syscall.c
47+++ qemu-3.0.0/linux-user/syscall.c
48@@ -8520,10 +8520,11 @@ abi_long do_syscall(void *cpu_env, int n
49 #ifdef TARGET_NR_stime /* not on alpha */
50 case TARGET_NR_stime:
51 {
52- time_t host_time;
53- if (get_user_sal(host_time, arg1))
54+ struct timespec ts;
55+ ts.tv_nsec = 0;
56+ if (get_user_sal(ts.tv_sec, arg1))
57 goto efault;
58- ret = get_errno(stime(&host_time));
59+ ret = get_errno(clock_settime(CLOCK_REALTIME, &ts));
60 }
61 break;
62 #endif
diff --git a/meta/recipes-devtools/qemu/qemu_3.0.0.bb b/meta/recipes-devtools/qemu/qemu_3.0.0.bb
index e483acab55..1daee7211f 100644
--- a/meta/recipes-devtools/qemu/qemu_3.0.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_3.0.0.bb
@@ -42,6 +42,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
42 file://CVE-2019-8934.patch \ 42 file://CVE-2019-8934.patch \
43 file://0001-linux-user-assume-__NR_gettid-always-exists.patch \ 43 file://0001-linux-user-assume-__NR_gettid-always-exists.patch \
44 file://0001-linux-user-rename-gettid-to-sys_gettid-to-avoid-clas.patch \ 44 file://0001-linux-user-rename-gettid-to-sys_gettid-to-avoid-clas.patch \
45 file://0011-linux-user-remove-host-stime-syscall.patch \
45 " 46 "
46UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 47UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
47 48
diff --git a/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p1.patch b/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p1.patch
new file mode 100644
index 0000000000..f954fac8fc
--- /dev/null
+++ b/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p1.patch
@@ -0,0 +1,170 @@
1Treat an ID of -1 as invalid since that means "no change".
2Fixes CVE-2019-14287.
3Found by Joe Vennix from Apple Information Security.
4
5CVE: CVE-2019-14287
6Upstream-Status: Backport
7[https://www.sudo.ws/repos/sudo/rev/83db8dba09e7]
8
9Signed-off-by: Dan Tran <dantran@microsoft.com>
10
11Index: sudo-1.8.21p2/lib/util/strtoid.c
12===================================================================
13--- sudo-1.8.21p2.orig/lib/util/strtoid.c 2019-10-10 14:31:08.338476078 -0400
14+++ sudo-1.8.21p2/lib/util/strtoid.c 2019-10-10 14:31:08.338476078 -0400
15@@ -42,6 +42,27 @@
16 #include "sudo_util.h"
17
18 /*
19+ * Make sure that the ID ends with a valid separator char.
20+ */
21+static bool
22+valid_separator(const char *p, const char *ep, const char *sep)
23+{
24+ bool valid = false;
25+ debug_decl(valid_separator, SUDO_DEBUG_UTIL)
26+
27+ if (ep != p) {
28+ /* check for valid separator (including '\0') */
29+ if (sep == NULL)
30+ sep = "";
31+ do {
32+ if (*ep == *sep)
33+ valid = true;
34+ } while (*sep++ != '\0');
35+ }
36+ debug_return_bool(valid);
37+}
38+
39+/*
40 * Parse a uid/gid in string form.
41 * If sep is non-NULL, it contains valid separator characters (e.g. comma, space)
42 * If endp is non-NULL it is set to the next char after the ID.
43@@ -55,36 +76,33 @@ sudo_strtoid_v1(const char *p, const cha
44 char *ep;
45 id_t ret = 0;
46 long long llval;
47- bool valid = false;
48 debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL)
49
50 /* skip leading space so we can pick up the sign, if any */
51 while (isspace((unsigned char)*p))
52 p++;
53- if (sep == NULL)
54- sep = "";
55+
56+ /* While id_t may be 64-bit signed, uid_t and gid_t are 32-bit unsigned. */
57 errno = 0;
58 llval = strtoll(p, &ep, 10);
59- if (ep != p) {
60- /* check for valid separator (including '\0') */
61- do {
62- if (*ep == *sep)
63- valid = true;
64- } while (*sep++ != '\0');
65+ if ((errno == ERANGE && llval == LLONG_MAX) || llval > (id_t)UINT_MAX) {
66+ errno = ERANGE;
67+ if (errstr != NULL)
68+ *errstr = N_("value too large");
69+ goto done;
70 }
71- if (!valid) {
72+ if ((errno == ERANGE && llval == LLONG_MIN) || llval < INT_MIN) {
73+ errno = ERANGE;
74 if (errstr != NULL)
75- *errstr = N_("invalid value");
76- errno = EINVAL;
77+ *errstr = N_("value too small");
78 goto done;
79 }
80- if (errno == ERANGE) {
81- if (errstr != NULL) {
82- if (llval == LLONG_MAX)
83- *errstr = N_("value too large");
84- else
85- *errstr = N_("value too small");
86- }
87+
88+ /* Disallow id -1, which means "no change". */
89+ if (!valid_separator(p, ep, sep) || llval == -1 || llval == (id_t)UINT_MAX) {
90+ if (errstr != NULL)
91+ *errstr = N_("invalid value");
92+ errno = EINVAL;
93 goto done;
94 }
95 ret = (id_t)llval;
96@@ -101,30 +119,15 @@ sudo_strtoid_v1(const char *p, const cha
97 {
98 char *ep;
99 id_t ret = 0;
100- bool valid = false;
101 debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL)
102
103 /* skip leading space so we can pick up the sign, if any */
104 while (isspace((unsigned char)*p))
105 p++;
106- if (sep == NULL)
107- sep = "";
108+
109 errno = 0;
110 if (*p == '-') {
111 long lval = strtol(p, &ep, 10);
112- if (ep != p) {
113- /* check for valid separator (including '\0') */
114- do {
115- if (*ep == *sep)
116- valid = true;
117- } while (*sep++ != '\0');
118- }
119- if (!valid) {
120- if (errstr != NULL)
121- *errstr = N_("invalid value");
122- errno = EINVAL;
123- goto done;
124- }
125 if ((errno == ERANGE && lval == LONG_MAX) || lval > INT_MAX) {
126 errno = ERANGE;
127 if (errstr != NULL)
128@@ -137,28 +140,31 @@ sudo_strtoid_v1(const char *p, const cha
129 *errstr = N_("value too small");
130 goto done;
131 }
132- ret = (id_t)lval;
133- } else {
134- unsigned long ulval = strtoul(p, &ep, 10);
135- if (ep != p) {
136- /* check for valid separator (including '\0') */
137- do {
138- if (*ep == *sep)
139- valid = true;
140- } while (*sep++ != '\0');
141- }
142- if (!valid) {
143+
144+ /* Disallow id -1, which means "no change". */
145+ if (!valid_separator(p, ep, sep) || lval == -1) {
146 if (errstr != NULL)
147 *errstr = N_("invalid value");
148 errno = EINVAL;
149 goto done;
150 }
151+ ret = (id_t)lval;
152+ } else {
153+ unsigned long ulval = strtoul(p, &ep, 10);
154 if ((errno == ERANGE && ulval == ULONG_MAX) || ulval > UINT_MAX) {
155 errno = ERANGE;
156 if (errstr != NULL)
157 *errstr = N_("value too large");
158 goto done;
159 }
160+
161+ /* Disallow id -1, which means "no change". */
162+ if (!valid_separator(p, ep, sep) || ulval == UINT_MAX) {
163+ if (errstr != NULL)
164+ *errstr = N_("invalid value");
165+ errno = EINVAL;
166+ goto done;
167+ }
168 ret = (id_t)ulval;
169 }
170 if (errstr != NULL)
diff --git a/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p2.patch b/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p2.patch
