summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/ruby
diff options
context:
space:
mode:
authorYogita Urade <yogita.urade@windriver.com>2024-10-07 11:27:42 +0000
committerSteve Sakoman <steve@sakoman.com>2024-10-18 06:04:40 -0700
commit0402f54b66438ec6e9f06f02652e148dce6480b3 (patch)
treeb9f4f00fd3798f29b7b356934ef07a3b561b9884 /meta/recipes-devtools/ruby
parent711c93422918d1810e652e75405b9f9ad6f01167 (diff)
downloadpoky-0402f54b66438ec6e9f06f02652e148dce6480b3.tar.gz
ruby: upgrade 3.2.2 -> 3.3.5
Includes fix for CVE-2024-41123 & CVE-2024-41946 Release notes: https://github.com/ruby/ruby/releases/tag/v3_3_5 Rebase: 0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch 0006-Make-gemspecs-reproducible.patch Drop: 0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch 0002-Obey-LDFLAGS-for-the-link-of-libruby.patch CVE-2023-36617_1.patch CVE-2023-36617_2.patch CVE-2024-27281.patch CVE-2024-27282.patch (merged upstream) 0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch 0002-template-Makefile.in-filter-out-f-prefix-map.patch remove_has_include_macros.patch (code rewritten upstream) License-Update: Updated LEGAL section (From OE-Core rev: 69ffe5bc09260918fb32bfcb29586dcaa1958a5c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-devtools/ruby')
-rw-r--r--meta/recipes-devtools/ruby/ruby/0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch52
-rw-r--r--meta/recipes-devtools/ruby/ruby/0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch32
-rw-r--r--meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch25
-rw-r--r--meta/recipes-devtools/ruby/ruby/0002-template-Makefile.in-filter-out-f-prefix-map.patch42
-rw-r--r--meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch26
-rw-r--r--meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch18
-rw-r--r--meta/recipes-devtools/ruby/ruby/CVE-2023-36617_1.patch56
-rw-r--r--meta/recipes-devtools/ruby/ruby/CVE-2023-36617_2.patch52
-rw-r--r--meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch97
-rw-r--r--meta/recipes-devtools/ruby/ruby/CVE-2024-27282.patch28
-rw-r--r--meta/recipes-devtools/ruby/ruby/remove_has_include_macros.patch35
-rw-r--r--meta/recipes-devtools/ruby/ruby_3.3.5.bb (renamed from meta/recipes-devtools/ruby/ruby_3.2.2.bb)13
12 files changed, 25 insertions, 451 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch b/meta/recipes-devtools/ruby/ruby/0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch
deleted file mode 100644
index 1dff9c0f8c..0000000000
--- a/meta/recipes-devtools/ruby/ruby/0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch
+++ /dev/null
@@ -1,52 +0,0 @@
1From 6b3c202b46b9312c5bb0789145f13d8086e70948 Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com>
3Date: Sun, 15 Jan 2023 02:34:17 -0800
4Subject: [PATCH] fiddle: Use C11 _Alignof to define ALIGN_OF when possible
5
6WG14 N2350 made very clear that it is an UB having type definitions
7within "offsetof" [1]. This patch enhances the implementation of macro
8ALIGN_OF to use builtin "_Alignof" to avoid undefined behavior
9when using std=c11 or newer
10
11clang 16+ has started to flag this [2]
12
13Fixes build when using -std >= gnu11 and using clang16+
14
15Older compilers gcc < 4.9 or clang < 8 has buggy _Alignof even though it
16may support C11, exclude those compiler versions
17
18[1] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2350.htm
19[2] https://reviews.llvm.org/D133574
20
21Upstream-Status: Submitted [https://github.com/ruby/fiddle/pull/120]
22Signed-off-by: Khem Raj <raj.khem@gmail.com>
23---
24 ext/fiddle/fiddle.h | 12 +++++++++++-
25 1 file changed, 11 insertions(+), 1 deletion(-)
26
27diff --git a/ext/fiddle/fiddle.h b/ext/fiddle/fiddle.h
28index 10eb9ce..ffb395e 100644
29--- a/ext/fiddle/fiddle.h
30+++ b/ext/fiddle/fiddle.h
31@@ -196,7 +196,17 @@
32 #endif
33 #define TYPE_UINTPTR_T (-TYPE_INTPTR_T)
34
35-#define ALIGN_OF(type) offsetof(struct {char align_c; type align_x;}, align_x)
36+/* GCC releases before GCC 4.9 had a bug in _Alignof. See GCC bug 52023
37+ <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52023>.
