From patchwork Fri Dec 16 14:57:40 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16832 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38F61C4332F for ; Fri, 16 Dec 2022 14:58:05 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web11.15110.1671202682004738349 for ; Fri, 16 Dec 2022 06:58:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=ZR9cbBmz; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id a9so2549670pld.7 for ; Fri, 16 Dec 2022 06:58:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=/admdcopI1vh0Uz80RzbhFOG4gBk3tb6VcKExV0aiPY=; b=ZR9cbBmz2XTzDHGv6A70HNqKIGmhUQrIFWciZANiear7B+/DnXoBiqVcA54zOxKUHY k3pL1I1xVXffpyh5gCXu0pRVpFcwZquc43Ao2WZ4wDq895dgXzft3S1hyIs+SCMUyFrQ 3cVIlGAlrCk+NVPeOxldO+cCzssi8xXVBY9A4xFYn1LP67TPCiuu+UnaWJh9eCH4qwuQ uSmKFL1ZMeAxoeeK8a2yAkTyT7ZLjbFQ9VE8bovIr1wq0b+3OyD7VHzZx9l5feSus1+T vQlCKl02hShn63MFqy3fJ9gM1JJwS9to5Yr2zLsAVQvUFlOKRrIvwDR6BsgVz/2vgOiw emAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/admdcopI1vh0Uz80RzbhFOG4gBk3tb6VcKExV0aiPY=; b=FF2XIxYAVykQG90Fd94zjVpcdT7ddYB5TwN1a0b7EDkrIMk3nij/fOBL6ng+uG0IwE z5OOb87GFNVkO0NEljmZMh2AG1AO4kFfAYHNVBoNzZv7Gtlcby4tD7Vpju9sYNtum9u+ EOXhdNfxX/mjN/SuA8xo5qrhA2eBFHeZn/y3al3+IXYx17cTz5Z2q3hiqDh68y+Lg9cx gQqPzrTNaF6Ff7QGvfhFCfs+JJldgLBsRlrmVYwndHBcE+zeujrVT4paPI/1xKzQ9GEO +mBT0mlBlbyNbvwV03fPVD0f3swfz/87pFXMhDydDU/wwIhuurnSEfGDLGrXrmmOj0IK yuLA== X-Gm-Message-State: ANoB5pn9CSvmllHnzF2RlwMEETPTj3a7lS58j+rLjVsBySeDLZA0niwb PfQSjXF7aho4fiyOhZjfEjxqf20/3yOhPFPD97w= X-Google-Smtp-Source: AA0mqf5Qerx44J0GsF2TD+8wtv/MeeWhKYNqGYgYTO7oZ89BXm4pEpfDNxS9iLecq0y6nyoKa9yorg== X-Received: by 2002:a17:90a:420e:b0:213:9000:907f with SMTP id o14-20020a17090a420e00b002139000907fmr33997919pjg.39.1671202680879; Fri, 16 Dec 2022 06:58:00 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.57.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:00 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 01/13] xserver-xorg: backport fixes for CVE-2022-3550, CVE-2022-3551 and CVE-2022-3553 Date: Fri, 16 Dec 2022 04:57:40 -1000 Message-Id: <081ac12677096886b25023a03df06b99585ef18c.1671202568.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174745 From: Minjae Kim xkb: proof GetCountedString against request length attacks Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e] xkb: fix some possible memleaks in XkbGetKbdByName Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2] xquartz: Fix a possible crash when editing the Application menu due to mutaing immutable arrays Upstream-Status: Backport[https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3] Signed-off-by:Minjae Kim Signed-off-by: Steve Sakoman --- .../xserver-xorg/CVE-2022-3550.patch | 40 ++++++++++++ .../xserver-xorg/CVE-2022-3551.patch | 64 +++++++++++++++++++ .../xserver-xorg/CVE-2022-3553.patch | 49 ++++++++++++++ .../xorg-xserver/xserver-xorg_1.20.14.bb | 3 + 4 files changed, 156 insertions(+) create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3550.patch create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3551.patch create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3553.patch diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3550.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3550.patch new file mode 100644 index 0000000000..efec7b6b4e --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3550.patch @@ -0,0 +1,40 @@ +From d2dcbdc67c96c84dff301505072b0b7b022f1a14 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Sun, 4 Dec 2022 17:40:21 +0000 +Subject: [PATCH 1/3] xkb: proof GetCountedString against request length + attacks + +GetCountedString did a check for the whole string to be within the +request buffer but not for the initial 2 bytes that contain the length +field. A swapped client could send a malformed request to trigger a +swaps() on those bytes, writing into random memory. + +Signed-off-by: Peter Hutterer + +Ustream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e] +CVE: CVE-2022-3550 +Signed-off-by:Minjae Kim + +--- + xkb/xkb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index 68c59df..bf8aaa3 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -5138,6 +5138,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) + CARD16 len; + + wire = *wire_inout; ++ ++ if (client->req_len < ++ bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) ++ return BadValue; ++ + len = *(CARD16 *) wire; + if (client->swapped) { + swaps(&len); +-- +2.17.1 + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3551.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3551.patch new file mode 100644 index 0000000000..a3b977aac9 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3551.patch @@ -0,0 +1,64 @@ +From d3787290f56165f5656ddd2123dbf676a32d0a68 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Sun, 4 Dec 2022 17:44:00 +0000 +Subject: [PATCH 2/3] xkb: fix some possible memleaks in XkbGetKbdByName + +GetComponentByName returns an allocated string, so let's free that if we +fail somewhere. + +Signed-off-by: Peter Hutterer + +Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2] +CVE: CVE-2022-3551 +Signed-off-by:Minjae Kim + +--- + xkb/xkb.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index bf8aaa3..f79d306 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -5908,19 +5908,31 @@ ProcXkbGetKbdByName(ClientPtr client) + xkb = dev->key->xkbInfo->desc; + status = Success; + str = (unsigned char *) &stuff[1]; +- if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */ +- return BadMatch; ++ { ++ char *keymap = GetComponentSpec(&str, TRUE, &status); /* keymap, unsupported */ ++ if (keymap) { ++ free(keymap); ++ return BadMatch; ++ } ++ } + names.keycodes = GetComponentSpec(&str, TRUE, &status); + names.types = GetComponentSpec(&str, TRUE, &status); + names.compat = GetComponentSpec(&str, TRUE, &status); + names.symbols = GetComponentSpec(&str, TRUE, &status); + names.geometry = GetComponentSpec(&str, TRUE, &status); +- if (status != Success) +- return status; +- len = str - ((unsigned char *) stuff); +- if ((XkbPaddedSize(len) / 4) != stuff->length) +- return BadLength; ++ if (status == Success) { ++ len = str - ((unsigned char *) stuff); ++ if ((XkbPaddedSize(len) / 4) != stuff->length) ++ status = BadLength; ++ } + ++ if (status != Success) { ++ free(names.keycodes); ++ free(names.types); ++ free(names.compat); ++ free(names.symbols); ++ free(names.geometry); ++ } + CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask); + CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask); + +-- +2.17.1 + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3553.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3553.patch new file mode 100644 index 0000000000..94cea77edc --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3553.patch @@ -0,0 +1,49 @@ +From 57ad2c03730d56f8432b6d66b29c0e5a9f9b1ec2 Mon Sep 17 00:00:00 2001 +From: Jeremy Huddleston Sequoia +Date: Sun, 4 Dec 2022 17:46:18 +0000 +Subject: [PATCH 3/3] xquartz: Fix a possible crash when editing the + Application menu due to mutaing immutable arrays + +Crashing on exception: -[__NSCFArray replaceObjectAtIndex:withObject:]: mutating method sent to immutable object + +Application Specific Backtrace 0: +0 CoreFoundation 0x00007ff80d2c5e9b __exceptionPreprocess + 242 +1 libobjc.A.dylib 0x00007ff80d027e48 objc_exception_throw + 48 +2 CoreFoundation 0x00007ff80d38167b _CFThrowFormattedException + 194 +3 CoreFoundation 0x00007ff80d382a25 -[__NSCFArray removeObjectAtIndex:].cold.1 + 0 +4 CoreFoundation 0x00007ff80d2e6c0b -[__NSCFArray replaceObjectAtIndex:withObject:] + 119 +5 X11.bin 0x00000001003180f9 -[X11Controller tableView:setObjectValue:forTableColumn:row:] + 169 + +Fixes: https://github.com/XQuartz/XQuartz/issues/267 +Signed-off-by: Jeremy Huddleston Sequoia + +Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3] +CVE: CVE-2022-3553 +Signed-off-by:Minjae Kim + +--- + hw/xquartz/X11Controller.m | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/hw/xquartz/X11Controller.m b/hw/xquartz/X11Controller.m +index 3efda50..9870ff2 100644 +--- a/hw/xquartz/X11Controller.m ++++ b/hw/xquartz/X11Controller.m +@@ -467,8 +467,12 @@ extern char *bundle_id_prefix; + self.table_apps = table_apps; + + NSArray * const apps = self.apps; +- if (apps != nil) +- [table_apps addObjectsFromArray:apps]; ++ ++ if (apps != nil) { ++ for (NSArray * row in apps) { ++ [table_apps addObject:row.mutableCopy]; ++ } ++ } + + columns = [apps_table tableColumns]; + [[columns objectAtIndex:0] setIdentifier:@"0"]; +-- +2.17.1 + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb index d176f390a4..4f5528f78b 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb @@ -5,6 +5,9 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat file://0001-test-xtest-Initialize-array-with-braces.patch \ file://sdksyms-no-build-path.patch \ file://0001-drmmode_display.c-add-missing-mi.h-include.patch \ + file://CVE-2022-3550.patch \ + file://CVE-2022-3551.patch \ + file://CVE-2022-3553.patch \ " SRC_URI[md5sum] = "453fc86aac8c629b3a5b77e8dcca30bf" SRC_URI[sha256sum] = "54b199c9280ff8bf0f73a54a759645bd0eeeda7255d1c99310d5b7595f3ac066" From patchwork Fri Dec 16 14:57:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16833 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C06AC3DA71 for ; Fri, 16 Dec 2022 14:58:05 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.web11.15119.1671202684272441997 for ; Fri, 16 Dec 2022 06:58:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=U16Ji26S; spf=softfail (domain: sakoman.com, ip: 209.85.216.51, mailfrom: steve@sakoman.com) Received: by mail-pj1-f51.google.com with SMTP id q17-20020a17090aa01100b002194cba32e9so6323800pjp.1 for ; Fri, 16 Dec 2022 06:58:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=Q4GNpn3MzXL44afJTVA4xXGBFzp/+nsnVfue6IeqC3Y=; b=U16Ji26SCtCLG7g+9gVCm33nP7/Zw8JoO7XKsiy8cKTfim+TXpwSOTHKc2n5Y+8KVi gbkfw5tMw5ITTduwsfdPx6oITWgPNvxI+Y09tfUhXpoOSD6HekurUUS+IDINYdqfwrYr ITMHeAAFB3YrQJehuArexMve4c33h4i9m73KDfMcZgyynEYG4P8Bs8Z/LVtWErXVZt2Z iKNkwjaOLa0HtizIjDrlmdpaCKqFb02IQUBnknhUPoruFftK5b0tl1sSm7ZesnBsNQPn S4/uwkOgKAf4NmNyb8Yi9tkkJ94a/mt68hWGFLRSuWT6y3Y82S7lccGPEakvngnoqNcF bLWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Q4GNpn3MzXL44afJTVA4xXGBFzp/+nsnVfue6IeqC3Y=; b=Rbcr3j6Dk5QrK+JVUO4WdG+iaIiu1pKvXWM+9dq/Jl2qFc85iXV6t05BZz2Jwew3JV wXETk5arA6ImkDbyRpvWum+L6Vqs6cXx2sdIACv+EQEKhwsbqI1xq2uGyabFZn+0h0iK W1/0zoS5mNyTeYSptGXlvyOdJHgqTS3+qInZclsdzMoHS2gmA8utZbkhM8VW5kXpI1ou ER/8uPVFm9Y0WApo7Rt1JLmUq3ii+NVu0jzwgQSXshQMhYMulQAit5lZaPU15zCe8rBS hSIxvHq7XIIs47oy8M+zFhcWvqfLkwX3EK2mzJZl1BWJhfkzmRuzqfTzuiSnkhd0OmU/ 9t8Q== X-Gm-Message-State: ANoB5pl+4T+PPWwYtZNOF5FH8SPCzUWE85tve8wYMoJKIZzSq9IZ8Kpn 9Aal8cZ4wsvGXQdLmpPygGT7AcmBzPu3PX5hf+Q= X-Google-Smtp-Source: AA0mqf4vwLtNJMmKyId+pyRiHAMHl7tyTa6vaD3Xa8SL+Cfmsh/Uc9LhxDKiQSi/B62nXj4/7jAfpg== X-Received: by 2002:a17:90a:7d0f:b0:219:aa6:87f with SMTP id g15-20020a17090a7d0f00b002190aa6087fmr33851280pjl.20.1671202682986; Fri, 16 Dec 2022 06:58:02 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:02 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 02/13] rpm: Fix rpm CVE CVE-2021-3521 Date: Fri, 16 Dec 2022 04:57:41 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174746 From: Riyaz Khan Links: Dependent Patches: CVE-2021-3521-01 https://github.com/rpm-software-management/rpm/commit/b5e8bc74b2b05aa557f663fe227b94d2bc64fbd8 