summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-core/glibc/glibc-version.inc2
-rw-r--r--meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch182
-rw-r--r--meta/recipes-core/glibc/glibc_2.33.bb1
3 files changed, 1 insertions, 184 deletions
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 4d69187961..63241ee951 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
1SRCBRANCH ?= "release/2.33/master" 1SRCBRANCH ?= "release/2.33/master"
2PV = "2.33" 2PV = "2.33"
3SRCREV_glibc ?= "6090cf1330faf2deb17285758f327cb23b89ebf1" 3SRCREV_glibc ?= "55b99e9ed07688019609bd4dcd17d3ebf4572948"
4SRCREV_localedef ?= "bd644c9e6f3e20c5504da1488448173c69c56c28" 4SRCREV_localedef ?= "bd644c9e6f3e20c5504da1488448173c69c56c28"
5 5
6GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git" 6GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git"
diff --git a/meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch b/meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch
deleted file mode 100644
index 72fd68b302..0000000000
--- a/meta/recipes-core/glibc/glibc/0031-CVE-2021-43396.patch
+++ /dev/null
@@ -1,182 +0,0 @@
1From ff012870b2c02a62598c04daa1e54632e020fd7d Mon Sep 17 00:00:00 2001
2From: Nikita Popov <npv1310@gmail.com>
3Date: Tue, 2 Nov 2021 13:21:42 +0500
4Subject: [PATCH] gconv: Do not emit spurious NUL character in ISO-2022-JP-3
5 (bug 28524)
6
7Bugfix 27256 has introduced another issue:
8In conversion from ISO-2022-JP-3 encoding, it is possible
9to force iconv to emit extra NUL character on internal state reset.
10To do this, it is sufficient to feed iconv with escape sequence
11which switches active character set.
12The simplified check 'data->__statep->__count != ASCII_set'
13introduced by the aforementioned bugfix picks that case and
14behaves as if '\0' character has been queued thus emitting it.
15
16To eliminate this issue, these steps are taken:
17* Restore original condition
18'(data->__statep->__count & ~7) != ASCII_set'.
19It is necessary since bits 0-2 may contain
20number of buffered input characters.
21* Check that queued character is not NUL.
22Similar step is taken for main conversion loop.
23
24Bundled test case follows following logic:
25* Try to convert ISO-2022-JP-3 escape sequence
26switching active character set
27* Reset internal state by providing NULL as input buffer
28* Ensure that nothing has been converted.
29
30Signed-off-by: Nikita Popov <npv1310@gmail.com>
31
32CVE: CVE-2021-43396
33Upstream-Status: Backport [ff012870b2c02a62598c04daa1e54632e020fd7d]
34---
35 iconvdata/Makefile | 5 +++-
36 iconvdata/bug-iconv15.c | 60 +++++++++++++++++++++++++++++++++++++++
37 iconvdata/iso-2022-jp-3.c | 28 ++++++++++++------
38 3 files changed, 84 insertions(+), 9 deletions(-)
39 create mode 100644 iconvdata/bug-iconv15.c
40
41diff --git a/iconvdata/bug-iconv15.c b/iconvdata/bug-iconv15.c
42new file mode 100644
43--- /dev/null
44+++ b/iconvdata/bug-iconv15.c
45@@ -0,0 +1,60 @@
46+/* Bug 28524: Conversion from ISO-2022-JP-3 with iconv
47+ may emit spurious NUL character on state reset.
48+ Copyright (C) The GNU Toolchain Authors.
49+ This file is part of the GNU C Library.
50+
51+ The GNU C Library is free software; you can redistribute it and/or
52+ modify it under the terms of the GNU Lesser General Public
53+ License as published by the Free Software Foundation; either
54+ version 2.1 of the License, or (at your option) any later version.
55+
56+ The GNU C Library is distributed in the hope that it will be useful,
57+ but WITHOUT ANY WARRANTY; without even the implied warranty of
58+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
59+ Lesser General Public License for more details.
60+
61+ You should have received a copy of the GNU Lesser General Public
62+ License along with the GNU C Library; if not, see
63+ <https://www.gnu.org/licenses/>. */
64+
65+#include <stddef.h>
66+#include <iconv.h>
67+#include <support/check.h>
68+
69+static int
70+do_test (void)
71+{
72+ char in[] = "\x1b(I";
73+ char *inbuf = in;
74+ size_t inleft = sizeof (in) - 1;
75+ char out[1];
76+ char *outbuf = out;
77+ size_t outleft = sizeof (out);
78+ iconv_t cd;
79+
80+ cd = iconv_open ("UTF8", "ISO-2022-JP-3");
81+ TEST_VERIFY_EXIT (cd != (iconv_t) -1);
82+
83+ /* First call to iconv should alter internal state.