38+ clang versions < 8.0.0 have the same bug. */
39+#if (!defined __STDC_VERSION__ || __STDC_VERSION__ < 201112 \
40+ || (defined __GNUC__ && __GNUC__ < 4 + (__GNUC_MINOR__ < 9) \
41+ && !defined __clang__) \
42+ || (defined __clang__ && __clang_major__ < 8))
43+# define ALIGN_OF(type) offsetof(struct {char align_c; type align_x;}, align_x)
44+#else
45+# define ALIGN_OF(type) _Alignof(type)
46+#endif
47
48 #define ALIGN_VOIDP ALIGN_OF(void*)
49 #define ALIGN_CHAR ALIGN_OF(char)
50--
512.39.0
52
diff --git a/meta/recipes-devtools/ruby/ruby/0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch b/meta/recipes-devtools/ruby/ruby/0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch
deleted file mode 100644
index 226ef3af75..0000000000
--- a/meta/recipes-devtools/ruby/ruby/0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch
+++ /dev/null
@@ -1,32 +0,0 @@
1From 2368d07660a93a2c41d63f3ab6054ca4daeef820 Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex.kanavin@gmail.com>
3Date: Tue, 17 Nov 2020 18:31:40 +0000
4Subject: [PATCH] template/Makefile.in: do not write host cross-cc items into
5 target config
6
7This helps reproducibility.
8
9Upstream-Status: Inappropriate [oe-core specific]
10Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
11---
12 template/Makefile.in | 4 ++--
13 1 file changed, 2 insertions(+), 2 deletions(-)
14
15diff --git a/template/Makefile.in b/template/Makefile.in
16index 10dc826..940ee07 100644
17--- a/template/Makefile.in
18+++ b/template/Makefile.in
19@@ -657,11 +657,11 @@ mjit_config.h:
20 echo '#endif'; \
21 quote MJIT_MIN_HEADER_NAME "$(MJIT_MIN_HEADER_NAME)"; \
22 sep=,; \
23- quote "MJIT_CC_COMMON " $(MJIT_CC); \
24+ quote "MJIT_CC_COMMON " ; \
25 quote "MJIT_CFLAGS MJIT_ARCHFLAG" $(MJIT_CFLAGS); \
26 quote "MJIT_OPTFLAGS " $(MJIT_OPTFLAGS); \
27 quote "MJIT_DEBUGFLAGS " $(MJIT_DEBUGFLAGS); \
28- quote "MJIT_LDSHARED " $(MJIT_LDSHARED); \
29+ quote "MJIT_LDSHARED " ; \
30 quote "MJIT_DLDFLAGS MJIT_ARCHFLAG" $(MJIT_DLDFLAGS); \
31 quote "MJIT_LIBS " $(LIBRUBYARG_SHARED); \
32 quote 'PRELOADENV "@PRELOADENV@"'; \
diff --git a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch b/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
deleted file mode 100644
index 96ae86263b..0000000000
--- a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
+++ /dev/null
@@ -1,25 +0,0 @@
1From 21d8e7700fa0a9c4bf569dd366134060ae858832 Mon Sep 17 00:00:00 2001
2From: Christopher Larson <chris_larson@mentor.com>
3Date: Thu, 5 May 2016 10:59:07 -0700
4Subject: [PATCH] Obey LDFLAGS for the link of libruby
5
6Signed-off-by: Christopher Larson <chris_larson@mentor.com>
7Upstream-Status: Pending
8
9---
10 template/Makefile.in | 2 +-
11 1 file changed, 1 insertion(+), 1 deletion(-)
12
13diff --git a/template/Makefile.in b/template/Makefile.in
14index 1456313..15b98a4 100644
15--- a/template/Makefile.in
16+++ b/template/Makefile.in
17@@ -127,7 +127,7 @@ ENABLE_SHARED = @ENABLE_SHARED@
18 LDSHARED = @LIBRUBY_LDSHARED@
19 DLDSHARED = @DLDSHARED@
20 XDLDFLAGS = @DLDFLAGS@
21-DLDFLAGS = @LIBRUBY_DLDFLAGS@ $(XLDFLAGS) $(ARCH_FLAG)