new file mode 100644
index 0000000000..dcb2703d23
--- /dev/null
+++ b/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p2.patch
@@ -0,0 +1,98 @@
1CVE: CVE-2019-14287
2Upstream-Status: Backport
3[https://www.sudo.ws/repos/sudo/rev/db06a8336c09]
4
5Signed-off-by: Dan Tran <dantran@microsoft.com>
6
7Index: sudo-1.8.21p2/lib/util/regress/atofoo/atofoo_test.c
8===================================================================
9--- sudo-1.8.21p2.orig/lib/util/regress/atofoo/atofoo_test.c 2019-10-11 07:11:49.874655384 -0400
10+++ sudo-1.8.21p2/lib/util/regress/atofoo/atofoo_test.c 2019-10-11 07:13:07.471005893 -0400
11@@ -24,6 +24,7 @@
12 #else
13 # include "compat/stdbool.h"
14 #endif
15+#include <errno.h>
16
17 #include "sudo_compat.h"
18 #include "sudo_util.h"
19@@ -78,15 +79,20 @@ static struct strtoid_data {
20 id_t id;
21 const char *sep;
22 const char *ep;
23+ int errnum;
24 } strtoid_data[] = {
25- { "0,1", 0, ",", "," },
26- { "10", 10, NULL, NULL },
27- { "-2", -2, NULL, NULL },
28+ { "0,1", 0, ",", ",", 0 },
29+ { "10", 10, NULL, NULL, 0 },
30+ { "-1", 0, NULL, NULL, EINVAL },
31+ { "4294967295", 0, NULL, NULL, EINVAL },
32+ { "4294967296", 0, NULL, NULL, ERANGE },
33+ { "-2147483649", 0, NULL, NULL, ERANGE },
34+ { "-2", -2, NULL, NULL, 0 },
35 #if SIZEOF_ID_T != SIZEOF_LONG_LONG
36- { "-2", 4294967294U, NULL, NULL },
37+ { "-2", (id_t)4294967294U, NULL, NULL, 0 },
38 #endif
39- { "4294967294", 4294967294U, NULL, NULL },
40- { NULL, 0, NULL, NULL }
41+ { "4294967294", (id_t)4294967294U, NULL, NULL, 0 },
42+ { NULL, 0, NULL, NULL, 0 }
43 };
44
45 static int
46@@ -102,11 +108,23 @@ test_strtoid(int *ntests)
47 (*ntests)++;
48 errstr = "some error";
49 value = sudo_strtoid(d->idstr, d->sep, &ep, &errstr);
50- if (errstr != NULL) {
51- if (d->id != (id_t)-1) {
52- sudo_warnx_nodebug("FAIL: %s: %s", d->idstr, errstr);
53+ if (d->errnum != 0) {
54+ if (errstr == NULL) {
55+ sudo_warnx_nodebug("FAIL: %s: missing errstr for errno %d",
56+ d->idstr, d->errnum);
57+ errors++;
58+ } else if (value != 0) {
59+ sudo_warnx_nodebug("FAIL: %s should return 0 on error",
60+ d->idstr);
61+ errors++;
62+ } else if (errno != d->errnum) {
63+ sudo_warnx_nodebug("FAIL: %s: errno mismatch, %d != %d",
64+ d->idstr, errno, d->errnum);
65 errors++;
66 }
67+ } else if (errstr != NULL) {
68+ sudo_warnx_nodebug("FAIL: %s: %s", d->idstr, errstr);
69+ errors++;
70 } else if (value != d->id) {
71 sudo_warnx_nodebug("FAIL: %s != %u", d->idstr, (unsigned int)d->id);
72 errors++;
73Index: sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.out.ok
74===================================================================
75--- sudo-1.8.21p2.orig/plugins/sudoers/regress/testsudoers/test5.out.ok 2019-10-11 07:11:49.874655384 -0400
76+++ sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.out.ok 2019-10-11 07:11:49.870655365 -0400
77@@ -4,7 +4,7 @@ Parse error in sudoers near line 1.
78 Entries for user root:
79
80 Command unmatched
81-testsudoers: test5.inc should be owned by gid 4294967295
82+testsudoers: test5.inc should be owned by gid 4294967294
83 Parse error in sudoers near line 1.
84
85 Entries for user root:
86Index: sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.sh
87===================================================================
88--- sudo-1.8.21p2.orig/plugins/sudoers/regress/testsudoers/test5.sh 2019-10-11 07:11:49.874655384 -0400
89+++ sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.sh 2019-10-11 07:11:49.870655365 -0400
90@@ -24,7 +24,7 @@ EOF
91
92 # Test group writable
93 chmod 664 $TESTFILE
94-./testsudoers -U $MYUID -G -1 root id <<EOF
95+./testsudoers -U $MYUID -G -2 root id <<EOF
96 #include $TESTFILE
97 EOF
98
diff --git a/meta/recipes-extended/sudo/sudo_1.8.23.bb b/meta/recipes-extended/sudo/sudo_1.8.23.bb
index ce32bd187e..d12cf2d549 100644
--- a/meta/recipes-extended/sudo/sudo_1.8.23.bb
+++ b/meta/recipes-extended/sudo/sudo_1.8.23.bb
@@ -3,6 +3,8 @@ require sudo.inc
3SRC_URI = "http://ftp.sudo.ws/sudo/dist/sudo-${PV}.tar.gz \ 3SRC_URI = "http://ftp.sudo.ws/sudo/dist/sudo-${PV}.tar.gz \
4 ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ 4 ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
5 file://0001-Include-sys-types.h-for-id_t-definition.patch \ 5 file://0001-Include-sys-types.h-for-id_t-definition.patch \
6 file://CVE-2019-14287_p1.patch \
7 file://CVE-2019-14287_p2.patch \
6 " 8 "
7 9
8PAM_SRC_URI = "file://sudo.pam" 10PAM_SRC_URI = "file://sudo.pam"
diff --git a/meta/recipes-extended/tar/tar/CVE-2018-20482.patch b/meta/recipes-extended/tar/tar/CVE-2018-20482.patch
new file mode 100644
index 0000000000..2a13148427
--- /dev/null
+++ b/meta/recipes-extended/tar/tar/CVE-2018-20482.patch
@@ -0,0 +1,405 @@
1From 331be56598b284d41370c67046df25673b040a55 Mon Sep 17 00:00:00 2001
2From: Sergey Poznyakoff <gray@gnu.org>
3Date: Thu, 27 Dec 2018 17:48:57 +0200
4Subject: [PATCH] Fix CVE-2018-20482
5
6* NEWS: Update.
7* src/sparse.c (sparse_dump_region): Handle short read condition.
8(sparse_extract_region,check_data_region): Fix dumped_size calculation.
9Handle short read condition.
10(pax_decode_header): Fix dumped_size calculation.
11* tests/Makefile.am: Add new testcases.
12* tests/testsuite.at: Likewise.
13
14* tests/sptrcreat.at: New file.
15* tests/sptrdiff00.at: New file.
16* tests/sptrdiff01.at: New file.
17
18CVE: CVE-2018-20482
19Upstream-Status: Backport
20[http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454]
21
22Signed-off-by: Dan Tran <dantran@microsoft.com>
23---
24 src/sparse.c | 50 +++++++++++++++++++++++++++++++-----
25 tests/Makefile.am | 5 +++-
26 tests/sptrcreat.at | 62 +++++++++++++++++++++++++++++++++++++++++++++
27 tests/sptrdiff00.at | 55 ++++++++++++++++++++++++++++++++++++++++
28 tests/sptrdiff01.at | 55 ++++++++++++++++++++++++++++++++++++++++
29 tests/testsuite.at | 5 +++-
30 6 files changed, 224 insertions(+), 8 deletions(-)
31 create mode 100644 tests/sptrcreat.at
32 create mode 100644 tests/sptrdiff00.at
33 create mode 100644 tests/sptrdiff01.at
34
35diff --git a/src/sparse.c b/src/sparse.c
36index 0830f62..e8e8259 100644
37--- a/src/sparse.c
38+++ b/src/sparse.c
39@@ -1,6 +1,6 @@
40 /* Functions for dealing with sparse files
41
42- Copyright 2003-2007, 2010, 2013-2017 Free Software Foundation, Inc.
43+ Copyright 2003-2007, 2010, 2013-2018 Free Software Foundation, Inc.