CVE-2021-3521-02 https://github.com/rpm-software-management/rpm/commit/9f03f42e2614a68f589f9db8fe76287146522c0c CVE-2021-3521-03 https://github.com/rpm-software-management/rpm/commit/5ff86764b17f31535cb247543a90dd739076ec38 CVE-2021-3521 https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 Signed-off-by: Riyaz Khan Signed-off-by: Steve Sakoman --- .../rpm/files/CVE-2021-3521-01.patch | 60 ++++ .../rpm/files/CVE-2021-3521-02.patch | 55 +++ .../rpm/files/CVE-2021-3521-03.patch | 34 ++ .../rpm/files/CVE-2021-3521.patch | 330 ++++++++++++++++++ meta/recipes-devtools/rpm/rpm_4.14.2.1.bb | 4 + 5 files changed, 483 insertions(+) create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521-01.patch create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521-02.patch create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521-03.patch create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521.patch diff --git a/meta/recipes-devtools/rpm/files/CVE-2021-3521-01.patch b/meta/recipes-devtools/rpm/files/CVE-2021-3521-01.patch new file mode 100644 index 0000000000..0882d6f310 --- /dev/null +++ b/meta/recipes-devtools/rpm/files/CVE-2021-3521-01.patch @@ -0,0 +1,60 @@ +From b5e8bc74b2b05aa557f663fe227b94d2bc64fbd8 Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Thu, 30 Sep 2021 09:51:10 +0300 +Subject: [PATCH] Process MPI's from all kinds of signatures + +No immediate effect but needed by the following commits. + +Dependent patch: +CVE: CVE-2021-3521 +Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/commit/b5e8bc74b2b05aa557f663fe227b94d2bc64fbd8] +Signed-off-by: Riyaz Khan + +--- + rpmio/rpmpgp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c +index ee5c81e246..340de5fc9a 100644 +--- a/rpmio/rpmpgp.c ++++ b/rpmio/rpmpgp.c +@@ -511,7 +511,7 @@ pgpDigAlg pgpDigAlgFree(pgpDigAlg alg) + return NULL; + } + +-static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype, ++static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, + const uint8_t *p, const uint8_t *h, size_t hlen, + pgpDigParams sigp) + { +@@ -524,10 +524,8 @@ static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype, + int mpil = pgpMpiLen(p); + if (p + mpil > pend) + break; +- if (sigtype == PGPSIGTYPE_BINARY || sigtype == PGPSIGTYPE_TEXT) { +- if (sigalg->setmpi(sigalg, i, p)) +- break; +- } ++ if (sigalg->setmpi(sigalg, i, p)) ++ break; + p += mpil; + } + +@@ -600,7 +598,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen, + } + + p = ((uint8_t *)v) + sizeof(*v); +- rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp); ++ rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp); + } break; + case 4: + { pgpPktSigV4 v = (pgpPktSigV4)h; +@@ -658,7 +656,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen, + if (p > (h + hlen)) + return 1; + +- rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp); ++ rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp); + } break; + default: + rpmlog(RPMLOG_WARNING, _("Unsupported version of key: V%d\n"), version); diff --git a/meta/recipes-devtools/rpm/files/CVE-2021-3521-02.patch b/meta/recipes-devtools/rpm/files/CVE-2021-3521-02.patch new file mode 100644 index 0000000000..c5f88a8c72 --- /dev/null +++ b/meta/recipes-devtools/rpm/files/CVE-2021-3521-02.patch @@ -0,0 +1,55 @@ +From 9f03f42e2614a68f589f9db8fe76287146522c0c Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Thu, 30 Sep 2021 09:56:20 +0300 +Subject: [PATCH] Refactor pgpDigParams construction to helper function + +No functional changes, just to reduce code duplication and needed by +the following commits. + +Dependent patch: +CVE: CVE-2021-3521 +Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/commit/9f03f42e2614a68f589f9db8fe76287146522c0c] +Signed-off-by: Riyaz Khan + +--- + rpmio/rpmpgp.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c +index 340de5fc9a..aad7c275c9 100644 +--- a/rpmio/rpmpgp.c ++++ b/rpmio/rpmpgp.c +@@ -1055,6 +1055,13 @@ unsigned int pgpDigParamsAlgo(pgpDigParams digp, unsigned int algotype) + return algo; + } + ++static pgpDigParams pgpDigParamsNew(uint8_t tag) ++{ ++ pgpDigParams digp = xcalloc(1, sizeof(*digp)); ++ digp->tag = tag; ++ return digp; ++} ++ + int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype, + pgpDigParams * ret) + { +@@ -1072,8 +1079,7 @@ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype, + if (pkttype && pkt.tag != pkttype) { + break; + } else { +- digp = xcalloc(1, sizeof(*digp)); +- digp->tag = pkt.tag; ++ digp = pgpDigParamsNew(pkt.tag); + } + } + +@@ -1121,8 +1127,7 @@ int pgpPrtParamsSubkeys(const uint8_t *pkts, size_t pktlen, + digps = xrealloc(digps, alloced * sizeof(*digps)); + } + +- digps[count] = xcalloc(1, sizeof(**digps)); +- digps[count]->tag = PGPTAG_PUBLIC_SUBKEY; ++ digps[count] = pgpDigParamsNew(PGPTAG_PUBLIC_SUBKEY); + /* Copy UID from main key to subkey */ + digps[count]->userid = xstrdup(mainkey->userid); + diff --git a/meta/recipes-devtools/rpm/files/CVE-2021-3521-03.patch b/meta/recipes-devtools/rpm/files/CVE-2021-3521-03.patch new file mode 100644 index 0000000000..fd31f11beb --- /dev/null +++ b/meta/recipes-devtools/rpm/files/CVE-2021-3521-03.patch @@ -0,0 +1,34 @@ +From 5ff86764b17f31535cb247543a90dd739076ec38 Mon Sep 17 00:00:00 2001 +From: Demi Marie Obenour +Date: Thu, 6 May 2021 18:34:45 -0400 +Subject: [PATCH] Do not allow extra packets to follow a signature +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +According to RFC 4880 § 11.4, a detached signature is “simply a +Signature packet”. Therefore, extra packets following a detached +signature are not allowed. + +Dependent patch: +CVE: CVE-2021-3521 +Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/commit/5ff86764b17f31535cb247543a90dd739076ec38] +Signed-off-by: Riyaz Khan + +--- + rpmio/rpmpgp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c +index f1a99e7169..5b346a8253 100644 +--- a/rpmio/rpmpgp.c ++++ b/rpmio/rpmpgp.c +@@ -1068,6 +1068,8 @@ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype, + break; + + p += (pkt.body - pkt.head) + pkt.blen; ++ if (pkttype == PGPTAG_SIGNATURE) ++ break; + } + + rc = (digp && (p == pend)) ? 0 : -1; diff --git a/meta/recipes-devtools/rpm/files/CVE-2021-3521.patch b/meta/recipes-devtools/rpm/files/CVE-2021-3521.patch new file mode 100644 index 0000000000..cb9e9842fe --- /dev/null +++ b/meta/recipes-devtools/rpm/files/CVE-2021-3521.patch @@ -0,0 +1,330 @@ +From bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Thu, 30 Sep 2021 09:59:30 +0300 +Subject: [PATCH] Validate and require subkey binding signatures on PGP public + keys + +All subkeys must be followed by a binding signature by the primary key +as per the OpenPGP RFC, enforce the presence and validity in the parser. + +The implementation is as kludgey as they come to work around our +simple-minded parser structure without touching API, to maximise +backportability. Store all the raw packets internally as we decode them +to be able to access previous elements at will, needed to validate ordering +and access the actual data. Add testcases for manipulated keys whose +import previously would succeed. + +Depends on the two previous commits: +7b399fcb8f52566e6f3b4327197a85facd08db91 and +236b802a4aa48711823a191d1b7f753c82a89ec5 + +CVE: CVE-2021-3521 +Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8] +Comment: Hunk refreshed +Signed-off-by: Riyaz Khan + +Fixes CVE-2021-3521. +--- + rpmio/rpmpgp.c | 98 +++++++++++++++++-- + tests/Makefile.am | 3 + + tests/data/keys/CVE-2021-3521-badbind.asc | 25 +++++ + .../data/keys/CVE-2021-3521-nosubsig-last.asc | 25 +++++ + tests/data/keys/CVE-2021-3521-nosubsig.asc | 37 +++++++ + tests/rpmsigdig.at | 28 ++++++ + 6 files changed, 209 insertions(+), 7 deletions(-) + create mode 100644 tests/data/keys/CVE-2021-3521-badbind.asc + create mode 100644 tests/data/keys/CVE-2021-3521-nosubsig-last.asc + create mode 100644 tests/data/keys/CVE-2021-3521-nosubsig.asc + +diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c +index aad7c275c9..d70802ae86 100644 +--- a/rpmio/rpmpgp.c ++++ b/rpmio/rpmpgp.c +@@ -1004,37 +1004,121 @@ static pgpDigParams pgpDigParamsNew(uint8_t tag) + return digp; + } + ++static int hashKey(DIGEST_CTX hash, const struct pgpPkt *pkt, int exptag) ++{ ++ int rc = -1; ++ if (pkt->tag == exptag) { ++ uint8_t head[] = { ++ 0x99, ++ (pkt->blen >> 8), ++ (pkt->blen ), ++ }; ++ ++ rpmDigestUpdate(hash, head, 3); ++ rpmDigestUpdate(hash, pkt->body, pkt->blen); ++ rc = 0; ++ } ++ return rc; ++} ++ ++static int pgpVerifySelf(pgpDigParams key, pgpDigParams selfsig, ++ const struct pgpPkt *all, int i) ++{ ++ int rc = -1; ++ DIGEST_CTX hash = NULL; ++ ++ switch (selfsig->sigtype) { ++ case PGPSIGTYPE_SUBKEY_BINDING: ++ hash = rpmDigestInit(selfsig->hash_algo, 0); ++ if (hash) { ++ rc = hashKey(hash, &all[0], PGPTAG_PUBLIC_KEY); ++ if (!rc) ++ rc = hashKey(hash, &all[i-1], PGPTAG_PUBLIC_SUBKEY); ++ } ++ break; ++ default: ++ /* ignore types we can't handle */ ++ rc = 0; ++ break; ++ } ++ ++ if (hash && rc == 0) ++ rc = pgpVerifySignature(key, selfsig, hash); ++ ++ rpmDigestFinal(hash, NULL, NULL, 0); ++ ++ return rc; ++} ++ + int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype, + pgpDigParams * ret) + { + const uint8_t *p = pkts; + const uint8_t *pend = pkts + pktlen; + pgpDigParams digp = NULL; +- struct pgpPkt pkt; ++ pgpDigParams selfsig = NULL; ++ int i = 0; ++ int alloced = 16; /* plenty for normal cases */ ++ struct pgpPkt *all = xmalloc(alloced * sizeof(*all)); + int rc = -1; /* assume failure */ ++ int expect = 0; ++ int prevtag = 0; + + while (p < pend) { +- if (decodePkt(p, (pend - p), &pkt)) ++ struct pgpPkt *pkt = &all[i]; ++ if (decodePkt(p, (pend - p), pkt)) + break; + + if (digp == NULL) { +- if (pkttype && pkt.tag != pkttype) { ++ if (pkttype && pkt->tag != pkttype) { + break; + } else { +- digp = pgpDigParamsNew(pkt.tag); ++ digp = pgpDigParamsNew(pkt->tag); + } + } + +- if (pgpPrtPkt(&pkt, digp)) ++ if (expect) { ++ if (pkt->tag != expect) ++ break; ++ selfsig = pgpDigParamsNew(pkt->tag); ++ } ++ ++ if (pgpPrtPkt(pkt, selfsig ? selfsig : digp)) + break; + +- p += (pkt.body - pkt.head) + pkt.blen; ++ if (selfsig) { ++ /* subkeys must be followed by binding signature */ ++ if (prevtag == PGPTAG_PUBLIC_SUBKEY) { ++ if (selfsig->sigtype != PGPSIGTYPE_SUBKEY_BINDING) ++ break; ++ } ++ ++ int xx = pgpVerifySelf(digp, selfsig, all, i); ++ ++ selfsig = pgpDigParamsFree(selfsig); ++ if (xx) ++ break; ++ expect = 0; ++ } ++ ++ if (pkt->tag == PGPTAG_PUBLIC_SUBKEY) ++ expect = PGPTAG_SIGNATURE; ++ prevtag = pkt->tag; ++ ++ i++; ++ p += (pkt->body - pkt->head) + pkt->blen; + if (pkttype == PGPTAG_SIGNATURE) + break; ++ ++ if (alloced <= i) { ++ alloced *= 2; ++ all = xrealloc(all, alloced * sizeof(*all)); ++ } + } + +- rc = (digp && (p == pend)) ? 0 : -1; ++ rc = (digp && (p == pend) && expect == 0) ? 