22+DLDFLAGS = @LIBRUBY_DLDFLAGS@ @LDFLAGS@ $(XLDFLAGS) $(ARCH_FLAG)
23 SOLIBS = @SOLIBS@
24 ENABLE_DEBUG_ENV = @ENABLE_DEBUG_ENV@
25 MAINLIBS = $(YJIT_LIBS) @MAINLIBS@
diff --git a/meta/recipes-devtools/ruby/ruby/0002-template-Makefile.in-filter-out-f-prefix-map.patch b/meta/recipes-devtools/ruby/ruby/0002-template-Makefile.in-filter-out-f-prefix-map.patch
deleted file mode 100644
index 2efbad7513..0000000000
--- a/meta/recipes-devtools/ruby/ruby/0002-template-Makefile.in-filter-out-f-prefix-map.patch
+++ /dev/null
@@ -1,42 +0,0 @@
1Subject: [PATCH] template/Makefile.in: filter out -f*prefix-map
2
3If we add DEBUG_PREFIX_MAP into LDFLAGS, ruby and ruby-dbg are no longer
4reproducible. Fix this.
5
6Upstream-Status: Inappropriate [oe-core specific]
7Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
8---
9--- a/tool/mjit_archflag.sh
10+++ b/tool/mjit_archflag.sh
11@@ -7,6 +7,20 @@ quote() {
12 echo
13 }
14
15+quote_filtered() {
16+ printf "#${indent}define $1"
17+ while shift && [ "$#" -gt 0 ]; do
18+ case "$1" in
19+ -ffile-prefix-map=*|-fdebug-prefix-map=*|-fmacro-prefix-map=*)
20+ ;;
21+ *)
22+ printf ' "%s"'$sep "$1"
23+ ;;
24+ esac
25+ done
26+ echo
27+}
28+
29 archs=""
30 arch_flag=""
31
32--- a/template/Makefile.in
33+++ b/template/Makefile.in
34@@ -666,7 +666,7 @@ mjit_config.h:
35 quote "MJIT_OPTFLAGS " $(MJIT_OPTFLAGS); \
36 quote "MJIT_DEBUGFLAGS " $(MJIT_DEBUGFLAGS); \
37 quote "MJIT_LDSHARED " ; \
38- quote "MJIT_DLDFLAGS MJIT_ARCHFLAG" $(MJIT_DLDFLAGS); \
39+ quote_filtered "MJIT_DLDFLAGS MJIT_ARCHFLAG" $(MJIT_DLDFLAGS); \
40 quote "MJIT_LIBS " $(LIBRUBYARG_SHARED); \
41 quote 'PRELOADENV "@PRELOADENV@"'; \
42 indent=$${archs:+' '}; \
diff --git a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
index 41f206523e..0902a201ec 100644
--- a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
+++ b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
@@ -12,20 +12,20 @@ Upstream-Status: Backport [debian]
12 1 file changed, 3 insertions(+), 1 deletion(-) 12 1 file changed, 3 insertions(+), 1 deletion(-)
13 13
14diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb 14diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
15index 0d72cee..eb7bc25 100644 15index d6eac7f..4b2e95e 100644
16--- a/lib/rubygems/specification.rb 16--- a/lib/rubygems/specification.rb
17+++ b/lib/rubygems/specification.rb 17+++ b/lib/rubygems/specification.rb
18@@ -1691,7 +1691,9 @@ class Gem::Specification < Gem::BasicSpecification 18@@ -1707,7 +1707,9 @@ class Gem::Specification < Gem::BasicSpecification
19 raise(Gem::InvalidSpecificationException, 19 raise(Gem::InvalidSpecificationException,
20 "invalid date format in specification: #{date.inspect}") 20 "invalid date format in specification: #{date.inspect}")
21 end 21 end
22- when Time, DateLike then 22- when Time, DateLike then
23+ when Time then 23+ when Time then
24+ Time.utc(date.utc.year, date.utc.month, date.utc.day) 24+ Time.utc(date.utc.year, date.utc.month, date.utc.day)
25+ when DateLike then 25+ when DateLike then
26 Time.utc(date.year, date.month, date.day) 26 Time.utc(date.year, date.month, date.day)
27 else 27 else
28 TODAY 28 TODAY
29-- 29--