84+ Now, JISX0201_Kana_set is selected and
85+ state value != ASCII_set. */
86+ TEST_VERIFY (iconv (cd, &inbuf, &inleft, &outbuf, &outleft) != (size_t) -1);
87+
88+ /* No bytes should have been added to
89+ the output buffer at this point. */
90+ TEST_VERIFY (outbuf == out);
91+ TEST_VERIFY (outleft == sizeof (out));
92+
93+ /* Second call shall emit spurious NUL character in unpatched glibc. */
94+ TEST_VERIFY (iconv (cd, NULL, NULL, &outbuf, &outleft) != (size_t) -1);
95+
96+ /* No characters are expected to be produced. */
97+ TEST_VERIFY (outbuf == out);
98+ TEST_VERIFY (outleft == sizeof (out));
99+
100+ TEST_VERIFY_EXIT (iconv_close (cd) != -1);
101+
102+ return 0;
103+}
104+
105+#include <support/test-driver.c>
106diff --git a/iconvdata/iso-2022-jp-3.c b/iconvdata/iso-2022-jp-3.c
107--- a/iconvdata/iso-2022-jp-3.c
108+++ b/iconvdata/iso-2022-jp-3.c
109@@ -1,5 +1,6 @@
110 /* Conversion module for ISO-2022-JP-3.
111 Copyright (C) 1998-2021 Free Software Foundation, Inc.
112+ Copyright (C) The GNU Toolchain Authors.
113 This file is part of the GNU C Library.
114 Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998,
115 and Bruno Haible <bruno@clisp.org>, 2002.
116@@ -81,20 +82,31 @@ enum
117 the output state to the initial state. This has to be done during the
118 flushing. */
119 #define EMIT_SHIFT_TO_INIT \
120- if (data->__statep->__count != ASCII_set) \
121+ if ((data->__statep->__count & ~7) != ASCII_set) \
122 { \
123 if (FROM_DIRECTION) \
124 { \
125- if (__glibc_likely (outbuf + 4 <= outend)) \
126+ uint32_t ch = data->__statep->__count >> 6; \
127+ \
128+ if (__glibc_unlikely (ch != 0)) \
129 { \
130- /* Write out the last character. */ \
131- *((uint32_t *) outbuf) = data->__statep->__count >> 6; \
132- outbuf += sizeof (uint32_t); \
133- data->__statep->__count = ASCII_set; \
134+ if (__glibc_likely (outbuf + 4 <= outend)) \
135+ { \
136+ /* Write out the last character. */ \
137+ put32u (outbuf, ch); \
138+ outbuf += 4; \
139+ data->__statep->__count &= 7; \
140+ data->__statep->__count |= ASCII_set; \
141+ } \
142+ else \
143+ /* We don't have enough room in the output buffer. */ \
144+ status = __GCONV_FULL_OUTPUT; \
145 } \
146 else \
147- /* We don't have enough room in the output buffer. */ \
148- status = __GCONV_FULL_OUTPUT; \
149+ { \
150+ data->__statep->__count &= 7; \
151+ data->__statep->__count |= ASCII_set; \
152+ } \
153 } \
154 else \
155 { \
156diff --git a/iconvdata/Makefile b/iconvdata/Makefile
157--- a/iconvdata/Makefile
158+++ b/iconvdata/Makefile
159@@ -1,4 +1,5 @@
160 # Copyright (C) 1997-2021 Free Software Foundation, Inc.
161+# Copyright (C) The GNU Toolchain Authors.
162 # This file is part of the GNU C Library.
163
164 # The GNU C Library is free software; you can redistribute it and/or
165@@ -74,7 +75,7 @@ ifeq (yes,$(build-shared))
166 tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
167 tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
168 bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
169- bug-iconv13 bug-iconv14
170+ bug-iconv13 bug-iconv14 bug-iconv15
171 ifeq ($(have-thread-library),yes)
172 tests += bug-iconv3
173 endif
174@@ -324,6 +325,8 @@ $(objpfx)bug-iconv12.out: $(objpfx)gconv
175 $(addprefix $(objpfx),$(modules.so))
176 $(objpfx)bug-iconv14.out: $(objpfx)gconv-modules \
177 $(addprefix $(objpfx),$(modules.so))
178+$(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \
179+ $(addprefix $(objpfx),$(modules.so))
180
181 $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \
182 $(addprefix $(objpfx),$(modules.so)) \
diff --git a/meta/recipes-core/glibc/glibc_2.33.bb b/meta/recipes-core/glibc/glibc_2.33.bb
index b7736359b1..a1e9eb3a16 100644
--- a/meta/recipes-core/glibc/glibc_2.33.bb
+++ b/meta/recipes-core/glibc/glibc_2.33.bb
@@ -56,7 +56,6 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
56 file://0028-readlib-Add-OECORE_KNOWN_INTERPRETER_NAMES-to-known-.patch \ 56 file://0028-readlib-Add-OECORE_KNOWN_INTERPRETER_NAMES-to-known-.patch \
57 file://0029-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch \ 57 file://0029-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch \
58 file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \ 58 file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \
59 file://0031-CVE-2021-43396.patch \
60 " 59 "
61S = "${WORKDIR}/git" 60S = "${WORKDIR}/git"
62B = "${WORKDIR}/build-${TARGET_SYS}" 61B = "${WORKDIR}/build-${TARGET_SYS}"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-09 10:08:33 +0000