diff options
815 files changed, 73032 insertions, 4007 deletions
diff --git a/meta-selftest/files/static-group b/meta-selftest/files/static-group index b13dde3218..cbec6f1377 100644 --- a/meta-selftest/files/static-group +++ b/meta-selftest/files/static-group @@ -24,3 +24,4 @@ weston-launch:x:524: weston:x:525: wayland:x:526: render:x:527: +sgx:x:528: diff --git a/meta-selftest/recipes-test/license/incompatible-license-alias.bb b/meta-selftest/recipes-test/license/incompatible-license-alias.bb index e0b4e13c26..1af99e7809 100644 --- a/meta-selftest/recipes-test/license/incompatible-license-alias.bb +++ b/meta-selftest/recipes-test/license/incompatible-license-alias.bb @@ -1,3 +1,5 @@ SUMMARY = "Recipe with an alias of an SPDX license" DESCRIPTION = "Is licensed with an alias of an SPDX license to be used for testing" LICENSE = "GPLv3" + +EXCLUDE_FROM_WORLD = "1" diff --git a/meta-selftest/recipes-test/license/incompatible-license.bb b/meta-selftest/recipes-test/license/incompatible-license.bb index 282f5c2875..6fdc58fd30 100644 --- a/meta-selftest/recipes-test/license/incompatible-license.bb +++ b/meta-selftest/recipes-test/license/incompatible-license.bb @@ -1,3 +1,5 @@ SUMMARY = "Recipe with an SPDX license" DESCRIPTION = "Is licensed with an SPDX license to be used for testing" LICENSE = "GPL-3.0-only" + +EXCLUDE_FROM_WORLD = "1" diff --git a/meta-selftest/recipes-test/license/incompatible-licenses.bb b/meta-selftest/recipes-test/license/incompatible-licenses.bb index 9709892644..47bd8d7c00 100644 --- a/meta-selftest/recipes-test/license/incompatible-licenses.bb +++ b/meta-selftest/recipes-test/license/incompatible-licenses.bb @@ -1,3 +1,5 @@ SUMMARY = "Recipe with multiple SPDX licenses" DESCRIPTION = "Is licensed with multiple SPDX licenses to be used for testing" LICENSE = "GPL-2.0-only & GPL-3.0-only & LGPL-3.0-only" + +EXCLUDE_FROM_WORLD = "1" diff --git a/meta-selftest/recipes-test/license/incompatible-nonspdx-license.bb b/meta-selftest/recipes-test/license/incompatible-nonspdx-license.bb index 35af0966ef..142d73158e 100644 --- a/meta-selftest/recipes-test/license/incompatible-nonspdx-license.bb +++ b/meta-selftest/recipes-test/license/incompatible-nonspdx-license.bb @@ -1,3 +1,5 @@ SUMMARY = "Recipe with a non-SPDX license" DESCRIPTION = "Is licensed with a non-SPDX license to be used for testing" LICENSE = "FooLicense" + +EXCLUDE_FROM_WORLD = "1" diff --git a/meta-skeleton/recipes-skeleton/useradd/useradd-example.bb b/meta-skeleton/recipes-skeleton/useradd/useradd-example.bb index 3f4c42d714..cff624e2f9 100644 --- a/meta-skeleton/recipes-skeleton/useradd/useradd-example.bb +++ b/meta-skeleton/recipes-skeleton/useradd/useradd-example.bb @@ -33,8 +33,8 @@ USERADD_PACKAGES = "${PN} ${PN}-user3" USERADD_PARAM:${PN} = "-u 1200 -d /home/user1 -r -s /bin/bash user1; -u 1201 -d /home/user2 -r -s /bin/bash user2" # user3 will be managed in the useradd-example-user3 pacakge: -# As an example, we use the -P option to set clear text password for user3 -USERADD_PARAM:${PN}-user3 = "-u 1202 -d /home/user3 -r -s /bin/bash -P 'user3' user3" +# As an example, we use the -p option to set password ('user3') for user3 +USERADD_PARAM:${PN}-user3 = "-u 1202 -d /home/user3 -r -s /bin/bash -p '\$6\$XAWr.8nc\$bUE4pYYaVb8n6BbnBitU0zeJMtfhTpFpiOBLL9zRl4e4YQo88UU4r/1kjRzmTimCy.BvDh4xoFwVqcO.pihLa1' user3" # GROUPADD_PARAM works the same way, which you set to the options # you'd normally pass to the groupadd command. This will create diff --git a/meta/classes/base.bbclass b/meta/classes/base.bbclass index b15c5839b6..ee26ee5597 100644 --- a/meta/classes/base.bbclass +++ b/meta/classes/base.bbclass @@ -12,7 +12,7 @@ inherit logging OE_EXTRA_IMPORTS ?= "" -OE_IMPORTS += "os sys time oe.path oe.utils oe.types oe.package oe.packagegroup oe.sstatesig oe.lsb oe.cachedpath oe.license oe.qa oe.reproducible oe.rust ${OE_EXTRA_IMPORTS}" +OE_IMPORTS += "os sys time oe.path oe.utils oe.types oe.package oe.packagegroup oe.sstatesig oe.lsb oe.cachedpath oe.license oe.qa oe.reproducible oe.rust oe.go ${OE_EXTRA_IMPORTS}" OE_IMPORTS[type] = "list" PACKAGECONFIG_CONFARGS ??= "" diff --git a/meta/classes/cargo.bbclass b/meta/classes/cargo.bbclass index 4a780a501f..6df3b19b00 100644 --- a/meta/classes/cargo.bbclass +++ b/meta/classes/cargo.bbclass @@ -49,7 +49,6 @@ oe_cargo_build () { do_compile[progress] = "outof:\s+(\d+)/(\d+)" cargo_do_compile () { - oe_cargo_fix_env oe_cargo_build } diff --git a/meta/classes/cargo_common.bbclass b/meta/classes/cargo_common.bbclass index 1e9d284b5d..c1bc142d85 100644 --- a/meta/classes/cargo_common.bbclass +++ b/meta/classes/cargo_common.bbclass @@ -101,6 +101,10 @@ cargo_common_do_configure () { EOF } +do_compile:prepend () { + oe_cargo_fix_env +} + oe_cargo_fix_env () { export CC="${RUST_TARGET_CC}" export CXX="${RUST_TARGET_CXX}" diff --git a/meta/classes/cmake.bbclass b/meta/classes/cmake.bbclass index d9bcddbdbb..7ec6ca58fc 100644 --- a/meta/classes/cmake.bbclass +++ b/meta/classes/cmake.bbclass @@ -85,9 +85,12 @@ def map_host_arch_to_uname_arch(host_arch): return "ppc64" return host_arch + cmake_do_generate_toolchain_file() { if [ "${BUILD_SYS}" = "${HOST_SYS}" ]; then cmake_crosscompiling="set( CMAKE_CROSSCOMPILING FALSE )" + else + cmake_sysroot="set( CMAKE_SYSROOT \"${RECIPE_SYSROOT}\" )" fi cat > ${WORKDIR}/toolchain.cmake <<EOF # CMake system name must be something like "Linux". @@ -120,6 +123,8 @@ set( CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY ) set( CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY ) set( CMAKE_PROGRAM_PATH "/" ) +$cmake_sysroot + # Use qt.conf settings set( ENV{QT_CONF_PATH} ${WORKDIR}/qt.conf ) diff --git a/meta/classes/cml1.bbclass b/meta/classes/cml1.bbclass index d319d66ab2..fd087c2a14 100644 --- a/meta/classes/cml1.bbclass +++ b/meta/classes/cml1.bbclass @@ -48,7 +48,7 @@ python do_menuconfig() { # ensure that environment variables are overwritten with this tasks 'd' values d.appendVar("OE_TERMINAL_EXPORTS", " PKG_CONFIG_DIR PKG_CONFIG_PATH PKG_CONFIG_LIBDIR PKG_CONFIG_SYSROOT_DIR") - oe_terminal("sh -c \"make %s; if [ \\$? -ne 0 ]; then echo 'Command failed.'; printf 'Press any key to continue... '; read r; fi\"" % d.getVar('KCONFIG_CONFIG_COMMAND'), + oe_terminal("sh -c 'make %s; if [ \\$? -ne 0 ]; then echo \"Command failed.\"; printf \"Press any key to continue... \"; read r; fi'" % d.getVar('KCONFIG_CONFIG_COMMAND'), d.getVar('PN') + ' Configuration', d) # FIXME this check can be removed when the minimum bitbake version has been bumped diff --git a/meta/classes/core-image.bbclass b/meta/classes/core-image.bbclass index 740a6c1d3d..803727da0e 100644 --- a/meta/classes/core-image.bbclass +++ b/meta/classes/core-image.bbclass @@ -62,7 +62,7 @@ IMAGE_FEATURES_REPLACES_ssh-server-openssh = "ssh-server-dropbear" # Do not install openssh complementary packages if either packagegroup-core-ssh-dropbear or dropbear # is installed # to avoid openssh-dropbear conflict # see [Yocto #14858] for more information -PACKAGE_EXCLUDE_COMPLEMENTARY:append = "${@bb.utils.contains_any('PACKAGE_INSTALL', 'packagegroup-core-ssh-dropbear dropbear', 'openssh', '' , d)}" +PACKAGE_EXCLUDE_COMPLEMENTARY:append = "${@bb.utils.contains_any('PACKAGE_INSTALL', 'packagegroup-core-ssh-dropbear dropbear', ' openssh', '' , d)}" # IMAGE_FEATURES_CONFLICTS_foo = 'bar1 bar2' # An error exception would be raised if both image features foo and bar1(or bar2) are included diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index b9c0bfd6d8..f554150d94 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -26,7 +26,7 @@ CVE_PRODUCT ??= "${BPN}" CVE_VERSION ??= "${PV}" CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" -CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_1.1.db" +CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_2.db" CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" CVE_CHECK_LOG ?= "${T}/cve.log" @@ -98,6 +98,8 @@ def generate_json_report(d, out_path, link_path): cve_check_merge_jsons(summary, data) filename = f.readline() + summary["package"].sort(key=lambda d: d['name']) + with open(out_path, "w") as f: json.dump(summary, f, indent=2) @@ -155,7 +157,7 @@ python do_cve_check () { } addtask cve_check before do_build -do_cve_check[depends] = "cve-update-db-native:do_fetch" +do_cve_check[depends] = "cve-update-nvd2-native:do_fetch" do_cve_check[nostamp] = "1" python cve_check_cleanup () { @@ -254,7 +256,7 @@ def check_cves(d, patched_cves): """ Connect to the NVD database and find unpatched cves. """ - from oe.cve_check import Version + from oe.cve_check import Version, convert_cve_version pn = d.getVar("PN") real_pv = d.getVar("PV") @@ -318,6 +320,9 @@ def check_cves(d, patched_cves): if cve in cve_ignore: ignored = True + version_start = convert_cve_version(version_start) + version_end = convert_cve_version(version_end) + if (operator_start == '=' and pv == version_start) or version_start == '-': vulnerable = True else: diff --git a/meta/classes/devshell.bbclass b/meta/classes/devshell.bbclass index 247d04478c..26c01c080a 100644 --- a/meta/classes/devshell.bbclass +++ b/meta/classes/devshell.bbclass @@ -2,8 +2,6 @@ inherit terminal DEVSHELL = "${SHELL}" -PATH:prepend:task-devshell = "${COREBASE}/scripts/git-intercept:" - python do_devshell () { if d.getVarFlag("do_devshell", "manualfakeroot"): d.prependVar("DEVSHELL", "pseudo ") diff --git a/meta/classes/externalsrc.bbclass b/meta/classes/externalsrc.bbclass index a649bcdff8..a209730240 100644 --- a/meta/classes/externalsrc.bbclass +++ b/meta/classes/externalsrc.bbclass @@ -62,6 +62,10 @@ python () { else: d.setVar('B', '${WORKDIR}/${BPN}-${PV}') + if d.getVar('SRCREV', "INVALID") != "INVALID": + # Ensure SRCREV has been processed before accessing SRC_URI + bb.fetch.get_srcrev(d) + local_srcuri = [] fetch = bb.fetch2.Fetch((d.getVar('SRC_URI') or '').split(), d) for url in fetch.urls: @@ -76,6 +80,8 @@ python () { # Dummy value because the default function can't be called with blank SRC_URI d.setVar('SRCPV', '999') + # sstate is never going to work for external source trees, disable it + d.setVar('SSTATE_SKIP_CREATION', '1') if d.getVar('CONFIGUREOPT_DEPTRACK') == '--disable-dependency-tracking': d.setVar('CONFIGUREOPT_DEPTRACK', '') @@ -83,10 +89,7 @@ python () { tasks = filter(lambda k: d.getVarFlag(k, "task"), d.keys()) for task in tasks: - if task.endswith("_setscene"): - # sstate is never going to work for external source trees, disable it - bb.build.deltask(task, d) - elif os.path.realpath(d.getVar('S')) == os.path.realpath(d.getVar('B')): + if os.path.realpath(d.getVar('S')) == os.path.realpath(d.getVar('B')): # Since configure will likely touch ${S}, ensure only we lock so one task has access at a time d.appendVarFlag(task, "lockfiles", " ${S}/singletask.lock") diff --git a/meta/classes/fontcache.bbclass b/meta/classes/fontcache.bbclass index 442bfc7392..34688591f4 100644 --- a/meta/classes/fontcache.bbclass +++ b/meta/classes/fontcache.bbclass @@ -7,6 +7,7 @@ PACKAGE_WRITE_DEPS += "qemu-native" inherit qemu FONT_PACKAGES ??= "${PN}" +FONT_PACKAGES:class-native = "" FONT_EXTRA_RDEPENDS ?= "${MLPREFIX}fontconfig-utils" FONTCONFIG_CACHE_DIR ?= "${localstatedir}/cache/fontconfig" FONTCONFIG_CACHE_PARAMS ?= "-v" diff --git a/meta/classes/fs-uuid.bbclass b/meta/classes/fs-uuid.bbclass index 9b53dfba7a..731ea575bd 100644 --- a/meta/classes/fs-uuid.bbclass +++ b/meta/classes/fs-uuid.bbclass @@ -4,7 +4,7 @@ def get_rootfs_uuid(d): import subprocess rootfs = d.getVar('ROOTFS') - output = subprocess.check_output(['tune2fs', '-l', rootfs]) + output = subprocess.check_output(['tune2fs', '-l', rootfs], text=True) for line in output.split('\n'): if line.startswith('Filesystem UUID:'): uuid = line.split()[-1] diff --git a/meta/classes/go.bbclass b/meta/classes/go.bbclass index f3d83febbf..d944722309 100644 --- a/meta/classes/go.bbclass +++ b/meta/classes/go.bbclass @@ -122,7 +122,7 @@ go_do_install() { tar -C ${B} -cf - --exclude-vcs --exclude '*.test' --exclude 'testdata' pkg | \ tar -C ${D}${libdir}/go --no-same-owner -xf - - if [ -n "`ls ${B}/${GO_BUILD_BINDIR}/`" ]; then + if ls ${B}/${GO_BUILD_BINDIR}/* >/dev/null 2>/dev/null ; then install -d ${D}${bindir} install -m 0755 ${B}/${GO_BUILD_BINDIR}/* ${D}${bindir}/ fi diff --git a/meta/classes/goarch.bbclass b/meta/classes/goarch.bbclass index 92fec16b82..394c0c5d84 100644 --- a/meta/classes/goarch.bbclass +++ b/meta/classes/goarch.bbclass @@ -61,31 +61,10 @@ SECURITY_NOPIE_CFLAGS ??= "" CCACHE_DISABLE ?= "1" def go_map_arch(a, d): - import re - if re.match('i.86', a): - return '386' - elif a == 'x86_64': - return 'amd64' - elif re.match('arm.*', a): - return 'arm' - elif re.match('aarch64.*', a): - return 'arm64' - elif re.match('mips64el.*', a): - return 'mips64le' - elif re.match('mips64.*', a): - return 'mips64' - elif a == 'mips': - return 'mips' - elif a == 'mipsel': - return 'mipsle' - elif re.match('p(pc|owerpc)(64le)', a): - return 'ppc64le' - elif re.match('p(pc|owerpc)(64)', a): - return 'ppc64' - elif a == 'riscv64': - return 'riscv64' - else: + arch = oe.go.map_arch(a) + if not arch: raise bb.parse.SkipRecipe("Unsupported CPU architecture: %s" % a) + return arch def go_map_arm(a, d): if a.startswith("arm"): diff --git a/meta/classes/image-live.bbclass b/meta/classes/image-live.bbclass index 2c948190cf..c0c1fb31ac 100644 --- a/meta/classes/image-live.bbclass +++ b/meta/classes/image-live.bbclass @@ -30,7 +30,7 @@ do_bootimg[depends] += "dosfstools-native:do_populate_sysroot \ virtual/kernel:do_deploy \ ${MLPREFIX}syslinux:do_populate_sysroot \ syslinux-native:do_populate_sysroot \ - ${@'%s:do_image_%s' % (d.getVar('PN'), d.getVar('LIVE_ROOTFS_TYPE').replace('-', '_')) if d.getVar('ROOTFS') else ''} \ + ${@'%s:do_image_%s' % (d.getVar('PN'), d.getVar('LIVE_ROOTFS_TYPE').replace('-', '_').split('.')[0]) if d.getVar('ROOTFS') else ''} \ " diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass index c424c4c41d..00413d56d1 100644 --- a/meta/classes/image.bbclass +++ b/meta/classes/image.bbclass @@ -313,7 +313,7 @@ fakeroot python do_image_qa () { except oe.utils.ImageQAFailed as e: qamsg = qamsg + '\tImage QA function %s failed: %s\n' % (e.name, e.description) except Exception as e: - qamsg = qamsg + '\tImage QA function %s failed\n' % cmd + qamsg = qamsg + '\tImage QA function %s failed: %s\n' % (cmd, e) if qamsg: imgname = d.getVar('IMAGE_NAME') @@ -440,7 +440,7 @@ python () { localdata.delVar('DATE') localdata.delVar('TMPDIR') localdata.delVar('IMAGE_VERSION_SUFFIX') - vardepsexclude = (d.getVarFlag('IMAGE_CMD:' + realt, 'vardepsexclude', True) or '').split() + vardepsexclude = (d.getVarFlag('IMAGE_CMD:' + realt, 'vardepsexclude') or '').split() for dep in vardepsexclude: localdata.delVar(dep) diff --git a/meta/classes/image_types.bbclass b/meta/classes/image_types.bbclass index 960dab1a60..9d5f8c68a4 100644 --- a/meta/classes/image_types.bbclass +++ b/meta/classes/image_types.bbclass @@ -130,10 +130,11 @@ IMAGE_CMD:cpio () { if [ ! -L ${IMAGE_ROOTFS}/init ] && [ ! -e ${IMAGE_ROOTFS}/init ]; then if [ -L ${IMAGE_ROOTFS}/sbin/init ] || [ -e ${IMAGE_ROOTFS}/sbin/init ]; then ln -sf /sbin/init ${WORKDIR}/cpio_append/init + touch -h -r ${IMAGE_ROOTFS}/sbin/init ${WORKDIR}/cpio_append/init else - touch ${WORKDIR}/cpio_append/init + touch -r ${IMAGE_ROOTFS} ${WORKDIR}/cpio_append/init fi - (cd ${WORKDIR}/cpio_append && echo ./init | cpio -oA -H newc -F ${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cpio) + (cd ${WORKDIR}/cpio_append && echo ./init | cpio --reproducible -oA -H newc -F ${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cpio) fi fi } @@ -187,7 +188,10 @@ multiubi_mkfs() { fi } +MULTIUBI_ARGS = "MKUBIFS_ARGS UBINIZE_ARGS" + IMAGE_CMD:multiubi () { + ${@' '.join(['%s_%s="%s";' % (arg, name, d.getVar('%s_%s' % (arg, name))) for arg in d.getVar('MULTIUBI_ARGS').split() for name in d.getVar('MULTIUBI_BUILD').split()])} # Split MKUBIFS_ARGS_<name> and UBINIZE_ARGS_<name> for name in ${MULTIUBI_BUILD}; do eval local mkubifs_args=\"\$MKUBIFS_ARGS_${name}\" diff --git a/meta/classes/image_types_wic.bbclass b/meta/classes/image_types_wic.bbclass index 6453dd1b74..8497916d48 100644 --- a/meta/classes/image_types_wic.bbclass +++ b/meta/classes/image_types_wic.bbclass @@ -83,7 +83,7 @@ do_image_wic[recrdeptask] += "do_deploy" do_image_wic[deptask] += "do_image_complete" WKS_FILE_DEPENDS_DEFAULT = '${@bb.utils.contains_any("BUILD_ARCH", [ 'x86_64', 'i686' ], "syslinux-native", "",d)}' -WKS_FILE_DEPENDS_DEFAULT += "bmap-tools-native cdrtools-native btrfs-tools-native squashfs-tools-native e2fsprogs-native" +WKS_FILE_DEPENDS_DEFAULT += "bmap-tools-native cdrtools-native btrfs-tools-native squashfs-tools-native e2fsprogs-native erofs-utils-native" # Unified kernel images need objcopy WKS_FILE_DEPENDS_DEFAULT += "virtual/${MLPREFIX}${TARGET_PREFIX}binutils" WKS_FILE_DEPENDS_BOOTLOADERS = "" diff --git a/meta/classes/kernel-arch.bbclass b/meta/classes/kernel-arch.bbclass index 4cd08b96fb..62c8211621 100644 --- a/meta/classes/kernel-arch.bbclass +++ b/meta/classes/kernel-arch.bbclass @@ -65,4 +65,3 @@ KERNEL_CC = "${CCACHE}${HOST_PREFIX}gcc ${HOST_CC_KERNEL_ARCH} -fuse-ld=bfd ${DE KERNEL_LD = "${CCACHE}${HOST_PREFIX}ld.bfd ${HOST_LD_KERNEL_ARCH}" KERNEL_AR = "${CCACHE}${HOST_PREFIX}ar ${HOST_AR_KERNEL_ARCH}" TOOLCHAIN ?= "gcc" - diff --git a/meta/classes/kernel-devicetree.bbclass b/meta/classes/kernel-devicetree.bbclass index b4338da1b1..18ab6b4c4f 100644 --- a/meta/classes/kernel-devicetree.bbclass +++ b/meta/classes/kernel-devicetree.bbclass @@ -6,7 +6,12 @@ python () { d.appendVar("PACKAGES", " ${KERNEL_PACKAGE_NAME}-image-zimage-bundle") } -FILES:${KERNEL_PACKAGE_NAME}-devicetree = "/${KERNEL_IMAGEDEST}/*.dtb /${KERNEL_IMAGEDEST}/*.dtbo" +# recursivly search for devicetree files +FILES:${KERNEL_PACKAGE_NAME}-devicetree = " \ + /${KERNEL_DTBDEST}/**/*.dtb \ + /${KERNEL_DTBDEST}/**/*.dtbo \ +" + FILES:${KERNEL_PACKAGE_NAME}-image-zimage-bundle = "/${KERNEL_IMAGEDEST}/zImage-*.dtb.bin" # Generate kernel+devicetree bundle @@ -67,12 +72,16 @@ do_compile:append() { } do_install:append() { + install -d ${D}/${KERNEL_DTBDEST} for dtbf in ${KERNEL_DEVICETREE}; do dtb=`normalize_dtb "$dtbf"` - dtb_ext=${dtb##*.} - dtb_base_name=`basename $dtb .$dtb_ext` dtb_path=`get_real_dtb_path_in_kernel "$dtb"` - install -m 0644 $dtb_path ${D}/${KERNEL_IMAGEDEST}/$dtb_base_name.$dtb_ext + if "${@'false' if oe.types.boolean(d.getVar('KERNEL_DTBVENDORED')) else 'true'}"; then + dtb_ext=${dtb##*.} + dtb_base_name=`basename $dtb .$dtb_ext` + dtb=$dtb_base_name.$dtb_ext + fi + install -Dm 0644 $dtb_path ${D}/${KERNEL_DTBDEST}/$dtb done } @@ -82,7 +91,10 @@ do_deploy:append() { dtb_ext=${dtb##*.} dtb_base_name=`basename $dtb .$dtb_ext` install -d $deployDir - install -m 0644 ${D}/${KERNEL_IMAGEDEST}/$dtb_base_name.$dtb_ext $deployDir/$dtb_base_name-${KERNEL_DTB_NAME}.$dtb_ext + if "${@'false' if oe.types.boolean(d.getVar('KERNEL_DTBVENDORED')) else 'true'}"; then + dtb=$dtb_base_name.$dtb_ext + fi + install -m 0644 ${D}/${KERNEL_DTBDEST}/$dtb $deployDir/$dtb_base_name-${KERNEL_DTB_NAME}.$dtb_ext if [ "${KERNEL_IMAGETYPE_SYMLINK}" = "1" ] ; then ln -sf $dtb_base_name-${KERNEL_DTB_NAME}.$dtb_ext $deployDir/$dtb_base_name.$dtb_ext fi diff --git a/meta/classes/kernel-yocto.bbclass b/meta/classes/kernel-yocto.bbclass index 82e792351f..4f8e391428 100644 --- a/meta/classes/kernel-yocto.bbclass +++ b/meta/classes/kernel-yocto.bbclass @@ -206,7 +206,7 @@ do_kernel_metadata() { # SRC_URI. If they were supplied, we convert them into include directives # for the update part of the process for f in ${feat_dirs}; do - if [ -d "${WORKDIR}/$f/meta" ]; then + if [ -d "${WORKDIR}/$f/kernel-meta" ]; then includes="$includes -I${WORKDIR}/$f/kernel-meta" elif [ -d "${WORKDIR}/../oe-local-files/$f" ]; then includes="$includes -I${WORKDIR}/../oe-local-files/$f" diff --git a/meta/classes/kernel.bbclass b/meta/classes/kernel.bbclass index 54b006550d..dbd89057f3 100644 --- a/meta/classes/kernel.bbclass +++ b/meta/classes/kernel.bbclass @@ -176,13 +176,14 @@ do_unpack[cleandirs] += " ${S} ${STAGING_KERNEL_DIR} ${B} ${STAGING_KERNEL_BUILD do_clean[cleandirs] += " ${S} ${STAGING_KERNEL_DIR} ${B} ${STAGING_KERNEL_BUILDDIR}" python do_symlink_kernsrc () { s = d.getVar("S") - if s[-1] == '/': - # drop trailing slash, so that os.symlink(kernsrc, s) doesn't use s as directory name and fail - s=s[:-1] kernsrc = d.getVar("STAGING_KERNEL_DIR") if s != kernsrc: bb.utils.mkdirhier(kernsrc) bb.utils.remove(kernsrc, recurse=True) + if s[-1] == '/': + # drop trailing slash, so that os.symlink(kernsrc, s) doesn't use s as + # directory name and fail + s = s[:-1] if d.getVar("EXTERNALSRC"): # With EXTERNALSRC S will not be wiped so we can symlink to it os.symlink(s, kernsrc) @@ -204,15 +205,14 @@ PACKAGES_DYNAMIC += "^${KERNEL_PACKAGE_NAME}-firmware-.*" export OS = "${TARGET_OS}" export CROSS_COMPILE = "${TARGET_PREFIX}" -export KBUILD_BUILD_VERSION = "1" -export KBUILD_BUILD_USER ?= "oe-user" -export KBUILD_BUILD_HOST ?= "oe-host" KERNEL_RELEASE ?= "${KERNEL_VERSION}" # The directory where built kernel lies in the kernel tree KERNEL_OUTPUT_DIR ?= "arch/${ARCH}/boot" KERNEL_IMAGEDEST ?= "boot" +KERNEL_DTBDEST ?= "${KERNEL_IMAGEDEST}" +KERNEL_DTBVENDORED ?= "0" # # configuration @@ -233,7 +233,7 @@ KERNEL_EXTRA_ARGS ?= "" EXTRA_OEMAKE += ' CC="${KERNEL_CC}" LD="${KERNEL_LD}"' EXTRA_OEMAKE += ' HOSTCC="${BUILD_CC}" HOSTCFLAGS="${BUILD_CFLAGS}" HOSTLDFLAGS="${BUILD_LDFLAGS}" HOSTCPP="${BUILD_CPP}"' -EXTRA_OEMAKE += ' HOSTCXX="${BUILD_CXX}" HOSTCXXFLAGS="${BUILD_CXXFLAGS}" PAHOLE=false' +EXTRA_OEMAKE += ' HOSTCXX="${BUILD_CXX}" HOSTCXXFLAGS="${BUILD_CXXFLAGS}"' KERNEL_ALT_IMAGETYPE ??= "" @@ -380,7 +380,7 @@ kernel_do_compile() { use_alternate_initrd=CONFIG_INITRAMFS_SOURCE=${B}/usr/${INITRAMFS_IMAGE_NAME}.cpio fi for typeformake in ${KERNEL_IMAGETYPE_FOR_MAKE} ; do - oe_runmake ${typeformake} ${KERNEL_EXTRA_ARGS} $use_alternate_initrd + oe_runmake ${PARALLEL_MAKE} ${typeformake} ${KERNEL_EXTRA_ARGS} $use_alternate_initrd done } @@ -396,6 +396,13 @@ addtask transform_kernel after do_compile before do_install do_compile_kernelmodules() { unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE + + # setup native pkg-config variables (kconfig scripts call pkg-config directly, cannot generically be overriden to pkg-config-native) + export PKG_CONFIG_DIR="${STAGING_DIR_NATIVE}${libdir_native}/pkgconfig" + export PKG_CONFIG_PATH="$PKG_CONFIG_DIR:${STAGING_DATADIR_NATIVE}/pkgconfig" + export PKG_CONFIG_LIBDIR="$PKG_CONFIG_DIR" + export PKG_CONFIG_SYSROOT_DIR="" + if [ "${KERNEL_DEBUG_TIMESTAMPS}" != "1" ]; then # kernel sources do not use do_unpack, so SOURCE_DATE_EPOCH may not # be set.... @@ -418,7 +425,7 @@ do_compile_kernelmodules() { if (grep -q -i -e '^CONFIG_MODULES=y$' ${B}/.config); then oe_runmake -C ${B} ${PARALLEL_MAKE} modules ${KERNEL_EXTRA_ARGS} - # Module.symvers gets updated during the + # Module.symvers gets updated during the # building of the kernel modules. We need to # update this in the shared workdir since some # external kernel modules has a dependency on @@ -442,8 +449,8 @@ kernel_do_install() { unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install - rm "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" - rm "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" + rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" + rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" # Remove empty module directories to prevent QA issues find "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/kernel" -type d -empty -delete else @@ -541,6 +548,7 @@ do_shared_workdir () { # echo "${KERNEL_VERSION}" > $kerneldir/${KERNEL_PACKAGE_NAME}-abiversion + echo "${KERNEL_LOCALVERSION}" > $kerneldir/${KERNEL_PACKAGE_NAME}-localversion # Copy files required for module builds cp System.map $kerneldir/System.map-${KERNEL_VERSION} @@ -630,12 +638,31 @@ python check_oldest_kernel() { check_oldest_kernel[vardepsexclude] += "OLDEST_KERNEL KERNEL_VERSION" do_configure[prefuncs] += "check_oldest_kernel" +KERNEL_LOCALVERSION ??= "" + +# 6.3+ requires the variable LOCALVERSION to be set to not get a "+" in +# the local version. Having it empty means nothing will be added, and any +# value will be appended to the local kernel version. This replaces the +# use of .scmversion file for setting a localversion without using +# the CONFIG_LOCALVERSION option. +# +# Note: This class saves the value of localversion to a file +# so other recipes like make-mod-scripts can restore it via the +# helper function get_kernellocalversion_file +export LOCALVERSION="${KERNEL_LOCALVERSION}" + kernel_do_configure() { # fixes extra + in /lib/modules/2.6.37+ # $ scripts/setlocalversion . => + # $ make kernelversion => 2.6.37 # $ make kernelrelease => 2.6.37+ - touch ${B}/.scmversion ${S}/.scmversion + # See kernel-arch.bbclass for post v6.3 removal of the extra + # + in localversion. .scmversion is no longer used, and the + # variable LOCALVERSION must be used + if [ ! -e ${B}/.scmversion -a ! -e ${S}/.scmversion ]; then + echo ${KERNEL_LOCALVERSION} > ${B}/.scmversion + echo ${KERNEL_LOCALVERSION} > ${S}/.scmversion + fi if [ "${S}" != "${B}" ] && [ -f "${S}/.config" ] && [ ! -f "${B}/.config" ]; then mv "${S}/.config" "${B}/.config" @@ -657,7 +684,7 @@ do_savedefconfig() { do_savedefconfig[nostamp] = "1" addtask savedefconfig after do_configure -inherit cml1 +inherit cml1 pkgconfig # Need LD, HOSTLDFLAGS and more for config operations KCONFIG_CONFIG_COMMAND:append = " ${EXTRA_OEMAKE}" @@ -673,6 +700,7 @@ FILES:${KERNEL_PACKAGE_NAME}-image = "" FILES:${KERNEL_PACKAGE_NAME}-dev = "/${KERNEL_IMAGEDEST}/System.map* /${KERNEL_IMAGEDEST}/Module.symvers* /${KERNEL_IMAGEDEST}/config* ${KERNEL_SRC_PATH} ${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" FILES:${KERNEL_PACKAGE_NAME}-vmlinux = "/${KERNEL_IMAGEDEST}/vmlinux-${KERNEL_VERSION_NAME}" FILES:${KERNEL_PACKAGE_NAME}-modules = "" +FILES:${KERNEL_PACKAGE_NAME}-dbg = "/usr/lib/debug /usr/src/debug" RDEPENDS:${KERNEL_PACKAGE_NAME} = "${KERNEL_PACKAGE_NAME}-base (= ${EXTENDPKGV})" # Allow machines to override this dependency if kernel image files are # not wanted in images as standard diff --git a/meta/classes/kernelsrc.bbclass b/meta/classes/kernelsrc.bbclass index a951ba3325..a79bf18b09 100644 --- a/meta/classes/kernelsrc.bbclass +++ b/meta/classes/kernelsrc.bbclass @@ -5,6 +5,7 @@ do_patch[depends] += "virtual/kernel:do_shared_workdir" do_patch[noexec] = "1" do_package[depends] += "virtual/kernel:do_populate_sysroot" KERNEL_VERSION = "${@get_kernelversion_file("${STAGING_KERNEL_BUILDDIR}")}" +LOCAL_VERSION = "${@get_kernellocalversion_file("${STAGING_KERNEL_BUILDDIR}")}" inherit linux-kernel-base diff --git a/meta/classes/libc-package.bbclass b/meta/classes/libc-package.bbclass index 13ef8cdc0d..baab8fc9a9 100644 --- a/meta/classes/libc-package.bbclass +++ b/meta/classes/libc-package.bbclass @@ -45,6 +45,7 @@ PACKAGE_NO_GCONV ?= "0" OVERRIDES:append = ":${TARGET_ARCH}-${TARGET_OS}" locale_base_postinst_ontarget() { +mkdir ${libdir}/locale localedef --inputfile=${datadir}/i18n/locales/%s --charmap=%s %s } diff --git a/meta/classes/license.bbclass b/meta/classes/license.bbclass index 4ebfc4fb92..b92838c030 100644 --- a/meta/classes/license.bbclass +++ b/meta/classes/license.bbclass @@ -223,7 +223,7 @@ def find_license_files(d): bb.fatal('%s: %s' % (d.getVar('PF'), exc)) except SyntaxError: oe.qa.handle_error("license-syntax", - "%s: Failed to parse it's LICENSE field." % (d.getVar('PF')), d) + "%s: Failed to parse LICENSE: %s" % (d.getVar('PF'), d.getVar('LICENSE')), d) # Add files from LIC_FILES_CHKSUM to list of license files lic_chksum_paths = defaultdict(OrderedDict) for path, data in sorted(lic_chksums.items()): diff --git a/meta/classes/license_image.bbclass b/meta/classes/license_image.bbclass index 3213ea758e..1c06a02951 100644 --- a/meta/classes/license_image.bbclass +++ b/meta/classes/license_image.bbclass @@ -229,7 +229,7 @@ def get_deployed_dependencies(d): deploy = {} # Get all the dependencies for the current task (rootfs). taskdata = d.getVar("BB_TASKDEPDATA", False) - pn = d.getVar("PN", True) + pn = d.getVar("PN") depends = list(set([dep[0] for dep in list(taskdata.values()) if not dep[0].endswith("-native") and not dep[0] == pn])) diff --git a/meta/classes/linux-kernel-base.bbclass b/meta/classes/linux-kernel-base.bbclass index ba59222c24..0e2a4a4abe 100644 --- a/meta/classes/linux-kernel-base.bbclass +++ b/meta/classes/linux-kernel-base.bbclass @@ -33,9 +33,24 @@ def get_kernelversion_file(p): except IOError: return None +def get_kernellocalversion_file(p): + fn = p + '/kernel-localversion' + + try: + with open(fn, 'r') as f: + return f.readlines()[0].strip() + except IOError: + return "" + + return "" + def linux_module_packages(s, d): suffix = "" return " ".join(map(lambda s: "kernel-module-%s%s" % (s.lower().replace('_', '-').replace('@', '+'), suffix), s.split())) +export KBUILD_BUILD_VERSION = "1" +export KBUILD_BUILD_USER ?= "oe-user" +export KBUILD_BUILD_HOST ?= "oe-host" + # that's all diff --git a/meta/classes/meson.bbclass b/meta/classes/meson.bbclass index 19b54e0fdc..fb6660c1a2 100644 --- a/meta/classes/meson.bbclass +++ b/meta/classes/meson.bbclass @@ -105,6 +105,7 @@ nm = ${@meson_array('BUILD_NM', d)} strip = ${@meson_array('BUILD_STRIP', d)} readelf = ${@meson_array('BUILD_READELF', d)} objcopy = ${@meson_array('BUILD_OBJCOPY', d)} +llvm-config = '${STAGING_BINDIR_NATIVE}/llvm-config' pkgconfig = 'pkg-config-native' ${@rust_tool(d, "BUILD_SYS")} diff --git a/meta/classes/module-base.bbclass b/meta/classes/module-base.bbclass index 27bd69ff33..5b2fde8144 100644 --- a/meta/classes/module-base.bbclass +++ b/meta/classes/module-base.bbclass @@ -14,6 +14,7 @@ export CROSS_COMPILE = "${TARGET_PREFIX}" export KBUILD_OUTPUT = "${STAGING_KERNEL_BUILDDIR}" export KERNEL_VERSION = "${@oe.utils.read_file('${STAGING_KERNEL_BUILDDIR}/kernel-abiversion')}" +export LOCALVERSION = "${@oe.utils.read_file('${STAGING_KERNEL_BUILDDIR}/kernel-localversion')}" KERNEL_OBJECT_SUFFIX = ".ko" # kernel modules are generally machine specific diff --git a/meta/classes/multilib.bbclass b/meta/classes/multilib.bbclass index 5859ca8d21..a0be559970 100644 --- a/meta/classes/multilib.bbclass +++ b/meta/classes/multilib.bbclass @@ -45,6 +45,7 @@ python multilib_virtclass_handler () { e.data.setVar("RECIPE_SYSROOT", "${WORKDIR}/recipe-sysroot") e.data.setVar("STAGING_DIR_TARGET", "${WORKDIR}/recipe-sysroot") e.data.setVar("STAGING_DIR_HOST", "${WORKDIR}/recipe-sysroot") + e.data.setVar("RECIPE_SYSROOT_MANIFEST_SUBDIR", "nativesdk-" + variant) e.data.setVar("MLPREFIX", variant + "-") override = ":virtclass-multilib-" + variant e.data.setVar("OVERRIDES", e.data.getVar("OVERRIDES", False) + override) diff --git a/meta/classes/native.bbclass b/meta/classes/native.bbclass index 4de96cd59b..56726301bd 100644 --- a/meta/classes/native.bbclass +++ b/meta/classes/native.bbclass @@ -23,6 +23,8 @@ TARGET_CFLAGS = "${BUILD_CFLAGS}" TARGET_CXXFLAGS = "${BUILD_CXXFLAGS}" TARGET_LDFLAGS = "${BUILD_LDFLAGS}" TARGET_FPU = "" +TUNE_FEATURES = "" +ABIEXTENSION = "" HOST_ARCH = "${BUILD_ARCH}" HOST_OS = "${BUILD_OS}" diff --git a/meta/classes/npm.bbclass b/meta/classes/npm.bbclass index 8379c7b988..45e6b4fac7 100644 --- a/meta/classes/npm.bbclass +++ b/meta/classes/npm.bbclass @@ -82,7 +82,7 @@ def npm_pack(env, srcdir, workdir): subprocess.run(['tar', 'czf', tarball, '--exclude', './node-modules', '--exclude-vcs', - '--transform', 's,^\./,package/,', + '--transform', r's,^\./,package/,', '--mtime', '1985-10-26T08:15:00.000Z', '.'], check = True, cwd = srcdir) diff --git a/meta/classes/package.bbclass b/meta/classes/package.bbclass index 8b11fdd155..67351b2510 100644 --- a/meta/classes/package.bbclass +++ b/meta/classes/package.bbclass @@ -262,7 +262,7 @@ def files_from_filevars(filevars): f = '.' + f if not f.startswith("./"): f = './' + f - globbed = glob.glob(f) + globbed = glob.glob(f, recursive=True) if globbed: if [ f ] != globbed: files += globbed @@ -636,6 +636,13 @@ def copydebugsources(debugsrcdir, sources, d): # Same check as above for externalsrc if workdir not in sdir: if os.path.exists(dvar + debugsrcdir + sdir): + # Special case for /build since we need to move into + # /usr/src/debug/build so rename sdir to build.build + if sdir == "/build" or sdir.find("/build/") == 0: + cmd = "mv %s%s%s %s%s%s" % (dvar, debugsrcdir, "/build", dvar, debugsrcdir, "/build.build") + subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT) + sdir = sdir.replace("/build", "/build.build", 1) + cmd = "mv %s%s%s/* %s%s" % (dvar, debugsrcdir, sdir, dvar,debugsrcdir) subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT) @@ -2171,18 +2178,18 @@ python package_do_pkgconfig () { with open(file, 'r') as f: lines = f.readlines() for l in lines: - m = var_re.match(l) - if m: - name = m.group(1) - val = m.group(2) - pd.setVar(name, pd.expand(val)) - continue m = field_re.match(l) if m: hdr = m.group(1) exp = pd.expand(m.group(2)) if hdr == 'Requires': pkgconfig_needed[pkg] += exp.replace(',', ' ').split() + continue + m = var_re.match(l) + if m: + name = m.group(1) + val = m.group(2) + pd.setVar(name, pd.expand(val)) for pkg in packages.split(): pkgs_file = os.path.join(shlibswork_dir, pkg + ".pclist") diff --git a/meta/classes/package_rpm.bbclass b/meta/classes/package_rpm.bbclass index bbbef3793f..f403af5343 100644 --- a/meta/classes/package_rpm.bbclass +++ b/meta/classes/package_rpm.bbclass @@ -4,6 +4,7 @@ IMAGE_PKGTYPE ?= "rpm" RPM="rpm" RPMBUILD="rpmbuild" +RPMBUILD_COMPMODE ?= "${@'w19T%d.zstdio' % int(d.getVar('ZSTD_THREADS'))}" PKGWRITEDIRRPM = "${WORKDIR}/deploy-rpms" @@ -652,6 +653,7 @@ python do_package_rpm () { # Setup the rpmbuild arguments... rpmbuild = d.getVar('RPMBUILD') + rpmbuild_compmode = d.getVar('RPMBUILD_COMPMODE') targetsys = d.getVar('TARGET_SYS') targetvendor = d.getVar('HOST_VENDOR') @@ -678,8 +680,8 @@ python do_package_rpm () { cmd = cmd + " --define '_use_internal_dependency_generator 0'" cmd = cmd + " --define '_binaries_in_noarch_packages_terminate_build 0'" cmd = cmd + " --define '_build_id_links none'" - cmd = cmd + " --define '_binary_payload w19T%d.zstdio'" % int(d.getVar("ZSTD_THREADS")) - cmd = cmd + " --define '_source_payload w19T%d.zstdio'" % int(d.getVar("ZSTD_THREADS")) + cmd = cmd + " --define '_source_payload %s'" % rpmbuild_compmode + cmd = cmd + " --define '_binary_payload %s'" % rpmbuild_compmode cmd = cmd + " --define 'clamp_mtime_to_source_date_epoch 1'" cmd = cmd + " --define 'use_source_date_epoch_as_buildtime 1'" cmd = cmd + " --define '_buildhost reproducible'" diff --git a/meta/classes/populate_sdk_base.bbclass b/meta/classes/populate_sdk_base.bbclass index 16f929bf59..fb00460172 100644 --- a/meta/classes/populate_sdk_base.bbclass +++ b/meta/classes/populate_sdk_base.bbclass @@ -53,6 +53,8 @@ TOOLCHAIN_OUTPUTNAME ?= "${SDK_NAME}-toolchain-${SDK_VERSION}" SDK_ARCHIVE_TYPE ?= "tar.xz" SDK_XZ_COMPRESSION_LEVEL ?= "-9" SDK_XZ_OPTIONS ?= "${XZ_DEFAULTS} ${SDK_XZ_COMPRESSION_LEVEL}" +SDK_ZIP_OPTIONS ?= "-y" + # To support different sdk type according to SDK_ARCHIVE_TYPE, now support zip and tar.xz python () { @@ -60,7 +62,7 @@ python () { d.setVar('SDK_ARCHIVE_DEPENDS', 'zip-native') # SDK_ARCHIVE_CMD used to generate archived sdk ${TOOLCHAIN_OUTPUTNAME}.${SDK_ARCHIVE_TYPE} from input dir ${SDK_OUTPUT}/${SDKPATH} to output dir ${SDKDEPLOYDIR} # recommand to cd into input dir first to avoid archive with buildpath - d.setVar('SDK_ARCHIVE_CMD', 'cd ${SDK_OUTPUT}/${SDKPATH}; zip -r -y ${SDKDEPLOYDIR}/${TOOLCHAIN_OUTPUTNAME}.${SDK_ARCHIVE_TYPE} .') + d.setVar('SDK_ARCHIVE_CMD', 'cd ${SDK_OUTPUT}/${SDKPATH}; zip -r ${SDK_ZIP_OPTIONS} ${SDKDEPLOYDIR}/${TOOLCHAIN_OUTPUTNAME}.${SDK_ARCHIVE_TYPE} .') else: d.setVar('SDK_ARCHIVE_DEPENDS', 'xz-native') d.setVar('SDK_ARCHIVE_CMD', 'cd ${SDK_OUTPUT}/${SDKPATH}; tar ${SDKTAROPTS} -cf - . | xz ${SDK_XZ_OPTIONS} > ${SDKDEPLOYDIR}/${TOOLCHAIN_OUTPUTNAME}.${SDK_ARCHIVE_TYPE}') diff --git a/meta/classes/populate_sdk_ext.bbclass b/meta/classes/populate_sdk_ext.bbclass index e2019f9bbf..bdd86863c6 100644 --- a/meta/classes/populate_sdk_ext.bbclass +++ b/meta/classes/populate_sdk_ext.bbclass @@ -114,7 +114,7 @@ python write_host_sdk_ext_manifest () { f.write("%s %s %s\n" % (info[1], info[2], info[3])) } -SDK_POSTPROCESS_COMMAND:append:task-populate-sdk-ext = "write_target_sdk_ext_manifest; write_host_sdk_ext_manifest; " +SDK_POSTPROCESS_COMMAND:append:task-populate-sdk-ext = " write_target_sdk_ext_manifest; write_host_sdk_ext_manifest; " SDK_TITLE:task-populate-sdk-ext = "${@d.getVar('DISTRO_NAME') or d.getVar('DISTRO')} Extensible SDK" @@ -227,7 +227,7 @@ python copy_buildsystem () { # Write out config file for devtool import configparser - config = configparser.SafeConfigParser() + config = configparser.ConfigParser() config.add_section('General') config.set('General', 'bitbake_subdir', conf_bbpath) config.set('General', 'init_path', conf_initpath) @@ -363,7 +363,8 @@ python copy_buildsystem () { f.write('BUILDCFG_HEADER = ""\n\n') # Write METADATA_REVISION - f.write('METADATA_REVISION = "%s"\n\n' % d.getVar('METADATA_REVISION')) + # Needs distro override so it can override the value set in the bbclass code (later than local.conf) + f.write('METADATA_REVISION:%s = "%s"\n\n' % (d.getVar('DISTRO'), d.getVar('METADATA_REVISION'))) f.write('# Provide a flag to indicate we are in the EXT_SDK Context\n') f.write('WITHIN_EXT_SDK = "1"\n\n') @@ -714,7 +715,7 @@ sdk_ext_postinst() { # A bit of another hack, but we need this in the path only for devtool # so put it at the end of $PATH. - echo "export PATH=$target_sdk_dir/sysroots/${SDK_SYS}${bindir_nativesdk}:\$PATH" >> $env_setup_script + echo "export PATH=\"$target_sdk_dir/sysroots/${SDK_SYS}${bindir_nativesdk}:\$PATH\"" >> $env_setup_script echo "printf 'SDK environment now set up; additionally you may now run devtool to perform development tasks.\nRun devtool --help for further details.\n'" >> $env_setup_script diff --git a/meta/classes/recipe_sanity.bbclass b/meta/classes/recipe_sanity.bbclass index 7fa4a849ea..df6e9a7db9 100644 --- a/meta/classes/recipe_sanity.bbclass +++ b/meta/classes/recipe_sanity.bbclass @@ -10,7 +10,7 @@ def bad_runtime_vars(cfgdata, d): for var in d.getVar("__recipe_sanity_badruntimevars").split(): val = d.getVar(var, False) if val and val != cfgdata.get(var): - __note("%s should be %s_${PN}" % (var, var), d) + __note("%s should be %s:${PN}" % (var, var), d) __recipe_sanity_reqvars = "DESCRIPTION" __recipe_sanity_reqdiffvars = "" diff --git a/meta/classes/scons.bbclass b/meta/classes/scons.bbclass index 80f8382107..ffe43bb7c9 100644 --- a/meta/classes/scons.bbclass +++ b/meta/classes/scons.bbclass @@ -3,7 +3,9 @@ inherit python3native DEPENDS += "python3-scons-native" EXTRA_OESCONS ?= "" - +# This value below is derived from $(getconf ARG_MAX) +SCONS_MAXLINELENGTH ?= "MAXLINELENGTH=2097152" +EXTRA_OESCONS:append = " ${SCONS_MAXLINELENGTH}" do_configure() { if [ -n "${CONFIGURESTAMPFILE}" -a "${S}" = "${B}" ]; then if [ -e "${CONFIGURESTAMPFILE}" -a "`cat ${CONFIGURESTAMPFILE}`" != "${BB_TASKHASH}" -a "${CLEANBROKEN}" != "1" ]; then @@ -25,4 +27,8 @@ scons_do_install() { die "scons install execution failed." } +do_configure[vardepsexclude] = "SCONS_MAXLINELENGTH" +do_compile[vardepsexclude] = "SCONS_MAXLINELENGTH" +do_install[vardepsexclude] = "SCONS_MAXLINELENGTH" + EXPORT_FUNCTIONS do_compile do_install diff --git a/meta/classes/staging.bbclass b/meta/classes/staging.bbclass index bf8ca58b0b..a78839bdc2 100644 --- a/meta/classes/staging.bbclass +++ b/meta/classes/staging.bbclass @@ -269,6 +269,10 @@ python extend_recipe_sysroot() { pn = d.getVar("PN") stagingdir = d.getVar("STAGING_DIR") sharedmanifests = d.getVar("COMPONENTS_DIR") + "/manifests" + # only needed by multilib cross-canadian since it redefines RECIPE_SYSROOT + manifestprefix = d.getVar("RECIPE_SYSROOT_MANIFEST_SUBDIR") + if manifestprefix: + sharedmanifests = sharedmanifests + "/" + manifestprefix recipesysroot = d.getVar("RECIPE_SYSROOT") recipesysrootnative = d.getVar("RECIPE_SYSROOT_NATIVE") @@ -644,7 +648,7 @@ python staging_taskhandler() { bbtasks = e.tasklist for task in bbtasks: deps = d.getVarFlag(task, "depends") - if task == "do_configure" or (deps and "populate_sysroot" in deps): + if task != 'do_prepare_recipe_sysroot' and (task == "do_configure" or (deps and "populate_sysroot" in deps)): d.prependVarFlag(task, "prefuncs", "extend_recipe_sysroot ") } staging_taskhandler[eventmask] = "bb.event.RecipeTaskPreProcess" diff --git a/meta/classes/systemd.bbclass b/meta/classes/systemd.bbclass index 09ec52792d..c07332d5b6 100644 --- a/meta/classes/systemd.bbclass +++ b/meta/classes/systemd.bbclass @@ -146,6 +146,7 @@ python systemd_populate_packages() { def systemd_check_services(): searchpaths = [oe.path.join(d.getVar("sysconfdir"), "systemd", "system"),] searchpaths.append(d.getVar("systemd_system_unitdir")) + searchpaths.append(d.getVar("systemd_user_unitdir")) systemd_packages = d.getVar('SYSTEMD_PACKAGES') keys = 'Also' diff --git a/meta/classes/testimage.bbclass b/meta/classes/testimage.bbclass index 8ffaeab284..0241f29dfb 100644 --- a/meta/classes/testimage.bbclass +++ b/meta/classes/testimage.bbclass @@ -101,36 +101,12 @@ TESTIMAGE_DUMP_DIR ?= "${LOG_DIR}/runtime-hostdump/" TESTIMAGE_UPDATE_VARS ?= "DL_DIR WORKDIR DEPLOY_DIR" testimage_dump_target () { - top -bn1 - ps - free - df - # The next command will export the default gateway IP - export DEFAULT_GATEWAY=$(ip route | awk '/default/ { print $3}') - ping -c3 $DEFAULT_GATEWAY - dmesg - netstat -an - ip address - # Next command will dump logs from /var/log/ - find /var/log/ -type f 2>/dev/null -exec echo "====================" \; -exec echo {} \; -exec echo "====================" \; -exec cat {} \; -exec echo "" \; } testimage_dump_host () { - top -bn1 - iostat -x -z -N -d -p ALL 20 2 - ps -ef - free - df - memstat - dmesg - ip -s link - netstat -an } testimage_dump_monitor () { - query-status - query-block - dump-guest-memory {"paging":false,"protocol":"file:%s.img"} } python do_testimage() { @@ -240,7 +216,7 @@ def testimage_main(d): with open(tdname, "r") as f: td = json.load(f) except FileNotFoundError as err: - bb.fatal('File %s not found (%s).\nHave you built the image with INHERIT += "testimage" in the conf/local.conf?' % (tdname, err)) + bb.fatal('File %s not found (%s).\nHave you built the image with IMAGE_CLASSES += "testimage" in the conf/local.conf?' % (tdname, err)) # Some variables need to be updates (mostly paths) with the # ones of the current environment because some tests require them. diff --git a/meta/classes/toolchain-scripts.bbclass b/meta/classes/toolchain-scripts.bbclass index d2562b5d38..d735d434e6 100644 --- a/meta/classes/toolchain-scripts.bbclass +++ b/meta/classes/toolchain-scripts.bbclass @@ -47,7 +47,7 @@ toolchain_create_sdk_env_script () { for i in ${CANADIANEXTRAOS}; do EXTRAPATH="$EXTRAPATH:$sdkpathnative$bindir/${TARGET_ARCH}${TARGET_VENDOR}-$i" done - echo "export PATH=$sdkpathnative$bindir:$sdkpathnative$sbindir:$sdkpathnative$base_bindir:$sdkpathnative$base_sbindir:$sdkpathnative$bindir/../${HOST_SYS}/bin:$sdkpathnative$bindir/${TARGET_SYS}"$EXTRAPATH':$PATH' >> $script + echo "export PATH=$sdkpathnative$bindir:$sdkpathnative$sbindir:$sdkpathnative$base_bindir:$sdkpathnative$base_sbindir:$sdkpathnative$bindir/../${HOST_SYS}/bin:$sdkpathnative$bindir/${TARGET_SYS}"$EXTRAPATH':"$PATH"' >> $script echo 'export PKG_CONFIG_SYSROOT_DIR=$SDKTARGETSYSROOT' >> $script echo 'export PKG_CONFIG_PATH=$SDKTARGETSYSROOT'"$libdir"'/pkgconfig:$SDKTARGETSYSROOT'"$prefix"'/share/pkgconfig' >> $script echo 'export CONFIG_SITE=${SDKPATH}/site-config-'"${multimach_target_sys}" >> $script diff --git a/meta/classes/uboot-config.bbclass b/meta/classes/uboot-config.bbclass index b9ad35821a..fe85521877 100644 --- a/meta/classes/uboot-config.bbclass +++ b/meta/classes/uboot-config.bbclass @@ -59,10 +59,6 @@ UBOOT_ENV_BINARY ?= "${UBOOT_ENV}.${UBOOT_ENV_SUFFIX}" UBOOT_ENV_IMAGE ?= "${UBOOT_ENV}-${MACHINE}-${PV}-${PR}.${UBOOT_ENV_SUFFIX}" UBOOT_ENV_SYMLINK ?= "${UBOOT_ENV}-${MACHINE}.${UBOOT_ENV_SUFFIX}" -# Default name of u-boot initial env, but enable individual recipes to change -# this value. -UBOOT_INITIAL_ENV ?= "${PN}-initial-env" - # U-Boot EXTLINUX variables. U-Boot searches for /boot/extlinux/extlinux.conf # to find EXTLINUX conf file. UBOOT_EXTLINUX_INSTALL_DIR ?= "/boot/extlinux" diff --git a/meta/classes/uboot-extlinux-config.bbclass b/meta/classes/uboot-extlinux-config.bbclass index dcebe7ff31..ba7a213ea2 100644 --- a/meta/classes/uboot-extlinux-config.bbclass +++ b/meta/classes/uboot-extlinux-config.bbclass @@ -33,11 +33,11 @@ # UBOOT_EXTLINUX_DEFAULT_LABEL ??= "Linux Default" # UBOOT_EXTLINUX_TIMEOUT ??= "30" # -# UBOOT_EXTLINUX_KERNEL_IMAGE_default ??= "../zImage" -# UBOOT_EXTLINUX_MENU_DESCRIPTION_default ??= "Linux Default" +# UBOOT_EXTLINUX_KERNEL_IMAGE:default ??= "../zImage" +# UBOOT_EXTLINUX_MENU_DESCRIPTION:default ??= "Linux Default" # -# UBOOT_EXTLINUX_KERNEL_IMAGE_fallback ??= "../zImage-fallback" -# UBOOT_EXTLINUX_MENU_DESCRIPTION_fallback ??= "Linux Fallback" +# UBOOT_EXTLINUX_KERNEL_IMAGE:fallback ??= "../zImage-fallback" +# UBOOT_EXTLINUX_MENU_DESCRIPTION:fallback ??= "Linux Fallback" # # Results: # @@ -152,7 +152,7 @@ python do_create_extlinux_config() { bb.fatal('Unable to open %s' % (cfile)) } UBOOT_EXTLINUX_VARS = "CONSOLE MENU_DESCRIPTION ROOT KERNEL_IMAGE FDTDIR FDT KERNEL_ARGS INITRD" -do_create_extlinux_config[vardeps] += "${@' '.join(['UBOOT_EXTLINUX_%s_%s' % (v, l) for v in d.getVar('UBOOT_EXTLINUX_VARS').split() for l in d.getVar('UBOOT_EXTLINUX_LABELS').split()])}" +do_create_extlinux_config[vardeps] += "${@' '.join(['UBOOT_EXTLINUX_%s:%s' % (v, l) for v in d.getVar('UBOOT_EXTLINUX_VARS').split() for l in d.getVar('UBOOT_EXTLINUX_LABELS').split()])}" do_create_extlinux_config[vardepsexclude] += "OVERRIDES" addtask create_extlinux_config before do_install do_deploy after do_compile diff --git a/meta/classes/uninative.bbclass b/meta/classes/uninative.bbclass index 6a9e862bcd..7f0591d49a 100644 --- a/meta/classes/uninative.bbclass +++ b/meta/classes/uninative.bbclass @@ -167,5 +167,7 @@ python uninative_changeinterp () { if not elf.isDynamic(): continue + os.chmod(f, s[stat.ST_MODE] | stat.S_IWUSR) subprocess.check_output(("patchelf-uninative", "--set-interpreter", d.getVar("UNINATIVE_LOADER"), f), stderr=subprocess.STDOUT) + os.chmod(f, s[stat.ST_MODE]) } diff --git a/meta/classes/update-alternatives.bbclass b/meta/classes/update-alternatives.bbclass index fc1ffd828c..2804299fc4 100644 --- a/meta/classes/update-alternatives.bbclass +++ b/meta/classes/update-alternatives.bbclass @@ -1,5 +1,5 @@ # This class is used to help the alternatives system which is useful when -# multiple sources provide same command. You can use update-alternatives +# multiple sources provide the same command. You can use update-alternatives # command directly in your recipe, but in most cases this class simplifies # that job. # @@ -29,7 +29,7 @@ # A non-default link to create for a target # ALTERNATIVE_TARGET[name] = "target" # -# This is the name of the binary as it's been install by do_install +# This is the name of the binary as it's been installed by do_install # i.e. ALTERNATIVE_TARGET[sh] = "/bin/bash" # # A package specific link for a target @@ -62,7 +62,7 @@ ALTERNATIVE_PRIORITY = "10" # We need special processing for vardeps because it can not work on # modified flag values. So we aggregate the flags into a new variable -# and include that vairable in the set. +# and include that variable in the set. UPDALTVARS = "ALTERNATIVE ALTERNATIVE_LINK_NAME ALTERNATIVE_TARGET ALTERNATIVE_PRIORITY" PACKAGE_WRITE_DEPS += "virtual/update-alternatives-native" @@ -80,10 +80,10 @@ def gen_updatealternativesvardeps(d): for p in pkgs: for v in vars: - for flag in sorted((d.getVarFlags("%s_%s" % (v,p)) or {}).keys()): + for flag in sorted((d.getVarFlags("%s:%s" % (v,p)) or {}).keys()): if flag == "doc" or flag == "vardeps" or flag == "vardepsexp": continue - d.appendVar('%s_VARDEPS_%s' % (v,p), ' %s:%s' % (flag, d.getVarFlag('%s_%s' % (v,p), flag, False))) + d.appendVar('%s_VARDEPS_%s' % (v,p), ' %s:%s' % (flag, d.getVarFlag('%s:%s' % (v,p), flag, False))) def ua_extend_depends(d): if not 'virtual/update-alternatives' in d.getVar('PROVIDES'): diff --git a/meta/classes/useradd-staticids.bbclass b/meta/classes/useradd-staticids.bbclass index 3acf59cd46..e5527f0529 100644 --- a/meta/classes/useradd-staticids.bbclass +++ b/meta/classes/useradd-staticids.bbclass @@ -41,7 +41,7 @@ def update_useradd_static_config(d): def handle_missing_id(id, type, pkg, files, var, value): # For backwards compatibility we accept "1" in addition to "error" error_dynamic = d.getVar('USERADD_ERROR_DYNAMIC') - msg = "%s - %s: %sname %s does not have a static ID defined." % (d.getVar('PN'), pkg, type, id) + msg = 'Recipe %s, package %s: %sname "%s" does not have a static ID defined.' % (d.getVar('PN'), pkg, type, id) if files: msg += " Add %s to one of these files: %s" % (id, files) else: diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf index 82b115e3a2..290dfda6c8 100644 --- a/meta/conf/bitbake.conf +++ b/meta/conf/bitbake.conf @@ -523,7 +523,7 @@ HOSTTOOLS += " \ python3 pzstd ranlib readelf readlink realpath rm rmdir rpcgen sed seq sh \ sha1sum sha224sum sha256sum sha384sum sha512sum \ sleep sort split stat strings strip tail tar tee test touch tr true uname \ - uniq wc wget which xargs zstd \ + uniq unzstd wc wget which xargs zstd \ " # Tools needed to run testimage runtime image testing @@ -948,7 +948,7 @@ BB_HASHCONFIG_IGNORE_VARS ?= "${BB_HASHEXCLUDE_COMMON} DATE TIME SSH_AGENT_PID \ PARALLEL_MAKE BB_NUMBER_THREADS BB_ORIGENV BB_INVALIDCONF BBINCLUDED \ GIT_PROXY_COMMAND ALL_PROXY all_proxy NO_PROXY no_proxy FTP_PROXY ftp_proxy \ HTTP_PROXY http_proxy HTTPS_PROXY https_proxy SOCKS5_USER SOCKS5_PASSWD \ - BB_SETSCENE_ENFORCE BB_CMDLINE BB_SERVER_TIMEOUT" + BB_SETSCENE_ENFORCE BB_CMDLINE BB_SERVER_TIMEOUT BB_NICE_LEVEL" BB_SIGNATURE_EXCLUDE_FLAGS ?= "doc deps depends \ lockfiles vardepsexclude vardeps vardepvalue vardepvalueexclude \ file-checksums python task nostamp \ diff --git a/meta/conf/distro/include/cve-extra-exclusions.inc b/meta/conf/distro/include/cve-extra-exclusions.inc index 8b5f8d49b8..cb2d920441 100644 --- a/meta/conf/distro/include/cve-extra-exclusions.inc +++ b/meta/conf/distro/include/cve-extra-exclusions.inc @@ -15,6 +15,11 @@ # the aim of sharing that work and ensuring we don't duplicate it. # +#cargo https://nvd.nist.gov/vuln/detail/CVE-2022-46176 +#cargo security advisor https://blog.rust-lang.org/2023/01/10/cve-2022-46176.html +#This CVE is a security issue when using cargo ssh. In kirkstone, rust 1.59.0 is used and the rust on-target is not supported, so the target images are not vulnerable to the cve. +#The bitbake using the 'wget' (which uses 'https') for fetching the sources instead of ssh. So, the cargo-native are also not vulnerable to this cve and so added to excluded list. +CVE_CHECK_IGNORE += "CVE-2022-46176" # strace https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-0006 # CVE is more than 20 years old with no resolution evident diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.inc index 4778b1e5e6..bfc14951fe 100644 --- a/meta/conf/distro/include/maintainers.inc +++ b/meta/conf/distro/include/maintainers.inc @@ -42,7 +42,7 @@ RECIPE_MAINTAINER:pn-alsa-utils-scripts = "Michael Opdenacker <michael.opdenacke RECIPE_MAINTAINER:pn-apmd = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-apr = "Hongxu Jia <hongxu.jia@windriver.com>" RECIPE_MAINTAINER:pn-apr-util = "Hongxu Jia <hongxu.jia@windriver.com>" -RECIPE_MAINTAINER:pn-apt = "Aníbal Limón <limon.anibal@gmail.com>" +RECIPE_MAINTAINER:pn-apt = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-argp-standalone = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-asciidoc = "Yi Zhao <yi.zhao@windriver.com>" RECIPE_MAINTAINER:pn-aspell = "Anuj Mittal <anuj.mittal@intel.com>" @@ -62,7 +62,7 @@ RECIPE_MAINTAINER:pn-base-passwd = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-bash = "Hongxu Jia <hongxu.jia@windriver.com>" RECIPE_MAINTAINER:pn-bash-completion = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-bc = "Anuj Mittal <anuj.mittal@intel.com>" -RECIPE_MAINTAINER:pn-bind = "Armin Kuster <akuster808@gmail.com>" +RECIPE_MAINTAINER:pn-bind = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-binutils = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-binutils-cross-${TARGET_ARCH} = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-binutils-cross-canadian-${TRANSLATED_TARGET_ARCH} = "Khem Raj <raj.khem@gmail.com>" @@ -95,8 +95,8 @@ RECIPE_MAINTAINER:pn-cantarell-fonts = "Alexander Kanavin <alex.kanavin@gmail.co RECIPE_MAINTAINER:pn-ccache = "Robert Yang <liezhi.yang@windriver.com>" RECIPE_MAINTAINER:pn-cdrtools-native = "Yi Zhao <yi.zhao@windriver.com>" RECIPE_MAINTAINER:pn-chrpath = "Yi Zhao <yi.zhao@windriver.com>" -RECIPE_MAINTAINER:pn-cmake = "Pascal Bach <pascal.bach@siemens.com>" -RECIPE_MAINTAINER:pn-cmake-native = "Pascal Bach <pascal.bach@siemens.com>" +RECIPE_MAINTAINER:pn-cmake = "Unassigned <unassigned@yoctoproject.org>" +RECIPE_MAINTAINER:pn-cmake-native = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-connman = "Changhyeok Bae <changhyeok.bae@gmail.com>" RECIPE_MAINTAINER:pn-connman-conf = "Ross Burton <ross.burton@arm.com>" RECIPE_MAINTAINER:pn-connman-gnome = "Ross Burton <ross.burton@arm.com>" @@ -152,7 +152,7 @@ RECIPE_MAINTAINER:pn-docbook-xml-dtd4 = "Yi Zhao <yi.zhao@windriver.com>" RECIPE_MAINTAINER:pn-docbook-xsl-stylesheets = "Yi Zhao <yi.zhao@windriver.com>" RECIPE_MAINTAINER:pn-dos2unix = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-dosfstools = "Yi Zhao <yi.zhao@windriver.com>" -RECIPE_MAINTAINER:pn-dpkg = "Aníbal Limón <limon.anibal@gmail.com>" +RECIPE_MAINTAINER:pn-dpkg = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-dropbear = "Yi Zhao <yi.zhao@windriver.com>" RECIPE_MAINTAINER:pn-dtc = "Wang Mingyu <wangmy@fujitsu.com>" RECIPE_MAINTAINER:pn-dwarfsrcfiles = "Alexander Kanavin <alex.kanavin@gmail.com>" @@ -165,7 +165,7 @@ RECIPE_MAINTAINER:pn-ell = "Zang Ruochen <zangrc.fnst@fujitsu.com>" RECIPE_MAINTAINER:pn-enchant2 = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-encodings = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-epiphany = "Alexander Kanavin <alex.kanavin@gmail.com>" -RECIPE_MAINTAINER:pn-erofs-utils = "Richard Weinberger <richard@nod.at>" +RECIPE_MAINTAINER:pn-erofs-utils = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-ethtool = "Changhyeok Bae <changhyeok.bae@gmail.com>" RECIPE_MAINTAINER:pn-eudev = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-expat = "Yi Zhao <yi.zhao@windriver.com>" @@ -189,7 +189,7 @@ RECIPE_MAINTAINER:pn-gcc-cross-canadian-${TRANSLATED_TARGET_ARCH} = "Khem Raj <r RECIPE_MAINTAINER:pn-gcc-crosssdk-${SDK_SYS} = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-gcc-runtime = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-gcc-sanitizers = "Khem Raj <raj.khem@gmail.com>" -RECIPE_MAINTAINER:pn-gcc-source-11.3.0 = "Khem Raj <raj.khem@gmail.com>" +RECIPE_MAINTAINER:pn-gcc-source-11.4.0 = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-gconf = "Ross Burton <ross.burton@arm.com>" RECIPE_MAINTAINER:pn-gcr = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-gdb = "Khem Raj <raj.khem@gmail.com>" @@ -280,8 +280,8 @@ RECIPE_MAINTAINER:pn-intltool = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-iproute2 = "Changhyeok Bae <changhyeok.bae@gmail.com>" RECIPE_MAINTAINER:pn-iptables = "Changhyeok Bae <changhyeok.bae@gmail.com>" RECIPE_MAINTAINER:pn-iputils = "Changhyeok Bae <changhyeok.bae@gmail.com>" -RECIPE_MAINTAINER:pn-iso-codes = "Wang Mingyu <wangmy@cn.ujitsu.com>" -RECIPE_MAINTAINER:pn-itstool = "Andreas Müller <schnitzeltony@gmail.com>" +RECIPE_MAINTAINER:pn-iso-codes = "Wang Mingyu <wangmy@cn.fujitsu.com>" +RECIPE_MAINTAINER:pn-itstool = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-iw = "Changhyeok Bae <changhyeok.bae@gmail.com>" RECIPE_MAINTAINER:pn-libjpeg-turbo = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-json-c = "Yi Zhao <yi.zhao@windriver.com>" @@ -294,7 +294,7 @@ RECIPE_MAINTAINER:pn-kernel-devsrc = "Bruce Ashfield <bruce.ashfield@gmail.com>" RECIPE_MAINTAINER:pn-kexec-tools = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-keymaps = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-kmod = "Chen Qi <Qi.Chen@windriver.com>" -RECIPE_MAINTAINER:pn-kmscube = "Carlos Rafael Giani <dv@pseudoterminal.org>" +RECIPE_MAINTAINER:pn-kmscube = "Carlos Rafael Giani <crg7475@mailbox.org>" RECIPE_MAINTAINER:pn-l3afpad = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-lame = "Michael Opdenacker <michael.opdenacker@bootlin.com>" RECIPE_MAINTAINER:pn-ldconfig-native = "Khem Raj <raj.khem@gmail.com>" @@ -402,7 +402,7 @@ RECIPE_MAINTAINER:pn-liburcu = "Wang Mingyu <wangmy@fujitsu.com>" RECIPE_MAINTAINER:pn-liburi-perl = "Tim Orling <tim.orling@konsulko.com>" RECIPE_MAINTAINER:pn-libusb1 = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-libubootenv = "Stefano Babic <sbabic@denx.de>" -RECIPE_MAINTAINER:pn-libuv = "Armin Kuster <akuster@mvista.com>" +RECIPE_MAINTAINER:pn-libuv = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-libva = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-libva-initial = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-libva-utils = "Anuj Mittal <anuj.mittal@intel.com>" @@ -541,7 +541,7 @@ RECIPE_MAINTAINER:pn-npth = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-nss-myhostname = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-numactl = "Richard Purdie <richard.purdie@linuxfoundation.org>" RECIPE_MAINTAINER:pn-ofono = "Ross Burton <ross.burton@arm.com>" -RECIPE_MAINTAINER:pn-opensbi = "Alistair Francis <alistair.francis@wdc.com>" +RECIPE_MAINTAINER:pn-opensbi = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-openssh = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-openssl = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-opkg = "Alex Stewart <alex.stewart@ni.com>" @@ -550,8 +550,8 @@ RECIPE_MAINTAINER:pn-opkg-keyrings = "Alex Stewart <alex.stewart@ni.com>" RECIPE_MAINTAINER:pn-opkg-utils = "Alex Stewart <alex.stewart@ni.com>" RECIPE_MAINTAINER:pn-orc = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-os-release = "Ross Burton <ross.burton@arm.com>" -RECIPE_MAINTAINER:pn-ovmf = "Ricardo Neri <ricardo.neri-calderon@linux.intel.com>" -RECIPE_MAINTAINER:pn-ovmf-shell-image = "Ricardo Neri <ricardo.neri-calderon@linux.intel.com>" +RECIPE_MAINTAINER:pn-ovmf = "Unassigned <unassigned@yoctoproject.org>" +RECIPE_MAINTAINER:pn-ovmf-shell-image = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-p11-kit = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-package-index = "Ross Burton <ross.burton@arm.com>" RECIPE_MAINTAINER:pn-pango = "Ross Burton <ross.burton@arm.com>" @@ -700,7 +700,7 @@ RECIPE_MAINTAINER:pn-quilt-native = "Robert Yang <liezhi.yang@windriver.com>" RECIPE_MAINTAINER:pn-quota = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-re2c = "Khem Raj <raj.khem@gmail.com>" RECIPE_MAINTAINER:pn-readline = "Hongxu Jia <hongxu.jia@windriver.com>" -RECIPE_MAINTAINER:pn-repo = "Jasper Orschulko <Jasper.Orschulko@iris-sensing.com>" +RECIPE_MAINTAINER:pn-repo = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-resolvconf = "Chen Qi <Qi.Chen@windriver.com>" RECIPE_MAINTAINER:pn-rgb = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-rpcbind = "Hongxu Jia <hongxu.jia@windriver.com>" @@ -816,7 +816,7 @@ RECIPE_MAINTAINER:pn-weston-init = "Denys Dmytriyenko <denis@denix.org>" RECIPE_MAINTAINER:pn-wget = "Yi Zhao <yi.zhao@windriver.com>" RECIPE_MAINTAINER:pn-which = "Anuj Mittal <anuj.mittal@intel.com>" RECIPE_MAINTAINER:pn-wic-tools = "Anuj Mittal <anuj.mittal@intel.com>" -RECIPE_MAINTAINER:pn-wireless-regdb = "Adrian Bunk <bunk@kernel.org>" +RECIPE_MAINTAINER:pn-wireless-regdb = "Unassigned <unassigned@yoctoproject.org>" RECIPE_MAINTAINER:pn-wpa-supplicant = "Changhyeok Bae <changhyeok.bae@gmail.com>" RECIPE_MAINTAINER:pn-wpebackend-fdo = "Alexander Kanavin <alex.kanavin@gmail.com>" RECIPE_MAINTAINER:pn-x11perf = "Unassigned <unassigned@yoctoproject.org>" diff --git a/meta/conf/distro/include/ptest-packagelists.inc b/meta/conf/distro/include/ptest-packagelists.inc index b51cce4d9e..5c6a30635f 100644 --- a/meta/conf/distro/include/ptest-packagelists.inc +++ b/meta/conf/distro/include/ptest-packagelists.inc @@ -22,12 +22,14 @@ PTESTS_FAST = "\ gettext-ptest \ glib-networking-ptest \ gzip-ptest \ + json-c-ptest \ json-glib-ptest \ libconvert-asn1-perl-ptest \ liberror-perl-ptest \ libnl-ptest \ libmodule-build-perl-ptest \ libpcre-ptest \ + libpng-ptest \ libssh2-ptest \ libtimedate-perl-ptest \ libtest-needs-perl-ptest \ @@ -99,7 +101,7 @@ PTESTS_SLOW = "\ " PTESTS_SLOW:remove:riscv64 = "valgrind-ptest" -PTESTS_PROBLEMS:append:riscv64 = "valgrind-ptest" +PTESTS_PROBLEMS:append:riscv64 = " valgrind-ptest" # ruby-ptest \ # Timeout # lz4-ptest \ # Needs a rewrite diff --git a/meta/conf/distro/include/yocto-uninative.inc b/meta/conf/distro/include/yocto-uninative.inc index 7012db441b..4ac66fd506 100644 --- a/meta/conf/distro/include/yocto-uninative.inc +++ b/meta/conf/distro/include/yocto-uninative.inc @@ -6,10 +6,10 @@ # to the distro running on the build machine. # -UNINATIVE_MAXGLIBCVERSION = "2.36" -UNINATIVE_VERSION = "3.7" +UNINATIVE_MAXGLIBCVERSION = "2.39" +UNINATIVE_VERSION = "4.4" UNINATIVE_URL ?= "http://downloads.yoctoproject.org/releases/uninative/${UNINATIVE_VERSION}/" -UNINATIVE_CHECKSUM[aarch64] ?= "6a29bcae4b5b716d2d520e18800b33943b65f8a835eac1ff8793fc5ee65b4be6" -UNINATIVE_CHECKSUM[i686] ?= "3f6d52e64996570c716108d49f8108baccf499a283bbefae438c7266b7a93305" -UNINATIVE_CHECKSUM[x86_64] ?= "b110bf2e10fe420f5ca2f3ec55f048ee5f0a54c7e34856a3594e51eb2aea0570" +UNINATIVE_CHECKSUM[aarch64] ?= "b61876130f494f75092f21086b4a64ea5fb064045769bf1d32e9cb6af17ea8ec" +UNINATIVE_CHECKSUM[i686] ?= "9f28627828f0082cc0344eede4d9a861a9a064bfa8f36e072e46212f0fe45fcc" +UNINATIVE_CHECKSUM[x86_64] ?= "d81c54284be2bb886931fc87281d58177a2cd381cf99d1981f8923039a72a302" diff --git a/meta/conf/documentation.conf b/meta/conf/documentation.conf index ab2addb321..e55bfa288d 100644 --- a/meta/conf/documentation.conf +++ b/meta/conf/documentation.conf @@ -253,6 +253,7 @@ KERNEL_MODULE_PROBECONF[doc] = "Lists kernel modules for which the build system KERNEL_PACKAGE_NAME[doc] = "Name prefix for kernel packages. Defaults to 'kernel'." KERNEL_PATH[doc] = "The location of the kernel sources. This variable is set to the value of the STAGING_KERNEL_DIR within the module class (module.bbclass)." KERNEL_SRC[doc] = "The location of the kernel sources. This variable is set to the value of the STAGING_KERNEL_DIR within the module class (module.bbclass)." +KERNEL_LOCALVERSION[doc] = "Appends a string to the name of the local version of the kernel image." KFEATURE_DESCRIPTION[doc] = "Provides a short description of a configuration fragment. You use this variable in the .scc file that describes a configuration fragment file." KMACHINE[doc] = "The machine as known by the kernel." KTYPE[doc] = "Defines the kernel type to be used in assembling the configuration." diff --git a/meta/conf/layer.conf b/meta/conf/layer.conf index ea57123601..1f329c3efe 100644 --- a/meta/conf/layer.conf +++ b/meta/conf/layer.conf @@ -69,6 +69,7 @@ SIGGEN_EXCLUDE_SAFE_RECIPE_DEPS += " \ initramfs-module-install->grub \ initramfs-module-install->parted \ initramfs-module-install->util-linux \ + initramfs-module-setup-live->udev-extraconf \ grub-efi->grub-bootconf \ liberation-fonts->fontconfig \ cantarell-fonts->fontconfig \ diff --git a/meta/conf/machine/include/arm/arch-arm64.inc b/meta/conf/machine/include/arm/arch-arm64.inc index 0e2efb5a40..832d0000ac 100644 --- a/meta/conf/machine/include/arm/arch-arm64.inc +++ b/meta/conf/machine/include/arm/arch-arm64.inc @@ -37,3 +37,8 @@ TUNE_ARCH = "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', '${TUNE_ARCH_64}', TUNE_PKGARCH = "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', '${TUNE_PKGARCH_64}', '${TUNE_PKGARCH_32}', d)}" ABIEXTENSION = "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', '${ABIEXTENSION_64}', '${ABIEXTENSION_32}', d)}" TARGET_FPU = "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', '${TARGET_FPU_64}', '${TARGET_FPU_32}', d)}" + +# Emit branch protection (PAC/BTI) instructions. On hardware that doesn't +# support these they're meaningless NOP instructions, so there's very little +# reason not to. +TUNE_CCARGS .= "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', ' -mbranch-protection=standard', '', d)}" diff --git a/meta/conf/machine/include/microblaze/feature-microblaze-versions.inc b/meta/conf/machine/include/microblaze/feature-microblaze-versions.inc index 5c37f49abb..658e87b8cd 100644 --- a/meta/conf/machine/include/microblaze/feature-microblaze-versions.inc +++ b/meta/conf/machine/include/microblaze/feature-microblaze-versions.inc @@ -16,7 +16,7 @@ def microblaze_current_version(d, gcc = False): # find the current version, and convert it to major/minor integers version = None for t in (d.getVar("TUNE_FEATURES") or "").split(): - m = re.search("^v(\d+)\.(\d+)", t) + m = re.search(r"^v(\d+)\.(\d+)", t) if m: version = int(m.group(1)), int(m.group(2)) break diff --git a/meta/files/common-licenses/LGPL-3.0-with-zeromq-exception b/meta/files/common-licenses/LGPL-3.0-with-zeromq-exception new file mode 100644 index 0000000000..02e943c4ac --- /dev/null +++ b/meta/files/common-licenses/LGPL-3.0-with-zeromq-exception @@ -0,0 +1,181 @@ + GNU LESSER GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + + This version of the GNU Lesser General Public License incorporates +the terms and conditions of version 3 of the GNU General Public +License, supplemented by the additional permissions listed below. + + 0. Additional Definitions. + + As used herein, "this License" refers to version 3 of the GNU Lesser +General Public License, and the "GNU GPL" refers to version 3 of the GNU +General Public License. + + "The Library" refers to a covered work governed by this License, +other than an Application or a Combined Work as defined below. + + An "Application" is any work that makes use of an interface provided +by the Library, but which is not otherwise based on the Library. +Defining a subclass of a class defined by the Library is deemed a mode +of using an interface provided by the Library. + + A "Combined Work" is a work produced by combining or linking an +Application with the Library. The particular version of the Library +with which the Combined Work was made is also called the "Linked +Version". + + The "Minimal Corresponding Source" for a Combined Work means the +Corresponding Source for the Combined Work, excluding any source code +for portions of the Combined Work that, considered in isolation, are +based on the Application, and not on the Linked Version. + + The "Corresponding Application Code" for a Combined Work means the +object code and/or source code for the Application, including any data +and utility programs needed for reproducing the Combined Work from the +Application, but excluding the System Libraries of the Combined Work. + + 1. Exception to Section 3 of the GNU GPL. + + You may convey a covered work under sections 3 and 4 of this License +without being bound by section 3 of the GNU GPL. + + 2. Conveying Modified Versions. + + If you modify a copy of the Library, and, in your modifications, a +facility refers to a function or data to be supplied by an Application +that uses the facility (other than as an argument passed when the +facility is invoked), then you may convey a copy of the modified +version: + + a) under this License, provided that you make a good faith effort to + ensure that, in the event an Application does not supply the + function or data, the facility still operates, and performs + whatever part of its purpose remains meaningful, or + + b) under the GNU GPL, with none of the additional permissions of + this License applicable to that copy. + + 3. Object Code Incorporating Material from Library Header Files. + + The object code form of an Application may incorporate material from +a header file that is part of the Library. You may convey such object +code under terms of your choice, provided that, if the incorporated +material is not limited to numerical parameters, data structure +layouts and accessors, or small macros, inline functions and templates +(ten or fewer lines in length), you do both of the following: + + a) Give prominent notice with each copy of the object code that the + Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the object code with a copy of the GNU GPL and this license + document. + + 4. Combined Works. + + You may convey a Combined Work under terms of your choice that, +taken together, effectively do not restrict modification of the +portions of the Library contained in the Combined Work and reverse +engineering for debugging such modifications, if you also do each of +the following: + + a) Give prominent notice with each copy of the Combined Work that + the Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the Combined Work with a copy of the GNU GPL and this license + document. + + c) For a Combined Work that displays copyright notices during + execution, include the copyright notice for the Library among + these notices, as well as a reference directing the user to the + copies of the GNU GPL and this license document. + + d) Do one of the following: + + 0) Convey the Minimal Corresponding Source under the terms of this + License, and the Corresponding Application Code in a form + suitable for, and under terms that permit, the user to + recombine or relink the Application with a modified version of + the Linked Version to produce a modified Combined Work, in the + manner specified by section 6 of the GNU GPL for conveying + Corresponding Source. + + 1) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (a) uses at run time + a copy of the Library already present on the user's computer + system, and (b) will operate properly with a modified version + of the Library that is interface-compatible with the Linked + Version. + + e) Provide Installation Information, but only if you would otherwise + be required to provide such information under section 6 of the + GNU GPL, and only to the extent that such information is + necessary to install and execute a modified version of the + Combined Work produced by recombining or relinking the + Application with a modified version of the Linked Version. (If + you use option 4d0, the Installation Information must accompany + the Minimal Corresponding Source and Corresponding Application + Code. If you use option 4d1, you must provide the Installation + Information in the manner specified by section 6 of the GNU GPL + for conveying Corresponding Source.) + + 5. Combined Libraries. + + You may place library facilities that are a work based on the +Library side by side in a single library together with other library +facilities that are not Applications and are not covered by this +License, and convey such a combined library under terms of your +choice, if you do both of the following: + + a) Accompany the combined library with a copy of the same work based + on the Library, uncombined with any other library facilities, + conveyed under the terms of this License. + + b) Give prominent notice with the combined library that part of it + is a work based on the Library, and explaining where to find the + accompanying uncombined form of the same work. + + 6. Revised Versions of the GNU Lesser General Public License. + + The Free Software Foundation may publish revised and/or new versions +of the GNU Lesser General Public License from time to time. Such new +versions will be similar in spirit to the present version, but may +differ in detail to address new problems or concerns. + + Each version is given a distinguishing version number. If the +Library as you received it specifies that a certain numbered version +of the GNU Lesser General Public License "or any later version" +applies to it, you have the option of following the terms and +conditions either of that published version or of any later version +published by the Free Software Foundation. If the Library as you +received it does not specify a version number of the GNU Lesser +General Public License, you may choose any version of the GNU Lesser +General Public License ever published by the Free Software Foundation. + + If the Library as you received it specifies that a proxy can decide +whether future versions of the GNU Lesser General Public License shall +apply, that proxy's public statement of acceptance of any version is +permanent authorization for you to choose that version for the +Library. + +-------------------------------------------------------------------------------- + + SPECIAL EXCEPTION GRANTED BY COPYRIGHT HOLDERS + +As a special exception, copyright holders give you permission to link this +library with independent modules to produce an executable, regardless of +the license terms of these independent modules, and to copy and distribute +the resulting executable under terms of your choice, provided that you also +meet, for each linked independent module, the terms and conditions of +the license of that module. An independent module is a module which is not +derived from or based on this library. If you modify this library, you must +extend this exception to your version of the library. + +Note: this exception relieves you of any obligations under sections 4 and 5 +of this license, and section 6 of the GNU General Public License. diff --git a/meta/lib/oe/cve_check.py b/meta/lib/oe/cve_check.py index f40f16d7ab..ca2b393116 100644 --- a/meta/lib/oe/cve_check.py +++ b/meta/lib/oe/cve_check.py @@ -73,33 +73,33 @@ def get_patched_cves(d): import re import oe.patch - pn = d.getVar("PN") - cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+") + cve_match = re.compile(r"CVE:( CVE-\d{4}-\d+)+") # Matches the last "CVE-YYYY-ID" in the file name, also if written # in lowercase. Possible to have multiple CVE IDs in a single # file name, but only the last one will be detected from the file name. # However, patch files contents addressing multiple CVE IDs are supported # (cve_match regular expression) - - cve_file_name_match = re.compile(".*([Cc][Vv][Ee]\-\d{4}\-\d+)") + cve_file_name_match = re.compile(r".*(CVE-\d{4}-\d+)", re.IGNORECASE) patched_cves = set() - bb.debug(2, "Looking for patches that solves CVEs for %s" % pn) - for url in oe.patch.src_patches(d): + patches = oe.patch.src_patches(d) + bb.debug(2, "Scanning %d patches for CVEs" % len(patches)) + for url in patches: patch_file = bb.fetch.decodeurl(url)[2] - # Remote compressed patches may not be unpacked, so silently ignore them - if not os.path.isfile(patch_file): - bb.warn("%s does not exist, cannot extract CVE list" % patch_file) - continue - # Check patch file name for CVE ID fname_match = cve_file_name_match.search(patch_file) if fname_match: cve = fname_match.group(1).upper() patched_cves.add(cve) - bb.debug(2, "Found CVE %s from patch file name %s" % (cve, patch_file)) + bb.debug(2, "Found %s from patch file name %s" % (cve, patch_file)) + + # Remote patches won't be present and compressed patches won't be + # unpacked, so say we're not scanning them + if not os.path.isfile(patch_file): + bb.note("%s is remote or compressed, not scanning content" % patch_file) + continue with open(patch_file, "r", encoding="utf-8") as f: try: @@ -159,7 +159,7 @@ def cve_check_merge_jsons(output, data): for product in output["package"]: if product["name"] == data["package"][0]["name"]: - bb.error("Error adding the same package twice") + bb.error("Error adding the same package %s twice" % product["name"]) return output["package"].append(data["package"][0]) @@ -173,3 +173,42 @@ def update_symlinks(target_path, link_path): if os.path.exists(os.path.realpath(link_path)): os.remove(link_path) os.symlink(os.path.basename(target_path), link_path) + + +def convert_cve_version(version): + """ + This function converts from CVE format to Yocto version format. + eg 8.3_p1 -> 8.3p1, 6.2_rc1 -> 6.2-rc1 + + Unless it is redefined using CVE_VERSION in the recipe, + cve_check uses the version in the name of the recipe (${PV}) + to check vulnerabilities against a CVE in the database downloaded from NVD. + + When the version has an update, i.e. + "p1" in OpenSSH 8.3p1, + "-rc1" in linux kernel 6.2-rc1, + the database stores the version as version_update (8.3_p1, 6.2_rc1). + Therefore, we must transform this version before comparing to the + recipe version. + + In this case, the parameter of the function is 8.3_p1. + If the version uses the Release Candidate format, "rc", + this function replaces the '_' by '-'. + If the version uses the Update format, "p", + this function removes the '_' completely. + """ + import re + + matches = re.match('^([0-9.]+)_((p|rc)[0-9]+)$', version) + + if not matches: + return version + + version = matches.group(1) + update = matches.group(2) + + if matches.group(3) == "rc": + return version + '-' + update + + return version + update + diff --git a/meta/lib/oe/go.py b/meta/lib/oe/go.py new file mode 100644 index 0000000000..9996057f12 --- /dev/null +++ b/meta/lib/oe/go.py @@ -0,0 +1,32 @@ +# +# Copyright OpenEmbedded Contributors +# +# SPDX-License-Identifier: MIT +# + +import re + +def map_arch(a): + if re.match('i.86', a): + return '386' + elif a == 'x86_64': + return 'amd64' + elif re.match('arm.*', a): + return 'arm' + elif re.match('aarch64.*', a): + return 'arm64' + elif re.match('mips64el.*', a): + return 'mips64le' + elif re.match('mips64.*', a): + return 'mips64' + elif a == 'mips': + return 'mips' + elif a == 'mipsel': + return 'mipsle' + elif re.match('p(pc|owerpc)(64le)', a): + return 'ppc64le' + elif re.match('p(pc|owerpc)(64)', a): + return 'ppc64' + elif a == 'riscv64': + return 'riscv64' + return '' diff --git a/meta/lib/oe/npm_registry.py b/meta/lib/oe/npm_registry.py index 96c0affb45..3f70e4f5c8 100644 --- a/meta/lib/oe/npm_registry.py +++ b/meta/lib/oe/npm_registry.py @@ -5,7 +5,7 @@ import subprocess _ALWAYS_SAFE = frozenset('ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' '0123456789' - '_.-~') + '_.-~()') MISSING_OK = object() diff --git a/meta/lib/oe/package_manager/__init__.py b/meta/lib/oe/package_manager/__init__.py index 80bc1a6bc6..6615258470 100644 --- a/meta/lib/oe/package_manager/__init__.py +++ b/meta/lib/oe/package_manager/__init__.py @@ -467,7 +467,10 @@ def create_packages_dir(d, subrepo_dir, deploydir, taskname, filterbydependencie # Detect bitbake -b usage nodeps = d.getVar("BB_LIMITEDDEPS") or False if nodeps or not filterbydependencies: - oe.path.symlink(deploydir, subrepo_dir, True) + for arch in d.getVar("ALL_MULTILIB_PACKAGE_ARCHS").split() + d.getVar("ALL_MULTILIB_PACKAGE_ARCHS").replace("-", "_").split(): + target = os.path.join(deploydir + "/" + arch) + if os.path.exists(target): + oe.path.symlink(target, subrepo_dir + "/" + arch, True) return start = None diff --git a/meta/lib/oe/package_manager/deb/__init__.py b/meta/lib/oe/package_manager/deb/__init__.py index 86ddb130ad..910f217b62 100644 --- a/meta/lib/oe/package_manager/deb/__init__.py +++ b/meta/lib/oe/package_manager/deb/__init__.py @@ -80,15 +80,15 @@ class DpkgIndexer(Indexer): return oe.utils.multiprocess_launch(create_index, index_cmds, self.d) - if self.d.getVar('PACKAGE_FEED_SIGN', True) == '1': - signer = get_signer(self.d, self.d.getVar('PACKAGE_FEED_GPG_BACKEND', True)) + if self.d.getVar('PACKAGE_FEED_SIGN') == '1': + signer = get_signer(self.d, self.d.getVar('PACKAGE_FEED_GPG_BACKEND')) else: signer = None if signer: for f in index_sign_files: signer.detach_sign(f, - self.d.getVar('PACKAGE_FEED_GPG_NAME', True), - self.d.getVar('PACKAGE_FEED_GPG_PASSPHRASE_FILE', True), + self.d.getVar('PACKAGE_FEED_GPG_NAME'), + self.d.getVar('PACKAGE_FEED_GPG_PASSPHRASE_FILE'), output_suffix="gpg", use_sha256=True) diff --git a/meta/lib/oe/package_manager/ipk/__init__.py b/meta/lib/oe/package_manager/ipk/__init__.py index 9f60f3abcc..fd61340087 100644 --- a/meta/lib/oe/package_manager/ipk/__init__.py +++ b/meta/lib/oe/package_manager/ipk/__init__.py @@ -245,7 +245,7 @@ class OpkgPM(OpkgDpkgPM): """ if (self.d.getVar('FEED_DEPLOYDIR_BASE_URI') or "") != "": for arch in self.pkg_archs.split(): - cfg_file_name = os.path.join(self.target_rootfs, + cfg_file_name = oe.path.join(self.target_rootfs, self.d.getVar("sysconfdir"), "opkg", "local-%s-feed.conf" % arch) diff --git a/meta/lib/oe/package_manager/ipk/manifest.py b/meta/lib/oe/package_manager/ipk/manifest.py index ae451c5c70..22669f97c0 100644 --- a/meta/lib/oe/package_manager/ipk/manifest.py +++ b/meta/lib/oe/package_manager/ipk/manifest.py @@ -62,7 +62,7 @@ class PkgManifest(Manifest): if len(pkgs_to_install) == 0: return - output = pm.dummy_install(pkgs_to_install).decode('utf-8') + output = pm.dummy_install(pkgs_to_install) with open(self.full_manifest, 'w+') as manifest: pkg_re = re.compile('^Installing ([^ ]+) [^ ].*') diff --git a/meta/lib/oe/package_manager/rpm/rootfs.py b/meta/lib/oe/package_manager/rpm/rootfs.py index 00d07cd9cc..a120092b83 100644 --- a/meta/lib/oe/package_manager/rpm/rootfs.py +++ b/meta/lib/oe/package_manager/rpm/rootfs.py @@ -108,7 +108,7 @@ class PkgRootfs(Rootfs): if self.progress_reporter: self.progress_reporter.next_stage() - self._setup_dbg_rootfs(['/etc', '/var/lib/rpm', '/var/cache/dnf', '/var/lib/dnf']) + self._setup_dbg_rootfs(['/etc/rpm', '/etc/rpmrc', '/etc/dnf', '/var/lib/rpm', '/var/cache/dnf', '/var/lib/dnf']) execute_pre_post_process(self.d, rpm_post_process_cmds) diff --git a/meta/lib/oe/package_manager/rpm/sdk.py b/meta/lib/oe/package_manager/rpm/sdk.py index c5f232431f..04dccf49d7 100644 --- a/meta/lib/oe/package_manager/rpm/sdk.py +++ b/meta/lib/oe/package_manager/rpm/sdk.py @@ -110,5 +110,6 @@ class PkgSdk(Sdk): for f in glob.glob(os.path.join(self.sdk_output, "etc", "rpm*")): self.movefile(f, native_sysconf_dir) for f in glob.glob(os.path.join(self.sdk_output, "etc", "dnf", "*")): - self.movefile(f, native_sysconf_dir) + self.mkdirhier(native_sysconf_dir + "/dnf") + self.movefile(f, native_sysconf_dir + "/dnf") self.remove(os.path.join(self.sdk_output, "etc"), True) diff --git a/meta/lib/oe/rootfs.py b/meta/lib/oe/rootfs.py index 91312f8353..2824d4f037 100644 --- a/meta/lib/oe/rootfs.py +++ b/meta/lib/oe/rootfs.py @@ -104,7 +104,7 @@ class Rootfs(object, metaclass=ABCMeta): def _cleanup(self): pass - def _setup_dbg_rootfs(self, dirs): + def _setup_dbg_rootfs(self, package_paths): gen_debugfs = self.d.getVar('IMAGE_GEN_DEBUGFS') or '0' if gen_debugfs != '1': return @@ -120,11 +120,12 @@ class Rootfs(object, metaclass=ABCMeta): bb.utils.mkdirhier(self.image_rootfs) bb.note(" Copying back package database...") - for dir in dirs: - if not os.path.isdir(self.image_rootfs + '-orig' + dir): - continue - bb.utils.mkdirhier(self.image_rootfs + os.path.dirname(dir)) - shutil.copytree(self.image_rootfs + '-orig' + dir, self.image_rootfs + dir, symlinks=True) + for path in package_paths: + bb.utils.mkdirhier(self.image_rootfs + os.path.dirname(path)) + if os.path.isdir(self.image_rootfs + '-orig' + path): + shutil.copytree(self.image_rootfs + '-orig' + path, self.image_rootfs + path, symlinks=True) + elif os.path.isfile(self.image_rootfs + '-orig' + path): + shutil.copyfile(self.image_rootfs + '-orig' + path, self.image_rootfs + path) # Copy files located in /usr/lib/debug or /usr/src/debug for dir in ["/usr/lib/debug", "/usr/src/debug"]: @@ -160,6 +161,13 @@ class Rootfs(object, metaclass=ABCMeta): bb.note(" Install extra debug packages...") self.pm.install(extra_debug_pkgs.split(), True) + bb.note(" Removing package database...") + for path in package_paths: + if os.path.isdir(self.image_rootfs + path): + shutil.rmtree(self.image_rootfs + path) + elif os.path.isfile(self.image_rootfs + path): + os.remove(self.image_rootfs + path) + bb.note(" Rename debug rootfs...") try: shutil.rmtree(self.image_rootfs + '-dbg') diff --git a/meta/lib/oe/sdk.py b/meta/lib/oe/sdk.py index 27347667e8..2383bd58b7 100644 --- a/meta/lib/oe/sdk.py +++ b/meta/lib/oe/sdk.py @@ -68,7 +68,7 @@ class Sdk(object, metaclass=ABCMeta): #FIXME: using umbrella exc catching because bb.utils method raises it except Exception as e: bb.debug(1, "printing the stack trace\n %s" %traceback.format_exc()) - bb.error("unable to place %s in final SDK location" % sourcefile) + bb.fatal("unable to place %s in final SDK location" % sourcefile) def mkdirhier(self, dirpath): try: diff --git a/meta/lib/oe/sstatesig.py b/meta/lib/oe/sstatesig.py index bbe28efa81..30f27b0f4f 100644 --- a/meta/lib/oe/sstatesig.py +++ b/meta/lib/oe/sstatesig.py @@ -660,6 +660,10 @@ def OEOuthashBasic(path, sigfile, task, d): if f == 'fixmepath': continue process(os.path.join(root, f)) + + for dir in dirs: + if os.path.islink(os.path.join(root, dir)): + process(os.path.join(root, dir)) finally: os.chdir(prev_dir) diff --git a/meta/lib/oe/terminal.py b/meta/lib/oe/terminal.py index de8dcebf94..b674335654 100644 --- a/meta/lib/oe/terminal.py +++ b/meta/lib/oe/terminal.py @@ -102,6 +102,10 @@ class Rxvt(XTerminal): command = 'rxvt -T "{title}" -e {command}' priority = 1 +class URxvt(XTerminal): + command = 'urxvt -T "{title}" -e {command}' + priority = 1 + class Screen(Terminal): command = 'screen -D -m -t "{title}" -S devshell {command}' diff --git a/meta/lib/oeqa/core/target/ssh.py b/meta/lib/oeqa/core/target/ssh.py index f956a7744f..6ee40083bd 100644 --- a/meta/lib/oeqa/core/target/ssh.py +++ b/meta/lib/oeqa/core/target/ssh.py @@ -34,6 +34,8 @@ class OESSHTarget(OETarget): self.timeout = timeout self.user = user ssh_options = [ + '-o', 'ServerAliveCountMax=2', + '-o', 'ServerAliveInterval=30', '-o', 'UserKnownHostsFile=/dev/null', '-o', 'StrictHostKeyChecking=no', '-o', 'LogLevel=ERROR' @@ -224,26 +226,35 @@ def SSHCall(command, logger, timeout=None, **opts): def run(): nonlocal output nonlocal process + output_raw = b'' starttime = time.time() process = subprocess.Popen(command, **options) if timeout: endtime = starttime + timeout eof = False + os.set_blocking(process.stdout.fileno(), False) while time.time() < endtime and not eof: - logger.debug('time: %s, endtime: %s' % (time.time(), endtime)) try: + logger.debug('Waiting for process output: time: %s, endtime: %s' % (time.time(), endtime)) if select.select([process.stdout], [], [], 5)[0] != []: - reader = codecs.getreader('utf-8')(process.stdout, 'ignore') - data = reader.read(1024, 4096) + # wait a bit for more data, tries to avoid reading single characters + time.sleep(0.2) + data = process.stdout.read() if not data: - process.stdout.close() eof = True else: - output += data - logger.debug('Partial data from SSH call: %s' % data) + output_raw += data + # ignore errors to capture as much as possible + logger.debug('Partial data from SSH call:\n%s' % data.decode('utf-8', errors='ignore')) endtime = time.time() + timeout except InterruptedError: + logger.debug('InterruptedError') continue + except BlockingIOError: + logger.debug('BlockingIOError') + continue + + process.stdout.close() # process hasn't returned yet if not eof: @@ -252,16 +263,32 @@ def SSHCall(command, logger, timeout=None, **opts): try: process.kill() except OSError: + logger.debug('OSError when killing process') pass endtime = time.time() - starttime lastline = ("\nProcess killed - no output for %d seconds. Total" " running time: %d seconds." % (timeout, endtime)) - logger.debug('Received data from SSH call %s ' % lastline) + logger.debug('Received data from SSH call:\n%s ' % lastline) output += lastline + process.wait() else: - output = process.communicate()[0].decode('utf-8', errors='ignore') - logger.debug('Data from SSH call: %s' % output.rstrip()) + output_raw = process.communicate()[0] + + output = output_raw.decode('utf-8', errors='ignore') + logger.debug('Data from SSH call:\n%s' % output.rstrip()) + + # timout or not, make sure process exits and is not hanging + if process.returncode == None: + try: + process.wait(timeout=5) + except TimeoutExpired: + try: + process.kill() + except OSError: + logger.debug('OSError') + pass + process.wait() options = { "stdout": subprocess.PIPE, @@ -288,6 +315,9 @@ def SSHCall(command, logger, timeout=None, **opts): # whilst running and ensure we don't leave a process behind. if process.poll() is None: process.kill() + if process.returncode == None: + process.wait() logger.debug('Something went wrong, killing SSH process') raise - return (process.wait(), output.rstrip()) + + return (process.returncode, output.rstrip()) diff --git a/meta/lib/oeqa/oetest.py b/meta/lib/oeqa/oetest.py index 9c84466dd0..b53c611062 100644 --- a/meta/lib/oeqa/oetest.py +++ b/meta/lib/oeqa/oetest.py @@ -256,7 +256,7 @@ class TestContext(object): modules = [] for test in self.testslist: - if re.search("\w+\.\w+\.test_\S+", test): + if re.search(r"\w+\.\w+\.test_\S+", test): test = '.'.join(t.split('.')[:3]) module = pkgutil.get_loader(test) modules.append(module) diff --git a/meta/lib/oeqa/runtime/cases/ltp.py b/meta/lib/oeqa/runtime/cases/ltp.py index a66d5d13d7..879f2a673c 100644 --- a/meta/lib/oeqa/runtime/cases/ltp.py +++ b/meta/lib/oeqa/runtime/cases/ltp.py @@ -67,7 +67,7 @@ class LtpTest(LtpTestBase): def runltp(self, ltp_group): cmd = '/opt/ltp/runltp -f %s -p -q -r /opt/ltp -l /opt/ltp/results/%s -I 1 -d /opt/ltp' % (ltp_group, ltp_group) starttime = time.time() - (status, output) = self.target.run(cmd) + (status, output) = self.target.run(cmd, timeout=1200) endtime = time.time() with open(os.path.join(self.ltptest_log_dir, "%s-raw.log" % ltp_group), 'w') as f: diff --git a/meta/lib/oeqa/runtime/cases/rpm.py b/meta/lib/oeqa/runtime/cases/rpm.py index 5bdce3d522..7226b8af6a 100644 --- a/meta/lib/oeqa/runtime/cases/rpm.py +++ b/meta/lib/oeqa/runtime/cases/rpm.py @@ -57,8 +57,8 @@ class RpmBasicTest(OERuntimeTestCase): return time.sleep(1) user_pss = [ps for ps in output.split("\n") if u + ' ' in ps] - msg = "There're %s 's process(es) still running: %s".format(u, "\n".join(user_pss)) - assertTrue(True, msg=msg) + msg = "User %s has processes still running: %s" % (u, "\n".join(user_pss)) + self.fail(msg=msg) def unset_up_test_user(u): # ensure no test1 process in running diff --git a/meta/lib/oeqa/runtime/cases/rtc.py b/meta/lib/oeqa/runtime/cases/rtc.py index c4e6681324..39f4d29f23 100644 --- a/meta/lib/oeqa/runtime/cases/rtc.py +++ b/meta/lib/oeqa/runtime/cases/rtc.py @@ -1,5 +1,6 @@ from oeqa.runtime.case import OERuntimeTestCase from oeqa.core.decorator.depends import OETestDepends +from oeqa.core.decorator.data import skipIfFeature from oeqa.runtime.decorator.package import OEHasPackage import re @@ -16,12 +17,14 @@ class RTCTest(OERuntimeTestCase): self.logger.debug('Starting systemd-timesyncd daemon') self.target.run('systemctl enable --now --runtime systemd-timesyncd') + @skipIfFeature('read-only-rootfs', + 'Test does not work with read-only-rootfs in IMAGE_FEATURES') @OETestDepends(['ssh.SSHTest.test_ssh']) @OEHasPackage(['coreutils', 'busybox']) def test_rtc(self): (status, output) = self.target.run('hwclock -r') self.assertEqual(status, 0, msg='Failed to get RTC time, output: %s' % output) - + (status, current_datetime) = self.target.run('date +"%m%d%H%M%Y"') self.assertEqual(status, 0, msg='Failed to get system current date & time, output: %s' % current_datetime) @@ -32,7 +35,6 @@ class RTCTest(OERuntimeTestCase): (status, output) = self.target.run('date %s' % current_datetime) self.assertEqual(status, 0, msg='Failed to reset system date & time, output: %s' % output) - + (status, output) = self.target.run('hwclock -w') self.assertEqual(status, 0, msg='Failed to reset RTC time, output: %s' % output) - diff --git a/meta/lib/oeqa/runtime/context.py b/meta/lib/oeqa/runtime/context.py index 8092dd0bae..0c5d1869ab 100644 --- a/meta/lib/oeqa/runtime/context.py +++ b/meta/lib/oeqa/runtime/context.py @@ -67,11 +67,11 @@ class OERuntimeTestContextExecutor(OETestContextExecutor): % self.default_target_type) runtime_group.add_argument('--target-ip', action='store', default=self.default_target_ip, - help="IP address of device under test, default: %s" \ + help="IP address and optionally ssh port (default 22) of device under test, for example '192.168.0.7:22'. Default: %s" \ % self.default_target_ip) runtime_group.add_argument('--server-ip', action='store', default=self.default_target_ip, - help="IP address of device under test, default: %s" \ + help="IP address of the test host from test target machine, default: %s" \ % self.default_server_ip) runtime_group.add_argument('--host-dumper-dir', action='store', diff --git a/meta/lib/oeqa/sdk/buildtools-cases/sanity.py b/meta/lib/oeqa/sdk/buildtools-cases/sanity.py index 64baaa8f84..68b19f4d47 100644 --- a/meta/lib/oeqa/sdk/buildtools-cases/sanity.py +++ b/meta/lib/oeqa/sdk/buildtools-cases/sanity.py @@ -19,4 +19,4 @@ class SanityTests(OESDKTestCase): # Canonicalise the location of this command tool_path = os.path.realpath(self._run("command -v %s" % command).strip()) # Assert that the tool was found inside the SDK root - self.assertEquals(os.path.commonprefix((sdk_base, tool_path)), sdk_base) + self.assertEqual(os.path.commonprefix((sdk_base, tool_path)), sdk_base) diff --git a/meta/lib/oeqa/sdk/cases/buildepoxy.py b/meta/lib/oeqa/sdk/cases/buildepoxy.py index f69f720cd6..1c41b04169 100644 --- a/meta/lib/oeqa/sdk/cases/buildepoxy.py +++ b/meta/lib/oeqa/sdk/cases/buildepoxy.py @@ -32,7 +32,7 @@ class EpoxyTest(OESDKTestCase): self.assertTrue(os.path.isdir(dirs["source"])) os.makedirs(dirs["build"]) - log = self._run("meson -Degl=no -Dglx=no -Dx11=false {build} {source}".format(**dirs)) + log = self._run("meson --warnlevel 1 -Degl=no -Dglx=no -Dx11=false {build} {source}".format(**dirs)) # Check that Meson thinks we're doing a cross build and not a native self.assertIn("Build type: cross build", log) self._run("ninja -C {build} -v".format(**dirs)) diff --git a/meta/lib/oeqa/sdkext/cases/devtool.py b/meta/lib/oeqa/sdkext/cases/devtool.py index a5c6a76e02..5ffb732556 100644 --- a/meta/lib/oeqa/sdkext/cases/devtool.py +++ b/meta/lib/oeqa/sdkext/cases/devtool.py @@ -112,7 +112,7 @@ class SdkUpdateTest(OESDKExtTestCase): cmd = 'oe-publish-sdk %s %s' % (tcname_new, self.publish_dir) subprocess.check_output(cmd, shell=True) - self.http_service = HTTPService(self.publish_dir) + self.http_service = HTTPService(self.publish_dir, logger=self.logger) self.http_service.start() self.http_url = "http://127.0.0.1:%d" % self.http_service.port diff --git a/meta/lib/oeqa/selftest/cases/bblayers.py b/meta/lib/oeqa/selftest/cases/bblayers.py index 7d74833f61..0b9f16eeae 100644 --- a/meta/lib/oeqa/selftest/cases/bblayers.py +++ b/meta/lib/oeqa/selftest/cases/bblayers.py @@ -46,7 +46,7 @@ class BitbakeLayers(OESelftestTestCase): bb_file = os.path.join(testoutdir, recipe_path, recipe_file) self.assertTrue(os.path.isfile(bb_file), msg = "Cannot find xcursor-transparent-theme_0.1.1.bb in the test_bitbakelayers_flatten local dir.") contents = ftools.read_file(bb_file) - find_in_contents = re.search("##### bbappended from meta-selftest #####\n(.*\n)*include test_recipe.inc", contents) + find_in_contents = re.search(r"##### bbappended from meta-selftest #####\n(.*\n)*include test_recipe.inc", contents) self.assertTrue(find_in_contents, msg = "Flattening layers did not work. bitbake-layers flatten output: %s" % result.output) def test_bitbakelayers_add_remove(self): diff --git a/meta/lib/oeqa/selftest/cases/bbtests.py b/meta/lib/oeqa/selftest/cases/bbtests.py index cfac7afcf4..d91c8ea82b 100644 --- a/meta/lib/oeqa/selftest/cases/bbtests.py +++ b/meta/lib/oeqa/selftest/cases/bbtests.py @@ -188,6 +188,10 @@ SSTATE_DIR = \"${TOPDIR}/download-selftest\" self.assertTrue(find, "No version returned for searched recipe. bitbake output: %s" % result.output) def test_prefile(self): + # Test when the prefile does not exist + result = runCmd('bitbake -r conf/prefile.conf', ignore_status=True) + self.assertEqual(1, result.status, "bitbake didn't error and should have when a specified prefile didn't exist: %s" % result.output) + # Test when the prefile exists preconf = os.path.join(self.builddir, 'conf/prefile.conf') self.track_for_cleanup(preconf) ftools.write_file(preconf ,"TEST_PREFILE=\"prefile\"") @@ -198,6 +202,10 @@ SSTATE_DIR = \"${TOPDIR}/download-selftest\" self.assertIn('localconf', result.output) def test_postfile(self): + # Test when the postfile does not exist + result = runCmd('bitbake -R conf/postfile.conf', ignore_status=True) + self.assertEqual(1, result.status, "bitbake didn't error and should have when a specified postfile didn't exist: %s" % result.output) + # Test when the postfile exists postconf = os.path.join(self.builddir, 'conf/postfile.conf') self.track_for_cleanup(postconf) ftools.write_file(postconf , "TEST_POSTFILE=\"postfile\"") @@ -350,4 +358,4 @@ INHERIT:remove = \"report-error\" self.write_config("DISTROOVERRIDES .= \":gitunpack-enable-recipe\"") result = bitbake('gitunpackoffline-fail -c fetch', ignore_status=True) - self.assertTrue("Recipe uses a floating tag/branch without a fixed SRCREV" in result.output, msg = "Recipe without PV set to SRCPV should have failed: %s" % result.output) + self.assertTrue(re.search("Recipe uses a floating tag/branch .* for repo .* without a fixed SRCREV yet doesn't call bb.fetch2.get_srcrev()", result.output), msg = "Recipe without PV set to SRCPV should have failed: %s" % result.output) diff --git a/meta/lib/oeqa/selftest/cases/cve_check.py b/meta/lib/oeqa/selftest/cases/cve_check.py index d0b2213703..22ffeffd29 100644 --- a/meta/lib/oeqa/selftest/cases/cve_check.py +++ b/meta/lib/oeqa/selftest/cases/cve_check.py @@ -48,6 +48,25 @@ class CVECheck(OESelftestTestCase): self.assertTrue( result ,msg="Failed to compare version with suffix '1.0_patch2' < '1.0_patch3'") + def test_convert_cve_version(self): + from oe.cve_check import convert_cve_version + + # Default format + self.assertEqual(convert_cve_version("8.3"), "8.3") + self.assertEqual(convert_cve_version(""), "") + + # OpenSSL format version + self.assertEqual(convert_cve_version("1.1.1t"), "1.1.1t") + + # OpenSSH format + self.assertEqual(convert_cve_version("8.3_p1"), "8.3p1") + self.assertEqual(convert_cve_version("8.3_p22"), "8.3p22") + + # Linux kernel format + self.assertEqual(convert_cve_version("6.2_rc8"), "6.2-rc8") + self.assertEqual(convert_cve_version("6.2_rc31"), "6.2-rc31") + + def test_recipe_report_json(self): config = """ INHERIT += "cve-check" diff --git a/meta/lib/oeqa/selftest/cases/devtool.py b/meta/lib/oeqa/selftest/cases/devtool.py index 34fc791f3a..dc0fc35062 100644 --- a/meta/lib/oeqa/selftest/cases/devtool.py +++ b/meta/lib/oeqa/selftest/cases/devtool.py @@ -8,6 +8,7 @@ import shutil import tempfile import glob import fnmatch +import unittest from oeqa.selftest.case import OESelftestTestCase from oeqa.utils.commands import runCmd, bitbake, get_bb_var, create_temp_layer @@ -38,6 +39,13 @@ def setUpModule(): canonical_layerpath = os.path.realpath(canonical_layerpath) + '/' edited_layers.append(layerpath) oldmetapath = os.path.realpath(layerpath) + + # when downloading poky from tar.gz some tests will be skipped (BUG 12389) + try: + runCmd('git rev-parse --is-inside-work-tree', cwd=canonical_layerpath) + except: + raise unittest.SkipTest("devtool tests require folder to be a git repo") + result = runCmd('git rev-parse --show-toplevel', cwd=canonical_layerpath) oldreporoot = result.output.rstrip() newmetapath = os.path.join(corecopydir, os.path.relpath(oldmetapath, oldreporoot)) @@ -258,6 +266,7 @@ class DevtoolBase(DevtoolTestCase): cls.sstate_conf = 'SSTATE_DIR = "%s"\n' % cls.devtool_sstate cls.sstate_conf += ('SSTATE_MIRRORS += "file://.* file:///%s/PATH"\n' % cls.original_sstate) + cls.sstate_conf += ('BB_HASHSERVE_UPSTREAM = "hashserv.yocto.io:8687"\n') @classmethod def tearDownClass(cls): @@ -339,6 +348,38 @@ class DevtoolAddTests(DevtoolBase): bindir = bindir[1:] self.assertTrue(os.path.isfile(os.path.join(installdir, bindir, 'pv')), 'pv binary not found in D') + def test_devtool_add_binary(self): + # Create a binary package containing a known test file + tempdir = tempfile.mkdtemp(prefix='devtoolqa') + self.track_for_cleanup(tempdir) + pn = 'tst-bin' + pv = '1.0' + test_file_dir = "var/lib/%s/" % pn + test_file_name = "test_file" + test_file_content = "TEST CONTENT" + test_file_package_root = os.path.join(tempdir, pn) + test_file_dir_full = os.path.join(test_file_package_root, test_file_dir) + bb.utils.mkdirhier(test_file_dir_full) + with open(os.path.join(test_file_dir_full, test_file_name), "w") as f: + f.write(test_file_content) + bin_package_path = os.path.join(tempdir, "%s.tar.gz" % pn) + runCmd("tar czf %s -C %s ." % (bin_package_path, test_file_package_root)) + + # Test devtool add -b on the binary package + self.track_for_cleanup(self.workspacedir) + self.add_command_to_tearDown('bitbake -c cleansstate %s' % pn) + self.add_command_to_tearDown('bitbake-layers remove-layer */workspace') + result = runCmd('devtool add -b %s %s' % (pn, bin_package_path)) + self.assertExists(os.path.join(self.workspacedir, 'conf', 'layer.conf'), 'Workspace directory not created') + + # Build the resulting recipe + result = runCmd('devtool build %s' % pn) + installdir = get_bb_var('D', pn) + self.assertTrue(installdir, 'Could not query installdir variable') + + # Check that a known file from the binary package has indeed been installed + self.assertTrue(os.path.isfile(os.path.join(installdir, test_file_dir, test_file_name)), '%s not found in D' % test_file_name) + def test_devtool_add_git_local(self): # We need dbus built so that DEPENDS recognition works bitbake('dbus') @@ -878,7 +919,7 @@ class DevtoolModifyTests(DevtoolBase): runCmd('git -C %s checkout %s' % (tempdir, branch)) with open(source, "rt") as f: content = f.read() - self.assertEquals(content, expected) + self.assertEqual(content, expected) check('devtool', 'This is a test for something\n') check('devtool-no-overrides', 'This is a test for something\n') check('devtool-override-qemuarm', 'This is a test for qemuarm\n') diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py index d732a9020d..4d820faf92 100644 --- a/meta/lib/oeqa/selftest/cases/fitimage.py +++ b/meta/lib/oeqa/selftest/cases/fitimage.py @@ -202,7 +202,7 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'" signed_sections = {} for line in result.output.splitlines(): if line.startswith((' Configuration', ' Image')): - in_signed = re.search('\((.*)\)', line).groups()[0] + in_signed = re.search(r'\((.*)\)', line).groups()[0] elif re.match('^ *', line) in (' ', ''): in_signed = None elif in_signed: @@ -521,7 +521,7 @@ UBOOT_FIT_HASH_ALG = "sha256" signed_sections = {} for line in result.output.splitlines(): if line.startswith((' Image')): - in_signed = re.search('\((.*)\)', line).groups()[0] + in_signed = re.search(r'\((.*)\)', line).groups()[0] elif re.match(' \w', line): in_signed = None elif in_signed: @@ -675,7 +675,7 @@ FIT_SIGN_INDIVIDUAL = "1" signed_sections = {} for line in result.output.splitlines(): if line.startswith((' Image')): - in_signed = re.search('\((.*)\)', line).groups()[0] + in_signed = re.search(r'\((.*)\)', line).groups()[0] elif re.match(' \w', line): in_signed = None elif in_signed: diff --git a/meta/lib/oeqa/selftest/cases/glibc.py b/meta/lib/oeqa/selftest/cases/glibc.py index 6fc98e9cb4..f42593a27f 100644 --- a/meta/lib/oeqa/selftest/cases/glibc.py +++ b/meta/lib/oeqa/selftest/cases/glibc.py @@ -24,7 +24,7 @@ class GlibcSelfTestBase(OESelftestTestCase, OEPTestResultTestCase): features.append('TOOLCHAIN_TEST_HOST_USER = "root"') features.append('TOOLCHAIN_TEST_HOST_PORT = "22"') # force single threaded test execution - features.append('EGLIBCPARALLELISM_task-check:pn-glibc-testsuite = "PARALLELMFLAGS="-j1""') + features.append('EGLIBCPARALLELISM:task-check:pn-glibc-testsuite = "PARALLELMFLAGS="-j1""') self.write_config("\n".join(features)) bitbake("glibc-testsuite -c check") @@ -41,7 +41,7 @@ class GlibcSelfTestBase(OESelftestTestCase, OEPTestResultTestCase): with contextlib.ExitStack() as s: # use the base work dir, as the nfs mount, since the recipe directory may not exist tmpdir = get_bb_var("BASE_WORKDIR") - nfsport, mountport = s.enter_context(unfs_server(tmpdir)) + nfsport, mountport = s.enter_context(unfs_server(tmpdir, udp = False)) # build core-image-minimal with required packages default_installed_packages = [ @@ -61,7 +61,7 @@ class GlibcSelfTestBase(OESelftestTestCase, OEPTestResultTestCase): bitbake("core-image-minimal") # start runqemu - qemu = s.enter_context(runqemu("core-image-minimal", runqemuparams = "nographic")) + qemu = s.enter_context(runqemu("core-image-minimal", runqemuparams = "nographic", qemuparams = "-m 1024")) # validate that SSH is working status, _ = qemu.run("uname") @@ -70,7 +70,7 @@ class GlibcSelfTestBase(OESelftestTestCase, OEPTestResultTestCase): # setup nfs mount if qemu.run("mkdir -p \"{0}\"".format(tmpdir))[0] != 0: raise Exception("Failed to setup NFS mount directory on target") - mountcmd = "mount -o noac,nfsvers=3,port={0},udp,mountport={1} \"{2}:{3}\" \"{3}\"".format(nfsport, mountport, qemu.server_ip, tmpdir) + mountcmd = "mount -o noac,nfsvers=3,port={0},mountport={1} \"{2}:{3}\" \"{3}\"".format(nfsport, mountport, qemu.server_ip, tmpdir) status, output = qemu.run(mountcmd) if status != 0: raise Exception("Failed to setup NFS mount on target ({})".format(repr(output))) diff --git a/meta/lib/oeqa/selftest/cases/liboe.py b/meta/lib/oeqa/selftest/cases/liboe.py index afe8f8809f..da88ff480e 100644 --- a/meta/lib/oeqa/selftest/cases/liboe.py +++ b/meta/lib/oeqa/selftest/cases/liboe.py @@ -97,6 +97,6 @@ class LibOE(OESelftestTestCase): dstcnt = len(os.listdir(dst)) srccnt = len(os.listdir(src)) - self.assertEquals(dstcnt, len(testfiles), "Number of files in dst (%s) differs from number of files in src(%s)." % (dstcnt, srccnt)) + self.assertEqual(dstcnt, len(testfiles), "Number of files in dst (%s) differs from number of files in src(%s)." % (dstcnt, srccnt)) oe.path.remove(testloc) diff --git a/meta/lib/oeqa/selftest/cases/locales.py b/meta/lib/oeqa/selftest/cases/locales.py new file mode 100644 index 0000000000..433991abf9 --- /dev/null +++ b/meta/lib/oeqa/selftest/cases/locales.py @@ -0,0 +1,45 @@ +# +# SPDX-License-Identifier: MIT +# + +from oeqa.selftest.case import OESelftestTestCase +from oeqa.core.decorator import OETestTag +from oeqa.utils.commands import bitbake, runqemu + +class LocalesTest(OESelftestTestCase): + + @OETestTag("runqemu") + def test_locales_on(self): + """ + Summary: Test the locales are generated + Expected: 1. Check the locale exist in the locale-archive + 2. Check the locale exist for the glibc + 3. Check the locale can be generated + Product: oe-core + Author: Louis Rannou <lrannou@baylibre.com> + AutomatedBy: Louis Rannou <lrannou@baylibre.com> + """ + + features = [] + features.append('EXTRA_IMAGE_FEATURES = "empty-root-password allow-empty-password allow-root-login"') + features.append('IMAGE_INSTALL:append = " glibc-utils localedef"') + features.append('GLIBC_GENERATE_LOCALES = "en_US.UTF-8 fr_FR.UTF-8"') + features.append('IMAGE_LINGUAS:append = " en-us fr-fr"') + features.append('ENABLE_BINARY_LOCALE_GENERATION = "1"') + self.write_config("\n".join(features)) + + # Build a core-image-minimal + bitbake('core-image-minimal') + + with runqemu("core-image-minimal", ssh=False, runqemuparams='nographic') as qemu: + cmd = "locale -a" + status, output = qemu.run_serial(cmd) + # output must includes fr_FR or fr_FR.UTF-8 + self.assertEqual(status, 1, msg='locale test command failed: output: %s' % output) + self.assertIn("fr_FR", output, msg='locale -a test failed: output: %s' % output) + + cmd = "localedef --list-archive -v" + status, output = qemu.run_serial(cmd) + # output must includes fr_FR.utf8 + self.assertEqual(status, 1, msg='localedef test command failed: output: %s' % output) + self.assertIn("fr_FR.utf8", output, msg='localedef test failed: output: %s' % output) diff --git a/meta/lib/oeqa/selftest/cases/oelib/buildhistory.py b/meta/lib/oeqa/selftest/cases/oelib/buildhistory.py index 33bd6df2f3..ae12aa0865 100644 --- a/meta/lib/oeqa/selftest/cases/oelib/buildhistory.py +++ b/meta/lib/oeqa/selftest/cases/oelib/buildhistory.py @@ -28,6 +28,16 @@ class TestBlobParsing(OESelftestTestCase): import shutil shutil.rmtree(self.repo_path) + @property + def heads_default(self): + """ + Support repos defaulting to master or to main branch + """ + try: + return self.repo.heads.main + except AttributeError: + return self.repo.heads.master + def commit_vars(self, to_add={}, to_remove = [], msg="A commit message"): if len(to_add) == 0 and len(to_remove) == 0: return @@ -65,10 +75,10 @@ class TestBlobParsing(OESelftestTestCase): changesmap = { "foo-2" : ("2", "8"), "bar" : ("","4"), "bar-2" : ("","5")} self.commit_vars(to_add = { "foo" : "1", "foo-2" : "2", "foo-3" : "3" }) - blob1 = self.repo.heads.master.commit.tree.blobs[0] + blob1 = self.heads_default.commit.tree.blobs[0] self.commit_vars(to_add = { "foo-2" : "8", "bar" : "4", "bar-2" : "5" }) - blob2 = self.repo.heads.master.commit.tree.blobs[0] + blob2 = self.heads_default.commit.tree.blobs[0] change_records = compare_dict_blobs(os.path.join(self.repo_path, self.test_file), blob1, blob2, False, False) @@ -84,10 +94,10 @@ class TestBlobParsing(OESelftestTestCase): defaultmap = { x : ("default", "1") for x in ["PKG", "PKGE", "PKGV", "PKGR"]} self.commit_vars(to_add = { "foo" : "1" }) - blob1 = self.repo.heads.master.commit.tree.blobs[0] + blob1 = self.heads_default.commit.tree.blobs[0] self.commit_vars(to_add = { "PKG" : "1", "PKGE" : "1", "PKGV" : "1", "PKGR" : "1" }) - blob2 = self.repo.heads.master.commit.tree.blobs[0] + blob2 = self.heads_default.commit.tree.blobs[0] change_records = compare_dict_blobs(os.path.join(self.repo_path, self.test_file), blob1, blob2, False, False) diff --git a/meta/lib/oeqa/selftest/cases/prservice.py b/meta/lib/oeqa/selftest/cases/prservice.py index 10158ca7c2..a41812148a 100644 --- a/meta/lib/oeqa/selftest/cases/prservice.py +++ b/meta/lib/oeqa/selftest/cases/prservice.py @@ -75,7 +75,7 @@ class BitbakePrTests(OESelftestTestCase): exported_db_path = os.path.join(self.builddir, 'export.inc') export_result = runCmd("bitbake-prserv-tool export %s" % exported_db_path, ignore_status=True) self.assertEqual(export_result.status, 0, msg="PR Service database export failed: %s" % export_result.output) - self.assertTrue(os.path.exists(exported_db_path)) + self.assertTrue(os.path.exists(exported_db_path), msg="%s didn't exist, tool output %s" % (exported_db_path, export_result.output)) if replace_current_db: current_db_path = os.path.join(get_bb_var('PERSISTENT_DIR'), 'prserv.sqlite3') diff --git a/meta/lib/oeqa/selftest/cases/recipetool.py b/meta/lib/oeqa/selftest/cases/recipetool.py index 510dae6bad..a2d8d292ad 100644 --- a/meta/lib/oeqa/selftest/cases/recipetool.py +++ b/meta/lib/oeqa/selftest/cases/recipetool.py @@ -440,16 +440,18 @@ class RecipetoolCreateTests(RecipetoolBase): self._test_recipe_contents(recipefile, checkvars, inherits) def test_recipetool_create_github(self): - # Basic test to see if github URL mangling works + # Basic test to see if github URL mangling works. Deliberately use an + # older release of Meson at present so we don't need a toml parser. temprecipe = os.path.join(self.tempdir, 'recipe') os.makedirs(temprecipe) recipefile = os.path.join(temprecipe, 'meson_git.bb') - srcuri = 'https://github.com/mesonbuild/meson;rev=0.32.0' - result = runCmd(['recipetool', 'create', '-o', temprecipe, srcuri]) - self.assertTrue(os.path.isfile(recipefile)) + srcuri = 'https://github.com/mesonbuild/meson;rev=0.52.1' + cmd = ['recipetool', 'create', '-o', temprecipe, srcuri] + result = runCmd(cmd) + self.assertTrue(os.path.isfile(recipefile), msg="recipe %s not created for command %s, output %s" % (recipefile, " ".join(cmd), result.output)) checkvars = {} - checkvars['LICENSE'] = set(['Apache-2.0']) - checkvars['SRC_URI'] = 'git://github.com/mesonbuild/meson;protocol=https;branch=master' + checkvars['LICENSE'] = set(['Apache-2.0', "Unknown"]) + checkvars['SRC_URI'] = 'git://github.com/mesonbuild/meson;protocol=https;branch=0.52' inherits = ['setuptools3'] self._test_recipe_contents(recipefile, checkvars, inherits) @@ -473,10 +475,11 @@ class RecipetoolCreateTests(RecipetoolBase): self._test_recipe_contents(recipefile, checkvars, inherits) def test_recipetool_create_github_tarball(self): - # Basic test to ensure github URL mangling doesn't apply to release tarballs + # Basic test to ensure github URL mangling doesn't apply to release tarballs. + # Deliberately use an older release of Meson at present so we don't need a toml parser. temprecipe = os.path.join(self.tempdir, 'recipe') os.makedirs(temprecipe) - pv = '0.32.0' + pv = '0.52.1' recipefile = os.path.join(temprecipe, 'meson_%s.bb' % pv) srcuri = 'https://github.com/mesonbuild/meson/releases/download/%s/meson-%s.tar.gz' % (pv, pv) result = runCmd('recipetool create -o %s %s' % (temprecipe, srcuri)) @@ -579,7 +582,10 @@ class RecipetoolTests(RecipetoolBase): commonlicdir = get_bb_var('COMMON_LICENSE_DIR') - d = bb.tinfoil.TinfoilDataStoreConnector + class DataConnectorCopy(bb.tinfoil.TinfoilDataStoreConnector): + pass + + d = DataConnectorCopy d.getVar = Mock(return_value=commonlicdir) srctree = tempfile.mkdtemp(prefix='recipetoolqa') diff --git a/meta/lib/oeqa/selftest/cases/reproducible.py b/meta/lib/oeqa/selftest/cases/reproducible.py index 5042c11d8e..49318be43a 100644 --- a/meta/lib/oeqa/selftest/cases/reproducible.py +++ b/meta/lib/oeqa/selftest/cases/reproducible.py @@ -126,15 +126,23 @@ class DiffoscopeTests(OESelftestTestCase): class ReproducibleTests(OESelftestTestCase): # Test the reproducibility of whatever is built between sstate_targets and targets - package_classes = ['deb', 'ipk', 'rpm'] + package_classes = get_bb_var("OEQA_REPRODUCIBLE_TEST_PACKAGE") + if package_classes: + package_classes = package_classes.split() + else: + package_classes = ['deb', 'ipk', 'rpm'] # Maximum report size, in bytes max_report_size = 250 * 1024 * 1024 # targets are the things we want to test the reproducibility of - targets = ['core-image-minimal', 'core-image-sato', 'core-image-full-cmdline', 'core-image-weston', 'world'] + targets = get_bb_var("OEQA_REPRODUCIBLE_TEST_TARGET") + if targets: + targets = targets.split() + else: + targets = ['core-image-minimal', 'core-image-sato', 'core-image-full-cmdline', 'core-image-weston', 'world'] # sstate targets are things to pull from sstate to potentially cut build/debugging time - sstate_targets = [] + sstate_targets = (get_bb_var("OEQA_REPRODUCIBLE_TEST_SSTATE_TARGETS") or "").split() save_results = False if 'OEQA_DEBUGGING_SAVED_OUTPUT' in os.environ: save_results = os.environ['OEQA_DEBUGGING_SAVED_OUTPUT'] @@ -149,7 +157,7 @@ class ReproducibleTests(OESelftestTestCase): def setUpLocal(self): super().setUpLocal() - needed_vars = ['TOPDIR', 'TARGET_PREFIX', 'BB_NUMBER_THREADS'] + needed_vars = ['TOPDIR', 'TARGET_PREFIX', 'BB_NUMBER_THREADS', 'BB_HASHSERVE'] bb_vars = get_bb_vars(needed_vars) for v in needed_vars: setattr(self, v.lower(), bb_vars[v]) @@ -223,7 +231,7 @@ class ReproducibleTests(OESelftestTestCase): # mirror, forcing a complete build from scratch config += textwrap.dedent('''\ SSTATE_DIR = "${TMPDIR}/sstate" - SSTATE_MIRRORS = "" + SSTATE_MIRRORS = "file://.*/.*-native.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH file://.*/.*-cross.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH" ''') self.logger.info("Building %s (sstate%s allowed)..." % (name, '' if use_sstate else ' NOT')) diff --git a/meta/lib/oeqa/selftest/cases/resulttooltests.py b/meta/lib/oeqa/selftest/cases/resulttooltests.py index dac5c46801..490f3fc5cf 100644 --- a/meta/lib/oeqa/selftest/cases/resulttooltests.py +++ b/meta/lib/oeqa/selftest/cases/resulttooltests.py @@ -69,7 +69,7 @@ class ResultToolTests(OESelftestTestCase): self.assertTrue('target_result1' in results['runtime/mydistro/qemux86/image'], msg="Pair not correct:%s" % results) self.assertTrue('target_result3' in results['runtime/mydistro/qemux86-64/image'], msg="Pair not correct:%s" % results) - def test_regrresion_can_get_regression_result(self): + def test_regression_can_get_regression_result(self): base_result_data = {'result': {'test1': {'status': 'PASSED'}, 'test2': {'status': 'PASSED'}, 'test3': {'status': 'FAILED'}, diff --git a/meta/lib/oeqa/selftest/cases/runtime_test.py b/meta/lib/oeqa/selftest/cases/runtime_test.py index 858f12ec90..7dcdfd0ab2 100644 --- a/meta/lib/oeqa/selftest/cases/runtime_test.py +++ b/meta/lib/oeqa/selftest/cases/runtime_test.py @@ -8,7 +8,7 @@ from oeqa.core.decorator import OETestTag import os import tempfile import oe.lsb -from oeqa.core.decorator.data import skipIfNotQemu +from oeqa.core.decorator.data import skipIfNotQemu, skipIfNotMachine class TestExport(OESelftestTestCase): @@ -200,6 +200,8 @@ class TestImage(OESelftestTestCase): bitbake('core-image-full-cmdline socat') bitbake('-c testimage core-image-full-cmdline') + # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14966 + @skipIfNotMachine("qemux86-64", "test needs qemux86-64") def test_testimage_virgl_gtk_sdl(self): """ Summary: Check host-assisted accelerate OpenGL functionality in qemu with gtk and SDL frontends @@ -219,6 +221,8 @@ class TestImage(OESelftestTestCase): self.skipTest('virgl isn\'t working with Centos 7') if distro and distro == 'opensuseleap-15.0': self.skipTest('virgl isn\'t working with Opensuse 15.0') + if distro and distro == 'ubuntu-18.04': + self.skipTest('virgl isn\'t working with Ubuntu 18.04') qemu_packageconfig = get_bb_var('PACKAGECONFIG', 'qemu-system-native') qemu_distrofeatures = get_bb_var('DISTRO_FEATURES', 'qemu-system-native') @@ -241,6 +245,7 @@ class TestImage(OESelftestTestCase): bitbake('core-image-minimal') bitbake('-c testimage core-image-minimal') + @skipIfNotMachine("qemux86-64", "test needs qemux86-64") def test_testimage_virgl_headless(self): """ Summary: Check host-assisted accelerate OpenGL functionality in qemu with egl-headless frontend @@ -252,7 +257,8 @@ class TestImage(OESelftestTestCase): import subprocess, os distro = oe.lsb.distro_identifier() - if distro and (distro in ['debian-9', 'debian-10', 'centos-7', 'centos-8', 'ubuntu-16.04', 'ubuntu-18.04'] or distro.startswith('almalinux')): + if distro and (distro in ['debian-9', 'debian-10', 'centos-7', 'centos-8', 'ubuntu-16.04', 'ubuntu-18.04'] or + distro.startswith('almalinux') or distro.startswith('rocky')): self.skipTest('virgl headless cannot be tested with %s' %(distro)) render_hint = """If /dev/dri/renderD* is absent due to lack of suitable GPU, 'modprobe vgem' will create one suitable for mesa llvmpipe software renderer.""" diff --git a/meta/lib/oeqa/utils/dump.py b/meta/lib/oeqa/utils/dump.py index 95a79a571c..6fd5832051 100644 --- a/meta/lib/oeqa/utils/dump.py +++ b/meta/lib/oeqa/utils/dump.py @@ -91,37 +91,55 @@ class HostDumper(BaseDumper): self._write_dump(cmd.split()[0], result.output) class TargetDumper(BaseDumper): - """ Class to get dumps from target, it only works with QemuRunner """ + """ Class to get dumps from target, it only works with QemuRunner. + Will give up permanently after 5 errors from running commands over + serial console. This helps to end testing when target is really dead, hanging + or unresponsive. + """ def __init__(self, cmds, parent_dir, runner): super(TargetDumper, self).__init__(cmds, parent_dir) self.runner = runner + self.errors = 0 def dump_target(self, dump_dir=""): + if self.errors >= 5: + print("Too many errors when dumping data from target, assuming it is dead! Will not dump data anymore!") + return if dump_dir: self.dump_dir = dump_dir for cmd in self.cmds: # We can continue with the testing if serial commands fail try: (status, output) = self.runner.run_serial(cmd) + if status == 0: + self.errors = self.errors + 1 self._write_dump(cmd.split()[0], output) except: + self.errors = self.errors + 1 print("Tried to dump info from target but " "serial console failed") print("Failed CMD: %s" % (cmd)) class MonitorDumper(BaseDumper): - """ Class to get dumps via the Qemu Monitor, it only works with QemuRunner """ + """ Class to get dumps via the Qemu Monitor, it only works with QemuRunner + Will stop completely if there are more than 5 errors when dumping monitor data. + This helps to end testing when target is really dead, hanging or unresponsive. + """ def __init__(self, cmds, parent_dir, runner): super(MonitorDumper, self).__init__(cmds, parent_dir) self.runner = runner + self.errors = 0 def dump_monitor(self, dump_dir=""): if self.runner is None: return if dump_dir: self.dump_dir = dump_dir + if self.errors >= 5: + print("Too many errors when dumping data from qemu monitor, assuming it is dead! Will not dump data anymore!") + return for cmd in self.cmds: cmd_name = cmd.split()[0] try: @@ -135,4 +153,5 @@ class MonitorDumper(BaseDumper): output = self.runner.run_monitor(cmd_name) self._write_dump(cmd_name, output) except Exception as e: + self.errors = self.errors + 1 print("Failed to dump QMP CMD: %s with\nException: %s" % (cmd_name, e)) diff --git a/meta/lib/oeqa/utils/httpserver.py b/meta/lib/oeqa/utils/httpserver.py index 58d3c3b3f8..0d602e2dfa 100644 --- a/meta/lib/oeqa/utils/httpserver.py +++ b/meta/lib/oeqa/utils/httpserver.py @@ -38,6 +38,12 @@ class HTTPService(object): self.port = self.server.server_port self.process = multiprocessing.Process(target=self.server.server_start, args=[self.root_dir, self.logger]) + def handle_error(self, request, client_address): + import traceback + exception = traceback.format_exc() + self.logger.warn("Exception when handling %s: %s" % (request, exception)) + self.server.handle_error = handle_error + # The signal handler from testimage.bbclass can cause deadlocks here # if the HTTPServer is terminated before it can restore the standard #signal behaviour diff --git a/meta/lib/oeqa/utils/metadata.py b/meta/lib/oeqa/utils/metadata.py index 8013aa684d..15ec190c4a 100644 --- a/meta/lib/oeqa/utils/metadata.py +++ b/meta/lib/oeqa/utils/metadata.py @@ -27,9 +27,9 @@ def metadata_from_bb(): data_dict = get_bb_vars() # Distro information - info_dict['distro'] = {'id': data_dict['DISTRO'], - 'version_id': data_dict['DISTRO_VERSION'], - 'pretty_name': '%s %s' % (data_dict['DISTRO'], data_dict['DISTRO_VERSION'])} + info_dict['distro'] = {'id': data_dict.get('DISTRO', 'NODISTRO'), + 'version_id': data_dict.get('DISTRO_VERSION', 'NO_DISTRO_VERSION'), + 'pretty_name': '%s %s' % (data_dict.get('DISTRO', 'NODISTRO'), data_dict.get('DISTRO_VERSION', 'NO_DISTRO_VERSION'))} # Host distro information os_release = get_os_release() diff --git a/meta/lib/oeqa/utils/nfs.py b/meta/lib/oeqa/utils/nfs.py index a37686c914..c9bac050a4 100644 --- a/meta/lib/oeqa/utils/nfs.py +++ b/meta/lib/oeqa/utils/nfs.py @@ -8,7 +8,7 @@ from oeqa.utils.commands import bitbake, get_bb_var, Command from oeqa.utils.network import get_free_port @contextlib.contextmanager -def unfs_server(directory, logger = None): +def unfs_server(directory, logger = None, udp = True): unfs_sysroot = get_bb_var("RECIPE_SYSROOT_NATIVE", "unfs3-native") if not os.path.exists(os.path.join(unfs_sysroot, "usr", "bin", "unfsd")): # build native tool @@ -22,7 +22,7 @@ def unfs_server(directory, logger = None): exports.write("{0} (rw,no_root_squash,no_all_squash,insecure)\n".format(directory).encode()) # find some ports for the server - nfsport, mountport = get_free_port(udp = True), get_free_port(udp = True) + nfsport, mountport = get_free_port(udp), get_free_port(udp) nenv = dict(os.environ) nenv['PATH'] = "{0}/sbin:{0}/usr/sbin:{0}/usr/bin:".format(unfs_sysroot) + nenv.get('PATH', '') diff --git a/meta/lib/oeqa/utils/qemurunner.py b/meta/lib/oeqa/utils/qemurunner.py index c19164e6e7..925d05a339 100644 --- a/meta/lib/oeqa/utils/qemurunner.py +++ b/meta/lib/oeqa/utils/qemurunner.py @@ -195,7 +195,7 @@ class QemuRunner: qmp_file = "." + next(tempfile._get_candidate_names()) qmp_param = ' -S -qmp unix:./%s,server,wait' % (qmp_file) qmp_port = self.tmpdir + "/" + qmp_file - # Create a second socket connection for debugging use, + # Create a second socket connection for debugging use, # note this will NOT cause qemu to block waiting for the connection qmp_file2 = "." + next(tempfile._get_candidate_names()) qmp_param += ' -qmp unix:./%s,server,nowait' % (qmp_file2) @@ -342,6 +342,8 @@ class QemuRunner: return False try: + # set timeout value for all QMP calls + self.qmp.settimeout(self.runqemutime) self.qmp.connect() connect_time = time.time() self.logger.info("QMP connected to QEMU at %s and took %s seconds" % @@ -459,6 +461,8 @@ class QemuRunner: socklist.remove(self.server_socket) self.logger.debug("Connection from %s:%s" % addr) else: + # try to avoid reading only a single character at a time + time.sleep(0.1) data = data + sock.recv(1024) if data: bootlog += data @@ -532,10 +536,13 @@ class QemuRunner: except OSError as e: if e.errno != errno.ESRCH: raise - endtime = time.time() + self.runqemutime - while self.runqemu.poll() is None and time.time() < endtime: - time.sleep(1) - if self.runqemu.poll() is None: + try: + outs, errs = self.runqemu.communicate(timeout = self.runqemutime) + if outs: + self.logger.info("Output from runqemu:\n%s", outs.decode("utf-8")) + if errs: + self.logger.info("Stderr from runqemu:\n%s", errs.decode("utf-8")) + except TimeoutExpired: self.logger.debug("Sending SIGKILL to runqemu") os.killpg(os.getpgid(self.runqemu.pid), signal.SIGKILL) if not self.runqemu.stdout.closed: @@ -612,6 +619,7 @@ class QemuRunner: def run_monitor(self, command, args=None, timeout=60): if hasattr(self, 'qmp') and self.qmp: + self.qmp.settimeout(timeout) if args is not None: return self.qmp.cmd(command, args) else: @@ -639,6 +647,8 @@ class QemuRunner: except InterruptedError: continue if sread: + # try to avoid reading single character at a time + time.sleep(0.1) answer = self.server_socket.recv(1024) if answer: data += answer.decode('utf-8') diff --git a/meta/recipes-bsp/efivar/efivar/0001-Remove-deprecated-add-needed-linker-flag.patch b/meta/recipes-bsp/efivar/efivar/0001-Remove-deprecated-add-needed-linker-flag.patch new file mode 100644 index 0000000000..fb6d2e8580 --- /dev/null +++ b/meta/recipes-bsp/efivar/efivar/0001-Remove-deprecated-add-needed-linker-flag.patch @@ -0,0 +1,45 @@ +From b23aba1469de8bb7a115751f9cd294ad3aaa6680 Mon Sep 17 00:00:00 2001 +From: Ali Abdel-Qader <abdelqaderali@protonmail.com> +Date: Tue, 31 May 2022 11:53:32 -0400 +Subject: [PATCH] Remove deprecated --add-needed linker flag + +Resolves #204 +Signed-off-by: Ali Abdel-Qader <abdelqaderali@protonmail.com> +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- +Upstream-Status: Backport [https://github.com/rhboot/efivar/pull/218/commits/b23aba1469de8bb7a115751f9cd294ad3aaa6680] + + src/include/defaults.mk | 2 -- + src/include/gcc.specs | 2 +- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/src/include/defaults.mk b/src/include/defaults.mk +index b8cc590..42bd3d6 100644 +--- a/src/include/defaults.mk ++++ b/src/include/defaults.mk +@@ -51,7 +51,6 @@ LDFLAGS ?= + override _CCLDFLAGS := $(CCLDFLAGS) + override _LDFLAGS := $(LDFLAGS) + override LDFLAGS = $(CFLAGS) -L. $(_LDFLAGS) $(_CCLDFLAGS) \ +- -Wl,--add-needed \ + -Wl,--build-id \ + -Wl,--no-allow-shlib-undefined \ + -Wl,--no-undefined-version \ +@@ -98,7 +97,6 @@ override _HOST_LDFLAGS := $(HOST_LDFLAGS) + override _HOST_CCLDFLAGS := $(HOST_CCLDFLAGS) + override HOST_LDFLAGS = $(HOST_CFLAGS) -L. \ + $(_HOST_LDFLAGS) $(_HOST_CCLDFLAGS) \ +- -Wl,--add-needed \ + -Wl,--build-id \ + -Wl,--no-allow-shlib-undefined \ + -Wl,-z,now \ +diff --git a/src/include/gcc.specs b/src/include/gcc.specs +index ef28e2b..d85e865 100644 +--- a/src/include/gcc.specs ++++ b/src/include/gcc.specs +@@ -5,4 +5,4 @@ + + %{!shared:%{!static:%{!r:-pie}}} %{static:-Wl,-no-fatal-warnings -Wl,-static -static -Wl,-z,relro,-z,now} -grecord-gcc-switches + + *link: +-+ %{!static:--fatal-warnings} --no-undefined-version --no-allow-shlib-undefined --add-needed -z now --build-id %{!static:%{!shared:-pie}} %{shared:-z relro} %{static:%<pie} +++ %{!static:--fatal-warnings} --no-undefined-version --no-allow-shlib-undefined -z now --build-id %{!static:%{!shared:-pie}} %{shared:-z relro} %{static:%<pie} diff --git a/meta/recipes-bsp/efivar/efivar/0002-Add-T-workaround-for-GNU-ld-2.36.patch b/meta/recipes-bsp/efivar/efivar/0002-Add-T-workaround-for-GNU-ld-2.36.patch new file mode 100644 index 0000000000..a175673922 --- /dev/null +++ b/meta/recipes-bsp/efivar/efivar/0002-Add-T-workaround-for-GNU-ld-2.36.patch @@ -0,0 +1,33 @@ +From 8469d6f72ee2450753f044080b018f9ad7ff62dc Mon Sep 17 00:00:00 2001 +From: Robbie Harwood <rharwood@redhat.com> +Date: Mon, 17 Jan 2022 12:34:55 -0500 +Subject: [PATCH] Add -T workaround for GNU ld 2.36 + +Signed-off-by: Robbie Harwood <rharwood@redhat.com> +Resolves: #195 +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- +Upstream-Status: Backport [https://github.com/rhboot/efivar/commit/197a0874ea4010061b98b4b55eff65b33b1cd741] + + src/include/workarounds.mk | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/include/workarounds.mk b/src/include/workarounds.mk +index 3118834..143e790 100644 +--- a/src/include/workarounds.mk ++++ b/src/include/workarounds.mk +@@ -4,12 +4,12 @@ + + LD_FLAVOR := $(shell $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/ .*//g') + LD_VERSION := $(shell $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/.* //') +-# I haven't tested 2.36 here; 2.35 is definitely broken and 2.37 seems to work ++# 2.35 is definitely broken and 2.36 seems to work + LD_DASH_T := $(shell \ + if [ "x${LD_FLAVOR}" = xLLD ] ; then \ + echo '-T' ; \ + elif [ "x${LD_FLAVOR}" = xGNU ] ; then \ +- if echo "${LD_VERSION}" | grep -q -E '^2\.3[789]|^2\.[456789]|^[3456789]|^[[:digit:]][[:digit:]]' ; then \ ++ if echo "${LD_VERSION}" | grep -q -E '^2\.3[6789]|^2\.[456789]|^[3456789]|^[[:digit:]][[:digit:]]' ; then \ + echo '-T' ; \ + else \ + echo "" ; \ diff --git a/meta/recipes-bsp/efivar/efivar/0003-Set-LC_ALL-C-to-force-English-output-from-ld.patch b/meta/recipes-bsp/efivar/efivar/0003-Set-LC_ALL-C-to-force-English-output-from-ld.patch new file mode 100644 index 0000000000..e53c31a673 --- /dev/null +++ b/meta/recipes-bsp/efivar/efivar/0003-Set-LC_ALL-C-to-force-English-output-from-ld.patch @@ -0,0 +1,33 @@ +From 8ea2cf0ab6182f29ecd8568cdc674b2736f6ffba Mon Sep 17 00:00:00 2001 +From: Mike Gilbert <floppym@gentoo.org> +Date: Fri, 24 Jun 2022 17:00:33 -0400 +Subject: [PATCH] Set LC_ALL=C to force English output from ld + +If the user has a different locale set, ld --version may not contain the +string "GNU ld". + +For example, in Italian, ld --version outputs "ld di GNU". + +Signed-off-by: Mike Gilbert <floppym@gentoo.org> +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- +Upstream-Status: Backport [https://github.com/rhboot/efivar/commit/01de7438520868650bfaa1ef3e2bfaf00cacbcc6] + + src/include/workarounds.mk | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/include/workarounds.mk b/src/include/workarounds.mk +index 143e790..b72fbaf 100644 +--- a/src/include/workarounds.mk ++++ b/src/include/workarounds.mk +@@ -2,8 +2,8 @@ + # + # workarounds.mk - workarounds for weird stuff behavior + +-LD_FLAVOR := $(shell $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/ .*//g') +-LD_VERSION := $(shell $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/.* //') ++LD_FLAVOR := $(shell LC_ALL=C $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/ .*//g') ++LD_VERSION := $(shell LC_ALL=C $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/.* //') + # 2.35 is definitely broken and 2.36 seems to work + LD_DASH_T := $(shell \ + if [ "x${LD_FLAVOR}" = xLLD ] ; then \ diff --git a/meta/recipes-bsp/efivar/efivar/0004-LLD-fix-detection-and-remove-not-needed-workarounds.patch b/meta/recipes-bsp/efivar/efivar/0004-LLD-fix-detection-and-remove-not-needed-workarounds.patch new file mode 100644 index 0000000000..f1a545140a --- /dev/null +++ b/meta/recipes-bsp/efivar/efivar/0004-LLD-fix-detection-and-remove-not-needed-workarounds.patch @@ -0,0 +1,45 @@ +From 09b9ddc51cb83ce547872a82271d1af4d11325da Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tomasz=20Pawe=C5=82=20Gajc?= <tpgxyz@gmail.com> +Date: Wed, 29 Jun 2022 21:44:29 +0200 +Subject: [PATCH] LLD: fix detection and remove not needed workarounds +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Tomasz Paweł Gajc <tpgxyz@gmail.com> +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- +Upstream-Status: Backport [https://github.com/rhboot/efivar/commit/1f247260c9b4bd6fcda30f3e4cc358852aeb9e4d] + + src/include/workarounds.mk | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/include/workarounds.mk b/src/include/workarounds.mk +index b72fbaf..57394ed 100644 +--- a/src/include/workarounds.mk ++++ b/src/include/workarounds.mk +@@ -2,12 +2,12 @@ + # + # workarounds.mk - workarounds for weird stuff behavior + +-LD_FLAVOR := $(shell LC_ALL=C $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/ .*//g') +-LD_VERSION := $(shell LC_ALL=C $(LD) --version | grep -E '^(LLD|GNU ld)'|sed 's/.* //') ++LD_FLAVOR := $(shell LC_ALL=C $(LD) --version | grep -E '^((.* )?LLD|GNU ld)'|sed 's/.* LLD/LLD/;s/ .*//g') ++LD_VERSION := $(shell LC_ALL=C $(LD) --version | grep -E '^((.* )?LLD|GNU ld)'|sed 's/.* LLD/LLD/;s/.* //') + # 2.35 is definitely broken and 2.36 seems to work + LD_DASH_T := $(shell \ + if [ "x${LD_FLAVOR}" = xLLD ] ; then \ +- echo '-T' ; \ ++ echo "" ; \ + elif [ "x${LD_FLAVOR}" = xGNU ] ; then \ + if echo "${LD_VERSION}" | grep -q -E '^2\.3[6789]|^2\.[456789]|^[3456789]|^[[:digit:]][[:digit:]]' ; then \ + echo '-T' ; \ +@@ -15,7 +15,7 @@ LD_DASH_T := $(shell \ + echo "" ; \ + fi ; \ + else \ +- echo "Your linker is not supported" ; \ ++ echo "Your linker ${LD_FLAVOR} version ${LD_VERSION} is not supported" ; \ + exit 1 ; \ + fi) + diff --git a/meta/recipes-bsp/efivar/efivar/0005-Revamp-efi_well_known_-variable-handling.patch b/meta/recipes-bsp/efivar/efivar/0005-Revamp-efi_well_known_-variable-handling.patch new file mode 100644 index 0000000000..758a151138 --- /dev/null +++ b/meta/recipes-bsp/efivar/efivar/0005-Revamp-efi_well_known_-variable-handling.patch @@ -0,0 +1,262 @@ +From 8c20b2242925616dfccc97b9be29f36afcf8034d Mon Sep 17 00:00:00 2001 +From: Nicholas Vinson <nvinson234@gmail.com> +Date: Mon, 10 Oct 2022 14:22:36 -0400 +Subject: [PATCH] Revamp efi_well_known_* variable handling + +The current implementation attempts to use the linker to create aliases +for efi_well_known_guids and efi_well_known_names. It also tries to use +the linker to generate the variables efi_well_known_guids_end and +efi_well_known_names_end. + +When building with clang, the generated linker result results in a +broken libefivar.so that causes programs to segfault when linked against +it. This change does away with linker script hacker and instead +introduces pointers to store the locations of efi_well_known_guids_end +and efi_well_known_names_end. + +Additionally, efi_well_known_guids and efi_well_known_names are now +created as pointers that point to the beginning of their respective +arrays. + +Signed-off-by: Nicholas Vinson <nvinson234@gmail.com> +Fixes: #234 +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- +Upstream-Status: Backport [https://github.com/rhboot/efivar/commit/cfd686de51494d3e34be896a91835657ccab37d4] + + src/Makefile | 7 ++-- + src/include/rules.mk | 5 +-- + src/include/workarounds.mk | 24 ------------- + src/makeguids.c | 72 +++++++++++++------------------------- + 4 files changed, 27 insertions(+), 81 deletions(-) + delete mode 100644 src/include/workarounds.mk + +diff --git a/src/Makefile b/src/Makefile +index b10051b..c69caf4 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -4,7 +4,6 @@ include $(TOPDIR)/src/include/deprecated.mk + include $(TOPDIR)/src/include/version.mk + include $(TOPDIR)/src/include/rules.mk + include $(TOPDIR)/src/include/defaults.mk +-include $(TOPDIR)/src/include/workarounds.mk + + LIBTARGETS=libefivar.so libefiboot.so libefisec.so + STATICLIBTARGETS=libefivar.a libefiboot.a libefisec.a +@@ -30,7 +29,7 @@ EFISECDB_OBJECTS = $(patsubst %.S,%.o,$(patsubst %.c,%.o,$(EFISECDB_SOURCES))) + GENERATED_SOURCES = include/efivar/efivar-guids.h guid-symbols.c + MAKEGUIDS_SOURCES = makeguids.c util-makeguids.c + MAKEGUIDS_OBJECTS = $(patsubst %.S,%.o,$(patsubst %.c,%.o,$(MAKEGUIDS_SOURCES))) +-MAKEGUIDS_OUTPUT = $(GENERATED_SOURCES) guids.lds ++MAKEGUIDS_OUTPUT = $(GENERATED_SOURCES) + + util-makeguids.c : + cp util.c util-makeguids.c +@@ -84,7 +83,7 @@ $(MAKEGUIDS_OUTPUT) : guids.txt + if [ "$${missing}" != "no" ]; then \ + exit 1 ; \ + fi +- ./makeguids $(LD_DASH_T) guids.txt guid-symbols.c include/efivar/efivar-guids.h guids.lds ++ ./makeguids guids.txt guid-symbols.c include/efivar/efivar-guids.h + + prep : makeguids $(GENERATED_SOURCES) + +@@ -96,7 +95,6 @@ libefivar.a : $(patsubst %.o,%.static.o,$(LIBEFIVAR_OBJECTS)) + libefivar.so : $(LIBEFIVAR_OBJECTS) + libefivar.so : | $(GENERATED_SOURCES) libefivar.map + libefivar.so : LIBS=dl +-libefivar.so : LDSCRIPTS=guids.lds + libefivar.so : MAP=libefivar.map + + efivar : $(EFIVAR_OBJECTS) | libefivar.so +@@ -137,7 +135,6 @@ deps : $(ALL_SOURCES) + clean : + @rm -rfv *~ *.o *.a *.E *.so *.so.* *.pc *.bin .*.d *.map \ + makeguids guid-symbols.c include/efivar/efivar-guids.h \ +- guids.lds \ + $(TARGETS) $(STATICTARGETS) + @# remove the deps files we used to create, as well. + @rm -rfv .*.P .*.h.P *.S.P include/efivar/.*.h.P +diff --git a/src/include/rules.mk b/src/include/rules.mk +index f309f86..8d0b68a 100644 +--- a/src/include/rules.mk ++++ b/src/include/rules.mk +@@ -3,7 +3,6 @@ default : all + .PHONY: default all clean install test + + include $(TOPDIR)/src/include/version.mk +-include $(TOPDIR)/src/include/workarounds.mk + + comma:= , + empty:= +@@ -36,9 +35,7 @@ family = $(foreach FAMILY_SUFFIX,$(FAMILY_SUFFIXES),$($(1)_$(FAMILY_SUFFIX))) + $(CCLD) $(CCLDFLAGS) $(CPPFLAGS) -o $@ $(sort $^) $(LDLIBS) + + %.so : +- $(CCLD) $(CCLDFLAGS) $(CPPFLAGS) $(SOFLAGS) \ +- $(foreach LDS,$(LDSCRIPTS),$(LD_DASH_T) $(LDS)) \ +- -o $@ $^ $(LDLIBS) ++ $(CCLD) $(CCLDFLAGS) $(CPPFLAGS) $(SOFLAGS) -o $@ $^ $(LDLIBS) + ln -vfs $@ $@.1 + + %.abixml : %.so +diff --git a/src/include/workarounds.mk b/src/include/workarounds.mk +deleted file mode 100644 +index 57394ed..0000000 +--- a/src/include/workarounds.mk ++++ /dev/null +@@ -1,24 +0,0 @@ +-# SPDX-License-Identifier: SPDX-License-Identifier: LGPL-2.1-or-later +-# +-# workarounds.mk - workarounds for weird stuff behavior +- +-LD_FLAVOR := $(shell LC_ALL=C $(LD) --version | grep -E '^((.* )?LLD|GNU ld)'|sed 's/.* LLD/LLD/;s/ .*//g') +-LD_VERSION := $(shell LC_ALL=C $(LD) --version | grep -E '^((.* )?LLD|GNU ld)'|sed 's/.* LLD/LLD/;s/.* //') +-# 2.35 is definitely broken and 2.36 seems to work +-LD_DASH_T := $(shell \ +- if [ "x${LD_FLAVOR}" = xLLD ] ; then \ +- echo "" ; \ +- elif [ "x${LD_FLAVOR}" = xGNU ] ; then \ +- if echo "${LD_VERSION}" | grep -q -E '^2\.3[6789]|^2\.[456789]|^[3456789]|^[[:digit:]][[:digit:]]' ; then \ +- echo '-T' ; \ +- else \ +- echo "" ; \ +- fi ; \ +- else \ +- echo "Your linker ${LD_FLAVOR} version ${LD_VERSION} is not supported" ; \ +- exit 1 ; \ +- fi) +- +-export LD_DASH_T +- +-# vim:ft=make +diff --git a/src/makeguids.c b/src/makeguids.c +index e4ff411..b9e9312 100644 +--- a/src/makeguids.c ++++ b/src/makeguids.c +@@ -107,51 +107,46 @@ write_guidnames(FILE *out, const char *listname, + gn->symbol, gn->name, gn->description); + } + fprintf(out, "};\n"); ++ fprintf(out, "const struct efivar_guidname\n" ++ "\t__attribute__((__visibility__ (\"default\")))\n" ++ "\t* const %s = %s_;\n", listname, listname); ++ fprintf(out, "const struct efivar_guidname\n" ++ "\t__attribute__((__visibility__ (\"default\")))\n" ++ "\t* const %s_end = %s_\n\t+ %zd;\n", ++ listname, listname, n - 1); + } + + int + main(int argc, char *argv[]) + { + int rc; +- int argstart = 0; +- FILE *symout, *header, *ldsout; +- int dash_t = 0; ++ FILE *symout, *header; + +- if (argc < 5) { ++ if (argc < 4) { + errx(1, "Not enough arguments.\n"); +- } else if (argc > 5 && !strcmp(argv[1],"-T")) { +- argstart = 1; +- dash_t = 1; +- } else if (argc > 5) { ++ } else if (argc > 4) { + errx(1, "Too many arguments.\n"); + } + +- symout = fopen(argv[argstart + 2], "w"); ++ symout = fopen(argv[2], "w"); + if (symout == NULL) +- err(1, "could not open \"%s\"", argv[argstart + 2]); +- rc = chmod(argv[argstart + 2], 0644); ++ err(1, "could not open \"%s\"", argv[2]); ++ rc = chmod(argv[2], 0644); + if (rc < 0) +- warn("chmod(%s, 0644)", argv[argstart + 2]); ++ warn("chmod(%s, 0644)", argv[2]); + +- header = fopen(argv[argstart + 3], "w"); ++ header = fopen(argv[3], "w"); + if (header == NULL) +- err(1, "could not open \"%s\"", argv[argstart + 3]); +- rc = chmod(argv[argstart + 3], 0644); +- if (rc < 0) +- warn("chmod(%s, 0644)", argv[argstart + 3]); +- +- ldsout = fopen(argv[argstart + 4], "w"); +- if (ldsout == NULL) +- err(1, "could not open \"%s\"", argv[argstart + 4]); +- rc = chmod(argv[argstart + 4], 0644); ++ err(1, "could not open \"%s\"", argv[3]); ++ rc = chmod(argv[3], 0644); + if (rc < 0) +- warn("chmod(%s, 0644)", argv[argstart + 4]); ++ warn("chmod(%s, 0644)", argv[3]); + + struct guidname_index *guidnames = NULL; + +- rc = read_guids_at(AT_FDCWD, argv[argstart + 1], &guidnames); ++ rc = read_guids_at(AT_FDCWD, argv[1], &guidnames); + if (rc < 0) +- err(1, "could not read \"%s\"", argv[argstart + 1]); ++ err(1, "could not read \"%s\"", argv[1]); + + struct efivar_guidname *outbuf; + +@@ -239,12 +234,11 @@ struct efivar_guidname {\n\ + fprintf(header, + "extern const struct efivar_guidname\n" + "\t__attribute__((__visibility__ (\"default\")))\n" +- "\tefi_well_known_guids[%d];\n", +- i); ++ "\t* const efi_well_known_guids;\n"); + fprintf(header, + "extern const struct efivar_guidname\n" + "\t__attribute__((__visibility__ (\"default\")))\n" +- "\tefi_well_known_guids_end;\n"); ++ "\t* const efi_well_known_guids_end;\n"); + fprintf(header, + "extern const uint64_t\n" + "\t__attribute__((__visibility__ (\"default\")))\n" +@@ -252,12 +246,11 @@ struct efivar_guidname {\n\ + fprintf(header, + "extern const struct efivar_guidname\n" + "\t__attribute__((__visibility__ (\"default\")))\n" +- "\tefi_well_known_names[%d];\n", +- i); ++ "\t* const efi_well_known_names;\n"); + fprintf(header, + "extern const struct efivar_guidname\n" + "\t__attribute__((__visibility__ (\"default\")))\n" +- "\tefi_well_known_names_end;\n"); ++ "\t* const efi_well_known_names_end;\n"); + fprintf(header, + "extern const uint64_t\n" + "\t__attribute__((__visibility__ (\"default\")))\n" +@@ -302,23 +295,6 @@ struct efivar_guidname {\n\ + + fclose(symout); + +- fprintf(ldsout, +- "SECTIONS\n" +- "{\n" +- " .data :\n" +- " {\n" +- " efi_well_known_guids = efi_well_known_guids_;\n" +- " efi_well_known_guids_end = efi_well_known_guids_ + %zd;\n" +- " efi_well_known_names = efi_well_known_names_;\n" +- " efi_well_known_names_end = efi_well_known_names_ + %zd;\n" +- " }\n" +- "}%s;\n", +- (line - 1) * sizeof(struct efivar_guidname), +- (line - 1) * sizeof(struct efivar_guidname), +- dash_t ? " INSERT AFTER .data" : ""); +- +- fclose(ldsout); +- + free(guidnames->strtab); + free(guidnames); + diff --git a/meta/recipes-bsp/efivar/efivar_38.bb b/meta/recipes-bsp/efivar/efivar_38.bb index 42625fa041..dc84b3732f 100644 --- a/meta/recipes-bsp/efivar/efivar_38.bb +++ b/meta/recipes-bsp/efivar/efivar_38.bb @@ -12,6 +12,11 @@ SRC_URI = "git://github.com/rhinstaller/efivar.git;branch=main;protocol=https \ file://0001-src-Makefile-build-util.c-separately-for-makeguids.patch \ file://efisecdb-fix-build-with-musl-libc.patch \ file://0001-Fix-invalid-free-in-main.patch \ + file://0001-Remove-deprecated-add-needed-linker-flag.patch \ + file://0002-Add-T-workaround-for-GNU-ld-2.36.patch \ + file://0003-Set-LC_ALL-C-to-force-English-output-from-ld.patch \ + file://0004-LLD-fix-detection-and-remove-not-needed-workarounds.patch \ + file://0005-Revamp-efi_well_known_-variable-handling.patch \ " SRCREV = "1753149d4176ebfb2b135ac0aaf79340bf0e7a93" @@ -21,10 +26,6 @@ inherit pkgconfig export CCLD_FOR_BUILD = "${BUILD_CCLD}" -# Upstream uses --add-needed in gcc.specs which gold doesn't support, so -# enforce BFD. -LDFLAGS += "-fuse-ld=bfd" - do_compile() { oe_runmake ERRORS= HOST_CFLAGS="${BUILD_CFLAGS}" HOST_LDFLAGS="${BUILD_LDFLAGS}" } diff --git a/meta/recipes-bsp/grub/files/CVE-2023-4692.patch b/meta/recipes-bsp/grub/files/CVE-2023-4692.patch new file mode 100644 index 0000000000..4780e35b7a --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2023-4692.patch @@ -0,0 +1,97 @@ +From 43651027d24e62a7a463254165e1e46e42aecdea Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov <dfirblog@gmail.com> +Date: Thu, 16 Nov 2023 07:21:50 +0000 +Subject: [PATCH] fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST + attribute for the $MFT file + +When parsing an extremely fragmented $MFT file, i.e., the file described +using the $ATTRIBUTE_LIST attribute, current NTFS code will reuse a buffer +containing bytes read from the underlying drive to store sector numbers, +which are consumed later to read data from these sectors into another buffer. + +These sectors numbers, two 32-bit integers, are always stored at predefined +offsets, 0x10 and 0x14, relative to first byte of the selected entry within +the $ATTRIBUTE_LIST attribute. Usually, this won't cause any problem. + +However, when parsing a specially-crafted file system image, this may cause +the NTFS code to write these integers beyond the buffer boundary, likely +causing the GRUB memory allocator to misbehave or fail. These integers contain +values which are controlled by on-disk structures of the NTFS file system. + +Such modification and resulting misbehavior may touch a memory range not +assigned to the GRUB and owned by firmware or another EFI application/driver. + +This fix introduces checks to ensure that these sector numbers are never +written beyond the boundary. + +Fixes: CVE-2023-4692 + +Reported-by: Maxim Suhanov <dfirblog@gmail.com> +Signed-off-by: Maxim Suhanov <dfirblog@gmail.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +CVE: CVE-2023-4692 +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=43651027d24e62a7a463254165e1e46e42aecdea] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + grub-core/fs/ntfs.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 2f34f76..6009e49 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -184,7 +184,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + } + if (at->attr_end) + { +- grub_uint8_t *pa; ++ grub_uint8_t *pa, *pa_end; + + at->emft_buf = grub_malloc (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + if (at->emft_buf == NULL) +@@ -209,11 +209,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + } + at->attr_nxt = at->edat_buf; + at->attr_end = at->edat_buf + u32at (pa, 0x30); ++ pa_end = at->edat_buf + n; + } + else + { + at->attr_nxt = at->attr_end + u16at (pa, 0x14); + at->attr_end = at->attr_end + u32at (pa, 4); ++ pa_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + } + at->flags |= GRUB_NTFS_AF_ALST; + while (at->attr_nxt < at->attr_end) +@@ -230,6 +232,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + at->flags |= GRUB_NTFS_AF_GPOS; + at->attr_cur = at->attr_nxt; + pa = at->attr_cur; ++ ++ if ((pa >= pa_end) || (pa_end - pa < 0x18)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "can\'t parse attribute list"); ++ return NULL; ++ } ++ + grub_set_unaligned32 ((char *) pa + 0x10, + grub_cpu_to_le32 (at->mft->data->mft_start)); + grub_set_unaligned32 ((char *) pa + 0x14, +@@ -240,6 +249,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + { + if (*pa != attr) + break; ++ ++ if ((pa >= pa_end) || (pa_end - pa < 0x18)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "can\'t parse attribute list"); ++ return NULL; ++ } ++ + if (read_attr + (at, pa + 0x10, + u32at (pa, 0x10) * (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR), +-- +2.40.0 diff --git a/meta/recipes-bsp/grub/files/CVE-2023-4693.patch b/meta/recipes-bsp/grub/files/CVE-2023-4693.patch new file mode 100644 index 0000000000..1b6013d86d --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2023-4693.patch @@ -0,0 +1,62 @@ +From 0ed2458cc4eff6d9a9199527e2a0b6d445802f94 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov <dfirblog@gmail.com> +Date: Mon, 28 Aug 2023 16:32:33 +0300 +Subject: [PATCH] fs/ntfs: Fix an OOB read when reading data from the resident + $DATA attribute + +When reading a file containing resident data, i.e., the file data is stored in +the $DATA attribute within the NTFS file record, not in external clusters, +there are no checks that this resident data actually fits the corresponding +file record segment. + +When parsing a specially-crafted file system image, the current NTFS code will +read the file data from an arbitrary, attacker-chosen memory offset and of +arbitrary, attacker-chosen length. + +This allows an attacker to display arbitrary chunks of memory, which could +contain sensitive information like password hashes or even plain-text, +obfuscated passwords from BS EFI variables. + +This fix implements a check to ensure that resident data is read from the +corresponding file record segment only. + +Fixes: CVE-2023-4693 + +Reported-by: Maxim Suhanov <dfirblog@gmail.com> +Signed-off-by: Maxim Suhanov <dfirblog@gmail.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=0ed2458cc4eff6d9a9199527e2a0b6d445802f94] +CVE: CVE-2023-4693 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + grub-core/fs/ntfs.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 7e43fd6..8f63c83 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -401,7 +401,18 @@ read_data (struct grub_ntfs_attr *at, grub_uint8_t *pa, grub_uint8_t *dest, + { + if (ofs + len > u32at (pa, 0x10)) + return grub_error (GRUB_ERR_BAD_FS, "read out of range"); +- grub_memcpy (dest, pa + u32at (pa, 0x14) + ofs, len); ++ ++ if (u32at (pa, 0x10) > (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ return grub_error (GRUB_ERR_BAD_FS, "resident attribute too large"); ++ ++ if (pa >= at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ return grub_error (GRUB_ERR_BAD_FS, "resident attribute out of range"); ++ ++ if (u16at (pa, 0x14) + u32at (pa, 0x10) > ++ (grub_addr_t) at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR) - (grub_addr_t) pa) ++ return grub_error (GRUB_ERR_BAD_FS, "resident attribute out of range"); ++ ++ grub_memcpy (dest, pa + u16at (pa, 0x14) + ofs, len); + return 0; + } + +-- +2.25.1 + diff --git a/meta/recipes-bsp/grub/files/determinism.patch b/meta/recipes-bsp/grub/files/determinism.patch index 2828e80975..852b95a856 100644 --- a/meta/recipes-bsp/grub/files/determinism.patch +++ b/meta/recipes-bsp/grub/files/determinism.patch @@ -14,7 +14,7 @@ missing sorting of the list used to generate it. Add such a sort. Also ensure the generated unidata.c file is deterministic by sorting the keys of the dict. -Upstream-Status: Pending +Upstream-Status: Submitted [https://lists.gnu.org/archive/html/grub-devel/2023-06/index.html] Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> --- diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index c14fe315d3..e6c6cd98b4 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -38,6 +38,8 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://loader-efi-chainloader-Simplify-the-loader-state.patch \ file://commands-boot-Add-API-to-pass-context-to-loader.patch \ file://CVE-2022-28736-loader-efi-chainloader-Use-grub_loader_set_ex.patch \ + file://CVE-2023-4692.patch \ + file://CVE-2023-4693.patch \ " SRC_URI[sha256sum] = "23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f" diff --git a/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb b/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb index c6a4bc4932..dcc09f279e 100644 --- a/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb +++ b/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb @@ -19,9 +19,12 @@ PACKAGECONFIG[manpages] = "--enable-doc, --disable-doc, libxslt-native xmlto-nat RDEPENDS:${PN} = "grep bash" +EXTRA_OECONF = "--libdir=${nonarch_libdir}" + do_configure:prepend () { ( cd ${S}; autoreconf -f -i -s ) } -FILES:${PN} += "${libdir}/${BPN}/*" +FILES:${PN} += "${nonarch_libdir}/${BPN}/*" FILES:${PN}-dbg += "${datadir}/doc/pm-utils/README.debugging" +FILES:${PN}-dev += "${nonarch_libdir}/pkgconfig/pm-utils.pc" diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc index b2f33e3826..54ea2e9e50 100644 --- a/meta/recipes-bsp/u-boot/u-boot.inc +++ b/meta/recipes-bsp/u-boot/u-boot.inc @@ -24,6 +24,10 @@ PACKAGECONFIG[openssl] = ",,openssl-native" # file already exists it will not be overwritten. UBOOT_LOCALVERSION ?= "" +# Default name of u-boot initial env, but enable individual recipes to change +# this value. +UBOOT_INITIAL_ENV ?= "${PN}-initial-env" + require u-boot-configure.inc do_compile () { diff --git a/meta/recipes-bsp/v86d/v86d_0.1.10.bb b/meta/recipes-bsp/v86d/v86d_0.1.10.bb index 5f342b1120..b4fe362f8e 100644 --- a/meta/recipes-bsp/v86d/v86d_0.1.10.bb +++ b/meta/recipes-bsp/v86d/v86d_0.1.10.bb @@ -6,7 +6,6 @@ DESCRIPTION = "v86d provides a backend for kernel drivers that need to execute x LICENSE = "GPL-2.0-only" LIC_FILES_CHKSUM = "file://README;md5=94ac1971e4f2309dc322d598e7b1f7dd" -DEPENDS = "virtual/kernel" RRECOMMENDS:${PN} = "kernel-module-uvesafb" PR = "r2" diff --git a/meta/recipes-connectivity/avahi/avahi_0.8.bb b/meta/recipes-connectivity/avahi/avahi_0.8.bb index 9bb5e5861e..5d1c86978a 100644 --- a/meta/recipes-connectivity/avahi/avahi_0.8.bb +++ b/meta/recipes-connectivity/avahi/avahi_0.8.bb @@ -26,6 +26,15 @@ SRC_URI = "https://github.com/lathiat/avahi/releases/download/v${PV}/avahi-${PV} file://0001-Fix-opening-etc-resolv.conf-error.patch \ file://handle-hup.patch \ file://local-ping.patch \ + file://CVE-2023-1981.patch \ + file://CVE-2023-38469-1.patch \ + file://CVE-2023-38469-2.patch \ + file://CVE-2023-38470-1.patch \ + file://CVE-2023-38470-2.patch \ + file://CVE-2023-38471-1.patch \ + file://CVE-2023-38471-2.patch \ + file://CVE-2023-38472.patch \ + file://CVE-2023-38473.patch \ " UPSTREAM_CHECK_URI = "https://github.com/lathiat/avahi/releases/" @@ -83,7 +92,6 @@ RRECOMMENDS:${PN}:append:libc-glibc = " libnss-mdns" do_install() { autotools_do_install rm -rf ${D}/run - rm -rf ${D}${datadir}/dbus-1/interfaces test -d ${D}${datadir}/dbus-1 && rmdir --ignore-fail-on-non-empty ${D}${datadir}/dbus-1 rm -rf ${D}${libdir}/avahi @@ -135,7 +143,7 @@ FILES:avahi-daemon = "${sbindir}/avahi-daemon \ ${sysconfdir}/avahi/services \ ${sysconfdir}/dbus-1 \ ${sysconfdir}/init.d/avahi-daemon \ - ${datadir}/avahi/introspection/*.introspect \ + ${datadir}/dbus-1/interfaces \ ${datadir}/avahi/avahi-service.dtd \ ${datadir}/avahi/service-types \ ${datadir}/dbus-1/system-services" diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch new file mode 100644 index 0000000000..4d7924d13a --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch @@ -0,0 +1,58 @@ +From a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com> +Date: Thu, 17 Nov 2022 01:51:53 +0100 +Subject: [PATCH] Emit error if requested service is not found + +It currently just crashes instead of replying with error. Check return +value and emit error instead of passing NULL pointer to reply. + +Fixes #375 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-1981.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f] +CVE: CVE-2023-1981 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + avahi-daemon/dbus-protocol.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/avahi-daemon/dbus-protocol.c b/avahi-daemon/dbus-protocol.c +index 70d7687bc..406d0b441 100644 +--- a/avahi-daemon/dbus-protocol.c ++++ b/avahi-daemon/dbus-protocol.c +@@ -375,10 +375,14 @@ static DBusHandlerResult dbus_get_alternative_host_name(DBusConnection *c, DBusM + } + + t = avahi_alternative_host_name(n); +- avahi_dbus_respond_string(c, m, t); +- avahi_free(t); ++ if (t) { ++ avahi_dbus_respond_string(c, m, t); ++ avahi_free(t); + +- return DBUS_HANDLER_RESULT_HANDLED; ++ return DBUS_HANDLER_RESULT_HANDLED; ++ } else { ++ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Hostname not found"); ++ } + } + + static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DBusMessage *m, DBusError *error) { +@@ -389,10 +393,14 @@ static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DB + } + + t = avahi_alternative_service_name(n); +- avahi_dbus_respond_string(c, m, t); +- avahi_free(t); ++ if (t) { ++ avahi_dbus_respond_string(c, m, t); ++ avahi_free(t); + +- return DBUS_HANDLER_RESULT_HANDLED; ++ return DBUS_HANDLER_RESULT_HANDLED; ++ } else { ++ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Service not found"); ++ } + } + + static DBusHandlerResult dbus_create_new_entry_group(DBusConnection *c, DBusMessage *m, DBusError *error) { diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38469-1.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38469-1.patch new file mode 100644 index 0000000000..f0f6c4bf7b --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38469-1.patch @@ -0,0 +1,47 @@ +From a337a1ba7d15853fb56deef1f464529af6e3a1cf Mon Sep 17 00:00:00 2001 +From: Evgeny Vereshchagin <evvers@ya.ru> +Date: Mon, 23 Oct 2023 20:29:31 +0000 +Subject: [PATCH]core: reject overly long TXT resource records +Closes https://github.com/lathiat/avahi/issues/455 + +Upstream-Status: Backport [https://github.com/lathiat/avahi/pull/500/commits/a337a1ba7d15853fb56deef1f464529af6e3a1cf] +CVE: CVE-2023-38469 + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + avahi-core/rr.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/avahi-core/rr.c b/avahi-core/rr.c +index 7fa0bee..b03a24c 100644 +--- a/avahi-core/rr.c ++++ b/avahi-core/rr.c +@@ -32,6 +32,7 @@ + #include <avahi-common/malloc.h> + #include <avahi-common/defs.h> + ++#include "dns.h" + #include "rr.h" + #include "log.h" + #include "util.h" +@@ -688,11 +689,17 @@ int avahi_record_is_valid(AvahiRecord *r) { + case AVAHI_DNS_TYPE_TXT: { + + AvahiStringList *strlst; ++ size_t used = 0; + +- for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) ++ for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) { + if (strlst->size > 255 || strlst->size <= 0) + return 0; + ++ used += 1+strlst->size; ++ if (used > AVAHI_DNS_RDATA_MAX) ++ return 0; ++ } ++ + return 1; + } + } +-- +2.40.0 diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch new file mode 100644 index 0000000000..f8f60ddca1 --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch @@ -0,0 +1,65 @@ +From c6cab87df290448a63323c8ca759baa516166237 Mon Sep 17 00:00:00 2001 +From: Evgeny Vereshchagin <evvers@ya.ru> +Date: Wed, 25 Oct 2023 18:15:42 +0000 +Subject: [PATCH] tests: pass overly long TXT resource records + +to make sure they don't crash avahi any more. +It reproduces https://github.com/lathiat/avahi/issues/455 + +Canonical notes: +nickgalanis> removed first hunk since there is no .github dir in this release + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38469-2.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237] +CVE: CVE-2023-38469 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + avahi-client/client-test.c | 14 ++++++++++++++ + 1 files changed, 14 insertions(+) + +Index: avahi-0.8/avahi-client/client-test.c +=================================================================== +--- avahi-0.8.orig/avahi-client/client-test.c ++++ avahi-0.8/avahi-client/client-test.c +@@ -22,6 +22,7 @@ + #endif + + #include <stdio.h> ++#include <string.h> + #include <assert.h> + + #include <avahi-client/client.h> +@@ -33,6 +34,8 @@ + #include <avahi-common/malloc.h> + #include <avahi-common/timeval.h> + ++#include <avahi-core/dns.h> ++ + static const AvahiPoll *poll_api = NULL; + static AvahiSimplePoll *simple_poll = NULL; + +@@ -222,6 +225,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVA + uint32_t cookie; + struct timeval tv; + AvahiAddress a; ++ uint8_t rdata[AVAHI_DNS_RDATA_MAX+1]; ++ AvahiStringList *txt = NULL; ++ int r; + + simple_poll = avahi_simple_poll_new(); + poll_api = avahi_simple_poll_get(simple_poll); +@@ -258,6 +264,14 @@ int main (AVAHI_GCC_UNUSED int argc, AVA + printf("%s\n", avahi_strerror(avahi_entry_group_add_service (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "Lathiat's Site", "_http._tcp", NULL, NULL, 80, "foo=bar", NULL))); + printf("add_record: %d\n", avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "\5booya", 6)); + ++ memset(rdata, 1, sizeof(rdata)); ++ r = avahi_string_list_parse(rdata, sizeof(rdata), &txt); ++ assert(r >= 0); ++ assert(avahi_string_list_serialize(txt, NULL, 0) == sizeof(rdata)); ++ error = avahi_entry_group_add_service_strlst(group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", "_qotd._tcp", NULL, NULL, 123, txt); ++ assert(error == AVAHI_ERR_INVALID_RECORD); ++ avahi_string_list_free(txt); ++ + avahi_entry_group_commit (group); + + domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u"); diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38470-1.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38470-1.patch new file mode 100644 index 0000000000..5cf9af6fd6 --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38470-1.patch @@ -0,0 +1,59 @@ +From 26806dbde54c5b40a2bf108d334ba59ec9d242d6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com> +Date: Tue, 11 Apr 2023 15:29:59 +0200 +Subject: [PATCH]Ensure each label is at least one byte long + +The only allowed exception is single dot, where it should return empty +string. + +Fixes #454. + +Upstream-Status: Backport [https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c] +CVE: CVE-2023-38470 + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + avahi-common/domain-test.c | 14 ++++++++++++++ + avahi-common/domain.c | 2 +- + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/avahi-common/domain-test.c b/avahi-common/domain-test.c +index cf763ec..3acc1c1 100644 +--- a/avahi-common/domain-test.c ++++ b/avahi-common/domain-test.c +@@ -45,6 +45,20 @@ int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) { + printf("%s\n", s = avahi_normalize_name_strdup("fo\\\\o\\..f oo.")); + avahi_free(s); + ++ printf("%s\n", s = avahi_normalize_name_strdup(".")); ++ avahi_free(s); ++ ++ s = avahi_normalize_name_strdup(",.