0 : -1; + ++ free(all); + if (ret && rc == 0) { + *ret = digp; + } else { +diff --git a/tests/Makefile.am b/tests/Makefile.am +index b4a2e2e1ce..bc535d2833 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -87,6 +87,9 @@ EXTRA_DIST += data/SPECS/hello-config-buildid.spec + EXTRA_DIST += data/SPECS/hello-cd.spec + EXTRA_DIST += data/keys/rpm.org-rsa-2048-test.pub + EXTRA_DIST += data/keys/rpm.org-rsa-2048-test.secret ++EXTRA_DIST += data/keys/CVE-2021-3521-badbind.asc ++EXTRA_DIST += data/keys/CVE-2021-3521-nosubsig.asc ++EXTRA_DIST += data/keys/CVE-2021-3521-nosubsig-last.asc + EXTRA_DIST += data/macros.testfile + + # testsuite voodoo +diff --git a/tests/data/keys/CVE-2021-3521-badbind.asc b/tests/data/keys/CVE-2021-3521-badbind.asc +new file mode 100644 +index 0000000000..aea00f9d7a +--- /dev/null ++++ b/tests/data/keys/CVE-2021-3521-badbind.asc +@@ -0,0 +1,25 @@ ++-----BEGIN PGP PUBLIC KEY BLOCK----- ++Version: rpm-4.17.90 (NSS-3) ++ ++mQENBFjmORgBCAC7TMEk6wnjSs8Dr4yqSScWdU2pjcqrkTxuzdWvowcIUPZI0w/g ++HkRqGd4apjvY2V15kjL10gk3QhFP3pZ/9p7zh8o8NHX7aGdSGDK7NOq1eFaErPRY ++91LW9RiZ0lbOjXEzIL0KHxUiTQEmdXJT43DJMFPyW9fkCWg0OltiX618FUdWWfI8 ++eySdLur1utnqBvdEbCUvWK2RX3vQZQdvEBODnNk2pxqTyV0w6VPQ96W++lF/5Aas ++7rUv3HIyIXxIggc8FRrnH+y9XvvHDonhTIlGnYZN4ubm9i4y3gOkrZlGTrEw7elQ ++1QeMyG2QQEbze8YjpTm4iLABCBrRfPRaQpwrABEBAAG0IXJwbS5vcmcgUlNBIHRl ++c3RrZXkgPHJzYUBycG0ub3JnPokBNwQTAQgAIQUCWOY5GAIbAwULCQgHAgYVCAkK ++CwIEFgIDAQIeAQIXgAAKCRBDRFkeGWTF/MxxCACnjqFL+MmPh9W9JQKT2DcLbBzf ++Cqo6wcEBoCOcwgRSk8dSikhARoteoa55JRJhuMyeKhhEAogE9HRmCPFdjezFTwgB ++BDVBpO2dZ023mLXDVCYX3S8pShOgCP6Tn4wqCnYeAdLcGg106N4xcmgtcssJE+Pr ++XzTZksbZsrTVEmL/Ym+R5w5jBfFnGk7Yw7ndwfQsfNXQb5AZynClFxnX546lcyZX ++fEx3/e6ezw57WNOUK6WT+8b+EGovPkbetK/rGxNXuWaP6X4A/QUm8O98nCuHYFQq +++mvNdsCBqGf7mhaRGtpHk/JgCn5rFvArMDqLVrR9hX0LdCSsH7EGE+bR3r7wuQEN ++BFjmORgBCACk+vDZrIXQuFXEYToZVwb2attzbbJJCqD71vmZTLsW0QxuPKRgbcYY ++zp4K4lVBnHhFrF8MOUOxJ7kQWIJZMZFt+BDcptCYurbD2H4W2xvnWViiC+LzCMzz ++iMJT6165uefL4JHTDPxC2fFiM9yrc72LmylJNkM/vepT128J5Qv0gRUaQbHiQuS6 ++Dm/+WRnUfx3i89SV4mnBxb/Ta93GVqoOciWwzWSnwEnWYAvOb95JL4U7c5J5f/+c ++KnQDHsW7sIiIdscsWzvgf6qs2Ra1Zrt7Fdk4+ZS2f/adagLhDO1C24sXf5XfMk5m ++L0OGwZSr9m5s17VXxfspgU5ugc8kBJfzABEBAAE= ++=WCfs ++-----END PGP PUBLIC KEY BLOCK----- ++ +diff --git a/tests/data/keys/CVE-2021-3521-nosubsig-last.asc b/tests/data/keys/CVE-2021-3521-nosubsig-last.asc +new file mode 100644 +index 0000000000..aea00f9d7a +--- /dev/null ++++ b/tests/data/keys/CVE-2021-3521-nosubsig-last.asc +@@ -0,0 +1,25 @@ ++-----BEGIN PGP PUBLIC KEY BLOCK----- ++Version: rpm-4.17.90 (NSS-3) ++ ++mQENBFjmORgBCAC7TMEk6wnjSs8Dr4yqSScWdU2pjcqrkTxuzdWvowcIUPZI0w/g ++HkRqGd4apjvY2V15kjL10gk3QhFP3pZ/9p7zh8o8NHX7aGdSGDK7NOq1eFaErPRY ++91LW9RiZ0lbOjXEzIL0KHxUiTQEmdXJT43DJMFPyW9fkCWg0OltiX618FUdWWfI8 ++eySdLur1utnqBvdEbCUvWK2RX3vQZQdvEBODnNk2pxqTyV0w6VPQ96W++lF/5Aas ++7rUv3HIyIXxIggc8FRrnH+y9XvvHDonhTIlGnYZN4ubm9i4y3gOkrZlGTrEw7elQ ++1QeMyG2QQEbze8YjpTm4iLABCBrRfPRaQpwrABEBAAG0IXJwbS5vcmcgUlNBIHRl ++c3RrZXkgPHJzYUBycG0ub3JnPokBNwQTAQgAIQUCWOY5GAIbAwULCQgHAgYVCAkK ++CwIEFgIDAQIeAQIXgAAKCRBDRFkeGWTF/MxxCACnjqFL+MmPh9W9JQKT2DcLbBzf ++Cqo6wcEBoCOcwgRSk8dSikhARoteoa55JRJhuMyeKhhEAogE9HRmCPFdjezFTwgB ++BDVBpO2dZ023mLXDVCYX3S8pShOgCP6Tn4wqCnYeAdLcGg106N4xcmgtcssJE+Pr ++XzTZksbZsrTVEmL/Ym+R5w5jBfFnGk7Yw7ndwfQsfNXQb5AZynClFxnX546lcyZX ++fEx3/e6ezw57WNOUK6WT+8b+EGovPkbetK/rGxNXuWaP6X4A/QUm8O98nCuHYFQq +++mvNdsCBqGf7mhaRGtpHk/JgCn5rFvArMDqLVrR9hX0LdCSsH7EGE+bR3r7wuQEN ++BFjmORgBCACk+vDZrIXQuFXEYToZVwb2attzbbJJCqD71vmZTLsW0QxuPKRgbcYY ++zp4K4lVBnHhFrF8MOUOxJ7kQWIJZMZFt+BDcptCYurbD2H4W2xvnWViiC+LzCMzz ++iMJT6165uefL4JHTDPxC2fFiM9yrc72LmylJNkM/vepT128J5Qv0gRUaQbHiQuS6 ++Dm/+WRnUfx3i89SV4mnBxb/Ta93GVqoOciWwzWSnwEnWYAvOb95JL4U7c5J5f/+c ++KnQDHsW7sIiIdscsWzvgf6qs2Ra1Zrt7Fdk4+ZS2f/adagLhDO1C24sXf5XfMk5m ++L0OGwZSr9m5s17VXxfspgU5ugc8kBJfzABEBAAE= ++=WCfs ++-----END PGP PUBLIC KEY BLOCK----- ++ +diff --git a/tests/data/keys/CVE-2021-3521-nosubsig.asc b/tests/data/keys/CVE-2021-3521-nosubsig.asc +new file mode 100644 +index 0000000000..3a2e7417f8 +--- /dev/null ++++ b/tests/data/keys/CVE-2021-3521-nosubsig.asc +@@ -0,0 +1,37 @@ ++-----BEGIN PGP PUBLIC KEY BLOCK----- ++Version: rpm-4.17.90 (NSS-3) ++ ++mQENBFjmORgBCAC7TMEk6wnjSs8Dr4yqSScWdU2pjcqrkTxuzdWvowcIUPZI0w/g ++HkRqGd4apjvY2V15kjL10gk3QhFP3pZ/9p7zh8o8NHX7aGdSGDK7NOq1eFaErPRY ++91LW9RiZ0lbOjXEzIL0KHxUiTQEmdXJT43DJMFPyW9fkCWg0OltiX618FUdWWfI8 ++eySdLur1utnqBvdEbCUvWK2RX3vQZQdvEBODnNk2pxqTyV0w6VPQ96W++lF/5Aas ++7rUv3HIyIXxIggc8FRrnH+y9XvvHDonhTIlGnYZN4ubm9i4y3gOkrZlGTrEw7elQ ++1QeMyG2QQEbze8YjpTm4iLABCBrRfPRaQpwrABEBAAG0IXJwbS5vcmcgUlNBIHRl ++c3RrZXkgPHJzYUBycG0ub3JnPokBNwQTAQgAIQUCWOY5GAIbAwULCQgHAgYVCAkK ++CwIEFgIDAQIeAQIXgAAKCRBDRFkeGWTF/MxxCACnjqFL+MmPh9W9JQKT2DcLbBzf ++Cqo6wcEBoCOcwgRSk8dSikhARoteoa55JRJhuMyeKhhEAogE9HRmCPFdjezFTwgB ++BDVBpO2dZ023mLXDVCYX3S8pShOgCP6Tn4wqCnYeAdLcGg106N4xcmgtcssJE+Pr ++XzTZksbZsrTVEmL/Ym+R5w5jBfFnGk7Yw7ndwfQsfNXQb5AZynClFxnX546lcyZX ++fEx3/e6ezw57WNOUK6WT+8b+EGovPkbetK/rGxNXuWaP6X4A/QUm8O98nCuHYFQq +++mvNdsCBqGf7mhaRGtpHk/JgCn5rFvArMDqLVrR9hX0LdCSsH7EGE+bR3r7wuQEN ++BFjmORgBCACk+vDZrIXQuFXEYToZVwb2attzbbJJCqD71vmZTLsW0QxuPKRgbcYY ++zp4K4lVBnHhFrF8MOUOxJ7kQWIJZMZFt+BDcptCYurbD2H4W2xvnWViiC+LzCMzz ++iMJT6165uefL4JHTDPxC2fFiM9yrc72LmylJNkM/vepT128J5Qv0gRUaQbHiQuS6 ++Dm/+WRnUfx3i89SV4mnBxb/Ta93GVqoOciWwzWSnwEnWYAvOb95JL4U7c5J5f/+c ++KnQDHsW7sIiIdscsWzvgf6qs2Ra1Zrt7Fdk4+ZS2f/adagLhDO1C24sXf5XfMk5m ++L0OGwZSr9m5s17VXxfspgU5ugc8kBJfzABEBAAG5AQ0EWOY5GAEIAKT68NmshdC4 ++VcRhOhlXBvZq23NtskkKoPvW+ZlMuxbRDG48pGBtxhjOngriVUGceEWsXww5Q7En ++uRBYglkxkW34ENym0Ji6tsPYfhbbG+dZWKIL4vMIzPOIwlPrXrm558vgkdMM/ELZ ++8WIz3KtzvYubKUk2Qz+96lPXbwnlC/SBFRpBseJC5LoOb/5ZGdR/HeLz1JXiacHF ++v9Nr3cZWqg5yJbDNZKfASdZgC85v3kkvhTtzknl//5wqdAMexbuwiIh2xyxbO+B/ ++qqzZFrVmu3sV2Tj5lLZ/9p1qAuEM7ULbixd/ld8yTmYvQ4bBlKv2bmzXtVfF+ymB ++Tm6BzyQEl/MAEQEAAYkBHwQYAQgACQUCWOY5GAIbDAAKCRBDRFkeGWTF/PANB/9j ++mifmj6z/EPe0PJFhrpISt9PjiUQCt0IPtiL5zKAkWjHePIzyi+0kCTBF6DDLFxos ++3vN4bWnVKT1kBhZAQlPqpJTg+m74JUYeDGCdNx9SK7oRllATqyu+5rncgxjWVPnQ ++zu/HRPlWJwcVFYEVXYL8xzfantwQTqefjmcRmBRdA2XJITK+hGWwAmrqAWx+q5xX ++Pa8wkNMxVzNS2rUKO9SoVuJ/wlUvfoShkJ/VJ5HDp3qzUqncADfdGN35TDzscngQ ++gHvnMwVBfYfSCABV1hNByoZcc/kxkrWMmsd/EnIyLd1Q1baKqc3cEDuC6E6/o4yJ ++E4XX4jtDmdZPreZALsiB ++=rRop ++-----END PGP PUBLIC KEY BLOCK----- ++ +diff --git a/tests/rpmsigdig.at b/tests/rpmsigdig.at +index 0f8f2b4884..c8b9f139e1 100644 +--- a/tests/rpmsigdig.at ++++ b/tests/rpmsigdig.at +@@ -240,6 +240,34 @@ gpg(185e6146f00650f8) = 4:185e6146f00650f8-58e63918 + []) + AT_CLEANUP + ++AT_SETUP([rpmkeys --import invalid keys]) ++AT_KEYWORDS([rpmkeys import]) ++RPMDB_INIT ++ ++AT_CHECK([ ++runroot rpmkeys --import /data/keys/CVE-2021-3521-badbind.asc ++], ++[1], ++[], ++[error: /data/keys/CVE-2021-3521-badbind.asc: key 1 import failed.] ++) ++AT_CHECK([ ++runroot rpmkeys --import /data/keys/CVE-2021-3521-nosubsig.asc ++], ++[1], ++[], ++[error: /data/keys/CVE-2021-3521-nosubsig.asc: key 1 import failed.] ++) ++ ++AT_CHECK([ ++runroot rpmkeys --import /data/keys/CVE-2021-3521-nosubsig-last.asc ++], ++[1], ++[], ++[error: /data/keys/CVE-2021-3521-nosubsig-last.asc: key 1 import failed.] ++) ++AT_CLEANUP ++ + # ------------------------------ + # Test pre-built package verification + AT_SETUP([rpmkeys -K 1]) + diff --git a/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb b/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb index 376021d913..4d605c8501 100644 --- a/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb +++ b/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb @@ -47,6 +47,10 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;branch=rpm-4.14.x;protoc file://0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch \ file://CVE-2021-3421.patch \ file://CVE-2021-20266.patch \ + file://CVE-2021-3521-01.patch \ + file://CVE-2021-3521-02.patch \ + file://CVE-2021-3521-03.patch \ + file://CVE-2021-3521.patch \ " PE = "1" From patchwork Fri Dec 16 14:57:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16835 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18BDEC4708D for ; Fri, 16 Dec 2022 14:58:15 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.web11.15121.1671202686156831583 for ; Fri, 16 Dec 2022 06:58:06 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=14rlbPod; spf=softfail (domain: sakoman.com, ip: 209.85.216.51, mailfrom: steve@sakoman.com) Received: by mail-pj1-f51.google.com with SMTP id n65-20020a17090a2cc700b0021bc5ef7a14so2654823pjd.0 for ; Fri, 16 Dec 2022 06:58:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=jyb/GeSl4CpOWkkZgwxDdI75bbhbO//A/Ln5xbgsBPs=; b=14rlbPodL1oo9IszhOZN89GU7ayrGDU+bsT8CCoe/EHQ59x5HReqKTzFcka1lnWJiU 1GVMyYOwM3VyfnEHdCZ7PfBHsPqgfgq0JvfruLAQv3CzVZbXHXLP3VTM9XVZVbUcAKa+ xl+zm4d0czCJT5Ls5CpcMHIlORhqGVDxIo7JRBctqsMkW1RhC3RgqhWIYFQovw28PzBy YADdPFZ6VK1ic+QStdFktjbgNYHXtp7MfmbURvpue+y1H9Hx0bXmUP3a5MwDCMAKCaQp gQYJfSC6Ud+gr46PLPLtYQIKXWzW7rqjqXbHvlrosQAD02VANyr5HYHvFz+ki8R/cANO OGJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jyb/GeSl4CpOWkkZgwxDdI75bbhbO//A/Ln5xbgsBPs=; b=2EntGeXVi79DlGUROaEIV/XCecDMdeFznuBqgJhE1/OvJZhpWCP5rMPVhQxmvATna0 qVwsaqz9CvESgR/fAndfmriAr6wa4eQoNIM/9KbXho2Uqr+sjYjzBMKnsLQ1nsUnVxNg H7Qgm+3lTLbaywucrsb7njpY1pbu0b2XA9SIdGI3RByDqE4MOWHs4HGwZBx63Nb0klf5 NdqPe5+c4JHYpMTWemgMioc92Jo5BQ4u/U4Q43qOJZ6UfBjXb6DMEXep1Qj/5SygUkSe 1j8p4ZhIQo0/vALK+l0KlTCTWETwQlDa2Y9Z4ryLmgQr1umN5qZN6AfRr6EWBeO8yCTb B6kQ== X-Gm-Message-State: ANoB5pmirQYrXDxydCvFVi4gqUAQToXCbWkj7ObsMMJMt2KGQPX7cKEa 1XUY8KNaaKDRbojr2rtXDypAE47smreR6qeFfmI= X-Google-Smtp-Source: AA0mqf5AwcmlCs493+rjc5kxcJNdQ7gIutbjkVSJSAem+0oWiGVgPoJOC+WQYBRu5fOWnXSNHIz+Sg== X-Received: by 2002:a17:90a:c584:b0:219:9eaa:80ef with SMTP id l4-20020a17090ac58400b002199eaa80efmr40355640pjt.14.1671202685141; Fri, 16 Dec 2022 06:58:05 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.03 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:04 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 03/13] curl: Fix CVE CVE-2022-35260 Date: Fri, 16 Dec 2022 04:57:42 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174747 From: Mathieu Dubois-Briand Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Steve Sakoman --- .../curl/curl/CVE-2022-35260.patch | 68 +++++++++++++++++++ meta/recipes-support/curl/curl_7.69.1.bb | 1 + 2 files changed, 69 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2022-35260.patch diff --git a/meta/recipes-support/curl/curl/CVE-2022-35260.patch b/meta/recipes-support/curl/curl/CVE-2022-35260.patch new file mode 100644 index 0000000000..476c996b0a --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2022-35260.patch @@ -0,0 +1,68 @@ +From 3ff3989ec53d9ddcf4bdd99f5d5788dd87486768 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 4 Oct 2022 14:37:24 +0200 +Subject: [PATCH] netrc: replace fgets with Curl_get_line + +Upstream-Status: Backport +CVE: CVE-2022-35260 +Reference to upstream patch: https://github.com/curl/curl/commit/c97ec984fb2bc919a3aa863e0476dffa377b184c + +Make the parser only accept complete lines and avoid problems with +overly long lines. + +Reported-by: Hiroki Kurosawa + +Closes #9789 +--- + lib/curl_get_line.c | 4 ++-- + lib/netrc.c | 5 +++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/lib/curl_get_line.c b/lib/curl_get_line.c +index c4194851ae09..4b9eea9e631c 100644 +--- a/lib/curl_get_line.c ++++ b/lib/curl_get_line.c +@@ -28,8 +28,8 @@ + #include "memdebug.h" + + /* +- * get_line() makes sure to only return complete whole lines that fit in 'len' +- * bytes and end with a newline. ++ * Curl_get_line() makes sure to only return complete whole lines that fit in ++ * 'len' bytes and end with a newline. + */ + char *Curl_get_line(char *buf, int len, FILE *input) + { +diff --git a/lib/netrc.c b/lib/netrc.c +index 1c9da31993c9..93239132c9d8 100644 +--- a/lib/netrc.c ++++ b/lib/netrc.c +@@ -31,6 +31,7 @@ + #include "netrc.h" + #include "strtok.h" + #include "strcase.h" ++#include "curl_get_line.h" + + /* The last 3 #include files should be in this order */ + #include "curl_printf.h" +@@ -83,7 +84,7 @@ static int parsenetrc(const char *host, + char netrcbuffer[4096]; + int netrcbuffsize = (int)sizeof(netrcbuffer); + +- while(!done && fgets(netrcbuffer, netrcbuffsize, file)) { ++ while(!done && Curl_get_line(netrcbuffer, netrcbuffsize, file)) { + tok = strtok_r(netrcbuffer, " \t\n", &tok_buf); + if(tok && *tok == '#') + /* treat an initial hash as a comment line */ +@@ -169,7 +170,7 @@ static int parsenetrc(const char *host, + + tok = strtok_r(NULL, " \t\n", &tok_buf); + } /* while(tok) */ +- } /* while fgets() */ ++ } /* while Curl_get_line() */ + + out: + if(!retcode) { +-- +2.34.1 + diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support/curl/curl_7.69.1.bb index 31aa9d7185..63faae6296 100644 --- a/meta/recipes-support/curl/curl_7.69.1.bb +++ b/meta/recipes-support/curl/curl_7.69.1.bb @@ -40,6 +40,7 @@ SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \ file://CVE-2022-32208.patch \ file://CVE-2022-35252.patch \ file://CVE-2022-32221.patch \ + file://CVE-2022-35260.patch \ " SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42" From patchwork Fri Dec 16 14:57:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16839 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25023C3DA78 for ; Fri, 16 Dec 2022 14:58:15 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.web10.14912.1671202688102784109 for ; Fri, 16 Dec 2022 06:58:08 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=wSZCUrJ/; spf=softfail (domain: sakoman.com, ip: 209.85.216.49, mailfrom: steve@sakoman.com) Received: by mail-pj1-f49.google.com with SMTP id o12so2714252pjo.4 for ; Fri, 16 Dec 2022 06:58:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=rVEQztKBd/b+f9yCeWePJp0wx+xAPsRCh8Ct0icPfPE=; b=wSZCUrJ/6fudiyL0Pg56WUOykQHsM0eNthOu18+Uf39mKqwQkLh9umUXjRLehpsMm1 8Gw4+wmDBecv2xFp4FBxjvHIs3u9b+ewvDmwwUrw3YqFqy91lPu4YliUmFp3J4hTSREX u18eZDRMUmq5KfCO63phcwa1OcVpjqbkxVNIKFzcsR3b36SLPyycpxAGq8RFYCNn/JGK xouIxueH8oSHcrpFg+okAAQ3E+wL/BfFY0zF4nVP7bNZh9Qg3lFEegaCisA25xWetH11 fc6Hn7EvWgs3pLp0SlEm5KEpYTu1tzPyk+Gx2uVqIqEGQiuLZATYDX8xe9/LmszGgMwB 2tPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=rVEQztKBd/b+f9yCeWePJp0wx+xAPsRCh8Ct0icPfPE=; b=7zAmJhc+/KdjhUvOrwqv5p0zsq2fV49njinrROGAJ5Xot6ZwHYdXhwU5Bp2N32WIuc rXQfkUSwBssbUF/4zQJAv/JNpI1KuYAHOM7eDvIwpiTX6Egi5FXXBy07alCwdclsNCT3 XjkZD8aLaqghC3k4IgktSeUbvqXa+ow+lgPkwfLZB/7gqq6bn+w9oOLQmq2YlZV6OBSR 2aUkdhUyjwmFBi4zF4NPZTymKUMwez+/W/UPtSPZQE0qEuaO6keHPkTmNiyV8qgK5i21 ccFy7NR6XjHdo40ps23+HnWnGcgT47fGZYXe61EtCFugUXQPkU9BQGRw7OeUzi/IJ26H Q+Eg== X-Gm-Message-State: ANoB5plXRXuRImYe091DWtYfuwu0kxD0Vl4Xb/P8Tah7/hcW0NPzcRX9 pSyRSrvADewfH4h/X0aeEK5VzH1soH/GOi6Ag3s= X-Google-Smtp-Source: AA0mqf6HJQ/JCjLD1SZOOiowucoG040jC2cg0h56fBs+dGyY7r21pSduUx3gyk6ikIWBzq/58cJM/w== X-Received: by 2002:a17:90b:2393:b0:219:a292:f6d1 with SMTP id mr19-20020a17090b239300b00219a292f6d1mr34125467pjb.33.1671202687097; Fri, 16 Dec 2022 06:58:07 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:06 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 04/13] libarchive: CVE-2022-36227 NULL pointer dereference in archive_write.c Date: Fri, 16 Dec 2022 04:57:43 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174748 From: Hitendra Prajapati Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/bff38efe8c110469c5080d387bec62a6ca15b1a5 Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman --- .../libarchive/CVE-2022-36227.patch | 43 +++++++++++++++++++ .../libarchive/libarchive_3.4.2.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch new file mode 100644 index 0000000000..980a0e884a --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch @@ -0,0 +1,43 @@ +From 6311080bff566fcc5591dadfd78efb41705b717f Mon Sep 17 00:00:00 2001 +From: obiwac +Date: Fri, 22 Jul 2022 22:41:10 +0200 +Subject: [PATCH] CVE-2022-36227 + +libarchive: CVE-2022-36227 Handle a `calloc` returning NULL (fixes #1754) + +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/bff38efe8c110469c5080d387bec62a6ca15b1a5] +CVE: CVE-2022-36227 +Signed-off-by: Hitendra Prajapati archive = _a; + f->state = ARCHIVE_WRITE_FILTER_STATE_NEW; + if (a->filter_first == NULL) +@@ -527,6 +531,10 @@ archive_write_open(struct archive *_a, void *client_data, + a->client_data = client_data; + + client_filter = __archive_write_allocate_filter(_a); ++ ++ if (client_filter == NULL) ++ return (ARCHIVE_FATAL); ++ + client_filter->open = archive_write_client_open; + client_filter->write = archive_write_client_write; + client_filter->close = archive_write_client_close; +-- +2.25.1 + diff --git a/meta/recipes-extended/libarchive/libarchive_3.4.2.bb b/meta/recipes-extended/libarchive/libarchive_3.4.2.bb index 7d2e7b711b..e0a6174d8b 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.4.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.4.2.bb @@ -39,6 +39,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://CVE-2021-23177.patch \ file://CVE-2021-31566-01.patch \ file://CVE-2021-31566-02.patch \ + file://CVE-2022-36227.patch \ " SRC_URI[md5sum] = "d953ed6b47694dadf0e6042f8f9ff451" From patchwork Fri Dec 16 14:57:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16838 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25226C4708E for ; Fri, 16 Dec 2022 14:58:15 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.web10.14915.1671202690074697750 for ; Fri, 16 Dec 2022 06:58:10 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=ExPGK4/F; spf=softfail (domain: sakoman.com, ip: 209.85.214.174, mailfrom: steve@sakoman.com) Received: by mail-pl1-f174.google.com with SMTP id l10so2546660plb.8 for ; Fri, 16 Dec 2022 06:58:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=XmZkGs6nyLWcH5jNiT+ZDuUXFhEURGe/m8anhZp2USQ=; b=ExPGK4/FrmlHiqDsWvDV0W2nVi0osPJ9G2JwA2YwiovSI5DAeIJohh5u7J0JKYFuB1 VuZmJjzz6SkqltWlT04i6SkaTsL79XZkZl2esfnVAOcyRG1NwrFeb9LhHtw1TcQ9y2bo q719atLGslpKEpHwsblNnfCKFJMPb3cZ/HaoVDgeibyl2orfLlYxppPTUDvmvAnHJs2r BCGo5JFE41qFmPOnreWJVlSTp/wdgRcvNVTmQQevvBcuzex8GNhsG3RJ6ur9ol1rM4rq 4HuV+Q5zXieNXpczCmw9DtaW4KdPadFtd31e83UHt1arHD8kPoBGXeTEPxsEuoa0+AOi fEEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=XmZkGs6nyLWcH5jNiT+ZDuUXFhEURGe/m8anhZp2USQ=; b=JzU5azwhXpGfN7CFmgNzakpgHe6hQ9F9xbiA/4ZnVGcMF5dx7f8TCGtxGIvSp2xXK1 XL7uvRJLVyWQrMEWSeydBqQ9TC4GR0EVbpg8JVMcB39bLSM5bHZNYAgNtqoiASpSRL4q wVZQpc0ma62qZPp4mYL0vcDY/dfn0hcLYoUCQLgCeDD4P07yg8ferUwaHkux96727+4y VXh0vbJ0/lqtANDbFCm4nqitZ78DPCPIf353ZWI1EC4pWABrdDDney7QHN14k0IX3fyt 8XYtG5g/A8QXjRF1C72C8skFz3KbWu9pYdzI04FoGRJc36+cYAARPJ2f6dZIkyvbYzUD vPuQ== X-Gm-Message-State: AFqh2krH9b8VHawMaEyxecTFJwpNfsTz3cMawCQH4VFFnnc7Ww+FaybK Y4CVJwKSuYie+K1uJsf2ef831oJemgrliRGY9tc= X-Google-Smtp-Source: AMrXdXtK3ZEQJ+U7ciWF/RL5n2vpsQ8pg7rKRQ7qTtpdqlKN+5KDNMrfkaXFmofk4+sb7SZtx0g4jw== X-Received: by 2002:a17:90b:ec1:b0:223:9cfb:2f9e with SMTP id gz1-20020a17090b0ec100b002239cfb2f9emr1136343pjb.22.1671202688955; Fri, 16 Dec 2022 06:58:08 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:08 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 05/13] sysstat: fix CVE-2022-39377 Date: Fri, 16 Dec 2022 04:57:44 -1000 Message-Id: <2e770eb2213f3d5ff25a75467395ed4738c756ea.1671202568.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174749 From: Hitendra Prajapati Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman --- .../sysstat/sysstat/CVE-2022-39377.patch | 92 +++++++++++++++++++ .../sysstat/sysstat_12.2.1.bb | 4 +- 2 files changed, 95 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-extended/sysstat/sysstat/CVE-2022-39377.patch diff --git a/meta/recipes-extended/sysstat/sysstat/CVE-2022-39377.patch b/meta/recipes-extended/sysstat/sysstat/CVE-2022-39377.patch new file mode 100644 index 0000000000..972cc8938b --- /dev/null +++ b/meta/recipes-extended/sysstat/sysstat/CVE-2022-39377.patch @@ -0,0 +1,92 @@ +From 9c4eaf150662ad40607923389d4519bc83b93540 Mon Sep 17 00:00:00 2001 +From: Sebastien +Date: Sat, 15 Oct 2022 14:24:22 +0200 +Subject: [PATCH] Fix size_t overflow in sa_common.c (GHSL-2022-074) + +allocate_structures function located in sa_common.c insufficiently +checks bounds before arithmetic multiplication allowing for an +overflow in the size allocated for the buffer representing system +activities. + +This patch checks that the post-multiplied value is not greater than +UINT_MAX. + +Signed-off-by: Sebastien + +Upstream-Status: Backport [https://github.com/sysstat/sysstat/commit/9c4eaf150662ad40607923389d4519bc83b93540] +CVE : CVE-2022-39377 +Signed-off-by: Hitendra Prajapati +--- + common.c | 25 +++++++++++++++++++++++++ + common.h | 2 ++ + sa_common.c | 6 ++++++ + 3 files changed, 33 insertions(+) + +diff --git a/common.c b/common.c +index ddfe75d..28d475e 100644 +--- a/common.c ++++ b/common.c +@@ -1528,4 +1528,29 @@ int parse_values(char *strargv, unsigned char bitmap[], int max_val, const char + + return 0; + } ++ ++/* ++ *************************************************************************** ++ * Check if the multiplication of the 3 values may be greater than UINT_MAX. ++ * ++ * IN: ++ * @val1 First value. ++ * @val2 Second value. ++ * @val3 Third value. ++ *************************************************************************** ++ */ ++void check_overflow(size_t val1, size_t val2, size_t val3) ++{ ++ if ((unsigned long long) val1 * ++ (unsigned long long) val2 * ++ (unsigned long long) val3 > UINT_MAX) { ++#ifdef DEBUG ++ fprintf(stderr, "%s: Overflow detected (%llu). Aborting...\n", ++ __FUNCTION__, ++ (unsigned long long) val1 * (unsigned long long) val2 * (unsigned long long) val3); ++#endif ++ exit(4); ++ } ++} ++ + #endif /* SOURCE_SADC undefined */ +diff --git a/common.h b/common.h +index 86905ba..75f837a 100644 +--- a/common.h ++++ b/common.h +@@ -249,6 +249,8 @@ int get_wwnid_from_pretty + (char *, unsigned long long *, unsigned int *); + + #ifndef SOURCE_SADC ++void check_overflow ++ (size_t, size_t, size_t); + int count_bits + (void *, int); + int count_csvalues +diff --git a/sa_common.c b/sa_common.c +index 8a03099..ff90c1f 100644 +--- a/sa_common.c ++++ b/sa_common.c +@@ -452,7 +452,13 @@ void allocate_structures(struct activity *act[]) + int i, j; + + for (i = 0; i < NR_ACT; i++) { ++ + if (act[i]->nr_ini > 0) { ++ ++ /* Look for a possible overflow */ ++ check_overflow((size_t) act[i]->msize, (size_t) act[i]->nr_ini, ++ (size_t) act[i]->nr2); ++ + for (j = 0; j < 3; j++) { + SREALLOC(act[i]->buf[j], void, + (size_t) act[i]->msize * (size_t) act[i]->nr_ini * (size_t) act[i]->nr2); +-- +2.25.1 + diff --git a/meta/recipes-extended/sysstat/sysstat_12.2.1.bb b/meta/recipes-extended/sysstat/sysstat_12.2.1.bb index 2a90f89d25..2c0d5c8136 100644 --- a/meta/recipes-extended/sysstat/sysstat_12.2.1.bb +++ b/meta/recipes-extended/sysstat/sysstat_12.2.1.bb @@ -2,7 +2,9 @@ require sysstat.inc LIC_FILES_CHKSUM = "file://COPYING;md5=a23a74b3f4caf9616230789d94217acb" -SRC_URI += "file://0001-configure.in-remove-check-for-chkconfig.patch" +SRC_URI += "file://0001-configure.in-remove-check-for-chkconfig.patch \ + file://CVE-2022-39377.patch \ + " SRC_URI[md5sum] = "9dfff5fac24e35bd92fb7896debf2ffb" SRC_URI[sha256sum] = "8edb0e19b514ac560a098a02933a4735b881296d61014db89bf80f05dd7a4732" From