302.25.1 302.40.0
31 31
diff --git a/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch b/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
index 0a87cae17f..d32e209129 100644
--- a/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
+++ b/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
@@ -7,7 +7,6 @@ Without an explicit date, they will get the current date and make the
7build unreproducible 7build unreproducible
8 8
9Upstream-Status: Backport [debian] 9Upstream-Status: Backport [debian]
10
11--- 10---
12 ext/bigdecimal/bigdecimal.gemspec | 1 + 11 ext/bigdecimal/bigdecimal.gemspec | 1 +
13 ext/fiddle/fiddle.gemspec | 1 + 12 ext/fiddle/fiddle.gemspec | 1 +
@@ -17,12 +16,12 @@ Upstream-Status: Backport [debian]
17 5 files changed, 5 insertions(+) 16 5 files changed, 5 insertions(+)
18 17
19diff --git a/ext/bigdecimal/bigdecimal.gemspec b/ext/bigdecimal/bigdecimal.gemspec 18diff --git a/ext/bigdecimal/bigdecimal.gemspec b/ext/bigdecimal/bigdecimal.gemspec
20index d215757..5148d56 100644 19index f9f3b45..b9a469d 100644
21--- a/ext/bigdecimal/bigdecimal.gemspec 20--- a/ext/bigdecimal/bigdecimal.gemspec
22+++ b/ext/bigdecimal/bigdecimal.gemspec 21+++ b/ext/bigdecimal/bigdecimal.gemspec
23@@ -4,6 +4,7 @@ Gem::Specification.new do |s| 22@@ -14,6 +14,7 @@ Gem::Specification.new do |s|
24 s.name = "bigdecimal" 23 s.name = name
25 s.version = "3.1.3" 24 s.version = source_version
26 s.authors = ["Kenta Murata", "Zachary Scott", "Shigeo Kobayashi"] 25 s.authors = ["Kenta Murata", "Zachary Scott", "Shigeo Kobayashi"]
27+ s.date = RUBY_RELEASE_DATE 26+ s.date = RUBY_RELEASE_DATE
28 s.email = ["mrkn@mrkn.jp"] 27 s.email = ["mrkn@mrkn.jp"]
@@ -41,10 +40,10 @@ index 8781093..efdca32 100644
41 spec.email = ["aaron@tenderlovemaking.com", "hsbt@ruby-lang.org"] 40 spec.email = ["aaron@tenderlovemaking.com", "hsbt@ruby-lang.org"]
42 41
43diff --git a/ext/io/console/io-console.gemspec b/ext/io/console/io-console.gemspec 42diff --git a/ext/io/console/io-console.gemspec b/ext/io/console/io-console.gemspec
44index d26a757..cc88c55 100644 43index d4f5276..8f89611 100644
45--- a/ext/io/console/io-console.gemspec 44--- a/ext/io/console/io-console.gemspec
46+++ b/ext/io/console/io-console.gemspec 45+++ b/ext/io/console/io-console.gemspec
47@@ -4,6 +4,7 @@ _VERSION = "0.6.0" 46@@ -4,6 +4,7 @@ _VERSION = "0.7.1"
48 Gem::Specification.new do |s| 47 Gem::Specification.new do |s|
49 s.name = "io-console" 48 s.name = "io-console"
50 s.version = _VERSION 49 s.version = _VERSION
@@ -65,7 +64,7 @@ index 1f4798e..48743cf 100644
65 spec.email = ["knu@idaemons.org", "ume@mahoroba.org"] 64 spec.email = ["knu@idaemons.org", "ume@mahoroba.org"]
66 65
67diff --git a/lib/rdoc/rdoc.gemspec b/lib/rdoc/rdoc.gemspec 66diff --git a/lib/rdoc/rdoc.gemspec b/lib/rdoc/rdoc.gemspec
68index 3c96f7d..fec0872 100644 67index 93a281c..cc5c155 100644
69--- a/lib/rdoc/rdoc.gemspec 68--- a/lib/rdoc/rdoc.gemspec
70+++ b/lib/rdoc/rdoc.gemspec 69+++ b/lib/rdoc/rdoc.gemspec
71@@ -7,6 +7,7 @@ end 70@@ -7,6 +7,7 @@ end
@@ -76,3 +75,6 @@ index 3c96f7d..fec0872 100644
76 s.version = RDoc::VERSION 75 s.version = RDoc::VERSION
77 76