=.}.=.?-.}.=.?.?.}.}.?.?.?.z.?.?.}.}." ++ "}.?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM.=.=.?.?.}.}.?.?.}.}.}" ++ ".?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM.=.=.?.?.}.}.?.?.?.zM.?`" ++ "?.}.}.}.?.?.?.r.=.?.}.=.?.?.}.?.?.?.}.=.?.?.}??.}.}.?.?." ++ "?.z.?.?.}.}.}.?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM.?`?.}.}.}." ++ "??.?.zM.?`?.}.}.}.?.?.?.r.=.?.}.=.?.?.}.?.?.?.}.=.?.?.}?" ++ "?.}.}.?.?.?.z.?.?.}.}.}.?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM." ++ "?`?.}.}.}.?.?.?.r.=.=.?.?`.?.?}.}.}.?.?.?.r.=.?.}.=.?.?." ++ "}.?.?.?.}.=.?.?.}"); ++ assert(s == NULL); ++ + printf("%i\n", avahi_domain_equal("\\065aa bbb\\.\\046cc.cc\\\\.dee.fff.", "Aaa BBB\\.\\.cc.cc\\\\.dee.fff")); + printf("%i\n", avahi_domain_equal("A", "a")); + +diff --git a/avahi-common/domain.c b/avahi-common/domain.c +index 3b1ab68..e66d241 100644 +--- a/avahi-common/domain.c ++++ b/avahi-common/domain.c +@@ -201,7 +201,7 @@ char *avahi_normalize_name(const char *s, char *ret_s, size_t size) { + } + + if (!empty) { +- if (size < 1) ++ if (size < 2) + return NULL; + + *(r++) = '.'; +-- +2.40.0 diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch new file mode 100644 index 0000000000..e0736bf210 --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch @@ -0,0 +1,52 @@ +From 20dec84b2480821704258bc908e7b2bd2e883b24 Mon Sep 17 00:00:00 2001 +From: Evgeny Vereshchagin <evvers@ya.ru> +Date: Tue, 19 Sep 2023 03:21:25 +0000 +Subject: [PATCH] [common] bail out when escaped labels can't fit into ret + +Fixes: +``` +==93410==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f9e76f14c16 at pc 0x00000047208d bp 0x7ffee90a6a00 sp 0x7ffee90a61c8 +READ of size 1110 at 0x7f9e76f14c16 thread T0 + #0 0x47208c in __interceptor_strlen (out/fuzz-domain+0x47208c) (BuildId: 731b20c1eef22c2104e75a6496a399b10cfc7cba) + #1 0x534eb0 in avahi_strdup avahi/avahi-common/malloc.c:167:12 + #2 0x53862c in avahi_normalize_name_strdup avahi/avahi-common/domain.c:226:12 +``` +and +``` +fuzz-domain: fuzz/fuzz-domain.c:38: int LLVMFuzzerTestOneInput(const uint8_t *, size_t): Assertion `avahi_domain_equal(s, t)' failed. +==101571== ERROR: libFuzzer: deadly signal + #0 0x501175 in __sanitizer_print_stack_trace (/home/vagrant/avahi/out/fuzz-domain+0x501175) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8) + #1 0x45ad2c in fuzzer::PrintStackTrace() (/home/vagrant/avahi/out/fuzz-domain+0x45ad2c) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8) + #2 0x43fc07 in fuzzer::Fuzzer::CrashCallback() (/home/vagrant/avahi/out/fuzz-domain+0x43fc07) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8) + #3 0x7f1581d7ebaf (/lib64/libc.so.6+0x3dbaf) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #4 0x7f1581dcf883 in __pthread_kill_implementation (/lib64/libc.so.6+0x8e883) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #5 0x7f1581d7eafd in gsignal (/lib64/libc.so.6+0x3dafd) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #6 0x7f1581d6787e in abort (/lib64/libc.so.6+0x2687e) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #7 0x7f1581d6779a in __assert_fail_base.cold (/lib64/libc.so.6+0x2679a) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #8 0x7f1581d77186 in __assert_fail (/lib64/libc.so.6+0x36186) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25) + #9 0x5344a4 in LLVMFuzzerTestOneInput /home/vagrant/avahi/fuzz/fuzz-domain.c:38:9 +``` + +It's a follow-up to 94cb6489114636940ac683515417990b55b5d66c + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38470-2.patch?h=ubuntu/jammy-security +CVE: CVE-2023-38470 #Follow-up patch +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + avahi-common/domain.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +Index: avahi-0.8/avahi-common/domain.c +=================================================================== +--- avahi-0.8.orig/avahi-common/domain.c ++++ avahi-0.8/avahi-common/domain.c +@@ -210,7 +210,8 @@ char *avahi_normalize_name(const char *s + } else + empty = 0; + +- avahi_escape_label(label, strlen(label), &r, &size); ++ if (!(avahi_escape_label(label, strlen(label), &r, &size))) ++ return NULL; + } + + return ret_s; diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38471-1.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38471-1.patch new file mode 100644 index 0000000000..40b61b71dd --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38471-1.patch @@ -0,0 +1,73 @@ +From 9cd4ea89b3ac89b7bb0196fda1aa88cd51b106b6 Mon Sep 17 00:00:00 2001 +From: Michal Sekletar <msekleta@redhat.com> +Date: Mon, 23 Oct 2023 13:38:35 +0200 +Subject: [PATCH] core: extract host name using avahi_unescape_label() + +Previously we could create invalid escape sequence when we split the +string on dot. For example, from valid host name "foo\\.bar" we have +created invalid name "foo\\" and tried to set that as the host name +which crashed the daemon. + +Fixes #453 + +Upstream-Status: Backport [https://github.com/lathiat/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09] +CVE: CVE-2023-38471 + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + avahi-core/server.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/avahi-core/server.c b/avahi-core/server.c +index e507750..40f1d68 100644 +--- a/avahi-core/server.c ++++ b/avahi-core/server.c +@@ -1295,7 +1295,11 @@ static void update_fqdn(AvahiServer *s) { + } + + int avahi_server_set_host_name(AvahiServer *s, const char *host_name) { +- char *hn = NULL; ++ char label_escaped[AVAHI_LABEL_MAX*4+1]; ++ char label[AVAHI_LABEL_MAX]; ++ char *hn = NULL, *h; ++ size_t len; ++ + assert(s); + + AVAHI_CHECK_VALIDITY(s, !host_name || avahi_is_valid_host_name(host_name), AVAHI_ERR_INVALID_HOST_NAME); +@@ -1305,17 +1309,28 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) { + else + hn = avahi_normalize_name_strdup(host_name); + +- hn[strcspn(hn, ".")] = 0; ++ h = hn; ++ if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) { ++ avahi_free(h); ++ return AVAHI_ERR_INVALID_HOST_NAME; ++ } ++ ++ avahi_free(h); ++ ++ h = label_escaped; ++ len = sizeof(label_escaped); ++ if (!avahi_escape_label(label, strlen(label), &h, &len)) ++ return AVAHI_ERR_INVALID_HOST_NAME; + +- if (avahi_domain_equal(s->host_name, hn) && s->state != AVAHI_SERVER_COLLISION) { +- avahi_free(hn); ++ if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION) + return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE); +- } + + withdraw_host_rrs(s); + + avahi_free(s->host_name); +- s->host_name = hn; ++ s->host_name = avahi_strdup(label_escaped); ++ if (!s->host_name) ++ return AVAHI_ERR_NO_MEMORY; + + update_fqdn(s); + +-- +2.40.0 diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch new file mode 100644 index 0000000000..44737bfc2e --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch @@ -0,0 +1,52 @@ +From b675f70739f404342f7f78635d6e2dcd85a13460 Mon Sep 17 00:00:00 2001 +From: Evgeny Vereshchagin <evvers@ya.ru> +Date: Tue, 24 Oct 2023 22:04:51 +0000 +Subject: [PATCH] core: return errors from avahi_server_set_host_name properly + +It's a follow-up to 894f085f402e023a98cbb6f5a3d117bd88d93b09 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38471-2.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460] +CVE: CVE-2023-38471 #Follow-up Patch +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + avahi-core/server.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +Index: avahi-0.8/avahi-core/server.c +=================================================================== +--- avahi-0.8.orig/avahi-core/server.c ++++ avahi-0.8/avahi-core/server.c +@@ -1309,10 +1309,13 @@ int avahi_server_set_host_name(AvahiServ + else + hn = avahi_normalize_name_strdup(host_name); + ++ if (!hn) ++ return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY); ++ + h = hn; + if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) { + avahi_free(h); +- return AVAHI_ERR_INVALID_HOST_NAME; ++ return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME); + } + + avahi_free(h); +@@ -1320,7 +1323,7 @@ int avahi_server_set_host_name(AvahiServ + h = label_escaped; + len = sizeof(label_escaped); + if (!avahi_escape_label(label, strlen(label), &h, &len)) +- return AVAHI_ERR_INVALID_HOST_NAME; ++ return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME); + + if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION) + return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE); +@@ -1330,7 +1333,7 @@ int avahi_server_set_host_name(AvahiServ + avahi_free(s->host_name); + s->host_name = avahi_strdup(label_escaped); + if (!s->host_name) +- return AVAHI_ERR_NO_MEMORY; ++ return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY); + + update_fqdn(s); + diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch new file mode 100644 index 0000000000..85dbded73b --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch @@ -0,0 +1,46 @@ +From b024ae5749f4aeba03478e6391687c3c9c8dee40 Mon Sep 17 00:00:00 2001 +From: Michal Sekletar <msekleta@redhat.com> +Date: Thu, 19 Oct 2023 17:36:44 +0200 +Subject: [PATCH] core: make sure there is rdata to process before parsing it + +Fixes #452 + +CVE-2023-38472 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches/CVE-2023-38472.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40] +CVE: CVE-2023-38472 +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + avahi-client/client-test.c | 3 +++ + avahi-daemon/dbus-entry-group.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +Index: avahi-0.8/avahi-client/client-test.c +=================================================================== +--- avahi-0.8.orig/avahi-client/client-test.c ++++ avahi-0.8/avahi-client/client-test.c +@@ -272,6 +272,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVA + assert(error == AVAHI_ERR_INVALID_RECORD); + avahi_string_list_free(txt); + ++ error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0); ++ assert(error != AVAHI_OK); ++ + avahi_entry_group_commit (group); + + domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u"); +Index: avahi-0.8/avahi-daemon/dbus-entry-group.c +=================================================================== +--- avahi-0.8.orig/avahi-daemon/dbus-entry-group.c ++++ avahi-0.8/avahi-daemon/dbus-entry-group.c +@@ -340,7 +340,7 @@ DBusHandlerResult avahi_dbus_msg_entry_g + if (!(r = avahi_record_new_full (name, clazz, type, ttl))) + return avahi_dbus_respond_error(c, m, AVAHI_ERR_NO_MEMORY, NULL); + +- if (avahi_rdata_parse (r, rdata, size) < 0) { ++ if (!rdata || avahi_rdata_parse (r, rdata, size) < 0) { + avahi_record_unref (r); + return avahi_dbus_respond_error(c, m, AVAHI_ERR_INVALID_RDATA, NULL); + } diff --git a/meta/recipes-connectivity/avahi/files/CVE-2023-38473.patch b/meta/recipes-connectivity/avahi/files/CVE-2023-38473.patch new file mode 100644 index 0000000000..8a372a072a --- /dev/null +++ b/meta/recipes-connectivity/avahi/files/CVE-2023-38473.patch @@ -0,0 +1,108 @@ +From b448c9f771bada14ae8de175695a9729f8646797 Mon Sep 17 00:00:00 2001 +From: Michal Sekletar <msekleta@redhat.com> +Date: Wed, 11 Oct 2023 17:45:44 +0200 +Subject: [PATCH]common: derive alternative host name from its + unescaped version + +Normalization of input makes sure we don't have to deal with special +cases like unescaped dot at the end of label. + +Upstream-Status: Backport [https://github.com/lathiat/avahi/commit/b448c9f771bada14ae8de175695a9729f8646797] +CVE: CVE-2023-38473 + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + avahi-common/alternative-test.c | 3 +++ + avahi-common/alternative.c | 27 +++++++++++++++++++-------- + 2 files changed, 22 insertions(+), 8 deletions(-) + +diff --git a/avahi-common/alternative-test.c b/avahi-common/alternative-test.c +index 9255435..681fc15 100644 +--- a/avahi-common/alternative-test.c ++++ b/avahi-common/alternative-test.c +@@ -31,6 +31,9 @@ int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) { + const char* const test_strings[] = { + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXüüüüüüü", ++ ").", ++ "\\.", ++ "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\\\", + "gurke", + "-", + " #", +diff --git a/avahi-common/alternative.c b/avahi-common/alternative.c +index b3d39f0..a094e6d 100644 +--- a/avahi-common/alternative.c ++++ b/avahi-common/alternative.c +@@ -49,15 +49,20 @@ static void drop_incomplete_utf8(char *c) { + } + + char *avahi_alternative_host_name(const char *s) { ++ char label[AVAHI_LABEL_MAX], alternative[AVAHI_LABEL_MAX*4+1]; ++ char *alt, *r, *ret; + const char *e; +- char *r; ++ size_t len; + + assert(s); + + if (!avahi_is_valid_host_name(s)) + return NULL; + +- if ((e = strrchr(s, '-'))) { ++ if (!avahi_unescape_label(&s, label, sizeof(label))) ++ return NULL; ++ ++ if ((e = strrchr(label, '-'))) { + const char *p; + + e++; +@@ -74,19 +79,18 @@ char *avahi_alternative_host_name(const char *s) { + + if (e) { + char *c, *m; +- size_t l; + int n; + + n = atoi(e)+1; + if (!(m = avahi_strdup_printf("%i", n))) + return NULL; + +- l = e-s-1; ++ len = e-label-1; + +- if (l >= AVAHI_LABEL_MAX-1-strlen(m)-1) +- l = AVAHI_LABEL_MAX-1-strlen(m)-1; ++ if (len >= AVAHI_LABEL_MAX-1-strlen(m)-1) ++ len = AVAHI_LABEL_MAX-1-strlen(m)-1; + +- if (!(c = avahi_strndup(s, l))) { ++ if (!(c = avahi_strndup(label, len))) { + avahi_free(m); + return NULL; + } +@@ -100,7 +104,7 @@ char *avahi_alternative_host_name(const char *s) { + } else { + char *c; + +- if (!(c = avahi_strndup(s, AVAHI_LABEL_MAX-1-2))) ++ if (!(c = avahi_strndup(label, AVAHI_LABEL_MAX-1-2))) + return NULL; + + drop_incomplete_utf8(c); +@@ -109,6 +113,13 @@ char *avahi_alternative_host_name(const char *s) { + avahi_free(c); + } + ++ alt = alternative; ++ len = sizeof(alternative); ++ ret = avahi_escape_label(r, strlen(r), &alt, &len); ++ ++ avahi_free(r); ++ r = avahi_strdup(ret); ++ + assert(avahi_is_valid_host_name(r)); + + return r; +-- +2.40.0 diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch index ec1bc7b567..ec1bc7b567 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/0001-avoid-start-failure-with-bind-user.patch +++ b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch index 4c10f33f04..4c10f33f04 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/0001-named-lwresd-V-and-start-log-hide-build-options.patch +++ b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch index f1abd179e8..f1abd179e8 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/bind-ensure-searching-for-json-headers-searches-sysr.patch +++ b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/bind9 b/meta/recipes-connectivity/bind/bind/bind9 index 968679ff7f..968679ff7f 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/bind9 +++ b/meta/recipes-connectivity/bind/bind/bind9 diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/conf.patch b/meta/recipes-connectivity/bind/bind/conf.patch index aa3642acec..aa3642acec 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/conf.patch +++ b/meta/recipes-connectivity/bind/bind/conf.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/generate-rndc-key.sh b/meta/recipes-connectivity/bind/bind/generate-rndc-key.sh index 633e29c0e6..633e29c0e6 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/generate-rndc-key.sh +++ b/meta/recipes-connectivity/bind/bind/generate-rndc-key.sh diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch index 11db95ede1..11db95ede1 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/init.d-add-support-for-read-only-rootfs.patch +++ b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch index 146f3e35db..146f3e35db 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/make-etc-initd-bind-stop-work.patch +++ b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.10/named.service b/meta/recipes-connectivity/bind/bind/named.service index cda56ef015..cda56ef015 100644 --- a/meta/recipes-connectivity/bind/bind-9.18.10/named.service +++ b/meta/recipes-connectivity/bind/bind/named.service diff --git a/meta/recipes-connectivity/bind/bind_9.18.10.bb b/meta/recipes-connectivity/bind/bind_9.18.24.bb index 2432131f5c..fbbebe89ad 100644 --- a/meta/recipes-connectivity/bind/bind_9.18.10.bb +++ b/meta/recipes-connectivity/bind/bind_9.18.24.bb @@ -4,7 +4,7 @@ DESCRIPTION = "BIND 9 provides a full-featured Domain Name Server system" SECTION = "console/network" LICENSE = "MPL-2.0" -LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=9a4a897f202c0710e07f2f2836bc2b62" +LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=c7a0b6d9a1b692a5da9af9d503671f43" DEPENDS = "openssl libcap zlib libuv" @@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \ file://0001-avoid-start-failure-with-bind-user.patch \ " -SRC_URI[sha256sum] = "f415a92feb62568b50854a063cb231e257351f8672186d0ab031a49b3de2cac6" +SRC_URI[sha256sum] = "709d73023c9115ddad3bab65b6c8c79a590196d0d114f5d0ca2533dbd52ddf66" UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" # follow the ESV versions divisible by 2 @@ -39,7 +39,7 @@ PACKAGECONFIG[readline] = "--with-readline=readline,,readline" PACKAGECONFIG[libedit] = "--with-readline=libedit,,libedit" PACKAGECONFIG[dns-over-http] = "--enable-doh,--disable-doh,nghttp2" -EXTRA_OECONF = " --disable-devpoll --disable-auto-validation --enable-epoll \ +EXTRA_OECONF = " --disable-auto-validation \ --with-gssapi=no --with-lmdb=no --with-zlib \ --sysconfdir=${sysconfdir}/bind \ --with-openssl=${STAGING_DIR_HOST}${prefix} \ diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index a8eaba1dd6..7786b65670 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -54,6 +54,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '', 'file://0001-Allow-using-obexd-without-systemd-in-the-user-sessio.patch', d)} \ file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \ file://0001-test-gatt-Fix-hung-issue.patch \ + file://CVE-2023-45866.patch \ " S = "${WORKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/CVE-2023-45866.patch b/meta/recipes-connectivity/bluez5/bluez5/CVE-2023-45866.patch new file mode 100644 index 0000000000..5bb31d866a --- /dev/null +++ b/meta/recipes-connectivity/bluez5/bluez5/CVE-2023-45866.patch @@ -0,0 +1,56 @@ +From 25a471a83e02e1effb15d5a488b3f0085eaeb675 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> +Date: Tue, 10 Oct 2023 13:03:12 -0700 +Subject: [PATCH] input.conf: Change default of ClassicBondedOnly + +This changes the default of ClassicBondedOnly since defaulting to false +is not inline with HID specification which mandates the of Security Mode +4: + +BLUETOOTH SPECIFICATION Page 84 of 123 +Human Interface Device (HID) Profile: + + 5.4.3.4.2 Security Modes + Bluetooth HID Hosts shall use Security Mode 4 when interoperating with + Bluetooth HID devices that are compliant to the Bluetooth Core + Specification v2.1+EDR[6]. + +Upstream-Status: Backport +[https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675] + +CVE: CVE-2023-45866 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + profiles/input/device.c | 2 +- + profiles/input/input.conf | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/profiles/input/device.c b/profiles/input/device.c +index 4a50ea9..4310dd1 100644 +--- a/profiles/input/device.c ++++ b/profiles/input/device.c +@@ -81,7 +81,7 @@ struct input_device { + + static int idle_timeout = 0; + static bool uhid_enabled = false; +-static bool classic_bonded_only = false; ++static bool classic_bonded_only = true; + + void input_set_idle_timeout(int timeout) + { +diff --git a/profiles/input/input.conf b/profiles/input/input.conf +index 4c70bc5..d8645f3 100644 +--- a/profiles/input/input.conf ++++ b/profiles/input/input.conf +@@ -17,7 +17,7 @@ + # platforms may want to make sure that input connections only come from bonded + # device connections. Several older mice have been known for not supporting + # pairing/encryption. +-# Defaults to false to maximize device compatibility. ++# Defaults to true for security. + #ClassicBondedOnly=true + + # LE upgrade security +-- +2.40.0 diff --git a/meta/recipes-connectivity/connman/connman.inc b/meta/recipes-connectivity/connman/connman.inc index 5880ecd5d4..0c1dc7e5dd 100644 --- a/meta/recipes-connectivity/connman/connman.inc +++ b/meta/recipes-connectivity/connman/connman.inc @@ -27,6 +27,7 @@ EXTRA_OECONF += "\ --enable-ethernet \ --enable-tools \ --disable-polkit \ + --runstatedir=/run \ " PACKAGECONFIG ??= "wispr iptables client\ diff --git a/meta/recipes-connectivity/connman/connman/CVE-2023-28488.patch b/meta/recipes-connectivity/connman/connman/CVE-2023-28488.patch new file mode 100644 index 0000000000..a6cabdfb20 --- /dev/null +++ b/meta/recipes-connectivity/connman/connman/CVE-2023-28488.patch @@ -0,0 +1,60 @@ +From 99e2c16ea1cced34a5dc450d76287a1c3e762138 Mon Sep 17 00:00:00 2001 +From: Daniel Wagner <wagi@monom.org> +Date: Tue, 11 Apr 2023 08:12:56 +0200 +Subject: gdhcp: Verify and sanitize packet length first + +Avoid overwriting the read packet length after the initial test. Thus +move all the length checks which depends on the total length first +and do not use the total lenght from the IP packet afterwards. + +Reported by Polina Smirnova <moe.hwr@gmail.com> + +CVE: CVE-2023-28488 +Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138] +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + gdhcp/client.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/gdhcp/client.c b/gdhcp/client.c +index 3016dfc..28fa606 100644 +--- a/gdhcp/client.c ++++ b/gdhcp/client.c +@@ -1319,9 +1319,9 @@ static bool sanity_check(struct ip_udp_dhcp_packet *packet, int bytes) + static int dhcp_recv_l2_packet(struct dhcp_packet *dhcp_pkt, int fd, + struct sockaddr_in *dst_addr) + { +- int bytes; + struct ip_udp_dhcp_packet packet; + uint16_t check; ++ int bytes, tot_len; + + memset(&packet, 0, sizeof(packet)); + +@@ -1329,15 +1329,17 @@ static int dhcp_recv_l2_packet(struct dhcp_packet *dhcp_pkt, int fd, + if (bytes < 0) + return -1; + +- if (bytes < (int) (sizeof(packet.ip) + sizeof(packet.udp))) +- return -1; +- +- if (bytes < ntohs(packet.ip.tot_len)) ++ tot_len = ntohs(packet.ip.tot_len); ++ if (bytes > tot_len) { ++ /* ignore any extra garbage bytes */ ++ bytes = tot_len; ++ } else if (bytes < tot_len) { + /* packet is bigger than sizeof(packet), we did partial read */ + return -1; ++ } + +- /* ignore any extra garbage bytes */ +- bytes = ntohs(packet.ip.tot_len); ++ if (bytes < (int) (sizeof(packet.ip) + sizeof(packet.udp))) ++ return -1; + + if (!sanity_check(&packet, bytes)) + return -1; +-- +2.25.1 + diff --git a/meta/recipes-connectivity/connman/connman_1.41.bb b/meta/recipes-connectivity/connman/connman_1.41.bb index 79542b2175..27b28be41c 100644 --- a/meta/recipes-connectivity/connman/connman_1.41.bb +++ b/meta/recipes-connectivity/connman/connman_1.41.bb @@ -8,6 +8,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \ file://CVE-2022-32293_p1.patch \ file://CVE-2022-32293_p2.patch \ file://CVE-2022-32292.patch \ + file://CVE-2023-28488.patch \ " SRC_URI:append:libc-musl = " file://0002-resolve-musl-does-not-implement-res_ninit.patch" diff --git a/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb b/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb index 5cf77fa0f6..21b2eebbd8 100644 --- a/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb +++ b/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb @@ -9,18 +9,19 @@ HOMEPAGE = "http://roy.marples.name/projects/dhcpcd/" LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=d148485768fe85b9f1072b186a7e9b4d" -UPSTREAM_CHECK_URI = "https://roy.marples.name/downloads/dhcpcd/" - -SRC_URI = "https://roy.marples.name/downloads/${BPN}/${BPN}-${PV}.tar.xz \ +SRC_URI = "git://github.com/NetworkConfiguration/dhcpcd;protocol=https;branch=dhcpcd-9 \ file://0001-remove-INCLUDEDIR-to-prevent-build-issues.patch \ file://0001-20-resolv.conf-improve-the-sitation-of-working-with-.patch \ file://0001-privsep-Allow-getrandom-sysctl-for-newer-glibc.patch \ file://0002-privsep-Allow-newfstatat-syscall-as-well.patch \ + file://0001-privsep-linux-fix-SECCOMP_AUDIT_ARCH-missing-ppc64le.patch \ file://dhcpcd.service \ file://dhcpcd@.service \ + file://0001-dhcpcd.8-Fix-conflict-error-when-enable-multilib.patch \ " -SRC_URI[sha256sum] = "819357634efed1ea5cf44ec01b24d3d3f8852fec8b4249925dcc5667c54e376c" +SRCREV = "3c458fc7fa4146029a1e4f9e98cd7e7adf03081a" +S = "${WORKDIR}/git" inherit pkgconfig autotools-brokensep systemd useradd diff --git a/meta/recipes-connectivity/dhcpcd/files/0001-dhcpcd.8-Fix-conflict-error-when-enable-multilib.patch b/meta/recipes-connectivity/dhcpcd/files/0001-dhcpcd.8-Fix-conflict-error-when-enable-multilib.patch new file mode 100644 index 0000000000..12998aada4 --- /dev/null +++ b/meta/recipes-connectivity/dhcpcd/files/0001-dhcpcd.8-Fix-conflict-error-when-enable-multilib.patch @@ -0,0 +1,46 @@ +From 4915a7e52fcea8fe283a842890a1e726b1e26b10 Mon Sep 17 00:00:00 2001 +From: Lei Maohui <leimaohui@fujitsu.com> +Date: Fri, 10 Mar 2023 03:48:46 +0000 +Subject: [PATCH] dhcpcd.8: Fix conflict error when enable multilib. + +Error: Transaction test error: + file /usr/share/man/man8/dhcpcd.8 conflicts between attempted + installs of dhcpcd-doc-9.4.1-r0.cortexa57 and + lib32-dhcpcd-doc-9.4.1-r0.armv7ahf_neon + +The differences between the two files are as follows: +@@ -821,7 +821,7 @@ + If you always use the same options, put them here. + .It Pa /usr/libexec/dhcpcd-run-hooks + Bourne shell script that is run to configure or de-configure an interface. +-.It Pa /usr/lib64/dhcpcd/dev ++.It Pa /usr/lib/dhcpcd/dev + Linux + .Pa /dev + management modules. + +It is just a man file, there is no necessary to manage multiple +versions. + +Upstream-Status: Inappropriate [oe specific] +Signed-off-by: Lei Maohui <leimaohui@fujitsu.com> +--- + src/dhcpcd.8.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/dhcpcd.8.in b/src/dhcpcd.8.in +index bc6b3b5..791f2ba 100644 +--- a/src/dhcpcd.8.in ++++ b/src/dhcpcd.8.in +@@ -821,7 +821,7 @@ Configuration file for dhcpcd. + If you always use the same options, put them here. + .It Pa @SCRIPT@ + Bourne shell script that is run to configure or de-configure an interface. +-.It Pa @LIBDIR@/dhcpcd/dev ++.It Pa /usr/<libdir>/dhcpcd/dev + Linux + .Pa /dev + management modules. +-- +2.34.1 + diff --git a/meta/recipes-connectivity/dhcpcd/files/0001-privsep-linux-fix-SECCOMP_AUDIT_ARCH-missing-ppc64le.patch b/meta/recipes-connectivity/dhcpcd/files/0001-privsep-linux-fix-SECCOMP_AUDIT_ARCH-missing-ppc64le.patch new file mode 100644 index 0000000000..1c514f9b8c --- /dev/null +++ b/meta/recipes-connectivity/dhcpcd/files/0001-privsep-linux-fix-SECCOMP_AUDIT_ARCH-missing-ppc64le.patch @@ -0,0 +1,34 @@ +From 7a2d9767585ed2c407d4985bd2d81552034fb90a Mon Sep 17 00:00:00 2001 +From: CHEN Xiangyu <xiangyu.chen@aol.com> +Date: Thu, 9 Feb 2023 18:41:52 +0800 +Subject: [PATCH] privsep-linux: fix SECCOMP_AUDIT_ARCH missing ppc64le (#181) + +when dhcpcd running on ppc64le platform, it would be killed by SIGSYS. + +Upstream-Status: Backport [7a2d9767585ed2c407d4985bd2d81552034fb90a] + +Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> +--- + src/privsep-linux.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/privsep-linux.c b/src/privsep-linux.c +index 7372d26b..6a301950 100644 +--- a/src/privsep-linux.c ++++ b/src/privsep-linux.c +@@ -232,7 +232,11 @@ ps_root_sendnetlink(struct dhcpcd_ctx *ctx, int protocol, struct msghdr *msg) + #elif defined(__or1k__) + # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_OPENRISC + #elif defined(__powerpc64__) +-# define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PPC64 ++# if (BYTE_ORDER == LITTLE_ENDIAN) ++# define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PPC64LE ++# else ++# define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PPC64 ++# endif + #elif defined(__powerpc__) + # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PPC + #elif defined(__riscv) +-- +2.34.1 + diff --git a/meta/recipes-connectivity/inetutils/inetutils/0001-CVE-2023-40303-ftpd-rcp-rlogin-rsh-rshd-uucpd-fix-ch.patch b/meta/recipes-connectivity/inetutils/inetutils/0001-CVE-2023-40303-ftpd-rcp-rlogin-rsh-rshd-uucpd-fix-ch.patch new file mode 100644 index 0000000000..7f5baf3637 --- /dev/null +++ b/meta/recipes-connectivity/inetutils/inetutils/0001-CVE-2023-40303-ftpd-rcp-rlogin-rsh-rshd-uucpd-fix-ch.patch @@ -0,0 +1,280 @@ +From 703418fe9d2e3b1e8d594df5788d8001a8116265 Mon Sep 17 00:00:00 2001 +From: Jeffrey Bencteux <jeffbencteux@gmail.com> +Date: Fri, 30 Jun 2023 19:02:45 +0200 +Subject: [PATCH] CVE-2023-40303: ftpd,rcp,rlogin,rsh,rshd,uucpd: fix: check + set*id() return values + +Several setuid(), setgid(), seteuid() and setguid() return values +were not checked in ftpd/rcp/rlogin/rsh/rshd/uucpd code potentially +leading to potential security issues. + +CVE: CVE-2023-40303 +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6] +Signed-off-by: Jeffrey Bencteux <jeffbencteux@gmail.com> +Signed-off-by: Simon Josefsson <simon@josefsson.org> +Signed-off-by: Khem Raj <raj.khem@gmail.com> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + ftpd/ftpd.c | 10 +++++++--- + src/rcp.c | 39 +++++++++++++++++++++++++++++++++------ + src/rlogin.c | 11 +++++++++-- + src/rsh.c | 25 +++++++++++++++++++++---- + src/rshd.c | 20 +++++++++++++++++--- + src/uucpd.c | 15 +++++++++++++-- + 6 files changed, 100 insertions(+), 20 deletions(-) + +diff --git a/ftpd/ftpd.c b/ftpd/ftpd.c +index 92b2cca5..28dd523f 100644 +--- a/ftpd/ftpd.c ++++ b/ftpd/ftpd.c +@@ -862,7 +862,9 @@ end_login (struct credentials *pcred) + char *remotehost = pcred->remotehost; + int atype = pcred->auth_type; + +- seteuid ((uid_t) 0); ++ if (seteuid ((uid_t) 0) == -1) ++ _exit (EXIT_FAILURE); ++ + if (pcred->logged_in) + { + logwtmp_keep_open (ttyline, "", ""); +@@ -1151,7 +1153,8 @@ getdatasock (const char *mode) + + if (data >= 0) + return fdopen (data, mode); +- seteuid ((uid_t) 0); ++ if (seteuid ((uid_t) 0) == -1) ++ _exit (EXIT_FAILURE); + s = socket (ctrl_addr.ss_family, SOCK_STREAM, 0); + if (s < 0) + goto bad; +@@ -1978,7 +1981,8 @@ passive (int epsv, int af) + else /* !AF_INET6 */ + ((struct sockaddr_in *) &pasv_addr)->sin_port = 0; + +- seteuid ((uid_t) 0); ++ if (seteuid ((uid_t) 0) == -1) ++ _exit (EXIT_FAILURE); + if (bind (pdata, (struct sockaddr *) &pasv_addr, pasv_addrlen) < 0) + { + if (seteuid ((uid_t) cred.uid)) +diff --git a/src/rcp.c b/src/rcp.c +index 75adb253..cdcf8500 100644 +--- a/src/rcp.c ++++ b/src/rcp.c +@@ -345,14 +345,23 @@ main (int argc, char *argv[]) + if (from_option) + { /* Follow "protocol", send data. */ + response (); +- setuid (userid); ++ ++ if (setuid (userid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); ++ } ++ + source (argc, argv); + exit (errs); + } + + if (to_option) + { /* Receive data. */ +- setuid (userid); ++ if (setuid (userid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); ++ } ++ + sink (argc, argv); + exit (errs); + } +@@ -537,7 +546,11 @@ toremote (char *targ, int argc, char *argv[]) + if (response () < 0) + exit (EXIT_FAILURE); + free (bp); +- setuid (userid); ++ ++ if (setuid (userid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); ++ } + } + source (1, argv + i); + close (rem); +@@ -630,7 +643,12 @@ tolocal (int argc, char *argv[]) + ++errs; + continue; + } +- seteuid (userid); ++ ++ if (seteuid (userid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (seteuid() failed)"); ++ } ++ + #if defined IP_TOS && defined IPPROTO_IP && defined IPTOS_THROUGHPUT + sslen = sizeof (ss); + (void) getpeername (rem, (struct sockaddr *) &ss, &sslen); +@@ -643,7 +661,12 @@ tolocal (int argc, char *argv[]) + #endif + vect[0] = target; + sink (1, vect); +- seteuid (effuid); ++ ++ if (seteuid (effuid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (seteuid() failed)"); ++ } ++ + close (rem); + rem = -1; + #ifdef SHISHI +@@ -1441,7 +1464,11 @@ susystem (char *s, int userid) + return (127); + + case 0: +- setuid (userid); ++ if (setuid (userid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); ++ } ++ + execl (PATH_BSHELL, "sh", "-c", s, NULL); + _exit (127); + } +diff --git a/src/rlogin.c b/src/rlogin.c +index aa6426fb..c543de0c 100644 +--- a/src/rlogin.c ++++ b/src/rlogin.c +@@ -647,8 +647,15 @@ try_connect: + /* Now change to the real user ID. We have to be set-user-ID root + to get the privileged port that rcmd () uses. We now want, however, + to run as the real user who invoked us. */ +- seteuid (uid); +- setuid (uid); ++ if (seteuid (uid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (seteuid() failed)"); ++ } ++ ++ if (setuid (uid) == -1) ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); ++ } + + doit (&osmask); /* The old mask will activate SIGURG and SIGUSR1! */ + +diff --git a/src/rsh.c b/src/rsh.c +index 2d622ca4..6f60667d 100644 +--- a/src/rsh.c ++++ b/src/rsh.c +@@ -276,8 +276,17 @@ main (int argc, char **argv) + { + if (asrsh) + *argv = (char *) "rlogin"; +- seteuid (getuid ()); +- setuid (getuid ()); ++ ++ if (seteuid (getuid ()) == -1) ++ { ++ error (EXIT_FAILURE, errno, "seteuid() failed"); ++ } ++ ++ if (setuid (getuid ()) == -1) ++ { ++ error (EXIT_FAILURE, errno, "setuid() failed"); ++ } ++ + execv (PATH_RLOGIN, argv); + error (EXIT_FAILURE, errno, "cannot execute %s", PATH_RLOGIN); + } +@@ -541,8 +550,16 @@ try_connect: + error (0, errno, "setsockopt DEBUG (ignored)"); + } + +- seteuid (uid); +- setuid (uid); ++ if (seteuid (uid) == -1) ++ { ++ error (EXIT_FAILURE, errno, "seteuid() failed"); ++ } ++ ++ if (setuid (uid) == -1) ++ { ++ error (EXIT_FAILURE, errno, "setuid() failed"); ++ } ++ + #ifdef HAVE_SIGACTION + sigemptyset (&sigs); + sigaddset (&sigs, SIGINT); +diff --git a/src/rshd.c b/src/rshd.c +index d1c0d0cd..707790e7 100644 +--- a/src/rshd.c ++++ b/src/rshd.c +@@ -1847,8 +1847,18 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen) + pwd->pw_shell = PATH_BSHELL; + + /* Set the gid, then uid to become the user specified by "locuser" */ +- setegid ((gid_t) pwd->pw_gid); +- setgid ((gid_t) pwd->pw_gid); ++ if (setegid ((gid_t) pwd->pw_gid) == -1) ++ { ++ rshd_error ("Cannot drop privileges (setegid() failed)\n"); ++ exit (EXIT_FAILURE); ++ } ++ ++ if (setgid ((gid_t) pwd->pw_gid) == -1) ++ { ++ rshd_error ("Cannot drop privileges (setgid() failed)\n"); ++ exit (EXIT_FAILURE); ++ } ++ + #ifdef HAVE_INITGROUPS + initgroups (pwd->pw_name, pwd->pw_gid); /* BSD groups */ + #endif +@@ -1870,7 +1880,11 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen) + } + #endif /* WITH_PAM */ + +- setuid ((uid_t) pwd->pw_uid); ++ if (setuid ((uid_t) pwd->pw_uid) == -1) ++ { ++ rshd_error ("Cannot drop privileges (setuid() failed)\n"); ++ exit (EXIT_FAILURE); ++ } + + /* We'll execute the client's command in the home directory + * of locuser. Note, that the chdir must be executed after +diff --git a/src/uucpd.c b/src/uucpd.c +index 107589e1..29cfce35 100644 +--- a/src/uucpd.c ++++ b/src/uucpd.c +@@ -252,7 +252,12 @@ doit (struct sockaddr *sap, socklen_t salen) + snprintf (Username, sizeof (Username), "USER=%s", user); + snprintf (Logname, sizeof (Logname), "LOGNAME=%s", user); + dologin (pw, sap, salen); +- setgid (pw->pw_gid); ++ ++ if (setgid (pw->pw_gid) == -1) ++ { ++ fprintf (stderr, "setgid() failed"); ++ return; ++ } + #ifdef HAVE_INITGROUPS + initgroups (pw->pw_name, pw->pw_gid); + #endif +@@ -261,7 +266,13 @@ doit (struct sockaddr *sap, socklen_t salen) + fprintf (stderr, "Login incorrect."); + return; + } +- setuid (pw->pw_uid); ++ ++ if (setuid (pw->pw_uid) == -1) ++ { ++ fprintf (stderr, "setuid() failed"); ++ return; ++ } ++ + execl (uucico_location, "uucico", NULL); + perror ("uucico server: execl"); + } diff --git a/meta/recipes-connectivity/inetutils/inetutils/0002-CVE-2023-40303-Indent-changes-in-previous-commit.patch b/meta/recipes-connectivity/inetutils/inetutils/0002-CVE-2023-40303-Indent-changes-in-previous-commit.patch new file mode 100644 index 0000000000..4bc354d256 --- /dev/null +++ b/meta/recipes-connectivity/inetutils/inetutils/0002-CVE-2023-40303-Indent-changes-in-previous-commit.patch @@ -0,0 +1,254 @@ +From 70fe022f9dac760eaece0228cad17e3d29a57fb8 Mon Sep 17 00:00:00 2001 +From: Simon Josefsson <simon@josefsson.org> +Date: Mon, 31 Jul 2023 13:59:05 +0200 +Subject: [PATCH] CVE-2023-40303: Indent changes in previous commit. + +CVE: CVE-2023-40303 +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=9122999252c7e21eb7774de11d539748e7bdf46d] +Signed-off-by: Khem Raj <raj.khem@gmail.com> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + src/rcp.c | 42 ++++++++++++++++++++++++------------------ + src/rlogin.c | 12 ++++++------ + src/rsh.c | 24 ++++++++++++------------ + src/rshd.c | 24 ++++++++++++------------ + src/uucpd.c | 16 ++++++++-------- + 5 files changed, 62 insertions(+), 56 deletions(-) + +diff --git a/src/rcp.c b/src/rcp.c +index cdcf8500..652f22e6 100644 +--- a/src/rcp.c ++++ b/src/rcp.c +@@ -347,9 +347,10 @@ main (int argc, char *argv[]) + response (); + + if (setuid (userid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, ++ "Could not drop privileges (setuid() failed)"); ++ } + + source (argc, argv); + exit (errs); +@@ -358,9 +359,10 @@ main (int argc, char *argv[]) + if (to_option) + { /* Receive data. */ + if (setuid (userid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, ++ "Could not drop privileges (setuid() failed)"); ++ } + + sink (argc, argv); + exit (errs); +@@ -548,9 +550,10 @@ toremote (char *targ, int argc, char *argv[]) + free (bp); + + if (setuid (userid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, ++ "Could not drop privileges (setuid() failed)"); ++ } + } + source (1, argv + i); + close (rem); +@@ -645,9 +648,10 @@ tolocal (int argc, char *argv[]) + } + + if (seteuid (userid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (seteuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, ++ "Could not drop privileges (seteuid() failed)"); ++ } + + #if defined IP_TOS && defined IPPROTO_IP && defined IPTOS_THROUGHPUT + sslen = sizeof (ss); +@@ -663,9 +667,10 @@ tolocal (int argc, char *argv[]) + sink (1, vect); + + if (seteuid (effuid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (seteuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, ++ "Could not drop privileges (seteuid() failed)"); ++ } + + close (rem); + rem = -1; +@@ -1465,9 +1470,10 @@ susystem (char *s, int userid) + + case 0: + if (setuid (userid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, ++ "Could not drop privileges (setuid() failed)"); ++ } + + execl (PATH_BSHELL, "sh", "-c", s, NULL); + _exit (127); +diff --git a/src/rlogin.c b/src/rlogin.c +index c543de0c..4360202f 100644 +--- a/src/rlogin.c ++++ b/src/rlogin.c +@@ -648,14 +648,14 @@ try_connect: + to get the privileged port that rcmd () uses. We now want, however, + to run as the real user who invoked us. */ + if (seteuid (uid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (seteuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (seteuid() failed)"); ++ } + + if (setuid (uid) == -1) +- { +- error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); +- } ++ { ++ error (EXIT_FAILURE, 0, "Could not drop privileges (setuid() failed)"); ++ } + + doit (&osmask); /* The old mask will activate SIGURG and SIGUSR1! */ + +diff --git a/src/rsh.c b/src/rsh.c +index 6f60667d..179b47cd 100644 +--- a/src/rsh.c ++++ b/src/rsh.c +@@ -278,14 +278,14 @@ main (int argc, char **argv) + *argv = (char *) "rlogin"; + + if (seteuid (getuid ()) == -1) +- { +- error (EXIT_FAILURE, errno, "seteuid() failed"); +- } ++ { ++ error (EXIT_FAILURE, errno, "seteuid() failed"); ++ } + + if (setuid (getuid ()) == -1) +- { +- error (EXIT_FAILURE, errno, "setuid() failed"); +- } ++ { ++ error (EXIT_FAILURE, errno, "setuid() failed"); ++ } + + execv (PATH_RLOGIN, argv); + error (EXIT_FAILURE, errno, "cannot execute %s", PATH_RLOGIN); +@@ -551,14 +551,14 @@ try_connect: + } + + if (seteuid (uid) == -1) +- { +- error (EXIT_FAILURE, errno, "seteuid() failed"); +- } ++ { ++ error (EXIT_FAILURE, errno, "seteuid() failed"); ++ } + + if (setuid (uid) == -1) +- { +- error (EXIT_FAILURE, errno, "setuid() failed"); +- } ++ { ++ error (EXIT_FAILURE, errno, "setuid() failed"); ++ } + + #ifdef HAVE_SIGACTION + sigemptyset (&sigs); +diff --git a/src/rshd.c b/src/rshd.c +index 707790e7..3a153a18 100644 +--- a/src/rshd.c ++++ b/src/rshd.c +@@ -1848,16 +1848,16 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen) + + /* Set the gid, then uid to become the user specified by "locuser" */ + if (setegid ((gid_t) pwd->pw_gid) == -1) +- { +- rshd_error ("Cannot drop privileges (setegid() failed)\n"); +- exit (EXIT_FAILURE); +- } ++ { ++ rshd_error ("Cannot drop privileges (setegid() failed)\n"); ++ exit (EXIT_FAILURE); ++ } + + if (setgid ((gid_t) pwd->pw_gid) == -1) +- { +- rshd_error ("Cannot drop privileges (setgid() failed)\n"); +- exit (EXIT_FAILURE); +- } ++ { ++ rshd_error ("Cannot drop privileges (setgid() failed)\n"); ++ exit (EXIT_FAILURE); ++ } + + #ifdef HAVE_INITGROUPS + initgroups (pwd->pw_name, pwd->pw_gid); /* BSD groups */ +@@ -1881,10 +1881,10 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen) + #endif /* WITH_PAM */ + + if (setuid ((uid_t) pwd->pw_uid) == -1) +- { +- rshd_error ("Cannot drop privileges (setuid() failed)\n"); +- exit (EXIT_FAILURE); +- } ++ { ++ rshd_error ("Cannot drop privileges (setuid() failed)\n"); ++ exit (EXIT_FAILURE); ++ } + + /* We'll execute the client's command in the home directory + * of locuser. Note, that the chdir must be executed after +diff --git a/src/uucpd.c b/src/uucpd.c +index 29cfce35..fde7b9c9 100644 +--- a/src/uucpd.c ++++ b/src/uucpd.c +@@ -254,10 +254,10 @@ doit (struct sockaddr *sap, socklen_t salen) + dologin (pw, sap, salen); + + if (setgid (pw->pw_gid) == -1) +- { +- fprintf (stderr, "setgid() failed"); +- return; +- } ++ { ++ fprintf (stderr, "setgid() failed"); ++ return; ++ } + #ifdef HAVE_INITGROUPS + initgroups (pw->pw_name, pw->pw_gid); + #endif +@@ -268,10 +268,10 @@ doit (struct sockaddr *sap, socklen_t salen) + } + + if (setuid (pw->pw_uid) == -1) +- { +- fprintf (stderr, "setuid() failed"); +- return; +- } ++ { ++ fprintf (stderr, "setuid() failed"); ++ return; ++ } + + execl (uucico_location, "uucico", NULL); + perror ("uucico server: execl"); diff --git a/meta/recipes-connectivity/inetutils/inetutils_2.2.bb b/meta/recipes-connectivity/inetutils/inetutils_2.2.bb index d8062e2b21..6f9173dbc1 100644 --- a/meta/recipes-connectivity/inetutils/inetutils_2.2.bb +++ b/meta/recipes-connectivity/inetutils/inetutils_2.2.bb @@ -22,6 +22,8 @@ SRC_URI = "${GNU_MIRROR}/inetutils/inetutils-${PV}.tar.xz \ file://inetutils-1.9-PATH_PROCNET_DEV.patch \ file://inetutils-only-check-pam_appl.h-when-pam-enabled.patch \ file://CVE-2022-39028.patch \ + file://0001-CVE-2023-40303-ftpd-rcp-rlogin-rsh-rshd-uucpd-fix-ch.patch \ + file://0002-CVE-2023-40303-Indent-changes-in-previous-commit.patch \ " inherit autotools gettext update-alternatives texinfo diff --git a/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-1.patch b/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-1.patch new file mode 100644 index 0000000000..d263cced8d --- /dev/null +++ b/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-1.patch @@ -0,0 +1,56 @@ +From b8ee33667d265b936d60ee7f0ba0b22463ccb019 Mon Sep 17 00:00:00 2001 +From: Ben Noordhuis <info@bnoordhuis.nl> +Date: Thu, 18 Jan 2024 14:51:40 +0100 +Subject: [PATCH] fix: always zero-terminate idna output + +Upstream-Status: Backport [https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629] +CVE: CVE-2024-24806 + +Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 +Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> +--- + src/idna.c | 5 +++-- + test/test-idna.c | 4 ++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/idna.c b/src/idna.c +index 93d982ca..ce7f2746 100644 +--- a/src/idna.c ++++ b/src/idna.c +@@ -308,8 +308,9 @@ long uv__idna_toascii(const char* s, const char* se, char* d, char* de) { + return rc; + } + +- if (d < de) +- *d++ = '\0'; ++ if (d >= de) ++ return UV_EINVAL; + ++ *d++ = '\0'; + return d - ds; /* Number of bytes written. */ + } +diff --git a/test/test-idna.c b/test/test-idna.c +index f4fad965..d079be55 100644 +--- a/test/test-idna.c ++++ b/test/test-idna.c +@@ -99,6 +99,7 @@ TEST_IMPL(utf8_decode1) { + TEST_IMPL(utf8_decode1_overrun) { + const char* p; + char b[1]; ++ char c[1]; + + /* Single byte. */ + p = b; +@@ -112,6 +113,9 @@ TEST_IMPL(utf8_decode1_overrun) { + ASSERT_EQ((unsigned) -1, uv__utf8_decode1(&p, b + 1)); + ASSERT_EQ(p, b + 1); + ++ b[0] = 0x7F; ++ ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 1, c, c + 1)); ++ + return 0; + } + +-- +2.43.0 + diff --git a/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-2.patch b/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-2.patch new file mode 100644 index 0000000000..b0ed5f0ea2 --- /dev/null +++ b/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-2.patch @@ -0,0 +1,44 @@ +From 96f881c8f600da33ec4ecec450ec491990ce613b Mon Sep 17 00:00:00 2001 +From: Ben Noordhuis <info@bnoordhuis.nl> +Date: Thu, 18 Jan 2024 14:52:38 +0100 +Subject: [PATCH] fix: reject zero-length idna inputs + +Upstream-Status: Backport [https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70] +CVE: CVE-2024-24806 + +Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 +Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> +--- + src/idna.c | 3 +++ + test/test-idna.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/src/idna.c b/src/idna.c +index ce7f2746..858b19d0 100644 +--- a/src/idna.c ++++ b/src/idna.c +@@ -274,6 +274,9 @@ long uv__idna_toascii(const char* s, const char* se, char* d, char* de) { + char* ds; + int rc; + ++ if (s == se) ++ return UV_EINVAL; ++ + ds = d; + + si = s; +diff --git a/test/test-idna.c b/test/test-idna.c +index d079be55..d59b521e 100644 +--- a/test/test-idna.c ++++ b/test/test-idna.c +@@ -114,6 +114,7 @@ TEST_IMPL(utf8_decode1_overrun) { + ASSERT_EQ(p, b + 1); + + b[0] = 0x7F; ++ ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 0, c, c + 1)); + ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 1, c, c + 1)); + + return 0; +-- +2.43.0 + diff --git a/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-3.patch b/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-3.patch new file mode 100644 index 0000000000..733660cf05 --- /dev/null +++ b/meta/recipes-connectivity/libuv/libuv/CVE-2024-24806-3.patch @@ -0,0 +1,31 @@ +From a7443ee6b3b3c6a12708148aa9bb001b7782905c Mon Sep 17 00:00:00 2001 +From: Santiago Gimeno <santiago.gimeno@gmail.com> +Date: Wed, 7 Feb 2024 20:27:58 +0100 +Subject: [PATCH] test: empty strings are not valid IDNA + +Upstream-Status: Backport [https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39] +CVE: CVE-2024-24806 + +Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 +Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> +--- + test/test-idna.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/test/test-idna.c b/test/test-idna.c +index d59b521e..37da38de 100644 +--- a/test/test-idna.c ++++ b/test/test-idna.c +@@ -150,8 +150,8 @@ TEST_IMPL(idna_toascii) { + /* Illegal inputs. */ + F("\xC0\x80\xC1\x80", UV_EINVAL); /* Overlong UTF-8 sequence. */ + F("\xC0\x80\xC1\x80.com", UV_EINVAL); /* Overlong UTF-8 sequence. */ ++ F("", UV_EINVAL); + /* No conversion. */ +- T("", ""); + T(".", "."); + T(".com", ".com"); + T("example", "example"); +-- +2.43.0 + diff --git a/meta/recipes-connectivity/libuv/libuv_1.44.2.bb b/meta/recipes-connectivity/libuv/libuv_1.44.2.bb index 27e79276b5..e2cd3c3247 100644 --- a/meta/recipes-connectivity/libuv/libuv_1.44.2.bb +++ b/meta/recipes-connectivity/libuv/libuv_1.44.2.bb @@ -6,7 +6,11 @@ LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE;md5=ad93ca1fffe931537fcf64f6fcce084d" SRCREV = "0c1fa696aa502eb749c2c4735005f41ba00a27b8" -SRC_URI = "git://github.com/libuv/libuv.git;branch=v1.x;protocol=https" +SRC_URI = "git://github.com/libuv/libuv.git;branch=v1.x;protocol=https \ + file://CVE-2024-24806-1.patch \ + file://CVE-2024-24806-2.patch \ + file://CVE-2024-24806-3.patch \ + " UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)" S = "${WORKDIR}/git" diff --git a/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb b/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb index e802bcee18..a4030b7b32 100644 --- a/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb +++ b/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb @@ -5,8 +5,8 @@ SECTION = "network" LICENSE = "PD" LIC_FILES_CHKSUM = "file://COPYING;md5=87964579b2a8ece4bc6744d2dc9a8b04" -SRCREV = "22a5de3ef637990ce03141f786fbdb327e9c5a3f" -PV = "20221107" +SRCREV = "aae7c68671d225e6d35224613d5b98192b9b2ffe" +PV = "20230416" PE = "1" SRC_URI = "git://gitlab.gnome.org/GNOME/mobile-broadband-provider-info.git;protocol=https;branch=main" diff --git a/meta/recipes-connectivity/openssh/openssh/0001-upstream-include-destination-constraints-for-smartca.patch b/meta/recipes-connectivity/openssh/openssh/0001-upstream-include-destination-constraints-for-smartca.patch new file mode 100644 index 0000000000..b4e7ce7ef6 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/0001-upstream-include-destination-constraints-for-smartca.patch @@ -0,0 +1,35 @@ +From 91889b5a3e7554af474a21ce8e1ffd3eb1542f06 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Thu, 9 Mar 2023 06:58:26 +0000 +Subject: [PATCH] upstream: include destination constraints for smartcard keys + too. + +Spotted by Luci Stanescu; ok deraadt@ markus@ + +OpenBSD-Commit-ID: add879fac6903a1cb1d1e42c4309e5359c3d870f + +CVE: CVE-2023-28531 + +Upstream-Status: Backport [54ac4ab2b53ce9fcb66b8250dee91c070e4167ed] + +Signed-off-by: Chen Qi <Qi.Chen@windriver.com> +--- + authfd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/authfd.c b/authfd.c +index 76e48aab..dca8e55b 100644 +--- a/authfd.c ++++ b/authfd.c +@@ -665,7 +665,7 @@ ssh_update_card(int sock, int add, const char *reader_id, const char *pin, + struct dest_constraint **dest_constraints, size_t ndest_constraints) + { + struct sshbuf *msg; +- int r, constrained = (life || confirm); ++ int r, constrained = (life || confirm || dest_constraints); + u_char type; + + if (add) { +-- +2.37.1 + diff --git a/meta/recipes-connectivity/openssh/openssh/7280401bdd77ca54be6867a154cc01e0d72612e0.patch b/meta/recipes-connectivity/openssh/openssh/7280401bdd77ca54be6867a154cc01e0d72612e0.patch new file mode 100644 index 0000000000..ebdff1ffe4 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/7280401bdd77ca54be6867a154cc01e0d72612e0.patch @@ -0,0 +1,984 @@ +From 7280401bdd77ca54be6867a154cc01e0d72612e0 Mon Sep 17 00:00:00 2001 +From: Damien Miller <djm@mindrot.org> +Date: Fri, 24 Mar 2023 13:56:25 +1100 +Subject: [PATCH] remove support for old libcrypto + +OpenSSH now requires LibreSSL 3.1.0 or greater or +OpenSSL 1.1.1 or greater + +with/ok dtucker@ + +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/7280401bdd77ca54be6867a154cc01e0d72612e0] +Comment: Hunk are refreshed, removed couple of hunks from configure.ac as hunk code is not prasent +and backported to the existing code. +Signed-off-by: Riyaz Khan <Riyaz.Khan@kpit.com> + +--- + .github/workflows/c-cpp.yml | 7 - + INSTALL | 8 +- + cipher-aes.c | 2 +- + configure.ac | 96 ++--- + openbsd-compat/libressl-api-compat.c | 556 +-------------------------- + openbsd-compat/openssl-compat.h | 151 +------- + 6 files changed, 40 insertions(+), 780 deletions(-) + +diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml +index 3d9aa22dba5..d299a32468d 100644 +--- a/.github/workflows/c-cpp.yml ++++ b/.github/workflows/c-cpp.yml +@@ -40,18 +40,11 @@ + - { os: ubuntu-20.04, configs: tcmalloc } + - { os: ubuntu-20.04, configs: musl } + - { os: ubuntu-latest, configs: libressl-master } +- - { os: ubuntu-latest, configs: libressl-2.2.9 } +- - { os: ubuntu-latest, configs: libressl-2.8.3 } +- - { os: ubuntu-latest, configs: libressl-3.0.2 } + - { os: ubuntu-latest, configs: libressl-3.2.6 } + - { os: ubuntu-latest, configs: libressl-3.3.4 } + - { os: ubuntu-latest, configs: libressl-3.4.1 } + - { os: ubuntu-latest, configs: openssl-master } + - { os: ubuntu-latest, configs: openssl-noec } +- - { os: ubuntu-latest, configs: openssl-1.0.1 } +- - { os: ubuntu-latest, configs: openssl-1.0.1u } +- - { os: ubuntu-latest, configs: openssl-1.0.2u } +- - { os: ubuntu-latest, configs: openssl-1.1.0h } + - { os: ubuntu-latest, configs: openssl-1.1.1 } + - { os: ubuntu-latest, configs: openssl-1.1.1k } + - { os: ubuntu-latest, configs: openssl-3.0.0 } +diff --git a/INSTALL b/INSTALL +index 68b15e13190..f99d1e2a809 100644 +--- a/INSTALL ++++ b/INSTALL +@@ -21,12 +21,8 @@ https://zlib.net/ + + libcrypto from either of LibreSSL or OpenSSL. Building without libcrypto + is supported but severely restricts the available ciphers and algorithms. +- - LibreSSL (https://www.libressl.org/) +- - OpenSSL (https://www.openssl.org) with any of the following versions: +- - 1.0.x >= 1.0.1 or 1.1.0 >= 1.1.0g or any 1.1.1 +- +-Note that due to a bug in EVP_CipherInit OpenSSL 1.1 versions prior to +-1.1.0g can't be used. ++ - LibreSSL (https://www.libressl.org/) 3.1.0 or greater ++ - OpenSSL (https://www.openssl.org) 1.1.1 or greater + + LibreSSL/OpenSSL should be compiled as a position-independent library + (i.e. -fPIC, eg by configuring OpenSSL as "./config [options] -fPIC" +diff --git a/cipher-aes.c b/cipher-aes.c +index 8b101727284..87c763353d8 100644 +--- a/cipher-aes.c ++++ b/cipher-aes.c +@@ -69,7 +69,7 @@ ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, + + static int + ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, +- LIBCRYPTO_EVP_INL_TYPE len) ++ size_t len) + { + struct ssh_rijndael_ctx *c; + u_char buf[RIJNDAEL_BLOCKSIZE]; +diff --git a/configure.ac b/configure.ac +index 22fee70f604..1c0ccdf19c5 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2744,42 +2744,40 @@ + #include <openssl/crypto.h> + #define DATA "conftest.ssllibver" + ]], [[ +- FILE *fd; +- int rc; ++ FILE *f; + +- fd = fopen(DATA,"w"); +- if(fd == NULL) ++ if ((f = fopen(DATA, "w")) == NULL) + exit(1); +-#ifndef OPENSSL_VERSION +-# define OPENSSL_VERSION SSLEAY_VERSION +-#endif +-#ifndef HAVE_OPENSSL_VERSION +-# define OpenSSL_version SSLeay_version +-#endif +-#ifndef HAVE_OPENSSL_VERSION_NUM +-# define OpenSSL_version_num SSLeay +-#endif +- if ((rc = fprintf(fd, "%08lx (%s)\n", ++ if (fprintf(f, "%08lx (%s)", + (unsigned long)OpenSSL_version_num(), +- OpenSSL_version(OPENSSL_VERSION))) < 0) ++ OpenSSL_version(OPENSSL_VERSION)) < 0) ++ exit(1); ++#ifdef LIBRESSL_VERSION_NUMBER ++ if (fprintf(f, " libressl-%08lx", LIBRESSL_VERSION_NUMBER) < 0) ++ exit(1); ++#endif ++ if (fputc('\n', f) == EOF || fclose(f) == EOF) + exit(1); +- + exit(0); + ]])], + [ +- ssl_library_ver=`cat conftest.ssllibver` ++ sslver=`cat conftest.ssllibver` ++ ssl_showver=`echo "$sslver" | sed 's/ libressl-.*//'` + # Check version is supported. +- case "$ssl_library_ver" in +- 10000*|0*) +- AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")]) +- ;; +- 100*) ;; # 1.0.x +- 101000[[0123456]]*) +- # https://github.com/openssl/openssl/pull/4613 +- AC_MSG_ERROR([OpenSSL 1.1.x versions prior to 1.1.0g have a bug that breaks their use with OpenSSH (have "$ssl_library_ver")]) ++ case "$sslver" in ++ 100*|10100*) # 1.0.x, 1.1.0x ++ AC_MSG_ERROR([OpenSSL >= 1.1.1 required (have "$ssl_showver")]) + ;; + 101*) ;; # 1.1.x +- 200*) ;; # LibreSSL ++ 200*) # LibreSSL ++ lver=`echo "$sslver" | sed 's/.*libressl-//'` ++ case "$lver" in ++ 2*|300*) # 2.x, 3.0.0 ++ AC_MSG_ERROR([LibreSSL >= 3.1.0 required (have "$ssl_showver")]) ++ ;; ++ *) ;; # Assume all other versions are good. ++ esac ++ ;; + 300*) ;; # OpenSSL 3 + 301*) ;; # OpenSSL development branch. + *) +@@ -2781,10 +2781,10 @@ + 300*) ;; # OpenSSL 3 + 301*) ;; # OpenSSL development branch. + *) +- AC_MSG_ERROR([Unknown/unsupported OpenSSL version ("$ssl_library_ver")]) ++ AC_MSG_ERROR([Unknown/unsupported OpenSSL version ("$ssl_showver")]) + ;; + esac +- AC_MSG_RESULT([$ssl_library_ver]) ++ AC_MSG_RESULT([$ssl_showver]) + ], + [ + AC_MSG_RESULT([not found]) +@@ -2804,9 +2804,6 @@ + #include <openssl/opensslv.h> + #include <openssl/crypto.h> + ]], [[ +-#ifndef HAVE_OPENSSL_VERSION_NUM +-# define OpenSSL_version_num SSLeay +-#endif + exit(OpenSSL_version_num() == OPENSSL_VERSION_NUMBER ? 0 : 1); + ]])], + [ +@@ -2881,44 +2878,13 @@ + ) + ) + +- # LibreSSL/OpenSSL 1.1x API ++ # LibreSSL/OpenSSL API differences + AC_CHECK_FUNCS([ \ +- OPENSSL_init_crypto \ +- DH_get0_key \ +- DH_get0_pqg \ +- DH_set0_key \ +- DH_set_length \ +- DH_set0_pqg \ +- DSA_get0_key \ +- DSA_get0_pqg \ +- DSA_set0_key \ +- DSA_set0_pqg \ +- DSA_SIG_get0 \ +- DSA_SIG_set0 \ +- ECDSA_SIG_get0 \ +- ECDSA_SIG_set0 \ + EVP_CIPHER_CTX_iv \ + EVP_CIPHER_CTX_iv_noconst \ + EVP_CIPHER_CTX_get_iv \ + EVP_CIPHER_CTX_get_updated_iv \ + EVP_CIPHER_CTX_set_iv \ +- RSA_get0_crt_params \ +- RSA_get0_factors \ +- RSA_get0_key \ +- RSA_set0_crt_params \ +- RSA_set0_factors \ +- RSA_set0_key \ +- RSA_meth_free \ +- RSA_meth_dup \ +- RSA_meth_set1_name \ +- RSA_meth_get_finish \ +- RSA_meth_set_priv_enc \ +- RSA_meth_set_priv_dec \ +- RSA_meth_set_finish \ +- EVP_PKEY_get0_RSA \ +- EVP_MD_CTX_new \ +- EVP_MD_CTX_free \ +- EVP_chacha20 \ + ]) + + if test "x$openssl_engine" = "xyes" ; then +@@ -3040,8 +3006,8 @@ + fi + AC_CHECK_FUNCS([crypt DES_crypt]) + +- # Check for SHA256, SHA384 and SHA512 support in OpenSSL +- AC_CHECK_FUNCS([EVP_sha256 EVP_sha384 EVP_sha512]) ++ # Check for various EVP support in OpenSSL ++ AC_CHECK_FUNCS([EVP_sha256 EVP_sha384 EVP_sha512 EVP_chacha20]) + + # Check complete ECC support in OpenSSL + AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1]) +diff --git a/openbsd-compat/libressl-api-compat.c b/openbsd-compat/libressl-api-compat.c +index 498180dc894..59be17397c5 100644 +--- a/openbsd-compat/libressl-api-compat.c ++++ b/openbsd-compat/libressl-api-compat.c +@@ -1,129 +1,5 @@ +-/* $OpenBSD: dsa_lib.c,v 1.29 2018/04/14 07:09:21 tb Exp $ */ +-/* $OpenBSD: rsa_lib.c,v 1.37 2018/04/14 07:09:21 tb Exp $ */ +-/* $OpenBSD: evp_lib.c,v 1.17 2018/09/12 06:35:38 djm Exp $ */ +-/* $OpenBSD: dh_lib.c,v 1.32 2018/05/02 15:48:38 tb Exp $ */ +-/* $OpenBSD: p_lib.c,v 1.24 2018/05/30 15:40:50 tb Exp $ */ +-/* $OpenBSD: digest.c,v 1.30 2018/04/14 07:09:21 tb Exp $ */ +-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) +- * All rights reserved. +- * +- * This package is an SSL implementation written +- * by Eric Young (eay@cryptsoft.com). +- * The implementation was written so as to conform with Netscapes SSL. +- * +- * This library is free for commercial and non-commercial use as long as +- * the following conditions are aheared to. The following conditions +- * apply to all code found in this distribution, be it the RC4, RSA, +- * lhash, DES, etc., code; not just the SSL code. The SSL documentation +- * included with this distribution is covered by the same copyright terms +- * except that the holder is Tim Hudson (tjh@cryptsoft.com). +- * +- * Copyright remains Eric Young's, and as such any Copyright notices in +- * the code are not to be removed. +- * If this package is used in a product, Eric Young should be given attribution +- * as the author of the parts of the library used. +- * This can be in the form of a textual message at program startup or +- * in documentation (online or textual) provided with the package. +- * +- * Redistribution and use in source and binary forms, with or without +- * modification, are permitted provided that the following conditions +- * are met: +- * 1. Redistributions of source code must retain the copyright +- * notice, this list of conditions and the following disclaimer. +- * 2. Redistributions in binary form must reproduce the above copyright +- * notice, this list of conditions and the following disclaimer in the +- * documentation and/or other materials provided with the distribution. +- * 3. All advertising materials mentioning features or use of this software +- * must display the following acknowledgement: +- * "This product includes cryptographic software written by +- * Eric Young (eay@cryptsoft.com)" +- * The word 'cryptographic' can be left out if the rouines from the library +- * being used are not cryptographic related :-). +- * 4. If you include any Windows specific code (or a derivative thereof) from +- * the apps directory (application code) you must include an acknowledgement: +- * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" +- * +- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND +- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +- * SUCH DAMAGE. +- * +- * The licence and distribution terms for any publically available version or +- * derivative of this code cannot be changed. i.e. this code cannot simply be +- * copied and put under another distribution licence +- * [including the GNU Public Licence.] +- */ +- +-/* $OpenBSD: dsa_asn1.c,v 1.22 2018/06/14 17:03:19 jsing Exp $ */ +-/* $OpenBSD: ecs_asn1.c,v 1.9 2018/03/17 15:24:44 tb Exp $ */ +-/* $OpenBSD: digest.c,v 1.30 2018/04/14 07:09:21 tb Exp $ */ +-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL +- * project 2000. +- */ +-/* ==================================================================== +- * Copyright (c) 2000-2005 The OpenSSL Project. All rights reserved. +- * +- * Redistribution and use in source and binary forms, with or without +- * modification, are permitted provided that the following conditions +- * are met: +- * +- * 1. Redistributions of source code must retain the above copyright +- * notice, this list of conditions and the following disclaimer. +- * +- * 2. Redistributions in binary form must reproduce the above copyright +- * notice, this list of conditions and the following disclaimer in +- * the documentation and/or other materials provided with the +- * distribution. +- * +- * 3. All advertising materials mentioning features or use of this +- * software must display the following acknowledgment: +- * "This product includes software developed by the OpenSSL Project +- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" +- * +- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to +- * endorse or promote products derived from this software without +- * prior written permission. For written permission, please contact +- * licensing@OpenSSL.org. +- * +- * 5. Products derived from this software may not be called "OpenSSL" +- * nor may "OpenSSL" appear in their names without prior written +- * permission of the OpenSSL Project. +- * +- * 6. Redistributions of any form whatsoever must retain the following +- * acknowledgment: +- * "This product includes software developed by the OpenSSL Project +- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" +- * +- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY +- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR +- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +- * OF THE POSSIBILITY OF SUCH DAMAGE. +- * ==================================================================== +- * +- * This product includes cryptographic software written by Eric Young +- * (eay@cryptsoft.com). This product includes software written by Tim +- * Hudson (tjh@cryptsoft.com). +- * +- */ +- +-/* $OpenBSD: rsa_meth.c,v 1.2 2018/09/12 06:35:38 djm Exp $ */ + /* +- * Copyright (c) 2018 Theo Buehler <tb@openbsd.org> ++ * Copyright (c) 2018 Damien Miller <djm@mindrot.org> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above +@@ -147,192 +23,7 @@ + #include <stdlib.h> + #include <string.h> + +-#include <openssl/err.h> +-#include <openssl/bn.h> +-#include <openssl/dsa.h> +-#include <openssl/rsa.h> + #include <openssl/evp.h> +-#ifdef OPENSSL_HAS_ECC +-#include <openssl/ecdsa.h> +-#endif +-#include <openssl/dh.h> +- +-#ifndef HAVE_DSA_GET0_PQG +-void +-DSA_get0_pqg(const DSA *d, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g) +-{ +- if (p != NULL) +- *p = d->p; +- if (q != NULL) +- *q = d->q; +- if (g != NULL) +- *g = d->g; +-} +-#endif /* HAVE_DSA_GET0_PQG */ +- +-#ifndef HAVE_DSA_SET0_PQG +-int +-DSA_set0_pqg(DSA *d, BIGNUM *p, BIGNUM *q, BIGNUM *g) +-{ +- if ((d->p == NULL && p == NULL) || (d->q == NULL && q == NULL) || +- (d->g == NULL && g == NULL)) +- return 0; +- +- if (p != NULL) { +- BN_free(d->p); +- d->p = p; +- } +- if (q != NULL) { +- BN_free(d->q); +- d->q = q; +- } +- if (g != NULL) { +- BN_free(d->g); +- d->g = g; +- } +- +- return 1; +-} +-#endif /* HAVE_DSA_SET0_PQG */ +- +-#ifndef HAVE_DSA_GET0_KEY +-void +-DSA_get0_key(const DSA *d, const BIGNUM **pub_key, const BIGNUM **priv_key) +-{ +- if (pub_key != NULL) +- *pub_key = d->pub_key; +- if (priv_key != NULL) +- *priv_key = d->priv_key; +-} +-#endif /* HAVE_DSA_GET0_KEY */ +- +-#ifndef HAVE_DSA_SET0_KEY +-int +-DSA_set0_key(DSA *d, BIGNUM *pub_key, BIGNUM *priv_key) +-{ +- if (d->pub_key == NULL && pub_key == NULL) +- return 0; +- +- if (pub_key != NULL) { +- BN_free(d->pub_key); +- d->pub_key = pub_key; +- } +- if (priv_key != NULL) { +- BN_free(d->priv_key); +- d->priv_key = priv_key; +- } +- +- return 1; +-} +-#endif /* HAVE_DSA_SET0_KEY */ +- +-#ifndef HAVE_RSA_GET0_KEY +-void +-RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) +-{ +- if (n != NULL) +- *n = r->n; +- if (e != NULL) +- *e = r->e; +- if (d != NULL) +- *d = r->d; +-} +-#endif /* HAVE_RSA_GET0_KEY */ +- +-#ifndef HAVE_RSA_SET0_KEY +-int +-RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) +-{ +- if ((r->n == NULL && n == NULL) || (r->e == NULL && e == NULL)) +- return 0; +- +- if (n != NULL) { +- BN_free(r->n); +- r->n = n; +- } +- if (e != NULL) { +- BN_free(r->e); +- r->e = e; +- } +- if (d != NULL) { +- BN_free(r->d); +- r->d = d; +- } +- +- return 1; +-} +-#endif /* HAVE_RSA_SET0_KEY */ +- +-#ifndef HAVE_RSA_GET0_CRT_PARAMS +-void +-RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, +- const BIGNUM **iqmp) +-{ +- if (dmp1 != NULL) +- *dmp1 = r->dmp1; +- if (dmq1 != NULL) +- *dmq1 = r->dmq1; +- if (iqmp != NULL) +- *iqmp = r->iqmp; +-} +-#endif /* HAVE_RSA_GET0_CRT_PARAMS */ +- +-#ifndef HAVE_RSA_SET0_CRT_PARAMS +-int +-RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) +-{ +- if ((r->dmp1 == NULL && dmp1 == NULL) || +- (r->dmq1 == NULL && dmq1 == NULL) || +- (r->iqmp == NULL && iqmp == NULL)) +- return 0; +- +- if (dmp1 != NULL) { +- BN_free(r->dmp1); +- r->dmp1 = dmp1; +- } +- if (dmq1 != NULL) { +- BN_free(r->dmq1); +- r->dmq1 = dmq1; +- } +- if (iqmp != NULL) { +- BN_free(r->iqmp); +- r->iqmp = iqmp; +- } +- +- return 1; +-} +-#endif /* HAVE_RSA_SET0_CRT_PARAMS */ +- +-#ifndef HAVE_RSA_GET0_FACTORS +-void +-RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) +-{ +- if (p != NULL) +- *p = r->p; +- if (q != NULL) +- *q = r->q; +-} +-#endif /* HAVE_RSA_GET0_FACTORS */ +- +-#ifndef HAVE_RSA_SET0_FACTORS +-int +-RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) +-{ +- if ((r->p == NULL && p == NULL) || (r->q == NULL && q == NULL)) +- return 0; +- +- if (p != NULL) { +- BN_free(r->p); +- r->p = p; +- } +- if (q != NULL) { +- BN_free(r->q); +- r->q = q; +- } +- +- return 1; +-} +-#endif /* HAVE_RSA_SET0_FACTORS */ + + #ifndef HAVE_EVP_CIPHER_CTX_GET_IV + int +@@ -392,249 +83,4 @@ EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx, const unsigned char *iv, size_t len) + } + #endif /* HAVE_EVP_CIPHER_CTX_SET_IV */ + +-#ifndef HAVE_DSA_SIG_GET0 +-void +-DSA_SIG_get0(const DSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) +-{ +- if (pr != NULL) +- *pr = sig->r; +- if (ps != NULL) +- *ps = sig->s; +-} +-#endif /* HAVE_DSA_SIG_GET0 */ +- +-#ifndef HAVE_DSA_SIG_SET0 +-int +-DSA_SIG_set0(DSA_SIG *sig, BIGNUM *r, BIGNUM *s) +-{ +- if (r == NULL || s == NULL) +- return 0; +- +- BN_clear_free(sig->r); +- sig->r = r; +- BN_clear_free(sig->s); +- sig->s = s; +- +- return 1; +-} +-#endif /* HAVE_DSA_SIG_SET0 */ +- +-#ifdef OPENSSL_HAS_ECC +-#ifndef HAVE_ECDSA_SIG_GET0 +-void +-ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) +-{ +- if (pr != NULL) +- *pr = sig->r; +- if (ps != NULL) +- *ps = sig->s; +-} +-#endif /* HAVE_ECDSA_SIG_GET0 */ +- +-#ifndef HAVE_ECDSA_SIG_SET0 +-int +-ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) +-{ +- if (r == NULL || s == NULL) +- return 0; +- +- BN_clear_free(sig->r); +- BN_clear_free(sig->s); +- sig->r = r; +- sig->s = s; +- return 1; +-} +-#endif /* HAVE_ECDSA_SIG_SET0 */ +-#endif /* OPENSSL_HAS_ECC */ +- +-#ifndef HAVE_DH_GET0_PQG +-void +-DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g) +-{ +- if (p != NULL) +- *p = dh->p; +- if (q != NULL) +- *q = dh->q; +- if (g != NULL) +- *g = dh->g; +-} +-#endif /* HAVE_DH_GET0_PQG */ +- +-#ifndef HAVE_DH_SET0_PQG +-int +-DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) +-{ +- if ((dh->p == NULL && p == NULL) || (dh->g == NULL && g == NULL)) +- return 0; +- +- if (p != NULL) { +- BN_free(dh->p); +- dh->p = p; +- } +- if (q != NULL) { +- BN_free(dh->q); +- dh->q = q; +- } +- if (g != NULL) { +- BN_free(dh->g); +- dh->g = g; +- } +- +- return 1; +-} +-#endif /* HAVE_DH_SET0_PQG */ +- +-#ifndef HAVE_DH_GET0_KEY +-void +-DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key) +-{ +- if (pub_key != NULL) +- *pub_key = dh->pub_key; +- if (priv_key != NULL) +- *priv_key = dh->priv_key; +-} +-#endif /* HAVE_DH_GET0_KEY */ +- +-#ifndef HAVE_DH_SET0_KEY +-int +-DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key) +-{ +- if (pub_key != NULL) { +- BN_free(dh->pub_key); +- dh->pub_key = pub_key; +- } +- if (priv_key != NULL) { +- BN_free(dh->priv_key); +- dh->priv_key = priv_key; +- } +- +- return 1; +-} +-#endif /* HAVE_DH_SET0_KEY */ +- +-#ifndef HAVE_DH_SET_LENGTH +-int +-DH_set_length(DH *dh, long length) +-{ +- if (length < 0 || length > INT_MAX) +- return 0; +- +- dh->length = length; +- return 1; +-} +-#endif /* HAVE_DH_SET_LENGTH */ +- +-#ifndef HAVE_RSA_METH_FREE +-void +-RSA_meth_free(RSA_METHOD *meth) +-{ +- if (meth != NULL) { +- free((char *)meth->name); +- free(meth); +- } +-} +-#endif /* HAVE_RSA_METH_FREE */ +- +-#ifndef HAVE_RSA_METH_DUP +-RSA_METHOD * +-RSA_meth_dup(const RSA_METHOD *meth) +-{ +- RSA_METHOD *copy; +- +- if ((copy = calloc(1, sizeof(*copy))) == NULL) +- return NULL; +- memcpy(copy, meth, sizeof(*copy)); +- if ((copy->name = strdup(meth->name)) == NULL) { +- free(copy); +- return NULL; +- } +- +- return copy; +-} +-#endif /* HAVE_RSA_METH_DUP */ +- +-#ifndef HAVE_RSA_METH_SET1_NAME +-int +-RSA_meth_set1_name(RSA_METHOD *meth, const char *name) +-{ +- char *copy; +- +- if ((copy = strdup(name)) == NULL) +- return 0; +- free((char *)meth->name); +- meth->name = copy; +- return 1; +-} +-#endif /* HAVE_RSA_METH_SET1_NAME */ +- +-#ifndef HAVE_RSA_METH_GET_FINISH +-int +-(*RSA_meth_get_finish(const RSA_METHOD *meth))(RSA *rsa) +-{ +- return meth->finish; +-} +-#endif /* HAVE_RSA_METH_GET_FINISH */ +- +-#ifndef HAVE_RSA_METH_SET_PRIV_ENC +-int +-RSA_meth_set_priv_enc(RSA_METHOD *meth, int (*priv_enc)(int flen, +- const unsigned char *from, unsigned char *to, RSA *rsa, int padding)) +-{ +- meth->rsa_priv_enc = priv_enc; +- return 1; +-} +-#endif /* HAVE_RSA_METH_SET_PRIV_ENC */ +- +-#ifndef HAVE_RSA_METH_SET_PRIV_DEC +-int +-RSA_meth_set_priv_dec(RSA_METHOD *meth, int (*priv_dec)(int flen, +- const unsigned char *from, unsigned char *to, RSA *rsa, int padding)) +-{ +- meth->rsa_priv_dec = priv_dec; +- return 1; +-} +-#endif /* HAVE_RSA_METH_SET_PRIV_DEC */ +- +-#ifndef HAVE_RSA_METH_SET_FINISH +-int +-RSA_meth_set_finish(RSA_METHOD *meth, int (*finish)(RSA *rsa)) +-{ +- meth->finish = finish; +- return 1; +-} +-#endif /* HAVE_RSA_METH_SET_FINISH */ +- +-#ifndef HAVE_EVP_PKEY_GET0_RSA +-RSA * +-EVP_PKEY_get0_RSA(EVP_PKEY *pkey) +-{ +- if (pkey->type != EVP_PKEY_RSA) { +- /* EVPerror(EVP_R_EXPECTING_AN_RSA_KEY); */ +- return NULL; +- } +- return pkey->pkey.rsa; +-} +-#endif /* HAVE_EVP_PKEY_GET0_RSA */ +- +-#ifndef HAVE_EVP_MD_CTX_NEW +-EVP_MD_CTX * +-EVP_MD_CTX_new(void) +-{ +- return calloc(1, sizeof(EVP_MD_CTX)); +-} +-#endif /* HAVE_EVP_MD_CTX_NEW */ +- +-#ifndef HAVE_EVP_MD_CTX_FREE +-void +-EVP_MD_CTX_free(EVP_MD_CTX *ctx) +-{ +- if (ctx == NULL) +- return; +- +- EVP_MD_CTX_cleanup(ctx); +- +- free(ctx); +-} +-#endif /* HAVE_EVP_MD_CTX_FREE */ +- + #endif /* WITH_OPENSSL */ +diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h +index 61a69dd56eb..d0dd2c3450d 100644 +--- a/openbsd-compat/openssl-compat.h ++++ b/openbsd-compat/openssl-compat.h +@@ -33,26 +33,13 @@ + int ssh_compatible_openssl(long, long); + void ssh_libcrypto_init(void); + +-#if (OPENSSL_VERSION_NUMBER < 0x1000100fL) +-# error OpenSSL 1.0.1 or greater is required ++#if (OPENSSL_VERSION_NUMBER < 0x10100000L) ++# error OpenSSL 1.1.0 or greater is required + #endif +- +-#ifndef OPENSSL_VERSION +-# define OPENSSL_VERSION SSLEAY_VERSION +-#endif +- +-#ifndef HAVE_OPENSSL_VERSION +-# define OpenSSL_version(x) SSLeay_version(x) +-#endif +- +-#ifndef HAVE_OPENSSL_VERSION_NUM +-# define OpenSSL_version_num SSLeay +-#endif +- +-#if OPENSSL_VERSION_NUMBER < 0x10000001L +-# define LIBCRYPTO_EVP_INL_TYPE unsigned int +-#else +-# define LIBCRYPTO_EVP_INL_TYPE size_t ++#ifdef LIBRESSL_VERSION_NUMBER ++# if LIBRESSL_VERSION_NUMBER < 0x3010000fL ++# error LibreSSL 3.1.0 or greater is required ++# endif + #endif + + #ifndef OPENSSL_RSA_MAX_MODULUS_BITS +@@ -68,25 +55,6 @@ void ssh_libcrypto_init(void); + # endif + #endif + +-/* LibreSSL/OpenSSL 1.1x API compat */ +-#ifndef HAVE_DSA_GET0_PQG +-void DSA_get0_pqg(const DSA *d, const BIGNUM **p, const BIGNUM **q, +- const BIGNUM **g); +-#endif /* HAVE_DSA_GET0_PQG */ +- +-#ifndef HAVE_DSA_SET0_PQG +-int DSA_set0_pqg(DSA *d, BIGNUM *p, BIGNUM *q, BIGNUM *g); +-#endif /* HAVE_DSA_SET0_PQG */ +- +-#ifndef HAVE_DSA_GET0_KEY +-void DSA_get0_key(const DSA *d, const BIGNUM **pub_key, +- const BIGNUM **priv_key); +-#endif /* HAVE_DSA_GET0_KEY */ +- +-#ifndef HAVE_DSA_SET0_KEY +-int DSA_set0_key(DSA *d, BIGNUM *pub_key, BIGNUM *priv_key); +-#endif /* HAVE_DSA_SET0_KEY */ +- + #ifndef HAVE_EVP_CIPHER_CTX_GET_IV + # ifdef HAVE_EVP_CIPHER_CTX_GET_UPDATED_IV + # define EVP_CIPHER_CTX_get_iv EVP_CIPHER_CTX_get_updated_iv +@@ -101,112 +69,5 @@ int EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx, + const unsigned char *iv, size_t len); + #endif /* HAVE_EVP_CIPHER_CTX_SET_IV */ + +-#ifndef HAVE_RSA_GET0_KEY +-void RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, +- const BIGNUM **d); +-#endif /* HAVE_RSA_GET0_KEY */ +- +-#ifndef HAVE_RSA_SET0_KEY +-int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d); +-#endif /* HAVE_RSA_SET0_KEY */ +- +-#ifndef HAVE_RSA_GET0_CRT_PARAMS +-void RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, +- const BIGNUM **iqmp); +-#endif /* HAVE_RSA_GET0_CRT_PARAMS */ +- +-#ifndef HAVE_RSA_SET0_CRT_PARAMS +-int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp); +-#endif /* HAVE_RSA_SET0_CRT_PARAMS */ +- +-#ifndef HAVE_RSA_GET0_FACTORS +-void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q); +-#endif /* HAVE_RSA_GET0_FACTORS */ +- +-#ifndef HAVE_RSA_SET0_FACTORS +-int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q); +-#endif /* HAVE_RSA_SET0_FACTORS */ +- +-#ifndef DSA_SIG_GET0 +-void DSA_SIG_get0(const DSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps); +-#endif /* DSA_SIG_GET0 */ +- +-#ifndef DSA_SIG_SET0 +-int DSA_SIG_set0(DSA_SIG *sig, BIGNUM *r, BIGNUM *s); +-#endif /* DSA_SIG_SET0 */ +- +-#ifdef OPENSSL_HAS_ECC +-#ifndef HAVE_ECDSA_SIG_GET0 +-void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps); +-#endif /* HAVE_ECDSA_SIG_GET0 */ +- +-#ifndef HAVE_ECDSA_SIG_SET0 +-int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s); +-#endif /* HAVE_ECDSA_SIG_SET0 */ +-#endif /* OPENSSL_HAS_ECC */ +- +-#ifndef HAVE_DH_GET0_PQG +-void DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, +- const BIGNUM **g); +-#endif /* HAVE_DH_GET0_PQG */ +- +-#ifndef HAVE_DH_SET0_PQG +-int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g); +-#endif /* HAVE_DH_SET0_PQG */ +- +-#ifndef HAVE_DH_GET0_KEY +-void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key); +-#endif /* HAVE_DH_GET0_KEY */ +- +-#ifndef HAVE_DH_SET0_KEY +-int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key); +-#endif /* HAVE_DH_SET0_KEY */ +- +-#ifndef HAVE_DH_SET_LENGTH +-int DH_set_length(DH *dh, long length); +-#endif /* HAVE_DH_SET_LENGTH */ +- +-#ifndef HAVE_RSA_METH_FREE +-void RSA_meth_free(RSA_METHOD *meth); +-#endif /* HAVE_RSA_METH_FREE */ +- +-#ifndef HAVE_RSA_METH_DUP +-RSA_METHOD *RSA_meth_dup(const RSA_METHOD *meth); +-#endif /* HAVE_RSA_METH_DUP */ +- +-#ifndef HAVE_RSA_METH_SET1_NAME +-int RSA_meth_set1_name(RSA_METHOD *meth, const char *name); +-#endif /* HAVE_RSA_METH_SET1_NAME */ +- +-#ifndef HAVE_RSA_METH_GET_FINISH +-int (*RSA_meth_get_finish(const RSA_METHOD *meth))(RSA *rsa); +-#endif /* HAVE_RSA_METH_GET_FINISH */ +- +-#ifndef HAVE_RSA_METH_SET_PRIV_ENC +-int RSA_meth_set_priv_enc(RSA_METHOD *meth, int (*priv_enc)(int flen, +- const unsigned char *from, unsigned char *to, RSA *rsa, int padding)); +-#endif /* HAVE_RSA_METH_SET_PRIV_ENC */ +- +-#ifndef HAVE_RSA_METH_SET_PRIV_DEC +-int RSA_meth_set_priv_dec(RSA_METHOD *meth, int (*priv_dec)(int flen, +- const unsigned char *from, unsigned char *to, RSA *rsa, int padding)); +-#endif /* HAVE_RSA_METH_SET_PRIV_DEC */ +- +-#ifndef HAVE_RSA_METH_SET_FINISH +-int RSA_meth_set_finish(RSA_METHOD *meth, int (*finish)(RSA *rsa)); +-#endif /* HAVE_RSA_METH_SET_FINISH */ +- +-#ifndef HAVE_EVP_PKEY_GET0_RSA +-RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey); +-#endif /* HAVE_EVP_PKEY_GET0_RSA */ +- +-#ifndef HAVE_EVP_MD_CTX_new +-EVP_MD_CTX *EVP_MD_CTX_new(void); +-#endif /* HAVE_EVP_MD_CTX_new */ +- +-#ifndef HAVE_EVP_MD_CTX_free +-void EVP_MD_CTX_free(EVP_MD_CTX *ctx); +-#endif /* HAVE_EVP_MD_CTX_free */ +- + #endif /* WITH_OPENSSL */ + #endif /* _OPENSSL_COMPAT_H */ diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0001.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0001.patch new file mode 100644 index 0000000000..2ee344cb27 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0001.patch @@ -0,0 +1,585 @@ +From 099cdf59ce1e72f55d421c8445bf6321b3004755 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Wed, 19 Jul 2023 14:03:45 +0000 +Subject: [PATCH 1/4] upstream: Separate ssh-pkcs11-helpers for each p11 module + +Make ssh-pkcs11-client start an independent helper for each provider, +providing better isolation between modules and reliability if a single +module misbehaves. + +This also implements reference counting of PKCS#11-hosted keys, +allowing ssh-pkcs11-helper subprocesses to be automatically reaped +when no remaining keys reference them. This fixes some bugs we have +that make PKCS11 keys unusable after they have been deleted, e.g. +https://bugzilla.mindrot.org/show_bug.cgi?id=3125 + +ok markus@ + +OpenBSD-Commit-ID: 0ce188b14fe271ab0568f4500070d96c5657244e + +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/099cdf59ce1e72f55d421c8445bf6321b3004755] + +CVE: CVE-2023-38408 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + ssh-pkcs11-client.c | 378 +++++++++++++++++++++++++++++++++----------- + 1 file changed, 285 insertions(+), 93 deletions(-) + +diff --git a/ssh-pkcs11-client.c b/ssh-pkcs11-client.c +index cfd833d..7db6c6c 100644 +--- a/ssh-pkcs11-client.c ++++ b/ssh-pkcs11-client.c +@@ -1,4 +1,4 @@ +-/* $OpenBSD: ssh-pkcs11-client.c,v 1.17 2020/10/18 11:32:02 djm Exp $ */ ++/* $OpenBSD: ssh-pkcs11-client.c,v 1.18 2023/07/19 14:03:45 djm Exp $ */ + /* + * Copyright (c) 2010 Markus Friedl. All rights reserved. + * Copyright (c) 2014 Pedro Martelletto. All rights reserved. +@@ -30,12 +30,11 @@ + #include <string.h> + #include <unistd.h> + #include <errno.h> ++#include <limits.h> + + #include <openssl/ecdsa.h> + #include <openssl/rsa.h> + +-#include "openbsd-compat/openssl-compat.h" +- + #include "pathnames.h" + #include "xmalloc.h" + #include "sshbuf.h" +@@ -47,18 +46,140 @@ + #include "ssh-pkcs11.h" + #include "ssherr.h" + ++#include "openbsd-compat/openssl-compat.h" ++ + /* borrows code from sftp-server and ssh-agent */ + +-static int fd = -1; +-static pid_t pid = -1; ++/* ++ * Maintain a list of ssh-pkcs11-helper subprocesses. These may be looked up ++ * by provider path or their unique EC/RSA METHOD pointers. ++ */ ++struct helper { ++ char *path; ++ pid_t pid; ++ int fd; ++ RSA_METHOD *rsa_meth; ++ EC_KEY_METHOD *ec_meth; ++ int (*rsa_finish)(RSA *rsa); ++ void (*ec_finish)(EC_KEY *key); ++ size_t nrsa, nec; /* number of active keys of each type */ ++}; ++static struct helper **helpers; ++static size_t nhelpers; ++ ++static struct helper * ++helper_by_provider(const char *path) ++{ ++ size_t i; ++ ++ for (i = 0; i < nhelpers; i++) { ++ if (helpers[i] == NULL || helpers[i]->path == NULL || ++ helpers[i]->fd == -1) ++ continue; ++ if (strcmp(helpers[i]->path, path) == 0) ++ return helpers[i]; ++ } ++ return NULL; ++} ++ ++static struct helper * ++helper_by_rsa(const RSA *rsa) ++{ ++ size_t i; ++ const RSA_METHOD *meth; ++ ++ if ((meth = RSA_get_method(rsa)) == NULL) ++ return NULL; ++ for (i = 0; i < nhelpers; i++) { ++ if (helpers[i] != NULL && helpers[i]->rsa_meth == meth) ++ return helpers[i]; ++ } ++ return NULL; ++ ++} ++ ++static struct helper * ++helper_by_ec(const EC_KEY *ec) ++{ ++ size_t i; ++ const EC_KEY_METHOD *meth; ++ ++ if ((meth = EC_KEY_get_method(ec)) == NULL) ++ return NULL; ++ for (i = 0; i < nhelpers; i++) { ++ if (helpers[i] != NULL && helpers[i]->ec_meth == meth) ++ return helpers[i]; ++ } ++ return NULL; ++ ++} ++ ++static void ++helper_free(struct helper *helper) ++{ ++ size_t i; ++ int found = 0; ++ ++ if (helper == NULL) ++ return; ++ if (helper->path == NULL || helper->ec_meth == NULL || ++ helper->rsa_meth == NULL) ++ fatal_f("inconsistent helper"); ++ debug3_f("free helper for provider %s", helper->path); ++ for (i = 0; i < nhelpers; i++) { ++ if (helpers[i] == helper) { ++ if (found) ++ fatal_f("helper recorded more than once"); ++ found = 1; ++ } ++ else if (found) ++ helpers[i - 1] = helpers[i]; ++ } ++ if (found) { ++ helpers = xrecallocarray(helpers, nhelpers, ++ nhelpers - 1, sizeof(*helpers)); ++ nhelpers--; ++ } ++ free(helper->path); ++ EC_KEY_METHOD_free(helper->ec_meth); ++ RSA_meth_free(helper->rsa_meth); ++ free(helper); ++} ++ ++static void ++helper_terminate(struct helper *helper) ++{ ++ if (helper == NULL) { ++ return; ++ } else if (helper->fd == -1) { ++ debug3_f("already terminated"); ++ } else { ++ debug3_f("terminating helper for %s; " ++ "remaining %zu RSA %zu ECDSA", ++ helper->path, helper->nrsa, helper->nec); ++ close(helper->fd); ++ /* XXX waitpid() */ ++ helper->fd = -1; ++ helper->pid = -1; ++ } ++ /* ++ * Don't delete the helper entry until there are no remaining keys ++ * that reference it. Otherwise, any signing operation would call ++ * a free'd METHOD pointer and that would be bad. ++ */ ++ if (helper->nrsa == 0 && helper->nec == 0) ++ helper_free(helper); ++} + + static void +-send_msg(struct sshbuf *m) ++send_msg(int fd, struct sshbuf *m) + { + u_char buf[4]; + size_t mlen = sshbuf_len(m); + int r; + ++ if (fd == -1) ++ return; + POKE_U32(buf, mlen); + if (atomicio(vwrite, fd, buf, 4) != 4 || + atomicio(vwrite, fd, sshbuf_mutable_ptr(m), +@@ -69,12 +190,15 @@ send_msg(struct sshbuf *m) + } + + static int +-recv_msg(struct sshbuf *m) ++recv_msg(int fd, struct sshbuf *m) + { + u_int l, len; + u_char c, buf[1024]; + int r; + ++ sshbuf_reset(m); ++ if (fd == -1) ++ return 0; /* XXX */ + if ((len = atomicio(read, fd, buf, 4)) != 4) { + error("read from helper failed: %u", len); + return (0); /* XXX */ +@@ -83,7 +207,6 @@ recv_msg(struct sshbuf *m) + if (len > 256 * 1024) + fatal("response too long: %u", len); + /* read len bytes into m */ +- sshbuf_reset(m); + while (len > 0) { + l = len; + if (l > sizeof(buf)) +@@ -104,14 +227,17 @@ recv_msg(struct sshbuf *m) + int + pkcs11_init(int interactive) + { +- return (0); ++ return 0; + } + + void + pkcs11_terminate(void) + { +- if (fd >= 0) +- close(fd); ++ size_t i; ++ ++ debug3_f("terminating %zu helpers", nhelpers); ++ for (i = 0; i < nhelpers; i++) ++ helper_terminate(helpers[i]); + } + + static int +@@ -122,7 +248,11 @@ rsa_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa, int padding) + u_char *blob = NULL, *signature = NULL; + size_t blen, slen = 0; + int r, ret = -1; ++ struct helper *helper; + ++ if ((helper = helper_by_rsa(rsa)) == NULL || helper->fd == -1) ++ fatal_f("no helper for PKCS11 key"); ++ debug3_f("signing with PKCS11 provider %s", helper->path); + if (padding != RSA_PKCS1_PADDING) + goto fail; + key = sshkey_new(KEY_UNSPEC); +@@ -144,10 +274,10 @@ rsa_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa, int padding) + (r = sshbuf_put_string(msg, from, flen)) != 0 || + (r = sshbuf_put_u32(msg, 0)) != 0) + fatal_fr(r, "compose"); +- send_msg(msg); ++ send_msg(helper->fd, msg); + sshbuf_reset(msg); + +- if (recv_msg(msg) == SSH2_AGENT_SIGN_RESPONSE) { ++ if (recv_msg(helper->fd, msg) == SSH2_AGENT_SIGN_RESPONSE) { + if ((r = sshbuf_get_string(msg, &signature, &slen)) != 0) + fatal_fr(r, "parse"); + if (slen <= (size_t)RSA_size(rsa)) { +@@ -163,7 +293,26 @@ rsa_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa, int padding) + return (ret); + } + +-#if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) ++static int ++rsa_finish(RSA *rsa) ++{ ++ struct helper *helper; ++ ++ if ((helper = helper_by_rsa(rsa)) == NULL) ++ fatal_f("no helper for PKCS11 key"); ++ debug3_f("free PKCS11 RSA key for provider %s", helper->path); ++ if (helper->rsa_finish != NULL) ++ helper->rsa_finish(rsa); ++ if (helper->nrsa == 0) ++ fatal_f("RSA refcount error"); ++ helper->nrsa--; ++ debug3_f("provider %s remaining keys: %zu RSA %zu ECDSA", ++ helper->path, helper->nrsa, helper->nec); ++ if (helper->nrsa == 0 && helper->nec == 0) ++ helper_terminate(helper); ++ return 1; ++} ++ + static ECDSA_SIG * + ecdsa_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv, + const BIGNUM *rp, EC_KEY *ec) +@@ -175,7 +324,11 @@ ecdsa_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv, + u_char *blob = NULL, *signature = NULL; + size_t blen, slen = 0; + int r, nid; ++ struct helper *helper; + ++ if ((helper = helper_by_ec(ec)) == NULL || helper->fd == -1) ++ fatal_f("no helper for PKCS11 key"); ++ debug3_f("signing with PKCS11 provider %s", helper->path); + nid = sshkey_ecdsa_key_to_nid(ec); + if (nid < 0) { + error_f("couldn't get curve nid"); +@@ -203,10 +356,10 @@ ecdsa_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv, + (r = sshbuf_put_string(msg, dgst, dgst_len)) != 0 || + (r = sshbuf_put_u32(msg, 0)) != 0) + fatal_fr(r, "compose"); +- send_msg(msg); ++ send_msg(helper->fd, msg); + sshbuf_reset(msg); + +- if (recv_msg(msg) == SSH2_AGENT_SIGN_RESPONSE) { ++ if (recv_msg(helper->fd, msg) == SSH2_AGENT_SIGN_RESPONSE) { + if ((r = sshbuf_get_string(msg, &signature, &slen)) != 0) + fatal_fr(r, "parse"); + cp = signature; +@@ -220,75 +373,110 @@ ecdsa_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv, + sshbuf_free(msg); + return (ret); + } +-#endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */ + +-static RSA_METHOD *helper_rsa; +-#if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) +-static EC_KEY_METHOD *helper_ecdsa; +-#endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */ ++static void ++ecdsa_do_finish(EC_KEY *ec) ++{ ++ struct helper *helper; ++ ++ if ((helper = helper_by_ec(ec)) == NULL) ++ fatal_f("no helper for PKCS11 key"); ++ debug3_f("free PKCS11 ECDSA key for provider %s", helper->path); ++ if (helper->ec_finish != NULL) ++ helper->ec_finish(ec); ++ if (helper->nec == 0) ++ fatal_f("ECDSA refcount error"); ++ helper->nec--; ++ debug3_f("provider %s remaining keys: %zu RSA %zu ECDSA", ++ helper->path, helper->nrsa, helper->nec); ++ if (helper->nrsa == 0 && helper->nec == 0) ++ helper_terminate(helper); ++} + + /* redirect private key crypto operations to the ssh-pkcs11-helper */ + static void +-wrap_key(struct sshkey *k) ++wrap_key(struct helper *helper, struct sshkey *k) + { +- if (k->type == KEY_RSA) +- RSA_set_method(k->rsa, helper_rsa); +-#if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) +- else if (k->type == KEY_ECDSA) +- EC_KEY_set_method(k->ecdsa, helper_ecdsa); +-#endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */ +- else ++ debug3_f("wrap %s for provider %s", sshkey_type(k), helper->path); ++ if (k->type == KEY_RSA) { ++ RSA_set_method(k->rsa, helper->rsa_meth); ++ if (helper->nrsa++ >= INT_MAX) ++ fatal_f("RSA refcount error"); ++ } else if (k->type == KEY_ECDSA) { ++ EC_KEY_set_method(k->ecdsa, helper->ec_meth); ++ if (helper->nec++ >= INT_MAX) ++ fatal_f("EC refcount error"); ++ } else + fatal_f("unknown key type"); ++ k->flags |= SSHKEY_FLAG_EXT; ++ debug3_f("provider %s remaining keys: %zu RSA %zu ECDSA", ++ helper->path, helper->nrsa, helper->nec); + } + + static int +-pkcs11_start_helper_methods(void) ++pkcs11_start_helper_methods(struct helper *helper) + { +- if (helper_rsa != NULL) +- return (0); +- +-#if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) +- int (*orig_sign)(int, const unsigned char *, int, unsigned char *, ++ int (*ec_init)(EC_KEY *key); ++ int (*ec_copy)(EC_KEY *dest, const EC_KEY *src); ++ int (*ec_set_group)(EC_KEY *key, const EC_GROUP *grp); ++ int (*ec_set_private)(EC_KEY *key, const BIGNUM *priv_key); ++ int (*ec_set_public)(EC_KEY *key, const EC_POINT *pub_key); ++ int (*ec_sign)(int, const unsigned char *, int, unsigned char *, + unsigned int *, const BIGNUM *, const BIGNUM *, EC_KEY *) = NULL; +- if (helper_ecdsa != NULL) +- return (0); +- helper_ecdsa = EC_KEY_METHOD_new(EC_KEY_OpenSSL()); +- if (helper_ecdsa == NULL) +- return (-1); +- EC_KEY_METHOD_get_sign(helper_ecdsa, &orig_sign, NULL, NULL); +- EC_KEY_METHOD_set_sign(helper_ecdsa, orig_sign, NULL, ecdsa_do_sign); +-#endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */ +- +- if ((helper_rsa = RSA_meth_dup(RSA_get_default_method())) == NULL) ++ RSA_METHOD *rsa_meth; ++ EC_KEY_METHOD *ec_meth; ++ ++ if ((ec_meth = EC_KEY_METHOD_new(EC_KEY_OpenSSL())) == NULL) ++ return -1; ++ EC_KEY_METHOD_get_sign(ec_meth, &ec_sign, NULL, NULL); ++ EC_KEY_METHOD_set_sign(ec_meth, ec_sign, NULL, ecdsa_do_sign); ++ EC_KEY_METHOD_get_init(ec_meth, &ec_init, &helper->ec_finish, ++ &ec_copy, &ec_set_group, &ec_set_private, &ec_set_public); ++ EC_KEY_METHOD_set_init(ec_meth, ec_init, ecdsa_do_finish, ++ ec_copy, ec_set_group, ec_set_private, ec_set_public); ++ ++ if ((rsa_meth = RSA_meth_dup(RSA_get_default_method())) == NULL) + fatal_f("RSA_meth_dup failed"); +- if (!RSA_meth_set1_name(helper_rsa, "ssh-pkcs11-helper") || +- !RSA_meth_set_priv_enc(helper_rsa, rsa_encrypt)) ++ helper->rsa_finish = RSA_meth_get_finish(rsa_meth); ++ if (!RSA_meth_set1_name(rsa_meth, "ssh-pkcs11-helper") || ++ !RSA_meth_set_priv_enc(rsa_meth, rsa_encrypt) || ++ !RSA_meth_set_finish(rsa_meth, rsa_finish)) + fatal_f("failed to prepare method"); + +- return (0); ++ helper->ec_meth = ec_meth; ++ helper->rsa_meth = rsa_meth; ++ return 0; + } + +-static int +-pkcs11_start_helper(void) ++static struct helper * ++pkcs11_start_helper(const char *path) + { + int pair[2]; +- char *helper, *verbosity = NULL; +- +- if (log_level_get() >= SYSLOG_LEVEL_DEBUG1) +- verbosity = "-vvv"; +- +- if (pkcs11_start_helper_methods() == -1) { +- error("pkcs11_start_helper_methods failed"); +- return (-1); +- } ++ char *prog, *verbosity = NULL; ++ struct helper *helper; ++ pid_t pid; + ++ if (nhelpers >= INT_MAX) ++ fatal_f("too many helpers"); ++ debug3_f("start helper for %s", path); + if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1) { +- error("socketpair: %s", strerror(errno)); +- return (-1); ++ error_f("socketpair: %s", strerror(errno)); ++ return NULL; ++ } ++ helper = xcalloc(1, sizeof(*helper)); ++ if (pkcs11_start_helper_methods(helper) == -1) { ++ error_f("pkcs11_start_helper_methods failed"); ++ goto fail; + } + if ((pid = fork()) == -1) { +- error("fork: %s", strerror(errno)); +- return (-1); ++ error_f("fork: %s", strerror(errno)); ++ fail: ++ close(pair[0]); ++ close(pair[1]); ++ RSA_meth_free(helper->rsa_meth); ++ EC_KEY_METHOD_free(helper->ec_meth); ++ free(helper); ++ return NULL; + } else if (pid == 0) { + if ((dup2(pair[1], STDIN_FILENO) == -1) || + (dup2(pair[1], STDOUT_FILENO) == -1)) { +@@ -297,18 +485,27 @@ pkcs11_start_helper(void) + } + close(pair[0]); + close(pair[1]); +- helper = getenv("SSH_PKCS11_HELPER"); +- if (helper == NULL || strlen(helper) == 0) +- helper = _PATH_SSH_PKCS11_HELPER; +- debug_f("starting %s %s", helper, ++ prog = getenv("SSH_PKCS11_HELPER"); ++ if (prog == NULL || strlen(prog) == 0) ++ prog = _PATH_SSH_PKCS11_HELPER; ++ if (log_level_get() >= SYSLOG_LEVEL_DEBUG1) ++ verbosity = "-vvv"; ++ debug_f("starting %s %s", prog, + verbosity == NULL ? "" : verbosity); +- execlp(helper, helper, verbosity, (char *)NULL); +- fprintf(stderr, "exec: %s: %s\n", helper, strerror(errno)); ++ execlp(prog, prog, verbosity, (char *)NULL); ++ fprintf(stderr, "exec: %s: %s\n", prog, strerror(errno)); + _exit(1); + } + close(pair[1]); +- fd = pair[0]; +- return (0); ++ helper->fd = pair[0]; ++ helper->path = xstrdup(path); ++ helper->pid = pid; ++ debug3_f("helper %zu for \"%s\" on fd %d pid %ld", nhelpers, ++ helper->path, helper->fd, (long)helper->pid); ++ helpers = xrecallocarray(helpers, nhelpers, ++ nhelpers + 1, sizeof(*helpers)); ++ helpers[nhelpers++] = helper; ++ return helper; + } + + int +@@ -322,9 +519,11 @@ pkcs11_add_provider(char *name, char *pin, struct sshkey ***keysp, + size_t blen; + u_int nkeys, i; + struct sshbuf *msg; ++ struct helper *helper; + +- if (fd < 0 && pkcs11_start_helper() < 0) +- return (-1); ++ if ((helper = helper_by_provider(name)) == NULL && ++ (helper = pkcs11_start_helper(name)) == NULL) ++ return -1; + + if ((msg = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); +@@ -332,10 +531,10 @@ pkcs11_add_provider(char *name, char *pin, struct sshkey ***keysp, + (r = sshbuf_put_cstring(msg, name)) != 0 || + (r = sshbuf_put_cstring(msg, pin)) != 0) + fatal_fr(r, "compose"); +- send_msg(msg); ++ send_msg(helper->fd, msg); + sshbuf_reset(msg); + +- type = recv_msg(msg); ++ type = recv_msg(helper->fd, msg); + if (type == SSH2_AGENT_IDENTITIES_ANSWER) { + if ((r = sshbuf_get_u32(msg, &nkeys)) != 0) + fatal_fr(r, "parse nkeys"); +@@ -349,7 +548,7 @@ pkcs11_add_provider(char *name, char *pin, struct sshkey ***keysp, + fatal_fr(r, "parse key"); + if ((r = sshkey_from_blob(blob, blen, &k)) != 0) + fatal_fr(r, "decode key"); +- wrap_key(k); ++ wrap_key(helper, k); + (*keysp)[i] = k; + if (labelsp) + (*labelsp)[i] = label; +@@ -370,22 +569,15 @@ pkcs11_add_provider(char *name, char *pin, struct sshkey ***keysp, + int + pkcs11_del_provider(char *name) + { +- int r, ret = -1; +- struct sshbuf *msg; +- +- if ((msg = sshbuf_new()) == NULL) +- fatal_f("sshbuf_new failed"); +- if ((r = sshbuf_put_u8(msg, SSH_AGENTC_REMOVE_SMARTCARD_KEY)) != 0 || +- (r = sshbuf_put_cstring(msg, name)) != 0 || +- (r = sshbuf_put_cstring(msg, "")) != 0) +- fatal_fr(r, "compose"); +- send_msg(msg); +- sshbuf_reset(msg); +- +- if (recv_msg(msg) == SSH_AGENT_SUCCESS) +- ret = 0; +- sshbuf_free(msg); +- return (ret); ++ struct helper *helper; ++ ++ /* ++ * ssh-agent deletes keys before calling this, so the helper entry ++ * should be gone before we get here. ++ */ ++ debug3_f("delete %s", name); ++ if ((helper = helper_by_provider(name)) != NULL) ++ helper_terminate(helper); ++ return 0; + } +- + #endif /* ENABLE_PKCS11 */ +-- +2.40.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0002.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0002.patch new file mode 100644 index 0000000000..81f4cc5fba --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0002.patch @@ -0,0 +1,173 @@ +From 29ef8a04866ca14688d5b7fed7b8b9deab851f77 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Wed, 19 Jul 2023 14:02:27 +0000 +Subject: [PATCH 2/4] upstream: Ensure FIDO/PKCS11 libraries contain expected + symbols + +This checks via nlist(3) that candidate provider libraries contain one +of the symbols that we will require prior to dlopen(), which can cause +a number of side effects, including execution of constructors. + +Feedback deraadt; ok markus + +OpenBSD-Commit-ID: 1508a5fbd74e329e69a55b56c453c292029aefbe + +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/29ef8a04866ca14688d5b7fed7b8b9deab851f77] + +CVE: CVE-2023-38408 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + misc.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++ + misc.h | 1 + + ssh-pkcs11.c | 4 +++ + ssh-sk.c | 6 ++-- + 4 files changed, 86 insertions(+), 2 deletions(-) + +diff --git a/misc.c b/misc.c +index 417498d..d0270e7 100644 +--- a/misc.c ++++ b/misc.c +@@ -22,6 +22,7 @@ + + #include <sys/types.h> + #include <sys/ioctl.h> ++#include <sys/mman.h> + #include <sys/socket.h> + #include <sys/stat.h> + #include <sys/time.h> +@@ -35,6 +36,9 @@ + #ifdef HAVE_POLL_H + #include <poll.h> + #endif ++#ifdef HAVE_NLIST_H ++#include <nlist.h> ++#endif + #include <signal.h> + #include <stdarg.h> + #include <stdio.h> +@@ -2784,3 +2788,76 @@ lookup_env_in_list(const char *env, char * const *envs, size_t nenvs) + } + return NULL; + } ++ ++ ++/* ++ * Returns zero if the library at 'path' contains symbol 's', nonzero ++ * otherwise. ++ */ ++int ++lib_contains_symbol(const char *path, const char *s) ++{ ++#ifdef HAVE_NLIST_H ++ struct nlist nl[2]; ++ int ret = -1, r; ++ ++ memset(nl, 0, sizeof(nl)); ++ nl[0].n_name = xstrdup(s); ++ nl[1].n_name = NULL; ++ if ((r = nlist(path, nl)) == -1) { ++ error_f("nlist failed for %s", path); ++ goto out; ++ } ++ if (r != 0 || nl[0].n_value == 0 || nl[0].n_type == 0) { ++ error_f("library %s does not contain symbol %s", path, s); ++ goto out; ++ } ++ /* success */ ++ ret = 0; ++ out: ++ free(nl[0].n_name); ++ return ret; ++#else /* HAVE_NLIST_H */ ++ int fd, ret = -1; ++ struct stat st; ++ void *m = NULL; ++ size_t sz = 0; ++ ++ memset(&st, 0, sizeof(st)); ++ if ((fd = open(path, O_RDONLY)) < 0) { ++ error_f("open %s: %s", path, strerror(errno)); ++ return -1; ++ } ++ if (fstat(fd, &st) != 0) { ++ error_f("fstat %s: %s", path, strerror(errno)); ++ goto out; ++ } ++ if (!S_ISREG(st.st_mode)) { ++ error_f("%s is not a regular file", path); ++ goto out; ++ } ++ if (st.st_size < 0 || ++ (size_t)st.st_size < strlen(s) || ++ st.st_size >= INT_MAX/2) { ++ error_f("%s bad size %lld", path, (long long)st.st_size); ++ goto out; ++ } ++ sz = (size_t)st.st_size; ++ if ((m = mmap(NULL, sz, PROT_READ, MAP_PRIVATE, fd, 0)) == MAP_FAILED || ++ m == NULL) { ++ error_f("mmap %s: %s", path, strerror(errno)); ++ goto out; ++ } ++ if (memmem(m, sz, s, strlen(s)) == NULL) { ++ error_f("%s does not contain expected string %s", path, s); ++ goto out; ++ } ++ /* success */ ++ ret = 0; ++ out: ++ if (m != NULL && m != MAP_FAILED) ++ munmap(m, sz); ++ close(fd); ++ return ret; ++#endif /* HAVE_NLIST_H */ ++} +diff --git a/misc.h b/misc.h +index 2e1b5fe..3f48315 100644 +--- a/misc.h ++++ b/misc.h +@@ -96,6 +96,7 @@ int parse_absolute_time(const char *, uint64_t *); + void format_absolute_time(uint64_t, char *, size_t); + int path_absolute(const char *); + int stdfd_devnull(int, int, int); ++int lib_contains_symbol(const char *, const char *); + + void sock_set_v6only(int); + +diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c +index b2e2b32..5eb28e9 100644 +--- a/ssh-pkcs11.c ++++ b/ssh-pkcs11.c +@@ -1532,6 +1532,10 @@ pkcs11_register_provider(char *provider_id, char *pin, + debug_f("provider already registered: %s", provider_id); + goto fail; + } ++ if (lib_contains_symbol(provider_id, "C_GetFunctionList") != 0) { ++ error("provider %s is not a PKCS11 library", provider_id); ++ goto fail; ++ } + /* open shared pkcs11-library */ + if ((handle = dlopen(provider_id, RTLD_NOW)) == NULL) { + error("dlopen %s failed: %s", provider_id, dlerror()); +diff --git a/ssh-sk.c b/ssh-sk.c +index a1ff5cc..1042bf6 100644 +--- a/ssh-sk.c ++++ b/ssh-sk.c +@@ -132,10 +132,12 @@ sshsk_open(const char *path) + #endif + return ret; + } +- if ((ret->dlhandle = dlopen(path, RTLD_NOW)) == NULL) { +- error("Provider \"%s\" dlopen failed: %s", path, dlerror()); ++ if (lib_contains_symbol(path, "sk_api_version") != 0) { ++ error("provider %s is not an OpenSSH FIDO library", path); + goto fail; + } ++ if ((ret->dlhandle = dlopen(path, RTLD_NOW)) == NULL) ++ fatal("Provider \"%s\" dlopen failed: %s", path, dlerror()); + if ((ret->sk_api_version = dlsym(ret->dlhandle, + "sk_api_version")) == NULL) { + error("Provider \"%s\" dlsym(sk_api_version) failed: %s", +-- +2.40.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0003.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0003.patch new file mode 100644 index 0000000000..f226f12edc --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0003.patch @@ -0,0 +1,36 @@ +From 892506b13654301f69f9545f48213fc210e5c5cc Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Wed, 19 Jul 2023 13:55:53 +0000 +Subject: [PATCH 3/4] upstream: terminate process if requested to load a + PKCS#11 provider that isn't a PKCS#11 provider; from / ok markus@ + +OpenBSD-Commit-ID: 39532cf18b115881bb4cfaee32084497aadfa05c + +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/892506b13654301f69f9545f48213fc210e5c5cc] + +CVE: CVE-2023-38408 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + ssh-pkcs11.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c +index 5eb28e9..0aef379 100644 +--- a/ssh-pkcs11.c ++++ b/ssh-pkcs11.c +@@ -1541,10 +1541,8 @@ pkcs11_register_provider(char *provider_id, char *pin, + error("dlopen %s failed: %s", provider_id, dlerror()); + goto fail; + } +- if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) { +- error("dlsym(C_GetFunctionList) failed: %s", dlerror()); +- goto fail; +- } ++ if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) ++ fatal("dlsym(C_GetFunctionList) failed: %s", dlerror()); + p = xcalloc(1, sizeof(*p)); + p->name = xstrdup(provider_id); + p->handle = handle; +-- +2.40.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0004.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0004.patch new file mode 100644 index 0000000000..1ff8505938 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-38408-0004.patch @@ -0,0 +1,114 @@ +From 1f2731f5d7a8f8a8385c6031667ed29072c0d92a Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Wed, 19 Jul 2023 13:56:33 +0000 +Subject: [PATCH 4/4] upstream: Disallow remote addition of FIDO/PKCS11 + provider libraries to ssh-agent by default. + +The old behaviour of allowing remote clients from loading providers +can be restored using `ssh-agent -O allow-remote-pkcs11`. + +Detection of local/remote clients requires a ssh(1) that supports +the `session-bind@openssh.com` extension. Forwarding access to a +ssh-agent socket using non-OpenSSH tools may circumvent this control. + +ok markus@ + +OpenBSD-Commit-ID: 4c2bdf79b214ae7e60cc8c39a45501344fa7bd7c + +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1f2731f5d7a8f8a8385c6031667ed29072c0d92a] + +CVE: CVE-2023-38408 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + ssh-agent.1 | 21 +++++++++++++++++++++ + ssh-agent.c | 21 ++++++++++++++++++++- + 2 files changed, 41 insertions(+), 1 deletion(-) + +diff --git a/ssh-agent.1 b/ssh-agent.1 +index ed8c870..15d0a47 100644 +--- a/ssh-agent.1 ++++ b/ssh-agent.1 +@@ -102,6 +102,27 @@ The default is + Kill the current agent (given by the + .Ev SSH_AGENT_PID + environment variable). ++Currently two options are supported: ++.Cm allow-remote-pkcs11 ++and ++.Cm no-restrict-websafe . ++.Pp ++The ++.Cm allow-remote-pkcs11 ++option allows clients of a forwarded ++.Nm ++to load PKCS#11 or FIDO provider libraries. ++By default only local clients may perform this operation. ++Note that signalling that a ++.Nm ++client remote is performed by ++.Xr ssh 1 , ++and use of other tools to forward access to the agent socket may circumvent ++this restriction. ++.Pp ++The ++.Cm no-restrict-websafe , ++instructs + .It Fl P Ar allowed_providers + Specify a pattern-list of acceptable paths for PKCS#11 provider and FIDO + authenticator middleware shared libraries that may be used with the +diff --git a/ssh-agent.c b/ssh-agent.c +index 03ae2b0..19eeaae 100644 +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -171,6 +171,12 @@ char socket_dir[PATH_MAX]; + /* Pattern-list of allowed PKCS#11/Security key paths */ + static char *allowed_providers; + ++/* ++ * Allows PKCS11 providers or SK keys that use non-internal providers to ++ * be added over a remote connection (identified by session-bind@openssh.com). ++ */ ++static int remote_add_provider; ++ + /* locking */ + #define LOCK_SIZE 32 + #define LOCK_SALT_SIZE 16 +@@ -1239,6 +1245,12 @@ process_add_identity(SocketEntry *e) + if (strcasecmp(sk_provider, "internal") == 0) { + debug_f("internal provider"); + } else { ++ if (e->nsession_ids != 0 && !remote_add_provider) { ++ verbose("failed add of SK provider \"%.100s\": " ++ "remote addition of providers is disabled", ++ sk_provider); ++ goto out; ++ } + if (realpath(sk_provider, canonical_provider) == NULL) { + verbose("failed provider \"%.100s\": " + "realpath: %s", sk_provider, +@@ -1402,6 +1414,11 @@ process_add_smartcard_key(SocketEntry *e) + error_f("failed to parse constraints"); + goto send; + } ++ if (e->nsession_ids != 0 && !remote_add_provider) { ++ verbose("failed PKCS#11 add of \"%.100s\": remote addition of " ++ "providers is disabled", provider); ++ goto send; ++ } + if (realpath(provider, canonical_provider) == NULL) { + verbose("failed PKCS#11 add of \"%.100s\": realpath: %s", + provider, strerror(errno)); +@@ -2061,7 +2078,9 @@ main(int ac, char **av) + break; + case 'O': + if (strcmp(optarg, "no-restrict-websafe") == 0) +- restrict_websafe = 0; ++ restrict_websafe = 0; ++ else if (strcmp(optarg, "allow-remote-pkcs11") == 0) ++ remote_add_provider = 1; + else + fatal("Unknown -O option"); + break; +-- +2.40.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch new file mode 100644 index 0000000000..6b2f927779 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-48795.patch @@ -0,0 +1,476 @@ +(modified to not remove ssh_packet_read_expect() and to add to +KexAlgorithms in sshd.c and sshconnect2.c as this version pre-dates +kex_proposal_populate_entries()) + +Backport of: + +From 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Mon, 18 Dec 2023 14:45:17 +0000 +Subject: [PATCH] upstream: implement "strict key exchange" in ssh and sshd + +This adds a protocol extension to improve the integrity of the SSH +transport protocol, particular in and around the initial key exchange +(KEX) phase. + +Full details of the extension are in the PROTOCOL file. + +with markus@ + +OpenBSD-Commit-ID: 2a66ac962f0a630d7945fee54004ed9e9c439f14 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches/CVE-2023-48795.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5] +CVE: CVE-2023-48795 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + PROTOCOL | 26 +++++++++++++++++ + kex.c | 72 +++++++++++++++++++++++++++++++---------------- + kex.h | 1 + + packet.c | 78 ++++++++++++++++++++++++++++++++++++++------------- + sshconnect2.c | 14 +++------ + sshd.c | 7 +++-- + 6 files changed, 142 insertions(+), 56 deletions(-) + +diff --git a/PROTOCOL b/PROTOCOL +index e6a7d60..971f01e 100644 +--- a/PROTOCOL ++++ b/PROTOCOL +@@ -102,6 +102,32 @@ OpenSSH supports the use of ECDH in Curve25519 for key exchange as + described at: + http://git.libssh.org/users/aris/libssh.git/plain/doc/curve25519-sha256@libssh.org.txt?h=curve25519 + ++1.9 transport: strict key exchange extension ++ ++OpenSSH supports a number of transport-layer hardening measures under ++a "strict KEX" feature. This feature is signalled similarly to the ++RFC8308 ext-info feature: by including a additional algorithm in the ++initiial SSH2_MSG_KEXINIT kex_algorithms field. The client may append ++"kex-strict-c-v00@openssh.com" to its kex_algorithms and the server ++may append "kex-strict-s-v00@openssh.com". These pseudo-algorithms ++are only valid in the initial SSH2_MSG_KEXINIT and MUST be ignored ++if they are present in subsequent SSH2_MSG_KEXINIT packets. ++ ++When an endpoint that supports this extension observes this algorithm ++name in a peer's KEXINIT packet, it MUST make the following changes to ++the the protocol: ++ ++a) During initial KEX, terminate the connection if any unexpected or ++ out-of-sequence packet is received. This includes terminating the ++ connection if the first packet received is not SSH2_MSG_KEXINIT. ++ Unexpected packets for the purpose of strict KEX include messages ++ that are otherwise valid at any time during the connection such as ++ SSH2_MSG_DEBUG and SSH2_MSG_IGNORE. ++b) After sending or receiving a SSH2_MSG_NEWKEYS message, reset the ++ packet sequence number to zero. This behaviour persists for the ++ duration of the connection (i.e. not just the first ++ SSH2_MSG_NEWKEYS). ++ + 2. Connection protocol changes + + 2.1. connection: Channel write close extension "eow@openssh.com" +diff --git a/kex.c b/kex.c +index 0bcd27d..e7b2d4d 100644 +--- a/kex.c ++++ b/kex.c +@@ -63,7 +63,7 @@ + #include "digest.h" + + /* prototype */ +-static int kex_choose_conf(struct ssh *); ++static int kex_choose_conf(struct ssh *, uint32_t seq); + static int kex_input_newkeys(int, u_int32_t, struct ssh *); + + static const char * const proposal_names[PROPOSAL_MAX] = { +@@ -175,6 +175,18 @@ kex_names_valid(const char *names) + return 1; + } + ++/* returns non-zero if proposal contains any algorithm from algs */ ++static int ++has_any_alg(const char *proposal, const char *algs) ++{ ++ char *cp; ++ ++ if ((cp = match_list(proposal, algs, NULL)) == NULL) ++ return 0; ++ free(cp); ++ return 1; ++} ++ + /* + * Concatenate algorithm names, avoiding duplicates in the process. + * Caller must free returned string. +@@ -182,7 +194,7 @@ kex_names_valid(const char *names) + char * + kex_names_cat(const char *a, const char *b) + { +- char *ret = NULL, *tmp = NULL, *cp, *p, *m; ++ char *ret = NULL, *tmp = NULL, *cp, *p; + size_t len; + + if (a == NULL || *a == '\0') +@@ -199,10 +211,8 @@ kex_names_cat(const char *a, const char *b) + } + strlcpy(ret, a, len); + for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) { +- if ((m = match_list(ret, p, NULL)) != NULL) { +- free(m); ++ if (has_any_alg(ret, p)) + continue; /* Algorithm already present */ +- } + if (strlcat(ret, ",", len) >= len || + strlcat(ret, p, len) >= len) { + free(tmp); +@@ -410,7 +420,12 @@ kex_protocol_error(int type, u_int32_t seq, struct ssh *ssh) + { + int r; + +- error("kex protocol error: type %d seq %u", type, seq); ++ /* If in strict mode, any unexpected message is an error */ ++ if ((ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict) { ++ ssh_packet_disconnect(ssh, "strict KEX violation: " ++ "unexpected packet type %u (seqnr %u)", type, seq); ++ } ++ error_f("type %u seq %u", type, seq); + if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 || + (r = sshpkt_put_u32(ssh, seq)) != 0 || + (r = sshpkt_send(ssh)) != 0) +@@ -485,6 +500,11 @@ kex_input_ext_info(int type, u_int32_t seq, struct ssh *ssh) + ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &kex_protocol_error); + if ((r = sshpkt_get_u32(ssh, &ninfo)) != 0) + return r; ++ if (ninfo >= 1024) { ++ error("SSH2_MSG_EXT_INFO with too many entries, expected " ++ "<=1024, received %u", ninfo); ++ return dispatch_protocol_error(type, seq, ssh); ++ } + for (i = 0; i < ninfo; i++) { + if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0) + return r; +@@ -600,7 +620,7 @@ kex_input_kexinit(int type, u_int32_t seq, struct ssh *ssh) + error_f("no kex"); + return SSH_ERR_INTERNAL_ERROR; + } +- ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL); ++ ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_protocol_error); + ptr = sshpkt_ptr(ssh, &dlen); + if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0) + return r; +@@ -636,7 +656,7 @@ kex_input_kexinit(int type, u_int32_t seq, struct ssh *ssh) + if (!(kex->flags & KEX_INIT_SENT)) + if ((r = kex_send_kexinit(ssh)) != 0) + return r; +- if ((r = kex_choose_conf(ssh)) != 0) ++ if ((r = kex_choose_conf(ssh, seq)) != 0) + return r; + + if (kex->kex_type < KEX_MAX && kex->kex[kex->kex_type] != NULL) +@@ -900,20 +920,14 @@ proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX]) + return (1); + } + +-/* returns non-zero if proposal contains any algorithm from algs */ + static int +-has_any_alg(const char *proposal, const char *algs) ++kexalgs_contains(char **peer, const char *ext) + { +- char *cp; +- +- if ((cp = match_list(proposal, algs, NULL)) == NULL) +- return 0; +- free(cp); +- return 1; ++ return has_any_alg(peer[PROPOSAL_KEX_ALGS], ext); + } + + static int +-kex_choose_conf(struct ssh *ssh) ++kex_choose_conf(struct ssh *ssh, uint32_t seq) + { + struct kex *kex = ssh->kex; + struct newkeys *newkeys; +@@ -938,13 +952,23 @@ kex_choose_conf(struct ssh *ssh) + sprop=peer; + } + +- /* Check whether client supports ext_info_c */ +- if (kex->server && (kex->flags & KEX_INITIAL)) { +- char *ext; +- +- ext = match_list("ext-info-c", peer[PROPOSAL_KEX_ALGS], NULL); +- kex->ext_info_c = (ext != NULL); +- free(ext); ++ /* Check whether peer supports ext_info/kex_strict */ ++ if ((kex->flags & KEX_INITIAL) != 0) { ++ if (kex->server) { ++ kex->ext_info_c = kexalgs_contains(peer, "ext-info-c"); ++ kex->kex_strict = kexalgs_contains(peer, ++ "kex-strict-c-v00@openssh.com"); ++ } else { ++ kex->kex_strict = kexalgs_contains(peer, ++ "kex-strict-s-v00@openssh.com"); ++ } ++ if (kex->kex_strict) { ++ debug3_f("will use strict KEX ordering"); ++ if (seq != 0) ++ ssh_packet_disconnect(ssh, ++ "strict KEX violation: " ++ "KEXINIT was not the first packet"); ++ } + } + + /* Check whether client supports rsa-sha2 algorithms */ +diff --git a/kex.h b/kex.h +index c353295..d97323e 100644 +--- a/kex.h ++++ b/kex.h +@@ -148,6 +148,7 @@ struct kex { + u_int kex_type; + char *server_sig_algs; + int ext_info_c; ++ int kex_strict; + struct sshbuf *my; + struct sshbuf *peer; + struct sshbuf *client_version; +diff --git a/packet.c b/packet.c +index bde6c10..28f3729 100644 +--- a/packet.c ++++ b/packet.c +@@ -1205,8 +1205,13 @@ ssh_packet_send2_wrapped(struct ssh *ssh) + sshbuf_dump(state->output, stderr); + #endif + /* increment sequence number for outgoing packets */ +- if (++state->p_send.seqnr == 0) ++ if (++state->p_send.seqnr == 0) { ++ if ((ssh->kex->flags & KEX_INITIAL) != 0) { ++ ssh_packet_disconnect(ssh, "outgoing sequence number " ++ "wrapped during initial key exchange"); ++ } + logit("outgoing seqnr wraps around"); ++ } + if (++state->p_send.packets == 0) + if (!(ssh->compat & SSH_BUG_NOREKEY)) + return SSH_ERR_NEED_REKEY; +@@ -1214,6 +1219,11 @@ ssh_packet_send2_wrapped(struct ssh *ssh) + state->p_send.bytes += len; + sshbuf_reset(state->outgoing_packet); + ++ if (type == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) { ++ debug_f("resetting send seqnr %u", state->p_send.seqnr); ++ state->p_send.seqnr = 0; ++ } ++ + if (type == SSH2_MSG_NEWKEYS) + r = ssh_set_newkeys(ssh, MODE_OUT); + else if (type == SSH2_MSG_USERAUTH_SUCCESS && state->server_side) +@@ -1342,8 +1352,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) + /* Stay in the loop until we have received a complete packet. */ + for (;;) { + /* Try to read a packet from the buffer. */ +- r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p); +- if (r != 0) ++ if ((r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p)) != 0) + break; + /* If we got a packet, return it. */ + if (*typep != SSH_MSG_NONE) +@@ -1627,10 +1636,16 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) + if ((r = sshbuf_consume(state->input, mac->mac_len)) != 0) + goto out; + } ++ + if (seqnr_p != NULL) + *seqnr_p = state->p_read.seqnr; +- if (++state->p_read.seqnr == 0) ++ if (++state->p_read.seqnr == 0) { ++ if ((ssh->kex->flags & KEX_INITIAL) != 0) { ++ ssh_packet_disconnect(ssh, "incoming sequence number " ++ "wrapped during initial key exchange"); ++ } + logit("incoming seqnr wraps around"); ++ } + if (++state->p_read.packets == 0) + if (!(ssh->compat & SSH_BUG_NOREKEY)) + return SSH_ERR_NEED_REKEY; +@@ -1696,6 +1711,10 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) + #endif + /* reset for next packet */ + state->packlen = 0; ++ if (*typep == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) { ++ debug_f("resetting read seqnr %u", state->p_read.seqnr); ++ state->p_read.seqnr = 0; ++ } + + if ((r = ssh_packet_check_rekey(ssh)) != 0) + return r; +@@ -1716,10 +1735,39 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) + r = ssh_packet_read_poll2(ssh, typep, seqnr_p); + if (r != 0) + return r; +- if (*typep) { +- state->keep_alive_timeouts = 0; +- DBG(debug("received packet type %d", *typep)); ++ if (*typep == 0) { ++ /* no message ready */ ++ return 0; ++ } ++ state->keep_alive_timeouts = 0; ++ DBG(debug("received packet type %d", *typep)); ++ ++ /* Always process disconnect messages */ ++ if (*typep == SSH2_MSG_DISCONNECT) { ++ if ((r = sshpkt_get_u32(ssh, &reason)) != 0 || ++ (r = sshpkt_get_string(ssh, &msg, NULL)) != 0) ++ return r; ++ /* Ignore normal client exit notifications */ ++ do_log2(ssh->state->server_side && ++ reason == SSH2_DISCONNECT_BY_APPLICATION ? ++ SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR, ++ "Received disconnect from %s port %d:" ++ "%u: %.400s", ssh_remote_ipaddr(ssh), ++ ssh_remote_port(ssh), reason, msg); ++ free(msg); ++ return SSH_ERR_DISCONNECTED; + } ++ ++ /* ++ * Do not implicitly handle any messages here during initial ++ * KEX when in strict mode. They will be need to be allowed ++ * explicitly by the KEX dispatch table or they will generate ++ * protocol errors. ++ */ ++ if (ssh->kex != NULL && ++ (ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict) ++ return 0; ++ /* Implicitly handle transport-level messages */ + switch (*typep) { + case SSH2_MSG_IGNORE: + debug3("Received SSH2_MSG_IGNORE"); +@@ -1734,19 +1782,6 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) + debug("Remote: %.900s", msg); + free(msg); + break; +- case SSH2_MSG_DISCONNECT: +- if ((r = sshpkt_get_u32(ssh, &reason)) != 0 || +- (r = sshpkt_get_string(ssh, &msg, NULL)) != 0) +- return r; +- /* Ignore normal client exit notifications */ +- do_log2(ssh->state->server_side && +- reason == SSH2_DISCONNECT_BY_APPLICATION ? +- SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR, +- "Received disconnect from %s port %d:" +- "%u: %.400s", ssh_remote_ipaddr(ssh), +- ssh_remote_port(ssh), reason, msg); +- free(msg); +- return SSH_ERR_DISCONNECTED; + case SSH2_MSG_UNIMPLEMENTED: + if ((r = sshpkt_get_u32(ssh, &seqnr)) != 0) + return r; +@@ -2211,6 +2246,7 @@ kex_to_blob(struct sshbuf *m, struct kex *kex) + (r = sshbuf_put_u32(m, kex->hostkey_type)) != 0 || + (r = sshbuf_put_u32(m, kex->hostkey_nid)) != 0 || + (r = sshbuf_put_u32(m, kex->kex_type)) != 0 || ++ (r = sshbuf_put_u32(m, kex->kex_strict)) != 0 || + (r = sshbuf_put_stringb(m, kex->my)) != 0 || + (r = sshbuf_put_stringb(m, kex->peer)) != 0 || + (r = sshbuf_put_stringb(m, kex->client_version)) != 0 || +@@ -2373,6 +2409,7 @@ kex_from_blob(struct sshbuf *m, struct kex **kexp) + (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_type)) != 0 || + (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_nid)) != 0 || + (r = sshbuf_get_u32(m, &kex->kex_type)) != 0 || ++ (r = sshbuf_get_u32(m, &kex->kex_strict)) != 0 || + (r = sshbuf_get_stringb(m, kex->my)) != 0 || + (r = sshbuf_get_stringb(m, kex->peer)) != 0 || + (r = sshbuf_get_stringb(m, kex->client_version)) != 0 || +@@ -2701,6 +2738,7 @@ sshpkt_disconnect(struct ssh *ssh, const char *fmt,...) + vsnprintf(buf, sizeof(buf), fmt, args); + va_end(args); + ++ debug2_f("sending SSH2_MSG_DISCONNECT: %s", buf); + if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 || + (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_PROTOCOL_ERROR)) != 0 || + (r = sshpkt_put_cstring(ssh, buf)) != 0 || +diff --git a/sshconnect2.c b/sshconnect2.c +index b25225e..83ae4a4 100644 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -241,7 +241,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, + fatal_fr(r, "kex_assemble_namelist"); + free(all_key); + +- if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL) ++ if ((s = kex_names_cat(options.kex_algorithms, ++ "ext-info-c,kex-strict-c-v00@openssh.com")) == NULL) + fatal_f("kex_names_cat"); + myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, s); + myproposal[PROPOSAL_ENC_ALGS_CTOS] = +@@ -363,7 +364,6 @@ struct cauthmethod { + }; + + static int input_userauth_service_accept(int, u_int32_t, struct ssh *); +-static int input_userauth_ext_info(int, u_int32_t, struct ssh *); + static int input_userauth_success(int, u_int32_t, struct ssh *); + static int input_userauth_failure(int, u_int32_t, struct ssh *); + static int input_userauth_banner(int, u_int32_t, struct ssh *); +@@ -477,7 +477,7 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, + + ssh->authctxt = &authctxt; + ssh_dispatch_init(ssh, &input_userauth_error); +- ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_ext_info); ++ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, kex_input_ext_info); + ssh_dispatch_set(ssh, SSH2_MSG_SERVICE_ACCEPT, &input_userauth_service_accept); + ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &authctxt.success); /* loop until success */ + pubkey_cleanup(ssh); +@@ -529,13 +529,6 @@ input_userauth_service_accept(int type, u_int32_t seq, struct ssh *ssh) + return r; + } + +-/* ARGSUSED */ +-static int +-input_userauth_ext_info(int type, u_int32_t seqnr, struct ssh *ssh) +-{ +- return kex_input_ext_info(type, seqnr, ssh); +-} +- + void + userauth(struct ssh *ssh, char *authlist) + { +@@ -617,6 +610,7 @@ input_userauth_success(int type, u_int32_t seq, struct ssh *ssh) + free(authctxt->methoddata); + authctxt->methoddata = NULL; + authctxt->success = 1; /* break out */ ++ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, dispatch_protocol_error); + return 0; + } + +diff --git a/sshd.c b/sshd.c +index ef18ba4..652bdc3 100644 +--- a/sshd.c ++++ b/sshd.c +@@ -2354,11 +2354,13 @@ static void + do_ssh2_kex(struct ssh *ssh) + { + char *myproposal[PROPOSAL_MAX] = { KEX_SERVER }; ++ char *s; + struct kex *kex; + int r; + +- myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, +- options.kex_algorithms); ++ if ((s = kex_names_cat(options.kex_algorithms, "kex-strict-s-v00@openssh.com")) == NULL) ++ fatal_f("kex_names_cat"); ++ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, s); + myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(ssh, + options.ciphers); + myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(ssh, +@@ -2411,6 +2413,7 @@ do_ssh2_kex(struct ssh *ssh) + (r = ssh_packet_write_wait(ssh)) != 0) + fatal_fr(r, "send test"); + #endif ++ free(s); + debug("KEX done"); + } + +-- +2.25.1 + diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-51384.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-51384.patch new file mode 100644 index 0000000000..ead3256915 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-51384.patch @@ -0,0 +1,171 @@ +From 881d9c6af9da4257c69c327c4e2f1508b2fa754b Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Mon, 18 Dec 2023 14:46:12 +0000 +Subject: [PATCH] upstream: apply destination constraints to all p11 keys + +Previously applied only to the first key returned from each token. + +ok markus@ + +OpenBSD-Commit-ID: 36df3afb8eb94eec6b2541f063d0d164ef8b488d + +CVE: CVE-2023-51384 + +Upstream-Status: Backport +https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + ssh-agent.c | 102 +++++++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 98 insertions(+), 4 deletions(-) + +diff --git a/ssh-agent.c b/ssh-agent.c +index 19eeaae..4dbb4f3 100644 +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -249,6 +249,90 @@ free_dest_constraints(struct dest_constraint *dcs, size_t ndcs) + free(dcs); + } + ++static void ++dup_dest_constraint_hop(const struct dest_constraint_hop *dch, ++ struct dest_constraint_hop *out) ++{ ++ u_int i; ++ int r; ++ ++ out->user = dch->user == NULL ? NULL : xstrdup(dch->user); ++ out->hostname = dch->hostname == NULL ? NULL : xstrdup(dch->hostname); ++ out->is_ca = dch->is_ca; ++ out->nkeys = dch->nkeys; ++ out->keys = out->nkeys == 0 ? NULL : ++ xcalloc(out->nkeys, sizeof(*out->keys)); ++ out->key_is_ca = out->nkeys == 0 ? NULL : ++ xcalloc(out->nkeys, sizeof(*out->key_is_ca)); ++ for (i = 0; i < dch->nkeys; i++) { ++ if (dch->keys[i] != NULL && ++ (r = sshkey_from_private(dch->keys[i], ++ &(out->keys[i]))) != 0) ++ fatal_fr(r, "copy key"); ++ out->key_is_ca[i] = dch->key_is_ca[i]; ++ } ++} ++ ++static struct dest_constraint * ++dup_dest_constraints(const struct dest_constraint *dcs, size_t ndcs) ++{ ++ size_t i; ++ struct dest_constraint *ret; ++ ++ if (ndcs == 0) ++ return NULL; ++ ret = xcalloc(ndcs, sizeof(*ret)); ++ for (i = 0; i < ndcs; i++) { ++ dup_dest_constraint_hop(&dcs[i].from, &ret[i].from); ++ dup_dest_constraint_hop(&dcs[i].to, &ret[i].to); ++ } ++ return ret; ++} ++ ++#ifdef DEBUG_CONSTRAINTS ++static void ++dump_dest_constraint_hop(const struct dest_constraint_hop *dch) ++{ ++ u_int i; ++ char *fp; ++ ++ debug_f("user %s hostname %s is_ca %d nkeys %u", ++ dch->user == NULL ? "(null)" : dch->user, ++ dch->hostname == NULL ? "(null)" : dch->hostname, ++ dch->is_ca, dch->nkeys); ++ for (i = 0; i < dch->nkeys; i++) { ++ fp = NULL; ++ if (dch->keys[i] != NULL && ++ (fp = sshkey_fingerprint(dch->keys[i], ++ SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL) ++ fatal_f("fingerprint failed"); ++ debug_f("key %u/%u: %s%s%s key_is_ca %d", i, dch->nkeys, ++ dch->keys[i] == NULL ? "" : sshkey_ssh_name(dch->keys[i]), ++ dch->keys[i] == NULL ? "" : " ", ++ dch->keys[i] == NULL ? "none" : fp, ++ dch->key_is_ca[i]); ++ free(fp); ++ } ++} ++#endif /* DEBUG_CONSTRAINTS */ ++ ++static void ++dump_dest_constraints(const char *context, ++ const struct dest_constraint *dcs, size_t ndcs) ++{ ++#ifdef DEBUG_CONSTRAINTS ++ size_t i; ++ ++ debug_f("%s: %zu constraints", context, ndcs); ++ for (i = 0; i < ndcs; i++) { ++ debug_f("constraint %zu / %zu: from: ", i, ndcs); ++ dump_dest_constraint_hop(&dcs[i].from); ++ debug_f("constraint %zu / %zu: to: ", i, ndcs); ++ dump_dest_constraint_hop(&dcs[i].to); ++ } ++ debug_f("done for %s", context); ++#endif /* DEBUG_CONSTRAINTS */ ++} + static void + free_identity(Identity *id) + { +@@ -520,13 +604,22 @@ process_request_identities(SocketEntry *e) + Identity *id; + struct sshbuf *msg, *keys; + int r; +- u_int nentries = 0; ++ u_int i = 0, nentries = 0; ++ char *fp; + + debug2_f("entering"); + + if ((msg = sshbuf_new()) == NULL || (keys = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); + TAILQ_FOREACH(id, &idtab->idlist, next) { ++ if ((fp = sshkey_fingerprint(id->key, SSH_FP_HASH_DEFAULT, ++ SSH_FP_DEFAULT)) == NULL) ++ fatal_f("fingerprint failed"); ++ debug_f("key %u / %u: %s %s", i++, idtab->nentries, ++ sshkey_ssh_name(id->key), fp); ++ dump_dest_constraints(__func__, ++ id->dest_constraints, id->ndest_constraints); ++ free(fp); + /* identity not visible, don't include in response */ + if (identity_permitted(id, e, NULL, NULL, NULL) != 0) + continue; +@@ -1235,6 +1328,7 @@ process_add_identity(SocketEntry *e) + sshbuf_reset(e->request); + goto out; + } ++ dump_dest_constraints(__func__, dest_constraints, ndest_constraints); + + if (sk_provider != NULL) { + if (!sshkey_is_sk(k)) { +@@ -1414,6 +1508,7 @@ process_add_smartcard_key(SocketEntry *e) + error_f("failed to parse constraints"); + goto send; + } ++ dump_dest_constraints(__func__, dest_constraints, ndest_constraints); + if (e->nsession_ids != 0 && !remote_add_provider) { + verbose("failed PKCS#11 add of \"%.100s\": remote addition of " + "providers is disabled", provider); +@@ -1449,10 +1544,9 @@ process_add_smartcard_key(SocketEntry *e) + } + id->death = death; + id->confirm = confirm; +- id->dest_constraints = dest_constraints; ++ id->dest_constraints = dup_dest_constraints( ++ dest_constraints, ndest_constraints); + id->ndest_constraints = ndest_constraints; +- dest_constraints = NULL; /* transferred */ +- ndest_constraints = 0; + TAILQ_INSERT_TAIL(&idtab->idlist, id, next); + idtab->nentries++; + success = 1; +-- +2.40.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch new file mode 100644 index 0000000000..b8e6813857 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch @@ -0,0 +1,97 @@ +From 7ef3787c84b6b524501211b11a26c742f829af1a Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Mon, 18 Dec 2023 14:47:44 +0000 +Subject: [PATCH] upstream: ban user/hostnames with most shell metacharacters + This makes ssh(1) refuse user or host names provided on the commandline that + contain most shell metacharacters. + +Some programs that invoke ssh(1) using untrusted data do not filter +metacharacters in arguments they supply. This could create +interactions with user-specified ProxyCommand and other directives +that allow shell injection attacks to occur. + +It's a mistake to invoke ssh(1) with arbitrary untrusted arguments, +but getting this stuff right can be tricky, so this should prevent +most obvious ways of creating risky situations. It however is not +and cannot be perfect: ssh(1) has no practical way of interpreting +what shell quoting rules are in use and how they interact with the +user's specified ProxyCommand. + +To allow configurations that use strange user or hostnames to +continue to work, this strictness is applied only to names coming +from the commandline. Names specified using User or Hostname +directives in ssh_config(5) are not affected. + +feedback/ok millert@ markus@ dtucker@ deraadt@ + +OpenBSD-Commit-ID: 3b487348b5964f3e77b6b4d3da4c3b439e94b2d9 + +CVE: CVE-2023-51385 + +Upstream-Status: Backport +[https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + ssh.c | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/ssh.c b/ssh.c +index 8ff9788..82ed15f 100644 +--- a/ssh.c ++++ b/ssh.c +@@ -611,6 +611,41 @@ ssh_conn_info_free(struct ssh_conn_info *cinfo) + free(cinfo); + } + ++static int ++valid_hostname(const char *s) ++{ ++ size_t i; ++ ++ if (*s == '-') ++ return 0; ++ for (i = 0; s[i] != 0; i++) { ++ if (strchr("'`\"$\\;&<>|(){}", s[i]) != NULL || ++ isspace((u_char)s[i]) || iscntrl((u_char)s[i])) ++ return 0; ++ } ++ return 1; ++} ++ ++static int ++valid_ruser(const char *s) ++{ ++ size_t i; ++ ++ if (*s == '-') ++ return 0; ++ for (i = 0; s[i] != 0; i++) { ++ if (strchr("'`\";&<>|(){}", s[i]) != NULL) ++ return 0; ++ /* Disallow '-' after whitespace */ ++ if (isspace((u_char)s[i]) && s[i + 1] == '-') ++ return 0; ++ /* Disallow \ in last position */ ++ if (s[i] == '\\' && s[i + 1] == '\0') ++ return 0; ++ } ++ return 1; ++} ++ + /* + * Main program for the ssh client. + */ +@@ -1097,6 +1132,10 @@ main(int ac, char **av) + if (!host) + usage(); + ++ if (!valid_hostname(host)) ++ fatal("hostname contains invalid characters"); ++ if (options.user != NULL && !valid_ruser(options.user)) ++ fatal("remote username contains invalid characters"); + host_arg = xstrdup(host); + + /* Initialize the command to execute on remote host. */ +-- +2.40.0 diff --git a/meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch b/meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch new file mode 100644 index 0000000000..3790774f15 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/fix-authorized-principals-command.patch @@ -0,0 +1,30 @@ +From fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Wed, 24 May 2023 23:01:06 +0000 +Subject: [PATCH] upstream: fix AuthorizedPrincipalsCommand when + AuthorizedKeysCommand +Description: Fix the wrong code as the Subject suggests + I added that description to mention, that the file header change was + incompatible with the proposed code below and failed to apply, + therefore I dropped that chunk of the code. +Origin: backport, https://github.com/openssh/openssh-portable/commit/fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290 +Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3574 +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2031942 +Last-Update: 2023-09-01 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches/fix-authorized-principals-command.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/openssh/openssh-portable/commit/fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290] +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ +--- a/servconf.c ++++ b/servconf.c +@@ -2372,7 +2372,7 @@ process_server_config_line_depth(ServerO + fatal("%.200s line %d: %s must be an absolute path", + filename, linenum, keyword); + } +- if (*activep && options->authorized_keys_command == NULL) ++ if (*activep && *charptr == NULL) + *charptr = xstrdup(str + len); + argv_consume(&ac); + break; diff --git a/meta/recipes-connectivity/openssh/openssh/run-ptest b/meta/recipes-connectivity/openssh/openssh/run-ptest index 8a9b770d59..9a406e9b65 100755 --- a/meta/recipes-connectivity/openssh/openssh/run-ptest +++ b/meta/recipes-connectivity/openssh/openssh/run-ptest @@ -5,7 +5,7 @@ export SKIP_UNIT=1 cd regress sed -i "/\t\tagent-ptrace /d" Makefile -make -k BUILDDIR=`pwd`/.. .OBJDIR=`pwd` .CURDIR=`pwd` SUDO="sudo" tests \ +make -k BUILDDIR=`pwd`/.. .OBJDIR=`pwd` .CURDIR=`pwd` SUDO="" tests \ | sed -u -e 's/^skipped/SKIP: /g' -e 's/^ok /PASS: /g' -e 's/^failed/FAIL: /g' SSHAGENT=`which ssh-agent` diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb index 6057d055f4..6411a64eff 100644 --- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb @@ -26,6 +26,16 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://add-test-support-for-busybox.patch \ file://f107467179428a0e3ea9e4aa9738ac12ff02822d.patch \ file://0001-Default-to-not-using-sandbox-when-cross-compiling.patch \ + file://7280401bdd77ca54be6867a154cc01e0d72612e0.patch \ + file://0001-upstream-include-destination-constraints-for-smartca.patch \ + file://CVE-2023-38408-0001.patch \ + file://CVE-2023-38408-0002.patch \ + file://CVE-2023-38408-0003.patch \ + file://CVE-2023-38408-0004.patch \ + file://fix-authorized-principals-command.patch \ + file://CVE-2023-48795.patch \ + file://CVE-2023-51384.patch \ + file://CVE-2023-51385.patch \ " SRC_URI[sha256sum] = "fd497654b7ab1686dac672fb83dfb4ba4096e8b5ffcdaccd262380ae58bec5e7" @@ -39,6 +49,11 @@ CVE_CHECK_IGNORE += "CVE-2014-9278" # CVE only applies to some distributed RHEL binaries CVE_CHECK_IGNORE += "CVE-2008-3844" +# Upstream does not consider CVE-2023-51767 a bug underlying in OpenSSH and +# does not intent to address it in OpenSSH +# https://security-tracker.debian.org/tracker/CVE-2023-51767 +CVE_CHECK_IGNORE += "CVE-2023-51767" + PAM_SRC_URI = "file://sshd" inherit manpages useradd update-rc.d update-alternatives systemd @@ -164,7 +179,7 @@ RDEPENDS:${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pa # conflict with each other RDEPENDS:${PN}-dev = "" # gdb would make attach-ptrace test pass rather than skip but not worth the build dependencies -RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed sudo coreutils" +RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed coreutils" RPROVIDES:${PN}-ssh = "ssh" RPROVIDES:${PN}-sshd = "sshd" diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch index 0b7abc3a11..af435472a5 100644 --- a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch +++ b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch @@ -22,7 +22,7 @@ Index: openssl-3.0.4/Configure } -if ($target =~ /linux.*-mips/ && !$disabled{asm} -- && !grep { $_ !~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) { +- && !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) { - # minimally required architecture flags for assembly modules - my $value; - $value = '-mips2' if ($target =~ /mips32/); diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2022-3996.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2022-3996.patch deleted file mode 100644 index 6d70b323d1..0000000000 --- a/meta/recipes-connectivity/openssl/openssl/CVE-2022-3996.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001 -From: Pauli <pauli@openssl.org> -Date: Fri, 11 Nov 2022 09:40:19 +1100 -Subject: [PATCH] x509: fix double locking problem - -This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the -redundant flag setting. - -Fixes #19643 - -Fixes LOW CVE-2022-3996 - -Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> -Reviewed-by: Tomas Mraz <tomas@openssl.org> -(Merged from https://github.com/openssl/openssl/pull/19652) - -(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5) - -Upstream-Status: Backport [https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7] -CVE: CVE-2022-3996 -Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> ---- - crypto/x509/pcy_map.c | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c -index 05406c6493..60dfd1e320 100644 ---- a/crypto/x509/pcy_map.c -+++ b/crypto/x509/pcy_map.c -@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) - - ret = 1; - bad_mapping: -- if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) { -- x->ex_flags |= EXFLAG_INVALID_POLICY; -- CRYPTO_THREAD_unlock(x->lock); -- } - sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); - return ret; - --- -2.30.2 - diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch new file mode 100644 index 0000000000..8aea686205 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch @@ -0,0 +1,122 @@ +From b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d Mon Sep 17 00:00:00 2001 +From: Matt Caswell <matt@openssl.org> +Date: Tue, 5 Mar 2024 15:43:53 +0000 +Subject: [PATCH] Fix unconstrained session cache growth in TLSv1.3 + +In TLSv1.3 we create a new session object for each ticket that we send. +We do this by duplicating the original session. If SSL_OP_NO_TICKET is in +use then the new session will be added to the session cache. However, if +early data is not in use (and therefore anti-replay protection is being +used), then multiple threads could be resuming from the same session +simultaneously. If this happens and a problem occurs on one of the threads, +then the original session object could be marked as not_resumable. When we +duplicate the session object this not_resumable status gets copied into the +new session object. The new session object is then added to the session +cache even though it is not_resumable. + +Subsequently, another bug means that the session_id_length is set to 0 for +sessions that are marked as not_resumable - even though that session is +still in the cache. Once this happens the session can never be removed from +the cache. When that object gets to be the session cache tail object the +cache never shrinks again and grows indefinitely. + +CVE-2024-2511 + +Reviewed-by: Neil Horman <nhorman@openssl.org> +Reviewed-by: Tomas Mraz <tomas@openssl.org> +(Merged from https://github.com/openssl/openssl/pull/24044) + +(cherry picked from commit 7e4d731b1c07201ad9374c1cd9ac5263bdf35bce) + +CVE: CVE-2024-2511 +Upstream-Status: Backport [https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + ssl/ssl_lib.c | 5 +++-- + ssl/ssl_sess.c | 28 ++++++++++++++++++++++------ + ssl/statem/statem_srvr.c | 5 ++--- + 3 files changed, 27 insertions(+), 11 deletions(-) + +diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c +index 2c8479eb5fc69..eed649c6fdee9 100644 +--- a/ssl/ssl_lib.c ++++ b/ssl/ssl_lib.c +@@ -3736,9 +3736,10 @@ void ssl_update_cache(SSL *s, int mode) + + /* + * If the session_id_length is 0, we are not supposed to cache it, and it +- * would be rather hard to do anyway :-) ++ * would be rather hard to do anyway :-). Also if the session has already ++ * been marked as not_resumable we should not cache it for later reuse. + */ +- if (s->session->session_id_length == 0) ++ if (s->session->session_id_length == 0 || s->session->not_resumable) + return; + + /* +diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c +index d836b33ed0e81..75adbd9e52b40 100644 +--- a/ssl/ssl_sess.c ++++ b/ssl/ssl_sess.c +@@ -152,16 +152,11 @@ SSL_SESSION *SSL_SESSION_new(void) + return ss; + } + +-SSL_SESSION *SSL_SESSION_dup(const SSL_SESSION *src) +-{ +- return ssl_session_dup(src, 1); +-} +- + /* + * Create a new SSL_SESSION and duplicate the contents of |src| into it. If + * ticket == 0 then no ticket information is duplicated, otherwise it is. + */ +-SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket) ++static SSL_SESSION *ssl_session_dup_intern(const SSL_SESSION *src, int ticket) + { + SSL_SESSION *dest; + +@@ -285,6 +280,27 @@ SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket) + return NULL; + } + ++SSL_SESSION *SSL_SESSION_dup(const SSL_SESSION *src) ++{ ++ return ssl_session_dup_intern(src, 1); ++} ++ ++/* ++ * Used internally when duplicating a session which might be already shared. ++ * We will have resumed the original session. Subsequently we might have marked ++ * it as non-resumable (e.g. in another thread) - but this copy should be ok to ++ * resume from. ++ */ ++SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket) ++{ ++ SSL_SESSION *sess = ssl_session_dup_intern(src, ticket); ++ ++ if (sess != NULL) ++ sess->not_resumable = 0; ++ ++ return sess; ++} ++ + const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len) + { + if (len) +diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c +index a9e67f9d32a77..6c942e6bcec29 100644 +--- a/ssl/statem/statem_srvr.c ++++ b/ssl/statem/statem_srvr.c +@@ -2338,9 +2338,8 @@ int tls_construct_server_hello(SSL *s, WPACKET *pkt) + * so the following won't overwrite an ID that we're supposed + * to send back. + */ +- if (s->session->not_resumable || +- (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER) +- && !s->hit)) ++ if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER) ++ && !s->hit) + s->session->session_id_length = 0; + + if (usetls13) { diff --git a/meta/recipes-connectivity/openssl/openssl_3.0.7.bb b/meta/recipes-connectivity/openssl/openssl_3.0.13.bb index 5156586661..3b253ddde0 100644 --- a/meta/recipes-connectivity/openssl/openssl_3.0.7.bb +++ b/meta/recipes-connectivity/openssl/openssl_3.0.13.bb @@ -12,14 +12,14 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ file://afalg.patch \ file://0001-Configure-do-not-tweak-mips-cflags.patch \ - file://CVE-2022-3996.patch \ + file://CVE-2024-2511.patch \ " SRC_URI:append:class-nativesdk = " \ file://environment.d-openssl.sh \ " -SRC_URI[sha256sum] = "83049d042a260e696f62406ac5c08bf706fd84383f945cf21bd61e9ed95c396e" +SRC_URI[sha256sum] = "88525753f79d3bec27d2fa7c66aa0b92b3aa9498dafd93d7cfa4b3780cdae313" inherit lib_package multilib_header multilib_script ptest perlnative MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash" @@ -78,7 +78,7 @@ do_configure () { esac target="$os-${HOST_ARCH}" case $target in - linux-arc) + linux-arc | linux-microblaze*) target=linux-latomic ;; linux-arm*) @@ -106,7 +106,7 @@ do_configure () { linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el) target=linux64-mips64 ;; - linux-microblaze* | linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*) + linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*) target=linux-generic32 ;; linux-powerpc) @@ -138,7 +138,9 @@ do_configure () { fi # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the # environment variables set by bitbake. Adjust the environment variables instead. - HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="${S}/external/perl/Text-Template-1.46/lib/" \ + PERLEXTERNAL="$(realpath ${S}/external/perl/Text-Template-*/lib)" + test -d "$PERLEXTERNAL" || bberror "PERLEXTERNAL '$PERLEXTERNAL' not found!" + HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="$PERLEXTERNAL" \ perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} ${DEPRECATED_CRYPTO_FLAGS} --prefix=$useprefix --openssldir=${libdir}/ssl-3 --libdir=${libdir} $target perl ${B}/configdata.pm --dump } @@ -184,6 +186,7 @@ PTEST_BUILD_HOST_PATTERN = "perl_version =" do_install_ptest () { install -d ${D}${PTEST_PATH}/test install -m755 ${B}/test/p_test.so ${D}${PTEST_PATH}/test + install -m755 ${B}/test/p_minimal.so ${D}${PTEST_PATH}/test install -m755 ${B}/test/provider_internal_test.cnf ${D}${PTEST_PATH}/test # Prune the build tree diff --git a/meta/recipes-core/base-files/base-files/hosts b/meta/recipes-core/base-files/base-files/hosts index b94f414d5c..10a5b6c704 100644 --- a/meta/recipes-core/base-files/base-files/hosts +++ b/meta/recipes-core/base-files/base-files/hosts @@ -1,4 +1,4 @@ -127.0.0.1 localhost.localdomain localhost +127.0.0.1 localhost # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback diff --git a/meta/recipes-core/busybox/busybox/0001-depmod-Ignore-.debug-directories.patch b/meta/recipes-core/busybox/busybox/0001-depmod-Ignore-.debug-directories.patch index 354f83a4a5..d76118f85b 100644 --- a/meta/recipes-core/busybox/busybox/0001-depmod-Ignore-.debug-directories.patch +++ b/meta/recipes-core/busybox/busybox/0001-depmod-Ignore-.debug-directories.patch @@ -21,7 +21,7 @@ index bb42bbe..aa5a2de 100644 /* Arbitrary. Was sb->st_size, but that breaks .gz etc */ size_t len = (64*1024*1024 - 4096); -+ if (strstr(fname, ".debug") == NULL) ++ if (strstr(fname, ".debug") != NULL) + return TRUE; + if (strrstr(fname, ".ko") == NULL) diff --git a/meta/recipes-core/busybox/busybox/CVE-2022-48174.patch b/meta/recipes-core/busybox/busybox/CVE-2022-48174.patch new file mode 100644 index 0000000000..dd0ea19f02 --- /dev/null +++ b/meta/recipes-core/busybox/busybox/CVE-2022-48174.patch @@ -0,0 +1,80 @@ +From cf5d0889262e1b04ec2aa4caff2f5da2d602c665 Mon Sep 17 00:00:00 2001 +From: Denys Vlasenko <vda.linux@googlemail.com> +Date: Mon, 12 Jun 2023 17:48:47 +0200 +Subject: [PATCH] busybox: shell: avoid segfault on ${0::0/0~09J}. Closes 15216 +function old new delta evaluate_string 1011 1053 +42 + +Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=d417193cf37ca1005830d7e16f5fa7e1d8a44209] +CVE: CVE-2022-48174 + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + shell/math.c | 39 +++++++++++++++++++++++++++++++++++---- + 1 file changed, 35 insertions(+), 4 deletions(-) + +diff --git a/shell/math.c b/shell/math.c +index 76d22c9..727c294 100644 +--- a/shell/math.c ++++ b/shell/math.c +@@ -577,6 +577,28 @@ static arith_t strto_arith_t(const char *nptr, char **endptr) + # endif + #endif + ++//TODO: much better estimation than expr_len/2? Such as: ++//static unsigned estimate_nums_and_names(const char *expr) ++//{ ++// unsigned count = 0; ++// while (*(expr = skip_whitespace(expr)) != '\0') { ++// const char *p; ++// if (isdigit(*expr)) { ++// while (isdigit(*++expr)) ++// continue; ++// count++; ++// continue; ++// } ++// p = endofname(expr); ++// if (p != expr) { ++// expr = p; ++// count++; ++// continue; ++// } ++// } ++// return count; ++//} ++ + static arith_t + evaluate_string(arith_state_t *math_state, const char *expr) + { +@@ -584,10 +606,12 @@ evaluate_string(arith_state_t *math_state, const char *expr) + const char *errmsg; + const char *start_expr = expr = skip_whitespace(expr); + unsigned expr_len = strlen(expr) + 2; +- /* Stack of integers */ +- /* The proof that there can be no more than strlen(startbuf)/2+1 +- * integers in any given correct or incorrect expression +- * is left as an exercise to the reader. */ ++ /* Stack of integers/names */ ++ /* There can be no more than strlen(startbuf)/2+1 ++ * integers/names in any given correct or incorrect expression. ++ * (modulo "09v09v09v09v09v" case, ++ * but we have code to detect that early) ++ */ + var_or_num_t *const numstack = alloca((expr_len / 2) * sizeof(numstack[0])); + var_or_num_t *numstackptr = numstack; + /* Stack of operator tokens */ +@@ -652,6 +676,13 @@ evaluate_string(arith_state_t *math_state, const char *expr) + numstackptr->var = NULL; + errno = 0; + numstackptr->val = strto_arith_t(expr, (char**) &expr); ++ /* A number can't be followed by another number, or a variable name. ++ * We'd catch this later anyway, but this would require numstack[] ++ * to be twice as deep to handle strings where _every_ char is ++ * a new number or name. Example: 09v09v09v09v09v09v09v09v09v ++ */ ++ if (isalnum(*expr) || *expr == '_') ++ goto err; + //bb_error_msg("val:%lld", numstackptr->val); + if (errno) + numstackptr->val = 0; /* bash compat */ +-- +2.40.0 diff --git a/meta/recipes-core/busybox/busybox_1.35.0.bb b/meta/recipes-core/busybox/busybox_1.35.0.bb index e9ca6fdb1a..07a5137d2a 100644 --- a/meta/recipes-core/busybox/busybox_1.35.0.bb +++ b/meta/recipes-core/busybox/busybox_1.35.0.bb @@ -51,6 +51,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ file://0002-nslookup-sanitize-all-printed-strings-with-printable.patch \ file://CVE-2022-30065.patch \ file://0001-devmem-add-128-bit-width.patch \ + file://CVE-2022-48174.patch \ " SRC_URI:append:libc-musl = " file://musl.cfg " diff --git a/meta/recipes-core/dbus/dbus_1.14.4.bb b/meta/recipes-core/dbus/dbus_1.14.8.bb index 85db58e214..f03e5c2d2e 100644 --- a/meta/recipes-core/dbus/dbus_1.14.4.bb +++ b/meta/recipes-core/dbus/dbus_1.14.8.bb @@ -14,9 +14,9 @@ SRC_URI = "https://dbus.freedesktop.org/releases/dbus/dbus-${PV}.tar.xz \ file://run-ptest \ file://tmpdir.patch \ file://dbus-1.init \ -" + " -SRC_URI[sha256sum] = "7c0f9b8e5ec0ff2479383e62c0084a3a29af99edf1514e9f659b81b30d4e353e" +SRC_URI[sha256sum] = "a6bd5bac5cf19f0c3c594bdae2565a095696980a683a0ef37cb6212e093bde35" EXTRA_OECONF = "--disable-xml-docs \ --disable-doxygen-docs \ @@ -25,6 +25,7 @@ EXTRA_OECONF = "--disable-xml-docs \ --enable-tests \ --enable-checks \ --enable-asserts \ + --runstatedir=/run \ " EXTRA_OECONF:append:class-target = " SYSTEMCTL=${base_bindir}/systemctl" @@ -132,7 +133,7 @@ do_install() { sed 's:@bindir@:${bindir}:' < ${WORKDIR}/dbus-1.init >${WORKDIR}/dbus-1.init.sh install -m 0755 ${WORKDIR}/dbus-1.init.sh ${D}${sysconfdir}/init.d/dbus-1 install -d ${D}${sysconfdir}/default/volatiles - echo "d messagebus messagebus 0755 ${localstatedir}/run/dbus none" \ + echo "d messagebus messagebus 0755 /run/dbus none" \ > ${D}${sysconfdir}/default/volatiles/99_dbus fi @@ -183,4 +184,4 @@ do_install:class-nativesdk() { } BBCLASSEXTEND = "native nativesdk" -CVE_PRODUCT += "d-bus_project:d-bus" +CVE_PRODUCT += "d-bus_project:d-bus freedesktop:dbus freedesktop:libdbus" diff --git a/meta/recipes-core/dropbear/dropbear.inc b/meta/recipes-core/dropbear/dropbear.inc index f3f085b616..a32242949b 100644 --- a/meta/recipes-core/dropbear/dropbear.inc +++ b/meta/recipes-core/dropbear/dropbear.inc @@ -29,6 +29,8 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} \ file://CVE-2021-36369.patch \ + file://CVE-2023-36328.patch \ + file://CVE-2023-48795.patch \ " PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \ diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2023-36328.patch b/meta/recipes-core/dropbear/dropbear/CVE-2023-36328.patch new file mode 100644 index 0000000000..4d8c40f70b --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2023-36328.patch @@ -0,0 +1,144 @@ +From beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 Mon Sep 17 00:00:00 2001 +From: czurnieden <czurnieden@gmx.de> +Date: Wed, 6 Sep 2023 10:48:58 +0000 +Subject: [PATCH] Fix possible integer overflow + +CVE: CVE-2023-36328 + +Upstream-Status: Backport [https://github.com/libtom/libtommath/commit/beba892bc0d4e4ded4d667ab1d2a94f4d75109a9] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + libtommath/bn_mp_2expt.c | 4 ++++ + libtommath/bn_mp_grow.c | 4 ++++ + libtommath/bn_mp_init_size.c | 5 +++++ + libtommath/bn_mp_mul_2d.c | 4 ++++ + libtommath/bn_s_mp_mul_digs.c | 4 ++++ + libtommath/bn_s_mp_mul_digs_fast.c | 4 ++++ + libtommath/bn_s_mp_mul_high_digs.c | 4 ++++ + libtommath/bn_s_mp_mul_high_digs_fast.c | 4 ++++ + 8 files changed, 33 insertions(+) + +diff --git a/libtommath/bn_mp_2expt.c b/libtommath/bn_mp_2expt.c +index 0ae3df1..7d4d884 100644 +--- a/libtommath/bn_mp_2expt.c ++++ b/libtommath/bn_mp_2expt.c +@@ -12,6 +12,10 @@ mp_err mp_2expt(mp_int *a, int b) + { + mp_err err; + ++ if (b < 0) { ++ return MP_VAL; ++ } ++ + /* zero a as per default */ + mp_zero(a); + +diff --git a/libtommath/bn_mp_grow.c b/libtommath/bn_mp_grow.c +index 9e904c5..e7b186c 100644 +--- a/libtommath/bn_mp_grow.c ++++ b/libtommath/bn_mp_grow.c +@@ -9,6 +9,10 @@ mp_err mp_grow(mp_int *a, int size) + int i; + mp_digit *tmp; + ++ if (size < 0) { ++ return MP_VAL; ++ } ++ + /* if the alloc size is smaller alloc more ram */ + if (a->alloc < size) { + /* reallocate the array a->dp +diff --git a/libtommath/bn_mp_init_size.c b/libtommath/bn_mp_init_size.c +index d622687..5fefa96 100644 +--- a/libtommath/bn_mp_init_size.c ++++ b/libtommath/bn_mp_init_size.c +@@ -6,6 +6,11 @@ + /* init an mp_init for a given size */ + mp_err mp_init_size(mp_int *a, int size) + { ++ ++ if (size < 0) { ++ return MP_VAL; ++ } ++ + size = MP_MAX(MP_MIN_PREC, size); + + /* alloc mem */ +diff --git a/libtommath/bn_mp_mul_2d.c b/libtommath/bn_mp_mul_2d.c +index 87354de..2744163 100644 +--- a/libtommath/bn_mp_mul_2d.c ++++ b/libtommath/bn_mp_mul_2d.c +@@ -9,6 +9,10 @@ mp_err mp_mul_2d(const mp_int *a, int b, mp_int *c) + mp_digit d; + mp_err err; + ++ if (b < 0) { ++ return MP_VAL; ++ } ++ + /* copy */ + if (a != c) { + if ((err = mp_copy(a, c)) != MP_OKAY) { +diff --git a/libtommath/bn_s_mp_mul_digs.c b/libtommath/bn_s_mp_mul_digs.c +index 64509d4..2d2f5b0 100644 +--- a/libtommath/bn_s_mp_mul_digs.c ++++ b/libtommath/bn_s_mp_mul_digs.c +@@ -16,6 +16,10 @@ mp_err s_mp_mul_digs(const mp_int *a, const mp_int *b, mp_int *c, int digs) + mp_word r; + mp_digit tmpx, *tmpt, *tmpy; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* can we use the fast multiplier? */ + if ((digs < MP_WARRAY) && + (MP_MIN(a->used, b->used) < MP_MAXFAST)) { +diff --git a/libtommath/bn_s_mp_mul_digs_fast.c b/libtommath/bn_s_mp_mul_digs_fast.c +index b2a287b..d6dd3cc 100644 +--- a/libtommath/bn_s_mp_mul_digs_fast.c ++++ b/libtommath/bn_s_mp_mul_digs_fast.c +@@ -26,6 +26,10 @@ mp_err s_mp_mul_digs_fast(const mp_int *a, const mp_int *b, mp_int *c, int digs) + mp_digit W[MP_WARRAY]; + mp_word _W; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* grow the destination as required */ + if (c->alloc < digs) { + if ((err = mp_grow(c, digs)) != MP_OKAY) { +diff --git a/libtommath/bn_s_mp_mul_high_digs.c b/libtommath/bn_s_mp_mul_high_digs.c +index 2bb2a50..c9dd355 100644 +--- a/libtommath/bn_s_mp_mul_high_digs.c ++++ b/libtommath/bn_s_mp_mul_high_digs.c +@@ -15,6 +15,10 @@ mp_err s_mp_mul_high_digs(const mp_int *a, const mp_int *b, mp_int *c, int digs) + mp_word r; + mp_digit tmpx, *tmpt, *tmpy; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* can we use the fast multiplier? */ + if (MP_HAS(S_MP_MUL_HIGH_DIGS_FAST) + && ((a->used + b->used + 1) < MP_WARRAY) +diff --git a/libtommath/bn_s_mp_mul_high_digs_fast.c b/libtommath/bn_s_mp_mul_high_digs_fast.c +index a2c4fb6..4ce7f59 100644 +--- a/libtommath/bn_s_mp_mul_high_digs_fast.c ++++ b/libtommath/bn_s_mp_mul_high_digs_fast.c +@@ -19,6 +19,10 @@ mp_err s_mp_mul_high_digs_fast(const mp_int *a, const mp_int *b, mp_int *c, int + mp_digit W[MP_WARRAY]; + mp_word _W; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* grow the destination as required */ + pa = a->used + b->used; + if (c->alloc < pa) { +-- +2.35.5 diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2023-48795.patch b/meta/recipes-core/dropbear/dropbear/CVE-2023-48795.patch new file mode 100644 index 0000000000..6800672ab0 --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2023-48795.patch @@ -0,0 +1,234 @@ +From 6e43be5c7b99dbee49dc72b6f989f29fdd7e9356 Mon Sep 17 00:00:00 2001 +From: Matt Johnston <matt@ucc.asn.au> +Date: Mon, 20 Nov 2023 14:02:47 +0800 +Subject: [PATCH] Implement Strict KEX mode + +As specified by OpenSSH with kex-strict-c-v00@openssh.com and +kex-strict-s-v00@openssh.com. + +CVE: CVE-2023-48795 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/6e43be5c7b99dbee49dc72b6f989f29fdd7e9356] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + cli-session.c | 11 +++++++++++ + common-algo.c | 6 ++++++ + common-kex.c | 26 +++++++++++++++++++++++++- + kex.h | 3 +++ + process-packet.c | 34 +++++++++++++++++++--------------- + ssh.h | 4 ++++ + svr-session.c | 3 +++ + 7 files changed, 71 insertions(+), 16 deletions(-) + +diff --git a/cli-session.c b/src/cli-session.c +index 5981b2470..d261c8f82 100644 +--- a/cli-session.c ++++ b/cli-session.c +@@ -46,6 +46,7 @@ static void cli_finished(void) ATTRIB_NORETURN; + static void recv_msg_service_accept(void); + static void cli_session_cleanup(void); + static void recv_msg_global_request_cli(void); ++static void cli_algos_initialise(void); + + struct clientsession cli_ses; /* GLOBAL */ + +@@ -114,6 +115,7 @@ void cli_session(int sock_in, int sock_out, struct dropbear_progress_connection + } + + chaninitialise(cli_chantypes); ++ cli_algos_initialise(); + + /* Set up cli_ses vars */ + cli_session_init(proxy_cmd_pid); +@@ -473,3 +475,12 @@ void cli_dropbear_log(int priority, const char* format, va_list param) { + fflush(stderr); + } + ++static void cli_algos_initialise(void) { ++ algo_type *algo; ++ for (algo = sshkex; algo->name; algo++) { ++ if (strcmp(algo->name, SSH_STRICT_KEX_S) == 0) { ++ algo->usable = 0; ++ } ++ } ++} ++ +diff --git a/common-algo.c b/src/common-algo.c +index 378f0ca8e..f9d46ebb6 100644 +--- a/common-algo.c ++++ b/common-algo.c +@@ -332,6 +332,12 @@ algo_type sshkex[] = { + /* Set unusable by svr_algos_initialise() */ + {SSH_EXT_INFO_C, 0, NULL, 1, NULL}, + #endif ++#endif ++#if DROPBEAR_CLIENT ++ {SSH_STRICT_KEX_C, 0, NULL, 1, NULL}, ++#endif ++#if DROPBEAR_SERVER ++ {SSH_STRICT_KEX_S, 0, NULL, 1, NULL}, + #endif + {NULL, 0, NULL, 0, NULL} + }; +diff --git a/common-kex.c b/src/common-kex.c +index ac8844246..8e33b12a6 100644 +--- a/common-kex.c ++++ b/common-kex.c +@@ -183,6 +183,10 @@ void send_msg_newkeys() { + gen_new_keys(); + switch_keys(); + ++ if (ses.kexstate.strict_kex) { ++ ses.transseq = 0; ++ } ++ + TRACE(("leave send_msg_newkeys")) + } + +@@ -193,7 +197,11 @@ void recv_msg_newkeys() { + + ses.kexstate.recvnewkeys = 1; + switch_keys(); +- ++ ++ if (ses.kexstate.strict_kex) { ++ ses.recvseq = 0; ++ } ++ + TRACE(("leave recv_msg_newkeys")) + } + +@@ -551,6 +559,10 @@ void recv_msg_kexinit() { + + ses.kexstate.recvkexinit = 1; + ++ if (ses.kexstate.strict_kex && !ses.kexstate.donefirstkex && ses.recvseq != 1) { ++ dropbear_exit("First packet wasn't kexinit"); ++ } ++ + TRACE(("leave recv_msg_kexinit")) + } + +@@ -861,6 +873,18 @@ static void read_kex_algos() { + } + #endif + ++ if (!ses.kexstate.donefirstkex) { ++ const char* strict_name; ++ if (IS_DROPBEAR_CLIENT) { ++ strict_name = SSH_STRICT_KEX_S; ++ } else { ++ strict_name = SSH_STRICT_KEX_C; ++ } ++ if (buf_has_algo(ses.payload, strict_name) == DROPBEAR_SUCCESS) { ++ ses.kexstate.strict_kex = 1; ++ } ++ } ++ + algo = buf_match_algo(ses.payload, sshkex, kexguess2, &goodguess); + allgood &= goodguess; + if (algo == NULL || algo->data == NULL) { +diff --git a/kex.h b/src/kex.h +index 77cf21a37..7fcc3c252 100644 +--- a/kex.h ++++ b/kex.h +@@ -83,6 +83,9 @@ struct KEXState { + + unsigned our_first_follows_matches : 1; + ++ /* Boolean indicating that strict kex mode is in use */ ++ unsigned int strict_kex; ++ + time_t lastkextime; /* time of the last kex */ + unsigned int datatrans; /* data transmitted since last kex */ + unsigned int datarecv; /* data received since last kex */ +diff --git a/process-packet.c b/src/process-packet.c +index 945416023..133a152d0 100644 +--- a/process-packet.c ++++ b/process-packet.c +@@ -44,6 +44,7 @@ void process_packet() { + + unsigned char type; + unsigned int i; ++ unsigned int first_strict_kex = ses.kexstate.strict_kex && !ses.kexstate.donefirstkex; + time_t now; + + TRACE2(("enter process_packet")) +@@ -54,22 +55,24 @@ void process_packet() { + now = monotonic_now(); + ses.last_packet_time_keepalive_recv = now; + +- /* These packets we can receive at any time */ +- switch(type) { + +- case SSH_MSG_IGNORE: +- goto out; +- case SSH_MSG_DEBUG: +- goto out; ++ if (type == SSH_MSG_DISCONNECT) { ++ /* Allowed at any time */ ++ dropbear_close("Disconnect received"); ++ } + +- case SSH_MSG_UNIMPLEMENTED: +- /* debugging XXX */ +- TRACE(("SSH_MSG_UNIMPLEMENTED")) +- goto out; +- +- case SSH_MSG_DISCONNECT: +- /* TODO cleanup? */ +- dropbear_close("Disconnect received"); ++ /* These packets may be received at any time, ++ except during first kex with strict kex */ ++ if (!first_strict_kex) { ++ switch(type) { ++ case SSH_MSG_IGNORE: ++ goto out; ++ case SSH_MSG_DEBUG: ++ goto out; ++ case SSH_MSG_UNIMPLEMENTED: ++ TRACE(("SSH_MSG_UNIMPLEMENTED")) ++ goto out; ++ } + } + + /* Ignore these packet types so that keepalives don't interfere with +@@ -98,7 +101,8 @@ void process_packet() { + if (type >= 1 && type <= 49 + && type != SSH_MSG_SERVICE_REQUEST + && type != SSH_MSG_SERVICE_ACCEPT +- && type != SSH_MSG_KEXINIT) ++ && type != SSH_MSG_KEXINIT ++ && !first_strict_kex) + { + TRACE(("unknown allowed packet during kexinit")) + recv_unimplemented(); +diff --git a/ssh.h b/src/ssh.h +index 1b4fec65f..ef3efdca0 100644 +--- a/ssh.h ++++ b/ssh.h +@@ -100,6 +100,10 @@ + #define SSH_EXT_INFO_C "ext-info-c" + #define SSH_SERVER_SIG_ALGS "server-sig-algs" + ++/* OpenSSH strict KEX feature */ ++#define SSH_STRICT_KEX_S "kex-strict-s-v00@openssh.com" ++#define SSH_STRICT_KEX_C "kex-strict-c-v00@openssh.com" ++ + /* service types */ + #define SSH_SERVICE_USERAUTH "ssh-userauth" + #define SSH_SERVICE_USERAUTH_LEN 12 +diff --git a/svr-session.c b/src/svr-session.c +index 769f0731d..a538e2c5c 100644 +--- a/svr-session.c ++++ b/svr-session.c +@@ -342,6 +342,9 @@ static void svr_algos_initialise(void) { + algo->usable = 0; + } + #endif ++ if (strcmp(algo->name, SSH_STRICT_KEX_C) == 0) { ++ algo->usable = 0; ++ } + } + } + diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-001.