patchwork Fri Dec 16 14:57:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16837 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DC87C3DA71 for ; Fri, 16 Dec 2022 14:58:15 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.web10.14916.1671202691847433743 for ; Fri, 16 Dec 2022 06:58:11 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=f86bqcci; spf=softfail (domain: sakoman.com, ip: 209.85.216.51, mailfrom: steve@sakoman.com) Received: by mail-pj1-f51.google.com with SMTP id fa4-20020a17090af0c400b002198d1328a0so8875567pjb.0 for ; Fri, 16 Dec 2022 06:58:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=RfPCxcsrb6Z3n71/Grod/lqHPgZJJ4Hn/29JX+YgF08=; b=f86bqcciL4dVaqn9SDjJgFML54iTGaYlCszlHALtDsD7C6ur2rSy236nXkkCrsF0vM vjjfuFme6LV7eRPqR/sAPLk1TGn/HKr8nxmJlKixTb8NIwleDE3beUgVi/AWgvYHwXKN u/F0W+nhM6fTpxkF4D8aIDPl3/KxfIpbp2HAprTavheq5gzWF52CHdesj0PCXjgIj82O RDEtf4kjtelCSMqnPHLoe3iUbsb1RVgkbCTt64qkLV7TaIq5asjko7Ig15IqXwIfIhbN ho1siAEDaoDNpwhuTtub7qnChgPOeN0Hx7JMZ8T14FjjWOIe9Bu9So2TNzJw8CAObbVo 4ysg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=RfPCxcsrb6Z3n71/Grod/lqHPgZJJ4Hn/29JX+YgF08=; b=Haf1w/Ad0cC/ICB3+AcneotNCcGsJF6aWwjUE41TEEgrQdVIe4q7JIIe4adKnlLNSG V0cCsdkNM1Q0QYMxG9kbxMT1pzo6+KiXGzFsVbsrHsb25dp61I+zE5glokW0sy+XXT5V srxnyCWggv3FX2d36W3LCmxaW9GpYnAbjc2109O+x3s3hDMWOfFUu7mRHqOp7OUGx8WI 5E2zF5J9l6m631COP6ElohhXKbZ5m611x6TtdtslNKV6uclBhlT1mZFthi2uvi6jF+RR 4SaaAp5Llspe/rcVZHT0HKl5Qjzg9wLdtkFfIaB2hw1nKGi9NHGN2wOHSg3oHCRD+qYY MTSA== X-Gm-Message-State: ANoB5pl1URL8nKGbZbxsv9cC508eNUBAtAukc4koCQHjlS19KAa+k1vh tj7WFdcppQPsc2F8ID8u/1IZ6xZNPIX0UwCEzms= X-Google-Smtp-Source: AA0mqf6uAcNzC4f/OUayDV2vGuXu4WlM/JhzYtEuvfZJq3qBSnMFdLhJiWa25cvXiOoZMX7JO08T4w== X-Received: by 2002:a17:90a:e391:b0:219:89c1:33ed with SMTP id b17-20020a17090ae39100b0021989c133edmr33299588pjz.46.1671202690805; Fri, 16 Dec 2022 06:58:10 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:10 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 06/13] dropbear: fix CVE-2021-36369 Date: Fri, 16 Dec 2022 04:57:45 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174750 From: Lee Chee Yang Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman --- meta/recipes-core/dropbear/dropbear.inc | 1 + .../dropbear/dropbear/CVE-2021-36369.patch | 145 ++++++++++++++++++ 2 files changed, 146 insertions(+) create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2021-36369.patch diff --git a/meta/recipes-core/dropbear/dropbear.inc b/meta/recipes-core/dropbear/dropbear.inc index 026292230c..0f5e9ba4ac 100644 --- a/meta/recipes-core/dropbear/dropbear.inc +++ b/meta/recipes-core/dropbear/dropbear.inc @@ -29,6 +29,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} \ file://CVE-2020-36254.patch \ + file://CVE-2021-36369.patch \ " PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \ diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2021-36369.patch b/meta/recipes-core/dropbear/dropbear/CVE-2021-36369.patch new file mode 100644 index 0000000000..5cabe8339d --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2021-36369.patch @@ -0,0 +1,145 @@ +From e10dec82930863e487b22978d3df107274f366b2 Mon Sep 17 00:00:00 2001 +From: Manfred Kaiser <37737811+manfred-kaiser@users.noreply.github.com> +Date: Thu, 19 Aug 2021 17:37:14 +0200 +Subject: [PATCH] added option to disable trivial auth methods (#128) + +* added option to disable trivial auth methods + +* rename argument to match with other ssh clients + +* fixed trivial auth detection for pubkeys + +[https://github.com/mkj/dropbear/pull/128] +Upstream-Status: Backport +CVE: CVE-2021-36369 +Signed-off-by: Chee Yang Lee + +--- + cli-auth.c | 3 +++ + cli-authinteract.c | 1 + + cli-authpasswd.c | 2 +- + cli-authpubkey.c | 1 + + cli-runopts.c | 7 +++++++ + cli-session.c | 1 + + runopts.h | 1 + + session.h | 1 + + 8 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/cli-auth.c b/cli-auth.c +index 2e509e5..6f04495 100644 +--- a/cli-auth.c ++++ b/cli-auth.c +@@ -267,6 +267,9 @@ void recv_msg_userauth_success() { + if DROPBEAR_CLI_IMMEDIATE_AUTH is set */ + + TRACE(("received msg_userauth_success")) ++ if (cli_opts.disable_trivial_auth && cli_ses.is_trivial_auth) { ++ dropbear_exit("trivial authentication not allowed"); ++ } + /* Note: in delayed-zlib mode, setting authdone here + * will enable compression in the transport layer */ + ses.authstate.authdone = 1; +diff --git a/cli-authinteract.c b/cli-authinteract.c +index e1cc9a1..f7128ee 100644 +--- a/cli-authinteract.c ++++ b/cli-authinteract.c +@@ -114,6 +114,7 @@ void recv_msg_userauth_info_request() { + m_free(instruction); + + for (i = 0; i < num_prompts; i++) { ++ cli_ses.is_trivial_auth = 0; + unsigned int response_len = 0; + prompt = buf_getstring(ses.payload, NULL); + cleantext(prompt); +diff --git a/cli-authpasswd.c b/cli-authpasswd.c +index 00fdd8b..a24d43e 100644 +--- a/cli-authpasswd.c ++++ b/cli-authpasswd.c +@@ -155,7 +155,7 @@ void cli_auth_password() { + + encrypt_packet(); + m_burn(password, strlen(password)); +- ++ cli_ses.is_trivial_auth = 0; + TRACE(("leave cli_auth_password")) + } + #endif /* DROPBEAR_CLI_PASSWORD_AUTH */ +diff --git a/cli-authpubkey.c b/cli-authpubkey.c +index 7cee164..7da1a04 100644 +--- a/cli-authpubkey.c ++++ b/cli-authpubkey.c +@@ -174,6 +174,7 @@ static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign) { + buf_putbytes(sigbuf, ses.writepayload->data, ses.writepayload->len); + cli_buf_put_sign(ses.writepayload, key, type, sigbuf); + buf_free(sigbuf); /* Nothing confidential in the buffer */ ++ cli_ses.is_trivial_auth = 0; + } + + encrypt_packet(); +diff --git a/cli-runopts.c b/cli-runopts.c +index 7d1fffe..6bf8b8e 100644 +--- a/cli-runopts.c ++++ b/cli-runopts.c +@@ -152,6 +152,7 @@ void cli_getopts(int argc, char ** argv) { + #if DROPBEAR_CLI_ANYTCPFWD + cli_opts.exit_on_fwd_failure = 0; + #endif ++ cli_opts.disable_trivial_auth = 0; + #if DROPBEAR_CLI_LOCALTCPFWD + cli_opts.localfwds = list_new(); + opts.listen_fwd_all = 0; +@@ -888,6 +889,7 @@ static void add_extendedopt(const char* origstr) { + #if DROPBEAR_CLI_ANYTCPFWD + "\tExitOnForwardFailure\n" + #endif ++ "\tDisableTrivialAuth\n" + #ifndef DISABLE_SYSLOG + "\tUseSyslog\n" + #endif +@@ -915,5 +917,10 @@ static void add_extendedopt(const char* origstr) { + return; + } + ++ if (match_extendedopt(&optstr, "DisableTrivialAuth") == DROPBEAR_SUCCESS) { ++ cli_opts.disable_trivial_auth = parse_flag_value(optstr); ++ return; ++ } ++ + dropbear_log(LOG_WARNING, "Ignoring unknown configuration option '%s'", origstr); + } +diff --git a/cli-session.c b/cli-session.c +index 56dd4af..73ef0db 100644 +--- a/cli-session.c ++++ b/cli-session.c +@@ -164,6 +164,7 @@ static void cli_session_init(pid_t proxy_cmd_pid) { + /* Auth */ + cli_ses.lastprivkey = NULL; + cli_ses.lastauthtype = 0; ++ cli_ses.is_trivial_auth = 1; + + /* For printing "remote host closed" for the user */ + ses.remoteclosed = cli_remoteclosed; +diff --git a/runopts.h b/runopts.h +index 31eae1f..8519626 100644 +--- a/runopts.h ++++ b/runopts.h +@@ -154,6 +154,7 @@ typedef struct cli_runopts { + #if DROPBEAR_CLI_ANYTCPFWD + int exit_on_fwd_failure; + #endif ++ int disable_trivial_auth; + #if DROPBEAR_CLI_REMOTETCPFWD + m_list * remotefwds; + #endif +diff --git a/session.h b/session.h +index 0f77055..8676054 100644 +--- a/session.h ++++ b/session.h +@@ -287,6 +287,7 @@ struct clientsession { + + int lastauthtype; /* either AUTH_TYPE_PUBKEY or AUTH_TYPE_PASSWORD, + for the last type of auth we tried */ ++ int is_trivial_auth; + int ignore_next_auth_response; + #if DROPBEAR_CLI_INTERACT_AUTH + int auth_interact_failed; /* flag whether interactive auth can still From patchwork Fri Dec 16 14:57:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16836 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18AA2C46467 for ; Fri, 16 Dec 2022 14:58:15 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web11.15110.1671202682004738349 for ; Fri, 16 Dec 2022 06:58:14 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=y0PIBwok; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id a9so2550190pld.7 for ; Fri, 16 Dec 2022 06:58:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=fahoIAAtpI175Nln87p7HAaV8p4bMtNzGfdx/66zfdI=; b=y0PIBwokb2GTma/TB1luQg/sbGOgcwMc1vtKu4wsuWrvnHKChpG6a9KIY/Qv0FdiXU BlK8NKnrfkr25zBIy7dZ3Cna0EA6ScGkrpm6ntIAle/QOzG0WjnlG5r3lfRI6EfNnHYp D8hvRH1DWUbPvoZB0qW1boeVnpbNb7Ob/NKi5Ps0AS9mF1+osx3nAOsuffrweIfh6/HC RLQydW8jZ4CNpq+171S8g2EDZoGja0uTVdbZOkw6D9xN5oUyqu5j/qWJm20Nl7be0vuK UJo26sq66uJonoGzkYK7lSTqav5RtygkbyOKLYP7jHnPaFEmFO+GXYuEXXkvPC9GtRYr 8idg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=fahoIAAtpI175Nln87p7HAaV8p4bMtNzGfdx/66zfdI=; b=p5UqKBpkZ4gD98zaxrTrNgiRTA4o2avtmXkhImD8+10JRikEfKLVYePYRx4/uJuBCy yYmot18AdC3k4loIlYtRL2c5wCKKz0vPjDOXgq+z2DiiBSHIOt5cH6R5IGQpG9JpRsRV Idao/kLtPtZfMhZbIHHAsxXTODdYC1zNBqgTQG3bBt7bFuIgzC7+lxwP2TCTdMB+wYI5 BF8sSChRxfpootPP73bnwhVYL52SyoGxEdJMlL/K9SS90jr0rFs4uhCFZqOFrarvrfLs aVOZ0WV1383T+LAdHWr8+Ujq8DvQsQRRAxeK3Ya0e7U8yahyLFE8HpOuDj3REPen43qk IPEg== X-Gm-Message-State: ANoB5pmfc7eljzrVvFZtM8fIB1V3jrOTtLDBGVFq9UGCn2yRedDA9qTk +XPyP0QRBnZtL2KC1EobCqx2VRwMovtAbidEzQ4= X-Google-Smtp-Source: AA0mqf7extqmwjZ+4PhRArwCfR+aSkHBhRXdGSq25rkGYWp+JQbyPaNbkspMF4K68Sz+LWU7WUNyrg== X-Received: by 2002:a17:90a:3188:b0:219:3e5f:2a65 with SMTP id j8-20020a17090a318800b002193e5f2a65mr33916218pjb.36.1671202692832; Fri, 16 Dec 2022 06:58:12 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:12 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 07/13] golang: CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps Date: Fri, 16 Dec 2022 04:57:46 -1000 Message-Id: <2470c52db633f206dbfcd049fcca828d1ff5f82a.1671202568.