78 s.authors = [ 77 s.authors = [
78--
792.40.0
80
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_1.patch b/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_1.patch
deleted file mode 100644
index 17c7e30176..0000000000
--- a/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_1.patch
+++ /dev/null
@@ -1,56 +0,0 @@
1From 2ebb50d2dc302917a6f57c1239dc9e700dfe0e34 Mon Sep 17 00:00:00 2001
2From: Nobuyoshi Nakada <nobu@ruby-lang.org>
3Date: Thu, 27 Jul 2023 15:53:01 +0800
4Subject: [PATCH] Fix quadratic backtracking on invalid relative URI
5
6https://hackerone.com/reports/1958260
7
8CVE: CVE-2023-36617
9
10Upstream-Status: Backport [https://github.com/ruby/uri/commit/9010ee2536adda10a0555ae1ed6fe2f5808e6bf1]
11
12Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
13---
14 lib/uri/rfc2396_parser.rb | 4 ++--
15 test/uri/test_parser.rb | 12 ++++++++++++
16 2 files changed, 14 insertions(+), 2 deletions(-)
17
18diff --git a/lib/uri/rfc2396_parser.rb b/lib/uri/rfc2396_parser.rb
19index 76a8f99..00c66cf 100644
20--- a/lib/uri/rfc2396_parser.rb
21+++ b/lib/uri/rfc2396_parser.rb
22@@ -497,8 +497,8 @@ module URI
23 ret = {}
24
25 # for URI::split
26- ret[:ABS_URI] = Regexp.new('\A\s*' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED)
27- ret[:REL_URI] = Regexp.new('\A\s*' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED)
28+ ret[:ABS_URI] = Regexp.new('\A\s*+' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED)
29+ ret[:REL_URI] = Regexp.new('\A\s*+' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED)
30
31 # for URI::extract
32 ret[:URI_REF] = Regexp.new(pattern[:URI_REF])
33diff --git a/test/uri/test_parser.rb b/test/uri/test_parser.rb
34index 72fb590..721e05e 100644
35--- a/test/uri/test_parser.rb
36+++ b/test/uri/test_parser.rb
37@@ -79,4 +79,16 @@ class URI::TestParser < Test::Unit::TestCase
38 assert_equal([nil, nil, "example.com", nil, nil, "", nil, nil, nil], URI.split("//example.com"))
39 assert_equal([nil, nil, "[0::0]", nil, nil, "", nil, nil, nil], URI.split("//[0::0]"))
40 end
41+
42+ def test_rfc2822_parse_relative_uri
43+ pre = ->(length) {
44+ " " * length + "\0"
45+ }
46+ parser = URI::RFC2396_Parser.new
47+ assert_linear_performance((1..5).map {|i| 10**i}, pre: pre) do |uri|
48+ assert_raise(URI::InvalidURIError) do
49+ parser.split(uri)
50+ end
51+ end
52+ end
53 end
54--
552.25.1
56
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_2.patch b/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_2.patch
deleted file mode 100644
index 7c51deaa42..0000000000
--- a/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_2.patch
+++ /dev/null
@@ -1,52 +0,0 @@
1From eea5868120509c245216c4b5c2d4b5db1c593d0e Mon Sep 17 00:00:00 2001
2From: Nobuyoshi Nakada <nobu@ruby-lang.org>
3Date: Thu, 27 Jul 2023 16:16:30 +0800
4Subject: [PATCH] Fix quadratic backtracking on invalid port number
5
6https://hackerone.com/reports/1958260
7
8CVE: CVE-2023-36617
9
10Upstream-Status: Backport [https://github.com/ruby/uri/commit/9d7bcef1e6ad23c9c6e4932f297fb737888144c8]
11
12Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
13---
14 lib/uri/rfc3986_parser.rb | 2 +-