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-001.patch new file mode 100644 index 0000000000..c38a334540 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-001.patch @@ -0,0 +1,35 @@ +From cdead241d4f1136c2f38d1b28e95073c59753d30 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 01:40:05 +0200 +Subject: [PATCH] doc/reference.html: Clarify effect of XML_DTD on external + entities + +Defining XML_DTD emnables support for external parameter(!) +entities. External general(!) entities have been supported +even with XML_DTD undefined. (Only now with Expat 2.6.0 +defining XML_GE as 0 can take that away.) + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/cdead241d4f1136c2f38d1b28e95073c59753d30] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + doc/reference.html | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/doc/reference.html b/doc/reference.html +index 8b0d47d..a30e462 100644 +--- a/doc/reference.html ++++ b/doc/reference.html +@@ -365,7 +365,7 @@ this is defined, default attribute values from an external DTD subset + are reported and attribute value normalization occurs based on the + type of attributes defined in the external subset. Without + this, Expat has a smaller memory footprint and can be faster, but will +-not load external entities or process conditional sections. If defined, makes ++not load external parameter entities or process conditional sections. If defined, makes + the functions <code><a + href="#XML_SetBillionLaughsAttackProtectionMaximumAmplification"> + XML_SetBillionLaughsAttackProtectionMaximumAmplification</a></code> and <code> +-- +2.40.0 + diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-002.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-002.patch new file mode 100644 index 0000000000..9aedc3010a --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-002.patch @@ -0,0 +1,72 @@ +From daa89e42c005cc7f4f7af9eee271ae0723d30300 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 00:59:52 +0200 + +Subject: [PATCH] cmake: Introduce option EXPAT_GE to control macro XML_GE + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/daa89e42c005cc7f4f7af9eee271ae0723d30300] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + CMakeLists.txt | 9 +++++++++ + expat_config.h.cmake | 3 +++ + 2 files changed, 12 insertions(+) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 2b4c13c..416fe96 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -140,6 +140,8 @@ expat_shy_set(EXPAT_CONTEXT_BYTES 1024 CACHE STRING "Define to specify how much + mark_as_advanced(EXPAT_CONTEXT_BYTES) + expat_shy_set(EXPAT_DTD ON CACHE BOOL "Define to make parameter entity parsing functionality available") + mark_as_advanced(EXPAT_DTD) ++expat_shy_set(EXPAT_GE ON CACHE BOOL "Define to make general entity parsing functionality available") ++mark_as_advanced(EXPAT_GE) + expat_shy_set(EXPAT_NS ON CACHE BOOL "Define to make XML Namespaces functionality available") + mark_as_advanced(EXPAT_NS) + expat_shy_set(EXPAT_WARNINGS_AS_ERRORS OFF CACHE BOOL "Treat all compiler warnings as errors") +@@ -172,6 +174,11 @@ endif() + # + # Environment checks + # ++if(EXPAT_DTD AND NOT EXPAT_GE) ++ message(SEND_ERROR "Option EXPAT_DTD requires that EXPAT_GE is also enabled.") ++ message(SEND_ERROR "Please either enable option EXPAT_GE (recommended) or disable EXPAT_DTD also.") ++endif() ++ + if(EXPAT_WITH_LIBBSD) + find_library(LIB_BSD NAMES bsd) + if(NOT LIB_BSD) +@@ -274,6 +281,7 @@ endif() + + _expat_copy_bool_int(EXPAT_ATTR_INFO XML_ATTR_INFO) + _expat_copy_bool_int(EXPAT_DTD XML_DTD) ++_expat_copy_bool_int(EXPAT_GE XML_GE) + _expat_copy_bool_int(EXPAT_LARGE_SIZE XML_LARGE_SIZE) + _expat_copy_bool_int(EXPAT_MIN_SIZE XML_MIN_SIZE) + _expat_copy_bool_int(EXPAT_NS XML_NS) +@@ -893,6 +901,7 @@ message(STATUS " // Advanced options, changes not advised") + message(STATUS " Attributes info .......... ${EXPAT_ATTR_INFO}") + message(STATUS " Context bytes ............ ${EXPAT_CONTEXT_BYTES}") + message(STATUS " DTD support .............. ${EXPAT_DTD}") ++message(STATUS " General entities ......... ${EXPAT_GE}") + message(STATUS " Large size ............... ${EXPAT_LARGE_SIZE}") + message(STATUS " Minimum size ............. ${EXPAT_MIN_SIZE}") + message(STATUS " Namespace support ........ ${EXPAT_NS}") +diff --git a/expat_config.h.cmake b/expat_config.h.cmake +index 78fcb4c..330945e 100644 +--- a/expat_config.h.cmake ++++ b/expat_config.h.cmake +@@ -103,6 +103,9 @@ + /* Define to make parameter entity parsing functionality available. */ + #cmakedefine XML_DTD + ++/* Define as 1/0 to enable/disable support for general entities. */ ++#define XML_GE @XML_GE@ ++ + /* Define to make XML Namespaces functionality available. */ + #cmakedefine XML_NS + +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-003.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-003.patch new file mode 100644 index 0000000000..96a62dcffc --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-003.patch @@ -0,0 +1,28 @@ +From ed87a4793404e91c0cc0c81435fcfcc64a8be9f4 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 00:45:23 +0200 +Subject: [PATCH] configure.ac: Define macro XML_GE as 1 + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/ed87a4793404e91c0cc0c81435fcfcc64a8be9f4] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + configure.ac | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/configure.ac b/configure.ac +index d3642de..153bb8e 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -295,6 +295,8 @@ AC_SUBST(FILEMAP) + dnl Some basic configuration: + AC_DEFINE([XML_NS], 1, + [Define to make XML Namespaces functionality available.]) ++AC_DEFINE([XML_GE], 1, ++ [Define as 1/0 to enable/disable support for general entities.]) + AC_DEFINE([XML_DTD], 1, + [Define to make parameter entity parsing functionality available.]) + AC_DEFINE([XML_DEV_URANDOM], 1, +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-004.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-004.patch new file mode 100644 index 0000000000..460113caf7 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-004.patch @@ -0,0 +1,429 @@ +From 0f075ec8ecb5e43f8fdca5182f8cca4703da0404 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 00:43:22 +0200 +Subject: [PATCH] lib|xmlwf|cmake: Extend scope of billion laughs attack + protection + +.. from "defined(XML_DTD)" to "defined(XML_DTD) || XML_GE==1". + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + CMakeLists.txt | 8 ++++- + lib/expat.h | 8 +++-- + lib/internal.h | 2 +- + lib/libexpat.def.cmake | 4 +-- + lib/xmlparse.c | 71 ++++++++++++++++++++++-------------------- + xmlwf/xmlwf.c | 18 ++++++----- + 6 files changed, 62 insertions(+), 49 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 416fe96..e6939e2 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -389,7 +389,13 @@ if(EXPAT_SHARED_LIBS) + endif() + endmacro() + +- _expat_def_file_toggle(EXPAT_DTD _EXPAT_COMMENT_DTD) ++ if(EXPAT_DTD OR EXPAT_GE) ++ set(_EXPAT_DTD_OR_GE TRUE) ++ else() ++ set(_EXPAT_DTD_OR_GE FALSE) ++ endif() ++ ++ _expat_def_file_toggle(_EXPAT_DTD_OR_GE _EXPAT_COMMENT_DTD_OR_GE) + _expat_def_file_toggle(EXPAT_ATTR_INFO _EXPAT_COMMENT_ATTR_INFO) + + configure_file("${CMAKE_CURRENT_SOURCE_DIR}/lib/libexpat.def.cmake" "${CMAKE_CURRENT_BINARY_DIR}/lib/libexpat.def") +diff --git a/lib/expat.h b/lib/expat.h +index 1c83563..33c94af 100644 +--- a/lib/expat.h ++++ b/lib/expat.h +@@ -1038,13 +1038,15 @@ typedef struct { + XMLPARSEAPI(const XML_Feature *) + XML_GetFeatureList(void); + +-#ifdef XML_DTD +-/* Added in Expat 2.4.0. */ ++#if defined(XML_DTD) || XML_GE == 1 ++/* Added in Expat 2.4.0 for XML_DTD defined and ++ * added in Expat 2.6.0 for XML_GE == 1. */ + XMLPARSEAPI(XML_Bool) + XML_SetBillionLaughsAttackProtectionMaximumAmplification( + XML_Parser parser, float maximumAmplificationFactor); + +-/* Added in Expat 2.4.0. */ ++/* Added in Expat 2.4.0 for XML_DTD defined and ++ * added in Expat 2.6.0 for XML_GE == 1. */ + XMLPARSEAPI(XML_Bool) + XML_SetBillionLaughsAttackProtectionActivationThreshold( + XML_Parser parser, unsigned long long activationThresholdBytes); +diff --git a/lib/internal.h b/lib/internal.h +index e09f533..1851925 100644 +--- a/lib/internal.h ++++ b/lib/internal.h +@@ -154,7 +154,7 @@ extern "C" { + void _INTERNAL_trim_to_complete_utf8_characters(const char *from, + const char **fromLimRef); + +-#if defined(XML_DTD) ++#if defined(XML_DTD) || XML_GE == 1 + unsigned long long testingAccountingGetCountBytesDirect(XML_Parser parser); + unsigned long long testingAccountingGetCountBytesIndirect(XML_Parser parser); + const char *unsignedCharToPrintable(unsigned char c); +diff --git a/lib/libexpat.def.cmake b/lib/libexpat.def.cmake +index cf434a2..61a4f00 100644 +--- a/lib/libexpat.def.cmake ++++ b/lib/libexpat.def.cmake +@@ -75,5 +75,5 @@ EXPORTS + XML_SetHashSalt @67 + ; internal @68 removed with version 2.3.1 + ; added with version 2.4.0 +-@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionActivationThreshold @69 +-@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70 ++@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionActivationThreshold @69 ++@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70 +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index b6c2eca..e23441e 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -408,7 +408,7 @@ enum XML_Account { + XML_ACCOUNT_NONE /* i.e. do not account, was accounted already */ + }; + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + typedef unsigned long long XmlBigCount; + typedef struct accounting { + XmlBigCount countBytesDirect; +@@ -424,7 +424,7 @@ typedef struct entity_stats { + unsigned int maximumDepthSeen; + int debugLevel; + } ENTITY_STATS; +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + + typedef enum XML_Error PTRCALL Processor(XML_Parser parser, const char *start, + const char *end, const char **endPtr); +@@ -562,7 +562,7 @@ static XML_Parser parserCreate(const XML_Char *encodingName, + + static void parserInit(XML_Parser parser, const XML_Char *encodingName); + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + static float accountingGetCurrentAmplification(XML_Parser rootParser); + static void accountingReportStats(XML_Parser originParser, const char *epilog); + static void accountingOnAbort(XML_Parser originParser); +@@ -585,7 +585,7 @@ static void entityTrackingOnClose(XML_Parser parser, ENTITY *entity, + + static XML_Parser getRootParserOf(XML_Parser parser, + unsigned int *outLevelDiff); +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + + static unsigned long getDebugLevel(const char *variableName, + unsigned long defaultDebugLevel); +@@ -703,7 +703,7 @@ struct XML_ParserStruct { + enum XML_ParamEntityParsing m_paramEntityParsing; + #endif + unsigned long m_hash_secret_salt; +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + ACCOUNTING m_accounting; + ENTITY_STATS m_entity_stats; + #endif +@@ -1163,7 +1163,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) { + #endif + parser->m_hash_secret_salt = 0; + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + memset(&parser->m_accounting, 0, sizeof(ACCOUNTING)); + parser->m_accounting.debugLevel = getDebugLevel("EXPAT_ACCOUNTING_DEBUG", 0u); + parser->m_accounting.maximumAmplificationFactor +@@ -2522,8 +2522,9 @@ XML_GetFeatureList(void) { + #ifdef XML_ATTR_INFO + {XML_FEATURE_ATTR_INFO, XML_L("XML_ATTR_INFO"), 0}, + #endif +-#ifdef XML_DTD +- /* Added in Expat 2.4.0. */ ++#if defined(XML_DTD) || XML_GE == 1 ++ /* Added in Expat 2.4.0 for XML_DTD defined and ++ * added in Expat 2.6.0 for XML_GE == 1. */ + {XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT, + XML_L("XML_BLAP_MAX_AMP"), + (long int) +@@ -2537,7 +2538,7 @@ XML_GetFeatureList(void) { + return features; + } + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + XML_Bool XMLCALL + XML_SetBillionLaughsAttackProtectionMaximumAmplification( + XML_Parser parser, float maximumAmplificationFactor) { +@@ -2559,7 +2560,7 @@ XML_SetBillionLaughsAttackProtectionActivationThreshold( + parser->m_accounting.activationThresholdBytes = activationThresholdBytes; + return XML_TRUE; + } +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + + /* Initially tag->rawName always points into the parse buffer; + for those TAG instances opened while the current parse buffer was +@@ -2645,13 +2646,13 @@ externalEntityInitProcessor2(XML_Parser parser, const char *start, + int tok = XmlContentTok(parser->m_encoding, start, end, &next); + switch (tok) { + case XML_TOK_BOM: +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, start, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); + return XML_ERROR_AMPLIFICATION_LIMIT_BREACH; + } +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + + /* If we are at the end of the buffer, this would cause the next stage, + i.e. externalEntityInitProcessor3, to pass control directly to +@@ -2765,7 +2766,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + for (;;) { + const char *next = s; /* XmlContentTok doesn't always set the last arg */ + int tok = XmlContentTok(enc, s, end, &next); +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + const char *accountAfter + = ((tok == XML_TOK_TRAILING_RSQB) || (tok == XML_TOK_TRAILING_CR)) + ? (haveMore ? s /* i.e. 0 bytes */ : end) +@@ -2831,14 +2832,14 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + XML_Char ch = (XML_Char)XmlPredefinedEntityName( + enc, s + enc->minBytesPerChar, next - enc->minBytesPerChar); + if (ch) { +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + /* NOTE: We are replacing 4-6 characters original input for 1 character + * so there is no amplification and hence recording without + * protection. */ + accountingDiffTolerated(parser, tok, (char *)&ch, + ((char *)&ch) + sizeof(XML_Char), __LINE__, + XML_ACCOUNT_ENTITY_EXPANSION); +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + if (parser->m_characterDataHandler) + parser->m_characterDataHandler(parser->m_handlerArg, &ch, 1); + else if (parser->m_defaultHandler) +@@ -4040,7 +4041,7 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + for (;;) { + const char *next = s; /* in case of XML_TOK_NONE or XML_TOK_PARTIAL */ + int tok = XmlCdataSectionTok(enc, s, end, &next); +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, account)) { + accountingOnAbort(parser); + return XML_ERROR_AMPLIFICATION_LIMIT_BREACH; +@@ -4192,7 +4193,7 @@ doIgnoreSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + *eventPP = s; + *startPtr = NULL; + tok = XmlIgnoreSectionTok(enc, s, end, &next); +-# ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -4284,7 +4285,7 @@ processXmlDecl(XML_Parser parser, int isGeneralTextEntity, const char *s, + const XML_Char *storedversion = NULL; + int standalone = -1; + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, XML_TOK_XML_DECL, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -4491,7 +4492,7 @@ entityValueInitProcessor(XML_Parser parser, const char *s, const char *end, + */ + else if (tok == XML_TOK_BOM && next == end + && ! parser->m_parsingStatus.finalBuffer) { +-# ifdef XML_DTD ++# if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -4707,11 +4708,13 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + } + } + role = XmlTokenRole(&parser->m_prologState, tok, s, next, enc); +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + switch (role) { + case XML_ROLE_INSTANCE_START: // bytes accounted in contentProcessor + case XML_ROLE_XML_DECL: // bytes accounted in processXmlDecl +- case XML_ROLE_TEXT_DECL: // bytes accounted in processXmlDecl ++ # ifdef XML_DTD ++ case XML_ROLE_TEXT_DECL: // bytes accounted in processXmlDecl ++# endif + break; + default: + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, account)) { +@@ -5648,7 +5651,7 @@ epilogProcessor(XML_Parser parser, const char *s, const char *end, + for (;;) { + const char *next = NULL; + int tok = XmlPrologTok(parser->m_encoding, s, end, &next); +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -5728,7 +5731,7 @@ processInternalEntity(XML_Parser parser, ENTITY *entity, XML_Bool betweenDecl) { + return XML_ERROR_NO_MEMORY; + } + entity->open = XML_TRUE; +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + entityTrackingOnOpen(parser, entity, __LINE__); + #endif + entity->processed = 0; +@@ -5762,9 +5765,9 @@ processInternalEntity(XML_Parser parser, ENTITY *entity, XML_Bool betweenDecl) { + entity->processed = (int)(next - textStart); + parser->m_processor = internalEntityProcessor; + } else { +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + entityTrackingOnClose(parser, entity, __LINE__); +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + entity->open = XML_FALSE; + parser->m_openInternalEntities = openEntity->next; + /* put openEntity back in list of free instances */ +@@ -5813,7 +5816,7 @@ internalEntityProcessor(XML_Parser parser, const char *s, const char *end, + return result; + } + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + entityTrackingOnClose(parser, entity, __LINE__); + #endif + entity->open = XML_FALSE; +@@ -5892,7 +5895,7 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + const char *next + = ptr; /* XmlAttributeValueTok doesn't always set the last arg */ + int tok = XmlAttributeValueTok(enc, ptr, end, &next); +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, ptr, next, __LINE__, account)) { + accountingOnAbort(parser); + return XML_ERROR_AMPLIFICATION_LIMIT_BREACH; +@@ -5957,14 +5960,14 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + XML_Char ch = (XML_Char)XmlPredefinedEntityName( + enc, ptr + enc->minBytesPerChar, next - enc->minBytesPerChar); + if (ch) { +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + /* NOTE: We are replacing 4-6 characters original input for 1 character + * so there is no amplification and hence recording without + * protection. */ + accountingDiffTolerated(parser, tok, (char *)&ch, + ((char *)&ch) + sizeof(XML_Char), __LINE__, + XML_ACCOUNT_ENTITY_EXPANSION); +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + if (! poolAppendChar(pool, ch)) + return XML_ERROR_NO_MEMORY; + break; +@@ -6042,14 +6045,14 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + enum XML_Error result; + const XML_Char *textEnd = entity->textPtr + entity->textLen; + entity->open = XML_TRUE; +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + entityTrackingOnOpen(parser, entity, __LINE__); + #endif + result = appendAttributeValue(parser, parser->m_internalEncoding, + isCdata, (const char *)entity->textPtr, + (const char *)textEnd, pool, + XML_ACCOUNT_ENTITY_EXPANSION); +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + entityTrackingOnClose(parser, entity, __LINE__); + #endif + entity->open = XML_FALSE; +@@ -6105,7 +6108,7 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + = entityTextPtr; /* XmlEntityValueTok doesn't always set the last arg */ + int tok = XmlEntityValueTok(enc, entityTextPtr, entityTextEnd, &next); + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, entityTextPtr, next, __LINE__, + account)) { + accountingOnAbort(parser); +@@ -7651,7 +7654,7 @@ copyString(const XML_Char *s, const XML_Memory_Handling_Suite *memsuite) { + return result; + } + +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + + static float + accountingGetCurrentAmplification(XML_Parser rootParser) { +@@ -8382,7 +8385,7 @@ unsignedCharToPrintable(unsigned char c) { + assert(0); /* never gets here */ + } + +-#endif /* XML_DTD */ ++#endif /* defined(XML_DTD) || XML_GE == 1 */ + + static unsigned long + getDebugLevel(const char *variableName, unsigned long defaultDebugLevel) { +diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c +index 471f2a2..be23f5a 100644 +--- a/xmlwf/xmlwf.c ++++ b/xmlwf/xmlwf.c +@@ -1062,9 +1062,10 @@ tmain(int argc, XML_Char **argv) { + " (needs a floating point number greater or equal than 1.0)")); + exit(XMLWF_EXIT_USAGE_ERROR); + } +-#ifndef XML_DTD +- ftprintf(stderr, T("Warning: Given amplification limit ignored") T( +- ", xmlwf has been compiled without DTD support.\n")); ++#if ! defined(XML_DTD) && XML_GE == 0 ++ ftprintf(stderr, ++ T("Warning: Given amplification limit ignored") ++ T(", xmlwf has been compiled without DTD/GE support.\n")); + #endif + break; + } +@@ -1083,9 +1084,10 @@ tmain(int argc, XML_Char **argv) { + exit(XMLWF_EXIT_USAGE_ERROR); + } + attackThresholdGiven = XML_TRUE; +-#ifndef XML_DTD +- ftprintf(stderr, T("Warning: Given attack threshold ignored") T( +- ", xmlwf has been compiled without DTD support.\n")); ++#if ! defined(XML_DTD) && XML_GE == 0 ++ ftprintf(stderr, ++ T("Warning: Given attack threshold ignored") ++ T(", xmlwf has been compiled without DTD/GE support.\n")); + #endif + break; + } +@@ -1120,13 +1122,13 @@ tmain(int argc, XML_Char **argv) { + } + + if (attackMaximumAmplification != -1.0f) { +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + XML_SetBillionLaughsAttackProtectionMaximumAmplification( + parser, attackMaximumAmplification); + #endif + } + if (attackThresholdGiven) { +-#ifdef XML_DTD ++#if defined(XML_DTD) || XML_GE == 1 + XML_SetBillionLaughsAttackProtectionActivationThreshold( + parser, attackThresholdBytes); + #else +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-005.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-005.patch new file mode 100644 index 0000000000..1e8223fff0 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-005.patch @@ -0,0 +1,34 @@ +From b0975cb73a41869fbecf0fa55afd35b69b64cc50 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 00:47:52 +0200 +Subject: [PATCH] lib: Fail the build if XML_GE is not set to 1 or 0 + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/b0975cb73a41869fbecf0fa55afd35b69b64cc50] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + lib/xmlparse.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index e23441e..ac3efe1 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -62,6 +62,14 @@ + + #include <expat_config.h> + ++#if ! defined(XML_GE) || (1 - XML_GE - 1 == 2) || (XML_GE < 0) || (XML_GE > 1) ++# error XML_GE (for general entities) must be defined, non-empty, either 1 or 0 (0 to disable, 1 to enable; 1 is a common default) ++#endif ++ ++#if defined(XML_DTD) && XML_GE == 0 ++# error Either undefine XML_DTD or define XML_GE to 1. ++#endif ++ + #if ! defined(_GNU_SOURCE) + # define _GNU_SOURCE 1 /* syscall prototype */ + #endif +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-006.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-006.patch new file mode 100644 index 0000000000..d1ab52fa32 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-006.patch @@ -0,0 +1,174 @@ +From 2b127c20b220b673cf52c6be8bef725bf04cbeaf Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 18:32:11 +0200 +Subject: [PATCH] lib: Make XML_GE==0 use self-references as entity replacement + text + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/2b127c20b220b673cf52c6be8bef725bf04cbeaf] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + lib/xmlparse.c | 79 +++++++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 71 insertions(+), 8 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index ac3efe1..c479174 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -504,9 +504,13 @@ static enum XML_Error appendAttributeValue(XML_Parser parser, const ENCODING *, + static ATTRIBUTE_ID *getAttributeId(XML_Parser parser, const ENCODING *enc, + const char *start, const char *end); + static int setElementTypePrefix(XML_Parser parser, ELEMENT_TYPE *); ++#if XML_GE == 1 + static enum XML_Error storeEntityValue(XML_Parser parser, const ENCODING *enc, + const char *start, const char *end, + enum XML_Account account); ++#else ++static enum XML_Error storeSelfEntityValue(XML_Parser parser, ENTITY *entity); ++#endif + static int reportProcessingInstruction(XML_Parser parser, const ENCODING *enc, + const char *start, const char *end); + static int reportComment(XML_Parser parser, const ENCODING *enc, +@@ -5040,6 +5044,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + break; + case XML_ROLE_ENTITY_VALUE: + if (dtd->keepProcessing) { ++#if defined(XML_DTD) || XML_GE == 1 ++ // This will store the given replacement text in ++ // parser->m_declEntity->textPtr. + enum XML_Error result + = storeEntityValue(parser, enc, s + enc->minBytesPerChar, + next - enc->minBytesPerChar, XML_ACCOUNT_NONE); +@@ -5060,6 +5067,25 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + poolDiscard(&dtd->entityValuePool); + if (result != XML_ERROR_NONE) + return result; ++#else ++ // This will store "&entity123;" in parser->m_declEntity->textPtr ++ // to end up as "&entity123;" in the handler. ++ if (parser->m_declEntity != NULL) { ++ const enum XML_Error result ++ = storeSelfEntityValue(parser, parser->m_declEntity); ++ if (result != XML_ERROR_NONE) ++ return result; ++ ++ if (parser->m_entityDeclHandler) { ++ *eventEndPP = s; ++ parser->m_entityDeclHandler( ++ parser->m_handlerArg, parser->m_declEntity->name, ++ parser->m_declEntity->is_param, parser->m_declEntity->textPtr, ++ parser->m_declEntity->textLen, parser->m_curBase, 0, 0, 0); ++ handleDefault = XML_FALSE; ++ } ++ } ++#endif + } + break; + case XML_ROLE_DOCTYPE_SYSTEM_ID: +@@ -5102,6 +5128,16 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + #endif /* XML_DTD */ + /* fall through */ + case XML_ROLE_ENTITY_SYSTEM_ID: ++#if XML_GE == 0 ++ // This will store "&entity123;" in entity->textPtr ++ // to end up as "&entity123;" in the handler. ++ if (parser->m_declEntity != NULL) { ++ const enum XML_Error result ++ = storeSelfEntityValue(parser, parser->m_declEntity); ++ if (result != XML_ERROR_NONE) ++ return result; ++ } ++#endif + if (dtd->keepProcessing && parser->m_declEntity) { + parser->m_declEntity->systemId + = poolStoreString(&dtd->pool, enc, s + enc->minBytesPerChar, +@@ -6090,6 +6126,7 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + /* not reached */ + } + ++#if XML_GE == 1 + static enum XML_Error + storeEntityValue(XML_Parser parser, const ENCODING *enc, + const char *entityTextPtr, const char *entityTextEnd, +@@ -6097,12 +6134,12 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + DTD *const dtd = parser->m_dtd; /* save one level of indirection */ + STRING_POOL *pool = &(dtd->entityValuePool); + enum XML_Error result = XML_ERROR_NONE; +-#ifdef XML_DTD ++# ifdef XML_DTD + int oldInEntityValue = parser->m_prologState.inEntityValue; + parser->m_prologState.inEntityValue = 1; +-#else ++# else + UNUSED_P(account); +-#endif /* XML_DTD */ ++# endif /* XML_DTD */ + /* never return Null for the value argument in EntityDeclHandler, + since this would indicate an external entity; therefore we + have to make sure that entityValuePool.start is not null */ +@@ -6116,18 +6153,18 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + = entityTextPtr; /* XmlEntityValueTok doesn't always set the last arg */ + int tok = XmlEntityValueTok(enc, entityTextPtr, entityTextEnd, &next); + +-#if defined(XML_DTD) || XML_GE == 1 ++# if defined(XML_DTD) || XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, entityTextPtr, next, __LINE__, + account)) { + accountingOnAbort(parser); + result = XML_ERROR_AMPLIFICATION_LIMIT_BREACH; + goto endEntityValue; + } +-#endif ++# endif + + switch (tok) { + case XML_TOK_PARAM_ENTITY_REF: +-#ifdef XML_DTD ++# ifdef XML_DTD + if (parser->m_isParamEntity || enc != parser->m_encoding) { + const XML_Char *name; + ENTITY *entity; +@@ -6270,12 +6307,38 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + entityTextPtr = next; + } + endEntityValue: +-#ifdef XML_DTD ++# ifdef XML_DTD + parser->m_prologState.inEntityValue = oldInEntityValue; +-#endif /* XML_DTD */ ++# endif /* XML_DTD */ + return result; + } + ++#else /* XML_GE == 0 */ ++ ++static enum XML_Error ++storeSelfEntityValue(XML_Parser parser, ENTITY *entity) { ++ // This will store "&entity123;" in entity->textPtr ++ // to end up as "&entity123;" in the handler. ++ const char *const entity_start = "&"; ++ const char *const entity_end = ";"; ++ ++ STRING_POOL *const pool = &(parser->m_dtd->entityValuePool); ++ if (! poolAppendString(pool, entity_start) ++ || ! poolAppendString(pool, entity->name) ++ || ! poolAppendString(pool, entity_end)) { ++ poolDiscard(pool); ++ return XML_ERROR_NO_MEMORY; ++ } ++ ++ entity->textPtr = poolStart(pool); ++ entity->textLen = (int)(poolLength(pool)); ++ poolFinish(pool); ++ ++ return XML_ERROR_NONE; ++} ++ ++#endif /* XML_GE == 0 */ ++ + static void FASTCALL + normalizeLines(XML_Char *s) { + XML_Char *p; +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-007.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-007.patch new file mode 100644 index 0000000000..a141bbf915 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-007.patch @@ -0,0 +1,53 @@ +From d3f7bbd37bef2565d64f31b549e197a3a414574e Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 01:39:39 +0200 +Subject: [PATCH] doc/reference.html: Document build time macro XML_GE + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/d3f7bbd37bef2565d64f31b549e197a3a414574e] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + doc/reference.html | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/doc/reference.html b/doc/reference.html +index 8b0d47d..74ba012 100644 +--- a/doc/reference.html ++++ b/doc/reference.html +@@ -359,6 +359,33 @@ and the definition of character types in the case of + <code>XML_UNICODE_WCHAR_T</code>. The symbols are:</p> + + <dl class="cpp-symbols"> ++<dt><a name="XML_GE">XML_GE</a></dt> ++<dd> ++Added in Expat 2.6.0. ++Include support for ++<a href="https://www.w3.org/TR/2006/REC-xml-20060816/#sec-physical-struct">general entities</a> ++(syntax <code>&e1;</code> to reference and ++syntax <code><!ENTITY e1 'value1'></code> (an internal general entity) or ++<code><!ENTITY e2 SYSTEM 'file2'></code> (an external general entity) to declare). ++With <code>XML_GE</code> enabled, general entities will be replaced by their declared replacement text; ++for this to work for <em>external</em> general entities, in addition an ++<code><a href="#XML_SetExternalEntityRefHandler">XML_ExternalEntityRefHandler</a></code> must be set using ++<code><a href="#XML_SetExternalEntityRefHandler">XML_SetExternalEntityRefHandler</a></code>. ++Also, enabling <code>XML_GE</code> makes ++the functions <code><a href="#XML_SetBillionLaughsAttackProtectionMaximumAmplification"> ++XML_SetBillionLaughsAttackProtectionMaximumAmplification</a></code> and <code> ++<a href="#XML_SetBillionLaughsAttackProtectionActivationThreshold"> ++XML_SetBillionLaughsAttackProtectionActivationThreshold</a></code> available. ++<br/> ++With <code>XML_GE</code> disabled, Expat has a smaller memory footprint and can be faster, but will ++not load external general entities and will replace all general entities ++(except the <a href="https://www.w3.org/TR/2006/REC-xml-20060816/#sec-predefined-ent">predefined five</a>: ++<code>amp</code>, <code>apos</code>, <code>gt</code>, <code>lt</code>, <code>quot</code>) ++with a self-reference: ++for example, referencing an entity <code>e1</code> via <code>&e1;</code> will be replaced ++by text <code>&e1;</code>. ++</dd> ++ + <dt>XML_DTD</dt> + <dd>Include support for using and reporting DTD-based content. If + this is defined, default attribute values from an external DTD subset +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-008.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-008.patch new file mode 100644 index 0000000000..d07c62ccf0 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-008.patch @@ -0,0 +1,37 @@ +From 2848dc4e7067de503934b388717e7a3d8d0c5bca Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Fri, 27 Oct 2023 18:45:50 +0200 +Subject: [PATCH] Simplify "! defined(XML_DTD) && XML_GE == 0" to "XML_GE == 0" + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/2848dc4e7067de503934b388717e7a3d8d0c5bca] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + xmlwf/xmlwf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c +index be23f5a..04ca759 100644 +--- a/xmlwf/xmlwf.c ++++ b/xmlwf/xmlwf.c +@@ -1062,7 +1062,7 @@ tmain(int argc, XML_Char **argv) { + " (needs a floating point number greater or equal than 1.0)")); + exit(XMLWF_EXIT_USAGE_ERROR); + } +-#if ! defined(XML_DTD) && XML_GE == 0 ++#if XML_GE == 0 + ftprintf(stderr, + T("Warning: Given amplification limit ignored") + T(", xmlwf has been compiled without DTD/GE support.\n")); +@@ -1084,7 +1084,7 @@ tmain(int argc, XML_Char **argv) { + exit(XMLWF_EXIT_USAGE_ERROR); + } + attackThresholdGiven = XML_TRUE; +-#if ! defined(XML_DTD) && XML_GE == 0 ++#if XML_GE == 0 + ftprintf(stderr, + T("Warning: Given attack threshold ignored") + T(", xmlwf has been compiled without DTD/GE support.\n")); +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-009.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-009.patch new file mode 100644 index 0000000000..99460249c0 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-009.patch @@ -0,0 +1,354 @@ +From caa27198637683b15d810737bb8a6a81af19bfa5 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Fri, 27 Oct 2023 18:47:37 +0200 +Subject: [PATCH] Simplify "defined(XML_DTD) || XML_GE == 1" to "XML_GE == 1" + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/caa27198637683b15d810737bb8a6a81af19bfa5] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + lib/expat.h | 2 +- + lib/internal.h | 2 +- + lib/xmlparse.c | 66 +++++++++++++++++++++++++------------------------- + xmlwf/xmlwf.c | 4 +-- + 4 files changed, 37 insertions(+), 37 deletions(-) + +diff --git a/lib/expat.h b/lib/expat.h +index 33c94af..fa2eb45 100644 +--- a/lib/expat.h ++++ b/lib/expat.h +@@ -1038,7 +1038,7 @@ typedef struct { + XMLPARSEAPI(const XML_Feature *) + XML_GetFeatureList(void); + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + /* Added in Expat 2.4.0 for XML_DTD defined and + * added in Expat 2.6.0 for XML_GE == 1. */ + XMLPARSEAPI(XML_Bool) +diff --git a/lib/internal.h b/lib/internal.h +index 1851925..03c8fde 100644 +--- a/lib/internal.h ++++ b/lib/internal.h +@@ -154,7 +154,7 @@ extern "C" { + void _INTERNAL_trim_to_complete_utf8_characters(const char *from, + const char **fromLimRef); + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + unsigned long long testingAccountingGetCountBytesDirect(XML_Parser parser); + unsigned long long testingAccountingGetCountBytesIndirect(XML_Parser parser); + const char *unsignedCharToPrintable(unsigned char c); +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index c479174..2d8f4c0 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -416,7 +416,7 @@ enum XML_Account { + XML_ACCOUNT_NONE /* i.e. do not account, was accounted already */ + }; + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + typedef unsigned long long XmlBigCount; + typedef struct accounting { + XmlBigCount countBytesDirect; +@@ -432,7 +432,7 @@ typedef struct entity_stats { + unsigned int maximumDepthSeen; + int debugLevel; + } ENTITY_STATS; +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + + typedef enum XML_Error PTRCALL Processor(XML_Parser parser, const char *start, + const char *end, const char **endPtr); +@@ -574,7 +574,7 @@ static XML_Parser parserCreate(const XML_Char *encodingName, + + static void parserInit(XML_Parser parser, const XML_Char *encodingName); + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + static float accountingGetCurrentAmplification(XML_Parser rootParser); + static void accountingReportStats(XML_Parser originParser, const char *epilog); + static void accountingOnAbort(XML_Parser originParser); +@@ -597,7 +597,7 @@ static void entityTrackingOnClose(XML_Parser parser, ENTITY *entity, + + static XML_Parser getRootParserOf(XML_Parser parser, + unsigned int *outLevelDiff); +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + + static unsigned long getDebugLevel(const char *variableName, + unsigned long defaultDebugLevel); +@@ -715,7 +715,7 @@ struct XML_ParserStruct { + enum XML_ParamEntityParsing m_paramEntityParsing; + #endif + unsigned long m_hash_secret_salt; +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + ACCOUNTING m_accounting; + ENTITY_STATS m_entity_stats; + #endif +@@ -1175,7 +1175,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) { + #endif + parser->m_hash_secret_salt = 0; + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + memset(&parser->m_accounting, 0, sizeof(ACCOUNTING)); + parser->m_accounting.debugLevel = getDebugLevel("EXPAT_ACCOUNTING_DEBUG", 0u); + parser->m_accounting.maximumAmplificationFactor +@@ -2534,7 +2534,7 @@ XML_GetFeatureList(void) { + #ifdef XML_ATTR_INFO + {XML_FEATURE_ATTR_INFO, XML_L("XML_ATTR_INFO"), 0}, + #endif +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + /* Added in Expat 2.4.0 for XML_DTD defined and + * added in Expat 2.6.0 for XML_GE == 1. */ + {XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT, +@@ -2550,7 +2550,7 @@ XML_GetFeatureList(void) { + return features; + } + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + XML_Bool XMLCALL + XML_SetBillionLaughsAttackProtectionMaximumAmplification( + XML_Parser parser, float maximumAmplificationFactor) { +@@ -2572,7 +2572,7 @@ XML_SetBillionLaughsAttackProtectionActivationThreshold( + parser->m_accounting.activationThresholdBytes = activationThresholdBytes; + return XML_TRUE; + } +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + + /* Initially tag->rawName always points into the parse buffer; + for those TAG instances opened while the current parse buffer was +@@ -2658,13 +2658,13 @@ externalEntityInitProcessor2(XML_Parser parser, const char *start, + int tok = XmlContentTok(parser->m_encoding, start, end, &next); + switch (tok) { + case XML_TOK_BOM: +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, start, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); + return XML_ERROR_AMPLIFICATION_LIMIT_BREACH; + } +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + + /* If we are at the end of the buffer, this would cause the next stage, + i.e. externalEntityInitProcessor3, to pass control directly to +@@ -2778,7 +2778,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + for (;;) { + const char *next = s; /* XmlContentTok doesn't always set the last arg */ + int tok = XmlContentTok(enc, s, end, &next); +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + const char *accountAfter + = ((tok == XML_TOK_TRAILING_RSQB) || (tok == XML_TOK_TRAILING_CR)) + ? (haveMore ? s /* i.e. 0 bytes */ : end) +@@ -2844,14 +2844,14 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + XML_Char ch = (XML_Char)XmlPredefinedEntityName( + enc, s + enc->minBytesPerChar, next - enc->minBytesPerChar); + if (ch) { +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + /* NOTE: We are replacing 4-6 characters original input for 1 character + * so there is no amplification and hence recording without + * protection. */ + accountingDiffTolerated(parser, tok, (char *)&ch, + ((char *)&ch) + sizeof(XML_Char), __LINE__, + XML_ACCOUNT_ENTITY_EXPANSION); +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + if (parser->m_characterDataHandler) + parser->m_characterDataHandler(parser->m_handlerArg, &ch, 1); + else if (parser->m_defaultHandler) +@@ -4053,7 +4053,7 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + for (;;) { + const char *next = s; /* in case of XML_TOK_NONE or XML_TOK_PARTIAL */ + int tok = XmlCdataSectionTok(enc, s, end, &next); +-#if defined(XML_DTD) || XML_GE == 1 ++# if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, account)) { + accountingOnAbort(parser); + return XML_ERROR_AMPLIFICATION_LIMIT_BREACH; +@@ -4205,7 +4205,7 @@ doIgnoreSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + *eventPP = s; + *startPtr = NULL; + tok = XmlIgnoreSectionTok(enc, s, end, &next); +-#if defined(XML_DTD) || XML_GE == 1 ++# if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -4297,7 +4297,7 @@ processXmlDecl(XML_Parser parser, int isGeneralTextEntity, const char *s, + const XML_Char *storedversion = NULL; + int standalone = -1; + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + if (! accountingDiffTolerated(parser, XML_TOK_XML_DECL, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -4504,7 +4504,7 @@ entityValueInitProcessor(XML_Parser parser, const char *s, const char *end, + */ + else if (tok == XML_TOK_BOM && next == end + && ! parser->m_parsingStatus.finalBuffer) { +-# if defined(XML_DTD) || XML_GE == 1 ++# if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -4720,7 +4720,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + } + } + role = XmlTokenRole(&parser->m_prologState, tok, s, next, enc); +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + switch (role) { + case XML_ROLE_INSTANCE_START: // bytes accounted in contentProcessor + case XML_ROLE_XML_DECL: // bytes accounted in processXmlDecl +@@ -5044,7 +5044,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + break; + case XML_ROLE_ENTITY_VALUE: + if (dtd->keepProcessing) { +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + // This will store the given replacement text in + // parser->m_declEntity->textPtr. + enum XML_Error result +@@ -5695,7 +5695,7 @@ epilogProcessor(XML_Parser parser, const char *s, const char *end, + for (;;) { + const char *next = NULL; + int tok = XmlPrologTok(parser->m_encoding, s, end, &next); +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, s, next, __LINE__, + XML_ACCOUNT_DIRECT)) { + accountingOnAbort(parser); +@@ -5775,7 +5775,7 @@ processInternalEntity(XML_Parser parser, ENTITY *entity, XML_Bool betweenDecl) { + return XML_ERROR_NO_MEMORY; + } + entity->open = XML_TRUE; +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + entityTrackingOnOpen(parser, entity, __LINE__); + #endif + entity->processed = 0; +@@ -5809,9 +5809,9 @@ processInternalEntity(XML_Parser parser, ENTITY *entity, XML_Bool betweenDecl) { + entity->processed = (int)(next - textStart); + parser->m_processor = internalEntityProcessor; + } else { +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + entityTrackingOnClose(parser, entity, __LINE__); +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + entity->open = XML_FALSE; + parser->m_openInternalEntities = openEntity->next; + /* put openEntity back in list of free instances */ +@@ -5860,7 +5860,7 @@ internalEntityProcessor(XML_Parser parser, const char *s, const char *end, + return result; + } + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + entityTrackingOnClose(parser, entity, __LINE__); + #endif + entity->open = XML_FALSE; +@@ -5939,7 +5939,7 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + const char *next + = ptr; /* XmlAttributeValueTok doesn't always set the last arg */ + int tok = XmlAttributeValueTok(enc, ptr, end, &next); +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, ptr, next, __LINE__, account)) { + accountingOnAbort(parser); + return XML_ERROR_AMPLIFICATION_LIMIT_BREACH; +@@ -6004,14 +6004,14 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + XML_Char ch = (XML_Char)XmlPredefinedEntityName( + enc, ptr + enc->minBytesPerChar, next - enc->minBytesPerChar); + if (ch) { +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + /* NOTE: We are replacing 4-6 characters original input for 1 character + * so there is no amplification and hence recording without + * protection. */ + accountingDiffTolerated(parser, tok, (char *)&ch, + ((char *)&ch) + sizeof(XML_Char), __LINE__, + XML_ACCOUNT_ENTITY_EXPANSION); +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + if (! poolAppendChar(pool, ch)) + return XML_ERROR_NO_MEMORY; + break; +@@ -6089,14 +6089,14 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + enum XML_Error result; + const XML_Char *textEnd = entity->textPtr + entity->textLen; + entity->open = XML_TRUE; +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + entityTrackingOnOpen(parser, entity, __LINE__); + #endif + result = appendAttributeValue(parser, parser->m_internalEncoding, + isCdata, (const char *)entity->textPtr, + (const char *)textEnd, pool, + XML_ACCOUNT_ENTITY_EXPANSION); +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + entityTrackingOnClose(parser, entity, __LINE__); + #endif + entity->open = XML_FALSE; +@@ -6153,7 +6153,7 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + = entityTextPtr; /* XmlEntityValueTok doesn't always set the last arg */ + int tok = XmlEntityValueTok(enc, entityTextPtr, entityTextEnd, &next); + +-# if defined(XML_DTD) || XML_GE == 1 ++# if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, entityTextPtr, next, __LINE__, + account)) { + accountingOnAbort(parser); +@@ -7725,7 +7725,7 @@ copyString(const XML_Char *s, const XML_Memory_Handling_Suite *memsuite) { + return result; + } + +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + + static float + accountingGetCurrentAmplification(XML_Parser rootParser) { +@@ -8456,7 +8456,7 @@ unsignedCharToPrintable(unsigned char c) { + assert(0); /* never gets here */ + } + +-#endif /* defined(XML_DTD) || XML_GE == 1 */ ++#endif /* XML_GE == 1 */ + + static unsigned long + getDebugLevel(const char *variableName, unsigned long defaultDebugLevel) { +diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c +index 04ca759..dd023a9 100644 +--- a/xmlwf/xmlwf.c ++++ b/xmlwf/xmlwf.c +@@ -1122,13 +1122,13 @@ tmain(int argc, XML_Char **argv) { + } + + if (attackMaximumAmplification != -1.0f) { +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + XML_SetBillionLaughsAttackProtectionMaximumAmplification( + parser, attackMaximumAmplification); + #endif + } + if (attackThresholdGiven) { +-#if defined(XML_DTD) || XML_GE == 1 ++#if XML_GE == 1 + XML_SetBillionLaughsAttackProtectionActivationThreshold( + parser, attackThresholdBytes); + #else +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-010.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-010.patch new file mode 100644 index 0000000000..4b5c5cb2e1 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-010.patch @@ -0,0 +1,50 @@ +From 55fecd6aa4af4a540812b81234679cd6b5714f1b Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Wed, 1 Nov 2023 18:24:55 +0100 +Subject: [PATCH] Drop redundant "XML_GE == 1" guards + +These are redundant because further out there is a guard +for "XML_GE == 1" already. In the visual world, the pattern +is this: + +> #if XML_GE == 1 +> [..] +> # if XML_GE == 1 +> [..] +> # endif +> [..] +> #endif + +Spotted by Snild Dolkow, thanks! + +Co-authored-by: Snild Dolkow <snild@sony.com> + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/55fecd6aa4af4a540812b81234679cd6b5714f1b] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + lib/xmlparse.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 2d8f4c0..82a8006 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -6153,14 +6153,12 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + = entityTextPtr; /* XmlEntityValueTok doesn't always set the last arg */ + int tok = XmlEntityValueTok(enc, entityTextPtr, entityTextEnd, &next); + +-# if XML_GE == 1 + if (! accountingDiffTolerated(parser, tok, entityTextPtr, next, __LINE__, + account)) { + accountingOnAbort(parser); + result = XML_ERROR_AMPLIFICATION_LIMIT_BREACH; + goto endEntityValue; + } +-# endif + + switch (tok) { + case XML_TOK_PARAM_ENTITY_REF: +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2023-52426-011.patch b/meta/recipes-core/expat/expat/CVE-2023-52426-011.patch new file mode 100644 index 0000000000..d1b0be2aff --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2023-52426-011.patch @@ -0,0 +1,45 @@ +From 8a6c61de4a425977e357cafd8667a0d7771ce292 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Thu, 26 Oct 2023 01:29:03 +0200 +Subject: [PATCH] lib: Add XML_GE to XML_GetFeatureList and XML_FeatureEnum + Co-authored-by: Snild Dolkow <snild@sony.com> + +CVE: CVE-2023-52426 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/8a6c61de4a425977e357cafd8667a0d7771ce292] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + lib/expat.h | 4 +++- + lib/xmlparse.c | 2 ++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/lib/expat.h b/lib/expat.h +index fa2eb45..9e64174 100644 +--- a/lib/expat.h ++++ b/lib/expat.h +@@ -1025,7 +1025,9 @@ enum XML_FeatureEnum { + XML_FEATURE_ATTR_INFO, + /* Added in Expat 2.4.0. */ + XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT, +- XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT ++ XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT, ++ /* Added in Expat 2.6.0. */ ++ XML_FEATURE_GE + /* Additional features must be added to the end of this enum. */ + }; + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 82a8006..0627d6c 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2544,6 +2544,8 @@ XML_GetFeatureList(void) { + {XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT, + XML_L("XML_BLAP_ACT_THRES"), + EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT}, ++ /* Added in Expat 2.6.0. */ ++ {XML_FEATURE_GE, XML_L("XML_GE"), 0}, + #endif + {XML_FEATURE_END, NULL, 0}}; + +-- +2.40.0 diff --git a/meta/recipes-core/expat/expat/CVE-2024-28757.patch b/meta/recipes-core/expat/expat/CVE-2024-28757.patch new file mode 100755 index 0000000000..768dab0c84 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2024-28757.patch @@ -0,0 +1,58 @@ +From 1d50b80cf31de87750103656f6eb693746854aa8 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Mon, 4 Mar 2024 23:49:06 +0100 +Subject: [PATCH] lib/xmlparse.c: Detect billion laughs attack with isolated + external parser + +When parsing DTD content with code like .. + + XML_Parser parser = XML_ParserCreate(NULL); + XML_Parser ext_parser = XML_ExternalEntityParserCreate(parser, NULL, NULL); + enum XML_Status status = XML_Parse(ext_parser, doc, (int)strlen(doc), XML_TRUE); + +.. there are 0 bytes accounted as direct input and all input from `doc` accounted +as indirect input. Now function accountingGetCurrentAmplification cannot calculate +the current amplification ratio as "(direct + indirect) / direct", and it did refuse +to divide by 0 as one would expect, but it returned 1.0 for this case to indicate +no amplification over direct input. As a result, billion laughs attacks from +DTD-only input were not detected with this isolated way of using an external parser. + +The new approach is to assume direct input of length not 0 but 22 -- derived from +ghost input "<!ENTITY a SYSTEM 'b'>", the shortest possible way to include an external +DTD --, and do the usual "(direct + indirect) / direct" math with "direct := 22". + +GitHub issue #839 has more details on this issue and its origin in ClusterFuzz +finding 66812. + +CVE: CVE-2024-28757 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/1d50b80cf31de87750103656f6eb693746854aa8] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + lib/xmlparse.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index b884d82b5..d44baa68d 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -7655,6 +7655,8 @@ copyString(const XML_Char *s, const XML_Memory_Handling_Suite *memsuite) { + + static float + accountingGetCurrentAmplification(XML_Parser rootParser) { ++ // 1.........1.........12 => 22 ++ const size_t lenOfShortestInclude = sizeof("<!ENTITY a SYSTEM 'b'>") - 1; + const XmlBigCount countBytesOutput + = rootParser->m_accounting.countBytesDirect + + rootParser->m_accounting.countBytesIndirect; +@@ -7662,7 +7664,9 @@ accountingGetCurrentAmplification(XML_Parser rootParser) { + = rootParser->m_accounting.countBytesDirect + ? (countBytesOutput + / (float)(rootParser->m_accounting.countBytesDirect)) +- : 1.0f; ++ : ((lenOfShortestInclude ++ + rootParser->m_accounting.countBytesIndirect) ++ / (float)lenOfShortestInclude); + assert(! rootParser->m_parentParser); + return amplificationFactor; + } diff --git a/meta/recipes-core/expat/expat_2.5.0.bb b/meta/recipes-core/expat/expat_2.5.0.bb index 7080f934d1..31e989cfe2 100644 --- a/meta/recipes-core/expat/expat_2.5.0.bb +++ b/meta/recipes-core/expat/expat_2.5.0.bb @@ -10,6 +10,18 @@ VERSION_TAG = "${@d.getVar('PV').replace('.', '_')}" SRC_URI = "https://github.com/libexpat/libexpat/releases/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://run-ptest \ + file://CVE-2024-28757.patch \ + file://CVE-2023-52426-001.patch \ + file://CVE-2023-52426-002.patch \ + file://CVE-2023-52426-003.patch \ + file://CVE-2023-52426-004.patch \ + file://CVE-2023-52426-005.patch \ + file://CVE-2023-52426-006.patch \ + file://CVE-2023-52426-007.patch \ + file://CVE-2023-52426-008.patch \ + file://CVE-2023-52426-009.patch \ + file://CVE-2023-52426-010.patch \ + file://CVE-2023-52426-011.patch \ " UPSTREAM_CHECK_URI = "https://github.com/libexpat/libexpat/releases/" diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-29499.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-29499.patch new file mode 100644 index 0000000000..65174efa6d --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-29499.patch @@ -0,0 +1,291 @@ +From 5f4485c4ff57fdefb1661531788def7ca5a47328 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Thu, 17 Aug 2023 04:19:44 +0000 +Subject: [PATCH] gvariant-serialiser: Check offset table entry size is minimal + +The entries in an offset table (which is used for variable sized arrays +and tuples containing variable sized members) are sized so that they can +address every byte in the overall variant. + +The specification requires that for a variant to be in normal form, its +offset table entries must be the minimum width such that they can +address every byte in the variant. + +That minimality requirement was not checked in +`g_variant_is_normal_form()`, leading to two different byte arrays being +interpreted as the normal form of a given variant tree. That kind of +confusion could potentially be exploited, and is certainly a bug. + +Fix it by adding the necessary checks on offset table entry width, and +unit tests. + +Spotted by William Manley. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Fixes: #2794 + +CVE: CVE-2023-29499 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/5f4485c4ff57fdefb1661531788def7ca5a47328] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant-serialiser.c | 19 +++- + glib/tests/gvariant.c | 176 +++++++++++++++++++++++++++++++++++++ + 2 files changed, 194 insertions(+), 1 deletion(-) + +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index 9c7f12a..3d6e7b8 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -694,6 +694,10 @@ gvs_variable_sized_array_get_frame_offsets (GVariantSerialised value) + out.data_size = last_end; + out.array = value.data + last_end; + out.length = offsets_array_size / out.offset_size; ++ ++ if (out.length > 0 && gvs_calculate_total_size (last_end, out.length) != value.size) ++ return out; /* offset size not minimal */ ++ + out.is_normal = TRUE; + + return out; +@@ -1201,6 +1205,7 @@ gvs_tuple_is_normal (GVariantSerialised value) + gsize length; + gsize offset; + gsize i; ++ gsize offset_table_size; + + /* as per the comment in gvs_tuple_get_child() */ + if G_UNLIKELY (value.data == NULL && value.size != 0) +@@ -1305,7 +1310,19 @@ gvs_tuple_is_normal (GVariantSerialised value) + } + } + +- return offset_ptr == offset; ++ /* @offset_ptr has been counting backwards from the end of the variant, to ++ * find the beginning of the offset table. @offset has been counting forwards ++ * from the beginning of the variant to find the end of the data. They should ++ * have met in the middle. */ ++ if (offset_ptr != offset) ++ return FALSE; ++ ++ offset_table_size = value.size - offset_ptr; ++ if (value.size > 0 && ++ gvs_calculate_total_size (offset, offset_table_size / offset_size) != value.size) ++ return FALSE; /* offset size not minimal */ ++ ++ return TRUE; + } + + /* Variants {{{2 +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index 44e4451..ad45043 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -5076,6 +5076,86 @@ test_normal_checking_array_offsets2 (void) + g_variant_unref (variant); + } + ++/* Test that an otherwise-valid serialised GVariant is considered non-normal if ++ * its offset table entries are too wide. ++ * ++ * See §2.3.6 (Framing Offsets) of the GVariant specification. */ ++static void ++test_normal_checking_array_offsets_minimal_sized (void) ++{ ++ GVariantBuilder builder; ++ gsize i; ++ GVariant *aay_constructed = NULL; ++ const guint8 *data = NULL; ++ guint8 *data_owned = NULL; ++ GVariant *aay_deserialised = NULL; ++ GVariant *aay_normalised = NULL; ++ ++ /* Construct an array of type aay, consisting of 128 elements which are each ++ * an empty array, i.e. `[[] * 128]`. This is chosen because the inner ++ * elements are variable sized (making the outer array variable sized, so it ++ * must have an offset table), but they are also zero-sized when serialised. ++ * So the serialised representation of @aay_constructed consists entirely of ++ * its offset table, which is entirely zeroes. ++ * ++ * The array is chosen to be 128 elements long because that means offset ++ * table entries which are 1 byte long. If the elements in the array were ++ * non-zero-sized (to the extent that the overall array is ≥256 bytes long), ++ * the offset table entries would end up being 2 bytes long. */ ++ g_variant_builder_init (&builder, G_VARIANT_TYPE ("aay")); ++ ++ for (i = 0; i < 128; i++) ++ g_variant_builder_add_value (&builder, g_variant_new_array (G_VARIANT_TYPE_BYTE, NULL, 0)); ++ ++ aay_constructed = g_variant_builder_end (&builder); ++ ++ /* Verify that the constructed array is in normal form, and its serialised ++ * form is `b'\0' * 128`. */ ++ g_assert_true (g_variant_is_normal_form (aay_constructed)); ++ g_assert_cmpuint (g_variant_n_children (aay_constructed), ==, 128); ++ g_assert_cmpuint (g_variant_get_size (aay_constructed), ==, 128); ++ ++ data = g_variant_get_data (aay_constructed); ++ for (i = 0; i < g_variant_get_size (aay_constructed); i++) ++ g_assert_cmpuint (data[i], ==, 0); ++ ++ /* Construct a serialised `aay` GVariant which is `b'\0' * 256`. This has to ++ * be a non-normal form of `[[] * 128]`, with 2-byte-long offset table ++ * entries, because each offset table entry has to be able to reference all of ++ * the byte boundaries in the container. All the entries in the offset table ++ * are zero, so all the elements of the array are zero-sized. */ ++ data = data_owned = g_malloc0 (256); ++ aay_deserialised = g_variant_new_from_data (G_VARIANT_TYPE ("aay"), ++ data, ++ 256, ++ FALSE, ++ g_free, ++ g_steal_pointer (&data_owned)); ++ ++ g_assert_false (g_variant_is_normal_form (aay_deserialised)); ++ g_assert_cmpuint (g_variant_n_children (aay_deserialised), ==, 128); ++ g_assert_cmpuint (g_variant_get_size (aay_deserialised), ==, 256); ++ ++ data = g_variant_get_data (aay_deserialised); ++ for (i = 0; i < g_variant_get_size (aay_deserialised); i++) ++ g_assert_cmpuint (data[i], ==, 0); ++ ++ /* Get its normal form. That should change the serialised size. */ ++ aay_normalised = g_variant_get_normal_form (aay_deserialised); ++ ++ g_assert_true (g_variant_is_normal_form (aay_normalised)); ++ g_assert_cmpuint (g_variant_n_children (aay_normalised), ==, 128); ++ g_assert_cmpuint (g_variant_get_size (aay_normalised), ==, 128); ++ ++ data = g_variant_get_data (aay_normalised); ++ for (i = 0; i < g_variant_get_size (aay_normalised); i++) ++ g_assert_cmpuint (data[i], ==, 0); ++ ++ g_variant_unref (aay_normalised); ++ g_variant_unref (aay_deserialised); ++ g_variant_unref (aay_constructed); ++} ++ + /* Test that a tuple with invalidly large values in its offset table is + * normalised successfully without looping infinitely. */ + static void +@@ -5270,6 +5350,98 @@ test_normal_checking_tuple_offsets4 (void) + g_variant_unref (variant); + } + ++/* Test that an otherwise-valid serialised GVariant is considered non-normal if ++ * its offset table entries are too wide. ++ * ++ * See §2.3.6 (Framing Offsets) of the GVariant specification. */ ++static void ++test_normal_checking_tuple_offsets_minimal_sized (void) ++{ ++ GString *type_string = NULL; ++ GVariantBuilder builder; ++ gsize i; ++ GVariant *ray_constructed = NULL; ++ const guint8 *data = NULL; ++ guint8 *data_owned = NULL; ++ GVariant *ray_deserialised = NULL; ++ GVariant *ray_normalised = NULL; ++ ++ /* Construct a tuple of type (ay…ay), consisting of 129 members which are each ++ * an empty array, i.e. `([] * 129)`. This is chosen because the inner ++ * members are variable sized, so the outer tuple must have an offset table, ++ * but they are also zero-sized when serialised. So the serialised ++ * representation of @ray_constructed consists entirely of its offset table, ++ * which is entirely zeroes. ++ * ++ * The tuple is chosen to be 129 members long because that means it has 128 ++ * offset table entries which are 1 byte long each. If the members in the ++ * tuple were non-zero-sized (to the extent that the overall tuple is ≥256 ++ * bytes long), the offset table entries would end up being 2 bytes long. ++ * ++ * 129 members are used unlike 128 array elements in ++ * test_normal_checking_array_offsets_minimal_sized(), because the last member ++ * in a tuple never needs an offset table entry. */ ++ type_string = g_string_new (""); ++ g_string_append_c (type_string, '('); ++ for (i = 0; i < 129; i++) ++ g_string_append (type_string, "ay"); ++ g_string_append_c (type_string, ')'); ++ ++ g_variant_builder_init (&builder, G_VARIANT_TYPE (type_string->str)); ++ ++ for (i = 0; i < 129; i++) ++ g_variant_builder_add_value (&builder, g_variant_new_array (G_VARIANT_TYPE_BYTE, NULL, 0)); ++ ++ ray_constructed = g_variant_builder_end (&builder); ++ ++ /* Verify that the constructed tuple is in normal form, and its serialised ++ * form is `b'\0' * 128`. */ ++ g_assert_true (g_variant_is_normal_form (ray_constructed)); ++ g_assert_cmpuint (g_variant_n_children (ray_constructed), ==, 129); ++ g_assert_cmpuint (g_variant_get_size (ray_constructed), ==, 128); ++ ++ data = g_variant_get_data (ray_constructed); ++ for (i = 0; i < g_variant_get_size (ray_constructed); i++) ++ g_assert_cmpuint (data[i], ==, 0); ++ ++ /* Construct a serialised `(ay…ay)` GVariant which is `b'\0' * 256`. This has ++ * to be a non-normal form of `([] * 129)`, with 2-byte-long offset table ++ * entries, because each offset table entry has to be able to reference all of ++ * the byte boundaries in the container. All the entries in the offset table ++ * are zero, so all the members of the tuple are zero-sized. */ ++ data = data_owned = g_malloc0 (256); ++ ray_deserialised = g_variant_new_from_data (G_VARIANT_TYPE (type_string->str), ++ data, ++ 256, ++ FALSE, ++ g_free, ++ g_steal_pointer (&data_owned)); ++ ++ g_assert_false (g_variant_is_normal_form (ray_deserialised)); ++ g_assert_cmpuint (g_variant_n_children (ray_deserialised), ==, 129); ++ g_assert_cmpuint (g_variant_get_size (ray_deserialised), ==, 256); ++ ++ data = g_variant_get_data (ray_deserialised); ++ for (i = 0; i < g_variant_get_size (ray_deserialised); i++) ++ g_assert_cmpuint (data[i], ==, 0); ++ ++ /* Get its normal form. That should change the serialised size. */ ++ ray_normalised = g_variant_get_normal_form (ray_deserialised); ++ ++ g_assert_true (g_variant_is_normal_form (ray_normalised)); ++ g_assert_cmpuint (g_variant_n_children (ray_normalised), ==, 129); ++ g_assert_cmpuint (g_variant_get_size (ray_normalised), ==, 128); ++ ++ data = g_variant_get_data (ray_normalised); ++ for (i = 0; i < g_variant_get_size (ray_normalised); i++) ++ g_assert_cmpuint (data[i], ==, 0); ++ ++ g_variant_unref (ray_normalised); ++ g_variant_unref (ray_deserialised); ++ g_variant_unref (ray_constructed); ++ g_string_free (type_string, TRUE); ++} ++ + /* Test that an empty object path is normalised successfully to the base object + * path, ‘/’. */ + static void +@@ -5414,6 +5586,8 @@ main (int argc, char **argv) + test_normal_checking_array_offsets); + g_test_add_func ("/gvariant/normal-checking/array-offsets2", + test_normal_checking_array_offsets2); ++ g_test_add_func ("/gvariant/normal-checking/array-offsets/minimal-sized", ++ test_normal_checking_array_offsets_minimal_sized); + g_test_add_func ("/gvariant/normal-checking/tuple-offsets", + test_normal_checking_tuple_offsets); + g_test_add_func ("/gvariant/normal-checking/tuple-offsets2", +@@ -5422,6 +5596,8 @@ main (int argc, char **argv) + test_normal_checking_tuple_offsets3); + g_test_add_func ("/gvariant/normal-checking/tuple-offsets4", + test_normal_checking_tuple_offsets4); ++ g_test_add_func ("/gvariant/normal-checking/tuple-offsets/minimal-sized", ++ test_normal_checking_tuple_offsets_minimal_sized); + g_test_add_func ("/gvariant/normal-checking/empty-object-path", + test_normal_checking_empty_object_path); + +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0001.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0001.patch new file mode 100644 index 0000000000..cc4b4055b2 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0001.patch @@ -0,0 +1,97 @@ +From 4c4cf568f0f710baf0bd04d52df715636bc6b971 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Thu, 17 Aug 2023 04:23:41 +0000 +Subject: [PATCH] gvariant: Fix g_variant_byteswap() returning non-normal data + +If `g_variant_byteswap()` was called on a non-normal variant of a type +which doesn’t need byteswapping, it would return a non-normal output. + +That contradicts the documentation, which says that the return value is +always in normal form. + +Fix the code so it matches the documentation. + +Includes a unit test. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Helps: #2797 + +CVE: CVE-2023-32611 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/4c4cf568f0f710baf0bd04d52df715636bc6b971] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant.c | 8 +++++--- + glib/tests/gvariant.c | 24 ++++++++++++++++++++++++ + 2 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/glib/gvariant.c b/glib/gvariant.c +index 30a3280..7e568d1 100644 +--- a/glib/gvariant.c ++++ b/glib/gvariant.c +@@ -6004,14 +6004,16 @@ g_variant_byteswap (GVariant *value) + g_variant_serialised_byteswap (serialised); + + bytes = g_bytes_new_take (serialised.data, serialised.size); +- new = g_variant_new_from_bytes (g_variant_get_type (value), bytes, TRUE); ++ new = g_variant_ref_sink (g_variant_new_from_bytes (g_variant_get_type (value), bytes, TRUE)); + g_bytes_unref (bytes); + } + else + /* contains no multi-byte data */ +- new = value; ++ new = g_variant_get_normal_form (value); + +- return g_variant_ref_sink (new); ++ g_assert (g_variant_is_trusted (new)); ++ ++ return g_steal_pointer (&new); + } + + /** +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index ad45043..36c86c2 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -3818,6 +3818,29 @@ test_gv_byteswap (void) + g_free (string); + } + ++static void ++test_gv_byteswap_non_normal_non_aligned (void) ++{ ++ const guint8 data[] = { 0x02 }; ++ GVariant *v = NULL; ++ GVariant *v_byteswapped = NULL; ++ ++ g_test_summary ("Test that calling g_variant_byteswap() on a variant which " ++ "is in non-normal form and doesn’t need byteswapping returns " ++ "the same variant in normal form."); ++ ++ v = g_variant_new_from_data (G_VARIANT_TYPE_BOOLEAN, data, sizeof (data), FALSE, NULL, NULL); ++ g_assert_false (g_variant_is_normal_form (v)); ++ ++ v_byteswapped = g_variant_byteswap (v); ++ g_assert_true (g_variant_is_normal_form (v_byteswapped)); ++ ++ g_assert_cmpvariant (v, v_byteswapped); ++ ++ g_variant_unref (v); ++ g_variant_unref (v_byteswapped); ++} ++ + static void + test_parser (void) + { +@@ -5553,6 +5576,7 @@ main (int argc, char **argv) + g_test_add_func ("/gvariant/builder-memory", test_builder_memory); + g_test_add_func ("/gvariant/hashing", test_hashing); + g_test_add_func ("/gvariant/byteswap", test_gv_byteswap); ++ g_test_add_func ("/gvariant/byteswap/non-normal-non-aligned", test_gv_byteswap_non_normal_non_aligned); + g_test_add_func ("/gvariant/parser", test_parses); + g_test_add_func ("/gvariant/parser/integer-bounds", test_parser_integer_bounds); + g_test_add_func ("/gvariant/parser/recursion", test_parser_recursion); +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0002.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0002.patch new file mode 100644 index 0000000000..304c15bceb --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0002.patch @@ -0,0 +1,282 @@ +From 7d7efce1d9c379fdd7d2ff58caea88f8806fdd2e Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Thu, 17 Aug 2023 05:05:39 +0000 +Subject: [PATCH] gvariant: Allow g_variant_byteswap() to operate on tree-form + variants + +This avoids needing to always serialise a variant before byteswapping it. +With variants in non-normal forms, serialisation can result in a large +increase in size of the variant, and a lot of allocations for leaf +`GVariant`s. This can lead to a denial of service attack. + +Avoid that by changing byteswapping so that it happens on the tree form +of the variant if the input is in non-normal form. If the input is in +normal form (either serialised or in tree form), continue using the +existing code as byteswapping an already-serialised normal variant is +about 3× faster than byteswapping on the equivalent tree form. + +The existing unit tests cover byteswapping well, but need some +adaptation so that they operate on tree form variants too. + +I considered dropping the serialised byteswapping code and doing all +byteswapping on tree-form variants, as that would make maintenance +simpler (avoiding having two parallel implementations of byteswapping). +However, most inputs to `g_variant_byteswap()` are likely to be +serialised variants (coming from a byte array of input from some foreign +source) and most of them are going to be in normal form (as corruption +and malicious action are rare). So getting rid of the serialised +byteswapping code would impose quite a performance penalty on the common +case. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Fixes: #2797 + +CVE: CVE-2023-32611 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/7d7efce1d9c379fdd7d2ff58caea88f8806fdd2e] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant.c | 83 ++++++++++++++++++++++++++++++++----------- + glib/tests/gvariant.c | 57 +++++++++++++++++++++++++---- + 2 files changed, 113 insertions(+), 27 deletions(-) + +diff --git a/glib/gvariant.c b/glib/gvariant.c +index 7e568d1..65b8443 100644 +--- a/glib/gvariant.c ++++ b/glib/gvariant.c +@@ -5839,7 +5839,8 @@ g_variant_iter_loop (GVariantIter *iter, + + /* Serialized data {{{1 */ + static GVariant * +-g_variant_deep_copy (GVariant *value) ++g_variant_deep_copy (GVariant *value, ++ gboolean byteswap) + { + switch (g_variant_classify (value)) + { +@@ -5857,7 +5858,7 @@ g_variant_deep_copy (GVariant *value) + for (i = 0, n_children = g_variant_n_children (value); i < n_children; i++) + { + GVariant *child = g_variant_get_child_value (value, i); +- g_variant_builder_add_value (&builder, g_variant_deep_copy (child)); ++ g_variant_builder_add_value (&builder, g_variant_deep_copy (child, byteswap)); + g_variant_unref (child); + } + +@@ -5871,28 +5872,63 @@ g_variant_deep_copy (GVariant *value) + return g_variant_new_byte (g_variant_get_byte (value)); + + case G_VARIANT_CLASS_INT16: +- return g_variant_new_int16 (g_variant_get_int16 (value)); ++ if (byteswap) ++ return g_variant_new_int16 (GUINT16_SWAP_LE_BE (g_variant_get_int16 (value))); ++ else ++ return g_variant_new_int16 (g_variant_get_int16 (value)); + + case G_VARIANT_CLASS_UINT16: +- return g_variant_new_uint16 (g_variant_get_uint16 (value)); ++ if (byteswap) ++ return g_variant_new_uint16 (GUINT16_SWAP_LE_BE (g_variant_get_uint16 (value))); ++ else ++ return g_variant_new_uint16 (g_variant_get_uint16 (value)); + + case G_VARIANT_CLASS_INT32: +- return g_variant_new_int32 (g_variant_get_int32 (value)); ++ if (byteswap) ++ return g_variant_new_int32 (GUINT32_SWAP_LE_BE (g_variant_get_int32 (value))); ++ else ++ return g_variant_new_int32 (g_variant_get_int32 (value)); + + case G_VARIANT_CLASS_UINT32: +- return g_variant_new_uint32 (g_variant_get_uint32 (value)); ++ if (byteswap) ++ return g_variant_new_uint32 (GUINT32_SWAP_LE_BE (g_variant_get_uint32 (value))); ++ else ++ return g_variant_new_uint32 (g_variant_get_uint32 (value)); + + case G_VARIANT_CLASS_INT64: +- return g_variant_new_int64 (g_variant_get_int64 (value)); ++ if (byteswap) ++ return g_variant_new_int64 (GUINT64_SWAP_LE_BE (g_variant_get_int64 (value))); ++ else ++ return g_variant_new_int64 (g_variant_get_int64 (value)); + + case G_VARIANT_CLASS_UINT64: +- return g_variant_new_uint64 (g_variant_get_uint64 (value)); ++ if (byteswap) ++ return g_variant_new_uint64 (GUINT64_SWAP_LE_BE (g_variant_get_uint64 (value))); ++ else ++ return g_variant_new_uint64 (g_variant_get_uint64 (value)); + + case G_VARIANT_CLASS_HANDLE: +- return g_variant_new_handle (g_variant_get_handle (value)); ++ if (byteswap) ++ return g_variant_new_handle (GUINT32_SWAP_LE_BE (g_variant_get_handle (value))); ++ else ++ return g_variant_new_handle (g_variant_get_handle (value)); + + case G_VARIANT_CLASS_DOUBLE: +- return g_variant_new_double (g_variant_get_double (value)); ++ if (byteswap) ++ { ++ /* We have to convert the double to a uint64 here using a union, ++ * because a cast will round it numerically. */ ++ union ++ { ++ guint64 u64; ++ gdouble dbl; ++ } u1, u2; ++ u1.dbl = g_variant_get_double (value); ++ u2.u64 = GUINT64_SWAP_LE_BE (u1.u64); ++ return g_variant_new_double (u2.dbl); ++ } ++ else ++ return g_variant_new_double (g_variant_get_double (value)); + + case G_VARIANT_CLASS_STRING: + return g_variant_new_string (g_variant_get_string (value, NULL)); +@@ -5947,7 +5983,7 @@ g_variant_get_normal_form (GVariant *value) + if (g_variant_is_normal_form (value)) + return g_variant_ref (value); + +- trusted = g_variant_deep_copy (value); ++ trusted = g_variant_deep_copy (value, FALSE); + g_assert (g_variant_is_trusted (trusted)); + + return g_variant_ref_sink (trusted); +@@ -5967,6 +6003,11 @@ g_variant_get_normal_form (GVariant *value) + * contain multi-byte numeric data. That include strings, booleans, + * bytes and containers containing only these things (recursively). + * ++ * While this function can safely handle untrusted, non-normal data, it is ++ * recommended to check whether the input is in normal form beforehand, using ++ * g_variant_is_normal_form(), and to reject non-normal inputs if your ++ * application can be strict about what inputs it rejects. ++ * + * The returned value is always in normal form and is marked as trusted. + * + * Returns: (transfer full): the byteswapped form of @value +@@ -5984,22 +6025,21 @@ g_variant_byteswap (GVariant *value) + + g_variant_type_info_query (type_info, &alignment, NULL); + +- if (alignment) +- /* (potentially) contains multi-byte numeric data */ ++ if (alignment && g_variant_is_normal_form (value)) + { ++ /* (potentially) contains multi-byte numeric data, but is also already in ++ * normal form so we can use a faster byteswapping codepath on the ++ * serialised data */ + GVariantSerialised serialised = { 0, }; +- GVariant *trusted; + GBytes *bytes; + +- trusted = g_variant_get_normal_form (value); +- serialised.type_info = g_variant_get_type_info (trusted); +- serialised.size = g_variant_get_size (trusted); ++ serialised.type_info = g_variant_get_type_info (value); ++ serialised.size = g_variant_get_size (value); + serialised.data = g_malloc (serialised.size); +- serialised.depth = g_variant_get_depth (trusted); ++ serialised.depth = g_variant_get_depth (value); + serialised.ordered_offsets_up_to = G_MAXSIZE; /* operating on the normal form */ + serialised.checked_offsets_up_to = G_MAXSIZE; +- g_variant_store (trusted, serialised.data); +- g_variant_unref (trusted); ++ g_variant_store (value, serialised.data); + + g_variant_serialised_byteswap (serialised); + +@@ -6007,6 +6047,9 @@ g_variant_byteswap (GVariant *value) + new = g_variant_ref_sink (g_variant_new_from_bytes (g_variant_get_type (value), bytes, TRUE)); + g_bytes_unref (bytes); + } ++ else if (alignment) ++ /* (potentially) contains multi-byte numeric data */ ++ new = g_variant_ref_sink (g_variant_deep_copy (value, TRUE)); + else + /* contains no multi-byte data */ + new = g_variant_get_normal_form (value); +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index 36c86c2..43091f2 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -2280,24 +2280,67 @@ serialise_tree (TreeInstance *tree, + static void + test_byteswap (void) + { +- GVariantSerialised one = { 0, }, two = { 0, }; ++ GVariantSerialised one = { 0, }, two = { 0, }, three = { 0, }; + TreeInstance *tree; +- ++ GVariant *one_variant = NULL; ++ GVariant *two_variant = NULL; ++ GVariant *two_byteswapped = NULL; ++ GVariant *three_variant = NULL; ++ GVariant *three_byteswapped = NULL; ++ guint8 *three_data_copy = NULL; ++ gsize three_size_copy = 0; ++ ++ /* Write a tree out twice, once normally and once byteswapped. */ + tree = tree_instance_new (NULL, 3); + serialise_tree (tree, &one); + ++ one_variant = g_variant_new_from_data (G_VARIANT_TYPE (g_variant_type_info_get_type_string (one.type_info)), ++ one.data, one.size, FALSE, NULL, NULL); ++ + i_am_writing_byteswapped = TRUE; + serialise_tree (tree, &two); ++ serialise_tree (tree, &three); + i_am_writing_byteswapped = FALSE; + +- g_variant_serialised_byteswap (two); +- +- g_assert_cmpmem (one.data, one.size, two.data, two.size); +- g_assert_cmpuint (one.depth, ==, two.depth); +- ++ /* Swap the first byteswapped one back using the function we want to test. */ ++ two_variant = g_variant_new_from_data (G_VARIANT_TYPE (g_variant_type_info_get_type_string (two.type_info)), ++ two.data, two.size, FALSE, NULL, NULL); ++ two_byteswapped = g_variant_byteswap (two_variant); ++ ++ /* Make the second byteswapped one non-normal (hopefully), and then byteswap ++ * it back using the function we want to test in its non-normal mode. ++ * This might not work because it’s not necessarily possible to make an ++ * arbitrary random variant non-normal. Adding a single zero byte to the end ++ * often makes something non-normal but still readable. */ ++ three_size_copy = three.size + 1; ++ three_data_copy = g_malloc (three_size_copy); ++ memcpy (three_data_copy, three.data, three.size); ++ three_data_copy[three.size] = '\0'; ++ ++ three_variant = g_variant_new_from_data (G_VARIANT_TYPE (g_variant_type_info_get_type_string (three.type_info)), ++ three_data_copy, three_size_copy, FALSE, NULL, NULL); ++ three_byteswapped = g_variant_byteswap (three_variant); ++ ++ /* Check they’re the same. We can always compare @one_variant and ++ * @two_byteswapped. We can only compare @two_byteswapped and ++ * @three_byteswapped if @two_variant and @three_variant are equal: in that ++ * case, the corruption to @three_variant was enough to make it non-normal but ++ * not enough to change its value. */ ++ g_assert_cmpvariant (one_variant, two_byteswapped); ++ ++ if (g_variant_equal (two_variant, three_variant)) ++ g_assert_cmpvariant (two_byteswapped, three_byteswapped); ++ ++ g_variant_unref (three_byteswapped); ++ g_variant_unref (three_variant); ++ g_variant_unref (two_byteswapped); ++ g_variant_unref (two_variant); ++ g_variant_unref (one_variant); + tree_instance_free (tree); + g_free (one.data); + g_free (two.data); ++ g_free (three.data); ++ g_free (three_data_copy); + } + + static void +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32636.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32636.patch new file mode 100644 index 0000000000..311993625a --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32636.patch @@ -0,0 +1,50 @@ +From 21a204147b16539b3eda3143b32844c49e29f4d4 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Thu, 17 Aug 2023 11:33:49 +0000 +Subject: [PATCH] gvariant: Propagate trust when getting a child of a + serialised variant + +If a variant is trusted, that means all its children are trusted, so +ensure that their checked offsets are set as such. + +This allows a lot of the offset table checks to be avoided when getting +children from trusted serialised tuples, which speeds things up. + +No unit test is included because this is just a performance fix. If +there are other slownesses, or regressions, in serialised `GVariant` +performance, the fuzzing setup will catch them like it did this one. + +This change does reduce the time to run the oss-fuzz reproducer from 80s +to about 0.7s on my machine. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Fixes: #2841 +oss-fuzz#54314 + +CVE: CVE-2023-32636 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/21a204147b16539b3eda3143b32844c49e29f4d4] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/glib/gvariant-core.c b/glib/gvariant-core.c +index 7b71efc..a2c7d2d 100644 +--- a/glib/gvariant-core.c ++++ b/glib/gvariant-core.c +@@ -1195,8 +1195,8 @@ g_variant_get_child_value (GVariant *value, + child->contents.serialised.bytes = + g_bytes_ref (value->contents.serialised.bytes); + child->contents.serialised.data = s_child.data; +- child->contents.serialised.ordered_offsets_up_to = s_child.ordered_offsets_up_to; +- child->contents.serialised.checked_offsets_up_to = s_child.checked_offsets_up_to; ++ child->contents.serialised.ordered_offsets_up_to = (value->state & STATE_TRUSTED) ? G_MAXSIZE : s_child.ordered_offsets_up_to; ++ child->contents.serialised.checked_offsets_up_to = (value->state & STATE_TRUSTED) ? G_MAXSIZE : s_child.checked_offsets_up_to; + + return child; + } +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32643.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32643.patch new file mode 100644 index 0000000000..b5cb4273b6 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32643.patch @@ -0,0 +1,155 @@ +From 78da5faccb3e065116b75b3ff87ff55381da6c76 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Thu, 17 Aug 2023 11:24:43 +0000 +Subject: [PATCH] gvariant: Check offset table doesn't fall outside variant + bounds + +When dereferencing the first entry in the offset table for a tuple, +check that it doesn’t fall outside the bounds of the variant first. + +This prevents an out-of-bounds read from some non-normal tuples. + +This bug was introduced in commit 73d0aa81c2575a5c9ae77d. + +Includes a unit test, although the test will likely only catch the +original bug if run with asan enabled. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Fixes: #2840 +oss-fuzz#54302 + +CVE: CVE-2023-32643 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/78da5faccb3e065116b75b3ff87ff55381da6c76] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant-serialiser.c | 12 ++++++-- + glib/tests/gvariant.c | 63 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 72 insertions(+), 3 deletions(-) + +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index 3d6e7b8..5abb87e 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -979,7 +979,8 @@ gvs_tuple_get_member_bounds (GVariantSerialised value, + + member_info = g_variant_type_info_member_info (value.type_info, index_); + +- if (member_info->i + 1) ++ if (member_info->i + 1 && ++ offset_size * (member_info->i + 1) <= value.size) + member_start = gvs_read_unaligned_le (value.data + value.size - + offset_size * (member_info->i + 1), + offset_size); +@@ -990,7 +991,8 @@ gvs_tuple_get_member_bounds (GVariantSerialised value, + member_start &= member_info->b; + member_start |= member_info->c; + +- if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_LAST) ++ if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_LAST && ++ offset_size * (member_info->i + 1) <= value.size) + member_end = value.size - offset_size * (member_info->i + 1); + + else if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_FIXED) +@@ -1001,11 +1003,15 @@ gvs_tuple_get_member_bounds (GVariantSerialised value, + member_end = member_start + fixed_size; + } + +- else /* G_VARIANT_MEMBER_ENDING_OFFSET */ ++ else if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_OFFSET && ++ offset_size * (member_info->i + 2) <= value.size) + member_end = gvs_read_unaligned_le (value.data + value.size - + offset_size * (member_info->i + 2), + offset_size); + ++ else /* invalid */ ++ member_end = G_MAXSIZE; ++ + if (out_member_start != NULL) + *out_member_start = member_start; + if (out_member_end != NULL) +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index 43091f2..ab0361a 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -5416,6 +5416,67 @@ test_normal_checking_tuple_offsets4 (void) + g_variant_unref (variant); + } + ++/* This is a regression test that dereferencing the first element in the offset ++ * table doesn’t dereference memory before the start of the GVariant. The first ++ * element in the offset table gives the offset of the final member in the ++ * tuple (the offset table is stored in reverse), and the position of this final ++ * member is needed to check that none of the tuple members overlap with the ++ * offset table ++ * ++ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2840 */ ++static void ++test_normal_checking_tuple_offsets5 (void) ++{ ++ /* A tuple of type (sss) in normal form would have an offset table with two ++ * entries: ++ * - The first entry (lowest index in the table) gives the offset of the ++ * third `s` in the tuple, as the offset table is reversed compared to the ++ * tuple members. ++ * - The second entry (highest index in the table) gives the offset of the ++ * second `s` in the tuple. ++ * - The offset of the first `s` in the tuple is always 0. ++ * ++ * See §2.5.4 (Structures) of the GVariant specification for details, noting ++ * that the table is only layed out this way because all three members of the ++ * tuple have non-fixed sizes. ++ * ++ * It’s not clear whether the 0xaa data of this variant is part of the strings ++ * in the tuple, or part of the offset table. It doesn’t really matter. This ++ * is a regression test to check that the code to validate the offset table ++ * doesn’t unconditionally try to access the first entry in the offset table ++ * by subtracting the table size from the end of the GVariant data. ++ * ++ * In this non-normal case, that would result in an address off the start of ++ * the GVariant data, and an out-of-bounds read, because the GVariant is one ++ * byte long, but the offset table is calculated as two bytes long (with 1B ++ * sized entries) from the tuple’s type. ++ */ ++ const GVariantType *data_type = G_VARIANT_TYPE ("(sss)"); ++ const guint8 data[] = { 0xaa }; ++ gsize size = sizeof (data); ++ GVariant *variant = NULL; ++ GVariant *normal_variant = NULL; ++ GVariant *expected = NULL; ++ ++ g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/2840"); ++ ++ variant = g_variant_new_from_data (data_type, data, size, FALSE, NULL, NULL); ++ g_assert_nonnull (variant); ++ ++ g_assert_false (g_variant_is_normal_form (variant)); ++ ++ normal_variant = g_variant_get_normal_form (variant); ++ g_assert_nonnull (normal_variant); ++ ++ expected = g_variant_new_parsed ("('', '', '')"); ++ g_assert_cmpvariant (expected, variant); ++ g_assert_cmpvariant (expected, normal_variant); ++ ++ g_variant_unref (expected); ++ g_variant_unref (normal_variant); ++ g_variant_unref (variant); ++} ++ + /* Test that an otherwise-valid serialised GVariant is considered non-normal if + * its offset table entries are too wide. + * +@@ -5663,6 +5724,8 @@ main (int argc, char **argv) + test_normal_checking_tuple_offsets3); + g_test_add_func ("/gvariant/normal-checking/tuple-offsets4", + test_normal_checking_tuple_offsets4); ++ g_test_add_func ("/gvariant/normal-checking/tuple-offsets5", ++ test_normal_checking_tuple_offsets5); + g_test_add_func ("/gvariant/normal-checking/tuple-offsets/minimal-sized", + test_normal_checking_tuple_offsets_minimal_sized); + g_test_add_func ("/gvariant/normal-checking/empty-object-path", +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0001.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0001.patch new file mode 100644 index 0000000000..2b7536c42d --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0001.patch @@ -0,0 +1,104 @@ +From 1deacdd4e8e35a5cf1417918ca4f6b0afa6409b1 Mon Sep 17 00:00:00 2001 +From: William Manley <will@stb-tester.com> +Date: Wed, 9 Aug 2023 10:04:49 +0000 +Subject: [PATCH] gvariant-core: Consolidate construction of + `GVariantSerialised` + +So I only need to change it in one place. + +This introduces no functional changes. + +Helps: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/1deacdd4e8e35a5cf1417918ca4f6b0afa6409b1] + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + glib/gvariant-core.c | 49 ++++++++++++++++++++++---------------------- + 1 file changed, 25 insertions(+), 24 deletions(-) + +diff --git a/glib/gvariant-core.c b/glib/gvariant-core.c +index a31d396..496f2e2 100644 +--- a/glib/gvariant-core.c ++++ b/glib/gvariant-core.c +@@ -349,6 +349,27 @@ g_variant_ensure_size (GVariant *value) + } + } + ++/* < private > ++ * g_variant_to_serialised: ++ * @value: a #GVariant ++ * ++ * Gets a GVariantSerialised for a GVariant in state STATE_SERIALISED. ++ */ ++inline static GVariantSerialised ++g_variant_to_serialised (GVariant *value) ++{ ++ g_assert (value->state & STATE_SERIALISED); ++ { ++ GVariantSerialised serialised = { ++ value->type_info, ++ (gpointer) value->contents.serialised.data, ++ value->size, ++ value->depth, ++ }; ++ return serialised; ++ } ++} ++ + /* < private > + * g_variant_serialise: + * @value: a #GVariant +@@ -1007,16 +1028,8 @@ g_variant_n_children (GVariant *value) + g_variant_lock (value); + + if (value->state & STATE_SERIALISED) +- { +- GVariantSerialised serialised = { +- value->type_info, +- (gpointer) value->contents.serialised.data, +- value->size, +- value->depth, +- }; +- +- n_children = g_variant_serialised_n_children (serialised); +- } ++ n_children = g_variant_serialised_n_children ( ++ g_variant_to_serialised (value)); + else + n_children = value->contents.tree.n_children; + +@@ -1083,12 +1096,7 @@ g_variant_get_child_value (GVariant *value, + } + + { +- GVariantSerialised serialised = { +- value->type_info, +- (gpointer) value->contents.serialised.data, +- value->size, +- value->depth, +- }; ++ GVariantSerialised serialised = g_variant_to_serialised (value); + GVariantSerialised s_child; + GVariant *child; + +@@ -1201,14 +1209,7 @@ g_variant_is_normal_form (GVariant *value) + + if (value->state & STATE_SERIALISED) + { +- GVariantSerialised serialised = { +- value->type_info, +- (gpointer) value->contents.serialised.data, +- value->size, +- value->depth +- }; +- +- if (g_variant_serialised_is_normal (serialised)) ++ if (g_variant_serialised_is_normal (g_variant_to_serialised (value))) + value->state |= STATE_TRUSTED; + } + else +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0002.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0002.patch new file mode 100644 index 0000000000..4eff85a5f3 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0002.patch @@ -0,0 +1,211 @@ +From 446e69f5edd72deb2196dee36bbaf8056caf6948 Mon Sep 17 00:00:00 2001 +From: William Manley <will@stb-tester.com> +Date: Wed, 9 Aug 2023 10:39:34 +0000 +Subject: [PATCH] gvariant-serialiser: Factor out functions for dealing with + framing offsets + +This introduces no functional changes. + +Helps: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/446e69f5edd72deb2196dee36bbaf8056caf6948] + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + glib/gvariant-serialiser.c | 108 +++++++++++++++++++------------------ + 1 file changed, 57 insertions(+), 51 deletions(-) + +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index 7b13381..e71248e 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -633,30 +633,62 @@ gvs_calculate_total_size (gsize body_size, + return body_size + 8 * offsets; + } + ++struct Offsets ++{ ++ gsize data_size; ++ ++ guchar *array; ++ gsize length; ++ guint offset_size; ++ ++ gboolean is_normal; ++}; ++ + static gsize +-gvs_variable_sized_array_n_children (GVariantSerialised value) ++gvs_offsets_get_offset_n (struct Offsets *offsets, ++ gsize n) ++{ ++ return gvs_read_unaligned_le ( ++ offsets->array + (offsets->offset_size * n), offsets->offset_size); ++} ++ ++static struct Offsets ++gvs_variable_sized_array_get_frame_offsets (GVariantSerialised value) + { ++ struct Offsets out = { 0, }; + gsize offsets_array_size; +- gsize offset_size; + gsize last_end; + + if (value.size == 0) +- return 0; +- +- offset_size = gvs_get_offset_size (value.size); ++ { ++ out.is_normal = TRUE; ++ return out; ++ } + +- last_end = gvs_read_unaligned_le (value.data + value.size - +- offset_size, offset_size); ++ out.offset_size = gvs_get_offset_size (value.size); ++ last_end = gvs_read_unaligned_le (value.data + value.size - out.offset_size, ++ out.offset_size); + + if (last_end > value.size) +- return 0; ++ return out; /* offsets not normal */ + + offsets_array_size = value.size - last_end; + +- if (offsets_array_size % offset_size) +- return 0; ++ if (offsets_array_size % out.offset_size) ++ return out; /* offsets not normal */ ++ ++ out.data_size = last_end; ++ out.array = value.data + last_end; ++ out.length = offsets_array_size / out.offset_size; ++ out.is_normal = TRUE; + +- return offsets_array_size / offset_size; ++ return out; ++} ++ ++static gsize ++gvs_variable_sized_array_n_children (GVariantSerialised value) ++{ ++ return gvs_variable_sized_array_get_frame_offsets (value).length; + } + + static GVariantSerialised +@@ -664,8 +696,9 @@ gvs_variable_sized_array_get_child (GVariantSerialised value, + gsize index_) + { + GVariantSerialised child = { 0, }; +- gsize offset_size; +- gsize last_end; ++ ++ struct Offsets offsets = gvs_variable_sized_array_get_frame_offsets (value); ++ + gsize start; + gsize end; + +@@ -673,18 +706,11 @@ gvs_variable_sized_array_get_child (GVariantSerialised value, + g_variant_type_info_ref (child.type_info); + child.depth = value.depth + 1; + +- offset_size = gvs_get_offset_size (value.size); +- +- last_end = gvs_read_unaligned_le (value.data + value.size - +- offset_size, offset_size); +- + if (index_ > 0) + { + guint alignment; + +- start = gvs_read_unaligned_le (value.data + last_end + +- (offset_size * (index_ - 1)), +- offset_size); ++ start = gvs_offsets_get_offset_n (&offsets, index_ - 1); + + g_variant_type_info_query (child.type_info, &alignment, NULL); + start += (-start) & alignment; +@@ -692,11 +718,9 @@ gvs_variable_sized_array_get_child (GVariantSerialised value, + else + start = 0; + +- end = gvs_read_unaligned_le (value.data + last_end + +- (offset_size * index_), +- offset_size); ++ end = gvs_offsets_get_offset_n (&offsets, index_); + +- if (start < end && end <= value.size && end <= last_end) ++ if (start < end && end <= value.size && end <= offsets.data_size) + { + child.data = value.data + start; + child.size = end - start; +@@ -768,34 +792,16 @@ static gboolean + gvs_variable_sized_array_is_normal (GVariantSerialised value) + { + GVariantSerialised child = { 0, }; +- gsize offsets_array_size; +- guchar *offsets_array; +- guint offset_size; + guint alignment; +- gsize last_end; +- gsize length; + gsize offset; + gsize i; + +- if (value.size == 0) +- return TRUE; +- +- offset_size = gvs_get_offset_size (value.size); +- last_end = gvs_read_unaligned_le (value.data + value.size - +- offset_size, offset_size); ++ struct Offsets offsets = gvs_variable_sized_array_get_frame_offsets (value); + +- if (last_end > value.size) ++ if (!offsets.is_normal) + return FALSE; + +- offsets_array_size = value.size - last_end; +- +- if (offsets_array_size % offset_size) +- return FALSE; +- +- offsets_array = value.data + value.size - offsets_array_size; +- length = offsets_array_size / offset_size; +- +- if (length == 0) ++ if (value.size != 0 && offsets.length == 0) + return FALSE; + + child.type_info = g_variant_type_info_element (value.type_info); +@@ -803,14 +809,14 @@ gvs_variable_sized_array_is_normal (GVariantSerialised value) + child.depth = value.depth + 1; + offset = 0; + +- for (i = 0; i < length; i++) ++ for (i = 0; i < offsets.length; i++) + { + gsize this_end; + +- this_end = gvs_read_unaligned_le (offsets_array + offset_size * i, +- offset_size); ++ this_end = gvs_read_unaligned_le (offsets.array + offsets.offset_size * i, ++ offsets.offset_size); + +- if (this_end < offset || this_end > last_end) ++ if (this_end < offset || this_end > offsets.data_size) + return FALSE; + + while (offset & alignment) +@@ -832,7 +838,7 @@ gvs_variable_sized_array_is_normal (GVariantSerialised value) + offset = this_end; + } + +- g_assert (offset == last_end); ++ g_assert (offset == offsets.data_size); + + return TRUE; + } +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0003.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0003.patch new file mode 100644 index 0000000000..183c6b20e7 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0003.patch @@ -0,0 +1,418 @@ +From ade71fb544391b2e33e1859645726bfee0d5eaaf Mon Sep 17 00:00:00 2001 +From: William Manley <will@stb-tester.com> +Date: Wed, 16 Aug 2023 03:12:21 +0000 +Subject: [PATCH] gvariant: Don't allow child elements to overlap with each + other + +If different elements of a variable sized array can overlap with each +other then we can cause a `GVariant` to normalise to a much larger type. + +This commit changes the behaviour of `GVariant` with non-normal form data. If +an invalid frame offset is found all subsequent elements are given their +default value. + +When retrieving an element at index `n` we scan the frame offsets up to index +`n` and if they are not in order we return an element with the default value +for that type. This guarantees that elements don't overlap with each +other. We remember the offset we've scanned up to so we don't need to +repeat this work on subsequent accesses. We skip these checks for trusted +data. + +Unfortunately this makes random access of untrusted data O(n) — at least +on first access. It doesn't affect the algorithmic complexity of accessing +elements in order, such as when using the `GVariantIter` interface. Also: +the cost of validation will be amortised as the `GVariant` instance is +continued to be used. + +I've implemented this with 4 different functions, 1 for each element size, +rather than looping calling `gvs_read_unaligned_le` in the hope that the +compiler will find it easy to optimise and should produce fairly tight +code. + +Fixes: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ade71fb544391b2e33e1859645726bfee0d5eaaf] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant-core.c | 35 ++++++++++++++++ + glib/gvariant-serialiser.c | 86 ++++++++++++++++++++++++++++++++++++-- + glib/gvariant-serialiser.h | 8 ++++ + glib/tests/gvariant.c | 45 ++++++++++++++++++++ + 4 files changed, 171 insertions(+), 3 deletions(-) + +diff --git a/glib/gvariant-core.c b/glib/gvariant-core.c +index 496f2e2..4e0b2b5 100644 +--- a/glib/gvariant-core.c ++++ b/glib/gvariant-core.c +@@ -65,6 +65,7 @@ struct _GVariant + { + GBytes *bytes; + gconstpointer data; ++ gsize ordered_offsets_up_to; + } serialised; + + struct +@@ -162,6 +163,24 @@ struct _GVariant + * if .data pointed to the appropriate number of nul + * bytes. + * ++ * .ordered_offsets_up_to: If ordered_offsets_up_to == n this means that all ++ * the frame offsets up to and including the frame ++ * offset determining the end of element n are in ++ * order. This guarantees that the bytes of element ++ * n don't overlap with any previous element. ++ * ++ * For trusted data this is set to G_MAXSIZE and we ++ * don't check that the frame offsets are in order. ++ * ++ * Note: This doesn't imply the offsets are good in ++ * any way apart from their ordering. In particular ++ * offsets may be out of bounds for this value or ++ * may imply that the data overlaps the frame ++ * offsets themselves. ++ * ++ * This field is only relevant for arrays of non ++ * fixed width types. ++ * + * .tree: Only valid when the instance is in tree form. + * + * Note that accesses from other threads could result in +@@ -365,6 +384,7 @@ g_variant_to_serialised (GVariant *value) + (gpointer) value->contents.serialised.data, + value->size, + value->depth, ++ value->contents.serialised.ordered_offsets_up_to, + }; + return serialised; + } +@@ -396,6 +416,7 @@ g_variant_serialise (GVariant *value, + serialised.size = value->size; + serialised.data = data; + serialised.depth = value->depth; ++ serialised.ordered_offsets_up_to = 0; + + children = (gpointer *) value->contents.tree.children; + n_children = value->contents.tree.n_children; +@@ -439,6 +460,15 @@ g_variant_fill_gvs (GVariantSerialised *serialised, + g_assert (serialised->size == value->size); + serialised->depth = value->depth; + ++ if (value->state & STATE_SERIALISED) ++ { ++ serialised->ordered_offsets_up_to = value->contents.serialised.ordered_offsets_up_to; ++ } ++ else ++ { ++ serialised->ordered_offsets_up_to = 0; ++ } ++ + if (serialised->data) + /* g_variant_store() is a public API, so it + * it will reacquire the lock if it needs to. +@@ -481,6 +511,7 @@ g_variant_ensure_serialised (GVariant *value) + bytes = g_bytes_new_take (data, value->size); + value->contents.serialised.data = g_bytes_get_data (bytes, NULL); + value->contents.serialised.bytes = bytes; ++ value->contents.serialised.ordered_offsets_up_to = G_MAXSIZE; + value->state |= STATE_SERIALISED; + } + } +@@ -561,6 +592,7 @@ g_variant_new_from_bytes (const GVariantType *type, + serialised.type_info = value->type_info; + serialised.data = (guchar *) g_bytes_get_data (bytes, &serialised.size); + serialised.depth = 0; ++ serialised.ordered_offsets_up_to = trusted ? G_MAXSIZE : 0; + + if (!g_variant_serialised_check (serialised)) + { +@@ -611,6 +643,8 @@ g_variant_new_from_bytes (const GVariantType *type, + value->contents.serialised.data = g_bytes_get_data (bytes, &value->size); + } + ++ value->contents.serialised.ordered_offsets_up_to = trusted ? G_MAXSIZE : 0; ++ + g_clear_pointer (&owned_bytes, g_bytes_unref); + + return value; +@@ -1130,6 +1164,7 @@ g_variant_get_child_value (GVariant *value, + child->contents.serialised.bytes = + g_bytes_ref (value->contents.serialised.bytes); + child->contents.serialised.data = s_child.data; ++ child->contents.serialised.ordered_offsets_up_to = s_child.ordered_offsets_up_to; + + return child; + } +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index e71248e..6fb3f2f 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -1,6 +1,7 @@ + /* + * Copyright © 2007, 2008 Ryan Lortie + * Copyright © 2010 Codethink Limited ++ * Copyright © 2020 William Manley + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public +@@ -264,6 +265,7 @@ gvs_fixed_sized_maybe_get_child (GVariantSerialised value, + value.type_info = g_variant_type_info_element (value.type_info); + g_variant_type_info_ref (value.type_info); + value.depth++; ++ value.ordered_offsets_up_to = 0; + + return value; + } +@@ -295,7 +297,7 @@ gvs_fixed_sized_maybe_serialise (GVariantSerialised value, + { + if (n_children) + { +- GVariantSerialised child = { NULL, value.data, value.size, value.depth + 1 }; ++ GVariantSerialised child = { NULL, value.data, value.size, value.depth + 1, 0 }; + + gvs_filler (&child, children[0]); + } +@@ -317,6 +319,7 @@ gvs_fixed_sized_maybe_is_normal (GVariantSerialised value) + /* proper element size: "Just". recurse to the child. */ + value.type_info = g_variant_type_info_element (value.type_info); + value.depth++; ++ value.ordered_offsets_up_to = 0; + + return g_variant_serialised_is_normal (value); + } +@@ -358,6 +361,7 @@ gvs_variable_sized_maybe_get_child (GVariantSerialised value, + value.data = NULL; + + value.depth++; ++ value.ordered_offsets_up_to = 0; + + return value; + } +@@ -388,7 +392,7 @@ gvs_variable_sized_maybe_serialise (GVariantSerialised value, + { + if (n_children) + { +- GVariantSerialised child = { NULL, value.data, value.size - 1, value.depth + 1 }; ++ GVariantSerialised child = { NULL, value.data, value.size - 1, value.depth + 1, 0 }; + + /* write the data for the child. */ + gvs_filler (&child, children[0]); +@@ -408,6 +412,7 @@ gvs_variable_sized_maybe_is_normal (GVariantSerialised value) + value.type_info = g_variant_type_info_element (value.type_info); + value.size--; + value.depth++; ++ value.ordered_offsets_up_to = 0; + + return g_variant_serialised_is_normal (value); + } +@@ -691,6 +696,32 @@ gvs_variable_sized_array_n_children (GVariantSerialised value) + return gvs_variable_sized_array_get_frame_offsets (value).length; + } + ++/* Find the index of the first out-of-order element in @data, assuming that ++ * @data is an array of elements of given @type, starting at index @start and ++ * containing a further @len-@start elements. */ ++#define DEFINE_FIND_UNORDERED(type) \ ++ static gsize \ ++ find_unordered_##type (const guint8 *data, gsize start, gsize len) \ ++ { \ ++ gsize off; \ ++ type current, previous; \ ++ \ ++ memcpy (&previous, data + start * sizeof (current), sizeof (current)); \ ++ for (off = (start + 1) * sizeof (current); off < len * sizeof (current); off += sizeof (current)) \ ++ { \ ++ memcpy (¤t, data + off, sizeof (current)); \ ++ if (current < previous) \ ++ break; \ ++ previous = current; \ ++ } \ ++ return off / sizeof (current) - 1; \ ++ } ++ ++DEFINE_FIND_UNORDERED (guint8); ++DEFINE_FIND_UNORDERED (guint16); ++DEFINE_FIND_UNORDERED (guint32); ++DEFINE_FIND_UNORDERED (guint64); ++ + static GVariantSerialised + gvs_variable_sized_array_get_child (GVariantSerialised value, + gsize index_) +@@ -706,6 +737,49 @@ gvs_variable_sized_array_get_child (GVariantSerialised value, + g_variant_type_info_ref (child.type_info); + child.depth = value.depth + 1; + ++ /* If the requested @index_ is beyond the set of indices whose framing offsets ++ * have been checked, check the remaining offsets to see whether they’re ++ * normal (in order, no overlapping array elements). */ ++ if (index_ > value.ordered_offsets_up_to) ++ { ++ switch (offsets.offset_size) ++ { ++ case 1: ++ { ++ value.ordered_offsets_up_to = find_unordered_guint8 ( ++ offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ break; ++ } ++ case 2: ++ { ++ value.ordered_offsets_up_to = find_unordered_guint16 ( ++ offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ break; ++ } ++ case 4: ++ { ++ value.ordered_offsets_up_to = find_unordered_guint32 ( ++ offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ break; ++ } ++ case 8: ++ { ++ value.ordered_offsets_up_to = find_unordered_guint64 ( ++ offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ break; ++ } ++ default: ++ /* gvs_get_offset_size() only returns maximum 8 */ ++ g_assert_not_reached (); ++ } ++ } ++ ++ if (index_ > value.ordered_offsets_up_to) ++ { ++ /* Offsets are invalid somewhere, so return an empty child. */ ++ return child; ++ } ++ + if (index_ > 0) + { + guint alignment; +@@ -840,6 +914,9 @@ gvs_variable_sized_array_is_normal (GVariantSerialised value) + + g_assert (offset == offsets.data_size); + ++ /* All offsets have now been checked. */ ++ value.ordered_offsets_up_to = G_MAXSIZE; ++ + return TRUE; + } + +@@ -1072,7 +1149,7 @@ gvs_tuple_is_normal (GVariantSerialised value) + for (i = 0; i < length; i++) + { + const GVariantMemberInfo *member_info; +- GVariantSerialised child; ++ GVariantSerialised child = { 0, }; + gsize fixed_size; + guint alignment; + gsize end; +@@ -1132,6 +1209,9 @@ gvs_tuple_is_normal (GVariantSerialised value) + offset = end; + } + ++ /* All element bounds have been checked above. */ ++ value.ordered_offsets_up_to = G_MAXSIZE; ++ + { + gsize fixed_size; + guint alignment; +diff --git a/glib/gvariant-serialiser.h b/glib/gvariant-serialiser.h +index 859cb7b..3ab83b3 100644 +--- a/glib/gvariant-serialiser.h ++++ b/glib/gvariant-serialiser.h +@@ -29,6 +29,14 @@ typedef struct + guchar *data; + gsize size; + gsize depth; /* same semantics as GVariant.depth */ ++ /* If ordered_offsets_up_to == n this means that all the frame offsets up to and ++ * including the frame offset determining the end of element n are in order. ++ * This guarantees that the bytes of element n don't overlap with any previous ++ * element. ++ * ++ * This is both read and set by g_variant_serialised_get_child for arrays of ++ * non-fixed-width types */ ++ gsize ordered_offsets_up_to; + } GVariantSerialised; + + /* deserialization */ +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index 0110f26..291f796 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -1,5 +1,6 @@ + /* + * Copyright © 2010 Codethink Limited ++ * Copyright © 2020 William Manley + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public +@@ -1279,6 +1280,7 @@ random_instance_filler (GVariantSerialised *serialised, + serialised->size = instance->size; + + serialised->depth = 0; ++ serialised->ordered_offsets_up_to = 0; + + g_assert_true (serialised->type_info == instance->type_info); + g_assert_cmpuint (serialised->size, ==, instance->size); +@@ -5023,6 +5025,47 @@ test_normal_checking_array_offsets (void) + g_variant_unref (variant); + } + ++/* This is a regression test that we can't have non-normal values that take up ++ * significantly more space than the normal equivalent, by specifying the ++ * offset table entries so that array elements overlap. ++ * ++ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2121#note_832242 */ ++static void ++test_normal_checking_array_offsets2 (void) ++{ ++ const guint8 data[] = { ++ 'h', 'i', '\0', ++ 0x03, 0x00, 0x03, ++ 0x06, 0x00, 0x06, ++ 0x09, 0x00, 0x09, ++ 0x0c, 0x00, 0x0c, ++ 0x0f, 0x00, 0x0f, ++ 0x12, 0x00, 0x12, ++ 0x15, 0x00, 0x15, ++ }; ++ gsize size = sizeof (data); ++ const GVariantType *aaaaaaas = G_VARIANT_TYPE ("aaaaaaas"); ++ GVariant *variant = NULL; ++ GVariant *normal_variant = NULL; ++ GVariant *expected = NULL; ++ ++ variant = g_variant_new_from_data (aaaaaaas, data, size, FALSE, NULL, NULL); ++ g_assert_nonnull (variant); ++ ++ normal_variant = g_variant_get_normal_form (variant); ++ g_assert_nonnull (normal_variant); ++ g_assert_cmpuint (g_variant_get_size (normal_variant), <=, size * 2); ++ ++ expected = g_variant_new_parsed ( ++ "[[[[[[['hi', '', ''], [], []], [], []], [], []], [], []], [], []], [], []]"); ++ g_assert_cmpvariant (expected, variant); ++ g_assert_cmpvariant (expected, normal_variant); ++ ++ g_variant_unref (expected); ++ g_variant_unref (normal_variant); ++ g_variant_unref (variant); ++} ++ + /* Test that a tuple with invalidly large values in its offset table is + * normalised successfully without looping infinitely. */ + static void +@@ -5189,6 +5232,8 @@ main (int argc, char **argv) + test_normal_checking_tuples); + g_test_add_func ("/gvariant/normal-checking/array-offsets", + test_normal_checking_array_offsets); ++ g_test_add_func ("/gvariant/normal-checking/array-offsets2", ++ test_normal_checking_array_offsets2); + g_test_add_func ("/gvariant/normal-checking/tuple-offsets", + test_normal_checking_tuple_offsets); + g_test_add_func ("/gvariant/normal-checking/empty-object-path", +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0004.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0004.patch new file mode 100644 index 0000000000..791efdee87 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0004.patch @@ -0,0 +1,114 @@ +From 345cae9c1aa7bf6752039225ef4c8d8d69fa8d76 Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Fri, 11 Aug 2023 04:09:12 +0000 +Subject: [PATCH] gvariant-serialiser: Factor out code to get bounds of a tuple + member + +This introduces no functional changes. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Helps: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/345cae9c1aa7bf6752039225ef4c8d8d69fa8d76] + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + glib/gvariant-serialiser.c | 73 ++++++++++++++++++++++++-------------- + 1 file changed, 46 insertions(+), 27 deletions(-) + +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index 2932427..1c23eab 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -946,6 +946,51 @@ gvs_variable_sized_array_is_normal (GVariantSerialised value) + * for the tuple. See the notes in gvarianttypeinfo.h. + */ + ++static void ++gvs_tuple_get_member_bounds (GVariantSerialised value, ++ gsize index_, ++ gsize offset_size, ++ gsize *out_member_start, ++ gsize *out_member_end) ++{ ++ const GVariantMemberInfo *member_info; ++ gsize member_start, member_end; ++ ++ member_info = g_variant_type_info_member_info (value.type_info, index_); ++ ++ if (member_info->i + 1) ++ member_start = gvs_read_unaligned_le (value.data + value.size - ++ offset_size * (member_info->i + 1), ++ offset_size); ++ else ++ member_start = 0; ++ ++ member_start += member_info->a; ++ member_start &= member_info->b; ++ member_start |= member_info->c; ++ ++ if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_LAST) ++ member_end = value.size - offset_size * (member_info->i + 1); ++ ++ else if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_FIXED) ++ { ++ gsize fixed_size; ++ ++ g_variant_type_info_query (member_info->type_info, NULL, &fixed_size); ++ member_end = member_start + fixed_size; ++ } ++ ++ else /* G_VARIANT_MEMBER_ENDING_OFFSET */ ++ member_end = gvs_read_unaligned_le (value.data + value.size - ++ offset_size * (member_info->i + 2), ++ offset_size); ++ ++ if (out_member_start != NULL) ++ *out_member_start = member_start; ++ if (out_member_end != NULL) ++ *out_member_end = member_end; ++} ++ + static gsize + gvs_tuple_n_children (GVariantSerialised value) + { +@@ -1001,33 +1046,7 @@ gvs_tuple_get_child (GVariantSerialised value, + } + } + +- if (member_info->i + 1) +- start = gvs_read_unaligned_le (value.data + value.size - +- offset_size * (member_info->i + 1), +- offset_size); +- else +- start = 0; +- +- start += member_info->a; +- start &= member_info->b; +- start |= member_info->c; +- +- if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_LAST) +- end = value.size - offset_size * (member_info->i + 1); +- +- else if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_FIXED) +- { +- gsize fixed_size; +- +- g_variant_type_info_query (child.type_info, NULL, &fixed_size); +- end = start + fixed_size; +- child.size = fixed_size; +- } +- +- else /* G_VARIANT_MEMBER_ENDING_OFFSET */ +- end = gvs_read_unaligned_le (value.data + value.size - +- offset_size * (member_info->i + 2), +- offset_size); ++ gvs_tuple_get_member_bounds (value, index_, offset_size, &start, &end); + + /* The child should not extend into the offset table. */ + if (index_ != g_variant_type_info_n_members (value.type_info) - 1) +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0005.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0005.patch new file mode 100644 index 0000000000..6c71c20819 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0005.patch @@ -0,0 +1,81 @@ +From 73d0aa81c2575a5c9ae77dcb94da919579014fc0 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Fri, 11 Aug 2023 04:13:02 +0000 +Subject: [PATCH] gvariant-serialiser: Rework child size calculation + +This reduces a few duplicate calls to `g_variant_type_info_query()` and +explains why they’re needed. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Helps: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/73d0aa81c2575a5c9ae77dcb94da919579014fc0] + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + glib/gvariant-serialiser.c | 31 +++++++++---------------------- + 1 file changed, 9 insertions(+), 22 deletions(-) + +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index 1c23eab..b63e99f 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -1011,14 +1011,18 @@ gvs_tuple_get_child (GVariantSerialised value, + child.depth = value.depth + 1; + offset_size = gvs_get_offset_size (value.size); + ++ /* Ensure the size is set for fixed-sized children, or ++ * g_variant_serialised_check() will fail, even if we return ++ * (child.data == NULL) to indicate an error. */ ++ if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_FIXED) ++ g_variant_type_info_query (child.type_info, NULL, &child.size); ++ + /* tuples are the only (potentially) fixed-sized containers, so the + * only ones that have to deal with the possibility of having %NULL + * data with a non-zero %size if errors occurred elsewhere. + */ + if G_UNLIKELY (value.data == NULL && value.size != 0) + { +- g_variant_type_info_query (child.type_info, NULL, &child.size); +- + /* this can only happen in fixed-sized tuples, + * so the child must also be fixed sized. + */ +@@ -1036,29 +1040,12 @@ gvs_tuple_get_child (GVariantSerialised value, + else + { + if (offset_size * (member_info->i + 1) > value.size) +- { +- /* if the child is fixed size, return its size. +- * if child is not fixed-sized, return size = 0. +- */ +- g_variant_type_info_query (child.type_info, NULL, &child.size); +- +- return child; +- } ++ return child; + } + +- gvs_tuple_get_member_bounds (value, index_, offset_size, &start, &end); +- + /* The child should not extend into the offset table. */ +- if (index_ != g_variant_type_info_n_members (value.type_info) - 1) +- { +- GVariantSerialised last_child; +- last_child = gvs_tuple_get_child (value, +- g_variant_type_info_n_members (value.type_info) - 1); +- last_end = last_child.data + last_child.size - value.data; +- g_variant_type_info_unref (last_child.type_info); +- } +- else +- last_end = end; ++ gvs_tuple_get_member_bounds (value, index_, offset_size, &start, &end); ++ gvs_tuple_get_member_bounds (value, g_variant_type_info_n_members (value.type_info) - 1, offset_size, NULL, &last_end); + + if (start < end && end <= value.size && end <= last_end) + { +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0006.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0006.patch new file mode 100644 index 0000000000..194ce15287 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0006.patch @@ -0,0 +1,397 @@ +From 7cf6f5b69146d20948d42f0c476688fe17fef787 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Wed, 16 Aug 2023 12:09:06 +0000 +Subject: [PATCH] gvariant: Don't allow child elements of a tuple to overlap + each other + +This is similar to the earlier commit which prevents child elements of a +variable-sized array from overlapping each other, but this time for +tuples. It is based heavily on ideas by William Manley. + +Tuples are slightly different from variable-sized arrays in that they +contain a mixture of fixed and variable sized elements. All but one of +the variable sized elements have an entry in the frame offsets table. +This means that if we were to just check the ordering of the frame +offsets table, the variable sized elements could still overlap +interleaving fixed sized elements, which would be bad. + +Therefore we have to check the elements rather than the frame offsets. + +The logic of checking the elements up to the index currently being +requested, and caching the result in `ordered_offsets_up_to`, means that +the algorithmic cost implications are the same for this commit as for +variable-sized arrays: an O(N) cost for these checks is amortised out +over N accesses to O(1) per access. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Fixes: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/7cf6f5b69146d20948d42f0c476688fe17fef787] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant-core.c | 6 +- + glib/gvariant-serialiser.c | 40 ++++++++ + glib/gvariant-serialiser.h | 7 +- + glib/gvariant.c | 1 + + glib/tests/gvariant.c | 181 +++++++++++++++++++++++++++++++++++++ + 5 files changed, 232 insertions(+), 3 deletions(-) + +diff --git a/glib/gvariant-core.c b/glib/gvariant-core.c +index 4e0b2b5..c57ee77 100644 +--- a/glib/gvariant-core.c ++++ b/glib/gvariant-core.c +@@ -1,6 +1,7 @@ + /* + * Copyright © 2007, 2008 Ryan Lortie + * Copyright © 2010 Codethink Limited ++ * Copyright © 2022 Endless OS Foundation, LLC + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public +@@ -179,7 +180,7 @@ struct _GVariant + * offsets themselves. + * + * This field is only relevant for arrays of non +- * fixed width types. ++ * fixed width types and for tuples. + * + * .tree: Only valid when the instance is in tree form. + * +@@ -1139,6 +1140,9 @@ g_variant_get_child_value (GVariant *value, + */ + s_child = g_variant_serialised_get_child (serialised, index_); + ++ /* Update the cached ordered_offsets_up_to, since @serialised will be thrown away when this function exits */ ++ value->contents.serialised.ordered_offsets_up_to = MAX (value->contents.serialised.ordered_offsets_up_to, serialised.ordered_offsets_up_to); ++ + /* Check whether this would cause nesting too deep. If so, return a fake + * child. The only situation we expect this to happen in is with a variant, + * as all other deeply-nested types have a static type, and hence should +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index 2493e76..d46d05c 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -942,6 +942,10 @@ gvs_variable_sized_array_is_normal (GVariantSerialised value) + * for the tuple. See the notes in gvarianttypeinfo.h. + */ + ++/* Note: This doesn’t guarantee that @out_member_end >= @out_member_start; that ++ * condition may not hold true for invalid serialised variants. The caller is ++ * responsible for checking the returned values and handling invalid ones ++ * appropriately. */ + static void + gvs_tuple_get_member_bounds (GVariantSerialised value, + gsize index_, +@@ -1028,6 +1032,42 @@ gvs_tuple_get_child (GVariantSerialised value, + return child; + } + ++ /* If the requested @index_ is beyond the set of indices whose framing offsets ++ * have been checked, check the remaining offsets to see whether they’re ++ * normal (in order, no overlapping tuple elements). ++ * ++ * Unlike the checks in gvs_variable_sized_array_get_child(), we have to check ++ * all the tuple *elements* here, not just all the framing offsets, since ++ * tuples contain a mix of elements which use framing offsets and ones which ++ * don’t. None of them are allowed to overlap. */ ++ if (index_ > value.ordered_offsets_up_to) ++ { ++ gsize i, prev_i_end = 0; ++ ++ if (value.ordered_offsets_up_to > 0) ++ gvs_tuple_get_member_bounds (value, value.ordered_offsets_up_to - 1, offset_size, NULL, &prev_i_end); ++ ++ for (i = value.ordered_offsets_up_to; i <= index_; i++) ++ { ++ gsize i_start, i_end; ++ ++ gvs_tuple_get_member_bounds (value, i, offset_size, &i_start, &i_end); ++ ++ if (i_start > i_end || i_start < prev_i_end || i_end > value.size) ++ break; ++ ++ prev_i_end = i_end; ++ } ++ ++ value.ordered_offsets_up_to = i - 1; ++ } ++ ++ if (index_ > value.ordered_offsets_up_to) ++ { ++ /* Offsets are invalid somewhere, so return an empty child. */ ++ return child; ++ } ++ + if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_OFFSET) + { + if (offset_size * (member_info->i + 2) > value.size) +diff --git a/glib/gvariant-serialiser.h b/glib/gvariant-serialiser.h +index 3ab83b3..03826f9 100644 +--- a/glib/gvariant-serialiser.h ++++ b/glib/gvariant-serialiser.h +@@ -34,8 +34,11 @@ typedef struct + * This guarantees that the bytes of element n don't overlap with any previous + * element. + * +- * This is both read and set by g_variant_serialised_get_child for arrays of +- * non-fixed-width types */ ++ * This is both read and set by g_variant_serialised_get_child() for arrays of ++ * non-fixed-width types, and for tuples. ++ * ++ * Even when dealing with tuples, @ordered_offsets_up_to is an element index, ++ * rather than an index into the frame offsets. */ + gsize ordered_offsets_up_to; + } GVariantSerialised; + +diff --git a/glib/gvariant.c b/glib/gvariant.c +index 42ffc9a..f645e05 100644 +--- a/glib/gvariant.c ++++ b/glib/gvariant.c +@@ -5997,6 +5997,7 @@ g_variant_byteswap (GVariant *value) + serialised.size = g_variant_get_size (trusted); + serialised.data = g_malloc (serialised.size); + serialised.depth = g_variant_get_depth (trusted); ++ serialised.ordered_offsets_up_to = G_MAXSIZE; /* operating on the normal form */ + g_variant_store (trusted, serialised.data); + g_variant_unref (trusted); + +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index 291f796..3ddff96 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -1,6 +1,7 @@ + /* + * Copyright © 2010 Codethink Limited + * Copyright © 2020 William Manley ++ * Copyright © 2022 Endless OS Foundation, LLC + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public +@@ -1447,6 +1448,7 @@ test_maybe (void) + serialised.data = flavoured_malloc (needed_size, flavour); + serialised.size = needed_size; + serialised.depth = 0; ++ serialised.ordered_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, + random_instance_filler, +@@ -1570,6 +1572,7 @@ test_array (void) + serialised.data = flavoured_malloc (needed_size, flavour); + serialised.size = needed_size; + serialised.depth = 0; ++ serialised.ordered_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, random_instance_filler, + (gpointer *) instances, n_children); +@@ -1734,6 +1737,7 @@ test_tuple (void) + serialised.data = flavoured_malloc (needed_size, flavour); + serialised.size = needed_size; + serialised.depth = 0; ++ serialised.ordered_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, random_instance_filler, + (gpointer *) instances, n_children); +@@ -1830,6 +1834,7 @@ test_variant (void) + serialised.data = flavoured_malloc (needed_size, flavour); + serialised.size = needed_size; + serialised.depth = 0; ++ serialised.ordered_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, random_instance_filler, + (gpointer *) &instance, 1); +@@ -5090,6 +5095,176 @@ test_normal_checking_tuple_offsets (void) + g_variant_unref (variant); + } + ++/* This is a regression test that we can't have non-normal values that take up ++ * significantly more space than the normal equivalent, by specifying the ++ * offset table entries so that tuple elements overlap. ++ * ++ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2121#note_838503 and ++ * https://gitlab.gnome.org/GNOME/glib/-/issues/2121#note_838513 */ ++static void ++test_normal_checking_tuple_offsets2 (void) ++{ ++ const GVariantType *data_type = G_VARIANT_TYPE ("(yyaiyyaiyy)"); ++ const guint8 data[] = { ++ 0x12, 0x34, 0x56, 0x78, 0x01, ++ /* ++ ^───────────────────┘ ++ ++ ^^^^^^^^^^ 1st yy ++ ^^^^^^^^^^ 2nd yy ++ ^^^^^^^^^^ 3rd yy ++ ^^^^ Framing offsets ++ */ ++ ++ /* If this variant was encoded normally, it would be something like this: ++ * 0x12, 0x34, pad, pad, [array bytes], 0x56, 0x78, pad, pad, [array bytes], 0x9A, 0xBC, 0xXX ++ * ^─────────────────────────────────────────────────────┘ ++ * ++ * ^^^^^^^^^^ 1st yy ++ * ^^^^^^^^^^ 2nd yy ++ * ^^^^^^^^^^ 3rd yy ++ * ^^^^ Framing offsets ++ */ ++ }; ++ gsize size = sizeof (data); ++ GVariant *variant = NULL; ++ GVariant *normal_variant = NULL; ++ GVariant *expected = NULL; ++ ++ variant = g_variant_new_from_data (data_type, data, size, FALSE, NULL, NULL); ++ g_assert_nonnull (variant); ++ ++ normal_variant = g_variant_get_normal_form (variant); ++ g_assert_nonnull (normal_variant); ++ g_assert_cmpuint (g_variant_get_size (normal_variant), <=, size * 3); ++ ++ expected = g_variant_new_parsed ( ++ "@(yyaiyyaiyy) (0x12, 0x34, [], 0x00, 0x00, [], 0x00, 0x00)"); ++ g_assert_cmpvariant (expected, variant); ++ g_assert_cmpvariant (expected, normal_variant); ++ ++ g_variant_unref (expected); ++ g_variant_unref (normal_variant); ++ g_variant_unref (variant); ++} ++ ++/* This is a regression test that overlapping entries in the offset table are ++ * decoded consistently, even though they’re non-normal. ++ * ++ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2121#note_910935 */ ++static void ++test_normal_checking_tuple_offsets3 (void) ++{ ++ /* The expected decoding of this non-normal byte stream is complex. See ++ * section 2.7.3 (Handling Non-Normal Serialised Data) of the GVariant ++ * specification. ++ * ++ * The rule “Child Values Overlapping Framing Offsets” from the specification ++ * says that the first `ay` must be decoded as `[0x01]` even though it ++ * overlaps the first byte of the offset table. However, since commit ++ * 7eedcd76f7d5b8c98fa60013e1fe6e960bf19df3, GLib explicitly doesn’t allow ++ * this as it’s exploitable. So the first `ay` must be given a default value. ++ * ++ * The second and third `ay`s must be given default values because of rule ++ * “End Boundary Precedes Start Boundary”. ++ * ++ * The `i` must be given a default value because of rule “Start or End ++ * Boundary of a Child Falls Outside the Container”. ++ */ ++ const GVariantType *data_type = G_VARIANT_TYPE ("(ayayiay)"); ++ const guint8 data[] = { ++ 0x01, 0x00, 0x02, ++ /* ++ ^──┘ ++ ++ ^^^^^^^^^^ 1st ay, bytes 0-2 (but given a default value anyway, see above) ++ 2nd ay, bytes 2-0 ++ i, bytes 0-4 ++ 3rd ay, bytes 4-1 ++ ^^^^^^^^^^ Framing offsets ++ */ ++ }; ++ gsize size = sizeof (data); ++ GVariant *variant = NULL; ++ GVariant *normal_variant = NULL; ++ GVariant *expected = NULL; ++ ++ variant = g_variant_new_from_data (data_type, data, size, FALSE, NULL, NULL); ++ g_assert_nonnull (variant); ++ ++ g_assert_false (g_variant_is_normal_form (variant)); ++ ++ normal_variant = g_variant_get_normal_form (variant); ++ g_assert_nonnull (normal_variant); ++ g_assert_cmpuint (g_variant_get_size (normal_variant), <=, size * 3); ++ ++ expected = g_variant_new_parsed ("@(ayayiay) ([], [], 0, [])"); ++ g_assert_cmpvariant (expected, variant); ++ g_assert_cmpvariant (expected, normal_variant); ++ ++ g_variant_unref (expected); ++ g_variant_unref (normal_variant); ++ g_variant_unref (variant); ++} ++ ++/* This is a regression test that overlapping entries in the offset table are ++ * decoded consistently, even though they’re non-normal. ++ * ++ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2121#note_910935 */ ++static void ++test_normal_checking_tuple_offsets4 (void) ++{ ++ /* The expected decoding of this non-normal byte stream is complex. See ++ * section 2.7.3 (Handling Non-Normal Serialised Data) of the GVariant ++ * specification. ++ * ++ * The rule “Child Values Overlapping Framing Offsets” from the specification ++ * says that the first `ay` must be decoded as `[0x01]` even though it ++ * overlaps the first byte of the offset table. However, since commit ++ * 7eedcd76f7d5b8c98fa60013e1fe6e960bf19df3, GLib explicitly doesn’t allow ++ * this as it’s exploitable. So the first `ay` must be given a default value. ++ * ++ * The second `ay` must be given a default value because of rule “End Boundary ++ * Precedes Start Boundary”. ++ * ++ * The third `ay` must be given a default value because its framing offsets ++ * overlap that of the first `ay`. ++ */ ++ const GVariantType *data_type = G_VARIANT_TYPE ("(ayayay)"); ++ const guint8 data[] = { ++ 0x01, 0x00, 0x02, ++ /* ++ ^──┘ ++ ++ ^^^^^^^^^^ 1st ay, bytes 0-2 (but given a default value anyway, see above) ++ 2nd ay, bytes 2-0 ++ 3rd ay, bytes 0-1 ++ ^^^^^^^^^^ Framing offsets ++ */ ++ }; ++ gsize size = sizeof (data); ++ GVariant *variant = NULL; ++ GVariant *normal_variant = NULL; ++ GVariant *expected = NULL; ++ ++ variant = g_variant_new_from_data (data_type, data, size, FALSE, NULL, NULL); ++ g_assert_nonnull (variant); ++ ++ g_assert_false (g_variant_is_normal_form (variant)); ++ ++ normal_variant = g_variant_get_normal_form (variant); ++ g_assert_nonnull (normal_variant); ++ g_assert_cmpuint (g_variant_get_size (normal_variant), <=, size * 3); ++ ++ expected = g_variant_new_parsed ("@(ayayay) ([], [], [])"); ++ g_assert_cmpvariant (expected, variant); ++ g_assert_cmpvariant (expected, normal_variant); ++ ++ g_variant_unref (expected); ++ g_variant_unref (normal_variant); ++ g_variant_unref (variant); ++} ++ + /* Test that an empty object path is normalised successfully to the base object + * path, ‘/’. */ + static void +@@ -5236,6 +5411,12 @@ main (int argc, char **argv) + test_normal_checking_array_offsets2); + g_test_add_func ("/gvariant/normal-checking/tuple-offsets", + test_normal_checking_tuple_offsets); ++ g_test_add_func ("/gvariant/normal-checking/tuple-offsets2", ++ test_normal_checking_tuple_offsets2); ++ g_test_add_func ("/gvariant/normal-checking/tuple-offsets3", ++ test_normal_checking_tuple_offsets3); ++ g_test_add_func ("/gvariant/normal-checking/tuple-offsets4", ++ test_normal_checking_tuple_offsets4); + g_test_add_func ("/gvariant/normal-checking/empty-object-path", + test_normal_checking_empty_object_path); + +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0007.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0007.patch new file mode 100644 index 0000000000..8a408ab030 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0007.patch @@ -0,0 +1,50 @@ +From e6490c84e84ba9f182fbd83b51ff4f9f5a0a1793 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Wed, 16 Aug 2023 03:42:47 +0000 +Subject: [PATCH] gvariant: Port g_variant_deep_copy() to count its iterations + directly + +This is equivalent to what `GVariantIter` does, but it means that +`g_variant_deep_copy()` is making its own `g_variant_get_child_value()` +calls. + +This will be useful in an upcoming commit, where those child values will +be inspected a little more deeply. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Helps: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/e6490c84e84ba9f182fbd83b51ff4f9f5a0a1793] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/glib/gvariant.c b/glib/gvariant.c +index 42ffc9a..ca13cc1 100644 +--- a/glib/gvariant.c ++++ b/glib/gvariant.c +@@ -5850,14 +5850,13 @@ g_variant_deep_copy (GVariant *value) + case G_VARIANT_CLASS_VARIANT: + { + GVariantBuilder builder; +- GVariantIter iter; +- GVariant *child; ++ gsize i, n_children; + + g_variant_builder_init (&builder, g_variant_get_type (value)); +- g_variant_iter_init (&iter, value); + +- while ((child = g_variant_iter_next_value (&iter))) ++ for (i = 0, n_children = g_variant_n_children (value); i < n_children; i++) + { ++ GVariant *child = g_variant_get_child_value (value, i); + g_variant_builder_add_value (&builder, g_variant_deep_copy (child)); + g_variant_unref (child); + } +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0008.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0008.patch new file mode 100644 index 0000000000..9b074a543d --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0008.patch @@ -0,0 +1,395 @@ +From d1a293c4e29880b8d17bb826c9a426a440ca4a91 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Thu, 17 Aug 2023 01:30:38 +0000 +Subject: [PATCH] gvariant: Track checked and ordered offsets independently + +The past few commits introduced the concept of known-good offsets in the +offset table (which is used for variable-width arrays and tuples). +Good offsets are ones which are non-overlapping with all the previous +offsets in the table. + +If a bad offset is encountered when indexing into the array or tuple, +the cached known-good offset index will not be increased. In this way, +all child variants at and beyond the first bad offset can be returned as +default values rather than dereferencing potentially invalid data. + +In this case, there was no information about the fact that the indexes +between the highest known-good index and the requested one had been +checked already. That could lead to a pathological case where an offset +table with an invalid first offset is repeatedly checked in full when +trying to access higher-indexed children. + +Avoid that by storing the index of the highest checked offset in the +table, as well as the index of the highest good/ordered offset. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Helps: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/d1a293c4e29880b8d17bb826c9a426a440ca4a91] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant-core.c | 28 ++++++++++++++++++++++++ + glib/gvariant-serialiser.c | 44 +++++++++++++++++++++++++++----------- + glib/gvariant-serialiser.h | 9 ++++++++ + glib/gvariant.c | 1 + + glib/tests/gvariant.c | 5 +++++ + 5 files changed, 75 insertions(+), 12 deletions(-) + +diff --git a/glib/gvariant-core.c b/glib/gvariant-core.c +index c57ee77..7b71efc 100644 +--- a/glib/gvariant-core.c ++++ b/glib/gvariant-core.c +@@ -67,6 +67,7 @@ struct _GVariant + GBytes *bytes; + gconstpointer data; + gsize ordered_offsets_up_to; ++ gsize checked_offsets_up_to; + } serialised; + + struct +@@ -182,6 +183,24 @@ struct _GVariant + * This field is only relevant for arrays of non + * fixed width types and for tuples. + * ++ * .checked_offsets_up_to: Similarly to .ordered_offsets_up_to, this stores ++ * the index of the highest element, n, whose frame ++ * offsets (and all the preceding frame offsets) ++ * have been checked for validity. ++ * ++ * It is always the case that ++ * .checked_offsets_up_to ≥ .ordered_offsets_up_to. ++ * ++ * If .checked_offsets_up_to == .ordered_offsets_up_to, ++ * then a bad offset has not been found so far. ++ * ++ * If .checked_offsets_up_to > .ordered_offsets_up_to, ++ * then a bad offset has been found at ++ * (.ordered_offsets_up_to + 1). ++ * ++ * This field is only relevant for arrays of non ++ * fixed width types and for tuples. ++ * + * .tree: Only valid when the instance is in tree form. + * + * Note that accesses from other threads could result in +@@ -386,6 +405,7 @@ g_variant_to_serialised (GVariant *value) + value->size, + value->depth, + value->contents.serialised.ordered_offsets_up_to, ++ value->contents.serialised.checked_offsets_up_to, + }; + return serialised; + } +@@ -418,6 +438,7 @@ g_variant_serialise (GVariant *value, + serialised.data = data; + serialised.depth = value->depth; + serialised.ordered_offsets_up_to = 0; ++ serialised.checked_offsets_up_to = 0; + + children = (gpointer *) value->contents.tree.children; + n_children = value->contents.tree.n_children; +@@ -464,10 +485,12 @@ g_variant_fill_gvs (GVariantSerialised *serialised, + if (value->state & STATE_SERIALISED) + { + serialised->ordered_offsets_up_to = value->contents.serialised.ordered_offsets_up_to; ++ serialised->checked_offsets_up_to = value->contents.serialised.checked_offsets_up_to; + } + else + { + serialised->ordered_offsets_up_to = 0; ++ serialised->checked_offsets_up_to = 0; + } + + if (serialised->data) +@@ -513,6 +536,7 @@ g_variant_ensure_serialised (GVariant *value) + value->contents.serialised.data = g_bytes_get_data (bytes, NULL); + value->contents.serialised.bytes = bytes; + value->contents.serialised.ordered_offsets_up_to = G_MAXSIZE; ++ value->contents.serialised.checked_offsets_up_to = G_MAXSIZE; + value->state |= STATE_SERIALISED; + } + } +@@ -594,6 +618,7 @@ g_variant_new_from_bytes (const GVariantType *type, + serialised.data = (guchar *) g_bytes_get_data (bytes, &serialised.size); + serialised.depth = 0; + serialised.ordered_offsets_up_to = trusted ? G_MAXSIZE : 0; ++ serialised.checked_offsets_up_to = trusted ? G_MAXSIZE : 0; + + if (!g_variant_serialised_check (serialised)) + { +@@ -645,6 +670,7 @@ g_variant_new_from_bytes (const GVariantType *type, + } + + value->contents.serialised.ordered_offsets_up_to = trusted ? G_MAXSIZE : 0; ++ value->contents.serialised.checked_offsets_up_to = trusted ? G_MAXSIZE : 0; + + g_clear_pointer (&owned_bytes, g_bytes_unref); + +@@ -1142,6 +1168,7 @@ g_variant_get_child_value (GVariant *value, + + /* Update the cached ordered_offsets_up_to, since @serialised will be thrown away when this function exits */ + value->contents.serialised.ordered_offsets_up_to = MAX (value->contents.serialised.ordered_offsets_up_to, serialised.ordered_offsets_up_to); ++ value->contents.serialised.checked_offsets_up_to = MAX (value->contents.serialised.checked_offsets_up_to, serialised.checked_offsets_up_to); + + /* Check whether this would cause nesting too deep. If so, return a fake + * child. The only situation we expect this to happen in is with a variant, +@@ -1169,6 +1196,7 @@ g_variant_get_child_value (GVariant *value, + g_bytes_ref (value->contents.serialised.bytes); + child->contents.serialised.data = s_child.data; + child->contents.serialised.ordered_offsets_up_to = s_child.ordered_offsets_up_to; ++ child->contents.serialised.checked_offsets_up_to = s_child.checked_offsets_up_to; + + return child; + } +diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c +index d46d05c..9c7f12a 100644 +--- a/glib/gvariant-serialiser.c ++++ b/glib/gvariant-serialiser.c +@@ -120,6 +120,8 @@ + * + * @depth has no restrictions; the depth of a top-level serialized #GVariant is + * zero, and it increases for each level of nested child. ++ * ++ * @checked_offsets_up_to is always ≥ @ordered_offsets_up_to + */ + + /* < private > +@@ -147,6 +149,9 @@ g_variant_serialised_check (GVariantSerialised serialised) + !(serialised.size == 0 || serialised.data != NULL)) + return FALSE; + ++ if (serialised.ordered_offsets_up_to > serialised.checked_offsets_up_to) ++ return FALSE; ++ + /* Depending on the native alignment requirements of the machine, the + * compiler will insert either 3 or 7 padding bytes after the char. + * This will result in the sizeof() the struct being 12 or 16. +@@ -266,6 +271,7 @@ gvs_fixed_sized_maybe_get_child (GVariantSerialised value, + g_variant_type_info_ref (value.type_info); + value.depth++; + value.ordered_offsets_up_to = 0; ++ value.checked_offsets_up_to = 0; + + return value; + } +@@ -297,7 +303,7 @@ gvs_fixed_sized_maybe_serialise (GVariantSerialised value, + { + if (n_children) + { +- GVariantSerialised child = { NULL, value.data, value.size, value.depth + 1, 0 }; ++ GVariantSerialised child = { NULL, value.data, value.size, value.depth + 1, 0, 0 }; + + gvs_filler (&child, children[0]); + } +@@ -320,6 +326,7 @@ gvs_fixed_sized_maybe_is_normal (GVariantSerialised value) + value.type_info = g_variant_type_info_element (value.type_info); + value.depth++; + value.ordered_offsets_up_to = 0; ++ value.checked_offsets_up_to = 0; + + return g_variant_serialised_is_normal (value); + } +@@ -362,6 +369,7 @@ gvs_variable_sized_maybe_get_child (GVariantSerialised value, + + value.depth++; + value.ordered_offsets_up_to = 0; ++ value.checked_offsets_up_to = 0; + + return value; + } +@@ -392,7 +400,7 @@ gvs_variable_sized_maybe_serialise (GVariantSerialised value, + { + if (n_children) + { +- GVariantSerialised child = { NULL, value.data, value.size - 1, value.depth + 1, 0 }; ++ GVariantSerialised child = { NULL, value.data, value.size - 1, value.depth + 1, 0, 0 }; + + /* write the data for the child. */ + gvs_filler (&child, children[0]); +@@ -413,6 +421,7 @@ gvs_variable_sized_maybe_is_normal (GVariantSerialised value) + value.size--; + value.depth++; + value.ordered_offsets_up_to = 0; ++ value.checked_offsets_up_to = 0; + + return g_variant_serialised_is_normal (value); + } +@@ -739,39 +748,46 @@ gvs_variable_sized_array_get_child (GVariantSerialised value, + + /* If the requested @index_ is beyond the set of indices whose framing offsets + * have been checked, check the remaining offsets to see whether they’re +- * normal (in order, no overlapping array elements). */ +- if (index_ > value.ordered_offsets_up_to) ++ * normal (in order, no overlapping array elements). ++ * ++ * Don’t bother checking if the highest known-good offset is lower than the ++ * highest checked offset, as that means there’s an invalid element at that ++ * index, so there’s no need to check further. */ ++ if (index_ > value.checked_offsets_up_to && ++ value.ordered_offsets_up_to == value.checked_offsets_up_to) + { + switch (offsets.offset_size) + { + case 1: + { + value.ordered_offsets_up_to = find_unordered_guint8 ( +- offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ offsets.array, value.checked_offsets_up_to, index_ + 1); + break; + } + case 2: + { + value.ordered_offsets_up_to = find_unordered_guint16 ( +- offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ offsets.array, value.checked_offsets_up_to, index_ + 1); + break; + } + case 4: + { + value.ordered_offsets_up_to = find_unordered_guint32 ( +- offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ offsets.array, value.checked_offsets_up_to, index_ + 1); + break; + } + case 8: + { + value.ordered_offsets_up_to = find_unordered_guint64 ( +- offsets.array, value.ordered_offsets_up_to, index_ + 1); ++ offsets.array, value.checked_offsets_up_to, index_ + 1); + break; + } + default: + /* gvs_get_offset_size() only returns maximum 8 */ + g_assert_not_reached (); + } ++ ++ value.checked_offsets_up_to = index_; + } + + if (index_ > value.ordered_offsets_up_to) +@@ -916,6 +932,7 @@ gvs_variable_sized_array_is_normal (GVariantSerialised value) + + /* All offsets have now been checked. */ + value.ordered_offsets_up_to = G_MAXSIZE; ++ value.checked_offsets_up_to = G_MAXSIZE; + + return TRUE; + } +@@ -1040,14 +1057,15 @@ gvs_tuple_get_child (GVariantSerialised value, + * all the tuple *elements* here, not just all the framing offsets, since + * tuples contain a mix of elements which use framing offsets and ones which + * don’t. None of them are allowed to overlap. */ +- if (index_ > value.ordered_offsets_up_to) ++ if (index_ > value.checked_offsets_up_to && ++ value.ordered_offsets_up_to == value.checked_offsets_up_to) + { + gsize i, prev_i_end = 0; + +- if (value.ordered_offsets_up_to > 0) +- gvs_tuple_get_member_bounds (value, value.ordered_offsets_up_to - 1, offset_size, NULL, &prev_i_end); ++ if (value.checked_offsets_up_to > 0) ++ gvs_tuple_get_member_bounds (value, value.checked_offsets_up_to - 1, offset_size, NULL, &prev_i_end); + +- for (i = value.ordered_offsets_up_to; i <= index_; i++) ++ for (i = value.checked_offsets_up_to; i <= index_; i++) + { + gsize i_start, i_end; + +@@ -1060,6 +1078,7 @@ gvs_tuple_get_child (GVariantSerialised value, + } + + value.ordered_offsets_up_to = i - 1; ++ value.checked_offsets_up_to = index_; + } + + if (index_ > value.ordered_offsets_up_to) +@@ -1257,6 +1276,7 @@ gvs_tuple_is_normal (GVariantSerialised value) + + /* All element bounds have been checked above. */ + value.ordered_offsets_up_to = G_MAXSIZE; ++ value.checked_offsets_up_to = G_MAXSIZE; + + { + gsize fixed_size; +diff --git a/glib/gvariant-serialiser.h b/glib/gvariant-serialiser.h +index 03826f9..2423e01 100644 +--- a/glib/gvariant-serialiser.h ++++ b/glib/gvariant-serialiser.h +@@ -40,6 +40,15 @@ typedef struct + * Even when dealing with tuples, @ordered_offsets_up_to is an element index, + * rather than an index into the frame offsets. */ + gsize ordered_offsets_up_to; ++ ++ /* Similar to @ordered_offsets_up_to. This gives the index of the child element ++ * whose frame offset is the highest in the offset table which has been ++ * checked so far. ++ * ++ * This is always ≥ @ordered_offsets_up_to. It is always an element index. ++ * ++ * See documentation in gvariant-core.c for `struct GVariant` for details. */ ++ gsize checked_offsets_up_to; + } GVariantSerialised; + + /* deserialization */ +diff --git a/glib/gvariant.c b/glib/gvariant.c +index 1b1cbdc..2e288af 100644 +--- a/glib/gvariant.c ++++ b/glib/gvariant.c +@@ -5997,6 +5997,7 @@ g_variant_byteswap (GVariant *value) + serialised.data = g_malloc (serialised.size); + serialised.depth = g_variant_get_depth (trusted); + serialised.ordered_offsets_up_to = G_MAXSIZE; /* operating on the normal form */ ++ serialised.checked_offsets_up_to = G_MAXSIZE; + g_variant_store (trusted, serialised.data); + g_variant_unref (trusted); + +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index 3ddff96..31a7dde 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -1282,6 +1282,7 @@ random_instance_filler (GVariantSerialised *serialised, + + serialised->depth = 0; + serialised->ordered_offsets_up_to = 0; ++ serialised->checked_offsets_up_to = 0; + + g_assert_true (serialised->type_info == instance->type_info); + g_assert_cmpuint (serialised->size, ==, instance->size); +@@ -1449,6 +1450,7 @@ test_maybe (void) + serialised.size = needed_size; + serialised.depth = 0; + serialised.ordered_offsets_up_to = 0; ++ serialised.checked_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, + random_instance_filler, +@@ -1573,6 +1575,7 @@ test_array (void) + serialised.size = needed_size; + serialised.depth = 0; + serialised.ordered_offsets_up_to = 0; ++ serialised.checked_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, random_instance_filler, + (gpointer *) instances, n_children); +@@ -1738,6 +1741,7 @@ test_tuple (void) + serialised.size = needed_size; + serialised.depth = 0; + serialised.ordered_offsets_up_to = 0; ++ serialised.checked_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, random_instance_filler, + (gpointer *) instances, n_children); +@@ -1835,6 +1839,7 @@ test_variant (void) + serialised.size = needed_size; + serialised.depth = 0; + serialised.ordered_offsets_up_to = 0; ++ serialised.checked_offsets_up_to = 0; + + g_variant_serialiser_serialise (serialised, random_instance_filler, + (gpointer *) &instance, 1); +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0009.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0009.patch new file mode 100644 index 0000000000..7a43b138f3 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0009.patch @@ -0,0 +1,98 @@ +From 298a537d5f6783e55d87e40011ee3fd3b22b72f9 Mon Sep 17 00:00:00 2001 +From: Philip Withnall <pwithnall@endlessos.org> +Date: Thu, 17 Aug 2023 01:39:01 +0000 +Subject: [PATCH] gvariant: Zero-initialise various GVariantSerialised objects + +The following few commits will add a couple of new fields to +`GVariantSerialised`, and they should be zero-filled by default. + +Try and pre-empt that a bit by zero-filling `GVariantSerialised` by +default in a few places. + +Signed-off-by: Philip Withnall <pwithnall@endlessos.org> + +Helps: #2121 + +CVE: CVE-2023-32665 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/298a537d5f6783e55d87e40011ee3fd3b22b72f9] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + glib/gvariant.c | 2 +- + glib/tests/gvariant.c | 12 ++++++------ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/glib/gvariant.c b/glib/gvariant.c +index 2e288af..30a3280 100644 +--- a/glib/gvariant.c ++++ b/glib/gvariant.c +@@ -5987,7 +5987,7 @@ g_variant_byteswap (GVariant *value) + if (alignment) + /* (potentially) contains multi-byte numeric data */ + { +- GVariantSerialised serialised; ++ GVariantSerialised serialised = { 0, }; + GVariant *trusted; + GBytes *bytes; + +diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c +index 31a7dde..2f33a3e 100644 +--- a/glib/tests/gvariant.c ++++ b/glib/tests/gvariant.c +@@ -1442,7 +1442,7 @@ test_maybe (void) + + for (flavour = 0; flavour < 8; flavour += alignment) + { +- GVariantSerialised serialised; ++ GVariantSerialised serialised = { 0, }; + GVariantSerialised child; + + serialised.type_info = type_info; +@@ -1568,7 +1568,7 @@ test_array (void) + + for (flavour = 0; flavour < 8; flavour += alignment) + { +- GVariantSerialised serialised; ++ GVariantSerialised serialised = { 0, }; + + serialised.type_info = array_info; + serialised.data = flavoured_malloc (needed_size, flavour); +@@ -1734,7 +1734,7 @@ test_tuple (void) + + for (flavour = 0; flavour < 8; flavour += alignment) + { +- GVariantSerialised serialised; ++ GVariantSerialised serialised = { 0, }; + + serialised.type_info = type_info; + serialised.data = flavoured_malloc (needed_size, flavour); +@@ -1831,7 +1831,7 @@ test_variant (void) + + for (flavour = 0; flavour < 8; flavour += alignment) + { +- GVariantSerialised serialised; ++ GVariantSerialised serialised = { 0, }; + GVariantSerialised child; + + serialised.type_info = type_info; +@@ -2280,7 +2280,7 @@ serialise_tree (TreeInstance *tree, + static void + test_byteswap (void) + { +- GVariantSerialised one, two; ++ GVariantSerialised one = { 0, }, two = { 0, }; + TreeInstance *tree; + + tree = tree_instance_new (NULL, 3); +@@ -2354,7 +2354,7 @@ test_serialiser_children (void) + static void + test_fuzz (gdouble *fuzziness) + { +- GVariantSerialised serialised; ++ GVariantSerialised serialised = { 0, }; + TreeInstance *tree; + + /* make an instance */ +-- +2.40.0 diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb index b5ab6502a3..24c590a714 100644 --- a/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb +++ b/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb @@ -17,6 +17,20 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \ file://0001-meson-Run-atomics-test-on-clang-as-well.patch \ file://0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch \ file://0001-gio-tests-g-file-info-don-t-assume-million-in-one-ev.patch \ + file://CVE-2023-32665-0001.patch \ + file://CVE-2023-32665-0002.patch \ + file://CVE-2023-32665-0003.patch \ + file://CVE-2023-32665-0004.patch \ + file://CVE-2023-32665-0005.patch \ + file://CVE-2023-32665-0006.patch \ + file://CVE-2023-32665-0007.patch \ + file://CVE-2023-32665-0008.patch \ + file://CVE-2023-32665-0009.patch \ + file://CVE-2023-29499.patch \ + file://CVE-2023-32611-0001.patch \ + file://CVE-2023-32611-0002.patch \ + file://CVE-2023-32643.patch \ + file://CVE-2023-32636.patch \ " SRC_URI:append:class-native = " file://relocate-modules.patch" diff --git a/meta/recipes-core/glibc/glibc-locale.inc b/meta/recipes-core/glibc/glibc-locale.inc index 7f70b3ca4f..69b29c836c 100644 --- a/meta/recipes-core/glibc/glibc-locale.inc +++ b/meta/recipes-core/glibc/glibc-locale.inc @@ -37,22 +37,22 @@ PACKAGES_DYNAMIC = "^locale-base-.* \ # Create a glibc-binaries package ALLOW_EMPTY:${BPN}-binaries = "1" PACKAGES += "${BPN}-binaries" -RRECOMMENDS:${BPN}-binaries = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-binary") != -1])}" +RRECOMMENDS:${BPN}-binaries = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-binary-") != -1])}" # Create a glibc-charmaps package ALLOW_EMPTY:${BPN}-charmaps = "1" PACKAGES += "${BPN}-charmaps" -RRECOMMENDS:${BPN}-charmaps = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-charmap") != -1])}" +RRECOMMENDS:${BPN}-charmaps = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-charmap-") != -1])}" # Create a glibc-gconvs package ALLOW_EMPTY:${BPN}-gconvs = "1" PACKAGES += "${BPN}-gconvs" -RRECOMMENDS:${BPN}-gconvs = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-gconv") != -1])}" +RRECOMMENDS:${BPN}-gconvs = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-gconv-") != -1])}" # Create a glibc-localedatas package ALLOW_EMPTY:${BPN}-localedatas = "1" PACKAGES += "${BPN}-localedatas" -RRECOMMENDS:${BPN}-localedatas = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-localedata") != -1])}" +RRECOMMENDS:${BPN}-localedatas = "${@" ".join([p for p in d.getVar('PACKAGES').split() if p.find("glibc-localedata-") != -1])}" DESCRIPTION:localedef = "glibc: compile locale definition files" diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index d36da0ce3f..e0d47f283b 100644 --- a/meta/recipes-core/glibc/glibc-version.inc +++ b/meta/recipes-core/glibc/glibc-version.inc @@ -1,6 +1,6 @@ SRCBRANCH ?= "release/2.35/master" PV = "2.35" -SRCREV_glibc ?= "293211b6fddf60fc407d21fcba0326dd2148f76b" +SRCREV_glibc ?= "c84018a05aec80f5ee6f682db0da1130b0196aef" SRCREV_localedef ?= "794da69788cbf9bf57b59a852f9f11307663fa87" GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git" diff --git a/meta/recipes-core/glibc/glibc.inc b/meta/recipes-core/glibc/glibc.inc index fdd241d973..3b940b8ab2 100644 --- a/meta/recipes-core/glibc/glibc.inc +++ b/meta/recipes-core/glibc/glibc.inc @@ -1,7 +1,9 @@ require glibc-common.inc require glibc-ld.inc -DEPENDS = "virtual/${TARGET_PREFIX}gcc libgcc-initial linux-libc-headers" +DEPENDS = "virtual/${TARGET_PREFIX}gcc virtual/${TARGET_PREFIX}binutils${BUSUFFIX} libgcc-initial linux-libc-headers" +BUSUFFIX= "" +BUSUFFIX:class-nativesdk = "-crosssdk" PROVIDES = "virtual/libc" PROVIDES += "virtual/libintl virtual/libiconv" diff --git a/meta/recipes-core/glibc/glibc/0002-get_nscd_addresses-Fix-subscript-typos-BZ-29605.patch b/meta/recipes-core/glibc/glibc/0002-get_nscd_addresses-Fix-subscript-typos-BZ-29605.patch new file mode 100644 index 0000000000..629298c23e --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0002-get_nscd_addresses-Fix-subscript-typos-BZ-29605.patch @@ -0,0 +1,40 @@ +From 707a878b655395f41b954bbed78008d1d9252f1a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rg=20Sonnenberger?= <joerg@bec.de> +Date: Mon, 26 Sep 2022 13:59:16 -0400 +Subject: [PATCH] get_nscd_addresses: Fix subscript typos [BZ #29605] + +Fix the subscript on air->family, which was accidentally set to COUNT +when it should have remained as I. + +Resolves: BZ #29605 + +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=c9226c03da0276593a0918eaa9a14835183343e8] + +Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> +Signed-off-by: Haitao Liu <haitao.liu@windriver.com> +--- + sysdeps/posix/getaddrinfo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c +index f4c08d6e3b..fa333ad6ec 100644 +--- a/sysdeps/posix/getaddrinfo.c ++++ b/sysdeps/posix/getaddrinfo.c +@@ -549,11 +549,11 @@ get_nscd_addresses (const char *name, const struct addrinfo *req, + at[count].addr[2] = htonl (0xffff); + } + else if (req->ai_family == AF_UNSPEC +- || air->family[count] == req->ai_family) ++ || air->family[i] == req->ai_family) + { +- at[count].family = air->family[count]; ++ at[count].family = air->family[i]; + memcpy (at[count].addr, addrs, size); +- if (air->family[count] == AF_INET6) ++ if (air->family[i] == AF_INET6) + res->got_ipv6 = true; + } + at[count].next = at + count + 1; +-- +2.35.5 + diff --git a/meta/recipes-core/glibc/glibc/check-test-wrapper b/meta/recipes-core/glibc/glibc/check-test-wrapper index 6ec9b9b29e..5cc993f718 100644 --- a/meta/recipes-core/glibc/glibc/check-test-wrapper +++ b/meta/recipes-core/glibc/glibc/check-test-wrapper @@ -58,7 +58,7 @@ elif targettype == "ssh": user = os.environ.get("SSH_HOST_USER", None) port = os.environ.get("SSH_HOST_PORT", None) - command = ["ssh", "-o", "UserKnownHostsFile=/dev/null", "-o", "StrictHostKeyChecking=no"] + command = ["ssh", "-o", "UserKnownHostsFile=/dev/null", "-o", "StrictHostKeyChecking=no", "-o", "LogLevel=quiet"] if port: command += ["-p", str(port)] if not host: diff --git a/meta/recipes-core/glibc/glibc_2.35.bb b/meta/recipes-core/glibc/glibc_2.35.bb index df847e76bf..751427517f 100644 --- a/meta/recipes-core/glibc/glibc_2.35.bb +++ b/meta/recipes-core/glibc/glibc_2.35.bb @@ -16,6 +16,16 @@ CVE_CHECK_IGNORE += "CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024" # Potential patch at https://sourceware.org/bugzilla/show_bug.cgi?id=22853 CVE_CHECK_IGNORE += "CVE-2019-1010025" +# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4527 +# This vulnerability was introduced in 2.36 by commit +# f282cdbe7f436c75864e5640a409a10485e9abb2 resolv: Implement no-aaaa stub resolver option +# so our version is not yet vulnerable +# See https://sourceware.org/bugzilla/show_bug.cgi?id=30842 +CVE_CHECK_IGNORE += "CVE-2023-4527" + +# To avoid these in cve-check reports since the recipe version did not change +CVE_CHECK_IGNORE += "CVE-2023-0687 CVE-2023-4813 CVE-2023-4806 CVE-2023-4911 CVE-2023-5156" + DEPENDS += "gperf-native bison-native" NATIVESDKFIXES ?= "" @@ -50,6 +60,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \ \ file://0001-Revert-Linux-Implement-a-useful-version-of-_startup_.patch \ + file://0002-get_nscd_addresses-Fix-subscript-typos-BZ-29605.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" diff --git a/meta/recipes-core/glibc/ldconfig-native-2.12.1/ldconfig-handle-.dynstr-located-in-separate-segment.patch b/meta/recipes-core/glibc/ldconfig-native-2.12.1/ldconfig-handle-.dynstr-located-in-separate-segment.patch new file mode 100644 index 0000000000..36f04adfde --- /dev/null +++ b/meta/recipes-core/glibc/ldconfig-native-2.12.1/ldconfig-handle-.dynstr-located-in-separate-segment.patch @@ -0,0 +1,178 @@ +From 864054a6cb971688a181316b8227ae0361b4d69e Mon Sep 17 00:00:00 2001 +From: Andreas Schwab <schwab@suse.de> +Date: Wed, 9 Oct 2019 17:46:47 +0200 +Subject: [PATCH] ldconfig: handle .dynstr located in separate segment (bug + 25087) + +To determine the load offset of the DT_STRTAB section search for the +segment containing it, instead of using the load offset of the first +segment. + +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=58e8f5fd2ba47b6dc47fd4d0a35e4175c7c87aaa] + +Backported: ported to support endianness and 32/64 bits. +Signed-off-by: Fabien Mahot <fabien.mahot@external.desouttertools.com> +--- + readelflib.c | 86 +++++++++++++++++++++++++++++++--------------------- + 1 file changed, 52 insertions(+), 34 deletions(-) + +diff --git a/readelflib.c b/readelflib.c +index a01e1cede3..380aed563d 100644 +--- a/readelflib.c ++++ b/readelflib.c +@@ -80,7 +80,6 @@ process_elf_file32 (const char *file_name, const char *lib, int *flag, + { + int i; + unsigned int j; +- Elf32_Addr loadaddr; + unsigned int dynamic_addr; + size_t dynamic_size; + char *program_interpreter; +@@ -110,7 +109,6 @@ process_elf_file32 (const char *file_name, const char *lib, int *flag, + libc5/libc6. */ + *flag = FLAG_ELF; + +- loadaddr = -1; + dynamic_addr = 0; + dynamic_size = 0; + program_interpreter = NULL; +@@ -121,11 +119,6 @@ process_elf_file32 (const char *file_name, const char *lib, int *flag, + + switch (read32(segment->p_type, be)) + { +- case PT_LOAD: +- if (loadaddr == (Elf32_Addr) -1) +- loadaddr = read32(segment->p_vaddr, be) - read32(segment->p_offset, be); +- break; +- + case PT_DYNAMIC: + if (dynamic_addr) + error (0, 0, _("more than one dynamic segment\n")); +@@ -188,11 +181,6 @@ process_elf_file32 (const char *file_name, const char *lib, int *flag, + } + + } +- if (loadaddr == (Elf32_Addr) -1) +- { +- /* Very strange. */ +- loadaddr = 0; +- } + + /* Now we can read the dynamic sections. */ + if (dynamic_size == 0) +@@ -208,11 +196,32 @@ process_elf_file32 (const char *file_name, const char *lib, int *flag, + { + check_ptr (dyn_entry); + if (read32(dyn_entry->d_tag, be) == DT_STRTAB) +- { +- dynamic_strings = (char *) (file_contents + read32(dyn_entry->d_un.d_val, be) - loadaddr); +- check_ptr (dynamic_strings); +- break; +- } ++ { ++ /* Find the file offset of the segment containing the dynamic ++ string table. */ ++ Elf32_Off loadoff = -1; ++ for (i = 0, segment = elf_pheader; ++ i < read16(elf_header->e_phnum, be); i++, segment++) ++ { ++ if (read32(segment->p_type, be) == PT_LOAD ++ && read32(dyn_entry->d_un.d_val, be) >= read32(segment->p_vaddr, be) ++ && (read32(dyn_entry->d_un.d_val, be) - read32(segment->p_vaddr, be) ++ < read32(segment->p_filesz, be))) ++ { ++ loadoff = read32(segment->p_vaddr, be) - read32(segment->p_offset, be); ++ break; ++ } ++ } ++ if (loadoff == (Elf32_Off) -1) ++ { ++ /* Very strange. */ ++ loadoff = 0; ++ } ++ ++ dynamic_strings = (char *) (file_contents + read32(dyn_entry->d_un.d_val, be) - loadoff); ++ check_ptr (dynamic_strings); ++ break; ++ } + } + + if (dynamic_strings == NULL) +@@ -269,7 +278,6 @@ process_elf_file64 (const char *file_name, const char *lib, int *flag, + { + int i; + unsigned int j; +- Elf64_Addr loadaddr; + Elf64_Addr dynamic_addr; + Elf64_Xword dynamic_size; + char *program_interpreter; +@@ -347,7 +355,6 @@ process_elf_file64 (const char *file_name, const char *lib, int *flag, + break; + } + +- loadaddr = -1; + dynamic_addr = 0; + dynamic_size = 0; + program_interpreter = NULL; +@@ -358,11 +365,6 @@ process_elf_file64 (const char *file_name, const char *lib, int *flag, + + switch (read32(segment->p_type, be)) + { +- case PT_LOAD: +- if (loadaddr == (Elf64_Addr) -1) +- loadaddr = read64(segment->p_vaddr, be) - read64(segment->p_offset, be); +- break; +- + case PT_DYNAMIC: + if (dynamic_addr) + error (0, 0, _("more than one dynamic segment\n")); +@@ -426,11 +428,6 @@ process_elf_file64 (const char *file_name, const char *lib, int *flag, + } + + } +- if (loadaddr == (Elf64_Addr) -1) +- { +- /* Very strange. */ +- loadaddr = 0; +- } + + /* Now we can read the dynamic sections. */ + if (dynamic_size == 0) +@@ -446,11 +443,32 @@ process_elf_file64 (const char *file_name, const char *lib, int *flag, + { + check_ptr (dyn_entry); + if (read64(dyn_entry->d_tag, be) == DT_STRTAB) +- { +- dynamic_strings = (char *) (file_contents + read64(dyn_entry->d_un.d_val, be) - loadaddr); +- check_ptr (dynamic_strings); +- break; +- } ++ { ++ /* Find the file offset of the segment containing the dynamic ++ string table. */ ++ Elf64_Off loadoff = -1; ++ for (i = 0, segment = elf_pheader; ++ i < read16(elf_header->e_phnum, be); i++, segment++) ++ { ++ if (read64(segment->p_type, be) == PT_LOAD ++ && read64(dyn_entry->d_un.d_val, be) >= read64(segment->p_vaddr, be) ++ && (read64(dyn_entry->d_un.d_val, be) - read64(segment->p_vaddr, be) ++ < read64(segment->p_filesz, be))) ++ { ++ loadoff = read64(segment->p_vaddr, be) - read64(segment->p_offset, be); ++ break; ++ } ++ } ++ if (loadoff == (Elf32_Off) -1) ++ { ++ /* Very strange. */ ++ loadoff = 0; ++ } ++ ++ dynamic_strings = (char *) (file_contents + read64(dyn_entry->d_un.d_val, be) - loadoff); ++ check_ptr (dynamic_strings); ++ break; ++ } + } + + if (dynamic_strings == NULL) diff --git a/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb b/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb index e867ceb3ec..665a3d324c 100644 --- a/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb +++ b/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb @@ -16,6 +16,7 @@ SRC_URI = "file://ldconfig-native-2.12.1.tar.bz2 \ file://add-64-bit-flag-for-ELF64-entries.patch \ file://no-aux-cache.patch \ file://add-riscv-support.patch \ + file://ldconfig-handle-.dynstr-located-in-separate-segment.patch \ " PR = "r2" diff --git a/meta/recipes-core/images/build-appliance-image_15.0.0.bb b/meta/recipes-core/images/build-appliance-image_15.0.0.bb index 1c039a8554..aef8b3055b 100644 --- a/meta/recipes-core/images/build-appliance-image_15.0.0.bb +++ b/meta/recipes-core/images/build-appliance-image_15.0.0.bb @@ -24,7 +24,7 @@ IMAGE_FSTYPES = "wic.vmdk wic.vhd wic.vhdx" inherit core-image setuptools3 -SRCREV ?