[kirkstone,v2] libpcre2: upgrade 10.39 -> 10.40

Message ID 20220531082603.11954-1-davide.gardenal@huawei.com
State Accepted, archived
Commit 9cf49b4f07afcf48a5e6d1ed12d0959d5d040e00
Headers show
Series [kirkstone,v2] libpcre2: upgrade 10.39 -> 10.40 | expand

Commit Message

Davide Gardenal May 31, 2022, 8:26 a.m. UTC
Security fixes and update to Unicode property handling.

Upstream release notes:
https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.40

CVE: CVE-2022-1587

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
---
Updates:
    - v2: change commit message
---
 .../libpcre/libpcre2/CVE-2022-1586.patch      | 58 -------------------
 .../{libpcre2_10.39.bb => libpcre2_10.40.bb}  |  5 +-
 2 files changed, 2 insertions(+), 61 deletions(-)
 delete mode 100644 meta/recipes-support/libpcre/libpcre2/CVE-2022-1586.patch
 rename meta/recipes-support/libpcre/{libpcre2_10.39.bb => libpcre2_10.40.bb} (90%)

Comments

Davide Gardenal May 31, 2022, 8:29 a.m. UTC | #1
After a bit of research I found out that the commit that fixes CVE-2022-1587 (https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0) is not directly applicable to .39, it needs a compiler update (https://github.com/PCRE2Project/pcre2/commit/dea56d2df94546c23021a42d9395f2333589f01e), this is a very substantial update. Looking at Fedora and Debian they updated the .40 too.

Hope it helps,

Davide
Marta Rybczynska May 31, 2022, 8:51 a.m. UTC | #2
On Tue, May 31, 2022 at 10:29 AM Davide Gardenal
<davidegarde2000@gmail.com> wrote:
>
> After a bit of research I found out that the commit that fixes CVE-2022-1587 (https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0) is not directly applicable to .39, it needs a compiler update (https://github.com/PCRE2Project/pcre2/commit/dea56d2df94546c23021a42d9395f2333589f01e), this is a very substantial update. Looking at Fedora and Debian they updated the .40 too.
>

I've have had a look at the JIT update, the commit list for .40. The
JIT update contains something that looks like fixes around types and
their sizes, among other things. Because of that I would suggest to
bump the version here to stay on the safe side.

Regards,
Marta

Patch

diff --git a/meta/recipes-support/libpcre/libpcre2/CVE-2022-1586.patch b/meta/recipes-support/libpcre/libpcre2/CVE-2022-1586.patch
deleted file mode 100644
index 10d88d7b73..0000000000
--- a/meta/recipes-support/libpcre/libpcre2/CVE-2022-1586.patch
+++ /dev/null
@@ -1,58 +0,0 @@ 
-From e881ed5028622959cf8859c053501fb1b16387f1 Mon Sep 17 00:00:00 2001
-From: Hitendra Prajapati <hprajapati@mvista.com>
-Date: Mon, 23 May 2022 13:52:39 +0530
-Subject: [PATCH] CVE-2022-1586
-
-Upstream-Status: Backport from https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a
-
-Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
----
- ChangeLog               | 3 +++
- src/pcre2_jit_compile.c | 2 +-
- src/pcre2_jit_test.c    | 3 +++
- 3 files changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/ChangeLog b/ChangeLog
-index d27542d..cd3da65 100644
---- a/ChangeLog
-+++ b/ChangeLog
-@@ -63,6 +63,9 @@ Version 10.39 29-October-2021
- 
-   Reformat slightly to make it C89 compatible again.
- 
-+23. Fixed a unicode properrty matching issue in JIT. The character was not
-+fully read in caseless matching.
-+
- 
- Version 10.38 01-October-2021
- -----------------------------
-diff --git a/src/pcre2_jit_compile.c b/src/pcre2_jit_compile.c
-index db2ce65..5baca9b 100644
---- a/src/pcre2_jit_compile.c
-+++ b/src/pcre2_jit_compile.c
-@@ -7473,7 +7473,7 @@ while (*cc != XCL_END)
-     {
-     SLJIT_ASSERT(*cc == XCL_PROP || *cc == XCL_NOTPROP);
-     cc++;
--    if (*cc == PT_CLIST)
-+    if (*cc == PT_CLIST && *cc == XCL_PROP)
-       {
-       other_cases = PRIV(ucd_caseless_sets) + cc[1];
-       while (*other_cases != NOTACHAR)
-diff --git a/src/pcre2_jit_test.c b/src/pcre2_jit_test.c
-index 8dee16e..7bb307e 100644
---- a/src/pcre2_jit_test.c
-+++ b/src/pcre2_jit_test.c
-@@ -412,6 +412,9 @@ static struct regression_test_case regression_test_cases[] = {
- 	{ MUP, A, 0, 0 | F_PROPERTY, "[\\P{L&}]{2}[^\xc2\x85-\xc2\x89\\p{Ll}\\p{Lu}]{2}", "\xc3\xa9\xe6\x92\xad.a\xe6\x92\xad|\xc2\x8a#" },
- 	{ PCRE2_UCP, 0, 0, 0 | F_PROPERTY, "[a-b\\s]{2,5}[^a]", "AB  baaa" },
- 	{ MUP, 0, 0, 0 | F_NOMATCH, "[^\\p{Hangul}\\p{Z}]", " " },
-+	{ MUP, 0, 0, 0, "[\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
-+	{ MUP, 0, 0, 0, "[\\x{a92e}\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
-+	{ CMUP, 0, 0, 0, "[^S]\\B", "\xe2\x80\x8a" },
- 
- 	/* Possible empty brackets. */
- 	{ MU, A, 0, 0, "(?:|ab||bc|a)+d", "abcxabcabd" },
--- 
-2.35.3
-
diff --git a/meta/recipes-support/libpcre/libpcre2_10.39.bb b/meta/recipes-support/libpcre/libpcre2_10.40.bb
similarity index 90%
rename from meta/recipes-support/libpcre/libpcre2_10.39.bb
rename to meta/recipes-support/libpcre/libpcre2_10.40.bb
index 36c51d700a..3843d43b69 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.39.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.40.bb
@@ -8,14 +8,13 @@  SUMMARY = "Perl Compatible Regular Expressions version 2"
 HOMEPAGE = "http://www.pcre.org"
 SECTION = "devel"
 LICENSE = "BSD-3-Clause"
-LIC_FILES_CHKSUM = "file://LICENCE;md5=43cfa999260dd853cd6cb174dc396f3d"
+LIC_FILES_CHKSUM = "file://LICENCE;md5=41bfb977e4933c506588724ce69bf5d2"
 
 SRC_URI = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
-           file://CVE-2022-1586.patch \
 "
 UPSTREAM_CHECK_URI = "https://github.com/PhilipHazel/pcre2/releases"
 
-SRC_URI[sha256sum] = "0f03caf57f81d9ff362ac28cd389c055ec2bf0678d277349a1a4bee00ad6d440"
+SRC_URI[sha256sum] = "14e4b83c4783933dc17e964318e6324f7cae1bc75d8f3c79bc6969f00c159d68"
 
 CVE_PRODUCT = "pcre2"