15 test/uri/test_parser.rb | 10 ++++++++++
16 2 files changed, 11 insertions(+), 1 deletion(-)
17
18diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb
19index dd24a40..9b1663d 100644
20--- a/lib/uri/rfc3986_parser.rb
21+++ b/lib/uri/rfc3986_parser.rb
22@@ -100,7 +100,7 @@ module URI
23 QUERY: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/,
24 FRAGMENT: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/,
25 OPAQUE: /\A(?:[^\/].*)?\z/,
26- PORT: /\A[\x09\x0a\x0c\x0d ]*\d*[\x09\x0a\x0c\x0d ]*\z/,
27+ PORT: /\A[\x09\x0a\x0c\x0d ]*+\d*[\x09\x0a\x0c\x0d ]*\z/,
28 }
29 end
30
31diff --git a/test/uri/test_parser.rb b/test/uri/test_parser.rb
32index 721e05e..cee0acb 100644
33--- a/test/uri/test_parser.rb
34+++ b/test/uri/test_parser.rb
35@@ -91,4 +91,14 @@ class URI::TestParser < Test::Unit::TestCase
36 end
37 end
38 end
39+
40+ def test_rfc3986_port_check
41+ pre = ->(length) {"\t" * length + "a"}
42+ uri = URI.parse("http://my.example.com")
43+ assert_linear_performance((1..5).map {|i| 10**i}, pre: pre) do |port|
44+ assert_raise(URI::InvalidComponentError) do
45+ uri.port = port
46+ end
47+ end
48+ end
49 end
50--
512.25.1
52
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch
deleted file mode 100644
index f69f3bcf4f..0000000000
--- a/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch
+++ /dev/null
@@ -1,97 +0,0 @@
1From da7a0c7553ef7250ca665a3fecdc01dbaacbb43d Mon Sep 17 00:00:00 2001
2From: Nobuyoshi Nakada <nobu@...>
3Date: Mon, 15 Apr 2024 11:40:00 +0000
4Subject: [PATCH] Filter marshaled objets
5
6CVE: CVE-2024-27281
7Upstream-Status: Backport [https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d]
8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
9---
10 lib/rdoc/store.rb | 45 ++++++++++++++++++++++++++-------------------
11 1 file changed, 26 insertions(+), 19 deletions(-)
12
13diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb
14index 9fc540d..5b663d7 100644
15--- a/lib/rdoc/store.rb
16+++ b/lib/rdoc/store.rb
17@@ -556,9 +556,7 @@ class RDoc::Store
18 def load_cache
19 #orig_enc = @encoding
20
21- File.open cache_path, 'rb' do |io|
22- @cache = Marshal.load io
23- end
24+ @cache = marshal_load(cache_path)
25
26 load_enc = @cache[:encoding]
27
28@@ -615,9 +613,7 @@ class RDoc::Store
29 def load_class_data klass_name
30 file = class_file klass_name
31
32- File.open file, 'rb' do |io|
33- Marshal.load io
34- end
35+ marshal_load(file)
36 rescue Errno::ENOENT => e
37 error = MissingFileError.new(self, file, klass_name)
38 error.set_backtrace e.backtrace
39@@ -630,14 +626,10 @@ class RDoc::Store
40 def load_method klass_name, method_name
41 file = method_file klass_name, method_name
42
43- File.open file, 'rb' do |io|
44- obj = Marshal.load io
45- obj.store = self
46- obj.parent =
47- find_class_or_module(klass_name) || load_class(klass_name) unless
48- obj.parent
49- obj
50- end
51+ obj = marshal_load(file)
52+ obj.store = self
53+ obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name)
54+ obj
55 rescue Errno::ENOENT => e
56 error = MissingFileError.new(self, file, klass_name + method_name)
57 error.set_backtrace e.backtrace