= "65dafea22018052fe7b2e17e6e4d7eb754224d38" +SRCREV ?= "ff7353b24f11f9ba8760f04b678e805fd2590073" SRC_URI = "git://git.yoctoproject.org/poky;branch=kirkstone \ file://Yocto_Build_Appliance.vmx \ file://Yocto_Build_Appliance.vmxf \ diff --git a/meta/recipes-core/libxcrypt/files/0001-Make-BuildCommon.pm-compatible-with-latest-perl.patch b/meta/recipes-core/libxcrypt/files/0001-Make-BuildCommon.pm-compatible-with-latest-perl.patch new file mode 100644 index 0000000000..b3e43d5815 --- /dev/null +++ b/meta/recipes-core/libxcrypt/files/0001-Make-BuildCommon.pm-compatible-with-latest-perl.patch @@ -0,0 +1,50 @@ +From c3ec04f1aee68970b82e4b033bee1477e76798f9 Mon Sep 17 00:00:00 2001 +From: Leon Timmermans <fawaka@gmail.com> +Date: Tue, 6 Jun 2023 17:03:57 +0200 +Subject: [PATCH] Make BuildCommon.pm compatible with latest perl + +It was previously using an experimental feature that has since been dropped. +This removes the use of that feature. + +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +Upstream-Status: Backport [v4.4.35 https://github.com/besser82/libxcrypt/commit/ce562f4d33dc090fcd8f6ea1af3ba32cdc2b3c9c] +--- + build-aux/scripts/BuildCommon.pm | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/build-aux/scripts/BuildCommon.pm b/build-aux/scripts/BuildCommon.pm +index 0e6f2a3..c38ba21 100644 +--- a/build-aux/scripts/BuildCommon.pm ++++ b/build-aux/scripts/BuildCommon.pm +@@ -11,7 +11,6 @@ use v5.14; # implicit use strict, use feature ':5.14' + use warnings FATAL => 'all'; + use utf8; + use open qw(:utf8); +-no if $] >= 5.018, warnings => 'experimental::smartmatch'; + no if $] >= 5.022, warnings => 'experimental::re_strict'; + use if $] >= 5.022, re => 'strict'; + +@@ -519,19 +518,19 @@ sub parse_symver_args { + my $COMPAT_ABI; + local $_; + for (@args) { +- when (/^SYMVER_MIN=(.+)$/) { ++ if (/^SYMVER_MIN=(.+)$/) { + $usage_error->() if defined $SYMVER_MIN; + $SYMVER_MIN = $1; + } +- when (/^SYMVER_FLOOR=(.+)$/) { ++ elsif (/^SYMVER_FLOOR=(.+)$/) { + $usage_error->() if defined $SYMVER_FLOOR; + $SYMVER_FLOOR = $1; + } +- when (/^COMPAT_ABI=(.+)$/) { ++ elsif (/^COMPAT_ABI=(.+)$/) { + $usage_error->() if defined $COMPAT_ABI; + $COMPAT_ABI = $1; + } +- default { ++ else { + $usage_error->() if defined $map_in; + $map_in = $_; + } diff --git a/meta/recipes-core/libxcrypt/files/0002-Remove-smartmatch-usage-from-gen-crypt-h.patch b/meta/recipes-core/libxcrypt/files/0002-Remove-smartmatch-usage-from-gen-crypt-h.patch new file mode 100644 index 0000000000..603f52f792 --- /dev/null +++ b/meta/recipes-core/libxcrypt/files/0002-Remove-smartmatch-usage-from-gen-crypt-h.patch @@ -0,0 +1,62 @@ +From 95d6e03ae37f4ec948474d111105bbdd2938aba2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andreas=20K=2E=20H=C3=BCttel?= <dilfridge@gentoo.org> +Date: Sun, 25 Jun 2023 01:35:08 +0200 +Subject: [PATCH] Remove smartmatch usage from gen-crypt-h + +Needed for Perl 5.38 + +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +Upstream-Status: Backport [v4.4.36 https://github.com/besser82/libxcrypt/commit/95d6e03ae37f4ec948474d111105bbdd2938aba2] +--- + build-aux/scripts/gen-crypt-h | 31 ++++++++++++++----------------- + 1 file changed, 14 insertions(+), 17 deletions(-) + +diff --git a/build-aux/scripts/gen-crypt-h b/build-aux/scripts/gen-crypt-h +index 12aecf6..b113b79 100644 +--- a/build-aux/scripts/gen-crypt-h ++++ b/build-aux/scripts/gen-crypt-h +@@ -12,7 +12,6 @@ use v5.14; # implicit use strict, use feature ':5.14' + use warnings FATAL => 'all'; + use utf8; + use open qw(:std :utf8); +-no if $] >= 5.018, warnings => 'experimental::smartmatch'; + no if $] >= 5.022, warnings => 'experimental::re_strict'; + use if $] >= 5.022, re => 'strict'; + +@@ -37,22 +36,20 @@ sub process_config_h { + local $_; + while (<$fh>) { + chomp; +- # Yes, 'given $_' is really required here. +- given ($_) { +- when ('#define HAVE_SYS_CDEFS_H 1') { +- $have_sys_cdefs_h = 1; +- } +- when ('#define HAVE_SYS_CDEFS_BEGIN_END_DECLS 1') { +- $have_sys_cdefs_begin_end_decls = 1; +- } +- when ('#define HAVE_SYS_CDEFS_THROW 1') { +- $have_sys_cdefs_throw = 1; +- } +- when (/^#define PACKAGE_VERSION "((\d+)\.(\d+)\.\d+)"$/) { +- $substs{XCRYPT_VERSION_STR} = $1; +- $substs{XCRYPT_VERSION_MAJOR} = $2; +- $substs{XCRYPT_VERSION_MINOR} = $3; +- } ++ ++ if ($_ eq '#define HAVE_SYS_CDEFS_H 1') { ++ $have_sys_cdefs_h = 1; ++ } ++ elsif ($_ eq '#define HAVE_SYS_CDEFS_BEGIN_END_DECLS 1') { ++ $have_sys_cdefs_begin_end_decls = 1; ++ } ++ elsif ($_ eq '#define HAVE_SYS_CDEFS_THROW 1') { ++ $have_sys_cdefs_throw = 1; ++ } ++ elsif (/^#define PACKAGE_VERSION "((\d+)\.(\d+)\.\d+)"$/) { ++ $substs{XCRYPT_VERSION_STR} = $1; ++ $substs{XCRYPT_VERSION_MAJOR} = $2; ++ $substs{XCRYPT_VERSION_MINOR} = $3; + } + } + diff --git a/meta/recipes-core/libxcrypt/libxcrypt.inc b/meta/recipes-core/libxcrypt/libxcrypt.inc index 61b0381076..342cbd0d06 100644 --- a/meta/recipes-core/libxcrypt/libxcrypt.inc +++ b/meta/recipes-core/libxcrypt/libxcrypt.inc @@ -11,18 +11,15 @@ inherit autotools pkgconfig SRC_URI = "git://github.com/besser82/libxcrypt.git;branch=${SRCBRANCH};protocol=https" SRCREV = "d7fe1ac04c326dba7e0440868889d1dccb41a175" -SRCBRANCH ?= "develop" +SRCBRANCH ?= "master" -SRC_URI += "file://fix_cflags_handling.patch" +SRC_URI += "file://fix_cflags_handling.patch \ + file://0001-Make-BuildCommon.pm-compatible-with-latest-perl.patch \ + file://0002-Remove-smartmatch-usage-from-gen-crypt-h.patch \ +" PROVIDES = "virtual/crypt" -FILES:${PN} = "${libdir}/libcrypt*.so.* \ - ${libdir}/libcrypt-*.so \ - ${libdir}/libowcrypt*.so.* \ - ${libdir}/libowcrypt-*.so \ -" - S = "${WORKDIR}/git" BUILD_CPPFLAGS = "-I${STAGING_INCDIR_NATIVE}" diff --git a/meta/recipes-core/libxcrypt/libxcrypt_4.4.30.bb b/meta/recipes-core/libxcrypt/libxcrypt_4.4.33.bb index 79dba2f6dc..79dba2f6dc 100644 --- a/meta/recipes-core/libxcrypt/libxcrypt_4.4.30.bb +++ b/meta/recipes-core/libxcrypt/libxcrypt_4.4.33.bb diff --git a/meta/recipes-core/libxml/libxml2/CVE-2023-28484.patch b/meta/recipes-core/libxml/libxml2/CVE-2023-28484.patch new file mode 100644 index 0000000000..907f2c4d47 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2023-28484.patch @@ -0,0 +1,79 @@ +From e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer <wellnhofer@aevum.de> +Date: Fri, 7 Apr 2023 11:46:35 +0200 +Subject: [PATCH] [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType + +Fix a null pointer dereference when parsing (invalid) XML schemas. + +Thanks to Robby Simpson for the report! + +Fixes #491. + +CVE: CVE-2023-28484 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + result/schemas/issue491_0_0.err | 1 + + test/schemas/issue491_0.xml | 1 + + test/schemas/issue491_0.xsd | 18 ++++++++++++++++++ + xmlschemas.c | 2 +- + 4 files changed, 21 insertions(+), 1 deletion(-) + create mode 100644 result/schemas/issue491_0_0.err + create mode 100644 test/schemas/issue491_0.xml + create mode 100644 test/schemas/issue491_0.xsd + +diff --git a/result/schemas/issue491_0_0.err b/result/schemas/issue491_0_0.err +new file mode 100644 +index 00000000..9b2bb969 +--- /dev/null ++++ b/result/schemas/issue491_0_0.err +@@ -0,0 +1 @@ ++./test/schemas/issue491_0.xsd:8: element complexType: Schemas parser error : complex type 'ChildType': The content type of both, the type and its base type, must either 'mixed' or 'element-only'. +diff --git a/test/schemas/issue491_0.xml b/test/schemas/issue491_0.xml +new file mode 100644 +index 00000000..e2b2fc2e +--- /dev/null ++++ b/test/schemas/issue491_0.xml +@@ -0,0 +1 @@ ++<Child xmlns="http://www.test.com">5</Child> +diff --git a/test/schemas/issue491_0.xsd b/test/schemas/issue491_0.xsd +new file mode 100644 +index 00000000..81702649 +--- /dev/null ++++ b/test/schemas/issue491_0.xsd +@@ -0,0 +1,18 @@ ++<?xml version='1.0' encoding='UTF-8'?> ++<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns="http://www.test.com" targetNamespace="http://www.test.com" elementFormDefault="qualified" attributeFormDefault="unqualified"> ++ <xs:complexType name="BaseType"> ++ <xs:simpleContent> ++ <xs:extension base="xs:int" /> ++ </xs:simpleContent> ++ </xs:complexType> ++ <xs:complexType name="ChildType"> ++ <xs:complexContent> ++ <xs:extension base="BaseType"> ++ <xs:sequence> ++ <xs:element name="bad" type="xs:int" minOccurs="0" maxOccurs="1"/> ++ </xs:sequence> ++ </xs:extension> ++ </xs:complexContent> ++ </xs:complexType> ++ <xs:element name="Child" type="ChildType" /> ++</xs:schema> +diff --git a/xmlschemas.c b/xmlschemas.c +index 6a353858..a4eaf591 100644 +--- a/xmlschemas.c ++++ b/xmlschemas.c +@@ -18632,7 +18632,7 @@ xmlSchemaFixupComplexType(xmlSchemaParserCtxtPtr pctxt, + "allowed to appear inside other model groups", + NULL, NULL); + +- } else if (! dummySequence) { ++ } else if ((!dummySequence) && (baseType->subtypes != NULL)) { + xmlSchemaTreeItemPtr effectiveContent = + (xmlSchemaTreeItemPtr) type->subtypes; + /* +-- +GitLab + diff --git a/meta/recipes-core/libxml/libxml2/CVE-2023-29469.patch b/meta/recipes-core/libxml/libxml2/CVE-2023-29469.patch new file mode 100644 index 0000000000..f60d160c49 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2023-29469.patch @@ -0,0 +1,42 @@ +From 547edbf1cbdccd46b2e8ff322a456eaa5931c5df Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer <wellnhofer@aevum.de> +Date: Fri, 7 Apr 2023 11:49:27 +0200 +Subject: [PATCH] [CVE-2023-29469] Hashing of empty dict strings isn't + deterministic + +When hashing empty strings which aren't null-terminated, +xmlDictComputeFastKey could produce inconsistent results. This could +lead to various logic or memory errors, including double frees. + +For consistency the seed is also taken into account, but this shouldn't +have an impact on security. + +Found by OSS-Fuzz. + +Fixes #510. + +CVE: CVE-2023-29469 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/547edbf1cbdccd46b2e8ff322a456eaa5931c5df] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + dict.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/dict.c b/dict.c +index 86c3f6d7..d7fd1a06 100644 +--- a/dict.c ++++ b/dict.c +@@ -433,7 +433,8 @@ static unsigned long + xmlDictComputeFastKey(const xmlChar *name, int namelen, int seed) { + unsigned long value = seed; + +- if (name == NULL) return(0); ++ if ((name == NULL) || (namelen <= 0)) ++ return(value); + value += *name; + value <<= 5; + if (namelen > 10) { +-- +GitLab + diff --git a/meta/recipes-core/libxml/libxml2/CVE-2023-39615-0001.patch b/meta/recipes-core/libxml/libxml2/CVE-2023-39615-0001.patch new file mode 100644 index 0000000000..3506779c4c --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2023-39615-0001.patch @@ -0,0 +1,37 @@ +From d0c3f01e110d54415611c5fa0040cdf4a56053f9 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer <wellnhofer@aevum.de> +Date: Sat May 6 17:47:37 2023 +0200 +Subject: [PATCH 1/2] parser: Fix old SAX1 parser with custom callbacks + +For some reason, xmlCtxtUseOptionsInternal set the start and end element +SAX handlers to the internal DOM builder functions when XML_PARSE_SAX1 +was specified. This means that custom SAX handlers could never work with +that flag because these functions would receive the wrong user data +argument and crash immediately. + +Fixes #535. + +CVE: CVE-2023-39615 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/d0c3f01e110d54415611c5fa0040cdf4a56053f9] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + parser.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/parser.c b/parser.c +index 0f76577..b781c80 100644 +--- a/parser.c ++++ b/parser.c +@@ -15069,8 +15069,6 @@ xmlCtxtUseOptionsInternal(xmlParserCtxtPtr ctxt, int options, const char *encodi + } + #ifdef LIBXML_SAX1_ENABLED + if (options & XML_PARSE_SAX1) { +- ctxt->sax->startElement = xmlSAX2StartElement; +- ctxt->sax->endElement = xmlSAX2EndElement; + ctxt->sax->startElementNs = NULL; + ctxt->sax->endElementNs = NULL; + ctxt->sax->initialized = 1; +-- +2.40.0 diff --git a/meta/recipes-core/libxml/libxml2/CVE-2023-39615-0002.patch b/meta/recipes-core/libxml/libxml2/CVE-2023-39615-0002.patch new file mode 100644 index 0000000000..d922ddc730 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2023-39615-0002.patch @@ -0,0 +1,72 @@ +From 235b15a590eecf97b09e87bdb7e4f8333e9de129 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer <wellnhofer@aevum.de> +Date: Mon May 8 17:58:02 2023 +0200 +Subject: [PATCH 2/2] SAX: Always initialize SAX1 element handlers + +Follow-up to commit d0c3f01e. A parser context will be initialized to +SAX version 2, but this can be overridden with XML_PARSE_SAX1 later, +so we must initialize the SAX1 element handlers as well. + +Change the check in xmlDetectSAX2 to only look for XML_SAX2_MAGIC, so +we don't switch to SAX1 if the SAX2 element handlers are NULL. + +CVE: CVE-2023-39615 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/235b15a590eecf97b09e87bdb7e4f8333e9de129] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + SAX2.c | 11 +++++++---- + parser.c | 5 +---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/SAX2.c b/SAX2.c +index 0319246..f7c77c2 100644 +--- a/SAX2.c ++++ b/SAX2.c +@@ -2842,20 +2842,23 @@ xmlSAXVersion(xmlSAXHandler *hdlr, int version) + { + if (hdlr == NULL) return(-1); + if (version == 2) { +- hdlr->startElement = NULL; +- hdlr->endElement = NULL; + hdlr->startElementNs = xmlSAX2StartElementNs; + hdlr->endElementNs = xmlSAX2EndElementNs; + hdlr->serror = NULL; + hdlr->initialized = XML_SAX2_MAGIC; + #ifdef LIBXML_SAX1_ENABLED + } else if (version == 1) { +- hdlr->startElement = xmlSAX2StartElement; +- hdlr->endElement = xmlSAX2EndElement; + hdlr->initialized = 1; + #endif /* LIBXML_SAX1_ENABLED */ + } else + return(-1); ++#ifdef LIBXML_SAX1_ENABLED ++ hdlr->startElement = xmlSAX2StartElement; ++ hdlr->endElement = xmlSAX2EndElement; ++#else ++ hdlr->startElement = NULL; ++ hdlr->endElement = NULL; ++#endif /* LIBXML_SAX1_ENABLED */ + hdlr->internalSubset = xmlSAX2InternalSubset; + hdlr->externalSubset = xmlSAX2ExternalSubset; + hdlr->isStandalone = xmlSAX2IsStandalone; +diff --git a/parser.c b/parser.c +index b781c80..738dbee 100644 +--- a/parser.c ++++ b/parser.c +@@ -1109,10 +1109,7 @@ xmlDetectSAX2(xmlParserCtxtPtr ctxt) { + if (ctxt == NULL) return; + sax = ctxt->sax; + #ifdef LIBXML_SAX1_ENABLED +- if ((sax) && (sax->initialized == XML_SAX2_MAGIC) && +- ((sax->startElementNs != NULL) || +- (sax->endElementNs != NULL) || +- ((sax->startElement == NULL) && (sax->endElement == NULL)))) ++ if ((sax) && (sax->initialized == XML_SAX2_MAGIC)) + ctxt->sax2 = 1; + #else + ctxt->sax2 = 1; +-- +2.40.0 diff --git a/meta/recipes-core/libxml/libxml2/CVE-2023-45322-1.patch b/meta/recipes-core/libxml/libxml2/CVE-2023-45322-1.patch new file mode 100644 index 0000000000..5f1cb72534 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2023-45322-1.patch @@ -0,0 +1,49 @@ +From a22bd982bf10291deea8ba0c61bf75b898c604ce Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer <wellnhofer@aevum.de> +Date: Wed, 2 Nov 2022 15:44:42 +0100 +Subject: [PATCH] malloc-fail: Fix memory leak in xmlStaticCopyNodeList + +Found with libFuzzer, see #344. + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/a22bd982bf10291deea8ba0c61bf75b898c604ce] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + tree.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tree.c b/tree.c +index 507869efe..647288ce3 100644 +--- a/tree.c ++++ b/tree.c +@@ -4461,7 +4461,7 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + } + if (doc->intSubset == NULL) { + q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); +- if (q == NULL) return(NULL); ++ if (q == NULL) goto error; + q->doc = doc; + q->parent = parent; + doc->intSubset = (xmlDtdPtr) q; +@@ -4473,7 +4473,7 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + } else + #endif /* LIBXML_TREE_ENABLED */ + q = xmlStaticCopyNode(node, doc, parent, 1); +- if (q == NULL) return(NULL); ++ if (q == NULL) goto error; + if (ret == NULL) { + q->prev = NULL; + ret = p = q; +@@ -4486,6 +4486,9 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + node = node->next; + } + return(ret); ++error: ++ xmlFreeNodeList(ret); ++ return(NULL); + } + + /** +-- +GitLab + diff --git a/meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch b/meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch new file mode 100644 index 0000000000..845fd70c66 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch @@ -0,0 +1,79 @@ +From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer <wellnhofer@aevum.de> +Date: Wed, 23 Aug 2023 20:24:24 +0200 +Subject: [PATCH] tree: Fix copying of DTDs + +- Don't create multiple DTD nodes. +- Fix UAF if malloc fails. +- Skip DTD nodes if tree module is disabled. + +Fixes #583. + +CVE: CVE-2023-45322 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/d39f78069dff496ec865c73aa44d7110e429bce9] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + tree.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/tree.c b/tree.c +index 6c8a875b9..02c1b5791 100644 +--- a/tree.c ++++ b/tree.c +@@ -4471,29 +4471,28 @@ xmlNodePtr + xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + xmlNodePtr ret = NULL; + xmlNodePtr p = NULL,q; ++ xmlDtdPtr newSubset = NULL; + + while (node != NULL) { +-#ifdef LIBXML_TREE_ENABLED + if (node->type == XML_DTD_NODE ) { +- if (doc == NULL) { ++#ifdef LIBXML_TREE_ENABLED ++ if ((doc == NULL) || (doc->intSubset != NULL)) { + node = node->next; + continue; + } +- if (doc->intSubset == NULL) { +- q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); +- if (q == NULL) goto error; +- q->doc = doc; +- q->parent = parent; +- doc->intSubset = (xmlDtdPtr) q; +- xmlAddChild(parent, q); +- } else { +- q = (xmlNodePtr) doc->intSubset; +- xmlAddChild(parent, q); +- } +- } else ++ q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); ++ if (q == NULL) goto error; ++ q->doc = doc; ++ q->parent = parent; ++ newSubset = (xmlDtdPtr) q; ++#else ++ node = node->next; ++ continue; + #endif /* LIBXML_TREE_ENABLED */ ++ } else { + q = xmlStaticCopyNode(node, doc, parent, 1); +- if (q == NULL) goto error; ++ if (q == NULL) goto error; ++ } + if (ret == NULL) { + q->prev = NULL; + ret = p = q; +@@ -4505,6 +4504,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + } + node = node->next; + } ++ if (newSubset != NULL) ++ doc->intSubset = newSubset; + return(ret); + error: + xmlFreeNodeList(ret); +-- +GitLab + diff --git a/meta/recipes-core/libxml/libxml2/CVE-2024-25062.patch b/meta/recipes-core/libxml/libxml2/CVE-2024-25062.patch new file mode 100644 index 0000000000..5365d5546a --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2024-25062.patch @@ -0,0 +1,33 @@ +From 2b0aac140d739905c7848a42efc60bfe783a39b7 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer <wellnhofer@aevum.de> +Date: Sat, 14 Oct 2023 22:45:54 +0200 +Subject: [PATCH] [CVE-2024-25062] xmlreader: Don't expand XIncludes when + backtracking + +Fixes a use-after-free if XML Reader if used with DTD validation and +XInclude expansion. + +Fixes #604. + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/2b0aac140d739905c7848a42efc60bfe783a39b7] +CVE: CVE-2024-25062 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + xmlreader.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/xmlreader.c b/xmlreader.c +index 979385a13..fefd68e0b 100644 +--- a/xmlreader.c ++++ b/xmlreader.c +@@ -1443,6 +1443,7 @@ node_found: + * Handle XInclude if asked for + */ + if ((reader->xinclude) && (reader->in_xinclude == 0) && ++ (reader->state != XML_TEXTREADER_BACKTRACK) && + (reader->node != NULL) && + (reader->node->type == XML_ELEMENT_NODE) && + (reader->node->ns != NULL) && +-- +GitLab + diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb index e15f8eb13f..2b7e9999d9 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.14.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb @@ -25,6 +25,13 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar;subdir=${BP};name=testt file://0001-Port-gentest.py-to-Python-3.patch \ file://CVE-2022-40303.patch \ file://CVE-2022-40304.patch \ + file://CVE-2023-28484.patch \ + file://CVE-2023-29469.patch \ + file://CVE-2023-39615-0001.patch \ + file://CVE-2023-39615-0002.patch \ + file://CVE-2023-45322-1.patch \ + file://CVE-2023-45322-2.patch \ + file://CVE-2024-25062.patch \ " SRC_URI[archive.sha256sum] = "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee" diff --git a/meta/recipes-core/meta/build-sysroots.bb b/meta/recipes-core/meta/build-sysroots.bb index ad22a75eb2..72da88921a 100644 --- a/meta/recipes-core/meta/build-sysroots.bb +++ b/meta/recipes-core/meta/build-sysroots.bb @@ -1,5 +1,6 @@ -INHIBIT_DEFAULT_DEPS = "1" LICENSE = "MIT" +SUMMARY = "Build old style sysroot based on everything in the components directory that matches the current MACHINE" +INHIBIT_DEFAULT_DEPS = "1" STANDALONE_SYSROOT = "${STAGING_DIR}/${MACHINE}" STANDALONE_SYSROOT_NATIVE = "${STAGING_DIR}/${BUILD_ARCH}" diff --git a/meta/recipes-core/meta/buildtools-tarball.bb b/meta/recipes-core/meta/buildtools-tarball.bb index de399173ba..70d740b4e0 100644 --- a/meta/recipes-core/meta/buildtools-tarball.bb +++ b/meta/recipes-core/meta/buildtools-tarball.bb @@ -67,7 +67,7 @@ create_sdk_files:append () { # Generate new (mini) sdk-environment-setup file script=${1:-${SDK_OUTPUT}/${SDKPATH}/environment-setup-${SDK_SYS}} touch $script - echo 'export PATH=${SDKPATHNATIVE}${bindir_nativesdk}:${SDKPATHNATIVE}${sbindir_nativesdk}:${SDKPATHNATIVE}${base_bindir_nativesdk}:${SDKPATHNATIVE}${base_sbindir_nativesdk}:$PATH' >> $script + echo 'export PATH="${SDKPATHNATIVE}${bindir_nativesdk}:${SDKPATHNATIVE}${sbindir_nativesdk}:${SDKPATHNATIVE}${base_bindir_nativesdk}:${SDKPATHNATIVE}${base_sbindir_nativesdk}:$PATH"' >> $script echo 'export OECORE_NATIVE_SYSROOT="${SDKPATHNATIVE}"' >> $script if [ -e "${SDK_OUTPUT}${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt" ]; then echo 'export GIT_SSL_CAINFO="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script @@ -75,6 +75,9 @@ create_sdk_files:append () { echo 'export REQUESTS_CA_BUNDLE="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script echo 'export CURL_CA_BUNDLE="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script fi + echo 'HOST_PKG_PATH=$(command -p pkg-config --variable=pc_path pkg-config 2>/dev/null)' >>$script + echo 'export PKG_CONFIG_LIBDIR=${SDKPATHNATIVE}/${libdir}/pkgconfig:${SDKPATHNATIVE}/${datadir}/pkgconfig:${HOST_PKG_PATH:-/usr/lib/pkgconfig:/usr/share/pkgconfig}' >>$script + echo 'unset HOST_PKG_PATH' toolchain_create_sdk_version ${SDK_OUTPUT}/${SDKPATH}/version-${SDK_SYS} diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb b/meta/recipes-core/meta/cve-update-nvd2-native.bb new file mode 100644 index 0000000000..1a3eeba6d0 --- /dev/null +++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb @@ -0,0 +1,372 @@ +SUMMARY = "Updates the NVD CVE database" +LICENSE = "MIT" + +# Important note: +# This product uses the NVD API but is not endorsed or certified by the NVD. + +INHIBIT_DEFAULT_DEPS = "1" + +inherit native + +deltask do_unpack +deltask do_patch +deltask do_configure +deltask do_compile +deltask do_install +deltask do_populate_sysroot + +NVDCVE_URL ?= "https://services.nvd.nist.gov/rest/json/cves/2.0" + +# If you have a NVD API key (https://nvd.nist.gov/developers/request-an-api-key) +# then setting this to get higher rate limits. +NVDCVE_API_KEY ?= "" + +# CVE database update interval, in seconds. By default: once a day (24*60*60). +# Use 0 to force the update +# Use a negative value to skip the update +CVE_DB_UPDATE_INTERVAL ?= "86400" + +# CVE database incremental update age threshold, in seconds. If the database is +# older than this threshold, do a full re-download, else, do an incremental +# update. By default: the maximum allowed value from NVD: 120 days (120*24*60*60) +# Use 0 to force a full download. +CVE_DB_INCR_UPDATE_AGE_THRES ?= "10368000" + +# Number of attempts for each http query to nvd server before giving up +CVE_DB_UPDATE_ATTEMPTS ?= "5" + +CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DIR}/temp_nvdcve_2.db" + +python () { + if not bb.data.inherits_class("cve-check", d): + raise bb.parse.SkipRecipe("Skip recipe when cve-check class is not loaded.") +} + +python do_fetch() { + """ + Update NVD database with API 2.0 + """ + import bb.utils + import bb.progress + import shutil + + bb.utils.export_proxies(d) + + db_file = d.getVar("CVE_CHECK_DB_FILE") + db_dir = os.path.dirname(db_file) + db_tmp_file = d.getVar("CVE_DB_TEMP_FILE") + + cleanup_db_download(db_file, db_tmp_file) + # By default let's update the whole database (since time 0) + database_time = 0 + + # The NVD database changes once a day, so no need to update more frequently + # Allow the user to force-update + try: + import time + update_interval = int(d.getVar("CVE_DB_UPDATE_INTERVAL")) + if update_interval < 0: + bb.note("CVE database update skipped") + return + if time.time() - os.path.getmtime(db_file) < update_interval: + bb.note("CVE database recently updated, skipping") + return + database_time = os.path.getmtime(db_file) + + except OSError: + pass + + bb.utils.mkdirhier(db_dir) + if os.path.exists(db_file): + shutil.copy2(db_file, db_tmp_file) + + if update_db_file(db_tmp_file, d, database_time) == True: + # Update downloaded correctly, can swap files + shutil.move(db_tmp_file, db_file) + else: + # Update failed, do not modify the database + bb.warn("CVE database update failed") + os.remove(db_tmp_file) +} + +do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}" +do_fetch[file-checksums] = "" +do_fetch[vardeps] = "" + +def cleanup_db_download(db_file, db_tmp_file): + """ + Cleanup the download space from possible failed downloads + """ + + # Clean up the updates done on the main file + # Remove it only if a journal file exists - it means a complete re-download + if os.path.exists("{0}-journal".format(db_file)): + # If a journal is present the last update might have been interrupted. In that case, + # just wipe any leftovers and force the DB to be recreated. + os.remove("{0}-journal".format(db_file)) + + if os.path.exists(db_file): + os.remove(db_file) + + # Clean-up the temporary file downloads, we can remove both journal + # and the temporary database + if os.path.exists("{0}-journal".format(db_tmp_file)): + # If a journal is present the last update might have been interrupted. In that case, + # just wipe any leftovers and force the DB to be recreated. + os.remove("{0}-journal".format(db_tmp_file)) + + if os.path.exists(db_tmp_file): + os.remove(db_tmp_file) + +def nvd_request_wait(attempt, min_wait): + return min ( ( (2 * attempt) + min_wait ) , 30) + +def nvd_request_next(url, attempts, api_key, args, min_wait): + """ + Request next part of the NVD database + NVD API documentation: https://nvd.nist.gov/developers/vulnerabilities + """ + + import urllib.request + import urllib.parse + import gzip + import http + import time + + request = urllib.request.Request(url + "?" + urllib.parse.urlencode(args)) + if api_key: + request.add_header("apiKey", api_key) + bb.note("Requesting %s" % request.full_url) + + for attempt in range(attempts): + try: + r = urllib.request.urlopen(request) + + if (r.headers['content-encoding'] == 'gzip'): + buf = r.read() + raw_data = gzip.decompress(buf).decode("utf-8") + else: + raw_data = r.read().decode("utf-8") + + r.close() + + except Exception as e: + wait_time = nvd_request_wait(attempt, min_wait) + bb.note("CVE database: received error (%s)" % (e)) + bb.note("CVE database: retrying download after %d seconds. attempted (%d/%d)" % (wait_time, attempt+1, attempts)) + time.sleep(wait_time) + pass + else: + return raw_data + else: + # We failed at all attempts + return None + +def update_db_file(db_tmp_file, d, database_time): + """ + Update the given database file + """ + import bb.utils, bb.progress + import datetime + import sqlite3 + import json + + # Connect to database + conn = sqlite3.connect(db_tmp_file) + initialize_db(conn) + + req_args = {'startIndex' : 0} + + incr_update_threshold = int(d.getVar("CVE_DB_INCR_UPDATE_AGE_THRES")) + if database_time != 0: + database_date = datetime.datetime.fromtimestamp(database_time, tz=datetime.timezone.utc) + today_date = datetime.datetime.now(tz=datetime.timezone.utc) + delta = today_date - database_date + if incr_update_threshold == 0: + bb.note("CVE database: forced full update") + elif delta < datetime.timedelta(seconds=incr_update_threshold): + bb.note("CVE database: performing partial update") + # The maximum range for time is 120 days + if delta > datetime.timedelta(days=120): + bb.error("CVE database: Trying to do an incremental update on a larger than supported range") + req_args['lastModStartDate'] = database_date.isoformat() + req_args['lastModEndDate'] = today_date.isoformat() + else: + bb.note("CVE database: file too old, forcing a full update") + else: + bb.note("CVE database: no preexisting database, do a full download") + + with bb.progress.ProgressHandler(d) as ph, open(os.path.join(d.getVar("TMPDIR"), 'cve_check'), 'a') as cve_f: + + bb.note("Updating entries") + index = 0 + url = d.getVar("NVDCVE_URL") + api_key = d.getVar("NVDCVE_API_KEY") or None + attempts = int(d.getVar("CVE_DB_UPDATE_ATTEMPTS")) + + # Recommended by NVD + wait_time = 6 + if api_key: + wait_time = 2 + + while True: + req_args['startIndex'] = index + raw_data = nvd_request_next(url, attempts, api_key, req_args, wait_time) + if raw_data is None: + # We haven't managed to download data + return False + + data = json.loads(raw_data) + + index = data["startIndex"] + total = data["totalResults"] + per_page = data["resultsPerPage"] + bb.note("Got %d entries" % per_page) + for cve in data["vulnerabilities"]: + update_db(conn, cve) + + index += per_page + ph.update((float(index) / (total+1)) * 100) + if index >= total: + break + + # Recommended by NVD + time.sleep(wait_time) + + # Update success, set the date to cve_check file. + cve_f.write('CVE database update : %s\n\n' % datetime.date.today()) + + conn.commit() + conn.close() + return True + +def initialize_db(conn): + with conn: + c = conn.cursor() + + c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)") + + c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \ + SCOREV2 TEXT, SCOREV3 TEXT, MODIFIED INTEGER, VECTOR TEXT)") + + c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \ + VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \ + VERSION_END TEXT, OPERATOR_END TEXT)") + c.execute("CREATE INDEX IF NOT EXISTS PRODUCT_ID_IDX on PRODUCTS(ID);") + + c.close() + +def parse_node_and_insert(conn, node, cveId): + + def cpe_generator(): + for cpe in node.get('cpeMatch', ()): + if not cpe['vulnerable']: + return + cpe23 = cpe.get('criteria') + if not cpe23: + return + cpe23 = cpe23.split(':') + if len(cpe23) < 6: + return + vendor = cpe23[3] + product = cpe23[4] + version = cpe23[5] + + if cpe23[6] == '*' or cpe23[6] == '-': + version_suffix = "" + else: + version_suffix = "_" + cpe23[6] + + if version != '*' and version != '-': + # Version is defined, this is a '=' match + yield [cveId, vendor, product, version + version_suffix, '=', '', ''] + elif version == '-': + # no version information is available + yield [cveId, vendor, product, version, '', '', ''] + else: + # Parse start version, end version and operators + op_start = '' + op_end = '' + v_start = '' + v_end = '' + + if 'versionStartIncluding' in cpe: + op_start = '>=' + v_start = cpe['versionStartIncluding'] + + if 'versionStartExcluding' in cpe: + op_start = '>' + v_start = cpe['versionStartExcluding'] + + if 'versionEndIncluding' in cpe: + op_end = '<=' + v_end = cpe['versionEndIncluding'] + + if 'versionEndExcluding' in cpe: + op_end = '<' + v_end = cpe['versionEndExcluding'] + + if op_start or op_end or v_start or v_end: + yield [cveId, vendor, product, v_start, op_start, v_end, op_end] + else: + # This is no version information, expressed differently. + # Save processing by representing as -. + yield [cveId, vendor, product, '-', '', '', ''] + + conn.executemany("insert into PRODUCTS values (?, ?, ?, ?, ?, ?, ?)", cpe_generator()).close() + +def update_db(conn, elt): + """ + Update a single entry in the on-disk database + """ + + accessVector = None + cveId = elt['cve']['id'] + if elt['cve']['vulnStatus'] == "Rejected": + c = conn.cursor() + c.execute("delete from PRODUCTS where ID = ?;", [cveId]) + c.execute("delete from NVD where ID = ?;", [cveId]) + c.close() + return + cveDesc = "" + for desc in elt['cve']['descriptions']: + if desc['lang'] == 'en': + cveDesc = desc['value'] + date = elt['cve']['lastModified'] + try: + accessVector = elt['cve']['metrics']['cvssMetricV2'][0]['cvssData']['accessVector'] + cvssv2 = elt['cve']['metrics']['cvssMetricV2'][0]['cvssData']['baseScore'] + except KeyError: + cvssv2 = 0.0 + cvssv3 = None + try: + accessVector = accessVector or elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['attackVector'] + cvssv3 = elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['baseScore'] + except KeyError: + pass + try: + accessVector = accessVector or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['attackVector'] + cvssv3 = cvssv3 or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['baseScore'] + except KeyError: + pass + accessVector = accessVector or "UNKNOWN" + cvssv3 = cvssv3 or 0.0 + + conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?)", + [cveId, cveDesc, cvssv2, cvssv3, date, accessVector]).close() + + try: + # Remove any pre-existing CVE configuration. Even for partial database + # update, those will be repopulated. This ensures that old + # configuration is not kept for an updated CVE. + conn.execute("delete from PRODUCTS where ID = ?", [cveId]).close() + for config in elt['cve']['configurations']: + # This is suboptimal as it doesn't handle AND/OR and negate, but is better than nothing + for node in config["nodes"]: + parse_node_and_insert(conn, node, cveId) + except KeyError: + bb.note("CVE %s has no configurations" % cveId) + +do_fetch[nostamp] = "1" + +EXCLUDE_FROM_WORLD = "1" diff --git a/meta/recipes-core/meta/wic-tools.bb b/meta/recipes-core/meta/wic-tools.bb index daaf3ea576..9282d36a4d 100644 --- a/meta/recipes-core/meta/wic-tools.bb +++ b/meta/recipes-core/meta/wic-tools.bb @@ -6,7 +6,7 @@ DEPENDS = "\ parted-native gptfdisk-native dosfstools-native \ mtools-native bmap-tools-native grub-native cdrtools-native \ btrfs-tools-native squashfs-tools-native pseudo-native \ - e2fsprogs-native util-linux-native tar-native \ + e2fsprogs-native util-linux-native tar-native erofs-utils-native \ virtual/${TARGET_PREFIX}binutils \ " DEPENDS:append:x86 = " syslinux-native syslinux grub-efi systemd-boot" diff --git a/meta/recipes-core/ncurses/files/CVE-2023-29491.patch b/meta/recipes-core/ncurses/files/CVE-2023-29491.patch new file mode 100644 index 0000000000..0116959bbf --- /dev/null +++ b/meta/recipes-core/ncurses/files/CVE-2023-29491.patch @@ -0,0 +1,464 @@ +From eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56 Mon Sep 17 00:00:00 2001 +From: Thomas E. Dickey <dickey@invisible-island.net> +Date: Sun, 9 Apr 2023 05:38:25 +0530 +Subject: [PATCH] Fix CVE-2023-29491 + +CVE: CVE-2023-29491 + +Upstream-Status: Backport [http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commitdiff;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56] + +Signed-off-by: Chen Qi <Qi.Chen@windriver.com> + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + ncurses/tinfo/lib_tgoto.c | 10 +++- + ncurses/tinfo/lib_tparm.c | 116 ++++++++++++++++++++++++++++++++----- + ncurses/tinfo/read_entry.c | 3 + + progs/tic.c | 6 ++ + progs/tparm_type.c | 9 +++ + progs/tparm_type.h | 2 + + progs/tput.c | 61 ++++++++++++++++--- + 7 files changed, 185 insertions(+), 22 deletions(-) + +diff --git a/ncurses/tinfo/lib_tgoto.c b/ncurses/tinfo/lib_tgoto.c +index 9cf5e100..c50ed4df 100644 +--- a/ncurses/tinfo/lib_tgoto.c ++++ b/ncurses/tinfo/lib_tgoto.c +@@ -207,6 +207,14 @@ tgoto(const char *string, int x, int y) + result = tgoto_internal(string, x, y); + else + #endif +- result = TIPARM_2(string, y, x); ++ if ((result = TIPARM_2(string, y, x)) == NULL) { ++ /* ++ * Because termcap did not provide a more general solution such as ++ * tparm(), it was necessary to handle single-parameter capabilities ++ * using tgoto(). The internal _nc_tiparm() function returns a NULL ++ * for that case; retry for the single-parameter case. ++ */ ++ result = TIPARM_1(string, y); ++ } + returnPtr(result); + } +diff --git a/ncurses/tinfo/lib_tparm.c b/ncurses/tinfo/lib_tparm.c +index d9bdfd8f..a10a3877 100644 +--- a/ncurses/tinfo/lib_tparm.c ++++ b/ncurses/tinfo/lib_tparm.c +@@ -1086,6 +1086,64 @@ tparam_internal(TPARM_STATE *tps, const char *string, TPARM_DATA *data) + return (TPS(out_buff)); + } + ++#ifdef CUR ++/* ++ * Only a few standard capabilities accept string parameters. The others that ++ * are parameterized accept only numeric parameters. ++ */ ++static bool ++check_string_caps(TPARM_DATA *data, const char *string) ++{ ++ bool result = FALSE; ++ ++#define CHECK_CAP(name) (VALID_STRING(name) && !strcmp(name, string)) ++ ++ /* ++ * Disallow string parameters unless we can check them against a terminal ++ * description. ++ */ ++ if (cur_term != NULL) { ++ int want_type = 0; ++ ++ if (CHECK_CAP(pkey_key)) ++ want_type = 2; /* function key #1, type string #2 */ ++ else if (CHECK_CAP(pkey_local)) ++ want_type = 2; /* function key #1, execute string #2 */ ++ else if (CHECK_CAP(pkey_xmit)) ++ want_type = 2; /* function key #1, transmit string #2 */ ++ else if (CHECK_CAP(plab_norm)) ++ want_type = 2; /* label #1, show string #2 */ ++ else if (CHECK_CAP(pkey_plab)) ++ want_type = 6; /* function key #1, type string #2, show string #3 */ ++#if NCURSES_XNAMES ++ else { ++ char *check; ++ ++ check = tigetstr("Cs"); ++ if (CHECK_CAP(check)) ++ want_type = 1; /* style #1 */ ++ ++ check = tigetstr("Ms"); ++ if (CHECK_CAP(check)) ++ want_type = 3; /* storage unit #1, content #2 */ ++ } ++#endif ++ ++ if (want_type == data->tparm_type) { ++ result = TRUE; ++ } else { ++ T(("unexpected string-parameter")); ++ } ++ } ++ return result; ++} ++ ++#define ValidCap() (myData.tparm_type == 0 || \ ++ check_string_caps(&myData, string)) ++#else ++#define ValidCap() 1 ++#endif ++ + #if NCURSES_TPARM_VARARGS + + NCURSES_EXPORT(char *) +@@ -1100,7 +1158,7 @@ tparm(const char *string, ...) + tps->tname = "tparm"; + #endif /* TRACE */ + +- if (tparm_setup(cur_term, string, &myData) == OK) { ++ if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) { + va_list ap; + + va_start(ap, string); +@@ -1135,7 +1193,7 @@ tparm(const char *string, + tps->tname = "tparm"; + #endif /* TRACE */ + +- if (tparm_setup(cur_term, string, &myData) == OK) { ++ if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) { + + myData.param[0] = a1; + myData.param[1] = a2; +@@ -1166,7 +1224,7 @@ tiparm(const char *string, ...) + tps->tname = "tiparm"; + #endif /* TRACE */ + +- if (tparm_setup(cur_term, string, &myData) == OK) { ++ if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) { + va_list ap; + + va_start(ap, string); +@@ -1179,7 +1237,25 @@ tiparm(const char *string, ...) + } + + /* +- * The internal-use flavor ensures that the parameters are numbers, not strings ++ * The internal-use flavor ensures that parameters are numbers, not strings. ++ * In addition to ensuring that they are numbers, it ensures that the parameter ++ * count is consistent with intended usage. ++ * ++ * Unlike the general-purpose tparm/tiparm, these internal calls are fairly ++ * well defined: ++ * ++ * expected == 0 - not applicable ++ * expected == 1 - set color, or vertical/horizontal addressing ++ * expected == 2 - cursor addressing ++ * expected == 4 - initialize color or color pair ++ * expected == 9 - set attributes ++ * ++ * Only for the last case (set attributes) should a parameter be optional. ++ * Also, a capability which calls for more parameters than expected should be ++ * ignored. ++ * ++ * Return a null if the parameter-checks fail. Otherwise, return a pointer to ++ * the formatted capability string. + */ + NCURSES_EXPORT(char *) + _nc_tiparm(int expected, const char *string, ...) +@@ -1189,22 +1265,36 @@ _nc_tiparm(int expected, const char *string, ...) + char *result = NULL; + + _nc_tparm_err = 0; ++ T((T_CALLED("_nc_tiparm(%d, %s, ...)"), expected, _nc_visbuf(string))); + #ifdef TRACE + tps->tname = "_nc_tiparm"; + #endif /* TRACE */ + +- if (tparm_setup(cur_term, string, &myData) == OK +- && myData.num_actual <= expected +- && myData.tparm_type == 0) { +- va_list ap; ++ if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) { ++ if (myData.num_actual == 0) { ++ T(("missing parameter%s, expected %s%d", ++ expected > 1 ? "s" : "", ++ expected == 9 ? "up to " : "", ++ expected)); ++ } else if (myData.num_actual > expected) { ++ T(("too many parameters, have %d, expected %d", ++ myData.num_actual, ++ expected)); ++ } else if (expected != 9 && myData.num_actual != expected) { ++ T(("expected %d parameters, have %d", ++ myData.num_actual, ++ expected)); ++ } else { ++ va_list ap; + +- va_start(ap, string); +- tparm_copy_valist(&myData, FALSE, ap); +- va_end(ap); ++ va_start(ap, string); ++ tparm_copy_valist(&myData, FALSE, ap); ++ va_end(ap); + +- result = tparam_internal(tps, string, &myData); ++ result = tparam_internal(tps, string, &myData); ++ } + } +- return result; ++ returnPtr(result); + } + + /* +diff --git a/ncurses/tinfo/read_entry.c b/ncurses/tinfo/read_entry.c +index 66e3d31e..8ccb1570 100644 +--- a/ncurses/tinfo/read_entry.c ++++ b/ncurses/tinfo/read_entry.c +@@ -321,6 +321,9 @@ _nc_read_termtype(TERMTYPE2 *ptr, char *buffer, int limit) + || bool_count < 0 + || num_count < 0 + || str_count < 0 ++ || bool_count > BOOLCOUNT ++ || num_count > NUMCOUNT ++ || str_count > STRCOUNT + || str_size < 0) { + returnDB(TGETENT_NO); + } +diff --git a/progs/tic.c b/progs/tic.c +index 152010d2..92d551c8 100644 +--- a/progs/tic.c ++++ b/progs/tic.c +@@ -2255,9 +2255,15 @@ check_1_infotocap(const char *name, NCURSES_CONST char *value, int count) + + _nc_reset_tparm(NULL); + switch (actual) { ++ case Str: ++ result = TPARM_1(value, strings[1]); ++ break; + case Num_Str: + result = TPARM_2(value, numbers[1], strings[2]); + break; ++ case Str_Str: ++ result = TPARM_2(value, strings[1], strings[2]); ++ break; + case Num_Str_Str: + result = TPARM_3(value, numbers[1], strings[2], strings[3]); + break; +diff --git a/progs/tparm_type.c b/progs/tparm_type.c +index 3da4a077..644aa62a 100644 +--- a/progs/tparm_type.c ++++ b/progs/tparm_type.c +@@ -47,6 +47,7 @@ tparm_type(const char *name) + {code, {longname} }, \ + {code, {ti} }, \ + {code, {tc} } ++#define XD(code, onlyname) TD(code, onlyname, onlyname, onlyname) + TParams result = Numbers; + /* *INDENT-OFF* */ + static const struct { +@@ -58,6 +59,10 @@ tparm_type(const char *name) + TD(Num_Str, "pkey_xmit", "pfx", "px"), + TD(Num_Str, "plab_norm", "pln", "pn"), + TD(Num_Str_Str, "pkey_plab", "pfxl", "xl"), ++#if NCURSES_XNAMES ++ XD(Str, "Cs"), ++ XD(Str_Str, "Ms"), ++#endif + }; + /* *INDENT-ON* */ + +@@ -80,12 +85,16 @@ guess_tparm_type(int nparam, char **p_is_s) + case 1: + if (!p_is_s[0]) + result = Numbers; ++ if (p_is_s[0]) ++ result = Str; + break; + case 2: + if (!p_is_s[0] && !p_is_s[1]) + result = Numbers; + if (!p_is_s[0] && p_is_s[1]) + result = Num_Str; ++ if (p_is_s[0] && p_is_s[1]) ++ result = Str_Str; + break; + case 3: + if (!p_is_s[0] && !p_is_s[1] && !p_is_s[2]) +diff --git a/progs/tparm_type.h b/progs/tparm_type.h +index 7c102a30..af5bcf0f 100644 +--- a/progs/tparm_type.h ++++ b/progs/tparm_type.h +@@ -45,8 +45,10 @@ + typedef enum { + Other = -1 + ,Numbers = 0 ++ ,Str + ,Num_Str + ,Num_Str_Str ++ ,Str_Str + } TParams; + + extern TParams tparm_type(const char *name); +diff --git a/progs/tput.c b/progs/tput.c +index 4cd0c5ba..41508b72 100644 +--- a/progs/tput.c ++++ b/progs/tput.c +@@ -1,5 +1,5 @@ + /**************************************************************************** +- * Copyright 2018-2021,2022 Thomas E. Dickey * ++ * Copyright 2018-2022,2023 Thomas E. Dickey * + * Copyright 1998-2016,2017 Free Software Foundation, Inc. * + * * + * Permission is hereby granted, free of charge, to any person obtaining a * +@@ -47,12 +47,15 @@ + #include <transform.h> + #include <tty_settings.h> + +-MODULE_ID("$Id: tput.c,v 1.99 2022/02/26 23:19:31 tom Exp $") ++MODULE_ID("$Id: tput.c,v 1.102 2023/04/08 16:26:36 tom Exp $") + + #define PUTS(s) fputs(s, stdout) + + const char *_nc_progname = "tput"; + ++static bool opt_v = FALSE; /* quiet, do not show warnings */ ++static bool opt_x = FALSE; /* clear scrollback if possible */ ++ + static bool is_init = FALSE; + static bool is_reset = FALSE; + static bool is_clear = FALSE; +@@ -81,6 +84,7 @@ usage(const char *optstring) + KEEP(" -S << read commands from standard input") + KEEP(" -T TERM use this instead of $TERM") + KEEP(" -V print curses-version") ++ KEEP(" -v verbose, show warnings") + KEEP(" -x do not try to clear scrollback") + KEEP("") + KEEP("Commands:") +@@ -148,7 +152,7 @@ exit_code(int token, int value) + * Returns nonzero on error. + */ + static int +-tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used) ++tput_cmd(int fd, TTY * settings, int argc, char **argv, int *used) + { + NCURSES_CONST char *name; + char *s; +@@ -231,7 +235,9 @@ tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used) + } else if (VALID_STRING(s)) { + if (argc > 1) { + int k; ++ int narg; + int analyzed; ++ int provided; + int popcount; + long numbers[1 + NUM_PARM]; + char *strings[1 + NUM_PARM]; +@@ -271,14 +277,45 @@ tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used) + + popcount = 0; + _nc_reset_tparm(NULL); ++ /* ++ * Count the number of numeric parameters which are provided. ++ */ ++ provided = 0; ++ for (narg = 1; narg < argc; ++narg) { ++ char *ending = NULL; ++ long check = strtol(argv[narg], &ending, 10); ++ if (check < 0 || ending == argv[narg] || *ending != '\0') ++ break; ++ provided = narg; ++ } + switch (paramType) { ++ case Str: ++ s = TPARM_1(s, strings[1]); ++ analyzed = 1; ++ if (provided == 0 && argc >= 1) ++ provided++; ++ break; ++ case Str_Str: ++ s = TPARM_2(s, strings[1], strings[2]); ++ analyzed = 2; ++ if (provided == 0 && argc >= 1) ++ provided++; ++ if (provided == 1 && argc >= 2) ++ provided++; ++ break; + case Num_Str: + s = TPARM_2(s, numbers[1], strings[2]); + analyzed = 2; ++ if (provided == 1 && argc >= 2) ++ provided++; + break; + case Num_Str_Str: + s = TPARM_3(s, numbers[1], strings[2], strings[3]); + analyzed = 3; ++ if (provided == 1 && argc >= 2) ++ provided++; ++ if (provided == 2 && argc >= 3) ++ provided++; + break; + case Numbers: + analyzed = _nc_tparm_analyze(NULL, s, p_is_s, &popcount); +@@ -316,7 +353,13 @@ tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used) + if (analyzed < popcount) { + analyzed = popcount; + } +- *used += analyzed; ++ if (opt_v && (analyzed != provided)) { ++ fprintf(stderr, "%s: %s parameters for \"%s\"\n", ++ _nc_progname, ++ (analyzed < provided ? "extra" : "missing"), ++ argv[0]); ++ } ++ *used += provided; + } + + /* use putp() in order to perform padding */ +@@ -339,7 +382,6 @@ main(int argc, char **argv) + int used; + TTY old_settings; + TTY tty_settings; +- bool opt_x = FALSE; /* clear scrollback if possible */ + bool is_alias; + bool need_tty; + +@@ -348,7 +390,7 @@ main(int argc, char **argv) + + term = getenv("TERM"); + +- while ((c = getopt(argc, argv, is_alias ? "T:Vx" : "ST:Vx")) != -1) { ++ while ((c = getopt(argc, argv, is_alias ? "T:Vvx" : "ST:Vvx")) != -1) { + switch (c) { + case 'S': + cmdline = FALSE; +@@ -361,6 +403,9 @@ main(int argc, char **argv) + case 'V': + puts(curses_version()); + ExitProgram(EXIT_SUCCESS); ++ case 'v': /* verbose */ ++ opt_v = TRUE; ++ break; + case 'x': /* do not try to clear scrollback */ + opt_x = TRUE; + break; +@@ -404,7 +449,7 @@ main(int argc, char **argv) + usage(NULL); + while (argc > 0) { + tty_settings = old_settings; +- code = tput_cmd(fd, &tty_settings, opt_x, argc, argv, &used); ++ code = tput_cmd(fd, &tty_settings, argc, argv, &used); + if (code != 0) + break; + argc -= used; +@@ -439,7 +484,7 @@ main(int argc, char **argv) + while (argnum > 0) { + int code; + tty_settings = old_settings; +- code = tput_cmd(fd, &tty_settings, opt_x, argnum, argnow, &used); ++ code = tput_cmd(fd, &tty_settings, argnum, argnow, &used); + if (code != 0) { + if (result == 0) + result = ErrSystem(0); /* will return value >4 */ +-- +2.40.0 + diff --git a/meta/recipes-core/ncurses/files/CVE-2023-50495.patch b/meta/recipes-core/ncurses/files/CVE-2023-50495.patch new file mode 100644 index 0000000000..e5a8f43b01 --- /dev/null +++ b/meta/recipes-core/ncurses/files/CVE-2023-50495.patch @@ -0,0 +1,81 @@ +commit ebc08cff36689eec54edc1ce2de6ebac826bd6cd +Author: Peter Marko <peter.marko@siemens.com> +Date: Fri Apr 12 23:56:25 2024 +0200 + +check return value of _nc_save_str(), in special case for tic where +extended capabilities are processed but the terminal description was +not initialized (report by Ziqiao Kong). + +Only parts relevant for this CVE was extracted from upstream patch. + +CVE: CVE-2023-45853 +Upstream-Status: Backport [https://invisible-island.net/archives/ncurses/6.4/ncurses-6.4-20230424.patch.gz] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> + +--- + ncurses/tinfo/parse_entry.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/ncurses/tinfo/parse_entry.c b/ncurses/tinfo/parse_entry.c +index a77cd0b..8ac02ac 100644 +--- a/ncurses/tinfo/parse_entry.c ++++ b/ncurses/tinfo/parse_entry.c +@@ -110,7 +110,7 @@ _nc_extend_names(ENTRY * entryp, const char *name, int token_type) + /* Well, we are given a cancel for a name that we don't recognize */ + return _nc_extend_names(entryp, name, STRING); + default: +- return 0; ++ return NULL; + } + + /* Adjust the 'offset' (insertion-point) to keep the lists of extended +@@ -142,6 +142,11 @@ _nc_extend_names(ENTRY * entryp, const char *name, int token_type) + for (last = (unsigned) (max - 1); last > tindex; last--) + + if (!found) { ++ char *saved; ++ ++ if ((saved = _nc_save_str(name)) == NULL) ++ return NULL; ++ + switch (token_type) { + case BOOLEAN: + tp->ext_Booleans++; +@@ -169,7 +174,7 @@ _nc_extend_names(ENTRY * entryp, const char *name, int token_type) + TYPE_REALLOC(char *, actual, tp->ext_Names); + while (--actual > offset) + tp->ext_Names[actual] = tp->ext_Names[actual - 1]; +- tp->ext_Names[offset] = _nc_save_str(name); ++ tp->ext_Names[offset] = saved; + } + + temp.nte_name = tp->ext_Names[offset]; +@@ -337,6 +342,8 @@ _nc_parse_entry(ENTRY * entryp, int literal, bool silent) + bool is_use = (strcmp(_nc_curr_token.tk_name, "use") == 0); + bool is_tc = !is_use && (strcmp(_nc_curr_token.tk_name, "tc") == 0); + if (is_use || is_tc) { ++ char *saved; ++ + if (!VALID_STRING(_nc_curr_token.tk_valstring) + || _nc_curr_token.tk_valstring[0] == '\0') { + _nc_warning("missing name for use-clause"); +@@ -350,11 +357,13 @@ _nc_parse_entry(ENTRY * entryp, int literal, bool silent) + _nc_curr_token.tk_valstring); + continue; + } +- entryp->uses[entryp->nuses].name = _nc_save_str(_nc_curr_token.tk_valstring); +- entryp->uses[entryp->nuses].line = _nc_curr_line; +- entryp->nuses++; +- if (entryp->nuses > 1 && is_tc) { +- BAD_TC_USAGE ++ if ((saved = _nc_save_str(_nc_curr_token.tk_valstring)) != NULL) { ++ entryp->uses[entryp->nuses].name = saved; ++ entryp->uses[entryp->nuses].line = _nc_curr_line; ++ entryp->nuses++; ++ if (entryp->nuses > 1 && is_tc) { ++ BAD_TC_USAGE ++ } + } + } else { + /* normal token lookup */ diff --git a/meta/recipes-core/ncurses/ncurses_6.3+20220423.bb b/meta/recipes-core/ncurses/ncurses_6.3+20220423.bb index f67a3f5bf4..da1e6d838d 100644 --- a/meta/recipes-core/ncurses/ncurses_6.3+20220423.bb +++ b/meta/recipes-core/ncurses/ncurses_6.3+20220423.bb @@ -3,6 +3,8 @@ require ncurses.inc SRC_URI += "file://0001-tic-hang.patch \ file://0002-configure-reproducible.patch \ file://0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch \ + file://CVE-2023-29491.patch \ + file://CVE-2023-50495.patch \ " # commit id corresponds to the revision in package version SRCREV = "a0bc708bc6954b5d3c0a38d92b683c3ec3135260" diff --git a/meta/recipes-core/sysfsutils/sysfsutils_2.1.0.bb b/meta/recipes-core/sysfsutils/sysfsutils_2.1.0.bb index c90a02f131..fd72cf4165 100644 --- a/meta/recipes-core/sysfsutils/sysfsutils_2.1.0.bb +++ b/meta/recipes-core/sysfsutils/sysfsutils_2.1.0.bb @@ -10,18 +10,14 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=3d06403ea54c7574a9e581c6478cc393 \ file://lib/LGPL;md5=b75d069791103ffe1c0d6435deeff72e" PR = "r5" -SRC_URI = "${SOURCEFORGE_MIRROR}/linux-diag/sysfsutils-${PV}.tar.gz \ +SRC_URI = "git://github.com/linux-ras/sysfsutils.git;protocol=https;branch=master \ file://sysfsutils-2.0.0-class-dup.patch \ file://obsolete_automake_macros.patch \ file://separatebuild.patch" -SRC_URI[md5sum] = "14e7dcd0436d2f49aa403f67e1ef7ddc" -SRC_URI[sha256sum] = "e865de2c1f559fff0d3fc936e660c0efaf7afe662064f2fb97ccad1ec28d208a" +SRCREV = "0d5456e1c9d969cdad6accef2ae2d4881d5db085" -UPSTREAM_CHECK_URI = "http://sourceforge.net/projects/linux-diag/files/sysfsutils/" -UPSTREAM_CHECK_REGEX = "/sysfsutils/(?P<pver>(\d+[\.\-_]*)+)/" - -S = "${WORKDIR}/sysfsutils-${PV}" +S = "${WORKDIR}/git" inherit autotools diff --git a/meta/recipes-core/systemd/systemd-systemctl/systemctl b/meta/recipes-core/systemd/systemd-systemctl/systemctl index 6d19666d82..0fd7e24085 100755 --- a/meta/recipes-core/systemd/systemd-systemctl/systemctl +++ b/meta/recipes-core/systemd/systemd-systemctl/systemctl @@ -184,12 +184,14 @@ class SystemdUnit(): raise SystemdUnitNotFoundError(self.root, unit) - def _process_deps(self, config, service, location, prop, dirstem): + def _process_deps(self, config, service, location, prop, dirstem, instance): systemdir = self.root / SYSCONFDIR / "systemd" / "system" target = ROOT / location.relative_to(self.root) try: for dependent in config.get('Install', prop): + # expand any %i to instance (ignoring escape sequence %%) + dependent = re.sub("([^%](%%)*)%i", "\\g<1>{}".format(instance), dependent) wants = systemdir / "{}.{}".format(dependent, dirstem) / service add_link(wants, target) @@ -229,8 +231,8 @@ class SystemdUnit(): else: service = self.unit - self._process_deps(config, service, path, 'WantedBy', 'wants') - self._process_deps(config, service, path, 'RequiredBy', 'requires') + self._process_deps(config, service, path, 'WantedBy', 'wants', instance) + self._process_deps(config, service, path, 'RequiredBy', 'requires', instance) try: for also in config.get('Install', 'Also'): diff --git a/meta/recipes-core/systemd/systemd/0001-network-remove-only-managed-configs-on-reconfigure-o.patch b/meta/recipes-core/systemd/systemd/0001-network-remove-only-managed-configs-on-reconfigure-o.patch new file mode 100644 index 0000000000..8950981d2e --- /dev/null +++ b/meta/recipes-core/systemd/systemd/0001-network-remove-only-managed-configs-on-reconfigure-o.patch @@ -0,0 +1,358 @@ +From 31b25c7d360a2ef2da1717aa39f190de5222d11a Mon Sep 17 00:00:00 2001 +From: Yu Watanabe <watanabe.yu+github@gmail.com> +Date: Mon, 31 Jan 2022 19:08:27 +0900 +Subject: [PATCH] network: remove only managed configs on reconfigure or + carrier lost + +Otherwise, if the carrir of the non-managed interface is lost, the +configs such as addresses or routes on the interface will be removed by +networkd. + +Upstream-Status: Backport [systemd v251 a0e99a377a2f22c0ba460d3e7228214008714c14] +Signed-off-by: C. Andy Martin <cam@myfastmail.com> +--- + src/network/networkd-address.c | 13 +++++-------- + src/network/networkd-address.h | 2 +- + src/network/networkd-link.c | 18 ++++++++++-------- + src/network/networkd-neighbor.c | 6 +++++- + src/network/networkd-neighbor.h | 2 +- + src/network/networkd-nexthop.c | 16 ++++++++++------ + src/network/networkd-nexthop.h | 2 +- + src/network/networkd-route.c | 16 ++++++++++------ + src/network/networkd-route.h | 2 +- + src/network/networkd-routing-policy-rule.c | 4 ++-- + src/network/networkd-routing-policy-rule.h | 2 +- + test/test-network/systemd-networkd-tests.py | 2 +- + 12 files changed, 48 insertions(+), 37 deletions(-) + +diff --git a/src/network/networkd-address.c b/src/network/networkd-address.c +index 7df743efb5..01c1d88dec 100644 +--- a/src/network/networkd-address.c ++++ b/src/network/networkd-address.c +@@ -891,22 +891,19 @@ int link_drop_foreign_addresses(Link *link) { + return r; + } + +-int link_drop_addresses(Link *link) { ++int link_drop_managed_addresses(Link *link) { + Address *address; + int k, r = 0; + + assert(link); + + SET_FOREACH(address, link->addresses) { +- /* Ignore addresses not assigned yet or already removing. */ +- if (!address_exists(address)) ++ /* Do not touch addresses managed by kernel or other tools. */ ++ if (address->source == NETWORK_CONFIG_SOURCE_FOREIGN) + continue; + +- /* Do not drop IPv6LL addresses assigned by the kernel here. They will be dropped in +- * link_drop_ipv6ll_addresses() if IPv6LL addressing is disabled. */ +- if (address->source == NETWORK_CONFIG_SOURCE_FOREIGN && +- address->family == AF_INET6 && +- in6_addr_is_link_local(&address->in_addr.in6)) ++ /* Ignore addresses not assigned yet or already removing. */ ++ if (!address_exists(address)) + continue; + + k = address_remove(address); +diff --git a/src/network/networkd-address.h b/src/network/networkd-address.h +index 41c4ce6fa4..b2110d8d21 100644 +--- a/src/network/networkd-address.h ++++ b/src/network/networkd-address.h +@@ -74,7 +74,7 @@ void address_set_broadcast(Address *a); + + DEFINE_NETWORK_SECTION_FUNCTIONS(Address, address_free); + +-int link_drop_addresses(Link *link); ++int link_drop_managed_addresses(Link *link); + int link_drop_foreign_addresses(Link *link); + int link_drop_ipv6ll_addresses(Link *link); + void link_foreignize_addresses(Link *link); +diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c +index b62a154828..12c592b257 100644 +--- a/src/network/networkd-link.c ++++ b/src/network/networkd-link.c +@@ -1070,27 +1070,27 @@ static int link_drop_foreign_config(Link *link) { + return r; + } + +-static int link_drop_config(Link *link) { ++static int link_drop_managed_config(Link *link) { + int k, r; + + assert(link); + assert(link->manager); + +- r = link_drop_routes(link); ++ r = link_drop_managed_routes(link); + +- k = link_drop_nexthops(link); ++ k = link_drop_managed_nexthops(link); + if (k < 0 && r >= 0) + r = k; + +- k = link_drop_addresses(link); ++ k = link_drop_managed_addresses(link); + if (k < 0 && r >= 0) + r = k; + +- k = link_drop_neighbors(link); ++ k = link_drop_managed_neighbors(link); + if (k < 0 && r >= 0) + r = k; + +- k = link_drop_routing_policy_rules(link); ++ k = link_drop_managed_routing_policy_rules(link); + if (k < 0 && r >= 0) + r = k; + +@@ -1318,7 +1318,9 @@ static int link_reconfigure_impl(Link *link, bool force) { + * link_drop_foreign_config() in link_configure(). */ + link_foreignize_config(link); + else { +- r = link_drop_config(link); ++ /* Remove all managed configs. Note, foreign configs are removed in later by ++ * link_configure() -> link_drop_foreign_config() if the link is managed by us. */ ++ r = link_drop_managed_config(link); + if (r < 0) + return r; + } +@@ -1705,7 +1707,7 @@ static int link_carrier_lost_impl(Link *link) { + if (r < 0) + ret = r; + +- r = link_drop_config(link); ++ r = link_drop_managed_config(link); + if (r < 0 && ret >= 0) + ret = r; + +diff --git a/src/network/networkd-neighbor.c b/src/network/networkd-neighbor.c +index 1766095e53..b58898a6dc 100644 +--- a/src/network/networkd-neighbor.c ++++ b/src/network/networkd-neighbor.c +@@ -406,13 +406,17 @@ int link_drop_foreign_neighbors(Link *link) { + return r; + } + +-int link_drop_neighbors(Link *link) { ++int link_drop_managed_neighbors(Link *link) { + Neighbor *neighbor; + int k, r = 0; + + assert(link); + + SET_FOREACH(neighbor, link->neighbors) { ++ /* Do not touch nexthops managed by kernel or other tools. */ ++ if (neighbor->source == NETWORK_CONFIG_SOURCE_FOREIGN) ++ continue; ++ + /* Ignore neighbors not assigned yet or already removing. */ + if (!neighbor_exists(neighbor)) + continue; +diff --git a/src/network/networkd-neighbor.h b/src/network/networkd-neighbor.h +index e9e1854110..8e3c510cd5 100644 +--- a/src/network/networkd-neighbor.h ++++ b/src/network/networkd-neighbor.h +@@ -34,7 +34,7 @@ int neighbor_compare_func(const Neighbor *a, const Neighbor *b); + + void network_drop_invalid_neighbors(Network *network); + +-int link_drop_neighbors(Link *link); ++int link_drop_managed_neighbors(Link *link); + int link_drop_foreign_neighbors(Link *link); + void link_foreignize_neighbors(Link *link); + +diff --git a/src/network/networkd-nexthop.c b/src/network/networkd-nexthop.c +index b829aaab90..42aa8c4c59 100644 +--- a/src/network/networkd-nexthop.c ++++ b/src/network/networkd-nexthop.c +@@ -613,8 +613,8 @@ static void manager_mark_nexthops(Manager *manager, bool foreign, const Link *ex + if (nexthop->protocol == RTPROT_KERNEL) + continue; + +- /* When 'foreign' is true, do not remove nexthops we configured. */ +- if (foreign && nexthop->source != NETWORK_CONFIG_SOURCE_FOREIGN) ++ /* When 'foreign' is true, mark only foreign nexthops, and vice versa. */ ++ if (foreign != (nexthop->source == NETWORK_CONFIG_SOURCE_FOREIGN)) + continue; + + /* Ignore nexthops not assigned yet or already removed. */ +@@ -641,7 +641,7 @@ static void manager_mark_nexthops(Manager *manager, bool foreign, const Link *ex + } + } + +-static int manager_drop_nexthops(Manager *manager) { ++static int manager_drop_marked_nexthops(Manager *manager) { + NextHop *nexthop; + int k, r = 0; + +@@ -704,14 +704,14 @@ int link_drop_foreign_nexthops(Link *link) { + + manager_mark_nexthops(link->manager, /* foreign = */ true, NULL); + +- k = manager_drop_nexthops(link->manager); ++ k = manager_drop_marked_nexthops(link->manager); + if (k < 0 && r >= 0) + r = k; + + return r; + } + +-int link_drop_nexthops(Link *link) { ++int link_drop_managed_nexthops(Link *link) { + NextHop *nexthop; + int k, r = 0; + +@@ -723,6 +723,10 @@ int link_drop_nexthops(Link *link) { + if (nexthop->protocol == RTPROT_KERNEL) + continue; + ++ /* Do not touch addresses managed by kernel or other tools. */ ++ if (nexthop->source == NETWORK_CONFIG_SOURCE_FOREIGN) ++ continue; ++ + /* Ignore nexthops not assigned yet or already removing. */ + if (!nexthop_exists(nexthop)) + continue; +@@ -734,7 +738,7 @@ int link_drop_nexthops(Link *link) { + + manager_mark_nexthops(link->manager, /* foreign = */ false, link); + +- k = manager_drop_nexthops(link->manager); ++ k = manager_drop_marked_nexthops(link->manager); + if (k < 0 && r >= 0) + r = k; + +diff --git a/src/network/networkd-nexthop.h b/src/network/networkd-nexthop.h +index 7a8920238c..1e54e9f211 100644 +--- a/src/network/networkd-nexthop.h ++++ b/src/network/networkd-nexthop.h +@@ -44,7 +44,7 @@ int nexthop_compare_func(const NextHop *a, const NextHop *b); + + void network_drop_invalid_nexthops(Network *network); + +-int link_drop_nexthops(Link *link); ++int link_drop_managed_nexthops(Link *link); + int link_drop_foreign_nexthops(Link *link); + void link_foreignize_nexthops(Link *link); + +diff --git a/src/network/networkd-route.c b/src/network/networkd-route.c +index ee7a535075..7e6fe8bc11 100644 +--- a/src/network/networkd-route.c ++++ b/src/network/networkd-route.c +@@ -788,8 +788,8 @@ static void manager_mark_routes(Manager *manager, bool foreign, const Link *exce + if (route->protocol == RTPROT_KERNEL) + continue; + +- /* When 'foreign' is true, do not remove routes we configured. */ +- if (foreign && route->source != NETWORK_CONFIG_SOURCE_FOREIGN) ++ /* When 'foreign' is true, mark only foreign routes, and vice versa. */ ++ if (foreign != (route->source == NETWORK_CONFIG_SOURCE_FOREIGN)) + continue; + + /* Do not touch dynamic routes. They will removed by dhcp_pd_prefix_lost() */ +@@ -834,7 +834,7 @@ static void manager_mark_routes(Manager *manager, bool foreign, const Link *exce + } + } + +-static int manager_drop_routes(Manager *manager) { ++static int manager_drop_marked_routes(Manager *manager) { + Route *route; + int k, r = 0; + +@@ -955,14 +955,14 @@ int link_drop_foreign_routes(Link *link) { + + manager_mark_routes(link->manager, /* foreign = */ true, NULL); + +- k = manager_drop_routes(link->manager); ++ k = manager_drop_marked_routes(link->manager); + if (k < 0 && r >= 0) + r = k; + + return r; + } + +-int link_drop_routes(Link *link) { ++int link_drop_managed_routes(Link *link) { + Route *route; + int k, r = 0; + +@@ -973,6 +973,10 @@ int link_drop_routes(Link *link) { + if (route_by_kernel(route)) + continue; + ++ /* Do not touch routes managed by kernel or other tools. */ ++ if (route->source == NETWORK_CONFIG_SOURCE_FOREIGN) ++ continue; ++ + if (!route_exists(route)) + continue; + +@@ -983,7 +987,7 @@ int link_drop_routes(Link *link) { + + manager_mark_routes(link->manager, /* foreign = */ false, link); + +- k = manager_drop_routes(link->manager); ++ k = manager_drop_marked_routes(link->manager); + if (k < 0 && r >= 0) + r = k; + +diff --git a/src/network/networkd-route.h b/src/network/networkd-route.h +index e3e22a5985..2180a196fc 100644 +--- a/src/network/networkd-route.h ++++ b/src/network/networkd-route.h +@@ -82,7 +82,7 @@ int route_remove(Route *route); + + int route_get(Manager *manager, Link *link, const Route *in, Route **ret); + +-int link_drop_routes(Link *link); ++int link_drop_managed_routes(Link *link); + int link_drop_foreign_routes(Link *link); + void link_foreignize_routes(Link *link); + +diff --git a/src/network/networkd-routing-policy-rule.c b/src/network/networkd-routing-policy-rule.c +index 90086f35a7..d4363060d8 100644 +--- a/src/network/networkd-routing-policy-rule.c ++++ b/src/network/networkd-routing-policy-rule.c +@@ -653,8 +653,8 @@ static void manager_mark_routing_policy_rules(Manager *m, bool foreign, const Li + if (rule->protocol == RTPROT_KERNEL) + continue; + +- /* When 'foreign' is true, do not remove rules we configured. */ +- if (foreign && rule->source != NETWORK_CONFIG_SOURCE_FOREIGN) ++ /* When 'foreign' is true, mark only foreign rules, and vice versa. */ ++ if (foreign != (rule->source == NETWORK_CONFIG_SOURCE_FOREIGN)) + continue; + + /* Ignore rules not assigned yet or already removing. */ +diff --git a/src/network/networkd-routing-policy-rule.h b/src/network/networkd-routing-policy-rule.h +index f52943bd2e..7cc6f55c8d 100644 +--- a/src/network/networkd-routing-policy-rule.h ++++ b/src/network/networkd-routing-policy-rule.h +@@ -71,7 +71,7 @@ int manager_drop_routing_policy_rules_internal(Manager *m, bool foreign, const L + static inline int manager_drop_foreign_routing_policy_rules(Manager *m) { + return manager_drop_routing_policy_rules_internal(m, true, NULL); + } +-static inline int link_drop_routing_policy_rules(Link *link) { ++static inline int link_drop_managed_routing_policy_rules(Link *link) { + assert(link); + return manager_drop_routing_policy_rules_internal(link->manager, false, link); + } +diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py +index ac2c1ba034..ed4d4992b1 100755 +--- a/test/test-network/systemd-networkd-tests.py ++++ b/test/test-network/systemd-networkd-tests.py +@@ -3876,7 +3876,7 @@ class NetworkdBridgeTests(unittest.TestCase, Utilities): + print(output) + self.assertRegex(output, 'NO-CARRIER') + self.assertNotRegex(output, '192.168.0.15/24') +- self.assertNotRegex(output, '192.168.0.16/24') ++ self.assertRegex(output, '192.168.0.16/24') # foreign address is kept + + print('### ip -6 route list table all dev bridge99') + output = check_output('ip -6 route list table all dev bridge99') +-- +2.34.1 + diff --git a/meta/recipes-core/systemd/systemd/0001-nspawn-make-sure-host-root-can-write-to-the-uidmappe.patch b/meta/recipes-core/systemd/systemd/0001-nspawn-make-sure-host-root-can-write-to-the-uidmappe.patch new file mode 100644 index 0000000000..8715019c99 --- /dev/null +++ b/meta/recipes-core/systemd/systemd/0001-nspawn-make-sure-host-root-can-write-to-the-uidmappe.patch @@ -0,0 +1,216 @@ +From e34fb1a4568bd080032065bb1506ab9b6c6606f1 Mon Sep 17 00:00:00 2001 +From: Lennart Poettering <lennart@poettering.net> +Date: Thu, 17 Mar 2022 13:46:12 +0100 +Subject: [PATCH] nspawn: make sure host root can write to the uidmapped mounts + we prepare for the container payload +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When using user namespaces in conjunction with uidmapped mounts, nspawn +so far set up two uidmappings: + +1. One that is used for the uidmapped mount and that maps the UID range + 0…65535 on the backing fs to some high UID range X…X+65535 on the + uidmapped fs. (Let's call this mapping the "mount mapping") + +2. One that is used for the userns namespace the container payload + processes run in, that maps X…X+65535 back to 0…65535. (Let's call + this one the "process mapping"). + +These mappings hence are pretty much identical, one just moves things up +and one back down. (Reminder: we do all this so that the processes can +run under high UIDs while running off file systems that require no +recursive chown()ing, i.e. we want processes with high UID range but +files with low UID range.) + +This creates one problem, i.e. issue #20989: if nspawn (which runs as +host root, i.e. host UID 0) wants to add inodes to the uidmapped mount +it can't do that, since host UID 0 is not defined in the mount mapping +(only the X…X+65536 range is, after all, and X > 0), and processes whose +UID is not mapped in a uidmapped fs cannot create inodes in it since +those would be owned by an unmapped UID, which then triggers +the famous EOVERFLOW error. + +Let's fix this, by explicitly including an entry for the host UID 0 in +the mount mapping. Specifically, we'll extend the mount mapping to map +UID 2147483646 (which is INT32_MAX-1, see code for an explanation why I +picked this one) of the backing fs to UID 0 on the uidmapped fs. This +way nspawn can creates inode on the uidmapped as it likes (which will +then actually be owned by UID 2147483646 on the backing fs), and as it +always did. Note that we do *not* create a similar entry in the process +mapping. Thus any files created by nspawn that way (and not chown()ed to +something better) will appear as unmapped (i.e. as overflowuid/"nobody") +in the container payload. And that's good. Of course, the latter is +mostly theoretic, as nspawn should generally chown() the inodes it +creates to UID ranges that actually make sense for the container (and we +generally already do this correctly), but it#s good to know that we are +safe here, given we might accidentally forget to chown() some inodes we +create. + +Net effect: the two mappings will not be identical anymore. The mount +mapping has one entry more, and the only reason it exists is so that +nspawn can access the uidmapped fs reasonably independently from any +process mapping. + +Fixes: #20989 + +Upstream-Status: Backport [50ae2966d20b0b4a19def060de3b966b7a70b54a] +Signed-off-by: Marek Vasut <marex@denx.de> +--- + src/basic/user-util.h | 13 +++++++++++++ + src/nspawn/nspawn-mount.c | 2 +- + src/nspawn/nspawn.c | 2 +- + src/shared/dissect-image.c | 2 +- + src/shared/mount-util.c | 28 +++++++++++++++++++++++----- + src/shared/mount-util.h | 13 ++++++++++++- + 6 files changed, 51 insertions(+), 9 deletions(-) + +diff --git a/src/basic/user-util.h b/src/basic/user-util.h +index ab1ce48b2d..0b9749ef8b 100644 +--- a/src/basic/user-util.h ++++ b/src/basic/user-util.h +@@ -59,6 +59,19 @@ int take_etc_passwd_lock(const char *root); + #define UID_NOBODY ((uid_t) 65534U) + #define GID_NOBODY ((gid_t) 65534U) + ++/* If REMOUNT_IDMAP_HOST_ROOT is set for remount_idmap() we'll include a mapping here that maps the host root ++ * user accessing the idmapped mount to the this user ID on the backing fs. This is the last valid UID in the ++ * *signed* 32bit range. You might wonder why precisely use this specific UID for this purpose? Well, we ++ * definitely cannot use the first 0…65536 UIDs for that, since in most cases that's precisely the file range ++ * we intend to map to some high UID range, and since UID mappings have to be bijective we thus cannot use ++ * them at all. Furthermore the UID range beyond INT32_MAX (i.e. the range above the signed 32bit range) is ++ * icky, since many APIs cannot use it (example: setfsuid() returns the old UID as signed integer). Following ++ * our usual logic of assigning a 16bit UID range to each container, so that the upper 16bit of a 32bit UID ++ * value indicate kind of a "container ID" and the lower 16bit map directly to the intended user you can read ++ * this specific UID as the "nobody" user of the container with ID 0x7FFF, which is kinda nice. */ ++#define UID_MAPPED_ROOT ((uid_t) (INT32_MAX-1)) ++#define GID_MAPPED_ROOT ((gid_t) (INT32_MAX-1)) ++ + #define ETC_PASSWD_LOCK_PATH "/etc/.pwd.lock" + + /* The following macros add 1 when converting things, since UID 0 is a valid UID, while the pointer +diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c +index 40773d90c1..f2fad0f462 100644 +--- a/src/nspawn/nspawn-mount.c ++++ b/src/nspawn/nspawn-mount.c +@@ -780,7 +780,7 @@ static int mount_bind(const char *dest, CustomMount *m, uid_t uid_shift, uid_t u + } + + if (idmapped) { +- r = remount_idmap(where, uid_shift, uid_range); ++ r = remount_idmap(where, uid_shift, uid_range, REMOUNT_IDMAP_HOST_ROOT); + if (r < 0) + return log_error_errno(r, "Failed to map ids for bind mount %s: %m", where); + } +diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c +index 8f17ab8810..fe0af8e42d 100644 +--- a/src/nspawn/nspawn.c ++++ b/src/nspawn/nspawn.c +@@ -3779,7 +3779,7 @@ static int outer_child( + IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) && + arg_uid_shift != 0) { + +- r = remount_idmap(directory, arg_uid_shift, arg_uid_range); ++ r = remount_idmap(directory, arg_uid_shift, arg_uid_range, REMOUNT_IDMAP_HOST_ROOT); + if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) { + /* This might fail because the kernel or file system doesn't support idmapping. We + * can't really distinguish this nicely, nor do we have any guarantees about the +diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c +index 39a7f4c3f2..471c165257 100644 +--- a/src/shared/dissect-image.c ++++ b/src/shared/dissect-image.c +@@ -1807,7 +1807,7 @@ static int mount_partition( + (void) fs_grow(node, p); + + if (remap_uid_gid) { +- r = remount_idmap(p, uid_shift, uid_range); ++ r = remount_idmap(p, uid_shift, uid_range, REMOUNT_IDMAP_HOST_ROOT); + if (r < 0) + return r; + } +diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c +index c75c02f5be..fb2e9a0711 100644 +--- a/src/shared/mount-util.c ++++ b/src/shared/mount-util.c +@@ -1049,14 +1049,31 @@ int make_mount_point(const char *path) { + return 1; + } + +-static int make_userns(uid_t uid_shift, uid_t uid_range) { +- char line[DECIMAL_STR_MAX(uid_t)*3+3+1]; ++static int make_userns(uid_t uid_shift, uid_t uid_range, RemountIdmapFlags flags) { + _cleanup_close_ int userns_fd = -1; ++ _cleanup_free_ char *line = NULL; + + /* Allocates a userns file descriptor with the mapping we need. For this we'll fork off a child + * process whose only purpose is to give us a new user namespace. It's killed when we got it. */ + +- xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, uid_shift, uid_range); ++ if (asprintf(&line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, uid_shift, uid_range) < 0) ++ return log_oom_debug(); ++ ++ /* If requested we'll include an entry in the mapping so that the host root user can make changes to ++ * the uidmapped mount like it normally would. Specifically, we'll map the user with UID_HOST_ROOT on ++ * the backing fs to UID 0. This is useful, since nspawn code wants to create various missing inodes ++ * in the OS tree before booting into it, and this becomes very easy and straightforward to do if it ++ * can just do it under its own regular UID. Note that in that case the container's runtime uidmap ++ * (i.e. the one the container payload processes run in) will leave this UID unmapped, i.e. if we ++ * accidentally leave files owned by host root in the already uidmapped tree around they'll show up ++ * as owned by 'nobody', which is safe. (Of course, we shouldn't leave such inodes around, but always ++ * chown() them to the container's own UID range, but it's good to have a safety net, in case we ++ * forget it.) */ ++ if (flags & REMOUNT_IDMAP_HOST_ROOT) ++ if (strextendf(&line, ++ UID_FMT " " UID_FMT " " UID_FMT "\n", ++ UID_MAPPED_ROOT, 0, 1) < 0) ++ return log_oom_debug(); + + /* We always assign the same UID and GID ranges */ + userns_fd = userns_acquire(line, line); +@@ -1069,7 +1086,8 @@ static int make_userns(uid_t uid_shift, uid_t uid_range) { + int remount_idmap( + const char *p, + uid_t uid_shift, +- uid_t uid_range) { ++ uid_t uid_range, ++ RemountIdmapFlags flags) { + + _cleanup_close_ int mount_fd = -1, userns_fd = -1; + int r; +@@ -1085,7 +1103,7 @@ int remount_idmap( + return log_debug_errno(errno, "Failed to open tree of mounted filesystem '%s': %m", p); + + /* Create a user namespace mapping */ +- userns_fd = make_userns(uid_shift, uid_range); ++ userns_fd = make_userns(uid_shift, uid_range, flags); + if (userns_fd < 0) + return userns_fd; + +diff --git a/src/shared/mount-util.h b/src/shared/mount-util.h +index ce73aebd4b..f53a64186f 100644 +--- a/src/shared/mount-util.h ++++ b/src/shared/mount-util.h +@@ -112,7 +112,18 @@ int mount_image_in_namespace(pid_t target, const char *propagate_path, const cha + + int make_mount_point(const char *path); + +-int remount_idmap(const char *p, uid_t uid_shift, uid_t uid_range); ++typedef enum RemountIdmapFlags { ++ /* Include a mapping from UID_MAPPED_ROOT (i.e. UID 2^31-2) on the backing fs to UID 0 on the ++ * uidmapped fs. This is useful to ensure that the host root user can safely add inodes to the ++ * uidmapped fs (which otherwise wouldn't work as the host root user is not defined on the uidmapped ++ * mount and any attempts to create inodes will then be refused with EOVERFLOW). The idea is that ++ * these inodes are quickly re-chown()ed to more suitable UIDs/GIDs. Any code that intends to be able ++ * to add inodes to file systems mapped this way should set this flag, but given it comes with ++ * certain security implications defaults to off, and requires explicit opt-in. */ ++ REMOUNT_IDMAP_HOST_ROOT = 1 << 0, ++} RemountIdmapFlags; ++ ++int remount_idmap(const char *p, uid_t uid_shift, uid_t uid_range, RemountIdmapFlags flags); + + /* Creates a mount point (not parents) based on the source path or stat - ie, a file or a directory */ + int make_mount_point_inode_from_stat(const struct stat *st, const char *dest, mode_t mode); +-- +2.40.1 + diff --git a/meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch b/meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch new file mode 100644 index 0000000000..5cf0fe284e --- /dev/null +++ b/meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch @@ -0,0 +1,109 @@ +From 45d323fc889a55fae400a5b08a56273d5724ef4a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> +Date: Tue, 29 Nov 2022 09:00:16 +0100 +Subject: [PATCH 1/2] coredump: adjust whitespace + +(cherry picked from commit 510a146634f3e095b34e2a26023b1b1f99dcb8c0) +(cherry picked from commit cc2eb7a9b5fd6d9dd8ea35fb045ce6e5e16e1187) +(cherry picked from commit cb044d734c44cd3c05a6e438b5b995b2a9cfa73c) + +Preparation to avoid conflicts when applying CVE CVE-2022-4415 +Upstream-Status: Backport [https://github.com/systemd/systemd-stable/commit/45d323fc889a55fae400a5b08a56273d5724ef4a] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/coredump/coredump.c | 56 ++++++++++++++++++++--------------------- + 1 file changed, 28 insertions(+), 28 deletions(-) + +diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c +index eaea63f682..8295b03ac7 100644 +--- a/src/coredump/coredump.c ++++ b/src/coredump/coredump.c +@@ -103,16 +103,16 @@ enum { + }; + + static const char * const meta_field_names[_META_MAX] = { +- [META_ARGV_PID] = "COREDUMP_PID=", +- [META_ARGV_UID] = "COREDUMP_UID=", +- [META_ARGV_GID] = "COREDUMP_GID=", +- [META_ARGV_SIGNAL] = "COREDUMP_SIGNAL=", +- [META_ARGV_TIMESTAMP] = "COREDUMP_TIMESTAMP=", +- [META_ARGV_RLIMIT] = "COREDUMP_RLIMIT=", +- [META_ARGV_HOSTNAME] = "COREDUMP_HOSTNAME=", +- [META_COMM] = "COREDUMP_COMM=", +- [META_EXE] = "COREDUMP_EXE=", +- [META_UNIT] = "COREDUMP_UNIT=", ++ [META_ARGV_PID] = "COREDUMP_PID=", ++ [META_ARGV_UID] = "COREDUMP_UID=", ++ [META_ARGV_GID] = "COREDUMP_GID=", ++ [META_ARGV_SIGNAL] = "COREDUMP_SIGNAL=", ++ [META_ARGV_TIMESTAMP] = "COREDUMP_TIMESTAMP=", ++ [META_ARGV_RLIMIT] = "COREDUMP_RLIMIT=", ++ [META_ARGV_HOSTNAME] = "COREDUMP_HOSTNAME=", ++ [META_COMM] = "COREDUMP_COMM=", ++ [META_EXE] = "COREDUMP_EXE=", ++ [META_UNIT] = "COREDUMP_UNIT=", + }; + + typedef struct Context { +@@ -131,9 +131,9 @@ typedef enum CoredumpStorage { + } CoredumpStorage; + + static const char* const coredump_storage_table[_COREDUMP_STORAGE_MAX] = { +- [COREDUMP_STORAGE_NONE] = "none", ++ [COREDUMP_STORAGE_NONE] = "none", + [COREDUMP_STORAGE_EXTERNAL] = "external", +- [COREDUMP_STORAGE_JOURNAL] = "journal", ++ [COREDUMP_STORAGE_JOURNAL] = "journal", + }; + + DEFINE_PRIVATE_STRING_TABLE_LOOKUP(coredump_storage, CoredumpStorage); +@@ -149,13 +149,13 @@ static uint64_t arg_max_use = UINT64_MAX; + + static int parse_config(void) { + static const ConfigTableItem items[] = { +- { "Coredump", "Storage", config_parse_coredump_storage, 0, &arg_storage }, +- { "Coredump", "Compress", config_parse_bool, 0, &arg_compress }, +- { "Coredump", "ProcessSizeMax", config_parse_iec_uint64, 0, &arg_process_size_max }, +- { "Coredump", "ExternalSizeMax", config_parse_iec_uint64_infinity, 0, &arg_external_size_max }, +- { "Coredump", "JournalSizeMax", config_parse_iec_size, 0, &arg_journal_size_max }, +- { "Coredump", "KeepFree", config_parse_iec_uint64, 0, &arg_keep_free }, +- { "Coredump", "MaxUse", config_parse_iec_uint64, 0, &arg_max_use }, ++ { "Coredump", "Storage", config_parse_coredump_storage, 0, &arg_storage }, ++ { "Coredump", "Compress", config_parse_bool, 0, &arg_compress }, ++ { "Coredump", "ProcessSizeMax", config_parse_iec_uint64, 0, &arg_process_size_max }, ++ { "Coredump", "ExternalSizeMax", config_parse_iec_uint64_infinity, 0, &arg_external_size_max }, ++ { "Coredump", "JournalSizeMax", config_parse_iec_size, 0, &arg_journal_size_max }, ++ { "Coredump", "KeepFree", config_parse_iec_uint64, 0, &arg_keep_free }, ++ { "Coredump", "MaxUse", config_parse_iec_uint64, 0, &arg_max_use }, + {} + }; + +@@ -201,15 +201,15 @@ static int fix_acl(int fd, uid_t uid) { + static int fix_xattr(int fd, const Context *context) { + + static const char * const xattrs[_META_MAX] = { +- [META_ARGV_PID] = "user.coredump.pid", +- [META_ARGV_UID] = "user.coredump.uid", +- [META_ARGV_GID] = "user.coredump.gid", +- [META_ARGV_SIGNAL] = "user.coredump.signal", +- [META_ARGV_TIMESTAMP] = "user.coredump.timestamp", +- [META_ARGV_RLIMIT] = "user.coredump.rlimit", +- [META_ARGV_HOSTNAME] = "user.coredump.hostname", +- [META_COMM] = "user.coredump.comm", +- [META_EXE] = "user.coredump.exe", ++ [META_ARGV_PID] = "user.coredump.pid", ++ [META_ARGV_UID] = "user.coredump.uid", ++ [META_ARGV_GID] = "user.coredump.gid", ++ [META_ARGV_SIGNAL] = "user.coredump.signal", ++ [META_ARGV_TIMESTAMP] = "user.coredump.timestamp", ++ [META_ARGV_RLIMIT] = "user.coredump.rlimit", ++ [META_ARGV_HOSTNAME] = "user.coredump.hostname", ++ [META_COMM] = "user.coredump.comm", ++ [META_EXE] = "user.coredump.exe", + }; + + int r = 0; +-- +2.30.2 + diff --git a/meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch b/meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch new file mode 100644 index 0000000000..8389ee8cd6 --- /dev/null +++ b/meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch @@ -0,0 +1,391 @@ +From 1d5e0e9910500f3c3584485f77bfc35e601036e3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> +Date: Mon, 28 Nov 2022 12:12:55 +0100 +Subject: [PATCH 2/2] coredump: do not allow user to access coredumps with + changed uid/gid/capabilities + +When the user starts a program which elevates its permissions via setuid, +setgid, or capabilities set on the file, it may access additional information +which would then be visible in the coredump. We shouldn't make the the coredump +visible to the user in such cases. + +Reported-by: Matthias Gerstner <mgerstner@suse.de> + +This reads the /proc/<pid>/auxv file and attaches it to the process metadata as +PROC_AUXV. Before the coredump is submitted, it is parsed and if either +at_secure was set (which the kernel will do for processes that are setuid, +setgid, or setcap), or if the effective uid/gid don't match uid/gid, the file +is not made accessible to the user. If we can't access this data, we assume the +file should not be made accessible either. In principle we could also access +the auxv data from a note in the core file, but that is much more complex and +it seems better to use the stand-alone file that is provided by the kernel. + +Attaching auxv is both convient for this patch (because this way it's passed +between the stages along with other fields), but I think it makes sense to save +it in general. + +We use the information early in the core file to figure out if the program was +32-bit or 64-bit and its endianness. This way we don't need heuristics to guess +whether the format of the auxv structure. This test might reject some cases on +fringe architecutes. But the impact would be limited: we just won't grant the +user permissions to view the coredump file. If people report that we're missing +some cases, we can always enhance this to support more architectures. + +I tested auxv parsing on amd64, 32-bit program on amd64, arm64, arm32, and +ppc64el, but not the whole coredump handling. + +(cherry picked from commit 3e4d0f6cf99f8677edd6a237382a65bfe758de03) +(cherry picked from commit 9b75a3d0502d6741c8ecb7175794345f8eb3827c) +(cherry picked from commit efca5283dc791a07171f80eef84e14fdb58fad57) + +CVE: CVE-2022-4415 +Upstream-Status: Backport [https://github.com/systemd/systemd-stable/commit/1d5e0e9910500f3c3584485f77bfc35e601036e3] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/basic/io-util.h | 9 ++ + src/coredump/coredump.c | 196 +++++++++++++++++++++++++++++++++++++--- + 2 files changed, 192 insertions(+), 13 deletions(-) + +diff --git a/src/basic/io-util.h b/src/basic/io-util.h +index 39728e06bc..3afb134266 100644 +--- a/src/basic/io-util.h ++++ b/src/basic/io-util.h +@@ -91,7 +91,16 @@ struct iovec_wrapper *iovw_new(void); + struct iovec_wrapper *iovw_free(struct iovec_wrapper *iovw); + struct iovec_wrapper *iovw_free_free(struct iovec_wrapper *iovw); + void iovw_free_contents(struct iovec_wrapper *iovw, bool free_vectors); ++ + int iovw_put(struct iovec_wrapper *iovw, void *data, size_t len); ++static inline int iovw_consume(struct iovec_wrapper *iovw, void *data, size_t len) { ++ /* Move data into iovw or free on error */ ++ int r = iovw_put(iovw, data, len); ++ if (r < 0) ++ free(data); ++ return r; ++} ++ + int iovw_put_string_field(struct iovec_wrapper *iovw, const char *field, const char *value); + int iovw_put_string_field_free(struct iovec_wrapper *iovw, const char *field, char *value); + void iovw_rebase(struct iovec_wrapper *iovw, char *old, char *new); +diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c +index 8295b03ac7..79280ab986 100644 +--- a/src/coredump/coredump.c ++++ b/src/coredump/coredump.c +@@ -4,6 +4,7 @@ + #include <stdio.h> + #include <sys/prctl.h> + #include <sys/statvfs.h> ++#include <sys/auxv.h> + #include <sys/xattr.h> + #include <unistd.h> + +@@ -99,6 +100,7 @@ enum { + + META_EXE = _META_MANDATORY_MAX, + META_UNIT, ++ META_PROC_AUXV, + _META_MAX + }; + +@@ -113,10 +115,12 @@ static const char * const meta_field_names[_META_MAX] = { + [META_COMM] = "COREDUMP_COMM=", + [META_EXE] = "COREDUMP_EXE=", + [META_UNIT] = "COREDUMP_UNIT=", ++ [META_PROC_AUXV] = "COREDUMP_PROC_AUXV=", + }; + + typedef struct Context { + const char *meta[_META_MAX]; ++ size_t meta_size[_META_MAX]; + pid_t pid; + bool is_pid1; + bool is_journald; +@@ -178,13 +182,16 @@ static uint64_t storage_size_max(void) { + return 0; + } + +-static int fix_acl(int fd, uid_t uid) { ++static int fix_acl(int fd, uid_t uid, bool allow_user) { ++ assert(fd >= 0); ++ assert(uid_is_valid(uid)); + + #if HAVE_ACL + int r; + +- assert(fd >= 0); +- assert(uid_is_valid(uid)); ++ /* We don't allow users to read coredumps if the uid or capabilities were changed. */ ++ if (!allow_user) ++ return 0; + + if (uid_is_system(uid) || uid_is_dynamic(uid) || uid == UID_NOBODY) + return 0; +@@ -244,7 +251,8 @@ static int fix_permissions( + const char *filename, + const char *target, + const Context *context, +- uid_t uid) { ++ uid_t uid, ++ bool allow_user) { + + int r; + +@@ -254,7 +262,7 @@ static int fix_permissions( + + /* Ignore errors on these */ + (void) fchmod(fd, 0640); +- (void) fix_acl(fd, uid); ++ (void) fix_acl(fd, uid, allow_user); + (void) fix_xattr(fd, context); + + r = fsync_full(fd); +@@ -324,6 +332,153 @@ static int make_filename(const Context *context, char **ret) { + return 0; + } + ++static int parse_auxv64( ++ const uint64_t *auxv, ++ size_t size_bytes, ++ int *at_secure, ++ uid_t *uid, ++ uid_t *euid, ++ gid_t *gid, ++ gid_t *egid) { ++ ++ assert(auxv || size_bytes == 0); ++ ++ if (size_bytes % (2 * sizeof(uint64_t)) != 0) ++ return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes); ++ ++ size_t words = size_bytes / sizeof(uint64_t); ++ ++ /* Note that we set output variables even on error. */ ++ ++ for (size_t i = 0; i + 1 < words; i += 2) ++ switch (auxv[i]) { ++ case AT_SECURE: ++ *at_secure = auxv[i + 1] != 0; ++ break; ++ case AT_UID: ++ *uid = auxv[i + 1]; ++ break; ++ case AT_EUID: ++ *euid = auxv[i + 1]; ++ break; ++ case AT_GID: ++ *gid = auxv[i + 1]; ++ break; ++ case AT_EGID: ++ *egid = auxv[i + 1]; ++ break; ++ case AT_NULL: ++ if (auxv[i + 1] != 0) ++ goto error; ++ return 0; ++ } ++ error: ++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), ++ "AT_NULL terminator not found, cannot parse auxv structure."); ++} ++ ++static int parse_auxv32( ++ const uint32_t *auxv, ++ size_t size_bytes, ++ int *at_secure, ++ uid_t *uid, ++ uid_t *euid, ++ gid_t *gid, ++ gid_t *egid) { ++ ++ assert(auxv || size_bytes == 0); ++ ++ size_t words = size_bytes / sizeof(uint32_t); ++ ++ if (size_bytes % (2 * sizeof(uint32_t)) != 0) ++ return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes); ++ ++ /* Note that we set output variables even on error. */ ++ ++ for (size_t i = 0; i + 1 < words; i += 2) ++ switch (auxv[i]) { ++ case AT_SECURE: ++ *at_secure = auxv[i + 1] != 0; ++ break; ++ case AT_UID: ++ *uid = auxv[i + 1]; ++ break; ++ case AT_EUID: ++ *euid = auxv[i + 1]; ++ break; ++ case AT_GID: ++ *gid = auxv[i + 1]; ++ break; ++ case AT_EGID: ++ *egid = auxv[i + 1]; ++ break; ++ case AT_NULL: ++ if (auxv[i + 1] != 0) ++ goto error; ++ return 0; ++ } ++ error: ++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), ++ "AT_NULL terminator not found, cannot parse auxv structure."); ++} ++ ++static int grant_user_access(int core_fd, const Context *context) { ++ int at_secure = -1; ++ uid_t uid = UID_INVALID, euid = UID_INVALID; ++ uid_t gid = GID_INVALID, egid = GID_INVALID; ++ int r; ++ ++ assert(core_fd >= 0); ++ assert(context); ++ ++ if (!context->meta[META_PROC_AUXV]) ++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), "No auxv data, not adjusting permissions."); ++ ++ uint8_t elf[EI_NIDENT]; ++ errno = 0; ++ if (pread(core_fd, &elf, sizeof(elf), 0) != sizeof(elf)) ++ return log_warning_errno(errno_or_else(EIO), ++ "Failed to pread from coredump fd: %s", errno != 0 ? strerror_safe(errno) : "Unexpected EOF"); ++ ++ if (elf[EI_MAG0] != ELFMAG0 || ++ elf[EI_MAG1] != ELFMAG1 || ++ elf[EI_MAG2] != ELFMAG2 || ++ elf[EI_MAG3] != ELFMAG3 || ++ elf[EI_VERSION] != EV_CURRENT) ++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), ++ "Core file does not have ELF header, not adjusting permissions."); ++ if (!IN_SET(elf[EI_CLASS], ELFCLASS32, ELFCLASS64) || ++ !IN_SET(elf[EI_DATA], ELFDATA2LSB, ELFDATA2MSB)) ++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), ++ "Core file has strange ELF class, not adjusting permissions."); ++ ++ if ((elf[EI_DATA] == ELFDATA2LSB) != (__BYTE_ORDER == __LITTLE_ENDIAN)) ++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), ++ "Core file has non-native endianness, not adjusting permissions."); ++ ++ if (elf[EI_CLASS] == ELFCLASS64) ++ r = parse_auxv64((const uint64_t*) context->meta[META_PROC_AUXV], ++ context->meta_size[META_PROC_AUXV], ++ &at_secure, &uid, &euid, &gid, &egid); ++ else ++ r = parse_auxv32((const uint32_t*) context->meta[META_PROC_AUXV], ++ context->meta_size[META_PROC_AUXV], ++ &at_secure, &uid, &euid, &gid, &egid); ++ if (r < 0) ++ return r; ++ ++ /* We allow access if we got all the data and at_secure is not set and ++ * the uid/gid matches euid/egid. */ ++ bool ret = ++ at_secure == 0 && ++ uid != UID_INVALID && euid != UID_INVALID && uid == euid && ++ gid != GID_INVALID && egid != GID_INVALID && gid == egid; ++ log_debug("Will %s access (uid="UID_FMT " euid="UID_FMT " gid="GID_FMT " egid="GID_FMT " at_secure=%s)", ++ ret ? "permit" : "restrict", ++ uid, euid, gid, egid, yes_no(at_secure)); ++ return ret; ++} ++ + static int save_external_coredump( + const Context *context, + int input_fd, +@@ -446,6 +601,8 @@ static int save_external_coredump( + context->meta[META_ARGV_PID], context->meta[META_COMM]); + truncated = r == 1; + ++ bool allow_user = grant_user_access(fd, context) > 0; ++ + #if HAVE_COMPRESSION + if (arg_compress) { + _cleanup_(unlink_and_freep) char *tmp_compressed = NULL; +@@ -483,7 +640,7 @@ static int save_external_coredump( + uncompressed_size += partial_uncompressed_size; + } + +- r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid); ++ r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid, allow_user); + if (r < 0) + return r; + +@@ -510,7 +667,7 @@ static int save_external_coredump( + "SIZE_LIMIT=%zu", max_size, + "MESSAGE_ID=" SD_MESSAGE_TRUNCATED_CORE_STR); + +- r = fix_permissions(fd, tmp, fn, context, uid); ++ r = fix_permissions(fd, tmp, fn, context, uid, allow_user); + if (r < 0) + return log_error_errno(r, "Failed to fix permissions and finalize coredump %s into %s: %m", coredump_tmpfile_name(tmp), fn); + +@@ -758,7 +915,7 @@ static int change_uid_gid(const Context *context) { + } + + static int submit_coredump( +- Context *context, ++ const Context *context, + struct iovec_wrapper *iovw, + int input_fd) { + +@@ -919,16 +1076,15 @@ static int save_context(Context *context, const struct iovec_wrapper *iovw) { + struct iovec *iovec = iovw->iovec + n; + + for (size_t i = 0; i < ELEMENTSOF(meta_field_names); i++) { +- char *p; +- + /* Note that these strings are NUL terminated, because we made sure that a + * trailing NUL byte is in the buffer, though not included in the iov_len + * count (see process_socket() and gather_pid_metadata_*()) */ + assert(((char*) iovec->iov_base)[iovec->iov_len] == 0); + +- p = startswith(iovec->iov_base, meta_field_names[i]); ++ const char *p = startswith(iovec->iov_base, meta_field_names[i]); + if (p) { + context->meta[i] = p; ++ context->meta_size[i] = iovec->iov_len - strlen(meta_field_names[i]); + count++; + break; + } +@@ -1170,6 +1326,7 @@ static int gather_pid_metadata(struct iovec_wrapper *iovw, Context *context) { + uid_t owner_uid; + pid_t pid; + char *t; ++ size_t size; + const char *p; + int r; + +@@ -1234,13 +1391,26 @@ static int gather_pid_metadata(struct iovec_wrapper *iovw, Context *context) { + (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_LIMITS=", t); + + p = procfs_file_alloca(pid, "cgroup"); +- if (read_full_virtual_file(p, &t, NULL) >=0) ++ if (read_full_virtual_file(p, &t, NULL) >= 0) + (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_CGROUP=", t); + + p = procfs_file_alloca(pid, "mountinfo"); +- if (read_full_virtual_file(p, &t, NULL) >=0) ++ if (read_full_virtual_file(p, &t, NULL) >= 0) + (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_MOUNTINFO=", t); + ++ /* We attach /proc/auxv here. ELF coredumps also contain a note for this (NT_AUXV), see elf(5). */ ++ p = procfs_file_alloca(pid, "auxv"); ++ if (read_full_virtual_file(p, &t, &size) >= 0) { ++ char *buf = malloc(strlen("COREDUMP_PROC_AUXV=") + size + 1); ++ if (buf) { ++ /* Add a dummy terminator to make save_context() happy. */ ++ *((uint8_t*) mempcpy(stpcpy(buf, "COREDUMP_PROC_AUXV="), t, size)) = '\0'; ++ (void) iovw_consume(iovw, buf, size + strlen("COREDUMP_PROC_AUXV=")); ++ } ++ ++ free(t); ++ } ++ + if (get_process_cwd(pid, &t) >= 0) + (void) iovw_put_string_field_free(iovw, "COREDUMP_CWD=", t); + +-- +2.30.2 + diff --git a/meta/recipes-core/systemd/systemd/CVE-2023-7008.patch b/meta/recipes-core/systemd/systemd/CVE-2023-7008.patch new file mode 100644 index 0000000000..e2296abc49 --- /dev/null +++ b/meta/recipes-core/systemd/systemd/CVE-2023-7008.patch @@ -0,0 +1,40 @@ +From 3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1 Mon Sep 17 00:00:00 2001 +From: Michal Sekletar <msekleta@redhat.com> +Date: Wed, 20 Dec 2023 16:44:14 +0100 +Subject: [PATCH] resolved: actually check authenticated flag of SOA + transaction + +Fixes #25676 + +Upstream-Status: Backport [https://github.com/systemd/systemd/commit/3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1] +CVE: CVE-2023-7008 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + src/resolve/resolved-dns-transaction.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c +index f937f9f7b5..7deb598400 100644 +--- a/src/resolve/resolved-dns-transaction.c ++++ b/src/resolve/resolved-dns-transaction.c +@@ -2761,7 +2761,7 @@ static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord * + if (r == 0) + continue; + +- return FLAGS_SET(t->answer_query_flags, SD_RESOLVED_AUTHENTICATED); ++ return FLAGS_SET(dt->answer_query_flags, SD_RESOLVED_AUTHENTICATED); + } + + return true; +@@ -2788,7 +2788,7 @@ static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord * + /* We found the transaction that was supposed to find the SOA RR for us. It was + * successful, but found no RR for us. This means we are not at a zone cut. In this + * case, we require authentication if the SOA lookup was authenticated too. */ +- return FLAGS_SET(t->answer_query_flags, SD_RESOLVED_AUTHENTICATED); ++ return FLAGS_SET(dt->answer_query_flags, SD_RESOLVED_AUTHENTICATED); + } + + return true; +-- +2.25.1 + diff --git a/meta/recipes-core/systemd/systemd/fix-vlan-qos-mapping.patch b/meta/recipes-core/systemd/systemd/fix-vlan-qos-mapping.patch new file mode 100644 index 0000000000..c530de7f50 --- /dev/null +++ b/meta/recipes-core/systemd/systemd/fix-vlan-qos-mapping.patch @@ -0,0 +1,140 @@ +From 4d13d175f8454df63843a880c78badd4f6d720ca Mon Sep 17 00:00:00 2001 +From: Yu Watanabe <watanabe.yu+github@gmail.com> +Date: Wed, 24 May 2023 11:02:36 +0900 +Subject: [PATCH 1/3] network/vlan: drop unnecessary restriction for QoS + mapping + +Fixes #27460. + +Upstream-Status: Backport [https://github.com/systemd/systemd/commit/fe830b84d4002582e7aefb16e5e09fd0195f21c8.patch] +Signed-off-by: Sana Kazi <sana.kazi@kpit.com> +--- + src/network/netdev/vlan.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/src/network/netdev/vlan.c b/src/network/netdev/vlan.c +index a3d961dac3ca4..d61e9486abc47 100644 +--- a/src/network/netdev/vlan.c ++++ b/src/network/netdev/vlan.c +@@ -165,11 +165,6 @@ int config_parse_vlan_qos_maps( + continue; + } + +- if (m->to > m->from || m->to == 0 || m->from == 0) { +- log_syntax(unit, LOG_WARNING, filename, line, 0, "Invalid %s, ignoring: %s", lvalue, w); +- continue; +- } +- + r = set_ensure_consume(s, &vlan_qos_maps_hash_ops, TAKE_PTR(m)); + if (r < 0) { + log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to store %s, ignoring: %s", lvalue, w); + +From 4194478af861f80a73905d1f9e570a09862f91a7 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe <watanabe.yu+github@gmail.com> +Date: Wed, 24 May 2023 11:06:35 +0900 +Subject: [PATCH 2/3] network/vlan: paranoia about type safety + +No functional change, as the struct is defined as the following: +``` +struct ifla_vlan_qos_mapping { + __u32 from; + __u32 to; +}; +``` +--- + src/network/netdev/vlan.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/src/network/netdev/vlan.c b/src/network/netdev/vlan.c +index d61e9486abc47..5eb36ef6801f3 100644 +--- a/src/network/netdev/vlan.c ++++ b/src/network/netdev/vlan.c +@@ -144,6 +144,7 @@ int config_parse_vlan_qos_maps( + for (const char *p = rvalue;;) { + _cleanup_free_ struct ifla_vlan_qos_mapping *m = NULL; + _cleanup_free_ char *w = NULL; ++ unsigned from, to; + + r = extract_first_word(&p, &w, NULL, EXTRACT_CUNESCAPE|EXTRACT_UNQUOTE); + if (r == -ENOMEM) +@@ -155,16 +156,21 @@ int config_parse_vlan_qos_maps( + if (r == 0) + return 0; + +- m = new0(struct ifla_vlan_qos_mapping, 1); +- if (!m) +- return log_oom(); +- +- r = parse_range(w, &m->from, &m->to); ++ r = parse_range(w, &from, &to); + if (r < 0) { + log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to parse %s, ignoring: %s", lvalue, w); + continue; + } + ++ m = new(struct ifla_vlan_qos_mapping, 1); ++ if (!m) ++ return log_oom(); ++ ++ *m = (struct ifla_vlan_qos_mapping) { ++ .from = from, ++ .to = to, ++ }; ++ + r = set_ensure_consume(s, &vlan_qos_maps_hash_ops, TAKE_PTR(m)); + if (r < 0) { + log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to store %s, ignoring: %s", lvalue, w); + +From 73d24e45f8ac18eaaebf1df2b1f055c14179c6ff Mon Sep 17 00:00:00 2001 +From: Yu Watanabe <watanabe.yu+github@gmail.com> +Date: Wed, 24 May 2023 11:15:44 +0900 +Subject: [PATCH 3/3] test-network: add tests for vlan QoS mapping + +--- + .../conf/21-vlan.netdev.d/override.conf | 10 ++++++---- + test/test-network/systemd-networkd-tests.py | 14 ++++++++------ + 2 files changed, 14 insertions(+), 10 deletions(-) + +diff --git a/test/test-network/conf/21-vlan.netdev.d/override.conf b/test/test-network/conf/21-vlan.netdev.d/override.conf +index 3b8d47d9b1db5..c71077d274a69 100644 +--- a/test/test-network/conf/21-vlan.netdev.d/override.conf ++++ b/test/test-network/conf/21-vlan.netdev.d/override.conf +@@ -3,7 +3,9 @@ MTUBytes=2000 + + [VLAN] + Id=99 +-GVRP=true +-MVRP=true +-LooseBinding=true +-ReorderHeader=true ++GVRP=yes ++MVRP=yes ++LooseBinding=yes ++ReorderHeader=yes ++EgressQOSMaps=0-1 1-3 10-3 6-6 7-7 ++IngressQOSMaps=15-13 20-100 +diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py +index fe72f37ce4f47..8b01718d55e64 100755 +--- a/test/test-network/systemd-networkd-tests.py ++++ b/test/test-network/systemd-networkd-tests.py +@@ -1285,12 +1285,14 @@ def test_vlan(self): + + output = check_output('ip -d link show vlan99') + print(output) +- self.assertRegex(output, ' mtu 2000 ') +- self.assertRegex(output, 'REORDER_HDR') +- self.assertRegex(output, 'LOOSE_BINDING') +- self.assertRegex(output, 'GVRP') +- self.assertRegex(output, 'MVRP') +- self.assertRegex(output, ' id 99 ') ++ self.assertIn(' mtu 2000 ', output) ++ self.assertIn('REORDER_HDR', output) ++ self.assertIn('LOOSE_BINDING', output) ++ self.assertIn('GVRP', output) ++ self.assertIn('MVRP', output) ++ self.assertIn(' id 99 ', output) ++ self.assertIn('ingress-qos-map { 4:100 7:13 }', output) ++ self.assertIn('egress-qos-map { 0:1 1:3 6:6 7:7 10:3 }', output) + + output = check_output('ip -4 address show dev test1') + print(output) diff --git a/meta/recipes-core/systemd/systemd_250.5.bb b/meta/recipes-core/systemd/systemd_250.5.bb index 7df7bca4cc..4d520c85f3 100644 --- a/meta/recipes-core/systemd/systemd_250.5.bb +++ b/meta/recipes-core/systemd/systemd_250.5.bb @@ -28,6 +28,12 @@ SRC_URI += "file://touchscreen.rules \ file://CVE-2022-3821.patch \ file://CVE-2022-45873.patch \ file://0001-shared-json-allow-json_variant_dump-to-return-an-err.patch \ + file://CVE-2022-4415-1.patch \ + file://CVE-2022-4415-2.patch \ + file://0001-network-remove-only-managed-configs-on-reconfigure-o.patch \ + file://0001-nspawn-make-sure-host-root-can-write-to-the-uidmappe.patch \ + file://CVE-2023-7008.patch \ + file://fix-vlan-qos-mapping.patch \ " # patches needed by musl @@ -221,7 +227,7 @@ rootlibdir ?= "${base_libdir}" rootlibexecdir = "${rootprefix}/lib" EXTRA_OEMESON += "-Dnobody-user=nobody \ - -Dnobody-group=nobody \ + -Dnobody-group=nogroup \ -Drootlibdir=${rootlibdir} \ -Drootprefix=${rootprefix} \ -Ddefault-locale=C \ @@ -397,7 +403,7 @@ USERADD_PACKAGES = "${PN} ${PN}-extra-utils \ ${@bb.utils.contains('PACKAGECONFIG', 'journal-upload', '${PN}-journal-upload', '', d)} \ " GROUPADD_PARAM:${PN} = "-r systemd-journal;" -GROUPADD_PARAM:udev = "-r render" +GROUPADD_PARAM:udev = "-r render;-r sgx;" GROUPADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit_hostnamed_fallback', '-r systemd-hostname;', '', d)}" USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'coredump', '--system -d / -M --shell /sbin/nologin systemd-coredump;', '', d)}" USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'networkd', '--system -d / -M --shell /sbin/nologin systemd-network;', '', d)}" @@ -771,15 +777,19 @@ ALTERNATIVE_LINK_NAME[runlevel] = "${base_sbindir}/runlevel" ALTERNATIVE_PRIORITY[runlevel] ?= "300" pkg_postinst:${PN}:libc-glibc () { - sed -e '/^hosts:/s/\s*\<myhostname\>//' \ - -e 's/\(^hosts:.*\)\(\<files\>\)\(.*\)\(\<dns\>\)\(.*\)/\1\2 myhostname \3\4\5/' \ - -i $D${sysconfdir}/nsswitch.conf + if ${@bb.utils.contains('PACKAGECONFIG', 'myhostname', 'true', 'false', d)}; then + sed -e '/^hosts:/s/\s*\<myhostname\>//' \ + -e 's/\(^hosts:.*\)\(\<files\>\)\(.*\)\(\<dns\>\)\(.*\)/\1\2 myhostname \3\4\5/' \ + -i $D${sysconfdir}/nsswitch.conf + fi } pkg_prerm:${PN}:libc-glibc () { - sed -e '/^hosts:/s/\s*\<myhostname\>//' \ - -e '/^hosts:/s/\s*myhostname//' \ - -i $D${sysconfdir}/nsswitch.conf + if ${@bb.utils.contains('PACKAGECONFIG', 'myhostname', 'true', 'false', d)}; then + sed -e '/^hosts:/s/\s*\<myhostname\>//' \ + -e '/^hosts:/s/\s*myhostname//' \ + -i $D${sysconfdir}/nsswitch.conf + fi } PACKAGE_WRITE_DEPS += "qemu-native" diff --git a/meta/recipes-core/util-linux/util-linux_2.37.4.bb b/meta/recipes-core/util-linux/util-linux_2.37.4.bb index f6d3ea2bc1..8866120eed 100644 --- a/meta/recipes-core/util-linux/util-linux_2.37.4.bb +++ b/meta/recipes-core/util-linux/util-linux_2.37.4.bb @@ -233,6 +233,8 @@ ALTERNATIVE_TARGET[getty] = "${base_sbindir}/agetty" ALTERNATIVE_LINK_NAME[hexdump] = "${bindir}/hexdump" ALTERNATIVE_LINK_NAME[hwclock] = "${base_sbindir}/hwclock" ALTERNATIVE_LINK_NAME[ionice] = "${bindir}/ionice" +ALTERNATIVE_LINK_NAME[ipcrm] = "${bindir}/ipcrm" +ALTERNATIVE_LINK_NAME[ipcs] = "${bindir}/ipcs" ALTERNATIVE_LINK_NAME[kill] = "${base_bindir}/kill" ALTERNATIVE:${PN}-last = "last lastb" ALTERNATIVE_LINK_NAME[last] = "${bindir}/last" diff --git a/meta/recipes-core/zlib/zlib/CVE-2023-45853.patch b/meta/recipes-core/zlib/zlib/CVE-2023-45853.patch new file mode 100644 index 0000000000..ba3709249b --- /dev/null +++ b/meta/recipes-core/zlib/zlib/CVE-2023-45853.patch @@ -0,0 +1,42 @@ +From 73331a6a0481067628f065ffe87bb1d8f787d10c Mon Sep 17 00:00:00 2001 +From: Hans Wennborg <hans@chromium.org> +Date: Fri, 18 Aug 2023 11:05:33 +0200 +Subject: [PATCH] Reject overflows of zip header fields in minizip. + +This checks the lengths of the file name, extra field, and comment +that would be put in the zip headers, and rejects them if they are +too long. They are each limited to 65535 bytes in length by the zip +format. This also avoids possible buffer overflows if the provided +fields are too long. + +CVE: CVE-2023-45853 +Upstream-Status: Backport [https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> + +--- + contrib/minizip/zip.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c +index 3d3d4cadd..0446109b2 100644 +--- a/contrib/minizip/zip.c ++++ b/contrib/minizip/zip.c +@@ -1043,6 +1043,17 @@ extern int ZEXPORT zipOpenNewFileInZip4_64(zipFile file, const char* filename, c + return ZIP_PARAMERROR; + #endif + ++ // The filename and comment length must fit in 16 bits. ++ if ((filename!=NULL) && (strlen(filename)>0xffff)) ++ return ZIP_PARAMERROR; ++ if ((comment!=NULL) && (strlen(comment)>0xffff)) ++ return ZIP_PARAMERROR; ++ // The extra field length must fit in 16 bits. If the member also requires ++ // a Zip64 extra block, that will also need to fit within that 16-bit ++ // length, but that will be checked for later. ++ if ((size_extrafield_local>0xffff) || (size_extrafield_global>0xffff)) ++ return ZIP_PARAMERROR; ++ + zi = (zip64_internal*)file; + + if (zi->in_opened_file_inzip == 1) diff --git a/meta/recipes-core/zlib/zlib_1.2.11.bb b/meta/recipes-core/zlib/zlib_1.2.11.bb index f768b41988..393ac61e3d 100644 --- a/meta/recipes-core/zlib/zlib_1.2.11.bb +++ b/meta/recipes-core/zlib/zlib_1.2.11.bb @@ -12,6 +12,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/libpng/${BPN}/${PV}/${BPN}-${PV}.tar.xz \ file://CVE-2018-25032.patch \ file://run-ptest \ file://CVE-2022-37434.patch \ + file://CVE-2023-45853.patch \ " UPSTREAM_CHECK_URI = "http://zlib.net/" @@ -53,3 +54,6 @@ do_install:append:class-target() { } BBCLASSEXTEND = "native nativesdk" + +# this CVE is for cloudflare zlib +CVE_CHECK_IGNORE += "CVE-2023-6992" diff --git a/meta/recipes-devtools/apt/apt/0001-add-missing-cstdint-for-uint16_t.patch b/meta/recipes-devtools/apt/apt/0001-add-missing-cstdint-for-uint16_t.patch new file mode 100644 index 0000000000..44aa8a5873 --- /dev/null +++ b/meta/recipes-devtools/apt/apt/0001-add-missing-cstdint-for-uint16_t.patch @@ -0,0 +1,35 @@ +From 960d10e89cf60d39998dae6fdcd4f0866b753a79 Mon Sep 17 00:00:00 2001 +From: Khem Raj <raj.khem@gmail.com> +Date: Mon, 23 Jan 2023 12:31:35 -0800 +Subject: [PATCH] add missing <cstdint> for uint16_t + +This fixes build problems with gcc 13 snapshot [1] + +Fixes +| include/apt-pkg/pkgcache.h:257:23: warning: cast from 'char*' to 'const uint16_t*' {aka 'const short unsigned int*'} increases required alignment of target type [-Wcast-align] +| 257 | uint16_t len = *reinterpret_cast<const uint16_t*>(name - sizeof(uint16_t)); +| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +[1] https://www.gnu.org/software/gcc/gcc-13/porting_to.html + +Upstream-Status: Submitted [https://salsa.debian.org/apt-team/apt/-/merge_requests/276] +Signed-off-by: Khem Raj <raj.khem@gmail.com> +--- + apt-pkg/contrib/mmap.cc | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/apt-pkg/contrib/mmap.cc b/apt-pkg/contrib/mmap.cc +index 642e20473..0568e1cd0 100644 +--- a/apt-pkg/contrib/mmap.cc ++++ b/apt-pkg/contrib/mmap.cc +@@ -23,6 +23,7 @@ + #include <apt-pkg/macros.h> + #include <apt-pkg/mmap.h> + ++#include <cstdint> + #include <cstring> + #include <string> + #include <errno.h> +-- +2.39.1 + diff --git a/meta/recipes-devtools/apt/apt_2.4.5.bb b/meta/recipes-devtools/apt/apt_2.4.5.bb index b5ada2ef55..9ceabcc186 100644 --- a/meta/recipes-devtools/apt/apt_2.4.5.bb +++ b/meta/recipes-devtools/apt/apt_2.4.5.bb @@ -13,6 +13,7 @@ SRC_URI = "${DEBIAN_MIRROR}/main/a/apt/${BPN}_${PV}.tar.xz \ file://0001-cmake-Do-not-build-po-files.patch \ file://0001-Hide-fstatat64-and-prlimit64-defines-on-musl.patch \ file://0001-aptwebserver.cc-Include-array.patch \ + file://0001-add-missing-cstdint-for-uint16_t.patch \ " SRC_URI:append:class-native = " \ @@ -117,6 +118,7 @@ do_install:append:class-native() { do_install:append:class-nativesdk() { customize_apt_conf_sample + rm -rf ${D}${localstatedir}/log } do_install:append:class-target() { diff --git a/meta/recipes-devtools/automake/automake/buildtest.patch b/meta/recipes-devtools/automake/automake/buildtest.patch index b88b9e8693..c43a4ac8f3 100644 --- a/meta/recipes-devtools/automake/automake/buildtest.patch +++ b/meta/recipes-devtools/automake/automake/buildtest.patch @@ -36,7 +36,7 @@ index e0db651..de137fa 100644 -check-TESTS: $(TESTS) +AM_RECURSIVE_TARGETS += buildtest runtest + -+buildtest-TESTS: $(TESTS) ++buildtest-TESTS: $(TESTS) $(check_PROGRAMS) + +check-TESTS: buildtest-TESTS + $(MAKE) $(AM_MAKEFLAGS) runtest-TESTS diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc index 0a4a0d7bc1..bbe7bb57b2 100644 --- a/meta/recipes-devtools/binutils/binutils-2.38.inc +++ b/meta/recipes-devtools/binutils/binutils-2.38.inc @@ -18,7 +18,7 @@ SRCBRANCH ?= "binutils-2_38-branch" UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P<pver>\d+_(\d_?)*)" -SRCREV ?= "dc2474e7d204c124ab5a21b4490aa46eb7e1d4c3" +SRCREV ?= "ea5fe5d01e5a182ee7a0eddb54a702109a9f5931" BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=git" SRC_URI = "\ ${BINUTILS_GIT_URI} \ @@ -43,5 +43,33 @@ SRC_URI = "\ file://0018-CVE-2022-38128-2.patch \ file://0018-CVE-2022-38128-3.patch \ file://0019-CVE-2022-4285.patch \ + file://0020-CVE-2023-22608-1.patch \ + file://0020-CVE-2023-22608-2.patch \ + file://0020-CVE-2023-22608-3.patch \ + file://0021-CVE-2023-1579-1.patch \ + file://0021-CVE-2023-1579-2.patch \ + file://0021-CVE-2023-1579-3.patch \ + file://0021-CVE-2023-1579-4.patch \ + file://0022-CVE-2023-25584-1.patch \ + file://0022-CVE-2023-25584-2.patch \ + file://0022-CVE-2023-25584-3.patch \ + file://0023-CVE-2023-25585.patch \ + file://0026-CVE-2023-1972.patch \ + file://0025-CVE-2023-25588.patch \ + file://0027-CVE-2022-47008.patch \ + file://0028-CVE-2022-47011.patch \ + file://0029-CVE-2022-48065-1.patch \ + file://0029-CVE-2022-48065-2.patch \ + file://0029-CVE-2022-48065-3.patch \ + file://0030-CVE-2022-44840.patch \ + file://0031-CVE-2022-45703-1.patch \ + file://0031-CVE-2022-45703-2.patch \ + file://0031-CVE-2022-47695.patch \ + file://CVE-2022-48063.patch \ + file://0032-CVE-2022-47010.patch \ + file://0033-CVE-2022-47007.patch \ + file://0034-CVE-2022-48064.patch \ + file://0035-CVE-2023-39129.patch \ + file://0036-CVE-2023-39130.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/0003-binutils-nativesdk-Search-for-alternative-ld.so.conf.patch b/meta/recipes-devtools/binutils/binutils/0003-binutils-nativesdk-Search-for-alternative-ld.so.conf.patch index 59a97c13c7..8a5f4a8d79 100644 --- a/meta/recipes-devtools/binutils/binutils/0003-binutils-nativesdk-Search-for-alternative-ld.so.conf.patch +++ b/meta/recipes-devtools/binutils/binutils/0003-binutils-nativesdk-Search-for-alternative-ld.so.conf.patch @@ -65,7 +65,7 @@ index 121c25d948f..34cbc60e5e9 100644 info.path = NULL; info.len = info.alloc = 0; - tmppath = concat (ld_sysroot, prefix, "/etc/ld.so.conf", -+ tmppath = concat (ld_sysconfdir, "/etc/ld.so.conf", ++ tmppath = concat (ld_sysconfdir, "/ld.so.conf", (const char *) NULL); if (!ldelf_parse_ld_so_conf (&info, tmppath)) { diff --git a/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-1.patch b/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-1.patch new file mode 100644 index 0000000000..18d4ac5f9d --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-1.patch @@ -0,0 +1,506 @@ +From 116aac1447ee92df25599859293752648e3c6ea0 Mon Sep 17 00:00:00 2001 +From: "Steinar H. Gunderson" <sesse@google.com> +Date: Fri, 20 May 2022 16:10:34 +0200 +Subject: [PATCH] add a trie to map quickly from address range to compilation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + + unit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When using perf to profile large binaries, _bfd_dwarf2_find_nearest_line() +becomes a hotspot, as perf wants to get line number information +(for inline-detection purposes) for each and every sample. In Chromium +in particular (the content_shell binary), this entails going through +475k address ranges, which takes a long time when done repeatedly. + +Add a radix-256 trie over the address space to quickly map address to +compilation unit spaces; for content_shell, which is 1.6 GB when some +(but not full) debug information turned is on, we go from 6 ms to +0.006 ms (6 µs) for each lookup from address to compilation unit, a 1000x +speedup. + +There is a modest RAM increase of 180 MB in this binary (the existing +linked list over ranges uses about 10 MB, and the entire perf job uses +between 2-3 GB for a medium-size profile); for smaller binaries with few +ranges, there should be hardly any extra RAM usage at all. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=b43771b045fb5616da3964f2994eefbe8ae70d32] + +CVE: CVE-2023-22608 + +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> + +--- + bfd/dwarf2.c | 326 ++++++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 312 insertions(+), 14 deletions(-) + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index fdf071c3..0ae50a37 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -82,6 +82,77 @@ struct adjusted_section + bfd_vma adj_vma; + }; + ++/* A trie to map quickly from address range to compilation unit. ++ ++ This is a fairly standard radix-256 trie, used to quickly locate which ++ compilation unit any given address belongs to. Given that each compilation ++ unit may register hundreds of very small and unaligned ranges (which may ++ potentially overlap, due to inlining and other concerns), and a large ++ program may end up containing hundreds of thousands of such ranges, we cannot ++ scan through them linearly without undue slowdown. ++ ++ We use a hybrid trie to avoid memory explosion: There are two types of trie ++ nodes, leaves and interior nodes. (Almost all nodes are leaves, so they ++ take up the bulk of the memory usage.) Leaves contain a simple array of ++ ranges (high/low address) and which compilation unit contains those ranges, ++ and when we get to a leaf, we scan through it linearly. Interior nodes ++ contain pointers to 256 other nodes, keyed by the next byte of the address. ++ So for a 64-bit address like 0x1234567abcd, we would start at the root and go ++ down child[0x00]->child[0x00]->child[0x01]->child[0x23]->child[0x45] etc., ++ until we hit a leaf. (Nodes are, in general, leaves until they exceed the ++ default allocation of 16 elements, at which point they are converted to ++ interior node if possible.) This gives us near-constant lookup times; ++ the only thing that can be costly is if there are lots of overlapping ranges ++ within a single 256-byte segment of the binary, in which case we have to ++ scan through them all to find the best match. ++ ++ For a binary with few ranges, we will in practice only have a single leaf ++ node at the root, containing a simple array. Thus, the scheme is efficient ++ for both small and large binaries. ++ */ ++ ++/* Experiments have shown 16 to be a memory-efficient default leaf size. ++ The only case where a leaf will hold more memory than this, is at the ++ bottomost level (covering 256 bytes in the binary), where we'll expand ++ the leaf to be able to hold more ranges if needed. ++ */ ++#define TRIE_LEAF_SIZE 16 ++ ++/* All trie_node pointers will really be trie_leaf or trie_interior, ++ but they have this common head. */ ++struct trie_node ++{ ++ /* If zero, we are an interior node. ++ Otherwise, how many ranges we have room for in this leaf. */ ++ unsigned int num_room_in_leaf; ++}; ++ ++struct trie_leaf ++{ ++ struct trie_node head; ++ unsigned int num_stored_in_leaf; ++ struct { ++ struct comp_unit *unit; ++ bfd_vma low_pc, high_pc; ++ } ranges[TRIE_LEAF_SIZE]; ++}; ++ ++struct trie_interior ++{ ++ struct trie_node head; ++ struct trie_node *children[256]; ++}; ++ ++static struct trie_node *alloc_trie_leaf (bfd *abfd) ++{ ++ struct trie_leaf *leaf = ++ bfd_zalloc (abfd, sizeof (struct trie_leaf)); ++ if (leaf == NULL) ++ return NULL; ++ leaf->head.num_room_in_leaf = TRIE_LEAF_SIZE; ++ return &leaf->head; ++} ++ + struct dwarf2_debug_file + { + /* The actual bfd from which debug info was loaded. Might be +@@ -139,6 +210,9 @@ struct dwarf2_debug_file + /* A list of all previously read comp_units. */ + struct comp_unit *all_comp_units; + ++ /* A list of all previously read comp_units with no ranges (yet). */ ++ struct comp_unit *all_comp_units_without_ranges; ++ + /* Last comp unit in list above. */ + struct comp_unit *last_comp_unit; + +@@ -147,6 +221,9 @@ struct dwarf2_debug_file + + /* Hash table to map offsets to decoded abbrevs. */ + htab_t abbrev_offsets; ++ ++ /* Root of a trie to map addresses to compilation units. */ ++ struct trie_node *trie_root; + }; + + struct dwarf2_debug +@@ -220,6 +297,11 @@ struct comp_unit + /* Chain the previously read compilation units. */ + struct comp_unit *next_unit; + ++ /* Chain the previously read compilation units that have no ranges yet. ++ We scan these separately when we have a trie over the ranges. ++ Unused if arange.high != 0. */ ++ struct comp_unit *next_unit_without_ranges; ++ + /* Likewise, chain the compilation unit read after this one. + The comp units are stored in reversed reading order. */ + struct comp_unit *prev_unit; +@@ -296,6 +378,10 @@ struct comp_unit + + /* TRUE if symbols are cached in hash table for faster lookup by name. */ + bool cached; ++ ++ /* Used when iterating over trie leaves to know which units we have ++ already seen in this iteration. */ ++ bool mark; + }; + + /* This data structure holds the information of an abbrev. */ +@@ -1766,9 +1852,189 @@ concat_filename (struct line_info_table *table, unsigned int file) + return strdup (filename); + } + ++/* Number of bits in a bfd_vma. */ ++#define VMA_BITS (8 * sizeof (bfd_vma)) ++ ++/* Check whether [low1, high1) can be combined with [low2, high2), ++ i.e., they touch or overlap. */ ++static bool ranges_overlap (bfd_vma low1, ++ bfd_vma high1, ++ bfd_vma low2, ++ bfd_vma high2) ++{ ++ if (low1 == low2 || high1 == high2) ++ return true; ++ ++ /* Sort so that low1 is below low2. */ ++ if (low1 > low2) ++ { ++ bfd_vma tmp; ++ ++ tmp = low1; ++ low1 = low2; ++ low2 = tmp; ++ ++ tmp = high1; ++ high1 = high2; ++ high2 = tmp; ++ } ++ ++ /* We touch iff low2 == high1. ++ We overlap iff low2 is within [low1, high1). */ ++ return (low2 <= high1); ++} ++ ++/* Insert an address range in the trie mapping addresses to compilation units. ++ Will return the new trie node (usually the same as is being sent in, but ++ in case of a leaf-to-interior conversion, or expansion of a leaf, it may be ++ different), or NULL on failure. ++ */ ++static struct trie_node *insert_arange_in_trie(bfd *abfd, ++ struct trie_node *trie, ++ bfd_vma trie_pc, ++ unsigned int trie_pc_bits, ++ struct comp_unit *unit, ++ bfd_vma low_pc, ++ bfd_vma high_pc) ++{ ++ bfd_vma clamped_low_pc, clamped_high_pc; ++ int ch, from_ch, to_ch; ++ bool is_full_leaf = false; ++ ++ /* See if we can extend any of the existing ranges. This merging ++ isn't perfect (if merging opens up the possibility of merging two existing ++ ranges, we won't find them), but it takes the majority of the cases. */ ++ if (trie->num_room_in_leaf > 0) ++ { ++ struct trie_leaf *leaf = (struct trie_leaf *) trie; ++ unsigned int i; ++ ++ for (i = 0; i < leaf->num_stored_in_leaf; ++i) ++ { ++ if (leaf->ranges[i].unit == unit && ++ ranges_overlap(low_pc, high_pc, ++ leaf->ranges[i].low_pc, leaf->ranges[i].high_pc)) ++ { ++ if (low_pc < leaf->ranges[i].low_pc) ++ leaf->ranges[i].low_pc = low_pc; ++ if (high_pc > leaf->ranges[i].high_pc) ++ leaf->ranges[i].high_pc = high_pc; ++ return trie; ++ } ++ } ++ ++ is_full_leaf = leaf->num_stored_in_leaf == trie->num_room_in_leaf; ++ } ++ ++ /* If we're a leaf with no more room and we're _not_ at the bottom, ++ convert to an interior node. */ ++ if (is_full_leaf && trie_pc_bits < VMA_BITS) ++ { ++ const struct trie_leaf *leaf = (struct trie_leaf *) trie; ++ unsigned int i; ++ ++ trie = bfd_zalloc (abfd, sizeof (struct trie_interior)); ++ if (!trie) ++ return NULL; ++ is_full_leaf = false; ++ ++ /* TODO: If we wanted to save a little more memory at the cost of ++ complexity, we could have reused the old leaf node as one of the ++ children of the new interior node, instead of throwing it away. */ ++ for (i = 0; i < leaf->num_stored_in_leaf; ++i) ++ { ++ if (!insert_arange_in_trie (abfd, trie, trie_pc, trie_pc_bits, ++ leaf->ranges[i].unit, leaf->ranges[i].low_pc, ++ leaf->ranges[i].high_pc)) ++ return NULL; ++ } ++ } ++ ++ /* If we're a leaf with no more room and we _are_ at the bottom, ++ we have no choice but to just make it larger. */ ++ if (is_full_leaf) ++ { ++ const struct trie_leaf *leaf = (struct trie_leaf *) trie; ++ unsigned int new_room_in_leaf = trie->num_room_in_leaf * 2; ++ struct trie_leaf *new_leaf; ++ ++ new_leaf = bfd_zalloc (abfd, ++ sizeof (struct trie_leaf) + ++ (new_room_in_leaf - TRIE_LEAF_SIZE) * sizeof (leaf->ranges[0])); ++ new_leaf->head.num_room_in_leaf = new_room_in_leaf; ++ new_leaf->num_stored_in_leaf = leaf->num_stored_in_leaf; ++ ++ memcpy (new_leaf->ranges, ++ leaf->ranges, ++ leaf->num_stored_in_leaf * sizeof (leaf->ranges[0])); ++ trie = &new_leaf->head; ++ is_full_leaf = false; ++ ++ /* Now the insert below will go through. */ ++ } ++ ++ /* If we're a leaf (now with room), we can just insert at the end. */ ++ if (trie->num_room_in_leaf > 0) ++ { ++ struct trie_leaf *leaf = (struct trie_leaf *) trie; ++ ++ unsigned int i = leaf->num_stored_in_leaf++; ++ leaf->ranges[i].unit = unit; ++ leaf->ranges[i].low_pc = low_pc; ++ leaf->ranges[i].high_pc = high_pc; ++ return trie; ++ } ++ ++ /* Now we are definitely an interior node, so recurse into all ++ the relevant buckets. */ ++ ++ /* Clamp the range to the current trie bucket. */ ++ clamped_low_pc = low_pc; ++ clamped_high_pc = high_pc; ++ if (trie_pc_bits > 0) ++ { ++ bfd_vma bucket_high_pc = ++ trie_pc + ((bfd_vma)-1 >> trie_pc_bits); /* Inclusive. */ ++ if (clamped_low_pc < trie_pc) ++ clamped_low_pc = trie_pc; ++ if (clamped_high_pc > bucket_high_pc) ++ clamped_high_pc = bucket_high_pc; ++ } ++ ++ /* Insert the ranges in all buckets that it spans. */ ++ from_ch = (clamped_low_pc >> (VMA_BITS - trie_pc_bits - 8)) & 0xff; ++ to_ch = ((clamped_high_pc - 1) >> (VMA_BITS - trie_pc_bits - 8)) & 0xff; ++ for (ch = from_ch; ch <= to_ch; ++ch) ++ { ++ struct trie_interior *interior = (struct trie_interior *) trie; ++ struct trie_node *child = interior->children[ch]; ++ ++ if (child == NULL) ++ { ++ child = alloc_trie_leaf (abfd); ++ if (!child) ++ return NULL; ++ } ++ child = insert_arange_in_trie (abfd, ++ child, ++ trie_pc + ((bfd_vma)ch << (VMA_BITS - trie_pc_bits - 8)), ++ trie_pc_bits + 8, ++ unit, ++ low_pc, ++ high_pc); ++ if (!child) ++ return NULL; ++ ++ interior->children[ch] = child; ++ } ++ ++ return trie; ++} ++ ++ + static bool +-arange_add (const struct comp_unit *unit, struct arange *first_arange, +- bfd_vma low_pc, bfd_vma high_pc) ++arange_add (struct comp_unit *unit, struct arange *first_arange, ++ struct trie_node **trie_root, bfd_vma low_pc, bfd_vma high_pc) + { + struct arange *arange; + +@@ -1776,6 +2042,19 @@ arange_add (const struct comp_unit *unit, struct arange *first_arange, + if (low_pc == high_pc) + return true; + ++ if (trie_root != NULL) ++ { ++ *trie_root = insert_arange_in_trie (unit->file->bfd_ptr, ++ *trie_root, ++ 0, ++ 0, ++ unit, ++ low_pc, ++ high_pc); ++ if (*trie_root == NULL) ++ return false; ++ } ++ + /* If the first arange is empty, use it. */ + if (first_arange->high == 0) + { +@@ -2410,7 +2689,8 @@ decode_line_info (struct comp_unit *unit) + low_pc = address; + if (address > high_pc) + high_pc = address; +- if (!arange_add (unit, &unit->arange, low_pc, high_pc)) ++ if (!arange_add (unit, &unit->arange, &unit->file->trie_root, ++ low_pc, high_pc)) + goto line_fail; + break; + case DW_LNE_set_address: +@@ -3134,7 +3414,7 @@ find_abstract_instance (struct comp_unit *unit, + + static bool + read_ranges (struct comp_unit *unit, struct arange *arange, +- bfd_uint64_t offset) ++ struct trie_node **trie_root, bfd_uint64_t offset) + { + bfd_byte *ranges_ptr; + bfd_byte *ranges_end; +@@ -3169,7 +3449,7 @@ read_ranges (struct comp_unit *unit, struct arange *arange, + base_address = high_pc; + else + { +- if (!arange_add (unit, arange, ++ if (!arange_add (unit, arange, trie_root, + base_address + low_pc, base_address + high_pc)) + return false; + } +@@ -3179,7 +3459,7 @@ read_ranges (struct comp_unit *unit, struct arange *arange, + + static bool + read_rnglists (struct comp_unit *unit, struct arange *arange, +- bfd_uint64_t offset) ++ struct trie_node **trie_root, bfd_uint64_t offset) + { + bfd_byte *rngs_ptr; + bfd_byte *rngs_end; +@@ -3253,19 +3533,19 @@ read_rnglists (struct comp_unit *unit, struct arange *arange, + return false; + } + +- if (!arange_add (unit, arange, low_pc, high_pc)) ++ if (!arange_add (unit, arange, trie_root, low_pc, high_pc)) + return false; + } + } + + static bool + read_rangelist (struct comp_unit *unit, struct arange *arange, +- bfd_uint64_t offset) ++ struct trie_node **trie_root, bfd_uint64_t offset) + { + if (unit->version <= 4) +- return read_ranges (unit, arange, offset); ++ return read_ranges (unit, arange, trie_root, offset); + else +- return read_rnglists (unit, arange, offset); ++ return read_rnglists (unit, arange, trie_root, offset); + } + + static struct funcinfo * +@@ -3563,7 +3843,8 @@ scan_unit_for_symbols (struct comp_unit *unit) + + case DW_AT_ranges: + if (is_int_form (&attr) +- && !read_rangelist (unit, &func->arange, attr.u.val)) ++ && !read_rangelist (unit, &func->arange, ++ &unit->file->trie_root, attr.u.val)) + goto fail; + break; + +@@ -3679,7 +3960,8 @@ scan_unit_for_symbols (struct comp_unit *unit) + + if (func && high_pc != 0) + { +- if (!arange_add (unit, &func->arange, low_pc, high_pc)) ++ if (!arange_add (unit, &func->arange, &unit->file->trie_root, ++ low_pc, high_pc)) + goto fail; + } + } +@@ -3874,7 +4156,8 @@ parse_comp_unit (struct dwarf2_debug *stash, + + case DW_AT_ranges: + if (is_int_form (&attr) +- && !read_rangelist (unit, &unit->arange, attr.u.val)) ++ && !read_rangelist (unit, &unit->arange, ++ &unit->file->trie_root, attr.u.val)) + return NULL; + break; + +@@ -3916,7 +4199,8 @@ parse_comp_unit (struct dwarf2_debug *stash, + high_pc += low_pc; + if (high_pc != 0) + { +- if (!arange_add (unit, &unit->arange, low_pc, high_pc)) ++ if (!arange_add (unit, &unit->arange, &unit->file->trie_root, ++ low_pc, high_pc)) + return NULL; + } + +@@ -4747,6 +5031,14 @@ _bfd_dwarf2_slurp_debug_info (bfd *abfd, bfd *debug_bfd, + if (!stash->alt.abbrev_offsets) + return false; + ++ stash->f.trie_root = alloc_trie_leaf (abfd); ++ if (!stash->f.trie_root) ++ return false; ++ ++ stash->alt.trie_root = alloc_trie_leaf (abfd); ++ if (!stash->alt.trie_root) ++ return false; ++ + *pinfo = stash; + + if (debug_bfd == NULL) +@@ -4918,6 +5210,12 @@ stash_comp_unit (struct dwarf2_debug *stash, struct dwarf2_debug_file *file) + each->next_unit = file->all_comp_units; + file->all_comp_units = each; + ++ if (each->arange.high == 0) ++ { ++ each->next_unit_without_ranges = file->all_comp_units_without_ranges; ++ file->all_comp_units_without_ranges = each->next_unit_without_ranges; ++ } ++ + file->info_ptr += length; + return each; + } diff --git a/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-2.patch b/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-2.patch new file mode 100644 index 0000000000..a58b8dccdc --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-2.patch @@ -0,0 +1,210 @@ +From 1e716c1b160d56c2ab8711e199cad5b4db47cedf Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Tue, 30 Aug 2022 16:01:20 +0100 +Subject: [PATCH] BFD library: Use entry 0 in directory and filename tables of + + DWARF-5 debug info. + + PR 29529 + * dwarf2.c (struct line_info_table): Add new field: + use_dir_and_file_0. + (concat_filename): Use new field to help select the correct table + slot. + (read_formatted_entries): Do not skip entry 0. + (decode_line_info): Set new field depending upon the version of + DWARF being parsed. Initialise filename based upon the setting of + the new field. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=37833b966576c5d25e797ea3b6c33d0459a71892] +CVE: CVE-2023-22608 + +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> + +--- + bfd/dwarf2.c | 86 ++++++++++++++++++++---------- + ld/testsuite/ld-x86-64/pr27587.err | 2 +- + 2 files changed, 59 insertions(+), 29 deletions(-) + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index 0ae50a37..b7839ad6 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -1571,6 +1571,7 @@ struct line_info_table + unsigned int num_files; + unsigned int num_dirs; + unsigned int num_sequences; ++ bool use_dir_and_file_0; + char * comp_dir; + char ** dirs; + struct fileinfo* files; +@@ -1791,16 +1792,30 @@ concat_filename (struct line_info_table *table, unsigned int file) + { + char *filename; + +- if (table == NULL || file - 1 >= table->num_files) ++ /* Pre DWARF-5 entry 0 in the directory and filename tables was not used. ++ So in order to save space in the tables used here the info for, eg ++ directory 1 is stored in slot 0 of the directory table, directory 2 ++ in slot 1 and so on. ++ ++ Starting with DWARF-5 the 0'th entry is used so there is a one to one ++ mapping between DWARF slots and internal table entries. */ ++ if (! table->use_dir_and_file_0) + { +- /* FILE == 0 means unknown. */ +- if (file) +- _bfd_error_handler +- (_("DWARF error: mangled line number section (bad file number)")); ++ /* Pre DWARF-5, FILE == 0 means unknown. */ ++ if (file == 0) ++ return strdup ("<unknown>"); ++ -- file; ++ } ++ ++ if (table == NULL || file >= table->num_files) ++ { ++ _bfd_error_handler ++ (_("DWARF error: mangled line number section (bad file number)")); + return strdup ("<unknown>"); + } + +- filename = table->files[file - 1].name; ++ filename = table->files[file].name; ++ + if (filename == NULL) + return strdup ("<unknown>"); + +@@ -1811,12 +1826,17 @@ concat_filename (struct line_info_table *table, unsigned int file) + char *name; + size_t len; + +- if (table->files[file - 1].dir ++ if (table->files[file].dir + /* PR 17512: file: 0317e960. */ +- && table->files[file - 1].dir <= table->num_dirs ++ && table->files[file].dir <= table->num_dirs + /* PR 17512: file: 7f3d2e4b. */ + && table->dirs != NULL) +- subdir_name = table->dirs[table->files[file - 1].dir - 1]; ++ { ++ if (table->use_dir_and_file_0) ++ subdir_name = table->dirs[table->files[file].dir]; ++ else ++ subdir_name = table->dirs[table->files[file].dir - 1]; ++ } + + if (!subdir_name || !IS_ABSOLUTE_PATH (subdir_name)) + dir_name = table->comp_dir; +@@ -1857,10 +1877,12 @@ concat_filename (struct line_info_table *table, unsigned int file) + + /* Check whether [low1, high1) can be combined with [low2, high2), + i.e., they touch or overlap. */ +-static bool ranges_overlap (bfd_vma low1, +- bfd_vma high1, +- bfd_vma low2, +- bfd_vma high2) ++ ++static bool ++ranges_overlap (bfd_vma low1, ++ bfd_vma high1, ++ bfd_vma low2, ++ bfd_vma high2) + { + if (low1 == low2 || high1 == high2) + return true; +@@ -1887,15 +1909,16 @@ static bool ranges_overlap (bfd_vma low1, + /* Insert an address range in the trie mapping addresses to compilation units. + Will return the new trie node (usually the same as is being sent in, but + in case of a leaf-to-interior conversion, or expansion of a leaf, it may be +- different), or NULL on failure. +- */ +-static struct trie_node *insert_arange_in_trie(bfd *abfd, +- struct trie_node *trie, +- bfd_vma trie_pc, +- unsigned int trie_pc_bits, +- struct comp_unit *unit, +- bfd_vma low_pc, +- bfd_vma high_pc) ++ different), or NULL on failure. */ ++ ++static struct trie_node * ++insert_arange_in_trie (bfd *abfd, ++ struct trie_node *trie, ++ bfd_vma trie_pc, ++ unsigned int trie_pc_bits, ++ struct comp_unit *unit, ++ bfd_vma low_pc, ++ bfd_vma high_pc) + { + bfd_vma clamped_low_pc, clamped_high_pc; + int ch, from_ch, to_ch; +@@ -2031,7 +2054,6 @@ static struct trie_node *insert_arange_in_trie(bfd *abfd, + return trie; + } + +- + static bool + arange_add (struct comp_unit *unit, struct arange *first_arange, + struct trie_node **trie_root, bfd_vma low_pc, bfd_vma high_pc) +@@ -2412,10 +2434,8 @@ read_formatted_entries (struct comp_unit *unit, bfd_byte **bufp, + } + } + +- /* Skip the first "zero entry", which is the compilation dir/file. */ +- if (datai != 0) +- if (!callback (table, fe.name, fe.dir, fe.time, fe.size)) +- return false; ++ if (!callback (table, fe.name, fe.dir, fe.time, fe.size)) ++ return false; + } + + *bufp = buf; +@@ -2592,6 +2612,7 @@ decode_line_info (struct comp_unit *unit) + if (!read_formatted_entries (unit, &line_ptr, line_end, table, + line_info_add_file_name)) + goto fail; ++ table->use_dir_and_file_0 = true; + } + else + { +@@ -2614,6 +2635,7 @@ decode_line_info (struct comp_unit *unit) + if (!line_info_add_file_name (table, cur_file, dir, xtime, size)) + goto fail; + } ++ table->use_dir_and_file_0 = false; + } + + /* Read the statement sequences until there's nothing left. */ +@@ -2622,7 +2644,7 @@ decode_line_info (struct comp_unit *unit) + /* State machine registers. */ + bfd_vma address = 0; + unsigned char op_index = 0; +- char * filename = table->num_files ? concat_filename (table, 1) : NULL; ++ char * filename = NULL; + unsigned int line = 1; + unsigned int column = 0; + unsigned int discriminator = 0; +@@ -2637,6 +2659,14 @@ decode_line_info (struct comp_unit *unit) + bfd_vma low_pc = (bfd_vma) -1; + bfd_vma high_pc = 0; + ++ if (table->num_files) ++ { ++ if (table->use_dir_and_file_0) ++ filename = concat_filename (table, 0); ++ else ++ filename = concat_filename (table, 1); ++ } ++ + /* Decode the table. */ + while (!end_sequence && line_ptr < line_end) + { +diff --git a/ld/testsuite/ld-x86-64/pr27587.err b/ld/testsuite/ld-x86-64/pr27587.err +index fa870790..807750ca 100644 +--- a/ld/testsuite/ld-x86-64/pr27587.err ++++ b/ld/testsuite/ld-x86-64/pr27587.err +@@ -1,3 +1,3 @@ + #... +-.*pr27587.i:4: undefined reference to `stack_size' ++.*pr27587/<artificial>:4: undefined reference to `stack_size' + #... diff --git a/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-3.patch b/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-3.patch new file mode 100644 index 0000000000..a1b74248ce --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0020-CVE-2023-22608-3.patch @@ -0,0 +1,32 @@ +From 4b8386a90802ed8e43eac2266f6e03c92b4462ed Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Fri, 23 Dec 2022 13:02:04 +0000 +Subject: [PATCH] Fix illegal memory access parsing corrupt DWARF information. + + PR 29936 + * dwarf2.c (concat_filename): Fix check for a directory index off + the end of the directory table. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=8af23b30edbaedf009bc9b243cd4dfa10ae1ac09] +CVE: CVE-2023-22608 + +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> + +--- + bfd/dwarf2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index b7839ad6..8b07a24c 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -1828,7 +1828,8 @@ concat_filename (struct line_info_table *table, unsigned int file) + + if (table->files[file].dir + /* PR 17512: file: 0317e960. */ +- && table->files[file].dir <= table->num_dirs ++ && table->files[file].dir ++ <= (table->use_dir_and_file_0 ? table->num_dirs - 1 : table->num_dirs) + /* PR 17512: file: 7f3d2e4b. */ + && table->dirs != NULL) + { diff --git a/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-1.patch b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-1.patch new file mode 100644 index 0000000000..1e9c03e70e --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-1.patch @@ -0,0 +1,459 @@ +From f67741e172bf342291fe3abd2b395899ce6433a0 Mon Sep 17 00:00:00 2001 +From: "Potharla, Rupesh" <Rupesh.Potharla@amd.com> +Date: Tue, 24 May 2022 00:01:49 +0000 +Subject: [PATCH] bfd: Add Support for DW_FORM_strx* and DW_FORM_addrx* + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=f67741e172bf342291fe3abd2b395899ce6433a0] + +CVE: CVE-2023-1579 + +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> + +--- + bfd/dwarf2.c | 282 ++++++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 268 insertions(+), 14 deletions(-) + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index f6b0183720b..45e286754e4 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -189,6 +189,18 @@ struct dwarf2_debug_file + /* Length of the loaded .debug_str section. */ + bfd_size_type dwarf_str_size; + ++ /* Pointer to the .debug_str_offsets section loaded into memory. */ ++ bfd_byte *dwarf_str_offsets_buffer; ++ ++ /* Length of the loaded .debug_str_offsets section. */ ++ bfd_size_type dwarf_str_offsets_size; ++ ++ /* Pointer to the .debug_addr section loaded into memory. */ ++ bfd_byte *dwarf_addr_buffer; ++ ++ /* Length of the loaded .debug_addr section. */ ++ bfd_size_type dwarf_addr_size; ++ + /* Pointer to the .debug_line_str section loaded into memory. */ + bfd_byte *dwarf_line_str_buffer; + +@@ -382,6 +394,12 @@ struct comp_unit + /* Used when iterating over trie leaves to know which units we have + already seen in this iteration. */ + bool mark; ++ ++ /* Base address of debug_addr section. */ ++ size_t dwarf_addr_offset; ++ ++ /* Base address of string offset table. */ ++ size_t dwarf_str_offset; + }; + + /* This data structure holds the information of an abbrev. */ +@@ -424,6 +442,8 @@ const struct dwarf_debug_section dwarf_debug_sections[] = + { ".debug_static_vars", ".zdebug_static_vars" }, + { ".debug_str", ".zdebug_str", }, + { ".debug_str", ".zdebug_str", }, ++ { ".debug_str_offsets", ".zdebug_str_offsets", }, ++ { ".debug_addr", ".zdebug_addr", }, + { ".debug_line_str", ".zdebug_line_str", }, + { ".debug_types", ".zdebug_types" }, + /* GNU DWARF 1 extensions */ +@@ -458,6 +478,8 @@ enum dwarf_debug_section_enum + debug_static_vars, + debug_str, + debug_str_alt, ++ debug_str_offsets, ++ debug_addr, + debug_line_str, + debug_types, + debug_sfnames, +@@ -1307,12 +1329,92 @@ is_int_form (const struct attribute *attr) + } + } + ++/* Returns true if the form is strx[1-4]. */ ++ ++static inline bool ++is_strx_form (enum dwarf_form form) ++{ ++ return (form == DW_FORM_strx ++ || form == DW_FORM_strx1 ++ || form == DW_FORM_strx2 ++ || form == DW_FORM_strx3 ++ || form == DW_FORM_strx4); ++} ++ ++/* Return true if the form is addrx[1-4]. */ ++ ++static inline bool ++is_addrx_form (enum dwarf_form form) ++{ ++ return (form == DW_FORM_addrx ++ || form == DW_FORM_addrx1 ++ || form == DW_FORM_addrx2 ++ || form == DW_FORM_addrx3 ++ || form == DW_FORM_addrx4); ++} ++ ++/* Returns the address in .debug_addr section using DW_AT_addr_base. ++ Used to implement DW_FORM_addrx*. */ ++static bfd_vma ++read_indexed_address (bfd_uint64_t idx, ++ struct comp_unit *unit) ++{ ++ struct dwarf2_debug *stash = unit->stash; ++ struct dwarf2_debug_file *file = unit->file; ++ size_t addr_base = unit->dwarf_addr_offset; ++ bfd_byte *info_ptr; ++ ++ if (stash == NULL) ++ return 0; ++ ++ if (!read_section (unit->abfd, &stash->debug_sections[debug_addr], ++ file->syms, 0, ++ &file->dwarf_addr_buffer, &file->dwarf_addr_size)) ++ return 0; ++ ++ info_ptr = file->dwarf_addr_buffer + addr_base + idx * unit->offset_size; ++ ++ if (unit->offset_size == 4) ++ return bfd_get_32 (unit->abfd, info_ptr); ++ else ++ return bfd_get_64 (unit->abfd, info_ptr); ++} ++ ++/* Returns the string using DW_AT_str_offsets_base. ++ Used to implement DW_FORM_strx*. */ + static const char * +-read_indexed_string (bfd_uint64_t idx ATTRIBUTE_UNUSED, +- struct comp_unit * unit ATTRIBUTE_UNUSED) ++read_indexed_string (bfd_uint64_t idx, ++ struct comp_unit *unit) + { +- /* FIXME: Add support for indexed strings. */ +- return "<indexed strings not yet supported>"; ++ struct dwarf2_debug *stash = unit->stash; ++ struct dwarf2_debug_file *file = unit->file; ++ bfd_byte *info_ptr; ++ unsigned long str_offset; ++ ++ if (stash == NULL) ++ return NULL; ++ ++ if (!read_section (unit->abfd, &stash->debug_sections[debug_str], ++ file->syms, 0, ++ &file->dwarf_str_buffer, &file->dwarf_str_size)) ++ return NULL; ++ ++ if (!read_section (unit->abfd, &stash->debug_sections[debug_str_offsets], ++ file->syms, 0, ++ &file->dwarf_str_offsets_buffer, ++ &file->dwarf_str_offsets_size)) ++ return NULL; ++ ++ info_ptr = (file->dwarf_str_offsets_buffer ++ + unit->dwarf_str_offset ++ + idx * unit->offset_size); ++ ++ if (unit->offset_size == 4) ++ str_offset = bfd_get_32 (unit->abfd, info_ptr); ++ else ++ str_offset = bfd_get_64 (unit->abfd, info_ptr); ++ ++ return (const char *) file->dwarf_str_buffer + str_offset; + } + + /* Read and fill in the value of attribute ATTR as described by FORM. +@@ -1381,21 +1483,37 @@ read_attribute_value (struct attribute * attr, + case DW_FORM_ref1: + case DW_FORM_flag: + case DW_FORM_data1: ++ attr->u.val = read_1_byte (abfd, &info_ptr, info_ptr_end); ++ break; + case DW_FORM_addrx1: + attr->u.val = read_1_byte (abfd, &info_ptr, info_ptr_end); ++ /* dwarf_addr_offset value 0 indicates the attribute DW_AT_addr_base ++ is not yet read. */ ++ if (unit->dwarf_addr_offset != 0) ++ attr->u.val = read_indexed_address (attr->u.val, unit); + break; + case DW_FORM_data2: +- case DW_FORM_addrx2: + case DW_FORM_ref2: + attr->u.val = read_2_bytes (abfd, &info_ptr, info_ptr_end); + break; ++ case DW_FORM_addrx2: ++ attr->u.val = read_2_bytes (abfd, &info_ptr, info_ptr_end); ++ if (unit->dwarf_addr_offset != 0) ++ attr->u.val = read_indexed_address (attr->u.val, unit); ++ break; + case DW_FORM_addrx3: + attr->u.val = read_3_bytes (abfd, &info_ptr, info_ptr_end); ++ if (unit->dwarf_addr_offset != 0) ++ attr->u.val = read_indexed_address(attr->u.val, unit); + break; + case DW_FORM_ref4: + case DW_FORM_data4: ++ attr->u.val = read_4_bytes (abfd, &info_ptr, info_ptr_end); ++ break; + case DW_FORM_addrx4: + attr->u.val = read_4_bytes (abfd, &info_ptr, info_ptr_end); ++ if (unit->dwarf_addr_offset != 0) ++ attr->u.val = read_indexed_address (attr->u.val, unit); + break; + case DW_FORM_data8: + case DW_FORM_ref8: +@@ -1416,24 +1534,31 @@ read_attribute_value (struct attribute * attr, + break; + case DW_FORM_strx1: + attr->u.val = read_1_byte (abfd, &info_ptr, info_ptr_end); +- attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ /* dwarf_str_offset value 0 indicates the attribute DW_AT_str_offsets_base ++ is not yet read. */ ++ if (unit->dwarf_str_offset != 0) ++ attr->u.str = (char *) read_indexed_string (attr->u.val, unit); + break; + case DW_FORM_strx2: + attr->u.val = read_2_bytes (abfd, &info_ptr, info_ptr_end); +- attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ if (unit->dwarf_str_offset != 0) ++ attr->u.str = (char *) read_indexed_string (attr->u.val, unit); + break; + case DW_FORM_strx3: + attr->u.val = read_3_bytes (abfd, &info_ptr, info_ptr_end); +- attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ if (unit->dwarf_str_offset != 0) ++ attr->u.str = (char *) read_indexed_string (attr->u.val, unit); + break; + case DW_FORM_strx4: + attr->u.val = read_4_bytes (abfd, &info_ptr, info_ptr_end); +- attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ if (unit->dwarf_str_offset != 0) ++ attr->u.str = (char *) read_indexed_string (attr->u.val, unit); + break; + case DW_FORM_strx: + attr->u.val = _bfd_safe_read_leb128 (abfd, &info_ptr, + false, info_ptr_end); +- attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ if (unit->dwarf_str_offset != 0) ++ attr->u.str = (char *) read_indexed_string (attr->u.val, unit); + break; + case DW_FORM_exprloc: + case DW_FORM_block: +@@ -1455,9 +1580,14 @@ read_attribute_value (struct attribute * attr, + break; + case DW_FORM_ref_udata: + case DW_FORM_udata: ++ attr->u.val = _bfd_safe_read_leb128 (abfd, &info_ptr, ++ false, info_ptr_end); ++ break; + case DW_FORM_addrx: + attr->u.val = _bfd_safe_read_leb128 (abfd, &info_ptr, + false, info_ptr_end); ++ if (unit->dwarf_addr_offset != 0) ++ attr->u.val = read_indexed_address (attr->u.val, unit); + break; + case DW_FORM_indirect: + form = _bfd_safe_read_leb128 (abfd, &info_ptr, +@@ -2396,6 +2526,11 @@ read_formatted_entries (struct comp_unit *unit, bfd_byte **bufp, + { + case DW_FORM_string: + case DW_FORM_line_strp: ++ case DW_FORM_strx: ++ case DW_FORM_strx1: ++ case DW_FORM_strx2: ++ case DW_FORM_strx3: ++ case DW_FORM_strx4: + *stringp = attr.u.str; + break; + +@@ -4031,6 +4166,80 @@ scan_unit_for_symbols (struct comp_unit *unit) + return false; + } + ++/* Read the attributes of the form strx and addrx. */ ++ ++static void ++reread_attribute (struct comp_unit *unit, ++ struct attribute *attr, ++ bfd_vma *low_pc, ++ bfd_vma *high_pc, ++ bool *high_pc_relative, ++ bool compunit) ++{ ++ if (is_strx_form (attr->form)) ++ attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ if (is_addrx_form (attr->form)) ++ attr->u.val = read_indexed_address (attr->u.val, unit); ++ ++ switch (attr->name) ++ { ++ case DW_AT_stmt_list: ++ unit->stmtlist = 1; ++ unit->line_offset = attr->u.val; ++ break; ++ ++ case DW_AT_name: ++ if (is_str_form (attr)) ++ unit->name = attr->u.str; ++ break; ++ ++ case DW_AT_low_pc: ++ *low_pc = attr->u.val; ++ if (compunit) ++ unit->base_address = *low_pc; ++ break; ++ ++ case DW_AT_high_pc: ++ *high_pc = attr->u.val; ++ *high_pc_relative = attr->form != DW_FORM_addr; ++ break; ++ ++ case DW_AT_ranges: ++ if (!read_rangelist (unit, &unit->arange, ++ &unit->file->trie_root, attr->u.val)) ++ return; ++ break; ++ ++ case DW_AT_comp_dir: ++ { ++ char *comp_dir = attr->u.str; ++ ++ if (!is_str_form (attr)) ++ { ++ _bfd_error_handler ++ (_("DWARF error: DW_AT_comp_dir attribute encountered " ++ "with a non-string form")); ++ comp_dir = NULL; ++ } ++ ++ if (comp_dir) ++ { ++ char *cp = strchr (comp_dir, ':'); ++ ++ if (cp && cp != comp_dir && cp[-1] == '.' && cp[1] == '/') ++ comp_dir = cp + 1; ++ } ++ unit->comp_dir = comp_dir; ++ break; ++ } ++ ++ case DW_AT_language: ++ unit->lang = attr->u.val; ++ default: ++ break; ++ } ++} ++ + /* Parse a DWARF2 compilation unit starting at INFO_PTR. UNIT_LENGTH + includes the compilation unit header that proceeds the DIE's, but + does not include the length field that precedes each compilation +@@ -4064,6 +4273,10 @@ parse_comp_unit (struct dwarf2_debug *stash, + bfd *abfd = file->bfd_ptr; + bool high_pc_relative = false; + enum dwarf_unit_type unit_type; ++ struct attribute *str_addrp = NULL; ++ size_t str_count = 0; ++ size_t str_alloc = 0; ++ bool compunit_flag = false; + + version = read_2_bytes (abfd, &info_ptr, end_ptr); + if (version < 2 || version > 5) +@@ -4168,11 +4381,33 @@ parse_comp_unit (struct dwarf2_debug *stash, + unit->file = file; + unit->info_ptr_unit = info_ptr_unit; + ++ if (abbrev->tag == DW_TAG_compile_unit) ++ compunit_flag = true; ++ + for (i = 0; i < abbrev->num_attrs; ++i) + { + info_ptr = read_attribute (&attr, &abbrev->attrs[i], unit, info_ptr, end_ptr); + if (info_ptr == NULL) +- return NULL; ++ goto err_exit; ++ ++ /* Identify attributes of the form strx* and addrx* which come before ++ DW_AT_str_offsets_base and DW_AT_addr_base respectively in the CU. ++ Store the attributes in an array and process them later. */ ++ if ((unit->dwarf_str_offset == 0 && is_strx_form (attr.form)) ++ || (unit->dwarf_addr_offset == 0 && is_addrx_form (attr.form))) ++ { ++ if (str_count <= str_alloc) ++ { ++ str_alloc = 2 * str_alloc + 200; ++ str_addrp = bfd_realloc (str_addrp, ++ str_alloc * sizeof (*str_addrp)); ++ if (str_addrp == NULL) ++ goto err_exit; ++ } ++ str_addrp[str_count] = attr; ++ str_count++; ++ continue; ++ } + + /* Store the data if it is of an attribute we want to keep in a + partial symbol table. */ +@@ -4198,7 +4433,7 @@ parse_comp_unit (struct dwarf2_debug *stash, + /* If the compilation unit DIE has a DW_AT_low_pc attribute, + this is the base address to use when reading location + lists or range lists. */ +- if (abbrev->tag == DW_TAG_compile_unit) ++ if (compunit_flag) + unit->base_address = low_pc; + } + break; +@@ -4215,7 +4450,7 @@ parse_comp_unit (struct dwarf2_debug *stash, + if (is_int_form (&attr) + && !read_rangelist (unit, &unit->arange, + &unit->file->trie_root, attr.u.val)) +- return NULL; ++ goto err_exit; + break; + + case DW_AT_comp_dir: +@@ -4248,21 +4483,40 @@ parse_comp_unit (struct dwarf2_debug *stash, + unit->lang = attr.u.val; + break; + ++ case DW_AT_addr_base: ++ unit->dwarf_addr_offset = attr.u.val; ++ break; ++ ++ case DW_AT_str_offsets_base: ++ unit->dwarf_str_offset = attr.u.val; ++ break; ++ + default: + break; + } + } ++ ++ for (i = 0; i < str_count; ++i) ++ reread_attribute (unit, &str_addrp[i], &low_pc, &high_pc, ++ &high_pc_relative, compunit_flag); ++ + if (high_pc_relative) + high_pc += low_pc; + if (high_pc != 0) + { + if (!arange_add (unit, &unit->arange, &unit->file->trie_root, + low_pc, high_pc)) +- return NULL; ++ goto err_exit; + } + + unit->first_child_die_ptr = info_ptr; ++ ++ free (str_addrp); + return unit; ++ ++ err_exit: ++ free (str_addrp); ++ return NULL; + } + + /* Return TRUE if UNIT may contain the address given by ADDR. When +-- +2.31.1 + diff --git a/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-2.patch b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-2.patch new file mode 100644 index 0000000000..be698ef5c1 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-2.patch @@ -0,0 +1,2127 @@ +From 0e3c1eebb22e0ade28b619fb41f42d66ed6fb145 Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Fri, 27 May 2022 12:37:21 +0930 +Subject: [PATCH] Remove use of bfd_uint64_t and similar + +Requiring C99 means that uses of bfd_uint64_t can be replaced with +uint64_t, and similarly for bfd_int64_t, BFD_HOST_U_64_BIT, and +BFD_HOST_64_BIT. This patch does that, removes #ifdef BFD_HOST_* +and tidies a few places that print 64-bit values. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=0e3c1eebb22e0ade28b619fb41f42d66ed6fb145] + +CVE: CVE-2023-1579 + +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> + +--- + bfd/aix386-core.c | 6 +-- + bfd/bfd-in.h | 24 ++++++------ + bfd/bfd-in2.h | 36 +++++++++--------- + bfd/coff-rs6000.c | 10 +---- + bfd/coff-x86_64.c | 2 +- + bfd/cpu-ia64-opc.c | 22 +++++------ + bfd/dwarf2.c | 83 ++++++++++++++++++++--------------------- + bfd/elf32-score.c | 16 ++++---- + bfd/elf64-ia64-vms.c | 8 ++-- + bfd/elflink.c | 16 +------- + bfd/elfxx-ia64.c | 6 +-- + bfd/hppabsd-core.c | 6 +-- + bfd/hpux-core.c | 6 +-- + bfd/irix-core.c | 6 +-- + bfd/libbfd.c | 65 +++++++++----------------------- + bfd/mach-o.c | 2 +- + bfd/mach-o.h | 8 ++-- + bfd/netbsd-core.c | 6 +-- + bfd/osf-core.c | 6 +-- + bfd/ptrace-core.c | 6 +-- + bfd/sco5-core.c | 6 +-- + bfd/targets.c | 12 +++--- + bfd/trad-core.c | 6 +-- + bfd/vms-alpha.c | 2 +- + binutils/nm.c | 49 +++--------------------- + binutils/od-macho.c | 50 ++++++++----------------- + binutils/prdbg.c | 39 +++---------------- + binutils/readelf.c | 21 +++++------ + gas/config/tc-arm.c | 28 ++++---------- + gas/config/tc-csky.c | 10 ++--- + gas/config/tc-sparc.c | 35 +++++++++-------- + gas/config/tc-tilegx.c | 20 +++++----- + gas/config/tc-tilepro.c | 20 +++++----- + gas/config/tc-z80.c | 8 ++-- + gas/config/te-vms.c | 2 +- + gas/config/te-vms.h | 2 +- + gdb/findcmd.c | 2 +- + gdb/tilegx-tdep.c | 2 +- + gprof/gmon_io.c | 44 ++++++---------------- + include/elf/nfp.h | 2 +- + include/opcode/csky.h | 62 +++++++++++++++--------------- + include/opcode/ia64.h | 2 +- + opcodes/csky-dis.c | 2 +- + opcodes/csky-opc.h | 4 +- + opcodes/ia64-dis.c | 2 +- + 45 files changed, 297 insertions(+), 475 deletions(-) + +diff --git a/bfd/aix386-core.c b/bfd/aix386-core.c +index 3443e49ed46..977a6bd1fb4 100644 +--- a/bfd/aix386-core.c ++++ b/bfd/aix386-core.c +@@ -220,9 +220,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_aix386_vec = + { +diff --git a/bfd/bfd-in.h b/bfd/bfd-in.h +index a1c4bf139fc..09c5728e944 100644 +--- a/bfd/bfd-in.h ++++ b/bfd/bfd-in.h +@@ -116,10 +116,10 @@ typedef struct bfd bfd; + #error No 64 bit integer type available + #endif /* ! defined (BFD_HOST_64_BIT) */ + +-typedef BFD_HOST_U_64_BIT bfd_vma; +-typedef BFD_HOST_64_BIT bfd_signed_vma; +-typedef BFD_HOST_U_64_BIT bfd_size_type; +-typedef BFD_HOST_U_64_BIT symvalue; ++typedef uint64_t bfd_vma; ++typedef int64_t bfd_signed_vma; ++typedef uint64_t bfd_size_type; ++typedef uint64_t symvalue; + + #if BFD_HOST_64BIT_LONG + #define BFD_VMA_FMT "l" +@@ -447,10 +447,10 @@ extern bool bfd_record_phdr + + /* Byte swapping routines. */ + +-bfd_uint64_t bfd_getb64 (const void *); +-bfd_uint64_t bfd_getl64 (const void *); +-bfd_int64_t bfd_getb_signed_64 (const void *); +-bfd_int64_t bfd_getl_signed_64 (const void *); ++uint64_t bfd_getb64 (const void *); ++uint64_t bfd_getl64 (const void *); ++int64_t bfd_getb_signed_64 (const void *); ++int64_t bfd_getl_signed_64 (const void *); + bfd_vma bfd_getb32 (const void *); + bfd_vma bfd_getl32 (const void *); + bfd_signed_vma bfd_getb_signed_32 (const void *); +@@ -459,8 +459,8 @@ bfd_vma bfd_getb16 (const void *); + bfd_vma bfd_getl16 (const void *); + bfd_signed_vma bfd_getb_signed_16 (const void *); + bfd_signed_vma bfd_getl_signed_16 (const void *); +-void bfd_putb64 (bfd_uint64_t, void *); +-void bfd_putl64 (bfd_uint64_t, void *); ++void bfd_putb64 (uint64_t, void *); ++void bfd_putl64 (uint64_t, void *); + void bfd_putb32 (bfd_vma, void *); + void bfd_putl32 (bfd_vma, void *); + void bfd_putb24 (bfd_vma, void *); +@@ -470,8 +470,8 @@ void bfd_putl16 (bfd_vma, void *); + + /* Byte swapping routines which take size and endiannes as arguments. */ + +-bfd_uint64_t bfd_get_bits (const void *, int, bool); +-void bfd_put_bits (bfd_uint64_t, void *, int, bool); ++uint64_t bfd_get_bits (const void *, int, bool); ++void bfd_put_bits (uint64_t, void *, int, bool); + + + /* mmap hacks */ +diff --git a/bfd/bfd-in2.h b/bfd/bfd-in2.h +index 50e26fc691d..d50885e76cf 100644 +--- a/bfd/bfd-in2.h ++++ b/bfd/bfd-in2.h +@@ -123,10 +123,10 @@ typedef struct bfd bfd; + #error No 64 bit integer type available + #endif /* ! defined (BFD_HOST_64_BIT) */ + +-typedef BFD_HOST_U_64_BIT bfd_vma; +-typedef BFD_HOST_64_BIT bfd_signed_vma; +-typedef BFD_HOST_U_64_BIT bfd_size_type; +-typedef BFD_HOST_U_64_BIT symvalue; ++typedef uint64_t bfd_vma; ++typedef int64_t bfd_signed_vma; ++typedef uint64_t bfd_size_type; ++typedef uint64_t symvalue; + + #if BFD_HOST_64BIT_LONG + #define BFD_VMA_FMT "l" +@@ -454,10 +454,10 @@ extern bool bfd_record_phdr + + /* Byte swapping routines. */ + +-bfd_uint64_t bfd_getb64 (const void *); +-bfd_uint64_t bfd_getl64 (const void *); +-bfd_int64_t bfd_getb_signed_64 (const void *); +-bfd_int64_t bfd_getl_signed_64 (const void *); ++uint64_t bfd_getb64 (const void *); ++uint64_t bfd_getl64 (const void *); ++int64_t bfd_getb_signed_64 (const void *); ++int64_t bfd_getl_signed_64 (const void *); + bfd_vma bfd_getb32 (const void *); + bfd_vma bfd_getl32 (const void *); + bfd_signed_vma bfd_getb_signed_32 (const void *); +@@ -466,8 +466,8 @@ bfd_vma bfd_getb16 (const void *); + bfd_vma bfd_getl16 (const void *); + bfd_signed_vma bfd_getb_signed_16 (const void *); + bfd_signed_vma bfd_getl_signed_16 (const void *); +-void bfd_putb64 (bfd_uint64_t, void *); +-void bfd_putl64 (bfd_uint64_t, void *); ++void bfd_putb64 (uint64_t, void *); ++void bfd_putl64 (uint64_t, void *); + void bfd_putb32 (bfd_vma, void *); + void bfd_putl32 (bfd_vma, void *); + void bfd_putb24 (bfd_vma, void *); +@@ -477,8 +477,8 @@ void bfd_putl16 (bfd_vma, void *); + + /* Byte swapping routines which take size and endiannes as arguments. */ + +-bfd_uint64_t bfd_get_bits (const void *, int, bool); +-void bfd_put_bits (bfd_uint64_t, void *, int, bool); ++uint64_t bfd_get_bits (const void *, int, bool); ++void bfd_put_bits (uint64_t, void *, int, bool); + + + /* mmap hacks */ +@@ -7416,9 +7416,9 @@ typedef struct bfd_target + /* Entries for byte swapping for data. These are different from the + other entry points, since they don't take a BFD as the first argument. + Certain other handlers could do the same. */ +- bfd_uint64_t (*bfd_getx64) (const void *); +- bfd_int64_t (*bfd_getx_signed_64) (const void *); +- void (*bfd_putx64) (bfd_uint64_t, void *); ++ uint64_t (*bfd_getx64) (const void *); ++ int64_t (*bfd_getx_signed_64) (const void *); ++ void (*bfd_putx64) (uint64_t, void *); + bfd_vma (*bfd_getx32) (const void *); + bfd_signed_vma (*bfd_getx_signed_32) (const void *); + void (*bfd_putx32) (bfd_vma, void *); +@@ -7427,9 +7427,9 @@ typedef struct bfd_target + void (*bfd_putx16) (bfd_vma, void *); + + /* Byte swapping for the headers. */ +- bfd_uint64_t (*bfd_h_getx64) (const void *); +- bfd_int64_t (*bfd_h_getx_signed_64) (const void *); +- void (*bfd_h_putx64) (bfd_uint64_t, void *); ++ uint64_t (*bfd_h_getx64) (const void *); ++ int64_t (*bfd_h_getx_signed_64) (const void *); ++ void (*bfd_h_putx64) (uint64_t, void *); + bfd_vma (*bfd_h_getx32) (const void *); + bfd_signed_vma (*bfd_h_getx_signed_32) (const void *); + void (*bfd_h_putx32) (bfd_vma, void *); +diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c +index 8819187ab42..48ce5c0516b 100644 +--- a/bfd/coff-rs6000.c ++++ b/bfd/coff-rs6000.c +@@ -1890,18 +1890,12 @@ xcoff_write_armap_old (bfd *abfd, unsigned int elength ATTRIBUTE_UNUSED, + } + + static char buff20[XCOFFARMAGBIG_ELEMENT_SIZE + 1]; +-#if BFD_HOST_64BIT_LONG +-#define FMT20 "%-20ld" +-#elif defined (__MSVCRT__) +-#define FMT20 "%-20I64d" +-#else +-#define FMT20 "%-20lld" +-#endif ++#define FMT20 "%-20" PRId64 + #define FMT12 "%-12d" + #define FMT12_OCTAL "%-12o" + #define FMT4 "%-4d" + #define PRINT20(d, v) \ +- sprintf (buff20, FMT20, (bfd_uint64_t)(v)), \ ++ sprintf (buff20, FMT20, (uint64_t) (v)), \ + memcpy ((void *) (d), buff20, 20) + + #define PRINT12(d, v) \ +diff --git a/bfd/coff-x86_64.c b/bfd/coff-x86_64.c +index e8e16d3ce4b..cf339c93215 100644 +--- a/bfd/coff-x86_64.c ++++ b/bfd/coff-x86_64.c +@@ -201,7 +201,7 @@ coff_amd64_reloc (bfd *abfd, + + case 4: + { +- bfd_uint64_t x = bfd_get_64 (abfd, addr); ++ uint64_t x = bfd_get_64 (abfd, addr); + DOIT (x); + bfd_put_64 (abfd, x, addr); + } +diff --git a/bfd/cpu-ia64-opc.c b/bfd/cpu-ia64-opc.c +index e2b5c2694b6..01e3c3f476a 100644 +--- a/bfd/cpu-ia64-opc.c ++++ b/bfd/cpu-ia64-opc.c +@@ -99,14 +99,14 @@ ins_immu (const struct ia64_operand *self, ia64_insn value, ia64_insn *code) + static const char* + ext_immu (const struct ia64_operand *self, ia64_insn code, ia64_insn *valuep) + { +- BFD_HOST_U_64_BIT value = 0; ++ uint64_t value = 0; + int i, bits = 0, total = 0; + + for (i = 0; i < NELEMS (self->field) && self->field[i].bits; ++i) + { + bits = self->field[i].bits; + value |= ((code >> self->field[i].shift) +- & ((((BFD_HOST_U_64_BIT) 1) << bits) - 1)) << total; ++ & (((uint64_t) 1 << bits) - 1)) << total; + total += bits; + } + *valuep = value; +@@ -161,7 +161,7 @@ static const char* + ins_imms_scaled (const struct ia64_operand *self, ia64_insn value, + ia64_insn *code, int scale) + { +- BFD_HOST_64_BIT svalue = value, sign_bit = 0; ++ int64_t svalue = value, sign_bit = 0; + ia64_insn new_insn = 0; + int i; + +@@ -186,17 +186,17 @@ ext_imms_scaled (const struct ia64_operand *self, ia64_insn code, + ia64_insn *valuep, int scale) + { + int i, bits = 0, total = 0; +- BFD_HOST_U_64_BIT val = 0, sign; ++ uint64_t val = 0, sign; + + for (i = 0; i < NELEMS (self->field) && self->field[i].bits; ++i) + { + bits = self->field[i].bits; + val |= ((code >> self->field[i].shift) +- & ((((BFD_HOST_U_64_BIT) 1) << bits) - 1)) << total; ++ & (((uint64_t) 1 << bits) - 1)) << total; + total += bits; + } + /* sign extend: */ +- sign = (BFD_HOST_U_64_BIT) 1 << (total - 1); ++ sign = (uint64_t) 1 << (total - 1); + val = (val ^ sign) - sign; + + *valuep = val << scale; +@@ -312,7 +312,7 @@ static const char* + ins_cnt (const struct ia64_operand *self, ia64_insn value, ia64_insn *code) + { + --value; +- if (value >= ((BFD_HOST_U_64_BIT) 1) << self->field[0].bits) ++ if (value >= (uint64_t) 1 << self->field[0].bits) + return "count out of range"; + + *code |= value << self->field[0].shift; +@@ -323,7 +323,7 @@ static const char* + ext_cnt (const struct ia64_operand *self, ia64_insn code, ia64_insn *valuep) + { + *valuep = ((code >> self->field[0].shift) +- & ((((BFD_HOST_U_64_BIT) 1) << self->field[0].bits) - 1)) + 1; ++ & (((uint64_t) 1 << self->field[0].bits) - 1)) + 1; + return 0; + } + +@@ -421,8 +421,8 @@ ext_strd5b (const struct ia64_operand *self, ia64_insn code, + static const char* + ins_inc3 (const struct ia64_operand *self, ia64_insn value, ia64_insn *code) + { +- BFD_HOST_64_BIT val = value; +- BFD_HOST_U_64_BIT sign = 0; ++ int64_t val = value; ++ uint64_t sign = 0; + + if (val < 0) + { +@@ -444,7 +444,7 @@ ins_inc3 (const struct ia64_operand *self, ia64_insn value, ia64_insn *code) + static const char* + ext_inc3 (const struct ia64_operand *self, ia64_insn code, ia64_insn *valuep) + { +- BFD_HOST_64_BIT val; ++ int64_t val; + int negate; + + val = (code >> self->field[0].shift) & 0x7; +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index 45e286754e4..6a728fc38b0 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -63,8 +63,8 @@ struct attribute + { + char *str; + struct dwarf_block *blk; +- bfd_uint64_t val; +- bfd_int64_t sval; ++ uint64_t val; ++ int64_t sval; + } + u; + }; +@@ -632,12 +632,12 @@ lookup_info_hash_table (struct info_hash_table *hash_table, const char *key) + the located section does not contain at least OFFSET bytes. */ + + static bool +-read_section (bfd * abfd, ++read_section (bfd *abfd, + const struct dwarf_debug_section *sec, +- asymbol ** syms, +- bfd_uint64_t offset, +- bfd_byte ** section_buffer, +- bfd_size_type * section_size) ++ asymbol **syms, ++ uint64_t offset, ++ bfd_byte **section_buffer, ++ bfd_size_type *section_size) + { + const char *section_name = sec->uncompressed_name; + bfd_byte *contents = *section_buffer; +@@ -848,7 +848,7 @@ read_indirect_string (struct comp_unit *unit, + bfd_byte **ptr, + bfd_byte *buf_end) + { +- bfd_uint64_t offset; ++ uint64_t offset; + struct dwarf2_debug *stash = unit->stash; + struct dwarf2_debug_file *file = unit->file; + char *str; +@@ -882,7 +882,7 @@ read_indirect_line_string (struct comp_unit *unit, + bfd_byte **ptr, + bfd_byte *buf_end) + { +- bfd_uint64_t offset; ++ uint64_t offset; + struct dwarf2_debug *stash = unit->stash; + struct dwarf2_debug_file *file = unit->file; + char *str; +@@ -919,7 +919,7 @@ read_alt_indirect_string (struct comp_unit *unit, + bfd_byte **ptr, + bfd_byte *buf_end) + { +- bfd_uint64_t offset; ++ uint64_t offset; + struct dwarf2_debug *stash = unit->stash; + char *str; + +@@ -975,8 +975,7 @@ read_alt_indirect_string (struct comp_unit *unit, + or NULL upon failure. */ + + static bfd_byte * +-read_alt_indirect_ref (struct comp_unit * unit, +- bfd_uint64_t offset) ++read_alt_indirect_ref (struct comp_unit *unit, uint64_t offset) + { + struct dwarf2_debug *stash = unit->stash; + +@@ -1012,7 +1011,7 @@ read_alt_indirect_ref (struct comp_unit * unit, + return stash->alt.dwarf_info_buffer + offset; + } + +-static bfd_uint64_t ++static uint64_t + read_address (struct comp_unit *unit, bfd_byte **ptr, bfd_byte *buf_end) + { + bfd_byte *buf = *ptr; +@@ -1131,7 +1130,7 @@ del_abbrev (void *p) + in a hash table. */ + + static struct abbrev_info** +-read_abbrevs (bfd *abfd, bfd_uint64_t offset, struct dwarf2_debug *stash, ++read_abbrevs (bfd *abfd, uint64_t offset, struct dwarf2_debug *stash, + struct dwarf2_debug_file *file) + { + struct abbrev_info **abbrevs; +@@ -1356,8 +1355,7 @@ is_addrx_form (enum dwarf_form form) + /* Returns the address in .debug_addr section using DW_AT_addr_base. + Used to implement DW_FORM_addrx*. */ + static bfd_vma +-read_indexed_address (bfd_uint64_t idx, +- struct comp_unit *unit) ++read_indexed_address (uint64_t idx, struct comp_unit *unit) + { + struct dwarf2_debug *stash = unit->stash; + struct dwarf2_debug_file *file = unit->file; +@@ -1383,8 +1381,7 @@ read_indexed_address (bfd_uint64_t idx, + /* Returns the string using DW_AT_str_offsets_base. + Used to implement DW_FORM_strx*. */ + static const char * +-read_indexed_string (bfd_uint64_t idx, +- struct comp_unit *unit) ++read_indexed_string (uint64_t idx, struct comp_unit *unit) + { + struct dwarf2_debug *stash = unit->stash; + struct dwarf2_debug_file *file = unit->file; +@@ -1717,39 +1714,39 @@ struct line_info_table + struct funcinfo + { + /* Pointer to previous function in list of all functions. */ +- struct funcinfo * prev_func; ++ struct funcinfo *prev_func; + /* Pointer to function one scope higher. */ +- struct funcinfo * caller_func; ++ struct funcinfo *caller_func; + /* Source location file name where caller_func inlines this func. */ +- char * caller_file; ++ char *caller_file; + /* Source location file name. */ +- char * file; ++ char *file; + /* Source location line number where caller_func inlines this func. */ +- int caller_line; ++ int caller_line; + /* Source location line number. */ +- int line; +- int tag; +- bool is_linkage; +- const char * name; +- struct arange arange; ++ int line; ++ int tag; ++ bool is_linkage; ++ const char *name; ++ struct arange arange; + /* Where the symbol is defined. */ +- asection * sec; ++ asection *sec; + /* The offset of the funcinfo from the start of the unit. */ +- bfd_uint64_t unit_offset; ++ uint64_t unit_offset; + }; + + struct lookup_funcinfo + { + /* Function information corresponding to this lookup table entry. */ +- struct funcinfo * funcinfo; ++ struct funcinfo *funcinfo; + + /* The lowest address for this specific function. */ +- bfd_vma low_addr; ++ bfd_vma low_addr; + + /* The highest address of this function before the lookup table is sorted. + The highest address of all prior functions after the lookup table is + sorted, which is used for binary search. */ +- bfd_vma high_addr; ++ bfd_vma high_addr; + /* Index of this function, used to ensure qsort is stable. */ + unsigned int idx; + }; +@@ -1759,7 +1756,7 @@ struct varinfo + /* Pointer to previous variable in list of all variables. */ + struct varinfo *prev_var; + /* The offset of the varinfo from the start of the unit. */ +- bfd_uint64_t unit_offset; ++ uint64_t unit_offset; + /* Source location file name. */ + char *file; + /* Source location line number. */ +@@ -3335,7 +3332,7 @@ find_abstract_instance (struct comp_unit *unit, + bfd_byte *info_ptr_end; + unsigned int abbrev_number, i; + struct abbrev_info *abbrev; +- bfd_uint64_t die_ref = attr_ptr->u.val; ++ uint64_t die_ref = attr_ptr->u.val; + struct attribute attr; + const char *name = NULL; + +@@ -3549,7 +3546,7 @@ find_abstract_instance (struct comp_unit *unit, + + static bool + read_ranges (struct comp_unit *unit, struct arange *arange, +- struct trie_node **trie_root, bfd_uint64_t offset) ++ struct trie_node **trie_root, uint64_t offset) + { + bfd_byte *ranges_ptr; + bfd_byte *ranges_end; +@@ -3594,7 +3591,7 @@ read_ranges (struct comp_unit *unit, struct arange *arange, + + static bool + read_rnglists (struct comp_unit *unit, struct arange *arange, +- struct trie_node **trie_root, bfd_uint64_t offset) ++ struct trie_node **trie_root, uint64_t offset) + { + bfd_byte *rngs_ptr; + bfd_byte *rngs_end; +@@ -3675,7 +3672,7 @@ read_rnglists (struct comp_unit *unit, struct arange *arange, + + static bool + read_rangelist (struct comp_unit *unit, struct arange *arange, +- struct trie_node **trie_root, bfd_uint64_t offset) ++ struct trie_node **trie_root, uint64_t offset) + { + if (unit->version <= 4) + return read_ranges (unit, arange, trie_root, offset); +@@ -3684,7 +3681,7 @@ read_rangelist (struct comp_unit *unit, struct arange *arange, + } + + static struct funcinfo * +-lookup_func_by_offset (bfd_uint64_t offset, struct funcinfo * table) ++lookup_func_by_offset (uint64_t offset, struct funcinfo * table) + { + for (; table != NULL; table = table->prev_func) + if (table->unit_offset == offset) +@@ -3693,7 +3690,7 @@ lookup_func_by_offset (bfd_uint64_t offset, struct funcinfo * table) + } + + static struct varinfo * +-lookup_var_by_offset (bfd_uint64_t offset, struct varinfo * table) ++lookup_var_by_offset (uint64_t offset, struct varinfo * table) + { + while (table) + { +@@ -3775,7 +3772,7 @@ scan_unit_for_symbols (struct comp_unit *unit) + struct abbrev_info *abbrev; + struct funcinfo *func; + struct varinfo *var; +- bfd_uint64_t current_offset; ++ uint64_t current_offset; + + /* PR 17512: file: 9f405d9d. */ + if (info_ptr >= info_ptr_end) +@@ -3909,7 +3906,7 @@ scan_unit_for_symbols (struct comp_unit *unit) + bfd_vma low_pc = 0; + bfd_vma high_pc = 0; + bool high_pc_relative = false; +- bfd_uint64_t current_offset; ++ uint64_t current_offset; + + /* PR 17512: file: 9f405d9d. */ + if (info_ptr >= info_ptr_end) +@@ -4259,7 +4256,7 @@ parse_comp_unit (struct dwarf2_debug *stash, + { + struct comp_unit* unit; + unsigned int version; +- bfd_uint64_t abbrev_offset = 0; ++ uint64_t abbrev_offset = 0; + /* Initialize it just to avoid a GCC false warning. */ + unsigned int addr_size = -1; + struct abbrev_info** abbrevs; +diff --git a/bfd/elf32-score.c b/bfd/elf32-score.c +index c868707347c..5bc78d523ea 100644 +--- a/bfd/elf32-score.c ++++ b/bfd/elf32-score.c +@@ -230,14 +230,14 @@ static bfd_vma + score3_bfd_getl48 (const void *p) + { + const bfd_byte *addr = p; +- bfd_uint64_t v; +- +- v = (bfd_uint64_t) addr[4]; +- v |= (bfd_uint64_t) addr[5] << 8; +- v |= (bfd_uint64_t) addr[2] << 16; +- v |= (bfd_uint64_t) addr[3] << 24; +- v |= (bfd_uint64_t) addr[0] << 32; +- v |= (bfd_uint64_t) addr[1] << 40; ++ uint64_t v; ++ ++ v = (uint64_t) addr[4]; ++ v |= (uint64_t) addr[5] << 8; ++ v |= (uint64_t) addr[2] << 16; ++ v |= (uint64_t) addr[3] << 24; ++ v |= (uint64_t) addr[0] << 32; ++ v |= (uint64_t) addr[1] << 40; + return v; + } + +diff --git a/bfd/elf64-ia64-vms.c b/bfd/elf64-ia64-vms.c +index 59cc6b6fe85..4d8f98550a3 100644 +--- a/bfd/elf64-ia64-vms.c ++++ b/bfd/elf64-ia64-vms.c +@@ -179,7 +179,7 @@ struct elf64_ia64_vms_obj_tdata + struct elf_obj_tdata root; + + /* Ident for shared library. */ +- bfd_uint64_t ident; ++ uint64_t ident; + + /* Used only during link: offset in the .fixups section for this bfd. */ + bfd_vma fixups_off; +@@ -2791,7 +2791,7 @@ elf64_ia64_size_dynamic_sections (bfd *output_bfd ATTRIBUTE_UNUSED, + if (!_bfd_elf_add_dynamic_entry (info, DT_IA_64_VMS_IDENT, 0)) + return false; + if (!_bfd_elf_add_dynamic_entry (info, DT_IA_64_VMS_LINKTIME, +- (((bfd_uint64_t)time_hi) << 32) ++ ((uint64_t) time_hi << 32) + + time_lo)) + return false; + +@@ -4720,7 +4720,7 @@ elf64_vms_close_and_cleanup (bfd *abfd) + if ((isize & 7) != 0) + { + int ishort = 8 - (isize & 7); +- bfd_uint64_t pad = 0; ++ uint64_t pad = 0; + + bfd_seek (abfd, isize, SEEK_SET); + bfd_bwrite (&pad, ishort, abfd); +@@ -4853,7 +4853,7 @@ elf64_vms_link_add_object_symbols (bfd *abfd, struct bfd_link_info *info) + bed->s->swap_dyn_in (abfd, extdyn, &dyn); + if (dyn.d_tag == DT_IA_64_VMS_IDENT) + { +- bfd_uint64_t tagv = dyn.d_un.d_val; ++ uint64_t tagv = dyn.d_un.d_val; + elf_ia64_vms_ident (abfd) = tagv; + break; + } +diff --git a/bfd/elflink.c b/bfd/elflink.c +index 96eb36aa5bf..fc3a335c72d 100644 +--- a/bfd/elflink.c ++++ b/bfd/elflink.c +@@ -6354,15 +6354,11 @@ compute_bucket_count (struct bfd_link_info *info ATTRIBUTE_UNUSED, + size_t best_size = 0; + unsigned long int i; + +- /* We have a problem here. The following code to optimize the table +- size requires an integer type with more the 32 bits. If +- BFD_HOST_U_64_BIT is set we know about such a type. */ +-#ifdef BFD_HOST_U_64_BIT + if (info->optimize) + { + size_t minsize; + size_t maxsize; +- BFD_HOST_U_64_BIT best_chlen = ~((BFD_HOST_U_64_BIT) 0); ++ uint64_t best_chlen = ~((uint64_t) 0); + bfd *dynobj = elf_hash_table (info)->dynobj; + size_t dynsymcount = elf_hash_table (info)->dynsymcount; + const struct elf_backend_data *bed = get_elf_backend_data (dynobj); +@@ -6399,7 +6395,7 @@ compute_bucket_count (struct bfd_link_info *info ATTRIBUTE_UNUSED, + for (i = minsize; i < maxsize; ++i) + { + /* Walk through the array of hashcodes and count the collisions. */ +- BFD_HOST_U_64_BIT max; ++ uint64_t max; + unsigned long int j; + unsigned long int fact; + +@@ -6464,11 +6460,7 @@ compute_bucket_count (struct bfd_link_info *info ATTRIBUTE_UNUSED, + free (counts); + } + else +-#endif /* defined (BFD_HOST_U_64_BIT) */ + { +- /* This is the fallback solution if no 64bit type is available or if we +- are not supposed to spend much time on optimizations. We select the +- bucket count using a fixed set of numbers. */ + for (i = 0; elf_buckets[i] != 0; i++) + { + best_size = elf_buckets[i]; +@@ -9354,7 +9346,6 @@ ext32b_r_offset (const void *p) + return aval; + } + +-#ifdef BFD_HOST_64_BIT + static bfd_vma + ext64l_r_offset (const void *p) + { +@@ -9398,7 +9389,6 @@ ext64b_r_offset (const void *p) + | (uint64_t) a->c[7]); + return aval; + } +-#endif + + /* When performing a relocatable link, the input relocations are + preserved. But, if they reference global symbols, the indices +@@ -9502,13 +9492,11 @@ elf_link_adjust_relocs (bfd *abfd, + } + else + { +-#ifdef BFD_HOST_64_BIT + if (abfd->xvec->header_byteorder == BFD_ENDIAN_LITTLE) + ext_r_off = ext64l_r_offset; + else if (abfd->xvec->header_byteorder == BFD_ENDIAN_BIG) + ext_r_off = ext64b_r_offset; + else +-#endif + abort (); + } + +diff --git a/bfd/elfxx-ia64.c b/bfd/elfxx-ia64.c +index c126adf6890..a108324ca39 100644 +--- a/bfd/elfxx-ia64.c ++++ b/bfd/elfxx-ia64.c +@@ -555,11 +555,7 @@ ia64_elf_install_value (bfd_byte *hit_addr, bfd_vma v, unsigned int r_type) + enum ia64_opnd opnd; + const char *err; + size_t size = 8; +-#ifdef BFD_HOST_U_64_BIT +- BFD_HOST_U_64_BIT val = (BFD_HOST_U_64_BIT) v; +-#else +- bfd_vma val = v; +-#endif ++ uint64_t val = v; + + opnd = IA64_OPND_NIL; + switch (r_type) +diff --git a/bfd/hppabsd-core.c b/bfd/hppabsd-core.c +index acfa5f69a95..d87af955838 100644 +--- a/bfd/hppabsd-core.c ++++ b/bfd/hppabsd-core.c +@@ -213,9 +213,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_hppabsd_vec = + { +diff --git a/bfd/hpux-core.c b/bfd/hpux-core.c +index 4f03b84909a..654532c6bb9 100644 +--- a/bfd/hpux-core.c ++++ b/bfd/hpux-core.c +@@ -362,9 +362,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_hpux_vec = + { +diff --git a/bfd/irix-core.c b/bfd/irix-core.c +index 694fe2e2e07..b12aef9ce8b 100644 +--- a/bfd/irix-core.c ++++ b/bfd/irix-core.c +@@ -275,9 +275,9 @@ swap_abort(void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_irix_vec = + { +diff --git a/bfd/libbfd.c b/bfd/libbfd.c +index 2781671ddba..d33f3416206 100644 +--- a/bfd/libbfd.c ++++ b/bfd/libbfd.c +@@ -617,7 +617,7 @@ DESCRIPTION + #define COERCE16(x) (((bfd_vma) (x) ^ 0x8000) - 0x8000) + #define COERCE32(x) (((bfd_vma) (x) ^ 0x80000000) - 0x80000000) + #define COERCE64(x) \ +- (((bfd_uint64_t) (x) ^ ((bfd_uint64_t) 1 << 63)) - ((bfd_uint64_t) 1 << 63)) ++ (((uint64_t) (x) ^ ((uint64_t) 1 << 63)) - ((uint64_t) 1 << 63)) + + bfd_vma + bfd_getb16 (const void *p) +@@ -757,12 +757,11 @@ bfd_getl_signed_32 (const void *p) + return COERCE32 (v); + } + +-bfd_uint64_t +-bfd_getb64 (const void *p ATTRIBUTE_UNUSED) ++uint64_t ++bfd_getb64 (const void *p) + { +-#ifdef BFD_HOST_64_BIT + const bfd_byte *addr = (const bfd_byte *) p; +- bfd_uint64_t v; ++ uint64_t v; + + v = addr[0]; v <<= 8; + v |= addr[1]; v <<= 8; +@@ -774,18 +773,13 @@ bfd_getb64 (const void *p ATTRIBUTE_UNUSED) + v |= addr[7]; + + return v; +-#else +- BFD_FAIL(); +- return 0; +-#endif + } + +-bfd_uint64_t +-bfd_getl64 (const void *p ATTRIBUTE_UNUSED) ++uint64_t ++bfd_getl64 (const void *p) + { +-#ifdef BFD_HOST_64_BIT + const bfd_byte *addr = (const bfd_byte *) p; +- bfd_uint64_t v; ++ uint64_t v; + + v = addr[7]; v <<= 8; + v |= addr[6]; v <<= 8; +@@ -797,19 +791,13 @@ bfd_getl64 (const void *p ATTRIBUTE_UNUSED) + v |= addr[0]; + + return v; +-#else +- BFD_FAIL(); +- return 0; +-#endif +- + } + +-bfd_int64_t +-bfd_getb_signed_64 (const void *p ATTRIBUTE_UNUSED) ++int64_t ++bfd_getb_signed_64 (const void *p) + { +-#ifdef BFD_HOST_64_BIT + const bfd_byte *addr = (const bfd_byte *) p; +- bfd_uint64_t v; ++ uint64_t v; + + v = addr[0]; v <<= 8; + v |= addr[1]; v <<= 8; +@@ -821,18 +809,13 @@ bfd_getb_signed_64 (const void *p ATTRIBUTE_UNUSED) + v |= addr[7]; + + return COERCE64 (v); +-#else +- BFD_FAIL(); +- return 0; +-#endif + } + +-bfd_int64_t +-bfd_getl_signed_64 (const void *p ATTRIBUTE_UNUSED) ++int64_t ++bfd_getl_signed_64 (const void *p) + { +-#ifdef BFD_HOST_64_BIT + const bfd_byte *addr = (const bfd_byte *) p; +- bfd_uint64_t v; ++ uint64_t v; + + v = addr[7]; v <<= 8; + v |= addr[6]; v <<= 8; +@@ -844,10 +827,6 @@ bfd_getl_signed_64 (const void *p ATTRIBUTE_UNUSED) + v |= addr[0]; + + return COERCE64 (v); +-#else +- BFD_FAIL(); +- return 0; +-#endif + } + + void +@@ -871,9 +850,8 @@ bfd_putl32 (bfd_vma data, void *p) + } + + void +-bfd_putb64 (bfd_uint64_t data ATTRIBUTE_UNUSED, void *p ATTRIBUTE_UNUSED) ++bfd_putb64 (uint64_t data, void *p) + { +-#ifdef BFD_HOST_64_BIT + bfd_byte *addr = (bfd_byte *) p; + addr[0] = (data >> (7*8)) & 0xff; + addr[1] = (data >> (6*8)) & 0xff; +@@ -883,15 +861,11 @@ bfd_putb64 (bfd_uint64_t data ATTRIBUTE_UNUSED, void *p ATTRIBUTE_UNUSED) + addr[5] = (data >> (2*8)) & 0xff; + addr[6] = (data >> (1*8)) & 0xff; + addr[7] = (data >> (0*8)) & 0xff; +-#else +- BFD_FAIL(); +-#endif + } + + void +-bfd_putl64 (bfd_uint64_t data ATTRIBUTE_UNUSED, void *p ATTRIBUTE_UNUSED) ++bfd_putl64 (uint64_t data, void *p) + { +-#ifdef BFD_HOST_64_BIT + bfd_byte *addr = (bfd_byte *) p; + addr[7] = (data >> (7*8)) & 0xff; + addr[6] = (data >> (6*8)) & 0xff; +@@ -901,13 +875,10 @@ bfd_putl64 (bfd_uint64_t data ATTRIBUTE_UNUSED, void *p ATTRIBUTE_UNUSED) + addr[2] = (data >> (2*8)) & 0xff; + addr[1] = (data >> (1*8)) & 0xff; + addr[0] = (data >> (0*8)) & 0xff; +-#else +- BFD_FAIL(); +-#endif + } + + void +-bfd_put_bits (bfd_uint64_t data, void *p, int bits, bool big_p) ++bfd_put_bits (uint64_t data, void *p, int bits, bool big_p) + { + bfd_byte *addr = (bfd_byte *) p; + int i; +@@ -926,11 +897,11 @@ bfd_put_bits (bfd_uint64_t data, void *p, int bits, bool big_p) + } + } + +-bfd_uint64_t ++uint64_t + bfd_get_bits (const void *p, int bits, bool big_p) + { + const bfd_byte *addr = (const bfd_byte *) p; +- bfd_uint64_t data; ++ uint64_t data; + int i; + int bytes; + +diff --git a/bfd/mach-o.c b/bfd/mach-o.c +index e32b7873cef..9f3f1f13e4e 100644 +--- a/bfd/mach-o.c ++++ b/bfd/mach-o.c +@@ -4773,7 +4773,7 @@ bfd_mach_o_read_source_version (bfd *abfd, bfd_mach_o_load_command *command) + { + bfd_mach_o_source_version_command *cmd = &command->command.source_version; + struct mach_o_source_version_command_external raw; +- bfd_uint64_t ver; ++ uint64_t ver; + + if (command->len < sizeof (raw) + 8) + return false; +diff --git a/bfd/mach-o.h b/bfd/mach-o.h +index 5a068d8d970..f7418ad8d40 100644 +--- a/bfd/mach-o.h ++++ b/bfd/mach-o.h +@@ -545,8 +545,8 @@ bfd_mach_o_encryption_info_command; + + typedef struct bfd_mach_o_main_command + { +- bfd_uint64_t entryoff; +- bfd_uint64_t stacksize; ++ uint64_t entryoff; ++ uint64_t stacksize; + } + bfd_mach_o_main_command; + +@@ -563,8 +563,8 @@ bfd_mach_o_source_version_command; + typedef struct bfd_mach_o_note_command + { + char data_owner[16]; +- bfd_uint64_t offset; +- bfd_uint64_t size; ++ uint64_t offset; ++ uint64_t size; + } + bfd_mach_o_note_command; + +diff --git a/bfd/netbsd-core.c b/bfd/netbsd-core.c +index cb215937da6..ffc8e50842c 100644 +--- a/bfd/netbsd-core.c ++++ b/bfd/netbsd-core.c +@@ -257,9 +257,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_netbsd_vec = + { +diff --git a/bfd/osf-core.c b/bfd/osf-core.c +index 09a04a07624..04434b2045c 100644 +--- a/bfd/osf-core.c ++++ b/bfd/osf-core.c +@@ -169,9 +169,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_osf_vec = + { +diff --git a/bfd/ptrace-core.c b/bfd/ptrace-core.c +index 3d077d21200..c4afffbfb95 100644 +--- a/bfd/ptrace-core.c ++++ b/bfd/ptrace-core.c +@@ -160,9 +160,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_ptrace_vec = + { +diff --git a/bfd/sco5-core.c b/bfd/sco5-core.c +index d1f80c9079f..7807ac86a65 100644 +--- a/bfd/sco5-core.c ++++ b/bfd/sco5-core.c +@@ -340,9 +340,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_sco5_vec = + { +diff --git a/bfd/targets.c b/bfd/targets.c +index 05dd8236d91..f44b5c67724 100644 +--- a/bfd/targets.c ++++ b/bfd/targets.c +@@ -226,9 +226,9 @@ DESCRIPTION + . {* Entries for byte swapping for data. These are different from the + . other entry points, since they don't take a BFD as the first argument. + . Certain other handlers could do the same. *} +-. bfd_uint64_t (*bfd_getx64) (const void *); +-. bfd_int64_t (*bfd_getx_signed_64) (const void *); +-. void (*bfd_putx64) (bfd_uint64_t, void *); ++. uint64_t (*bfd_getx64) (const void *); ++. int64_t (*bfd_getx_signed_64) (const void *); ++. void (*bfd_putx64) (uint64_t, void *); + . bfd_vma (*bfd_getx32) (const void *); + . bfd_signed_vma (*bfd_getx_signed_32) (const void *); + . void (*bfd_putx32) (bfd_vma, void *); +@@ -237,9 +237,9 @@ DESCRIPTION + . void (*bfd_putx16) (bfd_vma, void *); + . + . {* Byte swapping for the headers. *} +-. bfd_uint64_t (*bfd_h_getx64) (const void *); +-. bfd_int64_t (*bfd_h_getx_signed_64) (const void *); +-. void (*bfd_h_putx64) (bfd_uint64_t, void *); ++. uint64_t (*bfd_h_getx64) (const void *); ++. int64_t (*bfd_h_getx_signed_64) (const void *); ++. void (*bfd_h_putx64) (uint64_t, void *); + . bfd_vma (*bfd_h_getx32) (const void *); + . bfd_signed_vma (*bfd_h_getx_signed_32) (const void *); + . void (*bfd_h_putx32) (bfd_vma, void *); +diff --git a/bfd/trad-core.c b/bfd/trad-core.c +index 92a279b6a72..8e9ee0d6667 100644 +--- a/bfd/trad-core.c ++++ b/bfd/trad-core.c +@@ -249,9 +249,9 @@ swap_abort (void) + #define NO_GET ((bfd_vma (*) (const void *)) swap_abort) + #define NO_PUT ((void (*) (bfd_vma, void *)) swap_abort) + #define NO_GETS ((bfd_signed_vma (*) (const void *)) swap_abort) +-#define NO_GET64 ((bfd_uint64_t (*) (const void *)) swap_abort) +-#define NO_PUT64 ((void (*) (bfd_uint64_t, void *)) swap_abort) +-#define NO_GETS64 ((bfd_int64_t (*) (const void *)) swap_abort) ++#define NO_GET64 ((uint64_t (*) (const void *)) swap_abort) ++#define NO_PUT64 ((void (*) (uint64_t, void *)) swap_abort) ++#define NO_GETS64 ((int64_t (*) (const void *)) swap_abort) + + const bfd_target core_trad_vec = + { +diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c +index 1129c98f0e2..fd0762811df 100644 +--- a/bfd/vms-alpha.c ++++ b/bfd/vms-alpha.c +@@ -522,7 +522,7 @@ _bfd_vms_slurp_eisd (bfd *abfd, unsigned int offset) + struct vms_eisd *eisd; + unsigned int rec_size; + unsigned int size; +- bfd_uint64_t vaddr; ++ uint64_t vaddr; + unsigned int flags; + unsigned int vbn; + char *name = NULL; +diff --git a/binutils/nm.c b/binutils/nm.c +index 60e4d850885..539c5688425 100644 +--- a/binutils/nm.c ++++ b/binutils/nm.c +@@ -1557,29 +1557,15 @@ get_print_format (void) + padding = "016"; + } + +- const char * length = "l"; +- if (print_width == 64) +- { +-#if BFD_HOST_64BIT_LONG +- ; +-#elif BFD_HOST_64BIT_LONG_LONG +-#ifndef __MSVCRT__ +- length = "ll"; +-#else +- length = "I64"; +-#endif +-#endif +- } +- + const char * radix = NULL; + switch (print_radix) + { +- case 8: radix = "o"; break; +- case 10: radix = "d"; break; +- case 16: radix = "x"; break; ++ case 8: radix = PRIo64; break; ++ case 10: radix = PRId64; break; ++ case 16: radix = PRIx64; break; + } + +- return concat ("%", padding, length, radix, NULL); ++ return concat ("%", padding, radix, NULL); + } + + static void +@@ -1874,33 +1860,8 @@ print_value (bfd *abfd ATTRIBUTE_UNUSED, bfd_vma val) + switch (print_width) + { + case 32: +- printf (print_format_string, (unsigned long) val); +- break; +- + case 64: +-#if BFD_HOST_64BIT_LONG || BFD_HOST_64BIT_LONG_LONG +- printf (print_format_string, val); +-#else +- /* We have a 64 bit value to print, but the host is only 32 bit. */ +- if (print_radix == 16) +- bfd_fprintf_vma (abfd, stdout, val); +- else +- { +- char buf[30]; +- char *s; +- +- s = buf + sizeof buf; +- *--s = '\0'; +- while (val > 0) +- { +- *--s = (val % print_radix) + '0'; +- val /= print_radix; +- } +- while ((buf + sizeof buf - 1) - s < 16) +- *--s = '0'; +- printf ("%s", s); +- } +-#endif ++ printf (print_format_string, (uint64_t) val); + break; + + default: +diff --git a/binutils/od-macho.c b/binutils/od-macho.c +index 56d448ac3bd..e91c87d2acf 100644 +--- a/binutils/od-macho.c ++++ b/binutils/od-macho.c +@@ -283,15 +283,6 @@ bfd_mach_o_print_flags (const bfd_mach_o_xlat_name *table, + printf ("-"); + } + +-/* Print a bfd_uint64_t, using a platform independent style. */ +- +-static void +-printf_uint64 (bfd_uint64_t v) +-{ +- printf ("0x%08lx%08lx", +- (unsigned long)((v >> 16) >> 16), (unsigned long)(v & 0xffffffffUL)); +-} +- + static const char * + bfd_mach_o_get_name_or_null (const bfd_mach_o_xlat_name *table, + unsigned long val) +@@ -1729,26 +1720,20 @@ dump_load_command (bfd *abfd, bfd_mach_o_load_command *cmd, + } + case BFD_MACH_O_LC_MAIN: + { +- bfd_mach_o_main_command *entry = &cmd->command.main; +- printf (" entry offset: "); +- printf_uint64 (entry->entryoff); +- printf ("\n" +- " stack size: "); +- printf_uint64 (entry->stacksize); +- printf ("\n"); +- break; ++ bfd_mach_o_main_command *entry = &cmd->command.main; ++ printf (" entry offset: %#016" PRIx64 "\n" ++ " stack size: %#016" PRIx64 "\n", ++ entry->entryoff, entry->stacksize); ++ break; + } + case BFD_MACH_O_LC_NOTE: + { +- bfd_mach_o_note_command *note = &cmd->command.note; +- printf (" data owner: %.16s\n", note->data_owner); +- printf (" offset: "); +- printf_uint64 (note->offset); +- printf ("\n" +- " size: "); +- printf_uint64 (note->size); +- printf ("\n"); +- break; ++ bfd_mach_o_note_command *note = &cmd->command.note; ++ printf (" data owner: %.16s\n" ++ " offset: %#016" PRIx64 "\n" ++ " size: %#016" PRIx64 "\n", ++ note->data_owner, note->offset, note->size); ++ break; + } + case BFD_MACH_O_LC_BUILD_VERSION: + dump_build_version (abfd, cmd); +@@ -2013,14 +1998,11 @@ dump_obj_compact_unwind (bfd *abfd, + { + e = (struct mach_o_compact_unwind_64 *) p; + +- putchar (' '); +- printf_uint64 (bfd_get_64 (abfd, e->start)); +- printf (" %08lx", (unsigned long)bfd_get_32 (abfd, e->length)); +- putchar (' '); +- printf_uint64 (bfd_get_64 (abfd, e->personality)); +- putchar (' '); +- printf_uint64 (bfd_get_64 (abfd, e->lsda)); +- putchar ('\n'); ++ printf (" %#016" PRIx64 " %#08x %#016" PRIx64 " %#016" PRIx64 "\n", ++ (uint64_t) bfd_get_64 (abfd, e->start), ++ (unsigned int) bfd_get_32 (abfd, e->length), ++ (uint64_t) bfd_get_64 (abfd, e->personality), ++ (uint64_t) bfd_get_64 (abfd, e->lsda)); + + printf (" encoding: "); + dump_unwind_encoding (mdata, bfd_get_32 (abfd, e->encoding)); +diff --git a/binutils/prdbg.c b/binutils/prdbg.c +index d6cbab8578b..c1e41628d26 100644 +--- a/binutils/prdbg.c ++++ b/binutils/prdbg.c +@@ -485,41 +485,12 @@ pop_type (struct pr_handle *info) + static void + print_vma (bfd_vma vma, char *buf, bool unsignedp, bool hexp) + { +- if (sizeof (vma) <= sizeof (unsigned long)) +- { +- if (hexp) +- sprintf (buf, "0x%lx", (unsigned long) vma); +- else if (unsignedp) +- sprintf (buf, "%lu", (unsigned long) vma); +- else +- sprintf (buf, "%ld", (long) vma); +- } +-#if BFD_HOST_64BIT_LONG_LONG +- else if (sizeof (vma) <= sizeof (unsigned long long)) +- { +-#ifndef __MSVCRT__ +- if (hexp) +- sprintf (buf, "0x%llx", (unsigned long long) vma); +- else if (unsignedp) +- sprintf (buf, "%llu", (unsigned long long) vma); +- else +- sprintf (buf, "%lld", (long long) vma); +-#else +- if (hexp) +- sprintf (buf, "0x%I64x", (unsigned long long) vma); +- else if (unsignedp) +- sprintf (buf, "%I64u", (unsigned long long) vma); +- else +- sprintf (buf, "%I64d", (long long) vma); +-#endif +- } +-#endif ++ if (hexp) ++ sprintf (buf, "%#" PRIx64, (uint64_t) vma); ++ else if (unsignedp) ++ sprintf (buf, "%" PRIu64, (uint64_t) vma); + else +- { +- buf[0] = '0'; +- buf[1] = 'x'; +- sprintf_vma (buf + 2, vma); +- } ++ sprintf (buf, "%" PRId64, (int64_t) vma); + } + + /* Start a new compilation unit. */ +diff --git a/binutils/readelf.c b/binutils/readelf.c +index c35bfc12366..4c0a2a34767 100644 +--- a/binutils/readelf.c ++++ b/binutils/readelf.c +@@ -10729,7 +10729,7 @@ dynamic_section_parisc_val (Elf_Internal_Dyn * entry) + /* Display a VMS time in a human readable format. */ + + static void +-print_vms_time (bfd_int64_t vmstime) ++print_vms_time (int64_t vmstime) + { + struct tm *tm = NULL; + time_t unxtime; +@@ -20764,7 +20764,7 @@ print_ia64_vms_note (Elf_Internal_Note * pnote) + /* FIXME: Generate an error if descsz > 8 ? */ + + printf ("0x%016" BFD_VMA_FMT "x\n", +- (bfd_vma) byte_get ((unsigned char *)pnote->descdata, 8)); ++ (bfd_vma) byte_get ((unsigned char *) pnote->descdata, 8)); + break; + + case NT_VMS_LINKTIME: +@@ -20773,8 +20773,7 @@ print_ia64_vms_note (Elf_Internal_Note * pnote) + goto desc_size_fail; + /* FIXME: Generate an error if descsz > 8 ? */ + +- print_vms_time +- ((bfd_int64_t) byte_get ((unsigned char *)pnote->descdata, 8)); ++ print_vms_time (byte_get ((unsigned char *) pnote->descdata, 8)); + printf ("\n"); + break; + +@@ -20784,8 +20783,7 @@ print_ia64_vms_note (Elf_Internal_Note * pnote) + goto desc_size_fail; + /* FIXME: Generate an error if descsz > 8 ? */ + +- print_vms_time +- ((bfd_int64_t) byte_get ((unsigned char *)pnote->descdata, 8)); ++ print_vms_time (byte_get ((unsigned char *) pnote->descdata, 8)); + printf ("\n"); + break; + +@@ -20794,16 +20792,15 @@ print_ia64_vms_note (Elf_Internal_Note * pnote) + goto desc_size_fail; + + printf (_(" Major id: %u, minor id: %u\n"), +- (unsigned) byte_get ((unsigned char *)pnote->descdata, 4), +- (unsigned) byte_get ((unsigned char *)pnote->descdata + 4, 4)); ++ (unsigned) byte_get ((unsigned char *) pnote->descdata, 4), ++ (unsigned) byte_get ((unsigned char *) pnote->descdata + 4, 4)); + printf (_(" Last modified : ")); +- print_vms_time +- ((bfd_int64_t) byte_get ((unsigned char *)pnote->descdata + 8, 8)); ++ print_vms_time (byte_get ((unsigned char *) pnote->descdata + 8, 8)); + printf (_("\n Link flags : ")); + printf ("0x%016" BFD_VMA_FMT "x\n", +- (bfd_vma) byte_get ((unsigned char *)pnote->descdata + 16, 8)); ++ (bfd_vma) byte_get ((unsigned char *) pnote->descdata + 16, 8)); + printf (_(" Header flags: 0x%08x\n"), +- (unsigned) byte_get ((unsigned char *)pnote->descdata + 24, 4)); ++ (unsigned) byte_get ((unsigned char *) pnote->descdata + 24, 4)); + printf (_(" Image id : %.*s\n"), maxlen - 32, pnote->descdata + 32); + break; + #endif +diff --git a/gas/config/tc-arm.c b/gas/config/tc-arm.c +index 1721097cfca..2e6d175482e 100644 +--- a/gas/config/tc-arm.c ++++ b/gas/config/tc-arm.c +@@ -3565,7 +3565,7 @@ add_to_lit_pool (unsigned int nbytes) + imm1 = inst.operands[1].imm; + imm2 = (inst.operands[1].regisimm ? inst.operands[1].reg + : inst.relocs[0].exp.X_unsigned ? 0 +- : ((bfd_int64_t) inst.operands[1].imm) >> 32); ++ : (int64_t) inst.operands[1].imm >> 32); + if (target_big_endian) + { + imm1 = imm2; +@@ -8819,15 +8819,14 @@ neon_cmode_for_move_imm (unsigned immlo, unsigned immhi, int float_p, + return FAIL; + } + +-#if defined BFD_HOST_64_BIT + /* Returns TRUE if double precision value V may be cast + to single precision without loss of accuracy. */ + + static bool +-is_double_a_single (bfd_uint64_t v) ++is_double_a_single (uint64_t v) + { + int exp = (v >> 52) & 0x7FF; +- bfd_uint64_t mantissa = v & 0xFFFFFFFFFFFFFULL; ++ uint64_t mantissa = v & 0xFFFFFFFFFFFFFULL; + + return ((exp == 0 || exp == 0x7FF + || (exp >= 1023 - 126 && exp <= 1023 + 127)) +@@ -8838,11 +8837,11 @@ is_double_a_single (bfd_uint64_t v) + (ignoring the least significant bits in exponent and mantissa). */ + + static int +-double_to_single (bfd_uint64_t v) ++double_to_single (uint64_t v) + { + unsigned int sign = (v >> 63) & 1; + int exp = (v >> 52) & 0x7FF; +- bfd_uint64_t mantissa = v & 0xFFFFFFFFFFFFFULL; ++ uint64_t mantissa = v & 0xFFFFFFFFFFFFFULL; + + if (exp == 0x7FF) + exp = 0xFF; +@@ -8865,7 +8864,6 @@ double_to_single (bfd_uint64_t v) + mantissa >>= 29; + return (sign << 31) | (exp << 23) | mantissa; + } +-#endif /* BFD_HOST_64_BIT */ + + enum lit_type + { +@@ -8914,11 +8912,7 @@ move_or_literal_pool (int i, enum lit_type t, bool mode_3) + if (inst.relocs[0].exp.X_op == O_constant + || inst.relocs[0].exp.X_op == O_big) + { +-#if defined BFD_HOST_64_BIT +- bfd_uint64_t v; +-#else +- valueT v; +-#endif ++ uint64_t v; + if (inst.relocs[0].exp.X_op == O_big) + { + LITTLENUM_TYPE w[X_PRECISION]; +@@ -8933,7 +8927,6 @@ move_or_literal_pool (int i, enum lit_type t, bool mode_3) + else + l = generic_bignum; + +-#if defined BFD_HOST_64_BIT + v = l[3] & LITTLENUM_MASK; + v <<= LITTLENUM_NUMBER_OF_BITS; + v |= l[2] & LITTLENUM_MASK; +@@ -8941,11 +8934,6 @@ move_or_literal_pool (int i, enum lit_type t, bool mode_3) + v |= l[1] & LITTLENUM_MASK; + v <<= LITTLENUM_NUMBER_OF_BITS; + v |= l[0] & LITTLENUM_MASK; +-#else +- v = l[1] & LITTLENUM_MASK; +- v <<= LITTLENUM_NUMBER_OF_BITS; +- v |= l[0] & LITTLENUM_MASK; +-#endif + } + else + v = inst.relocs[0].exp.X_add_number; +@@ -9041,7 +9029,7 @@ move_or_literal_pool (int i, enum lit_type t, bool mode_3) + ? inst.operands[1].reg + : inst.relocs[0].exp.X_unsigned + ? 0 +- : ((bfd_int64_t)((int) immlo)) >> 32; ++ : (int64_t) (int) immlo >> 32; + int cmode = neon_cmode_for_move_imm (immlo, immhi, false, &immbits, + &op, 64, NT_invtype); + +@@ -9090,7 +9078,6 @@ move_or_literal_pool (int i, enum lit_type t, bool mode_3) + discrepancy between the output produced by an assembler built for + a 32-bit-only host and the output produced from a 64-bit host, but + this cannot be helped. */ +-#if defined BFD_HOST_64_BIT + else if (!inst.operands[1].issingle + && ARM_CPU_HAS_FEATURE (cpu_variant, fpu_vfp_ext_v3)) + { +@@ -9103,7 +9090,6 @@ move_or_literal_pool (int i, enum lit_type t, bool mode_3) + return true; + } + } +-#endif + } + } + +diff --git a/gas/config/tc-csky.c b/gas/config/tc-csky.c +index 2371eeb747e..5b824d89af0 100644 +--- a/gas/config/tc-csky.c ++++ b/gas/config/tc-csky.c +@@ -215,7 +215,7 @@ enum + unsigned int mach_flag = 0; + unsigned int arch_flag = 0; + unsigned int other_flag = 0; +-BFD_HOST_U_64_BIT isa_flag = 0; ++uint64_t isa_flag = 0; + unsigned int dsp_flag = 0; + + typedef struct stack_size_entry +@@ -245,7 +245,7 @@ struct csky_macro_info + const char *name; + /* How many operands : if operands == 5, all of 1,2,3,4 are ok. */ + long oprnd_num; +- BFD_HOST_U_64_BIT isa_flag; ++ uint64_t isa_flag; + /* Do the work. */ + void (*handle_func)(void); + }; +@@ -591,14 +591,14 @@ struct csky_cpu_feature + { + const char unique; + unsigned int arch_flag; +- bfd_uint64_t isa_flag; ++ uint64_t isa_flag; + }; + + struct csky_cpu_version + { + int r; + int p; +- bfd_uint64_t isa_flag; ++ uint64_t isa_flag; + }; + + #define CSKY_FEATURE_MAX 10 +@@ -608,7 +608,7 @@ struct csky_cpu_info + { + const char *name; + unsigned int arch_flag; +- bfd_uint64_t isa_flag; ++ uint64_t isa_flag; + struct csky_cpu_feature features[CSKY_FEATURE_MAX]; + struct csky_cpu_version ver[CSKY_CPU_REVERISON_MAX]; + }; +diff --git a/gas/config/tc-sparc.c b/gas/config/tc-sparc.c +index 222223f3549..4e443b1d28d 100644 +--- a/gas/config/tc-sparc.c ++++ b/gas/config/tc-sparc.c +@@ -75,10 +75,10 @@ static enum { MM_TSO, MM_PSO, MM_RMO } sparc_memory_model = MM_RMO; + #ifndef TE_SOLARIS + /* Bitmask of instruction types seen so far, used to populate the + GNU attributes section with hwcap information. */ +-static bfd_uint64_t hwcap_seen; ++static uint64_t hwcap_seen; + #endif + +-static bfd_uint64_t hwcap_allowed; ++static uint64_t hwcap_allowed; + + static int architecture_requested; + static int warn_on_bump; +@@ -498,15 +498,15 @@ md_parse_option (int c, const char *arg) + || opcode_arch > max_architecture) + max_architecture = opcode_arch; + +- /* The allowed hardware capabilities are the implied by the +- opcodes arch plus any extra capabilities defined in the GAS +- arch. */ +- hwcap_allowed +- = (hwcap_allowed +- | (((bfd_uint64_t) sparc_opcode_archs[opcode_arch].hwcaps2) << 32) +- | (((bfd_uint64_t) sa->hwcap2_allowed) << 32) +- | sparc_opcode_archs[opcode_arch].hwcaps +- | sa->hwcap_allowed); ++ /* The allowed hardware capabilities are the implied by the ++ opcodes arch plus any extra capabilities defined in the GAS ++ arch. */ ++ hwcap_allowed ++ = (hwcap_allowed ++ | ((uint64_t) sparc_opcode_archs[opcode_arch].hwcaps2 << 32) ++ | ((uint64_t) sa->hwcap2_allowed << 32) ++ | sparc_opcode_archs[opcode_arch].hwcaps ++ | sa->hwcap_allowed); + architecture_requested = 1; + } + break; +@@ -1607,7 +1607,7 @@ md_assemble (char *str) + } + + static const char * +-get_hwcap_name (bfd_uint64_t mask) ++get_hwcap_name (uint64_t mask) + { + if (mask & HWCAP_MUL32) + return "mul32"; +@@ -3171,8 +3171,7 @@ sparc_ip (char *str, const struct sparc_opcode **pinsn) + msg_str = sasi->name; + } + +- bfd_uint64_t hwcaps +- = (((bfd_uint64_t) insn->hwcaps2) << 32) | insn->hwcaps; ++ uint64_t hwcaps = ((uint64_t) insn->hwcaps2 << 32) | insn->hwcaps; + + #ifndef TE_SOLARIS + if (hwcaps) +@@ -3211,10 +3210,10 @@ sparc_ip (char *str, const struct sparc_opcode **pinsn) + } + current_architecture = needed_architecture; + hwcap_allowed +- = (hwcap_allowed +- | hwcaps +- | (((bfd_uint64_t) sparc_opcode_archs[current_architecture].hwcaps2) << 32) +- | sparc_opcode_archs[current_architecture].hwcaps); ++ = (hwcap_allowed ++ | hwcaps ++ | ((uint64_t) sparc_opcode_archs[current_architecture].hwcaps2 << 32) ++ | sparc_opcode_archs[current_architecture].hwcaps); + } + /* Conflict. */ + /* ??? This seems to be a bit fragile. What if the next entry in +diff --git a/gas/config/tc-tilegx.c b/gas/config/tc-tilegx.c +index b627b7080e5..4fcc38c9034 100644 +--- a/gas/config/tc-tilegx.c ++++ b/gas/config/tc-tilegx.c +@@ -789,16 +789,16 @@ emit_tilegx_instruction (tilegx_bundle_bits bits, + static void + check_illegal_reg_writes (void) + { +- BFD_HOST_U_64_BIT all_regs_written = 0; ++ uint64_t all_regs_written = 0; + int j; + + for (j = 0; j < current_bundle_index; j++) + { + const struct tilegx_instruction *instr = ¤t_bundle[j]; + int k; +- BFD_HOST_U_64_BIT regs = +- ((BFD_HOST_U_64_BIT)1) << instr->opcode->implicitly_written_register; +- BFD_HOST_U_64_BIT conflict; ++ uint64_t regs = ++ (uint64_t) 1 << instr->opcode->implicitly_written_register; ++ uint64_t conflict; + + for (k = 0; k < instr->opcode->num_operands; k++) + { +@@ -808,12 +808,12 @@ check_illegal_reg_writes (void) + if (operand->is_dest_reg) + { + int regno = instr->operand_values[k].X_add_number; +- BFD_HOST_U_64_BIT mask = ((BFD_HOST_U_64_BIT)1) << regno; ++ uint64_t mask = (uint64_t) 1 << regno; + +- if ((mask & ( (((BFD_HOST_U_64_BIT)1) << TREG_IDN1) +- | (((BFD_HOST_U_64_BIT)1) << TREG_UDN1) +- | (((BFD_HOST_U_64_BIT)1) << TREG_UDN2) +- | (((BFD_HOST_U_64_BIT)1) << TREG_UDN3))) != 0 ++ if ((mask & ( ((uint64_t) 1 << TREG_IDN1) ++ | ((uint64_t) 1 << TREG_UDN1) ++ | ((uint64_t) 1 << TREG_UDN2) ++ | ((uint64_t) 1 << TREG_UDN3))) != 0 + && !allow_suspicious_bundles) + { + as_bad (_("Writes to register '%s' are not allowed."), +@@ -825,7 +825,7 @@ check_illegal_reg_writes (void) + } + + /* Writing to the zero register doesn't count. */ +- regs &= ~(((BFD_HOST_U_64_BIT)1) << TREG_ZERO); ++ regs &= ~((uint64_t) 1 << TREG_ZERO); + + conflict = all_regs_written & regs; + if (conflict != 0 && !allow_suspicious_bundles) +diff --git a/gas/config/tc-tilepro.c b/gas/config/tc-tilepro.c +index af0be422f98..ca092d77a4b 100644 +--- a/gas/config/tc-tilepro.c ++++ b/gas/config/tc-tilepro.c +@@ -677,16 +677,16 @@ emit_tilepro_instruction (tilepro_bundle_bits bits, + static void + check_illegal_reg_writes (void) + { +- BFD_HOST_U_64_BIT all_regs_written = 0; ++ uint64_t all_regs_written = 0; + int j; + + for (j = 0; j < current_bundle_index; j++) + { + const struct tilepro_instruction *instr = ¤t_bundle[j]; + int k; +- BFD_HOST_U_64_BIT regs = +- ((BFD_HOST_U_64_BIT)1) << instr->opcode->implicitly_written_register; +- BFD_HOST_U_64_BIT conflict; ++ uint64_t regs = ++ (uint64_t) 1 << instr->opcode->implicitly_written_register; ++ uint64_t conflict; + + for (k = 0; k < instr->opcode->num_operands; k++) + { +@@ -696,12 +696,12 @@ check_illegal_reg_writes (void) + if (operand->is_dest_reg) + { + int regno = instr->operand_values[k].X_add_number; +- BFD_HOST_U_64_BIT mask = ((BFD_HOST_U_64_BIT)1) << regno; ++ uint64_t mask = (uint64_t) 1 << regno; + +- if ((mask & ( (((BFD_HOST_U_64_BIT)1) << TREG_IDN1) +- | (((BFD_HOST_U_64_BIT)1) << TREG_UDN1) +- | (((BFD_HOST_U_64_BIT)1) << TREG_UDN2) +- | (((BFD_HOST_U_64_BIT)1) << TREG_UDN3))) != 0 ++ if ((mask & ( ((uint64_t) 1 << TREG_IDN1) ++ | ((uint64_t) 1 << TREG_UDN1) ++ | ((uint64_t) 1 << TREG_UDN2) ++ | ((uint64_t) 1 << TREG_UDN3))) != 0 + && !allow_suspicious_bundles) + { + as_bad (_("Writes to register '%s' are not allowed."), +@@ -713,7 +713,7 @@ check_illegal_reg_writes (void) + } + + /* Writing to the zero register doesn't count. */ +- regs &= ~(((BFD_HOST_U_64_BIT)1) << TREG_ZERO); ++ regs &= ~((uint64_t) 1 << TREG_ZERO); + + conflict = all_regs_written & regs; + if (conflict != 0 && !allow_suspicious_bundles) +diff --git a/gas/config/tc-z80.c b/gas/config/tc-z80.c +index 81fbfe3b0ae..714e704e24a 100644 +--- a/gas/config/tc-z80.c ++++ b/gas/config/tc-z80.c +@@ -3910,11 +3910,11 @@ z80_tc_label_is_local (const char *name) + #define EXP_MIN -0x10000 + #define EXP_MAX 0x10000 + static int +-str_to_broken_float (bool *signP, bfd_uint64_t *mantissaP, int *expP) ++str_to_broken_float (bool *signP, uint64_t *mantissaP, int *expP) + { + char *p; + bool sign; +- bfd_uint64_t mantissa = 0; ++ uint64_t mantissa = 0; + int exponent = 0; + int i; + +@@ -4029,7 +4029,7 @@ str_to_broken_float (bool *signP, bfd_uint64_t *mantissaP, int *expP) + static const char * + str_to_zeda32(char *litP, int *sizeP) + { +- bfd_uint64_t mantissa; ++ uint64_t mantissa; + bool sign; + int exponent; + unsigned i; +@@ -4088,7 +4088,7 @@ str_to_zeda32(char *litP, int *sizeP) + static const char * + str_to_float48(char *litP, int *sizeP) + { +- bfd_uint64_t mantissa; ++ uint64_t mantissa; + bool sign; + int exponent; + unsigned i; +diff --git a/gas/config/te-vms.c b/gas/config/te-vms.c +index 015c95867f0..6661a3b6a72 100644 +--- a/gas/config/te-vms.c ++++ b/gas/config/te-vms.c +@@ -339,7 +339,7 @@ vms_file_stats_name (const char *dirname, + return 0; + } + +-bfd_uint64_t ++uint64_t + vms_dwarf2_file_time_name (const char *filename, const char *dirname) + { + long long cdt; +diff --git a/gas/config/te-vms.h b/gas/config/te-vms.h +index ffe7f5e8f37..08f218502de 100644 +--- a/gas/config/te-vms.h ++++ b/gas/config/te-vms.h +@@ -20,7 +20,7 @@ + #define TE_VMS + #include "obj-format.h" + +-extern bfd_uint64_t vms_dwarf2_file_time_name (const char *, const char *); ++extern uint64_t vms_dwarf2_file_time_name (const char *, const char *); + extern long vms_dwarf2_file_size_name (const char *, const char *); + extern char *vms_dwarf2_file_name (const char *, const char *); + +diff --git a/gdb/findcmd.c b/gdb/findcmd.c +index ff13f22e970..ed2cea7b74d 100644 +--- a/gdb/findcmd.c ++++ b/gdb/findcmd.c +@@ -30,7 +30,7 @@ + /* Copied from bfd_put_bits. */ + + static void +-put_bits (bfd_uint64_t data, gdb::byte_vector &buf, int bits, bfd_boolean big_p) ++put_bits (uint64_t data, gdb::byte_vector &buf, int bits, bfd_boolean big_p) + { + int i; + int bytes; +diff --git a/gdb/tilegx-tdep.c b/gdb/tilegx-tdep.c +index 7930db72779..9668aa80b53 100644 +--- a/gdb/tilegx-tdep.c ++++ b/gdb/tilegx-tdep.c +@@ -375,7 +375,7 @@ tilegx_analyze_prologue (struct gdbarch* gdbarch, + CORE_ADDR instbuf_start; + unsigned int instbuf_size; + int status; +- bfd_uint64_t bundle; ++ uint64_t bundle; + struct tilegx_decoded_instruction + decoded[TILEGX_MAX_INSTRUCTIONS_PER_BUNDLE]; + int num_insns; +diff --git a/gprof/gmon_io.c b/gprof/gmon_io.c +index c613809d396..2b4dd26375b 100644 +--- a/gprof/gmon_io.c ++++ b/gprof/gmon_io.c +@@ -48,10 +48,8 @@ enum gmon_ptr_signedness { + static enum gmon_ptr_size gmon_get_ptr_size (void); + static enum gmon_ptr_signedness gmon_get_ptr_signedness (void); + +-#ifdef BFD_HOST_U_64_BIT +-static int gmon_io_read_64 (FILE *, BFD_HOST_U_64_BIT *); +-static int gmon_io_write_64 (FILE *, BFD_HOST_U_64_BIT); +-#endif ++static int gmon_io_read_64 (FILE *, uint64_t *); ++static int gmon_io_write_64 (FILE *, uint64_t); + static int gmon_read_raw_arc + (FILE *, bfd_vma *, bfd_vma *, unsigned long *); + static int gmon_write_raw_arc +@@ -109,9 +107,8 @@ gmon_io_read_32 (FILE *ifp, unsigned int *valp) + return 0; + } + +-#ifdef BFD_HOST_U_64_BIT + static int +-gmon_io_read_64 (FILE *ifp, BFD_HOST_U_64_BIT *valp) ++gmon_io_read_64 (FILE *ifp, uint64_t *valp) + { + char buf[8]; + +@@ -120,15 +117,12 @@ gmon_io_read_64 (FILE *ifp, BFD_HOST_U_64_BIT *valp) + *valp = bfd_get_64 (core_bfd, buf); + return 0; + } +-#endif + + int + gmon_io_read_vma (FILE *ifp, bfd_vma *valp) + { + unsigned int val32; +-#ifdef BFD_HOST_U_64_BIT +- BFD_HOST_U_64_BIT val64; +-#endif ++ uint64_t val64; + + switch (gmon_get_ptr_size ()) + { +@@ -136,23 +130,19 @@ gmon_io_read_vma (FILE *ifp, bfd_vma *valp) + if (gmon_io_read_32 (ifp, &val32)) + return 1; + if (gmon_get_ptr_signedness () == ptr_signed) +- *valp = (int) val32; ++ *valp = (int) val32; + else +- *valp = val32; ++ *valp = val32; + break; + +-#ifdef BFD_HOST_U_64_BIT + case ptr_64bit: + if (gmon_io_read_64 (ifp, &val64)) + return 1; +-#ifdef BFD_HOST_64_BIT + if (gmon_get_ptr_signedness () == ptr_signed) +- *valp = (BFD_HOST_64_BIT) val64; ++ *valp = (int64_t) val64; + else +-#endif +- *valp = val64; ++ *valp = val64; + break; +-#endif + } + return 0; + } +@@ -176,9 +166,8 @@ gmon_io_write_32 (FILE *ofp, unsigned int val) + return 0; + } + +-#ifdef BFD_HOST_U_64_BIT + static int +-gmon_io_write_64 (FILE *ofp, BFD_HOST_U_64_BIT val) ++gmon_io_write_64 (FILE *ofp, uint64_t val) + { + char buf[8]; + +@@ -187,7 +176,6 @@ gmon_io_write_64 (FILE *ofp, BFD_HOST_U_64_BIT val) + return 1; + return 0; + } +-#endif + + int + gmon_io_write_vma (FILE *ofp, bfd_vma val) +@@ -200,12 +188,10 @@ gmon_io_write_vma (FILE *ofp, bfd_vma val) + return 1; + break; + +-#ifdef BFD_HOST_U_64_BIT + case ptr_64bit: +- if (gmon_io_write_64 (ofp, (BFD_HOST_U_64_BIT) val)) ++ if (gmon_io_write_64 (ofp, (uint64_t) val)) + return 1; + break; +-#endif + } + return 0; + } +@@ -232,9 +218,7 @@ gmon_io_write (FILE *ofp, char *buf, size_t n) + static int + gmon_read_raw_arc (FILE *ifp, bfd_vma *fpc, bfd_vma *spc, unsigned long *cnt) + { +-#ifdef BFD_HOST_U_64_BIT +- BFD_HOST_U_64_BIT cnt64; +-#endif ++ uint64_t cnt64; + unsigned int cnt32; + + if (gmon_io_read_vma (ifp, fpc) +@@ -249,13 +233,11 @@ gmon_read_raw_arc (FILE *ifp, bfd_vma *fpc, bfd_vma *spc, unsigned long *cnt) + *cnt = cnt32; + break; + +-#ifdef BFD_HOST_U_64_BIT + case ptr_64bit: + if (gmon_io_read_64 (ifp, &cnt64)) + return 1; + *cnt = cnt64; + break; +-#endif + + default: + return 1; +@@ -278,12 +260,10 @@ gmon_write_raw_arc (FILE *ofp, bfd_vma fpc, bfd_vma spc, unsigned long cnt) + return 1; + break; + +-#ifdef BFD_HOST_U_64_BIT + case ptr_64bit: +- if (gmon_io_write_64 (ofp, (BFD_HOST_U_64_BIT) cnt)) ++ if (gmon_io_write_64 (ofp, (uint64_t) cnt)) + return 1; + break; +-#endif + } + return 0; + } +diff --git a/include/elf/nfp.h b/include/elf/nfp.h +index 5a06051196c..c89cefff27b 100644 +--- a/include/elf/nfp.h ++++ b/include/elf/nfp.h +@@ -102,7 +102,7 @@ extern "C" + #define SHF_NFP_INIT 0x80000000 + #define SHF_NFP_INIT2 0x40000000 + #define SHF_NFP_SCS(shf) (((shf) >> 32) & 0xFF) +-#define SHF_NFP_SET_SCS(v) (((BFD_HOST_U_64_BIT)((v) & 0xFF)) << 32) ++#define SHF_NFP_SET_SCS(v) ((uint64_t) ((v) & 0xFF) << 32) + + /* NFP Section Info + For PROGBITS and NOBITS sections: +diff --git a/include/opcode/csky.h b/include/opcode/csky.h +index ed00bfd7cd6..faecba11611 100644 +--- a/include/opcode/csky.h ++++ b/include/opcode/csky.h +@@ -22,46 +22,46 @@ + #include "dis-asm.h" + + /* The following bitmasks control instruction set architecture. */ +-#define CSKYV1_ISA_E1 ((bfd_uint64_t)1 << 0) +-#define CSKYV2_ISA_E1 ((bfd_uint64_t)1 << 1) +-#define CSKYV2_ISA_1E2 ((bfd_uint64_t)1 << 2) +-#define CSKYV2_ISA_2E3 ((bfd_uint64_t)1 << 3) +-#define CSKYV2_ISA_3E7 ((bfd_uint64_t)1 << 4) +-#define CSKYV2_ISA_7E10 ((bfd_uint64_t)1 << 5) +-#define CSKYV2_ISA_3E3R1 ((bfd_uint64_t)1 << 6) +-#define CSKYV2_ISA_3E3R2 ((bfd_uint64_t)1 << 7) +-#define CSKYV2_ISA_10E60 ((bfd_uint64_t)1 << 8) +-#define CSKYV2_ISA_3E3R3 ((bfd_uint64_t)1 << 9) +- +-#define CSKY_ISA_TRUST ((bfd_uint64_t)1 << 11) +-#define CSKY_ISA_CACHE ((bfd_uint64_t)1 << 12) +-#define CSKY_ISA_NVIC ((bfd_uint64_t)1 << 13) +-#define CSKY_ISA_CP ((bfd_uint64_t)1 << 14) +-#define CSKY_ISA_MP ((bfd_uint64_t)1 << 15) +-#define CSKY_ISA_MP_1E2 ((bfd_uint64_t)1 << 16) +-#define CSKY_ISA_JAVA ((bfd_uint64_t)1 << 17) +-#define CSKY_ISA_MAC ((bfd_uint64_t)1 << 18) +-#define CSKY_ISA_MAC_DSP ((bfd_uint64_t)1 << 19) ++#define CSKYV1_ISA_E1 ((uint64_t) 1 << 0) ++#define CSKYV2_ISA_E1 ((uint64_t) 1 << 1) ++#define CSKYV2_ISA_1E2 ((uint64_t) 1 << 2) ++#define CSKYV2_ISA_2E3 ((uint64_t) 1 << 3) ++#define CSKYV2_ISA_3E7 ((uint64_t) 1 << 4) ++#define CSKYV2_ISA_7E10 ((uint64_t) 1 << 5) ++#define CSKYV2_ISA_3E3R1 ((uint64_t) 1 << 6) ++#define CSKYV2_ISA_3E3R2 ((uint64_t) 1 << 7) ++#define CSKYV2_ISA_10E60 ((uint64_t) 1 << 8) ++#define CSKYV2_ISA_3E3R3 ((uint64_t) 1 << 9) ++ ++#define CSKY_ISA_TRUST ((uint64_t) 1 << 11) ++#define CSKY_ISA_CACHE ((uint64_t) 1 << 12) ++#define CSKY_ISA_NVIC ((uint64_t) 1 << 13) ++#define CSKY_ISA_CP ((uint64_t) 1 << 14) ++#define CSKY_ISA_MP ((uint64_t) 1 << 15) ++#define CSKY_ISA_MP_1E2 ((uint64_t) 1 << 16) ++#define CSKY_ISA_JAVA ((uint64_t) 1 << 17) ++#define CSKY_ISA_MAC ((uint64_t) 1 << 18) ++#define CSKY_ISA_MAC_DSP ((uint64_t) 1 << 19) + + /* Base ISA for csky v1 and v2. */ +-#define CSKY_ISA_DSP ((bfd_uint64_t)1 << 20) +-#define CSKY_ISA_DSP_1E2 ((bfd_uint64_t)1 << 21) +-#define CSKY_ISA_DSP_ENHANCE ((bfd_uint64_t)1 << 22) +-#define CSKY_ISA_DSPE60 ((bfd_uint64_t)1 << 23) ++#define CSKY_ISA_DSP ((uint64_t) 1 << 20) ++#define CSKY_ISA_DSP_1E2 ((uint64_t) 1 << 21) ++#define CSKY_ISA_DSP_ENHANCE ((uint64_t) 1 << 22) ++#define CSKY_ISA_DSPE60 ((uint64_t) 1 << 23) + + /* Base float instruction (803f & 810f). */ +-#define CSKY_ISA_FLOAT_E1 ((bfd_uint64_t)1 << 25) ++#define CSKY_ISA_FLOAT_E1 ((uint64_t) 1 << 25) + /* M_FLOAT support (810f). */ +-#define CSKY_ISA_FLOAT_1E2 ((bfd_uint64_t)1 << 26) ++#define CSKY_ISA_FLOAT_1E2 ((uint64_t) 1 << 26) + /* 803 support (803f). */ +-#define CSKY_ISA_FLOAT_1E3 ((bfd_uint64_t)1 << 27) ++#define CSKY_ISA_FLOAT_1E3 ((uint64_t) 1 << 27) + /* 807 support (803f & 807f). */ +-#define CSKY_ISA_FLOAT_3E4 ((bfd_uint64_t)1 << 28) ++#define CSKY_ISA_FLOAT_3E4 ((uint64_t) 1 << 28) + /* 860 support. */ +-#define CSKY_ISA_FLOAT_7E60 ((bfd_uint64_t)1 << 36) ++#define CSKY_ISA_FLOAT_7E60 ((uint64_t) 1 << 36) + /* Vector DSP support. */ +-#define CSKY_ISA_VDSP ((bfd_uint64_t)1 << 29) +-#define CSKY_ISA_VDSP_2 ((bfd_uint64_t)1 << 30) ++#define CSKY_ISA_VDSP ((uint64_t) 1 << 29) ++#define CSKY_ISA_VDSP_2 ((uint64_t) 1 << 30) + + /* The following bitmasks control cpu architecture for CSKY. */ + #define CSKY_ABI_V1 (1 << 28) +diff --git a/include/opcode/ia64.h b/include/opcode/ia64.h +index fbdd8f14e65..42a6812c3f8 100644 +--- a/include/opcode/ia64.h ++++ b/include/opcode/ia64.h +@@ -29,7 +29,7 @@ + extern "C" { + #endif + +-typedef BFD_HOST_U_64_BIT ia64_insn; ++typedef uint64_t ia64_insn; + + enum ia64_insn_type + { +diff --git a/opcodes/csky-dis.c b/opcodes/csky-dis.c +index b7c833623e5..99103ff57b5 100644 +--- a/opcodes/csky-dis.c ++++ b/opcodes/csky-dis.c +@@ -49,7 +49,7 @@ struct csky_dis_info + disassemble_info *info; + /* Opcode information. */ + struct csky_opcode_info const *opinfo; +- BFD_HOST_U_64_BIT isa; ++ uint64_t isa; + /* The value of operand to show. */ + int value; + /* Whether to look up/print a symbol name. */ +diff --git a/opcodes/csky-opc.h b/opcodes/csky-opc.h +index b65efe19d9f..d2db90ede95 100644 +--- a/opcodes/csky-opc.h ++++ b/opcodes/csky-opc.h +@@ -271,8 +271,8 @@ struct csky_opcode + /* Encodings for 32-bit opcodes. */ + struct csky_opcode_info op32[OP_TABLE_NUM]; + /* Instruction set flag. */ +- BFD_HOST_U_64_BIT isa_flag16; +- BFD_HOST_U_64_BIT isa_flag32; ++ uint64_t isa_flag16; ++ uint64_t isa_flag32; + /* Whether this insn needs relocation, 0: no, !=0: yes. */ + signed int reloc16; + signed int reloc32; +diff --git a/opcodes/ia64-dis.c b/opcodes/ia64-dis.c +index 5eb37277a5d..e76f40393c6 100644 +--- a/opcodes/ia64-dis.c ++++ b/opcodes/ia64-dis.c +@@ -73,7 +73,7 @@ print_insn_ia64 (bfd_vma memaddr, struct disassemble_info *info) + const struct ia64_operand *odesc; + const struct ia64_opcode *idesc; + const char *err, *str, *tname; +- BFD_HOST_U_64_BIT value; ++ uint64_t value; + bfd_byte bundle[16]; + enum ia64_unit unit; + char regname[16]; +-- +2.31.1 + diff --git a/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-3.patch b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-3.patch new file mode 100644 index 0000000000..6a838ea3ea --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-3.patch @@ -0,0 +1,156 @@ +From 31d6c13defeba7716ebc9d5c8f81f2f35fe39980 Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Tue, 14 Jun 2022 12:46:42 +0930 +Subject: [PATCH] PR29230, segv in lookup_symbol_in_variable_table + +The PR23230 testcase uses indexed strings without specifying +SW_AT_str_offsets_base. In this case we left u.str with garbage (from +u.val) which then led to a segfault when attempting to access the +string. Fix that by clearing u.str. The patch also adds missing +sanity checks in the recently committed read_indexed_address and +read_indexed_string functions. + + PR 29230 + * dwarf2.c (read_indexed_address): Return uint64_t. Sanity check idx. + (read_indexed_string): Use uint64_t for str_offset. Sanity check idx. + (read_attribute_value): Clear u.str for indexed string forms when + DW_AT_str_offsets_base is not yet read or missing. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=31d6c13defeba7716ebc9d5c8f81f2f35fe39980] + +CVE: CVE-2023-1579 + +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> + +--- + bfd/dwarf2.c | 51 ++++++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 42 insertions(+), 9 deletions(-) + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index 51018e1ab45..aaa2d84887f 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -1353,13 +1353,13 @@ is_addrx_form (enum dwarf_form form) + + /* Returns the address in .debug_addr section using DW_AT_addr_base. + Used to implement DW_FORM_addrx*. */ +-static bfd_vma ++static uint64_t + read_indexed_address (uint64_t idx, struct comp_unit *unit) + { + struct dwarf2_debug *stash = unit->stash; + struct dwarf2_debug_file *file = unit->file; +- size_t addr_base = unit->dwarf_addr_offset; + bfd_byte *info_ptr; ++ size_t offset; + + if (stash == NULL) + return 0; +@@ -1369,12 +1369,23 @@ read_indexed_address (uint64_t idx, struct comp_unit *unit) + &file->dwarf_addr_buffer, &file->dwarf_addr_size)) + return 0; + +- info_ptr = file->dwarf_addr_buffer + addr_base + idx * unit->offset_size; ++ if (_bfd_mul_overflow (idx, unit->offset_size, &offset)) ++ return 0; ++ ++ offset += unit->dwarf_addr_offset; ++ if (offset < unit->dwarf_addr_offset ++ || offset > file->dwarf_addr_size ++ || file->dwarf_addr_size - offset < unit->offset_size) ++ return 0; ++ ++ info_ptr = file->dwarf_addr_buffer + offset; + + if (unit->offset_size == 4) + return bfd_get_32 (unit->abfd, info_ptr); +- else ++ else if (unit->offset_size == 8) + return bfd_get_64 (unit->abfd, info_ptr); ++ else ++ return 0; + } + + /* Returns the string using DW_AT_str_offsets_base. +@@ -1385,7 +1396,8 @@ read_indexed_string (uint64_t idx, struct comp_unit *unit) + struct dwarf2_debug *stash = unit->stash; + struct dwarf2_debug_file *file = unit->file; + bfd_byte *info_ptr; +- unsigned long str_offset; ++ uint64_t str_offset; ++ size_t offset; + + if (stash == NULL) + return NULL; +@@ -1401,15 +1413,26 @@ read_indexed_string (uint64_t idx, struct comp_unit *unit) + &file->dwarf_str_offsets_size)) + return NULL; + +- info_ptr = (file->dwarf_str_offsets_buffer +- + unit->dwarf_str_offset +- + idx * unit->offset_size); ++ if (_bfd_mul_overflow (idx, unit->offset_size, &offset)) ++ return NULL; ++ ++ offset += unit->dwarf_str_offset; ++ if (offset < unit->dwarf_str_offset ++ || offset > file->dwarf_str_offsets_size ++ || file->dwarf_str_offsets_size - offset < unit->offset_size) ++ return NULL; ++ ++ info_ptr = file->dwarf_str_offsets_buffer + offset; + + if (unit->offset_size == 4) + str_offset = bfd_get_32 (unit->abfd, info_ptr); +- else ++ else if (unit->offset_size == 8) + str_offset = bfd_get_64 (unit->abfd, info_ptr); ++ else ++ return NULL; + ++ if (str_offset >= file->dwarf_str_size) ++ return NULL; + return (const char *) file->dwarf_str_buffer + str_offset; + } + +@@ -1534,27 +1557,37 @@ read_attribute_value (struct attribute * attr, + is not yet read. */ + if (unit->dwarf_str_offset != 0) + attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ else ++ attr->u.str = NULL; + break; + case DW_FORM_strx2: + attr->u.val = read_2_bytes (abfd, &info_ptr, info_ptr_end); + if (unit->dwarf_str_offset != 0) + attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ else ++ attr->u.str = NULL; + break; + case DW_FORM_strx3: + attr->u.val = read_3_bytes (abfd, &info_ptr, info_ptr_end); + if (unit->dwarf_str_offset != 0) + attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ else ++ attr->u.str = NULL; + break; + case DW_FORM_strx4: + attr->u.val = read_4_bytes (abfd, &info_ptr, info_ptr_end); + if (unit->dwarf_str_offset != 0) + attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ else ++ attr->u.str = NULL; + break; + case DW_FORM_strx: + attr->u.val = _bfd_safe_read_leb128 (abfd, &info_ptr, + false, info_ptr_end); + if (unit->dwarf_str_offset != 0) + attr->u.str = (char *) read_indexed_string (attr->u.val, unit); ++ else ++ attr->u.str = NULL; + break; + case DW_FORM_exprloc: + case DW_FORM_block: +-- +2.31.1 + diff --git a/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-4.patch b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-4.patch new file mode 100644 index 0000000000..c5a869ca9d --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0021-CVE-2023-1579-4.patch @@ -0,0 +1,37 @@ +From 3e307d538c351aa9327cbad672c884059ecc20dd Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Wed, 11 Jan 2023 12:13:46 +0000 +Subject: [PATCH] Fix a potential illegal memory access in the BFD library when + parsing a corrupt DWARF file. + + PR 29988 + * dwarf2.c (read_indexed_address): Fix check for an out of range + offset. + +Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=3e307d538c351aa9327cbad672c884059ecc20dd] + +CVE: CVE-2023-1579 + +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> + +--- + bfd/ChangeLog | 6 ++++++ + bfd/dwarf2.c | 2 +- + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index 6eb6e04e6e5..4ec0053a111 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -1412,7 +1412,7 @@ read_indexed_address (uint64_t idx, struct comp_unit *unit) + offset += unit->dwarf_addr_offset; + if (offset < unit->dwarf_addr_offset + || offset > file->dwarf_addr_size +- || file->dwarf_addr_size - offset < unit->offset_size) ++ || file->dwarf_addr_size - offset < unit->addr_size) + return 0; + + info_ptr = file->dwarf_addr_buffer + offset; +-- +2.31.1 + diff --git a/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-1.patch b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-1.patch new file mode 100644 index 0000000000..990243f5c9 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-1.patch @@ -0,0 +1,56 @@ +From: Alan Modra <amodra@gmail.com> +Date: Thu, 17 Mar 2022 09:35:39 +0000 (+1030) +Subject: ubsan: Null dereference in parse_module +X-Git-Tag: gdb-12.1-release~59 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c9178f285acf19e066be8367185d52837161b0a2 + +ubsan: Null dereference in parse_module + + * vms-alpha.c (parse_module): Sanity check that DST__K_RTNBEG + has set module->func_table for DST__K_RTNEND. Check return + of bfd_zalloc. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c9178f285acf19e066be8367185d52837161b0a2] + +CVE: CVE-2023-25584 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +--- + +diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c +index 4a92574c850..1129c98f0e2 100644 +--- a/bfd/vms-alpha.c ++++ b/bfd/vms-alpha.c +@@ -4352,9 +4352,13 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + + /* Initialize tables with zero element. */ + curr_srec = (struct srecinfo *) bfd_zalloc (abfd, sizeof (struct srecinfo)); ++ if (!curr_srec) ++ return false; + module->srec_table = curr_srec; + + curr_line = (struct lineinfo *) bfd_zalloc (abfd, sizeof (struct lineinfo)); ++ if (!curr_line) ++ return false; + module->line_table = curr_line; + + while (length == -1 || ptr < maxptr) +@@ -4389,6 +4393,8 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + case DST__K_RTNBEG: + funcinfo = (struct funcinfo *) + bfd_zalloc (abfd, sizeof (struct funcinfo)); ++ if (!funcinfo) ++ return false; + funcinfo->name + = _bfd_vms_save_counted_string (abfd, ptr + DST_S_B_RTNBEG_NAME, + maxptr - (ptr + DST_S_B_RTNBEG_NAME)); +@@ -4401,6 +4407,8 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + break; + + case DST__K_RTNEND: ++ if (!module->func_table) ++ return false; + module->func_table->high = module->func_table->low + + bfd_getl32 (ptr + DST_S_L_RTNEND_SIZE) - 1; + diff --git a/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-2.patch b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-2.patch new file mode 100644 index 0000000000..f4c5ed2aff --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-2.patch @@ -0,0 +1,38 @@ +From da928f639002002dfc649ed9f50492d5d6cb4cee Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Mon, 5 Dec 2022 11:11:44 +0000 +Subject: [PATCH] Fix an illegal memory access when parsing a corrupt VMS Alpha + file. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Fix an illegal memory access when parsing a corrupt VMS Alpha file. + + PR 29848 + * vms-alpha.c (parse_module): Fix potential out of bounds memory + access. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=942fa4fb32738ecbb447546d54f1e5f0312d2ed4] + +CVE: CVE-2023-25584 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +--- + bfd/vms-alpha.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c +index c548722c..53b3f1bf 100644 +--- a/bfd/vms-alpha.c ++++ b/bfd/vms-alpha.c +@@ -4361,7 +4361,7 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + return false; + module->line_table = curr_line; + +- while (length == -1 || ptr < maxptr) ++ while (length == -1 || (ptr + 3) < maxptr) + { + /* The first byte is not counted in the recorded length. */ + int rec_length = bfd_getl16 (ptr) + 1; diff --git a/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-3.patch b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-3.patch new file mode 100644 index 0000000000..47cc3f310b --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0022-CVE-2023-25584-3.patch @@ -0,0 +1,536 @@ +From: Alan Modra <amodra@gmail.com> +Date: Mon, 12 Dec 2022 07:58:49 +0000 (+1030) +Subject: Lack of bounds checking in vms-alpha.c parse_module +X-Git-Tag: gdb-13-branchpoint~87 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=77c225bdeb410cf60da804879ad41622f5f1aa44 + +Lack of bounds checking in vms-alpha.c parse_module + + PR 29873 + PR 29874 + PR 29875 + PR 29876 + PR 29877 + PR 29878 + PR 29879 + PR 29880 + PR 29881 + PR 29882 + PR 29883 + PR 29884 + PR 29885 + PR 29886 + PR 29887 + PR 29888 + PR 29889 + PR 29890 + PR 29891 + * vms-alpha.c (parse_module): Make length param bfd_size_type. + Delete length == -1 checks. Sanity check record_length. + Sanity check DST__K_MODBEG, DST__K_RTNBEG, DST__K_RTNEND lengths. + Sanity check DST__K_SOURCE and DST__K_LINE_NUM elements + before accessing. + (build_module_list): Pass dst_section size to parse_module. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=77c225bdeb410cf60da804879ad41622f5f1aa44] + +CVE: CVE-2023-25584 +CVE: CVE-2022-47673 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> +Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com> + +--- + +diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c +index c0eb5bc5a2a..3b63259cc81 100644 +--- a/bfd/vms-alpha.c ++++ b/bfd/vms-alpha.c +@@ -4340,7 +4340,7 @@ new_module (bfd *abfd) + + static bool + parse_module (bfd *abfd, struct module *module, unsigned char *ptr, +- int length) ++ bfd_size_type length) + { + unsigned char *maxptr = ptr + length; + unsigned char *src_ptr, *pcl_ptr; +@@ -4361,7 +4361,7 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + return false; + module->line_table = curr_line; + +- while (length == -1 || (ptr + 3) < maxptr) ++ while (ptr + 3 < maxptr) + { + /* The first byte is not counted in the recorded length. */ + int rec_length = bfd_getl16 (ptr) + 1; +@@ -4369,15 +4369,19 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + + vms_debug2 ((2, "DST record: leng %d, type %d\n", rec_length, rec_type)); + +- if (length == -1 && rec_type == DST__K_MODEND) ++ if (rec_length > maxptr - ptr) ++ break; ++ if (rec_type == DST__K_MODEND) + break; + + switch (rec_type) + { + case DST__K_MODBEG: ++ if (rec_length <= DST_S_B_MODBEG_NAME) ++ break; + module->name + = _bfd_vms_save_counted_string (abfd, ptr + DST_S_B_MODBEG_NAME, +- maxptr - (ptr + DST_S_B_MODBEG_NAME)); ++ rec_length - DST_S_B_MODBEG_NAME); + + curr_pc = 0; + prev_pc = 0; +@@ -4391,13 +4395,15 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + break; + + case DST__K_RTNBEG: ++ if (rec_length <= DST_S_B_RTNBEG_NAME) ++ break; + funcinfo = (struct funcinfo *) + bfd_zalloc (abfd, sizeof (struct funcinfo)); + if (!funcinfo) + return false; + funcinfo->name + = _bfd_vms_save_counted_string (abfd, ptr + DST_S_B_RTNBEG_NAME, +- maxptr - (ptr + DST_S_B_RTNBEG_NAME)); ++ rec_length - DST_S_B_RTNBEG_NAME); + funcinfo->low = bfd_getl32 (ptr + DST_S_L_RTNBEG_ADDRESS); + funcinfo->next = module->func_table; + module->func_table = funcinfo; +@@ -4407,6 +4413,8 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + break; + + case DST__K_RTNEND: ++ if (rec_length < DST_S_L_RTNEND_SIZE + 4) ++ break; + if (!module->func_table) + return false; + module->func_table->high = module->func_table->low +@@ -4439,10 +4447,63 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + + vms_debug2 ((3, "source info\n")); + +- while (src_ptr < ptr + rec_length) ++ while (src_ptr - ptr < rec_length) + { + int cmd = src_ptr[0], cmd_length, data; + ++ switch (cmd) ++ { ++ case DST__K_SRC_DECLFILE: ++ if (src_ptr - ptr + DST_S_B_SRC_DF_LENGTH >= rec_length) ++ cmd_length = 0x10000; ++ else ++ cmd_length = src_ptr[DST_S_B_SRC_DF_LENGTH] + 2; ++ break; ++ ++ case DST__K_SRC_DEFLINES_B: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_SRC_DEFLINES_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_SRC_INCRLNUM_B: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_SRC_SETFILE: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_SRC_SETLNUM_L: ++ cmd_length = 5; ++ break; ++ ++ case DST__K_SRC_SETLNUM_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_SRC_SETREC_L: ++ cmd_length = 5; ++ break; ++ ++ case DST__K_SRC_SETREC_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_SRC_FORMFEED: ++ cmd_length = 1; ++ break; ++ ++ default: ++ cmd_length = 2; ++ break; ++ } ++ ++ if (src_ptr - ptr + cmd_length > rec_length) ++ break; ++ + switch (cmd) + { + case DST__K_SRC_DECLFILE: +@@ -4467,7 +4528,6 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + + module->file_table [fileid].name = filename; + module->file_table [fileid].srec = 1; +- cmd_length = src_ptr[DST_S_B_SRC_DF_LENGTH] + 2; + vms_debug2 ((4, "DST_S_C_SRC_DECLFILE: %d, %s\n", + fileid, module->file_table [fileid].name)); + } +@@ -4484,7 +4544,6 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + srec->sfile = curr_srec->sfile; + curr_srec->next = srec; + curr_srec = srec; +- cmd_length = 2; + vms_debug2 ((4, "DST_S_C_SRC_DEFLINES_B: %d\n", data)); + break; + +@@ -4499,14 +4558,12 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + srec->sfile = curr_srec->sfile; + curr_srec->next = srec; + curr_srec = srec; +- cmd_length = 3; + vms_debug2 ((4, "DST_S_C_SRC_DEFLINES_W: %d\n", data)); + break; + + case DST__K_SRC_INCRLNUM_B: + data = src_ptr[DST_S_B_SRC_UNSBYTE]; + curr_srec->line += data; +- cmd_length = 2; + vms_debug2 ((4, "DST_S_C_SRC_INCRLNUM_B: %d\n", data)); + break; + +@@ -4514,21 +4571,18 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + data = bfd_getl16 (src_ptr + DST_S_W_SRC_UNSWORD); + curr_srec->sfile = data; + curr_srec->srec = module->file_table[data].srec; +- cmd_length = 3; + vms_debug2 ((4, "DST_S_C_SRC_SETFILE: %d\n", data)); + break; + + case DST__K_SRC_SETLNUM_L: + data = bfd_getl32 (src_ptr + DST_S_L_SRC_UNSLONG); + curr_srec->line = data; +- cmd_length = 5; + vms_debug2 ((4, "DST_S_C_SRC_SETLNUM_L: %d\n", data)); + break; + + case DST__K_SRC_SETLNUM_W: + data = bfd_getl16 (src_ptr + DST_S_W_SRC_UNSWORD); + curr_srec->line = data; +- cmd_length = 3; + vms_debug2 ((4, "DST_S_C_SRC_SETLNUM_W: %d\n", data)); + break; + +@@ -4536,7 +4590,6 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + data = bfd_getl32 (src_ptr + DST_S_L_SRC_UNSLONG); + curr_srec->srec = data; + module->file_table[curr_srec->sfile].srec = data; +- cmd_length = 5; + vms_debug2 ((4, "DST_S_C_SRC_SETREC_L: %d\n", data)); + break; + +@@ -4544,19 +4597,16 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + data = bfd_getl16 (src_ptr + DST_S_W_SRC_UNSWORD); + curr_srec->srec = data; + module->file_table[curr_srec->sfile].srec = data; +- cmd_length = 3; + vms_debug2 ((4, "DST_S_C_SRC_SETREC_W: %d\n", data)); + break; + + case DST__K_SRC_FORMFEED: +- cmd_length = 1; + vms_debug2 ((4, "DST_S_C_SRC_FORMFEED\n")); + break; + + default: + _bfd_error_handler (_("unknown source command %d"), + cmd); +- cmd_length = 2; + break; + } + +@@ -4569,18 +4619,114 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + + vms_debug2 ((3, "line info\n")); + +- while (pcl_ptr < ptr + rec_length) ++ while (pcl_ptr - ptr < rec_length) + { + /* The command byte is signed so we must sign-extend it. */ + int cmd = ((signed char *)pcl_ptr)[0], cmd_length, data; + ++ switch (cmd) ++ { ++ case DST__K_DELTA_PC_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_DELTA_PC_L: ++ cmd_length = 5; ++ break; ++ ++ case DST__K_INCR_LINUM: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_INCR_LINUM_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_INCR_LINUM_L: ++ cmd_length = 5; ++ break; ++ ++ case DST__K_SET_LINUM_INCR: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_SET_LINUM_INCR_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_RESET_LINUM_INCR: ++ cmd_length = 1; ++ break; ++ ++ case DST__K_BEG_STMT_MODE: ++ cmd_length = 1; ++ break; ++ ++ case DST__K_END_STMT_MODE: ++ cmd_length = 1; ++ break; ++ ++ case DST__K_SET_LINUM_B: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_SET_LINUM: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_SET_LINUM_L: ++ cmd_length = 5; ++ break; ++ ++ case DST__K_SET_PC: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_SET_PC_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_SET_PC_L: ++ cmd_length = 5; ++ break; ++ ++ case DST__K_SET_STMTNUM: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_TERM: ++ cmd_length = 2; ++ break; ++ ++ case DST__K_TERM_W: ++ cmd_length = 3; ++ break; ++ ++ case DST__K_TERM_L: ++ cmd_length = 5; ++ break; ++ ++ case DST__K_SET_ABS_PC: ++ cmd_length = 5; ++ break; ++ ++ default: ++ if (cmd <= 0) ++ cmd_length = 1; ++ else ++ cmd_length = 2; ++ break; ++ } ++ ++ if (pcl_ptr - ptr + cmd_length > rec_length) ++ break; ++ + switch (cmd) + { + case DST__K_DELTA_PC_W: + data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); + curr_pc += data; + curr_linenum += 1; +- cmd_length = 3; + vms_debug2 ((4, "DST__K_DELTA_PC_W: %d\n", data)); + break; + +@@ -4588,131 +4734,111 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); + curr_pc += data; + curr_linenum += 1; +- cmd_length = 5; + vms_debug2 ((4, "DST__K_DELTA_PC_L: %d\n", data)); + break; + + case DST__K_INCR_LINUM: + data = pcl_ptr[DST_S_B_PCLINE_UNSBYTE]; + curr_linenum += data; +- cmd_length = 2; + vms_debug2 ((4, "DST__K_INCR_LINUM: %d\n", data)); + break; + + case DST__K_INCR_LINUM_W: + data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); + curr_linenum += data; +- cmd_length = 3; + vms_debug2 ((4, "DST__K_INCR_LINUM_W: %d\n", data)); + break; + + case DST__K_INCR_LINUM_L: + data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); + curr_linenum += data; +- cmd_length = 5; + vms_debug2 ((4, "DST__K_INCR_LINUM_L: %d\n", data)); + break; + + case DST__K_SET_LINUM_INCR: + _bfd_error_handler + (_("%s not implemented"), "DST__K_SET_LINUM_INCR"); +- cmd_length = 2; + break; + + case DST__K_SET_LINUM_INCR_W: + _bfd_error_handler + (_("%s not implemented"), "DST__K_SET_LINUM_INCR_W"); +- cmd_length = 3; + break; + + case DST__K_RESET_LINUM_INCR: + _bfd_error_handler + (_("%s not implemented"), "DST__K_RESET_LINUM_INCR"); +- cmd_length = 1; + break; + + case DST__K_BEG_STMT_MODE: + _bfd_error_handler + (_("%s not implemented"), "DST__K_BEG_STMT_MODE"); +- cmd_length = 1; + break; + + case DST__K_END_STMT_MODE: + _bfd_error_handler + (_("%s not implemented"), "DST__K_END_STMT_MODE"); +- cmd_length = 1; + break; + + case DST__K_SET_LINUM_B: + data = pcl_ptr[DST_S_B_PCLINE_UNSBYTE]; + curr_linenum = data; +- cmd_length = 2; + vms_debug2 ((4, "DST__K_SET_LINUM_B: %d\n", data)); + break; + + case DST__K_SET_LINUM: + data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); + curr_linenum = data; +- cmd_length = 3; + vms_debug2 ((4, "DST__K_SET_LINE_NUM: %d\n", data)); + break; + + case DST__K_SET_LINUM_L: + data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); + curr_linenum = data; +- cmd_length = 5; + vms_debug2 ((4, "DST__K_SET_LINUM_L: %d\n", data)); + break; + + case DST__K_SET_PC: + _bfd_error_handler + (_("%s not implemented"), "DST__K_SET_PC"); +- cmd_length = 2; + break; + + case DST__K_SET_PC_W: + _bfd_error_handler + (_("%s not implemented"), "DST__K_SET_PC_W"); +- cmd_length = 3; + break; + + case DST__K_SET_PC_L: + _bfd_error_handler + (_("%s not implemented"), "DST__K_SET_PC_L"); +- cmd_length = 5; + break; + + case DST__K_SET_STMTNUM: + _bfd_error_handler + (_("%s not implemented"), "DST__K_SET_STMTNUM"); +- cmd_length = 2; + break; + + case DST__K_TERM: + data = pcl_ptr[DST_S_B_PCLINE_UNSBYTE]; + curr_pc += data; +- cmd_length = 2; + vms_debug2 ((4, "DST__K_TERM: %d\n", data)); + break; + + case DST__K_TERM_W: + data = bfd_getl16 (pcl_ptr + DST_S_W_PCLINE_UNSWORD); + curr_pc += data; +- cmd_length = 3; + vms_debug2 ((4, "DST__K_TERM_W: %d\n", data)); + break; + + case DST__K_TERM_L: + data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); + curr_pc += data; +- cmd_length = 5; + vms_debug2 ((4, "DST__K_TERM_L: %d\n", data)); + break; + + case DST__K_SET_ABS_PC: + data = bfd_getl32 (pcl_ptr + DST_S_L_PCLINE_UNSLONG); + curr_pc = data; +- cmd_length = 5; + vms_debug2 ((4, "DST__K_SET_ABS_PC: 0x%x\n", data)); + break; + +@@ -4721,15 +4847,11 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + { + curr_pc -= cmd; + curr_linenum += 1; +- cmd_length = 1; + vms_debug2 ((4, "bump pc to 0x%lx and line to %d\n", + (unsigned long)curr_pc, curr_linenum)); + } + else +- { +- _bfd_error_handler (_("unknown line command %d"), cmd); +- cmd_length = 2; +- } ++ _bfd_error_handler (_("unknown line command %d"), cmd); + break; + } + +@@ -4859,7 +4981,8 @@ build_module_list (bfd *abfd) + return NULL; + + module = new_module (abfd); +- if (!parse_module (abfd, module, PRIV (dst_section)->contents, -1)) ++ if (!parse_module (abfd, module, PRIV (dst_section)->contents, ++ PRIV (dst_section)->size)) + return NULL; + list = module; + } diff --git a/meta/recipes-devtools/binutils/binutils/0023-CVE-2023-25585.patch b/meta/recipes-devtools/binutils/binutils/0023-CVE-2023-25585.patch new file mode 100644 index 0000000000..e31a027b9f --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0023-CVE-2023-25585.patch @@ -0,0 +1,54 @@ +From: Alan Modra <amodra@gmail.com> +Date: Mon, 12 Dec 2022 08:31:08 +0000 (+1030) +Subject: PR29892, Field file_table of struct module is uninitialized +X-Git-Tag: gdb-13-branchpoint~86 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=65cf035b8dc1df5d8020e0b1449514a3c42933e7 + +PR29892, Field file_table of struct module is uninitialized + + PR 29892 + * vms-alphs.c (new_module): Use bfd_zmalloc to alloc file_table. + (parse_module): Rewrite file_table reallocation code and clear. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=65cf035b8dc1df5d8020e0b1449514a3c42933e7] + +CVE: CVE-2023-25585 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +--- + +diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c +index 3b63259cc81..6ee7060b0b2 100644 +--- a/bfd/vms-alpha.c ++++ b/bfd/vms-alpha.c +@@ -4337,7 +4337,7 @@ new_module (bfd *abfd) + = (struct module *) bfd_zalloc (abfd, sizeof (struct module)); + module->file_table_count = 16; /* Arbitrary. */ + module->file_table +- = bfd_malloc (module->file_table_count * sizeof (struct fileinfo)); ++ = bfd_zmalloc (module->file_table_count * sizeof (struct fileinfo)); + return module; + } + +@@ -4520,15 +4520,18 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr, + src_ptr + DST_S_B_SRC_DF_FILENAME, + ptr + rec_length - (src_ptr + DST_S_B_SRC_DF_FILENAME)); + +- while (fileid >= module->file_table_count) ++ if (fileid >= module->file_table_count) + { +- module->file_table_count *= 2; ++ unsigned int old_count = module->file_table_count; ++ module->file_table_count += fileid; + module->file_table + = bfd_realloc_or_free (module->file_table, + module->file_table_count + * sizeof (struct fileinfo)); + if (module->file_table == NULL) + return false; ++ memset (module->file_table + old_count, 0, ++ fileid * sizeof (struct fileinfo)); + } + + module->file_table [fileid].name = filename; diff --git a/meta/recipes-devtools/binutils/binutils/0025-CVE-2023-25588.patch b/meta/recipes-devtools/binutils/binutils/0025-CVE-2023-25588.patch new file mode 100644 index 0000000000..9b5825037f --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0025-CVE-2023-25588.patch @@ -0,0 +1,149 @@ +From: Alan Modra <amodra@gmail.com> +Date: Fri, 14 Oct 2022 00:00:21 +0000 (+1030) +Subject: PR29677, Field `the_bfd` of `asymbol` is uninitialised +X-Git-Tag: gdb-13-branchpoint~871 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1 + +PR29677, Field `the_bfd` of `asymbol` is uninitialised + +Besides not initialising the_bfd of synthetic symbols, counting +symbols when sizing didn't match symbols created if there were any +dynsyms named "". We don't want synthetic symbols without names +anyway, so get rid of them. Also, simplify and correct sanity checks. + + PR 29677 + * mach-o.c (bfd_mach_o_get_synthetic_symtab): Rewrite. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1] + +CVE: CVE-2023-25588 +CVE: CVE-2022-47696 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> +Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com> + +--- + +diff --git a/bfd/mach-o.c b/bfd/mach-o.c +index acb35e7f0c6..5279343768c 100644 +--- a/bfd/mach-o.c ++++ b/bfd/mach-o.c +@@ -938,11 +938,9 @@ bfd_mach_o_get_synthetic_symtab (bfd *abfd, + bfd_mach_o_symtab_command *symtab = mdata->symtab; + asymbol *s; + char * s_start; +- char * s_end; + unsigned long count, i, j, n; + size_t size; + char *names; +- char *nul_name; + const char stub [] = "$stub"; + + *ret = NULL; +@@ -955,27 +953,27 @@ bfd_mach_o_get_synthetic_symtab (bfd *abfd, + /* We need to allocate a bfd symbol for every indirect symbol and to + allocate the memory for its name. */ + count = dysymtab->nindirectsyms; +- size = count * sizeof (asymbol) + 1; +- ++ size = 0; + for (j = 0; j < count; j++) + { +- const char * strng; + unsigned int isym = dysymtab->indirect_syms[j]; ++ const char *str; + + /* Some indirect symbols are anonymous. */ +- if (isym < symtab->nsyms && (strng = symtab->symbols[isym].symbol.name)) +- /* PR 17512: file: f5b8eeba. */ +- size += strnlen (strng, symtab->strsize - (strng - symtab->strtab)) + sizeof (stub); ++ if (isym < symtab->nsyms ++ && (str = symtab->symbols[isym].symbol.name) != NULL) ++ { ++ /* PR 17512: file: f5b8eeba. */ ++ size += strnlen (str, symtab->strsize - (str - symtab->strtab)); ++ size += sizeof (stub); ++ } + } + +- s_start = bfd_malloc (size); ++ s_start = bfd_malloc (size + count * sizeof (asymbol)); + s = *ret = (asymbol *) s_start; + if (s == NULL) + return -1; + names = (char *) (s + count); +- nul_name = names; +- *names++ = 0; +- s_end = s_start + size; + + n = 0; + for (i = 0; i < mdata->nsects; i++) +@@ -997,47 +995,39 @@ bfd_mach_o_get_synthetic_symtab (bfd *abfd, + entry_size = bfd_mach_o_section_get_entry_size (abfd, sec); + + /* PR 17512: file: 08e15eec. */ +- if (first >= count || last >= count || first > last) ++ if (first >= count || last > count || first > last) + goto fail; + + for (j = first; j < last; j++) + { + unsigned int isym = dysymtab->indirect_syms[j]; +- +- /* PR 17512: file: 04d64d9b. */ +- if (((char *) s) + sizeof (* s) > s_end) +- goto fail; +- +- s->flags = BSF_GLOBAL | BSF_SYNTHETIC; +- s->section = sec->bfdsection; +- s->value = addr - sec->addr; +- s->udata.p = NULL; ++ const char *str; ++ size_t len; + + if (isym < symtab->nsyms +- && symtab->symbols[isym].symbol.name) ++ && (str = symtab->symbols[isym].symbol.name) != NULL) + { +- const char *sym = symtab->symbols[isym].symbol.name; +- size_t len; +- +- s->name = names; +- len = strlen (sym); +- /* PR 17512: file: 47dfd4d2. */ +- if (names + len >= s_end) ++ /* PR 17512: file: 04d64d9b. */ ++ if (n >= count) + goto fail; +- memcpy (names, sym, len); +- names += len; +- /* PR 17512: file: 18f340a4. */ +- if (names + sizeof (stub) >= s_end) ++ len = strnlen (str, symtab->strsize - (str - symtab->strtab)); ++ /* PR 17512: file: 47dfd4d2, 18f340a4. */ ++ if (size < len + sizeof (stub)) + goto fail; +- memcpy (names, stub, sizeof (stub)); +- names += sizeof (stub); ++ memcpy (names, str, len); ++ memcpy (names + len, stub, sizeof (stub)); ++ s->name = names; ++ names += len + sizeof (stub); ++ size -= len + sizeof (stub); ++ s->the_bfd = symtab->symbols[isym].symbol.the_bfd; ++ s->flags = BSF_GLOBAL | BSF_SYNTHETIC; ++ s->section = sec->bfdsection; ++ s->value = addr - sec->addr; ++ s->udata.p = NULL; ++ s++; ++ n++; + } +- else +- s->name = nul_name; +- + addr += entry_size; +- s++; +- n++; + } + break; + default: diff --git a/meta/recipes-devtools/binutils/binutils/0026-CVE-2023-1972.patch b/meta/recipes-devtools/binutils/binutils/0026-CVE-2023-1972.patch new file mode 100644 index 0000000000..f86adad217 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0026-CVE-2023-1972.patch @@ -0,0 +1,41 @@ +From: Nick Clifton <nickc@redhat.com> +Date: Thu, 30 Mar 2023 09:10:09 +0000 (+0100) +Subject: Fix an illegal memory access when an accessing a zer0-lengthverdef table. +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57 + +Fix an illegal memory access when an accessing a zer0-lengthverdef table. + + PR 30285 + * elf.c (_bfd_elf_slurp_version_tables): Fail if no version definitions are allocated. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57] + +CVE: CVE-2023-1972 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +--- + +diff --git a/bfd/elf.c b/bfd/elf.c +index 027d0143735..185028cbd97 100644 +--- a/bfd/elf.c ++++ b/bfd/elf.c +@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver) + bfd_set_error (bfd_error_file_too_big); + goto error_return_verdef; + } ++ ++ if (amt == 0) ++ goto error_return_verdef; + elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt); + if (elf_tdata (abfd)->verdef == NULL) + goto error_return_verdef; +@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver) + bfd_set_error (bfd_error_file_too_big); + goto error_return; + } ++ if (amt == 0) ++ goto error_return; + elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt); + if (elf_tdata (abfd)->verdef == NULL) + goto error_return; diff --git a/meta/recipes-devtools/binutils/binutils/0027-CVE-2022-47008.patch b/meta/recipes-devtools/binutils/binutils/0027-CVE-2022-47008.patch new file mode 100644 index 0000000000..a3fff65409 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0027-CVE-2022-47008.patch @@ -0,0 +1,67 @@ +From: Alan Modra <amodra@gmail.com> +Date: Thu, 16 Jun 2022 23:43:38 +0000 (+0930) +Subject: PR29255, memory leak in make_tempdir +X-Git-Tag: binutils-2_39~236 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d6e1d48c83b165c129cb0aa78905f7ca80a1f682 + +PR29255, memory leak in make_tempdir + + PR 29255 + * bucomm.c (make_tempdir, make_tempname): Free template on all + failure paths. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d6e1d48c83b165c129cb0aa78905f7ca80a1f682] + +CVE: CVE-2022-47008 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +--- + +diff --git a/binutils/bucomm.c b/binutils/bucomm.c +index fdc2209df9c..4395cb9f7f5 100644 +--- a/binutils/bucomm.c ++++ b/binutils/bucomm.c +@@ -537,8 +537,9 @@ make_tempname (const char *filename, int *ofd) + #else + tmpname = mktemp (tmpname); + if (tmpname == NULL) +- return NULL; +- fd = open (tmpname, O_RDWR | O_CREAT | O_EXCL, 0600); ++ fd = -1; ++ else ++ fd = open (tmpname, O_RDWR | O_CREAT | O_EXCL, 0600); + #endif + if (fd == -1) + { +@@ -556,22 +557,23 @@ char * + make_tempdir (const char *filename) + { + char *tmpname = template_in_dir (filename); ++ char *ret; + + #ifdef HAVE_MKDTEMP +- return mkdtemp (tmpname); ++ ret = mkdtemp (tmpname); + #else +- tmpname = mktemp (tmpname); +- if (tmpname == NULL) +- return NULL; ++ ret = mktemp (tmpname); + #if defined (_WIN32) && !defined (__CYGWIN32__) + if (mkdir (tmpname) != 0) +- return NULL; ++ ret = NULL; + #else + if (mkdir (tmpname, 0700) != 0) +- return NULL; ++ ret = NULL; + #endif +- return tmpname; + #endif ++ if (ret == NULL) ++ free (tmpname); ++ return ret; + } + + /* Parse a string into a VMA, with a fatal error if it can't be diff --git a/meta/recipes-devtools/binutils/binutils/0028-CVE-2022-47011.patch b/meta/recipes-devtools/binutils/binutils/0028-CVE-2022-47011.patch new file mode 100644 index 0000000000..73ae46e218 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0028-CVE-2022-47011.patch @@ -0,0 +1,35 @@ +From: Alan Modra <amodra@gmail.com> +Date: Mon, 20 Jun 2022 01:09:13 +0000 (+0930) +Subject: PR29261, memory leak in parse_stab_struct_fields +X-Git-Tag: binutils-2_39~225 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=8a24927bc8dbf6beac2000593b21235c3796dc35 + +PR29261, memory leak in parse_stab_struct_fields + + PR 29261 + * stabs.c (parse_stab_struct_fields): Free "fields" on failure path. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=8a24927bc8dbf6beac2000593b21235c3796dc35] + +CVE: CVE-2022-47011 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +--- + +diff --git a/binutils/stabs.c b/binutils/stabs.c +index 796ff85b86a..bf3f578cbcc 100644 +--- a/binutils/stabs.c ++++ b/binutils/stabs.c +@@ -2367,7 +2367,10 @@ parse_stab_struct_fields (void *dhandle, + + if (! parse_stab_one_struct_field (dhandle, info, pp, p, fields + c, + staticsp, p_end)) +- return false; ++ { ++ free (fields); ++ return false; ++ } + + ++c; + } diff --git a/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-1.patch b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-1.patch new file mode 100644 index 0000000000..4642251f9b --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-1.patch @@ -0,0 +1,31 @@ +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 29 Mar 2022 06:19:14 +0000 (+0200) +Subject: bfd/Dwarf2: gas doesn't mangle names +X-Git-Tag: binutils-2_39~1287 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=ddfc2f56d5782af79c696d7fef7c73bba11e8b09 + +bfd/Dwarf2: gas doesn't mangle names + +Include the language identifier emitted by gas in the set of ones where +no mangled names are expected. Even if there could be "hand-mangled" +names, gas doesn't emit DW_AT_linkage_name in the first place. +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=ddfc2f56d5782af79c696d7fef7c73bba11e8b09] + +CVE: CVE-2022-48065 + +Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com> + +--- + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index 8cd0ce9d425..9aa4e955a5e 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -1441,6 +1441,7 @@ non_mangled (int lang) + case DW_LANG_PLI: + case DW_LANG_UPC: + case DW_LANG_C11: ++ case DW_LANG_Mips_Assembler: + return true; + } + } diff --git a/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-2.patch b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-2.patch new file mode 100644 index 0000000000..8aa21f2716 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-2.patch @@ -0,0 +1,115 @@ +From: Alan Modra <amodra@gmail.com> +Date: Wed, 21 Sep 2022 05:15:44 +0000 (+0930) +Subject: dwarf2.c: mangle_style +X-Git-Tag: gdb-13-branchpoint~1165 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=4609af80c29db6015ce01b67c48f237c210da9b4 + +dwarf2.c: mangle_style + +non_mangled incorrectly returned "true" for Ada. Correct that, and +add a few more non-mangled entries. Return a value suitable for +passing to cplus_demangle to control demangling. + + * dwarf2.c: Include demangle.h. + (mangle_style): Rename from non_mangled. Return DMGL_* value + to suit lang. Adjust all callers. +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=4609af80c29db6015ce01b67c48f237c210da9b4] + +CVE: CVE-2022-48065 + +Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com> + +--- + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index e7c12c3e9de..138cdbb00bb 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -32,6 +32,7 @@ + #include "sysdep.h" + #include "bfd.h" + #include "libiberty.h" ++#include "demangle.h" + #include "libbfd.h" + #include "elf-bfd.h" + #include "dwarf2.h" +@@ -1711,31 +1712,52 @@ read_attribute (struct attribute * attr, + return info_ptr; + } + +-/* Return whether DW_AT_name will return the same as DW_AT_linkage_name +- for a function. */ ++/* Return mangling style given LANG. */ + +-static bool +-non_mangled (int lang) ++static int ++mangle_style (int lang) + { + switch (lang) + { ++ case DW_LANG_Ada83: ++ case DW_LANG_Ada95: ++ return DMGL_GNAT; ++ ++ case DW_LANG_C_plus_plus: ++ case DW_LANG_C_plus_plus_03: ++ case DW_LANG_C_plus_plus_11: ++ case DW_LANG_C_plus_plus_14: ++ return DMGL_GNU_V3; ++ ++ case DW_LANG_Java: ++ return DMGL_JAVA; ++ ++ case DW_LANG_D: ++ return DMGL_DLANG; ++ ++ case DW_LANG_Rust: ++ case DW_LANG_Rust_old: ++ return DMGL_RUST; ++ + default: +- return false; ++ return DMGL_AUTO; + + case DW_LANG_C89: + case DW_LANG_C: +- case DW_LANG_Ada83: + case DW_LANG_Cobol74: + case DW_LANG_Cobol85: + case DW_LANG_Fortran77: + case DW_LANG_Pascal83: +- case DW_LANG_C99: +- case DW_LANG_Ada95: + case DW_LANG_PLI: ++ case DW_LANG_C99: + case DW_LANG_UPC: + case DW_LANG_C11: + case DW_LANG_Mips_Assembler: +- return true; ++ case DW_LANG_Upc: ++ case DW_LANG_HP_Basic91: ++ case DW_LANG_HP_IMacro: ++ case DW_LANG_HP_Assembler: ++ return 0; + } + } + +@@ -3599,7 +3621,7 @@ find_abstract_instance (struct comp_unit *unit, + if (name == NULL && is_str_form (&attr)) + { + name = attr.u.str; +- if (non_mangled (unit->lang)) ++ if (mangle_style (unit->lang) == 0) + *is_linkage = true; + } + break; +@@ -4095,7 +4117,7 @@ scan_unit_for_symbols (struct comp_unit *unit) + if (func->name == NULL && is_str_form (&attr)) + { + func->name = attr.u.str; +- if (non_mangled (unit->lang)) ++ if (mangle_style (unit->lang) == 0) + func->is_linkage = true; + } + break; diff --git a/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-3.patch b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-3.patch new file mode 100644 index 0000000000..35a658a22c --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-3.patch @@ -0,0 +1,122 @@ +From: Alan Modra <amodra@gmail.com> +Date: Wed, 21 Dec 2022 11:10:12 +0000 (+1030) +Subject: PR29925, Memory leak in find_abstract_instance +X-Git-Tag: binutils-2_40~192 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d28fbc7197ba0e021a43f873eff90b05dcdcff6a + +PR29925, Memory leak in find_abstract_instance + +The testcase in the PR had a variable with both DW_AT_decl_file and +DW_AT_specification, where the DW_AT_specification also specified +DW_AT_decl_file. This leads to a memory leak as the file name is +malloced and duplicates are not expected. + +I've also changed find_abstract_instance to not use a temp for "name", +because that can result in a change in behaviour from the usual last +of duplicate attributes wins. + + PR 29925 + * dwarf2.c (find_abstract_instance): Delete "name" variable. + Free *filename_ptr before assigning new file name. + (scan_unit_for_symbols): Similarly free func->file and + var->file before assigning. +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d28fbc7197ba0e021a43f873eff90b05dcdcff6a] + +CVE: CVE-2022-48065 + +Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com> + +--- + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index 0cd8152ee6e..b608afbc0cf 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -3441,7 +3441,6 @@ find_abstract_instance (struct comp_unit *unit, + struct abbrev_info *abbrev; + uint64_t die_ref = attr_ptr->u.val; + struct attribute attr; +- const char *name = NULL; + + if (recur_count == 100) + { +@@ -3602,9 +3601,9 @@ find_abstract_instance (struct comp_unit *unit, + case DW_AT_name: + /* Prefer DW_AT_MIPS_linkage_name or DW_AT_linkage_name + over DW_AT_name. */ +- if (name == NULL && is_str_form (&attr)) ++ if (*pname == NULL && is_str_form (&attr)) + { +- name = attr.u.str; ++ *pname = attr.u.str; + if (mangle_style (unit->lang) == 0) + *is_linkage = true; + } +@@ -3612,7 +3611,7 @@ find_abstract_instance (struct comp_unit *unit, + case DW_AT_specification: + if (is_int_form (&attr) + && !find_abstract_instance (unit, &attr, recur_count + 1, +- &name, is_linkage, ++ pname, is_linkage, + filename_ptr, linenumber_ptr)) + return false; + break; +@@ -3622,7 +3621,7 @@ find_abstract_instance (struct comp_unit *unit, + non-string forms into these attributes. */ + if (is_str_form (&attr)) + { +- name = attr.u.str; ++ *pname = attr.u.str; + *is_linkage = true; + } + break; +@@ -3630,8 +3629,11 @@ find_abstract_instance (struct comp_unit *unit, + if (!comp_unit_maybe_decode_line_info (unit)) + return false; + if (is_int_form (&attr)) +- *filename_ptr = concat_filename (unit->line_table, +- attr.u.val); ++ { ++ free (*filename_ptr); ++ *filename_ptr = concat_filename (unit->line_table, ++ attr.u.val); ++ } + break; + case DW_AT_decl_line: + if (is_int_form (&attr)) +@@ -3643,7 +3645,6 @@ find_abstract_instance (struct comp_unit *unit, + } + } + } +- *pname = name; + return true; + } + +@@ -4139,8 +4140,11 @@ scan_unit_for_symbols (struct comp_unit *unit) + + case DW_AT_decl_file: + if (is_int_form (&attr)) +- func->file = concat_filename (unit->line_table, +- attr.u.val); ++ { ++ free (func->file); ++ func->file = concat_filename (unit->line_table, ++ attr.u.val); ++ } + break; + + case DW_AT_decl_line: +@@ -4182,8 +4186,11 @@ scan_unit_for_symbols (struct comp_unit *unit) + + case DW_AT_decl_file: + if (is_int_form (&attr)) +- var->file = concat_filename (unit->line_table, +- attr.u.val); ++ { ++ free (var->file); ++ var->file = concat_filename (unit->line_table, ++ attr.u.val); ++ } + break; + + case DW_AT_decl_line: diff --git a/meta/recipes-devtools/binutils/binutils/0030-CVE-2022-44840.patch b/meta/recipes-devtools/binutils/binutils/0030-CVE-2022-44840.patch new file mode 100644 index 0000000000..2f4c38044b --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0030-CVE-2022-44840.patch @@ -0,0 +1,151 @@ +From: Alan Modra <amodra@gmail.com> +Date: Sun, 30 Oct 2022 08:38:51 +0000 (+1030) +Subject: Pool section entries for DWP version 1 +X-Git-Tag: gdb-13-branchpoint~664 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=28750e3b967da2207d51cbce9fc8be262817ee59 + +Pool section entries for DWP version 1 + +Ref: https://gcc.gnu.org/wiki/DebugFissionDWP?action=recall&rev=3 + +Fuzzers have found a weakness in the code stashing pool section +entries. With random nonsensical values in the index entries (rather +than each index pointing to its own set distinct from other sets), +it's possible to overflow the space allocated, losing the NULL +terminator. Without a terminator, find_section_in_set can run off the +end of the shndx_pool buffer. Fix this by scanning the pool directly. + +binutils/ + * dwarf.c (add_shndx_to_cu_tu_entry): Delete range check. + (end_cu_tu_entry): Likewise. + (process_cu_tu_index): Fill shndx_pool by directly scanning + pool, rather than indirectly from index entries. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff_plain;f=binutils/dwarf.c;h=7730293326ac1049451eb4a037ac86d827030700;hp=c6340a28906114e9df29d7401472c7dc0a98c2b1;hb=28750e3b967da2207d51cbce9fc8be262817ee59;hpb=60095ba3b8f8ba26a6389dded732fa446422c98f] + +CVE: CVE-2022-44840 + +Signed-off-by: yash shinde <yash.shinde@windriver.com> + +diff --git a/binutils/dwarf.c b/binutils/dwarf.c +index c6340a28906..7730293326a 100644 +--- a/binutils/dwarf.c ++++ b/binutils/dwarf.c +@@ -10652,22 +10652,12 @@ prealloc_cu_tu_list (unsigned int nshndx) + static void + add_shndx_to_cu_tu_entry (unsigned int shndx) + { +- if (shndx_pool_used >= shndx_pool_size) +- { +- error (_("Internal error: out of space in the shndx pool.\n")); +- return; +- } + shndx_pool [shndx_pool_used++] = shndx; + } + + static void + end_cu_tu_entry (void) + { +- if (shndx_pool_used >= shndx_pool_size) +- { +- error (_("Internal error: out of space in the shndx pool.\n")); +- return; +- } + shndx_pool [shndx_pool_used++] = 0; + } + +@@ -10773,53 +10763,55 @@ process_cu_tu_index (struct dwarf_section *section, int do_display) + + if (version == 1) + { ++ unsigned char *shndx_list; ++ unsigned int shndx; ++ + if (!do_display) +- prealloc_cu_tu_list ((limit - ppool) / 4); +- for (i = 0; i < nslots; i++) + { +- unsigned char *shndx_list; +- unsigned int shndx; +- +- SAFE_BYTE_GET (signature, phash, 8, limit); +- if (signature != 0) ++ prealloc_cu_tu_list ((limit - ppool) / 4); ++ for (shndx_list = ppool + 4; shndx_list <= limit - 4; shndx_list += 4) + { +- SAFE_BYTE_GET (j, pindex, 4, limit); +- shndx_list = ppool + j * 4; +- /* PR 17531: file: 705e010d. */ +- if (shndx_list < ppool) +- { +- warn (_("Section index pool located before start of section\n")); +- return 0; +- } ++ shndx = byte_get (shndx_list, 4); ++ add_shndx_to_cu_tu_entry (shndx); ++ } ++ end_cu_tu_entry (); ++ } ++ else ++ for (i = 0; i < nslots; i++) ++ { ++ SAFE_BYTE_GET (signature, phash, 8, limit); ++ if (signature != 0) ++ { ++ SAFE_BYTE_GET (j, pindex, 4, limit); ++ shndx_list = ppool + j * 4; ++ /* PR 17531: file: 705e010d. */ ++ if (shndx_list < ppool) ++ { ++ warn (_("Section index pool located before start of section\n")); ++ return 0; ++ } + +- if (do_display) + printf (_(" [%3d] Signature: 0x%s Sections: "), + i, dwarf_vmatoa ("x", signature)); +- for (;;) +- { +- if (shndx_list >= limit) +- { +- warn (_("Section %s too small for shndx pool\n"), +- section->name); +- return 0; +- } +- SAFE_BYTE_GET (shndx, shndx_list, 4, limit); +- if (shndx == 0) +- break; +- if (do_display) ++ for (;;) ++ { ++ if (shndx_list >= limit) ++ { ++ warn (_("Section %s too small for shndx pool\n"), ++ section->name); ++ return 0; ++ } ++ SAFE_BYTE_GET (shndx, shndx_list, 4, limit); ++ if (shndx == 0) ++ break; + printf (" %d", shndx); +- else +- add_shndx_to_cu_tu_entry (shndx); +- shndx_list += 4; +- } +- if (do_display) ++ shndx_list += 4; ++ } + printf ("\n"); +- else +- end_cu_tu_entry (); +- } +- phash += 8; +- pindex += 4; +- } ++ } ++ phash += 8; ++ pindex += 4; ++ } + } + else if (version == 2) + { diff --git a/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-45703-1.patch b/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-45703-1.patch new file mode 100644 index 0000000000..3db4385e13 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-45703-1.patch @@ -0,0 +1,147 @@ +From: Alan Modra <amodra@gmail.com> +Date: Tue, 24 May 2022 00:02:14 +0000 (+0930) +Subject: PR29169, invalid read displaying fuzzed .gdb_index +X-Git-Tag: binutils-2_39~530 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=244e19c79111eed017ee38ab1d44fb2a6cd1b636 + +PR29169, invalid read displaying fuzzed .gdb_index + + PR 29169 + * dwarf.c (display_gdb_index): Combine sanity checks. Calculate + element counts, not word counts. +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=244e19c79111eed017ee38ab1d44fb2a6cd1b636] + +CVE: CVE-2022-45703 + +Signed-off-by: yash shinde <yash.shinde@windriver.com> + +--- + +diff --git a/binutils/dwarf.c b/binutils/dwarf.c +index 7de6f28161f..c855972a12f 100644 +--- a/binutils/dwarf.c ++++ b/binutils/dwarf.c +@@ -10406,7 +10406,7 @@ display_gdb_index (struct dwarf_section *section, + uint32_t cu_list_offset, tu_list_offset; + uint32_t address_table_offset, symbol_table_offset, constant_pool_offset; + unsigned int cu_list_elements, tu_list_elements; +- unsigned int address_table_size, symbol_table_slots; ++ unsigned int address_table_elements, symbol_table_slots; + unsigned char *cu_list, *tu_list; + unsigned char *address_table, *symbol_table, *constant_pool; + unsigned int i; +@@ -10454,48 +10454,19 @@ display_gdb_index (struct dwarf_section *section, + || tu_list_offset > section->size + || address_table_offset > section->size + || symbol_table_offset > section->size +- || constant_pool_offset > section->size) ++ || constant_pool_offset > section->size ++ || tu_list_offset < cu_list_offset ++ || address_table_offset < tu_list_offset ++ || symbol_table_offset < address_table_offset ++ || constant_pool_offset < symbol_table_offset) + { + warn (_("Corrupt header in the %s section.\n"), section->name); + return 0; + } + +- /* PR 17531: file: 418d0a8a. */ +- if (tu_list_offset < cu_list_offset) +- { +- warn (_("TU offset (%x) is less than CU offset (%x)\n"), +- tu_list_offset, cu_list_offset); +- return 0; +- } +- +- cu_list_elements = (tu_list_offset - cu_list_offset) / 8; +- +- if (address_table_offset < tu_list_offset) +- { +- warn (_("Address table offset (%x) is less than TU offset (%x)\n"), +- address_table_offset, tu_list_offset); +- return 0; +- } +- +- tu_list_elements = (address_table_offset - tu_list_offset) / 8; +- +- /* PR 17531: file: 18a47d3d. */ +- if (symbol_table_offset < address_table_offset) +- { +- warn (_("Symbol table offset (%x) is less then Address table offset (%x)\n"), +- symbol_table_offset, address_table_offset); +- return 0; +- } +- +- address_table_size = symbol_table_offset - address_table_offset; +- +- if (constant_pool_offset < symbol_table_offset) +- { +- warn (_("Constant pool offset (%x) is less than symbol table offset (%x)\n"), +- constant_pool_offset, symbol_table_offset); +- return 0; +- } +- ++ cu_list_elements = (tu_list_offset - cu_list_offset) / 16; ++ tu_list_elements = (address_table_offset - tu_list_offset) / 24; ++ address_table_elements = (symbol_table_offset - address_table_offset) / 20; + symbol_table_slots = (constant_pool_offset - symbol_table_offset) / 8; + + cu_list = start + cu_list_offset; +@@ -10504,31 +10475,25 @@ display_gdb_index (struct dwarf_section *section, + symbol_table = start + symbol_table_offset; + constant_pool = start + constant_pool_offset; + +- if (address_table_offset + address_table_size > section->size) +- { +- warn (_("Address table extends beyond end of section.\n")); +- return 0; +- } +- + printf (_("\nCU table:\n")); +- for (i = 0; i < cu_list_elements; i += 2) ++ for (i = 0; i < cu_list_elements; i++) + { +- uint64_t cu_offset = byte_get_little_endian (cu_list + i * 8, 8); +- uint64_t cu_length = byte_get_little_endian (cu_list + i * 8 + 8, 8); ++ uint64_t cu_offset = byte_get_little_endian (cu_list + i * 16, 8); ++ uint64_t cu_length = byte_get_little_endian (cu_list + i * 16 + 8, 8); + +- printf (_("[%3u] 0x%lx - 0x%lx\n"), i / 2, ++ printf (_("[%3u] 0x%lx - 0x%lx\n"), i, + (unsigned long) cu_offset, + (unsigned long) (cu_offset + cu_length - 1)); + } + + printf (_("\nTU table:\n")); +- for (i = 0; i < tu_list_elements; i += 3) ++ for (i = 0; i < tu_list_elements; i++) + { +- uint64_t tu_offset = byte_get_little_endian (tu_list + i * 8, 8); +- uint64_t type_offset = byte_get_little_endian (tu_list + i * 8 + 8, 8); +- uint64_t signature = byte_get_little_endian (tu_list + i * 8 + 16, 8); ++ uint64_t tu_offset = byte_get_little_endian (tu_list + i * 24, 8); ++ uint64_t type_offset = byte_get_little_endian (tu_list + i * 24 + 8, 8); ++ uint64_t signature = byte_get_little_endian (tu_list + i * 24 + 16, 8); + +- printf (_("[%3u] 0x%lx 0x%lx "), i / 3, ++ printf (_("[%3u] 0x%lx 0x%lx "), i, + (unsigned long) tu_offset, + (unsigned long) type_offset); + print_dwarf_vma (signature, 8); +@@ -10536,12 +10501,11 @@ display_gdb_index (struct dwarf_section *section, + } + + printf (_("\nAddress table:\n")); +- for (i = 0; i < address_table_size && i <= address_table_size - (2 * 8 + 4); +- i += 2 * 8 + 4) ++ for (i = 0; i < address_table_elements; i++) + { +- uint64_t low = byte_get_little_endian (address_table + i, 8); +- uint64_t high = byte_get_little_endian (address_table + i + 8, 8); +- uint32_t cu_index = byte_get_little_endian (address_table + i + 16, 4); ++ uint64_t low = byte_get_little_endian (address_table + i * 20, 8); ++ uint64_t high = byte_get_little_endian (address_table + i * 20 + 8, 8); ++ uint32_t cu_index = byte_get_little_endian (address_table + i + 20 + 16, 4); + + print_dwarf_vma (low, 8); + print_dwarf_vma (high, 8); diff --git a/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-45703-2.patch b/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-45703-2.patch new file mode 100644 index 0000000000..1fac9739dd --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-45703-2.patch @@ -0,0 +1,31 @@ +From 69bfd1759db41c8d369f9dcc98a135c5a5d97299 Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Fri, 18 Nov 2022 11:29:13 +1030 +Subject: [PATCH] PR29799 heap buffer overflow in display_gdb_index + dwarf.c:10548 + + PR 29799 + * dwarf.c (display_gdb_index): Typo fix. +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff_plain;f=binutils/dwarf.c;h=4bba8dfb81a6df49f5e61b3fae99dd545cc5c7dd;hp=7730293326ac1049451eb4a037ac86d827030700;hb=69bfd1759db41c8d369f9dcc98a135c5a5d97299;hpb=7828dfa93b210b6bbc6596e6e096cc150a9f8aa4] + +CVE: CVE-2022-45703 + +Signed-off-by: yash shinde <yash.shinde@windriver.com> + +--- + binutils/dwarf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/binutils/dwarf.c b/binutils/dwarf.c +index 7730293326a..4bba8dfb81a 100644 +--- a/binutils/dwarf.c ++++ b/binutils/dwarf.c +@@ -10562,7 +10562,7 @@ display_gdb_index (struct dwarf_section + { + uint64_t low = byte_get_little_endian (address_table + i * 20, 8); + uint64_t high = byte_get_little_endian (address_table + i * 20 + 8, 8); +- uint32_t cu_index = byte_get_little_endian (address_table + i + 20 + 16, 4); ++ uint32_t cu_index = byte_get_little_endian (address_table + i * 20 + 16, 4); + + print_dwarf_vma (low, 8); + print_dwarf_vma (high, 8); diff --git a/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-47695.patch b/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-47695.patch new file mode 100644 index 0000000000..f2e9cea027 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0031-CVE-2022-47695.patch @@ -0,0 +1,58 @@ +From 2f7426b9bb2d2450b32cad3d79fab9abe3ec42bb Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Sun, 4 Dec 2022 22:15:40 +1030 +Subject: [PATCH] PR29846, segmentation fault in objdump.c compare_symbols + +Fixes a fuzzed object file problem where plt relocs were manipulated +in such a way that two synthetic symbols were generated at the same +plt location. Won't occur in real object files. + + PR 29846 + PR 20337 + * objdump.c (compare_symbols): Test symbol flags to exclude + section and synthetic symbols before attempting to check flavour. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3d3af4ba39e892b1c544d667ca241846bc3df386] + +CVE: CVE-2022-47695 + +Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com> +--- + binutils/objdump.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +diff --git a/binutils/objdump.c b/binutils/objdump.c +index 08a0fe521d8..21f75f4db40 100644 +--- a/binutils/objdump.c ++++ b/binutils/objdump.c +@@ -1165,20 +1165,17 @@ compare_symbols (const void *ap, const void *bp) + return 1; + } + +- if (bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour ++ /* Sort larger size ELF symbols before smaller. See PR20337. */ ++ bfd_vma asz = 0; ++ if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0 ++ && bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour) ++ asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size; ++ bfd_vma bsz = 0; ++ if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0 + && bfd_get_flavour (bfd_asymbol_bfd (b)) == bfd_target_elf_flavour) +- { +- bfd_vma asz, bsz; +- +- asz = 0; +- if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0) +- asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size; +- bsz = 0; +- if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0) +- bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size; +- if (asz != bsz) +- return asz > bsz ? -1 : 1; +- } ++ bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size; ++ if (asz != bsz) ++ return asz > bsz ? -1 : 1; + + /* Symbols that start with '.' might be section names, so sort them + after symbols that don't start with '.'. */ diff --git a/meta/recipes-devtools/binutils/binutils/0032-CVE-2022-47010.patch b/meta/recipes-devtools/binutils/binutils/0032-CVE-2022-47010.patch new file mode 100644 index 0000000000..9648033e67 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0032-CVE-2022-47010.patch @@ -0,0 +1,38 @@ +From: Alan Modra <amodra@gmail.com> +Date: Mon, 20 Jun 2022 01:09:31 +0000 (+0930) +Subject: PR29262, memory leak in pr_function_type +X-Git-Tag: binutils-2_39~224 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=0d02e70b197c786f26175b9a73f94e01d14abdab + +PR29262, memory leak in pr_function_type + + PR 29262 + * prdbg.c (pr_function_type): Free "s" on failure path. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=0d02e70b197c786f26175b9a73f94e01d14abdab] + +CVE: CVE-2022-47010 + +Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com> + +--- + +diff --git a/binutils/prdbg.c b/binutils/prdbg.c +index c1e41628d26..bb42a5b6c2d 100644 +--- a/binutils/prdbg.c ++++ b/binutils/prdbg.c +@@ -742,12 +742,9 @@ pr_function_type (void *p, int argcount, bool varargs) + + strcat (s, ")"); + +- if (! substitute_type (info, s)) +- return false; +- ++ bool ret = substitute_type (info, s); + free (s); +- +- return true; ++ return ret; + } + + /* Turn the top type on the stack into a reference to that type. */ diff --git a/meta/recipes-devtools/binutils/binutils/0033-CVE-2022-47007.patch b/meta/recipes-devtools/binutils/binutils/0033-CVE-2022-47007.patch new file mode 100644 index 0000000000..cc6dfe684b --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0033-CVE-2022-47007.patch @@ -0,0 +1,34 @@ +From: Alan Modra <amodra@gmail.com> +Date: Thu, 16 Jun 2022 23:30:41 +0000 (+0930) +Subject: PR29254, memory leak in stab_demangle_v3_arg +X-Git-Tag: binutils-2_39~237 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=0ebc886149c22aceaf8ed74267821a59ca9d03eb + +PR29254, memory leak in stab_demangle_v3_arg + + PR 29254 + * stabs.c (stab_demangle_v3_arg): Free dt on failure path. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=0ebc886149c22aceaf8ed74267821a59ca9d03eb] + +CVE: CVE-2022-47007 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> +--- + +diff --git a/binutils/stabs.c b/binutils/stabs.c +index 2b5241637c1..796ff85b86a 100644 +--- a/binutils/stabs.c ++++ b/binutils/stabs.c +@@ -5467,7 +5467,10 @@ stab_demangle_v3_arg (void *dhandle, struct stab_handle *info, + dc->u.s_binary.right, + &varargs); + if (pargs == NULL) +- return NULL; ++ { ++ free (dt); ++ return NULL; ++ } + + return debug_make_function_type (dhandle, dt, pargs, varargs); + } diff --git a/meta/recipes-devtools/binutils/binutils/0034-CVE-2022-48064.patch b/meta/recipes-devtools/binutils/binutils/0034-CVE-2022-48064.patch new file mode 100644 index 0000000000..b0840366c7 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0034-CVE-2022-48064.patch @@ -0,0 +1,57 @@ +From: Alan Modra <amodra@gmail.com> +Date: Tue, 20 Dec 2022 13:17:03 +0000 (+1030) +Subject: PR29922, SHT_NOBITS section avoids section size sanity check +X-Git-Tag: binutils-2_40~202 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=8f2c64de86bc3d7556121fe296dd679000283931 + +PR29922, SHT_NOBITS section avoids section size sanity check + + PR 29922 + * dwarf2.c (find_debug_info): Ignore sections without + SEC_HAS_CONTENTS. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=8f2c64de86bc3d7556121fe296dd679000283931] + +CVE: CVE-2022-48064 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +--- + +diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c +index 95f45708e9d..0cd8152ee6e 100644 +--- a/bfd/dwarf2.c ++++ b/bfd/dwarf2.c +@@ -4831,16 +4831,19 @@ find_debug_info (bfd *abfd, const struct dwarf_debug_section *debug_sections, + { + look = debug_sections[debug_info].uncompressed_name; + msec = bfd_get_section_by_name (abfd, look); +- if (msec != NULL) ++ /* Testing SEC_HAS_CONTENTS is an anti-fuzzer measure. Of ++ course debug sections always have contents. */ ++ if (msec != NULL && (msec->flags & SEC_HAS_CONTENTS) != 0) + return msec; + + look = debug_sections[debug_info].compressed_name; + msec = bfd_get_section_by_name (abfd, look); +- if (msec != NULL) ++ if (msec != NULL && (msec->flags & SEC_HAS_CONTENTS) != 0) + return msec; + + for (msec = abfd->sections; msec != NULL; msec = msec->next) +- if (startswith (msec->name, GNU_LINKONCE_INFO)) ++ if ((msec->flags & SEC_HAS_CONTENTS) != 0 ++ && startswith (msec->name, GNU_LINKONCE_INFO)) + return msec; + + return NULL; +@@ -4848,6 +4851,9 @@ find_debug_info (bfd *abfd, const struct dwarf_debug_section *debug_sections, + + for (msec = after_sec->next; msec != NULL; msec = msec->next) + { ++ if ((msec->flags & SEC_HAS_CONTENTS) == 0) ++ continue; ++ + look = debug_sections[debug_info].uncompressed_name; + if (strcmp (msec->name, look) == 0) + return msec; diff --git a/meta/recipes-devtools/binutils/binutils/0035-CVE-2023-39129.patch b/meta/recipes-devtools/binutils/binutils/0035-CVE-2023-39129.patch new file mode 100644 index 0000000000..63fb44d59a --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0035-CVE-2023-39129.patch @@ -0,0 +1,50 @@ +From: Keith Seitz <keiths@...> +Date: Wed, 2 Aug 2023 15:35:11 +0000 (-0700) +Subject: Verify COFF symbol stringtab offset +X-Git-Tag: gdb-14-branchpoint~473 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=58abdf887821a5da09ba184c6e400a3bc5cccd5a + +Verify COFF symbol stringtab offset + +This patch addresses an issue with malformed/fuzzed debug information that +was recently reported in gdb/30639. That bug specifically deals with +an ASAN issue, but the reproducer provided by the reporter causes a +another failure outside of ASAN: + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=58abdf887821a5da09ba184c6e400a3bc5cccd5a] + +CVE: CVE-2023-39129 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +diff --git a/gdb/coffread.c b/gdb/coffread.c +--- a/gdb/coffread.c ++++ b/gdb/coffread.c +@@ -159,6 +160,7 @@ static file_ptr linetab_offset; + static file_ptr linetab_size; + + static char *stringtab = NULL; ++static long stringtab_length = 0; + + extern void stabsread_clear_cache (void); + +@@ -1303,6 +1298,7 @@ init_stringtab (bfd *abfd, file_ptr offset, gdb::unique_xmalloc_ptr<char> *stora + /* This is in target format (probably not very useful, and not + currently used), not host format. */ + memcpy (stringtab, lengthbuf, sizeof lengthbuf); ++ stringtab_length = length; + if (length == sizeof length) /* Empty table -- just the count. */ + return 0; + +@@ -1322,8 +1318,9 @@ getsymname (struct internal_syment *symbol_entry) + + if (symbol_entry->_n._n_n._n_zeroes == 0) + { +- /* FIXME: Probably should be detecting corrupt symbol files by +- seeing whether offset points to within the stringtab. */ ++ if (symbol_entry->_n._n_n._n_offset > stringtab_length) ++ error (_("COFF Error: string table offset (%ld) outside string table (length %ld)"), ++ symbol_entry->_n._n_n._n_offset, stringtab_length); + result = stringtab + symbol_entry->_n._n_n._n_offset; + } + else diff --git a/meta/recipes-devtools/binutils/binutils/0036-CVE-2023-39130.patch b/meta/recipes-devtools/binutils/binutils/0036-CVE-2023-39130.patch new file mode 100644 index 0000000000..bfd5b18d7d --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0036-CVE-2023-39130.patch @@ -0,0 +1,326 @@ +From 2db20b97f1dc3e5dce3d6ed74a8a62f0dede8c80 Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Wed, 9 Aug 2023 09:58:36 +0930 +Subject: [PATCH] gdb: warn unused result for bfd IO functions + +This fixes the compilation warnings introduced by my bfdio.c patch. + +The removed bfd_seeks in coff_symfile_read date back to 1994, commit +7f4c859520, prior to which the file used stdio rather than bfd to read +symbols. Since it now uses bfd to read the file there should be no +need to synchronise to bfd's idea of the file position. I also fixed +a potential uninitialised memory access. + +Approved-By: Andrew Burgess <aburgess@redhat.com> + +Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=2db20b97f1dc3e5dce3d6ed74a8a62f0dede8c80] +CVE: CVE-2023-39130 +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> +--- + gdb/coff-pe-read.c | 114 +++++++++++++++++++++++++++++---------------- + gdb/coffread.c | 27 ++--------- + gdb/dbxread.c | 7 +-- + gdb/xcoffread.c | 5 +- + 4 files changed, 85 insertions(+), 68 deletions(-) + +diff --git a/gdb/coff-pe-read.c b/gdb/coff-pe-read.c +--- a/gdb/coff-pe-read.c ++++ b/gdb/coff-pe-read.c +@@ -291,23 +291,31 @@ read_pe_truncate_name (char *dll_name) + + /* Low-level support functions, direct from the ld module pe-dll.c. */ + static unsigned int +-pe_get16 (bfd *abfd, int where) ++pe_get16 (bfd *abfd, int where, bool *fail) + { + unsigned char b[2]; + +- bfd_seek (abfd, (file_ptr) where, SEEK_SET); +- bfd_bread (b, (bfd_size_type) 2, abfd); ++ if (bfd_seek (abfd, where, SEEK_SET) != 0 ++ || bfd_bread (b, 2, abfd) != 2) ++ { ++ *fail = true; ++ return 0; ++ } + return b[0] + (b[1] << 8); + } + + static unsigned int +-pe_get32 (bfd *abfd, int where) ++pe_get32 (bfd *abfd, int where, bool *fail) + { + unsigned char b[4]; + +- bfd_seek (abfd, (file_ptr) where, SEEK_SET); +- bfd_bread (b, (bfd_size_type) 4, abfd); +- return b[0] + (b[1] << 8) + (b[2] << 16) + (b[3] << 24); ++ if (bfd_seek (abfd, where, SEEK_SET) != 0 ++ || bfd_bread (b, 4, abfd) != 4) ++ { ++ *fail = true; ++ return 0; ++ } ++ return b[0] + (b[1] << 8) + (b[2] << 16) + ((unsigned) b[3] << 24); + } + + static unsigned int +@@ -323,7 +331,7 @@ pe_as32 (void *ptr) + { + unsigned char *b = (unsigned char *) ptr; + +- return b[0] + (b[1] << 8) + (b[2] << 16) + (b[3] << 24); ++ return b[0] + (b[1] << 8) + (b[2] << 16) + ((unsigned) b[3] << 24); + } + + /* Read the (non-debug) export symbol table from a portable +@@ -376,37 +384,50 @@ read_pe_exported_syms (minimal_symbol_re + || strcmp (target, "pei-i386") == 0 + || strcmp (target, "pe-arm-wince-little") == 0 + || strcmp (target, "pei-arm-wince-little") == 0); ++ ++ /* Possibly print a debug message about DLL not having a valid format. */ ++ auto maybe_print_debug_msg = [&] () -> void { ++ if (debug_coff_pe_read) ++ fprintf_unfiltered (gdb_stdlog, _("%s doesn't appear to be a DLL\n"), ++ bfd_get_filename (dll)); ++ }; ++ + if (!is_pe32 && !is_pe64) +- { +- /* This is not a recognized PE format file. Abort now, because +- the code is untested on anything else. *FIXME* test on +- further architectures and loosen or remove this test. */ +- return; +- } ++ return maybe_print_debug_msg (); + + /* Get pe_header, optional header and numbers of export entries. */ +- pe_header_offset = pe_get32 (dll, 0x3c); ++ bool fail = false; ++ pe_header_offset = pe_get32 (dll, 0x3c, &fail); ++ if (fail) ++ return maybe_print_debug_msg (); + opthdr_ofs = pe_header_offset + 4 + 20; + if (is_pe64) +- num_entries = pe_get32 (dll, opthdr_ofs + 108); ++ num_entries = pe_get32 (dll, opthdr_ofs + 108, &fail); + else +- num_entries = pe_get32 (dll, opthdr_ofs + 92); ++ num_entries = pe_get32 (dll, opthdr_ofs + 92, &fail); ++ if (fail) ++ return maybe_print_debug_msg (); + + if (num_entries < 1) /* No exports. */ + return; + if (is_pe64) + { +- export_opthdrrva = pe_get32 (dll, opthdr_ofs + 112); +- export_opthdrsize = pe_get32 (dll, opthdr_ofs + 116); ++ export_opthdrrva = pe_get32 (dll, opthdr_ofs + 112, &fail); ++ export_opthdrsize = pe_get32 (dll, opthdr_ofs + 116, &fail); + } + else + { +- export_opthdrrva = pe_get32 (dll, opthdr_ofs + 96); +- export_opthdrsize = pe_get32 (dll, opthdr_ofs + 100); ++ export_opthdrrva = pe_get32 (dll, opthdr_ofs + 96, &fail); ++ export_opthdrsize = pe_get32 (dll, opthdr_ofs + 100, &fail); + } +- nsections = pe_get16 (dll, pe_header_offset + 4 + 2); ++ if (fail) ++ return maybe_print_debug_msg (); ++ ++ nsections = pe_get16 (dll, pe_header_offset + 4 + 2, &fail); + secptr = (pe_header_offset + 4 + 20 + +- pe_get16 (dll, pe_header_offset + 4 + 16)); ++ pe_get16 (dll, pe_header_offset + 4 + 16, &fail)); ++ if (fail) ++ return maybe_print_debug_msg (); + expptr = 0; + export_size = 0; + +@@ -415,12 +436,13 @@ read_pe_exported_syms (minimal_symbol_re + { + char sname[8]; + unsigned long secptr1 = secptr + 40 * i; +- unsigned long vaddr = pe_get32 (dll, secptr1 + 12); +- unsigned long vsize = pe_get32 (dll, secptr1 + 16); +- unsigned long fptr = pe_get32 (dll, secptr1 + 20); +- +- bfd_seek (dll, (file_ptr) secptr1, SEEK_SET); +- bfd_bread (sname, (bfd_size_type) sizeof (sname), dll); ++ unsigned long vaddr = pe_get32 (dll, secptr1 + 12, &fail); ++ unsigned long vsize = pe_get32 (dll, secptr1 + 16, &fail); ++ unsigned long fptr = pe_get32 (dll, secptr1 + 20, &fail); ++ ++ if (fail ++ || bfd_seek (dll, secptr1, SEEK_SET) != 0 ++ || bfd_bread (sname, sizeof (sname), dll) != sizeof (sname)) + + if ((strcmp (sname, ".edata") == 0) + || (vaddr <= export_opthdrrva && export_opthdrrva < vaddr + vsize)) +@@ -461,16 +483,18 @@ read_pe_exported_syms (minimal_symbol_re + for (i = 0; i < nsections; i++) + { + unsigned long secptr1 = secptr + 40 * i; +- unsigned long vsize = pe_get32 (dll, secptr1 + 8); +- unsigned long vaddr = pe_get32 (dll, secptr1 + 12); +- unsigned long characteristics = pe_get32 (dll, secptr1 + 36); ++ unsigned long vsize = pe_get32 (dll, secptr1 + 8, &fail); ++ unsigned long vaddr = pe_get32 (dll, secptr1 + 12, &fail); ++ unsigned long characteristics = pe_get32 (dll, secptr1 + 36, &fail); + char sec_name[SCNNMLEN + 1]; + int sectix; + unsigned int bfd_section_index; + asection *section; + +- bfd_seek (dll, (file_ptr) secptr1 + 0, SEEK_SET); +- bfd_bread (sec_name, (bfd_size_type) SCNNMLEN, dll); ++ if (fail ++ || bfd_seek (dll, secptr1 + 0, SEEK_SET) != 0 ++ || bfd_bread (sec_name, SCNNMLEN, dll) != SCNNMLEN) ++ return maybe_print_debug_msg (); + sec_name[SCNNMLEN] = '\0'; + + sectix = read_pe_section_index (sec_name); +@@ -509,8 +533,9 @@ read_pe_exported_syms (minimal_symbol_re + gdb::def_vector<unsigned char> expdata_storage (export_size); + expdata = expdata_storage.data (); + +- bfd_seek (dll, (file_ptr) expptr, SEEK_SET); +- bfd_bread (expdata, (bfd_size_type) export_size, dll); ++ if (bfd_seek (dll, expptr, SEEK_SET) != 0 ++ || bfd_bread (expdata, export_size, dll) != export_size) ++ return maybe_print_debug_msg (); + erva = expdata - export_rva; + + nexp = pe_as32 (expdata + 24); +@@ -658,20 +683,27 @@ pe_text_section_offset (struct bfd *abfd + } + + /* Get pe_header, optional header and numbers of sections. */ +- pe_header_offset = pe_get32 (abfd, 0x3c); +- nsections = pe_get16 (abfd, pe_header_offset + 4 + 2); ++ bool fail = false; ++ pe_header_offset = pe_get32 (abfd, 0x3c, &fail); ++ if (fail) ++ return DEFAULT_COFF_PE_TEXT_SECTION_OFFSET; ++ nsections = pe_get16 (abfd, pe_header_offset + 4 + 2, &fail); + secptr = (pe_header_offset + 4 + 20 + +- pe_get16 (abfd, pe_header_offset + 4 + 16)); ++ pe_get16 (abfd, pe_header_offset + 4 + 16, &fail)); ++ if (fail) ++ return DEFAULT_COFF_PE_TEXT_SECTION_OFFSET; + + /* Get the rva and size of the export section. */ + for (i = 0; i < nsections; i++) + { + char sname[SCNNMLEN + 1]; + unsigned long secptr1 = secptr + 40 * i; +- unsigned long vaddr = pe_get32 (abfd, secptr1 + 12); ++ unsigned long vaddr = pe_get32 (abfd, secptr1 + 12, &fail); + +- bfd_seek (abfd, (file_ptr) secptr1, SEEK_SET); +- bfd_bread (sname, (bfd_size_type) SCNNMLEN, abfd); ++ if (fail ++ || bfd_seek (abfd, secptr1, SEEK_SET) != 0 ++ || bfd_bread (sname, SCNNMLEN, abfd) != SCNNMLEN) ++ return DEFAULT_COFF_PE_TEXT_SECTION_OFFSET; + sname[SCNNMLEN] = '\0'; + if (strcmp (sname, ".text") == 0) + return vaddr; +diff --git a/gdb/coffread.c b/gdb/coffread.c +--- a/gdb/coffread.c ++++ b/gdb/coffread.c +@@ -690,8 +690,6 @@ coff_symfile_read (struct objfile *objfi + + /* FIXME: dubious. Why can't we use something normal like + bfd_get_section_contents? */ +- bfd_seek (abfd, abfd->where, 0); +- + stabstrsize = bfd_section_size (info->stabstrsect); + + coffstab_build_psymtabs (objfile, +@@ -780,22 +778,6 @@ coff_symtab_read (minimal_symbol_reader + + scoped_free_pendings free_pending; + +- /* Work around a stdio bug in SunOS4.1.1 (this makes me nervous.... +- it's hard to know I've really worked around it. The fix should +- be harmless, anyway). The symptom of the bug is that the first +- fread (in read_one_sym), will (in my example) actually get data +- from file offset 268, when the fseek was to 264 (and ftell shows +- 264). This causes all hell to break loose. I was unable to +- reproduce this on a short test program which operated on the same +- file, performing (I think) the same sequence of operations. +- +- It stopped happening when I put in this (former) rewind(). +- +- FIXME: Find out if this has been reported to Sun, whether it has +- been fixed in a later release, etc. */ +- +- bfd_seek (objfile->obfd, 0, 0); +- + /* Position to read the symbol table. */ + val = bfd_seek (objfile->obfd, symtab_offset, 0); + if (val < 0) +@@ -1285,12 +1267,13 @@ init_stringtab (bfd *abfd, file_ptr offs + if (bfd_seek (abfd, offset, 0) < 0) + return -1; + +- val = bfd_bread ((char *) lengthbuf, sizeof lengthbuf, abfd); +- length = bfd_h_get_32 (symfile_bfd, lengthbuf); +- ++ val = bfd_bread (lengthbuf, sizeof lengthbuf, abfd); + /* If no string table is needed, then the file may end immediately + after the symbols. Just return with `stringtab' set to null. */ +- if (val != sizeof lengthbuf || length < sizeof lengthbuf) ++ if (val != sizeof lengthbuf) ++ return 0; ++ length = bfd_h_get_32 (symfile_bfd, lengthbuf); ++ if (length < sizeof lengthbuf) + return 0; + + storage->reset ((char *) xmalloc (length)); +diff --git a/gdb/dbxread.c b/gdb/dbxread.c +--- a/gdb/dbxread.c ++++ b/gdb/dbxread.c +@@ -812,7 +812,8 @@ stabs_seek (int sym_offset) + symbuf_left -= sym_offset; + } + else +- bfd_seek (symfile_bfd, sym_offset, SEEK_CUR); ++ if (bfd_seek (symfile_bfd, sym_offset, SEEK_CUR) != 0) ++ perror_with_name (bfd_get_filename (symfile_bfd)); + } + + #define INTERNALIZE_SYMBOL(intern, extern, abfd) \ +@@ -2095,8 +2096,8 @@ dbx_expand_psymtab (legacy_psymtab *pst, + symbol_size = SYMBOL_SIZE (pst); + + /* Read in this file's symbols. */ +- bfd_seek (objfile->obfd, SYMBOL_OFFSET (pst), SEEK_SET); +- read_ofile_symtab (objfile, pst); ++ if (bfd_seek (objfile->obfd, SYMBOL_OFFSET (pst), SEEK_SET) == 0) ++ read_ofile_symtab (objfile, pst); + } + + pst->readin = true; +diff --git a/gdb/xcoffread.c b/gdb/xcoffread.c +--- a/gdb/xcoffread.c ++++ b/gdb/xcoffread.c +@@ -865,8 +865,9 @@ enter_line_range (struct subfile *subfil + + while (curoffset <= limit_offset) + { +- bfd_seek (abfd, curoffset, SEEK_SET); +- bfd_bread (ext_lnno, linesz, abfd); ++ if (bfd_seek (abfd, curoffset, SEEK_SET) != 0 ++ || bfd_bread (ext_lnno, linesz, abfd) != linesz) ++ return; + bfd_coff_swap_lineno_in (abfd, ext_lnno, &int_lnno); + + /* Find the address this line represents. */ +-- +2.39.3 diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2022-48063.patch b/meta/recipes-devtools/binutils/binutils/CVE-2022-48063.patch new file mode 100644 index 0000000000..ea2e030503 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2022-48063.patch @@ -0,0 +1,48 @@ +From 75393a2d54bcc40053e5262a3de9d70c5ebfbbfd Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Wed, 21 Dec 2022 11:51:23 +0000 +Subject: [PATCH] Fix an attempt to allocate an unreasonably large amount of + memory when parsing a corrupt ELF file. + + PR 29924 + * objdump.c (load_specific_debug_section): Check for excessively + large sections. + +Upstream-Status: Backport +CVE: CVE-2022-48063 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + binutils/ChangeLog | 6 ++++++ + binutils/objdump.c | 4 +++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +Index: git/binutils/objdump.c +=================================================================== +--- git.orig/binutils/objdump.c ++++ git/binutils/objdump.c +@@ -3768,7 +3768,9 @@ load_specific_debug_section (enum dwarf_ + section->size = bfd_section_size (sec); + /* PR 24360: On 32-bit hosts sizeof (size_t) < sizeof (bfd_size_type). */ + alloced = amt = section->size + 1; +- if (alloced != amt || alloced == 0) ++ if (alloced != amt ++ || alloced == 0 ++ || (bfd_get_size (abfd) != 0 && alloced >= bfd_get_size (abfd))) + { + section->start = NULL; + free_debug_section (debug); +Index: git/binutils/ChangeLog +=================================================================== +--- git.orig/binutils/ChangeLog ++++ git/binutils/ChangeLog +@@ -1,3 +1,9 @@ ++2022-12-21 Nick Clifton <nickc@redhat.com> ++ ++ PR 29924 ++ * objdump.c (load_specific_debug_section): Check for excessively ++ large sections. ++ + 2022-03-23 Nick Clifton <nickc@redhat.com> + + Import patch from mainline: diff --git a/meta/recipes-devtools/bootchart2/bootchart2/0001-bootchart2-support-usrmerge.patch b/meta/recipes-devtools/bootchart2/bootchart2/0001-bootchart2-support-usrmerge.patch deleted file mode 100644 index 88597cf3a9..0000000000 --- a/meta/recipes-devtools/bootchart2/bootchart2/0001-bootchart2-support-usrmerge.patch +++ /dev/null @@ -1,37 +0,0 @@ -From b6d1a1ff2de363b1b76c8c70f77ae56a4e4d4b56 Mon Sep 17 00:00:00 2001 -From: Changqing Li <changqing.li@windriver.com> -Date: Thu, 5 Sep 2019 18:37:31 +0800 -Subject: [PATCH] bootchart2: support usrmerge - -Upstream-Status: Inappropriate [oe-specific] - -Signed-off-by: Changqing Li <changqing.li@windriver.com> ---- - Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Makefile b/Makefile -index 1cc2974..f988904 100644 ---- a/Makefile -+++ b/Makefile -@@ -36,7 +36,7 @@ endif - PY_SITEDIR ?= $(PY_LIBDIR)/site-packages - LIBC_A_PATH = /usr$(LIBDIR) - # Always lib, even on systems that otherwise use lib64 --SYSTEMD_UNIT_DIR = $(EARLY_PREFIX)/lib/systemd/system -+SYSTEMD_UNIT_DIR ?= $(EARLY_PREFIX)/lib/systemd/system - COLLECTOR = \ - collector/collector.o \ - collector/output.o \ -@@ -99,7 +99,7 @@ install-chroot: - install -d $(DESTDIR)$(PKGLIBDIR)/tmpfs - - install-collector: all install-chroot -- install -m 755 -D bootchartd $(DESTDIR)$(EARLY_PREFIX)/sbin/$(PROGRAM_PREFIX)bootchartd$(PROGRAM_SUFFIX) -+ install -m 755 -D bootchartd $(DESTDIR)${BASE_SBINDIR}/$(PROGRAM_PREFIX)bootchartd$(PROGRAM_SUFFIX) - install -m 644 -D bootchartd.conf $(DESTDIR)/etc/$(PROGRAM_PREFIX)bootchartd$(PROGRAM_SUFFIX).conf - install -m 755 -D bootchart-collector $(DESTDIR)$(PKGLIBDIR)/$(PROGRAM_PREFIX)bootchart$(PROGRAM_SUFFIX)-collector - --- -2.7.4 - diff --git a/meta/recipes-devtools/bootchart2/bootchart2_0.14.9.bb b/meta/recipes-devtools/bootchart2/bootchart2_0.14.9.bb index b1628075a7..38a1c9d147 100644 --- a/meta/recipes-devtools/bootchart2/bootchart2_0.14.9.bb +++ b/meta/recipes-devtools/bootchart2/bootchart2_0.14.9.bb @@ -93,7 +93,6 @@ UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+(\.\d+)*)" SRC_URI = "git://github.com/xrmx/bootchart.git;branch=master;protocol=https \ file://bootchartd_stop.sh \ file://0001-collector-Allocate-space-on-heap-for-chunks.patch \ - file://0001-bootchart2-support-usrmerge.patch \ file://0001-bootchartd.in-make-sure-only-one-bootchartd-process.patch \ " @@ -119,12 +118,11 @@ UPDATERCPN = "bootchartd-stop-initscript" INITSCRIPT_NAME = "bootchartd_stop.sh" INITSCRIPT_PARAMS = "start 99 2 3 4 5 ." -EXTRA_OEMAKE = 'BASE_SBINDIR="${base_sbindir}"' - do_compile:prepend () { export PY_LIBDIR="${libdir}/${PYTHON_DIR}" export BINDIR="${bindir}" - export LIBDIR="${base_libdir}" + export LIBDIR="/${baselib}" + export EARLY_PREFIX="${root_prefix}" } do_install () { @@ -132,9 +130,8 @@ do_install () { export PY_LIBDIR="${libdir}/${PYTHON_DIR}" export BINDIR="${bindir}" export DESTDIR="${D}" - export LIBDIR="${base_libdir}" - export PKGLIBDIR="${base_libdir}/bootchart" - export SYSTEMD_UNIT_DIR="${systemd_system_unitdir}" + export LIBDIR="/${baselib}" + export EARLY_PREFIX="${root_prefix}" oe_runmake install NO_PYTHON_COMPILE=1 install -d ${D}${sysconfdir}/init.d diff --git a/meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch b/meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch new file mode 100644 index 0000000000..d62e1ef26b --- /dev/null +++ b/meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch @@ -0,0 +1,92 @@ +From 1523eaeff4669e421b3f60618b43c878e4860fe6 Mon Sep 17 00:00:00 2001 +From: Joel Rosdahl <joel@rosdahl.net> +Date: Tue, 5 Jul 2022 21:42:58 +0200 +Subject: [PATCH] build: Fix FTBFS with not yet released GCC 13 + +Reference: https://gcc.gnu.org/gcc-13/porting_to.html#header-dep-changes + +Fixes #1105. + +Upstream-Status: Backport [v4.7 https://github.com/ccache/ccache/commit/19ef6e267d38d4d8b3e11c915213472d5662d593] +Signed-off-by: Martin Jansa <martin.jansa@gmail.com> +--- + src/Stat.hpp | 1 + + src/core/CacheEntryHeader.hpp | 2 ++ + src/core/Sloppiness.hpp | 1 + + src/core/Statistics.hpp | 3 ++- + src/util/TextTable.hpp | 3 ++- + 5 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/src/Stat.hpp b/src/Stat.hpp +index 2f56214a..074cdeeb 100644 +--- a/src/Stat.hpp ++++ b/src/Stat.hpp +@@ -23,6 +23,7 @@ + #include <sys/stat.h> + #include <sys/types.h> + ++#include <cstdint> + #include <ctime> + #include <string> + +diff --git a/src/core/CacheEntryHeader.hpp b/src/core/CacheEntryHeader.hpp +index 4c3e04c7..dcc32e1c 100644 +--- a/src/core/CacheEntryHeader.hpp ++++ b/src/core/CacheEntryHeader.hpp +@@ -21,6 +21,8 @@ + #include <compression/types.hpp> + #include <core/types.hpp> + ++#include <cstdint> ++ + // Cache entry format + // ================== + // +diff --git a/src/core/Sloppiness.hpp b/src/core/Sloppiness.hpp +index 917526bf..1ab31d71 100644 +--- a/src/core/Sloppiness.hpp ++++ b/src/core/Sloppiness.hpp +@@ -18,6 +18,7 @@ + + #pragma once + ++#include <cstdint> + #include <string> + + namespace core { +diff --git a/src/core/Statistics.hpp b/src/core/Statistics.hpp +index 3e9ed816..54f32e9c 100644 +--- a/src/core/Statistics.hpp ++++ b/src/core/Statistics.hpp +@@ -1,4 +1,4 @@ +-// Copyright (C) 2020-2021 Joel Rosdahl and other contributors ++// Copyright (C) 2020-2022 Joel Rosdahl and other contributors + // + // See doc/AUTHORS.adoc for a complete list of contributors. + // +@@ -20,6 +20,7 @@ + + #include <core/StatisticsCounters.hpp> + ++#include <cstdint> + #include <string> + #include <unordered_map> + #include <vector> +diff --git a/src/util/TextTable.hpp b/src/util/TextTable.hpp +index 05c0e0e5..60edee75 100644 +--- a/src/util/TextTable.hpp ++++ b/src/util/TextTable.hpp +@@ -1,4 +1,4 @@ +-// Copyright (C) 2021 Joel Rosdahl and other contributors ++// Copyright (C) 2021-2022 Joel Rosdahl and other contributors + // + // See doc/AUTHORS.adoc for a complete list of contributors. + // +@@ -18,6 +18,7 @@ + + #pragma once + ++#include <cstdint> + #include <string> + #include <vector> + diff --git a/meta/recipes-devtools/ccache/ccache_4.6.bb b/meta/recipes-devtools/ccache/ccache_4.6.bb index f019679cf1..d94c5d591a 100644 --- a/meta/recipes-devtools/ccache/ccache_4.6.bb +++ b/meta/recipes-devtools/ccache/ccache_4.6.bb @@ -11,7 +11,9 @@ LIC_FILES_CHKSUM = "file://LICENSE.adoc;md5=ff5327dc93e2b286c931dda3d6079da9" DEPENDS = "zstd" -SRC_URI = "https://github.com/ccache/ccache/releases/download/v${PV}/${BP}.tar.gz" +SRC_URI = "https://github.com/ccache/ccache/releases/download/v${PV}/${BP}.tar.gz \ + file://0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch \ +" SRC_URI[sha256sum] = "73a1767ac6b7c0404a1a55f761a746d338e702883c7137fbf587023062258625" UPSTREAM_CHECK_URI = "https://github.com/ccache/ccache/releases/" diff --git a/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake b/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake index 3ddef12c83..6434b27371 100644 --- a/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake +++ b/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake @@ -11,13 +11,13 @@ set( CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY ) set(CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX "$ENV{OE_CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX}") -# Set CMAKE_SYSTEM_PROCESSOR from the sysroot name (assuming processor-distro-os). -if ($ENV{SDKTARGETSYSROOT} MATCHES "/sysroots/([a-zA-Z0-9_-]+)-.+-.+") - set(CMAKE_SYSTEM_PROCESSOR ${CMAKE_MATCH_1}) -endif() +set( CMAKE_SYSTEM_PROCESSOR $ENV{OECORE_TARGET_ARCH} ) # Include the toolchain configuration subscripts file( GLOB toolchain_config_files "${CMAKE_CURRENT_LIST_FILE}.d/*.cmake" ) foreach(config ${toolchain_config_files}) include(${config}) endforeach() + +unset(CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES) +unset(CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES) diff --git a/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1a.patch b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1a.patch new file mode 100644 index 0000000000..bf93fbc13c --- /dev/null +++ b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1a.patch @@ -0,0 +1,236 @@ +From ee6db10dd70b8fdc7a93cffd7cf5bc7a28f9d3d7 Mon Sep 17 00:00:00 2001 +From: Jean Delvare <jdelvare@suse.de> +Date: Mon, 20 Feb 2023 14:53:21 +0100 +Subject: [PATCH 1/5] dmidecode: Split table fetching from decoding + +Clean up function dmi_table so that it does only one thing: +* dmi_table() is renamed to dmi_table_get(). It now retrieves the + DMI table, but does not process it any longer. +* Decoding or dumping the table is now done in smbios3_decode(), + smbios_decode() and legacy_decode(). +No functional change. + +A side effect of this change is that writing the header and body of +dump files is now done in a single location. This is required to +further consolidate the writing of dump files. + +Signed-off-by: Jean Delvare <jdelvare@suse.de> +Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com> + +CVE: CVE-2023-30630 + +Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=39b2dd7b6ab719b920e96ed832cfb4bdd664e808] + +Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> +--- + dmidecode.c | 86 ++++++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 62 insertions(+), 24 deletions(-) + +diff --git a/dmidecode.c b/dmidecode.c +index cd2b5c9..b082c03 100644 +--- a/dmidecode.c ++++ b/dmidecode.c +@@ -5247,8 +5247,9 @@ static void dmi_table_decode(u8 *buf, u32 len, u16 num, u16 ver, u32 flags) + } + } + +-static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem, +- u32 flags) ++/* Allocates a buffer for the table, must be freed by the caller */ ++static u8 *dmi_table_get(off_t base, u32 *len, u16 num, u32 ver, ++ const char *devmem, u32 flags) + { + u8 *buf; + +@@ -5267,7 +5268,7 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem, + { + if (num) + pr_info("%u structures occupying %u bytes.", +- num, len); ++ num, *len); + if (!(opt.flags & FLAG_FROM_DUMP)) + pr_info("Table at 0x%08llX.", + (unsigned long long)base); +@@ -5285,19 +5286,19 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem, + * would be the result of the kernel truncating the table on + * parse error. + */ +- size_t size = len; ++ size_t size = *len; + buf = read_file(flags & FLAG_NO_FILE_OFFSET ? 0 : base, + &size, devmem); +- if (!(opt.flags & FLAG_QUIET) && num && size != (size_t)len) ++ if (!(opt.flags & FLAG_QUIET) && num && size != (size_t)*len) + { + fprintf(stderr, "Wrong DMI structures length: %u bytes " + "announced, only %lu bytes available.\n", +- len, (unsigned long)size); ++ *len, (unsigned long)size); + } +- len = size; ++ *len = size; + } + else +- buf = mem_chunk(base, len, devmem); ++ buf = mem_chunk(base, *len, devmem); + + if (buf == NULL) + { +@@ -5307,15 +5308,9 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem, + fprintf(stderr, + "Try compiling dmidecode with -DUSE_MMAP.\n"); + #endif +- return; + } + +- if (opt.flags & FLAG_DUMP_BIN) +- dmi_table_dump(buf, len); +- else +- dmi_table_decode(buf, len, num, ver >> 8, flags); +- +- free(buf); ++ return buf; + } + + +@@ -5350,8 +5345,9 @@ static void overwrite_smbios3_address(u8 *buf) + + static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) + { +- u32 ver; ++ u32 ver, len; + u64 offset; ++ u8 *table; + + /* Don't let checksum run beyond the buffer */ + if (buf[0x06] > 0x20) +@@ -5377,8 +5373,12 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) + return 0; + } + +- dmi_table(((off_t)offset.h << 32) | offset.l, +- DWORD(buf + 0x0C), 0, ver, devmem, flags | FLAG_STOP_AT_EOT); ++ /* Maximum length, may get trimmed */ ++ len = DWORD(buf + 0x0C); ++ table = dmi_table_get(((off_t)offset.h << 32) | offset.l, &len, 0, ver, ++ devmem, flags | FLAG_STOP_AT_EOT); ++ if (table == NULL) ++ return 1; + + if (opt.flags & FLAG_DUMP_BIN) + { +@@ -5387,18 +5387,28 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) + memcpy(crafted, buf, 32); + overwrite_smbios3_address(crafted); + ++ dmi_table_dump(table, len); + if (!(opt.flags & FLAG_QUIET)) + pr_comment("Writing %d bytes to %s.", crafted[0x06], + opt.dumpfile); + write_dump(0, crafted[0x06], crafted, opt.dumpfile, 1); + } ++ else ++ { ++ dmi_table_decode(table, len, 0, ver >> 8, ++ flags | FLAG_STOP_AT_EOT); ++ } ++ ++ free(table); + + return 1; + } + + static int smbios_decode(u8 *buf, const char *devmem, u32 flags) + { +- u16 ver; ++ u16 ver, num; ++ u32 len; ++ u8 *table; + + /* Don't let checksum run beyond the buffer */ + if (buf[0x05] > 0x20) +@@ -5438,8 +5448,13 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags) + pr_info("SMBIOS %u.%u present.", + ver >> 8, ver & 0xFF); + +- dmi_table(DWORD(buf + 0x18), WORD(buf + 0x16), WORD(buf + 0x1C), +- ver << 8, devmem, flags); ++ /* Maximum length, may get trimmed */ ++ len = WORD(buf + 0x16); ++ num = WORD(buf + 0x1C); ++ table = dmi_table_get(DWORD(buf + 0x18), &len, num, ver << 8, ++ devmem, flags); ++ if (table == NULL) ++ return 1; + + if (opt.flags & FLAG_DUMP_BIN) + { +@@ -5448,27 +5463,43 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags) + memcpy(crafted, buf, 32); + overwrite_dmi_address(crafted + 0x10); + ++ dmi_table_dump(table, len); + if (!(opt.flags & FLAG_QUIET)) + pr_comment("Writing %d bytes to %s.", crafted[0x05], + opt.dumpfile); + write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1); + } ++ else ++ { ++ dmi_table_decode(table, len, num, ver, flags); ++ } ++ ++ free(table); + + return 1; + } + + static int legacy_decode(u8 *buf, const char *devmem, u32 flags) + { ++ u16 ver, num; ++ u32 len; ++ u8 *table; ++ + if (!checksum(buf, 0x0F)) + return 0; + ++ ver = ((buf[0x0E] & 0xF0) << 4) + (buf[0x0E] & 0x0F); + if (!(opt.flags & FLAG_QUIET)) + pr_info("Legacy DMI %u.%u present.", + buf[0x0E] >> 4, buf[0x0E] & 0x0F); + +- dmi_table(DWORD(buf + 0x08), WORD(buf + 0x06), WORD(buf + 0x0C), +- ((buf[0x0E] & 0xF0) << 12) + ((buf[0x0E] & 0x0F) << 8), +- devmem, flags); ++ /* Maximum length, may get trimmed */ ++ len = WORD(buf + 0x06); ++ num = WORD(buf + 0x0C); ++ table = dmi_table_get(DWORD(buf + 0x08), &len, num, ver << 8, ++ devmem, flags); ++ if (table == NULL) ++ return 1; + + if (opt.flags & FLAG_DUMP_BIN) + { +@@ -5477,11 +5508,18 @@ static int legacy_decode(u8 *buf, const char *devmem, u32 flags) + memcpy(crafted, buf, 16); + overwrite_dmi_address(crafted); + ++ dmi_table_dump(table, len); + if (!(opt.flags & FLAG_QUIET)) + pr_comment("Writing %d bytes to %s.", 0x0F, + opt.dumpfile); + write_dump(0, 0x0F, crafted, opt.dumpfile, 1); + } ++ else ++ { ++ dmi_table_decode(table, len, num, ver, flags); ++ } ++ ++ free(table); + + return 1; + } +-- +2.41.0 + diff --git a/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1b.patch b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1b.patch new file mode 100644 index 0000000000..e03bda05e4 --- /dev/null +++ b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1b.patch @@ -0,0 +1,197 @@ +From d362549bce92ac22860cda8cad4532c1a3fe6928 Mon Sep 17 00:00:00 2001 +From: Jean Delvare <jdelvare@suse.de> +Date: Mon, 20 Feb 2023 14:53:25 +0100 +Subject: [PATCH 2/5] dmidecode: Write the whole dump file at once + +When option --dump-bin is used, write the whole dump file at once, +instead of opening and closing the file separately for the table +and then for the entry point. + +As the file writing function is no longer generic, it gets moved +from util.c to dmidecode.c. + +One minor functional change resulting from the new implementation is +that the entry point is written first now, so the messages printed +are swapped. + +Signed-off-by: Jean Delvare <jdelvare@suse.de> +Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com> + +CVE: CVE-2023-30630 + +Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=d8cfbc808f387e87091c25e7d5b8c2bb348bb206] + +Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> +--- + dmidecode.c | 69 +++++++++++++++++++++++++++++++++++++++-------------- + util.c | 40 ------------------------------- + util.h | 1 - + 3 files changed, 51 insertions(+), 59 deletions(-) + +diff --git a/dmidecode.c b/dmidecode.c +index b082c03..a80a140 100644 +--- a/dmidecode.c ++++ b/dmidecode.c +@@ -5130,11 +5130,56 @@ static void dmi_table_string(const struct dmi_header *h, const u8 *data, u16 ver + } + } + +-static void dmi_table_dump(const u8 *buf, u32 len) ++static int dmi_table_dump(const u8 *ep, u32 ep_len, const u8 *table, ++ u32 table_len) + { ++ FILE *f; ++ ++ f = fopen(opt.dumpfile, "wb"); ++ if (!f) ++ { ++ fprintf(stderr, "%s: ", opt.dumpfile); ++ perror("fopen"); ++ return -1; ++ } ++ ++ if (!(opt.flags & FLAG_QUIET)) ++ pr_comment("Writing %d bytes to %s.", ep_len, opt.dumpfile); ++ if (fwrite(ep, ep_len, 1, f) != 1) ++ { ++ fprintf(stderr, "%s: ", opt.dumpfile); ++ perror("fwrite"); ++ goto err_close; ++ } ++ ++ if (fseek(f, 32, SEEK_SET) != 0) ++ { ++ fprintf(stderr, "%s: ", opt.dumpfile); ++ perror("fseek"); ++ goto err_close; ++ } ++ + if (!(opt.flags & FLAG_QUIET)) +- pr_comment("Writing %d bytes to %s.", len, opt.dumpfile); +- write_dump(32, len, buf, opt.dumpfile, 0); ++ pr_comment("Writing %d bytes to %s.", table_len, opt.dumpfile); ++ if (fwrite(table, table_len, 1, f) != 1) ++ { ++ fprintf(stderr, "%s: ", opt.dumpfile); ++ perror("fwrite"); ++ goto err_close; ++ } ++ ++ if (fclose(f)) ++ { ++ fprintf(stderr, "%s: ", opt.dumpfile); ++ perror("fclose"); ++ return -1; ++ } ++ ++ return 0; ++ ++err_close: ++ fclose(f); ++ return -1; + } + + static void dmi_table_decode(u8 *buf, u32 len, u16 num, u16 ver, u32 flags) +@@ -5387,11 +5432,7 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) + memcpy(crafted, buf, 32); + overwrite_smbios3_address(crafted); + +- dmi_table_dump(table, len); +- if (!(opt.flags & FLAG_QUIET)) +- pr_comment("Writing %d bytes to %s.", crafted[0x06], +- opt.dumpfile); +- write_dump(0, crafted[0x06], crafted, opt.dumpfile, 1); ++ dmi_table_dump(crafted, crafted[0x06], table, len); + } + else + { +@@ -5463,11 +5504,7 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags) + memcpy(crafted, buf, 32); + overwrite_dmi_address(crafted + 0x10); + +- dmi_table_dump(table, len); +- if (!(opt.flags & FLAG_QUIET)) +- pr_comment("Writing %d bytes to %s.", crafted[0x05], +- opt.dumpfile); +- write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1); ++ dmi_table_dump(crafted, crafted[0x05], table, len); + } + else + { +@@ -5508,11 +5545,7 @@ static int legacy_decode(u8 *buf, const char *devmem, u32 flags) + memcpy(crafted, buf, 16); + overwrite_dmi_address(crafted); + +- dmi_table_dump(table, len); +- if (!(opt.flags & FLAG_QUIET)) +- pr_comment("Writing %d bytes to %s.", 0x0F, +- opt.dumpfile); +- write_dump(0, 0x0F, crafted, opt.dumpfile, 1); ++ dmi_table_dump(crafted, 0x0F, table, len); + } + else + { +diff --git a/util.c b/util.c +index 04aaadd..1547096 100644 +--- a/util.c ++++ b/util.c +@@ -259,46 +259,6 @@ out: + return p; + } + +-int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add) +-{ +- FILE *f; +- +- f = fopen(dumpfile, add ? "r+b" : "wb"); +- if (!f) +- { +- fprintf(stderr, "%s: ", dumpfile); +- perror("fopen"); +- return -1; +- } +- +- if (fseek(f, base, SEEK_SET) != 0) +- { +- fprintf(stderr, "%s: ", dumpfile); +- perror("fseek"); +- goto err_close; +- } +- +- if (fwrite(data, len, 1, f) != 1) +- { +- fprintf(stderr, "%s: ", dumpfile); +- perror("fwrite"); +- goto err_close; +- } +- +- if (fclose(f)) +- { +- fprintf(stderr, "%s: ", dumpfile); +- perror("fclose"); +- return -1; +- } +- +- return 0; +- +-err_close: +- fclose(f); +- return -1; +-} +- + /* Returns end - start + 1, assuming start < end */ + u64 u64_range(u64 start, u64 end) + { +diff --git a/util.h b/util.h +index 3094cf8..ef24eb9 100644 +--- a/util.h ++++ b/util.h +@@ -27,5 +27,4 @@ + int checksum(const u8 *buf, size_t len); + void *read_file(off_t base, size_t *len, const char *filename); + void *mem_chunk(off_t base, size_t len, const char *devmem); +-int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add); + u64 u64_range(u64 start, u64 end); +-- +2.41.0 + diff --git a/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_2.patch b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_2.patch new file mode 100644 index 0000000000..37167a9c4f --- /dev/null +++ b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_2.patch @@ -0,0 +1,83 @@ +From 2d26f187c734635d072d24ea401255b84f03f4c4 Mon Sep 17 00:00:00 2001 +From: Jean Delvare <jdelvare@suse.de> +Date: Tue, 27 Jun 2023 10:03:53 +0000 +Subject: [PATCH 3/5] dmidecode: Do not let --dump-bin overwrite an existing + file + +Make sure that the file passed to option --dump-bin does not already +exist. In practice, it is rather unlikely that an honest user would +want to overwrite an existing dump file, while this possibility +could be used by a rogue user to corrupt a system file. + +Signed-off-by: Jean Delvare <jdelvare@suse.de> +Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com> + +CVE: CVE-2023-30630 + +Upstream-Status: Backport +[https://github.com/mirror/dmidecode/commit/6ca381c1247c81f74e1ca4e7706f70bdda72e6f2] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + dmidecode.c | 14 ++++++++++++-- + man/dmidecode.8 | 3 ++- + 2 files changed, 14 insertions(+), 3 deletions(-) + +diff --git a/dmidecode.c b/dmidecode.c +index a80a140..32a77cc 100644 +--- a/dmidecode.c ++++ b/dmidecode.c +@@ -60,6 +60,7 @@ + * https://www.dmtf.org/sites/default/files/DSP0270_1.0.1.pdf + */ + ++#include <fcntl.h> + #include <stdio.h> + #include <string.h> + #include <strings.h> +@@ -5133,13 +5134,22 @@ static void dmi_table_string(const struct dmi_header *h, const u8 *data, u16 ver + static int dmi_table_dump(const u8 *ep, u32 ep_len, const u8 *table, + u32 table_len) + { ++ int fd; + FILE *f; + +- f = fopen(opt.dumpfile, "wb"); ++ fd = open(opt.dumpfile, O_WRONLY|O_CREAT|O_EXCL, 0666); ++ if (fd == -1) ++ { ++ fprintf(stderr, "%s: ", opt.dumpfile); ++ perror("open"); ++ return -1; ++ } ++ ++ f = fdopen(fd, "wb"); + if (!f) + { + fprintf(stderr, "%s: ", opt.dumpfile); +- perror("fopen"); ++ perror("fdopen"); + return -1; + } + +diff --git a/man/dmidecode.8 b/man/dmidecode.8 +index 64dc7e7..d5b7f01 100644 +--- a/man/dmidecode.8 ++++ b/man/dmidecode.8 +@@ -1,4 +1,4 @@ +-.TH DMIDECODE 8 "January 2019" "dmidecode" ++.TH DMIDECODE 8 "February 2023" "dmidecode" + .\" + .SH NAME + dmidecode \- \s-1DMI\s0 table decoder +@@ -132,6 +132,7 @@ hexadecimal and \s-1ASCII\s0. This option is mainly useful for debugging. + Do not decode the entries, instead dump the DMI data to a file in binary + form. The generated file is suitable to pass to \fB--from-dump\fR + later. ++\fIFILE\fP must not exist. + .TP + .BR " " " " "--from-dump FILE" + Read the DMI data from a binary file previously generated using +-- +2.41.0 + diff --git a/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_3.patch b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_3.patch new file mode 100644 index 0000000000..181092a3fd --- /dev/null +++ b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_3.patch @@ -0,0 +1,71 @@ +From ac881f801b92b57fd8daac65fb16fff6d84fd366 Mon Sep 17 00:00:00 2001 +From: Jean Delvare <jdelvare@suse.de> +Date: Tue, 27 Jun 2023 10:25:50 +0000 +Subject: [PATCH 4/5] Consistently use read_file() when reading from a dump + file + +Use read_file() instead of mem_chunk() to read the entry point from a +dump file. This is faster, and consistent with how we then read the +actual DMI table from that dump file. + +This made no functional difference so far, which is why it went +unnoticed for years. But now that a file type check was added to the +mem_chunk() function, we must stop using it to read from regular +files. + +This will again allow root to use the --from-dump option. + +Signed-off-by: Jean Delvare <jdelvare@suse.de> +Tested-by: Jerry Hoemann <jerry.hoemann@hpe.com> + +CVE: CVE-2023-30630 + +Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=c76ddda0ba0aa99a55945e3290095c2ec493c892] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + dmidecode.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/dmidecode.c b/dmidecode.c +index 32a77cc..9a691e0 100644 +--- a/dmidecode.c ++++ b/dmidecode.c +@@ -5693,17 +5693,25 @@ int main(int argc, char * const argv[]) + pr_comment("dmidecode %s", VERSION); + + /* Read from dump if so instructed */ ++ size = 0x20; + if (opt.flags & FLAG_FROM_DUMP) + { + if (!(opt.flags & FLAG_QUIET)) + pr_info("Reading SMBIOS/DMI data from file %s.", + opt.dumpfile); +- if ((buf = mem_chunk(0, 0x20, opt.dumpfile)) == NULL) ++ if ((buf = read_file(0, &size, opt.dumpfile)) == NULL) + { + ret = 1; + goto exit_free; + } + ++ /* Truncated entry point can't be processed */ ++ if (size < 0x20) ++ { ++ ret = 1; ++ goto done; ++ } ++ + if (memcmp(buf, "_SM3_", 5) == 0) + { + if (smbios3_decode(buf, opt.dumpfile, 0)) +@@ -5727,7 +5735,6 @@ int main(int argc, char * const argv[]) + * contain one of several types of entry points, so read enough for + * the largest one, then determine what type it contains. + */ +- size = 0x20; + if (!(opt.flags & FLAG_NO_SYSFS) + && (buf = read_file(0, &size, SYS_ENTRY_FILE)) != NULL) + { +-- +2.41.0 + diff --git a/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_4.patch b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_4.patch new file mode 100644 index 0000000000..b7d7f4ff96 --- /dev/null +++ b/meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_4.patch @@ -0,0 +1,138 @@ +From 2fb126eef436389a2dc48d4225b4a9888b0625a8 Mon Sep 17 00:00:00 2001 +From: Jean Delvare <jdelvare@suse.de> +Date: Tue, 27 Jun 2023 10:58:11 +0000 +Subject: [PATCH 5/5] Don't read beyond sysfs entry point buffer + +Functions smbios_decode() and smbios3_decode() include a check +against buffer overrun. This check assumes that the buffer length is +always 32 bytes. This is true when reading from /dev/mem or from a +dump file, however when reading from sysfs, the buffer length is the +size of the actual sysfs attribute file, typically 31 bytes for an +SMBIOS 2.x entry point and 24 bytes for an SMBIOS 3.x entry point. + +In the unlikely event of a malformed entry point, with encoded length +larger than expected but smaller than or equal to 32, we would hit a +buffer overrun. So properly pass the actual buffer length as an +argument and perform the check against it. + +In practice, this will never happen, because on the Linux kernel +side, the size of the sysfs attribute file is decided from the entry +point length field. So it is technically impossible for them not to +match. But user-space code should not make such assumptions. + +Signed-off-by: Jean Delvare <jdelvare@suse.de> + +CVE: CVE-2023-30630 + +Upstream-Status: Backport +[https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=2b83c4b898f8325313162f588765411e8e3e5561] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + dmidecode.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/dmidecode.c b/dmidecode.c +index 9a691e0..e725801 100644 +--- a/dmidecode.c ++++ b/dmidecode.c +@@ -5398,14 +5398,14 @@ static void overwrite_smbios3_address(u8 *buf) + buf[0x17] = 0; + } + +-static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) ++static int smbios3_decode(u8 *buf, size_t buf_len, const char *devmem, u32 flags) + { + u32 ver, len; + u64 offset; + u8 *table; + + /* Don't let checksum run beyond the buffer */ +- if (buf[0x06] > 0x20) ++ if (buf[0x06] > buf_len) + { + fprintf(stderr, + "Entry point length too large (%u bytes, expected %u).\n", +@@ -5455,14 +5455,14 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags) + return 1; + } + +-static int smbios_decode(u8 *buf, const char *devmem, u32 flags) ++static int smbios_decode(u8 *buf, size_t buf_len, const char *devmem, u32 flags) + { + u16 ver, num; + u32 len; + u8 *table; + + /* Don't let checksum run beyond the buffer */ +- if (buf[0x05] > 0x20) ++ if (buf[0x05] > buf_len) + { + fprintf(stderr, + "Entry point length too large (%u bytes, expected %u).