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174751 From: Hitendra Prajapati Upstream-Status: Backport from https://github.com/golang/go/commit/e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997 Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman --- meta/recipes-devtools/go/go-1.14.inc | 1 + .../go/go-1.14/CVE-2022-41715.patch | 271 ++++++++++++++++++ 2 files changed, 272 insertions(+) create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2022-41715.patch diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc index cec37c1b09..b4a137b8c8 100644 --- a/meta/recipes-devtools/go/go-1.14.inc +++ b/meta/recipes-devtools/go/go-1.14.inc @@ -49,6 +49,7 @@ SRC_URI += "\ file://CVE-2022-24921.patch \ file://CVE-2022-28131.patch \ file://CVE-2022-28327.patch \ + file://CVE-2022-41715.patch \ " SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2022-41715.patch b/meta/recipes-devtools/go/go-1.14/CVE-2022-41715.patch new file mode 100644 index 0000000000..fac0ebe94c --- /dev/null +++ b/meta/recipes-devtools/go/go-1.14/CVE-2022-41715.patch @@ -0,0 +1,271 @@ +From e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997 Mon Sep 17 00:00:00 2001 +From: Russ Cox +Date: Wed, 28 Sep 2022 11:18:51 -0400 +Subject: [PATCH] [release-branch.go1.18] regexp: limit size of parsed regexps + +Set a 128 MB limit on the amount of space used by []syntax.Inst +in the compiled form corresponding to a given regexp. + +Also set a 128 MB limit on the rune storage in the *syntax.Regexp +tree itself. + +Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting this issue. + +Fixes CVE-2022-41715. +Updates #55949. +Fixes #55950. + +Change-Id: Ia656baed81564436368cf950e1c5409752f28e1b +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1592136 +TryBot-Result: Security TryBots +Reviewed-by: Damien Neil +Run-TryBot: Roland Shoemaker +Reviewed-by: Julie Qiu +Reviewed-on: https://go-review.googlesource.com/c/go/+/438501 +Run-TryBot: Carlos Amedee +Reviewed-by: Carlos Amedee +Reviewed-by: Dmitri Shuralyov +TryBot-Result: Gopher Robot +Reviewed-by: Dmitri Shuralyov + +Upstream-Status: Backport [https://github.com/golang/go/commit/e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997] +CVE: CVE-2022-41715 +Signed-off-by: Hitendra Prajapati + +--- + src/regexp/syntax/parse.go | 145 ++++++++++++++++++++++++++++++-- + src/regexp/syntax/parse_test.go | 13 +-- + 2 files changed, 148 insertions(+), 10 deletions(-) + +diff --git a/src/regexp/syntax/parse.go b/src/regexp/syntax/parse.go +index 55bd20d..60491d5 100644 +--- a/src/regexp/syntax/parse.go ++++ b/src/regexp/syntax/parse.go +@@ -90,15 +90,49 @@ const ( + // until we've allocated at least maxHeight Regexp structures. + const maxHeight = 1000 + ++// maxSize is the maximum size of a compiled regexp in Insts. ++// It too is somewhat arbitrarily chosen, but the idea is to be large enough ++// to allow significant regexps while at the same time small enough that ++// the compiled form will not take up too much memory. ++// 128 MB is enough for a 3.3 million Inst structures, which roughly ++// corresponds to a 3.3 MB regexp. ++const ( ++ maxSize = 128 << 20 / instSize ++ instSize = 5 * 8 // byte, 2 uint32, slice is 5 64-bit words ++) ++ ++// maxRunes is the maximum number of runes allowed in a regexp tree ++// counting the runes in all the nodes. ++// Ignoring character classes p.numRunes is always less than the length of the regexp. ++// Character classes can make it much larger: each \pL adds 1292 runes. ++// 128 MB is enough for 32M runes, which is over 26k \pL instances. ++// Note that repetitions do not make copies of the rune slices, ++// so \pL{1000} is only one rune slice, not 1000. ++// We could keep a cache of character classes we've seen, ++// so that all the \pL we see use the same rune list, ++// but that doesn't remove the problem entirely: ++// consider something like [\pL01234][\pL01235][\pL01236]...[\pL^&*()]. ++// And because the Rune slice is exposed directly in the Regexp, ++// there is not an opportunity to change the representation to allow ++// partial sharing between different character classes. ++// So the limit is the best we can do. ++const ( ++ maxRunes = 128 << 20 / runeSize ++ runeSize = 4 // rune is int32 ++) ++ + type parser struct { + flags Flags // parse mode flags + stack []*Regexp // stack of parsed expressions + free *Regexp + numCap int // number of capturing groups seen + wholeRegexp string +- tmpClass []rune // temporary char class work space +- numRegexp int // number of regexps allocated +- height map[*Regexp]int // regexp height for height limit check ++ tmpClass []rune // temporary char class work space ++ numRegexp int // number of regexps allocated ++ numRunes int // number of runes in char classes ++ repeats int64 // product of all repetitions seen ++ height map[*Regexp]int // regexp height, for height limit check ++ size map[*Regexp]int64 // regexp compiled size, for size limit check + } + + func (p *parser) newRegexp(op Op) *Regexp { +@@ -122,6 +156,104 @@ func (p *parser) reuse(re *Regexp) { + p.free = re + } + ++func (p *parser) checkLimits(re *Regexp) { ++ if p.numRunes > maxRunes { ++ panic(ErrInternalError) ++ } ++ p.checkSize(re) ++ p.checkHeight(re) ++} ++ ++func (p *parser) checkSize(re *Regexp) { ++ if p.size == nil { ++ // We haven't started tracking size yet. ++ // Do a relatively cheap check to see if we need to start. ++ // Maintain the product of all the repeats we've seen ++ // and don't track if the total number of regexp nodes ++ // we've seen times the repeat product is in budget. ++ if p.repeats == 0 { ++ p.repeats = 1 ++ } ++ if re.Op == OpRepeat { ++ n := re.Max ++ if n == -1 { ++ n = re.Min ++ } ++ if n <= 0 { ++ n = 1 ++ } ++ if int64(n) > maxSize/p.repeats { ++ p.repeats = maxSize ++ } else { ++ p.repeats *= int64(n) ++ } ++ } ++ if int64(p.numRegexp) < maxSize/p.repeats { ++ return ++ } ++ ++ // We need to start tracking size. ++ // Make the map and belatedly populate it ++ // with info about everything we've constructed so far. ++ p.size = make(map[*Regexp]int64) ++ for _, re := range p.stack { ++ p.checkSize(re) ++ } ++ } ++ ++ if p.calcSize(re, true) > maxSize { ++ panic(ErrInternalError) ++ } ++} ++ ++func (p *parser) calcSize(re *Regexp, force bool) int64 { ++ if !force { ++ if size, ok := p.size[re]; ok { ++ return size ++ } ++ } ++ ++ var size int64 ++ switch re.Op { ++ case OpLiteral: ++ size = int64(len(re.Rune)) ++ case OpCapture, OpStar: ++ // star can be 1+ or 2+; assume 2 pessimistically ++ size = 2 + p.calcSize(re.Sub[0], false) ++ case OpPlus, OpQuest: ++ size = 1 + p.calcSize(re.Sub[0], false) ++ case OpConcat: ++ for _, sub := range re.Sub { ++ size += p.calcSize(sub, false) ++ } ++ case OpAlternate: ++ for _, sub := range re.Sub { ++ size += p.calcSize(sub, false) ++ } ++ if len(re.Sub) > 1 { ++ size += int64(len(re.Sub)) - 1 ++ } ++ case OpRepeat: ++ sub := p.calcSize(re.Sub[0], false) ++ if re.Max == -1 { ++ if re.Min == 0 { ++ size = 2 + sub // x* ++ } else { ++ size = 1 + int64(re.Min)*sub // xxx+ ++ } ++ break ++ } ++ // x{2,5} = xx(x(x(x)?)?)? ++ size = int64(re.Max)*sub + int64(re.Max-re.Min) ++ } ++ ++ if size < 1 { ++ size = 1 ++ } ++ p.size[re] = size ++ return size ++} ++ + func (p *parser) checkHeight(re *Regexp) { + if p.numRegexp < maxHeight { + return +@@ -158,6 +290,7 @@ func (p *parser) calcHeight(re *Regexp, force bool) int { + + // push pushes the regexp re onto the parse stack and returns the regexp. + func (p *parser) push(re *Regexp) *Regexp { ++ p.numRunes += len(re.Rune) + if re.Op == OpCharClass && len(re.Rune) == 2 && re.Rune[0] == re.Rune[1] { + // Single rune. + if p.maybeConcat(re.Rune[0], p.flags&^FoldCase) { +@@ -189,7 +322,7 @@ func (p *parser) push(re *Regexp) *Regexp { + } + + p.stack = append(p.stack, re) +- p.checkHeight(re) ++ p.checkLimits(re) + return re + } + +@@ -305,7 +438,7 @@ func (p *parser) repeat(op Op, min, max int, before, after, lastRepeat string) ( + re.Sub = re.Sub0[:1] + re.Sub[0] = sub + p.stack[n-1] = re +- p.checkHeight(re) ++ p.checkLimits(re) + + if op == OpRepeat && (min >= 2 || max >= 2) && !repeatIsValid(re, 1000) { + return "", &Error{ErrInvalidRepeatSize, before[:len(before)-len(after)]} +@@ -509,6 +642,7 @@ func (p *parser) factor(sub []*Regexp) []*Regexp { + + for j := start; j < i; j++ { + sub[j] = p.removeLeadingString(sub[j], len(str)) ++ p.checkLimits(sub[j]) + } + suffix := p.collapse(sub[start:i], OpAlternate) // recurse + +@@ -566,6 +700,7 @@ func (p *parser) factor(sub []*Regexp) []*Regexp { + for j := start; j < i; j++ { + reuse := j != start // prefix came from sub[start] + sub[j] = p.removeLeadingRegexp(sub[j], reuse) ++ p.checkLimits(sub[j]) + } + suffix := p.collapse(sub[start:i], OpAlternate) // recurse + +diff --git a/src/regexp/syntax/parse_test.go b/src/regexp/syntax/parse_test.go +index 1ef6d8a..67e3c56 100644 +--- a/src/regexp/syntax/parse_test.go ++++ b/src/regexp/syntax/parse_test.go +@@ -484,12 +484,15 @@ var invalidRegexps = []string{ + `(?P<>a)`, + `[a-Z]`, + `(?i)[a-Z]`, +- `a{100000}`, +- `a{100000,}`, +- "((((((((((x{2}){2}){2}){2}){2}){2}){2}){2}){2}){2})", +- strings.Repeat("(", 1000) + strings.Repeat(")", 1000), +- strings.Repeat("(?:", 1000) + strings.Repeat(")*", 1000), + `\Q\E*`, ++ `a{100000}`, // too much repetition ++ `a{100000,}`, // too much repetition ++ "((((((((((x{2}){2}){2}){2}){2}){2}){2}){2}){2}){2})", // too much repetition ++ strings.Repeat("(", 1000) + strings.Repeat(")", 1000), // too deep ++ strings.Repeat("(?:", 1000) + strings.Repeat(")*", 1000), // too deep ++ "(" + strings.Repeat("(xx?)", 1000) + "){1000}", // too long ++ strings.Repeat("(xx?){1000}", 1000), // too long ++ strings.Repeat(`\pL`, 27000), // too many runes + } + + var onlyPerl = []string{ +-- +2.25.1 + From patchwork Fri Dec 16 14:57:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16844 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17C27C4167B for ; Fri, 16 Dec 2022 14:58:25 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.web11.15128.1671202695923092277 for ; Fri, 16 Dec 2022 06:58:15 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=aB5dp2zY; spf=softfail (domain: sakoman.com, ip: 209.85.214.173, mailfrom: steve@sakoman.com) Received: by mail-pl1-f173.google.com with SMTP id 4so2573583plj.3 for ; Fri, 16 Dec 2022 06:58:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=vVkKabzIXrMm/IVelKuivvreSLjyHPf27WddBNEPG0I=; b=aB5dp2zYBK+fuI0JB/P66jjN24NBVojzoTkmGz1Ds8xnoHS6UwbijBnY4+kw6IASAd O98qzAgmOncq7hEnCJwJ/dG+FcFsHMwaqj3j0QWiyxwds8jK8fg/P27kGEn9CoGrgYP6 ht/bwwOswHLdSfZe/mabXXQSqWtcGhgKSnnyV9OAEe8ZKDr1twmAOTEoQgkpTLhBldXH wGin0BlYRSyxJuy0QHo9eSCjcoJyFNg7WWzQGi3ukK3O50q48Gl037+Gag657+9Gr76w 5rtOhz6U0n1DQ7lzXflWwIn4YjwppxM6enepaOUXa9lUVpUWeYSkujPSKAabKNU2WDBH J8vA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vVkKabzIXrMm/IVelKuivvreSLjyHPf27WddBNEPG0I=; b=VOwA8a++9tMFfIdNP2uyICdDSj+qWQzYZ2Jd2xZXrV7aQjJ2lM4yp7sD8dMl+yyqIm C1ys8b7UrcWiVUuWYQ0pftB+tbSyrlMA0Qgd7nWhOz65Oy5OO3uN/LdCiVpwj42tahst yu0XTpGXcqwXujqvRoHJOQw/pwfxmb2HFEDsOfBeOlclawusKrc2fmEyPN9Ab5OZtofC r/eXXkdVYg9YMkk/xlB69I3eSGidG80lzWLHUSGr/EpC3s4Qk13nZdGN1yWuSWe2FCsB Z7wd9iFeZsjyYRVCmwg5edRbZ+Z7F1DOlF1tb9A0Fl348e+1cMllsCOttitpBHTbEUYf EaOA== X-Gm-Message-State: ANoB5pmivFnq418HTC7z39Ta7soRK/30daq0i8eZaEhocNhg/khG2AUE 4w7gtz3NDD6woLNT9skx7zfUIxZFMZLkQmb188c= X-Google-Smtp-Source: AA0mqf7ALIC574kSgySJGs/aIY6iNQ7tl/y1JMqICtzhwkyaly0yQ68HfekI41ktVWj06FjsJnnmzA== X-Received: by 2002:a17:90b:1d05:b0:219:f993:7f0f with SMTP id on5-20020a17090b1d0500b00219f9937f0fmr33663194pjb.11.1671202694852; Fri, 16 Dec 2022 06:58:14 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:14 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 08/13] python3: Fix CVE-2022-37454 Date: Fri, 16 Dec 2022 04:57:47 -1000 Message-Id: <6a8ef6cc3604008860dcb6aa5d7155b914d7c391.1671202568.