58@@ -650,11 +642,9 @@ class RDoc::Store
59 def load_page page_name
60 file = page_file page_name
61
62- File.open file, 'rb' do |io|
63- obj = Marshal.load io
64- obj.store = self
65- obj
66- end
67+ obj = marshal_load(file)
68+ obj.store = self
69+ obj
70 rescue Errno::ENOENT => e
71 error = MissingFileError.new(self, file, page_name)
72 error.set_backtrace e.backtrace
73@@ -976,4 +966,21 @@ class RDoc::Store
74 @unique_modules
75 end
76
77+ private
78+ def marshal_load(file)
79+ File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)}
80+ end
81+
82+ MarshalFilter = proc do |obj|
83+ case obj
84+ when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text
85+ else
86+ unless obj.class.name.start_with("RDoc::")
87+ raise TypeError, "not permitted class: #{obj.class.name}"
88+ end
89+ end
90+ obj
91+ end
92+ private_constant :MarshalFilter
93+
94 end
95--
962.25.1
97
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2024-27282.patch b/meta/recipes-devtools/ruby/ruby/CVE-2024-27282.patch
deleted file mode 100644
index dde7979278..0000000000
--- a/meta/recipes-devtools/ruby/ruby/CVE-2024-27282.patch
+++ /dev/null
@@ -1,28 +0,0 @@
1From 989a2355808a63fc45367785c82ffd46d18c900a Mon Sep 17 00:00:00 2001
2From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
3Date: Fri, 12 Apr 2024 15:01:47 +1000
4Subject: [PATCH] Fix Use-After-Free issue for Regexp
5
6Co-authored-by: Isaac Peka <7493006+isaac-peka@users.noreply.github.com>
7
8Upstream-Status: Backport [https://github.com/ruby/ruby/commit/989a2355808a63fc45367785c82ffd46d18c900a]
9CVE: CVE-2024-27282
10Signed-off-by: Ashish Sharma <asharma@mvista.com>
11
12 regexec.c | 2 +-
13 1 file changed, 1 insertion(+), 1 deletion(-)
14
15diff --git a/regexec.c b/regexec.c
16index 73694ab14a0b0a..140691ad42489f 100644
17--- a/regexec.c
18+++ b/regexec.c
19@@ -3449,8 +3449,8 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
20 CASE(OP_MEMORY_END_PUSH_REC) MOP_IN(OP_MEMORY_END_PUSH_REC);
21 GET_MEMNUM_INC(mem, p);
22 STACK_GET_MEM_START(mem, stkp); /* should be before push mem-end. */
23- STACK_PUSH_MEM_END(mem, s);
24 mem_start_stk[mem] = GET_STACK_INDEX(stkp);
25+ STACK_PUSH_MEM_END(mem, s);
26 MOP_OUT;
27 JUMP;
28
diff --git a/meta/recipes-devtools/ruby/ruby/remove_has_include_macros.patch b/meta/recipes-devtools/ruby/ruby/remove_has_include_macros.patch
deleted file mode 100644
index b78e3db892..0000000000
--- a/meta/recipes-devtools/ruby/ruby/remove_has_include_macros.patch
+++ /dev/null
@@ -1,35 +0,0 @@
1From e74b57febec9bd806e29025e6eeb8091e7021d75 Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com>
3Date: Sun, 26 Jan 2020 11:27:40 -0800
4Subject: [PATCH] Filter out __has_include* compiler defines
5
6They are internal to compiler and this header is later on includes in C
7files, but newer gcc >= 10 complains about it.
8
9error in initial header file:
10| In file included from /tmp/20200124-86625-14hiju4.c:1:
11| /tmp/20200124-86625-11y6l6i.h:13849:9: error: "__has_include" cannot be used as a macro name
12| 13849 | #define __has_include __has_include
13| | ^~~~~~~~~~~~~
14| compilation terminated due to -Wfatal-errors.
