From d9a5006a73ead66c1dc9f39a55bd43dce5b1f177 Mon Sep 17 00:00:00 2001 From: Leonardo Sandoval Date: Thu, 12 Oct 2017 11:35:23 -0700 Subject: ruby: upgrade to 2.4.2 The CVE-2017-14064 patch is already at 2.4.2 as explained on project's commit, so removing from the recipe & repo. commit 83735ba29a0bfdaffa8e9c2a1dc025c3b0b63153 Author: hsbt Date: Wed Apr 12 00:21:18 2017 +0000 Merge json-2.0.4. * https://github.com/flori/json/releases/tag/v2.0.4 * https://github.com/flori/json/blob/09fabeb03e73ed88dc8ce8f19d76ac59e51dae20/CHANGES.md#2017-03-23-204 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58323 b2dd03c8-39d4-4d8f-98ff-823fe69b080e (From OE-Core rev: 6e37a88af155d5e5453fb0f44bb11d6f8e406438) (From OE-Core rev: 59fed1c288bc8d5549fffccedcc24ae9f4f32dac) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../ruby/ruby/ruby-CVE-2017-14064.patch | 87 ---------------------- meta/recipes-devtools/ruby/ruby_2.4.1.bb | 53 ------------- meta/recipes-devtools/ruby/ruby_2.4.2.bb | 52 +++++++++++++ 3 files changed, 52 insertions(+), 140 deletions(-) delete mode 100644 meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-14064.patch delete mode 100644 meta/recipes-devtools/ruby/ruby_2.4.1.bb create mode 100644 meta/recipes-devtools/ruby/ruby_2.4.2.bb diff --git a/meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-14064.patch b/meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-14064.patch deleted file mode 100644 index 88e693c94e..0000000000 --- a/meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-14064.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 8f782fd8e181d9cfe9387ded43a5ca9692266b85 Mon Sep 17 00:00:00 2001 -From: Florian Frank -Date: Thu, 2 Mar 2017 12:12:33 +0100 -Subject: [PATCH] Fix arbitrary heap exposure problem - -Upstream-Status: Backport -CVE: CVE-2017-14064 - -Signed-off-by: Ovidiu Panait ---- - ext/json/generator/generator.c | 12 ++++++------ - ext/json/generator/generator.h | 1 - - 2 files changed, 6 insertions(+), 7 deletions(-) - -diff --git a/ext/json/generator/generator.c b/ext/json/generator/generator.c -index ef85bb7..c88818c 100644 ---- a/ext/json/generator/generator.c -+++ b/ext/json/generator/generator.c -@@ -308,7 +308,7 @@ static char *fstrndup(const char *ptr, unsigned long len) { - char *result; - if (len <= 0) return NULL; - result = ALLOC_N(char, len); -- memccpy(result, ptr, 0, len); -+ memcpy(result, ptr, len); - return result; - } - -@@ -1062,7 +1062,7 @@ static VALUE cState_indent_set(VALUE self, VALUE indent) - } - } else { - if (state->indent) ruby_xfree(state->indent); -- state->indent = strdup(RSTRING_PTR(indent)); -+ state->indent = fstrndup(RSTRING_PTR(indent), len); - state->indent_len = len; - } - return Qnil; -@@ -1100,7 +1100,7 @@ static VALUE cState_space_set(VALUE self, VALUE space) - } - } else { - if (state->space) ruby_xfree(state->space); -- state->space = strdup(RSTRING_PTR(space)); -+ state->space = fstrndup(RSTRING_PTR(space), len); - state->space_len = len; - } - return Qnil; -@@ -1136,7 +1136,7 @@ static VALUE cState_space_before_set(VALUE self, VALUE space_before) - } - } else { - if (state->space_before) ruby_xfree(state->space_before); -- state->space_before = strdup(RSTRING_PTR(space_before)); -+ state->space_before = fstrndup(RSTRING_PTR(space_before), len); - state->space_before_len = len; - } - return Qnil; -@@ -1173,7 +1173,7 @@ static VALUE cState_object_nl_set(VALUE self, VALUE object_nl) - } - } else { - if (state->object_nl) ruby_xfree(state->object_nl); -- state->object_nl = strdup(RSTRING_PTR(object_nl)); -+ state->object_nl = fstrndup(RSTRING_PTR(object_nl), len); - state->object_nl_len = len; - } - return Qnil; -@@ -1208,7 +1208,7 @@ static VALUE cState_array_nl_set(VALUE self, VALUE array_nl) - } - } else { - if (state->array_nl) ruby_xfree(state->array_nl); -- state->array_nl = strdup(RSTRING_PTR(array_nl)); -+ state->array_nl = fstrndup(RSTRING_PTR(array_nl), len); - state->array_nl_len = len; - } - return Qnil; -diff --git a/ext/json/generator/generator.h b/ext/json/generator/generator.h -index 900b4d5..c367a62 100644 ---- a/ext/json/generator/generator.h -+++ b/ext/json/generator/generator.h -@@ -1,7 +1,6 @@ - #ifndef _GENERATOR_H_ - #define _GENERATOR_H_ - --#include - #include - #include - --- -2.10.2 - diff --git a/meta/recipes-devtools/ruby/ruby_2.4.1.bb b/meta/recipes-devtools/ruby/ruby_2.4.1.bb deleted file mode 100644 index 7d27ac84ec..0000000000 --- a/meta/recipes-devtools/ruby/ruby_2.4.1.bb +++ /dev/null @@ -1,53 +0,0 @@ -require ruby.inc - -SRC_URI += " \ - file://ruby-CVE-2017-9224.patch \ - file://ruby-CVE-2017-9226.patch \ - file://ruby-CVE-2017-9227.patch \ - file://ruby-CVE-2017-9228.patch \ - file://ruby-CVE-2017-9229.patch \ - file://ruby-CVE-2017-14064.patch \ - " - -SRC_URI[md5sum] = "782bca562e474dd25956dd0017d92677" -SRC_URI[sha256sum] = "a330e10d5cb5e53b3a0078326c5731888bb55e32c4abfeb27d9e7f8e5d000250" - -# it's unknown to configure script, but then passed to extconf.rb -# maybe it's not really needed as we're hardcoding the result with -# 0001-socket-extconf-hardcode-wide-getaddr-info-test-outco.patch -UNKNOWN_CONFIGURE_WHITELIST += "--enable-wide-getaddrinfo" - -PACKAGECONFIG ??= "" -PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" - -PACKAGECONFIG[valgrind] = "--with-valgrind=yes, --with-valgrind=no, valgrind" -PACKAGECONFIG[gpm] = "--with-gmp=yes, --with-gmp=no, gmp" -PACKAGECONFIG[ipv6] = ",--enable-wide-getaddrinfo," - -EXTRA_AUTORECONF += "--exclude=aclocal" - -EXTRA_OECONF = "\ - --disable-versioned-paths \ - --disable-rpath \ - --disable-dtrace \ - --enable-shared \ - --enable-load-relative \ -" - -do_install() { - oe_runmake 'DESTDIR=${D}' install -} - -PACKAGES =+ "${PN}-ri-docs ${PN}-rdoc" - -SUMMARY_${PN}-ri-docs = "ri (Ruby Interactive) documentation for the Ruby standard library" -RDEPENDS_${PN}-ri-docs = "${PN}" -FILES_${PN}-ri-docs += "${datadir}/ri" - -SUMMARY_${PN}-rdoc = "RDoc documentation generator from Ruby source" -RDEPENDS_${PN}-rdoc = "${PN}" -FILES_${PN}-rdoc += "${libdir}/ruby/*/rdoc ${bindir}/rdoc" - -FILES_${PN} += "${datadir}/rubygems" - -BBCLASSEXTEND = "native" diff --git a/meta/recipes-devtools/ruby/ruby_2.4.2.bb b/meta/recipes-devtools/ruby/ruby_2.4.2.bb new file mode 100644 index 0000000000..b471154a22 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby_2.4.2.bb @@ -0,0 +1,52 @@ +require ruby.inc + +SRC_URI += " \ + file://ruby-CVE-2017-9224.patch \ + file://ruby-CVE-2017-9226.patch \ + file://ruby-CVE-2017-9227.patch \ + file://ruby-CVE-2017-9228.patch \ + file://ruby-CVE-2017-9229.patch \ + " + +SRC_URI[md5sum] = "fe106eed9738c4e03813ab904f8d891c" +SRC_URI[sha256sum] = "93b9e75e00b262bc4def6b26b7ae8717efc252c47154abb7392e54357e6c8c9c" + +# it's unknown to configure script, but then passed to extconf.rb +# maybe it's not really needed as we're hardcoding the result with +# 0001-socket-extconf-hardcode-wide-getaddr-info-test-outco.patch +UNKNOWN_CONFIGURE_WHITELIST += "--enable-wide-getaddrinfo" + +PACKAGECONFIG ??= "" +PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" + +PACKAGECONFIG[valgrind] = "--with-valgrind=yes, --with-valgrind=no, valgrind" +PACKAGECONFIG[gpm] = "--with-gmp=yes, --with-gmp=no, gmp" +PACKAGECONFIG[ipv6] = ",--enable-wide-getaddrinfo," + +EXTRA_AUTORECONF += "--exclude=aclocal" + +EXTRA_OECONF = "\ + --disable-versioned-paths \ + --disable-rpath \ + --disable-dtrace \ + --enable-shared \ + --enable-load-relative \ +" + +do_install() { + oe_runmake 'DESTDIR=${D}' install +} + +PACKAGES =+ "${PN}-ri-docs ${PN}-rdoc" + +SUMMARY_${PN}-ri-docs = "ri (Ruby Interactive) documentation for the Ruby standard library" +RDEPENDS_${PN}-ri-docs = "${PN}" +FILES_${PN}-ri-docs += "${datadir}/ri" + +SUMMARY_${PN}-rdoc = "RDoc documentation generator from Ruby source" +RDEPENDS_${PN}-rdoc = "${PN}" +FILES_${PN}-rdoc += "${libdir}/ruby/*/rdoc ${bindir}/rdoc" + +FILES_${PN} += "${datadir}/rubygems" + +BBCLASSEXTEND = "native" -- cgit v1.2.3-54-g00ecf