\n", +@@ -5714,12 +5714,12 @@ int main(int argc, char * const argv[]) + + if (memcmp(buf, "_SM3_", 5) == 0) + { +- if (smbios3_decode(buf, opt.dumpfile, 0)) ++ if (smbios3_decode(buf, size, opt.dumpfile, 0)) + found++; + } + else if (memcmp(buf, "_SM_", 4) == 0) + { +- if (smbios_decode(buf, opt.dumpfile, 0)) ++ if (smbios_decode(buf, size, opt.dumpfile, 0)) + found++; + } + else if (memcmp(buf, "_DMI_", 5) == 0) +@@ -5742,12 +5742,12 @@ int main(int argc, char * const argv[]) + pr_info("Getting SMBIOS data from sysfs."); + if (size >= 24 && memcmp(buf, "_SM3_", 5) == 0) + { +- if (smbios3_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) ++ if (smbios3_decode(buf, size, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) + found++; + } + else if (size >= 31 && memcmp(buf, "_SM_", 4) == 0) + { +- if (smbios_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) ++ if (smbios_decode(buf, size, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET)) + found++; + } + else if (size >= 15 && memcmp(buf, "_DMI_", 5) == 0) +@@ -5784,12 +5784,12 @@ int main(int argc, char * const argv[]) + + if (memcmp(buf, "_SM3_", 5) == 0) + { +- if (smbios3_decode(buf, opt.devmem, 0)) ++ if (smbios3_decode(buf, 0x20, opt.devmem, 0)) + found++; + } + else if (memcmp(buf, "_SM_", 4) == 0) + { +- if (smbios_decode(buf, opt.devmem, 0)) ++ if (smbios_decode(buf, 0x20, opt.devmem, 0)) + found++; + } + goto done; +@@ -5810,7 +5810,7 @@ memory_scan: + { + if (memcmp(buf + fp, "_SM3_", 5) == 0) + { +- if (smbios3_decode(buf + fp, opt.devmem, 0)) ++ if (smbios3_decode(buf + fp, 0x20, opt.devmem, 0)) + { + found++; + goto done; +@@ -5823,7 +5823,7 @@ memory_scan: + { + if (memcmp(buf + fp, "_SM_", 4) == 0 && fp <= 0xFFE0) + { +- if (smbios_decode(buf + fp, opt.devmem, 0)) ++ if (smbios_decode(buf + fp, 0x20, opt.devmem, 0)) + { + found++; + goto done; +-- +2.41.0 + diff --git a/meta/recipes-devtools/dmidecode/dmidecode_3.3.bb b/meta/recipes-devtools/dmidecode/dmidecode_3.3.bb index 23540b2703..c0f6b45313 100644 --- a/meta/recipes-devtools/dmidecode/dmidecode_3.3.bb +++ b/meta/recipes-devtools/dmidecode/dmidecode_3.3.bb @@ -6,6 +6,11 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=b234ee4d69f5fce4486a80fdaf4a4263" SRC_URI = "${SAVANNAH_NONGNU_MIRROR}/dmidecode/${BP}.tar.xz \ file://0001-Committing-changes-from-do_unpack_extra.patch \ + file://CVE-2023-30630_1a.patch \ + file://CVE-2023-30630_1b.patch \ + file://CVE-2023-30630_2.patch \ + file://CVE-2023-30630_3.patch \ + file://CVE-2023-30630_4.patch \ " COMPATIBLE_HOST = "(i.86|x86_64|aarch64|arm|powerpc|powerpc64).*-linux" diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest b/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest index c97c0377e9..279923db8e 100644 --- a/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest +++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest @@ -8,3 +8,4 @@ rm -f *.tmp rm -f *.ok rm -f *.failed rm -f *.log +cp ../data/test_data.tmp ./ diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.46.5.bb b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.46.5.bb index 5b2d1921f0..68c620cf71 100644 --- a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.46.5.bb +++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.46.5.bb @@ -141,4 +141,7 @@ do_install_ptest() { install -d ${D}${PTEST_PATH}/lib install -m 0644 ${B}/lib/config.h ${D}${PTEST_PATH}/lib/ + + install -d ${D}${PTEST_PATH}/data + install -m 0644 ${B}/tests/test_data.tmp ${D}${PTEST_PATH}/data/ } diff --git a/meta/recipes-devtools/elfutils/elfutils_0.186.bb b/meta/recipes-devtools/elfutils/elfutils_0.186.bb index 46ee40cce6..d742a2e14e 100644 --- a/meta/recipes-devtools/elfutils/elfutils_0.186.bb +++ b/meta/recipes-devtools/elfutils/elfutils_0.186.bb @@ -35,6 +35,8 @@ PTEST_ENABLED:libc-musl = "0" EXTRA_OECONF = "--program-prefix=eu-" +BUILD_CFLAGS += "-Wno-error=stringop-overflow" + DEPENDS_BZIP2 = "bzip2-replacement-native" DEPENDS_BZIP2:class-target = "bzip2" diff --git a/meta/recipes-devtools/file/file/CVE-2022-48554.patch b/meta/recipes-devtools/file/file/CVE-2022-48554.patch new file mode 100644 index 0000000000..c285bd2c23 --- /dev/null +++ b/meta/recipes-devtools/file/file/CVE-2022-48554.patch @@ -0,0 +1,35 @@ +CVE: CVE-2022-48554 +Upstream-Status: Backport [ https://github.com/file/file/commit/497aabb29cd08d2a5aeb63e45798d65fcbe03502 ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +From 497aabb29cd08d2a5aeb63e45798d65fcbe03502 Mon Sep 17 00:00:00 2001 +From: Christos Zoulas <christos@zoulas.com> +Date: Mon, 14 Feb 2022 16:26:10 +0000 +Subject: [PATCH] PR/310: p870613: Don't use strlcpy to copy the string, it + will try to scan the source string to find out how much space is needed the + source string might not be NUL terminated. + +--- + src/funcs.c | 11 +++++++---- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/src/funcs.c b/src/funcs.c +index 89e1da597..dcfd352d2 100644 +--- a/src/funcs.c ++++ b/src/funcs.c +@@ -54,9 +54,12 @@ FILE_RCSID("@(#)$File: funcs.c,v 1.124 2022/01/10 14:15:08 christos Exp $") + protected char * + file_copystr(char *buf, size_t blen, size_t width, const char *str) + { +- if (++width > blen) +- width = blen; +- strlcpy(buf, str, width); ++ if (blen == 0) ++ return buf; ++ if (width >= blen) ++ width = blen - 1; ++ memcpy(buf, str, width); ++ buf[width] = '\0'; + return buf; + } + diff --git a/meta/recipes-devtools/file/file_5.41.bb b/meta/recipes-devtools/file/file_5.41.bb index 653887e97a..6fd4f2c746 100644 --- a/meta/recipes-devtools/file/file_5.41.bb +++ b/meta/recipes-devtools/file/file_5.41.bb @@ -11,7 +11,9 @@ LIC_FILES_CHKSUM = "file://COPYING;beginline=2;md5=0251eaec1188b20d9a72c502ecfdd DEPENDS = "file-replacement-native" DEPENDS:class-native = "bzip2-replacement-native" -SRC_URI = "git://github.com/file/file.git;branch=master;protocol=https" +SRC_URI = "git://github.com/file/file.git;branch=master;protocol=https \ + file://CVE-2022-48554.patch \ +" SRCREV = "504206e53a89fd6eed71aeaf878aa3512418eab1" S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/gcc/gcc-11.3.inc b/meta/recipes-devtools/gcc/gcc-11.4.inc index ab2ece3cce..fd6a3e92e3 100644 --- a/meta/recipes-devtools/gcc/gcc-11.3.inc +++ b/meta/recipes-devtools/gcc/gcc-11.4.inc @@ -2,11 +2,11 @@ require gcc-common.inc # Third digit in PV should be incremented after a minor release -PV = "11.3.0" +PV = "11.4.0" # BINV should be incremented to a revision after a minor gcc release -BINV = "11.3.0" +BINV = "11.4.0" FILESEXTRAPATHS =. "${FILE_DIRNAME}/gcc:${FILE_DIRNAME}/gcc/backport:" @@ -59,6 +59,7 @@ SRC_URI = "\ file://0028-debug-101473-apply-debug-prefix-maps-before-checksum.patch \ file://0029-Fix-install-path-of-linux64.h.patch \ file://0030-rust-recursion-limit.patch \ + file://0031-gcc-sanitizers-fix.patch \ file://0001-CVE-2021-42574.patch \ file://0002-CVE-2021-42574.patch \ file://0003-CVE-2021-42574.patch \ @@ -68,15 +69,16 @@ SRC_URI = "\ file://0002-aarch64-add-armv9-a-to-march.patch \ file://0003-aarch64-Enable-FP16-feature-by-default-for-Armv9.patch \ file://0004-arm-add-armv9-a-architecture-to-march.patch \ + file://CVE-2023-4039.patch \ " -SRC_URI[sha256sum] = "b47cf2818691f5b1e21df2bb38c795fac2cfbd640ede2d0a5e1c89e338a3ac39" +SRC_URI[sha256sum] = "3f2db222b007e8a4a23cd5ba56726ef08e8b1f1eb2055ee72c1402cea73a8dd9" S = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/gcc-${PV}" # For dev release snapshotting #S = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/gcc-${RELEASE}" -#B = "${WORKDIR}/gcc-${PV}/build.${HOST_SYS}.${TARGET_SYS}" +B = "${WORKDIR}/gcc-${PV}/build.${HOST_SYS}.${TARGET_SYS}" # Language Overrides FORTRAN = "" diff --git a/meta/recipes-devtools/gcc/gcc-configure-common.inc b/meta/recipes-devtools/gcc/gcc-configure-common.inc index e4cdb73f0a..dba25eb754 100644 --- a/meta/recipes-devtools/gcc/gcc-configure-common.inc +++ b/meta/recipes-devtools/gcc/gcc-configure-common.inc @@ -40,7 +40,6 @@ EXTRA_OECONF = "\ ${@get_gcc_mips_plt_setting(bb, d)} \ ${@get_gcc_ppc_plt_settings(bb, d)} \ ${@get_gcc_multiarch_setting(bb, d)} \ - --enable-standard-branch-protection \ " # glibc version is a minimum controlling whether features are enabled. diff --git a/meta/recipes-devtools/gcc/gcc-cross-canadian_11.3.bb b/meta/recipes-devtools/gcc/gcc-cross-canadian_11.4.bb index bf53c5cd78..bf53c5cd78 100644 --- a/meta/recipes-devtools/gcc/gcc-cross-canadian_11.3.bb +++ b/meta/recipes-devtools/gcc/gcc-cross-canadian_11.4.bb diff --git a/meta/recipes-devtools/gcc/gcc-cross_11.3.bb b/meta/recipes-devtools/gcc/gcc-cross_11.4.bb index b43cca0c52..b43cca0c52 100644 --- a/meta/recipes-devtools/gcc/gcc-cross_11.3.bb +++ b/meta/recipes-devtools/gcc/gcc-cross_11.4.bb diff --git a/meta/recipes-devtools/gcc/gcc-crosssdk_11.3.bb b/meta/recipes-devtools/gcc/gcc-crosssdk_11.4.bb index 40a6c4feff..40a6c4feff 100644 --- a/meta/recipes-devtools/gcc/gcc-crosssdk_11.3.bb +++ b/meta/recipes-devtools/gcc/gcc-crosssdk_11.4.bb diff --git a/meta/recipes-devtools/gcc/gcc-runtime.inc b/meta/recipes-devtools/gcc/gcc-runtime.inc index 8074bf1025..d019b0790b 100644 --- a/meta/recipes-devtools/gcc/gcc-runtime.inc +++ b/meta/recipes-devtools/gcc/gcc-runtime.inc @@ -68,7 +68,8 @@ do_configure () { # libstdc++ isn't built yet so CXX would error not able to find it which breaks stdc++'s configure # tests. Create a dummy empty lib for the purposes of configure. mkdir -p ${WORKDIR}/dummylib - ${CC} -x c /dev/null -nostartfiles -shared -o ${WORKDIR}/dummylib/libstdc++.so + ${CC} -x c /dev/null -c -o ${WORKDIR}/dummylib/dummylib.o + ${AR} rcs ${WORKDIR}/dummylib/libstdc++.a ${WORKDIR}/dummylib/dummylib.o for d in libgcc ${RUNTIMETARGET}; do echo "Configuring $d" rm -rf ${B}/${TARGET_SYS}/$d/ diff --git a/meta/recipes-devtools/gcc/gcc-runtime_11.3.bb b/meta/recipes-devtools/gcc/gcc-runtime_11.4.bb index dd430b57eb..dd430b57eb 100644 --- a/meta/recipes-devtools/gcc/gcc-runtime_11.3.bb +++ b/meta/recipes-devtools/gcc/gcc-runtime_11.4.bb diff --git a/meta/recipes-devtools/gcc/gcc-sanitizers_11.3.bb b/meta/recipes-devtools/gcc/gcc-sanitizers_11.4.bb index 8bda2ccad6..8bda2ccad6 100644 --- a/meta/recipes-devtools/gcc/gcc-sanitizers_11.3.bb +++ b/meta/recipes-devtools/gcc/gcc-sanitizers_11.4.bb diff --git a/meta/recipes-devtools/gcc/gcc-shared-source.inc b/meta/recipes-devtools/gcc/gcc-shared-source.inc index cd2e341099..7aa1c22bf0 100644 --- a/meta/recipes-devtools/gcc/gcc-shared-source.inc +++ b/meta/recipes-devtools/gcc/gcc-shared-source.inc @@ -16,6 +16,9 @@ do_deploy_source_date_epoch () { sde_file=${SDE_FILE} sde_file=${sde_file#${WORKDIR}/} mkdir -p ${SDE_DEPLOYDIR} $(dirname ${SDE_FILE}) - cp -p ${S}/../$sde_file ${SDE_DEPLOYDIR} - cp -p ${S}/../$sde_file ${SDE_FILE} + cp -p $(dirname ${S})/$sde_file ${SDE_DEPLOYDIR} + cp -p $(dirname ${S})/$sde_file ${SDE_FILE} } + +# patch is available via gcc-source recipe +CVE_CHECK_IGNORE += "CVE-2023-4039" diff --git a/meta/recipes-devtools/gcc/gcc-source_11.3.bb b/meta/recipes-devtools/gcc/gcc-source_11.4.bb index b890fa33ea..b890fa33ea 100644 --- a/meta/recipes-devtools/gcc/gcc-source_11.3.bb +++ b/meta/recipes-devtools/gcc/gcc-source_11.4.bb diff --git a/meta/recipes-devtools/gcc/gcc-testsuite.inc b/meta/recipes-devtools/gcc/gcc-testsuite.inc index f68fec58ed..64f60c730f 100644 --- a/meta/recipes-devtools/gcc/gcc-testsuite.inc +++ b/meta/recipes-devtools/gcc/gcc-testsuite.inc @@ -51,9 +51,10 @@ python check_prepare() { # enable all valid instructions, since the test suite itself does not # limit itself to the target cpu options. # - valid for x86*, powerpc, arm, arm64 - if qemu_binary.lstrip("qemu-") in ["x86_64", "i386", "ppc", "arm", "aarch64"]: + if qemu_binary.lstrip("qemu-") in ["x86_64", "i386", "arm", "aarch64"]: args += ["-cpu", "max"] - + elif qemu_binary.lstrip("qemu-") in ["ppc"]: + args += d.getVar("QEMU_EXTRAOPTIONS_%s" % d.getVar('PACKAGE_ARCH')).split() sysroot = d.getVar("RECIPE_SYSROOT") args += ["-L", sysroot] # lib paths are static here instead of using $libdir since this is used by a -cross recipe diff --git a/meta/recipes-devtools/gcc/gcc/0001-aarch64-Update-Neoverse-N2-core-defini.patch b/meta/recipes-devtools/gcc/gcc/0001-aarch64-Update-Neoverse-N2-core-defini.patch index 8429242348..a0c9db72e1 100644 --- a/meta/recipes-devtools/gcc/gcc/0001-aarch64-Update-Neoverse-N2-core-defini.patch +++ b/meta/recipes-devtools/gcc/gcc/0001-aarch64-Update-Neoverse-N2-core-defini.patch @@ -19,24 +19,20 @@ diff --git a/gcc/config/aarch64/aarch64-cores.def b/gcc/config/aarch64/aarch64-c index 4643e0e27..3478e567a 100644 --- a/gcc/config/aarch64/aarch64-cores.def +++ b/gcc/config/aarch64/aarch64-cores.def -@@ -145,9 +145,6 @@ AARCH64_CORE("neoverse-512tvb", neoverse512tvb, cortexa57, 8_4A, AARCH64_FL_FOR - /* Qualcomm ('Q') cores. */ - AARCH64_CORE("saphira", saphira, saphira, 8_4A, AARCH64_FL_FOR_ARCH8_4 | AARCH64_FL_CRYPTO | AARCH64_FL_RCPC, saphira, 0x51, 0xC01, -1) - --/* Armv8.5-A Architecture Processors. */ +@@ -147,7 +147,6 @@ + AARCH64_CORE("saphira", saphira, saphira, 8_4A, AARCH64_FL_FOR_ARCH8_4 | AARCH64_FL_CRYPTO, saphira, 0x51, 0xC01, -1) + + /* Armv8.5-A Architecture Processors. */ -AARCH64_CORE("neoverse-n2", neoversen2, cortexa57, 8_5A, AARCH64_FL_FOR_ARCH8_5 | AARCH64_FL_I8MM | AARCH64_FL_BF16 | AARCH64_FL_F16 | AARCH64_FL_SVE | AARCH64_FL_SVE2 | AARCH64_FL_SVE2_BITPERM | AARCH64_FL_RNG | AARCH64_FL_MEMTAG, neoversen2, 0x41, 0xd49, -1) -- + AARCH64_CORE("neoverse-v2", neoversev2, cortexa57, 8_5A, AARCH64_FL_FOR_ARCH8_5 | AARCH64_FL_I8MM | AARCH64_FL_BF16 | AARCH64_FL_F16 | AARCH64_FL_SVE | AARCH64_FL_SVE2 | AARCH64_FL_SVE2_BITPERM | AARCH64_FL_RNG | AARCH64_FL_MEMTAG, neoverse512tvb, 0x41, 0xd4f, -1) + /* ARMv8-A big.LITTLE implementations. */ - - AARCH64_CORE("cortex-a57.cortex-a53", cortexa57cortexa53, cortexa53, 8A, AARCH64_FL_FOR_ARCH8 | AARCH64_FL_CRC, cortexa57, 0x41, AARCH64_BIG_LITTLE (0xd07, 0xd03), -1) -@@ -163,4 +160,7 @@ AARCH64_CORE("cortex-a76.cortex-a55", cortexa76cortexa55, cortexa53, 8_2A, AAR +@@ -165,4 +164,7 @@ /* Armv8-R Architecture Processors. */ AARCH64_CORE("cortex-r82", cortexr82, cortexa53, 8R, AARCH64_FL_FOR_ARCH8_R, cortexa53, 0x41, 0xd15, -1) - + +/* Armv9-A Architecture Processors. */ +AARCH64_CORE("neoverse-n2", neoversen2, cortexa57, 9A, AARCH64_FL_FOR_ARCH9 | AARCH64_FL_I8MM | AARCH64_FL_BF16 | AARCH64_FL_SVE2_BITPERM | AARCH64_FL_RNG | AARCH64_FL_MEMTAG | AARCH64_FL_PROFILE, neoversen2, 0x41, 0xd49, -1) + #undef AARCH64_CORE --- -2.32.0 diff --git a/meta/recipes-devtools/gcc/gcc/0004-arm-add-armv9-a-architecture-to-march.patch b/meta/recipes-devtools/gcc/gcc/0004-arm-add-armv9-a-architecture-to-march.patch index 864c8b3017..b9b0988d5a 100644 --- a/meta/recipes-devtools/gcc/gcc/0004-arm-add-armv9-a-architecture-to-march.patch +++ b/meta/recipes-devtools/gcc/gcc/0004-arm-add-armv9-a-architecture-to-march.patch @@ -43,10 +43,10 @@ Signed-off-by: Ruiqiang Hao <Ruiqiang.Hao@windriver.com> gcc/testsuite/lib/target-supports.exp | 3 ++- 9 files changed, 79 insertions(+), 8 deletions(-) -Index: gcc-11.3.0/gcc/config/arm/arm-cpus.in +Index: gcc/gcc/config/arm/arm-cpus.in =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/arm-cpus.in -+++ gcc-11.3.0/gcc/config/arm/arm-cpus.in +--- a/gcc/config/arm/arm-cpus.in ++++ b/gcc/config/arm/arm-cpus.in @@ -132,6 +132,9 @@ define feature cmse # Architecture rel 8.1-M. define feature armv8_1m_main @@ -87,10 +87,10 @@ Index: gcc-11.3.0/gcc/config/arm/arm-cpus.in begin arch iwmmxt tune for iwmmxt tune flags LDSCHED STRONG XSCALE -Index: gcc-11.3.0/gcc/config/arm/arm-tables.opt +Index: gcc/gcc/config/arm/arm-tables.opt =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/arm-tables.opt -+++ gcc-11.3.0/gcc/config/arm/arm-tables.opt +--- a/gcc/config/arm/arm-tables.opt ++++ b/gcc/config/arm/arm-tables.opt @@ -380,10 +380,13 @@ EnumValue Enum(arm_arch) String(armv8.1-m.main) Value(30) @@ -107,10 +107,10 @@ Index: gcc-11.3.0/gcc/config/arm/arm-tables.opt Enum Name(arm_fpu) Type(enum fpu_type) -Index: gcc-11.3.0/gcc/config/arm/arm.h +Index: gcc/gcc/config/arm/arm.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/arm.h -+++ gcc-11.3.0/gcc/config/arm/arm.h +--- a/gcc/config/arm/arm.h ++++ b/gcc/config/arm/arm.h @@ -456,7 +456,8 @@ enum base_architecture BASE_ARCH_8A = 8, BASE_ARCH_8M_BASE = 8, @@ -121,10 +121,10 @@ Index: gcc-11.3.0/gcc/config/arm/arm.h }; /* The major revision number of the ARM Architecture implemented by the target. */ -Index: gcc-11.3.0/gcc/config/arm/t-aprofile +Index: gcc/gcc/config/arm/t-aprofile =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/t-aprofile -+++ gcc-11.3.0/gcc/config/arm/t-aprofile +--- a/gcc/config/arm/t-aprofile ++++ b/gcc/config/arm/t-aprofile @@ -26,8 +26,8 @@ # Arch and FPU variants to build libraries with @@ -180,10 +180,10 @@ Index: gcc-11.3.0/gcc/config/arm/t-aprofile - $(foreach ARCH, armv7-a armv8-a, \ + $(foreach ARCH, armv7-a armv8-a armv9-a, \ mthumb/march.$(ARCH)/mfloat-abi.soft=m$(MODE)/march.$(ARCH)/mfloat-abi.softfp)) -Index: gcc-11.3.0/gcc/config/arm/t-arm-elf +Index: gcc/gcc/config/arm/t-arm-elf =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/t-arm-elf -+++ gcc-11.3.0/gcc/config/arm/t-arm-elf +--- a/gcc/config/arm/t-arm-elf ++++ b/gcc/config/arm/t-arm-elf @@ -38,6 +38,8 @@ v7ve_fps := vfpv3-d16 vfpv3 vfpv3-d16-fp # it seems to work ok. v8_fps := simd fp16 crypto fp16+crypto dotprod fp16fml @@ -214,10 +214,10 @@ Index: gcc-11.3.0/gcc/config/arm/t-arm-elf MULTILIB_MATCHES += $(foreach ARCH, armv7e-m armv8-m.mainline, \ march?armv7+fp=march?$(ARCH)+fp.dp) -Index: gcc-11.3.0/gcc/config/arm/t-multilib +Index: gcc/gcc/config/arm/t-multilib =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/t-multilib -+++ gcc-11.3.0/gcc/config/arm/t-multilib +--- a/gcc/config/arm/t-multilib ++++ b/gcc/config/arm/t-multilib @@ -78,6 +78,8 @@ v8_4_a_simd_variants := $(call all_feat_ v8_5_a_simd_variants := $(call all_feat_combs, simd fp16 crypto i8mm bf16) v8_6_a_simd_variants := $(call all_feat_combs, simd fp16 crypto i8mm bf16) @@ -244,10 +244,10 @@ Index: gcc-11.3.0/gcc/config/arm/t-multilib endif # Not APROFILE. # Use Thumb libraries for everything. -Index: gcc-11.3.0/gcc/doc/invoke.texi +Index: gcc/gcc/doc/invoke.texi =================================================================== ---- gcc-11.3.0.orig/gcc/doc/invoke.texi -+++ gcc-11.3.0/gcc/doc/invoke.texi +--- a/gcc/doc/invoke.texi ++++ b/gcc/doc/invoke.texi @@ -19701,6 +19701,7 @@ Permissible names are: @samp{armv7-m}, @samp{armv7e-m}, @samp{armv8-m.base}, @samp{armv8-m.main}, @@ -256,10 +256,10 @@ Index: gcc-11.3.0/gcc/doc/invoke.texi @samp{iwmmxt} and @samp{iwmmxt2}. Additionally, the following architectures, which lack support for the -Index: gcc-11.3.0/gcc/testsuite/gcc.target/arm/multilib.exp +Index: gcc/gcc/testsuite/gcc.target/arm/multilib.exp =================================================================== ---- gcc-11.3.0.orig/gcc/testsuite/gcc.target/arm/multilib.exp -+++ gcc-11.3.0/gcc/testsuite/gcc.target/arm/multilib.exp +--- a/gcc/testsuite/gcc.target/arm/multilib.exp ++++ b/gcc/testsuite/gcc.target/arm/multilib.exp @@ -135,6 +135,14 @@ if {[multilib_config "aprofile"] } { {-march=armv8.6-a+simd+fp16 -mfloat-abi=softfp} "thumb/v8-a+simd/softfp" {-march=armv8.6-a+simd+fp16+nofp -mfloat-abi=softfp} "thumb/v8-a/nofp" @@ -275,10 +275,10 @@ Index: gcc-11.3.0/gcc/testsuite/gcc.target/arm/multilib.exp {-mcpu=cortex-a53+crypto -mfloat-abi=hard} "thumb/v8-a+simd/hard" {-mcpu=cortex-a53+nofp -mfloat-abi=softfp} "thumb/v8-a/nofp" {-march=armv8-a+crc -mfloat-abi=hard -mfpu=vfp} "thumb/v8-a+simd/hard" -Index: gcc-11.3.0/gcc/testsuite/lib/target-supports.exp +Index: gcc/gcc/testsuite/lib/target-supports.exp =================================================================== ---- gcc-11.3.0.orig/gcc/testsuite/lib/target-supports.exp -+++ gcc-11.3.0/gcc/testsuite/lib/target-supports.exp +--- a/gcc/testsuite/lib/target-supports.exp ++++ b/gcc/testsuite/lib/target-supports.exp @@ -4820,7 +4820,8 @@ foreach { armfunc armflag armdefs } { v8m_base "-march=armv8-m.base -mthumb -mfloat-abi=soft" __ARM_ARCH_8M_BASE__ diff --git a/meta/recipes-devtools/gcc/gcc/0006-Define-GLIBC_DYNAMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch b/meta/recipes-devtools/gcc/gcc/0006-Define-GLIBC_DYNAMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch index b3515c9734..ece5873258 100644 --- a/meta/recipes-devtools/gcc/gcc/0006-Define-GLIBC_DYNAMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch +++ b/meta/recipes-devtools/gcc/gcc/0006-Define-GLIBC_DYNAMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch @@ -39,10 +39,10 @@ Signed-off-by: Pavel Zhukov <pavel@zhukoff.net> gcc/config/sparc/linux64.h | 4 ++-- 17 files changed, 53 insertions(+), 58 deletions(-) -Index: gcc-11.3.0/gcc/config/aarch64/aarch64-linux.h +Index: gcc/gcc/config/aarch64/aarch64-linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/aarch64/aarch64-linux.h -+++ gcc-11.3.0/gcc/config/aarch64/aarch64-linux.h +--- a/gcc/config/aarch64/aarch64-linux.h ++++ b/gcc/config/aarch64/aarch64-linux.h @@ -21,10 +21,10 @@ #ifndef GCC_AARCH64_LINUX_H #define GCC_AARCH64_LINUX_H @@ -56,10 +56,10 @@ Index: gcc-11.3.0/gcc/config/aarch64/aarch64-linux.h #undef ASAN_CC1_SPEC #define ASAN_CC1_SPEC "%{%:sanitize(address):-funwind-tables}" -Index: gcc-11.3.0/gcc/config/alpha/linux-elf.h +Index: gcc/gcc/config/alpha/linux-elf.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/alpha/linux-elf.h -+++ gcc-11.3.0/gcc/config/alpha/linux-elf.h +--- a/gcc/config/alpha/linux-elf.h ++++ b/gcc/config/alpha/linux-elf.h @@ -23,8 +23,8 @@ along with GCC; see the file COPYING3. #define EXTRA_SPECS \ { "elf_dynamic_linker", ELF_DYNAMIC_LINKER }, @@ -71,10 +71,10 @@ Index: gcc-11.3.0/gcc/config/alpha/linux-elf.h #if DEFAULT_LIBC == LIBC_UCLIBC #define CHOOSE_DYNAMIC_LINKER(G, U) "%{mglibc:" G ";:" U "}" #elif DEFAULT_LIBC == LIBC_GLIBC -Index: gcc-11.3.0/gcc/config/arm/linux-eabi.h +Index: gcc/gcc/config/arm/linux-eabi.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/linux-eabi.h -+++ gcc-11.3.0/gcc/config/arm/linux-eabi.h +--- a/gcc/config/arm/linux-eabi.h ++++ b/gcc/config/arm/linux-eabi.h @@ -65,8 +65,8 @@ GLIBC_DYNAMIC_LINKER_DEFAULT and TARGET_DEFAULT_FLOAT_ABI. */ @@ -95,10 +95,10 @@ Index: gcc-11.3.0/gcc/config/arm/linux-eabi.h /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to use the GNU/Linux version, not the generic BPABI version. */ -Index: gcc-11.3.0/gcc/config/arm/linux-elf.h +Index: gcc/gcc/config/arm/linux-elf.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/linux-elf.h -+++ gcc-11.3.0/gcc/config/arm/linux-elf.h +--- a/gcc/config/arm/linux-elf.h ++++ b/gcc/config/arm/linux-elf.h @@ -60,7 +60,7 @@ #define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc" @@ -108,10 +108,10 @@ Index: gcc-11.3.0/gcc/config/arm/linux-elf.h #define LINUX_TARGET_LINK_SPEC "%{h*} \ %{static:-Bstatic} \ -Index: gcc-11.3.0/gcc/config/i386/linux.h +Index: gcc/gcc/config/i386/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/i386/linux.h -+++ gcc-11.3.0/gcc/config/i386/linux.h +--- a/gcc/config/i386/linux.h ++++ b/gcc/config/i386/linux.h @@ -20,7 +20,7 @@ along with GCC; see the file COPYING3. <http://www.gnu.org/licenses/>. */ @@ -122,10 +122,10 @@ Index: gcc-11.3.0/gcc/config/i386/linux.h #undef MUSL_DYNAMIC_LINKER -#define MUSL_DYNAMIC_LINKER "/lib/ld-musl-i386.so.1" +#define MUSL_DYNAMIC_LINKER SYSTEMLIBS_DIR "ld-musl-i386.so.1" -Index: gcc-11.3.0/gcc/config/i386/linux64.h +Index: gcc/gcc/config/i386/linux64.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/i386/linux64.h -+++ gcc-11.3.0/gcc/config/i386/linux64.h +--- a/gcc/config/i386/linux64.h ++++ b/gcc/config/i386/linux64.h @@ -27,13 +27,13 @@ see the files COPYING3 and COPYING.RUNTI #define GNU_USER_LINK_EMULATION64 "elf_x86_64" #define GNU_USER_LINK_EMULATIONX32 "elf32_x86_64" @@ -146,10 +146,10 @@ Index: gcc-11.3.0/gcc/config/i386/linux64.h #undef MUSL_DYNAMIC_LINKERX32 -#define MUSL_DYNAMIC_LINKERX32 "/lib/ld-musl-x32.so.1" +#define MUSL_DYNAMIC_LINKERX32 SYSTEMLIBS_DIR "ld-musl-x32.so.1" -Index: gcc-11.3.0/gcc/config/linux.h +Index: gcc/gcc/config/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/linux.h -+++ gcc-11.3.0/gcc/config/linux.h +--- a/gcc/config/linux.h ++++ b/gcc/config/linux.h @@ -94,10 +94,10 @@ see the files COPYING3 and COPYING.RUNTI GLIBC_DYNAMIC_LINKER must be defined for each target using them, or GLIBC_DYNAMIC_LINKER32 and GLIBC_DYNAMIC_LINKER64 for targets @@ -165,10 +165,10 @@ Index: gcc-11.3.0/gcc/config/linux.h #define BIONIC_DYNAMIC_LINKER "/system/bin/linker" #define BIONIC_DYNAMIC_LINKER32 "/system/bin/linker" #define BIONIC_DYNAMIC_LINKER64 "/system/bin/linker64" -Index: gcc-11.3.0/gcc/config/microblaze/linux.h +Index: gcc/gcc/config/microblaze/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/microblaze/linux.h -+++ gcc-11.3.0/gcc/config/microblaze/linux.h +--- a/gcc/config/microblaze/linux.h ++++ b/gcc/config/microblaze/linux.h @@ -28,7 +28,7 @@ #undef TLS_NEEDS_GOT #define TLS_NEEDS_GOT 1 @@ -187,10 +187,10 @@ Index: gcc-11.3.0/gcc/config/microblaze/linux.h #undef SUBTARGET_EXTRA_SPECS #define SUBTARGET_EXTRA_SPECS \ -Index: gcc-11.3.0/gcc/config/mips/linux.h +Index: gcc/gcc/config/mips/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/mips/linux.h -+++ gcc-11.3.0/gcc/config/mips/linux.h +--- a/gcc/config/mips/linux.h ++++ b/gcc/config/mips/linux.h @@ -22,29 +22,29 @@ along with GCC; see the file COPYING3. #define GNU_USER_LINK_EMULATIONN32 "elf32%{EB:b}%{EL:l}tsmipn32" @@ -230,10 +230,10 @@ Index: gcc-11.3.0/gcc/config/mips/linux.h #define BIONIC_DYNAMIC_LINKERN32 "/system/bin/linker32" #define GNU_USER_DYNAMIC_LINKERN32 \ -Index: gcc-11.3.0/gcc/config/nios2/linux.h +Index: gcc/gcc/config/nios2/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/nios2/linux.h -+++ gcc-11.3.0/gcc/config/nios2/linux.h +--- a/gcc/config/nios2/linux.h ++++ b/gcc/config/nios2/linux.h @@ -29,7 +29,7 @@ #undef CPP_SPEC #define CPP_SPEC "%{posix:-D_POSIX_SOURCE} %{pthread:-D_REENTRANT}" @@ -243,10 +243,10 @@ Index: gcc-11.3.0/gcc/config/nios2/linux.h #undef LINK_SPEC #define LINK_SPEC LINK_SPEC_ENDIAN \ -Index: gcc-11.3.0/gcc/config/riscv/linux.h +Index: gcc/gcc/config/riscv/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/riscv/linux.h -+++ gcc-11.3.0/gcc/config/riscv/linux.h +--- a/gcc/config/riscv/linux.h ++++ b/gcc/config/riscv/linux.h @@ -22,7 +22,7 @@ along with GCC; see the file COPYING3. GNU_USER_TARGET_OS_CPP_BUILTINS(); \ } while (0) @@ -265,10 +265,10 @@ Index: gcc-11.3.0/gcc/config/riscv/linux.h /* Because RISC-V only has word-sized atomics, it requries libatomic where others do not. So link libatomic by default, as needed. */ -Index: gcc-11.3.0/gcc/config/rs6000/linux64.h +Index: gcc/gcc/config/rs6000/linux64.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/rs6000/linux64.h -+++ gcc-11.3.0/gcc/config/rs6000/linux64.h +--- a/gcc/config/rs6000/linux64.h ++++ b/gcc/config/rs6000/linux64.h @@ -336,24 +336,19 @@ extern int dot_symbols; #undef LINK_OS_DEFAULT_SPEC #define LINK_OS_DEFAULT_SPEC "%(link_os_linux)" @@ -299,10 +299,10 @@ Index: gcc-11.3.0/gcc/config/rs6000/linux64.h #undef DEFAULT_ASM_ENDIAN #if (TARGET_DEFAULT & MASK_LITTLE_ENDIAN) -Index: gcc-11.3.0/gcc/config/rs6000/sysv4.h +Index: gcc/gcc/config/rs6000/sysv4.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/rs6000/sysv4.h -+++ gcc-11.3.0/gcc/config/rs6000/sysv4.h +--- a/gcc/config/rs6000/sysv4.h ++++ b/gcc/config/rs6000/sysv4.h @@ -780,10 +780,10 @@ GNU_USER_TARGET_CC1_SPEC #define MUSL_DYNAMIC_LINKER_E ENDIAN_SELECT("","le","") @@ -316,10 +316,10 @@ Index: gcc-11.3.0/gcc/config/rs6000/sysv4.h #ifndef GNU_USER_DYNAMIC_LINKER #define GNU_USER_DYNAMIC_LINKER GLIBC_DYNAMIC_LINKER -Index: gcc-11.3.0/gcc/config/s390/linux.h +Index: gcc/gcc/config/s390/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/s390/linux.h -+++ gcc-11.3.0/gcc/config/s390/linux.h +--- a/gcc/config/s390/linux.h ++++ b/gcc/config/s390/linux.h @@ -72,13 +72,13 @@ along with GCC; see the file COPYING3. #define MULTILIB_DEFAULTS { "m31" } #endif @@ -338,10 +338,10 @@ Index: gcc-11.3.0/gcc/config/s390/linux.h #undef LINK_SPEC #define LINK_SPEC \ -Index: gcc-11.3.0/gcc/config/sh/linux.h +Index: gcc/gcc/config/sh/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/sh/linux.h -+++ gcc-11.3.0/gcc/config/sh/linux.h +--- a/gcc/config/sh/linux.h ++++ b/gcc/config/sh/linux.h @@ -61,10 +61,10 @@ along with GCC; see the file COPYING3. #undef MUSL_DYNAMIC_LINKER @@ -355,10 +355,10 @@ Index: gcc-11.3.0/gcc/config/sh/linux.h #undef SUBTARGET_LINK_EMUL_SUFFIX #define SUBTARGET_LINK_EMUL_SUFFIX "%{mfdpic:_fd;:_linux}" -Index: gcc-11.3.0/gcc/config/sparc/linux.h +Index: gcc/gcc/config/sparc/linux.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/sparc/linux.h -+++ gcc-11.3.0/gcc/config/sparc/linux.h +--- a/gcc/config/sparc/linux.h ++++ b/gcc/config/sparc/linux.h @@ -78,7 +78,7 @@ extern const char *host_detect_local_cpu When the -shared link option is used a final link is not being done. */ @@ -368,10 +368,10 @@ Index: gcc-11.3.0/gcc/config/sparc/linux.h #undef LINK_SPEC #define LINK_SPEC "-m elf32_sparc %{shared:-shared} \ -Index: gcc-11.3.0/gcc/config/sparc/linux64.h +Index: gcc/gcc/config/sparc/linux64.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/sparc/linux64.h -+++ gcc-11.3.0/gcc/config/sparc/linux64.h +--- a/gcc/config/sparc/linux64.h ++++ b/gcc/config/sparc/linux64.h @@ -78,8 +78,8 @@ along with GCC; see the file COPYING3. When the -shared link option is used a final link is not being done. */ diff --git a/meta/recipes-devtools/gcc/gcc/0009-gcc-armv4-pass-fix-v4bx-to-linker-to-support-EABI.patch b/meta/recipes-devtools/gcc/gcc/0009-gcc-armv4-pass-fix-v4bx-to-linker-to-support-EABI.patch index 0f94936140..1ec942e977 100644 --- a/meta/recipes-devtools/gcc/gcc/0009-gcc-armv4-pass-fix-v4bx-to-linker-to-support-EABI.patch +++ b/meta/recipes-devtools/gcc/gcc/0009-gcc-armv4-pass-fix-v4bx-to-linker-to-support-EABI.patch @@ -18,10 +18,10 @@ Upstream-Status: Pending gcc/config/arm/linux-eabi.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -Index: gcc-11.3.0/gcc/config/arm/linux-eabi.h +Index: gcc/gcc/config/arm/linux-eabi.h =================================================================== ---- gcc-11.3.0.orig/gcc/config/arm/linux-eabi.h -+++ gcc-11.3.0/gcc/config/arm/linux-eabi.h +--- a/gcc/config/arm/linux-eabi.h ++++ b/gcc/config/arm/linux-eabi.h @@ -91,10 +91,14 @@ #define MUSL_DYNAMIC_LINKER \ SYSTEMLIBS_DIR "ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1" diff --git a/meta/recipes-devtools/gcc/gcc/0031-gcc-sanitizers-fix.patch b/meta/recipes-devtools/gcc/gcc/0031-gcc-sanitizers-fix.patch new file mode 100644 index 0000000000..d63618132a --- /dev/null +++ b/meta/recipes-devtools/gcc/gcc/0031-gcc-sanitizers-fix.patch @@ -0,0 +1,63 @@ +From fb77ca05ffb4f8e666878f2f6718a9fb4d686839 Mon Sep 17 00:00:00 2001 +From: Thurston Dang <thurston@google.com> +Date: Thu, 13 Apr 2023 23:55:01 +0000 +Subject: [PATCH] Re-land 'ASan: move allocator base to avoid conflict with + high-entropy ASLR for x86-64 Linux' + +D147984 was reverted because it broke lit tests on Mac. This revision is based on D147984 +but maintains the old behavior for Apple. + +Note that, per the follow-up discussion with MaskRay in D147984, this patch excludes Apple +but includes other platforms (e.g., aarch64, MIPS64) and OSes (e.g., FreeBSD, S390X), not just +x86-64 Linux. + +Original commit message from D147984: + +Users have discovered [*] that when CONFIG_ARCH_MMAP_RND_BITS == 32, +it will frequently conflict with ASan's allocator on x86-64 Linux, because the +PIE program segment base address of 0x555555555554 plus an ASLR shift of up to +((2**32) * 4K == 0x100000000000) will sometimes exceed ASan's hardcoded +base address of 0x600000000000. We fix this by simply moving the allocator base +to 0x500000000000, which is below the PIE program segment base address. This is +cleaner than trying to move it to another location that is sandwiched between +the PIE program and library segments, because if either of those grow too large, +it will collide with the allocator region. + +Note that we will never need to change this base address again (unless we want to increase +the size of the allocator), because ASLR cannot be set above 32-bits for x86-64 Linux (the +PIE program segment and library segments would collide with each other; see also +ARCH_MMAP_RND_BITS_MAX in https://github.com/torvalds/linux/blob/master/arch/x86/Kconfig). + +[*] see https://b.corp.google.com/issues/276925478 +and https://groups.google.com/a/google.com/g/chrome-os-gardeners/c/BbfzCP3dEeo/m/h3C_vVUxCQAJ + +Differential Revision: https://reviews.llvm.org/D148280 + +Upstream-Status: Backport from llvm-project: https://github.com/llvm/llvm-project/commit/fb77ca05ffb4f8e666878f2f6718a9fb4d686839 +Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> +--- + libsanitizer/asan/asan_allocator.h | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/libsanitizer/asan/asan_allocator.h b/libsanitizer/asan/asan_allocator.h +index 0b4dbf03bb9d53..6a12a6c6025283 100644 +--- a/libsanitizer/asan/asan_allocator.h ++++ b/libsanitizer/asan/asan_allocator.h +@@ -143,11 +143,15 @@ typedef DefaultSizeClassMap SizeClassMap; + const uptr kAllocatorSpace = ~(uptr)0; + const uptr kAllocatorSize = 0x8000000000ULL; // 500G + typedef DefaultSizeClassMap SizeClassMap; +-# else ++# elif SANITIZER_APPLE + const uptr kAllocatorSpace = 0x600000000000ULL; + const uptr kAllocatorSize = 0x40000000000ULL; // 4T. + typedef DefaultSizeClassMap SizeClassMap; +-# endif ++# else ++const uptr kAllocatorSpace = 0x500000000000ULL; ++const uptr kAllocatorSize = 0x40000000000ULL; // 4T. ++typedef DefaultSizeClassMap SizeClassMap; ++# endif + template <typename AddressSpaceViewTy> + struct AP64 { // Allocator64 parameters. Deliberately using a short name. + static const uptr kSpaceBeg = kAllocatorSpace; diff --git a/meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch b/meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch new file mode 100644 index 0000000000..41684fe7dd --- /dev/null +++ b/meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch @@ -0,0 +1,2893 @@ +From: Richard Sandiford <richard.sandiford@arm.com> +Subject: [PATCH 00/19] aarch64: Fix -fstack-protector issue +Date: Tue, 12 Sep 2023 16:25:10 +0100 + +This series of patches fixes deficiencies in GCC's -fstack-protector +implementation for AArch64 when using dynamically allocated stack space. +This is CVE-2023-4039. See: + +https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 +https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf + +for more details. + +The fix is to put the saved registers above the locals area when +-fstack-protector is used. + +The series also fixes a stack-clash problem that I found while working +on the CVE. In unpatched sources, the stack-clash problem would only +trigger for unrealistic numbers of arguments (8K 64-bit arguments, or an +equivalent). But it would be a more significant issue with the new +-fstack-protector frame layout. It's therefore important that both +problems are fixed together. + +Some reorganisation of the code seemed necessary to fix the problems in a +cleanish way. The series is therefore quite long, but only a handful of +patches should have any effect on code generation. + +See the individual patches for a detailed description. + +Tested on aarch64-linux-gnu. Pushed to trunk and to all active branches. +I've also pushed backports to GCC 7+ to vendors/ARM/heads/CVE-2023-4039. + +CVE: CVE-2023-4039 +Upstream-Status: Backport +Signed-off-by: Ross Burton <ross.burton@arm.com> + + +From 52816ab48f97968f3fbfb5656250f3de7c00166d Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:43 +0100 +Subject: [PATCH 01/19] aarch64: Use local frame vars in shrink-wrapping code + +aarch64_layout_frame uses a shorthand for referring to +cfun->machine->frame: + + aarch64_frame &frame = cfun->machine->frame; + +This patch does the same for some other heavy users of the structure. +No functional change intended. + +gcc/ + * config/aarch64/aarch64.c (aarch64_save_callee_saves): Use + a local shorthand for cfun->machine->frame. + (aarch64_restore_callee_saves, aarch64_get_separate_components): + (aarch64_process_components): Likewise. + (aarch64_allocate_and_probe_stack_space): Likewise. + (aarch64_expand_prologue, aarch64_expand_epilogue): Likewise. + (aarch64_layout_frame): Use existing shorthand for one more case. +--- + gcc/config/aarch64/aarch64.c | 115 ++++++++++++++++++----------------- + 1 file changed, 60 insertions(+), 55 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 391a93f3018..77c1d1300a5 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7994,6 +7994,7 @@ aarch64_save_callee_saves (poly_int64 start_offset, + unsigned start, unsigned limit, bool skip_wb, + bool hard_fp_valid_p) + { ++ aarch64_frame &frame = cfun->machine->frame; + rtx_insn *insn; + unsigned regno; + unsigned regno2; +@@ -8008,8 +8009,8 @@ aarch64_save_callee_saves (poly_int64 start_offset, + bool frame_related_p = aarch64_emit_cfi_for_reg_p (regno); + + if (skip_wb +- && (regno == cfun->machine->frame.wb_candidate1 +- || regno == cfun->machine->frame.wb_candidate2)) ++ && (regno == frame.wb_candidate1 ++ || regno == frame.wb_candidate2)) + continue; + + if (cfun->machine->reg_is_wrapped_separately[regno]) +@@ -8017,7 +8018,7 @@ aarch64_save_callee_saves (poly_int64 start_offset, + + machine_mode mode = aarch64_reg_save_mode (regno); + reg = gen_rtx_REG (mode, regno); +- offset = start_offset + cfun->machine->frame.reg_offset[regno]; ++ offset = start_offset + frame.reg_offset[regno]; + rtx base_rtx = stack_pointer_rtx; + poly_int64 sp_offset = offset; + +@@ -8030,7 +8031,7 @@ aarch64_save_callee_saves (poly_int64 start_offset, + { + gcc_assert (known_eq (start_offset, 0)); + poly_int64 fp_offset +- = cfun->machine->frame.below_hard_fp_saved_regs_size; ++ = frame.below_hard_fp_saved_regs_size; + if (hard_fp_valid_p) + base_rtx = hard_frame_pointer_rtx; + else +@@ -8052,8 +8053,7 @@ aarch64_save_callee_saves (poly_int64 start_offset, + && (regno2 = aarch64_next_callee_save (regno + 1, limit)) <= limit + && !cfun->machine->reg_is_wrapped_separately[regno2] + && known_eq (GET_MODE_SIZE (mode), +- cfun->machine->frame.reg_offset[regno2] +- - cfun->machine->frame.reg_offset[regno])) ++ frame.reg_offset[regno2] - frame.reg_offset[regno])) + { + rtx reg2 = gen_rtx_REG (mode, regno2); + rtx mem2; +@@ -8103,6 +8103,7 @@ static void + aarch64_restore_callee_saves (poly_int64 start_offset, unsigned start, + unsigned limit, bool skip_wb, rtx *cfi_ops) + { ++ aarch64_frame &frame = cfun->machine->frame; + unsigned regno; + unsigned regno2; + poly_int64 offset; +@@ -8119,13 +8120,13 @@ aarch64_restore_callee_saves (poly_int64 start_offset, unsigned start, + rtx reg, mem; + + if (skip_wb +- && (regno == cfun->machine->frame.wb_candidate1 +- || regno == cfun->machine->frame.wb_candidate2)) ++ && (regno == frame.wb_candidate1 ++ || regno == frame.wb_candidate2)) + continue; + + machine_mode mode = aarch64_reg_save_mode (regno); + reg = gen_rtx_REG (mode, regno); +- offset = start_offset + cfun->machine->frame.reg_offset[regno]; ++ offset = start_offset + frame.reg_offset[regno]; + rtx base_rtx = stack_pointer_rtx; + if (mode == VNx2DImode && BYTES_BIG_ENDIAN) + aarch64_adjust_sve_callee_save_base (mode, base_rtx, anchor_reg, +@@ -8136,8 +8137,7 @@ aarch64_restore_callee_saves (poly_int64 start_offset, unsigned start, + && (regno2 = aarch64_next_callee_save (regno + 1, limit)) <= limit + && !cfun->machine->reg_is_wrapped_separately[regno2] + && known_eq (GET_MODE_SIZE (mode), +- cfun->machine->frame.reg_offset[regno2] +- - cfun->machine->frame.reg_offset[regno])) ++ frame.reg_offset[regno2] - frame.reg_offset[regno])) + { + rtx reg2 = gen_rtx_REG (mode, regno2); + rtx mem2; +@@ -8242,6 +8242,7 @@ offset_12bit_unsigned_scaled_p (machine_mode mode, poly_int64 offset) + static sbitmap + aarch64_get_separate_components (void) + { ++ aarch64_frame &frame = cfun->machine->frame; + sbitmap components = sbitmap_alloc (LAST_SAVED_REGNUM + 1); + bitmap_clear (components); + +@@ -8258,18 +8259,18 @@ aarch64_get_separate_components (void) + if (mode == VNx2DImode && BYTES_BIG_ENDIAN) + continue; + +- poly_int64 offset = cfun->machine->frame.reg_offset[regno]; ++ poly_int64 offset = frame.reg_offset[regno]; + + /* If the register is saved in the first SVE save slot, we use + it as a stack probe for -fstack-clash-protection. */ + if (flag_stack_clash_protection +- && maybe_ne (cfun->machine->frame.below_hard_fp_saved_regs_size, 0) ++ && maybe_ne (frame.below_hard_fp_saved_regs_size, 0) + && known_eq (offset, 0)) + continue; + + /* Get the offset relative to the register we'll use. */ + if (frame_pointer_needed) +- offset -= cfun->machine->frame.below_hard_fp_saved_regs_size; ++ offset -= frame.below_hard_fp_saved_regs_size; + else + offset += crtl->outgoing_args_size; + +@@ -8288,11 +8289,11 @@ aarch64_get_separate_components (void) + /* If the spare predicate register used by big-endian SVE code + is call-preserved, it must be saved in the main prologue + before any saves that use it. */ +- if (cfun->machine->frame.spare_pred_reg != INVALID_REGNUM) +- bitmap_clear_bit (components, cfun->machine->frame.spare_pred_reg); ++ if (frame.spare_pred_reg != INVALID_REGNUM) ++ bitmap_clear_bit (components, frame.spare_pred_reg); + +- unsigned reg1 = cfun->machine->frame.wb_candidate1; +- unsigned reg2 = cfun->machine->frame.wb_candidate2; ++ unsigned reg1 = frame.wb_candidate1; ++ unsigned reg2 = frame.wb_candidate2; + /* If registers have been chosen to be stored/restored with + writeback don't interfere with them to avoid having to output explicit + stack adjustment instructions. */ +@@ -8401,6 +8402,7 @@ aarch64_get_next_set_bit (sbitmap bmp, unsigned int start) + static void + aarch64_process_components (sbitmap components, bool prologue_p) + { ++ aarch64_frame &frame = cfun->machine->frame; + rtx ptr_reg = gen_rtx_REG (Pmode, frame_pointer_needed + ? HARD_FRAME_POINTER_REGNUM + : STACK_POINTER_REGNUM); +@@ -8415,9 +8417,9 @@ aarch64_process_components (sbitmap components, bool prologue_p) + machine_mode mode = aarch64_reg_save_mode (regno); + + rtx reg = gen_rtx_REG (mode, regno); +- poly_int64 offset = cfun->machine->frame.reg_offset[regno]; ++ poly_int64 offset = frame.reg_offset[regno]; + if (frame_pointer_needed) +- offset -= cfun->machine->frame.below_hard_fp_saved_regs_size; ++ offset -= frame.below_hard_fp_saved_regs_size; + else + offset += crtl->outgoing_args_size; + +@@ -8442,14 +8444,14 @@ aarch64_process_components (sbitmap components, bool prologue_p) + break; + } + +- poly_int64 offset2 = cfun->machine->frame.reg_offset[regno2]; ++ poly_int64 offset2 = frame.reg_offset[regno2]; + /* The next register is not of the same class or its offset is not + mergeable with the current one into a pair. */ + if (aarch64_sve_mode_p (mode) + || !satisfies_constraint_Ump (mem) + || GP_REGNUM_P (regno) != GP_REGNUM_P (regno2) + || (crtl->abi->id () == ARM_PCS_SIMD && FP_REGNUM_P (regno)) +- || maybe_ne ((offset2 - cfun->machine->frame.reg_offset[regno]), ++ || maybe_ne ((offset2 - frame.reg_offset[regno]), + GET_MODE_SIZE (mode))) + { + insn = emit_insn (set); +@@ -8471,7 +8473,7 @@ aarch64_process_components (sbitmap components, bool prologue_p) + /* REGNO2 can be saved/restored in a pair with REGNO. */ + rtx reg2 = gen_rtx_REG (mode, regno2); + if (frame_pointer_needed) +- offset2 -= cfun->machine->frame.below_hard_fp_saved_regs_size; ++ offset2 -= frame.below_hard_fp_saved_regs_size; + else + offset2 += crtl->outgoing_args_size; + rtx addr2 = plus_constant (Pmode, ptr_reg, offset2); +@@ -8566,6 +8568,7 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + bool frame_related_p, + bool final_adjustment_p) + { ++ aarch64_frame &frame = cfun->machine->frame; + HOST_WIDE_INT guard_size + = 1 << param_stack_clash_protection_guard_size; + HOST_WIDE_INT guard_used_by_caller = STACK_CLASH_CALLER_GUARD; +@@ -8586,25 +8589,25 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + register as a probe. We can't assume that LR was saved at position 0 + though, so treat any space below it as unprobed. */ + if (final_adjustment_p +- && known_eq (cfun->machine->frame.below_hard_fp_saved_regs_size, 0)) ++ && known_eq (frame.below_hard_fp_saved_regs_size, 0)) + { +- poly_int64 lr_offset = cfun->machine->frame.reg_offset[LR_REGNUM]; ++ poly_int64 lr_offset = frame.reg_offset[LR_REGNUM]; + if (known_ge (lr_offset, 0)) + min_probe_threshold -= lr_offset.to_constant (); + else + gcc_assert (!flag_stack_clash_protection || known_eq (poly_size, 0)); + } + +- poly_int64 frame_size = cfun->machine->frame.frame_size; ++ poly_int64 frame_size = frame.frame_size; + + /* We should always have a positive probe threshold. */ + gcc_assert (min_probe_threshold > 0); + + if (flag_stack_clash_protection && !final_adjustment_p) + { +- poly_int64 initial_adjust = cfun->machine->frame.initial_adjust; +- poly_int64 sve_callee_adjust = cfun->machine->frame.sve_callee_adjust; +- poly_int64 final_adjust = cfun->machine->frame.final_adjust; ++ poly_int64 initial_adjust = frame.initial_adjust; ++ poly_int64 sve_callee_adjust = frame.sve_callee_adjust; ++ poly_int64 final_adjust = frame.final_adjust; + + if (known_eq (frame_size, 0)) + { +@@ -8893,17 +8896,18 @@ aarch64_epilogue_uses (int regno) + void + aarch64_expand_prologue (void) + { +- poly_int64 frame_size = cfun->machine->frame.frame_size; +- poly_int64 initial_adjust = cfun->machine->frame.initial_adjust; +- HOST_WIDE_INT callee_adjust = cfun->machine->frame.callee_adjust; +- poly_int64 final_adjust = cfun->machine->frame.final_adjust; +- poly_int64 callee_offset = cfun->machine->frame.callee_offset; +- poly_int64 sve_callee_adjust = cfun->machine->frame.sve_callee_adjust; ++ aarch64_frame &frame = cfun->machine->frame; ++ poly_int64 frame_size = frame.frame_size; ++ poly_int64 initial_adjust = frame.initial_adjust; ++ HOST_WIDE_INT callee_adjust = frame.callee_adjust; ++ poly_int64 final_adjust = frame.final_adjust; ++ poly_int64 callee_offset = frame.callee_offset; ++ poly_int64 sve_callee_adjust = frame.sve_callee_adjust; + poly_int64 below_hard_fp_saved_regs_size +- = cfun->machine->frame.below_hard_fp_saved_regs_size; +- unsigned reg1 = cfun->machine->frame.wb_candidate1; +- unsigned reg2 = cfun->machine->frame.wb_candidate2; +- bool emit_frame_chain = cfun->machine->frame.emit_frame_chain; ++ = frame.below_hard_fp_saved_regs_size; ++ unsigned reg1 = frame.wb_candidate1; ++ unsigned reg2 = frame.wb_candidate2; ++ bool emit_frame_chain = frame.emit_frame_chain; + rtx_insn *insn; + + if (flag_stack_clash_protection && known_eq (callee_adjust, 0)) +@@ -8969,7 +8973,7 @@ aarch64_expand_prologue (void) + + /* The offset of the frame chain record (if any) from the current SP. */ + poly_int64 chain_offset = (initial_adjust + callee_adjust +- - cfun->machine->frame.hard_fp_offset); ++ - frame.hard_fp_offset); + gcc_assert (known_ge (chain_offset, 0)); + + /* The offset of the bottom of the save area from the current SP. */ +@@ -9072,15 +9076,16 @@ aarch64_use_return_insn_p (void) + void + aarch64_expand_epilogue (bool for_sibcall) + { +- poly_int64 initial_adjust = cfun->machine->frame.initial_adjust; +- HOST_WIDE_INT callee_adjust = cfun->machine->frame.callee_adjust; +- poly_int64 final_adjust = cfun->machine->frame.final_adjust; +- poly_int64 callee_offset = cfun->machine->frame.callee_offset; +- poly_int64 sve_callee_adjust = cfun->machine->frame.sve_callee_adjust; ++ aarch64_frame &frame = cfun->machine->frame; ++ poly_int64 initial_adjust = frame.initial_adjust; ++ HOST_WIDE_INT callee_adjust = frame.callee_adjust; ++ poly_int64 final_adjust = frame.final_adjust; ++ poly_int64 callee_offset = frame.callee_offset; ++ poly_int64 sve_callee_adjust = frame.sve_callee_adjust; + poly_int64 below_hard_fp_saved_regs_size +- = cfun->machine->frame.below_hard_fp_saved_regs_size; +- unsigned reg1 = cfun->machine->frame.wb_candidate1; +- unsigned reg2 = cfun->machine->frame.wb_candidate2; ++ = frame.below_hard_fp_saved_regs_size; ++ unsigned reg1 = frame.wb_candidate1; ++ unsigned reg2 = frame.wb_candidate2; + rtx cfi_ops = NULL; + rtx_insn *insn; + /* A stack clash protection prologue may not have left EP0_REGNUM or +@@ -9113,7 +9118,7 @@ aarch64_expand_epilogue (bool for_sibcall) + /* We need to add memory barrier to prevent read from deallocated stack. */ + bool need_barrier_p + = maybe_ne (get_frame_size () +- + cfun->machine->frame.saved_varargs_size, 0); ++ + frame.saved_varargs_size, 0); + + /* Emit a barrier to prevent loads from a deallocated stack. */ + if (maybe_gt (final_adjust, crtl->outgoing_args_size) +@@ -11744,24 +11749,24 @@ aarch64_can_eliminate (const int from ATTRIBUTE_UNUSED, const int to) + poly_int64 + aarch64_initial_elimination_offset (unsigned from, unsigned to) + { ++ aarch64_frame &frame = cfun->machine->frame; ++ + if (to == HARD_FRAME_POINTER_REGNUM) + { + if (from == ARG_POINTER_REGNUM) +- return cfun->machine->frame.hard_fp_offset; ++ return frame.hard_fp_offset; + + if (from == FRAME_POINTER_REGNUM) +- return cfun->machine->frame.hard_fp_offset +- - cfun->machine->frame.locals_offset; ++ return frame.hard_fp_offset - frame.locals_offset; + } + + if (to == STACK_POINTER_REGNUM) + { + if (from == FRAME_POINTER_REGNUM) +- return cfun->machine->frame.frame_size +- - cfun->machine->frame.locals_offset; ++ return frame.frame_size - frame.locals_offset; + } + +- return cfun->machine->frame.frame_size; ++ return frame.frame_size; + } + + +-- +2.34.1 + + +From a2a57f7ec7912e77eb26919545807d90065584ff Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:44 +0100 +Subject: [PATCH 02/19] aarch64: Avoid a use of callee_offset + +When we emit the frame chain, i.e. when we reach Here in this statement +of aarch64_expand_prologue: + + if (emit_frame_chain) + { + // Here + ... + } + +the stack is in one of two states: + +- We've allocated up to the frame chain, but no more. + +- We've allocated the whole frame, and the frame chain is within easy + reach of the new SP. + +The offset of the frame chain from the current SP is available +in aarch64_frame as callee_offset. It is also available as the +chain_offset local variable, where the latter is calculated from other +data. (However, chain_offset is not always equal to callee_offset when +!emit_frame_chain, so chain_offset isn't redundant.) + +In c600df9a4060da3c6121ff4d0b93f179eafd69d1 I switched to using +chain_offset for the initialisation of the hard frame pointer: + + aarch64_add_offset (Pmode, hard_frame_pointer_rtx, +- stack_pointer_rtx, callee_offset, ++ stack_pointer_rtx, chain_offset, + tmp1_rtx, tmp0_rtx, frame_pointer_needed); + +But the later REG_CFA_ADJUST_CFA handling still used callee_offset. + +I think the difference is harmless, but it's more logical for the +CFA note to be in sync, and it's more convenient for later patches +if it uses chain_offset. + +gcc/ + * config/aarch64/aarch64.c (aarch64_expand_prologue): Use + chain_offset rather than callee_offset. +--- + gcc/config/aarch64/aarch64.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 77c1d1300a5..6bc026bd08f 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -8901,7 +8901,6 @@ aarch64_expand_prologue (void) + poly_int64 initial_adjust = frame.initial_adjust; + HOST_WIDE_INT callee_adjust = frame.callee_adjust; + poly_int64 final_adjust = frame.final_adjust; +- poly_int64 callee_offset = frame.callee_offset; + poly_int64 sve_callee_adjust = frame.sve_callee_adjust; + poly_int64 below_hard_fp_saved_regs_size + = frame.below_hard_fp_saved_regs_size; +@@ -9010,8 +9009,7 @@ aarch64_expand_prologue (void) + implicit. */ + if (!find_reg_note (insn, REG_CFA_ADJUST_CFA, NULL_RTX)) + { +- rtx src = plus_constant (Pmode, stack_pointer_rtx, +- callee_offset); ++ rtx src = plus_constant (Pmode, stack_pointer_rtx, chain_offset); + add_reg_note (insn, REG_CFA_ADJUST_CFA, + gen_rtx_SET (hard_frame_pointer_rtx, src)); + } +-- +2.34.1 + + +From 5efdcc8ed19d9d9e708a001f5dc695560411496d Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:44 +0100 +Subject: [PATCH 03/19] aarch64: Explicitly handle frames with no saved + registers + +If a frame has no saved registers, it can be allocated in one go. +There is no need to treat the areas below and above the saved +registers as separate. + +And if we allocate the frame in one go, it should be allocated +as the initial_adjust rather than the final_adjust. This allows the +frame size to grow to guard_size - guard_used_by_caller before a stack +probe is needed. (A frame with no register saves is necessarily a +leaf frame.) + +This is a no-op as thing stand, since a leaf function will have +no outgoing arguments, and so all the frame will be above where +the saved registers normally go. + +gcc/ + * config/aarch64/aarch64.c (aarch64_layout_frame): Explicitly + allocate the frame in one go if there are no saved registers. +--- + gcc/config/aarch64/aarch64.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 6bc026bd08f..05e6ae8c0c9 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7609,9 +7609,11 @@ aarch64_layout_frame (void) + + HOST_WIDE_INT const_size, const_outgoing_args_size, const_fp_offset; + HOST_WIDE_INT const_saved_regs_size; +- if (frame.frame_size.is_constant (&const_size) +- && const_size < max_push_offset +- && known_eq (frame.hard_fp_offset, const_size)) ++ if (known_eq (frame.saved_regs_size, 0)) ++ frame.initial_adjust = frame.frame_size; ++ else if (frame.frame_size.is_constant (&const_size) ++ && const_size < max_push_offset ++ && known_eq (frame.hard_fp_offset, const_size)) + { + /* Simple, small frame with no outgoing arguments: + +-- +2.34.1 + + +From a8385d14318634f2e3a08a75bd2d6e2810f8cec9 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:45 +0100 +Subject: [PATCH 04/19] aarch64: Add bytes_below_saved_regs to frame info + +The frame layout code currently hard-codes the assumption that +the number of bytes below the saved registers is equal to the +size of the outgoing arguments. This patch abstracts that +value into a new field of aarch64_frame. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::bytes_below_saved_regs): New + field. + * config/aarch64/aarch64.c (aarch64_layout_frame): Initialize it, + and use it instead of crtl->outgoing_args_size. + (aarch64_get_separate_components): Use bytes_below_saved_regs instead + of outgoing_args_size. + (aarch64_process_components): Likewise. +--- + gcc/config/aarch64/aarch64.c | 71 ++++++++++++++++++------------------ + gcc/config/aarch64/aarch64.h | 5 +++ + 2 files changed, 41 insertions(+), 35 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 05e6ae8c0c9..8fa5a0b2545 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7476,6 +7476,8 @@ aarch64_layout_frame (void) + gcc_assert (crtl->is_leaf + || maybe_ne (frame.reg_offset[R30_REGNUM], SLOT_NOT_REQUIRED)); + ++ frame.bytes_below_saved_regs = crtl->outgoing_args_size; ++ + /* Now assign stack slots for the registers. Start with the predicate + registers, since predicate LDR and STR have a relatively small + offset range. These saves happen below the hard frame pointer. */ +@@ -7580,18 +7582,18 @@ aarch64_layout_frame (void) + + poly_int64 varargs_and_saved_regs_size = offset + frame.saved_varargs_size; + +- poly_int64 above_outgoing_args ++ poly_int64 saved_regs_and_above + = aligned_upper_bound (varargs_and_saved_regs_size + + get_frame_size (), + STACK_BOUNDARY / BITS_PER_UNIT); + + frame.hard_fp_offset +- = above_outgoing_args - frame.below_hard_fp_saved_regs_size; ++ = saved_regs_and_above - frame.below_hard_fp_saved_regs_size; + + /* Both these values are already aligned. */ +- gcc_assert (multiple_p (crtl->outgoing_args_size, ++ gcc_assert (multiple_p (frame.bytes_below_saved_regs, + STACK_BOUNDARY / BITS_PER_UNIT)); +- frame.frame_size = above_outgoing_args + crtl->outgoing_args_size; ++ frame.frame_size = saved_regs_and_above + frame.bytes_below_saved_regs; + + frame.locals_offset = frame.saved_varargs_size; + +@@ -7607,7 +7609,7 @@ aarch64_layout_frame (void) + else if (frame.wb_candidate1 != INVALID_REGNUM) + max_push_offset = 256; + +- HOST_WIDE_INT const_size, const_outgoing_args_size, const_fp_offset; ++ HOST_WIDE_INT const_size, const_below_saved_regs, const_fp_offset; + HOST_WIDE_INT const_saved_regs_size; + if (known_eq (frame.saved_regs_size, 0)) + frame.initial_adjust = frame.frame_size; +@@ -7615,31 +7617,31 @@ aarch64_layout_frame (void) + && const_size < max_push_offset + && known_eq (frame.hard_fp_offset, const_size)) + { +- /* Simple, small frame with no outgoing arguments: ++ /* Simple, small frame with no data below the saved registers. + + stp reg1, reg2, [sp, -frame_size]! + stp reg3, reg4, [sp, 16] */ + frame.callee_adjust = const_size; + } +- else if (crtl->outgoing_args_size.is_constant (&const_outgoing_args_size) ++ else if (frame.bytes_below_saved_regs.is_constant (&const_below_saved_regs) + && frame.saved_regs_size.is_constant (&const_saved_regs_size) +- && const_outgoing_args_size + const_saved_regs_size < 512 +- /* We could handle this case even with outgoing args, provided +- that the number of args left us with valid offsets for all +- predicate and vector save slots. It's such a rare case that +- it hardly seems worth the effort though. */ +- && (!saves_below_hard_fp_p || const_outgoing_args_size == 0) ++ && const_below_saved_regs + const_saved_regs_size < 512 ++ /* We could handle this case even with data below the saved ++ registers, provided that that data left us with valid offsets ++ for all predicate and vector save slots. It's such a rare ++ case that it hardly seems worth the effort though. */ ++ && (!saves_below_hard_fp_p || const_below_saved_regs == 0) + && !(cfun->calls_alloca + && frame.hard_fp_offset.is_constant (&const_fp_offset) + && const_fp_offset < max_push_offset)) + { +- /* Frame with small outgoing arguments: ++ /* Frame with small area below the saved registers: + + sub sp, sp, frame_size +- stp reg1, reg2, [sp, outgoing_args_size] +- stp reg3, reg4, [sp, outgoing_args_size + 16] */ ++ stp reg1, reg2, [sp, bytes_below_saved_regs] ++ stp reg3, reg4, [sp, bytes_below_saved_regs + 16] */ + frame.initial_adjust = frame.frame_size; +- frame.callee_offset = const_outgoing_args_size; ++ frame.callee_offset = const_below_saved_regs; + } + else if (saves_below_hard_fp_p + && known_eq (frame.saved_regs_size, +@@ -7649,30 +7651,29 @@ aarch64_layout_frame (void) + + sub sp, sp, hard_fp_offset + below_hard_fp_saved_regs_size + save SVE registers relative to SP +- sub sp, sp, outgoing_args_size */ ++ sub sp, sp, bytes_below_saved_regs */ + frame.initial_adjust = (frame.hard_fp_offset + + frame.below_hard_fp_saved_regs_size); +- frame.final_adjust = crtl->outgoing_args_size; ++ frame.final_adjust = frame.bytes_below_saved_regs; + } + else if (frame.hard_fp_offset.is_constant (&const_fp_offset) + && const_fp_offset < max_push_offset) + { +- /* Frame with large outgoing arguments or SVE saves, but with +- a small local area: ++ /* Frame with large area below the saved registers, or with SVE saves, ++ but with a small area above: + + stp reg1, reg2, [sp, -hard_fp_offset]! + stp reg3, reg4, [sp, 16] + [sub sp, sp, below_hard_fp_saved_regs_size] + [save SVE registers relative to SP] +- sub sp, sp, outgoing_args_size */ ++ sub sp, sp, bytes_below_saved_regs */ + frame.callee_adjust = const_fp_offset; + frame.sve_callee_adjust = frame.below_hard_fp_saved_regs_size; +- frame.final_adjust = crtl->outgoing_args_size; ++ frame.final_adjust = frame.bytes_below_saved_regs; + } + else + { +- /* Frame with large local area and outgoing arguments or SVE saves, +- using frame pointer: ++ /* General case: + + sub sp, sp, hard_fp_offset + stp x29, x30, [sp, 0] +@@ -7680,10 +7681,10 @@ aarch64_layout_frame (void) + stp reg3, reg4, [sp, 16] + [sub sp, sp, below_hard_fp_saved_regs_size] + [save SVE registers relative to SP] +- sub sp, sp, outgoing_args_size */ ++ sub sp, sp, bytes_below_saved_regs */ + frame.initial_adjust = frame.hard_fp_offset; + frame.sve_callee_adjust = frame.below_hard_fp_saved_regs_size; +- frame.final_adjust = crtl->outgoing_args_size; ++ frame.final_adjust = frame.bytes_below_saved_regs; + } + + /* Make sure the individual adjustments add up to the full frame size. */ +@@ -8274,7 +8275,7 @@ aarch64_get_separate_components (void) + if (frame_pointer_needed) + offset -= frame.below_hard_fp_saved_regs_size; + else +- offset += crtl->outgoing_args_size; ++ offset += frame.bytes_below_saved_regs; + + /* Check that we can access the stack slot of the register with one + direct load with no adjustments needed. */ +@@ -8423,7 +8424,7 @@ aarch64_process_components (sbitmap components, bool prologue_p) + if (frame_pointer_needed) + offset -= frame.below_hard_fp_saved_regs_size; + else +- offset += crtl->outgoing_args_size; ++ offset += frame.bytes_below_saved_regs; + + rtx addr = plus_constant (Pmode, ptr_reg, offset); + rtx mem = gen_frame_mem (mode, addr); +@@ -8477,7 +8478,7 @@ aarch64_process_components (sbitmap components, bool prologue_p) + if (frame_pointer_needed) + offset2 -= frame.below_hard_fp_saved_regs_size; + else +- offset2 += crtl->outgoing_args_size; ++ offset2 += frame.bytes_below_saved_regs; + rtx addr2 = plus_constant (Pmode, ptr_reg, offset2); + rtx mem2 = gen_frame_mem (mode, addr2); + rtx set2 = prologue_p ? gen_rtx_SET (mem2, reg2) +@@ -8551,10 +8552,10 @@ aarch64_stack_clash_protection_alloca_probe_range (void) + registers. If POLY_SIZE is not large enough to require a probe this function + will only adjust the stack. When allocating the stack space + FRAME_RELATED_P is then used to indicate if the allocation is frame related. +- FINAL_ADJUSTMENT_P indicates whether we are allocating the outgoing +- arguments. If we are then we ensure that any allocation larger than the ABI +- defined buffer needs a probe so that the invariant of having a 1KB buffer is +- maintained. ++ FINAL_ADJUSTMENT_P indicates whether we are allocating the area below ++ the saved registers. If we are then we ensure that any allocation ++ larger than the ABI defined buffer needs a probe so that the ++ invariant of having a 1KB buffer is maintained. + + We emit barriers after each stack adjustment to prevent optimizations from + breaking the invariant that we never drop the stack more than a page. This +@@ -8763,7 +8764,7 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + /* Handle any residuals. Residuals of at least MIN_PROBE_THRESHOLD have to + be probed. This maintains the requirement that each page is probed at + least once. For initial probing we probe only if the allocation is +- more than GUARD_SIZE - buffer, and for the outgoing arguments we probe ++ more than GUARD_SIZE - buffer, and below the saved registers we probe + if the amount is larger than buffer. GUARD_SIZE - buffer + buffer == + GUARD_SIZE. This works that for any allocation that is large enough to + trigger a probe here, we'll have at least one, and if they're not large +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index bb383acfae8..6f0b8c7107e 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -837,6 +837,11 @@ struct GTY (()) aarch64_frame + /* The size of the callee-save registers with a slot in REG_OFFSET. */ + poly_int64 saved_regs_size; + ++ /* The number of bytes between the bottom of the static frame (the bottom ++ of the outgoing arguments) and the bottom of the register save area. ++ This value is always a multiple of STACK_BOUNDARY. */ ++ poly_int64 bytes_below_saved_regs; ++ + /* The size of the callee-save registers with a slot in REG_OFFSET that + are saved below the hard frame pointer. */ + poly_int64 below_hard_fp_saved_regs_size; +-- +2.34.1 + + +From d3f6ceecc8a7f128a9e6cb7d8aecf0de81ed9705 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:45 +0100 +Subject: [PATCH 05/19] aarch64: Add bytes_below_hard_fp to frame info + +Following on from the previous bytes_below_saved_regs patch, this one +records the number of bytes that are below the hard frame pointer. +This eventually replaces below_hard_fp_saved_regs_size. + +If a frame pointer is not needed, the epilogue adds final_adjust +to the stack pointer before restoring registers: + + aarch64_add_sp (tmp1_rtx, tmp0_rtx, final_adjust, true); + +Therefore, if the epilogue needs to restore the stack pointer from +the hard frame pointer, the directly corresponding offset is: + + -bytes_below_hard_fp + final_adjust + +i.e. go from the hard frame pointer to the bottom of the frame, +then add the same amount as if we were using the stack pointer +from the outset. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::bytes_below_hard_fp): New + field. + * config/aarch64/aarch64.c (aarch64_layout_frame): Initialize it. + (aarch64_expand_epilogue): Use it instead of + below_hard_fp_saved_regs_size. +--- + gcc/config/aarch64/aarch64.c | 6 +++--- + gcc/config/aarch64/aarch64.h | 5 +++++ + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 8fa5a0b2545..e03adf57226 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7528,6 +7528,7 @@ aarch64_layout_frame (void) + of the callee save area. */ + bool saves_below_hard_fp_p = maybe_ne (offset, 0); + frame.below_hard_fp_saved_regs_size = offset; ++ frame.bytes_below_hard_fp = offset + frame.bytes_below_saved_regs; + if (frame.emit_frame_chain) + { + /* FP and LR are placed in the linkage record. */ +@@ -9083,8 +9084,7 @@ aarch64_expand_epilogue (bool for_sibcall) + poly_int64 final_adjust = frame.final_adjust; + poly_int64 callee_offset = frame.callee_offset; + poly_int64 sve_callee_adjust = frame.sve_callee_adjust; +- poly_int64 below_hard_fp_saved_regs_size +- = frame.below_hard_fp_saved_regs_size; ++ poly_int64 bytes_below_hard_fp = frame.bytes_below_hard_fp; + unsigned reg1 = frame.wb_candidate1; + unsigned reg2 = frame.wb_candidate2; + rtx cfi_ops = NULL; +@@ -9140,7 +9140,7 @@ aarch64_expand_epilogue (bool for_sibcall) + is restored on the instruction doing the writeback. */ + aarch64_add_offset (Pmode, stack_pointer_rtx, + hard_frame_pointer_rtx, +- -callee_offset - below_hard_fp_saved_regs_size, ++ -bytes_below_hard_fp + final_adjust, + tmp1_rtx, tmp0_rtx, callee_adjust == 0); + else + /* The case where we need to re-use the register here is very rare, so +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index 6f0b8c7107e..21ac920a3fe 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -846,6 +846,11 @@ struct GTY (()) aarch64_frame + are saved below the hard frame pointer. */ + poly_int64 below_hard_fp_saved_regs_size; + ++ /* The number of bytes between the bottom of the static frame (the bottom ++ of the outgoing arguments) and the hard frame pointer. This value is ++ always a multiple of STACK_BOUNDARY. */ ++ poly_int64 bytes_below_hard_fp; ++ + /* Offset from the base of the frame (incomming SP) to the + top of the locals area. This value is always a multiple of + STACK_BOUNDARY. */ +-- +2.34.1 + + +From e8a7ec87fcdbaa5f7c7bd499aebe5cefacbf8687 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:46 +0100 +Subject: [PATCH 06/19] aarch64: Tweak aarch64_save/restore_callee_saves + +aarch64_save_callee_saves and aarch64_restore_callee_saves took +a parameter called start_offset that gives the offset of the +bottom of the saved register area from the current stack pointer. +However, it's more convenient for later patches if we use the +bottom of the entire frame as the reference point, rather than +the bottom of the saved registers. + +Doing that removes the need for the callee_offset field. +Other than that, this is not a win on its own. It only really +makes sense in combination with the follow-on patches. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::callee_offset): Delete. + * config/aarch64/aarch64.c (aarch64_layout_frame): Remove + callee_offset handling. + (aarch64_save_callee_saves): Replace the start_offset parameter + with a bytes_below_sp parameter. + (aarch64_restore_callee_saves): Likewise. + (aarch64_expand_prologue): Update accordingly. + (aarch64_expand_epilogue): Likewise. +--- + gcc/config/aarch64/aarch64.c | 56 ++++++++++++++++++------------------ + gcc/config/aarch64/aarch64.h | 4 --- + 2 files changed, 28 insertions(+), 32 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index e03adf57226..96e99f6c17a 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7602,7 +7602,6 @@ aarch64_layout_frame (void) + frame.final_adjust = 0; + frame.callee_adjust = 0; + frame.sve_callee_adjust = 0; +- frame.callee_offset = 0; + + HOST_WIDE_INT max_push_offset = 0; + if (frame.wb_candidate2 != INVALID_REGNUM) +@@ -7642,7 +7641,6 @@ aarch64_layout_frame (void) + stp reg1, reg2, [sp, bytes_below_saved_regs] + stp reg3, reg4, [sp, bytes_below_saved_regs + 16] */ + frame.initial_adjust = frame.frame_size; +- frame.callee_offset = const_below_saved_regs; + } + else if (saves_below_hard_fp_p + && known_eq (frame.saved_regs_size, +@@ -7989,12 +7987,13 @@ aarch64_add_cfa_expression (rtx_insn *insn, rtx reg, + } + + /* Emit code to save the callee-saved registers from register number START +- to LIMIT to the stack at the location starting at offset START_OFFSET, +- skipping any write-back candidates if SKIP_WB is true. HARD_FP_VALID_P +- is true if the hard frame pointer has been set up. */ ++ to LIMIT to the stack. The stack pointer is currently BYTES_BELOW_SP ++ bytes above the bottom of the static frame. Skip any write-back ++ candidates if SKIP_WB is true. HARD_FP_VALID_P is true if the hard ++ frame pointer has been set up. */ + + static void +-aarch64_save_callee_saves (poly_int64 start_offset, ++aarch64_save_callee_saves (poly_int64 bytes_below_sp, + unsigned start, unsigned limit, bool skip_wb, + bool hard_fp_valid_p) + { +@@ -8022,7 +8021,9 @@ aarch64_save_callee_saves (poly_int64 start_offset, + + machine_mode mode = aarch64_reg_save_mode (regno); + reg = gen_rtx_REG (mode, regno); +- offset = start_offset + frame.reg_offset[regno]; ++ offset = (frame.reg_offset[regno] ++ + frame.bytes_below_saved_regs ++ - bytes_below_sp); + rtx base_rtx = stack_pointer_rtx; + poly_int64 sp_offset = offset; + +@@ -8033,9 +8034,7 @@ aarch64_save_callee_saves (poly_int64 start_offset, + else if (GP_REGNUM_P (regno) + && (!offset.is_constant (&const_offset) || const_offset >= 512)) + { +- gcc_assert (known_eq (start_offset, 0)); +- poly_int64 fp_offset +- = frame.below_hard_fp_saved_regs_size; ++ poly_int64 fp_offset = frame.bytes_below_hard_fp - bytes_below_sp; + if (hard_fp_valid_p) + base_rtx = hard_frame_pointer_rtx; + else +@@ -8099,12 +8098,13 @@ aarch64_save_callee_saves (poly_int64 start_offset, + } + + /* Emit code to restore the callee registers from register number START +- up to and including LIMIT. Restore from the stack offset START_OFFSET, +- skipping any write-back candidates if SKIP_WB is true. Write the +- appropriate REG_CFA_RESTORE notes into CFI_OPS. */ ++ up to and including LIMIT. The stack pointer is currently BYTES_BELOW_SP ++ bytes above the bottom of the static frame. Skip any write-back ++ candidates if SKIP_WB is true. Write the appropriate REG_CFA_RESTORE ++ notes into CFI_OPS. */ + + static void +-aarch64_restore_callee_saves (poly_int64 start_offset, unsigned start, ++aarch64_restore_callee_saves (poly_int64 bytes_below_sp, unsigned start, + unsigned limit, bool skip_wb, rtx *cfi_ops) + { + aarch64_frame &frame = cfun->machine->frame; +@@ -8130,7 +8130,9 @@ aarch64_restore_callee_saves (poly_int64 start_offset, unsigned start, + + machine_mode mode = aarch64_reg_save_mode (regno); + reg = gen_rtx_REG (mode, regno); +- offset = start_offset + frame.reg_offset[regno]; ++ offset = (frame.reg_offset[regno] ++ + frame.bytes_below_saved_regs ++ - bytes_below_sp); + rtx base_rtx = stack_pointer_rtx; + if (mode == VNx2DImode && BYTES_BIG_ENDIAN) + aarch64_adjust_sve_callee_save_base (mode, base_rtx, anchor_reg, +@@ -8906,8 +8908,6 @@ aarch64_expand_prologue (void) + HOST_WIDE_INT callee_adjust = frame.callee_adjust; + poly_int64 final_adjust = frame.final_adjust; + poly_int64 sve_callee_adjust = frame.sve_callee_adjust; +- poly_int64 below_hard_fp_saved_regs_size +- = frame.below_hard_fp_saved_regs_size; + unsigned reg1 = frame.wb_candidate1; + unsigned reg2 = frame.wb_candidate2; + bool emit_frame_chain = frame.emit_frame_chain; +@@ -8979,8 +8979,8 @@ aarch64_expand_prologue (void) + - frame.hard_fp_offset); + gcc_assert (known_ge (chain_offset, 0)); + +- /* The offset of the bottom of the save area from the current SP. */ +- poly_int64 saved_regs_offset = chain_offset - below_hard_fp_saved_regs_size; ++ /* The offset of the current SP from the bottom of the static frame. */ ++ poly_int64 bytes_below_sp = frame_size - initial_adjust - callee_adjust; + + if (emit_frame_chain) + { +@@ -8988,7 +8988,7 @@ aarch64_expand_prologue (void) + { + reg1 = R29_REGNUM; + reg2 = R30_REGNUM; +- aarch64_save_callee_saves (saved_regs_offset, reg1, reg2, ++ aarch64_save_callee_saves (bytes_below_sp, reg1, reg2, + false, false); + } + else +@@ -9028,7 +9028,7 @@ aarch64_expand_prologue (void) + emit_insn (gen_stack_tie (stack_pointer_rtx, hard_frame_pointer_rtx)); + } + +- aarch64_save_callee_saves (saved_regs_offset, R0_REGNUM, R30_REGNUM, ++ aarch64_save_callee_saves (bytes_below_sp, R0_REGNUM, R30_REGNUM, + callee_adjust != 0 || emit_frame_chain, + emit_frame_chain); + if (maybe_ne (sve_callee_adjust, 0)) +@@ -9038,16 +9038,17 @@ aarch64_expand_prologue (void) + aarch64_allocate_and_probe_stack_space (tmp1_rtx, tmp0_rtx, + sve_callee_adjust, + !frame_pointer_needed, false); +- saved_regs_offset += sve_callee_adjust; ++ bytes_below_sp -= sve_callee_adjust; + } +- aarch64_save_callee_saves (saved_regs_offset, P0_REGNUM, P15_REGNUM, ++ aarch64_save_callee_saves (bytes_below_sp, P0_REGNUM, P15_REGNUM, + false, emit_frame_chain); +- aarch64_save_callee_saves (saved_regs_offset, V0_REGNUM, V31_REGNUM, ++ aarch64_save_callee_saves (bytes_below_sp, V0_REGNUM, V31_REGNUM, + callee_adjust != 0 || emit_frame_chain, + emit_frame_chain); + + /* We may need to probe the final adjustment if it is larger than the guard + that is assumed by the called. */ ++ gcc_assert (known_eq (bytes_below_sp, final_adjust)); + aarch64_allocate_and_probe_stack_space (tmp1_rtx, tmp0_rtx, final_adjust, + !frame_pointer_needed, true); + } +@@ -9082,7 +9083,6 @@ aarch64_expand_epilogue (bool for_sibcall) + poly_int64 initial_adjust = frame.initial_adjust; + HOST_WIDE_INT callee_adjust = frame.callee_adjust; + poly_int64 final_adjust = frame.final_adjust; +- poly_int64 callee_offset = frame.callee_offset; + poly_int64 sve_callee_adjust = frame.sve_callee_adjust; + poly_int64 bytes_below_hard_fp = frame.bytes_below_hard_fp; + unsigned reg1 = frame.wb_candidate1; +@@ -9150,13 +9150,13 @@ aarch64_expand_epilogue (bool for_sibcall) + + /* Restore the vector registers before the predicate registers, + so that we can use P4 as a temporary for big-endian SVE frames. */ +- aarch64_restore_callee_saves (callee_offset, V0_REGNUM, V31_REGNUM, ++ aarch64_restore_callee_saves (final_adjust, V0_REGNUM, V31_REGNUM, + callee_adjust != 0, &cfi_ops); +- aarch64_restore_callee_saves (callee_offset, P0_REGNUM, P15_REGNUM, ++ aarch64_restore_callee_saves (final_adjust, P0_REGNUM, P15_REGNUM, + false, &cfi_ops); + if (maybe_ne (sve_callee_adjust, 0)) + aarch64_add_sp (NULL_RTX, NULL_RTX, sve_callee_adjust, true); +- aarch64_restore_callee_saves (callee_offset - sve_callee_adjust, ++ aarch64_restore_callee_saves (final_adjust + sve_callee_adjust, + R0_REGNUM, R30_REGNUM, + callee_adjust != 0, &cfi_ops); + +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index 21ac920a3fe..57e67217745 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -873,10 +873,6 @@ struct GTY (()) aarch64_frame + It is zero when no push is used. */ + HOST_WIDE_INT callee_adjust; + +- /* The offset from SP to the callee-save registers after initial_adjust. +- It may be non-zero if no push is used (ie. callee_adjust == 0). */ +- poly_int64 callee_offset; +- + /* The size of the stack adjustment before saving or after restoring + SVE registers. */ + poly_int64 sve_callee_adjust; +-- +2.34.1 + + +From 7356df0319aefe4c68ef57ec4c6bd18c72188a34 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:46 +0100 +Subject: [PATCH 07/19] aarch64: Only calculate chain_offset if there is a + chain + +After previous patches, it is no longer necessary to calculate +a chain_offset in cases where there is no chain record. + +gcc/ + * config/aarch64/aarch64.c (aarch64_expand_prologue): Move the + calculation of chain_offset into the emit_frame_chain block. +--- + gcc/config/aarch64/aarch64.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 96e99f6c17a..cf5244b7ec0 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -8974,16 +8974,16 @@ aarch64_expand_prologue (void) + if (callee_adjust != 0) + aarch64_push_regs (reg1, reg2, callee_adjust); + +- /* The offset of the frame chain record (if any) from the current SP. */ +- poly_int64 chain_offset = (initial_adjust + callee_adjust +- - frame.hard_fp_offset); +- gcc_assert (known_ge (chain_offset, 0)); +- + /* The offset of the current SP from the bottom of the static frame. */ + poly_int64 bytes_below_sp = frame_size - initial_adjust - callee_adjust; + + if (emit_frame_chain) + { ++ /* The offset of the frame chain record (if any) from the current SP. */ ++ poly_int64 chain_offset = (initial_adjust + callee_adjust ++ - frame.hard_fp_offset); ++ gcc_assert (known_ge (chain_offset, 0)); ++ + if (callee_adjust == 0) + { + reg1 = R29_REGNUM; +-- +2.34.1 + + +From 82fb69e75c21010f7afc72bb842751164fe8fc72 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:46 +0100 +Subject: [PATCH 08/19] aarch64: Rename locals_offset to bytes_above_locals +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +locals_offset was described as: + + /* Offset from the base of the frame (incomming SP) to the + top of the locals area. This value is always a multiple of + STACK_BOUNDARY. */ + +This is implicitly an “upside down” view of the frame: the incoming +SP is at offset 0, and anything N bytes below the incoming SP is at +offset N (rather than -N). + +However, reg_offset instead uses a “right way up” view; that is, +it views offsets in address terms. Something above X is at a +positive offset from X and something below X is at a negative +offset from X. + +Also, even on FRAME_GROWS_DOWNWARD targets like AArch64, +target-independent code views offsets in address terms too: +locals are allocated at negative offsets to virtual_stack_vars. + +It seems confusing to have *_offset fields of the same structure +using different polarities like this. This patch tries to avoid +that by renaming locals_offset to bytes_above_locals. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::locals_offset): Rename to... + (aarch64_frame::bytes_above_locals): ...this. + * config/aarch64/aarch64.c (aarch64_layout_frame) + (aarch64_initial_elimination_offset): Update accordingly. +--- + gcc/config/aarch64/aarch64.c | 6 +++--- + gcc/config/aarch64/aarch64.h | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index cf5244b7ec0..d54f7a89306 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7596,7 +7596,7 @@ aarch64_layout_frame (void) + STACK_BOUNDARY / BITS_PER_UNIT)); + frame.frame_size = saved_regs_and_above + frame.bytes_below_saved_regs; + +- frame.locals_offset = frame.saved_varargs_size; ++ frame.bytes_above_locals = frame.saved_varargs_size; + + frame.initial_adjust = 0; + frame.final_adjust = 0; +@@ -11758,13 +11758,13 @@ aarch64_initial_elimination_offset (unsigned from, unsigned to) + return frame.hard_fp_offset; + + if (from == FRAME_POINTER_REGNUM) +- return frame.hard_fp_offset - frame.locals_offset; ++ return frame.hard_fp_offset - frame.bytes_above_locals; + } + + if (to == STACK_POINTER_REGNUM) + { + if (from == FRAME_POINTER_REGNUM) +- return frame.frame_size - frame.locals_offset; ++ return frame.frame_size - frame.bytes_above_locals; + } + + return frame.frame_size; +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index 57e67217745..3c5e3dd429d 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -851,10 +851,10 @@ struct GTY (()) aarch64_frame + always a multiple of STACK_BOUNDARY. */ + poly_int64 bytes_below_hard_fp; + +- /* Offset from the base of the frame (incomming SP) to the +- top of the locals area. This value is always a multiple of ++ /* The number of bytes between the top of the locals area and the top ++ of the frame (the incomming SP). This value is always a multiple of + STACK_BOUNDARY. */ +- poly_int64 locals_offset; ++ poly_int64 bytes_above_locals; + + /* Offset from the base of the frame (incomming SP) to the + hard_frame_pointer. This value is always a multiple of +-- +2.34.1 + + +From fa6600b55b49ee14d8288f13719ceea2a75eea60 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:47 +0100 +Subject: [PATCH 09/19] aarch64: Rename hard_fp_offset to bytes_above_hard_fp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Similarly to the previous locals_offset patch, hard_fp_offset +was described as: + + /* Offset from the base of the frame (incomming SP) to the + hard_frame_pointer. This value is always a multiple of + STACK_BOUNDARY. */ + poly_int64 hard_fp_offset; + +which again took an “upside-down” view: higher offsets meant lower +addresses. This patch renames the field to bytes_above_hard_fp instead. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::hard_fp_offset): Rename + to... + (aarch64_frame::bytes_above_hard_fp): ...this. + * config/aarch64/aarch64.c (aarch64_layout_frame) + (aarch64_expand_prologue): Update accordingly. + (aarch64_initial_elimination_offset): Likewise. +--- + gcc/config/aarch64/aarch64.c | 26 +++++++++++++------------- + gcc/config/aarch64/aarch64.h | 6 +++--- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index d54f7a89306..23cb084e5a7 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7588,7 +7588,7 @@ aarch64_layout_frame (void) + + get_frame_size (), + STACK_BOUNDARY / BITS_PER_UNIT); + +- frame.hard_fp_offset ++ frame.bytes_above_hard_fp + = saved_regs_and_above - frame.below_hard_fp_saved_regs_size; + + /* Both these values are already aligned. */ +@@ -7609,13 +7609,13 @@ aarch64_layout_frame (void) + else if (frame.wb_candidate1 != INVALID_REGNUM) + max_push_offset = 256; + +- HOST_WIDE_INT const_size, const_below_saved_regs, const_fp_offset; ++ HOST_WIDE_INT const_size, const_below_saved_regs, const_above_fp; + HOST_WIDE_INT const_saved_regs_size; + if (known_eq (frame.saved_regs_size, 0)) + frame.initial_adjust = frame.frame_size; + else if (frame.frame_size.is_constant (&const_size) + && const_size < max_push_offset +- && known_eq (frame.hard_fp_offset, const_size)) ++ && known_eq (frame.bytes_above_hard_fp, const_size)) + { + /* Simple, small frame with no data below the saved registers. + +@@ -7632,8 +7632,8 @@ aarch64_layout_frame (void) + case that it hardly seems worth the effort though. */ + && (!saves_below_hard_fp_p || const_below_saved_regs == 0) + && !(cfun->calls_alloca +- && frame.hard_fp_offset.is_constant (&const_fp_offset) +- && const_fp_offset < max_push_offset)) ++ && frame.bytes_above_hard_fp.is_constant (&const_above_fp) ++ && const_above_fp < max_push_offset)) + { + /* Frame with small area below the saved registers: + +@@ -7651,12 +7651,12 @@ aarch64_layout_frame (void) + sub sp, sp, hard_fp_offset + below_hard_fp_saved_regs_size + save SVE registers relative to SP + sub sp, sp, bytes_below_saved_regs */ +- frame.initial_adjust = (frame.hard_fp_offset ++ frame.initial_adjust = (frame.bytes_above_hard_fp + + frame.below_hard_fp_saved_regs_size); + frame.final_adjust = frame.bytes_below_saved_regs; + } +- else if (frame.hard_fp_offset.is_constant (&const_fp_offset) +- && const_fp_offset < max_push_offset) ++ else if (frame.bytes_above_hard_fp.is_constant (&const_above_fp) ++ && const_above_fp < max_push_offset) + { + /* Frame with large area below the saved registers, or with SVE saves, + but with a small area above: +@@ -7666,7 +7666,7 @@ aarch64_layout_frame (void) + [sub sp, sp, below_hard_fp_saved_regs_size] + [save SVE registers relative to SP] + sub sp, sp, bytes_below_saved_regs */ +- frame.callee_adjust = const_fp_offset; ++ frame.callee_adjust = const_above_fp; + frame.sve_callee_adjust = frame.below_hard_fp_saved_regs_size; + frame.final_adjust = frame.bytes_below_saved_regs; + } +@@ -7681,7 +7681,7 @@ aarch64_layout_frame (void) + [sub sp, sp, below_hard_fp_saved_regs_size] + [save SVE registers relative to SP] + sub sp, sp, bytes_below_saved_regs */ +- frame.initial_adjust = frame.hard_fp_offset; ++ frame.initial_adjust = frame.bytes_above_hard_fp; + frame.sve_callee_adjust = frame.below_hard_fp_saved_regs_size; + frame.final_adjust = frame.bytes_below_saved_regs; + } +@@ -8981,7 +8981,7 @@ aarch64_expand_prologue (void) + { + /* The offset of the frame chain record (if any) from the current SP. */ + poly_int64 chain_offset = (initial_adjust + callee_adjust +- - frame.hard_fp_offset); ++ - frame.bytes_above_hard_fp); + gcc_assert (known_ge (chain_offset, 0)); + + if (callee_adjust == 0) +@@ -11755,10 +11755,10 @@ aarch64_initial_elimination_offset (unsigned from, unsigned to) + if (to == HARD_FRAME_POINTER_REGNUM) + { + if (from == ARG_POINTER_REGNUM) +- return frame.hard_fp_offset; ++ return frame.bytes_above_hard_fp; + + if (from == FRAME_POINTER_REGNUM) +- return frame.hard_fp_offset - frame.bytes_above_locals; ++ return frame.bytes_above_hard_fp - frame.bytes_above_locals; + } + + if (to == STACK_POINTER_REGNUM) +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index 3c5e3dd429d..9291cfd3ec8 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -856,10 +856,10 @@ struct GTY (()) aarch64_frame + STACK_BOUNDARY. */ + poly_int64 bytes_above_locals; + +- /* Offset from the base of the frame (incomming SP) to the +- hard_frame_pointer. This value is always a multiple of ++ /* The number of bytes between the hard_frame_pointer and the top of ++ the frame (the incomming SP). This value is always a multiple of + STACK_BOUNDARY. */ +- poly_int64 hard_fp_offset; ++ poly_int64 bytes_above_hard_fp; + + /* The size of the frame. This value is the offset from base of the + frame (incomming SP) to the stack_pointer. This value is always +-- +2.34.1 + + +From b8cd5a0229da78c2d1289d54731fbef0126617d5 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:47 +0100 +Subject: [PATCH 10/19] aarch64: Tweak frame_size comment +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This patch fixes another case in which a value was described with +an “upside-down” view. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::frame_size): Tweak comment. +--- + gcc/config/aarch64/aarch64.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index 9291cfd3ec8..82883ad5a0d 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -861,8 +861,8 @@ struct GTY (()) aarch64_frame + STACK_BOUNDARY. */ + poly_int64 bytes_above_hard_fp; + +- /* The size of the frame. This value is the offset from base of the +- frame (incomming SP) to the stack_pointer. This value is always ++ /* The size of the frame, i.e. the number of bytes between the bottom ++ of the outgoing arguments and the incoming SP. This value is always + a multiple of STACK_BOUNDARY. */ + poly_int64 frame_size; + +-- +2.34.1 + + +From 999c4a81cffddb850d6ab0f6d3a8de3e704d2f7a Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:48 +0100 +Subject: [PATCH 11/19] aarch64: Measure reg_offset from the bottom of the + frame + +reg_offset was measured from the bottom of the saved register area. +This made perfect sense with the original layout, since the bottom +of the saved register area was also the hard frame pointer address. +It became slightly less obvious with SVE, since we save SVE +registers below the hard frame pointer, but it still made sense. + +However, if we want to allow different frame layouts, it's more +convenient and obvious to measure reg_offset from the bottom of +the frame. After previous patches, it's also a slight simplification +in its own right. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame): Add comment above + reg_offset. + * config/aarch64/aarch64.c (aarch64_layout_frame): Walk offsets + from the bottom of the frame, rather than the bottom of the saved + register area. Measure reg_offset from the bottom of the frame + rather than the bottom of the saved register area. + (aarch64_save_callee_saves): Update accordingly. + (aarch64_restore_callee_saves): Likewise. + (aarch64_get_separate_components): Likewise. + (aarch64_process_components): Likewise. +--- + gcc/config/aarch64/aarch64.c | 53 ++++++++++++++++-------------------- + gcc/config/aarch64/aarch64.h | 3 ++ + 2 files changed, 27 insertions(+), 29 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 23cb084e5a7..45ff664cba6 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7398,7 +7398,6 @@ aarch64_needs_frame_chain (void) + static void + aarch64_layout_frame (void) + { +- poly_int64 offset = 0; + int regno, last_fp_reg = INVALID_REGNUM; + machine_mode vector_save_mode = aarch64_reg_save_mode (V8_REGNUM); + poly_int64 vector_save_size = GET_MODE_SIZE (vector_save_mode); +@@ -7476,7 +7475,9 @@ aarch64_layout_frame (void) + gcc_assert (crtl->is_leaf + || maybe_ne (frame.reg_offset[R30_REGNUM], SLOT_NOT_REQUIRED)); + +- frame.bytes_below_saved_regs = crtl->outgoing_args_size; ++ poly_int64 offset = crtl->outgoing_args_size; ++ gcc_assert (multiple_p (offset, STACK_BOUNDARY / BITS_PER_UNIT)); ++ frame.bytes_below_saved_regs = offset; + + /* Now assign stack slots for the registers. Start with the predicate + registers, since predicate LDR and STR have a relatively small +@@ -7488,7 +7489,8 @@ aarch64_layout_frame (void) + offset += BYTES_PER_SVE_PRED; + } + +- if (maybe_ne (offset, 0)) ++ poly_int64 saved_prs_size = offset - frame.bytes_below_saved_regs; ++ if (maybe_ne (saved_prs_size, 0)) + { + /* If we have any vector registers to save above the predicate registers, + the offset of the vector register save slots need to be a multiple +@@ -7506,10 +7508,10 @@ aarch64_layout_frame (void) + offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); + else + { +- if (known_le (offset, vector_save_size)) +- offset = vector_save_size; +- else if (known_le (offset, vector_save_size * 2)) +- offset = vector_save_size * 2; ++ if (known_le (saved_prs_size, vector_save_size)) ++ offset = frame.bytes_below_saved_regs + vector_save_size; ++ else if (known_le (saved_prs_size, vector_save_size * 2)) ++ offset = frame.bytes_below_saved_regs + vector_save_size * 2; + else + gcc_unreachable (); + } +@@ -7526,9 +7528,10 @@ aarch64_layout_frame (void) + + /* OFFSET is now the offset of the hard frame pointer from the bottom + of the callee save area. */ +- bool saves_below_hard_fp_p = maybe_ne (offset, 0); +- frame.below_hard_fp_saved_regs_size = offset; +- frame.bytes_below_hard_fp = offset + frame.bytes_below_saved_regs; ++ frame.below_hard_fp_saved_regs_size = offset - frame.bytes_below_saved_regs; ++ bool saves_below_hard_fp_p ++ = maybe_ne (frame.below_hard_fp_saved_regs_size, 0); ++ frame.bytes_below_hard_fp = offset; + if (frame.emit_frame_chain) + { + /* FP and LR are placed in the linkage record. */ +@@ -7579,9 +7582,10 @@ aarch64_layout_frame (void) + + offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); + +- frame.saved_regs_size = offset; ++ frame.saved_regs_size = offset - frame.bytes_below_saved_regs; + +- poly_int64 varargs_and_saved_regs_size = offset + frame.saved_varargs_size; ++ poly_int64 varargs_and_saved_regs_size ++ = frame.saved_regs_size + frame.saved_varargs_size; + + poly_int64 saved_regs_and_above + = aligned_upper_bound (varargs_and_saved_regs_size +@@ -8021,9 +8025,7 @@ aarch64_save_callee_saves (poly_int64 bytes_below_sp, + + machine_mode mode = aarch64_reg_save_mode (regno); + reg = gen_rtx_REG (mode, regno); +- offset = (frame.reg_offset[regno] +- + frame.bytes_below_saved_regs +- - bytes_below_sp); ++ offset = frame.reg_offset[regno] - bytes_below_sp; + rtx base_rtx = stack_pointer_rtx; + poly_int64 sp_offset = offset; + +@@ -8130,9 +8132,7 @@ aarch64_restore_callee_saves (poly_int64 bytes_below_sp, unsigned start, + + machine_mode mode = aarch64_reg_save_mode (regno); + reg = gen_rtx_REG (mode, regno); +- offset = (frame.reg_offset[regno] +- + frame.bytes_below_saved_regs +- - bytes_below_sp); ++ offset = frame.reg_offset[regno] - bytes_below_sp; + rtx base_rtx = stack_pointer_rtx; + if (mode == VNx2DImode && BYTES_BIG_ENDIAN) + aarch64_adjust_sve_callee_save_base (mode, base_rtx, anchor_reg, +@@ -8271,14 +8271,12 @@ aarch64_get_separate_components (void) + it as a stack probe for -fstack-clash-protection. */ + if (flag_stack_clash_protection + && maybe_ne (frame.below_hard_fp_saved_regs_size, 0) +- && known_eq (offset, 0)) ++ && known_eq (offset, frame.bytes_below_saved_regs)) + continue; + + /* Get the offset relative to the register we'll use. */ + if (frame_pointer_needed) +- offset -= frame.below_hard_fp_saved_regs_size; +- else +- offset += frame.bytes_below_saved_regs; ++ offset -= frame.bytes_below_hard_fp; + + /* Check that we can access the stack slot of the register with one + direct load with no adjustments needed. */ +@@ -8425,9 +8423,7 @@ aarch64_process_components (sbitmap components, bool prologue_p) + rtx reg = gen_rtx_REG (mode, regno); + poly_int64 offset = frame.reg_offset[regno]; + if (frame_pointer_needed) +- offset -= frame.below_hard_fp_saved_regs_size; +- else +- offset += frame.bytes_below_saved_regs; ++ offset -= frame.bytes_below_hard_fp; + + rtx addr = plus_constant (Pmode, ptr_reg, offset); + rtx mem = gen_frame_mem (mode, addr); +@@ -8479,9 +8475,7 @@ aarch64_process_components (sbitmap components, bool prologue_p) + /* REGNO2 can be saved/restored in a pair with REGNO. */ + rtx reg2 = gen_rtx_REG (mode, regno2); + if (frame_pointer_needed) +- offset2 -= frame.below_hard_fp_saved_regs_size; +- else +- offset2 += frame.bytes_below_saved_regs; ++ offset2 -= frame.bytes_below_hard_fp; + rtx addr2 = plus_constant (Pmode, ptr_reg, offset2); + rtx mem2 = gen_frame_mem (mode, addr2); + rtx set2 = prologue_p ? gen_rtx_SET (mem2, reg2) +@@ -8597,7 +8591,8 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + if (final_adjustment_p + && known_eq (frame.below_hard_fp_saved_regs_size, 0)) + { +- poly_int64 lr_offset = frame.reg_offset[LR_REGNUM]; ++ poly_int64 lr_offset = (frame.reg_offset[LR_REGNUM] ++ - frame.bytes_below_saved_regs); + if (known_ge (lr_offset, 0)) + min_probe_threshold -= lr_offset.to_constant (); + else +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index 82883ad5a0d..c8ec3d58495 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -826,6 +826,9 @@ extern enum aarch64_processor aarch64_tune; + #ifdef HAVE_POLY_INT_H + struct GTY (()) aarch64_frame + { ++ /* The offset from the bottom of the static frame (the bottom of the ++ outgoing arguments) of each register save slot, or -2 if no save is ++ needed. */ + poly_int64 reg_offset[LAST_SAVED_REGNUM + 1]; + + /* The number of extra stack bytes taken up by register varargs. +-- +2.34.1 + + +From 8b664cc8f05c8130e8ca73a59ae2751cdef8a0ea Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:48 +0100 +Subject: [PATCH 12/19] aarch64: Simplify top of frame allocation + +After previous patches, it no longer really makes sense to allocate +the top of the frame in terms of varargs_and_saved_regs_size and +saved_regs_and_above. + +gcc/ + * config/aarch64/aarch64.c (aarch64_layout_frame): Simplify + the allocation of the top of the frame. +--- + gcc/config/aarch64/aarch64.c | 23 ++++++++--------------- + 1 file changed, 8 insertions(+), 15 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 45ff664cba6..779547d0344 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7584,23 +7584,16 @@ aarch64_layout_frame (void) + + frame.saved_regs_size = offset - frame.bytes_below_saved_regs; + +- poly_int64 varargs_and_saved_regs_size +- = frame.saved_regs_size + frame.saved_varargs_size; +- +- poly_int64 saved_regs_and_above +- = aligned_upper_bound (varargs_and_saved_regs_size +- + get_frame_size (), +- STACK_BOUNDARY / BITS_PER_UNIT); +- +- frame.bytes_above_hard_fp +- = saved_regs_and_above - frame.below_hard_fp_saved_regs_size; ++ offset += get_frame_size (); ++ offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); ++ auto top_of_locals = offset; + +- /* Both these values are already aligned. */ +- gcc_assert (multiple_p (frame.bytes_below_saved_regs, +- STACK_BOUNDARY / BITS_PER_UNIT)); +- frame.frame_size = saved_regs_and_above + frame.bytes_below_saved_regs; ++ offset += frame.saved_varargs_size; ++ gcc_assert (multiple_p (offset, STACK_BOUNDARY / BITS_PER_UNIT)); ++ frame.frame_size = offset; + +- frame.bytes_above_locals = frame.saved_varargs_size; ++ frame.bytes_above_hard_fp = frame.frame_size - frame.bytes_below_hard_fp; ++ frame.bytes_above_locals = frame.frame_size - top_of_locals; + + frame.initial_adjust = 0; + frame.final_adjust = 0; +-- +2.34.1 + + +From bb4600071acc3a02db4f37ffb95c8495ad76a140 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:49 +0100 +Subject: [PATCH 13/19] aarch64: Minor initial adjustment tweak + +This patch just changes a calculation of initial_adjust +to one that makes it slightly more obvious that the total +adjustment is frame.frame_size. + +gcc/ + * config/aarch64/aarch64.c (aarch64_layout_frame): Tweak + calculation of initial_adjust for frames in which all saves + are SVE saves. +--- + gcc/config/aarch64/aarch64.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 779547d0344..0b8992ada74 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7645,11 +7645,10 @@ aarch64_layout_frame (void) + { + /* Frame in which all saves are SVE saves: + +- sub sp, sp, hard_fp_offset + below_hard_fp_saved_regs_size ++ sub sp, sp, frame_size - bytes_below_saved_regs + save SVE registers relative to SP + sub sp, sp, bytes_below_saved_regs */ +- frame.initial_adjust = (frame.bytes_above_hard_fp +- + frame.below_hard_fp_saved_regs_size); ++ frame.initial_adjust = frame.frame_size - frame.bytes_below_saved_regs; + frame.final_adjust = frame.bytes_below_saved_regs; + } + else if (frame.bytes_above_hard_fp.is_constant (&const_above_fp) +-- +2.34.1 + + +From f22329d5efbacf80edf4a2d45ebadd93f283252c Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:49 +0100 +Subject: [PATCH 14/19] aarch64: Tweak stack clash boundary condition + +The AArch64 ABI says that, when stack clash protection is used, +there can be a maximum of 1KiB of unprobed space at sp on entry +to a function. Therefore, we need to probe when allocating +>= guard_size - 1KiB of data (>= rather than >). This is what +GCC does. + +If an allocation is exactly guard_size bytes, it is enough to allocate +those bytes and probe once at offset 1024. It isn't possible to use a +single probe at any other offset: higher would conmplicate later code, +by leaving more unprobed space than usual, while lower would risk +leaving an entire page unprobed. For simplicity, the code probes all +allocations at offset 1024. + +Some register saves also act as probes. If we need to allocate +more space below the last such register save probe, we need to +probe the allocation if it is > 1KiB. Again, this allocation is +then sometimes (but not always) probed at offset 1024. This sort of +allocation is currently only used for outgoing arguments, which are +rarely this big. + +However, the code also probed if this final outgoing-arguments +allocation was == 1KiB, rather than just > 1KiB. This isn't +necessary, since the register save then probes at offset 1024 +as required. Continuing to probe allocations of exactly 1KiB +would complicate later patches. + +gcc/ + * config/aarch64/aarch64.c (aarch64_allocate_and_probe_stack_space): + Don't probe final allocations that are exactly 1KiB in size (after + unprobed space above the final allocation has been deducted). + +gcc/testsuite/ + * gcc.target/aarch64/stack-check-prologue-17.c: New test. +--- + gcc/config/aarch64/aarch64.c | 4 +- + .../aarch64/stack-check-prologue-17.c | 55 +++++++++++++++++++ + 2 files changed, 58 insertions(+), 1 deletion(-) + create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 0b8992ada74..bfd24876195 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -8564,9 +8564,11 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + HOST_WIDE_INT guard_size + = 1 << param_stack_clash_protection_guard_size; + HOST_WIDE_INT guard_used_by_caller = STACK_CLASH_CALLER_GUARD; ++ HOST_WIDE_INT byte_sp_alignment = STACK_BOUNDARY / BITS_PER_UNIT; ++ gcc_assert (multiple_p (poly_size, byte_sp_alignment)); + HOST_WIDE_INT min_probe_threshold + = (final_adjustment_p +- ? guard_used_by_caller ++ ? guard_used_by_caller + byte_sp_alignment + : guard_size - guard_used_by_caller); + /* When doing the final adjustment for the outgoing arguments, take into + account any unprobed space there is above the current SP. There are +diff --git a/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c +new file mode 100644 +index 00000000000..0d8a25d73a2 +--- /dev/null ++++ b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c +@@ -0,0 +1,55 @@ ++/* { dg-options "-O2 -fstack-clash-protection -fomit-frame-pointer --param stack-clash-protection-guard-size=12" } */ ++/* { dg-final { check-function-bodies "**" "" } } */ ++ ++void f(int, ...); ++void g(); ++ ++/* ++** test1: ++** ... ++** str x30, \[sp\] ++** sub sp, sp, #1024 ++** cbnz w0, .* ++** bl g ++** ... ++*/ ++int test1(int z) { ++ __uint128_t x = 0; ++ int y[0x400]; ++ if (z) ++ { ++ f(0, 0, 0, 0, 0, 0, 0, &y, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x); ++ } ++ g(); ++ return 1; ++} ++ ++/* ++** test2: ++** ... ++** str x30, \[sp\] ++** sub sp, sp, #1040 ++** str xzr, \[sp\] ++** cbnz w0, .* ++** bl g ++** ... ++*/ ++int test2(int z) { ++ __uint128_t x = 0; ++ int y[0x400]; ++ if (z) ++ { ++ f(0, 0, 0, 0, 0, 0, 0, &y, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x); ++ } ++ g(); ++ return 1; ++} +-- +2.34.1 + + +From 174a9747491e591ef2abb3e20a0332303f11003a Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:49 +0100 +Subject: [PATCH 15/19] aarch64: Put LR save probe in first 16 bytes + +-fstack-clash-protection uses the save of LR as a probe for the next +allocation. The next allocation could be: + +* another part of the static frame, e.g. when allocating SVE save slots + or outgoing arguments + +* an alloca in the same function + +* an allocation made by a callee function + +However, when -fomit-frame-pointer is used, the LR save slot is placed +above the other GPR save slots. It could therefore be up to 80 bytes +above the base of the GPR save area (which is also the hard fp address). + +aarch64_allocate_and_probe_stack_space took this into account when +deciding how much subsequent space could be allocated without needing +a probe. However, it interacted badly with: + + /* If doing a small final adjustment, we always probe at offset 0. + This is done to avoid issues when LR is not at position 0 or when + the final adjustment is smaller than the probing offset. */ + else if (final_adjustment_p && rounded_size == 0) + residual_probe_offset = 0; + +which forces any allocation that is smaller than the guard page size +to be probed at offset 0 rather than the usual offset 1024. It was +therefore possible to construct cases in which we had: + +* a probe using LR at SP + 80 bytes (or some other value >= 16) +* an allocation of the guard page size - 16 bytes +* a probe at SP + 0 + +which allocates guard page size + 64 consecutive unprobed bytes. + +This patch requires the LR probe to be in the first 16 bytes of the +save area when stack clash protection is active. Doing it +unconditionally would cause code-quality regressions, but a later +patch deals with that. + +The new comment doesn't say that the probe register is required +to be LR, since a later patch removes that restriction. + +gcc/ + * config/aarch64/aarch64.c (aarch64_layout_frame): Ensure that + the LR save slot is in the first 16 bytes of the register save area. + (aarch64_allocate_and_probe_stack_space): Remove workaround for + when LR was not in the first 16 bytes. + +gcc/testsuite/ + * gcc.target/aarch64/stack-check-prologue-18.c: New test. +--- + gcc/config/aarch64/aarch64.c | 61 ++++------- + .../aarch64/stack-check-prologue-18.c | 100 ++++++++++++++++++ + 2 files changed, 123 insertions(+), 38 deletions(-) + create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index bfd24876195..3f2b10de987 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7532,26 +7532,34 @@ aarch64_layout_frame (void) + bool saves_below_hard_fp_p + = maybe_ne (frame.below_hard_fp_saved_regs_size, 0); + frame.bytes_below_hard_fp = offset; ++ ++ auto allocate_gpr_slot = [&](unsigned int regno) ++ { ++ frame.reg_offset[regno] = offset; ++ if (frame.wb_candidate1 == INVALID_REGNUM) ++ frame.wb_candidate1 = regno; ++ else if (frame.wb_candidate2 == INVALID_REGNUM) ++ frame.wb_candidate2 = regno; ++ offset += UNITS_PER_WORD; ++ }; ++ + if (frame.emit_frame_chain) + { + /* FP and LR are placed in the linkage record. */ +- frame.reg_offset[R29_REGNUM] = offset; +- frame.wb_candidate1 = R29_REGNUM; +- frame.reg_offset[R30_REGNUM] = offset + UNITS_PER_WORD; +- frame.wb_candidate2 = R30_REGNUM; +- offset += 2 * UNITS_PER_WORD; ++ allocate_gpr_slot (R29_REGNUM); ++ allocate_gpr_slot (R30_REGNUM); + } ++ else if (flag_stack_clash_protection ++ && known_eq (frame.reg_offset[R30_REGNUM], SLOT_REQUIRED)) ++ /* Put the LR save slot first, since it makes a good choice of probe ++ for stack clash purposes. The idea is that the link register usually ++ has to be saved before a call anyway, and so we lose little by ++ stopping it from being individually shrink-wrapped. */ ++ allocate_gpr_slot (R30_REGNUM); + + for (regno = R0_REGNUM; regno <= R30_REGNUM; regno++) + if (known_eq (frame.reg_offset[regno], SLOT_REQUIRED)) +- { +- frame.reg_offset[regno] = offset; +- if (frame.wb_candidate1 == INVALID_REGNUM) +- frame.wb_candidate1 = regno; +- else if (frame.wb_candidate2 == INVALID_REGNUM) +- frame.wb_candidate2 = regno; +- offset += UNITS_PER_WORD; +- } ++ allocate_gpr_slot (regno); + + poly_int64 max_int_offset = offset; + offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); +@@ -8570,29 +8578,6 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + = (final_adjustment_p + ? guard_used_by_caller + byte_sp_alignment + : guard_size - guard_used_by_caller); +- /* When doing the final adjustment for the outgoing arguments, take into +- account any unprobed space there is above the current SP. There are +- two cases: +- +- - When saving SVE registers below the hard frame pointer, we force +- the lowest save to take place in the prologue before doing the final +- adjustment (i.e. we don't allow the save to be shrink-wrapped). +- This acts as a probe at SP, so there is no unprobed space. +- +- - When there are no SVE register saves, we use the store of the link +- register as a probe. We can't assume that LR was saved at position 0 +- though, so treat any space below it as unprobed. */ +- if (final_adjustment_p +- && known_eq (frame.below_hard_fp_saved_regs_size, 0)) +- { +- poly_int64 lr_offset = (frame.reg_offset[LR_REGNUM] +- - frame.bytes_below_saved_regs); +- if (known_ge (lr_offset, 0)) +- min_probe_threshold -= lr_offset.to_constant (); +- else +- gcc_assert (!flag_stack_clash_protection || known_eq (poly_size, 0)); +- } +- + poly_int64 frame_size = frame.frame_size; + + /* We should always have a positive probe threshold. */ +@@ -8772,8 +8757,8 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + if (final_adjustment_p && rounded_size != 0) + min_probe_threshold = 0; + /* If doing a small final adjustment, we always probe at offset 0. +- This is done to avoid issues when LR is not at position 0 or when +- the final adjustment is smaller than the probing offset. */ ++ This is done to avoid issues when the final adjustment is smaller ++ than the probing offset. */ + else if (final_adjustment_p && rounded_size == 0) + residual_probe_offset = 0; + +diff --git a/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c +new file mode 100644 +index 00000000000..82447d20fff +--- /dev/null ++++ b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c +@@ -0,0 +1,100 @@ ++/* { dg-options "-O2 -fstack-clash-protection -fomit-frame-pointer --param stack-clash-protection-guard-size=12" } */ ++/* { dg-final { check-function-bodies "**" "" } } */ ++ ++void f(int, ...); ++void g(); ++ ++/* ++** test1: ++** ... ++** str x30, \[sp\] ++** sub sp, sp, #4064 ++** str xzr, \[sp\] ++** cbnz w0, .* ++** bl g ++** ... ++** str x26, \[sp, #?4128\] ++** ... ++*/ ++int test1(int z) { ++ __uint128_t x = 0; ++ int y[0x400]; ++ if (z) ++ { ++ asm volatile ("" ::: ++ "x19", "x20", "x21", "x22", "x23", "x24", "x25", "x26"); ++ f(0, 0, 0, 0, 0, 0, 0, &y, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x); ++ } ++ g(); ++ return 1; ++} ++ ++/* ++** test2: ++** ... ++** str x30, \[sp\] ++** sub sp, sp, #1040 ++** str xzr, \[sp\] ++** cbnz w0, .* ++** bl g ++** ... ++*/ ++int test2(int z) { ++ __uint128_t x = 0; ++ int y[0x400]; ++ if (z) ++ { ++ asm volatile ("" ::: ++ "x19", "x20", "x21", "x22", "x23", "x24", "x25", "x26"); ++ f(0, 0, 0, 0, 0, 0, 0, &y, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x); ++ } ++ g(); ++ return 1; ++} ++ ++/* ++** test3: ++** ... ++** str x30, \[sp\] ++** sub sp, sp, #1024 ++** cbnz w0, .* ++** bl g ++** ... ++*/ ++int test3(int z) { ++ __uint128_t x = 0; ++ int y[0x400]; ++ if (z) ++ { ++ asm volatile ("" ::: ++ "x19", "x20", "x21", "x22", "x23", "x24", "x25", "x26"); ++ f(0, 0, 0, 0, 0, 0, 0, &y, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, ++ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x); ++ } ++ g(); ++ return 1; ++} +-- +2.34.1 + + +From e932e11c353be52256dd30d30d924f4e834e3ca3 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:51 +0100 +Subject: [PATCH 16/19] aarch64: Simplify probe of final frame allocation + +Previous patches ensured that the final frame allocation only needs +a probe when the size is strictly greater than 1KiB. It's therefore +safe to use the normal 1024 probe offset in all cases. + +The main motivation for doing this is to simplify the code and +remove the number of special cases. + +gcc/ + * config/aarch64/aarch64.c (aarch64_allocate_and_probe_stack_space): + Always probe the residual allocation at offset 1024, asserting + that that is in range. + +gcc/testsuite/ + * gcc.target/aarch64/stack-check-prologue-17.c: Expect the probe + to be at offset 1024 rather than offset 0. + * gcc.target/aarch64/stack-check-prologue-18.c: Likewise. +--- + gcc/config/aarch64/aarch64.c | 12 ++++-------- + .../gcc.target/aarch64/stack-check-prologue-17.c | 2 +- + .../gcc.target/aarch64/stack-check-prologue-18.c | 4 ++-- + 3 files changed, 7 insertions(+), 11 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 3f2b10de987..4b9cd687525 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -8751,16 +8751,12 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + are still safe. */ + if (residual) + { +- HOST_WIDE_INT residual_probe_offset = guard_used_by_caller; ++ gcc_assert (guard_used_by_caller + byte_sp_alignment <= size); ++ + /* If we're doing final adjustments, and we've done any full page + allocations then any residual needs to be probed. */ + if (final_adjustment_p && rounded_size != 0) + min_probe_threshold = 0; +- /* If doing a small final adjustment, we always probe at offset 0. +- This is done to avoid issues when the final adjustment is smaller +- than the probing offset. */ +- else if (final_adjustment_p && rounded_size == 0) +- residual_probe_offset = 0; + + aarch64_sub_sp (temp1, temp2, residual, frame_related_p); + if (residual >= min_probe_threshold) +@@ -8771,8 +8767,8 @@ aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2, + HOST_WIDE_INT_PRINT_DEC " bytes, probing will be required." + "\n", residual); + +- emit_stack_probe (plus_constant (Pmode, stack_pointer_rtx, +- residual_probe_offset)); ++ emit_stack_probe (plus_constant (Pmode, stack_pointer_rtx, ++ guard_used_by_caller)); + emit_insn (gen_blockage ()); + } + } +diff --git a/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c +index 0d8a25d73a2..f0ec1389771 100644 +--- a/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c ++++ b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c +@@ -33,7 +33,7 @@ int test1(int z) { + ** ... + ** str x30, \[sp\] + ** sub sp, sp, #1040 +-** str xzr, \[sp\] ++** str xzr, \[sp, #?1024\] + ** cbnz w0, .* + ** bl g + ** ... +diff --git a/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c +index 82447d20fff..6383bec5ebc 100644 +--- a/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c ++++ b/gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c +@@ -9,7 +9,7 @@ void g(); + ** ... + ** str x30, \[sp\] + ** sub sp, sp, #4064 +-** str xzr, \[sp\] ++** str xzr, \[sp, #?1024\] + ** cbnz w0, .* + ** bl g + ** ... +@@ -50,7 +50,7 @@ int test1(int z) { + ** ... + ** str x30, \[sp\] + ** sub sp, sp, #1040 +-** str xzr, \[sp\] ++** str xzr, \[sp, #?1024\] + ** cbnz w0, .* + ** bl g + ** ... +-- +2.34.1 + + +From 9ed9fd54b2b471745c9489e83496c091a7b64904 Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:52 +0100 +Subject: [PATCH 17/19] aarch64: Explicitly record probe registers in frame + info + +The stack frame is currently divided into three areas: + +A: the area above the hard frame pointer +B: the SVE saves below the hard frame pointer +C: the outgoing arguments + +If the stack frame is allocated in one chunk, the allocation needs a +probe if the frame size is >= guard_size - 1KiB. In addition, if the +function is not a leaf function, it must probe an address no more than +1KiB above the outgoing SP. We ensured the second condition by + +(1) using single-chunk allocations for non-leaf functions only if + the link register save slot is within 512 bytes of the bottom + of the frame; and + +(2) using the link register save as a probe (meaning, for instance, + that it can't be individually shrink wrapped) + +If instead the stack is allocated in multiple chunks, then: + +* an allocation involving only the outgoing arguments (C above) requires + a probe if the allocation size is > 1KiB + +* any other allocation requires a probe if the allocation size + is >= guard_size - 1KiB + +* second and subsequent allocations require the previous allocation + to probe at the bottom of the allocated area, regardless of the size + of that previous allocation + +The final point means that, unlike for single allocations, +it can be necessary to have both a non-SVE register probe and +an SVE register probe. For example: + +* allocate A, probe using a non-SVE register save +* allocate B, probe using an SVE register save +* allocate C + +The non-SVE register used in this case was again the link register. +It was previously used even if the link register save slot was some +bytes above the bottom of the non-SVE register saves, but an earlier +patch avoided that by putting the link register save slot first. + +As a belt-and-braces fix, this patch explicitly records which +probe registers we're using and allows the non-SVE probe to be +whichever register comes first (as for SVE). + +The patch also avoids unnecessary probes in sve/pcs/stack_clash_3.c. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::sve_save_and_probe) + (aarch64_frame::hard_fp_save_and_probe): New fields. + * config/aarch64/aarch64.c (aarch64_layout_frame): Initialize them. + Rather than asserting that a leaf function saves LR, instead assert + that a leaf function saves something. + (aarch64_get_separate_components): Prevent the chosen probe + registers from being individually shrink-wrapped. + (aarch64_allocate_and_probe_stack_space): Remove workaround for + probe registers that aren't at the bottom of the previous allocation. + +gcc/testsuite/ + * gcc.target/aarch64/sve/pcs/stack_clash_3.c: Avoid redundant probes. +--- + gcc/config/aarch64/aarch64.c | 68 +++++++++++++++---- + gcc/config/aarch64/aarch64.h | 8 +++ + .../aarch64/sve/pcs/stack_clash_3.c | 6 +- + 3 files changed, 64 insertions(+), 18 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 4b9cd687525..ef4b3b671ba 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7469,15 +7469,11 @@ aarch64_layout_frame (void) + && !crtl->abi->clobbers_full_reg_p (regno)) + frame.reg_offset[regno] = SLOT_REQUIRED; + +- /* With stack-clash, LR must be saved in non-leaf functions. The saving of +- LR counts as an implicit probe which allows us to maintain the invariant +- described in the comment at expand_prologue. */ +- gcc_assert (crtl->is_leaf +- || maybe_ne (frame.reg_offset[R30_REGNUM], SLOT_NOT_REQUIRED)); + + poly_int64 offset = crtl->outgoing_args_size; + gcc_assert (multiple_p (offset, STACK_BOUNDARY / BITS_PER_UNIT)); + frame.bytes_below_saved_regs = offset; ++ frame.sve_save_and_probe = INVALID_REGNUM; + + /* Now assign stack slots for the registers. Start with the predicate + registers, since predicate LDR and STR have a relatively small +@@ -7485,6 +7481,8 @@ aarch64_layout_frame (void) + for (regno = P0_REGNUM; regno <= P15_REGNUM; regno++) + if (known_eq (frame.reg_offset[regno], SLOT_REQUIRED)) + { ++ if (frame.sve_save_and_probe == INVALID_REGNUM) ++ frame.sve_save_and_probe = regno; + frame.reg_offset[regno] = offset; + offset += BYTES_PER_SVE_PRED; + } +@@ -7522,6 +7520,8 @@ aarch64_layout_frame (void) + for (regno = V0_REGNUM; regno <= V31_REGNUM; regno++) + if (known_eq (frame.reg_offset[regno], SLOT_REQUIRED)) + { ++ if (frame.sve_save_and_probe == INVALID_REGNUM) ++ frame.sve_save_and_probe = regno; + frame.reg_offset[regno] = offset; + offset += vector_save_size; + } +@@ -7531,10 +7531,18 @@ aarch64_layout_frame (void) + frame.below_hard_fp_saved_regs_size = offset - frame.bytes_below_saved_regs; + bool saves_below_hard_fp_p + = maybe_ne (frame.below_hard_fp_saved_regs_size, 0); ++ gcc_assert (!saves_below_hard_fp_p ++ || (frame.sve_save_and_probe != INVALID_REGNUM ++ && known_eq (frame.reg_offset[frame.sve_save_and_probe], ++ frame.bytes_below_saved_regs))); ++ + frame.bytes_below_hard_fp = offset; ++ frame.hard_fp_save_and_probe = INVALID_REGNUM; + + auto allocate_gpr_slot = [&](unsigned int regno) + { ++ if (frame.hard_fp_save_and_probe == INVALID_REGNUM) ++ frame.hard_fp_save_and_probe = regno; + frame.reg_offset[regno] = offset; + if (frame.wb_candidate1 == INVALID_REGNUM) + frame.wb_candidate1 = regno; +@@ -7568,6 +7576,8 @@ aarch64_layout_frame (void) + for (regno = V0_REGNUM; regno <= V31_REGNUM; regno++) + if (known_eq (frame.reg_offset[regno], SLOT_REQUIRED)) + { ++ if (frame.hard_fp_save_and_probe == INVALID_REGNUM) ++ frame.hard_fp_save_and_probe = regno; + /* If there is an alignment gap between integer and fp callee-saves, + allocate the last fp register to it if possible. */ + if (regno == last_fp_reg +@@ -7591,6 +7601,17 @@ aarch64_layout_frame (void) + offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); + + frame.saved_regs_size = offset - frame.bytes_below_saved_regs; ++ gcc_assert (known_eq (frame.saved_regs_size, ++ frame.below_hard_fp_saved_regs_size) ++ || (frame.hard_fp_save_and_probe != INVALID_REGNUM ++ && known_eq (frame.reg_offset[frame.hard_fp_save_and_probe], ++ frame.bytes_below_hard_fp))); ++ ++ /* With stack-clash, a register must be saved in non-leaf functions. ++ The saving of the bottommost register counts as an implicit probe, ++ which allows us to maintain the invariant described in the comment ++ at expand_prologue. */ ++ gcc_assert (crtl->is_leaf || maybe_ne (frame.saved_regs_size, 0)); + + offset += get_frame_size (); + offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); +@@ -7690,6 +7711,25 @@ aarch64_layout_frame (void) + frame.final_adjust = frame.bytes_below_saved_regs; + } + ++ /* The frame is allocated in pieces, with each non-final piece ++ including a register save at offset 0 that acts as a probe for ++ the following piece. In addition, the save of the bottommost register ++ acts as a probe for callees and allocas. Roll back any probes that ++ aren't needed. ++ ++ A probe isn't needed if it is associated with the final allocation ++ (including callees and allocas) that happens before the epilogue is ++ executed. */ ++ if (crtl->is_leaf ++ && !cfun->calls_alloca ++ && known_eq (frame.final_adjust, 0)) ++ { ++ if (maybe_ne (frame.sve_callee_adjust, 0)) ++ frame.sve_save_and_probe = INVALID_REGNUM; ++ else ++ frame.hard_fp_save_and_probe = INVALID_REGNUM; ++ } ++ + /* Make sure the individual adjustments add up to the full frame size. */ + gcc_assert (known_eq (frame.initial_adjust + + frame.callee_adjust +@@ -8267,13 +8307,6 @@ aarch64_get_separate_components (void) + + poly_int64 offset = frame.reg_offset[regno]; + +- /* If the register is saved in the first SVE save slot, we use +- it as a stack probe for -fstack-clash-protection. */ +- if (flag_stack_clash_protection +- && maybe_ne (frame.below_hard_fp_saved_regs_size, 0) +- && known_eq (offset, frame.bytes_below_saved_regs)) +- continue; +- + /* Get the offset relative to the register we'll use. */ + if (frame_pointer_needed) + offset -= frame.bytes_below_hard_fp; +@@ -8308,6 +8341,13 @@ aarch64_get_separate_components (void) + + bitmap_clear_bit (components, LR_REGNUM); + bitmap_clear_bit (components, SP_REGNUM); ++ if (flag_stack_clash_protection) ++ { ++ if (frame.sve_save_and_probe != INVALID_REGNUM) ++ bitmap_clear_bit (components, frame.sve_save_and_probe); ++ if (frame.hard_fp_save_and_probe != INVALID_REGNUM) ++ bitmap_clear_bit (components, frame.hard_fp_save_and_probe); ++ } + + return components; + } +@@ -8844,8 +8884,8 @@ aarch64_epilogue_uses (int regno) + When probing is needed, we emit a probe at the start of the prologue + and every PARAM_STACK_CLASH_PROTECTION_GUARD_SIZE bytes thereafter. + +- We have to track how much space has been allocated and the only stores +- to the stack we track as implicit probes are the FP/LR stores. ++ We can also use register saves as probes. These are stored in ++ sve_save_and_probe and hard_fp_save_and_probe. + + For outgoing arguments we probe if the size is larger than 1KB, such that + the ABI specified buffer is maintained for the next callee. +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index c8ec3d58495..97173e48598 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -911,6 +911,14 @@ struct GTY (()) aarch64_frame + This is the register they should use. */ + unsigned spare_pred_reg; + ++ /* An SVE register that is saved below the hard frame pointer and that acts ++ as a probe for later allocations, or INVALID_REGNUM if none. */ ++ unsigned sve_save_and_probe; ++ ++ /* A register that is saved at the hard frame pointer and that acts ++ as a probe for later allocations, or INVALID_REGNUM if none. */ ++ unsigned hard_fp_save_and_probe; ++ + bool laid_out; + }; + +diff --git a/gcc/testsuite/gcc.target/aarch64/sve/pcs/stack_clash_3.c b/gcc/testsuite/gcc.target/aarch64/sve/pcs/stack_clash_3.c +index 3e01ec36c3a..3530a0d504b 100644 +--- a/gcc/testsuite/gcc.target/aarch64/sve/pcs/stack_clash_3.c ++++ b/gcc/testsuite/gcc.target/aarch64/sve/pcs/stack_clash_3.c +@@ -11,11 +11,10 @@ + ** mov x11, sp + ** ... + ** sub sp, sp, x13 +-** str p4, \[sp\] + ** cbz w0, [^\n]* ++** str p4, \[sp\] + ** ... + ** ptrue p0\.b, all +-** ldr p4, \[sp\] + ** addvl sp, sp, #1 + ** ldr x24, \[sp\], 32 + ** ret +@@ -39,13 +38,12 @@ test_1 (int n) + ** mov x11, sp + ** ... + ** sub sp, sp, x13 +-** str p4, \[sp\] + ** cbz w0, [^\n]* ++** str p4, \[sp\] + ** str p5, \[sp, #1, mul vl\] + ** str p6, \[sp, #2, mul vl\] + ** ... + ** ptrue p0\.b, all +-** ldr p4, \[sp\] + ** addvl sp, sp, #1 + ** ldr x24, \[sp\], 32 + ** ret +-- +2.34.1 + + +From 4bbf7b6cdd02b0d547ddd6a630f2065680bf2f6b Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:52 +0100 +Subject: [PATCH 18/19] aarch64: Remove below_hard_fp_saved_regs_size + +After previous patches, it's no longer necessary to store +saved_regs_size and below_hard_fp_saved_regs_size in the frame info. +All measurements instead use the top or bottom of the frame as +reference points. + +gcc/ + * config/aarch64/aarch64.h (aarch64_frame::saved_regs_size) + (aarch64_frame::below_hard_fp_saved_regs_size): Delete. + * config/aarch64/aarch64.c (aarch64_layout_frame): Update accordingly. +--- + gcc/config/aarch64/aarch64.c | 45 +++++++++++++++++------------------- + gcc/config/aarch64/aarch64.h | 7 ------ + 2 files changed, 21 insertions(+), 31 deletions(-) + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index ef4b3b671ba..385718a475b 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7528,9 +7528,8 @@ aarch64_layout_frame (void) + + /* OFFSET is now the offset of the hard frame pointer from the bottom + of the callee save area. */ +- frame.below_hard_fp_saved_regs_size = offset - frame.bytes_below_saved_regs; +- bool saves_below_hard_fp_p +- = maybe_ne (frame.below_hard_fp_saved_regs_size, 0); ++ auto below_hard_fp_saved_regs_size = offset - frame.bytes_below_saved_regs; ++ bool saves_below_hard_fp_p = maybe_ne (below_hard_fp_saved_regs_size, 0); + gcc_assert (!saves_below_hard_fp_p + || (frame.sve_save_and_probe != INVALID_REGNUM + && known_eq (frame.reg_offset[frame.sve_save_and_probe], +@@ -7600,9 +7599,8 @@ aarch64_layout_frame (void) + + offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); + +- frame.saved_regs_size = offset - frame.bytes_below_saved_regs; +- gcc_assert (known_eq (frame.saved_regs_size, +- frame.below_hard_fp_saved_regs_size) ++ auto saved_regs_size = offset - frame.bytes_below_saved_regs; ++ gcc_assert (known_eq (saved_regs_size, below_hard_fp_saved_regs_size) + || (frame.hard_fp_save_and_probe != INVALID_REGNUM + && known_eq (frame.reg_offset[frame.hard_fp_save_and_probe], + frame.bytes_below_hard_fp))); +@@ -7611,7 +7609,7 @@ aarch64_layout_frame (void) + The saving of the bottommost register counts as an implicit probe, + which allows us to maintain the invariant described in the comment + at expand_prologue. */ +- gcc_assert (crtl->is_leaf || maybe_ne (frame.saved_regs_size, 0)); ++ gcc_assert (crtl->is_leaf || maybe_ne (saved_regs_size, 0)); + + offset += get_frame_size (); + offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); +@@ -7637,7 +7635,7 @@ aarch64_layout_frame (void) + + HOST_WIDE_INT const_size, const_below_saved_regs, const_above_fp; + HOST_WIDE_INT const_saved_regs_size; +- if (known_eq (frame.saved_regs_size, 0)) ++ if (known_eq (saved_regs_size, 0)) + frame.initial_adjust = frame.frame_size; + else if (frame.frame_size.is_constant (&const_size) + && const_size < max_push_offset +@@ -7650,7 +7648,7 @@ aarch64_layout_frame (void) + frame.callee_adjust = const_size; + } + else if (frame.bytes_below_saved_regs.is_constant (&const_below_saved_regs) +- && frame.saved_regs_size.is_constant (&const_saved_regs_size) ++ && saved_regs_size.is_constant (&const_saved_regs_size) + && const_below_saved_regs + const_saved_regs_size < 512 + /* We could handle this case even with data below the saved + registers, provided that that data left us with valid offsets +@@ -7669,8 +7667,7 @@ aarch64_layout_frame (void) + frame.initial_adjust = frame.frame_size; + } + else if (saves_below_hard_fp_p +- && known_eq (frame.saved_regs_size, +- frame.below_hard_fp_saved_regs_size)) ++ && known_eq (saved_regs_size, below_hard_fp_saved_regs_size)) + { + /* Frame in which all saves are SVE saves: + +@@ -7692,7 +7689,7 @@ aarch64_layout_frame (void) + [save SVE registers relative to SP] + sub sp, sp, bytes_below_saved_regs */ + frame.callee_adjust = const_above_fp; +- frame.sve_callee_adjust = frame.below_hard_fp_saved_regs_size; ++ frame.sve_callee_adjust = below_hard_fp_saved_regs_size; + frame.final_adjust = frame.bytes_below_saved_regs; + } + else +@@ -7707,7 +7704,7 @@ aarch64_layout_frame (void) + [save SVE registers relative to SP] + sub sp, sp, bytes_below_saved_regs */ + frame.initial_adjust = frame.bytes_above_hard_fp; +- frame.sve_callee_adjust = frame.below_hard_fp_saved_regs_size; ++ frame.sve_callee_adjust = below_hard_fp_saved_regs_size; + frame.final_adjust = frame.bytes_below_saved_regs; + } + +@@ -8849,17 +8846,17 @@ aarch64_epilogue_uses (int regno) + | local variables | <-- frame_pointer_rtx + | | + +-------------------------------+ +- | padding | \ +- +-------------------------------+ | +- | callee-saved registers | | frame.saved_regs_size +- +-------------------------------+ | +- | LR' | | +- +-------------------------------+ | +- | FP' | | +- +-------------------------------+ |<- hard_frame_pointer_rtx (aligned) +- | SVE vector registers | | \ +- +-------------------------------+ | | below_hard_fp_saved_regs_size +- | SVE predicate registers | / / ++ | padding | ++ +-------------------------------+ ++ | callee-saved registers | ++ +-------------------------------+ ++ | LR' | ++ +-------------------------------+ ++ | FP' | ++ +-------------------------------+ <-- hard_frame_pointer_rtx (aligned) ++ | SVE vector registers | ++ +-------------------------------+ ++ | SVE predicate registers | + +-------------------------------+ + | dynamic allocation | + +-------------------------------+ +diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h +index 97173e48598..9084b1cfb9d 100644 +--- a/gcc/config/aarch64/aarch64.h ++++ b/gcc/config/aarch64/aarch64.h +@@ -837,18 +837,11 @@ struct GTY (()) aarch64_frame + STACK_BOUNDARY. */ + HOST_WIDE_INT saved_varargs_size; + +- /* The size of the callee-save registers with a slot in REG_OFFSET. */ +- poly_int64 saved_regs_size; +- + /* The number of bytes between the bottom of the static frame (the bottom + of the outgoing arguments) and the bottom of the register save area. + This value is always a multiple of STACK_BOUNDARY. */ + poly_int64 bytes_below_saved_regs; + +- /* The size of the callee-save registers with a slot in REG_OFFSET that +- are saved below the hard frame pointer. */ +- poly_int64 below_hard_fp_saved_regs_size; +- + /* The number of bytes between the bottom of the static frame (the bottom + of the outgoing arguments) and the hard frame pointer. This value is + always a multiple of STACK_BOUNDARY. */ +-- +2.34.1 + + +From bea0985749c12fcc264710586addb7838cc61e6d Mon Sep 17 00:00:00 2001 +From: Richard Sandiford <richard.sandiford@arm.com> +Date: Tue, 12 Sep 2023 16:19:52 +0100 +Subject: [PATCH 19/19] aarch64: Make stack smash canary protect saved + registers + +AArch64 normally puts the saved registers near the bottom of the frame, +immediately above any dynamic allocations. But this means that a +stack-smash attack on those dynamic allocations could overwrite the +saved registers without needing to reach as far as the stack smash +canary. + +The same thing could also happen for variable-sized arguments that are +passed by value, since those are allocated before a call and popped on +return. + +This patch avoids that by putting the locals (and thus the canary) below +the saved registers when stack smash protection is active. + +The patch fixes CVE-2023-4039. + +gcc/ + * config/aarch64/aarch64.c (aarch64_save_regs_above_locals_p): + New function. + (aarch64_layout_frame): Use it to decide whether locals should + go above or below the saved registers. + (aarch64_expand_prologue): Update stack layout comment. + Emit a stack tie after the final adjustment. + +gcc/testsuite/ + * gcc.target/aarch64/stack-protector-8.c: New test. + * gcc.target/aarch64/stack-protector-9.c: Likewise. +--- + gcc/config/aarch64/aarch64.c | 46 +++++++-- + .../gcc.target/aarch64/stack-protector-8.c | 95 +++++++++++++++++++ + .../gcc.target/aarch64/stack-protector-9.c | 33 +++++++ + 3 files changed, 168 insertions(+), 6 deletions(-) + create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-protector-8.c + create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-protector-9.c + +diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c +index 385718a475b..3ccfd3c30fc 100644 +--- a/gcc/config/aarch64/aarch64.c ++++ b/gcc/config/aarch64/aarch64.c +@@ -7392,6 +7392,20 @@ aarch64_needs_frame_chain (void) + return aarch64_use_frame_pointer; + } + ++/* Return true if the current function should save registers above ++ the locals area, rather than below it. */ ++ ++static bool ++aarch64_save_regs_above_locals_p () ++{ ++ /* When using stack smash protection, make sure that the canary slot ++ comes between the locals and the saved registers. Otherwise, ++ it would be possible for a carefully sized smash attack to change ++ the saved registers (particularly LR and FP) without reaching the ++ canary. */ ++ return crtl->stack_protect_guard; ++} ++ + /* Mark the registers that need to be saved by the callee and calculate + the size of the callee-saved registers area and frame record (both FP + and LR may be omitted). */ +@@ -7403,6 +7417,7 @@ aarch64_layout_frame (void) + poly_int64 vector_save_size = GET_MODE_SIZE (vector_save_mode); + bool frame_related_fp_reg_p = false; + aarch64_frame &frame = cfun->machine->frame; ++ poly_int64 top_of_locals = -1; + + frame.emit_frame_chain = aarch64_needs_frame_chain (); + +@@ -7469,9 +7484,16 @@ aarch64_layout_frame (void) + && !crtl->abi->clobbers_full_reg_p (regno)) + frame.reg_offset[regno] = SLOT_REQUIRED; + ++ bool regs_at_top_p = aarch64_save_regs_above_locals_p (); + + poly_int64 offset = crtl->outgoing_args_size; + gcc_assert (multiple_p (offset, STACK_BOUNDARY / BITS_PER_UNIT)); ++ if (regs_at_top_p) ++ { ++ offset += get_frame_size (); ++ offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); ++ top_of_locals = offset; ++ } + frame.bytes_below_saved_regs = offset; + frame.sve_save_and_probe = INVALID_REGNUM; + +@@ -7611,15 +7633,18 @@ aarch64_layout_frame (void) + at expand_prologue. */ + gcc_assert (crtl->is_leaf || maybe_ne (saved_regs_size, 0)); + +- offset += get_frame_size (); +- offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); +- auto top_of_locals = offset; +- ++ if (!regs_at_top_p) ++ { ++ offset += get_frame_size (); ++ offset = aligned_upper_bound (offset, STACK_BOUNDARY / BITS_PER_UNIT); ++ top_of_locals = offset; ++ } + offset += frame.saved_varargs_size; + gcc_assert (multiple_p (offset, STACK_BOUNDARY / BITS_PER_UNIT)); + frame.frame_size = offset; + + frame.bytes_above_hard_fp = frame.frame_size - frame.bytes_below_hard_fp; ++ gcc_assert (known_ge (top_of_locals, 0)); + frame.bytes_above_locals = frame.frame_size - top_of_locals; + + frame.initial_adjust = 0; +@@ -8843,10 +8868,10 @@ aarch64_epilogue_uses (int regno) + | for register varargs | + | | + +-------------------------------+ +- | local variables | <-- frame_pointer_rtx ++ | local variables (1) | <-- frame_pointer_rtx + | | + +-------------------------------+ +- | padding | ++ | padding (1) | + +-------------------------------+ + | callee-saved registers | + +-------------------------------+ +@@ -8858,6 +8883,10 @@ aarch64_epilogue_uses (int regno) + +-------------------------------+ + | SVE predicate registers | + +-------------------------------+ ++ | local variables (2) | ++ +-------------------------------+ ++ | padding (2) | ++ +-------------------------------+ + | dynamic allocation | + +-------------------------------+ + | padding | +@@ -8867,6 +8896,9 @@ aarch64_epilogue_uses (int regno) + +-------------------------------+ + | | <-- stack_pointer_rtx (aligned) + ++ The regions marked (1) and (2) are mutually exclusive. (2) is used ++ when aarch64_save_regs_above_locals_p is true. ++ + Dynamic stack allocations via alloca() decrease stack_pointer_rtx + but leave frame_pointer_rtx and hard_frame_pointer_rtx + unchanged. +@@ -9058,6 +9090,8 @@ aarch64_expand_prologue (void) + gcc_assert (known_eq (bytes_below_sp, final_adjust)); + aarch64_allocate_and_probe_stack_space (tmp1_rtx, tmp0_rtx, final_adjust, + !frame_pointer_needed, true); ++ if (emit_frame_chain && maybe_ne (final_adjust, 0)) ++ emit_insn (gen_stack_tie (stack_pointer_rtx, hard_frame_pointer_rtx)); + } + + /* Return TRUE if we can use a simple_return insn. +diff --git a/gcc/testsuite/gcc.target/aarch64/stack-protector-8.c b/gcc/testsuite/gcc.target/aarch64/stack-protector-8.c +new file mode 100644 +index 00000000000..e71d820e365 +--- /dev/null ++++ b/gcc/testsuite/gcc.target/aarch64/stack-protector-8.c +@@ -0,0 +1,95 @@ ++/* { dg-options " -O -fstack-protector-strong -mstack-protector-guard=sysreg -mstack-protector-guard-reg=tpidr2_el0 -mstack-protector-guard-offset=16" } */ ++/* { dg-final { check-function-bodies "**" "" } } */ ++ ++void g(void *); ++__SVBool_t *h(void *); ++ ++/* ++** test1: ++** sub sp, sp, #288 ++** stp x29, x30, \[sp, #?272\] ++** add x29, sp, #?272 ++** mrs (x[0-9]+), tpidr2_el0 ++** ldr (x[0-9]+), \[\1, #?16\] ++** str \2, \[sp, #?264\] ++** mov \2, #?0 ++** add x0, sp, #?8 ++** bl g ++** ... ++** mrs .* ++** ... ++** bne .* ++** ... ++** ldp x29, x30, \[sp, #?272\] ++** add sp, sp, #?288 ++** ret ++** bl __stack_chk_fail ++*/ ++int test1() { ++ int y[0x40]; ++ g(y); ++ return 1; ++} ++ ++/* ++** test2: ++** stp x29, x30, \[sp, #?-16\]! ++** mov x29, sp ++** sub sp, sp, #1040 ++** mrs (x[0-9]+), tpidr2_el0 ++** ldr (x[0-9]+), \[\1, #?16\] ++** str \2, \[sp, #?1032\] ++** mov \2, #?0 ++** add x0, sp, #?8 ++** bl g ++** ... ++** mrs .* ++** ... ++** bne .* ++** ... ++** add sp, sp, #?1040 ++** ldp x29, x30, \[sp\], #?16 ++** ret ++** bl __stack_chk_fail ++*/ ++int test2() { ++ int y[0x100]; ++ g(y); ++ return 1; ++} ++ ++#pragma GCC target "+sve" ++ ++/* ++** test3: ++** stp x29, x30, \[sp, #?-16\]! ++** mov x29, sp ++** addvl sp, sp, #-18 ++** ... ++** str p4, \[sp\] ++** ... ++** sub sp, sp, #272 ++** mrs (x[0-9]+), tpidr2_el0 ++** ldr (x[0-9]+), \[\1, #?16\] ++** str \2, \[sp, #?264\] ++** mov \2, #?0 ++** add x0, sp, #?8 ++** bl h ++** ... ++** mrs .* ++** ... ++** bne .* ++** ... ++** add sp, sp, #?272 ++** ... ++** ldr p4, \[sp\] ++** ... ++** addvl sp, sp, #18 ++** ldp x29, x30, \[sp\], #?16 ++** ret ++** bl __stack_chk_fail ++*/ ++__SVBool_t test3() { ++ int y[0x40]; ++ return *h(y); ++} +diff --git a/gcc/testsuite/gcc.target/aarch64/stack-protector-9.c b/gcc/testsuite/gcc.target/aarch64/stack-protector-9.c +new file mode 100644 +index 00000000000..58f322aa480 +--- /dev/null ++++ b/gcc/testsuite/gcc.target/aarch64/stack-protector-9.c +@@ -0,0 +1,33 @@ ++/* { dg-options "-O2 -mcpu=neoverse-v1 -fstack-protector-all" } */ ++/* { dg-final { check-function-bodies "**" "" } } */ ++ ++/* ++** main: ++** ... ++** stp x29, x30, \[sp, #?-[0-9]+\]! ++** ... ++** sub sp, sp, #[0-9]+ ++** ... ++** str x[0-9]+, \[x29, #?-8\] ++** ... ++*/ ++int f(const char *); ++void g(void *); ++int main(int argc, char* argv[]) ++{ ++ int a; ++ int b; ++ char c[2+f(argv[1])]; ++ int d[0x100]; ++ char y; ++ ++ y=42; a=4; b=10; ++ c[0] = 'h'; c[1] = '\0'; ++ ++ c[f(argv[2])] = '\0'; ++ ++ __builtin_printf("%d %d\n%s\n", a, b, c); ++ g(d); ++ ++ return 0; ++} +-- +2.34.1 + diff --git a/meta/recipes-devtools/gcc/gcc_11.3.bb b/meta/recipes-devtools/gcc/gcc_11.4.bb index 255fe552bd..255fe552bd 100644 --- a/meta/recipes-devtools/gcc/gcc_11.3.bb +++ b/meta/recipes-devtools/gcc/gcc_11.4.bb diff --git a/meta/recipes-devtools/gcc/libgcc-initial_11.3.bb b/meta/recipes-devtools/gcc/libgcc-initial_11.4.bb index a259082b47..a259082b47 100644 --- a/meta/recipes-devtools/gcc/libgcc-initial_11.3.bb +++ b/meta/recipes-devtools/gcc/libgcc-initial_11.4.bb diff --git a/meta/recipes-devtools/gcc/libgcc_11.3.bb b/meta/recipes-devtools/gcc/libgcc_11.4.bb index f88963b0a4..f88963b0a4 100644 --- a/meta/recipes-devtools/gcc/libgcc_11.3.bb +++ b/meta/recipes-devtools/gcc/libgcc_11.4.bb diff --git a/meta/recipes-devtools/gcc/libgfortran_11.3.bb b/meta/recipes-devtools/gcc/libgfortran_11.4.bb index 71dd8b4bdc..71dd8b4bdc 100644 --- a/meta/recipes-devtools/gcc/libgfortran_11.3.bb +++ b/meta/recipes-devtools/gcc/libgfortran_11.4.bb diff --git a/meta/recipes-devtools/gdb/gdb.inc b/meta/recipes-devtools/gdb/gdb.inc index 649ee28727..6c9fe60cab 100644 --- a/meta/recipes-devtools/gdb/gdb.inc +++ b/meta/recipes-devtools/gdb/gdb.inc @@ -14,5 +14,8 @@ SRC_URI = "${GNU_MIRROR}/gdb/gdb-${PV}.tar.xz \ file://0008-resolve-restrict-keyword-conflict.patch \ file://0009-Fix-invalid-sigprocmask-call.patch \ file://0010-gdbserver-ctrl-c-handling.patch \ + file://0011-CVE-2023-39128.patch \ + file://0012-CVE-2023-39129.patch \ + file://0013-CVE-2023-39130.patch \ " SRC_URI[sha256sum] = "1497c36a71881b8671a9a84a0ee40faab788ca30d7ba19d8463c3cc787152e32" diff --git a/meta/recipes-devtools/gdb/gdb/0011-CVE-2023-39128.patch b/meta/recipes-devtools/gdb/gdb/0011-CVE-2023-39128.patch new file mode 100644 index 0000000000..53b49cb21d --- /dev/null +++ b/meta/recipes-devtools/gdb/gdb/0011-CVE-2023-39128.patch @@ -0,0 +1,75 @@ +From 033bc52bb6190393c8eed80925fa78cc35b40c6d Mon Sep 17 00:00:00 2001 +From: Tom Tromey <tromey@adacore.com> +Date: Wed, 16 Aug 2023 11:29:19 -0600 +Subject: [PATCH] Avoid buffer overflow in ada_decode + +A bug report pointed out a buffer overflow in ada_decode, which Keith +helpfully analyzed. ada_decode had a logic error when the input was +all digits. While this isn't valid -- and would probably only appear +in fuzzer tests -- it still should be handled properly. + +This patch adds a missing bounds check. Tested with the self-tests in +an asan build. + +Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30639 +Reviewed-by: Keith Seitz <keiths@redhat.com> + +Upstream-Status: Backport from [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=033bc52bb6190393c8eed80925fa78cc35b40c6d] +CVE: CVE-2023-39128 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + gdb/ada-lang.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/gdb/ada-lang.c b/gdb/ada-lang.c +index 70a2b44..f682302 100644 +--- a/gdb/ada-lang.c ++++ b/gdb/ada-lang.c +@@ -57,6 +57,7 @@ + #include "cli/cli-utils.h" + #include "gdbsupport/function-view.h" + #include "gdbsupport/byte-vector.h" ++#include "gdbsupport/selftest.h" + #include <algorithm> + #include "ada-exp.h" + +@@ -1057,7 +1058,7 @@ ada_decode (const char *encoded, bool wrap) + i -= 1; + if (i > 1 && encoded[i] == '_' && encoded[i - 1] == '_') + len0 = i - 1; +- else if (encoded[i] == '$') ++ else if (i >= 0 && encoded[i] == '$') + len0 = i; + } + +@@ -1225,6 +1226,18 @@ ada_decode (const char *encoded, bool wrap) + return decoded; + } + ++#ifdef GDB_SELF_TEST ++ ++static void ++ada_decode_tests () ++{ ++ /* This isn't valid, but used to cause a crash. PR gdb/30639. The ++ result does not really matter very much. */ ++ SELF_CHECK (ada_decode ("44") == "44"); ++} ++ ++#endif ++ + /* Table for keeping permanent unique copies of decoded names. Once + allocated, names in this table are never released. While this is a + storage leak, it should not be significant unless there are massive +@@ -13497,4 +13510,8 @@ DWARF attribute."), + gdb::observers::new_objfile.attach (ada_new_objfile_observer, "ada-lang"); + gdb::observers::free_objfile.attach (ada_free_objfile_observer, "ada-lang"); + gdb::observers::inferior_exit.attach (ada_inferior_exit, "ada-lang"); ++ ++#ifdef GDB_SELF_TEST ++ selftests::register_test ("ada-decode", ada_decode_tests); ++#endif + } +-- +2.35.7 + diff --git a/meta/recipes-devtools/gdb/gdb/0012-CVE-2023-39129.patch b/meta/recipes-devtools/gdb/gdb/0012-CVE-2023-39129.patch new file mode 100644 index 0000000000..63fb44d59a --- /dev/null +++ b/meta/recipes-devtools/gdb/gdb/0012-CVE-2023-39129.patch @@ -0,0 +1,50 @@ +From: Keith Seitz <keiths@...> +Date: Wed, 2 Aug 2023 15:35:11 +0000 (-0700) +Subject: Verify COFF symbol stringtab offset +X-Git-Tag: gdb-14-branchpoint~473 +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=58abdf887821a5da09ba184c6e400a3bc5cccd5a + +Verify COFF symbol stringtab offset + +This patch addresses an issue with malformed/fuzzed debug information that +was recently reported in gdb/30639. That bug specifically deals with +an ASAN issue, but the reproducer provided by the reporter causes a +another failure outside of ASAN: + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=58abdf887821a5da09ba184c6e400a3bc5cccd5a] + +CVE: CVE-2023-39129 + +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> + +diff --git a/gdb/coffread.c b/gdb/coffread.c +--- a/gdb/coffread.c ++++ b/gdb/coffread.c +@@ -159,6 +160,7 @@ static file_ptr linetab_offset; + static file_ptr linetab_size; + + static char *stringtab = NULL; ++static long stringtab_length = 0; + + extern void stabsread_clear_cache (void); + +@@ -1303,6 +1298,7 @@ init_stringtab (bfd *abfd, file_ptr offset, gdb::unique_xmalloc_ptr<char> *stora + /* This is in target format (probably not very useful, and not + currently used), not host format. */ + memcpy (stringtab, lengthbuf, sizeof lengthbuf); ++ stringtab_length = length; + if (length == sizeof length) /* Empty table -- just the count. */ + return 0; + +@@ -1322,8 +1318,9 @@ getsymname (struct internal_syment *symbol_entry) + + if (symbol_entry->_n._n_n._n_zeroes == 0) + { +- /* FIXME: Probably should be detecting corrupt symbol files by +- seeing whether offset points to within the stringtab. */ ++ if (symbol_entry->_n._n_n._n_offset > stringtab_length) ++ error (_("COFF Error: string table offset (%ld) outside string table (length %ld)"), ++ symbol_entry->_n._n_n._n_offset, stringtab_length); + result = stringtab + symbol_entry->_n._n_n._n_offset; + } + else diff --git a/meta/recipes-devtools/gdb/gdb/0013-CVE-2023-39130.patch b/meta/recipes-devtools/gdb/gdb/0013-CVE-2023-39130.patch new file mode 100644 index 0000000000..bfd5b18d7d --- /dev/null +++ b/meta/recipes-devtools/gdb/gdb/0013-CVE-2023-39130.patch @@ -0,0 +1,326 @@ +From 2db20b97f1dc3e5dce3d6ed74a8a62f0dede8c80 Mon Sep 17 00:00:00 2001 +From: Alan Modra <amodra@gmail.com> +Date: Wed, 9 Aug 2023 09:58:36 +0930 +Subject: [PATCH] gdb: warn unused result for bfd IO functions + +This fixes the compilation warnings introduced by my bfdio.c patch. + +The removed bfd_seeks in coff_symfile_read date back to 1994, commit +7f4c859520, prior to which the file used stdio rather than bfd to read +symbols. Since it now uses bfd to read the file there should be no +need to synchronise to bfd's idea of the file position. I also fixed +a potential uninitialised memory access. + +Approved-By: Andrew Burgess <aburgess@redhat.com> + +Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=2db20b97f1dc3e5dce3d6ed74a8a62f0dede8c80] +CVE: CVE-2023-39130 +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> +--- + gdb/coff-pe-read.c | 114 +++++++++++++++++++++++++++++---------------- + gdb/coffread.c | 27 ++--------- + gdb/dbxread.c | 7 +-- + gdb/xcoffread.c | 5 +- + 4 files changed, 85 insertions(+), 68 deletions(-) + +diff --git a/gdb/coff-pe-read.c b/gdb/coff-pe-read.c +--- a/gdb/coff-pe-read.c ++++ b/gdb/coff-pe-read.c +@@ -291,23 +291,31 @@ read_pe_truncate_name (char *dll_name) + + /* Low-level support functions, direct from the ld module pe-dll.c. */ + static unsigned int +-pe_get16 (bfd *abfd, int where) ++pe_get16 (bfd *abfd, int where, bool *fail) + { + unsigned char b[2]; + +- bfd_seek (abfd, (file_ptr) where, SEEK_SET); +- bfd_bread (b, (bfd_size_type) 2, abfd); ++ if (bfd_seek (abfd, where, SEEK_SET) != 0 ++ || bfd_bread (b, 2, abfd) != 2) ++ { ++ *fail = true; ++ return 0; ++ } + return b[0] + (b[1] << 8); + } + + static unsigned int +-pe_get32 (bfd *abfd, int where) ++pe_get32 (bfd *abfd, int where, bool *fail) + { + unsigned char b[4]; + +- bfd_seek (abfd, (file_ptr) where, SEEK_SET); +- bfd_bread (b, (bfd_size_type) 4, abfd); +- return b[0] + (b[1] << 8) + (b[2] << 16) + (b[3] << 24); ++ if (bfd_seek (abfd, where, SEEK_SET) != 0 ++ || bfd_bread (b, 4, abfd) != 4) ++ { ++ *fail = true; ++ return 0; ++ } ++ return b[0] + (b[1] << 8) + (b[2] << 16) + ((unsigned) b[3] << 24); + } + + static unsigned int +@@ -323,7 +331,7 @@ pe_as32 (void *ptr) + { + unsigned char *b = (unsigned char *) ptr; + +- return b[0] + (b[1] << 8) + (b[2] << 16) + (b[3] << 24); ++ return b[0] + (b[1] << 8) + (b[2] << 16) + ((unsigned) b[3] << 24); + } + + /* Read the (non-debug) export symbol table from a portable +@@ -376,37 +384,50 @@ read_pe_exported_syms (minimal_symbol_re + || strcmp (target, "pei-i386") == 0 + || strcmp (target, "pe-arm-wince-little") == 0 + || strcmp (target, "pei-arm-wince-little") == 0); ++ ++ /* Possibly print a debug message about DLL not having a valid format. */ ++ auto maybe_print_debug_msg = [&] () -> void { ++ if (debug_coff_pe_read) ++ fprintf_unfiltered (gdb_stdlog, _("%s doesn't appear to be a DLL\n"), ++ bfd_get_filename (dll)); ++ }; ++ + if (!is_pe32 && !is_pe64) +- { +- /* This is not a recognized PE format file. Abort now, because +- the code is untested on anything else. *FIXME* test on +- further architectures and loosen or remove this test. */ +- return; +- } ++ return maybe_print_debug_msg (); + + /* Get pe_header, optional header and numbers of export entries. */ +- pe_header_offset = pe_get32 (dll, 0x3c); ++ bool fail = false; ++ pe_header_offset = pe_get32 (dll, 0x3c, &fail); ++ if (fail) ++ return maybe_print_debug_msg (); + opthdr_ofs = pe_header_offset + 4 + 20; + if (is_pe64) +- num_entries = pe_get32 (dll, opthdr_ofs + 108); ++ num_entries = pe_get32 (dll, opthdr_ofs + 108, &fail); + else +- num_entries = pe_get32 (dll, opthdr_ofs + 92); ++ num_entries = pe_get32 (dll, opthdr_ofs + 92, &fail); ++ if (fail) ++ return maybe_print_debug_msg (); + + if (num_entries < 1) /* No exports. */ + return; + if (is_pe64) + { +- export_opthdrrva = pe_get32 (dll, opthdr_ofs + 112); +- export_opthdrsize = pe_get32 (dll, opthdr_ofs + 116); ++ export_opthdrrva = pe_get32 (dll, opthdr_ofs + 112, &fail); ++ export_opthdrsize = pe_get32 (dll, opthdr_ofs + 116, &fail); + } + else + { +- export_opthdrrva = pe_get32 (dll, opthdr_ofs + 96); +- export_opthdrsize = pe_get32 (dll, opthdr_ofs + 100); ++ export_opthdrrva = pe_get32 (dll, opthdr_ofs + 96, &fail); ++ export_opthdrsize = pe_get32 (dll, opthdr_ofs + 100, &fail); + } +- nsections = pe_get16 (dll, pe_header_offset + 4 + 2); ++ if (fail) ++ return maybe_print_debug_msg (); ++ ++ nsections = pe_get16 (dll, pe_header_offset + 4 + 2, &fail); + secptr = (pe_header_offset + 4 + 20 + +- pe_get16 (dll, pe_header_offset + 4 + 16)); ++ pe_get16 (dll, pe_header_offset + 4 + 16, &fail)); ++ if (fail) ++ return maybe_print_debug_msg (); + expptr = 0; + export_size = 0; + +@@ -415,12 +436,13 @@ read_pe_exported_syms (minimal_symbol_re + { + char sname[8]; + unsigned long secptr1 = secptr + 40 * i; +- unsigned long vaddr = pe_get32 (dll, secptr1 + 12); +- unsigned long vsize = pe_get32 (dll, secptr1 + 16); +- unsigned long fptr = pe_get32 (dll, secptr1 + 20); +- +- bfd_seek (dll, (file_ptr) secptr1, SEEK_SET); +- bfd_bread (sname, (bfd_size_type) sizeof (sname), dll); ++ unsigned long vaddr = pe_get32 (dll, secptr1 + 12, &fail); ++ unsigned long vsize = pe_get32 (dll, secptr1 + 16, &fail); ++ unsigned long fptr = pe_get32 (dll, secptr1 + 20, &fail); ++ ++ if (fail ++ || bfd_seek (dll, secptr1, SEEK_SET) != 0 ++ || bfd_bread (sname, sizeof (sname), dll) != sizeof (sname)) + + if ((strcmp (sname, ".edata") == 0) + || (vaddr <= export_opthdrrva && export_opthdrrva < vaddr + vsize)) +@@ -461,16 +483,18 @@ read_pe_exported_syms (minimal_symbol_re + for (i = 0; i < nsections; i++) + { + unsigned long secptr1 = secptr + 40 * i; +- unsigned long vsize = pe_get32 (dll, secptr1 + 8); +- unsigned long vaddr = pe_get32 (dll, secptr1 + 12); +- unsigned long characteristics = pe_get32 (dll, secptr1 + 36); ++ unsigned long vsize = pe_get32 (dll, secptr1 + 8, &fail); ++ unsigned long vaddr = pe_get32 (dll, secptr1 + 12, &fail); ++ unsigned long characteristics = pe_get32 (dll, secptr1 + 36, &fail); + char sec_name[SCNNMLEN + 1]; + int sectix; + unsigned int bfd_section_index; + asection *section; + +- bfd_seek (dll, (file_ptr) secptr1 + 0, SEEK_SET); +- bfd_bread (sec_name, (bfd_size_type) SCNNMLEN, dll); ++ if (fail ++ || bfd_seek (dll, secptr1 + 0, SEEK_SET) != 0 ++ || bfd_bread (sec_name, SCNNMLEN, dll) != SCNNMLEN) ++ return maybe_print_debug_msg (); + sec_name[SCNNMLEN] = '\0'; + + sectix = read_pe_section_index (sec_name); +@@ -509,8 +533,9 @@ read_pe_exported_syms (minimal_symbol_re + gdb::def_vector<unsigned char> expdata_storage (export_size); + expdata = expdata_storage.data (); + +- bfd_seek (dll, (file_ptr) expptr, SEEK_SET); +- bfd_bread (expdata, (bfd_size_type) export_size, dll); ++ if (bfd_seek (dll, expptr, SEEK_SET) != 0 ++ || bfd_bread (expdata, export_size, dll) != export_size) ++ return maybe_print_debug_msg (); + erva = expdata - export_rva; + + nexp = pe_as32 (expdata + 24); +@@ -658,20 +683,27 @@ pe_text_section_offset (struct bfd *abfd + } + + /* Get pe_header, optional header and numbers of sections. */ +- pe_header_offset = pe_get32 (abfd, 0x3c); +- nsections = pe_get16 (abfd, pe_header_offset + 4 + 2); ++ bool fail = false; ++ pe_header_offset = pe_get32 (abfd, 0x3c, &fail); ++ if (fail) ++ return DEFAULT_COFF_PE_TEXT_SECTION_OFFSET; ++ nsections = pe_get16 (abfd, pe_header_offset + 4 + 2, &fail); + secptr = (pe_header_offset + 4 + 20 + +- pe_get16 (abfd, pe_header_offset + 4 + 16)); ++ pe_get16 (abfd, pe_header_offset + 4 + 16, &fail)); ++ if (fail) ++ return DEFAULT_COFF_PE_TEXT_SECTION_OFFSET; + + /* Get the rva and size of the export section. */ + for (i = 0; i < nsections; i++) + { + char sname[SCNNMLEN + 1]; + unsigned long secptr1 = secptr + 40 * i; +- unsigned long vaddr = pe_get32 (abfd, secptr1 + 12); ++ unsigned long vaddr = pe_get32 (abfd, secptr1 + 12, &fail); + +- bfd_seek (abfd, (file_ptr) secptr1, SEEK_SET); +- bfd_bread (sname, (bfd_size_type) SCNNMLEN, abfd); ++ if (fail ++ || bfd_seek (abfd, secptr1, SEEK_SET) != 0 ++ || bfd_bread (sname, SCNNMLEN, abfd) != SCNNMLEN) ++ return DEFAULT_COFF_PE_TEXT_SECTION_OFFSET; + sname[SCNNMLEN] = '\0'; + if (strcmp (sname, ".text") == 0) + return vaddr; +diff --git a/gdb/coffread.c b/gdb/coffread.c +--- a/gdb/coffread.c ++++ b/gdb/coffread.c +@@ -690,8 +690,6 @@ coff_symfile_read (struct objfile *objfi + + /* FIXME: dubious. Why can't we use something normal like + bfd_get_section_contents? */ +- bfd_seek (abfd, abfd->where, 0); +- + stabstrsize = bfd_section_size (info->stabstrsect); + + coffstab_build_psymtabs (objfile, +@@ -780,22 +778,6 @@ coff_symtab_read (minimal_symbol_reader + + scoped_free_pendings free_pending; + +- /* Work around a stdio bug in SunOS4.1.1 (this makes me nervous.... +- it's hard to know I've really worked around it. The fix should +- be harmless, anyway). The symptom of the bug is that the first +- fread (in read_one_sym), will (in my example) actually get data +- from file offset 268, when the fseek was to 264 (and ftell shows +- 264). This causes all hell to break loose. I was unable to +- reproduce this on a short test program which operated on the same +- file, performing (I think) the same sequence of operations. +- +- It stopped happening when I put in this (former) rewind(). +- +- FIXME: Find out if this has been reported to Sun, whether it has +- been fixed in a later release, etc. */ +- +- bfd_seek (objfile->obfd, 0, 0); +- + /* Position to read the symbol table. */ + val = bfd_seek (objfile->obfd, symtab_offset, 0); + if (val < 0) +@@ -1285,12 +1267,13 @@ init_stringtab (bfd *abfd, file_ptr offs + if (bfd_seek (abfd, offset, 0) < 0) + return -1; + +- val = bfd_bread ((char *) lengthbuf, sizeof lengthbuf, abfd); +- length = bfd_h_get_32 (symfile_bfd, lengthbuf); +- ++ val = bfd_bread (lengthbuf, sizeof lengthbuf, abfd); + /* If no string table is needed, then the file may end immediately + after the symbols. Just return with `stringtab' set to null. */ +- if (val != sizeof lengthbuf || length < sizeof lengthbuf) ++ if (val != sizeof lengthbuf) ++ return 0; ++ length = bfd_h_get_32 (symfile_bfd, lengthbuf); ++ if (length < sizeof lengthbuf) + return 0; + + storage->reset ((char *) xmalloc (length)); +diff --git a/gdb/dbxread.c b/gdb/dbxread.c +--- a/gdb/dbxread.c ++++ b/gdb/dbxread.c +@@ -812,7 +812,8 @@ stabs_seek (int sym_offset) + symbuf_left -= sym_offset; + } + else +- bfd_seek (symfile_bfd, sym_offset, SEEK_CUR); ++ if (bfd_seek (symfile_bfd, sym_offset, SEEK_CUR) != 0) ++ perror_with_name (bfd_get_filename (symfile_bfd)); + } + + #define INTERNALIZE_SYMBOL(intern, extern, abfd) \ +@@ -2095,8 +2096,8 @@ dbx_expand_psymtab (legacy_psymtab *pst, + symbol_size = SYMBOL_SIZE (pst); + + /* Read in this file's symbols. */ +- bfd_seek (objfile->obfd, SYMBOL_OFFSET (pst), SEEK_SET); +- read_ofile_symtab (objfile, pst); ++ if (bfd_seek (objfile->obfd, SYMBOL_OFFSET (pst), SEEK_SET) == 0) ++ read_ofile_symtab (objfile, pst); + } + + pst->readin = true; +diff --git a/gdb/xcoffread.c b/gdb/xcoffread.c +--- a/gdb/xcoffread.c ++++ b/gdb/xcoffread.c +@@ -865,8 +865,9 @@ enter_line_range (struct subfile *subfil + + while (curoffset <= limit_offset) + { +- bfd_seek (abfd, curoffset, SEEK_SET); +- bfd_bread (ext_lnno, linesz, abfd); ++ if (bfd_seek (abfd, curoffset, SEEK_SET) != 0 ++ || bfd_bread (ext_lnno, linesz, abfd) != linesz) ++ return; + bfd_coff_swap_lineno_in (abfd, ext_lnno, &int_lnno); + + /* Find the address this line represents. */ +-- +2.39.3 diff --git a/meta/recipes-devtools/git/git/CVE-2023-25652.patch b/meta/recipes-devtools/git/git/CVE-2023-25652.patch new file mode 100644 index 0000000000..825701eaff --- /dev/null +++ b/meta/recipes-devtools/git/git/CVE-2023-25652.patch @@ -0,0 +1,94 @@ +From 9db05711c98efc14f414d4c87135a34c13586e0b Mon Sep 17 00:00:00 2001 +From: Johannes Schindelin <Johannes.Schindelin@gmx.de> +Date: Thu Mar 9 16:02:54 2023 +0100 +Subject: [PATCH] apply --reject: overwrite existing `.rej` symlink if it + exists + + The `git apply --reject` is expected to write out `.rej` files in case + one or more hunks fail to apply cleanly. Historically, the command + overwrites any existing `.rej` files. The idea being that + apply/reject/edit cycles are relatively common, and the generated `.rej` + files are not considered precious. + + But the command does not overwrite existing `.rej` symbolic links, and + instead follows them. This is unsafe because the same patch could + potentially create such a symbolic link and point at arbitrary paths + outside the current worktree, and `git apply` would write the contents + of the `.rej` file into that location. + + Therefore, let's make sure that any existing `.rej` file or symbolic + link is removed before writing it. + + Reported-by: RyotaK <ryotak.mail@gmail.com> + Helped-by: Taylor Blau <me@ttaylorr.com> + Helped-by: Junio C Hamano <gitster@pobox.com> + Helped-by: Linus Torvalds <torvalds@linuxfoundation.org> + Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> + +CVE: CVE-2023-25652 +Upstream-Status: Backport [https://github.com/git/git/commit/9db05711c98efc14f414d4c87135a34c13586e0b] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + apply.c | 14 ++++++++++++-- + t/t4115-apply-symlink.sh | 15 +++++++++++++++ + 2 files changed, 27 insertions(+), 2 deletions(-) + +diff --git a/apply.c b/apply.c +index fc6f484..47f2686 100644 +--- a/apply.c ++++ b/apply.c +@@ -4584,7 +4584,7 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch) + FILE *rej; + char namebuf[PATH_MAX]; + struct fragment *frag; +- int cnt = 0; ++ int fd, cnt = 0; + struct strbuf sb = STRBUF_INIT; + + for (cnt = 0, frag = patch->fragments; frag; frag = frag->next) { +@@ -4624,7 +4624,17 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch) + memcpy(namebuf, patch->new_name, cnt); + memcpy(namebuf + cnt, ".rej", 5); + +- rej = fopen(namebuf, "w"); ++ fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666); ++ if (fd < 0) { ++ if (errno != EEXIST) ++ return error_errno(_("cannot open %s"), namebuf); ++ if (unlink(namebuf)) ++ return error_errno(_("cannot unlink '%s'"), namebuf); ++ fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666); ++ if (fd < 0) ++ return error_errno(_("cannot open %s"), namebuf); ++ } ++ rej = fdopen(fd, "w"); + if (!rej) + return error_errno(_("cannot open %s"), namebuf); + +diff --git a/t/t4115-apply-symlink.sh b/t/t4115-apply-symlink.sh +index 65ac7df..e95e6d4 100755 +--- a/t/t4115-apply-symlink.sh ++++ b/t/t4115-apply-symlink.sh +@@ -126,4 +126,19 @@ test_expect_success SYMLINKS 'symlink escape when deleting file' ' + test_path_is_file .git/delete-me + ' + ++test_expect_success SYMLINKS '--reject removes .rej symlink if it exists' ' ++ test_when_finished "git reset --hard && git clean -dfx" && ++ ++ test_commit file && ++ echo modified >file.t && ++ git diff -- file.t >patch && ++ echo modified-again >file.t && ++ ++ ln -s foo file.t.rej && ++ test_must_fail git apply patch --reject 2>err && ++ test_i18ngrep "Rejected hunk" err && ++ test_path_is_missing foo && ++ test_path_is_file file.t.rej ++' ++ + test_done +-- +2.40.0 diff --git a/meta/recipes-devtools/git/git/CVE-2023-29007.patch b/meta/recipes-devtools/git/git/CVE-2023-29007.patch new file mode 100644 index 0000000000..472f4022b2 --- /dev/null +++ b/meta/recipes-devtools/git/git/CVE-2023-29007.patch @@ -0,0 +1,162 @@ +From 057c07a7b1fae22fdeef26c243f4cfbe3afc90ce Mon Sep 17 00:00:00 2001 +From: Taylor Blau <me@ttaylorr.com> +Date: Fri, 14 Apr 2023 11:46:59 -0400 +Subject: [PATCH] Merge branch 'tb/config-copy-or-rename-in-file-injection' + +Avoids issues with renaming or deleting sections with long lines, where +configuration values may be interpreted as sections, leading to +configuration injection. Addresses CVE-2023-29007. + +* tb/config-copy-or-rename-in-file-injection: + config.c: disallow overly-long lines in `copy_or_rename_section_in_file()` + config.c: avoid integer truncation in `copy_or_rename_section_in_file()` + config: avoid fixed-sized buffer when renaming/deleting a section + t1300: demonstrate failure when renaming sections with long lines + +Signed-off-by: Taylor Blau <me@ttaylorr.com> + +Upstream-Status: Backport +CVE: CVE-2023-29007 + +Reference to upstream patch: +https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + config.c | 36 +++++++++++++++++++++++++----------- + t/t1300-config.sh | 30 ++++++++++++++++++++++++++++++ + 2 files changed, 55 insertions(+), 11 deletions(-) + +diff --git a/config.c b/config.c +index 2bffa8d..6a01938 100644 +--- a/config.c ++++ b/config.c +@@ -3192,9 +3192,10 @@ void git_config_set_multivar(const char *key, const char *value, + flags); + } + +-static int section_name_match (const char *buf, const char *name) ++static size_t section_name_match (const char *buf, const char *name) + { +- int i = 0, j = 0, dot = 0; ++ size_t i = 0, j = 0; ++ int dot = 0; + if (buf[i] != '[') + return 0; + for (i = 1; buf[i] && buf[i] != ']'; i++) { +@@ -3247,6 +3248,8 @@ static int section_name_is_ok(const char *name) + return 1; + } + ++#define GIT_CONFIG_MAX_LINE_LEN (512 * 1024) ++ + /* if new_name == NULL, the section is removed instead */ + static int git_config_copy_or_rename_section_in_file(const char *config_filename, + const char *old_name, +@@ -3256,11 +3259,12 @@ static int git_config_copy_or_rename_section_in_file(const char *config_filename + char *filename_buf = NULL; + struct lock_file lock = LOCK_INIT; + int out_fd; +- char buf[1024]; ++ struct strbuf buf = STRBUF_INIT; + FILE *config_file = NULL; + struct stat st; + struct strbuf copystr = STRBUF_INIT; + struct config_store_data store; ++ uint32_t line_nr = 0; + + memset(&store, 0, sizeof(store)); + +@@ -3297,16 +3301,25 @@ static int git_config_copy_or_rename_section_in_file(const char *config_filename + goto out; + } + +- while (fgets(buf, sizeof(buf), config_file)) { +- unsigned i; +- int length; ++ while (!strbuf_getwholeline(&buf, config_file, '\n')) { ++ size_t i, length; + int is_section = 0; +- char *output = buf; +- for (i = 0; buf[i] && isspace(buf[i]); i++) ++ char *output = buf.buf; ++ ++ line_nr++; ++ ++ if (buf.len >= GIT_CONFIG_MAX_LINE_LEN) { ++ ret = error(_("refusing to work with overly long line " ++ "in '%s' on line %"PRIuMAX), ++ config_filename, (uintmax_t)line_nr); ++ goto out; ++ } ++ ++ for (i = 0; buf.buf[i] && isspace(buf.buf[i]); i++) + ; /* do nothing */ +- if (buf[i] == '[') { ++ if (buf.buf[i] == '[') { + /* it's a section */ +- int offset; ++ size_t offset; + is_section = 1; + + /* +@@ -3323,7 +3336,7 @@ static int git_config_copy_or_rename_section_in_file(const char *config_filename + strbuf_reset(©str); + } + +- offset = section_name_match(&buf[i], old_name); ++ offset = section_name_match(&buf.buf[i], old_name); + if (offset > 0) { + ret++; + if (new_name == NULL) { +@@ -3398,6 +3411,7 @@ static int git_config_copy_or_rename_section_in_file(const char *config_filename + out_no_rollback: + free(filename_buf); + config_store_data_clear(&store); ++ strbuf_release(&buf); + return ret; + } + +diff --git a/t/t1300-config.sh b/t/t1300-config.sh +index 78359f1..b07feb1 100755 +--- a/t/t1300-config.sh ++++ b/t/t1300-config.sh +@@ -617,6 +617,36 @@ test_expect_success 'renaming to bogus section is rejected' ' + test_must_fail git config --rename-section branch.zwei "bogus name" + ' + ++test_expect_success 'renaming a section with a long line' ' ++ { ++ printf "[b]\\n" && ++ printf " c = d %1024s [a] e = f\\n" " " && ++ printf "[a] g = h\\n" ++ } >y && ++ git config -f y --rename-section a xyz && ++ test_must_fail git config -f y b.e ++' ++ ++test_expect_success 'renaming an embedded section with a long line' ' ++ { ++ printf "[b]\\n" && ++ printf " c = d %1024s [a] [foo] e = f\\n" " " && ++ printf "[a] g = h\\n" ++ } >y && ++ git config -f y --rename-section a xyz && ++ test_must_fail git config -f y foo.e ++' ++ ++test_expect_success 'renaming a section with an overly-long line' ' ++ { ++ printf "[b]\\n" && ++ printf " c = d %525000s e" " " && ++ printf "[a] g = h\\n" ++ } >y && ++ test_must_fail git config -f y --rename-section a xyz 2>err && ++ test_i18ngrep "refusing to work with overly long line in .y. on line 2" err ++' ++ + cat >> .git/config << EOF + [branch "zwei"] a = 1 [branch "vier"] + EOF +-- +2.40.0 diff --git a/meta/recipes-devtools/git/git_2.35.5.bb b/meta/recipes-devtools/git/git_2.35.7.bb index be4e3ca1d3..9e7b0a8cff 100644 --- a/meta/recipes-devtools/git/git_2.35.5.bb +++ b/meta/recipes-devtools/git/git_2.35.7.bb @@ -10,6 +10,8 @@ PROVIDES:append:class-native = " git-replacement-native" SRC_URI = "${KERNELORG_MIRROR}/software/scm/git/git-${PV}.tar.gz;name=tarball \ file://fixsort.patch \ file://0001-config.mak.uname-do-not-force-RHEL-7-specific-build-.patch \ + file://CVE-2023-29007.patch \ + file://CVE-2023-25652.patch \ " S = "${WORKDIR}/git-${PV}" @@ -31,6 +33,12 @@ CVE_PRODUCT = "git-scm:git" # in mirrored git repos. Most OE users wouldn't build the docs and # we don't see this as a major issue for our general users/usecases. CVE_CHECK_IGNORE += "CVE-2022-24975" +# This is specific to Git-for-Windows +CVE_CHECK_IGNORE += "CVE-2022-41953" +# specific to Git for Windows +CVE_CHECK_IGNORE += "CVE-2023-22743" +# This is specific to Git-for-Windows +CVE_CHECK_IGNORE += "CVE-2023-25815" PACKAGECONFIG ??