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174752 From: Pawan Badganchi Add below patch to fix CVE-2022-37454 CVE-2022-37454.patch Link: https://security-tracker.debian.org/tracker/CVE-2022-37454 Link: https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631 Signed-off-by: Pawan Badganchi Signed-off-by: pawan Signed-off-by: Steve Sakoman --- .../python/python3/CVE-2022-37454.patch | 105 ++++++++++++++++++ .../recipes-devtools/python/python3_3.8.14.bb | 1 + 2 files changed, 106 insertions(+) create mode 100644 meta/recipes-devtools/python/python3/CVE-2022-37454.patch diff --git a/meta/recipes-devtools/python/python3/CVE-2022-37454.patch b/meta/recipes-devtools/python/python3/CVE-2022-37454.patch new file mode 100644 index 0000000000..a41cc301e2 --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2022-37454.patch @@ -0,0 +1,105 @@ +From 948c6794711458fd148a3fa62296cadeeb2ed631 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Fri, 28 Oct 2022 03:07:50 -0700 +Subject: [PATCH] [3.8] gh-98517: Fix buffer overflows in _sha3 module + (GH-98519) (#98527) + +This is a port of the applicable part of XKCP's fix [1] for +CVE-2022-37454 and avoids the segmentation fault and the infinite +loop in the test cases published in [2]. + +[1]: https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a +[2]: https://mouha.be/sha-3-buffer-overflow/ + +Regression test added by: Gregory P. Smith [Google LLC] +(cherry picked from commit 0e4e058602d93b88256ff90bbef501ba20be9dd3) + +Co-authored-by: Theo Buehler + +CVE: CVE-2022-37454 +Upstream-Status: Backport [https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631] +Signed-off-by: Pawan Badganchi +--- + Lib/test/test_hashlib.py | 9 +++++++++ + .../2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst | 1 + + Modules/_sha3/kcp/KeccakSponge.inc | 15 ++++++++------- + 3 files changed, 18 insertions(+), 7 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst + +diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py +index 8b53d23ef525..e6cec4e306e5 100644 +--- a/Lib/test/test_hashlib.py ++++ b/Lib/test/test_hashlib.py +@@ -434,6 +434,15 @@ def test_case_md5_huge(self, size): + def test_case_md5_uintmax(self, size): + self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3') + ++ @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems') ++ @bigmemtest(size=_4G - 1, memuse=1, dry_run=False) ++ def test_sha3_update_overflow(self, size): ++ """Regression test for gh-98517 CVE-2022-37454.""" ++ h = hashlib.sha3_224() ++ h.update(b'\x01') ++ h.update(b'\x01'*0xffff_ffff) ++ self.assertEqual(h.hexdigest(), '80762e8ce6700f114fec0f621fd97c4b9c00147fa052215294cceeed') ++ + # use the three examples from Federal Information Processing Standards + # Publication 180-1, Secure Hash Standard, 1995 April 17 + # http://www.itl.nist.gov/div897/pubs/fip180-1.htm +diff --git a/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst b/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst +new file mode 100644 +index 000000000000..2d23a6ad93c7 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst +@@ -0,0 +1 @@ ++Port XKCP's fix for the buffer overflows in SHA-3 (CVE-2022-37454). +diff --git a/Modules/_sha3/kcp/KeccakSponge.inc b/Modules/_sha3/kcp/KeccakSponge.inc +index e10739deafa8..cf92e4db4d36 100644 +--- a/Modules/_sha3/kcp/KeccakSponge.inc ++++ b/Modules/_sha3/kcp/KeccakSponge.inc +@@ -171,7 +171,7 @@ int SpongeAbsorb(SpongeInstance *instance, const unsigned char *data, size_t dat + i = 0; + curData = data; + while(i < dataByteLen) { +- if ((instance->byteIOIndex == 0) && (dataByteLen >= (i + rateInBytes))) { ++ if ((instance->byteIOIndex == 0) && (dataByteLen-i >= rateInBytes)) { + #ifdef SnP_FastLoop_Absorb + /* processing full blocks first */ + +@@ -199,10 +199,10 @@ int SpongeAbsorb(SpongeInstance *instance, const unsigned char *data, size_t dat + } + else { + /* normal lane: using the message queue */ +- +- partialBlock = (unsigned int)(dataByteLen - i); +- if (partialBlock+instance->byteIOIndex > rateInBytes) ++ if (dataByteLen-i > rateInBytes-instance->byteIOIndex) + partialBlock = rateInBytes-instance->byteIOIndex; ++ else ++ partialBlock = (unsigned int)(dataByteLen - i); + #ifdef KeccakReference + displayBytes(1, "Block to be absorbed (part)", curData, partialBlock); + #endif +@@ -281,7 +281,7 @@ int SpongeSqueeze(SpongeInstance *instance, unsigned char *data, size_t dataByte + i = 0; + curData = data; + while(i < dataByteLen) { +- if ((instance->byteIOIndex == rateInBytes) && (dataByteLen >= (i + rateInBytes))) { ++ if ((instance->byteIOIndex == rateInBytes) && (dataByteLen-i >= rateInBytes)) { + for(j=dataByteLen-i; j>=rateInBytes; j-=rateInBytes) { + SnP_Permute(instance->state); + SnP_ExtractBytes(instance->state, curData, 0, rateInBytes); +@@ -299,9 +299,10 @@ int SpongeSqueeze(SpongeInstance *instance, unsigned char *data, size_t dataByte + SnP_Permute(instance->state); + instance->byteIOIndex = 0; + } +- partialBlock = (unsigned int)(dataByteLen - i); +- if (partialBlock+instance->byteIOIndex > rateInBytes) ++ if (dataByteLen-i > rateInBytes-instance->byteIOIndex) + partialBlock = rateInBytes-instance->byteIOIndex; ++ else ++ partialBlock = (unsigned int)(dataByteLen - i); + i += partialBlock; + + SnP_ExtractBytes(instance->state, curData, instance->byteIOIndex, partialBlock); diff --git a/meta/recipes-devtools/python/python3_3.8.14.bb b/meta/recipes-devtools/python/python3_3.8.14.bb index cbf57684ca..960e41aced 100644 --- a/meta/recipes-devtools/python/python3_3.8.14.bb +++ b/meta/recipes-devtools/python/python3_3.8.14.bb @@ -35,6 +35,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \ file://makerace.patch \ file://CVE-2022-45061.patch \ + file://CVE-2022-37454.patch \ " SRC_URI_append_class-native = " \ From patchwork Fri Dec 16 14:57:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16841 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26200C46467 for ; Fri, 16 Dec 2022 14:58:25 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web11.15129.1671202697712081318 for ; Fri, 16 Dec 2022 06:58:17 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=lt8YGwwQ; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id d7so2540724pll.9 for ; Fri, 16 Dec 2022 06:58:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=ozumjGNh/K0l7v4DraZEN9r6poZs3YJzXZMGihHpCXI=; b=lt8YGwwQZvzxy8qdTDGM84nhWYUnG2u1Oy1lK5icVSdmPhn72lVKwsGa2WrW52F87t YaUTd7A8HG8Q2qbtK9XoWbS1W2EhUx/0Rbuhs4gDSeWh6QVPeMGc5MPzgiFl9WFdcFVe 6UNMG1P4SMfDEnCMtjzSBjGmB1rJNnA0fTBgZF9LxRRipJ9csGH4DHXfkzVuw/hYgrKu yD7GzBdJ0T8gwrxSJBBsULc5QuJCjo6H+5M97kkc9v7B/bQwjJ33grqfaEcaxkJTxFvs R1mAvJY++5qcA/6f0UnVTw9ke0bhNM6rDfr/XIxTOeSaKcxAxkfqh0lUAK1rC9Ux+IjQ DKDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ozumjGNh/K0l7v4DraZEN9r6poZs3YJzXZMGihHpCXI=; b=xLujnLiiEfgb6DcaNLMP9Ip39UNJM+AStSlnMWWpbGm5pPlfel3DkmHo0PXLg0siQ+ J6g3K5CtGb3mFXMDeSpwggGBYZg7eYuZwNCLRukA43lBWS1EVafsprK/HuMF3Muz1lza afCPhQRomohZJw+xJJ9UB4PB0lytcrN7thwl4tHGhyhsPDooI2X0e5oD/gf9Ixn/XPLg BFxupBgs3eMWnv+Unb/ewREWHZGRcnAikPTBTumAru3JWDzYcE3gGF/XJKjYDO+vFeaN JxVxEvwdUiebRg6rg3jb1yV2lxtG0SbpgsKMA5+3dILYLCx4LQvg62xzgo25b/L5NjcO rUAw== X-Gm-Message-State: ANoB5pl4s97rP+dEA+iXSzR/8kc4a5/uCnUO/eGFHoJtPgLJHJOySq5C wIWIw1xRmjdz5QFgmr04Q7jHHjylEocVd4TQA58= X-Google-Smtp-Source: AA0mqf7snLlNGhoSbZd4tgXsEcfwndsFwX3E4SCsD3uoYH8/P9B/0PsNqR03Gmdxm5C/aoLet5/tkA== X-Received: by 2002:a17:90a:ea09:b0:219:8d8a:a608 with SMTP id w9-20020a17090aea0900b002198d8aa608mr33893596pjy.43.1671202696710; Fri, 16 Dec 2022 06:58:16 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:16 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 09/13] vim: upgrade 9.0.0820 -> 9.0.0947 Date: Fri, 16 Dec 2022 04:57:48 -1000 Message-Id: <64c323a444f43a7c7b3390720c4d1eafa3b982ac.1671202568.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174753 From: "Qiu, Zheng" Includes fixes for CVE-2022-4141 https://nvd.nist.gov/vuln/detail/CVE-2022-4141 For a short list of important changes, see: https://www.arp242.net/vimlog/ Signed-off-by: Zheng Qiu Signed-off-by: Alexandre Belloni (cherry picked from commit 160f459febc7fb36cc0fe85c63eb26780ace3bfd) Signed-off-by: Steve Sakoman --- meta/recipes-support/vim/vim.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 262c97bf0f..1e5ef1c811 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -20,8 +20,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://no-path-adjust.patch \ " -PV .= ".0820" -SRCREV = "03d6e6f42b0deeb02d52c8a48c14abe431370c1c" +PV .= ".0947" +SRCREV = "cc762a48d42b579fb7bdec2c614636b830342dd5" # Remove when 8.3 is out UPSTREAM_VERSION_UNKNOWN = "1" From patchwork Fri Dec 16 14:57:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16843 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2667EC4708D for ; Fri, 16 Dec 2022 14:58:25 +0000 (UTC) Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by mx.groups.io with SMTP id smtpd.web10.14922.1671202699953939964 for ; Fri, 16 Dec 2022 06:58:20 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=rBZAlPHM; spf=softfail (domain: sakoman.com, ip: 209.85.216.50, mailfrom: steve@sakoman.com) Received: by mail-pj1-f50.google.com with SMTP id u5so2707589pjy.5 for ; Fri, 16 Dec 2022 06:58:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=3mDEWgms70O7khCpRrOwjQcaEDRlKkzed40lNgULGHQ=; b=rBZAlPHMtzTwiDwr518qiO2mOGPAPTZcQL6Yq9/PbqEJxqQVT8TU6aUJN16AWjKqna GFZAapetZXLJt70fDFs+/jOUtjtpZL1U9omk0TjcK8qNhn/q2567U8SRdc5c3nBrWDk3 8a7oPiE0pL524Itoleqrv+0Jzk2ETcJeUhWu7u9a5ZZodp117RBrRg/JmrJOjpOGOikE 96Fl/x3vtrz1j5BdZ242s0z7srYNWcHXBYW9JN7r/KLNW2evh8NhplXb66gJ7k9jn4M2 7WxvtfQ0fDVlM4EHPIzD0Xaz5bX4STrKRkztJkL5sOUXPZuVKbN3CAgATPa7jQ+NgshD VPzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3mDEWgms70O7khCpRrOwjQcaEDRlKkzed40lNgULGHQ=; b=2ugCqOBqmtYTmSE2aGvGjMtQp5KFiNRDU6P7rXFWxV55GjHsNKiampRwDr0mHNymSG z73YSEDK7+VMNoE/uKJeFa/HCFYCmmgf8yc4aDCDxjswMILqg2wORAEgIMe/FvzIyGUB 87BWWcuI3eNPUo2Jv35zpUJUKCUQDJBZDTd9tm9ufA4fwsNIMH37lHeT5KFsbbSGsoHd gH82/cKqXhUb3QJs6o2aJCO3TqfVV+aUpp5afr/CKaw0aS08zwg/9hGBwMFHJJxqXJR7 RnzKjGNlFKGvdbFzc4h9CWMpaJnLVwbT4GUrE93elWgsHW9Mhcze156IN3FXBUMCPQsA LMpw== X-Gm-Message-State: ANoB5pnMqPOeV/7mwyejSEb0cITNmsRY7tQXTEmCJy6n24ajXBxOYyKG jgtB+YBH94IgnG+p1W3K4msj15A/yJlBxqv9SsM= X-Google-Smtp-Source: AA0mqf6gdtNdAeqUUiD9CT8aDMKERdnjGZOZqfZpeiqSNamelqgoCtJzWjrQQ8g7hWFGFtJBjFafMA== X-Received: by 2002:a17:90a:4681:b0:220:bc30:a19e with SMTP id z1-20020a17090a468100b00220bc30a19emr26935098pjf.32.1671202698865; Fri, 16 Dec 2022 06:58:18 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:18 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 10/13] opkg: Set correct info_dir and status_file in opkg.conf Date: Fri, 16 Dec 2022 04:57:49 -1000 Message-Id: <38224b19bda2592705ef4274c28cb250d9e980dc.1671202568.