44
45 This program is free software; you can redistribute it and/or modify it
46 under the terms of the GNU General Public License as published by the
47@@ -427,6 +427,30 @@ sparse_dump_region (struct tar_sparse_file *file, size_t i)
48 bufsize);
49 return false;
50 }
51+ else if (bytes_read == 0)
52+ {
53+ char buf[UINTMAX_STRSIZE_BOUND];
54+ struct stat st;
55+ size_t n;
56+ if (fstat (file->fd, &st) == 0)
57+ n = file->stat_info->stat.st_size - st.st_size;
58+ else
59+ n = file->stat_info->stat.st_size
60+ - (file->stat_info->sparse_map[i].offset
61+ + file->stat_info->sparse_map[i].numbytes
62+ - bytes_left);
63+
64+ WARNOPT (WARN_FILE_SHRANK,
65+ (0, 0,
66+ ngettext ("%s: File shrank by %s byte; padding with zeros",
67+ "%s: File shrank by %s bytes; padding with zeros",
68+ n),
69+ quotearg_colon (file->stat_info->orig_file_name),
70+ STRINGIFY_BIGINT (n, buf)));
71+ if (! ignore_failed_read_option)
72+ set_exit_status (TAREXIT_DIFFERS);
73+ return false;
74+ }
75
76 memset (blk->buffer + bytes_read, 0, BLOCKSIZE - bytes_read);
77 bytes_left -= bytes_read;
78@@ -464,9 +488,9 @@ sparse_extract_region (struct tar_sparse_file *file, size_t i)
79 return false;
80 }
81 set_next_block_after (blk);
82+ file->dumped_size += BLOCKSIZE;
83 count = blocking_write (file->fd, blk->buffer, wrbytes);
84 write_size -= count;
85- file->dumped_size += count;
86 mv_size_left (file->stat_info->archive_file_size - file->dumped_size);
87 file->offset += count;
88 if (count != wrbytes)
89@@ -598,6 +622,12 @@ check_sparse_region (struct tar_sparse_file *file, off_t beg, off_t end)
90 rdsize);
91 return false;
92 }
93+ else if (bytes_read == 0)
94+ {
95+ report_difference (file->stat_info, _("Size differs"));
96+ return false;
97+ }
98+
99 if (!zero_block_p (diff_buffer, bytes_read))
100 {
101 char begbuf[INT_BUFSIZE_BOUND (off_t)];
102@@ -609,6 +639,7 @@ check_sparse_region (struct tar_sparse_file *file, off_t beg, off_t end)
103
104 beg += bytes_read;
105 }
106+
107 return true;
108 }
109
110@@ -635,6 +666,7 @@ check_data_region (struct tar_sparse_file *file, size_t i)
111 return false;
112 }
113 set_next_block_after (blk);
114+ file->dumped_size += BLOCKSIZE;
115 bytes_read = safe_read (file->fd, diff_buffer, rdsize);
116 if (bytes_read == SAFE_READ_ERROR)
117 {
118@@ -645,7 +677,11 @@ check_data_region (struct tar_sparse_file *file, size_t i)
119 rdsize);
120 return false;
121 }
122- file->dumped_size += bytes_read;
123+ else if (bytes_read == 0)
124+ {
125+ report_difference (&current_stat_info, _("Size differs"));
126+ return false;
127+ }
128 size_left -= bytes_read;
129 mv_size_left (file->stat_info->archive_file_size - file->dumped_size);
130 if (memcmp (blk->buffer, diff_buffer, rdsize))
131@@ -1213,7 +1249,8 @@ pax_decode_header (struct tar_sparse_file *file)
132 union block *blk;
133 char *p;
134 size_t i;
135-
136+ off_t start;
137+
138 #define COPY_BUF(b,buf,src) do \
139 { \
140 char *endp = b->buffer + BLOCKSIZE; \
141@@ -1229,7 +1266,6 @@ pax_decode_header (struct tar_sparse_file *file)
142 if (src == endp) \
143 { \
144 set_next_block_after (b); \
145- file->dumped_size += BLOCKSIZE; \
146 b = find_next_block (); \
147 if (!b) \
148 FATAL_ERROR ((0, 0, _("Unexpected EOF in archive"))); \
149@@ -1242,8 +1278,8 @@ pax_decode_header (struct tar_sparse_file *file)
150 dst[-1] = 0; \
151 } while (0)
152
153+ start = current_block_ordinal ();
154 set_next_block_after (current_header);
155- file->dumped_size += BLOCKSIZE;
156 blk = find_next_block ();
157 if (!blk)
158 FATAL_ERROR ((0, 0, _("Unexpected EOF in archive")));
159@@ -1282,6 +1318,8 @@ pax_decode_header (struct tar_sparse_file *file)
160 sparse_add_map (file->stat_info, &sp);
161 }
162 set_next_block_after (blk);
163+
164+ file->dumped_size += BLOCKSIZE * (current_block_ordinal () - start);
165 }
166
167 return true;
168diff --git a/tests/Makefile.am b/tests/Makefile.am
169index 2d7939d..ac3b6e7 100644
170--- a/tests/Makefile.am
171+++ b/tests/Makefile.am
172@@ -1,6 +1,6 @@
173 # Makefile for GNU tar regression tests.
174
175-# Copyright 1996-1997, 1999-2001, 2003-2007, 2009, 2012-2015 Free Software
176+# Copyright 1996-1997, 1999-2001, 2003-2007, 2009, 2012-2018 Free Software
177
178 # This file is part of GNU tar.
179
180@@ -228,6 +228,9 @@ TESTSUITE_AT = \
181 spmvp00.at\
182 spmvp01.at\
183 spmvp10.at\
184+ sptrcreat.at\
185+ sptrdiff00.at\
186+ sptrdiff01.at\
187 time01.at\
188 time02.at\
189 truncate.at\
190diff --git a/tests/sptrcreat.at b/tests/sptrcreat.at
191new file mode 100644
192index 0000000..8e28f0e
193--- /dev/null
194+++ b/tests/sptrcreat.at
195@@ -0,0 +1,62 @@
196+# Process this file with autom4te to create testsuite. -*- Autotest -*-
197+
198+# Test suite for GNU tar.
199+# Copyright 2018 Free Software Foundation, Inc.
200+
201+# This file is part of GNU tar.
202+
203+# GNU tar is free software; you can redistribute it and/or modify
204+# it under the terms of the GNU General Public License as published by
205+# the Free Software Foundation; either version 3 of the License, or
206+# (at your option) any later version.
207+
208+# GNU tar is distributed in the hope that it will be useful,
209+# but WITHOUT ANY WARRANTY; without even the implied warranty of
210+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
211+# GNU General Public License for more details.
212+
213+# You should have received a copy of the GNU General Public License
214+# along with this program. If not, see <http://www.gnu.org/licenses/>.
215+
216+# Tar up to 1.30 would loop endlessly if a sparse file had been truncated
217+# while being archived (with --sparse flag).
218+#
219+# The bug has been assigned id CVE-2018-20482 (on the grounds that it is a
220+# denial of service possibility).
221+#
222+# Reported by: Chris Siebenmann <cks.gnutar-01@cs.toronto.edu>
223+# References: <20181226223948.781EB32008E@apps1.cs.toronto.edu>,
224+# <http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html>
225+# <https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug>
226+# <https://nvd.nist.gov/vuln/detail/CVE-2018-20482>
227+
228+AT_SETUP([sparse file truncated while archiving])
229+AT_KEYWORDS([truncate filechange sparse sptr sptrcreat])
230+
231+AT_TAR_CHECK([
232+genfile --sparse --block-size=1024 --file foo \
233+ 0 ABCDEFGHIJ 1M ABCDEFGHIJ 10M ABCDEFGHIJ 200M ABCDEFGHIJ
234+genfile --file baz
235+genfile --run --checkpoint 3 --length 200m --truncate foo -- \
236+ tar --checkpoint=1 \
237+ --checkpoint-action=echo \
238+ --checkpoint-action=sleep=1 \
239+ --sparse -vcf bar foo baz
240+echo Exit status: $?
241+echo separator
242+genfile --file foo --seek 200m --length 11575296 --pattern=zeros
243+tar dvf bar],
244+[1],
245+[foo
246+baz
247+Exit status: 1
248+separator
249+foo
250+foo: Mod time differs
251+baz
252+],
253+[tar: foo: File shrank by 11575296 bytes; padding with zeros
254+],
255+[],[],[posix, gnu, oldgnu])
256+
257+AT_CLEANUP
258diff --git a/tests/sptrdiff00.at b/tests/sptrdiff00.at
259new file mode 100644
260index 0000000..c410561
261--- /dev/null
262+++ b/tests/sptrdiff00.at
263@@ -0,0 +1,55 @@
264+# Process this file with autom4te to create testsuite. -*- Autotest -*-
265+#
266+# Test suite for GNU tar.
267+# Copyright 2018 Free Software Foundation, Inc.
268+#
269+# This file is part of GNU tar.
270+#
271+# GNU tar is free software; you can redistribute it and/or modify
272+# it under the terms of the GNU General Public License as published by
273+# the Free Software Foundation; either version 3 of the License, or
274+# (at your option) any later version.
275+#
276+# GNU tar is distributed in the hope that it will be useful,
277+# but WITHOUT ANY WARRANTY; without even the implied warranty of
278+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
279+# GNU General Public License for more details.
280+#
281+# You should have received a copy of the GNU General Public License
282+# along with this program. If not, see <http://www.gnu.org/licenses/>.