= "expat curl" PACKAGECONFIG[cvsserver] = "" @@ -165,4 +173,4 @@ EXTRA_OECONF += "ac_cv_snprintf_returns_bogus=no \ " EXTRA_OEMAKE += "NO_GETTEXT=1" -SRC_URI[tarball.sha256sum] = "2cca63fe7bebb5b4bf8efea7b46b12bb89c16ff9711b6b6d845928501d00d0a3" +SRC_URI[tarball.sha256sum] = "fc849272a95cc7457091221a645fcd753b3b1984767ee3323fb6a0aa944bbcb4" diff --git a/meta/recipes-devtools/go/go-1.17.13.inc b/meta/recipes-devtools/go/go-1.17.13.inc index 99662bd298..768961de2c 100644 --- a/meta/recipes-devtools/go/go-1.17.13.inc +++ b/meta/recipes-devtools/go/go-1.17.13.inc @@ -1,6 +1,6 @@ require go-common.inc -FILESEXTRAPATHS:prepend := "${FILE_DIRNAME}/go-1.18:" +FILESEXTRAPATHS:prepend := "${FILE_DIRNAME}/go-1.21:${FILE_DIRNAME}/go-1.20:${FILE_DIRNAME}/go-1.19:${FILE_DIRNAME}/go-1.18:" LIC_FILES_CHKSUM = "file://LICENSE;md5=5d4950ecb7b26d2c5e4e7b4e0dd74707" @@ -16,10 +16,45 @@ SRC_URI += "\ file://0009-Revert-cmd-go-make-sure-CC-and-CXX-are-absolute.patch \ file://0001-exec.go-do-not-write-linker-flags-into-buildids.patch \ file://0001-src-cmd-dist-buildgo.go-do-not-hardcode-host-compile.patch \ + file://0010-net-Fix-issue-with-DNS-not-being-updated.patch \ file://CVE-2022-27664.patch \ file://0001-net-http-httputil-avoid-query-parameter-smuggling.patch \ file://CVE-2022-41715.patch \ file://CVE-2022-41717.patch \ + file://CVE-2022-2879.patch \ + file://CVE-2022-41720.patch \ + file://CVE-2022-41723.patch \ + file://cve-2022-41724.patch \ + file://add_godebug.patch \ + file://cve-2022-41725.patch \ + file://CVE-2022-41722.patch \ + file://CVE-2023-24537.patch \ + file://CVE-2023-24534.patch \ + file://CVE-2023-24538_1.patch \ + file://CVE-2023-24538_2.patch \ + file://CVE-2023-24540.patch \ + file://CVE-2023-24539.patch \ + file://CVE-2023-29404.patch \ + file://CVE-2023-29405.patch \ + file://CVE-2023-29402.patch \ + file://CVE-2023-29400.patch \ + file://CVE-2023-29406-1.patch \ + file://CVE-2023-29406-2.patch \ + file://CVE-2023-24536_1.patch \ + file://CVE-2023-24536_2.patch \ + file://CVE-2023-24536_3.patch \ + file://CVE-2023-24531_1.patch \ + file://CVE-2023-24531_2.patch \ + file://CVE-2023-29409.patch \ + file://CVE-2023-39319.patch \ + file://CVE-2023-39318.patch \ + file://CVE-2023-39326.patch \ + file://CVE-2023-45285.patch \ + file://CVE-2023-45287.patch \ + file://CVE-2023-45289.patch \ + file://CVE-2023-45290.patch \ + file://CVE-2024-24784.patch \ + file://CVE-2024-24785.patch \ " SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd" @@ -27,3 +62,6 @@ SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784 # fix in 1.17 onwards where we can drop this. # https://github.com/golang/go/issues/30999#issuecomment-910470358 CVE_CHECK_IGNORE += "CVE-2021-29923" + +# This are specific to Microsoft Windows +CVE_CHECK_IGNORE += "CVE-2022-41716 CVE-2023-45283 CVE-2023-45284" diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2022-2879.patch b/meta/recipes-devtools/go/go-1.18/CVE-2022-2879.patch new file mode 100644 index 0000000000..0315e1a3ee --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2022-2879.patch @@ -0,0 +1,177 @@ +From d064ed520a7cc6b480f9565e30751e695d394f4e Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Fri, 2 Sep 2022 20:45:18 -0700 +Subject: [PATCH] archive/tar: limit size of headers + +Set a 1MiB limit on special file blocks (PAX headers, GNU long names, +GNU link names), to avoid reading arbitrarily large amounts of data +into memory. + +Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting +this issue. + +Fixes CVE-2022-2879 +Updates #54853 +Fixes #55925 + +Change-Id: I85136d6ff1e0af101a112190e027987ab4335680 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1565555 +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +(cherry picked from commit 6ee768cef6b82adf7a90dcf367a1699ef694f3b2) +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1590622 +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/438500 +Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> +Reviewed-by: Carlos Amedee <carlos@golang.org> +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> +Run-TryBot: Carlos Amedee <carlos@golang.org> +TryBot-Result: Gopher Robot <gobot@golang.org> + +CVE: CVE-2022-2879 +Upstream-Status: Backport [0a723816cd205576945fa57fbdde7e6532d59d08] +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/archive/tar/format.go | 4 ++++ + src/archive/tar/reader.go | 14 ++++++++++++-- + src/archive/tar/reader_test.go | 8 +++++++- + src/archive/tar/writer.go | 3 +++ + src/archive/tar/writer_test.go | 27 +++++++++++++++++++++++++++ + 5 files changed, 53 insertions(+), 3 deletions(-) + +diff --git a/src/archive/tar/format.go b/src/archive/tar/format.go +index cfe24a5..6642364 100644 +--- a/src/archive/tar/format.go ++++ b/src/archive/tar/format.go +@@ -143,6 +143,10 @@ const ( + blockSize = 512 // Size of each block in a tar stream + nameSize = 100 // Max length of the name field in USTAR format + prefixSize = 155 // Max length of the prefix field in USTAR format ++ ++ // Max length of a special file (PAX header, GNU long name or link). ++ // This matches the limit used by libarchive. ++ maxSpecialFileSize = 1 << 20 + ) + + // blockPadding computes the number of bytes needed to pad offset up to the +diff --git a/src/archive/tar/reader.go b/src/archive/tar/reader.go +index 1b1d5b4..f645af8 100644 +--- a/src/archive/tar/reader.go ++++ b/src/archive/tar/reader.go +@@ -103,7 +103,7 @@ func (tr *Reader) next() (*Header, error) { + continue // This is a meta header affecting the next header + case TypeGNULongName, TypeGNULongLink: + format.mayOnlyBe(FormatGNU) +- realname, err := io.ReadAll(tr) ++ realname, err := readSpecialFile(tr) + if err != nil { + return nil, err + } +@@ -293,7 +293,7 @@ func mergePAX(hdr *Header, paxHdrs map[string]string) (err error) { + // parsePAX parses PAX headers. + // If an extended header (type 'x') is invalid, ErrHeader is returned + func parsePAX(r io.Reader) (map[string]string, error) { +- buf, err := io.ReadAll(r) ++ buf, err := readSpecialFile(r) + if err != nil { + return nil, err + } +@@ -826,6 +826,16 @@ func tryReadFull(r io.Reader, b []byte) (n int, err error) { + return n, err + } + ++// readSpecialFile is like io.ReadAll except it returns ++// ErrFieldTooLong if more than maxSpecialFileSize is read. ++func readSpecialFile(r io.Reader) ([]byte, error) { ++ buf, err := io.ReadAll(io.LimitReader(r, maxSpecialFileSize+1)) ++ if len(buf) > maxSpecialFileSize { ++ return nil, ErrFieldTooLong ++ } ++ return buf, err ++} ++ + // discard skips n bytes in r, reporting an error if unable to do so. + func discard(r io.Reader, n int64) error { + // If possible, Seek to the last byte before the end of the data section. +diff --git a/src/archive/tar/reader_test.go b/src/archive/tar/reader_test.go +index 789ddc1..926dc3d 100644 +--- a/src/archive/tar/reader_test.go ++++ b/src/archive/tar/reader_test.go +@@ -6,6 +6,7 @@ package tar + + import ( + "bytes" ++ "compress/bzip2" + "crypto/md5" + "errors" + "fmt" +@@ -625,9 +626,14 @@ func TestReader(t *testing.T) { + } + defer f.Close() + ++ var fr io.Reader = f ++ if strings.HasSuffix(v.file, ".bz2") { ++ fr = bzip2.NewReader(fr) ++ } ++ + // Capture all headers and checksums. + var ( +- tr = NewReader(f) ++ tr = NewReader(fr) + hdrs []*Header + chksums []string + rdbuf = make([]byte, 8) +diff --git a/src/archive/tar/writer.go b/src/archive/tar/writer.go +index e80498d..893eac0 100644 +--- a/src/archive/tar/writer.go ++++ b/src/archive/tar/writer.go +@@ -199,6 +199,9 @@ func (tw *Writer) writePAXHeader(hdr *Header, paxHdrs map[string]string) error { + flag = TypeXHeader + } + data := buf.String() ++ if len(data) > maxSpecialFileSize { ++ return ErrFieldTooLong ++ } + if err := tw.writeRawFile(name, data, flag, FormatPAX); err != nil || isGlobal { + return err // Global headers return here + } +diff --git a/src/archive/tar/writer_test.go b/src/archive/tar/writer_test.go +index a00f02d..4e709e5 100644 +--- a/src/archive/tar/writer_test.go ++++ b/src/archive/tar/writer_test.go +@@ -1006,6 +1006,33 @@ func TestIssue12594(t *testing.T) { + } + } + ++func TestWriteLongHeader(t *testing.T) { ++ for _, test := range []struct { ++ name string ++ h *Header ++ }{{ ++ name: "name too long", ++ h: &Header{Name: strings.Repeat("a", maxSpecialFileSize)}, ++ }, { ++ name: "linkname too long", ++ h: &Header{Linkname: strings.Repeat("a", maxSpecialFileSize)}, ++ }, { ++ name: "uname too long", ++ h: &Header{Uname: strings.Repeat("a", maxSpecialFileSize)}, ++ }, { ++ name: "gname too long", ++ h: &Header{Gname: strings.Repeat("a", maxSpecialFileSize)}, ++ }, { ++ name: "PAX header too long", ++ h: &Header{PAXRecords: map[string]string{"GOLANG.x": strings.Repeat("a", maxSpecialFileSize)}}, ++ }} { ++ w := NewWriter(io.Discard) ++ if err := w.WriteHeader(test.h); err != ErrFieldTooLong { ++ t.Errorf("%v: w.WriteHeader() = %v, want ErrFieldTooLong", test.name, err) ++ } ++ } ++} ++ + // testNonEmptyWriter wraps an io.Writer and ensures that + // Write is never called with an empty buffer. + type testNonEmptyWriter struct{ io.Writer } diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2022-41720.patch b/meta/recipes-devtools/go/go-1.18/CVE-2022-41720.patch new file mode 100644 index 0000000000..6c2e8804b3 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2022-41720.patch @@ -0,0 +1,514 @@ +From f8896a97a0630b0f2f8c488310147f7f20b3ec7d Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Thu, 10 Nov 2022 12:16:27 -0800 +Subject: [PATCH] os, net/http: avoid escapes from os.DirFS and http.Dir on + Windows + +Do not permit access to Windows reserved device names (NUL, COM1, etc.) +via os.DirFS and http.Dir filesystems. + +Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the +the root to the relative path with a path separator, making +os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is +a UNC name. Not only does this not open the intended file, but permits +reference to any file on the system rather than only files on the +current drive. + +Make os.DirFS("") invalid, with all file access failing. Previously, +a root of "" was interpreted as "/", which is surprising and probably +unintentional. + +Fixes CVE-2022-41720. +Fixes #56694. + +Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663832 +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/455360 +Reviewed-by: Michael Pratt <mpratt@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Run-TryBot: Jenny Rakoczy <jenny@golang.org> + +CVE: CVE-2022-41720 +Upstream-Status: Backport [7013a4f5f816af62033ad63dd06b77c30d7a62a7] +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/go/build/deps_test.go | 1 + + src/internal/safefilepath/path.go | 21 +++++ + src/internal/safefilepath/path_other.go | 23 ++++++ + src/internal/safefilepath/path_test.go | 88 +++++++++++++++++++++ + src/internal/safefilepath/path_windows.go | 95 +++++++++++++++++++++++ + src/net/http/fs.go | 8 +- + src/net/http/fs_test.go | 28 +++++++ + src/os/file.go | 36 +++++++-- + src/os/os_test.go | 38 +++++++++ + 9 files changed, 328 insertions(+), 10 deletions(-) + create mode 100644 src/internal/safefilepath/path.go + create mode 100644 src/internal/safefilepath/path_other.go + create mode 100644 src/internal/safefilepath/path_test.go + create mode 100644 src/internal/safefilepath/path_windows.go + +diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go +index 45e2f25..dc3bb8c 100644 +--- a/src/go/build/deps_test.go ++++ b/src/go/build/deps_test.go +@@ -165,6 +165,7 @@ var depsRules = ` + io/fs + < internal/testlog + < internal/poll ++ < internal/safefilepath + < os + < os/signal; + +diff --git a/src/internal/safefilepath/path.go b/src/internal/safefilepath/path.go +new file mode 100644 +index 0000000..0f0a270 +--- /dev/null ++++ b/src/internal/safefilepath/path.go +@@ -0,0 +1,21 @@ ++// Copyright 2022 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++// Package safefilepath manipulates operating-system file paths. ++package safefilepath ++ ++import ( ++ "errors" ++) ++ ++var errInvalidPath = errors.New("invalid path") ++ ++// FromFS converts a slash-separated path into an operating-system path. ++// ++// FromFS returns an error if the path cannot be represented by the operating ++// system. For example, paths containing '\' and ':' characters are rejected ++// on Windows. ++func FromFS(path string) (string, error) { ++ return fromFS(path) ++} +diff --git a/src/internal/safefilepath/path_other.go b/src/internal/safefilepath/path_other.go +new file mode 100644 +index 0000000..f93da18 +--- /dev/null ++++ b/src/internal/safefilepath/path_other.go +@@ -0,0 +1,23 @@ ++// Copyright 2022 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++//go:build !windows ++ ++package safefilepath ++ ++import "runtime" ++ ++func fromFS(path string) (string, error) { ++ if runtime.GOOS == "plan9" { ++ if len(path) > 0 && path[0] == '#' { ++ return path, errInvalidPath ++ } ++ } ++ for i := range path { ++ if path[i] == 0 { ++ return "", errInvalidPath ++ } ++ } ++ return path, nil ++} +diff --git a/src/internal/safefilepath/path_test.go b/src/internal/safefilepath/path_test.go +new file mode 100644 +index 0000000..dc662c1 +--- /dev/null ++++ b/src/internal/safefilepath/path_test.go +@@ -0,0 +1,88 @@ ++// Copyright 2022 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++package safefilepath_test ++ ++import ( ++ "internal/safefilepath" ++ "os" ++ "path/filepath" ++ "runtime" ++ "testing" ++) ++ ++type PathTest struct { ++ path, result string ++} ++ ++const invalid = "" ++ ++var fspathtests = []PathTest{ ++ {".", "."}, ++ {"/a/b/c", "/a/b/c"}, ++ {"a\x00b", invalid}, ++} ++ ++var winreservedpathtests = []PathTest{ ++ {`a\b`, `a\b`}, ++ {`a:b`, `a:b`}, ++ {`a/b:c`, `a/b:c`}, ++ {`NUL`, `NUL`}, ++ {`./com1`, `./com1`}, ++ {`a/nul/b`, `a/nul/b`}, ++} ++ ++// Whether a reserved name with an extension is reserved or not varies by ++// Windows version. ++var winreservedextpathtests = []PathTest{ ++ {"nul.txt", "nul.txt"}, ++ {"a/nul.txt/b", "a/nul.txt/b"}, ++} ++ ++var plan9reservedpathtests = []PathTest{ ++ {`#c`, `#c`}, ++} ++ ++func TestFromFS(t *testing.T) { ++ switch runtime.GOOS { ++ case "windows": ++ if canWriteFile(t, "NUL") { ++ t.Errorf("can unexpectedly write a file named NUL on Windows") ++ } ++ if canWriteFile(t, "nul.txt") { ++ fspathtests = append(fspathtests, winreservedextpathtests...) ++ } else { ++ winreservedpathtests = append(winreservedpathtests, winreservedextpathtests...) ++ } ++ for i := range winreservedpathtests { ++ winreservedpathtests[i].result = invalid ++ } ++ for i := range fspathtests { ++ fspathtests[i].result = filepath.FromSlash(fspathtests[i].result) ++ } ++ case "plan9": ++ for i := range plan9reservedpathtests { ++ plan9reservedpathtests[i].result = invalid ++ } ++ } ++ tests := fspathtests ++ tests = append(tests, winreservedpathtests...) ++ tests = append(tests, plan9reservedpathtests...) ++ for _, test := range tests { ++ got, err := safefilepath.FromFS(test.path) ++ if (got == "") != (err != nil) { ++ t.Errorf(`FromFS(%q) = %q, %v; want "" only if err != nil`, test.path, got, err) ++ } ++ if got != test.result { ++ t.Errorf("FromFS(%q) = %q, %v; want %q", test.path, got, err, test.result) ++ } ++ } ++} ++ ++func canWriteFile(t *testing.T, name string) bool { ++ path := filepath.Join(t.TempDir(), name) ++ os.WriteFile(path, []byte("ok"), 0666) ++ b, _ := os.ReadFile(path) ++ return string(b) == "ok" ++} +diff --git a/src/internal/safefilepath/path_windows.go b/src/internal/safefilepath/path_windows.go +new file mode 100644 +index 0000000..909c150 +--- /dev/null ++++ b/src/internal/safefilepath/path_windows.go +@@ -0,0 +1,95 @@ ++// Copyright 2022 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++package safefilepath ++ ++import ( ++ "syscall" ++ "unicode/utf8" ++) ++ ++func fromFS(path string) (string, error) { ++ if !utf8.ValidString(path) { ++ return "", errInvalidPath ++ } ++ for len(path) > 1 && path[0] == '/' && path[1] == '/' { ++ path = path[1:] ++ } ++ containsSlash := false ++ for p := path; p != ""; { ++ // Find the next path element. ++ i := 0 ++ dot := -1 ++ for i < len(p) && p[i] != '/' { ++ switch p[i] { ++ case 0, '\\', ':': ++ return "", errInvalidPath ++ case '.': ++ if dot < 0 { ++ dot = i ++ } ++ } ++ i++ ++ } ++ part := p[:i] ++ if i < len(p) { ++ containsSlash = true ++ p = p[i+1:] ++ } else { ++ p = "" ++ } ++ // Trim the extension and look for a reserved name. ++ base := part ++ if dot >= 0 { ++ base = part[:dot] ++ } ++ if isReservedName(base) { ++ if dot < 0 { ++ return "", errInvalidPath ++ } ++ // The path element is a reserved name with an extension. ++ // Some Windows versions consider this a reserved name, ++ // while others do not. Use FullPath to see if the name is ++ // reserved. ++ if p, _ := syscall.FullPath(part); len(p) >= 4 && p[:4] == `\\.\` { ++ return "", errInvalidPath ++ } ++ } ++ } ++ if containsSlash { ++ // We can't depend on strings, so substitute \ for / manually. ++ buf := []byte(path) ++ for i, b := range buf { ++ if b == '/' { ++ buf[i] = '\\' ++ } ++ } ++ path = string(buf) ++ } ++ return path, nil ++} ++ ++// isReservedName reports if name is a Windows reserved device name. ++// It does not detect names with an extension, which are also reserved on some Windows versions. ++// ++// For details, search for PRN in ++// https://docs.microsoft.com/en-us/windows/desktop/fileio/naming-a-file. ++func isReservedName(name string) bool { ++ if 3 <= len(name) && len(name) <= 4 { ++ switch string([]byte{toUpper(name[0]), toUpper(name[1]), toUpper(name[2])}) { ++ case "CON", "PRN", "AUX", "NUL": ++ return len(name) == 3 ++ case "COM", "LPT": ++ return len(name) == 4 && '1' <= name[3] && name[3] <= '9' ++ } ++ } ++ return false ++} ++ ++func toUpper(c byte) byte { ++ if 'a' <= c && c <= 'z' { ++ return c - ('a' - 'A') ++ } ++ return c ++} +diff --git a/src/net/http/fs.go b/src/net/http/fs.go +index 57e731e..43ee4b5 100644 +--- a/src/net/http/fs.go ++++ b/src/net/http/fs.go +@@ -9,6 +9,7 @@ package http + import ( + "errors" + "fmt" ++ "internal/safefilepath" + "io" + "io/fs" + "mime" +@@ -69,14 +70,15 @@ func mapDirOpenError(originalErr error, name string) error { + // Open implements FileSystem using os.Open, opening files for reading rooted + // and relative to the directory d. + func (d Dir) Open(name string) (File, error) { +- if filepath.Separator != '/' && strings.ContainsRune(name, filepath.Separator) { +- return nil, errors.New("http: invalid character in file path") ++ path, err := safefilepath.FromFS(path.Clean("/" + name)) ++ if err != nil { ++ return nil, errors.New("http: invalid or unsafe file path") + } + dir := string(d) + if dir == "" { + dir = "." + } +- fullName := filepath.Join(dir, filepath.FromSlash(path.Clean("/"+name))) ++ fullName := filepath.Join(dir, path) + f, err := os.Open(fullName) + if err != nil { + return nil, mapDirOpenError(err, fullName) +diff --git a/src/net/http/fs_test.go b/src/net/http/fs_test.go +index b42ade1..941448a 100644 +--- a/src/net/http/fs_test.go ++++ b/src/net/http/fs_test.go +@@ -648,6 +648,34 @@ func TestFileServerZeroByte(t *testing.T) { + } + } + ++func TestFileServerNamesEscape(t *testing.T) { ++ t.Run("h1", func(t *testing.T) { ++ testFileServerNamesEscape(t, h1Mode) ++ }) ++ t.Run("h2", func(t *testing.T) { ++ testFileServerNamesEscape(t, h2Mode) ++ }) ++} ++func testFileServerNamesEscape(t *testing.T, h2 bool) { ++ defer afterTest(t) ++ ts := newClientServerTest(t, h2, FileServer(Dir("testdata"))).ts ++ defer ts.Close() ++ for _, path := range []string{ ++ "/../testdata/file", ++ "/NUL", // don't read from device files on Windows ++ } { ++ res, err := ts.Client().Get(ts.URL + path) ++ if err != nil { ++ t.Fatal(err) ++ } ++ res.Body.Close() ++ if res.StatusCode < 400 || res.StatusCode > 599 { ++ t.Errorf("Get(%q): got status %v, want 4xx or 5xx", path, res.StatusCode) ++ } ++ ++ } ++} ++ + type fakeFileInfo struct { + dir bool + basename string +diff --git a/src/os/file.go b/src/os/file.go +index e717f17..cb87158 100644 +--- a/src/os/file.go ++++ b/src/os/file.go +@@ -37,12 +37,12 @@ + // Note: The maximum number of concurrent operations on a File may be limited by + // the OS or the system. The number should be high, but exceeding it may degrade + // performance or cause other issues. +-// + package os + + import ( + "errors" + "internal/poll" ++ "internal/safefilepath" + "internal/testlog" + "internal/unsafeheader" + "io" +@@ -623,6 +623,8 @@ func isWindowsNulName(name string) bool { + // the /prefix tree, then using DirFS does not stop the access any more than using + // os.Open does. DirFS is therefore not a general substitute for a chroot-style security + // mechanism when the directory tree contains arbitrary content. ++// ++// The directory dir must not be "". + func DirFS(dir string) fs.FS { + return dirFS(dir) + } +@@ -641,10 +643,11 @@ func containsAny(s, chars string) bool { + type dirFS string + + func (dir dirFS) Open(name string) (fs.File, error) { +- if !fs.ValidPath(name) || runtime.GOOS == "windows" && containsAny(name, `\:`) { +- return nil, &PathError{Op: "open", Path: name, Err: ErrInvalid} ++ fullname, err := dir.join(name) ++ if err != nil { ++ return nil, &PathError{Op: "stat", Path: name, Err: err} + } +- f, err := Open(string(dir) + "/" + name) ++ f, err := Open(fullname) + if err != nil { + return nil, err // nil fs.File + } +@@ -652,16 +655,35 @@ func (dir dirFS) Open(name string) (fs.File, error) { + } + + func (dir dirFS) Stat(name string) (fs.FileInfo, error) { +- if !fs.ValidPath(name) || runtime.GOOS == "windows" && containsAny(name, `\:`) { +- return nil, &PathError{Op: "stat", Path: name, Err: ErrInvalid} ++ fullname, err := dir.join(name) ++ if err != nil { ++ return nil, &PathError{Op: "stat", Path: name, Err: err} + } +- f, err := Stat(string(dir) + "/" + name) ++ f, err := Stat(fullname) + if err != nil { + return nil, err + } + return f, nil + } + ++// join returns the path for name in dir. ++func (dir dirFS) join(name string) (string, error) { ++ if dir == "" { ++ return "", errors.New("os: DirFS with empty root") ++ } ++ if !fs.ValidPath(name) { ++ return "", ErrInvalid ++ } ++ name, err := safefilepath.FromFS(name) ++ if err != nil { ++ return "", ErrInvalid ++ } ++ if IsPathSeparator(dir[len(dir)-1]) { ++ return string(dir) + name, nil ++ } ++ return string(dir) + string(PathSeparator) + name, nil ++} ++ + // ReadFile reads the named file and returns the contents. + // A successful call returns err == nil, not err == EOF. + // Because ReadFile reads the whole file, it does not treat an EOF from Read +diff --git a/src/os/os_test.go b/src/os/os_test.go +index 506f1fb..be269bb 100644 +--- a/src/os/os_test.go ++++ b/src/os/os_test.go +@@ -2702,6 +2702,44 @@ func TestDirFS(t *testing.T) { + if err == nil { + t.Fatalf(`Open testdata\dirfs succeeded`) + } ++ ++ // Test that Open does not open Windows device files. ++ _, err = d.Open(`NUL`) ++ if err == nil { ++ t.Errorf(`Open NUL succeeded`) ++ } ++} ++ ++func TestDirFSRootDir(t *testing.T) { ++ cwd, err := os.Getwd() ++ if err != nil { ++ t.Fatal(err) ++ } ++ cwd = cwd[len(filepath.VolumeName(cwd)):] // trim volume prefix (C:) on Windows ++ cwd = filepath.ToSlash(cwd) // convert \ to / ++ cwd = strings.TrimPrefix(cwd, "/") // trim leading / ++ ++ // Test that Open can open a path starting at /. ++ d := DirFS("/") ++ f, err := d.Open(cwd + "/testdata/dirfs/a") ++ if err != nil { ++ t.Fatal(err) ++ } ++ f.Close() ++} ++ ++func TestDirFSEmptyDir(t *testing.T) { ++ d := DirFS("") ++ cwd, _ := os.Getwd() ++ for _, path := range []string{ ++ "testdata/dirfs/a", // not DirFS(".") ++ filepath.ToSlash(cwd) + "/testdata/dirfs/a", // not DirFS("/") ++ } { ++ _, err := d.Open(path) ++ if err == nil { ++ t.Fatalf(`DirFS("").Open(%q) succeeded`, path) ++ } ++ } + } + + func TestDirFSPathsValid(t *testing.T) { diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2022-41722.patch b/meta/recipes-devtools/go/go-1.18/CVE-2022-41722.patch new file mode 100644 index 0000000000..426a4f925f --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2022-41722.patch @@ -0,0 +1,103 @@ +From a826b19625caebed6dd0f3fbd9d0111f6c83737c Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Mon, 12 Dec 2022 16:43:37 -0800 +Subject: [PATCH] path/filepath: do not Clean("a/../c:/b") into c:\b on Windows + +Do not permit Clean to convert a relative path into one starting +with a drive reference. This change causes Clean to insert a . +path element at the start of a path when the original path does not +start with a volume name, and the first path element would contain +a colon. + +This may introduce a spurious but harmless . path element under +some circumstances. For example, Clean("a/../b:/../c") becomes `.\c`. + +This reverts CL 401595, since the change here supersedes the one +in that CL. + +Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue. + +Updates #57274 +Fixes #57276 +Fixes CVE-2022-41722 + +Change-Id: I837446285a03aa74c79d7642720e01f354c2ca17 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1675249 +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com> +(cherry picked from commit 8ca37f4813ef2f64600c92b83f17c9f3ca6c03a5) +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728944 +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/468119 +Reviewed-by: Than McIntosh <thanm@google.com> +Run-TryBot: Michael Pratt <mpratt@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Auto-Submit: Michael Pratt <mpratt@google.com> + +CVE: CVE-2022-41722 +Upstream-Status: Backport from https://github.com/golang/go/commit/bdf07c2e168baf736e4c057279ca12a4d674f18 +Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> +--- + src/path/filepath/path.go | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/src/path/filepath/path.go b/src/path/filepath/path.go +index 8300a32..94621a0 100644 +--- a/src/path/filepath/path.go ++++ b/src/path/filepath/path.go +@@ -15,6 +15,7 @@ import ( + "errors" + "io/fs" + "os" ++ "runtime" + "sort" + "strings" + ) +@@ -117,21 +118,9 @@ func Clean(path string) string { + case os.IsPathSeparator(path[r]): + // empty path element + r++ +- case path[r] == '.' && r+1 == n: ++ case path[r] == '.' && (r+1 == n || os.IsPathSeparator(path[r+1])): + // . element + r++ +- case path[r] == '.' && os.IsPathSeparator(path[r+1]): +- // ./ element +- r++ +- +- for r < len(path) && os.IsPathSeparator(path[r]) { +- r++ +- } +- if out.w == 0 && volumeNameLen(path[r:]) > 0 { +- // When joining prefix "." and an absolute path on Windows, +- // the prefix should not be removed. +- out.append('.') +- } + case path[r] == '.' && path[r+1] == '.' && (r+2 == n || os.IsPathSeparator(path[r+2])): + // .. element: remove to last separator + r += 2 +@@ -157,6 +146,18 @@ func Clean(path string) string { + if rooted && out.w != 1 || !rooted && out.w != 0 { + out.append(Separator) + } ++ // If a ':' appears in the path element at the start of a Windows path, ++ // insert a .\ at the beginning to avoid converting relative paths ++ // like a/../c: into c:. ++ if runtime.GOOS == "windows" && out.w == 0 && out.volLen == 0 && r != 0 { ++ for i := r; i < n && !os.IsPathSeparator(path[i]); i++ { ++ if path[i] == ':' { ++ out.append('.') ++ out.append(Separator) ++ break ++ } ++ } ++ } + // copy element + for ; r < n && !os.IsPathSeparator(path[r]); r++ { + out.append(path[r]) +-- +2.7.4 diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch b/meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch new file mode 100644 index 0000000000..a93fa31dcd --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch @@ -0,0 +1,156 @@ +From 451766789f646617157c725e20c955d4a9a70d4e Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Mon, 6 Feb 2023 10:03:44 -0800 +Subject: [PATCH] net/http: update bundled golang.org/x/net/http2 + +Disable cmd/internal/moddeps test, since this update includes PRIVATE +track fixes. + +Fixes CVE-2022-41723 +Fixes #58355 +Updates #57855 + +Change-Id: Ie870562a6f6e44e4e8f57db6a0dde1a41a2b090c +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728939 +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/468118 +TryBot-Result: Gopher Robot <gobot@golang.org> +Run-TryBot: Michael Pratt <mpratt@google.com> +Auto-Submit: Michael Pratt <mpratt@google.com> +Reviewed-by: Than McIntosh <thanm@google.com> + +Upstream-Status: Backport [https://github.com/golang/go/commit/5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3] +CVE: CVE-2022-41723 +Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> +--- + src/vendor/golang.org/x/net/http2/hpack/hpack.go | 79 +++++++++++++++--------- + 1 file changed, 49 insertions(+), 30 deletions(-) + +diff --git a/src/vendor/golang.org/x/net/http2/hpack/hpack.go b/src/vendor/golang.org/x/net/http2/hpack/hpack.go +index 85f18a2..02e80e3 100644 +--- a/src/vendor/golang.org/x/net/http2/hpack/hpack.go ++++ b/src/vendor/golang.org/x/net/http2/hpack/hpack.go +@@ -359,6 +359,7 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error { + + var hf HeaderField + wantStr := d.emitEnabled || it.indexed() ++ var undecodedName undecodedString + if nameIdx > 0 { + ihf, ok := d.at(nameIdx) + if !ok { +@@ -366,15 +367,27 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error { + } + hf.Name = ihf.Name + } else { +- hf.Name, buf, err = d.readString(buf, wantStr) ++ undecodedName, buf, err = d.readString(buf) + if err != nil { + return err + } + } +- hf.Value, buf, err = d.readString(buf, wantStr) ++ undecodedValue, buf, err := d.readString(buf) + if err != nil { + return err + } ++ if wantStr { ++ if nameIdx <= 0 { ++ hf.Name, err = d.decodeString(undecodedName) ++ if err != nil { ++ return err ++ } ++ } ++ hf.Value, err = d.decodeString(undecodedValue) ++ if err != nil { ++ return err ++ } ++ } + d.buf = buf + if it.indexed() { + d.dynTab.add(hf) +@@ -459,46 +472,52 @@ func readVarInt(n byte, p []byte) (i uint64, remain []byte, err error) { + return 0, origP, errNeedMore + } + +-// readString decodes an hpack string from p. ++// readString reads an hpack string from p. + // +-// wantStr is whether s will be used. If false, decompression and +-// []byte->string garbage are skipped if s will be ignored +-// anyway. This does mean that huffman decoding errors for non-indexed +-// strings past the MAX_HEADER_LIST_SIZE are ignored, but the server +-// is returning an error anyway, and because they're not indexed, the error +-// won't affect the decoding state. +-func (d *Decoder) readString(p []byte, wantStr bool) (s string, remain []byte, err error) { ++// It returns a reference to the encoded string data to permit deferring decode costs ++// until after the caller verifies all data is present. ++func (d *Decoder) readString(p []byte) (u undecodedString, remain []byte, err error) { + if len(p) == 0 { +- return "", p, errNeedMore ++ return u, p, errNeedMore + } + isHuff := p[0]&128 != 0 + strLen, p, err := readVarInt(7, p) + if err != nil { +- return "", p, err ++ return u, p, err + } + if d.maxStrLen != 0 && strLen > uint64(d.maxStrLen) { +- return "", nil, ErrStringLength ++ // Returning an error here means Huffman decoding errors ++ // for non-indexed strings past the maximum string length ++ // are ignored, but the server is returning an error anyway ++ // and because the string is not indexed the error will not ++ // affect the decoding state. ++ return u, nil, ErrStringLength + } + if uint64(len(p)) < strLen { +- return "", p, errNeedMore +- } +- if !isHuff { +- if wantStr { +- s = string(p[:strLen]) +- } +- return s, p[strLen:], nil ++ return u, p, errNeedMore + } ++ u.isHuff = isHuff ++ u.b = p[:strLen] ++ return u, p[strLen:], nil ++} + +- if wantStr { +- buf := bufPool.Get().(*bytes.Buffer) +- buf.Reset() // don't trust others +- defer bufPool.Put(buf) +- if err := huffmanDecode(buf, d.maxStrLen, p[:strLen]); err != nil { +- buf.Reset() +- return "", nil, err +- } ++type undecodedString struct { ++ isHuff bool ++ b []byte ++} ++ ++func (d *Decoder) decodeString(u undecodedString) (string, error) { ++ if !u.isHuff { ++ return string(u.b), nil ++ } ++ buf := bufPool.Get().(*bytes.Buffer) ++ buf.Reset() // don't trust others ++ var s string ++ err := huffmanDecode(buf, d.maxStrLen, u.b) ++ if err == nil { + s = buf.String() +- buf.Reset() // be nice to GC + } +- return s, p[strLen:], nil ++ buf.Reset() // be nice to GC ++ bufPool.Put(buf) ++ return s, err + } +-- +2.7.4 diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-24534.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-24534.patch new file mode 100644 index 0000000000..c65c7852d5 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-24534.patch @@ -0,0 +1,200 @@ +From d6759e7a059f4208f07aa781402841d7ddaaef96 Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Fri, 10 Mar 2023 14:21:05 -0800 +Subject: [PATCH] [release-branch.go1.19] net/textproto: avoid overpredicting + the number of MIME header keys + +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802452 +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +(cherry picked from commit f739f080a72fd5b06d35c8e244165159645e2ed6) +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802393 +Reviewed-by: Damien Neil <dneil@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Change-Id: I675451438d619a9130360c56daf529559004903f +Reviewed-on: https://go-review.googlesource.com/c/go/+/481982 +Run-TryBot: Michael Knyszek <mknyszek@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Matthew Dempsky <mdempsky@google.com> +Auto-Submit: Michael Knyszek <mknyszek@google.com> + +Upstream-Status: Backport [https://github.com/golang/go/commit/d6759e7a059f4208f07aa781402841d7ddaaef96] +CVE: CVE-2023-24534 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> + +--- + src/bytes/bytes.go | 14 ++++++++ + src/net/textproto/reader.go | 30 ++++++++++------ + src/net/textproto/reader_test.go | 59 ++++++++++++++++++++++++++++++++ + 3 files changed, 92 insertions(+), 11 deletions(-) + +diff --git a/src/bytes/bytes.go b/src/bytes/bytes.go +index ce52649..95ff31c 100644 +--- a/src/bytes/bytes.go ++++ b/src/bytes/bytes.go +@@ -1174,3 +1174,17 @@ func Index(s, sep []byte) int { + } + return -1 + } ++ ++// Cut slices s around the first instance of sep, ++// returning the text before and after sep. ++// The found result reports whether sep appears in s. ++// If sep does not appear in s, cut returns s, nil, false. ++// ++// Cut returns slices of the original slice s, not copies. ++func Cut(s, sep []byte) (before, after []byte, found bool) { ++ if i := Index(s, sep); i >= 0 { ++ return s[:i], s[i+len(sep):], true ++ } ++ return s, nil, false ++} ++ +diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go +index 6a680f4..fcbede8 100644 +--- a/src/net/textproto/reader.go ++++ b/src/net/textproto/reader.go +@@ -493,8 +493,11 @@ func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { + // large one ahead of time which we'll cut up into smaller + // slices. If this isn't big enough later, we allocate small ones. + var strs []string +- hint := r.upcomingHeaderNewlines() ++ hint := r.upcomingHeaderKeys() + if hint > 0 { ++ if hint > 1000 { ++ hint = 1000 // set a cap to avoid overallocation ++ } + strs = make([]string, hint) + } + +@@ -589,9 +592,11 @@ func mustHaveFieldNameColon(line []byte) error { + return nil + } + +-// upcomingHeaderNewlines returns an approximation of the number of newlines ++var nl = []byte("\n") ++ ++// upcomingHeaderKeys returns an approximation of the number of keys + // that will be in this header. If it gets confused, it returns 0. +-func (r *Reader) upcomingHeaderNewlines() (n int) { ++func (r *Reader) upcomingHeaderKeys() (n int) { + // Try to determine the 'hint' size. + r.R.Peek(1) // force a buffer load if empty + s := r.R.Buffered() +@@ -599,17 +604,20 @@ func (r *Reader) upcomingHeaderNewlines() (n int) { + return + } + peek, _ := r.R.Peek(s) +- for len(peek) > 0 { +- i := bytes.IndexByte(peek, '\n') +- if i < 3 { +- // Not present (-1) or found within the next few bytes, +- // implying we're at the end ("\r\n\r\n" or "\n\n") +- return ++ for len(peek) > 0 && n < 1000 { ++ var line []byte ++ line, peek, _ = bytes.Cut(peek, nl) ++ if len(line) == 0 || (len(line) == 1 && line[0] == '\r') { ++ // Blank line separating headers from the body. ++ break ++ } ++ if line[0] == ' ' || line[0] == '\t' { ++ // Folded continuation of the previous line. ++ continue + } + n++ +- peek = peek[i+1:] + } +- return ++ return n + } + + // CanonicalMIMEHeaderKey returns the canonical format of the +diff --git a/src/net/textproto/reader_test.go b/src/net/textproto/reader_test.go +index 3124d43..3ae0de1 100644 +--- a/src/net/textproto/reader_test.go ++++ b/src/net/textproto/reader_test.go +@@ -9,6 +9,7 @@ import ( + "bytes" + "io" + "reflect" ++ "runtime" + "strings" + "testing" + ) +@@ -127,6 +128,42 @@ func TestReadMIMEHeaderSingle(t *testing.T) { + } + } + ++// TestReaderUpcomingHeaderKeys is testing an internal function, but it's very ++// difficult to test well via the external API. ++func TestReaderUpcomingHeaderKeys(t *testing.T) { ++ for _, test := range []struct { ++ input string ++ want int ++ }{{ ++ input: "", ++ want: 0, ++ }, { ++ input: "A: v", ++ want: 1, ++ }, { ++ input: "A: v\r\nB: v\r\n", ++ want: 2, ++ }, { ++ input: "A: v\nB: v\n", ++ want: 2, ++ }, { ++ input: "A: v\r\n continued\r\n still continued\r\nB: v\r\n\r\n", ++ want: 2, ++ }, { ++ input: "A: v\r\n\r\nB: v\r\nC: v\r\n", ++ want: 1, ++ }, { ++ input: "A: v" + strings.Repeat("\n", 1000), ++ want: 1, ++ }} { ++ r := reader(test.input) ++ got := r.upcomingHeaderKeys() ++ if test.want != got { ++ t.Fatalf("upcomingHeaderKeys(%q): %v; want %v", test.input, got, test.want) ++ } ++ } ++} ++ + func TestReadMIMEHeaderNoKey(t *testing.T) { + r := reader(": bar\ntest-1: 1\n\n") + m, err := r.ReadMIMEHeader() +@@ -223,6 +260,28 @@ func TestReadMIMEHeaderTrimContinued(t *testing.T) { + } + } + ++// Test that reading a header doesn't overallocate. Issue 58975. ++func TestReadMIMEHeaderAllocations(t *testing.T) { ++ var totalAlloc uint64 ++ const count = 200 ++ for i := 0; i < count; i++ { ++ r := reader("A: b\r\n\r\n" + strings.Repeat("\n", 4096)) ++ var m1, m2 runtime.MemStats ++ runtime.ReadMemStats(&m1) ++ _, err := r.ReadMIMEHeader() ++ if err != nil { ++ t.Fatalf("ReadMIMEHeader: %v", err) ++ } ++ runtime.ReadMemStats(&m2) ++ totalAlloc += m2.TotalAlloc - m1.TotalAlloc ++ } ++ // 32k is large and we actually allocate substantially less, ++ // but prior to the fix for #58975 we allocated ~400k in this case. ++ if got, want := totalAlloc/count, uint64(32768); got > want { ++ t.Fatalf("ReadMIMEHeader allocated %v bytes, want < %v", got, want) ++ } ++} ++ + type readResponseTest struct { + in string + inCode int +-- +2.25.1 + diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-24537.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-24537.patch new file mode 100644 index 0000000000..4521f159ea --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-24537.patch @@ -0,0 +1,75 @@ +From bf8c7c575c8a552d9d79deb29e80854dc88528d0 Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Mon, 20 Mar 2023 10:43:19 -0700 +Subject: [PATCH] [release-branch.go1.20] mime/multipart: limit parsed mime + message sizes + +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802456 +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802611 +Reviewed-by: Damien Neil <dneil@google.com> +Change-Id: Ifdfa192d54f722d781a4d8c5f35b5fb72d122168 +Reviewed-on: https://go-review.googlesource.com/c/go/+/481986 +Reviewed-by: Matthew Dempsky <mdempsky@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Run-TryBot: Michael Knyszek <mknyszek@google.com> +Auto-Submit: Michael Knyszek <mknyszek@google.com> + +Upstream-Status: Backport [https://github.com/golang/go/commit/126a1d02da82f93ede7ce0bd8d3c51ef627f2104] +CVE: CVE-2023-24537 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/go/parser/parser_test.go | 16 ++++++++++++++++ + src/go/scanner/scanner.go | 5 ++++- + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/src/go/parser/parser_test.go b/src/go/parser/parser_test.go +index 1a46c87..993df63 100644 +--- a/src/go/parser/parser_test.go ++++ b/src/go/parser/parser_test.go +@@ -746,3 +746,19 @@ func TestScopeDepthLimit(t *testing.T) { + } + } + } ++ ++// TestIssue59180 tests that line number overflow doesn't cause an infinite loop. ++func TestIssue59180(t *testing.T) { ++ testcases := []string{ ++ "package p\n//line :9223372036854775806\n\n//", ++ "package p\n//line :1:9223372036854775806\n\n//", ++ "package p\n//line file:9223372036854775806\n\n//", ++ } ++ ++ for _, src := range testcases { ++ _, err := ParseFile(token.NewFileSet(), "", src, ParseComments) ++ if err == nil { ++ t.Errorf("ParseFile(%s) succeeded unexpectedly", src) ++ } ++ } ++} +diff --git a/src/go/scanner/scanner.go b/src/go/scanner/scanner.go +index f08e28c..ff847b5 100644 +--- a/src/go/scanner/scanner.go ++++ b/src/go/scanner/scanner.go +@@ -251,13 +251,16 @@ func (s *Scanner) updateLineInfo(next, offs int, text []byte) { + return + } + ++ // Put a cap on the maximum size of line and column numbers. ++ // 30 bits allows for some additional space before wrapping an int32. ++ const maxLineCol = 1<<30 - 1 + var line, col int + i2, n2, ok2 := trailingDigits(text[:i-1]) + if ok2 { + //line filename:line:col + i, i2 = i2, i + line, col = n2, n +- if col == 0 { ++ if col == 0 || col > maxLineCol { + s.error(offs+i2, "invalid column number: "+string(text[i2:])) + return + } +-- +2.25.1 diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch new file mode 100644 index 0000000000..bb0a416f46 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch @@ -0,0 +1,597 @@ +From b1e4e8ec7e946ff2d3bb37ac99c5468ceb49c362 Mon Sep 17 00:00:00 2001 +From: Russ Cox <rsc@golang.org> +Date: Thu, 20 May 2021 12:46:33 -0400 +Subject: [PATCH 1/2] html/template, text/template: implement break and + continue for range loops + +Break and continue for range loops was accepted as a proposal in June 2017. +It was implemented in CL 66410 (Oct 2017) +but then rolled back in CL 92155 (Feb 2018) +because html/template changes had not been implemented. + +This CL reimplements break and continue in text/template +and then adds support for them in html/template as well. + +Fixes #20531. + +Change-Id: I05330482a976f1c078b4b49c2287bd9031bb7616 +Reviewed-on: https://go-review.googlesource.com/c/go/+/321491 +Trust: Russ Cox <rsc@golang.org> +Run-TryBot: Russ Cox <rsc@golang.org> +TryBot-Result: Go Bot <gobot@golang.org> +Reviewed-by: Rob Pike <r@golang.org> + +Upstream-Status: Backport from https://github.com/golang/go/commit/d0dd26a88c019d54f22463daae81e785f5867565 +CVE: CVE-2023-24538 +Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> +--- + src/html/template/context.go | 4 ++ + src/html/template/escape.go | 71 ++++++++++++++++++++++++++++++++++- + src/html/template/escape_test.go | 24 ++++++++++++ + src/html/template/exec_test.go | 2 + + src/text/template/doc.go | 8 ++++ + src/text/template/exec.go | 24 +++++++++++- + src/text/template/exec_test.go | 2 + + src/text/template/parse/lex.go | 13 ++++++- + src/text/template/parse/lex_test.go | 2 + + src/text/template/parse/node.go | 36 ++++++++++++++++++ + src/text/template/parse/parse.go | 42 ++++++++++++++++++++- + src/text/template/parse/parse_test.go | 8 ++++ + 12 files changed, 232 insertions(+), 4 deletions(-) + +diff --git a/src/html/template/context.go b/src/html/template/context.go +index f7d4849..aaa7d08 100644 +--- a/src/html/template/context.go ++++ b/src/html/template/context.go +@@ -6,6 +6,7 @@ package template + + import ( + "fmt" ++ "text/template/parse" + ) + + // context describes the state an HTML parser must be in when it reaches the +@@ -22,6 +23,7 @@ type context struct { + jsCtx jsCtx + attr attr + element element ++ n parse.Node // for range break/continue + err *Error + } + +@@ -141,6 +143,8 @@ const ( + // stateError is an infectious error state outside any valid + // HTML/CSS/JS construct. + stateError ++ // stateDead marks unreachable code after a {{break}} or {{continue}}. ++ stateDead + ) + + // isComment is true for any state that contains content meant for template +diff --git a/src/html/template/escape.go b/src/html/template/escape.go +index 8739735..6dea79c 100644 +--- a/src/html/template/escape.go ++++ b/src/html/template/escape.go +@@ -97,6 +97,15 @@ type escaper struct { + actionNodeEdits map[*parse.ActionNode][]string + templateNodeEdits map[*parse.TemplateNode]string + textNodeEdits map[*parse.TextNode][]byte ++ // rangeContext holds context about the current range loop. ++ rangeContext *rangeContext ++} ++ ++// rangeContext holds information about the current range loop. ++type rangeContext struct { ++ outer *rangeContext // outer loop ++ breaks []context // context at each break action ++ continues []context // context at each continue action + } + + // makeEscaper creates a blank escaper for the given set. +@@ -109,6 +118,7 @@ func makeEscaper(n *nameSpace) escaper { + map[*parse.ActionNode][]string{}, + map[*parse.TemplateNode]string{}, + map[*parse.TextNode][]byte{}, ++ nil, + } + } + +@@ -124,8 +134,16 @@ func (e *escaper) escape(c context, n parse.Node) context { + switch n := n.(type) { + case *parse.ActionNode: + return e.escapeAction(c, n) ++ case *parse.BreakNode: ++ c.n = n ++ e.rangeContext.breaks = append(e.rangeContext.breaks, c) ++ return context{state: stateDead} + case *parse.CommentNode: + return c ++ case *parse.ContinueNode: ++ c.n = n ++ e.rangeContext.continues = append(e.rangeContext.breaks, c) ++ return context{state: stateDead} + case *parse.IfNode: + return e.escapeBranch(c, &n.BranchNode, "if") + case *parse.ListNode: +@@ -427,6 +445,12 @@ func join(a, b context, node parse.Node, nodeName string) context { + if b.state == stateError { + return b + } ++ if a.state == stateDead { ++ return b ++ } ++ if b.state == stateDead { ++ return a ++ } + if a.eq(b) { + return a + } +@@ -466,14 +490,27 @@ func join(a, b context, node parse.Node, nodeName string) context { + + // escapeBranch escapes a branch template node: "if", "range" and "with". + func (e *escaper) escapeBranch(c context, n *parse.BranchNode, nodeName string) context { ++ if nodeName == "range" { ++ e.rangeContext = &rangeContext{outer: e.rangeContext} ++ } + c0 := e.escapeList(c, n.List) +- if nodeName == "range" && c0.state != stateError { ++ if nodeName == "range" { ++ if c0.state != stateError { ++ c0 = joinRange(c0, e.rangeContext) ++ } ++ e.rangeContext = e.rangeContext.outer ++ if c0.state == stateError { ++ return c0 ++ } ++ + // The "true" branch of a "range" node can execute multiple times. + // We check that executing n.List once results in the same context + // as executing n.List twice. ++ e.rangeContext = &rangeContext{outer: e.rangeContext} + c1, _ := e.escapeListConditionally(c0, n.List, nil) + c0 = join(c0, c1, n, nodeName) + if c0.state == stateError { ++ e.rangeContext = e.rangeContext.outer + // Make clear that this is a problem on loop re-entry + // since developers tend to overlook that branch when + // debugging templates. +@@ -481,11 +518,39 @@ func (e *escaper) escapeBranch(c context, n *parse.BranchNode, nodeName string) + c0.err.Description = "on range loop re-entry: " + c0.err.Description + return c0 + } ++ c0 = joinRange(c0, e.rangeContext) ++ e.rangeContext = e.rangeContext.outer ++ if c0.state == stateError { ++ return c0 ++ } + } + c1 := e.escapeList(c, n.ElseList) + return join(c0, c1, n, nodeName) + } + ++func joinRange(c0 context, rc *rangeContext) context { ++ // Merge contexts at break and continue statements into overall body context. ++ // In theory we could treat breaks differently from continues, but for now it is ++ // enough to treat them both as going back to the start of the loop (which may then stop). ++ for _, c := range rc.breaks { ++ c0 = join(c0, c, c.n, "range") ++ if c0.state == stateError { ++ c0.err.Line = c.n.(*parse.BreakNode).Line ++ c0.err.Description = "at range loop break: " + c0.err.Description ++ return c0 ++ } ++ } ++ for _, c := range rc.continues { ++ c0 = join(c0, c, c.n, "range") ++ if c0.state == stateError { ++ c0.err.Line = c.n.(*parse.ContinueNode).Line ++ c0.err.Description = "at range loop continue: " + c0.err.Description ++ return c0 ++ } ++ } ++ return c0 ++} ++ + // escapeList escapes a list template node. + func (e *escaper) escapeList(c context, n *parse.ListNode) context { + if n == nil { +@@ -493,6 +558,9 @@ func (e *escaper) escapeList(c context, n *parse.ListNode) context { + } + for _, m := range n.Nodes { + c = e.escape(c, m) ++ if c.state == stateDead { ++ break ++ } + } + return c + } +@@ -503,6 +571,7 @@ func (e *escaper) escapeList(c context, n *parse.ListNode) context { + // which is the same as whether e was updated. + func (e *escaper) escapeListConditionally(c context, n *parse.ListNode, filter func(*escaper, context) bool) (context, bool) { + e1 := makeEscaper(e.ns) ++ e1.rangeContext = e.rangeContext + // Make type inferences available to f. + for k, v := range e.output { + e1.output[k] = v +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index fbc84a7..3b0aa8c 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -920,6 +920,22 @@ func TestErrors(t *testing.T) { + "<a href='/foo?{{range .Items}}&{{.K}}={{.V}}{{end}}'>", + "", + }, ++ { ++ "{{range .Items}}<a{{if .X}}{{end}}>{{end}}", ++ "", ++ }, ++ { ++ "{{range .Items}}<a{{if .X}}{{end}}>{{continue}}{{end}}", ++ "", ++ }, ++ { ++ "{{range .Items}}<a{{if .X}}{{end}}>{{break}}{{end}}", ++ "", ++ }, ++ { ++ "{{range .Items}}<a{{if .X}}{{end}}>{{if .X}}{{break}}{{end}}{{end}}", ++ "", ++ }, + // Error cases. + { + "{{if .Cond}}<a{{end}}", +@@ -956,6 +972,14 @@ func TestErrors(t *testing.T) { + "z:2:8: on range loop re-entry: {{range}} branches", + }, + { ++ "{{range .Items}}<a{{if .X}}{{break}}{{end}}>{{end}}", ++ "z:1:29: at range loop break: {{range}} branches end in different contexts", ++ }, ++ { ++ "{{range .Items}}<a{{if .X}}{{continue}}{{end}}>{{end}}", ++ "z:1:29: at range loop continue: {{range}} branches end in different contexts", ++ }, ++ { + "<a b=1 c={{.H}}", + "z: ends in a non-text context: {stateAttr delimSpaceOrTagEnd", + }, +diff --git a/src/html/template/exec_test.go b/src/html/template/exec_test.go +index 8885873..523340b 100644 +--- a/src/html/template/exec_test.go ++++ b/src/html/template/exec_test.go +@@ -567,6 +567,8 @@ var execTests = []execTest{ + {"range empty no else", "{{range .SIEmpty}}-{{.}}-{{end}}", "", tVal, true}, + {"range []int else", "{{range .SI}}-{{.}}-{{else}}EMPTY{{end}}", "-3--4--5-", tVal, true}, + {"range empty else", "{{range .SIEmpty}}-{{.}}-{{else}}EMPTY{{end}}", "EMPTY", tVal, true}, ++ {"range []int break else", "{{range .SI}}-{{.}}-{{break}}NOTREACHED{{else}}EMPTY{{end}}", "-3-", tVal, true}, ++ {"range []int continue else", "{{range .SI}}-{{.}}-{{continue}}NOTREACHED{{else}}EMPTY{{end}}", "-3--4--5-", tVal, true}, + {"range []bool", "{{range .SB}}-{{.}}-{{end}}", "-true--false-", tVal, true}, + {"range []int method", "{{range .SI | .MAdd .I}}-{{.}}-{{end}}", "-20--21--22-", tVal, true}, + {"range map", "{{range .MSI}}-{{.}}-{{end}}", "-1--3--2-", tVal, true}, +diff --git a/src/text/template/doc.go b/src/text/template/doc.go +index 7b30294..0228b15 100644 +--- a/src/text/template/doc.go ++++ b/src/text/template/doc.go +@@ -112,6 +112,14 @@ data, defined in detail in the corresponding sections that follow. + T0 is executed; otherwise, dot is set to the successive elements + of the array, slice, or map and T1 is executed. + ++ {{break}} ++ The innermost {{range pipeline}} loop is ended early, stopping the ++ current iteration and bypassing all remaining iterations. ++ ++ {{continue}} ++ The current iteration of the innermost {{range pipeline}} loop is ++ stopped, and the loop starts the next iteration. ++ + {{template "name"}} + The template with the specified name is executed with nil data. + +diff --git a/src/text/template/exec.go b/src/text/template/exec.go +index 5ad3b4e..92fa9d9 100644 +--- a/src/text/template/exec.go ++++ b/src/text/template/exec.go +@@ -5,6 +5,7 @@ + package template + + import ( ++ "errors" + "fmt" + "internal/fmtsort" + "io" +@@ -243,6 +244,12 @@ func (t *Template) DefinedTemplates() string { + return b.String() + } + ++// Sentinel errors for use with panic to signal early exits from range loops. ++var ( ++ walkBreak = errors.New("break") ++ walkContinue = errors.New("continue") ++) ++ + // Walk functions step through the major pieces of the template structure, + // generating output as they go. + func (s *state) walk(dot reflect.Value, node parse.Node) { +@@ -255,7 +262,11 @@ func (s *state) walk(dot reflect.Value, node parse.Node) { + if len(node.Pipe.Decl) == 0 { + s.printValue(node, val) + } ++ case *parse.BreakNode: ++ panic(walkBreak) + case *parse.CommentNode: ++ case *parse.ContinueNode: ++ panic(walkContinue) + case *parse.IfNode: + s.walkIfOrWith(parse.NodeIf, dot, node.Pipe, node.List, node.ElseList) + case *parse.ListNode: +@@ -334,6 +345,11 @@ func isTrue(val reflect.Value) (truth, ok bool) { + + func (s *state) walkRange(dot reflect.Value, r *parse.RangeNode) { + s.at(r) ++ defer func() { ++ if r := recover(); r != nil && r != walkBreak { ++ panic(r) ++ } ++ }() + defer s.pop(s.mark()) + val, _ := indirect(s.evalPipeline(dot, r.Pipe)) + // mark top of stack before any variables in the body are pushed. +@@ -347,8 +363,14 @@ func (s *state) walkRange(dot reflect.Value, r *parse.RangeNode) { + if len(r.Pipe.Decl) > 1 { + s.setTopVar(2, index) + } ++ defer s.pop(mark) ++ defer func() { ++ // Consume panic(walkContinue) ++ if r := recover(); r != nil && r != walkContinue { ++ panic(r) ++ } ++ }() + s.walk(elem, r.List) +- s.pop(mark) + } + switch val.Kind() { + case reflect.Array, reflect.Slice: +diff --git a/src/text/template/exec_test.go b/src/text/template/exec_test.go +index ef52164..586af55 100644 +--- a/src/text/template/exec_test.go ++++ b/src/text/template/exec_test.go +@@ -564,6 +564,8 @@ var execTests = []execTest{ + {"range empty no else", "{{range .SIEmpty}}-{{.}}-{{end}}", "", tVal, true}, + {"range []int else", "{{range .SI}}-{{.}}-{{else}}EMPTY{{end}}", "-3--4--5-", tVal, true}, + {"range empty else", "{{range .SIEmpty}}-{{.}}-{{else}}EMPTY{{end}}", "EMPTY", tVal, true}, ++ {"range []int break else", "{{range .SI}}-{{.}}-{{break}}NOTREACHED{{else}}EMPTY{{end}}", "-3-", tVal, true}, ++ {"range []int continue else", "{{range .SI}}-{{.}}-{{continue}}NOTREACHED{{else}}EMPTY{{end}}", "-3--4--5-", tVal, true}, + {"range []bool", "{{range .SB}}-{{.}}-{{end}}", "-true--false-", tVal, true}, + {"range []int method", "{{range .SI | .MAdd .I}}-{{.}}-{{end}}", "-20--21--22-", tVal, true}, + {"range map", "{{range .MSI}}-{{.}}-{{end}}", "-1--3--2-", tVal, true}, +diff --git a/src/text/template/parse/lex.go b/src/text/template/parse/lex.go +index 6784071..95e3377 100644 +--- a/src/text/template/parse/lex.go ++++ b/src/text/template/parse/lex.go +@@ -62,6 +62,8 @@ const ( + // Keywords appear after all the rest. + itemKeyword // used only to delimit the keywords + itemBlock // block keyword ++ itemBreak // break keyword ++ itemContinue // continue keyword + itemDot // the cursor, spelled '.' + itemDefine // define keyword + itemElse // else keyword +@@ -76,6 +78,8 @@ const ( + var key = map[string]itemType{ + ".": itemDot, + "block": itemBlock, ++ "break": itemBreak, ++ "continue": itemContinue, + "define": itemDefine, + "else": itemElse, + "end": itemEnd, +@@ -119,6 +123,8 @@ type lexer struct { + parenDepth int // nesting depth of ( ) exprs + line int // 1+number of newlines seen + startLine int // start line of this item ++ breakOK bool // break keyword allowed ++ continueOK bool // continue keyword allowed + } + + // next returns the next rune in the input. +@@ -461,7 +467,12 @@ Loop: + } + switch { + case key[word] > itemKeyword: +- l.emit(key[word]) ++ item := key[word] ++ if item == itemBreak && !l.breakOK || item == itemContinue && !l.continueOK { ++ l.emit(itemIdentifier) ++ } else { ++ l.emit(item) ++ } + case word[0] == '.': + l.emit(itemField) + case word == "true", word == "false": +diff --git a/src/text/template/parse/lex_test.go b/src/text/template/parse/lex_test.go +index 6510eed..df6aabf 100644 +--- a/src/text/template/parse/lex_test.go ++++ b/src/text/template/parse/lex_test.go +@@ -35,6 +35,8 @@ var itemName = map[itemType]string{ + // keywords + itemDot: ".", + itemBlock: "block", ++ itemBreak: "break", ++ itemContinue: "continue", + itemDefine: "define", + itemElse: "else", + itemIf: "if", +diff --git a/src/text/template/parse/node.go b/src/text/template/parse/node.go +index 177482f..4726822 100644 +--- a/src/text/template/parse/node.go ++++ b/src/text/template/parse/node.go +@@ -71,6 +71,8 @@ const ( + NodeVariable // A $ variable. + NodeWith // A with action. + NodeComment // A comment. ++ NodeBreak // A break action. ++ NodeContinue // A continue action. + ) + + // Nodes. +@@ -907,6 +909,40 @@ func (i *IfNode) Copy() Node { + return i.tr.newIf(i.Pos, i.Line, i.Pipe.CopyPipe(), i.List.CopyList(), i.ElseList.CopyList()) + } + ++// BreakNode represents a {{break}} action. ++type BreakNode struct { ++ tr *Tree ++ NodeType ++ Pos ++ Line int ++} ++ ++func (t *Tree) newBreak(pos Pos, line int) *BreakNode { ++ return &BreakNode{tr: t, NodeType: NodeBreak, Pos: pos, Line: line} ++} ++ ++func (b *BreakNode) Copy() Node { return b.tr.newBreak(b.Pos, b.Line) } ++func (b *BreakNode) String() string { return "{{break}}" } ++func (b *BreakNode) tree() *Tree { return b.tr } ++func (b *BreakNode) writeTo(sb *strings.Builder) { sb.WriteString("{{break}}") } ++ ++// ContinueNode represents a {{continue}} action. ++type ContinueNode struct { ++ tr *Tree ++ NodeType ++ Pos ++ Line int ++} ++ ++func (t *Tree) newContinue(pos Pos, line int) *ContinueNode { ++ return &ContinueNode{tr: t, NodeType: NodeContinue, Pos: pos, Line: line} ++} ++ ++func (c *ContinueNode) Copy() Node { return c.tr.newContinue(c.Pos, c.Line) } ++func (c *ContinueNode) String() string { return "{{continue}}" } ++func (c *ContinueNode) tree() *Tree { return c.tr } ++func (c *ContinueNode) writeTo(sb *strings.Builder) { sb.WriteString("{{continue}}") } ++ + // RangeNode represents a {{range}} action and its commands. + type RangeNode struct { + BranchNode +diff --git a/src/text/template/parse/parse.go b/src/text/template/parse/parse.go +index 1a63961..d92bed5 100644 +--- a/src/text/template/parse/parse.go ++++ b/src/text/template/parse/parse.go +@@ -31,6 +31,7 @@ type Tree struct { + vars []string // variables defined at the moment. + treeSet map[string]*Tree + actionLine int // line of left delim starting action ++ rangeDepth int + mode Mode + } + +@@ -224,6 +225,8 @@ func (t *Tree) startParse(funcs []map[string]interface{}, lex *lexer, treeSet ma + t.vars = []string{"$"} + t.funcs = funcs + t.treeSet = treeSet ++ lex.breakOK = !t.hasFunction("break") ++ lex.continueOK = !t.hasFunction("continue") + } + + // stopParse terminates parsing. +@@ -386,6 +389,10 @@ func (t *Tree) action() (n Node) { + switch token := t.nextNonSpace(); token.typ { + case itemBlock: + return t.blockControl() ++ case itemBreak: ++ return t.breakControl(token.pos, token.line) ++ case itemContinue: ++ return t.continueControl(token.pos, token.line) + case itemElse: + return t.elseControl() + case itemEnd: +@@ -405,6 +412,32 @@ func (t *Tree) action() (n Node) { + return t.newAction(token.pos, token.line, t.pipeline("command", itemRightDelim)) + } + ++// Break: ++// {{break}} ++// Break keyword is past. ++func (t *Tree) breakControl(pos Pos, line int) Node { ++ if token := t.next(); token.typ != itemRightDelim { ++ t.unexpected(token, "in {{break}}") ++ } ++ if t.rangeDepth == 0 { ++ t.errorf("{{break}} outside {{range}}") ++ } ++ return t.newBreak(pos, line) ++} ++ ++// Continue: ++// {{continue}} ++// Continue keyword is past. ++func (t *Tree) continueControl(pos Pos, line int) Node { ++ if token := t.next(); token.typ != itemRightDelim { ++ t.unexpected(token, "in {{continue}}") ++ } ++ if t.rangeDepth == 0 { ++ t.errorf("{{continue}} outside {{range}}") ++ } ++ return t.newContinue(pos, line) ++} ++ + // Pipeline: + // declarations? command ('|' command)* + func (t *Tree) pipeline(context string, end itemType) (pipe *PipeNode) { +@@ -480,8 +513,14 @@ func (t *Tree) checkPipeline(pipe *PipeNode, context string) { + func (t *Tree) parseControl(allowElseIf bool, context string) (pos Pos, line int, pipe *PipeNode, list, elseList *ListNode) { + defer t.popVars(len(t.vars)) + pipe = t.pipeline(context, itemRightDelim) ++ if context == "range" { ++ t.rangeDepth++ ++ } + var next Node + list, next = t.itemList() ++ if context == "range" { ++ t.rangeDepth-- ++ } + switch next.Type() { + case nodeEnd: //done + case nodeElse: +@@ -523,7 +562,8 @@ func (t *Tree) ifControl() Node { + // {{range pipeline}} itemList {{else}} itemList {{end}} + // Range keyword is past. + func (t *Tree) rangeControl() Node { +- return t.newRange(t.parseControl(false, "range")) ++ r := t.newRange(t.parseControl(false, "range")) ++ return r + } + + // With: +diff --git a/src/text/template/parse/parse_test.go b/src/text/template/parse/parse_test.go +index 9b1be27..c3679a0 100644 +--- a/src/text/template/parse/parse_test.go ++++ b/src/text/template/parse/parse_test.go +@@ -230,6 +230,10 @@ var parseTests = []parseTest{ + `{{range $x := .SI}}{{.}}{{end}}`}, + {"range 2 vars", "{{range $x, $y := .SI}}{{.}}{{end}}", noError, + `{{range $x, $y := .SI}}{{.}}{{end}}`}, ++ {"range with break", "{{range .SI}}{{.}}{{break}}{{end}}", noError, ++ `{{range .SI}}{{.}}{{break}}{{end}}`}, ++ {"range with continue", "{{range .SI}}{{.}}{{continue}}{{end}}", noError, ++ `{{range .SI}}{{.}}{{continue}}{{end}}`}, + {"constants", "{{range .SI 1 -3.2i true false 'a' nil}}{{end}}", noError, + `{{range .SI 1 -3.2i true false 'a' nil}}{{end}}`}, + {"template", "{{template `x`}}", noError, +@@ -279,6 +283,10 @@ var parseTests = []parseTest{ + {"adjacent args", "{{printf 3`x`}}", hasError, ""}, + {"adjacent args with .", "{{printf `x`.}}", hasError, ""}, + {"extra end after if", "{{if .X}}a{{else if .Y}}b{{end}}{{end}}", hasError, ""}, ++ {"break outside range", "{{range .}}{{end}} {{break}}", hasError, ""}, ++ {"continue outside range", "{{range .}}{{end}} {{continue}}", hasError, ""}, ++ {"break in range else", "{{range .}}{{else}}{{break}}{{end}}", hasError, ""}, ++ {"continue in range else", "{{range .}}{{else}}{{continue}}{{end}}", hasError, ""}, + // Other kinds of assignments and operators aren't available yet. + {"bug0a", "{{$x := 0}}{{$x}}", noError, "{{$x := 0}}{{$x}}"}, + {"bug0b", "{{$x += 1}}{{$x}}", hasError, ""}, +-- +2.7.4 diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_2.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_2.patch new file mode 100644 index 0000000000..f94f0f55c7 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_2.patch @@ -0,0 +1,371 @@ +From 07cc3b8711a8efbb5885f56dd90d854049ad2f7d Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Mon, 20 Mar 2023 11:01:13 -0700 +Subject: [PATCH 2/2] html/template: disallow actions in JS template literals + +ECMAScript 6 introduced template literals[0][1] which are delimited with +backticks. These need to be escaped in a similar fashion to the +delimiters for other string literals. Additionally template literals can +contain special syntax for string interpolation. + +There is no clear way to allow safe insertion of actions within JS +template literals, as handling (JS) string interpolation inside of these +literals is rather complex. As such we've chosen to simply disallow +template actions within these template literals. + +A new error code is added for this parsing failure case, errJsTmplLit, +but it is unexported as it is not backwards compatible with other minor +release versions to introduce an API change in a minor release. We will +export this code in the next major release. + +The previous behavior (with the cavet that backticks are now escaped +properly) can be re-enabled with GODEBUG=jstmpllitinterp=1. + +This change subsumes CL471455. + +Thanks to Sohom Datta, Manipal Institute of Technology, for reporting +this issue. + +Fixes CVE-2023-24538 +For #59234 +Fixes #59271 + +[0] https://tc39.es/ecma262/multipage/ecmascript-language-expressions.html#sec-template-literals +[1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals + +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802457 +Reviewed-by: Damien Neil <dneil@google.com> +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802612 +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Change-Id: Ic7f10595615f2b2740d9c85ad7ef40dc0e78c04c +Reviewed-on: https://go-review.googlesource.com/c/go/+/481987 +Auto-Submit: Michael Knyszek <mknyszek@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Run-TryBot: Michael Knyszek <mknyszek@google.com> +Reviewed-by: Matthew Dempsky <mdempsky@google.com> + +Upstream-Status: Backport from https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b +CVE: CVE-2023-24538 +Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> +--- + src/html/template/context.go | 2 ++ + src/html/template/error.go | 13 ++++++++ + src/html/template/escape.go | 11 +++++++ + src/html/template/escape_test.go | 66 ++++++++++++++++++++++----------------- + src/html/template/js.go | 2 ++ + src/html/template/js_test.go | 2 +- + src/html/template/jsctx_string.go | 9 ++++++ + src/html/template/state_string.go | 37 ++++++++++++++++++++-- + src/html/template/transition.go | 7 ++++- + 9 files changed, 116 insertions(+), 33 deletions(-) + +diff --git a/src/html/template/context.go b/src/html/template/context.go +index f7d4849..0b65313 100644 +--- a/src/html/template/context.go ++++ b/src/html/template/context.go +@@ -116,6 +116,8 @@ const ( + stateJSDqStr + // stateJSSqStr occurs inside a JavaScript single quoted string. + stateJSSqStr ++ // stateJSBqStr occurs inside a JavaScript back quoted string. ++ stateJSBqStr + // stateJSRegexp occurs inside a JavaScript regexp literal. + stateJSRegexp + // stateJSBlockCmt occurs inside a JavaScript /* block comment */. +diff --git a/src/html/template/error.go b/src/html/template/error.go +index 0e52706..fd26b64 100644 +--- a/src/html/template/error.go ++++ b/src/html/template/error.go +@@ -211,6 +211,19 @@ const ( + // pipeline occurs in an unquoted attribute value context, "html" is + // disallowed. Avoid using "html" and "urlquery" entirely in new templates. + ErrPredefinedEscaper ++ ++ // errJSTmplLit: "... appears in a JS template literal" ++ // Example: ++ // <script>var tmpl = `{{.Interp}`</script> ++ // Discussion: ++ // Package html/template does not support actions inside of JS template ++ // literals. ++ // ++ // TODO(rolandshoemaker): we cannot add this as an exported error in a minor ++ // release, since it is backwards incompatible with the other minor ++ // releases. As such we need to leave it unexported, and then we'll add it ++ // in the next major release. ++ errJSTmplLit + ) + + func (e *Error) Error() string { +diff --git a/src/html/template/escape.go b/src/html/template/escape.go +index 8739735..ca078f4 100644 +--- a/src/html/template/escape.go ++++ b/src/html/template/escape.go +@@ -8,6 +8,7 @@ import ( + "bytes" + "fmt" + "html" ++ "internal/godebug" + "io" + "text/template" + "text/template/parse" +@@ -205,6 +206,16 @@ func (e *escaper) escapeAction(c context, n *parse.ActionNode) context { + c.jsCtx = jsCtxDivOp + case stateJSDqStr, stateJSSqStr: + s = append(s, "_html_template_jsstrescaper") ++ case stateJSBqStr: ++ debugAllowActionJSTmpl := godebug.Get("jstmpllitinterp") ++ if debugAllowActionJSTmpl == "1" { ++ s = append(s, "_html_template_jsstrescaper") ++ } else { ++ return context{ ++ state: stateError, ++ err: errorf(errJSTmplLit, n, n.Line, "%s appears in a JS template literal", n), ++ } ++ } + case stateJSRegexp: + s = append(s, "_html_template_jsregexpescaper") + case stateCSS: +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index 3b0aa8c..a695b17 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -681,35 +681,31 @@ func TestEscape(t *testing.T) { + } + + for _, test := range tests { +- tmpl := New(test.name) +- tmpl = Must(tmpl.Parse(test.input)) +- // Check for bug 6459: Tree field was not set in Parse. +- if tmpl.Tree != tmpl.text.Tree { +- t.Errorf("%s: tree not set properly", test.name) +- continue +- } +- b := new(bytes.Buffer) +- if err := tmpl.Execute(b, data); err != nil { +- t.Errorf("%s: template execution failed: %s", test.name, err) +- continue +- } +- if w, g := test.output, b.String(); w != g { +- t.Errorf("%s: escaped output: want\n\t%q\ngot\n\t%q", test.name, w, g) +- continue +- } +- b.Reset() +- if err := tmpl.Execute(b, pdata); err != nil { +- t.Errorf("%s: template execution failed for pointer: %s", test.name, err) +- continue +- } +- if w, g := test.output, b.String(); w != g { +- t.Errorf("%s: escaped output for pointer: want\n\t%q\ngot\n\t%q", test.name, w, g) +- continue +- } +- if tmpl.Tree != tmpl.text.Tree { +- t.Errorf("%s: tree mismatch", test.name) +- continue +- } ++ t.Run(test.name, func(t *testing.T) { ++ tmpl := New(test.name) ++ tmpl = Must(tmpl.Parse(test.input)) ++ // Check for bug 6459: Tree field was not set in Parse. ++ if tmpl.Tree != tmpl.text.Tree { ++ t.Fatalf("%s: tree not set properly", test.name) ++ } ++ b := new(strings.Builder) ++ if err := tmpl.Execute(b, data); err != nil { ++ t.Fatalf("%s: template execution failed: %s", test.name, err) ++ } ++ if w, g := test.output, b.String(); w != g { ++ t.Fatalf("%s: escaped output: want\n\t%q\ngot\n\t%q", test.name, w, g) ++ } ++ b.Reset() ++ if err := tmpl.Execute(b, pdata); err != nil { ++ t.Fatalf("%s: template execution failed for pointer: %s", test.name, err) ++ } ++ if w, g := test.output, b.String(); w != g { ++ t.Fatalf("%s: escaped output for pointer: want\n\t%q\ngot\n\t%q", test.name, w, g) ++ } ++ if tmpl.Tree != tmpl.text.Tree { ++ t.Fatalf("%s: tree mismatch", test.name) ++ } ++ }) + } + } + +@@ -936,6 +932,10 @@ func TestErrors(t *testing.T) { + "{{range .Items}}<a{{if .X}}{{end}}>{{if .X}}{{break}}{{end}}{{end}}", + "", + }, ++ { ++ "<script>var a = `${a+b}`</script>`", ++ "", ++ }, + // Error cases. + { + "{{if .Cond}}<a{{end}}", +@@ -1082,6 +1082,10 @@ func TestErrors(t *testing.T) { + // html is allowed since it is the last command in the pipeline, but urlquery is not. + `predefined escaper "urlquery" disallowed in template`, + }, ++ { ++ "<script>var tmpl = `asd {{.}}`;</script>", ++ `{{.}} appears in a JS template literal`, ++ }, + } + for _, test := range tests { + buf := new(bytes.Buffer) +@@ -1304,6 +1308,10 @@ func TestEscapeText(t *testing.T) { + context{state: stateJSSqStr, delim: delimDoubleQuote, attr: attrScript}, + }, + { ++ "<a onclick=\"`foo", ++ context{state: stateJSBqStr, delim: delimDoubleQuote, attr: attrScript}, ++ }, ++ { + `<A ONCLICK="'`, + context{state: stateJSSqStr, delim: delimDoubleQuote, attr: attrScript}, + }, +diff --git a/src/html/template/js.go b/src/html/template/js.go +index ea9c183..b888eaf 100644 +--- a/src/html/template/js.go ++++ b/src/html/template/js.go +@@ -308,6 +308,7 @@ var jsStrReplacementTable = []string{ + // Encode HTML specials as hex so the output can be embedded + // in HTML attributes without further encoding. + '"': `\u0022`, ++ '`': `\u0060`, + '&': `\u0026`, + '\'': `\u0027`, + '+': `\u002b`, +@@ -331,6 +332,7 @@ var jsStrNormReplacementTable = []string{ + '"': `\u0022`, + '&': `\u0026`, + '\'': `\u0027`, ++ '`': `\u0060`, + '+': `\u002b`, + '/': `\/`, + '<': `\u003c`, +diff --git a/src/html/template/js_test.go b/src/html/template/js_test.go +index d7ee47b..7d963ae 100644 +--- a/src/html/template/js_test.go ++++ b/src/html/template/js_test.go +@@ -292,7 +292,7 @@ func TestEscapersOnLower7AndSelectHighCodepoints(t *testing.T) { + `0123456789:;\u003c=\u003e?` + + `@ABCDEFGHIJKLMNO` + + `PQRSTUVWXYZ[\\]^_` + +- "`abcdefghijklmno" + ++ "\\u0060abcdefghijklmno" + + "pqrstuvwxyz{|}~\u007f" + + "\u00A0\u0100\\u2028\\u2029\ufeff\U0001D11E", + }, +diff --git a/src/html/template/jsctx_string.go b/src/html/template/jsctx_string.go +index dd1d87e..2394893 100644 +--- a/src/html/template/jsctx_string.go ++++ b/src/html/template/jsctx_string.go +@@ -4,6 +4,15 @@ package template + + import "strconv" + ++func _() { ++ // An "invalid array index" compiler error signifies that the constant values have changed. ++ // Re-run the stringer command to generate them again. ++ var x [1]struct{} ++ _ = x[jsCtxRegexp-0] ++ _ = x[jsCtxDivOp-1] ++ _ = x[jsCtxUnknown-2] ++} ++ + const _jsCtx_name = "jsCtxRegexpjsCtxDivOpjsCtxUnknown" + + var _jsCtx_index = [...]uint8{0, 11, 21, 33} +diff --git a/src/html/template/state_string.go b/src/html/template/state_string.go +index 05104be..6fb1a6e 100644 +--- a/src/html/template/state_string.go ++++ b/src/html/template/state_string.go +@@ -4,9 +4,42 @@ package template + + import "strconv" + +-const _state_name = "stateTextstateTagstateAttrNamestateAfterNamestateBeforeValuestateHTMLCmtstateRCDATAstateAttrstateURLstateSrcsetstateJSstateJSDqStrstateJSSqStrstateJSRegexpstateJSBlockCmtstateJSLineCmtstateCSSstateCSSDqStrstateCSSSqStrstateCSSDqURLstateCSSSqURLstateCSSURLstateCSSBlockCmtstateCSSLineCmtstateError" ++func _() { ++ // An "invalid array index" compiler error signifies that the constant values have changed. ++ // Re-run the stringer command to generate them again. ++ var x [1]struct{} ++ _ = x[stateText-0] ++ _ = x[stateTag-1] ++ _ = x[stateAttrName-2] ++ _ = x[stateAfterName-3] ++ _ = x[stateBeforeValue-4] ++ _ = x[stateHTMLCmt-5] ++ _ = x[stateRCDATA-6] ++ _ = x[stateAttr-7] ++ _ = x[stateURL-8] ++ _ = x[stateSrcset-9] ++ _ = x[stateJS-10] ++ _ = x[stateJSDqStr-11] ++ _ = x[stateJSSqStr-12] ++ _ = x[stateJSBqStr-13] ++ _ = x[stateJSRegexp-14] ++ _ = x[stateJSBlockCmt-15] ++ _ = x[stateJSLineCmt-16] ++ _ = x[stateCSS-17] ++ _ = x[stateCSSDqStr-18] ++ _ = x[stateCSSSqStr-19] ++ _ = x[stateCSSDqURL-20] ++ _ = x[stateCSSSqURL-21] ++ _ = x[stateCSSURL-22] ++ _ = x[stateCSSBlockCmt-23] ++ _ = x[stateCSSLineCmt-24] ++ _ = x[stateError-25] ++ _ = x[stateDead-26] ++} ++ ++const _state_name = "stateTextstateTagstateAttrNamestateAfterNamestateBeforeValuestateHTMLCmtstateRCDATAstateAttrstateURLstateSrcsetstateJSstateJSDqStrstateJSSqStrstateJSBqStrstateJSRegexpstateJSBlockCmtstateJSLineCmtstateCSSstateCSSDqStrstateCSSSqStrstateCSSDqURLstateCSSSqURLstateCSSURLstateCSSBlockCmtstateCSSLineCmtstateErrorstateDead" + +-var _state_index = [...]uint16{0, 9, 17, 30, 44, 60, 72, 83, 92, 100, 111, 118, 130, 142, 155, 170, 184, 192, 205, 218, 231, 244, 255, 271, 286, 296} ++var _state_index = [...]uint16{0, 9, 17, 30, 44, 60, 72, 83, 92, 100, 111, 118, 130, 142, 154, 167, 182, 196, 204, 217, 230, 243, 256, 267, 283, 298, 308, 317} + + func (i state) String() string { + if i >= state(len(_state_index)-1) { +diff --git a/src/html/template/transition.go b/src/html/template/transition.go +index 06df679..92eb351 100644 +--- a/src/html/template/transition.go ++++ b/src/html/template/transition.go +@@ -27,6 +27,7 @@ var transitionFunc = [...]func(context, []byte) (context, int){ + stateJS: tJS, + stateJSDqStr: tJSDelimited, + stateJSSqStr: tJSDelimited, ++ stateJSBqStr: tJSDelimited, + stateJSRegexp: tJSDelimited, + stateJSBlockCmt: tBlockCmt, + stateJSLineCmt: tLineCmt, +@@ -262,7 +263,7 @@ func tURL(c context, s []byte) (context, int) { + + // tJS is the context transition function for the JS state. + func tJS(c context, s []byte) (context, int) { +- i := bytes.IndexAny(s, `"'/`) ++ i := bytes.IndexAny(s, "\"`'/") + if i == -1 { + // Entire input is non string, comment, regexp tokens. + c.jsCtx = nextJSCtx(s, c.jsCtx) +@@ -274,6 +275,8 @@ func tJS(c context, s []byte) (context, int) { + c.state, c.jsCtx = stateJSDqStr, jsCtxRegexp + case '\'': + c.state, c.jsCtx = stateJSSqStr, jsCtxRegexp ++ case '`': ++ c.state, c.jsCtx = stateJSBqStr, jsCtxRegexp + case '/': + switch { + case i+1 < len(s) && s[i+1] == '/': +@@ -303,6 +306,8 @@ func tJSDelimited(c context, s []byte) (context, int) { + switch c.state { + case stateJSSqStr: + specials = `\'` ++ case stateJSBqStr: ++ specials = "`\\" + case stateJSRegexp: + specials = `\/[]` + } +-- +2.7.4 diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-24539.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-24539.patch new file mode 100644 index 0000000000..fa19e18264 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-24539.patch @@ -0,0 +1,53 @@ +From e49282327b05192e46086bf25fd3ac691205fe80 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Thu, 13 Apr 2023 15:40:44 -0700 +Subject: [PATCH] [release-branch.go1.19] html/template: disallow angle + brackets in CSS values + +Change-Id: Iccc659c9a18415992b0c05c178792228e3a7bae4 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1826636 +Reviewed-by: Julie Qiu <julieqiu@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1851496 +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/491335 +Run-TryBot: Carlos Amedee <carlos@golang.org> +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> + +Upstream-Status: Backport [https://github.com/golang/go/commit/e49282327b05192e46086bf25fd3ac691205fe80] +CVE: CVE-2023-24539 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/html/template/css.go | 2 +- + src/html/template/css_test.go | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/html/template/css.go b/src/html/template/css.go +index 890a0c6b227fe..f650d8b3e843a 100644 +--- a/src/html/template/css.go ++++ b/src/html/template/css.go +@@ -238,7 +238,7 @@ func cssValueFilter(args ...any) string { + // inside a string that might embed JavaScript source. + for i, c := range b { + switch c { +- case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}': ++ case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}', '<', '>': + return filterFailsafe + case '-': + // Disallow <!-- or -->. +diff --git a/src/html/template/css_test.go b/src/html/template/css_test.go +index a735638b0314f..2b76256a766e9 100644 +--- a/src/html/template/css_test.go ++++ b/src/html/template/css_test.go +@@ -231,6 +231,8 @@ func TestCSSValueFilter(t *testing.T) { + {`-exp\000052 ession(alert(1337))`, "ZgotmplZ"}, + {`-expre\0000073sion`, "-expre\x073sion"}, + {`@import url evil.css`, "ZgotmplZ"}, ++ {"<", "ZgotmplZ"}, ++ {">", "ZgotmplZ"}, + } + for _, test := range tests { + got := cssValueFilter(test.css) diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-29400.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-29400.patch new file mode 100644 index 0000000000..04bd1f5fec --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-29400.patch @@ -0,0 +1,99 @@ +From 9db0e74f606b8afb28cc71d4b1c8b4ed24cabbf5 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Thu, 13 Apr 2023 14:01:50 -0700 +Subject: [PATCH] [release-branch.go1.19] html/template: emit filterFailsafe + for empty unquoted attr value + +An unquoted action used as an attribute value can result in unsafe +behavior if it is empty, as HTML normalization will result in unexpected +attributes, and may allow attribute injection. If executing a template +results in a empty unquoted attribute value, emit filterFailsafe +instead. + +Thanks to Juho Nurminen of Mattermost for reporting this issue. + +For #59722 +Fixes #59815 +Fixes CVE-2023-29400 + +Change-Id: Ia38d1b536ae2b4af5323a6c6d861e3c057c2570a +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1826631 +Reviewed-by: Julie Qiu <julieqiu@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1851498 +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/491357 +Run-TryBot: Carlos Amedee <carlos@golang.org> +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> + +Upstream-Status: Backport [https://github.com/golang/go/commit/9db0e74f606b8afb28cc71d4b1c8b4ed24cabbf5] +CVE: CVE-2023-29400 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/html/template/escape.go | 5 ++--- + src/html/template/escape_test.go | 15 +++++++++++++++ + src/html/template/html.go | 3 +++ + 3 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/src/html/template/escape.go b/src/html/template/escape.go +index ca078f4..bdccc65 100644 +--- a/src/html/template/escape.go ++++ b/src/html/template/escape.go +@@ -362,9 +362,8 @@ func normalizeEscFn(e string) string { + // for all x. + var redundantFuncs = map[string]map[string]bool{ + "_html_template_commentescaper": { +- "_html_template_attrescaper": true, +- "_html_template_nospaceescaper": true, +- "_html_template_htmlescaper": true, ++ "_html_template_attrescaper": true, ++ "_html_template_htmlescaper": true, + }, + "_html_template_cssescaper": { + "_html_template_attrescaper": true, +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index fbc84a7..4f48afe 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -678,6 +678,21 @@ func TestEscape(t *testing.T) { + `<img srcset={{",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"}}>`, + `<img srcset=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,>`, + }, ++ { ++ "unquoted empty attribute value (plaintext)", ++ "<p name={{.U}}>", ++ "<p name=ZgotmplZ>", ++ }, ++ { ++ "unquoted empty attribute value (url)", ++ "<p href={{.U}}>", ++ "<p href=ZgotmplZ>", ++ }, ++ { ++ "quoted empty attribute value", ++ "<p name=\"{{.U}}\">", ++ "<p name=\"\">", ++ }, + } + + for _, test := range tests { +diff --git a/src/html/template/html.go b/src/html/template/html.go +index 356b829..636bc21 100644 +--- a/src/html/template/html.go ++++ b/src/html/template/html.go +@@ -14,6 +14,9 @@ import ( + // htmlNospaceEscaper escapes for inclusion in unquoted attribute values. + func htmlNospaceEscaper(args ...interface{}) string { + s, t := stringify(args...) ++ if s == "" { ++ return filterFailsafe ++ } + if t == contentTypeHTML { + return htmlReplacer(stripTags(s), htmlNospaceNormReplacementTable, false) + } +-- +2.25.1 + diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-29406-1.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-29406-1.patch new file mode 100644 index 0000000000..a326cda5c4 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-29406-1.patch @@ -0,0 +1,210 @@ +From 5fa6923b1ea891400153d04ddf1545e23b40041b Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Wed, 28 Jun 2023 13:20:08 -0700 +Subject: [PATCH] [release-branch.go1.19] net/http: validate Host header before + sending + +Verify that the Host header we send is valid. +Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops" +adding an X-Evil header to HTTP/1 requests. + +Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to +header injection in the way HTTP/1 is, but x/net/http2 doesn't validate +the header and will go into a retry loop when the server rejects it. +CL 506995 adds the necessary validation to x/net/http2. + +Updates #60374 +Fixes #61075 +For CVE-2023-29406 + +Change-Id: I05cb6866a9bead043101954dfded199258c6dd04 +Reviewed-on: https://go-review.googlesource.com/c/go/+/506996 +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Run-TryBot: Damien Neil <dneil@google.com> +(cherry picked from commit 499458f7ca04087958987a33c2703c3ef03e27e2) +Reviewed-on: https://go-review.googlesource.com/c/go/+/507358 +Run-TryBot: Tatiana Bradley <tatianabradley@google.com> +Reviewed-by: Roland Shoemaker <roland@golang.org> + +Upstream-Status: Backport [https://github.com/golang/go/commit/5fa6923b1ea891400153d04ddf1545e23b40041b] +CVE: CVE-2023-29406 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/net/http/http_test.go | 29 ---------------------- + src/net/http/request.go | 45 ++++++++-------------------------- + src/net/http/request_test.go | 11 ++------- + src/net/http/transport_test.go | 18 ++++++++++++++ + 4 files changed, 30 insertions(+), 73 deletions(-) + +diff --git a/src/net/http/http_test.go b/src/net/http/http_test.go +index 0d92fe5..f03272a 100644 +--- a/src/net/http/http_test.go ++++ b/src/net/http/http_test.go +@@ -48,35 +48,6 @@ func TestForeachHeaderElement(t *testing.T) { + } + } + +-func TestCleanHost(t *testing.T) { +- tests := []struct { +- in, want string +- }{ +- {"www.google.com", "www.google.com"}, +- {"www.google.com foo", "www.google.com"}, +- {"www.google.com/foo", "www.google.com"}, +- {" first character is a space", ""}, +- {"[1::6]:8080", "[1::6]:8080"}, +- +- // Punycode: +- {"гофер.рф/foo", "xn--c1ae0ajs.xn--p1ai"}, +- {"bücher.de", "xn--bcher-kva.de"}, +- {"bücher.de:8080", "xn--bcher-kva.de:8080"}, +- // Verify we convert to lowercase before punycode: +- {"BÜCHER.de", "xn--bcher-kva.de"}, +- {"BÜCHER.de:8080", "xn--bcher-kva.de:8080"}, +- // Verify we normalize to NFC before punycode: +- {"gophér.nfc", "xn--gophr-esa.nfc"}, // NFC input; no work needed +- {"goph\u0065\u0301r.nfd", "xn--gophr-esa.nfd"}, // NFD input +- } +- for _, tt := range tests { +- got := cleanHost(tt.in) +- if tt.want != got { +- t.Errorf("cleanHost(%q) = %q, want %q", tt.in, got, tt.want) +- } +- } +-} +- + // Test that cmd/go doesn't link in the HTTP server. + // + // This catches accidental dependencies between the HTTP transport and +diff --git a/src/net/http/request.go b/src/net/http/request.go +index 09cb0c7..2f4e740 100644 +--- a/src/net/http/request.go ++++ b/src/net/http/request.go +@@ -17,7 +17,6 @@ import ( + "io" + "mime" + "mime/multipart" +- "net" + "net/http/httptrace" + "net/http/internal/ascii" + "net/textproto" +@@ -27,6 +26,7 @@ import ( + "strings" + "sync" + ++ "golang.org/x/net/http/httpguts" + "golang.org/x/net/idna" + ) + +@@ -568,12 +568,19 @@ func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitF + // is not given, use the host from the request URL. + // + // Clean the host, in case it arrives with unexpected stuff in it. +- host := cleanHost(r.Host) ++ host := r.Host + if host == "" { + if r.URL == nil { + return errMissingHost + } +- host = cleanHost(r.URL.Host) ++ host = r.URL.Host ++ } ++ host, err = httpguts.PunycodeHostPort(host) ++ if err != nil { ++ return err ++ } ++ if !httpguts.ValidHostHeader(host) { ++ return errors.New("http: invalid Host header") + } + + // According to RFC 6874, an HTTP client, proxy, or other +@@ -730,38 +737,6 @@ func idnaASCII(v string) (string, error) { + return idna.Lookup.ToASCII(v) + } + +-// cleanHost cleans up the host sent in request's Host header. +-// +-// It both strips anything after '/' or ' ', and puts the value +-// into Punycode form, if necessary. +-// +-// Ideally we'd clean the Host header according to the spec: +-// https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]") +-// https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host) +-// https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host) +-// But practically, what we are trying to avoid is the situation in +-// issue 11206, where a malformed Host header used in the proxy context +-// would create a bad request. So it is enough to just truncate at the +-// first offending character. +-func cleanHost(in string) string { +- if i := strings.IndexAny(in, " /"); i != -1 { +- in = in[:i] +- } +- host, port, err := net.SplitHostPort(in) +- if err != nil { // input was just a host +- a, err := idnaASCII(in) +- if err != nil { +- return in // garbage in, garbage out +- } +- return a +- } +- a, err := idnaASCII(host) +- if err != nil { +- return in // garbage in, garbage out +- } +- return net.JoinHostPort(a, port) +-} +- + // removeZone removes IPv6 zone identifier from host. + // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" + func removeZone(host string) string { +diff --git a/src/net/http/request_test.go b/src/net/http/request_test.go +index fac12b7..368e87a 100644 +--- a/src/net/http/request_test.go ++++ b/src/net/http/request_test.go +@@ -776,15 +776,8 @@ func TestRequestBadHost(t *testing.T) { + } + req.Host = "foo.com with spaces" + req.URL.Host = "foo.com with spaces" +- req.Write(logWrites{t, &got}) +- want := []string{ +- "GET /after HTTP/1.1\r\n", +- "Host: foo.com\r\n", +- "User-Agent: " + DefaultUserAgent + "\r\n", +- "\r\n", +- } +- if !reflect.DeepEqual(got, want) { +- t.Errorf("Writes = %q\n Want = %q", got, want) ++ if err := req.Write(logWrites{t, &got}); err == nil { ++ t.Errorf("Writing request with invalid Host: succeded, want error") + } + } + +diff --git a/src/net/http/transport_test.go b/src/net/http/transport_test.go +index eeaa492..58f12af 100644 +--- a/src/net/http/transport_test.go ++++ b/src/net/http/transport_test.go +@@ -6512,3 +6512,21 @@ func TestCancelRequestWhenSharingConnection(t *testing.T) { + close(r2c) + wg.Wait() + } ++ ++func TestRequestSanitization(t *testing.T) { ++ setParallel(t) ++ defer afterTest(t) ++ ++ ts := newClientServerTest(t, h1Mode, HandlerFunc(func(rw ResponseWriter, req *Request) { ++ if h, ok := req.Header["X-Evil"]; ok { ++ t.Errorf("request has X-Evil header: %q", h) ++ } ++ })).ts ++ defer ts.Close() ++ req, _ := NewRequest("GET", ts.URL, nil) ++ req.Host = "go.dev\r\nX-Evil:evil" ++ resp, _ := ts.Client().Do(req) ++ if resp != nil { ++ resp.Body.Close() ++ } ++} +-- +2.25.1 diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-29406-2.patch b/meta/recipes-devtools/go/go-1.18/CVE-2023-29406-2.patch new file mode 100644 index 0000000000..637f46a537 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-29406-2.patch @@ -0,0 +1,114 @@ +From c08a5fa413a34111c9a37fd9e545de27ab0978b1 Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Wed, 19 Jul 2023 10:30:46 -0700 +Subject: [PATCH] [release-branch.go1.19] net/http: permit requests with + invalid Host headers + +Historically, the Transport has silently truncated invalid +Host headers at the first '/' or ' ' character. CL 506996 changed +this behavior to reject invalid Host headers entirely. +Unfortunately, Docker appears to rely on the previous behavior. + +When sending a HTTP/1 request with an invalid Host, send an empty +Host header. This is safer than truncation: If you care about the +Host, then you should get the one you set; if you don't care, +then an empty Host should be fine. + +Continue to fully validate Host headers sent to a proxy, +since proxies generally can't productively forward requests +without a Host. + +For #60374 +Fixes #61431 +Fixes #61825 + +Change-Id: If170c7dd860aa20eb58fe32990fc93af832742b6 +Reviewed-on: https://go-review.googlesource.com/c/go/+/511155 +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Roland Shoemaker <roland@golang.org> +Run-TryBot: Damien Neil <dneil@google.com> +(cherry picked from commit b9153f6ef338baee5fe02a867c8fbc83a8b29dd1) +Reviewed-on: https://go-review.googlesource.com/c/go/+/518855 +Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> +Run-TryBot: Roland Shoemaker <roland@golang.org> +Reviewed-by: Russ Cox <rsc@golang.org> + +Upstream-Status: Backport [https://github.com/golang/go/commit/c08a5fa413a34111c9a37fd9e545de27ab0978b1] +CVE: CVE-2023-29406 +Signed-off-by: Ming Liu <liu.ming50@gmail.com> +--- + src/net/http/request.go | 23 ++++++++++++++++++++++- + src/net/http/request_test.go | 17 ++++++++++++----- + 2 files changed, 34 insertions(+), 6 deletions(-) + +diff --git a/src/net/http/request.go b/src/net/http/request.go +index 3100037386..91cb8a66b9 100644 +--- a/src/net/http/request.go ++++ b/src/net/http/request.go +@@ -582,8 +582,29 @@ func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitF + if err != nil { + return err + } ++ // Validate that the Host header is a valid header in general, ++ // but don't validate the host itself. This is sufficient to avoid ++ // header or request smuggling via the Host field. ++ // The server can (and will, if it's a net/http server) reject ++ // the request if it doesn't consider the host valid. + if !httpguts.ValidHostHeader(host) { +- return errors.New("http: invalid Host header") ++ // Historically, we would truncate the Host header after '/' or ' '. ++ // Some users have relied on this truncation to convert a network ++ // address such as Unix domain socket path into a valid, ignored ++ // Host header (see https://go.dev/issue/61431). ++ // ++ // We don't preserve the truncation, because sending an altered ++ // header field opens a smuggling vector. Instead, zero out the ++ // Host header entirely if it isn't valid. (An empty Host is valid; ++ // see RFC 9112 Section 3.2.) ++ // ++ // Return an error if we're sending to a proxy, since the proxy ++ // probably can't do anything useful with an empty Host header. ++ if !usingProxy { ++ host = "" ++ } else { ++ return errors.New("http: invalid Host header") ++ } + } + + // According to RFC 6874, an HTTP client, proxy, or other +diff --git a/src/net/http/request_test.go b/src/net/http/request_test.go +index fddc85d6a9..dd1e2dc2a1 100644 +--- a/src/net/http/request_test.go ++++ b/src/net/http/request_test.go +@@ -770,16 +770,23 @@ func TestRequestWriteBufferedWriter(t *testing.T) { + } + } + +-func TestRequestBadHost(t *testing.T) { ++func TestRequestBadHostHeader(t *testing.T) { + got := []string{} + req, err := NewRequest("GET", "http://foo/after", nil) + if err != nil { + t.Fatal(err) + } +- req.Host = "foo.com with spaces" +- req.URL.Host = "foo.com with spaces" +- if err := req.Write(logWrites{t, &got}); err == nil { +- t.Errorf("Writing request with invalid Host: succeded, want error") ++ req.Host = "foo.com\nnewline" ++ req.URL.Host = "foo.com\nnewline" ++ req.Write(logWrites{t, &got}) ++ want := []string{ ++ "GET /after HTTP/1.1\r\n", ++ "Host: \r\n", ++ "User-Agent: " + DefaultUserAgent + "\r\n", ++ "\r\n", ++ } ++ if !reflect.DeepEqual(got, want) { ++ t.Errorf("Writes = %q\n Want = %q", got, want) + } + } + +-- +2.34.1 + diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2024-24784.patch b/meta/recipes-devtools/go/go-1.18/CVE-2024-24784.patch new file mode 100644 index 0000000000..d3fc6b0313 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2024-24784.patch @@ -0,0 +1,207 @@ +From 5330cd225ba54c7dc78c1b46dcdf61a4671a632c Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Wed, 10 Jan 2024 11:02:14 -0800 +Subject: [PATCH] [release-branch.go1.22] net/mail: properly handle special + characters in phrase and obs-phrase + +Fixes a couple of misalignments with RFC 5322 which introduce +significant diffs between (mostly) conformant parsers. + +This change reverts the changes made in CL50911, which allowed certain +special RFC 5322 characters to appear unquoted in the "phrase" syntax. +It is unclear why this change was made in the first place, and created +a divergence from comformant parsers. In particular this resulted in +treating comments in display names incorrectly. + +Additionally properly handle trailing malformed comments in the group +syntax. + +For #65083 +Fixed #65849 + +Change-Id: I00dddc044c6ae3381154e43236632604c390f672 +Reviewed-on: https://go-review.googlesource.com/c/go/+/555596 +Reviewed-by: Damien Neil <dneil@google.com> +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/566215 +Reviewed-by: Carlos Amedee <carlos@golang.org> + +Upstream-Status: Backport [https://github.com/golang/go/commit/5330cd225ba54c7dc78c1b46dcdf61a4671a632c] +CVE: CVE-2024-24784 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/net/mail/message.go | 30 +++++++++++++++------------ + src/net/mail/message_test.go | 40 ++++++++++++++++++++++++++---------- + 2 files changed, 46 insertions(+), 24 deletions(-) + +diff --git a/src/net/mail/message.go b/src/net/mail/message.go +index 47bbf6c..84f48f0 100644 +--- a/src/net/mail/message.go ++++ b/src/net/mail/message.go +@@ -231,7 +231,7 @@ func (a *Address) String() string { + // Add quotes if needed + quoteLocal := false + for i, r := range local { +- if isAtext(r, false, false) { ++ if isAtext(r, false) { + continue + } + if r == '.' { +@@ -395,7 +395,7 @@ func (p *addrParser) parseAddress(handleGroup bool) ([]*Address, error) { + if !p.consume('<') { + atext := true + for _, r := range displayName { +- if !isAtext(r, true, false) { ++ if !isAtext(r, true) { + atext = false + break + } +@@ -430,7 +430,9 @@ func (p *addrParser) consumeGroupList() ([]*Address, error) { + // handle empty group. + p.skipSpace() + if p.consume(';') { +- p.skipCFWS() ++ if !p.skipCFWS() { ++ return nil, errors.New("mail: misformatted parenthetical comment") ++ } + return group, nil + } + +@@ -447,7 +449,9 @@ func (p *addrParser) consumeGroupList() ([]*Address, error) { + return nil, errors.New("mail: misformatted parenthetical comment") + } + if p.consume(';') { +- p.skipCFWS() ++ if !p.skipCFWS() { ++ return nil, errors.New("mail: misformatted parenthetical comment") ++ } + break + } + if !p.consume(',') { +@@ -517,6 +521,12 @@ func (p *addrParser) consumePhrase() (phrase string, err error) { + var words []string + var isPrevEncoded bool + for { ++ // obs-phrase allows CFWS after one word ++ if len(words) > 0 { ++ if !p.skipCFWS() { ++ return "", errors.New("mail: misformatted parenthetical comment") ++ } ++ } + // word = atom / quoted-string + var word string + p.skipSpace() +@@ -612,7 +622,6 @@ Loop: + // If dot is true, consumeAtom parses an RFC 5322 dot-atom instead. + // If permissive is true, consumeAtom will not fail on: + // - leading/trailing/double dots in the atom (see golang.org/issue/4938) +-// - special characters (RFC 5322 3.2.3) except '<', '>', ':' and '"' (see golang.org/issue/21018) + func (p *addrParser) consumeAtom(dot bool, permissive bool) (atom string, err error) { + i := 0 + +@@ -623,7 +632,7 @@ Loop: + case size == 1 && r == utf8.RuneError: + return "", fmt.Errorf("mail: invalid utf-8 in address: %q", p.s) + +- case size == 0 || !isAtext(r, dot, permissive): ++ case size == 0 || !isAtext(r, dot): + break Loop + + default: +@@ -777,18 +786,13 @@ func (e charsetError) Error() string { + + // isAtext reports whether r is an RFC 5322 atext character. + // If dot is true, period is included. +-// If permissive is true, RFC 5322 3.2.3 specials is included, +-// except '<', '>', ':' and '"'. +-func isAtext(r rune, dot, permissive bool) bool { ++func isAtext(r rune, dot bool) bool { + switch r { + case '.': + return dot + + // RFC 5322 3.2.3. specials +- case '(', ')', '[', ']', ';', '@', '\\', ',': +- return permissive +- +- case '<', '>', '"', ':': ++ case '(', ')', '<', '>', '[', ']', ':', ';', '@', '\\', ',', '"': // RFC 5322 3.2.3. specials + return false + } + return isVchar(r) +diff --git a/src/net/mail/message_test.go b/src/net/mail/message_test.go +index 80a17b2..00bc93e 100644 +--- a/src/net/mail/message_test.go ++++ b/src/net/mail/message_test.go +@@ -334,8 +334,11 @@ func TestAddressParsingError(t *testing.T) { + 13: {"group not closed: null@example.com", "expected comma"}, + 14: {"group: first@example.com, second@example.com;", "group with multiple addresses"}, + 15: {"john.doe", "missing '@' or angle-addr"}, +- 16: {"john.doe@", "no angle-addr"}, ++ 16: {"john.doe@", "missing '@' or angle-addr"}, + 17: {"John Doe@foo.bar", "no angle-addr"}, ++ 18: {" group: null@example.com; (asd", "misformatted parenthetical comment"}, ++ 19: {" group: ; (asd", "misformatted parenthetical comment"}, ++ 20: {`(John) Doe <jdoe@machine.example>`, "missing word in phrase:"}, + } + + for i, tc := range mustErrTestCases { +@@ -374,24 +377,19 @@ func TestAddressParsing(t *testing.T) { + Address: "john.q.public@example.com", + }}, + }, +- { +- `"John (middle) Doe" <jdoe@machine.example>`, +- []*Address{{ +- Name: "John (middle) Doe", +- Address: "jdoe@machine.example", +- }}, +- }, ++ // Comment in display name + { + `John (middle) Doe <jdoe@machine.example>`, + []*Address{{ +- Name: "John (middle) Doe", ++ Name: "John Doe", + Address: "jdoe@machine.example", + }}, + }, ++ // Display name is quoted string, so comment is not a comment + { +- `John !@M@! Doe <jdoe@machine.example>`, ++ `"John (middle) Doe" <jdoe@machine.example>`, + []*Address{{ +- Name: "John !@M@! Doe", ++ Name: "John (middle) Doe", + Address: "jdoe@machine.example", + }}, + }, +@@ -726,6 +724,26 @@ func TestAddressParsing(t *testing.T) { + }, + }, + }, ++ // Comment in group display name ++ { ++ `group (comment:): a@example.com, b@example.com;`, ++ []*Address{ ++ { ++ Address: "a@example.com", ++ }, ++ { ++ Address: "b@example.com", ++ }, ++ }, ++ }, ++ { ++ `x(:"):"@a.example;("@b.example;`, ++ []*Address{ ++ { ++ Address: `@a.example;(@b.example`, ++ }, ++ }, ++ }, + } + for _, test := range tests { + if len(test.exp) == 1 { +-- +2.39.3 diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2024-24785.patch b/meta/recipes-devtools/go/go-1.18/CVE-2024-24785.patch new file mode 100644 index 0000000000..5c8244e89a --- /dev/null +++ b/meta/recipes-devtools/go/go-1.18/CVE-2024-24785.patch @@ -0,0 +1,196 @@ +From 056b0edcb8c152152021eebf4cf42adbfbe77992 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <roland@golang.org> +Date: Wed, 14 Feb 2024 17:18:36 -0800 +Subject: [PATCH] [release-branch.go1.22] html/template: escape additional + tokens in MarshalJSON errors + +Escape "</script" and "<!--" in errors returned from MarshalJSON errors +when attempting to marshal types in script blocks. This prevents any +user controlled content from prematurely terminating the script block. + +Updates #65697 +Fixes #65969 + +Change-Id: Icf0e26c54ea7d9c1deed0bff11b6506c99ddef1b +Reviewed-on: https://go-review.googlesource.com/c/go/+/564196 +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> +Reviewed-by: Damien Neil <dneil@google.com> +(cherry picked from commit ccbc725f2d678255df1bd326fa511a492aa3a0aa) +Reviewed-on: https://go-review.googlesource.com/c/go/+/567535 +Reviewed-by: Carlos Amedee <carlos@golang.org> + +Upstream-Status: Backport [https://github.com/golang/go/commit/056b0edcb8c152152021eebf4cf42adbfbe77992] +CVE: CVE-2024-24785 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/html/template/js.go | 22 ++++++++- + src/html/template/js_test.go | 96 ++++++++++++++++++++---------------- + 2 files changed, 74 insertions(+), 44 deletions(-) + +diff --git a/src/html/template/js.go b/src/html/template/js.go +index 35994f0..4d3b25d 100644 +--- a/src/html/template/js.go ++++ b/src/html/template/js.go +@@ -171,13 +171,31 @@ func jsValEscaper(args ...interface{}) string { + // cyclic data. This may be an unacceptable DoS risk. + b, err := json.Marshal(a) + if err != nil { +- // Put a space before comment so that if it is flush against ++ // While the standard JSON marshaller does not include user controlled ++ // information in the error message, if a type has a MarshalJSON method, ++ // the content of the error message is not guaranteed. Since we insert ++ // the error into the template, as part of a comment, we attempt to ++ // prevent the error from either terminating the comment, or the script ++ // block itself. ++ // ++ // In particular we: ++ // * replace "*/" comment end tokens with "* /", which does not ++ // terminate the comment ++ // * replace "</script" with "\x3C/script", and "<!--" with ++ // "\x3C!--", which prevents confusing script block termination ++ // semantics ++ // ++ // We also put a space before the comment so that if it is flush against + // a division operator it is not turned into a line comment: + // x/{{y}} + // turning into + // x//* error marshaling y: + // second line of error message */null +- return fmt.Sprintf(" /* %s */null ", strings.ReplaceAll(err.Error(), "*/", "* /")) ++ errStr := err.Error() ++ errStr = strings.ReplaceAll(errStr, "*/", "* /") ++ errStr = strings.ReplaceAll(errStr, "</script", `\x3C/script`) ++ errStr = strings.ReplaceAll(errStr, "<!--", `\x3C!--`) ++ return fmt.Sprintf(" /* %s */null ", errStr) + } + + // TODO: maybe post-process output to prevent it from containing +diff --git a/src/html/template/js_test.go b/src/html/template/js_test.go +index de9ef28..0eaec11 100644 +--- a/src/html/template/js_test.go ++++ b/src/html/template/js_test.go +@@ -5,6 +5,7 @@ + package template + + import ( ++ "errors" + "bytes" + "math" + "strings" +@@ -104,61 +105,72 @@ func TestNextJsCtx(t *testing.T) { + } + } + ++type jsonErrType struct{} ++ ++func (e *jsonErrType) MarshalJSON() ([]byte, error) { ++ return nil, errors.New("beep */ boop </script blip <!--") ++} ++ + func TestJSValEscaper(t *testing.T) { + tests := []struct { +- x interface{} +- js string ++ x any ++ js string ++ skipNest bool + }{ +- {int(42), " 42 "}, +- {uint(42), " 42 "}, +- {int16(42), " 42 "}, +- {uint16(42), " 42 "}, +- {int32(-42), " -42 "}, +- {uint32(42), " 42 "}, +- {int16(-42), " -42 "}, +- {uint16(42), " 42 "}, +- {int64(-42), " -42 "}, +- {uint64(42), " 42 "}, +- {uint64(1) << 53, " 9007199254740992 "}, ++ {int(42), " 42 ", false}, ++ {uint(42), " 42 ", false}, ++ {int16(42), " 42 ", false}, ++ {uint16(42), " 42 ", false}, ++ {int32(-42), " -42 ", false}, ++ {uint32(42), " 42 ", false}, ++ {int16(-42), " -42 ", false}, ++ {uint16(42), " 42 ", false}, ++ {int64(-42), " -42 ", false}, ++ {uint64(42), " 42 ", false}, ++ {uint64(1) << 53, " 9007199254740992 ", false}, + // ulp(1 << 53) > 1 so this loses precision in JS + // but it is still a representable integer literal. +- {uint64(1)<<53 + 1, " 9007199254740993 "}, +- {float32(1.0), " 1 "}, +- {float32(-1.0), " -1 "}, +- {float32(0.5), " 0.5 "}, +- {float32(-0.5), " -0.5 "}, +- {float32(1.0) / float32(256), " 0.00390625 "}, +- {float32(0), " 0 "}, +- {math.Copysign(0, -1), " -0 "}, +- {float64(1.0), " 1 "}, +- {float64(-1.0), " -1 "}, +- {float64(0.5), " 0.5 "}, +- {float64(-0.5), " -0.5 "}, +- {float64(0), " 0 "}, +- {math.Copysign(0, -1), " -0 "}, +- {"", `""`}, +- {"foo", `"foo"`}, ++ {uint64(1)<<53 + 1, " 9007199254740993 ", false}, ++ {float32(1.0), " 1 ", false}, ++ {float32(-1.0), " -1 ", false}, ++ {float32(0.5), " 0.5 ", false}, ++ {float32(-0.5), " -0.5 ", false}, ++ {float32(1.0) / float32(256), " 0.00390625 ", false}, ++ {float32(0), " 0 ", false}, ++ {math.Copysign(0, -1), " -0 ", false}, ++ {float64(1.0), " 1 ", false}, ++ {float64(-1.0), " -1 ", false}, ++ {float64(0.5), " 0.5 ", false}, ++ {float64(-0.5), " -0.5 ", false}, ++ {float64(0), " 0 ", false}, ++ {math.Copysign(0, -1), " -0 ", false}, ++ {"", `""`, false}, ++ {"foo", `"foo"`, false}, + // Newlines. +- {"\r\n\u2028\u2029", `"\r\n\u2028\u2029"`}, ++ {"\r\n\u2028\u2029", `"\r\n\u2028\u2029"`, false}, + // "\v" == "v" on IE 6 so use "\u000b" instead. +- {"\t\x0b", `"\t\u000b"`}, +- {struct{ X, Y int }{1, 2}, `{"X":1,"Y":2}`}, +- {[]interface{}{}, "[]"}, +- {[]interface{}{42, "foo", nil}, `[42,"foo",null]`}, +- {[]string{"<!--", "</script>", "-->"}, `["\u003c!--","\u003c/script\u003e","--\u003e"]`}, +- {"<!--", `"\u003c!--"`}, +- {"-->", `"--\u003e"`}, +- {"<![CDATA[", `"\u003c![CDATA["`}, +- {"]]>", `"]]\u003e"`}, +- {"</script", `"\u003c/script"`}, +- {"\U0001D11E", "\"\U0001D11E\""}, // or "\uD834\uDD1E" +- {nil, " null "}, ++ {"\t\x0b", `"\t\u000b"`, false}, ++ {struct{ X, Y int }{1, 2}, `{"X":1,"Y":2}`, false}, ++ {[]any{}, "[]", false}, ++ {[]any{42, "foo", nil}, `[42,"foo",null]`, false}, ++ {[]string{"<!--", "</script>", "-->"}, `["\u003c!--","\u003c/script\u003e","--\u003e"]`, false}, ++ {"<!--", `"\u003c!--"`, false}, ++ {"-->", `"--\u003e"`, false}, ++ {"<![CDATA[", `"\u003c![CDATA["`, false}, ++ {"]]>", `"]]\u003e"`, false}, ++ {"</script", `"\u003c/script"`, false}, ++ {"\U0001D11E", "\"\U0001D11E\"", false}, // or "\uD834\uDD1E" ++ {nil, " null ", false}, ++ {&jsonErrType{}, " /* json: error calling MarshalJSON for type *template.jsonErrType: beep * / boop \\x3C/script blip \\x3C!-- */null ", true}, + } + + for _, test := range tests { + if js := jsValEscaper(test.x); js != test.js { + t.Errorf("%+v: want\n\t%q\ngot\n\t%q", test.x, test.js, js) + } ++ if test.skipNest { ++ continue ++ } + // Make sure that escaping corner cases are not broken + // by nesting. + a := []interface{}{test.x} +-- +2.39.3 diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_1.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_1.patch new file mode 100644 index 0000000000..ff9ba18ec5 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_1.patch @@ -0,0 +1,137 @@ +From f8d691d335c6ac14bcbae6886b5bf8ca8bf1e6a5 Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Thu, 16 Mar 2023 14:18:04 -0700 +Subject: [PATCH 1/3] mime/multipart: avoid excessive copy buffer allocations + in ReadForm + +When copying form data to disk with io.Copy, +allocate only one copy buffer and reuse it rather than +creating two buffers per file (one from io.multiReader.WriteTo, +and a second one from os.File.ReadFrom). + +Thanks to Jakob Ackermann (@das7pad) for reporting this issue. + +For CVE-2023-24536 +For #59153 +For #59269 + +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802453 +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802395 +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Change-Id: Ie405470c92abffed3356913b37d813e982c96c8b +Reviewed-on: https://go-review.googlesource.com/c/go/+/481983 +Run-TryBot: Michael Knyszek <mknyszek@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Auto-Submit: Michael Knyszek <mknyszek@google.com> +Reviewed-by: Matthew Dempsky <mdempsky@google.com> + +CVE: CVE-2023-24536 +Upstream-Status: Backport [ef41a4e2face45e580c5836eaebd51629fc23f15] +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/mime/multipart/formdata.go | 15 +++++++-- + src/mime/multipart/formdata_test.go | 49 +++++++++++++++++++++++++++++ + 2 files changed, 61 insertions(+), 3 deletions(-) + +diff --git a/src/mime/multipart/formdata.go b/src/mime/multipart/formdata.go +index a7d4ca9..975dcb6 100644 +--- a/src/mime/multipart/formdata.go ++++ b/src/mime/multipart/formdata.go +@@ -84,6 +84,7 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + maxMemoryBytes = math.MaxInt64 + } + } ++ var copyBuf []byte + for { + p, err := r.nextPart(false, maxMemoryBytes) + if err == io.EOF { +@@ -147,14 +148,22 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + } + } + numDiskFiles++ +- size, err := io.Copy(file, io.MultiReader(&b, p)) ++ if _, err := file.Write(b.Bytes()); err != nil { ++ return nil, err ++ } ++ if copyBuf == nil { ++ copyBuf = make([]byte, 32*1024) // same buffer size as io.Copy uses ++ } ++ // os.File.ReadFrom will allocate its own copy buffer if we let io.Copy use it. ++ type writerOnly struct{ io.Writer } ++ remainingSize, err := io.CopyBuffer(writerOnly{file}, p, copyBuf) + if err != nil { + return nil, err + } + fh.tmpfile = file.Name() +- fh.Size = size ++ fh.Size = int64(b.Len()) + remainingSize + fh.tmpoff = fileOff +- fileOff += size ++ fileOff += fh.Size + if !combineFiles { + if err := file.Close(); err != nil { + return nil, err +diff --git a/src/mime/multipart/formdata_test.go b/src/mime/multipart/formdata_test.go +index 5cded71..f5b5608 100644 +--- a/src/mime/multipart/formdata_test.go ++++ b/src/mime/multipart/formdata_test.go +@@ -368,3 +368,52 @@ func testReadFormManyFiles(t *testing.T, distinct bool) { + t.Fatalf("temp dir contains %v files; want 0", len(names)) + } + } ++ ++func BenchmarkReadForm(b *testing.B) { ++ for _, test := range []struct { ++ name string ++ form func(fw *Writer, count int) ++ }{{ ++ name: "fields", ++ form: func(fw *Writer, count int) { ++ for i := 0; i < count; i++ { ++ w, _ := fw.CreateFormField(fmt.Sprintf("field%v", i)) ++ fmt.Fprintf(w, "value %v", i) ++ } ++ }, ++ }, { ++ name: "files", ++ form: func(fw *Writer, count int) { ++ for i := 0; i < count; i++ { ++ w, _ := fw.CreateFormFile(fmt.Sprintf("field%v", i), fmt.Sprintf("file%v", i)) ++ fmt.Fprintf(w, "value %v", i) ++ } ++ }, ++ }} { ++ b.Run(test.name, func(b *testing.B) { ++ for _, maxMemory := range []int64{ ++ 0, ++ 1 << 20, ++ } { ++ var buf bytes.Buffer ++ fw := NewWriter(&buf) ++ test.form(fw, 10) ++ if err := fw.Close(); err != nil { ++ b.Fatal(err) ++ } ++ b.Run(fmt.Sprintf("maxMemory=%v", maxMemory), func(b *testing.B) { ++ b.ReportAllocs() ++ for i := 0; i < b.N; i++ { ++ fr := NewReader(bytes.NewReader(buf.Bytes()), fw.Boundary()) ++ form, err := fr.ReadForm(maxMemory) ++ if err != nil { ++ b.Fatal(err) ++ } ++ form.RemoveAll() ++ } ++ ++ }) ++ } ++ }) ++ } ++} +-- +2.35.5 + diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_2.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_2.patch new file mode 100644 index 0000000000..704a1fb567 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_2.patch @@ -0,0 +1,187 @@ +From 4174a87b600c58e8cc00d9d18d0c507c67ca5d41 Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Thu, 16 Mar 2023 16:56:12 -0700 +Subject: [PATCH 2/3] net/textproto, mime/multipart: improve accounting of + non-file data + +For requests containing large numbers of small parts, +memory consumption of a parsed form could be about 250% +over the estimated size. + +When considering the size of parsed forms, account for the size of +FileHeader structs and increase the estimate of memory consumed by +map entries. + +Thanks to Jakob Ackermann (@das7pad) for reporting this issue. + +For CVE-2023-24536 +For #59153 +For #59269 + +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802454 +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802396 +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Change-Id: I31bc50e9346b4eee6fbe51a18c3c57230cc066db +Reviewed-on: https://go-review.googlesource.com/c/go/+/481984 +Reviewed-by: Matthew Dempsky <mdempsky@google.com> +Auto-Submit: Michael Knyszek <mknyszek@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Run-TryBot: Michael Knyszek <mknyszek@google.com> + +CVE: CVE-2023-24536 +Upstream-Status: Backport [7a359a651c7ebdb29e0a1c03102fce793e9f58f0] +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/mime/multipart/formdata.go | 9 +++-- + src/mime/multipart/formdata_test.go | 55 ++++++++++++----------------- + src/net/textproto/reader.go | 8 ++++- + 3 files changed, 37 insertions(+), 35 deletions(-) + +diff --git a/src/mime/multipart/formdata.go b/src/mime/multipart/formdata.go +index 975dcb6..3f6ff69 100644 +--- a/src/mime/multipart/formdata.go ++++ b/src/mime/multipart/formdata.go +@@ -103,8 +103,9 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + // Multiple values for the same key (one map entry, longer slice) are cheaper + // than the same number of values for different keys (many map entries), but + // using a consistent per-value cost for overhead is simpler. ++ const mapEntryOverhead = 200 + maxMemoryBytes -= int64(len(name)) +- maxMemoryBytes -= 100 // map overhead ++ maxMemoryBytes -= mapEntryOverhead + if maxMemoryBytes < 0 { + // We can't actually take this path, since nextPart would already have + // rejected the MIME headers for being too large. Check anyway. +@@ -128,7 +129,10 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + } + + // file, store in memory or on disk ++ const fileHeaderSize = 100 + maxMemoryBytes -= mimeHeaderSize(p.Header) ++ maxMemoryBytes -= mapEntryOverhead ++ maxMemoryBytes -= fileHeaderSize + if maxMemoryBytes < 0 { + return nil, ErrMessageTooLarge + } +@@ -183,9 +187,10 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + } + + func mimeHeaderSize(h textproto.MIMEHeader) (size int64) { ++ size = 400 + for k, vs := range h { + size += int64(len(k)) +- size += 100 // map entry overhead ++ size += 200 // map entry overhead + for _, v := range vs { + size += int64(len(v)) + } +diff --git a/src/mime/multipart/formdata_test.go b/src/mime/multipart/formdata_test.go +index f5b5608..8ed26e0 100644 +--- a/src/mime/multipart/formdata_test.go ++++ b/src/mime/multipart/formdata_test.go +@@ -192,10 +192,10 @@ func (r *failOnReadAfterErrorReader) Read(p []byte) (n int, err error) { + // TestReadForm_NonFileMaxMemory asserts that the ReadForm maxMemory limit is applied + // while processing non-file form data as well as file form data. + func TestReadForm_NonFileMaxMemory(t *testing.T) { +- n := 10<<20 + 25 + if testing.Short() { +- n = 10<<10 + 25 ++ t.Skip("skipping in -short mode") + } ++ n := 10 << 20 + largeTextValue := strings.Repeat("1", n) + message := `--MyBoundary + Content-Disposition: form-data; name="largetext" +@@ -203,38 +203,29 @@ Content-Disposition: form-data; name="largetext" + ` + largeTextValue + ` + --MyBoundary-- + ` +- + testBody := strings.ReplaceAll(message, "\n", "\r\n") +- testCases := []struct { +- name string +- maxMemory int64 +- err error +- }{ +- {"smaller", 50 + int64(len("largetext")) + 100, nil}, +- {"exact-fit", 25 + int64(len("largetext")) + 100, nil}, +- {"too-large", 0, ErrMessageTooLarge}, +- } +- for _, tc := range testCases { +- t.Run(tc.name, func(t *testing.T) { +- if tc.maxMemory == 0 && testing.Short() { +- t.Skip("skipping in -short mode") +- } +- b := strings.NewReader(testBody) +- r := NewReader(b, boundary) +- f, err := r.ReadForm(tc.maxMemory) +- if err == nil { +- defer f.RemoveAll() +- } +- if tc.err != err { +- t.Fatalf("ReadForm error - got: %v; expected: %v", err, tc.err) +- } +- if err == nil { +- if g := f.Value["largetext"][0]; g != largeTextValue { +- t.Errorf("largetext mismatch: got size: %v, expected size: %v", len(g), len(largeTextValue)) +- } +- } +- }) ++ // Try parsing the form with increasing maxMemory values. ++ // Changes in how we account for non-file form data may cause the exact point ++ // where we change from rejecting the form as too large to accepting it to vary, ++ // but we should see both successes and failures. ++ const failWhenMaxMemoryLessThan = 128 ++ for maxMemory := int64(0); maxMemory < failWhenMaxMemoryLessThan*2; maxMemory += 16 { ++ b := strings.NewReader(testBody) ++ r := NewReader(b, boundary) ++ f, err := r.ReadForm(maxMemory) ++ if err != nil { ++ continue ++ } ++ if g := f.Value["largetext"][0]; g != largeTextValue { ++ t.Errorf("largetext mismatch: got size: %v, expected size: %v", len(g), len(largeTextValue)) ++ } ++ f.RemoveAll() ++ if maxMemory < failWhenMaxMemoryLessThan { ++ t.Errorf("ReadForm(%v): no error, expect to hit memory limit when maxMemory < %v", maxMemory, failWhenMaxMemoryLessThan) ++ } ++ return + } ++ t.Errorf("ReadForm(x) failed for x < 1024, expect success") + } + + // TestReadForm_MetadataTooLarge verifies that we account for the size of field names, +diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go +index fcbede8..9af4c49 100644 +--- a/src/net/textproto/reader.go ++++ b/src/net/textproto/reader.go +@@ -503,6 +503,12 @@ func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { + + m := make(MIMEHeader, hint) + ++ // Account for 400 bytes of overhead for the MIMEHeader, plus 200 bytes per entry. ++ // Benchmarking map creation as of go1.20, a one-entry MIMEHeader is 416 bytes and large ++ // MIMEHeaders average about 200 bytes per entry. ++ lim -= 400 ++ const mapEntryOverhead = 200 ++ + // The first line cannot start with a leading space. + if buf, err := r.R.Peek(1); err == nil && (buf[0] == ' ' || buf[0] == '\t') { + line, err := r.readLineSlice() +@@ -552,7 +558,7 @@ func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { + vv := m[key] + if vv == nil { + lim -= int64(len(key)) +- lim -= 100 // map entry overhead ++ lim -= mapEntryOverhead + } + lim -= int64(len(value)) + if lim < 0 { +-- +2.35.5 + diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_3.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_3.patch new file mode 100644 index 0000000000..6de04e9a61 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-24536_3.patch @@ -0,0 +1,349 @@ +From ec763bc936f76cec0fe71a791c6bb7d4ac5f3e46 Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Mon, 20 Mar 2023 10:43:19 -0700 +Subject: [PATCH 3/3] mime/multipart: limit parsed mime message sizes + +The parsed forms of MIME headers and multipart forms can consume +substantially more memory than the size of the input data. +A malicious input containing a very large number of headers or +form parts can cause excessively large memory allocations. + +Set limits on the size of MIME data: + +Reader.NextPart and Reader.NextRawPart limit the the number +of headers in a part to 10000. + +Reader.ReadForm limits the total number of headers in all +FileHeaders to 10000. + +Both of these limits may be set with with +GODEBUG=multipartmaxheaders=<values>. + +Reader.ReadForm limits the number of parts in a form to 1000. +This limit may be set with GODEBUG=multipartmaxparts=<value>. + +Thanks for Jakob Ackermann (@das7pad) for reporting this issue. + +For CVE-2023-24536 +For #59153 +For #59269 + +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802455 +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Julie Qiu <julieqiu@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1801087 +Reviewed-by: Damien Neil <dneil@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Change-Id: If134890d75f0d95c681d67234daf191ba08e6424 +Reviewed-on: https://go-review.googlesource.com/c/go/+/481985 +Run-TryBot: Michael Knyszek <mknyszek@google.com> +Auto-Submit: Michael Knyszek <mknyszek@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Matthew Dempsky <mdempsky@google.com> + +CVE: CVE-2023-24536 +Upstream-Status: Backport [7917b5f31204528ea72e0629f0b7d52b35b27538] +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/mime/multipart/formdata.go | 19 ++++++++- + src/mime/multipart/formdata_test.go | 61 ++++++++++++++++++++++++++++ + src/mime/multipart/multipart.go | 31 ++++++++++---- + src/mime/multipart/readmimeheader.go | 2 +- + src/net/textproto/reader.go | 19 +++++---- + 5 files changed, 115 insertions(+), 17 deletions(-) + +diff --git a/src/mime/multipart/formdata.go b/src/mime/multipart/formdata.go +index 3f6ff69..4f26aab 100644 +--- a/src/mime/multipart/formdata.go ++++ b/src/mime/multipart/formdata.go +@@ -12,6 +12,7 @@ import ( + "math" + "net/textproto" + "os" ++ "strconv" + ) + + // ErrMessageTooLarge is returned by ReadForm if the message form +@@ -41,6 +42,15 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + numDiskFiles := 0 + multipartFiles := godebug.Get("multipartfiles") + combineFiles := multipartFiles != "distinct" ++ maxParts := 1000 ++ multipartMaxParts := godebug.Get("multipartmaxparts") ++ if multipartMaxParts != "" { ++ if v, err := strconv.Atoi(multipartMaxParts); err == nil && v >= 0 { ++ maxParts = v ++ } ++ } ++ maxHeaders := maxMIMEHeaders() ++ + defer func() { + if file != nil { + if cerr := file.Close(); err == nil { +@@ -86,13 +96,17 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + } + var copyBuf []byte + for { +- p, err := r.nextPart(false, maxMemoryBytes) ++ p, err := r.nextPart(false, maxMemoryBytes, maxHeaders) + if err == io.EOF { + break + } + if err != nil { + return nil, err + } ++ if maxParts <= 0 { ++ return nil, ErrMessageTooLarge ++ } ++ maxParts-- + + name := p.FormName() + if name == "" { +@@ -136,6 +150,9 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + if maxMemoryBytes < 0 { + return nil, ErrMessageTooLarge + } ++ for _, v := range p.Header { ++ maxHeaders -= int64(len(v)) ++ } + fh := &FileHeader{ + Filename: filename, + Header: p.Header, +diff --git a/src/mime/multipart/formdata_test.go b/src/mime/multipart/formdata_test.go +index 8ed26e0..c78eeb7 100644 +--- a/src/mime/multipart/formdata_test.go ++++ b/src/mime/multipart/formdata_test.go +@@ -360,6 +360,67 @@ func testReadFormManyFiles(t *testing.T, distinct bool) { + } + } + ++func TestReadFormLimits(t *testing.T) { ++ for _, test := range []struct { ++ values int ++ files int ++ extraKeysPerFile int ++ wantErr error ++ godebug string ++ }{ ++ {values: 1000}, ++ {values: 1001, wantErr: ErrMessageTooLarge}, ++ {values: 500, files: 500}, ++ {values: 501, files: 500, wantErr: ErrMessageTooLarge}, ++ {files: 1000}, ++ {files: 1001, wantErr: ErrMessageTooLarge}, ++ {files: 1, extraKeysPerFile: 9998}, // plus Content-Disposition and Content-Type ++ {files: 1, extraKeysPerFile: 10000, wantErr: ErrMessageTooLarge}, ++ {godebug: "multipartmaxparts=100", values: 100}, ++ {godebug: "multipartmaxparts=100", values: 101, wantErr: ErrMessageTooLarge}, ++ {godebug: "multipartmaxheaders=100", files: 2, extraKeysPerFile: 48}, ++ {godebug: "multipartmaxheaders=100", files: 2, extraKeysPerFile: 50, wantErr: ErrMessageTooLarge}, ++ } { ++ name := fmt.Sprintf("values=%v/files=%v/extraKeysPerFile=%v", test.values, test.files, test.extraKeysPerFile) ++ if test.godebug != "" { ++ name += fmt.Sprintf("/godebug=%v", test.godebug) ++ } ++ t.Run(name, func(t *testing.T) { ++ if test.godebug != "" { ++ t.Setenv("GODEBUG", test.godebug) ++ } ++ var buf bytes.Buffer ++ fw := NewWriter(&buf) ++ for i := 0; i < test.values; i++ { ++ w, _ := fw.CreateFormField(fmt.Sprintf("field%v", i)) ++ fmt.Fprintf(w, "value %v", i) ++ } ++ for i := 0; i < test.files; i++ { ++ h := make(textproto.MIMEHeader) ++ h.Set("Content-Disposition", ++ fmt.Sprintf(`form-data; name="file%v"; filename="file%v"`, i, i)) ++ h.Set("Content-Type", "application/octet-stream") ++ for j := 0; j < test.extraKeysPerFile; j++ { ++ h.Set(fmt.Sprintf("k%v", j), "v") ++ } ++ w, _ := fw.CreatePart(h) ++ fmt.Fprintf(w, "value %v", i) ++ } ++ if err := fw.Close(); err != nil { ++ t.Fatal(err) ++ } ++ fr := NewReader(bytes.NewReader(buf.Bytes()), fw.Boundary()) ++ form, err := fr.ReadForm(1 << 10) ++ if err == nil { ++ defer form.RemoveAll() ++ } ++ if err != test.wantErr { ++ t.Errorf("ReadForm = %v, want %v", err, test.wantErr) ++ } ++ }) ++ } ++} ++ + func BenchmarkReadForm(b *testing.B) { + for _, test := range []struct { + name string +diff --git a/src/mime/multipart/multipart.go b/src/mime/multipart/multipart.go +index 19fe0ea..80acabc 100644 +--- a/src/mime/multipart/multipart.go ++++ b/src/mime/multipart/multipart.go +@@ -16,11 +16,13 @@ import ( + "bufio" + "bytes" + "fmt" ++ "internal/godebug" + "io" + "mime" + "mime/quotedprintable" + "net/textproto" + "path/filepath" ++ "strconv" + "strings" + ) + +@@ -128,12 +130,12 @@ func (r *stickyErrorReader) Read(p []byte) (n int, _ error) { + return n, r.err + } + +-func newPart(mr *Reader, rawPart bool, maxMIMEHeaderSize int64) (*Part, error) { ++func newPart(mr *Reader, rawPart bool, maxMIMEHeaderSize, maxMIMEHeaders int64) (*Part, error) { + bp := &Part{ + Header: make(map[string][]string), + mr: mr, + } +- if err := bp.populateHeaders(maxMIMEHeaderSize); err != nil { ++ if err := bp.populateHeaders(maxMIMEHeaderSize, maxMIMEHeaders); err != nil { + return nil, err + } + bp.r = partReader{bp} +@@ -149,9 +151,9 @@ func newPart(mr *Reader, rawPart bool, maxMIMEHeaderSize int64) (*Part, error) { + return bp, nil + } + +-func (bp *Part) populateHeaders(maxMIMEHeaderSize int64) error { ++func (bp *Part) populateHeaders(maxMIMEHeaderSize, maxMIMEHeaders int64) error { + r := textproto.NewReader(bp.mr.bufReader) +- header, err := readMIMEHeader(r, maxMIMEHeaderSize) ++ header, err := readMIMEHeader(r, maxMIMEHeaderSize, maxMIMEHeaders) + if err == nil { + bp.Header = header + } +@@ -313,6 +315,19 @@ type Reader struct { + // including header keys, values, and map overhead. + const maxMIMEHeaderSize = 10 << 20 + ++func maxMIMEHeaders() int64 { ++ // multipartMaxHeaders is the maximum number of header entries NextPart will return, ++ // as well as the maximum combined total of header entries Reader.ReadForm will return ++ // in FileHeaders. ++ multipartMaxHeaders := godebug.Get("multipartmaxheaders") ++ if multipartMaxHeaders != "" { ++ if v, err := strconv.ParseInt(multipartMaxHeaders, 10, 64); err == nil && v >= 0 { ++ return v ++ } ++ } ++ return 10000 ++} ++ + // NextPart returns the next part in the multipart or an error. + // When there are no more parts, the error io.EOF is returned. + // +@@ -320,7 +335,7 @@ const maxMIMEHeaderSize = 10 << 20 + // has a value of "quoted-printable", that header is instead + // hidden and the body is transparently decoded during Read calls. + func (r *Reader) NextPart() (*Part, error) { +- return r.nextPart(false, maxMIMEHeaderSize) ++ return r.nextPart(false, maxMIMEHeaderSize, maxMIMEHeaders()) + } + + // NextRawPart returns the next part in the multipart or an error. +@@ -329,10 +344,10 @@ func (r *Reader) NextPart() (*Part, error) { + // Unlike NextPart, it does not have special handling for + // "Content-Transfer-Encoding: quoted-printable". + func (r *Reader) NextRawPart() (*Part, error) { +- return r.nextPart(true, maxMIMEHeaderSize) ++ return r.nextPart(true, maxMIMEHeaderSize, maxMIMEHeaders()) + } + +-func (r *Reader) nextPart(rawPart bool, maxMIMEHeaderSize int64) (*Part, error) { ++func (r *Reader) nextPart(rawPart bool, maxMIMEHeaderSize, maxMIMEHeaders int64) (*Part, error) { + if r.currentPart != nil { + r.currentPart.Close() + } +@@ -357,7 +372,7 @@ func (r *Reader) nextPart(rawPart bool, maxMIMEHeaderSize int64) (*Part, error) + + if r.isBoundaryDelimiterLine(line) { + r.partsRead++ +- bp, err := newPart(r, rawPart, maxMIMEHeaderSize) ++ bp, err := newPart(r, rawPart, maxMIMEHeaderSize, maxMIMEHeaders) + if err != nil { + return nil, err + } +diff --git a/src/mime/multipart/readmimeheader.go b/src/mime/multipart/readmimeheader.go +index 6836928..25aa6e2 100644 +--- a/src/mime/multipart/readmimeheader.go ++++ b/src/mime/multipart/readmimeheader.go +@@ -11,4 +11,4 @@ import ( + // readMIMEHeader is defined in package net/textproto. + // + //go:linkname readMIMEHeader net/textproto.readMIMEHeader +-func readMIMEHeader(r *textproto.Reader, lim int64) (textproto.MIMEHeader, error) ++func readMIMEHeader(r *textproto.Reader, maxMemory, maxHeaders int64) (textproto.MIMEHeader, error) +diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go +index 9af4c49..c6569c8 100644 +--- a/src/net/textproto/reader.go ++++ b/src/net/textproto/reader.go +@@ -483,12 +483,12 @@ func (r *Reader) ReadDotLines() ([]string, error) { + // } + // + func (r *Reader) ReadMIMEHeader() (MIMEHeader, error) { +- return readMIMEHeader(r, math.MaxInt64) ++ return readMIMEHeader(r, math.MaxInt64, math.MaxInt64) + } + + // readMIMEHeader is a version of ReadMIMEHeader which takes a limit on the header size. + // It is called by the mime/multipart package. +-func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { ++func readMIMEHeader(r *Reader, maxMemory, maxHeaders int64) (MIMEHeader, error) { + // Avoid lots of small slice allocations later by allocating one + // large one ahead of time which we'll cut up into smaller + // slices. If this isn't big enough later, we allocate small ones. +@@ -506,7 +506,7 @@ func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { + // Account for 400 bytes of overhead for the MIMEHeader, plus 200 bytes per entry. + // Benchmarking map creation as of go1.20, a one-entry MIMEHeader is 416 bytes and large + // MIMEHeaders average about 200 bytes per entry. +- lim -= 400 ++ maxMemory -= 400 + const mapEntryOverhead = 200 + + // The first line cannot start with a leading space. +@@ -538,6 +538,11 @@ func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { + continue + } + ++ maxHeaders-- ++ if maxHeaders < 0 { ++ return nil, errors.New("message too large") ++ } ++ + // backport 5c55ac9bf1e5f779220294c843526536605f42ab + // + // value is computed as +@@ -557,11 +562,11 @@ func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { + + vv := m[key] + if vv == nil { +- lim -= int64(len(key)) +- lim -= mapEntryOverhead ++ maxMemory -= int64(len(key)) ++ maxMemory -= mapEntryOverhead + } +- lim -= int64(len(value)) +- if lim < 0 { ++ maxMemory -= int64(len(value)) ++ if maxMemory < 0 { + // TODO: This should be a distinguishable error (ErrMessageTooLarge) + // to allow mime/multipart to detect it. + return m, errors.New("message too large") +-- +2.35.5 + diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-24540.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-24540.patch new file mode 100644 index 0000000000..7e6e871e38 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-24540.patch @@ -0,0 +1,93 @@ +From 2305cdb2aa5ac8e9960bd64e548a119c7dd87530 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Tue, 11 Apr 2023 16:27:43 +0100 +Subject: [PATCH] html/template: handle all JS whitespace characters + +Rather than just a small set. Character class as defined by \s [0]. + +Thanks to Juho Nurminen of Mattermost for reporting this. + +For #59721 +Fixes #59813 +Fixes CVE-2023-24540 + +[0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Character_Classes + +Change-Id: I56d4fa1ef08125b417106ee7dbfb5b0923b901ba +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1821459 +Reviewed-by: Julie Qiu <julieqiu@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1851497 +Run-TryBot: Damien Neil <dneil@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/491355 +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> +Reviewed-by: Carlos Amedee <carlos@golang.org> +TryBot-Bypass: Carlos Amedee <carlos@golang.org> +Run-TryBot: Carlos Amedee <carlos@golang.org> + +CVE: CVE-2023-24540 +Upstream-Status: Backport [https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797] + +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/html/template/js.go | 8 +++++++- + src/html/template/js_test.go | 11 +++++++---- + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/src/html/template/js.go b/src/html/template/js.go +index b888eaf..35994f0 100644 +--- a/src/html/template/js.go ++++ b/src/html/template/js.go +@@ -13,6 +13,11 @@ import ( + "unicode/utf8" + ) + ++// jsWhitespace contains all of the JS whitespace characters, as defined ++// by the \s character class. ++// See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions/Character_classes. ++const jsWhitespace = "\f\n\r\t\v\u0020\u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000\ufeff" ++ + // nextJSCtx returns the context that determines whether a slash after the + // given run of tokens starts a regular expression instead of a division + // operator: / or /=. +@@ -26,7 +31,8 @@ import ( + // JavaScript 2.0 lexical grammar and requires one token of lookbehind: + // https://www.mozilla.org/js/language/js20-2000-07/rationale/syntax.html + func nextJSCtx(s []byte, preceding jsCtx) jsCtx { +- s = bytes.TrimRight(s, "\t\n\f\r \u2028\u2029") ++ // Trim all JS whitespace characters ++ s = bytes.TrimRight(s, jsWhitespace) + if len(s) == 0 { + return preceding + } +diff --git a/src/html/template/js_test.go b/src/html/template/js_test.go +index d7ee47b..8f5d76d 100644 +--- a/src/html/template/js_test.go ++++ b/src/html/template/js_test.go +@@ -81,14 +81,17 @@ func TestNextJsCtx(t *testing.T) { + {jsCtxDivOp, "0"}, + // Dots that are part of a number are div preceders. + {jsCtxDivOp, "0."}, ++ // Some JS interpreters treat NBSP as a normal space, so ++ // we must too in order to properly escape things. ++ {jsCtxRegexp, "=\u00A0"}, + } + + for _, test := range tests { +- if nextJSCtx([]byte(test.s), jsCtxRegexp) != test.jsCtx { +- t.Errorf("want %s got %q", test.jsCtx, test.s) ++ if ctx := nextJSCtx([]byte(test.s), jsCtxRegexp); ctx != test.jsCtx { ++ t.Errorf("%q: want %s got %s", test.s, test.jsCtx, ctx) + } +- if nextJSCtx([]byte(test.s), jsCtxDivOp) != test.jsCtx { +- t.Errorf("want %s got %q", test.jsCtx, test.s) ++ if ctx := nextJSCtx([]byte(test.s), jsCtxDivOp); ctx != test.jsCtx { ++ t.Errorf("%q: want %s got %s", test.s, test.jsCtx, ctx) + } + } + +-- +2.40.0 + diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-29402.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-29402.patch new file mode 100644 index 0000000000..bf1fbbe0d6 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-29402.patch @@ -0,0 +1,194 @@ +From 4dae3bbe0e6a5700037bb996ae84d6f457c4f58a Mon Sep 17 00:00:00 2001 +From: Bryan C. Mills <bcmills@google.com> +Date: Fri, 12 May 2023 14:15:16 -0400 +Subject: [PATCH] cmd/go: disallow package directories containing newlines + +Directory or file paths containing newlines may cause tools (such as +cmd/cgo) that emit "//line" or "#line" -directives to write part of +the path into non-comment lines in generated source code. If those +lines contain valid Go code, it may be injected into the resulting +binary. + +(Note that Go import paths and file paths within module zip files +already could not contain newlines.) + +Thanks to Juho Nurminen of Mattermost for reporting this issue. + +Fixes #60167. +Fixes CVE-2023-29402. + +Change-Id: I64572e9f454bce7b685d00e2e6a1c96cd33d53df +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1882606 +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Russ Cox <rsc@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/501226 +Run-TryBot: David Chase <drchase@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Michael Knyszek <mknyszek@google.com> + +Upstream-Status: Backport [https://github.com/golang/go/commit/4dae3bbe0e6a5700037bb996ae84d6f457c4f58a] +CVE: CVE-2023-29402 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + src/cmd/go/internal/load/pkg.go | 4 + + src/cmd/go/internal/work/exec.go | 6 ++ + src/cmd/go/script_test.go | 1 + + .../go/testdata/script/build_cwd_newline.txt | 100 ++++++++++++++++++ + 4 files changed, 111 insertions(+) + create mode 100644 src/cmd/go/testdata/script/build_cwd_newline.txt + +diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go +index a83cc9a..d4da86d 100644 +--- a/src/cmd/go/internal/load/pkg.go ++++ b/src/cmd/go/internal/load/pkg.go +@@ -1897,6 +1897,10 @@ func (p *Package) load(ctx context.Context, opts PackageOpts, path string, stk * + setError(fmt.Errorf("invalid input directory name %q", name)) + return + } ++ if strings.ContainsAny(p.Dir, "\r\n") { ++ setError(fmt.Errorf("invalid package directory %q", p.Dir)) ++ return ++ } + + // Build list of imported packages and full dependency list. + imports := make([]*Package, 0, len(p.Imports)) +diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go +index b35caa4..b1bf347 100644 +--- a/src/cmd/go/internal/work/exec.go ++++ b/src/cmd/go/internal/work/exec.go +@@ -505,6 +505,12 @@ func (b *Builder) build(ctx context.Context, a *Action) (err error) { + b.Print(a.Package.ImportPath + "\n") + } + ++ if p.Error != nil { ++ // Don't try to build anything for packages with errors. There may be a ++ // problem with the inputs that makes the package unsafe to build. ++ return p.Error ++ } ++ + if a.Package.BinaryOnly { + p.Stale = true + p.StaleReason = "binary-only packages are no longer supported" +diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go +index c0156d0..ce4ff37 100644 +--- a/src/cmd/go/script_test.go ++++ b/src/cmd/go/script_test.go +@@ -182,6 +182,7 @@ func (ts *testScript) setup() { + "devnull=" + os.DevNull, + "goversion=" + goVersion(ts), + ":=" + string(os.PathListSeparator), ++ "newline=\n", + } + if !testenv.HasExternalNetwork() { + ts.env = append(ts.env, "TESTGONETWORK=panic", "TESTGOVCS=panic") +diff --git a/src/cmd/go/testdata/script/build_cwd_newline.txt b/src/cmd/go/testdata/script/build_cwd_newline.txt +new file mode 100644 +index 0000000..61c6966 +--- /dev/null ++++ b/src/cmd/go/testdata/script/build_cwd_newline.txt +@@ -0,0 +1,100 @@ ++[windows] skip 'filesystem normalizes / to \' ++[plan9] skip 'filesystem disallows \n in paths' ++ ++# If the directory path containing a package to be built includes a newline, ++# the go command should refuse to even try to build the package. ++ ++env DIR=$WORK${/}${newline}'package main'${newline}'func main() { panic("uh-oh")'${newline}'/*' ++ ++mkdir $DIR ++cd $DIR ++exec pwd ++cp $WORK/go.mod ./go.mod ++cp $WORK/main.go ./main.go ++cp $WORK/main_test.go ./main_test.go ++ ++! go build -o $devnull . ++stderr 'package example: invalid package directory .*uh-oh' ++ ++! go build -o $devnull main.go ++stderr 'package command-line-arguments: invalid package directory .*uh-oh' ++ ++! go run . ++stderr 'package example: invalid package directory .*uh-oh' ++ ++! go run main.go ++stderr 'package command-line-arguments: invalid package directory .*uh-oh' ++ ++! go test . ++stderr 'package example: invalid package directory .*uh-oh' ++ ++! go test -v main.go main_test.go ++stderr 'package command-line-arguments: invalid package directory .*uh-oh' ++ ++ ++# Since we do preserve $PWD (or set it appropriately) for commands, and we do ++# not resolve symlinks unnecessarily, referring to the contents of the unsafe ++# directory via a safe symlink should be ok, and should not inject the data from ++# the symlink target path. ++ ++[!symlink] stop 'remainder of test checks symlink behavior' ++[short] stop 'links and runs binaries' ++ ++symlink $WORK${/}link -> $DIR ++ ++go run $WORK${/}link${/}main.go ++! stdout panic ++! stderr panic ++stderr '^ok$' ++ ++go test -v $WORK${/}link${/}main.go $WORK${/}link${/}main_test.go ++! stdout panic ++! stderr panic ++stdout '^ok$' # 'go test' combines the test's stdout into stderr ++ ++cd $WORK/link ++ ++! go run $DIR${/}main.go ++stderr 'package command-line-arguments: invalid package directory .*uh-oh' ++ ++go run . ++! stdout panic ++! stderr panic ++stderr '^ok$' ++ ++go run main.go ++! stdout panic ++! stderr panic ++stderr '^ok$' ++ ++go test -v ++! stdout panic ++! stderr panic ++stdout '^ok$' # 'go test' combines the test's stdout into stderr ++ ++go test -v . ++! stdout panic ++! stderr panic ++stdout '^ok$' # 'go test' combines the test's stdout into stderr ++ ++ ++-- $WORK/go.mod -- ++module example ++go 1.19 ++-- $WORK/main.go -- ++package main ++ ++import "C" ++ ++func main() { ++ /* nothing here */ ++ println("ok") ++} ++-- $WORK/main_test.go -- ++package main ++ ++import "testing" ++ ++func TestMain(*testing.M) { ++ main() ++} +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-29404.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-29404.patch new file mode 100644 index 0000000000..c6beced884 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-29404.patch @@ -0,0 +1,78 @@ +From bbeb55f5faf93659e1cfd6ab073ab3c9d126d195 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Fri, 5 May 2023 13:10:34 -0700 +Subject: [PATCH] cmd/go: enforce flags with non-optional arguments + +Enforce that linker flags which expect arguments get them, otherwise it +may be possible to smuggle unexpected flags through as the linker can +consume what looks like a flag as an argument to a preceding flag (i.e. +"-Wl,-O -Wl,-R,-bad-flag" is interpreted as "-O=-R -bad-flag"). Also be +somewhat more restrictive in the general format of some flags. + +Thanks to Juho Nurminen of Mattermost for reporting this issue. + +Fixes #60305 +Fixes CVE-2023-29404 + +Change-Id: I913df78a692cee390deefc3cd7d8f5b031524fc9 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1876275 +Reviewed-by: Ian Lance Taylor <iant@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/501225 +Run-TryBot: David Chase <drchase@google.com> +Reviewed-by: Michael Knyszek <mknyszek@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> + +Upstream-Status: Backport [https://github.com/golang/go/commit/bbeb55f5faf93659e1cfd6ab073ab3c9d126d195] +CVE: CVE-2023-29404 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + src/cmd/go/internal/work/security.go | 6 +++--- + src/cmd/go/internal/work/security_test.go | 5 +++++ + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go +index e9b9f6c..91e6e4c 100644 +--- a/src/cmd/go/internal/work/security.go ++++ b/src/cmd/go/internal/work/security.go +@@ -179,10 +179,10 @@ var validLinkerFlags = []*lazyregexp.Regexp{ + re(`-Wl,-berok`), + re(`-Wl,-Bstatic`), + re(`-Wl,-Bsymbolic-functions`), +- re(`-Wl,-O([^@,\-][^,]*)?`), ++ re(`-Wl,-O[0-9]+`), + re(`-Wl,-d[ny]`), + re(`-Wl,--disable-new-dtags`), +- re(`-Wl,-e[=,][a-zA-Z0-9]*`), ++ re(`-Wl,-e[=,][a-zA-Z0-9]+`), + re(`-Wl,--enable-new-dtags`), + re(`-Wl,--end-group`), + re(`-Wl,--(no-)?export-dynamic`), +@@ -191,7 +191,7 @@ var validLinkerFlags = []*lazyregexp.Regexp{ + re(`-Wl,--hash-style=(sysv|gnu|both)`), + re(`-Wl,-headerpad_max_install_names`), + re(`-Wl,--no-undefined`), +- re(`-Wl,-R([^@\-][^,@]*$)`), ++ re(`-Wl,-R,?([^@\-,][^,@]*$)`), + re(`-Wl,--just-symbols[=,]([^,@\-][^,@]+)`), + re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`), + re(`-Wl,-s`), +diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go +index 8d4be0a..3616548 100644 +--- a/src/cmd/go/internal/work/security_test.go ++++ b/src/cmd/go/internal/work/security_test.go +@@ -227,6 +227,11 @@ var badLinkerFlags = [][]string{ + {"-Wl,-R,@foo"}, + {"-Wl,--just-symbols,@foo"}, + {"../x.o"}, ++ {"-Wl,-R,"}, ++ {"-Wl,-O"}, ++ {"-Wl,-e="}, ++ {"-Wl,-e,"}, ++ {"-Wl,-R,-flag"}, + } + + func TestCheckLinkerFlags(t *testing.T) { +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-29405.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-29405.patch new file mode 100644 index 0000000000..d806e1e67d --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-29405.patch @@ -0,0 +1,109 @@ +From 6d8af00a630aa51134e54f0f321658621c6410f0 Mon Sep 17 00:00:00 2001 +From: Ian Lance Taylor <iant@golang.org> +Date: Thu, 4 May 2023 14:06:39 -0700 +Subject: [PATCH] cmd/go,cmd/cgo: in _cgo_flags use one line per flag + +The flags that we recorded in _cgo_flags did not use any quoting, +so a flag containing embedded spaces was mishandled. +Change the _cgo_flags format to put each flag on a separate line. +That is a simple format that does not require any quoting. + +As far as I can tell only cmd/go uses _cgo_flags, and it is only +used for gccgo. If this patch doesn't cause any trouble, then +in the next release we can change to only using _cgo_flags for gccgo. + +Thanks to Juho Nurminen of Mattermost for reporting this issue. + +Fixes #60306 +Fixes CVE-2023-29405 + +Change-Id: I81fb5337db8a22e1f4daca22ceff4b79b96d0b4f +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1875094 +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/501224 +Reviewed-by: Ian Lance Taylor <iant@google.com> +Run-TryBot: David Chase <drchase@google.com> +Reviewed-by: Michael Knyszek <mknyszek@google.com> +Reviewed-by: Roland Shoemaker <roland@golang.org> +TryBot-Result: Gopher Robot <gobot@golang.org> + +Upstream-Status: Backport [https://github.com/golang/go/commit/6d8af00a630aa51134e54f0f321658621c6410f0] +CVE: CVE-2023-29405 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + src/cmd/cgo/out.go | 4 +++- + src/cmd/go/internal/work/gccgo.go | 14 ++++++------- + .../go/testdata/script/gccgo_link_ldflags.txt | 20 +++++++++++++++++++ + 3 files changed, 29 insertions(+), 9 deletions(-) + create mode 100644 src/cmd/go/testdata/script/gccgo_link_ldflags.txt + +diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go +index 94152f4..62e6528 100644 +--- a/src/cmd/cgo/out.go ++++ b/src/cmd/cgo/out.go +@@ -47,7 +47,9 @@ func (p *Package) writeDefs() { + + fflg := creat(*objDir + "_cgo_flags") + for k, v := range p.CgoFlags { +- fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, strings.Join(v, " ")) ++ for _, arg := range v { ++ fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, arg) ++ } + if k == "LDFLAGS" && !*gccgo { + for _, arg := range v { + fmt.Fprintf(fgo2, "//go:cgo_ldflag %q\n", arg) +diff --git a/src/cmd/go/internal/work/gccgo.go b/src/cmd/go/internal/work/gccgo.go +index 1499536..bb4be2f 100644 +--- a/src/cmd/go/internal/work/gccgo.go ++++ b/src/cmd/go/internal/work/gccgo.go +@@ -283,14 +283,12 @@ func (tools gccgoToolchain) link(b *Builder, root *Action, out, importcfg string + const ldflagsPrefix = "_CGO_LDFLAGS=" + for _, line := range strings.Split(string(flags), "\n") { + if strings.HasPrefix(line, ldflagsPrefix) { +- newFlags := strings.Fields(line[len(ldflagsPrefix):]) +- for _, flag := range newFlags { +- // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS +- // but they don't mean anything to the linker so filter +- // them out. +- if flag != "-g" && !strings.HasPrefix(flag, "-O") { +- cgoldflags = append(cgoldflags, flag) +- } ++ flag := line[len(ldflagsPrefix):] ++ // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS ++ // but they don't mean anything to the linker so filter ++ // them out. ++ if flag != "-g" && !strings.HasPrefix(flag, "-O") { ++ cgoldflags = append(cgoldflags, flag) + } + } + } +diff --git a/src/cmd/go/testdata/script/gccgo_link_ldflags.txt b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt +new file mode 100644 +index 0000000..4e91ae5 +--- /dev/null ++++ b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt +@@ -0,0 +1,20 @@ ++# Test that #cgo LDFLAGS are properly quoted. ++# The #cgo LDFLAGS below should pass a string with spaces to -L, ++# as though searching a directory with a space in its name. ++# It should not pass --nosuchoption to the external linker. ++ ++[!cgo] skip ++ ++go build ++ ++[!exec:gccgo] skip ++ ++go build -compiler gccgo ++ ++-- go.mod -- ++module m ++-- cgo.go -- ++package main ++// #cgo LDFLAGS: -L "./ -Wl,--nosuchoption" ++import "C" ++func main() {} +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-29409.patch b/meta/recipes-devtools/go/go-1.19/CVE-2023-29409.patch new file mode 100644 index 0000000000..38451f7555 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-29409.patch @@ -0,0 +1,175 @@ +From 2300f7ef07718f6be4d8aa8486c7de99836e233f Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Wed, 23 Aug 2023 12:03:43 +0000 +Subject: [PATCH] crypto/tls: restrict RSA keys in certificates to <= 8192 bits + +Extremely large RSA keys in certificate chains can cause a client/server +to expend significant CPU time verifying signatures. Limit this by +restricting the size of RSA keys transmitted during handshakes to <= +8192 bits. + +Based on a survey of publicly trusted RSA keys, there are currently only +three certificates in circulation with keys larger than this, and all +three appear to be test certificates that are not actively deployed. It +is possible there are larger keys in use in private PKIs, but we target +the web PKI, so causing breakage here in the interests of increasing the +default safety of users of crypto/tls seems reasonable. + +Thanks to Mateusz Poliwczak for reporting this issue. + +Updates #61460 +Fixes #61579 +Fixes CVE-2023-29409 + +Change-Id: Ie35038515a649199a36a12fc2c5df3af855dca6c +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1912161 +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +(cherry picked from commit d865c715d92887361e4bd5596e19e513f27781b7) +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1965487 +Reviewed-on: https://go-review.googlesource.com/c/go/+/514915 +Run-TryBot: David Chase <drchase@google.com> +Reviewed-by: Matthew Dempsky <mdempsky@google.com> +TryBot-Bypass: David Chase <drchase@google.com> + +CVE: CVE-2023-29409 + +Upstream-Status: Backport [https://github.com/golang/go/commit/2300f7ef07718f6be4d8aa8486c7de99836e233f] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/crypto/tls/handshake_client.go | 8 +++ + src/crypto/tls/handshake_client_test.go | 78 +++++++++++++++++++++++++ + src/crypto/tls/handshake_server.go | 4 ++ + 3 files changed, 90 insertions(+) + +diff --git a/src/crypto/tls/handshake_client.go b/src/crypto/tls/handshake_client.go +index 85622f1..828d2cb 100644 +--- a/src/crypto/tls/handshake_client.go ++++ b/src/crypto/tls/handshake_client.go +@@ -852,6 +852,10 @@ func (hs *clientHandshakeState) sendFinished(out []byte) error { + return nil + } + ++// maxRSAKeySize is the maximum RSA key size in bits that we are willing ++// to verify the signatures of during a TLS handshake. ++const maxRSAKeySize = 8192 ++ + // verifyServerCertificate parses and verifies the provided chain, setting + // c.verifiedChains and c.peerCertificates or sending the appropriate alert. + func (c *Conn) verifyServerCertificate(certificates [][]byte) error { +@@ -862,6 +866,10 @@ func (c *Conn) verifyServerCertificate(certificates [][]byte) error { + c.sendAlert(alertBadCertificate) + return errors.New("tls: failed to parse certificate from server: " + err.Error()) + } ++ if cert.PublicKeyAlgorithm == x509.RSA && cert.PublicKey.(*rsa.PublicKey).N.BitLen() > maxRSAKeySize { ++ c.sendAlert(alertBadCertificate) ++ return fmt.Errorf("tls: server sent certificate containing RSA key larger than %d bits", maxRSAKeySize) ++ } + certs[i] = cert + } + +diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go +index 0228745..d581cb1 100644 +--- a/src/crypto/tls/handshake_client_test.go ++++ b/src/crypto/tls/handshake_client_test.go +@@ -2595,3 +2595,81 @@ func TestClientHandshakeContextCancellation(t *testing.T) { + t.Error("Client connection was not closed when the context was canceled") + } + } ++ ++// discardConn wraps a net.Conn but discards all writes, but reports that they happened. ++type discardConn struct { ++ net.Conn ++} ++ ++func (dc *discardConn) Write(data []byte) (int, error) { ++ return len(data), nil ++} ++ ++// largeRSAKeyCertPEM contains a 8193 bit RSA key ++const largeRSAKeyCertPEM = `-----BEGIN CERTIFICATE----- ++MIIInjCCBIWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDEwd0ZXN0 ++aW5nMB4XDTIzMDYwNzIxMjMzNloXDTIzMDYwNzIzMjMzNlowEjEQMA4GA1UEAxMH ++dGVzdGluZzCCBCIwDQYJKoZIhvcNAQEBBQADggQPADCCBAoCggQBAWdHsf6Rh2Ca ++n2SQwn4t4OQrOjbLLdGE1pM6TBKKrHUFy62uEL8atNjlcfXIsa4aEu3xNGiqxqur ++ZectlkZbm0FkaaQ1Wr9oikDY3KfjuaXdPdO/XC/h8AKNxlDOylyXwUSK/CuYb+1j ++gy8yF5QFvVfwW/xwTlHmhUeSkVSQPosfQ6yXNNsmMzkd+ZPWLrfq4R+wiNtwYGu0 ++WSBcI/M9o8/vrNLnIppoiBJJ13j9CR1ToEAzOFh9wwRWLY10oZhoh1ONN1KQURx4 ++qedzvvP2DSjZbUccdvl2rBGvZpzfOiFdm1FCnxB0c72Cqx+GTHXBFf8bsa7KHky9 ++sNO1GUanbq17WoDNgwbY6H51bfShqv0CErxatwWox3we4EcAmFHPVTCYL1oWVMGo ++a3Eth91NZj+b/nGhF9lhHKGzXSv9brmLLkfvM1jA6XhNhA7BQ5Vz67lj2j3XfXdh ++t/BU5pBXbL4Ut4mIhT1YnKXAjX2/LF5RHQTE8Vwkx5JAEKZyUEGOReD/B+7GOrLp ++HduMT9vZAc5aR2k9I8qq1zBAzsL69lyQNAPaDYd1BIAjUety9gAYaSQffCgAgpRO ++Gt+DYvxS+7AT/yEd5h74MU2AH7KrAkbXOtlwupiGwhMVTstncDJWXMJqbBhyHPF8 ++3UmZH0hbL4PYmzSj9LDWQQXI2tv6vrCpfts3Cqhqxz9vRpgY7t1Wu6l/r+KxYYz3 ++1pcGpPvRmPh0DJm7cPTiXqPnZcPt+ulSaSdlxmd19OnvG5awp0fXhxryZVwuiT8G ++VDkhyARrxYrdjlINsZJZbQjO0t8ketXAELJOnbFXXzeCOosyOHkLwsqOO96AVJA8 ++45ZVL5m95ClGy0RSrjVIkXsxTAMVG6SPAqKwk6vmTdRGuSPS4rhgckPVDHmccmuq ++dfnT2YkX+wB2/M3oCgU+s30fAHGkbGZ0pCdNbFYFZLiH0iiMbTDl/0L/z7IdK0nH ++GLHVE7apPraKC6xl6rPWsD2iSfrmtIPQa0+rqbIVvKP5JdfJ8J4alI+OxFw/znQe ++V0/Rez0j22Fe119LZFFSXhRv+ZSvcq20xDwh00mzcumPWpYuCVPozA18yIhC9tNn ++ALHndz0tDseIdy9vC71jQWy9iwri3ueN0DekMMF8JGzI1Z6BAFzgyAx3DkHtwHg7 ++B7qD0jPG5hJ5+yt323fYgJsuEAYoZ8/jzZ01pkX8bt+UsVN0DGnSGsI2ktnIIk3J ++l+8krjmUy6EaW79nITwoOqaeHOIp8m3UkjEcoKOYrzHRKqRy+A09rY+m/cAQaafW ++4xp0Zv7qZPLwnu0jsqB4jD8Ll9yPB02ndsoV6U5PeHzTkVhPml19jKUAwFfs7TJg ++kXy+/xFhYVUCAwEAATANBgkqhkiG9w0BAQsFAAOCBAIAAQnZY77pMNeypfpba2WK ++aDasT7dk2JqP0eukJCVPTN24Zca+xJNPdzuBATm/8SdZK9lddIbjSnWRsKvTnO2r ++/rYdlPf3jM5uuJtb8+Uwwe1s+gszelGS9G/lzzq+ehWicRIq2PFcs8o3iQMfENiv ++qILJ+xjcrvms5ZPDNahWkfRx3KCg8Q+/at2n5p7XYjMPYiLKHnDC+RE2b1qT20IZ ++FhuK/fTWLmKbfYFNNga6GC4qcaZJ7x0pbm4SDTYp0tkhzcHzwKhidfNB5J2vNz6l ++Ur6wiYwamFTLqcOwWo7rdvI+sSn05WQBv0QZlzFX+OAu0l7WQ7yU+noOxBhjvHds ++14+r9qcQZg2q9kG+evopYZqYXRUNNlZKo9MRBXhfrISulFAc5lRFQIXMXnglvAu+ ++Ipz2gomEAOcOPNNVldhKAU94GAMJd/KfN0ZP7gX3YvPzuYU6XDhag5RTohXLm18w ++5AF+ES3DOQ6ixu3DTf0D+6qrDuK+prdX8ivcdTQVNOQ+MIZeGSc6NWWOTaMGJ3lg ++aZIxJUGdo6E7GBGiC1YTjgFKFbHzek1LRTh/LX3vbSudxwaG0HQxwsU9T4DWiMqa ++Fkf2KteLEUA6HrR+0XlAZrhwoqAmrJ+8lCFX3V0gE9lpENfVHlFXDGyx10DpTB28 ++DdjnY3F7EPWNzwf9P3oNT69CKW3Bk6VVr3ROOJtDxVu1ioWo3TaXltQ0VOnap2Pu ++sa5wfrpfwBDuAS9JCDg4ttNp2nW3F7tgXC6xPqw5pvGwUppEw9XNrqV8TZrxduuv ++rQ3NyZ7KSzIpmFlD3UwV/fGfz3UQmHS6Ng1evrUID9DjfYNfRqSGIGjDfxGtYD+j ++Z1gLJZuhjJpNtwBkKRtlNtrCWCJK2hidK/foxwD7kwAPo2I9FjpltxCRywZUs07X ++KwXTfBR9v6ij1LV6K58hFS+8ezZyZ05CeVBFkMQdclTOSfuPxlMkQOtjp8QWDj+F ++j/MYziT5KBkHvcbrjdRtUJIAi4N7zCsPZtjik918AK1WBNRVqPbrgq/XSEXMfuvs ++6JbfK0B76vdBDRtJFC1JsvnIrGbUztxXzyQwFLaR/AjVJqpVlysLWzPKWVX6/+SJ ++u1NQOl2E8P6ycyBsuGnO89p0S4F8cMRcI2X1XQsZ7/q0NBrOMaEp5T3SrWo9GiQ3 ++o2SBdbs3Y6MBPBtTu977Z/0RO63J3M5i2tjUiDfrFy7+VRLKr7qQ7JibohyB8QaR ++9tedgjn2f+of7PnP/PEl1cCphUZeHM7QKUMPT8dbqwmKtlYY43EHXcvNOT5IBk3X ++9lwJoZk/B2i+ZMRNSP34ztAwtxmasPt6RAWGQpWCn9qmttAHAnMfDqe7F7jVR6rS ++u58= ++-----END CERTIFICATE-----` ++ ++func TestHandshakeRSATooBig(t *testing.T) { ++ testCert, _ := pem.Decode([]byte(largeRSAKeyCertPEM)) ++ ++ c := &Conn{conn: &discardConn{}, config: testConfig.Clone()} ++ ++ expectedErr := "tls: server sent certificate containing RSA key larger than 8192 bits" ++ err := c.verifyServerCertificate([][]byte{testCert.Bytes}) ++ if err == nil || err.Error() != expectedErr { ++ t.Errorf("Conn.verifyServerCertificate unexpected error: want %q, got %q", expectedErr, err) ++ } ++ ++ expectedErr = "tls: client sent certificate containing RSA key larger than 8192 bits" ++ err = c.processCertsFromClient(Certificate{Certificate: [][]byte{testCert.Bytes}}) ++ if err == nil || err.Error() != expectedErr { ++ t.Errorf("Conn.processCertsFromClient unexpected error: want %q, got %q", expectedErr, err) ++ } ++} +diff --git a/src/crypto/tls/handshake_server.go b/src/crypto/tls/handshake_server.go +index 8d51e7e..a5d8f4a 100644 +--- a/src/crypto/tls/handshake_server.go ++++ b/src/crypto/tls/handshake_server.go +@@ -812,6 +812,10 @@ func (c *Conn) processCertsFromClient(certificate Certificate) error { + c.sendAlert(alertBadCertificate) + return errors.New("tls: failed to parse client certificate: " + err.Error()) + } ++ if certs[i].PublicKeyAlgorithm == x509.RSA && certs[i].PublicKey.