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174754 From: Harald Seiler Distros can customize the location of OPKG data using OPKGLIBDIR. In OE-Core commit 11f1956cf5d7 ("package_manager.py: define info_dir and status_file when OPKGLIBDIR isn't the default"), a fix was applied to correctly set the info_dir and status_file options relative to OPKGLIBDIR. However, as the commit message notes, the opkg.conf file deployed as part of the opkg package must also be adjusted to correctly reflect the changed location. Otherwise, opkg running inside the image cannot find its data. Fix this by also setting the info_dir and status_file options in opkg.conf to the correct location relative to OPKGLIBDIR. Fixes: 11f1956cf5d7 ("package_manager.py: define info_dir and status_file when OPKGLIBDIR isn't the default") Signed-off-by: Harald Seiler Signed-off-by: Alexandre Belloni (cherry picked from commit adb939ae3635de6e02208859fbf29cf0ed39f565) Signed-off-by: Steve Sakoman --- meta/recipes-devtools/opkg/opkg_0.4.2.bb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/meta/recipes-devtools/opkg/opkg_0.4.2.bb b/meta/recipes-devtools/opkg/opkg_0.4.2.bb index a813f7258b..55be6547c0 100644 --- a/meta/recipes-devtools/opkg/opkg_0.4.2.bb +++ b/meta/recipes-devtools/opkg/opkg_0.4.2.bb @@ -50,7 +50,9 @@ EXTRA_OECONF_class-native = "--localstatedir=/${@os.path.relpath('${localstatedi do_install_append () { install -d ${D}${sysconfdir}/opkg install -m 0644 ${WORKDIR}/opkg.conf ${D}${sysconfdir}/opkg/opkg.conf - echo "option lists_dir ${OPKGLIBDIR}/opkg/lists" >>${D}${sysconfdir}/opkg/opkg.conf + echo "option lists_dir ${OPKGLIBDIR}/opkg/lists" >>${D}${sysconfdir}/opkg/opkg.conf + echo "option info_dir ${OPKGLIBDIR}/opkg/info" >>${D}${sysconfdir}/opkg/opkg.conf + echo "option status_file ${OPKGLIBDIR}/opkg/status" >>${D}${sysconfdir}/opkg/opkg.conf # We need to create the lock directory install -d ${D}${OPKGLIBDIR}/opkg From patchwork Fri Dec 16 14:57:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16840 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1799CC4332F for ; Fri, 16 Dec 2022 14:58:25 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.web11.15133.1671202702238821849 for ; Fri, 16 Dec 2022 06:58:22 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=v8S1uiwY; spf=softfail (domain: sakoman.com, ip: 209.85.214.172, mailfrom: steve@sakoman.com) Received: by mail-pl1-f172.google.com with SMTP id g10so2527644plo.11 for ; Fri, 16 Dec 2022 06:58:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=XYpu9m/Y7zssU+vmNrOZYju82zhxqPAY0ai2LyYZvG8=; b=v8S1uiwY1+2SbQp/1fAf57yXIxuCZFhqSOZFXSGRRCYLPBe05TNODYlSAWdde4v+4l 2PCb9fjD2wBWDf4kOrkNKVCH0IYt3eLmLUJN/7pZCtiMa0/Y6SyXekg12S+PEPYKP7FD VNoneyHtjRqEf0Yn0XdsKX1CGSso97tbi0vUe1N+SMjhDxr1NRKRIph256UjWvKi9x8F E3SE4Hfb8cLAN64KusX48KqAyfCa2qBOLQFUkeq6nlNQpQE9jP3TylSjXFpHdAEOVFbu /MgpceyooxjILZ1/P5NXm0bOiL8b7f+QJAgvRM2P+bYSktu37koPIzkA/nV46YH7xeYE /nOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=XYpu9m/Y7zssU+vmNrOZYju82zhxqPAY0ai2LyYZvG8=; b=6YT4ABitYosy3wT/FlLsFavxN1EuObNHzpLbnh6dt5kOiuWpRCUccijMk36aSSXngr kRFo43TgqGE4tUVnM2+kJqkTEVqg/1oqVL24rCcrsDcKH46hWN5awAtSaXZFGPE72HX/ WmdAqjSpdOTj+7HdpHipheX9j8CgRfNFJLg7FP/Daps6yVk64bvOFJjKhN/ZEruSPWVH Q+AeGFvfoGwW1iW8dKKlXvWlz8+MWNN3QgQM7JhDWkUz/5dkakpa3vy/VL8r3C6id0Ut VKFZZhxsQhXau0Xbtls9Tx85yzLJEtIgw4RaRwlHH7Ffo3in9XtskpZuoaYoCD9xLS9N VsFA== X-Gm-Message-State: ANoB5pk7dnXeMTKnCTU2Tx3QoSWIoUL9DXBblUcHKmTdsjcR6sSvbXcJ pU6D/PtdTk3R6gnIFETZlYir9gHFGcFcgd81HfU= X-Google-Smtp-Source: AA0mqf6oMuavIjjquxMRhKwHcfwo0fRBGwWXBFCT1EkPKs7Mg028CppSYRY/t3FYnQ8U2k0EqOSWSQ== X-Received: by 2002:a17:90a:784a:b0:213:3918:f2a0 with SMTP id y10-20020a17090a784a00b002133918f2a0mr33449447pjl.15.1671202701168; Fri, 16 Dec 2022 06:58:21 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:20 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 11/13] classes: make TOOLCHAIN more permissive for kernel Date: Fri, 16 Dec 2022 04:57:50 -1000 Message-Id: <7d45d4696970c45534b905dc7a65418073108f97.1671202568.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174755 From: Alexey Smirnov Currently TOOLCHAIN is strictly set to gcc in kernel-arch.bbclass. And this prevents any TOOLCHAIN changes for any kernel recipe. This change makes TOOLCHAIN configurable as usual. Signed-off-by: Alexey Smirnov Signed-off-by: Alexandre Belloni (cherry picked from commit be1634fc35dcc81f0301d942064a6eed584e0704) Signed-off-by: Steve Sakoman --- meta/classes/kernel-arch.bbclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/classes/kernel-arch.bbclass b/meta/classes/kernel-arch.bbclass index 348a3adf22..4cd08b96fb 100644 --- a/meta/classes/kernel-arch.bbclass +++ b/meta/classes/kernel-arch.bbclass @@ -64,5 +64,5 @@ HOST_AR_KERNEL_ARCH ?= "${TARGET_AR_KERNEL_ARCH}" KERNEL_CC = "${CCACHE}${HOST_PREFIX}gcc ${HOST_CC_KERNEL_ARCH} -fuse-ld=bfd ${DEBUG_PREFIX_MAP} -fdebug-prefix-map=${STAGING_KERNEL_DIR}=${KERNEL_SRC_PATH} -fdebug-prefix-map=${STAGING_KERNEL_BUILDDIR}=${KERNEL_SRC_PATH}" KERNEL_LD = "${CCACHE}${HOST_PREFIX}ld.bfd ${HOST_LD_KERNEL_ARCH}" KERNEL_AR = "${CCACHE}${HOST_PREFIX}ar ${HOST_AR_KERNEL_ARCH}" -TOOLCHAIN = "gcc" +TOOLCHAIN ?= "gcc" From patchwork Fri Dec 16 14:57:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16842 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2286AC3DA71 for ; Fri, 16 Dec 2022 14:58:25 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.web10.14925.1671202704147520230 for ; Fri, 16 Dec 2022 06:58:24 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=nExsbEnW; spf=softfail (domain: sakoman.com, ip: 209.85.214.177, mailfrom: steve@sakoman.com) Received: by mail-pl1-f177.google.com with SMTP id d3so2532602plr.10 for ; Fri, 16 Dec 2022 06:58:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=kqdVRTU3ttke6KL1A8jIOHzndVuNNFFsUM9KDzu3Bzw=; b=nExsbEnWWKgtLCuOdSgSMLlrhquc3cD3zH7fmw8NYINS8jQ6agTsGGlYSmrOTXOBEq +I40FgEIwmMPHuhBTkZvOt8EgRakgcZltMXBzgSHwDmuDkQ3miy1H65otcDA9E7HhBbb dYATihahyRFBWWbKD8BZINwRIXL7xhCMvAc0SYoWHfKhXP9L0kRu9YmvdcS9E68gE3np 7JQUHNBLZoMP1vAMGeAnlFQSLkMDc/10ekyFF7fXTYwmRIKT+eSr1mjL/KWwmTycxDuX QaWWUAYeCba/10m0pS7hK0QHmP6g1CmInH0YbbQ1YIK9wPUKA17a8OkRwZgqDqVa7Dvh fyFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kqdVRTU3ttke6KL1A8jIOHzndVuNNFFsUM9KDzu3Bzw=; b=4kJPC87xq/gE8/FTrvS2joIbmrFOY03tg3KMDTzH2CM+NKywXWj/HgHd5lwBZGPVZX XVj70PwdefNBR+60In6ylGoFAtbiiuM/IVcy4tJjnlcffT9k5+UYzeKlGAysELWbAxHy cfOFAV4YDaTqd5FOiGoeCTFEpwvwyzme8BACsf35yYyD4eGtsIToTjtRApcyKpAInud2 Qpd2i1rJul9G6i/9zl6Wxa5hJ04ZW5eCXzCr2PxQxYnev25lmIlKsREyZrocr6OGox+G WyRZlSuGn+31Y7CX9YQ5Wj+xA22L9oIeOOmQ+qdIcwTyUhTqVC5iKfFFW4z4fWBJ7m/c accw== X-Gm-Message-State: ANoB5pnVtVL9Mkoq+BKdDo8uYzsaJmtrJeDjMtHYDBQ0o9pgQALnfbil oZFF4Nn71KJWbcP3EWMYVvYgRSY8yYHSQWHYbBU= X-Google-Smtp-Source: AA0mqf6lgyC69PYBweEf71nLCpOhJms9uSsgWHUTYbRwuQeq53f7pxzmhCWhaQXDZnbW03XX+Pndow== X-Received: by 2002:a17:90a:be06:b0:219:ecd7:759b with SMTP id a6-20020a17090abe0600b00219ecd7759bmr33789070pjs.10.1671202703182; Fri, 16 Dec 2022 06:58:23 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:22 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 12/13] psplash: consider the situation of psplash not exist for systemd Date: Fri, 16 Dec 2022 04:57:51 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174756 From: Chen Qi In current psplash framework, the psplash might not exist at all. For example, in case DSITRO is set to nodistro, the psplash does not exist. In our psplash recipe, we have: SPLASH_IMAGES = "file://psplash-poky-img.h;outsuffix=default" This variable is parsed to if psplash-poky-img.h exists, a package named psplash-default is created and is added to RDEPENDS:${PN}. We can see that the psplash-poky-img.h resides in meta-poky, and in psplash_git.bbappend file in meta-poky, we have: FILESEXTRAPATHS:prepend:poky := "${THISDIR}/files:" So this file is only available in case poky distro is used. To fix this issue, add condition check in the corresponding systemd services. Signed-off-by: Chen Qi Signed-off-by: Alexandre Belloni (cherry picked from commit 7a62ff9ed39c179d2b9b0c40f4f8423ced413063) Signed-off-by: Steve Sakoman --- meta/recipes-core/psplash/files/psplash-start.service | 1 + meta/recipes-core/psplash/files/psplash-systemd.service | 1 + 2 files changed, 2 insertions(+) diff --git a/meta/recipes-core/psplash/files/psplash-start.service b/meta/recipes-core/psplash/files/psplash-start.service index 36c2bb38e0..bec9368427 100644 --- a/meta/recipes-core/psplash/files/psplash-start.service +++ b/meta/recipes-core/psplash/files/psplash-start.service @@ -2,6 +2,7 @@ Description=Start psplash boot splash screen DefaultDependencies=no RequiresMountsFor=/run +ConditionFileIsExecutable=/usr/bin/psplash [Service] Type=notify diff --git a/meta/recipes-core/psplash/files/psplash-systemd.service b/meta/recipes-core/psplash/files/psplash-systemd.service index 082207f232..e93e3deb35 100644 --- a/meta/recipes-core/psplash/files/psplash-systemd.service +++ b/meta/recipes-core/psplash/files/psplash-systemd.service @@ -4,6 +4,7 @@ DefaultDependencies=no After=psplash-start.service Requires=psplash-start.service RequiresMountsFor=/run +ConditionFileIsExecutable=/usr/bin/psplash [Service] ExecStart=/usr/bin/psplash-systemd From patchwork Fri Dec 16 14:57:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 16845 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 165D7C4332F for ; Fri, 16 Dec 2022 14:58:35 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web11.15129.1671202697712081318 for ; Fri, 16 Dec 2022 06:58:26 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=7TShnvNJ; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id d7so2541109pll.9 for ; Fri, 16 Dec 2022 06:58:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=GTcnF7M2bTtBDDxao4dZgoNkrd9DgSKmTzrFIDSLVpE=; b=7TShnvNJ9N84aUg2oGnysoAWB3UafHMKuaDxDFr54LnkN0ydbWFeDuaCGDrk9pR2q2 6yIKjOmk2dc5y1VObzVar9OE2xVBkm1SYHaSNPkpcUt9TalfAoNKzOPJNFOqMuHz3yYw 2nbxgVgXi+l0i/x+Af8McFhlyxHuoMtVNO6w47txI4smb+p+d5tl8d86u0qKjRsMQ6qp rKltn6AX+1I4bl0PgbdwqnqRt2aUFlYpCWtFV1MRyrgjuZqclLsrI//jN9usWYvEiosh ZXZ+MW/GVMPo3yTqhOR5V4bBJHokzkBXMv1W0uu8CYKJ5m3dwTcex5jMCnt19MlLpWEc sQBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=GTcnF7M2bTtBDDxao4dZgoNkrd9DgSKmTzrFIDSLVpE=; b=rL9VUg2QsZHUVmS+S7EFVoHrvNQ2fJrlAE2HAKAoVlwio1RL9LzH0hHoIRGqRhemya JlbToLVmB8Bmi2wgCClKa9CAq+pcOgpjOVIhjL2c4MTUEBpXjWorZTOmNGt95Dmq7iiM vT0IApgIt2xUlHS18WLRcvR3ShsGyeIs7GMwfXw8hiBkDX26j+6W9UnpMRamKjf2Yf3e B8i3j0LvThv/qdNEFOBla5DFmStrFIyxNk/3uTM13MYzRc65sGYWXYLiJYmy+Lvo0wk7 15Ch624e94bkwJNclXc4UpDRBCUPBit1MyLmgq5l0G9b7pHrU584/a8O8Zx26rVWJrH3 kG/w== X-Gm-Message-State: ANoB5pn1itid0dFttrIzVKMg5dGnmGh6/DSIlUr2meFja9v1kK5BdyJs 8IwSul6sY7x31FdVCIQf7eZTpzCrLtP6zEFzjSY= X-Google-Smtp-Source: AA0mqf4qVm6tW3EEHu7a5bB40M9lLUr6vHJN0FASK5rpnk6OrgLHCjb9QkA5mjiTiiyW2ZRQ2VqhqA== X-Received: by 2002:a17:90b:3692:b0:221:5597:bfeb with SMTP id mj18-20020a17090b369200b002215597bfebmr20260076pjb.46.1671202705180; Fri, 16 Dec 2022 06:58:25 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id r21-20020a17090b051500b00219eefe47c7sm1482230pjz.47.2022.12.16.06.58.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Dec 2022 06:58:24 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 13/13] oeqa/selftest/tinfoil: Add test for separate config_data with recipe_parse_file() Date: Fri, 16 Dec 2022 04:57:52 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Dec 2022 14:58:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/174757 From: Richard Purdie We've seen two different regressions in this API since it is used by layer-index but not be the core code. Add a test for it to try and ensure we don't break it again. Signed-off-by: Richard Purdie Signed-off-by: Alexandre Belloni (cherry picked from commit b07de5de43ec9c9a2c5d496a64940ccdc5b47cf8) Signed-off-by: Steve Sakoman --- meta/lib/oeqa/selftest/cases/tinfoil.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/meta/lib/oeqa/selftest/cases/tinfoil.py b/meta/lib/oeqa/selftest/cases/tinfoil.py index 686ce7e6b9..6668d7cdc8 100644 --- a/meta/lib/oeqa/selftest/cases/tinfoil.py +++ b/meta/lib/oeqa/selftest/cases/tinfoil.py @@ -65,6 +65,20 @@ class TinfoilTests(OESelftestTestCase): localdata.setVar('PN', 'hello') self.assertEqual('hello', localdata.getVar('BPN')) + # The config_data API tp parse_recipe_file is used by: + # layerindex-web layerindex/update_layer.py + def test_parse_recipe_custom_data(self): + with bb.tinfoil.Tinfoil() as tinfoil: + tinfoil.prepare(config_only=False, quiet=2) + localdata = bb.data.createCopy(tinfoil.config_data) + localdata.setVar("TESTVAR", "testval") + testrecipe = 'mdadm' + best = tinfoil.find_best_provider(testrecipe) + if not best: + self.fail('Unable to find recipe providing %s' % testrecipe) + rd = tinfoil.parse_recipe_file(best[3], config_data=localdata) + self.assertEqual("testval", rd.getVar('TESTVAR')) + def test_list_recipes(self): with bb.tinfoil.Tinfoil() as tinfoil: tinfoil.prepare(config_only=False, quiet=2)