283+
284+# While fixing CVE-2018-20482 (see sptrcreat.at) it has been discovered
285+# that similar bug exists in file checking code (tar d).
286+# This test case checks if tar correctly handles a short read condition
287+# appearing in check_sparse_region.
288+
289+AT_SETUP([file truncated in sparse region while comparing])
290+AT_KEYWORDS([truncate filechange sparse sptr sptrdiff diff])
291+
292+# This triggers short read in check_sparse_region.
293+AT_TAR_CHECK([
294+genfile --sparse --block-size=1024 --file foo \
295+ 0 ABCDEFGHIJ 1M ABCDEFGHIJ 10M ABCDEFGHIJ 200M ABCDEFGHIJ
296+genfile --file baz
297+echo creating
298+tar --sparse -vcf bar foo baz
299+echo comparing
300+genfile --run --checkpoint 3 --length 200m --truncate foo -- \
301+ tar --checkpoint=1 \
302+ --checkpoint-action=echo='Write checkpoint %u' \
303+ --checkpoint-action=sleep=1 \
304+ --sparse -vdf bar
305+],
306+[1],
307+[creating
308+foo
309+baz
310+comparing
311+foo
312+foo: Size differs
313+baz
314+],
315+[],
316+[],[],[posix, gnu, oldgnu])
317+
318+AT_CLEANUP
319diff --git a/tests/sptrdiff01.at b/tests/sptrdiff01.at
320new file mode 100644
321index 0000000..2da2267
322--- /dev/null
323+++ b/tests/sptrdiff01.at
324@@ -0,0 +1,55 @@
325+# Process this file with autom4te to create testsuite. -*- Autotest -*-
326+#
327+# Test suite for GNU tar.
328+# Copyright 2018 Free Software Foundation, Inc.
329+#
330+# This file is part of GNU tar.
331+#
332+# GNU tar is free software; you can redistribute it and/or modify
333+# it under the terms of the GNU General Public License as published by
334+# the Free Software Foundation; either version 3 of the License, or
335+# (at your option) any later version.
336+#
337+# GNU tar is distributed in the hope that it will be useful,
338+# but WITHOUT ANY WARRANTY; without even the implied warranty of
339+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
340+# GNU General Public License for more details.
341+#
342+# You should have received a copy of the GNU General Public License
343+# along with this program. If not, see <http://www.gnu.org/licenses/>.
344+
345+# While fixing CVE-2018-20482 (see sptrcreat.at) it has been discovered
346+# that similar bug exists in file checking code (tar d).
347+# This test case checks if tar correctly handles a short read condition
348+# appearing in check_data_region.
349+
350+AT_SETUP([file truncated in data region while comparing])
351+AT_KEYWORDS([truncate filechange sparse sptr sptrdiff diff])
352+
353+# This triggers short read in check_data_region.
354+AT_TAR_CHECK([
355+genfile --sparse --block-size=1024 --file foo \
356+ 0 ABCDEFGHIJ 1M ABCDEFGHIJ 10M ABCDEFGHIJ 200M ABCDEFGHIJ
357+genfile --file baz
358+echo creating
359+tar --sparse -vcf bar foo baz
360+echo comparing
361+genfile --run --checkpoint 5 --length 221278210 --truncate foo -- \
362+ tar --checkpoint=1 \
363+ --checkpoint-action=echo='Write checkpoint %u' \
364+ --checkpoint-action=sleep=1 \
365+ --sparse -vdf bar
366+],
367+[1],
368+[creating
369+foo
370+baz
371+comparing
372+foo
373+foo: Size differs
374+baz
375+],
376+[],
377+[],[],[posix, gnu, oldgnu])
378+
379+AT_CLEANUP
380diff --git a/tests/testsuite.at b/tests/testsuite.at
381index 2a83757..23386f7 100644
382--- a/tests/testsuite.at
383+++ b/tests/testsuite.at
384@@ -1,7 +1,7 @@
385 # Process this file with autom4te to create testsuite. -*- Autotest -*-
386
387 # Test suite for GNU tar.
388-# Copyright 2004-2008, 2010-2017 Free Software Foundation, Inc.
389+# Copyright 2004-2008, 2010-2018 Free Software Foundation, Inc.
390
391 # This file is part of GNU tar.
392
393@@ -405,6 +405,9 @@ m4_include([sparsemv.at])
394 m4_include([spmvp00.at])
395 m4_include([spmvp01.at])
396 m4_include([spmvp10.at])
397+m4_include([sptrcreat.at])
398+m4_include([sptrdiff00.at])
399+m4_include([sptrdiff01.at])
400
401 AT_BANNER([Updates])
402 m4_include([update.at])
403--
4042.22.0.vfs.1.1.57.gbaf16c8
405
diff --git a/meta/recipes-extended/tar/tar_1.30.bb b/meta/recipes-extended/tar/tar_1.30.bb
index ab1b33b378..7cf0522455 100644
--- a/meta/recipes-extended/tar/tar_1.30.bb
+++ b/meta/recipes-extended/tar/tar_1.30.bb
@@ -10,6 +10,7 @@ SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2 \
10 file://remove-gets.patch \ 10 file://remove-gets.patch \
11 file://musl_dirent.patch \ 11 file://musl_dirent.patch \
12 file://CVE-2019-9923.patch \ 12 file://CVE-2019-9923.patch \
13 file://CVE-2018-20482.patch \
13" 14"
14 15
15SRC_URI[md5sum] = "8404e4c1fc5a3000228ab2b8ad674a65" 16SRC_URI[md5sum] = "8404e4c1fc5a3000228ab2b8ad674a65"
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb b/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb
index 0ed290088a..de6f5c98bf 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_4.14.bb
@@ -11,13 +11,13 @@ python () {
11 raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") 11 raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
12} 12}
13 13
14SRCREV_machine ?= "72075349c6af55a7a6d024f0aa241711653fcb97" 14SRCREV_machine ?= "3aa9671ae072f45665e72591be5636522c8a6215"
15SRCREV_meta ?= "1bd749b7ce4240e83024b10fa4a4a6b9de5a5e5f" 15SRCREV_meta ?= "a889c43359ca8bee705601817c50edf3c209bc09"
16 16
17SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \ 17SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \
18 git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.14;destsuffix=${KMETA}" 18 git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.14;destsuffix=${KMETA}"
19 19
20LINUX_VERSION ?= "4.14.143" 20LINUX_VERSION ?= "4.14.154"
21 21
22DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" 22DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
23DEPENDS += "openssl-native util-linux-native" 23DEPENDS += "openssl-native util-linux-native"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb
index cb463074e1..52c02cad10 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_4.14.bb
@@ -4,7 +4,7 @@ KCONFIG_MODE = "--allnoconfig"
4 4
5require recipes-kernel/linux/linux-yocto.inc 5require recipes-kernel/linux/linux-yocto.inc
6 6
7LINUX_VERSION ?= "4.14.143" 7LINUX_VERSION ?= "4.14.154"
8 8
9DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" 9DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
10DEPENDS += "openssl-native util-linux-native" 10DEPENDS += "openssl-native util-linux-native"
@@ -12,8 +12,8 @@ DEPENDS += "openssl-native util-linux-native"
12KMETA = "kernel-meta" 12KMETA = "kernel-meta"