15
16Upstream-Status: Pending
17Signed-off-by: Khem Raj <raj.khem@gmail.com>
18
19---
20 common.mk | 2 ++
21 1 file changed, 2 insertions(+)
22
23diff --git a/common.mk b/common.mk
24index 664f750..3b8fbe6 100644
25--- a/common.mk
26+++ b/common.mk
27@@ -238,6 +238,8 @@ $(TIMESTAMPDIR)/$(MJIT_HEADER:.h=)$(MJIT_HEADER_SUFFIX).time: probes.h vm.$(OBJE
28 $(ECHO) building $(@F:.time=.h)
29 $(Q)$(MINIRUBY) $(tooldir)/mjit_tabs.rb "$(MJIT_TABS)" \
30 $(CPP) -DMJIT_HEADER $(MJIT_HEADER_FLAGS) $(CFLAGS) $(XCFLAGS) $(CPPFLAGS) $(srcdir)/vm.c $(CPPOUTFLAG)$(@F:.time=.h).new
31+ $(Q)sed -i -e "/#define __has_include __has_include/d" $(@F:.time=.h).new
32+ $(Q)sed -i -e "/#define __has_include_next __has_include_next/d" $(@F:.time=.h).new
33 $(Q) $(IFCHANGE) "--timestamp=$@" $(@F:.time=.h) $(@F:.time=.h).new
34
35 $(MJIT_HEADER:.h=)$(MJIT_HEADER_SUFFIX).h: $(TIMESTAMPDIR)/$(MJIT_HEADER:.h=)$(MJIT_HEADER_SUFFIX).time
diff --git a/meta/recipes-devtools/ruby/ruby_3.2.2.bb b/meta/recipes-devtools/ruby/ruby_3.3.5.bb
index 508154dad5..fb0d711765 100644
--- a/meta/recipes-devtools/ruby/ruby_3.2.2.bb
+++ b/meta/recipes-devtools/ruby/ruby_3.3.5.bb
@@ -10,7 +10,7 @@ LICENSE = "Ruby | BSD-2-Clause | BSD-3-Clause | GPL-2.0-only | ISC | MIT"
10LIC_FILES_CHKSUM = "file://COPYING;md5=5b8c87559868796979806100db3f3805 \ 10LIC_FILES_CHKSUM = "file://COPYING;md5=5b8c87559868796979806100db3f3805 \
11 file://BSDL;md5=8b50bc6de8f586dc66790ba11d064d75 \ 11 file://BSDL;md5=8b50bc6de8f586dc66790ba11d064d75 \
12 file://GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ 12 file://GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
13 file://LEGAL;md5=bcd74b47bbaf2051c5e49811a5faa97a \ 13 file://LEGAL;md5=81e6a4d81533b9263da4c3485a0ad883 \
14 " 14 "
15 15
16DEPENDS = "zlib openssl libyaml gdbm readline libffi" 16DEPENDS = "zlib openssl libyaml gdbm readline libffi"
@@ -20,21 +20,12 @@ DEPENDS:append:class-nativesdk = " ruby-native"
20SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}" 20SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}"
21SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \ 21SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \
22 file://0001-extmk-fix-cross-compilation-of-external-gems.patch \ 22 file://0001-extmk-fix-cross-compilation-of-external-gems.patch \
23 file://0002-Obey-LDFLAGS-for-the-link-of-libruby.patch \
24 file://remove_has_include_macros.patch \
25 file://run-ptest \ 23 file://run-ptest \
26 file://0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch \
27 file://0002-template-Makefile.in-filter-out-f-prefix-map.patch \
28 file://0003-rdoc-build-reproducible-documentation.patch \ 24 file://0003-rdoc-build-reproducible-documentation.patch \
29 file://0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch \ 25 file://0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch \
30 file://0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch \ 26 file://0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch \
31 file://0006-Make-gemspecs-reproducible.patch \ 27 file://0006-Make-gemspecs-reproducible.patch \
32 file://0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch \ 28 file://0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch \
33 file://0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch \
34 file://CVE-2023-36617_1.patch \
35 file://CVE-2023-36617_2.patch \
36 file://CVE-2024-27281.patch \
37 file://CVE-2024-27282.patch \
38 " 29 "
39UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/" 30UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/"
40 31
@@ -55,7 +46,7 @@ do_configure:prepend() {
55 46
56DEPENDS:append:libc-musl = " libucontext" 47DEPENDS:append:libc-musl = " libucontext"
57 48
58SRC_URI[sha256sum] = "96c57558871a6748de5bc9f274e93f4b5aad06cd8f37befa0e8d94e7b8a423bc" 49SRC_URI[sha256sum] = "3781a3504222c2f26cb4b9eb9c1a12dbf4944d366ce24a9ff8cf99ecbce75196"
59 50
60PACKAGECONFIG ??= "" 51PACKAGECONFIG ??= ""
61PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" 52PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-13 19:35:12 +0000