13KCONF_BSP_AUDIT_LEVEL = "2" 13KCONF_BSP_AUDIT_LEVEL = "2"
14 14
15SRCREV_machine ?= "3d884bc92763f474cc0728d1feb0becad8ed37d5" 15SRCREV_machine ?= "38c3a6549d60a3b4a5ab0cb6a440929ba8502f7f"
16SRCREV_meta ?= "1bd749b7ce4240e83024b10fa4a4a6b9de5a5e5f" 16SRCREV_meta ?= "a889c43359ca8bee705601817c50edf3c209bc09"
17 17
18PV = "${LINUX_VERSION}+git${SRCPV}" 18PV = "${LINUX_VERSION}+git${SRCPV}"
19 19
diff --git a/meta/recipes-kernel/linux/linux-yocto_4.14.bb b/meta/recipes-kernel/linux/linux-yocto_4.14.bb
index 4a92d27e78..0048735c01 100644
--- a/meta/recipes-kernel/linux/linux-yocto_4.14.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_4.14.bb
@@ -11,20 +11,20 @@ KBRANCH_qemux86 ?= "v4.14/standard/base"
11KBRANCH_qemux86-64 ?= "v4.14/standard/base" 11KBRANCH_qemux86-64 ?= "v4.14/standard/base"
12KBRANCH_qemumips64 ?= "v4.14/standard/mti-malta64" 12KBRANCH_qemumips64 ?= "v4.14/standard/mti-malta64"
13 13
14SRCREV_machine_qemuarm ?= "bd85f4880bb890bf9c45ee6c2fd95f077d2bf67e" 14SRCREV_machine_qemuarm ?= "e4e2990af921c2d1544d18efa5f7183f95289cd0"
15SRCREV_machine_qemuarm64 ?= "445a4787bd489eb6b3d5c172b9842dbe5a34d734" 15SRCREV_machine_qemuarm64 ?= "51c9e69ebef5d2d15dfbcdf098269d86e0e38317"
16SRCREV_machine_qemumips ?= "3d07ac9aa6ca729674dfb763563202f18f9eedde" 16SRCREV_machine_qemumips ?= "e70c76a3fe9cc785619d9e4c8e28cb4d4d76ecaf"
17SRCREV_machine_qemuppc ?= "81ba8dbab3b1bfc371e539956be905809db0e41a" 17SRCREV_machine_qemuppc ?= "6b6eab44d3a04294c233e0b47d6b7c6cbb6e9ffb"
18SRCREV_machine_qemux86 ?= "bc9d4b045fa0254d14ef3a667a200f02cb9af755" 18SRCREV_machine_qemux86 ?= "57278e88a6b0f7c6230f7429cab7e74229f2b7ce"
19SRCREV_machine_qemux86-64 ?= "bc9d4b045fa0254d14ef3a667a200f02cb9af755" 19SRCREV_machine_qemux86-64 ?= "57278e88a6b0f7c6230f7429cab7e74229f2b7ce"
20SRCREV_machine_qemumips64 ?= "3c4acadcbe2ee11043f7d0fce43a5181511d0935" 20SRCREV_machine_qemumips64 ?= "4e099e87d223bfc1526543a5e4c5383cb2edda70"
21SRCREV_machine ?= "bc9d4b045fa0254d14ef3a667a200f02cb9af755" 21SRCREV_machine ?= "57278e88a6b0f7c6230f7429cab7e74229f2b7ce"
22SRCREV_meta ?= "1bd749b7ce4240e83024b10fa4a4a6b9de5a5e5f" 22SRCREV_meta ?= "a889c43359ca8bee705601817c50edf3c209bc09"
23 23
24SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRANCH}; \ 24SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRANCH}; \
25 git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.14;destsuffix=${KMETA}" 25 git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.14;destsuffix=${KMETA}"
26 26
27LINUX_VERSION ?= "4.14.143" 27LINUX_VERSION ?= "4.14.154"
28 28
29DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" 29DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
30DEPENDS += "openssl-native util-linux-native" 30DEPENDS += "openssl-native util-linux-native"
diff --git a/meta/recipes-support/atk/at-spi2-core_2.28.0.bb b/meta/recipes-support/atk/at-spi2-core_2.28.0.bb
index 7975f58bad..0bdb1e37f3 100644
--- a/meta/recipes-support/atk/at-spi2-core_2.28.0.bb
+++ b/meta/recipes-support/atk/at-spi2-core_2.28.0.bb
@@ -18,7 +18,7 @@ inherit meson gtk-doc gettext systemd pkgconfig distro_features_check upstream-v
18REQUIRED_DISTRO_FEATURES = "x11" 18REQUIRED_DISTRO_FEATURES = "x11"
19 19
20EXTRA_OEMESON = " -Dsystemd_user_dir=${systemd_user_unitdir} \ 20EXTRA_OEMESON = " -Dsystemd_user_dir=${systemd_user_unitdir} \
21 -Ddbus_daemon=${bindir}" 21 -Ddbus_daemon=${bindir}/dbus-daemon"
22 22
23GTKDOC_ENABLE_FLAG = "-Denable_docs=true" 23GTKDOC_ENABLE_FLAG = "-Denable_docs=true"
24GTKDOC_DISABLE_FLAG = "-Denable_docs=false" 24GTKDOC_DISABLE_FLAG = "-Denable_docs=false"
diff --git a/meta/recipes-support/attr/attr_2.4.47.bb b/meta/recipes-support/attr/attr_2.4.47.bb
index fc88bef830..c3da66a0c7 100644
--- a/meta/recipes-support/attr/attr_2.4.47.bb
+++ b/meta/recipes-support/attr/attr_2.4.47.bb
@@ -12,4 +12,7 @@ SRC_URI += "file://attr-Missing-configure.ac.patch \
12SRC_URI[md5sum] = "84f58dec00b60f2dc8fd1c9709291cc7" 12SRC_URI[md5sum] = "84f58dec00b60f2dc8fd1c9709291cc7"
13SRC_URI[sha256sum] = "25772f653ac5b2e3ceeb89df50e4688891e21f723c460636548971652af0a859" 13SRC_URI[sha256sum] = "25772f653ac5b2e3ceeb89df50e4688891e21f723c460636548971652af0a859"
14 14
15# Has issues with newer versions of make
16PARALLEL_MAKEINST = ""
17
15BBCLASSEXTEND = "native nativesdk" 18BBCLASSEXTEND = "native nativesdk"
diff --git a/meta/recipes-support/iso-codes/iso-codes_4.1.bb b/meta/recipes-support/iso-codes/iso-codes_4.1.bb
index 1761ded44e..a70513033d 100644
--- a/meta/recipes-support/iso-codes/iso-codes_4.1.bb
+++ b/meta/recipes-support/iso-codes/iso-codes_4.1.bb
@@ -5,7 +5,7 @@ BUGTRACKER = "https://salsa.debian.org/iso-codes-team/iso-codes/issues"
5LICENSE = "LGPLv2.1" 5LICENSE = "LGPLv2.1"
6LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c" 6LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
7 7
8SRC_URI = "git://salsa.debian.org/iso-codes-team/iso-codes.git;protocol=http" 8SRC_URI = "git://salsa.debian.org/iso-codes-team/iso-codes.git;protocol=http;branch=main;"
9SRCREV = "164802d5fd8c7a8167816fd86a62b286680619f0" 9SRCREV = "164802d5fd8c7a8167816fd86a62b286680619f0"
10 10
11# inherit gettext cannot be used, because it adds gettext-native to BASEDEPENDS which 11# inherit gettext cannot be used, because it adds gettext-native to BASEDEPENDS which
diff --git a/meta/recipes-support/libgcrypt/files/CVE-2019-12904_p1.patch b/meta/recipes-support/libgcrypt/files/CVE-2019-12904_p1.patch
new file mode 100644
index 0000000000..cda52119ba
--- /dev/null
+++ b/meta/recipes-support/libgcrypt/files/CVE-2019-12904_p1.patch
@@ -0,0 +1,176 @@
1From 263ad8ae08f287e32656d4e3e0116479f3d9ad9d Mon Sep 17 00:00:00 2001
2From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
3Date: Fri, 31 May 2019 17:27:25 +0300
4Subject: [PATCH] GCM: move look-up table to .data section and unshare between processes
5Reply-To: shuagr@microsoft.com
6
7CVE: CVE-2019-12904_p1
8Upstream-Status: Backport
9Signed-off-by: Shubham Agrawal<shuagr@microsoft.com>
10Upstream-commit : https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020
11
12* cipher/cipher-gcm.c (ATTR_ALIGNED_64): New.
13(gcmR): Move to 'gcm_table' structure.
14(gcm_table): New structure for look-up table with counters before and
15after.
16(gcmR): New macro.
17(prefetch_table): Handle input with length not multiple of 256.
18(do_prefetch_tables): Modify pre- and post-table counters to unshare
19look-up table pages between processes.
20--
21GnuPG-bug-id: 4541
22Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
23---
24 cipher/cipher-gcm.c | 129 ++++++++++++++++++++++++++++++++++++++--------------
25 1 file changed, 95 insertions(+), 34 deletions(-)
26
27diff --git a/cipher/cipher-gcm.c b/cipher/cipher-gcm.c
28index 6169d14..97a8015 100644
29--- a/cipher/cipher-gcm.c
30+++ b/cipher/cipher-gcm.c
31@@ -30,6 +30,14 @@
32 #include "./cipher-internal.h"
33
34
35+/* Helper macro to force alignment to 16 or 64 bytes. */
36+#ifdef HAVE_GCC_ATTRIBUTE_ALIGNED
37+# define ATTR_ALIGNED_64 __attribute__ ((aligned (64)))
38+#else
39+# define ATTR_ALIGNED_64
40+#endif
41+
42+
43 #ifdef GCM_USE_INTEL_PCLMUL
44 extern void _gcry_ghash_setup_intel_pclmul (gcry_cipher_hd_t c);
45
46@@ -63,40 +71,93 @@ ghash_armv8_ce_pmull (gcry_cipher_hd_t c, byte *result, const byte *buf,
47
48
49 #ifdef GCM_USE_TABLES
50-static const u16 gcmR[256] = {
51- 0x0000, 0x01c2, 0x0384, 0x0246, 0x0708, 0x06ca, 0x048c, 0x054e,
52- 0x0e10, 0x0fd2, 0x0d94, 0x0c56, 0x0918, 0x08da, 0x0a9c, 0x0b5e,
53- 0x1c20, 0x1de2, 0x1fa4, 0x1e66, 0x1b28, 0x1aea, 0x18ac, 0x196e,
54- 0x1230, 0x13f2, 0x11b4, 0x1076, 0x1538, 0x14fa, 0x16bc, 0x177e,
55- 0x3840, 0x3982, 0x3bc4, 0x3a06, 0x3f48, 0x3e8a, 0x3ccc, 0x3d0e,
56- 0x3650, 0x3792, 0x35d4, 0x3416, 0x3158, 0x309a, 0x32dc, 0x331e,
57- 0x2460, 0x25a2, 0x27e4, 0x2626, 0x2368, 0x22aa, 0x20ec, 0x212e,
58- 0x2a70, 0x2bb2, 0x29f4, 0x2836, 0x2d78, 0x2cba, 0x2efc, 0x2f3e,
59- 0x7080, 0x7142, 0x7304, 0x72c6, 0x7788, 0x764a, 0x740c, 0x75ce,
60- 0x7e90, 0x7f52, 0x7d14, 0x7cd6, 0x7998, 0x785a, 0x7a1c, 0x7bde,
61- 0x6ca0, 0x6d62, 0x6f24, 0x6ee6, 0x6ba8, 0x6a6a, 0x682c, 0x69ee,
62- 0x62b0, 0x6372, 0x6134, 0x60f6, 0x65b8, 0x647a, 0x663c, 0x67fe,
63- 0x48c0, 0x4902, 0x4b44, 0x4a86, 0x4fc8, 0x4e0a, 0x4c4c, 0x4d8e,
64- 0x46d0, 0x4712, 0x4554, 0x4496, 0x41d8, 0x401a, 0x425c, 0x439e,
65- 0x54e0, 0x5522, 0x5764, 0x56a6, 0x53e8, 0x522a, 0x506c, 0x51ae,
66- 0x5af0, 0x5b32, 0x5974, 0x58b6, 0x5df8, 0x5c3a, 0x5e7c, 0x5fbe,
67- 0xe100, 0xe0c2, 0xe284, 0xe346, 0xe608, 0xe7ca, 0xe58c, 0xe44e,
68- 0xef10, 0xeed2, 0xec94, 0xed56, 0xe818, 0xe9da, 0xeb9c, 0xea5e,
69- 0xfd20, 0xfce2, 0xfea4, 0xff66, 0xfa28, 0xfbea, 0xf9ac, 0xf86e,
70- 0xf330, 0xf2f2, 0xf0b4, 0xf176, 0xf438, 0xf5fa, 0xf7bc, 0xf67e,
71- 0xd940, 0xd882, 0xdac4, 0xdb06, 0xde48, 0xdf8a, 0xddcc, 0xdc0e,
72- 0xd750, 0xd692, 0xd4d4, 0xd516, 0xd058, 0xd19a, 0xd3dc, 0xd21e,
73- 0xc560, 0xc4a2, 0xc6e4, 0xc726, 0xc268, 0xc3aa, 0xc1ec, 0xc02e,
74- 0xcb70, 0xcab2, 0xc8f4, 0xc936, 0xcc78, 0xcdba, 0xcffc, 0xce3e,
75- 0x9180, 0x9042, 0x9204, 0x93c6, 0x9688, 0x974a, 0x950c, 0x94ce,
76- 0x9f90, 0x9e52, 0x9c14, 0x9dd6, 0x9898, 0x995a, 0x9b1c, 0x9ade,
77- 0x8da0, 0x8c62, 0x8e24, 0x8fe6, 0x8aa8, 0x8b6a, 0x892c, 0x88ee,
78- 0x83b0, 0x8272, 0x8034, 0x81f6, 0x84b8, 0x857a, 0x873c, 0x86fe,
79- 0xa9c0, 0xa802, 0xaa44, 0xab86, 0xaec8, 0xaf0a, 0xad4c, 0xac8e,
80- 0xa7d0, 0xa612, 0xa454, 0xa596, 0xa0d8, 0xa11a, 0xa35c, 0xa29e,
81- 0xb5e0, 0xb422, 0xb664, 0xb7a6, 0xb2e8, 0xb32a, 0xb16c, 0xb0ae,
82- 0xbbf0, 0xba32, 0xb874, 0xb9b6, 0xbcf8, 0xbd3a, 0xbf7c, 0xbebe,
83-};
84+static struct
85+{
86+ volatile u32 counter_head;
87+ u32 cacheline_align[64 / 4 - 1];
88+ u16 R[256];
89+ volatile u32 counter_tail;
90+} gcm_table ATTR_ALIGNED_64 =
91+ {
92+ 0,
93+ { 0, },
94+ {
95+ 0x0000, 0x01c2, 0x0384, 0x0246, 0x0708, 0x06ca, 0x048c, 0x054e,
96+ 0x0e10, 0x0fd2, 0x0d94, 0x0c56, 0x0918, 0x08da, 0x0a9c, 0x0b5e,
97+ 0x1c20, 0x1de2, 0x1fa4, 0x1e66, 0x1b28, 0x1aea, 0x18ac, 0x196e,
98+ 0x1230, 0x13f2, 0x11b4, 0x1076, 0x1538, 0x14fa, 0x16bc, 0x177e,
99+ 0x3840, 0x3982, 0x3bc4, 0x3a06, 0x3f48, 0x3e8a, 0x3ccc, 0x3d0e,
100+ 0x3650, 0x3792, 0x35d4, 0x3416, 0x3158, 0x309a, 0x32dc, 0x331e,
101+ 0x2460, 0x25a2, 0x27e4, 0x2626, 0x2368, 0x22aa, 0x20ec, 0x212e,
102+ 0x2a70, 0x2bb2, 0x29f4, 0x2836, 0x2d78, 0x2cba, 0x2efc, 0x2f3e,
103+ 0x7080, 0x7142, 0x7304, 0x72c6, 0x7788, 0x764a, 0x740c, 0x75ce,
104+ 0x7e90, 0x7f52, 0x7d14, 0x7cd6, 0x7998, 0x785a, 0x7a1c, 0x7bde,
105+ 0x6ca0, 0x6d62, 0x6f24, 0x6ee6, 0x6ba8, 0x6a6a, 0x682c, 0x69ee,
106+ 0x62b0, 0x6372, 0x6134, 0x60f6, 0x65b8, 0x647a, 0x663c, 0x67fe,
107+ 0x48c0, 0x4902, 0x4b44, 0x4a86, 0x4fc8, 0x4e0a, 0x4c4c, 0x4d8e,
108+ 0x46d0, 0x4712, 0x4554, 0x4496, 0x41d8, 0x401a, 0x425c, 0x439e,
109+ 0x54e0, 0x5522, 0x5764, 0x56a6, 0x53e8, 0x522a, 0x506c, 0x51ae,
110+ 0x5af0, 0x5b32, 0x5974, 0x58b6, 0x5df8, 0x5c3a, 0x5e7c, 0x5fbe,
111+ 0xe100, 0xe0c2, 0xe284, 0xe346, 0xe608, 0xe7ca, 0xe58c, 0xe44e,
112+ 0xef10, 0xeed2, 0xec94, 0xed56, 0xe818, 0xe9da, 0xeb9c, 0xea5e,
113+ 0xfd20, 0xfce2, 0xfea4, 0xff66, 0xfa28, 0xfbea, 0xf9ac, 0xf86e,
114+ 0xf330, 0xf2f2, 0xf0b4, 0xf176, 0xf438, 0xf5fa, 0xf7bc, 0xf67e,
115+ 0xd940, 0xd882, 0xdac4, 0xdb06, 0xde48, 0xdf8a, 0xddcc, 0xdc0e,
116+ 0xd750, 0xd692, 0xd4d4, 0xd516, 0xd058, 0xd19a, 0xd3dc, 0xd21e,
117+ 0xc560, 0xc4a2, 0xc6e4, 0xc726, 0xc268, 0xc3aa, 0xc1ec, 0xc02e,
118+ 0xcb70, 0xcab2, 0xc8f4, 0xc936, 0xcc78, 0xcdba, 0xcffc, 0xce3e,
119+ 0x9180, 0x9042, 0x9204, 0x93c6, 0x9688, 0x974a, 0x950c, 0x94ce,
120+ 0x9f90, 0x9e52, 0x9c14, 0x9dd6, 0x9898, 0x995a, 0x9b1c, 0x9ade,
121+ 0x8da0, 0x8c62, 0x8e24, 0x8fe6, 0x8aa8, 0x8b6a, 0x892c, 0x88ee,
122+ 0x83b0, 0x8272, 0x8034, 0x81f6, 0x84b8, 0x857a, 0x873c, 0x86fe,
123+ 0xa9c0, 0xa802, 0xaa44, 0xab86, 0xaec8, 0xaf0a, 0xad4c, 0xac8e,
124+ 0xa7d0, 0xa612, 0xa454, 0xa596, 0xa0d8, 0xa11a, 0xa35c, 0xa29e,
125+ 0xb5e0, 0xb422, 0xb664, 0xb7a6, 0xb2e8, 0xb32a, 0xb16c, 0xb0ae,
126+ 0xbbf0, 0xba32, 0xb874, 0xb9b6, 0xbcf8, 0xbd3a, 0xbf7c, 0xbebe,
127+ },
128+ 0
129+ };
130+
131+#define gcmR gcm_table.R
132+static inline
133+void prefetch_table(const void *tab, size_t len)
134+{
135+ const volatile byte *vtab = tab;
136+ size_t i;
137+
138+ for (i = 0; len - i >= 8 * 32; i += 8 * 32)
139+ {
140+ (void)vtab[i + 0 * 32];
141+ (void)vtab[i + 1 * 32];
142+ (void)vtab[i + 2 * 32];
143+ (void)vtab[i + 3 * 32];
144+ (void)vtab[i + 4 * 32];
145+ (void)vtab[i + 5 * 32];
146+ (void)vtab[i + 6 * 32];
147+ (void)vtab[i + 7 * 32];
148+ }
149+ for (; i < len; i += 32)
150+ {
151+ (void)vtab[i];
152+ }
153+
154+ (void)vtab[len - 1];
155+}
156+
157+static inline void
158+do_prefetch_tables (const void *gcmM, size_t gcmM_size)
159+{
160+ /* Modify counters to trigger copy-on-write and unsharing if physical pages
161+ * of look-up table are shared between processes. Modifying counters also
162+ * causes checksums for pages to change and hint same-page merging algorithm
163+ * that these pages are frequently changing. */
164+ gcm_table.counter_head++;
165+ gcm_table.counter_tail++;
166+
167+ /* Prefetch look-up tables to cache. */
168+ prefetch_table(gcmM, gcmM_size);
169+ prefetch_table(&gcm_table, sizeof(gcm_table));
170+}
171
172 #ifdef GCM_TABLES_USE_U64
173 static void
174--
1752.7.4
176
diff --git a/meta/recipes-support/libgcrypt/files/CVE-2019-12904_p2.patch b/meta/recipes-support/libgcrypt/files/CVE-2019-12904_p2.patch
new file mode 100644
index 0000000000..0cb503ed65
--- /dev/null
+++ b/meta/recipes-support/libgcrypt/files/CVE-2019-12904_p2.patch
@@ -0,0 +1,330 @@
1From a5c359cc68a4def9bf39f63070837d89711b4e17 Mon Sep 17 00:00:00 2001
2From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
3Date: Fri, 31 May 2019 17:18:09 +0300
4Subject: [PATCH] AES: move look-up tables to .data section and unshare between processes
5Reply-To: shuagr@microsoft.com
6
7CVE: CVE-2019-12904_p2
8Upstream-status: Backport
9Signed-off-by: Shubham Agrawal<shuagr@microsoft.com>
10Upstream-commit: https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762
11
12* cipher/rijndael-internal.h (ATTR_ALIGNED_64): New.
13* cipher/rijndael-tables.h (encT): Move to 'enc_tables' structure.
14(enc_tables): New structure for encryption table with counters before
15and after.
16(encT): New macro.
17(dec_tables): Add counters before and after encryption table; Move
18from .rodata to .data section.
19(do_encrypt): Change 'encT' to 'enc_tables.T'.
20(do_decrypt): Change '&dec_tables' to 'dec_tables.T'.
21* cipher/cipher-gcm.c (prefetch_table): Make inline; Handle input
22with length not multiple of 256.
23(prefetch_enc, prefetch_dec): Modify pre- and post-table counters
24to unshare look-up table pages between processes.
25--
26
27GnuPG-bug-id: 4541
28Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
29---
30 cipher/rijndael-internal.h | 4 +-
31 cipher/rijndael-tables.h | 155 +++++++++++++++++++++++++--------------------
32 cipher/rijndael.c | 35 ++++++++--
33 3 files changed, 118 insertions(+), 76 deletions(-)
34
35diff --git a/cipher/rijndael-internal.h b/cipher/rijndael-internal.h
36index 160fb8c..a62d4b7 100644
37--- a/cipher/rijndael-internal.h
38+++ b/cipher/rijndael-internal.h
39@@ -29,11 +29,13 @@
40 #define BLOCKSIZE (128/8)
41
42
43-/* Helper macro to force alignment to 16 bytes. */
44+/* Helper macro to force alignment to 16 or 64 bytes. */
45 #ifdef HAVE_GCC_ATTRIBUTE_ALIGNED
46 # define ATTR_ALIGNED_16 __attribute__ ((aligned (16)))
47+# define ATTR_ALIGNED_64 __attribute__ ((aligned (64)))
48 #else
49 # define ATTR_ALIGNED_16
50+# define ATTR_ALIGNED_64
51 #endif
52
53
54diff --git a/cipher/rijndael-tables.h b/cipher/rijndael-tables.h
55index 8359470..b54d959 100644
56--- a/cipher/rijndael-tables.h
57+++ b/cipher/rijndael-tables.h
58@@ -21,80 +21,98 @@
59 /* To keep the actual implementation at a readable size we use this
60 include file to define the tables. */
61
62-static const u32 encT[256] =
63+static struct
64+{
65+ volatile u32 counter_head;
66+ u32 cacheline_align[64 / 4 - 1];
67+ u32 T[256];
68+ volatile u32 counter_tail;
69+} enc_tables ATTR_ALIGNED_64 =
70 {
71- 0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6,
72- 0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591,
73- 0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56,
74- 0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec,
75- 0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa,
76- 0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb,
77- 0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45,
78- 0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b,
79- 0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c,
80- 0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83,
81- 0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9,
82- 0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a,
83- 0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d,
84- 0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f,
85- 0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df,
86- 0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea,
87- 0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34,
88- 0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b,
89- 0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d,
90- 0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413,
91- 0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1,
92- 0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6,
93- 0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972,
94- 0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85,
95- 0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed,
96- 0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511,
97- 0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe,
98- 0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b,
99- 0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05,
100- 0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1,
101- 0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142,
102- 0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf,
103- 0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3,
104- 0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e,
105- 0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a,
106- 0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6,
107- 0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3,
108- 0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b,
109- 0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428,
110- 0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad,
111- 0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14,
112- 0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8,
113- 0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4,
114- 0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2,
115- 0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda,
116- 0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949,
117- 0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf,
118- 0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810,
119- 0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c,
120- 0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697,
121- 0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e,
122- 0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f,
123- 0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc,
124- 0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c,
125- 0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969,
126- 0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27,
127- 0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122,
128- 0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433,
129- 0xb69b9b2d, 0x221e1e3c, 0x92878715, 0x20e9e9c9,
130- 0x49cece87, 0xff5555aa, 0x78282850, 0x7adfdfa5,
131- 0x8f8c8c03, 0xf8a1a159, 0x80898909, 0x170d0d1a,
132- 0xdabfbf65, 0x31e6e6d7, 0xc6424284, 0xb86868d0,
133- 0xc3414182, 0xb0999929, 0x772d2d5a, 0x110f0f1e,
134- 0xcbb0b07b, 0xfc5454a8, 0xd6bbbb6d, 0x3a16162c
135+ 0,
136+ { 0, },
137+ {
138+ 0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6,
139+ 0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591,
140+ 0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56,
141+ 0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec,
142+ 0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa,
143+ 0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb,
144+ 0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45,
145+ 0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b,
146+ 0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c,
147+ 0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83,
148+ 0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9,
149+ 0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a,
150+ 0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d,
151+ 0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f,
152+ 0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df,
153+ 0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea,
154+ 0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34,
155+ 0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b,
156+ 0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d,
157+ 0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413,
158+ 0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1,
159+ 0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6,
160+ 0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972,
161+ 0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85,
162+ 0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed,
163+ 0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511,
164+ 0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe,
165+ 0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b,
166+ 0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05,
167+ 0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1,
168+ 0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142,
169+ 0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf,
170+ 0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3,
171+ 0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e,
172+ 0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a,
173+ 0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6,
174+ 0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3,
175+ 0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b,
176+ 0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428,
177+ 0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad,
178+ 0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14,
179+ 0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8,
180+ 0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4,
181+ 0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2,
182+ 0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda,
183+ 0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949,
184+ 0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf,
185+ 0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810,
186+ 0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c,
187+ 0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697,
188+ 0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e,
189+ 0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f,
190+ 0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc,
191+ 0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c,
192+ 0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969,
193+ 0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27,
194+ 0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122,
195+ 0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433,
196+ 0xb69b9b2d, 0x221e1e3c, 0x92878715, 0x20e9e9c9,
197+ 0x49cece87, 0xff5555aa, 0x78282850, 0x7adfdfa5,
198+ 0x8f8c8c03, 0xf8a1a159, 0x80898909, 0x170d0d1a,
199+ 0xdabfbf65, 0x31e6e6d7, 0xc6424284, 0xb86868d0,
200+ 0xc3414182, 0xb0999929, 0x772d2d5a, 0x110f0f1e,
201+ 0xcbb0b07b, 0xfc5454a8, 0xd6bbbb6d, 0x3a16162c
202+ },
203+ 0
204 };
205
206-static const struct
207+#define encT enc_tables.T
208+
209+static struct
210 {
211+ volatile u32 counter_head;
212+ u32 cacheline_align[64 / 4 - 1];
213 u32 T[256];
214 byte inv_sbox[256];
215-} dec_tables =
216+ volatile u32 counter_tail;
217+} dec_tables ATTR_ALIGNED_64 =
218 {
219+ 0,
220+ { 0, },
221 {
222 0x50a7f451, 0x5365417e, 0xc3a4171a, 0x965e273a,
223 0xcb6bab3b, 0xf1459d1f, 0xab58faac, 0x9303e34b,
224@@ -194,7 +212,8 @@ static const struct
225 0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61,
226 0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26,
227 0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d
228- }
229+ },
230+ 0
231 };
232
233 #define decT dec_tables.T
234diff --git a/cipher/rijndael.c b/cipher/rijndael.c
235index 8637195..d0edab2 100644
236--- a/cipher/rijndael.c
237+++ b/cipher/rijndael.c
238@@ -227,11 +227,11 @@ static const char *selftest(void);
239
240
241 /* Prefetching for encryption/decryption tables. */
242-static void prefetch_table(const volatile byte *tab, size_t len)
243+static inline void prefetch_table(const volatile byte *tab, size_t len)
244 {
245 size_t i;
246
247- for (i = 0; i < len; i += 8 * 32)
248+ for (i = 0; len - i >= 8 * 32; i += 8 * 32)
249 {
250 (void)tab[i + 0 * 32];
251 (void)tab[i + 1 * 32];
252@@ -242,17 +242,37 @@ static void prefetch_table(const volatile byte *tab, size_t len)
253 (void)tab[i + 6 * 32];
254 (void)tab[i + 7 * 32];
255 }
256+ for (; i < len; i += 32)
257+ {
258+ (void)tab[i];
259+ }
260
261 (void)tab[len - 1];
262 }
263
264 static void prefetch_enc(void)
265 {
266- prefetch_table((const void *)encT, sizeof(encT));
267+ /* Modify counters to trigger copy-on-write and unsharing if physical pages
268+ * of look-up table are shared between processes. Modifying counters also
269+ * causes checksums for pages to change and hint same-page merging algorithm
270+ * that these pages are frequently changing. */
271+ enc_tables.counter_head++;
272+ enc_tables.counter_tail++;
273+
274+ /* Prefetch look-up tables to cache. */
275+ prefetch_table((const void *)&enc_tables, sizeof(enc_tables));
276 }
277
278 static void prefetch_dec(void)
279 {
280+ /* Modify counters to trigger copy-on-write and unsharing if physical pages
281+ * of look-up table are shared between processes. Modifying counters also
282+ * causes checksums for pages to change and hint same-page merging algorithm
283+ * that these pages are frequently changing. */
284+ dec_tables.counter_head++;
285+ dec_tables.counter_tail++;
286+
287+ /* Prefetch look-up tables to cache. */
288 prefetch_table((const void *)&dec_tables, sizeof(dec_tables));
289 }
290
291@@ -737,7 +757,7 @@ do_encrypt (const RIJNDAEL_context *ctx,
292 #ifdef USE_AMD64_ASM
293 # ifdef HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS
294 return _gcry_aes_amd64_encrypt_block(ctx->keyschenc, bx, ax, ctx->rounds,
295- encT);
296+ enc_tables.T);
297 # else
298 /* Call SystemV ABI function without storing non-volatile XMM registers,
299 * as target function does not use vector instruction sets. */
300@@ -757,7 +777,8 @@ do_encrypt (const RIJNDAEL_context *ctx,
301 return ret;
302 # endif /* HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS */
303 #elif defined(USE_ARM_ASM)
304- return _gcry_aes_arm_encrypt_block(ctx->keyschenc, bx, ax, ctx->rounds, encT);
305+ return _gcry_aes_arm_encrypt_block(ctx->keyschenc, bx, ax, ctx->rounds,
306+ enc_tables.T);
307 #else
308 return do_encrypt_fn (ctx, bx, ax);
309 #endif /* !USE_ARM_ASM && !USE_AMD64_ASM*/
310@@ -1120,7 +1141,7 @@ do_decrypt (const RIJNDAEL_context *ctx, unsigned char *bx,
311 #ifdef USE_AMD64_ASM
312 # ifdef HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS
313 return _gcry_aes_amd64_decrypt_block(ctx->keyschdec, bx, ax, ctx->rounds,
314- &dec_tables);
315+ dec_tables.T);
316 # else
317 /* Call SystemV ABI function without storing non-volatile XMM registers,
318 * as target function does not use vector instruction sets. */
319@@ -1141,7 +1162,7 @@ do_decrypt (const RIJNDAEL_context *ctx, unsigned char *bx,
320 # endif /* HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS */
321 #elif defined(USE_ARM_ASM)
322 return _gcry_aes_arm_decrypt_block(ctx->keyschdec, bx, ax, ctx->rounds,
323- &dec_tables);
324+ dec_tables.T);
325 #else
326 return do_decrypt_fn (ctx, bx, ax);
327 #endif /*!USE_ARM_ASM && !USE_AMD64_ASM*/
328--
3292.7.4
330
diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb
index fda68a2938..13d037880b 100644
--- a/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb
+++ b/meta/recipes-support/libgcrypt/libgcrypt_1.8.4.bb
@@ -21,6 +21,8 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \
21 file://0003-tests-bench-slope.c-workaround-ICE-failure-on-mips-w.patch \ 21 file://0003-tests-bench-slope.c-workaround-ICE-failure-on-mips-w.patch \
22 file://0002-libgcrypt-fix-building-error-with-O2-in-sysroot-path.patch \ 22 file://0002-libgcrypt-fix-building-error-with-O2-in-sysroot-path.patch \
23 file://0004-tests-Makefile.am-fix-undefined-reference-to-pthread.patch \ 23 file://0004-tests-Makefile.am-fix-undefined-reference-to-pthread.patch \
24 file://CVE-2019-12904_p1.patch \
25 file://CVE-2019-12904_p2.patch \
24" 26"
25SRC_URI[md5sum] = "fbfdaebbbc6d7e5fbbf6ffdb3e139573" 27SRC_URI[md5sum] = "fbfdaebbbc6d7e5fbbf6ffdb3e139573"
26SRC_URI[sha256sum] = "f638143a0672628fde0cad745e9b14deb85dffb175709cacc1f4fe24b93f2227" 28SRC_URI[sha256sum] = "f638143a0672628fde0cad745e9b14deb85dffb175709cacc1f4fe24b93f2227"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-03 22:51:46 +0000