(*rsa.PublicKey).N.BitLen() > maxRSAKeySize { ++ c.sendAlert(alertBadCertificate) ++ return fmt.Errorf("tls: client sent certificate containing RSA key larger than %d bits", maxRSAKeySize) ++ } + } + + if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) { +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.19/add_godebug.patch b/meta/recipes-devtools/go/go-1.19/add_godebug.patch new file mode 100644 index 0000000000..0c3d2d2855 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/add_godebug.patch @@ -0,0 +1,84 @@ + +Upstream-Status: Backport [see text] + +https://github.com/golong/go.git as of commit 22c1d18a27... +Copy src/internal/godebug from go 1.19 since it does not +exist in 1.17. + +Signed-off-by: Joe Slater <joe.slater@windriver.com> +--- + +--- /dev/null ++++ go/src/internal/godebug/godebug.go +@@ -0,0 +1,34 @@ ++// Copyright 2021 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++// Package godebug parses the GODEBUG environment variable. ++package godebug ++ ++import "os" ++ ++// Get returns the value for the provided GODEBUG key. ++func Get(key string) string { ++ return get(os.Getenv("GODEBUG"), key) ++} ++ ++// get returns the value part of key=value in s (a GODEBUG value). ++func get(s, key string) string { ++ for i := 0; i < len(s)-len(key)-1; i++ { ++ if i > 0 && s[i-1] != ',' { ++ continue ++ } ++ afterKey := s[i+len(key):] ++ if afterKey[0] != '=' || s[i:i+len(key)] != key { ++ continue ++ } ++ val := afterKey[1:] ++ for i, b := range val { ++ if b == ',' { ++ return val[:i] ++ } ++ } ++ return val ++ } ++ return "" ++} +--- /dev/null ++++ go/src/internal/godebug/godebug_test.go +@@ -0,0 +1,34 @@ ++// Copyright 2021 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++package godebug ++ ++import "testing" ++ ++func TestGet(t *testing.T) { ++ tests := []struct { ++ godebug string ++ key string ++ want string ++ }{ ++ {"", "", ""}, ++ {"", "foo", ""}, ++ {"foo=bar", "foo", "bar"}, ++ {"foo=bar,after=x", "foo", "bar"}, ++ {"before=x,foo=bar,after=x", "foo", "bar"}, ++ {"before=x,foo=bar", "foo", "bar"}, ++ {",,,foo=bar,,,", "foo", "bar"}, ++ {"foodecoy=wrong,foo=bar", "foo", "bar"}, ++ {"foo=", "foo", ""}, ++ {"foo", "foo", ""}, ++ {",foo", "foo", ""}, ++ {"foo=bar,baz", "loooooooong", ""}, ++ } ++ for _, tt := range tests { ++ got := get(tt.godebug, tt.key) ++ if got != tt.want { ++ t.Errorf("get(%q, %q) = %q; want %q", tt.godebug, tt.key, got, tt.want) ++ } ++ } ++} diff --git a/meta/recipes-devtools/go/go-1.19/cve-2022-41724.patch b/meta/recipes-devtools/go/go-1.19/cve-2022-41724.patch new file mode 100644 index 0000000000..aacffbffcd --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/cve-2022-41724.patch @@ -0,0 +1,2391 @@ +From 00b256e9e3c0fa02a278ec9dfc3e191e02ceaf80 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <roland@golang.org> +Date: Wed, 14 Dec 2022 09:43:16 -0800 +Subject: [PATCH] [release-branch.go1.19] crypto/tls: replace all usages of + BytesOrPanic + +Message marshalling makes use of BytesOrPanic a lot, under the +assumption that it will never panic. This assumption was incorrect, and +specifically crafted handshakes could trigger panics. Rather than just +surgically replacing the usages of BytesOrPanic in paths that could +panic, replace all usages of it with proper error returns in case there +are other ways of triggering panics which we didn't find. + +In one specific case, the tree routed by expandLabel, we replace the +usage of BytesOrPanic, but retain a panic. This function already +explicitly panicked elsewhere, and returning an error from it becomes +rather painful because it requires changing a large number of APIs. +The marshalling is unlikely to ever panic, as the inputs are all either +fixed length, or already limited to the sizes required. If it were to +panic, it'd likely only be during development. A close inspection shows +no paths for a user to cause a panic currently. + +This patches ends up being rather large, since it requires routing +errors back through functions which previously had no error returns. +Where possible I've tried to use helpers that reduce the verbosity +of frequently repeated stanzas, and to make the diffs as minimal as +possible. + +Thanks to Marten Seemann for reporting this issue. + +Updates #58001 +Fixes #58358 +Fixes CVE-2022-41724 + +Change-Id: Ieb55867ef0a3e1e867b33f09421932510cb58851 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1679436 +Reviewed-by: Julie Qiu <julieqiu@google.com> +TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +(cherry picked from commit 0f3a44ad7b41cc89efdfad25278953e17d9c1e04) +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728204 +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/468117 +Auto-Submit: Michael Pratt <mpratt@google.com> +Run-TryBot: Michael Pratt <mpratt@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Than McIntosh <thanm@google.com> +--- + +CVE: CVE-2022-41724 + +Upstream-Status: Backport [see text] + +https://github.com/golong/go.git commit 00b256e9e3c0fa... +boring_test.go does not exist +modified for conn.go and handshake_messages.go + +Signed-off-by: Joe Slater <joe.slater@windriver.com> + +--- + src/crypto/tls/boring_test.go | 2 +- + src/crypto/tls/common.go | 2 +- + src/crypto/tls/conn.go | 46 +- + src/crypto/tls/handshake_client.go | 95 +-- + src/crypto/tls/handshake_client_test.go | 4 +- + src/crypto/tls/handshake_client_tls13.go | 74 ++- + src/crypto/tls/handshake_messages.go | 716 +++++++++++----------- + src/crypto/tls/handshake_messages_test.go | 19 +- + src/crypto/tls/handshake_server.go | 73 ++- + src/crypto/tls/handshake_server_test.go | 31 +- + src/crypto/tls/handshake_server_tls13.go | 71 ++- + src/crypto/tls/key_schedule.go | 19 +- + src/crypto/tls/ticket.go | 8 +- + 13 files changed, 657 insertions(+), 503 deletions(-) + +--- go.orig/src/crypto/tls/common.go ++++ go/src/crypto/tls/common.go +@@ -1357,7 +1357,7 @@ func (c *Certificate) leaf() (*x509.Cert + } + + type handshakeMessage interface { +- marshal() []byte ++ marshal() ([]byte, error) + unmarshal([]byte) bool + } + +--- go.orig/src/crypto/tls/conn.go ++++ go/src/crypto/tls/conn.go +@@ -994,18 +994,46 @@ func (c *Conn) writeRecordLocked(typ rec + return n, nil + } + +-// writeRecord writes a TLS record with the given type and payload to the +-// connection and updates the record layer state. +-func (c *Conn) writeRecord(typ recordType, data []byte) (int, error) { ++// writeHandshakeRecord writes a handshake message to the connection and updates ++// the record layer state. If transcript is non-nil the marshalled message is ++// written to it. ++func (c *Conn) writeHandshakeRecord(msg handshakeMessage, transcript transcriptHash) (int, error) { + c.out.Lock() + defer c.out.Unlock() + +- return c.writeRecordLocked(typ, data) ++ data, err := msg.marshal() ++ if err != nil { ++ return 0, err ++ } ++ if transcript != nil { ++ transcript.Write(data) ++ } ++ ++ return c.writeRecordLocked(recordTypeHandshake, data) ++} ++ ++// writeChangeCipherRecord writes a ChangeCipherSpec message to the connection and ++// updates the record layer state. ++func (c *Conn) writeChangeCipherRecord() error { ++ c.out.Lock() ++ defer c.out.Unlock() ++ _, err := c.writeRecordLocked(recordTypeChangeCipherSpec, []byte{1}) ++ return err + } + + // readHandshake reads the next handshake message from +-// the record layer. +-func (c *Conn) readHandshake() (interface{}, error) { ++// the record layer. If transcript is non-nil, the message ++// is written to the passed transcriptHash. ++ ++// backport 00b256e9e3c0fa02a278ec9dfc3e191e02ceaf80 ++// ++// Commit wants to set this to ++// ++// func (c *Conn) readHandshake(transcript transcriptHash) (any, error) { ++// ++// but that does not compile. Retain the original interface{} argument. ++// ++func (c *Conn) readHandshake(transcript transcriptHash) (interface{}, error) { + for c.hand.Len() < 4 { + if err := c.readRecord(); err != nil { + return nil, err +@@ -1084,6 +1112,11 @@ func (c *Conn) readHandshake() (interfac + if !m.unmarshal(data) { + return nil, c.in.setErrorLocked(c.sendAlert(alertUnexpectedMessage)) + } ++ ++ if transcript != nil { ++ transcript.Write(data) ++ } ++ + return m, nil + } + +@@ -1159,7 +1192,7 @@ func (c *Conn) handleRenegotiation() err + return errors.New("tls: internal error: unexpected renegotiation") + } + +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -1205,7 +1238,7 @@ func (c *Conn) handlePostHandshakeMessag + return c.handleRenegotiation() + } + +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -1241,7 +1274,11 @@ func (c *Conn) handleKeyUpdate(keyUpdate + defer c.out.Unlock() + + msg := &keyUpdateMsg{} +- _, err := c.writeRecordLocked(recordTypeHandshake, msg.marshal()) ++ msgBytes, err := msg.marshal() ++ if err != nil { ++ return err ++ } ++ _, err = c.writeRecordLocked(recordTypeHandshake, msgBytes) + if err != nil { + // Surface the error at the next write. + c.out.setErrorLocked(err) +--- go.orig/src/crypto/tls/handshake_client.go ++++ go/src/crypto/tls/handshake_client.go +@@ -157,7 +157,10 @@ func (c *Conn) clientHandshake(ctx conte + } + c.serverName = hello.serverName + +- cacheKey, session, earlySecret, binderKey := c.loadSession(hello) ++ cacheKey, session, earlySecret, binderKey, err := c.loadSession(hello) ++ if err != nil { ++ return err ++ } + if cacheKey != "" && session != nil { + defer func() { + // If we got a handshake failure when resuming a session, throw away +@@ -172,11 +175,12 @@ func (c *Conn) clientHandshake(ctx conte + }() + } + +- if _, err := c.writeRecord(recordTypeHandshake, hello.marshal()); err != nil { ++ if _, err := c.writeHandshakeRecord(hello, nil); err != nil { + return err + } + +- msg, err := c.readHandshake() ++ // serverHelloMsg is not included in the transcript ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -241,9 +245,9 @@ func (c *Conn) clientHandshake(ctx conte + } + + func (c *Conn) loadSession(hello *clientHelloMsg) (cacheKey string, +- session *ClientSessionState, earlySecret, binderKey []byte) { ++ session *ClientSessionState, earlySecret, binderKey []byte, err error) { + if c.config.SessionTicketsDisabled || c.config.ClientSessionCache == nil { +- return "", nil, nil, nil ++ return "", nil, nil, nil, nil + } + + hello.ticketSupported = true +@@ -258,14 +262,14 @@ func (c *Conn) loadSession(hello *client + // renegotiation is primarily used to allow a client to send a client + // certificate, which would be skipped if session resumption occurred. + if c.handshakes != 0 { +- return "", nil, nil, nil ++ return "", nil, nil, nil, nil + } + + // Try to resume a previously negotiated TLS session, if available. + cacheKey = clientSessionCacheKey(c.conn.RemoteAddr(), c.config) + session, ok := c.config.ClientSessionCache.Get(cacheKey) + if !ok || session == nil { +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + + // Check that version used for the previous session is still valid. +@@ -277,7 +281,7 @@ func (c *Conn) loadSession(hello *client + } + } + if !versOk { +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + + // Check that the cached server certificate is not expired, and that it's +@@ -286,16 +290,16 @@ func (c *Conn) loadSession(hello *client + if !c.config.InsecureSkipVerify { + if len(session.verifiedChains) == 0 { + // The original connection had InsecureSkipVerify, while this doesn't. +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + serverCert := session.serverCertificates[0] + if c.config.time().After(serverCert.NotAfter) { + // Expired certificate, delete the entry. + c.config.ClientSessionCache.Put(cacheKey, nil) +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + if err := serverCert.VerifyHostname(c.config.ServerName); err != nil { +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + } + +@@ -303,7 +307,7 @@ func (c *Conn) loadSession(hello *client + // In TLS 1.2 the cipher suite must match the resumed session. Ensure we + // are still offering it. + if mutualCipherSuite(hello.cipherSuites, session.cipherSuite) == nil { +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + + hello.sessionTicket = session.sessionTicket +@@ -313,14 +317,14 @@ func (c *Conn) loadSession(hello *client + // Check that the session ticket is not expired. + if c.config.time().After(session.useBy) { + c.config.ClientSessionCache.Put(cacheKey, nil) +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + + // In TLS 1.3 the KDF hash must match the resumed session. Ensure we + // offer at least one cipher suite with that hash. + cipherSuite := cipherSuiteTLS13ByID(session.cipherSuite) + if cipherSuite == nil { +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + cipherSuiteOk := false + for _, offeredID := range hello.cipherSuites { +@@ -331,7 +335,7 @@ func (c *Conn) loadSession(hello *client + } + } + if !cipherSuiteOk { +- return cacheKey, nil, nil, nil ++ return cacheKey, nil, nil, nil, nil + } + + // Set the pre_shared_key extension. See RFC 8446, Section 4.2.11.1. +@@ -349,9 +353,15 @@ func (c *Conn) loadSession(hello *client + earlySecret = cipherSuite.extract(psk, nil) + binderKey = cipherSuite.deriveSecret(earlySecret, resumptionBinderLabel, nil) + transcript := cipherSuite.hash.New() +- transcript.Write(hello.marshalWithoutBinders()) ++ helloBytes, err := hello.marshalWithoutBinders() ++ if err != nil { ++ return "", nil, nil, nil, err ++ } ++ transcript.Write(helloBytes) + pskBinders := [][]byte{cipherSuite.finishedHash(binderKey, transcript)} +- hello.updateBinders(pskBinders) ++ if err := hello.updateBinders(pskBinders); err != nil { ++ return "", nil, nil, nil, err ++ } + + return + } +@@ -396,8 +406,12 @@ func (hs *clientHandshakeState) handshak + hs.finishedHash.discardHandshakeBuffer() + } + +- hs.finishedHash.Write(hs.hello.marshal()) +- hs.finishedHash.Write(hs.serverHello.marshal()) ++ if err := transcriptMsg(hs.hello, &hs.finishedHash); err != nil { ++ return err ++ } ++ if err := transcriptMsg(hs.serverHello, &hs.finishedHash); err != nil { ++ return err ++ } + + c.buffering = true + c.didResume = isResume +@@ -468,7 +482,7 @@ func (hs *clientHandshakeState) pickCiph + func (hs *clientHandshakeState) doFullHandshake() error { + c := hs.c + +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -477,9 +491,8 @@ func (hs *clientHandshakeState) doFullHa + c.sendAlert(alertUnexpectedMessage) + return unexpectedMessageError(certMsg, msg) + } +- hs.finishedHash.Write(certMsg.marshal()) + +- msg, err = c.readHandshake() ++ msg, err = c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -497,11 +510,10 @@ func (hs *clientHandshakeState) doFullHa + c.sendAlert(alertUnexpectedMessage) + return errors.New("tls: received unexpected CertificateStatus message") + } +- hs.finishedHash.Write(cs.marshal()) + + c.ocspResponse = cs.response + +- msg, err = c.readHandshake() ++ msg, err = c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -530,14 +542,13 @@ func (hs *clientHandshakeState) doFullHa + + skx, ok := msg.(*serverKeyExchangeMsg) + if ok { +- hs.finishedHash.Write(skx.marshal()) + err = keyAgreement.processServerKeyExchange(c.config, hs.hello, hs.serverHello, c.peerCertificates[0], skx) + if err != nil { + c.sendAlert(alertUnexpectedMessage) + return err + } + +- msg, err = c.readHandshake() ++ msg, err = c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -548,7 +559,6 @@ func (hs *clientHandshakeState) doFullHa + certReq, ok := msg.(*certificateRequestMsg) + if ok { + certRequested = true +- hs.finishedHash.Write(certReq.marshal()) + + cri := certificateRequestInfoFromMsg(hs.ctx, c.vers, certReq) + if chainToSend, err = c.getClientCertificate(cri); err != nil { +@@ -556,7 +566,7 @@ func (hs *clientHandshakeState) doFullHa + return err + } + +- msg, err = c.readHandshake() ++ msg, err = c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -567,7 +577,6 @@ func (hs *clientHandshakeState) doFullHa + c.sendAlert(alertUnexpectedMessage) + return unexpectedMessageError(shd, msg) + } +- hs.finishedHash.Write(shd.marshal()) + + // If the server requested a certificate then we have to send a + // Certificate message, even if it's empty because we don't have a +@@ -575,8 +584,7 @@ func (hs *clientHandshakeState) doFullHa + if certRequested { + certMsg = new(certificateMsg) + certMsg.certificates = chainToSend.Certificate +- hs.finishedHash.Write(certMsg.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil { + return err + } + } +@@ -587,8 +595,7 @@ func (hs *clientHandshakeState) doFullHa + return err + } + if ckx != nil { +- hs.finishedHash.Write(ckx.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, ckx.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(ckx, &hs.finishedHash); err != nil { + return err + } + } +@@ -635,8 +642,7 @@ func (hs *clientHandshakeState) doFullHa + return err + } + +- hs.finishedHash.Write(certVerify.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certVerify.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certVerify, &hs.finishedHash); err != nil { + return err + } + } +@@ -771,7 +777,10 @@ func (hs *clientHandshakeState) readFini + return err + } + +- msg, err := c.readHandshake() ++ // finishedMsg is included in the transcript, but not until after we ++ // check the client version, since the state before this message was ++ // sent is used during verification. ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -787,7 +796,11 @@ func (hs *clientHandshakeState) readFini + c.sendAlert(alertHandshakeFailure) + return errors.New("tls: server's Finished message was incorrect") + } +- hs.finishedHash.Write(serverFinished.marshal()) ++ ++ if err := transcriptMsg(serverFinished, &hs.finishedHash); err != nil { ++ return err ++ } ++ + copy(out, verify) + return nil + } +@@ -798,7 +811,7 @@ func (hs *clientHandshakeState) readSess + } + + c := hs.c +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -807,7 +820,6 @@ func (hs *clientHandshakeState) readSess + c.sendAlert(alertUnexpectedMessage) + return unexpectedMessageError(sessionTicketMsg, msg) + } +- hs.finishedHash.Write(sessionTicketMsg.marshal()) + + hs.session = &ClientSessionState{ + sessionTicket: sessionTicketMsg.ticket, +@@ -827,14 +839,13 @@ func (hs *clientHandshakeState) readSess + func (hs *clientHandshakeState) sendFinished(out []byte) error { + c := hs.c + +- if _, err := c.writeRecord(recordTypeChangeCipherSpec, []byte{1}); err != nil { ++ if err := c.writeChangeCipherRecord(); err != nil { + return err + } + + finished := new(finishedMsg) + finished.verifyData = hs.finishedHash.clientSum(hs.masterSecret) +- hs.finishedHash.Write(finished.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil { + return err + } + copy(out, finished.verifyData) +--- go.orig/src/crypto/tls/handshake_client_test.go ++++ go/src/crypto/tls/handshake_client_test.go +@@ -1257,7 +1257,7 @@ func TestServerSelectingUnconfiguredAppl + cipherSuite: TLS_RSA_WITH_AES_128_GCM_SHA256, + alpnProtocol: "how-about-this", + } +- serverHelloBytes := serverHello.marshal() ++ serverHelloBytes := mustMarshal(t, serverHello) + + s.Write([]byte{ + byte(recordTypeHandshake), +@@ -1500,7 +1500,7 @@ func TestServerSelectingUnconfiguredCiph + random: make([]byte, 32), + cipherSuite: TLS_RSA_WITH_AES_256_GCM_SHA384, + } +- serverHelloBytes := serverHello.marshal() ++ serverHelloBytes := mustMarshal(t, serverHello) + + s.Write([]byte{ + byte(recordTypeHandshake), +--- go.orig/src/crypto/tls/handshake_client_tls13.go ++++ go/src/crypto/tls/handshake_client_tls13.go +@@ -58,7 +58,10 @@ func (hs *clientHandshakeStateTLS13) han + } + + hs.transcript = hs.suite.hash.New() +- hs.transcript.Write(hs.hello.marshal()) ++ ++ if err := transcriptMsg(hs.hello, hs.transcript); err != nil { ++ return err ++ } + + if bytes.Equal(hs.serverHello.random, helloRetryRequestRandom) { + if err := hs.sendDummyChangeCipherSpec(); err != nil { +@@ -69,7 +72,9 @@ func (hs *clientHandshakeStateTLS13) han + } + } + +- hs.transcript.Write(hs.serverHello.marshal()) ++ if err := transcriptMsg(hs.serverHello, hs.transcript); err != nil { ++ return err ++ } + + c.buffering = true + if err := hs.processServerHello(); err != nil { +@@ -168,8 +173,7 @@ func (hs *clientHandshakeStateTLS13) sen + } + hs.sentDummyCCS = true + +- _, err := hs.c.writeRecord(recordTypeChangeCipherSpec, []byte{1}) +- return err ++ return hs.c.writeChangeCipherRecord() + } + + // processHelloRetryRequest handles the HRR in hs.serverHello, modifies and +@@ -184,7 +188,9 @@ func (hs *clientHandshakeStateTLS13) pro + hs.transcript.Reset() + hs.transcript.Write([]byte{typeMessageHash, 0, 0, uint8(len(chHash))}) + hs.transcript.Write(chHash) +- hs.transcript.Write(hs.serverHello.marshal()) ++ if err := transcriptMsg(hs.serverHello, hs.transcript); err != nil { ++ return err ++ } + + // The only HelloRetryRequest extensions we support are key_share and + // cookie, and clients must abort the handshake if the HRR would not result +@@ -249,10 +255,18 @@ func (hs *clientHandshakeStateTLS13) pro + transcript := hs.suite.hash.New() + transcript.Write([]byte{typeMessageHash, 0, 0, uint8(len(chHash))}) + transcript.Write(chHash) +- transcript.Write(hs.serverHello.marshal()) +- transcript.Write(hs.hello.marshalWithoutBinders()) ++ if err := transcriptMsg(hs.serverHello, hs.transcript); err != nil { ++ return err ++ } ++ helloBytes, err := hs.hello.marshalWithoutBinders() ++ if err != nil { ++ return err ++ } ++ transcript.Write(helloBytes) + pskBinders := [][]byte{hs.suite.finishedHash(hs.binderKey, transcript)} +- hs.hello.updateBinders(pskBinders) ++ if err := hs.hello.updateBinders(pskBinders); err != nil { ++ return err ++ } + } else { + // Server selected a cipher suite incompatible with the PSK. + hs.hello.pskIdentities = nil +@@ -260,12 +274,12 @@ func (hs *clientHandshakeStateTLS13) pro + } + } + +- hs.transcript.Write(hs.hello.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(hs.hello, hs.transcript); err != nil { + return err + } + +- msg, err := c.readHandshake() ++ // serverHelloMsg is not included in the transcript ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -354,6 +368,7 @@ func (hs *clientHandshakeStateTLS13) est + if !hs.usingPSK { + earlySecret = hs.suite.extract(nil, nil) + } ++ + handshakeSecret := hs.suite.extract(sharedKey, + hs.suite.deriveSecret(earlySecret, "derived", nil)) + +@@ -384,7 +399,7 @@ func (hs *clientHandshakeStateTLS13) est + func (hs *clientHandshakeStateTLS13) readServerParameters() error { + c := hs.c + +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(hs.transcript) + if err != nil { + return err + } +@@ -394,7 +409,6 @@ func (hs *clientHandshakeStateTLS13) rea + c.sendAlert(alertUnexpectedMessage) + return unexpectedMessageError(encryptedExtensions, msg) + } +- hs.transcript.Write(encryptedExtensions.marshal()) + + if err := checkALPN(hs.hello.alpnProtocols, encryptedExtensions.alpnProtocol); err != nil { + c.sendAlert(alertUnsupportedExtension) +@@ -423,18 +437,16 @@ func (hs *clientHandshakeStateTLS13) rea + return nil + } + +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(hs.transcript) + if err != nil { + return err + } + + certReq, ok := msg.(*certificateRequestMsgTLS13) + if ok { +- hs.transcript.Write(certReq.marshal()) +- + hs.certReq = certReq + +- msg, err = c.readHandshake() ++ msg, err = c.readHandshake(hs.transcript) + if err != nil { + return err + } +@@ -449,7 +461,6 @@ func (hs *clientHandshakeStateTLS13) rea + c.sendAlert(alertDecodeError) + return errors.New("tls: received empty certificates message") + } +- hs.transcript.Write(certMsg.marshal()) + + c.scts = certMsg.certificate.SignedCertificateTimestamps + c.ocspResponse = certMsg.certificate.OCSPStaple +@@ -458,7 +469,10 @@ func (hs *clientHandshakeStateTLS13) rea + return err + } + +- msg, err = c.readHandshake() ++ // certificateVerifyMsg is included in the transcript, but not until ++ // after we verify the handshake signature, since the state before ++ // this message was sent is used. ++ msg, err = c.readHandshake(nil) + if err != nil { + return err + } +@@ -489,7 +503,9 @@ func (hs *clientHandshakeStateTLS13) rea + return errors.New("tls: invalid signature by the server certificate: " + err.Error()) + } + +- hs.transcript.Write(certVerify.marshal()) ++ if err := transcriptMsg(certVerify, hs.transcript); err != nil { ++ return err ++ } + + return nil + } +@@ -497,7 +513,10 @@ func (hs *clientHandshakeStateTLS13) rea + func (hs *clientHandshakeStateTLS13) readServerFinished() error { + c := hs.c + +- msg, err := c.readHandshake() ++ // finishedMsg is included in the transcript, but not until after we ++ // check the client version, since the state before this message was ++ // sent is used during verification. ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -514,7 +533,9 @@ func (hs *clientHandshakeStateTLS13) rea + return errors.New("tls: invalid server finished hash") + } + +- hs.transcript.Write(finished.marshal()) ++ if err := transcriptMsg(finished, hs.transcript); err != nil { ++ return err ++ } + + // Derive secrets that take context through the server Finished. + +@@ -563,8 +584,7 @@ func (hs *clientHandshakeStateTLS13) sen + certMsg.scts = hs.certReq.scts && len(cert.SignedCertificateTimestamps) > 0 + certMsg.ocspStapling = hs.certReq.ocspStapling && len(cert.OCSPStaple) > 0 + +- hs.transcript.Write(certMsg.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certMsg, hs.transcript); err != nil { + return err + } + +@@ -601,8 +621,7 @@ func (hs *clientHandshakeStateTLS13) sen + } + certVerifyMsg.signature = sig + +- hs.transcript.Write(certVerifyMsg.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certVerifyMsg.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certVerifyMsg, hs.transcript); err != nil { + return err + } + +@@ -616,8 +635,7 @@ func (hs *clientHandshakeStateTLS13) sen + verifyData: hs.suite.finishedHash(c.out.trafficSecret, hs.transcript), + } + +- hs.transcript.Write(finished.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(finished, hs.transcript); err != nil { + return err + } + +--- go.orig/src/crypto/tls/handshake_messages.go ++++ go/src/crypto/tls/handshake_messages.go +@@ -5,6 +5,7 @@ + package tls + + import ( ++ "errors" + "fmt" + "strings" + +@@ -94,9 +95,181 @@ type clientHelloMsg struct { + pskBinders [][]byte + } + +-func (m *clientHelloMsg) marshal() []byte { ++func (m *clientHelloMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil ++ } ++ ++ var exts cryptobyte.Builder ++ if len(m.serverName) > 0 { ++ // RFC 6066, Section 3 ++ exts.AddUint16(extensionServerName) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8(0) // name_type = host_name ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes([]byte(m.serverName)) ++ }) ++ }) ++ }) ++ } ++ if m.ocspStapling { ++ // RFC 4366, Section 3.6 ++ exts.AddUint16(extensionStatusRequest) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8(1) // status_type = ocsp ++ exts.AddUint16(0) // empty responder_id_list ++ exts.AddUint16(0) // empty request_extensions ++ }) ++ } ++ if len(m.supportedCurves) > 0 { ++ // RFC 4492, sections 5.1.1 and RFC 8446, Section 4.2.7 ++ exts.AddUint16(extensionSupportedCurves) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, curve := range m.supportedCurves { ++ exts.AddUint16(uint16(curve)) ++ } ++ }) ++ }) ++ } ++ if len(m.supportedPoints) > 0 { ++ // RFC 4492, Section 5.1.2 ++ exts.AddUint16(extensionSupportedPoints) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.supportedPoints) ++ }) ++ }) ++ } ++ if m.ticketSupported { ++ // RFC 5077, Section 3.2 ++ exts.AddUint16(extensionSessionTicket) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.sessionTicket) ++ }) ++ } ++ if len(m.supportedSignatureAlgorithms) > 0 { ++ // RFC 5246, Section 7.4.1.4.1 ++ exts.AddUint16(extensionSignatureAlgorithms) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, sigAlgo := range m.supportedSignatureAlgorithms { ++ exts.AddUint16(uint16(sigAlgo)) ++ } ++ }) ++ }) ++ } ++ if len(m.supportedSignatureAlgorithmsCert) > 0 { ++ // RFC 8446, Section 4.2.3 ++ exts.AddUint16(extensionSignatureAlgorithmsCert) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, sigAlgo := range m.supportedSignatureAlgorithmsCert { ++ exts.AddUint16(uint16(sigAlgo)) ++ } ++ }) ++ }) ++ } ++ if m.secureRenegotiationSupported { ++ // RFC 5746, Section 3.2 ++ exts.AddUint16(extensionRenegotiationInfo) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.secureRenegotiation) ++ }) ++ }) ++ } ++ if len(m.alpnProtocols) > 0 { ++ // RFC 7301, Section 3.1 ++ exts.AddUint16(extensionALPN) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, proto := range m.alpnProtocols { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes([]byte(proto)) ++ }) ++ } ++ }) ++ }) ++ } ++ if m.scts { ++ // RFC 6962, Section 3.3.1 ++ exts.AddUint16(extensionSCT) ++ exts.AddUint16(0) // empty extension_data ++ } ++ if len(m.supportedVersions) > 0 { ++ // RFC 8446, Section 4.2.1 ++ exts.AddUint16(extensionSupportedVersions) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, vers := range m.supportedVersions { ++ exts.AddUint16(vers) ++ } ++ }) ++ }) ++ } ++ if len(m.cookie) > 0 { ++ // RFC 8446, Section 4.2.2 ++ exts.AddUint16(extensionCookie) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.cookie) ++ }) ++ }) ++ } ++ if len(m.keyShares) > 0 { ++ // RFC 8446, Section 4.2.8 ++ exts.AddUint16(extensionKeyShare) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, ks := range m.keyShares { ++ exts.AddUint16(uint16(ks.group)) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(ks.data) ++ }) ++ } ++ }) ++ }) ++ } ++ if m.earlyData { ++ // RFC 8446, Section 4.2.10 ++ exts.AddUint16(extensionEarlyData) ++ exts.AddUint16(0) // empty extension_data ++ } ++ if len(m.pskModes) > 0 { ++ // RFC 8446, Section 4.2.9 ++ exts.AddUint16(extensionPSKModes) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.pskModes) ++ }) ++ }) ++ } ++ if len(m.pskIdentities) > 0 { // pre_shared_key must be the last extension ++ // RFC 8446, Section 4.2.11 ++ exts.AddUint16(extensionPreSharedKey) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, psk := range m.pskIdentities { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(psk.label) ++ }) ++ exts.AddUint32(psk.obfuscatedTicketAge) ++ } ++ }) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, binder := range m.pskBinders { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(binder) ++ }) ++ } ++ }) ++ }) ++ } ++ extBytes, err := exts.Bytes() ++ if err != nil { ++ return nil, err + } + + var b cryptobyte.Builder +@@ -116,219 +289,53 @@ func (m *clientHelloMsg) marshal() []byt + b.AddBytes(m.compressionMethods) + }) + +- // If extensions aren't present, omit them. +- var extensionsPresent bool +- bWithoutExtensions := *b +- +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- if len(m.serverName) > 0 { +- // RFC 6066, Section 3 +- b.AddUint16(extensionServerName) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8(0) // name_type = host_name +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes([]byte(m.serverName)) +- }) +- }) +- }) +- } +- if m.ocspStapling { +- // RFC 4366, Section 3.6 +- b.AddUint16(extensionStatusRequest) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8(1) // status_type = ocsp +- b.AddUint16(0) // empty responder_id_list +- b.AddUint16(0) // empty request_extensions +- }) +- } +- if len(m.supportedCurves) > 0 { +- // RFC 4492, sections 5.1.1 and RFC 8446, Section 4.2.7 +- b.AddUint16(extensionSupportedCurves) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, curve := range m.supportedCurves { +- b.AddUint16(uint16(curve)) +- } +- }) +- }) +- } +- if len(m.supportedPoints) > 0 { +- // RFC 4492, Section 5.1.2 +- b.AddUint16(extensionSupportedPoints) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.supportedPoints) +- }) +- }) +- } +- if m.ticketSupported { +- // RFC 5077, Section 3.2 +- b.AddUint16(extensionSessionTicket) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.sessionTicket) +- }) +- } +- if len(m.supportedSignatureAlgorithms) > 0 { +- // RFC 5246, Section 7.4.1.4.1 +- b.AddUint16(extensionSignatureAlgorithms) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, sigAlgo := range m.supportedSignatureAlgorithms { +- b.AddUint16(uint16(sigAlgo)) +- } +- }) +- }) +- } +- if len(m.supportedSignatureAlgorithmsCert) > 0 { +- // RFC 8446, Section 4.2.3 +- b.AddUint16(extensionSignatureAlgorithmsCert) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, sigAlgo := range m.supportedSignatureAlgorithmsCert { +- b.AddUint16(uint16(sigAlgo)) +- } +- }) +- }) +- } +- if m.secureRenegotiationSupported { +- // RFC 5746, Section 3.2 +- b.AddUint16(extensionRenegotiationInfo) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.secureRenegotiation) +- }) +- }) +- } +- if len(m.alpnProtocols) > 0 { +- // RFC 7301, Section 3.1 +- b.AddUint16(extensionALPN) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, proto := range m.alpnProtocols { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes([]byte(proto)) +- }) +- } +- }) +- }) +- } +- if m.scts { +- // RFC 6962, Section 3.3.1 +- b.AddUint16(extensionSCT) +- b.AddUint16(0) // empty extension_data +- } +- if len(m.supportedVersions) > 0 { +- // RFC 8446, Section 4.2.1 +- b.AddUint16(extensionSupportedVersions) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, vers := range m.supportedVersions { +- b.AddUint16(vers) +- } +- }) +- }) +- } +- if len(m.cookie) > 0 { +- // RFC 8446, Section 4.2.2 +- b.AddUint16(extensionCookie) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.cookie) +- }) +- }) +- } +- if len(m.keyShares) > 0 { +- // RFC 8446, Section 4.2.8 +- b.AddUint16(extensionKeyShare) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, ks := range m.keyShares { +- b.AddUint16(uint16(ks.group)) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(ks.data) +- }) +- } +- }) +- }) +- } +- if m.earlyData { +- // RFC 8446, Section 4.2.10 +- b.AddUint16(extensionEarlyData) +- b.AddUint16(0) // empty extension_data +- } +- if len(m.pskModes) > 0 { +- // RFC 8446, Section 4.2.9 +- b.AddUint16(extensionPSKModes) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.pskModes) +- }) +- }) +- } +- if len(m.pskIdentities) > 0 { // pre_shared_key must be the last extension +- // RFC 8446, Section 4.2.11 +- b.AddUint16(extensionPreSharedKey) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, psk := range m.pskIdentities { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(psk.label) +- }) +- b.AddUint32(psk.obfuscatedTicketAge) +- } +- }) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, binder := range m.pskBinders { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(binder) +- }) +- } +- }) +- }) +- } +- +- extensionsPresent = len(b.BytesOrPanic()) > 2 +- }) +- +- if !extensionsPresent { +- *b = bWithoutExtensions +- } +- }) ++ if len(extBytes) > 0 { ++ b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { ++ b.AddBytes(extBytes) ++ }) ++ } ++ }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + // marshalWithoutBinders returns the ClientHello through the + // PreSharedKeyExtension.identities field, according to RFC 8446, Section + // 4.2.11.2. Note that m.pskBinders must be set to slices of the correct length. +-func (m *clientHelloMsg) marshalWithoutBinders() []byte { ++func (m *clientHelloMsg) marshalWithoutBinders() ([]byte, error) { + bindersLen := 2 // uint16 length prefix + for _, binder := range m.pskBinders { + bindersLen += 1 // uint8 length prefix + bindersLen += len(binder) + } + +- fullMessage := m.marshal() +- return fullMessage[:len(fullMessage)-bindersLen] ++ fullMessage, err := m.marshal() ++ if err != nil { ++ return nil, err ++ } ++ return fullMessage[:len(fullMessage)-bindersLen], nil + } + + // updateBinders updates the m.pskBinders field, if necessary updating the + // cached marshaled representation. The supplied binders must have the same + // length as the current m.pskBinders. +-func (m *clientHelloMsg) updateBinders(pskBinders [][]byte) { ++func (m *clientHelloMsg) updateBinders(pskBinders [][]byte) error { + if len(pskBinders) != len(m.pskBinders) { +- panic("tls: internal error: pskBinders length mismatch") ++ return errors.New("tls: internal error: pskBinders length mismatch") + } + for i := range m.pskBinders { + if len(pskBinders[i]) != len(m.pskBinders[i]) { +- panic("tls: internal error: pskBinders length mismatch") ++ return errors.New("tls: internal error: pskBinders length mismatch") + } + } + m.pskBinders = pskBinders + if m.raw != nil { +- lenWithoutBinders := len(m.marshalWithoutBinders()) ++ helloBytes, err := m.marshalWithoutBinders() ++ if err != nil { ++ return err ++ } ++ lenWithoutBinders := len(helloBytes) + // TODO(filippo): replace with NewFixedBuilder once CL 148882 is imported. + b := cryptobyte.NewBuilder(m.raw[:lenWithoutBinders]) + b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +@@ -339,9 +346,11 @@ func (m *clientHelloMsg) updateBinders(p + } + }) + if len(b.BytesOrPanic()) != len(m.raw) { +- panic("tls: internal error: failed to update binders") ++ return errors.New("tls: internal error: failed to update binders") + } + } ++ ++ return nil + } + + func (m *clientHelloMsg) unmarshal(data []byte) bool { +@@ -613,9 +622,98 @@ type serverHelloMsg struct { + selectedGroup CurveID + } + +-func (m *serverHelloMsg) marshal() []byte { ++func (m *serverHelloMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil ++ } ++ ++ var exts cryptobyte.Builder ++ if m.ocspStapling { ++ exts.AddUint16(extensionStatusRequest) ++ exts.AddUint16(0) // empty extension_data ++ } ++ if m.ticketSupported { ++ exts.AddUint16(extensionSessionTicket) ++ exts.AddUint16(0) // empty extension_data ++ } ++ if m.secureRenegotiationSupported { ++ exts.AddUint16(extensionRenegotiationInfo) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.secureRenegotiation) ++ }) ++ }) ++ } ++ if len(m.alpnProtocol) > 0 { ++ exts.AddUint16(extensionALPN) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes([]byte(m.alpnProtocol)) ++ }) ++ }) ++ }) ++ } ++ if len(m.scts) > 0 { ++ exts.AddUint16(extensionSCT) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ for _, sct := range m.scts { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(sct) ++ }) ++ } ++ }) ++ }) ++ } ++ if m.supportedVersion != 0 { ++ exts.AddUint16(extensionSupportedVersions) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16(m.supportedVersion) ++ }) ++ } ++ if m.serverShare.group != 0 { ++ exts.AddUint16(extensionKeyShare) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16(uint16(m.serverShare.group)) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.serverShare.data) ++ }) ++ }) ++ } ++ if m.selectedIdentityPresent { ++ exts.AddUint16(extensionPreSharedKey) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16(m.selectedIdentity) ++ }) ++ } ++ ++ if len(m.cookie) > 0 { ++ exts.AddUint16(extensionCookie) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.cookie) ++ }) ++ }) ++ } ++ if m.selectedGroup != 0 { ++ exts.AddUint16(extensionKeyShare) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint16(uint16(m.selectedGroup)) ++ }) ++ } ++ if len(m.supportedPoints) > 0 { ++ exts.AddUint16(extensionSupportedPoints) ++ exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) { ++ exts.AddBytes(m.supportedPoints) ++ }) ++ }) ++ } ++ ++ extBytes, err := exts.Bytes() ++ if err != nil { ++ return nil, err + } + + var b cryptobyte.Builder +@@ -629,104 +727,15 @@ func (m *serverHelloMsg) marshal() []byt + b.AddUint16(m.cipherSuite) + b.AddUint8(m.compressionMethod) + +- // If extensions aren't present, omit them. +- var extensionsPresent bool +- bWithoutExtensions := *b +- +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- if m.ocspStapling { +- b.AddUint16(extensionStatusRequest) +- b.AddUint16(0) // empty extension_data +- } +- if m.ticketSupported { +- b.AddUint16(extensionSessionTicket) +- b.AddUint16(0) // empty extension_data +- } +- if m.secureRenegotiationSupported { +- b.AddUint16(extensionRenegotiationInfo) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.secureRenegotiation) +- }) +- }) +- } +- if len(m.alpnProtocol) > 0 { +- b.AddUint16(extensionALPN) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes([]byte(m.alpnProtocol)) +- }) +- }) +- }) +- } +- if len(m.scts) > 0 { +- b.AddUint16(extensionSCT) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- for _, sct := range m.scts { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(sct) +- }) +- } +- }) +- }) +- } +- if m.supportedVersion != 0 { +- b.AddUint16(extensionSupportedVersions) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16(m.supportedVersion) +- }) +- } +- if m.serverShare.group != 0 { +- b.AddUint16(extensionKeyShare) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16(uint16(m.serverShare.group)) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.serverShare.data) +- }) +- }) +- } +- if m.selectedIdentityPresent { +- b.AddUint16(extensionPreSharedKey) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16(m.selectedIdentity) +- }) +- } +- +- if len(m.cookie) > 0 { +- b.AddUint16(extensionCookie) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.cookie) +- }) +- }) +- } +- if m.selectedGroup != 0 { +- b.AddUint16(extensionKeyShare) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint16(uint16(m.selectedGroup)) +- }) +- } +- if len(m.supportedPoints) > 0 { +- b.AddUint16(extensionSupportedPoints) +- b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { +- b.AddBytes(m.supportedPoints) +- }) +- }) +- } +- +- extensionsPresent = len(b.BytesOrPanic()) > 2 +- }) +- +- if !extensionsPresent { +- *b = bWithoutExtensions ++ if len(extBytes) > 0 { ++ b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) { ++ b.AddBytes(extBytes) ++ }) + } + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *serverHelloMsg) unmarshal(data []byte) bool { +@@ -844,9 +853,9 @@ type encryptedExtensionsMsg struct { + alpnProtocol string + } + +-func (m *encryptedExtensionsMsg) marshal() []byte { ++func (m *encryptedExtensionsMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -866,8 +875,9 @@ func (m *encryptedExtensionsMsg) marshal + }) + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *encryptedExtensionsMsg) unmarshal(data []byte) bool { +@@ -915,10 +925,10 @@ func (m *encryptedExtensionsMsg) unmarsh + + type endOfEarlyDataMsg struct{} + +-func (m *endOfEarlyDataMsg) marshal() []byte { ++func (m *endOfEarlyDataMsg) marshal() ([]byte, error) { + x := make([]byte, 4) + x[0] = typeEndOfEarlyData +- return x ++ return x, nil + } + + func (m *endOfEarlyDataMsg) unmarshal(data []byte) bool { +@@ -930,9 +940,9 @@ type keyUpdateMsg struct { + updateRequested bool + } + +-func (m *keyUpdateMsg) marshal() []byte { ++func (m *keyUpdateMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -945,8 +955,9 @@ func (m *keyUpdateMsg) marshal() []byte + } + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *keyUpdateMsg) unmarshal(data []byte) bool { +@@ -978,9 +989,9 @@ type newSessionTicketMsgTLS13 struct { + maxEarlyData uint32 + } + +-func (m *newSessionTicketMsgTLS13) marshal() []byte { ++func (m *newSessionTicketMsgTLS13) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -1005,8 +1016,9 @@ func (m *newSessionTicketMsgTLS13) marsh + }) + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *newSessionTicketMsgTLS13) unmarshal(data []byte) bool { +@@ -1059,9 +1071,9 @@ type certificateRequestMsgTLS13 struct { + certificateAuthorities [][]byte + } + +-func (m *certificateRequestMsgTLS13) marshal() []byte { ++func (m *certificateRequestMsgTLS13) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -1120,8 +1132,9 @@ func (m *certificateRequestMsgTLS13) mar + }) + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *certificateRequestMsgTLS13) unmarshal(data []byte) bool { +@@ -1205,9 +1218,9 @@ type certificateMsg struct { + certificates [][]byte + } + +-func (m *certificateMsg) marshal() (x []byte) { ++func (m *certificateMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var i int +@@ -1216,7 +1229,7 @@ func (m *certificateMsg) marshal() (x [] + } + + length := 3 + 3*len(m.certificates) + i +- x = make([]byte, 4+length) ++ x := make([]byte, 4+length) + x[0] = typeCertificate + x[1] = uint8(length >> 16) + x[2] = uint8(length >> 8) +@@ -1237,7 +1250,7 @@ func (m *certificateMsg) marshal() (x [] + } + + m.raw = x +- return ++ return m.raw, nil + } + + func (m *certificateMsg) unmarshal(data []byte) bool { +@@ -1284,9 +1297,9 @@ type certificateMsgTLS13 struct { + scts bool + } + +-func (m *certificateMsgTLS13) marshal() []byte { ++func (m *certificateMsgTLS13) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -1304,8 +1317,9 @@ func (m *certificateMsgTLS13) marshal() + marshalCertificate(b, certificate) + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func marshalCertificate(b *cryptobyte.Builder, certificate Certificate) { +@@ -1428,9 +1442,9 @@ type serverKeyExchangeMsg struct { + key []byte + } + +-func (m *serverKeyExchangeMsg) marshal() []byte { ++func (m *serverKeyExchangeMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + length := len(m.key) + x := make([]byte, length+4) +@@ -1441,7 +1455,7 @@ func (m *serverKeyExchangeMsg) marshal() + copy(x[4:], m.key) + + m.raw = x +- return x ++ return x, nil + } + + func (m *serverKeyExchangeMsg) unmarshal(data []byte) bool { +@@ -1458,9 +1472,9 @@ type certificateStatusMsg struct { + response []byte + } + +-func (m *certificateStatusMsg) marshal() []byte { ++func (m *certificateStatusMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -1472,8 +1486,9 @@ func (m *certificateStatusMsg) marshal() + }) + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *certificateStatusMsg) unmarshal(data []byte) bool { +@@ -1492,10 +1507,10 @@ func (m *certificateStatusMsg) unmarshal + + type serverHelloDoneMsg struct{} + +-func (m *serverHelloDoneMsg) marshal() []byte { ++func (m *serverHelloDoneMsg) marshal() ([]byte, error) { + x := make([]byte, 4) + x[0] = typeServerHelloDone +- return x ++ return x, nil + } + + func (m *serverHelloDoneMsg) unmarshal(data []byte) bool { +@@ -1507,9 +1522,9 @@ type clientKeyExchangeMsg struct { + ciphertext []byte + } + +-func (m *clientKeyExchangeMsg) marshal() []byte { ++func (m *clientKeyExchangeMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + length := len(m.ciphertext) + x := make([]byte, length+4) +@@ -1520,7 +1535,7 @@ func (m *clientKeyExchangeMsg) marshal() + copy(x[4:], m.ciphertext) + + m.raw = x +- return x ++ return x, nil + } + + func (m *clientKeyExchangeMsg) unmarshal(data []byte) bool { +@@ -1541,9 +1556,9 @@ type finishedMsg struct { + verifyData []byte + } + +-func (m *finishedMsg) marshal() []byte { ++func (m *finishedMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -1552,8 +1567,9 @@ func (m *finishedMsg) marshal() []byte { + b.AddBytes(m.verifyData) + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *finishedMsg) unmarshal(data []byte) bool { +@@ -1575,9 +1591,9 @@ type certificateRequestMsg struct { + certificateAuthorities [][]byte + } + +-func (m *certificateRequestMsg) marshal() (x []byte) { ++func (m *certificateRequestMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + // See RFC 4346, Section 7.4.4. +@@ -1592,7 +1608,7 @@ func (m *certificateRequestMsg) marshal( + length += 2 + 2*len(m.supportedSignatureAlgorithms) + } + +- x = make([]byte, 4+length) ++ x := make([]byte, 4+length) + x[0] = typeCertificateRequest + x[1] = uint8(length >> 16) + x[2] = uint8(length >> 8) +@@ -1627,7 +1643,7 @@ func (m *certificateRequestMsg) marshal( + } + + m.raw = x +- return ++ return m.raw, nil + } + + func (m *certificateRequestMsg) unmarshal(data []byte) bool { +@@ -1713,9 +1729,9 @@ type certificateVerifyMsg struct { + signature []byte + } + +-func (m *certificateVerifyMsg) marshal() (x []byte) { ++func (m *certificateVerifyMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + var b cryptobyte.Builder +@@ -1729,8 +1745,9 @@ func (m *certificateVerifyMsg) marshal() + }) + }) + +- m.raw = b.BytesOrPanic() +- return m.raw ++ var err error ++ m.raw, err = b.Bytes() ++ return m.raw, err + } + + func (m *certificateVerifyMsg) unmarshal(data []byte) bool { +@@ -1753,15 +1770,15 @@ type newSessionTicketMsg struct { + ticket []byte + } + +-func (m *newSessionTicketMsg) marshal() (x []byte) { ++func (m *newSessionTicketMsg) marshal() ([]byte, error) { + if m.raw != nil { +- return m.raw ++ return m.raw, nil + } + + // See RFC 5077, Section 3.3. + ticketLen := len(m.ticket) + length := 2 + 4 + ticketLen +- x = make([]byte, 4+length) ++ x := make([]byte, 4+length) + x[0] = typeNewSessionTicket + x[1] = uint8(length >> 16) + x[2] = uint8(length >> 8) +@@ -1772,7 +1789,7 @@ func (m *newSessionTicketMsg) marshal() + + m.raw = x + +- return ++ return m.raw, nil + } + + func (m *newSessionTicketMsg) unmarshal(data []byte) bool { +@@ -1800,10 +1817,25 @@ func (m *newSessionTicketMsg) unmarshal( + type helloRequestMsg struct { + } + +-func (*helloRequestMsg) marshal() []byte { +- return []byte{typeHelloRequest, 0, 0, 0} ++func (*helloRequestMsg) marshal() ([]byte, error) { ++ return []byte{typeHelloRequest, 0, 0, 0}, nil + } + + func (*helloRequestMsg) unmarshal(data []byte) bool { + return len(data) == 4 + } ++ ++type transcriptHash interface { ++ Write([]byte) (int, error) ++} ++ ++// transcriptMsg is a helper used to marshal and hash messages which typically ++// are not written to the wire, and as such aren't hashed during Conn.writeRecord. ++func transcriptMsg(msg handshakeMessage, h transcriptHash) error { ++ data, err := msg.marshal() ++ if err != nil { ++ return err ++ } ++ h.Write(data) ++ return nil ++} +--- go.orig/src/crypto/tls/handshake_messages_test.go ++++ go/src/crypto/tls/handshake_messages_test.go +@@ -37,6 +37,15 @@ var tests = []interface{}{ + &certificateMsgTLS13{}, + } + ++func mustMarshal(t *testing.T, msg handshakeMessage) []byte { ++ t.Helper() ++ b, err := msg.marshal() ++ if err != nil { ++ t.Fatal(err) ++ } ++ return b ++} ++ + func TestMarshalUnmarshal(t *testing.T) { + rand := rand.New(rand.NewSource(time.Now().UnixNano())) + +@@ -55,7 +64,7 @@ func TestMarshalUnmarshal(t *testing.T) + } + + m1 := v.Interface().(handshakeMessage) +- marshaled := m1.marshal() ++ marshaled := mustMarshal(t, m1) + m2 := iface.(handshakeMessage) + if !m2.unmarshal(marshaled) { + t.Errorf("#%d failed to unmarshal %#v %x", i, m1, marshaled) +@@ -408,12 +417,12 @@ func TestRejectEmptySCTList(t *testing.T + + var random [32]byte + sct := []byte{0x42, 0x42, 0x42, 0x42} +- serverHello := serverHelloMsg{ ++ serverHello := &serverHelloMsg{ + vers: VersionTLS12, + random: random[:], + scts: [][]byte{sct}, + } +- serverHelloBytes := serverHello.marshal() ++ serverHelloBytes := mustMarshal(t, serverHello) + + var serverHelloCopy serverHelloMsg + if !serverHelloCopy.unmarshal(serverHelloBytes) { +@@ -451,12 +460,12 @@ func TestRejectEmptySCT(t *testing.T) { + // not be zero length. + + var random [32]byte +- serverHello := serverHelloMsg{ ++ serverHello := &serverHelloMsg{ + vers: VersionTLS12, + random: random[:], + scts: [][]byte{nil}, + } +- serverHelloBytes := serverHello.marshal() ++ serverHelloBytes := mustMarshal(t, serverHello) + + var serverHelloCopy serverHelloMsg + if serverHelloCopy.unmarshal(serverHelloBytes) { +--- go.orig/src/crypto/tls/handshake_server.go ++++ go/src/crypto/tls/handshake_server.go +@@ -129,7 +129,9 @@ func (hs *serverHandshakeState) handshak + + // readClientHello reads a ClientHello message and selects the protocol version. + func (c *Conn) readClientHello(ctx context.Context) (*clientHelloMsg, error) { +- msg, err := c.readHandshake() ++ // clientHelloMsg is included in the transcript, but we haven't initialized ++ // it yet. The respective handshake functions will record it themselves. ++ msg, err := c.readHandshake(nil) + if err != nil { + return nil, err + } +@@ -456,9 +458,10 @@ func (hs *serverHandshakeState) doResume + hs.hello.ticketSupported = hs.sessionState.usedOldKey + hs.finishedHash = newFinishedHash(c.vers, hs.suite) + hs.finishedHash.discardHandshakeBuffer() +- hs.finishedHash.Write(hs.clientHello.marshal()) +- hs.finishedHash.Write(hs.hello.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil { ++ if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil { ++ return err ++ } ++ if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil { + return err + } + +@@ -496,24 +499,23 @@ func (hs *serverHandshakeState) doFullHa + // certificates won't be used. + hs.finishedHash.discardHandshakeBuffer() + } +- hs.finishedHash.Write(hs.clientHello.marshal()) +- hs.finishedHash.Write(hs.hello.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil { ++ if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil { ++ return err ++ } ++ if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil { + return err + } + + certMsg := new(certificateMsg) + certMsg.certificates = hs.cert.Certificate +- hs.finishedHash.Write(certMsg.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil { + return err + } + + if hs.hello.ocspStapling { + certStatus := new(certificateStatusMsg) + certStatus.response = hs.cert.OCSPStaple +- hs.finishedHash.Write(certStatus.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certStatus.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certStatus, &hs.finishedHash); err != nil { + return err + } + } +@@ -525,8 +527,7 @@ func (hs *serverHandshakeState) doFullHa + return err + } + if skx != nil { +- hs.finishedHash.Write(skx.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, skx.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(skx, &hs.finishedHash); err != nil { + return err + } + } +@@ -552,15 +553,13 @@ func (hs *serverHandshakeState) doFullHa + if c.config.ClientCAs != nil { + certReq.certificateAuthorities = c.config.ClientCAs.Subjects() + } +- hs.finishedHash.Write(certReq.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certReq.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certReq, &hs.finishedHash); err != nil { + return err + } + } + + helloDone := new(serverHelloDoneMsg) +- hs.finishedHash.Write(helloDone.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, helloDone.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(helloDone, &hs.finishedHash); err != nil { + return err + } + +@@ -570,7 +569,7 @@ func (hs *serverHandshakeState) doFullHa + + var pub crypto.PublicKey // public key for client auth, if any + +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -583,7 +582,6 @@ func (hs *serverHandshakeState) doFullHa + c.sendAlert(alertUnexpectedMessage) + return unexpectedMessageError(certMsg, msg) + } +- hs.finishedHash.Write(certMsg.marshal()) + + if err := c.processCertsFromClient(Certificate{ + Certificate: certMsg.certificates, +@@ -594,7 +592,7 @@ func (hs *serverHandshakeState) doFullHa + pub = c.peerCertificates[0].PublicKey + } + +- msg, err = c.readHandshake() ++ msg, err = c.readHandshake(&hs.finishedHash) + if err != nil { + return err + } +@@ -612,7 +610,6 @@ func (hs *serverHandshakeState) doFullHa + c.sendAlert(alertUnexpectedMessage) + return unexpectedMessageError(ckx, msg) + } +- hs.finishedHash.Write(ckx.marshal()) + + preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers) + if err != nil { +@@ -632,7 +629,10 @@ func (hs *serverHandshakeState) doFullHa + // to the client's certificate. This allows us to verify that the client is in + // possession of the private key of the certificate. + if len(c.peerCertificates) > 0 { +- msg, err = c.readHandshake() ++ // certificateVerifyMsg is included in the transcript, but not until ++ // after we verify the handshake signature, since the state before ++ // this message was sent is used. ++ msg, err = c.readHandshake(nil) + if err != nil { + return err + } +@@ -667,7 +667,9 @@ func (hs *serverHandshakeState) doFullHa + return errors.New("tls: invalid signature by the client certificate: " + err.Error()) + } + +- hs.finishedHash.Write(certVerify.marshal()) ++ if err := transcriptMsg(certVerify, &hs.finishedHash); err != nil { ++ return err ++ } + } + + hs.finishedHash.discardHandshakeBuffer() +@@ -707,7 +709,10 @@ func (hs *serverHandshakeState) readFini + return err + } + +- msg, err := c.readHandshake() ++ // finishedMsg is included in the transcript, but not until after we ++ // check the client version, since the state before this message was ++ // sent is used during verification. ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -724,7 +729,10 @@ func (hs *serverHandshakeState) readFini + return errors.New("tls: client's Finished message is incorrect") + } + +- hs.finishedHash.Write(clientFinished.marshal()) ++ if err := transcriptMsg(clientFinished, &hs.finishedHash); err != nil { ++ return err ++ } ++ + copy(out, verify) + return nil + } +@@ -758,14 +766,16 @@ func (hs *serverHandshakeState) sendSess + masterSecret: hs.masterSecret, + certificates: certsFromClient, + } +- var err error +- m.ticket, err = c.encryptTicket(state.marshal()) ++ stateBytes, err := state.marshal() ++ if err != nil { ++ return err ++ } ++ m.ticket, err = c.encryptTicket(stateBytes) + if err != nil { + return err + } + +- hs.finishedHash.Write(m.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, m.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(m, &hs.finishedHash); err != nil { + return err + } + +@@ -775,14 +785,13 @@ func (hs *serverHandshakeState) sendSess + func (hs *serverHandshakeState) sendFinished(out []byte) error { + c := hs.c + +- if _, err := c.writeRecord(recordTypeChangeCipherSpec, []byte{1}); err != nil { ++ if err := c.writeChangeCipherRecord(); err != nil { + return err + } + + finished := new(finishedMsg) + finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret) +- hs.finishedHash.Write(finished.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil { + return err + } + +--- go.orig/src/crypto/tls/handshake_server_test.go ++++ go/src/crypto/tls/handshake_server_test.go +@@ -30,6 +30,13 @@ func testClientHello(t *testing.T, serve + testClientHelloFailure(t, serverConfig, m, "") + } + ++// testFatal is a hack to prevent the compiler from complaining that there is a ++// call to t.Fatal from a non-test goroutine ++func testFatal(t *testing.T, err error) { ++ t.Helper() ++ t.Fatal(err) ++} ++ + func testClientHelloFailure(t *testing.T, serverConfig *Config, m handshakeMessage, expectedSubStr string) { + c, s := localPipe(t) + go func() { +@@ -37,7 +44,9 @@ func testClientHelloFailure(t *testing.T + if ch, ok := m.(*clientHelloMsg); ok { + cli.vers = ch.vers + } +- cli.writeRecord(recordTypeHandshake, m.marshal()) ++ if _, err := cli.writeHandshakeRecord(m, nil); err != nil { ++ testFatal(t, err) ++ } + c.Close() + }() + ctx := context.Background() +@@ -194,7 +203,9 @@ func TestRenegotiationExtension(t *testi + go func() { + cli := Client(c, testConfig) + cli.vers = clientHello.vers +- cli.writeRecord(recordTypeHandshake, clientHello.marshal()) ++ if _, err := cli.writeHandshakeRecord(clientHello, nil); err != nil { ++ testFatal(t, err) ++ } + + buf := make([]byte, 1024) + n, err := c.Read(buf) +@@ -253,8 +264,10 @@ func TestTLS12OnlyCipherSuites(t *testin + go func() { + cli := Client(c, testConfig) + cli.vers = clientHello.vers +- cli.writeRecord(recordTypeHandshake, clientHello.marshal()) +- reply, err := cli.readHandshake() ++ if _, err := cli.writeHandshakeRecord(clientHello, nil); err != nil { ++ testFatal(t, err) ++ } ++ reply, err := cli.readHandshake(nil) + c.Close() + if err != nil { + replyChan <- err +@@ -308,8 +321,10 @@ func TestTLSPointFormats(t *testing.T) { + go func() { + cli := Client(c, testConfig) + cli.vers = clientHello.vers +- cli.writeRecord(recordTypeHandshake, clientHello.marshal()) +- reply, err := cli.readHandshake() ++ if _, err := cli.writeHandshakeRecord(clientHello, nil); err != nil { ++ testFatal(t, err) ++ } ++ reply, err := cli.readHandshake(nil) + c.Close() + if err != nil { + replyChan <- err +@@ -1425,7 +1440,9 @@ func TestSNIGivenOnFailure(t *testing.T) + go func() { + cli := Client(c, testConfig) + cli.vers = clientHello.vers +- cli.writeRecord(recordTypeHandshake, clientHello.marshal()) ++ if _, err := cli.writeHandshakeRecord(clientHello, nil); err != nil { ++ testFatal(t, err) ++ } + c.Close() + }() + conn := Server(s, serverConfig) +--- go.orig/src/crypto/tls/handshake_server_tls13.go ++++ go/src/crypto/tls/handshake_server_tls13.go +@@ -298,7 +298,12 @@ func (hs *serverHandshakeStateTLS13) che + c.sendAlert(alertInternalError) + return errors.New("tls: internal error: failed to clone hash") + } +- transcript.Write(hs.clientHello.marshalWithoutBinders()) ++ clientHelloBytes, err := hs.clientHello.marshalWithoutBinders() ++ if err != nil { ++ c.sendAlert(alertInternalError) ++ return err ++ } ++ transcript.Write(clientHelloBytes) + pskBinder := hs.suite.finishedHash(binderKey, transcript) + if !hmac.Equal(hs.clientHello.pskBinders[i], pskBinder) { + c.sendAlert(alertDecryptError) +@@ -389,8 +394,7 @@ func (hs *serverHandshakeStateTLS13) sen + } + hs.sentDummyCCS = true + +- _, err := hs.c.writeRecord(recordTypeChangeCipherSpec, []byte{1}) +- return err ++ return hs.c.writeChangeCipherRecord() + } + + func (hs *serverHandshakeStateTLS13) doHelloRetryRequest(selectedGroup CurveID) error { +@@ -398,7 +402,9 @@ func (hs *serverHandshakeStateTLS13) doH + + // The first ClientHello gets double-hashed into the transcript upon a + // HelloRetryRequest. See RFC 8446, Section 4.4.1. +- hs.transcript.Write(hs.clientHello.marshal()) ++ if err := transcriptMsg(hs.clientHello, hs.transcript); err != nil { ++ return err ++ } + chHash := hs.transcript.Sum(nil) + hs.transcript.Reset() + hs.transcript.Write([]byte{typeMessageHash, 0, 0, uint8(len(chHash))}) +@@ -414,8 +420,7 @@ func (hs *serverHandshakeStateTLS13) doH + selectedGroup: selectedGroup, + } + +- hs.transcript.Write(helloRetryRequest.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, helloRetryRequest.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(helloRetryRequest, hs.transcript); err != nil { + return err + } + +@@ -423,7 +428,8 @@ func (hs *serverHandshakeStateTLS13) doH + return err + } + +- msg, err := c.readHandshake() ++ // clientHelloMsg is not included in the transcript. ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +@@ -514,9 +520,10 @@ func illegalClientHelloChange(ch, ch1 *c + func (hs *serverHandshakeStateTLS13) sendServerParameters() error { + c := hs.c + +- hs.transcript.Write(hs.clientHello.marshal()) +- hs.transcript.Write(hs.hello.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil { ++ if err := transcriptMsg(hs.clientHello, hs.transcript); err != nil { ++ return err ++ } ++ if _, err := hs.c.writeHandshakeRecord(hs.hello, hs.transcript); err != nil { + return err + } + +@@ -559,8 +566,7 @@ func (hs *serverHandshakeStateTLS13) sen + encryptedExtensions.alpnProtocol = selectedProto + c.clientProtocol = selectedProto + +- hs.transcript.Write(encryptedExtensions.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, encryptedExtensions.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(encryptedExtensions, hs.transcript); err != nil { + return err + } + +@@ -589,8 +595,7 @@ func (hs *serverHandshakeStateTLS13) sen + certReq.certificateAuthorities = c.config.ClientCAs.Subjects() + } + +- hs.transcript.Write(certReq.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certReq.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certReq, hs.transcript); err != nil { + return err + } + } +@@ -601,8 +606,7 @@ func (hs *serverHandshakeStateTLS13) sen + certMsg.scts = hs.clientHello.scts && len(hs.cert.SignedCertificateTimestamps) > 0 + certMsg.ocspStapling = hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 + +- hs.transcript.Write(certMsg.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certMsg, hs.transcript); err != nil { + return err + } + +@@ -633,8 +637,7 @@ func (hs *serverHandshakeStateTLS13) sen + } + certVerifyMsg.signature = sig + +- hs.transcript.Write(certVerifyMsg.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, certVerifyMsg.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(certVerifyMsg, hs.transcript); err != nil { + return err + } + +@@ -648,8 +651,7 @@ func (hs *serverHandshakeStateTLS13) sen + verifyData: hs.suite.finishedHash(c.out.trafficSecret, hs.transcript), + } + +- hs.transcript.Write(finished.marshal()) +- if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil { ++ if _, err := hs.c.writeHandshakeRecord(finished, hs.transcript); err != nil { + return err + } + +@@ -710,7 +712,9 @@ func (hs *serverHandshakeStateTLS13) sen + finishedMsg := &finishedMsg{ + verifyData: hs.clientFinished, + } +- hs.transcript.Write(finishedMsg.marshal()) ++ if err := transcriptMsg(finishedMsg, hs.transcript); err != nil { ++ return err ++ } + + if !hs.shouldSendSessionTickets() { + return nil +@@ -735,8 +739,12 @@ func (hs *serverHandshakeStateTLS13) sen + SignedCertificateTimestamps: c.scts, + }, + } +- var err error +- m.label, err = c.encryptTicket(state.marshal()) ++ stateBytes, err := state.marshal() ++ if err != nil { ++ c.sendAlert(alertInternalError) ++ return err ++ } ++ m.label, err = c.encryptTicket(stateBytes) + if err != nil { + return err + } +@@ -755,7 +763,7 @@ func (hs *serverHandshakeStateTLS13) sen + // ticket_nonce, which must be unique per connection, is always left at + // zero because we only ever send one ticket per connection. + +- if _, err := c.writeRecord(recordTypeHandshake, m.marshal()); err != nil { ++ if _, err := c.writeHandshakeRecord(m, nil); err != nil { + return err + } + +@@ -780,7 +788,7 @@ func (hs *serverHandshakeStateTLS13) rea + // If we requested a client certificate, then the client must send a + // certificate message. If it's empty, no CertificateVerify is sent. + +- msg, err := c.readHandshake() ++ msg, err := c.readHandshake(hs.transcript) + if err != nil { + return err + } +@@ -790,7 +798,6 @@ func (hs *serverHandshakeStateTLS13) rea + c.sendAlert(alertUnexpectedMessage) + return unexpectedMessageError(certMsg, msg) + } +- hs.transcript.Write(certMsg.marshal()) + + if err := c.processCertsFromClient(certMsg.certificate); err != nil { + return err +@@ -804,7 +811,10 @@ func (hs *serverHandshakeStateTLS13) rea + } + + if len(certMsg.certificate.Certificate) != 0 { +- msg, err = c.readHandshake() ++ // certificateVerifyMsg is included in the transcript, but not until ++ // after we verify the handshake signature, since the state before ++ // this message was sent is used. ++ msg, err = c.readHandshake(nil) + if err != nil { + return err + } +@@ -835,7 +845,9 @@ func (hs *serverHandshakeStateTLS13) rea + return errors.New("tls: invalid signature by the client certificate: " + err.Error()) + } + +- hs.transcript.Write(certVerify.marshal()) ++ if err := transcriptMsg(certVerify, hs.transcript); err != nil { ++ return err ++ } + } + + // If we waited until the client certificates to send session tickets, we +@@ -850,7 +862,8 @@ func (hs *serverHandshakeStateTLS13) rea + func (hs *serverHandshakeStateTLS13) readClientFinished() error { + c := hs.c + +- msg, err := c.readHandshake() ++ // finishedMsg is not included in the transcript. ++ msg, err := c.readHandshake(nil) + if err != nil { + return err + } +--- go.orig/src/crypto/tls/key_schedule.go ++++ go/src/crypto/tls/key_schedule.go +@@ -8,6 +8,7 @@ import ( + "crypto/elliptic" + "crypto/hmac" + "errors" ++ "fmt" + "hash" + "io" + "math/big" +@@ -42,8 +43,24 @@ func (c *cipherSuiteTLS13) expandLabel(s + hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { + b.AddBytes(context) + }) ++ hkdfLabelBytes, err := hkdfLabel.Bytes() ++ if err != nil { ++ // Rather than calling BytesOrPanic, we explicitly handle this error, in ++ // order to provide a reasonable error message. It should be basically ++ // impossible for this to panic, and routing errors back through the ++ // tree rooted in this function is quite painful. The labels are fixed ++ // size, and the context is either a fixed-length computed hash, or ++ // parsed from a field which has the same length limitation. As such, an ++ // error here is likely to only be caused during development. ++ // ++ // NOTE: another reasonable approach here might be to return a ++ // randomized slice if we encounter an error, which would break the ++ // connection, but avoid panicking. This would perhaps be safer but ++ // significantly more confusing to users. ++ panic(fmt.Errorf("failed to construct HKDF label: %s", err)) ++ } + out := make([]byte, length) +- n, err := hkdf.Expand(c.hash.New, secret, hkdfLabel.BytesOrPanic()).Read(out) ++ n, err := hkdf.Expand(c.hash.New, secret, hkdfLabelBytes).Read(out) + if err != nil || n != length { + panic("tls: HKDF-Expand-Label invocation failed unexpectedly") + } +--- go.orig/src/crypto/tls/ticket.go ++++ go/src/crypto/tls/ticket.go +@@ -32,7 +32,7 @@ type sessionState struct { + usedOldKey bool + } + +-func (m *sessionState) marshal() []byte { ++func (m *sessionState) marshal() ([]byte, error) { + var b cryptobyte.Builder + b.AddUint16(m.vers) + b.AddUint16(m.cipherSuite) +@@ -47,7 +47,7 @@ func (m *sessionState) marshal() []byte + }) + } + }) +- return b.BytesOrPanic() ++ return b.Bytes() + } + + func (m *sessionState) unmarshal(data []byte) bool { +@@ -86,7 +86,7 @@ type sessionStateTLS13 struct { + certificate Certificate // CertificateEntry certificate_list<0..2^24-1>; + } + +-func (m *sessionStateTLS13) marshal() []byte { ++func (m *sessionStateTLS13) marshal() ([]byte, error) { + var b cryptobyte.Builder + b.AddUint16(VersionTLS13) + b.AddUint8(0) // revision +@@ -96,7 +96,7 @@ func (m *sessionStateTLS13) marshal() [] + b.AddBytes(m.resumptionSecret) + }) + marshalCertificate(&b, m.certificate) +- return b.BytesOrPanic() ++ return b.Bytes() + } + + func (m *sessionStateTLS13) unmarshal(data []byte) bool { diff --git a/meta/recipes-devtools/go/go-1.19/cve-2022-41725.patch b/meta/recipes-devtools/go/go-1.19/cve-2022-41725.patch new file mode 100644 index 0000000000..a71d07e3f1 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.19/cve-2022-41725.patch @@ -0,0 +1,652 @@ +From 5c55ac9bf1e5f779220294c843526536605f42ab Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Wed, 25 Jan 2023 09:27:01 -0800 +Subject: [PATCH] [release-branch.go1.19] mime/multipart: limit memory/inode + consumption of ReadForm + +Reader.ReadForm is documented as storing "up to maxMemory bytes + 10MB" +in memory. Parsed forms can consume substantially more memory than +this limit, since ReadForm does not account for map entry overhead +and MIME headers. + +In addition, while the amount of disk memory consumed by ReadForm can +be constrained by limiting the size of the parsed input, ReadForm will +create one temporary file per form part stored on disk, potentially +consuming a large number of inodes. + +Update ReadForm's memory accounting to include part names, +MIME headers, and map entry overhead. + +Update ReadForm to store all on-disk file parts in a single +temporary file. + +Files returned by FileHeader.Open are documented as having a concrete +type of *os.File when a file is stored on disk. The change to use a +single temporary file for all parts means that this is no longer the +case when a form contains more than a single file part stored on disk. + +The previous behavior of storing each file part in a separate disk +file may be reenabled with GODEBUG=multipartfiles=distinct. + +Update Reader.NextPart and Reader.NextRawPart to set a 10MiB cap +on the size of MIME headers. + +Thanks to Jakob Ackermann (@das7pad) for reporting this issue. + +Updates #58006 +Fixes #58362 +Fixes CVE-2022-41725 + +Change-Id: Ibd780a6c4c83ac8bcfd3cbe344f042e9940f2eab +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1714276 +Reviewed-by: Julie Qiu <julieqiu@google.com> +TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Run-TryBot: Damien Neil <dneil@google.com> +(cherry picked from commit ed4664330edcd91b24914c9371c377c132dbce8c) +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728949 +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/468116 +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Than McIntosh <thanm@google.com> +Run-TryBot: Michael Pratt <mpratt@google.com> +Auto-Submit: Michael Pratt <mpratt@google.com> +--- + +CVE: CVE-2022-41725 + +Upstream-Status: Backport [see text] + +https://github.com/golong/go.git commit 5c55ac9bf1e5... +modified for reader.go + +Signed-off-by: Joe Slater <joe.slater@windriver.com> + +___ + src/mime/multipart/formdata.go | 132 ++++++++++++++++++++----- + src/mime/multipart/formdata_test.go | 140 ++++++++++++++++++++++++++- + src/mime/multipart/multipart.go | 25 +++-- + src/mime/multipart/readmimeheader.go | 14 +++ + src/net/http/request_test.go | 2 +- + src/net/textproto/reader.go | 20 +++- + 6 files changed, 295 insertions(+), 38 deletions(-) + create mode 100644 src/mime/multipart/readmimeheader.go + +--- go.orig/src/mime/multipart/formdata.go ++++ go/src/mime/multipart/formdata.go +@@ -7,6 +7,7 @@ package multipart + import ( + "bytes" + "errors" ++ "internal/godebug" + "io" + "math" + "net/textproto" +@@ -33,23 +34,58 @@ func (r *Reader) ReadForm(maxMemory int6 + + func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { + form := &Form{make(map[string][]string), make(map[string][]*FileHeader)} ++ var ( ++ file *os.File ++ fileOff int64 ++ ) ++ numDiskFiles := 0 ++ multipartFiles := godebug.Get("multipartfiles") ++ combineFiles := multipartFiles != "distinct" + defer func() { ++ if file != nil { ++ if cerr := file.Close(); err == nil { ++ err = cerr ++ } ++ } ++ if combineFiles && numDiskFiles > 1 { ++ for _, fhs := range form.File { ++ for _, fh := range fhs { ++ fh.tmpshared = true ++ } ++ } ++ } + if err != nil { + form.RemoveAll() ++ if file != nil { ++ os.Remove(file.Name()) ++ } + } + }() + +- // Reserve an additional 10 MB for non-file parts. +- maxValueBytes := maxMemory + int64(10<<20) +- if maxValueBytes <= 0 { ++ // maxFileMemoryBytes is the maximum bytes of file data we will store in memory. ++ // Data past this limit is written to disk. ++ // This limit strictly applies to content, not metadata (filenames, MIME headers, etc.), ++ // since metadata is always stored in memory, not disk. ++ // ++ // maxMemoryBytes is the maximum bytes we will store in memory, including file content, ++ // non-file part values, metdata, and map entry overhead. ++ // ++ // We reserve an additional 10 MB in maxMemoryBytes for non-file data. ++ // ++ // The relationship between these parameters, as well as the overly-large and ++ // unconfigurable 10 MB added on to maxMemory, is unfortunate but difficult to change ++ // within the constraints of the API as documented. ++ maxFileMemoryBytes := maxMemory ++ maxMemoryBytes := maxMemory + int64(10<<20) ++ if maxMemoryBytes <= 0 { + if maxMemory < 0 { +- maxValueBytes = 0 ++ maxMemoryBytes = 0 + } else { +- maxValueBytes = math.MaxInt64 ++ maxMemoryBytes = math.MaxInt64 + } + } + for { +- p, err := r.NextPart() ++ p, err := r.nextPart(false, maxMemoryBytes) + if err == io.EOF { + break + } +@@ -63,16 +99,27 @@ func (r *Reader) readForm(maxMemory int6 + } + filename := p.FileName() + ++ // Multiple values for the same key (one map entry, longer slice) are cheaper ++ // than the same number of values for different keys (many map entries), but ++ // using a consistent per-value cost for overhead is simpler. ++ maxMemoryBytes -= int64(len(name)) ++ maxMemoryBytes -= 100 // map overhead ++ if maxMemoryBytes < 0 { ++ // We can't actually take this path, since nextPart would already have ++ // rejected the MIME headers for being too large. Check anyway. ++ return nil, ErrMessageTooLarge ++ } ++ + var b bytes.Buffer + + if filename == "" { + // value, store as string in memory +- n, err := io.CopyN(&b, p, maxValueBytes+1) ++ n, err := io.CopyN(&b, p, maxMemoryBytes+1) + if err != nil && err != io.EOF { + return nil, err + } +- maxValueBytes -= n +- if maxValueBytes < 0 { ++ maxMemoryBytes -= n ++ if maxMemoryBytes < 0 { + return nil, ErrMessageTooLarge + } + form.Value[name] = append(form.Value[name], b.String()) +@@ -80,35 +127,45 @@ func (r *Reader) readForm(maxMemory int6 + } + + // file, store in memory or on disk ++ maxMemoryBytes -= mimeHeaderSize(p.Header) ++ if maxMemoryBytes < 0 { ++ return nil, ErrMessageTooLarge ++ } + fh := &FileHeader{ + Filename: filename, + Header: p.Header, + } +- n, err := io.CopyN(&b, p, maxMemory+1) ++ n, err := io.CopyN(&b, p, maxFileMemoryBytes+1) + if err != nil && err != io.EOF { + return nil, err + } +- if n > maxMemory { +- // too big, write to disk and flush buffer +- file, err := os.CreateTemp("", "multipart-") +- if err != nil { +- return nil, err ++ if n > maxFileMemoryBytes { ++ if file == nil { ++ file, err = os.CreateTemp(r.tempDir, "multipart-") ++ if err != nil { ++ return nil, err ++ } + } ++ numDiskFiles++ + size, err := io.Copy(file, io.MultiReader(&b, p)) +- if cerr := file.Close(); err == nil { +- err = cerr +- } + if err != nil { +- os.Remove(file.Name()) + return nil, err + } + fh.tmpfile = file.Name() + fh.Size = size ++ fh.tmpoff = fileOff ++ fileOff += size ++ if !combineFiles { ++ if err := file.Close(); err != nil { ++ return nil, err ++ } ++ file = nil ++ } + } else { + fh.content = b.Bytes() + fh.Size = int64(len(fh.content)) +- maxMemory -= n +- maxValueBytes -= n ++ maxFileMemoryBytes -= n ++ maxMemoryBytes -= n + } + form.File[name] = append(form.File[name], fh) + } +@@ -116,6 +173,17 @@ func (r *Reader) readForm(maxMemory int6 + return form, nil + } + ++func mimeHeaderSize(h textproto.MIMEHeader) (size int64) { ++ for k, vs := range h { ++ size += int64(len(k)) ++ size += 100 // map entry overhead ++ for _, v := range vs { ++ size += int64(len(v)) ++ } ++ } ++ return size ++} ++ + // Form is a parsed multipart form. + // Its File parts are stored either in memory or on disk, + // and are accessible via the *FileHeader's Open method. +@@ -133,7 +201,7 @@ func (f *Form) RemoveAll() error { + for _, fh := range fhs { + if fh.tmpfile != "" { + e := os.Remove(fh.tmpfile) +- if e != nil && err == nil { ++ if e != nil && !errors.Is(e, os.ErrNotExist) && err == nil { + err = e + } + } +@@ -148,15 +216,25 @@ type FileHeader struct { + Header textproto.MIMEHeader + Size int64 + +- content []byte +- tmpfile string ++ content []byte ++ tmpfile string ++ tmpoff int64 ++ tmpshared bool + } + + // Open opens and returns the FileHeader's associated File. + func (fh *FileHeader) Open() (File, error) { + if b := fh.content; b != nil { + r := io.NewSectionReader(bytes.NewReader(b), 0, int64(len(b))) +- return sectionReadCloser{r}, nil ++ return sectionReadCloser{r, nil}, nil ++ } ++ if fh.tmpshared { ++ f, err := os.Open(fh.tmpfile) ++ if err != nil { ++ return nil, err ++ } ++ r := io.NewSectionReader(f, fh.tmpoff, fh.Size) ++ return sectionReadCloser{r, f}, nil + } + return os.Open(fh.tmpfile) + } +@@ -175,8 +253,12 @@ type File interface { + + type sectionReadCloser struct { + *io.SectionReader ++ io.Closer + } + + func (rc sectionReadCloser) Close() error { ++ if rc.Closer != nil { ++ return rc.Closer.Close() ++ } + return nil + } +--- go.orig/src/mime/multipart/formdata_test.go ++++ go/src/mime/multipart/formdata_test.go +@@ -6,8 +6,10 @@ package multipart + + import ( + "bytes" ++ "fmt" + "io" + "math" ++ "net/textproto" + "os" + "strings" + "testing" +@@ -208,8 +210,8 @@ Content-Disposition: form-data; name="la + maxMemory int64 + err error + }{ +- {"smaller", 50, nil}, +- {"exact-fit", 25, nil}, ++ {"smaller", 50 + int64(len("largetext")) + 100, nil}, ++ {"exact-fit", 25 + int64(len("largetext")) + 100, nil}, + {"too-large", 0, ErrMessageTooLarge}, + } + for _, tc := range testCases { +@@ -224,7 +226,7 @@ Content-Disposition: form-data; name="la + defer f.RemoveAll() + } + if tc.err != err { +- t.Fatalf("ReadForm error - got: %v; expected: %v", tc.err, err) ++ t.Fatalf("ReadForm error - got: %v; expected: %v", err, tc.err) + } + if err == nil { + if g := f.Value["largetext"][0]; g != largeTextValue { +@@ -234,3 +236,135 @@ Content-Disposition: form-data; name="la + }) + } + } ++ ++// TestReadForm_MetadataTooLarge verifies that we account for the size of field names, ++// MIME headers, and map entry overhead while limiting the memory consumption of parsed forms. ++func TestReadForm_MetadataTooLarge(t *testing.T) { ++ for _, test := range []struct { ++ name string ++ f func(*Writer) ++ }{{ ++ name: "large name", ++ f: func(fw *Writer) { ++ name := strings.Repeat("a", 10<<20) ++ w, _ := fw.CreateFormField(name) ++ w.Write([]byte("value")) ++ }, ++ }, { ++ name: "large MIME header", ++ f: func(fw *Writer) { ++ h := make(textproto.MIMEHeader) ++ h.Set("Content-Disposition", `form-data; name="a"`) ++ h.Set("X-Foo", strings.Repeat("a", 10<<20)) ++ w, _ := fw.CreatePart(h) ++ w.Write([]byte("value")) ++ }, ++ }, { ++ name: "many parts", ++ f: func(fw *Writer) { ++ for i := 0; i < 110000; i++ { ++ w, _ := fw.CreateFormField("f") ++ w.Write([]byte("v")) ++ } ++ }, ++ }} { ++ t.Run(test.name, func(t *testing.T) { ++ var buf bytes.Buffer ++ fw := NewWriter(&buf) ++ test.f(fw) ++ if err := fw.Close(); err != nil { ++ t.Fatal(err) ++ } ++ fr := NewReader(&buf, fw.Boundary()) ++ _, err := fr.ReadForm(0) ++ if err != ErrMessageTooLarge { ++ t.Errorf("fr.ReadForm() = %v, want ErrMessageTooLarge", err) ++ } ++ }) ++ } ++} ++ ++// TestReadForm_ManyFiles_Combined tests that a multipart form containing many files only ++// results in a single on-disk file. ++func TestReadForm_ManyFiles_Combined(t *testing.T) { ++ const distinct = false ++ testReadFormManyFiles(t, distinct) ++} ++ ++// TestReadForm_ManyFiles_Distinct tests that setting GODEBUG=multipartfiles=distinct ++// results in every file in a multipart form being placed in a distinct on-disk file. ++func TestReadForm_ManyFiles_Distinct(t *testing.T) { ++ t.Setenv("GODEBUG", "multipartfiles=distinct") ++ const distinct = true ++ testReadFormManyFiles(t, distinct) ++} ++ ++func testReadFormManyFiles(t *testing.T, distinct bool) { ++ var buf bytes.Buffer ++ fw := NewWriter(&buf) ++ const numFiles = 10 ++ for i := 0; i < numFiles; i++ { ++ name := fmt.Sprint(i) ++ w, err := fw.CreateFormFile(name, name) ++ if err != nil { ++ t.Fatal(err) ++ } ++ w.Write([]byte(name)) ++ } ++ if err := fw.Close(); err != nil { ++ t.Fatal(err) ++ } ++ fr := NewReader(&buf, fw.Boundary()) ++ fr.tempDir = t.TempDir() ++ form, err := fr.ReadForm(0) ++ if err != nil { ++ t.Fatal(err) ++ } ++ for i := 0; i < numFiles; i++ { ++ name := fmt.Sprint(i) ++ if got := len(form.File[name]); got != 1 { ++ t.Fatalf("form.File[%q] has %v entries, want 1", name, got) ++ } ++ fh := form.File[name][0] ++ file, err := fh.Open() ++ if err != nil { ++ t.Fatalf("form.File[%q].Open() = %v", name, err) ++ } ++ if distinct { ++ if _, ok := file.(*os.File); !ok { ++ t.Fatalf("form.File[%q].Open: %T, want *os.File", name, file) ++ } ++ } ++ got, err := io.ReadAll(file) ++ file.Close() ++ if string(got) != name || err != nil { ++ t.Fatalf("read form.File[%q]: %q, %v; want %q, nil", name, string(got), err, name) ++ } ++ } ++ dir, err := os.Open(fr.tempDir) ++ if err != nil { ++ t.Fatal(err) ++ } ++ defer dir.Close() ++ names, err := dir.Readdirnames(0) ++ if err != nil { ++ t.Fatal(err) ++ } ++ wantNames := 1 ++ if distinct { ++ wantNames = numFiles ++ } ++ if len(names) != wantNames { ++ t.Fatalf("temp dir contains %v files; want 1", len(names)) ++ } ++ if err := form.RemoveAll(); err != nil { ++ t.Fatalf("form.RemoveAll() = %v", err) ++ } ++ names, err = dir.Readdirnames(0) ++ if err != nil { ++ t.Fatal(err) ++ } ++ if len(names) != 0 { ++ t.Fatalf("temp dir contains %v files; want 0", len(names)) ++ } ++} +--- go.orig/src/mime/multipart/multipart.go ++++ go/src/mime/multipart/multipart.go +@@ -128,12 +128,12 @@ func (r *stickyErrorReader) Read(p []byt + return n, r.err + } + +-func newPart(mr *Reader, rawPart bool) (*Part, error) { ++func newPart(mr *Reader, rawPart bool, maxMIMEHeaderSize int64) (*Part, error) { + bp := &Part{ + Header: make(map[string][]string), + mr: mr, + } +- if err := bp.populateHeaders(); err != nil { ++ if err := bp.populateHeaders(maxMIMEHeaderSize); err != nil { + return nil, err + } + bp.r = partReader{bp} +@@ -149,12 +149,16 @@ func newPart(mr *Reader, rawPart bool) ( + return bp, nil + } + +-func (bp *Part) populateHeaders() error { ++func (bp *Part) populateHeaders(maxMIMEHeaderSize int64) error { + r := textproto.NewReader(bp.mr.bufReader) +- header, err := r.ReadMIMEHeader() ++ header, err := readMIMEHeader(r, maxMIMEHeaderSize) + if err == nil { + bp.Header = header + } ++ // TODO: Add a distinguishable error to net/textproto. ++ if err != nil && err.Error() == "message too large" { ++ err = ErrMessageTooLarge ++ } + return err + } + +@@ -294,6 +298,7 @@ func (p *Part) Close() error { + // isn't supported. + type Reader struct { + bufReader *bufio.Reader ++ tempDir string // used in tests + + currentPart *Part + partsRead int +@@ -304,6 +309,10 @@ type Reader struct { + dashBoundary []byte // "--boundary" + } + ++// maxMIMEHeaderSize is the maximum size of a MIME header we will parse, ++// including header keys, values, and map overhead. ++const maxMIMEHeaderSize = 10 << 20 ++ + // NextPart returns the next part in the multipart or an error. + // When there are no more parts, the error io.EOF is returned. + // +@@ -311,7 +320,7 @@ type Reader struct { + // has a value of "quoted-printable", that header is instead + // hidden and the body is transparently decoded during Read calls. + func (r *Reader) NextPart() (*Part, error) { +- return r.nextPart(false) ++ return r.nextPart(false, maxMIMEHeaderSize) + } + + // NextRawPart returns the next part in the multipart or an error. +@@ -320,10 +329,10 @@ func (r *Reader) NextPart() (*Part, erro + // Unlike NextPart, it does not have special handling for + // "Content-Transfer-Encoding: quoted-printable". + func (r *Reader) NextRawPart() (*Part, error) { +- return r.nextPart(true) ++ return r.nextPart(true, maxMIMEHeaderSize) + } + +-func (r *Reader) nextPart(rawPart bool) (*Part, error) { ++func (r *Reader) nextPart(rawPart bool, maxMIMEHeaderSize int64) (*Part, error) { + if r.currentPart != nil { + r.currentPart.Close() + } +@@ -348,7 +357,7 @@ func (r *Reader) nextPart(rawPart bool) + + if r.isBoundaryDelimiterLine(line) { + r.partsRead++ +- bp, err := newPart(r, rawPart) ++ bp, err := newPart(r, rawPart, maxMIMEHeaderSize) + if err != nil { + return nil, err + } +--- /dev/null ++++ go/src/mime/multipart/readmimeheader.go +@@ -0,0 +1,14 @@ ++// Copyright 2023 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++package multipart ++ ++import ( ++ "net/textproto" ++ _ "unsafe" // for go:linkname ++) ++ ++// readMIMEHeader is defined in package net/textproto. ++// ++//go:linkname readMIMEHeader net/textproto.readMIMEHeader ++func readMIMEHeader(r *textproto.Reader, lim int64) (textproto.MIMEHeader, error) +--- go.orig/src/net/http/request_test.go ++++ go/src/net/http/request_test.go +@@ -1110,7 +1110,7 @@ func testMissingFile(t *testing.T, req * + t.Errorf("FormFile file = %v, want nil", f) + } + if fh != nil { +- t.Errorf("FormFile file header = %q, want nil", fh) ++ t.Errorf("FormFile file header = %v, want nil", fh) + } + if err != ErrMissingFile { + t.Errorf("FormFile err = %q, want ErrMissingFile", err) +--- go.orig/src/net/textproto/reader.go ++++ go/src/net/textproto/reader.go +@@ -7,8 +7,10 @@ package textproto + import ( + "bufio" + "bytes" ++ "errors" + "fmt" + "io" ++ "math" + "strconv" + "strings" + "sync" +@@ -481,6 +483,12 @@ func (r *Reader) ReadDotLines() ([]strin + // } + // + func (r *Reader) ReadMIMEHeader() (MIMEHeader, error) { ++ return readMIMEHeader(r, math.MaxInt64) ++} ++ ++// readMIMEHeader is a version of ReadMIMEHeader which takes a limit on the header size. ++// It is called by the mime/multipart package. ++func readMIMEHeader(r *Reader, lim int64) (MIMEHeader, error) { + // Avoid lots of small slice allocations later by allocating one + // large one ahead of time which we'll cut up into smaller + // slices. If this isn't big enough later, we allocate small ones. +@@ -521,6 +529,16 @@ func (r *Reader) ReadMIMEHeader() (MIMEH + continue + } + ++ // backport 5c55ac9bf1e5f779220294c843526536605f42ab ++ // ++ // value is computed as ++ // ++ // value := string(bytes.TrimLeft(v, " \t")) ++ // ++ // in the original patch from 1.19. This relies on ++ // 'v' which does not exist in 1.17. We leave the ++ // 1.17 method unchanged. ++ + // Skip initial spaces in value. + i++ // skip colon + for i < len(kv) && (kv[i] == ' ' || kv[i] == '\t') { +@@ -529,6 +547,16 @@ func (r *Reader) ReadMIMEHeader() (MIMEH + value := string(kv[i:]) + + vv := m[key] ++ if vv == nil { ++ lim -= int64(len(key)) ++ lim -= 100 // map entry overhead ++ } ++ lim -= int64(len(value)) ++ if lim < 0 { ++ // TODO: This should be a distinguishable error (ErrMessageTooLarge) ++ // to allow mime/multipart to detect it. ++ return m, errors.New("message too large") ++ } + if vv == nil && len(strs) > 0 { + // More than likely this will be a single-element key. + // Most headers aren't multi-valued. diff --git a/meta/recipes-devtools/go/go-1.20/0010-net-Fix-issue-with-DNS-not-being-updated.patch b/meta/recipes-devtools/go/go-1.20/0010-net-Fix-issue-with-DNS-not-being-updated.patch new file mode 100644 index 0000000000..6ead518843 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.20/0010-net-Fix-issue-with-DNS-not-being-updated.patch @@ -0,0 +1,51 @@ +From 20176b390e28daa86b4552965cb7bd9181983c4d Mon Sep 17 00:00:00 2001 +From: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com> +Date: Mon, 6 Nov 2023 20:11:19 -0600 +Subject: [PATCH] net: Fix issue with DNS not being updated + +When dns requests are made, go's native DNS resolver only reads +/etc/resolv.conf if the previous request is older than 5 seconds. + +On first network call, an initialization code runs that is +supposed to initialize DNS data and set lastChecked time. There is a bug +in this code that causes /etc/resolv.conf to not be read during +initialization and the DNS data from program startup ends up being used +until the next 5 seconds. This means that if /etc/resolv.conf changed +between program startup and the first network call, old DNS data is +still used until the next 5 seconds. + +This causes "docker pull" to fail the first time if docker daemon is +started before networking is up. + +Upstream commit d52883f443e1d564b0300acdd382af1769bf0477 made lot of +improvements to DNS resolver to fix some issues which also fixes this +issue. +This patch picks the relevant changes from it to fix this particular +issue. + +Upstream-Status: Backport [https://github.com/golang/go/commit/d52883f443e1d564b0300acdd382af1769bf0477] + +Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com> +--- + src/net/dnsclient_unix.go | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/net/dnsclient_unix.go b/src/net/dnsclient_unix.go +index 6dfd4af..520ffe6 100644 +--- a/src/net/dnsclient_unix.go ++++ b/src/net/dnsclient_unix.go +@@ -337,10 +337,7 @@ var resolvConf resolverConfig + func (conf *resolverConfig) init() { + // Set dnsConfig and lastChecked so we don't parse + // resolv.conf twice the first time. +- conf.dnsConfig = systemConf().resolv +- if conf.dnsConfig == nil { +- conf.dnsConfig = dnsReadConfig("/etc/resolv.conf") +- } ++ conf.dnsConfig = dnsReadConfig("/etc/resolv.conf") + conf.lastChecked = time.Now() + + // Prepare ch so that only one update of resolverConfig may +-- +2.34.1 + diff --git a/meta/recipes-devtools/go/go-1.20/CVE-2023-39319.patch b/meta/recipes-devtools/go/go-1.20/CVE-2023-39319.patch new file mode 100644 index 0000000000..1554aa975c --- /dev/null +++ b/meta/recipes-devtools/go/go-1.20/CVE-2023-39319.patch @@ -0,0 +1,254 @@ +From 2070531d2f53df88e312edace6c8dfc9686ab2f5 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Thu Aug 3 12:28:28 2023 -0700 +Subject: [PATCH] html/template: properly handle special tags within the script + context + +The HTML specification has incredibly complex rules for how to handle +"<!--", "<script", and "</script" when they appear within literals in +the script context. Rather than attempting to apply these restrictions +(which require a significantly more complex state machine) we apply +the workaround suggested in section 4.12.1.3 of the HTML specification [1]. + +More precisely, when "<!--", "<script", and "</script" appear within +literals (strings and regular expressions, ignoring comments since we +already elide their content) we replace the "<" with "\x3C". This avoids +the unintuitive behavior that using these tags within literals can cause, +by simply preventing the rendered content from triggering it. This may +break some correct usages of these tags, but on balance is more likely +to prevent XSS attacks where users are unknowingly either closing or not +closing the script blocks where they think they are. + +Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for +reporting this issue. + +Fixes #62197 +Fixes #62397 +Fixes CVE-2023-39319 + +[1] https://html.spec.whatwg.org/#restrictions-for-contents-of-script-elements + +Change-Id: Iab57b0532694827e3eddf57a7497ba1fab1746dc +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1976594 +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2014621 +Reviewed-on: https://go-review.googlesource.com/c/go/+/526099 +TryBot-Result: Gopher Robot <gobot@golang.org> +Run-TryBot: Cherry Mui <cherryyz@google.com> + +CVE: CVE-2023-39319 + +Upstream-Status: Backport [https://github.com/golang/go/commit/2070531d2f53df88e312edace6c8dfc9686ab2f5] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/go/build/deps_test.go | 6 ++-- + src/html/template/context.go | 14 ++++++++++ + src/html/template/escape.go | 26 ++++++++++++++++++ + src/html/template/escape_test.go | 47 +++++++++++++++++++++++++++++++- + src/html/template/transition.go | 15 ++++++++++ + 5 files changed, 104 insertions(+), 4 deletions(-) + +diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go +index dc3bb8c..359a00a 100644 +--- a/src/go/build/deps_test.go ++++ b/src/go/build/deps_test.go +@@ -255,15 +255,15 @@ var depsRules = ` + < text/template + < internal/lazytemplate; + +- encoding/json, html, text/template +- < html/template; +- + # regexp + FMT + < regexp/syntax + < regexp + < internal/lazyregexp; + ++ encoding/json, html, text/template, regexp ++ < html/template; ++ + # suffix array + encoding/binary, regexp + < index/suffixarray; +diff --git a/src/html/template/context.go b/src/html/template/context.go +index 0b65313..f5f44a1 100644 +--- a/src/html/template/context.go ++++ b/src/html/template/context.go +@@ -164,6 +164,20 @@ func isInTag(s state) bool { + return false + } + ++// isInScriptLiteral returns true if s is one of the literal states within a ++// <script> tag, and as such occurances of "<!--", "<script", and "</script" ++// need to be treated specially. ++func isInScriptLiteral(s state) bool { ++ // Ignore the comment states (stateJSBlockCmt, stateJSLineCmt, ++ // stateJSHTMLOpenCmt, stateJSHTMLCloseCmt) because their content is already ++ // omitted from the output. ++ switch s { ++ case stateJSDqStr, stateJSSqStr, stateJSBqStr, stateJSRegexp: ++ return true ++ } ++ return false ++} ++ + // delim is the delimiter that will end the current HTML attribute. + type delim uint8 + +diff --git a/src/html/template/escape.go b/src/html/template/escape.go +index bdccc65..1747ec9 100644 +--- a/src/html/template/escape.go ++++ b/src/html/template/escape.go +@@ -10,6 +10,7 @@ import ( + "html" + "internal/godebug" + "io" ++ "regexp" + "text/template" + "text/template/parse" + ) +@@ -652,6 +653,26 @@ var delimEnds = [...]string{ + delimSpaceOrTagEnd: " \t\n\f\r>", + } + ++var ( ++ // Per WHATWG HTML specification, section 4.12.1.3, there are extremely ++ // complicated rules for how to handle the set of opening tags <!--, ++ // <script, and </script when they appear in JS literals (i.e. strings, ++ // regexs, and comments). The specification suggests a simple solution, ++ // rather than implementing the arcane ABNF, which involves simply escaping ++ // the opening bracket with \x3C. We use the below regex for this, since it ++ // makes doing the case-insensitive find-replace much simpler. ++ specialScriptTagRE = regexp.MustCompile("(?i)<(script|/script|!--)") ++ specialScriptTagReplacement = []byte("\\x3C$1") ++) ++ ++func containsSpecialScriptTag(s []byte) bool { ++ return specialScriptTagRE.Match(s) ++} ++ ++func escapeSpecialScriptTags(s []byte) []byte { ++ return specialScriptTagRE.ReplaceAll(s, specialScriptTagReplacement) ++} ++ + var doctypeBytes = []byte("<!DOCTYPE") + + // escapeText escapes a text template node. +@@ -707,6 +728,11 @@ func (e *escaper) escapeText(c context, n *parse.TextNode) context { + b.Write(s[written:cs]) + written = i1 + } ++ if isInScriptLiteral(c.state) && containsSpecialScriptTag(s[i:i1]) { ++ b.Write(s[written:i]) ++ b.Write(escapeSpecialScriptTags(s[i:i1])) ++ written = i1 ++ } + if i == i1 && c.state == c1.state { + panic(fmt.Sprintf("infinite loop from %v to %v on %q..%q", c, c1, s[:i], s[i:])) + } +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index 4f48afe..7853daa 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -503,6 +503,21 @@ func TestEscape(t *testing.T) { + "<script>var a/*b*///c\nd</script>", + "<script>var a \nd</script>", + }, ++ { ++ "Special tags in <script> string literals", ++ `<script>var a = "asd < 123 <!-- 456 < fgh <script jkl < 789 </script"</script>`, ++ `<script>var a = "asd < 123 \x3C!-- 456 < fgh \x3Cscript jkl < 789 \x3C/script"</script>`, ++ }, ++ { ++ "Special tags in <script> string literals (mixed case)", ++ `<script>var a = "<!-- <ScripT </ScripT"</script>`, ++ `<script>var a = "\x3C!-- \x3CScripT \x3C/ScripT"</script>`, ++ }, ++ { ++ "Special tags in <script> regex literals (mixed case)", ++ `<script>var a = /<!-- <ScripT </ScripT/</script>`, ++ `<script>var a = /\x3C!-- \x3CScripT \x3C/ScripT/</script>`, ++ }, + { + "CSS comments", + "<style>p// paragraph\n" + +@@ -1491,8 +1506,38 @@ func TestEscapeText(t *testing.T) { + context{state: stateJS, element: elementScript}, + }, + { ++ // <script and </script tags are escaped, so </script> should not ++ // cause us to exit the JS state. + `<script>document.write("<script>alert(1)</script>");`, +- context{state: stateText}, ++ context{state: stateJS, element: elementScript}, ++ }, ++ { ++ `<script>document.write("<script>`, ++ context{state: stateJSDqStr, element: elementScript}, ++ }, ++ { ++ `<script>document.write("<script>alert(1)</script>`, ++ context{state: stateJSDqStr, element: elementScript}, ++ }, ++ { ++ `<script>document.write("<script>alert(1)<!--`, ++ context{state: stateJSDqStr, element: elementScript}, ++ }, ++ { ++ `<script>document.write("<script>alert(1)</Script>");`, ++ context{state: stateJS, element: elementScript}, ++ }, ++ { ++ `<script>document.write("<!--");`, ++ context{state: stateJS, element: elementScript}, ++ }, ++ { ++ `<script>let a = /</script`, ++ context{state: stateJSRegexp, element: elementScript}, ++ }, ++ { ++ `<script>let a = /</script/`, ++ context{state: stateJS, element: elementScript, jsCtx: jsCtxDivOp}, + }, + { + `<script type="text/template">`, +diff --git a/src/html/template/transition.go b/src/html/template/transition.go +index 92eb351..e2660cc 100644 +--- a/src/html/template/transition.go ++++ b/src/html/template/transition.go +@@ -212,6 +212,11 @@ var ( + // element states. + func tSpecialTagEnd(c context, s []byte) (context, int) { + if c.element != elementNone { ++ // script end tags ("</script") within script literals are ignored, so that ++ // we can properly escape them. ++ if c.element == elementScript && (isInScriptLiteral(c.state) || isComment(c.state)) { ++ return c, len(s) ++ } + if i := indexTagEnd(s, specialTagEndMarkers[c.element]); i != -1 { + return context{}, i + } +@@ -331,6 +336,16 @@ func tJSDelimited(c context, s []byte) (context, int) { + inCharset = true + case ']': + inCharset = false ++ case '/': ++ // If "</script" appears in a regex literal, the '/' should not ++ // close the regex literal, and it will later be escaped to ++ // "\x3C/script" in escapeText. ++ if i > 0 && i+7 <= len(s) && bytes.Compare(bytes.ToLower(s[i-1:i+7]), []byte("</script")) == 0 { ++ i++ ++ } else if !inCharset { ++ c.state, c.jsCtx = stateJS, jsCtxDivOp ++ return c, i + 1 ++ } + default: + // end delimiter + if !inCharset { +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch b/meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch new file mode 100644 index 0000000000..ca78e552c2 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.20/CVE-2023-39326.patch @@ -0,0 +1,182 @@ +From 6446af942e2e2b161c4ec1b60d9703a2b55dc4dd Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Tue, 7 Nov 2023 10:47:56 -0800 +Subject: [PATCH] net/http: limit chunked data overhead + +The chunked transfer encoding adds some overhead to +the content transferred. When writing one byte per +chunk, for example, there are five bytes of overhead +per byte of data transferred: "1\r\nX\r\n" to send "X". + +Chunks may include "chunk extensions", +which we skip over and do not use. +For example: "1;chunk extension here\r\nX\r\n". + +A malicious sender can use chunk extensions to add +about 4k of overhead per byte of data. +(The maximum chunk header line size we will accept.) + +Track the amount of overhead read in chunked data, +and produce an error if it seems excessive. + +Updates #64433 +Fixes #64434 +Fixes CVE-2023-39326 + +Change-Id: I40f8d70eb6f9575fb43f506eb19132ccedafcf39 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2076135 +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +(cherry picked from commit 3473ae72ee66c60744665a24b2fde143e8964d4f) +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2095407 +Run-TryBot: Roland Shoemaker <bracewell@google.com> +TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/547355 +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> + +CVE: CVE-2023-39326 + +Upstream-Status: Backport [https://github.com/golang/go/commit/6446af942e2e2b161c4ec1b60d9703a2b55dc4dd] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/net/http/internal/chunked.go | 36 +++++++++++++--- + src/net/http/internal/chunked_test.go | 59 +++++++++++++++++++++++++++ + 2 files changed, 89 insertions(+), 6 deletions(-) + +diff --git a/src/net/http/internal/chunked.go b/src/net/http/internal/chunked.go +index f06e572..ddbaacb 100644 +--- a/src/net/http/internal/chunked.go ++++ b/src/net/http/internal/chunked.go +@@ -39,7 +39,8 @@ type chunkedReader struct { + n uint64 // unread bytes in chunk + err error + buf [2]byte +- checkEnd bool // whether need to check for \r\n chunk footer ++ checkEnd bool // whether need to check for \r\n chunk footer ++ excess int64 // "excessive" chunk overhead, for malicious sender detection + } + + func (cr *chunkedReader) beginChunk() { +@@ -49,10 +50,38 @@ func (cr *chunkedReader) beginChunk() { + if cr.err != nil { + return + } ++ cr.excess += int64(len(line)) + 2 // header, plus \r\n after the chunk data ++ line = trimTrailingWhitespace(line) ++ line, cr.err = removeChunkExtension(line) ++ if cr.err != nil { ++ return ++ } + cr.n, cr.err = parseHexUint(line) + if cr.err != nil { + return + } ++ // A sender who sends one byte per chunk will send 5 bytes of overhead ++ // for every byte of data. ("1\r\nX\r\n" to send "X".) ++ // We want to allow this, since streaming a byte at a time can be legitimate. ++ // ++ // A sender can use chunk extensions to add arbitrary amounts of additional ++ // data per byte read. ("1;very long extension\r\nX\r\n" to send "X".) ++ // We don't want to disallow extensions (although we discard them), ++ // but we also don't want to allow a sender to reduce the signal/noise ratio ++ // arbitrarily. ++ // ++ // We track the amount of excess overhead read, ++ // and produce an error if it grows too large. ++ // ++ // Currently, we say that we're willing to accept 16 bytes of overhead per chunk, ++ // plus twice the amount of real data in the chunk. ++ cr.excess -= 16 + (2 * int64(cr.n)) ++ if cr.excess < 0 { ++ cr.excess = 0 ++ } ++ if cr.excess > 16*1024 { ++ cr.err = errors.New("chunked encoding contains too much non-data") ++ } + if cr.n == 0 { + cr.err = io.EOF + } +@@ -133,11 +162,6 @@ func readChunkLine(b *bufio.Reader) ([]byte, error) { + if len(p) >= maxLineLength { + return nil, ErrLineTooLong + } +- p = trimTrailingWhitespace(p) +- p, err = removeChunkExtension(p) +- if err != nil { +- return nil, err +- } + return p, nil + } + +diff --git a/src/net/http/internal/chunked_test.go b/src/net/http/internal/chunked_test.go +index 08152ed..5fbeb08 100644 +--- a/src/net/http/internal/chunked_test.go ++++ b/src/net/http/internal/chunked_test.go +@@ -211,3 +211,62 @@ func TestChunkReadPartial(t *testing.T) { + } + + } ++ ++func TestChunkReaderTooMuchOverhead(t *testing.T) { ++ // If the sender is sending 100x as many chunk header bytes as chunk data, ++ // we should reject the stream at some point. ++ chunk := []byte("1;") ++ for i := 0; i < 100; i++ { ++ chunk = append(chunk, 'a') // chunk extension ++ } ++ chunk = append(chunk, "\r\nX\r\n"...) ++ const bodylen = 1 << 20 ++ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) { ++ if i < bodylen { ++ return chunk, nil ++ } ++ return []byte("0\r\n"), nil ++ }}) ++ _, err := io.ReadAll(r) ++ if err == nil { ++ t.Fatalf("successfully read body with excessive overhead; want error") ++ } ++} ++ ++func TestChunkReaderByteAtATime(t *testing.T) { ++ // Sending one byte per chunk should not trip the excess-overhead detection. ++ const bodylen = 1 << 20 ++ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) { ++ if i < bodylen { ++ return []byte("1\r\nX\r\n"), nil ++ } ++ return []byte("0\r\n"), nil ++ }}) ++ got, err := io.ReadAll(r) ++ if err != nil { ++ t.Errorf("unexpected error: %v", err) ++ } ++ if len(got) != bodylen { ++ t.Errorf("read %v bytes, want %v", len(got), bodylen) ++ } ++} ++ ++type funcReader struct { ++ f func(iteration int) ([]byte, error) ++ i int ++ b []byte ++ err error ++} ++ ++func (r *funcReader) Read(p []byte) (n int, err error) { ++ if len(r.b) == 0 && r.err == nil { ++ r.b, r.err = r.f(r.i) ++ r.i++ ++ } ++ n = copy(p, r.b) ++ r.b = r.b[n:] ++ if len(r.b) > 0 { ++ return n, nil ++ } ++ return n, r.err ++} +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.20/CVE-2023-45285.patch b/meta/recipes-devtools/go/go-1.20/CVE-2023-45285.patch new file mode 100644 index 0000000000..0459ae0a1a --- /dev/null +++ b/meta/recipes-devtools/go/go-1.20/CVE-2023-45285.patch @@ -0,0 +1,110 @@ +From 46bc33819ac86a9596b8059235842f0e0c7469bd Mon Sep 17 00:00:00 2001 +From: Bryan C. Mills <bcmills@google.com> +Date: Thu, 2 Nov 2023 15:06:35 -0400 +Subject: [PATCH] cmd/go/internal/vcs: error out if the requested repo does not + support a secure protocol + +Updates #63845. +Fixes #63972. + +Change-Id: If86d6b13d3b55877b35c087112bd76388c9404b8 +Reviewed-on: https://go-review.googlesource.com/c/go/+/539321 +Reviewed-by: Michael Matloob <matloob@golang.org> +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> +Reviewed-by: Roland Shoemaker <roland@golang.org> +Auto-Submit: Bryan Mills <bcmills@google.com> +(cherry picked from commit be26ae18caf7ddffca4073333f80d0d9e76483c3) +Reviewed-on: https://go-review.googlesource.com/c/go/+/540335 +Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> + +CVE: CVE-2023-45285 + +Upstream-Status: Backport [https://github.com/golang/go/commit/46bc33819ac86a9596b8059235842f0e0c7469bd] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/cmd/go/internal/vcs/vcs.go | 25 +++++++++++++---- + .../script/mod_insecure_issue63845.txt | 28 +++++++++++++++++++ + 2 files changed, 47 insertions(+), 6 deletions(-) + create mode 100644 src/cmd/go/testdata/script/mod_insecure_issue63845.txt + +diff --git a/src/cmd/go/internal/vcs/vcs.go b/src/cmd/go/internal/vcs/vcs.go +index ab42424..0e2882d 100644 +--- a/src/cmd/go/internal/vcs/vcs.go ++++ b/src/cmd/go/internal/vcs/vcs.go +@@ -891,19 +891,32 @@ func repoRootFromVCSPaths(importPath string, security web.SecurityMode, vcsPaths + if !srv.schemelessRepo { + repoURL = match["repo"] + } else { +- scheme := vcs.Scheme[0] // default to first scheme + repo := match["repo"] +- if vcs.PingCmd != "" { +- // If we know how to test schemes, scan to find one. ++ scheme, err := func() (string, error) { + for _, s := range vcs.Scheme { + if security == web.SecureOnly && !vcs.isSecureScheme(s) { + continue + } +- if vcs.Ping(s, repo) == nil { +- scheme = s +- break ++ ++ // If we know how to ping URL schemes for this VCS, ++ // check that this repo works. ++ // Otherwise, default to the first scheme ++ // that meets the requested security level. ++ if vcs.PingCmd == "" { ++ return s, nil ++ } ++ if err := vcs.Ping(s, repo); err == nil { ++ return s, nil + } + } ++ securityFrag := "" ++ if security == web.SecureOnly { ++ securityFrag = "secure " ++ } ++ return "", fmt.Errorf("no %sprotocol found for repository", securityFrag) ++ }() ++ if err != nil { ++ return nil, err + } + repoURL = scheme + "://" + repo + } +diff --git a/src/cmd/go/testdata/script/mod_insecure_issue63845.txt b/src/cmd/go/testdata/script/mod_insecure_issue63845.txt +new file mode 100644 +index 0000000..5fa6a4f +--- /dev/null ++++ b/src/cmd/go/testdata/script/mod_insecure_issue63845.txt +@@ -0,0 +1,28 @@ ++# Regression test for https://go.dev/issue/63845: ++# If 'git ls-remote' fails for all secure protocols, ++# we should fail instead of falling back to an arbitrary protocol. ++# ++# Note that this test does not use the local vcweb test server ++# (vcs-test.golang.org), because the hook for redirecting to that ++# server bypasses the "ping to determine protocol" logic ++# in cmd/go/internal/vcs. ++ ++[!net] skip ++[!git] skip ++[short] skip 'tries to access a nonexistent external Git repo' ++ ++env GOPRIVATE=golang.org ++env CURLOPT_TIMEOUT_MS=100 ++env GIT_SSH_COMMAND=false ++ ++! go get -x golang.org/nonexist.git@latest ++stderr '^git ls-remote https://golang.org/nonexist$' ++stderr '^git ls-remote git\+ssh://golang.org/nonexist' ++stderr '^git ls-remote ssh://golang.org/nonexist$' ++! stderr 'git://' ++stderr '^go: golang.org/nonexist.git@latest: no secure protocol found for repository$' ++ ++-- go.mod -- ++module example ++ ++go 1.19 +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.20/CVE-2023-45287.patch b/meta/recipes-devtools/go/go-1.20/CVE-2023-45287.patch new file mode 100644 index 0000000000..477e3c98ee --- /dev/null +++ b/meta/recipes-devtools/go/go-1.20/CVE-2023-45287.patch @@ -0,0 +1,1695 @@ +From 8a81fdf165facdcefa06531de5af98a4db343035 Mon Sep 17 00:00:00 2001 +From: Lúcás Meier <cronokirby@gmail.com> +Date: Tue Jun 8 21:36:06 2021 +0200 +Subject: [PATCH] crypto/rsa: replace big.Int for encryption and decryption + +Infamously, big.Int does not provide constant-time arithmetic, making +its use in cryptographic code quite tricky. RSA uses big.Int +pervasively, in its public API, for key generation, precomputation, and +for encryption and decryption. This is a known problem. One mitigation, +blinding, is already in place during decryption. This helps mitigate the +very leaky exponentiation operation. Because big.Int is fundamentally +not constant-time, it's unfortunately difficult to guarantee that +mitigations like these are completely effective. + +This patch removes the use of big.Int for encryption and decryption, +replacing it with an internal nat type instead. Signing and verification +are also affected, because they depend on encryption and decryption. + +Overall, this patch degrades performance by 55% for private key +operations, and 4-5x for (much faster) public key operations. +(Signatures do both, so the slowdown is worse than decryption.) + +name old time/op new time/op delta +DecryptPKCS1v15/2048-8 1.50ms ± 0% 2.34ms ± 0% +56.44% (p=0.000 n=8+10) +DecryptPKCS1v15/3072-8 4.40ms ± 0% 6.79ms ± 0% +54.33% (p=0.000 n=10+9) +DecryptPKCS1v15/4096-8 9.31ms ± 0% 15.14ms ± 0% +62.60% (p=0.000 n=10+10) +EncryptPKCS1v15/2048-8 8.16µs ± 0% 355.58µs ± 0% +4258.90% (p=0.000 n=10+9) +DecryptOAEP/2048-8 1.50ms ± 0% 2.34ms ± 0% +55.68% (p=0.000 n=10+9) +EncryptOAEP/2048-8 8.51µs ± 0% 355.95µs ± 0% +4082.75% (p=0.000 n=10+9) +SignPKCS1v15/2048-8 1.51ms ± 0% 2.69ms ± 0% +77.94% (p=0.000 n=10+10) +VerifyPKCS1v15/2048-8 7.25µs ± 0% 354.34µs ± 0% +4789.52% (p=0.000 n=9+9) +SignPSS/2048-8 1.51ms ± 0% 2.70ms ± 0% +78.80% (p=0.000 n=9+10) +VerifyPSS/2048-8 8.27µs ± 1% 355.65µs ± 0% +4199.39% (p=0.000 n=10+10) + +Keep in mind that this is without any assembly at all, and that further +improvements are likely possible. I think having a review of the logic +and the cryptography would be a good idea at this stage, before we +complicate the code too much through optimization. + +The bulk of the work is in nat.go. This introduces two new types: nat, +representing natural numbers, and modulus, representing moduli used in +modular arithmetic. + +A nat has an "announced size", which may be larger than its "true size", +the number of bits needed to represent this number. Operations on a nat +will only ever leak its announced size, never its true size, or other +information about its value. The size of a nat is always clear based on +how its value is set. For example, x.mod(y, m) will make the announced +size of x match that of m, since x is reduced modulo m. + +Operations assume that the announced size of the operands match what's +expected (with a few exceptions). For example, x.modAdd(y, m) assumes +that x and y have the same announced size as m, and that they're reduced +modulo m. + +Nats are represented over unsatured bits.UintSize - 1 bit limbs. This +means that we can't reuse the assembly routines for big.Int, which use +saturated bits.UintSize limbs. The advantage of unsaturated limbs is +that it makes Montgomery multiplication faster, by needing fewer +registers in a hot loop. This makes exponentiation faster, which +consists of many Montgomery multiplications. + +Moduli use nat internally. Unlike nat, the true size of a modulus always +matches its announced size. When creating a modulus, any zero padding is +removed. Moduli will also precompute constants when created, which is +another reason why having a separate type is desirable. + +Updates #20654 + +Co-authored-by: Filippo Valsorda <filippo@golang.org> +Change-Id: I73b61f87d58ab912e80a9644e255d552cbadcced +Reviewed-on: https://go-review.googlesource.com/c/go/+/326012 +Run-TryBot: Filippo Valsorda <filippo@golang.org> +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Roland Shoemaker <roland@golang.org> +Reviewed-by: Joedian Reid <joedian@golang.org> + +CVE: CVE-2023-45287 + +Upstream-Status: Backport [https://github.com/golang/go/commit/8a81fdf165facdcefa06531de5af98a4db343035] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/crypto/rsa/example_test.go | 21 +- + src/crypto/rsa/nat.go | 626 +++++++++++++++++++++++++++++++++ + src/crypto/rsa/nat_test.go | 384 ++++++++++++++++++++ + src/crypto/rsa/pkcs1v15.go | 47 +-- + src/crypto/rsa/pss.go | 49 ++- + src/crypto/rsa/pss_test.go | 10 +- + src/crypto/rsa/rsa.go | 172 ++++----- + 7 files changed, 1140 insertions(+), 169 deletions(-) + create mode 100644 src/crypto/rsa/nat.go + create mode 100644 src/crypto/rsa/nat_test.go + +diff --git a/src/crypto/rsa/example_test.go b/src/crypto/rsa/example_test.go +index ce5c2d9..52e5639 100644 +--- a/src/crypto/rsa/example_test.go ++++ b/src/crypto/rsa/example_test.go +@@ -12,7 +12,6 @@ import ( + "crypto/sha256" + "encoding/hex" + "fmt" +- "io" + "os" + ) + +@@ -36,21 +35,17 @@ import ( + // a buffer that contains a random key. Thus, if the RSA result isn't + // well-formed, the implementation uses a random key in constant time. + func ExampleDecryptPKCS1v15SessionKey() { +- // crypto/rand.Reader is a good source of entropy for blinding the RSA +- // operation. +- rng := rand.Reader +- + // The hybrid scheme should use at least a 16-byte symmetric key. Here + // we read the random key that will be used if the RSA decryption isn't + // well-formed. + key := make([]byte, 32) +- if _, err := io.ReadFull(rng, key); err != nil { ++ if _, err := rand.Read(key); err != nil { + panic("RNG failure") + } + + rsaCiphertext, _ := hex.DecodeString("aabbccddeeff") + +- if err := DecryptPKCS1v15SessionKey(rng, rsaPrivateKey, rsaCiphertext, key); err != nil { ++ if err := DecryptPKCS1v15SessionKey(nil, rsaPrivateKey, rsaCiphertext, key); err != nil { + // Any errors that result will be “public” – meaning that they + // can be determined without any secret information. (For + // instance, if the length of key is impossible given the RSA +@@ -86,10 +81,6 @@ func ExampleDecryptPKCS1v15SessionKey() { + } + + func ExampleSignPKCS1v15() { +- // crypto/rand.Reader is a good source of entropy for blinding the RSA +- // operation. +- rng := rand.Reader +- + message := []byte("message to be signed") + + // Only small messages can be signed directly; thus the hash of a +@@ -99,7 +90,7 @@ func ExampleSignPKCS1v15() { + // of writing (2016). + hashed := sha256.Sum256(message) + +- signature, err := SignPKCS1v15(rng, rsaPrivateKey, crypto.SHA256, hashed[:]) ++ signature, err := SignPKCS1v15(nil, rsaPrivateKey, crypto.SHA256, hashed[:]) + if err != nil { + fmt.Fprintf(os.Stderr, "Error from signing: %s\n", err) + return +@@ -151,11 +142,7 @@ func ExampleDecryptOAEP() { + ciphertext, _ := hex.DecodeString("4d1ee10e8f286390258c51a5e80802844c3e6358ad6690b7285218a7c7ed7fc3a4c7b950fbd04d4b0239cc060dcc7065ca6f84c1756deb71ca5685cadbb82be025e16449b905c568a19c088a1abfad54bf7ecc67a7df39943ec511091a34c0f2348d04e058fcff4d55644de3cd1d580791d4524b92f3e91695582e6e340a1c50b6c6d78e80b4e42c5b4d45e479b492de42bbd39cc642ebb80226bb5200020d501b24a37bcc2ec7f34e596b4fd6b063de4858dbf5a4e3dd18e262eda0ec2d19dbd8e890d672b63d368768360b20c0b6b8592a438fa275e5fa7f60bef0dd39673fd3989cc54d2cb80c08fcd19dacbc265ee1c6014616b0e04ea0328c2a04e73460") + label := []byte("orders") + +- // crypto/rand.Reader is a good source of entropy for blinding the RSA +- // operation. +- rng := rand.Reader +- +- plaintext, err := DecryptOAEP(sha256.New(), rng, test2048Key, ciphertext, label) ++ plaintext, err := DecryptOAEP(sha256.New(), nil, test2048Key, ciphertext, label) + if err != nil { + fmt.Fprintf(os.Stderr, "Error from decryption: %s\n", err) + return +diff --git a/src/crypto/rsa/nat.go b/src/crypto/rsa/nat.go +new file mode 100644 +index 0000000..da521c2 +--- /dev/null ++++ b/src/crypto/rsa/nat.go +@@ -0,0 +1,626 @@ ++// Copyright 2021 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++package rsa ++ ++import ( ++ "math/big" ++ "math/bits" ++) ++ ++const ( ++ // _W is the number of bits we use for our limbs. ++ _W = bits.UintSize - 1 ++ // _MASK selects _W bits from a full machine word. ++ _MASK = (1 << _W) - 1 ++) ++ ++// choice represents a constant-time boolean. The value of choice is always ++// either 1 or 0. We use an int instead of bool in order to make decisions in ++// constant time by turning it into a mask. ++type choice uint ++ ++func not(c choice) choice { return 1 ^ c } ++ ++const yes = choice(1) ++const no = choice(0) ++ ++// ctSelect returns x if on == 1, and y if on == 0. The execution time of this ++// function does not depend on its inputs. If on is any value besides 1 or 0, ++// the result is undefined. ++func ctSelect(on choice, x, y uint) uint { ++ // When on == 1, mask is 0b111..., otherwise mask is 0b000... ++ mask := -uint(on) ++ // When mask is all zeros, we just have y, otherwise, y cancels with itself. ++ return y ^ (mask & (y ^ x)) ++} ++ ++// ctEq returns 1 if x == y, and 0 otherwise. The execution time of this ++// function does not depend on its inputs. ++func ctEq(x, y uint) choice { ++ // If x != y, then either x - y or y - x will generate a carry. ++ _, c1 := bits.Sub(x, y, 0) ++ _, c2 := bits.Sub(y, x, 0) ++ return not(choice(c1 | c2)) ++} ++ ++// ctGeq returns 1 if x >= y, and 0 otherwise. The execution time of this ++// function does not depend on its inputs. ++func ctGeq(x, y uint) choice { ++ // If x < y, then x - y generates a carry. ++ _, carry := bits.Sub(x, y, 0) ++ return not(choice(carry)) ++} ++ ++// nat represents an arbitrary natural number ++// ++// Each nat has an announced length, which is the number of limbs it has stored. ++// Operations on this number are allowed to leak this length, but will not leak ++// any information about the values contained in those limbs. ++type nat struct { ++ // limbs is a little-endian representation in base 2^W with ++ // W = bits.UintSize - 1. The top bit is always unset between operations. ++ // ++ // The top bit is left unset to optimize Montgomery multiplication, in the ++ // inner loop of exponentiation. Using fully saturated limbs would leave us ++ // working with 129-bit numbers on 64-bit platforms, wasting a lot of space, ++ // and thus time. ++ limbs []uint ++} ++ ++// expand expands x to n limbs, leaving its value unchanged. ++func (x *nat) expand(n int) *nat { ++ for len(x.limbs) > n { ++ if x.limbs[len(x.limbs)-1] != 0 { ++ panic("rsa: internal error: shrinking nat") ++ } ++ x.limbs = x.limbs[:len(x.limbs)-1] ++ } ++ if cap(x.limbs) < n { ++ newLimbs := make([]uint, n) ++ copy(newLimbs, x.limbs) ++ x.limbs = newLimbs ++ return x ++ } ++ extraLimbs := x.limbs[len(x.limbs):n] ++ for i := range extraLimbs { ++ extraLimbs[i] = 0 ++ } ++ x.limbs = x.limbs[:n] ++ return x ++} ++ ++// reset returns a zero nat of n limbs, reusing x's storage if n <= cap(x.limbs). ++func (x *nat) reset(n int) *nat { ++ if cap(x.limbs) < n { ++ x.limbs = make([]uint, n) ++ return x ++ } ++ for i := range x.limbs { ++ x.limbs[i] = 0 ++ } ++ x.limbs = x.limbs[:n] ++ return x ++} ++ ++// clone returns a new nat, with the same value and announced length as x. ++func (x *nat) clone() *nat { ++ out := &nat{make([]uint, len(x.limbs))} ++ copy(out.limbs, x.limbs) ++ return out ++} ++ ++// natFromBig creates a new natural number from a big.Int. ++// ++// The announced length of the resulting nat is based on the actual bit size of ++// the input, ignoring leading zeroes. ++func natFromBig(x *big.Int) *nat { ++ xLimbs := x.Bits() ++ bitSize := bigBitLen(x) ++ requiredLimbs := (bitSize + _W - 1) / _W ++ ++ out := &nat{make([]uint, requiredLimbs)} ++ outI := 0 ++ shift := 0 ++ for i := range xLimbs { ++ xi := uint(xLimbs[i]) ++ out.limbs[outI] |= (xi << shift) & _MASK ++ outI++ ++ if outI == requiredLimbs { ++ return out ++ } ++ out.limbs[outI] = xi >> (_W - shift) ++ shift++ // this assumes bits.UintSize - _W = 1 ++ if shift == _W { ++ shift = 0 ++ outI++ ++ } ++ } ++ return out ++} ++ ++// fillBytes sets bytes to x as a zero-extended big-endian byte slice. ++// ++// If bytes is not long enough to contain the number or at least len(x.limbs)-1 ++// limbs, or has zero length, fillBytes will panic. ++func (x *nat) fillBytes(bytes []byte) []byte { ++ if len(bytes) == 0 { ++ panic("nat: fillBytes invoked with too small buffer") ++ } ++ for i := range bytes { ++ bytes[i] = 0 ++ } ++ shift := 0 ++ outI := len(bytes) - 1 ++ for i, limb := range x.limbs { ++ remainingBits := _W ++ for remainingBits >= 8 { ++ bytes[outI] |= byte(limb) << shift ++ consumed := 8 - shift ++ limb >>= consumed ++ remainingBits -= consumed ++ shift = 0 ++ outI-- ++ if outI < 0 { ++ if limb != 0 || i < len(x.limbs)-1 { ++ panic("nat: fillBytes invoked with too small buffer") ++ } ++ return bytes ++ } ++ } ++ bytes[outI] = byte(limb) ++ shift = remainingBits ++ } ++ return bytes ++} ++ ++// natFromBytes converts a slice of big-endian bytes into a nat. ++// ++// The announced length of the output depends on the length of bytes. Unlike ++// big.Int, creating a nat will not remove leading zeros. ++func natFromBytes(bytes []byte) *nat { ++ bitSize := len(bytes) * 8 ++ requiredLimbs := (bitSize + _W - 1) / _W ++ ++ out := &nat{make([]uint, requiredLimbs)} ++ outI := 0 ++ shift := 0 ++ for i := len(bytes) - 1; i >= 0; i-- { ++ bi := bytes[i] ++ out.limbs[outI] |= uint(bi) << shift ++ shift += 8 ++ if shift >= _W { ++ shift -= _W ++ out.limbs[outI] &= _MASK ++ outI++ ++ if shift > 0 { ++ out.limbs[outI] = uint(bi) >> (8 - shift) ++ } ++ } ++ } ++ return out ++} ++ ++// cmpEq returns 1 if x == y, and 0 otherwise. ++// ++// Both operands must have the same announced length. ++func (x *nat) cmpEq(y *nat) choice { ++ // Eliminate bounds checks in the loop. ++ size := len(x.limbs) ++ xLimbs := x.limbs[:size] ++ yLimbs := y.limbs[:size] ++ ++ equal := yes ++ for i := 0; i < size; i++ { ++ equal &= ctEq(xLimbs[i], yLimbs[i]) ++ } ++ return equal ++} ++ ++// cmpGeq returns 1 if x >= y, and 0 otherwise. ++// ++// Both operands must have the same announced length. ++func (x *nat) cmpGeq(y *nat) choice { ++ // Eliminate bounds checks in the loop. ++ size := len(x.limbs) ++ xLimbs := x.limbs[:size] ++ yLimbs := y.limbs[:size] ++ ++ var c uint ++ for i := 0; i < size; i++ { ++ c = (xLimbs[i] - yLimbs[i] - c) >> _W ++ } ++ // If there was a carry, then subtracting y underflowed, so ++ // x is not greater than or equal to y. ++ return not(choice(c)) ++} ++ ++// assign sets x <- y if on == 1, and does nothing otherwise. ++// ++// Both operands must have the same announced length. ++func (x *nat) assign(on choice, y *nat) *nat { ++ // Eliminate bounds checks in the loop. ++ size := len(x.limbs) ++ xLimbs := x.limbs[:size] ++ yLimbs := y.limbs[:size] ++ ++ for i := 0; i < size; i++ { ++ xLimbs[i] = ctSelect(on, yLimbs[i], xLimbs[i]) ++ } ++ return x ++} ++ ++// add computes x += y if on == 1, and does nothing otherwise. It returns the ++// carry of the addition regardless of on. ++// ++// Both operands must have the same announced length. ++func (x *nat) add(on choice, y *nat) (c uint) { ++ // Eliminate bounds checks in the loop. ++ size := len(x.limbs) ++ xLimbs := x.limbs[:size] ++ yLimbs := y.limbs[:size] ++ ++ for i := 0; i < size; i++ { ++ res := xLimbs[i] + yLimbs[i] + c ++ xLimbs[i] = ctSelect(on, res&_MASK, xLimbs[i]) ++ c = res >> _W ++ } ++ return ++} ++ ++// sub computes x -= y if on == 1, and does nothing otherwise. It returns the ++// borrow of the subtraction regardless of on. ++// ++// Both operands must have the same announced length. ++func (x *nat) sub(on choice, y *nat) (c uint) { ++ // Eliminate bounds checks in the loop. ++ size := len(x.limbs) ++ xLimbs := x.limbs[:size] ++ yLimbs := y.limbs[:size] ++ ++ for i := 0; i < size; i++ { ++ res := xLimbs[i] - yLimbs[i] - c ++ xLimbs[i] = ctSelect(on, res&_MASK, xLimbs[i]) ++ c = res >> _W ++ } ++ return ++} ++ ++// modulus is used for modular arithmetic, precomputing relevant constants. ++// ++// Moduli are assumed to be odd numbers. Moduli can also leak the exact ++// number of bits needed to store their value, and are stored without padding. ++// ++// Their actual value is still kept secret. ++type modulus struct { ++ // The underlying natural number for this modulus. ++ // ++ // This will be stored without any padding, and shouldn't alias with any ++ // other natural number being used. ++ nat *nat ++ leading int // number of leading zeros in the modulus ++ m0inv uint // -nat.limbs[0]⁻¹ mod _W ++} ++ ++// minusInverseModW computes -x⁻¹ mod _W with x odd. ++// ++// This operation is used to precompute a constant involved in Montgomery ++// multiplication. ++func minusInverseModW(x uint) uint { ++ // Every iteration of this loop doubles the least-significant bits of ++ // correct inverse in y. The first three bits are already correct (1⁻¹ = 1, ++ // 3⁻¹ = 3, 5⁻¹ = 5, and 7⁻¹ = 7 mod 8), so doubling five times is enough ++ // for 61 bits (and wastes only one iteration for 31 bits). ++ // ++ // See https://crypto.stackexchange.com/a/47496. ++ y := x ++ for i := 0; i < 5; i++ { ++ y = y * (2 - x*y) ++ } ++ return (1 << _W) - (y & _MASK) ++} ++ ++// modulusFromNat creates a new modulus from a nat. ++// ++// The nat should be odd, nonzero, and the number of significant bits in the ++// number should be leakable. The nat shouldn't be reused. ++func modulusFromNat(nat *nat) *modulus { ++ m := &modulus{} ++ m.nat = nat ++ size := len(m.nat.limbs) ++ for m.nat.limbs[size-1] == 0 { ++ size-- ++ } ++ m.nat.limbs = m.nat.limbs[:size] ++ m.leading = _W - bitLen(m.nat.limbs[size-1]) ++ m.m0inv = minusInverseModW(m.nat.limbs[0]) ++ return m ++} ++ ++// bitLen is a version of bits.Len that only leaks the bit length of n, but not ++// its value. bits.Len and bits.LeadingZeros use a lookup table for the ++// low-order bits on some architectures. ++func bitLen(n uint) int { ++ var len int ++ // We assume, here and elsewhere, that comparison to zero is constant time ++ // with respect to different non-zero values. ++ for n != 0 { ++ len++ ++ n >>= 1 ++ } ++ return len ++} ++ ++// bigBitLen is a version of big.Int.BitLen that only leaks the bit length of x, ++// but not its value. big.Int.BitLen uses bits.Len. ++func bigBitLen(x *big.Int) int { ++ xLimbs := x.Bits() ++ fullLimbs := len(xLimbs) - 1 ++ topLimb := uint(xLimbs[len(xLimbs)-1]) ++ return fullLimbs*bits.UintSize + bitLen(topLimb) ++} ++ ++// modulusSize returns the size of m in bytes. ++func modulusSize(m *modulus) int { ++ bits := len(m.nat.limbs)*_W - int(m.leading) ++ return (bits + 7) / 8 ++} ++ ++// shiftIn calculates x = x << _W + y mod m. ++// ++// This assumes that x is already reduced mod m, and that y < 2^_W. ++func (x *nat) shiftIn(y uint, m *modulus) *nat { ++ d := new(nat).resetFor(m) ++ ++ // Eliminate bounds checks in the loop. ++ size := len(m.nat.limbs) ++ xLimbs := x.limbs[:size] ++ dLimbs := d.limbs[:size] ++ mLimbs := m.nat.limbs[:size] ++ ++ // Each iteration of this loop computes x = 2x + b mod m, where b is a bit ++ // from y. Effectively, it left-shifts x and adds y one bit at a time, ++ // reducing it every time. ++ // ++ // To do the reduction, each iteration computes both 2x + b and 2x + b - m. ++ // The next iteration (and finally the return line) will use either result ++ // based on whether the subtraction underflowed. ++ needSubtraction := no ++ for i := _W - 1; i >= 0; i-- { ++ carry := (y >> i) & 1 ++ var borrow uint ++ for i := 0; i < size; i++ { ++ l := ctSelect(needSubtraction, dLimbs[i], xLimbs[i]) ++ ++ res := l<<1 + carry ++ xLimbs[i] = res & _MASK ++ carry = res >> _W ++ ++ res = xLimbs[i] - mLimbs[i] - borrow ++ dLimbs[i] = res & _MASK ++ borrow = res >> _W ++ } ++ // See modAdd for how carry (aka overflow), borrow (aka underflow), and ++ // needSubtraction relate. ++ needSubtraction = ctEq(carry, borrow) ++ } ++ return x.assign(needSubtraction, d) ++} ++ ++// mod calculates out = x mod m. ++// ++// This works regardless how large the value of x is. ++// ++// The output will be resized to the size of m and overwritten. ++func (out *nat) mod(x *nat, m *modulus) *nat { ++ out.resetFor(m) ++ // Working our way from the most significant to the least significant limb, ++ // we can insert each limb at the least significant position, shifting all ++ // previous limbs left by _W. This way each limb will get shifted by the ++ // correct number of bits. We can insert at least N - 1 limbs without ++ // overflowing m. After that, we need to reduce every time we shift. ++ i := len(x.limbs) - 1 ++ // For the first N - 1 limbs we can skip the actual shifting and position ++ // them at the shifted position, which starts at min(N - 2, i). ++ start := len(m.nat.limbs) - 2 ++ if i < start { ++ start = i ++ } ++ for j := start; j >= 0; j-- { ++ out.limbs[j] = x.limbs[i] ++ i-- ++ } ++ // We shift in the remaining limbs, reducing modulo m each time. ++ for i >= 0 { ++ out.shiftIn(x.limbs[i], m) ++ i-- ++ } ++ return out ++} ++ ++// expandFor ensures out has the right size to work with operations modulo m. ++// ++// This assumes that out has as many or fewer limbs than m, or that the extra ++// limbs are all zero (which may happen when decoding a value that has leading ++// zeroes in its bytes representation that spill over the limb threshold). ++func (out *nat) expandFor(m *modulus) *nat { ++ return out.expand(len(m.nat.limbs)) ++} ++ ++// resetFor ensures out has the right size to work with operations modulo m. ++// ++// out is zeroed and may start at any size. ++func (out *nat) resetFor(m *modulus) *nat { ++ return out.reset(len(m.nat.limbs)) ++} ++ ++// modSub computes x = x - y mod m. ++// ++// The length of both operands must be the same as the modulus. Both operands ++// must already be reduced modulo m. ++func (x *nat) modSub(y *nat, m *modulus) *nat { ++ underflow := x.sub(yes, y) ++ // If the subtraction underflowed, add m. ++ x.add(choice(underflow), m.nat) ++ return x ++} ++ ++// modAdd computes x = x + y mod m. ++// ++// The length of both operands must be the same as the modulus. Both operands ++// must already be reduced modulo m. ++func (x *nat) modAdd(y *nat, m *modulus) *nat { ++ overflow := x.add(yes, y) ++ underflow := not(x.cmpGeq(m.nat)) // x < m ++ ++ // Three cases are possible: ++ // ++ // - overflow = 0, underflow = 0 ++ // ++ // In this case, addition fits in our limbs, but we can still subtract away ++ // m without an underflow, so we need to perform the subtraction to reduce ++ // our result. ++ // ++ // - overflow = 0, underflow = 1 ++ // ++ // The addition fits in our limbs, but we can't subtract m without ++ // underflowing. The result is already reduced. ++ // ++ // - overflow = 1, underflow = 1 ++ // ++ // The addition does not fit in our limbs, and the subtraction's borrow ++ // would cancel out with the addition's carry. We need to subtract m to ++ // reduce our result. ++ // ++ // The overflow = 1, underflow = 0 case is not possible, because y is at ++ // most m - 1, and if adding m - 1 overflows, then subtracting m must ++ // necessarily underflow. ++ needSubtraction := ctEq(overflow, uint(underflow)) ++ ++ x.sub(needSubtraction, m.nat) ++ return x ++} ++ ++// montgomeryRepresentation calculates x = x * R mod m, with R = 2^(_W * n) and ++// n = len(m.nat.limbs). ++// ++// Faster Montgomery multiplication replaces standard modular multiplication for ++// numbers in this representation. ++// ++// This assumes that x is already reduced mod m. ++func (x *nat) montgomeryRepresentation(m *modulus) *nat { ++ for i := 0; i < len(m.nat.limbs); i++ { ++ x.shiftIn(0, m) // x = x * 2^_W mod m ++ } ++ return x ++} ++ ++// montgomeryMul calculates d = a * b / R mod m, with R = 2^(_W * n) and ++// n = len(m.nat.limbs), using the Montgomery Multiplication technique. ++// ++// All inputs should be the same length, not aliasing d, and already ++// reduced modulo m. d will be resized to the size of m and overwritten. ++func (d *nat) montgomeryMul(a *nat, b *nat, m *modulus) *nat { ++ // See https://bearssl.org/bigint.html#montgomery-reduction-and-multiplication ++ // for a description of the algorithm. ++ ++ // Eliminate bounds checks in the loop. ++ size := len(m.nat.limbs) ++ aLimbs := a.limbs[:size] ++ bLimbs := b.limbs[:size] ++ dLimbs := d.resetFor(m).limbs[:size] ++ mLimbs := m.nat.limbs[:size] ++ ++ var overflow uint ++ for i := 0; i < size; i++ { ++ f := ((dLimbs[0] + aLimbs[i]*bLimbs[0]) * m.m0inv) & _MASK ++ carry := uint(0) ++ for j := 0; j < size; j++ { ++ // z = d[j] + a[i] * b[j] + f * m[j] + carry <= 2^(2W+1) - 2^(W+1) + 2^W ++ hi, lo := bits.Mul(aLimbs[i], bLimbs[j]) ++ z_lo, c := bits.Add(dLimbs[j], lo, 0) ++ z_hi, _ := bits.Add(0, hi, c) ++ hi, lo = bits.Mul(f, mLimbs[j]) ++ z_lo, c = bits.Add(z_lo, lo, 0) ++ z_hi, _ = bits.Add(z_hi, hi, c) ++ z_lo, c = bits.Add(z_lo, carry, 0) ++ z_hi, _ = bits.Add(z_hi, 0, c) ++ if j > 0 { ++ dLimbs[j-1] = z_lo & _MASK ++ } ++ carry = z_hi<<1 | z_lo>>_W // carry <= 2^(W+1) - 2 ++ } ++ z := overflow + carry // z <= 2^(W+1) - 1 ++ dLimbs[size-1] = z & _MASK ++ overflow = z >> _W // overflow <= 1 ++ } ++ // See modAdd for how overflow, underflow, and needSubtraction relate. ++ underflow := not(d.cmpGeq(m.nat)) // d < m ++ needSubtraction := ctEq(overflow, uint(underflow)) ++ d.sub(needSubtraction, m.nat) ++ ++ return d ++} ++ ++// modMul calculates x *= y mod m. ++// ++// x and y must already be reduced modulo m, they must share its announced ++// length, and they may not alias. ++func (x *nat) modMul(y *nat, m *modulus) *nat { ++ // A Montgomery multiplication by a value out of the Montgomery domain ++ // takes the result out of Montgomery representation. ++ xR := x.clone().montgomeryRepresentation(m) // xR = x * R mod m ++ return x.montgomeryMul(xR, y, m) // x = xR * y / R mod m ++} ++ ++// exp calculates out = x^e mod m. ++// ++// The exponent e is represented in big-endian order. The output will be resized ++// to the size of m and overwritten. x must already be reduced modulo m. ++func (out *nat) exp(x *nat, e []byte, m *modulus) *nat { ++ // We use a 4 bit window. For our RSA workload, 4 bit windows are faster ++ // than 2 bit windows, but use an extra 12 nats worth of scratch space. ++ // Using bit sizes that don't divide 8 are more complex to implement. ++ table := make([]*nat, (1<<4)-1) // table[i] = x ^ (i+1) ++ table[0] = x.clone().montgomeryRepresentation(m) ++ for i := 1; i < len(table); i++ { ++ table[i] = new(nat).expandFor(m) ++ table[i].montgomeryMul(table[i-1], table[0], m) ++ } ++ ++ out.resetFor(m) ++ out.limbs[0] = 1 ++ out.montgomeryRepresentation(m) ++ t0 := new(nat).expandFor(m) ++ t1 := new(nat).expandFor(m) ++ for _, b := range e { ++ for _, j := range []int{4, 0} { ++ // Square four times. ++ t1.montgomeryMul(out, out, m) ++ out.montgomeryMul(t1, t1, m) ++ t1.montgomeryMul(out, out, m) ++ out.montgomeryMul(t1, t1, m) ++ ++ // Select x^k in constant time from the table. ++ k := uint((b >> j) & 0b1111) ++ for i := range table { ++ t0.assign(ctEq(k, uint(i+1)), table[i]) ++ } ++ ++ // Multiply by x^k, discarding the result if k = 0. ++ t1.montgomeryMul(out, t0, m) ++ out.assign(not(ctEq(k, 0)), t1) ++ } ++ } ++ ++ // By Montgomery multiplying with 1 not in Montgomery representation, we ++ // convert out back from Montgomery representation, because it works out to ++ // dividing by R. ++ t0.assign(yes, out) ++ t1.resetFor(m) ++ t1.limbs[0] = 1 ++ out.montgomeryMul(t0, t1, m) ++ ++ return out ++} +diff --git a/src/crypto/rsa/nat_test.go b/src/crypto/rsa/nat_test.go +new file mode 100644 +index 0000000..3e6eb10 +--- /dev/null ++++ b/src/crypto/rsa/nat_test.go +@@ -0,0 +1,384 @@ ++// Copyright 2021 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++package rsa ++ ++import ( ++ "bytes" ++ "math/big" ++ "math/bits" ++ "math/rand" ++ "reflect" ++ "testing" ++ "testing/quick" ++) ++ ++// Generate generates an even nat. It's used by testing/quick to produce random ++// *nat values for quick.Check invocations. ++func (*nat) Generate(r *rand.Rand, size int) reflect.Value { ++ limbs := make([]uint, size) ++ for i := 0; i < size; i++ { ++ limbs[i] = uint(r.Uint64()) & ((1 << _W) - 2) ++ } ++ return reflect.ValueOf(&nat{limbs}) ++} ++ ++func testModAddCommutative(a *nat, b *nat) bool { ++ mLimbs := make([]uint, len(a.limbs)) ++ for i := 0; i < len(mLimbs); i++ { ++ mLimbs[i] = _MASK ++ } ++ m := modulusFromNat(&nat{mLimbs}) ++ aPlusB := a.clone() ++ aPlusB.modAdd(b, m) ++ bPlusA := b.clone() ++ bPlusA.modAdd(a, m) ++ return aPlusB.cmpEq(bPlusA) == 1 ++} ++ ++func TestModAddCommutative(t *testing.T) { ++ err := quick.Check(testModAddCommutative, &quick.Config{}) ++ if err != nil { ++ t.Error(err) ++ } ++} ++ ++func testModSubThenAddIdentity(a *nat, b *nat) bool { ++ mLimbs := make([]uint, len(a.limbs)) ++ for i := 0; i < len(mLimbs); i++ { ++ mLimbs[i] = _MASK ++ } ++ m := modulusFromNat(&nat{mLimbs}) ++ original := a.clone() ++ a.modSub(b, m) ++ a.modAdd(b, m) ++ return a.cmpEq(original) == 1 ++} ++ ++func TestModSubThenAddIdentity(t *testing.T) { ++ err := quick.Check(testModSubThenAddIdentity, &quick.Config{}) ++ if err != nil { ++ t.Error(err) ++ } ++} ++ ++func testMontgomeryRoundtrip(a *nat) bool { ++ one := &nat{make([]uint, len(a.limbs))} ++ one.limbs[0] = 1 ++ aPlusOne := a.clone() ++ aPlusOne.add(1, one) ++ m := modulusFromNat(aPlusOne) ++ monty := a.clone() ++ monty.montgomeryRepresentation(m) ++ aAgain := monty.clone() ++ aAgain.montgomeryMul(monty, one, m) ++ return a.cmpEq(aAgain) == 1 ++} ++ ++func TestMontgomeryRoundtrip(t *testing.T) { ++ err := quick.Check(testMontgomeryRoundtrip, &quick.Config{}) ++ if err != nil { ++ t.Error(err) ++ } ++} ++ ++func TestFromBig(t *testing.T) { ++ expected := []byte{0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff} ++ theBig := new(big.Int).SetBytes(expected) ++ actual := natFromBig(theBig).fillBytes(make([]byte, len(expected))) ++ if !bytes.Equal(actual, expected) { ++ t.Errorf("%+x != %+x", actual, expected) ++ } ++} ++ ++func TestFillBytes(t *testing.T) { ++ xBytes := []byte{0xAA, 0xFF, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88} ++ x := natFromBytes(xBytes) ++ for l := 20; l >= len(xBytes); l-- { ++ buf := make([]byte, l) ++ rand.Read(buf) ++ actual := x.fillBytes(buf) ++ expected := make([]byte, l) ++ copy(expected[l-len(xBytes):], xBytes) ++ if !bytes.Equal(actual, expected) { ++ t.Errorf("%d: %+v != %+v", l, actual, expected) ++ } ++ } ++ for l := len(xBytes) - 1; l >= 0; l-- { ++ (func() { ++ defer func() { ++ if recover() == nil { ++ t.Errorf("%d: expected panic", l) ++ } ++ }() ++ x.fillBytes(make([]byte, l)) ++ })() ++ } ++} ++ ++func TestFromBytes(t *testing.T) { ++ f := func(xBytes []byte) bool { ++ if len(xBytes) == 0 { ++ return true ++ } ++ actual := natFromBytes(xBytes).fillBytes(make([]byte, len(xBytes))) ++ if !bytes.Equal(actual, xBytes) { ++ t.Errorf("%+x != %+x", actual, xBytes) ++ return false ++ } ++ return true ++ } ++ ++ err := quick.Check(f, &quick.Config{}) ++ if err != nil { ++ t.Error(err) ++ } ++ ++ f([]byte{0xFF, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}) ++ f(bytes.Repeat([]byte{0xFF}, _W)) ++} ++ ++func TestShiftIn(t *testing.T) { ++ if bits.UintSize != 64 { ++ t.Skip("examples are only valid in 64 bit") ++ } ++ examples := []struct { ++ m, x, expected []byte ++ y uint64 ++ }{{ ++ m: []byte{13}, ++ x: []byte{0}, ++ y: 0x7FFF_FFFF_FFFF_FFFF, ++ expected: []byte{7}, ++ }, { ++ m: []byte{13}, ++ x: []byte{7}, ++ y: 0x7FFF_FFFF_FFFF_FFFF, ++ expected: []byte{11}, ++ }, { ++ m: []byte{0x06, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d}, ++ x: make([]byte, 9), ++ y: 0x7FFF_FFFF_FFFF_FFFF, ++ expected: []byte{0x00, 0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, ++ }, { ++ m: []byte{0x06, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d}, ++ x: []byte{0x00, 0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, ++ y: 0, ++ expected: []byte{0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08}, ++ }} ++ ++ for i, tt := range examples { ++ m := modulusFromNat(natFromBytes(tt.m)) ++ got := natFromBytes(tt.x).expandFor(m).shiftIn(uint(tt.y), m) ++ if got.cmpEq(natFromBytes(tt.expected).expandFor(m)) != 1 { ++ t.Errorf("%d: got %x, expected %x", i, got, tt.expected) ++ } ++ } ++} ++ ++func TestModulusAndNatSizes(t *testing.T) { ++ // These are 126 bit (2 * _W on 64-bit architectures) values, serialized as ++ // 128 bits worth of bytes. If leading zeroes are stripped, they fit in two ++ // limbs, if they are not, they fit in three. This can be a problem because ++ // modulus strips leading zeroes and nat does not. ++ m := modulusFromNat(natFromBytes([]byte{ ++ 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, ++ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff})) ++ x := natFromBytes([]byte{ ++ 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, ++ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe}) ++ x.expandFor(m) // must not panic for shrinking ++} ++ ++func TestExpand(t *testing.T) { ++ sliced := []uint{1, 2, 3, 4} ++ examples := []struct { ++ in []uint ++ n int ++ out []uint ++ }{{ ++ []uint{1, 2}, ++ 4, ++ []uint{1, 2, 0, 0}, ++ }, { ++ sliced[:2], ++ 4, ++ []uint{1, 2, 0, 0}, ++ }, { ++ []uint{1, 2}, ++ 2, ++ []uint{1, 2}, ++ }, { ++ []uint{1, 2, 0}, ++ 2, ++ []uint{1, 2}, ++ }} ++ ++ for i, tt := range examples { ++ got := (&nat{tt.in}).expand(tt.n) ++ if len(got.limbs) != len(tt.out) || got.cmpEq(&nat{tt.out}) != 1 { ++ t.Errorf("%d: got %x, expected %x", i, got, tt.out) ++ } ++ } ++} ++ ++func TestMod(t *testing.T) { ++ m := modulusFromNat(natFromBytes([]byte{0x06, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d})) ++ x := natFromBytes([]byte{0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01}) ++ out := new(nat) ++ out.mod(x, m) ++ expected := natFromBytes([]byte{0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09}) ++ if out.cmpEq(expected) != 1 { ++ t.Errorf("%+v != %+v", out, expected) ++ } ++} ++ ++func TestModSub(t *testing.T) { ++ m := modulusFromNat(&nat{[]uint{13}}) ++ x := &nat{[]uint{6}} ++ y := &nat{[]uint{7}} ++ x.modSub(y, m) ++ expected := &nat{[]uint{12}} ++ if x.cmpEq(expected) != 1 { ++ t.Errorf("%+v != %+v", x, expected) ++ } ++ x.modSub(y, m) ++ expected = &nat{[]uint{5}} ++ if x.cmpEq(expected) != 1 { ++ t.Errorf("%+v != %+v", x, expected) ++ } ++} ++ ++func TestModAdd(t *testing.T) { ++ m := modulusFromNat(&nat{[]uint{13}}) ++ x := &nat{[]uint{6}} ++ y := &nat{[]uint{7}} ++ x.modAdd(y, m) ++ expected := &nat{[]uint{0}} ++ if x.cmpEq(expected) != 1 { ++ t.Errorf("%+v != %+v", x, expected) ++ } ++ x.modAdd(y, m) ++ expected = &nat{[]uint{7}} ++ if x.cmpEq(expected) != 1 { ++ t.Errorf("%+v != %+v", x, expected) ++ } ++} ++ ++func TestExp(t *testing.T) { ++ m := modulusFromNat(&nat{[]uint{13}}) ++ x := &nat{[]uint{3}} ++ out := &nat{[]uint{0}} ++ out.exp(x, []byte{12}, m) ++ expected := &nat{[]uint{1}} ++ if out.cmpEq(expected) != 1 { ++ t.Errorf("%+v != %+v", out, expected) ++ } ++} ++ ++func makeBenchmarkModulus() *modulus { ++ m := make([]uint, 32) ++ for i := 0; i < 32; i++ { ++ m[i] = _MASK ++ } ++ return modulusFromNat(&nat{limbs: m}) ++} ++ ++func makeBenchmarkValue() *nat { ++ x := make([]uint, 32) ++ for i := 0; i < 32; i++ { ++ x[i] = _MASK - 1 ++ } ++ return &nat{limbs: x} ++} ++ ++func makeBenchmarkExponent() []byte { ++ e := make([]byte, 256) ++ for i := 0; i < 32; i++ { ++ e[i] = 0xFF ++ } ++ return e ++} ++ ++func BenchmarkModAdd(b *testing.B) { ++ x := makeBenchmarkValue() ++ y := makeBenchmarkValue() ++ m := makeBenchmarkModulus() ++ ++ b.ResetTimer() ++ for i := 0; i < b.N; i++ { ++ x.modAdd(y, m) ++ } ++} ++ ++func BenchmarkModSub(b *testing.B) { ++ x := makeBenchmarkValue() ++ y := makeBenchmarkValue() ++ m := makeBenchmarkModulus() ++ ++ b.ResetTimer() ++ for i := 0; i < b.N; i++ { ++ x.modSub(y, m) ++ } ++} ++ ++func BenchmarkMontgomeryRepr(b *testing.B) { ++ x := makeBenchmarkValue() ++ m := makeBenchmarkModulus() ++ ++ b.ResetTimer() ++ for i := 0; i < b.N; i++ { ++ x.montgomeryRepresentation(m) ++ } ++} ++ ++func BenchmarkMontgomeryMul(b *testing.B) { ++ x := makeBenchmarkValue() ++ y := makeBenchmarkValue() ++ out := makeBenchmarkValue() ++ m := makeBenchmarkModulus() ++ ++ b.ResetTimer() ++ for i := 0; i < b.N; i++ { ++ out.montgomeryMul(x, y, m) ++ } ++} ++ ++func BenchmarkModMul(b *testing.B) { ++ x := makeBenchmarkValue() ++ y := makeBenchmarkValue() ++ m := makeBenchmarkModulus() ++ ++ b.ResetTimer() ++ for i := 0; i < b.N; i++ { ++ x.modMul(y, m) ++ } ++} ++ ++func BenchmarkExpBig(b *testing.B) { ++ out := new(big.Int) ++ exponentBytes := makeBenchmarkExponent() ++ x := new(big.Int).SetBytes(exponentBytes) ++ e := new(big.Int).SetBytes(exponentBytes) ++ n := new(big.Int).SetBytes(exponentBytes) ++ one := new(big.Int).SetUint64(1) ++ n.Add(n, one) ++ ++ b.ResetTimer() ++ for i := 0; i < b.N; i++ { ++ out.Exp(x, e, n) ++ } ++} ++ ++func BenchmarkExp(b *testing.B) { ++ x := makeBenchmarkValue() ++ e := makeBenchmarkExponent() ++ out := makeBenchmarkValue() ++ m := makeBenchmarkModulus() ++ ++ b.ResetTimer() ++ for i := 0; i < b.N; i++ { ++ out.exp(x, e, m) ++ } ++} +diff --git a/src/crypto/rsa/pkcs1v15.go b/src/crypto/rsa/pkcs1v15.go +index 0cbd6d0..90233bb 100644 +--- a/src/crypto/rsa/pkcs1v15.go ++++ b/src/crypto/rsa/pkcs1v15.go +@@ -9,7 +9,6 @@ import ( + "crypto/subtle" + "errors" + "io" +- "math/big" + + "crypto/internal/randutil" + ) +@@ -58,14 +57,11 @@ func EncryptPKCS1v15(rand io.Reader, pub *PublicKey, msg []byte) ([]byte, error) + em[len(em)-len(msg)-1] = 0 + copy(mm, msg) + +- m := new(big.Int).SetBytes(em) +- c := encrypt(new(big.Int), pub, m) +- +- return c.FillBytes(em), nil ++ return encrypt(pub, em), nil + } + + // DecryptPKCS1v15 decrypts a plaintext using RSA and the padding scheme from PKCS #1 v1.5. +-// If rand != nil, it uses RSA blinding to avoid timing side-channel attacks. ++// The random parameter is legacy and ignored, and it can be as nil. + // + // Note that whether this function returns an error or not discloses secret + // information. If an attacker can cause this function to run repeatedly and +@@ -76,7 +72,7 @@ func DecryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) ([]byt + if err := checkPub(&priv.PublicKey); err != nil { + return nil, err + } +- valid, out, index, err := decryptPKCS1v15(rand, priv, ciphertext) ++ valid, out, index, err := decryptPKCS1v15(priv, ciphertext) + if err != nil { + return nil, err + } +@@ -87,7 +83,7 @@ func DecryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) ([]byt + } + + // DecryptPKCS1v15SessionKey decrypts a session key using RSA and the padding scheme from PKCS #1 v1.5. +-// If rand != nil, it uses RSA blinding to avoid timing side-channel attacks. ++// The random parameter is legacy and ignored, and it can be as nil. + // It returns an error if the ciphertext is the wrong length or if the + // ciphertext is greater than the public modulus. Otherwise, no error is + // returned. If the padding is valid, the resulting plaintext message is copied +@@ -114,7 +110,7 @@ func DecryptPKCS1v15SessionKey(rand io.Reader, priv *PrivateKey, ciphertext []by + return ErrDecryption + } + +- valid, em, index, err := decryptPKCS1v15(rand, priv, ciphertext) ++ valid, em, index, err := decryptPKCS1v15(priv, ciphertext) + if err != nil { + return err + } +@@ -130,26 +126,24 @@ func DecryptPKCS1v15SessionKey(rand io.Reader, priv *PrivateKey, ciphertext []by + return nil + } + +-// decryptPKCS1v15 decrypts ciphertext using priv and blinds the operation if +-// rand is not nil. It returns one or zero in valid that indicates whether the +-// plaintext was correctly structured. In either case, the plaintext is +-// returned in em so that it may be read independently of whether it was valid +-// in order to maintain constant memory access patterns. If the plaintext was +-// valid then index contains the index of the original message in em. +-func decryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) (valid int, em []byte, index int, err error) { ++// decryptPKCS1v15 decrypts ciphertext using priv. It returns one or zero in ++// valid that indicates whether the plaintext was correctly structured. ++// In either case, the plaintext is returned in em so that it may be read ++// independently of whether it was valid in order to maintain constant memory ++// access patterns. If the plaintext was valid then index contains the index of ++// the original message in em, to allow constant time padding removal. ++func decryptPKCS1v15(priv *PrivateKey, ciphertext []byte) (valid int, em []byte, index int, err error) { + k := priv.Size() + if k < 11 { + err = ErrDecryption + return + } + +- c := new(big.Int).SetBytes(ciphertext) +- m, err := decrypt(rand, priv, c) ++ em, err = decrypt(priv, ciphertext) + if err != nil { + return + } + +- em = m.FillBytes(make([]byte, k)) + firstByteIsZero := subtle.ConstantTimeByteEq(em[0], 0) + secondByteIsTwo := subtle.ConstantTimeByteEq(em[1], 2) + +@@ -221,8 +215,7 @@ var hashPrefixes = map[crypto.Hash][]byte{ + // function. If hash is zero, hashed is signed directly. This isn't + // advisable except for interoperability. + // +-// If rand is not nil then RSA blinding will be used to avoid timing +-// side-channel attacks. ++// The random parameter is legacy and ignored, and it can be as nil. + // + // This function is deterministic. Thus, if the set of possible + // messages is small, an attacker may be able to build a map from +@@ -249,13 +242,7 @@ func SignPKCS1v15(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []b + copy(em[k-tLen:k-hashLen], prefix) + copy(em[k-hashLen:k], hashed) + +- m := new(big.Int).SetBytes(em) +- c, err := decryptAndCheck(rand, priv, m) +- if err != nil { +- return nil, err +- } +- +- return c.FillBytes(em), nil ++ return decryptAndCheck(priv, em) + } + + // VerifyPKCS1v15 verifies an RSA PKCS #1 v1.5 signature. +@@ -282,9 +269,7 @@ func VerifyPKCS1v15(pub *PublicKey, hash crypto.Hash, hashed []byte, sig []byte) + return ErrVerification + } + +- c := new(big.Int).SetBytes(sig) +- m := encrypt(new(big.Int), pub, c) +- em := m.FillBytes(make([]byte, k)) ++ em := encrypt(pub, sig) + // EM = 0x00 || 0x01 || PS || 0x00 || T + + ok := subtle.ConstantTimeByteEq(em[0], 0) +diff --git a/src/crypto/rsa/pss.go b/src/crypto/rsa/pss.go +index 814522d..aeb6148 100644 +--- a/src/crypto/rsa/pss.go ++++ b/src/crypto/rsa/pss.go +@@ -12,7 +12,6 @@ import ( + "errors" + "hash" + "io" +- "math/big" + ) + + // Per RFC 8017, Section 9.1 +@@ -207,19 +206,26 @@ func emsaPSSVerify(mHash, em []byte, emBits, sLen int, hash hash.Hash) error { + // Note that hashed must be the result of hashing the input message using the + // given hash function. salt is a random sequence of bytes whose length will be + // later used to verify the signature. +-func signPSSWithSalt(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed, salt []byte) ([]byte, error) { +- emBits := priv.N.BitLen() - 1 ++func signPSSWithSalt(priv *PrivateKey, hash crypto.Hash, hashed, salt []byte) ([]byte, error) { ++ emBits := bigBitLen(priv.N) - 1 + em, err := emsaPSSEncode(hashed, emBits, salt, hash.New()) + if err != nil { + return nil, err + } +- m := new(big.Int).SetBytes(em) +- c, err := decryptAndCheck(rand, priv, m) +- if err != nil { +- return nil, err ++ // RFC 8017: "Note that the octet length of EM will be one less than k if ++ // modBits - 1 is divisible by 8 and equal to k otherwise, where k is the ++ // length in octets of the RSA modulus n." ++ // ++ // This is extremely annoying, as all other encrypt and decrypt inputs are ++ // always the exact same size as the modulus. Since it only happens for ++ // weird modulus sizes, fix it by padding inefficiently. ++ if emLen, k := len(em), priv.Size(); emLen < k { ++ emNew := make([]byte, k) ++ copy(emNew[k-emLen:], em) ++ em = emNew + } +- s := make([]byte, priv.Size()) +- return c.FillBytes(s), nil ++ ++ return decryptAndCheck(priv, em) + } + + const ( +@@ -269,7 +275,7 @@ func SignPSS(rand io.Reader, priv *PrivateKey, hash crypto.Hash, digest []byte, + saltLength := opts.saltLength() + switch saltLength { + case PSSSaltLengthAuto: +- saltLength = (priv.N.BitLen()-1+7)/8 - 2 - hash.Size() ++ saltLength = (bigBitLen(priv.N)-1+7)/8 - 2 - hash.Size() + case PSSSaltLengthEqualsHash: + saltLength = hash.Size() + } +@@ -278,7 +284,7 @@ func SignPSS(rand io.Reader, priv *PrivateKey, hash crypto.Hash, digest []byte, + if _, err := io.ReadFull(rand, salt); err != nil { + return nil, err + } +- return signPSSWithSalt(rand, priv, hash, digest, salt) ++ return signPSSWithSalt(priv, hash, digest, salt) + } + + // VerifyPSS verifies a PSS signature. +@@ -291,13 +297,22 @@ func VerifyPSS(pub *PublicKey, hash crypto.Hash, digest []byte, sig []byte, opts + if len(sig) != pub.Size() { + return ErrVerification + } +- s := new(big.Int).SetBytes(sig) +- m := encrypt(new(big.Int), pub, s) +- emBits := pub.N.BitLen() - 1 ++ ++ emBits := bigBitLen(pub.N) - 1 + emLen := (emBits + 7) / 8 +- if m.BitLen() > emLen*8 { +- return ErrVerification ++ em := encrypt(pub, sig) ++ ++ // Like in signPSSWithSalt, deal with mismatches between emLen and the size ++ // of the modulus. The spec would have us wire emLen into the encoding ++ // function, but we'd rather always encode to the size of the modulus and ++ // then strip leading zeroes if necessary. This only happens for weird ++ // modulus sizes anyway. ++ for len(em) > emLen && len(em) > 0 { ++ if em[0] != 0 { ++ return ErrVerification ++ } ++ em = em[1:] + } +- em := m.FillBytes(make([]byte, emLen)) ++ + return emsaPSSVerify(digest, em, emBits, opts.saltLength(), hash.New()) + } +diff --git a/src/crypto/rsa/pss_test.go b/src/crypto/rsa/pss_test.go +index c3a6d46..d018b43 100644 +--- a/src/crypto/rsa/pss_test.go ++++ b/src/crypto/rsa/pss_test.go +@@ -233,7 +233,10 @@ func TestPSSSigning(t *testing.T) { + } + } + +-func TestSignWithPSSSaltLengthAuto(t *testing.T) { ++func TestPSS513(t *testing.T) { ++ // See Issue 42741, and separately, RFC 8017: "Note that the octet length of ++ // EM will be one less than k if modBits - 1 is divisible by 8 and equal to ++ // k otherwise, where k is the length in octets of the RSA modulus n." + key, err := GenerateKey(rand.Reader, 513) + if err != nil { + t.Fatal(err) +@@ -246,8 +249,9 @@ func TestSignWithPSSSaltLengthAuto(t *testing.T) { + if err != nil { + t.Fatal(err) + } +- if len(signature) == 0 { +- t.Fatal("empty signature returned") ++ err = VerifyPSS(&key.PublicKey, crypto.SHA256, digest[:], signature, nil) ++ if err != nil { ++ t.Error(err) + } + } + +diff --git a/src/crypto/rsa/rsa.go b/src/crypto/rsa/rsa.go +index 6fd59b3..20c1fe1 100644 +--- a/src/crypto/rsa/rsa.go ++++ b/src/crypto/rsa/rsa.go +@@ -19,13 +19,17 @@ + // over the public key primitive, the PrivateKey type implements the + // Decrypter and Signer interfaces from the crypto package. + // +-// The RSA operations in this package are not implemented using constant-time algorithms. ++// Operations in this package are implemented using constant-time algorithms, ++// except for [GenerateKey], [PrivateKey.Precompute], and [PrivateKey.Validate]. ++// Every other operation only leaks the bit size of the involved values, which ++// all depend on the selected key size. + package rsa + + import ( + "crypto" + "crypto/rand" + "crypto/subtle" ++ "encoding/binary" + "errors" + "hash" + "io" +@@ -35,7 +39,6 @@ import ( + "crypto/internal/randutil" + ) + +-var bigZero = big.NewInt(0) + var bigOne = big.NewInt(1) + + // A PublicKey represents the public part of an RSA key. +@@ -50,7 +53,7 @@ type PublicKey struct { + // Size returns the modulus size in bytes. Raw signatures and ciphertexts + // for or by this public key will have the same size. + func (pub *PublicKey) Size() int { +- return (pub.N.BitLen() + 7) / 8 ++ return (bigBitLen(pub.N) + 7) / 8 + } + + // Equal reports whether pub and x have the same value. +@@ -384,10 +387,18 @@ func mgf1XOR(out []byte, hash hash.Hash, seed []byte) { + // too large for the size of the public key. + var ErrMessageTooLong = errors.New("crypto/rsa: message too long for RSA public key size") + +-func encrypt(c *big.Int, pub *PublicKey, m *big.Int) *big.Int { +- e := big.NewInt(int64(pub.E)) +- c.Exp(m, e, pub.N) +- return c ++func encrypt(pub *PublicKey, plaintext []byte) []byte { ++ N := modulusFromNat(natFromBig(pub.N)) ++ m := natFromBytes(plaintext).expandFor(N) ++ ++ e := make([]byte, 8) ++ binary.BigEndian.PutUint64(e, uint64(pub.E)) ++ for len(e) > 1 && e[0] == 0 { ++ e = e[1:] ++ } ++ ++ out := make([]byte, modulusSize(N)) ++ return new(nat).exp(m, e, N).fillBytes(out) + } + + // EncryptOAEP encrypts the given message with RSA-OAEP. +@@ -437,12 +448,7 @@ func EncryptOAEP(hash hash.Hash, random io.Reader, pub *PublicKey, msg []byte, l + mgf1XOR(db, hash, seed) + mgf1XOR(seed, hash, db) + +- m := new(big.Int) +- m.SetBytes(em) +- c := encrypt(new(big.Int), pub, m) +- +- out := make([]byte, k) +- return c.FillBytes(out), nil ++ return encrypt(pub, em), nil + } + + // ErrDecryption represents a failure to decrypt a message. +@@ -484,98 +490,70 @@ func (priv *PrivateKey) Precompute() { + } + } + +-// decrypt performs an RSA decryption, resulting in a plaintext integer. If a +-// random source is given, RSA blinding is used. +-func decrypt(random io.Reader, priv *PrivateKey, c *big.Int) (m *big.Int, err error) { +- // TODO(agl): can we get away with reusing blinds? +- if c.Cmp(priv.N) > 0 { +- err = ErrDecryption +- return ++// decrypt performs an RSA decryption of ciphertext into out. ++func decrypt(priv *PrivateKey, ciphertext []byte) ([]byte, error) { ++ N := modulusFromNat(natFromBig(priv.N)) ++ c := natFromBytes(ciphertext).expandFor(N) ++ if c.cmpGeq(N.nat) == 1 { ++ return nil, ErrDecryption + } + if priv.N.Sign() == 0 { + return nil, ErrDecryption + } + +- var ir *big.Int +- if random != nil { +- randutil.MaybeReadByte(random) +- +- // Blinding enabled. Blinding involves multiplying c by r^e. +- // Then the decryption operation performs (m^e * r^e)^d mod n +- // which equals mr mod n. The factor of r can then be removed +- // by multiplying by the multiplicative inverse of r. +- +- var r *big.Int +- ir = new(big.Int) +- for { +- r, err = rand.Int(random, priv.N) +- if err != nil { +- return +- } +- if r.Cmp(bigZero) == 0 { +- r = bigOne +- } +- ok := ir.ModInverse(r, priv.N) +- if ok != nil { +- break +- } +- } +- bigE := big.NewInt(int64(priv.E)) +- rpowe := new(big.Int).Exp(r, bigE, priv.N) // N != 0 +- cCopy := new(big.Int).Set(c) +- cCopy.Mul(cCopy, rpowe) +- cCopy.Mod(cCopy, priv.N) +- c = cCopy +- } +- ++ // Note that because our private decryption exponents are stored as big.Int, ++ // we potentially leak the exact number of bits of these exponents. This ++ // isn't great, but should be fine. + if priv.Precomputed.Dp == nil { +- m = new(big.Int).Exp(c, priv.D, priv.N) +- } else { +- // We have the precalculated values needed for the CRT. +- m = new(big.Int).Exp(c, priv.Precomputed.Dp, priv.Primes[0]) +- m2 := new(big.Int).Exp(c, priv.Precomputed.Dq, priv.Primes[1]) +- m.Sub(m, m2) +- if m.Sign() < 0 { +- m.Add(m, priv.Primes[0]) +- } +- m.Mul(m, priv.Precomputed.Qinv) +- m.Mod(m, priv.Primes[0]) +- m.Mul(m, priv.Primes[1]) +- m.Add(m, m2) +- +- for i, values := range priv.Precomputed.CRTValues { +- prime := priv.Primes[2+i] +- m2.Exp(c, values.Exp, prime) +- m2.Sub(m2, m) +- m2.Mul(m2, values.Coeff) +- m2.Mod(m2, prime) +- if m2.Sign() < 0 { +- m2.Add(m2, prime) +- } +- m2.Mul(m2, values.R) +- m.Add(m, m2) +- } +- } +- +- if ir != nil { +- // Unblind. +- m.Mul(m, ir) +- m.Mod(m, priv.N) +- } +- +- return ++ out := make([]byte, modulusSize(N)) ++ return new(nat).exp(c, priv.D.Bytes(), N).fillBytes(out), nil ++ } ++ ++ t0 := new(nat) ++ P := modulusFromNat(natFromBig(priv.Primes[0])) ++ Q := modulusFromNat(natFromBig(priv.Primes[1])) ++ // m = c ^ Dp mod p ++ m := new(nat).exp(t0.mod(c, P), priv.Precomputed.Dp.Bytes(), P) ++ // m2 = c ^ Dq mod q ++ m2 := new(nat).exp(t0.mod(c, Q), priv.Precomputed.Dq.Bytes(), Q) ++ // m = m - m2 mod p ++ m.modSub(t0.mod(m2, P), P) ++ // m = m * Qinv mod p ++ m.modMul(natFromBig(priv.Precomputed.Qinv).expandFor(P), P) ++ // m = m * q mod N ++ m.expandFor(N).modMul(t0.mod(Q.nat, N), N) ++ // m = m + m2 mod N ++ m.modAdd(m2.expandFor(N), N) ++ ++ for i, values := range priv.Precomputed.CRTValues { ++ p := modulusFromNat(natFromBig(priv.Primes[2+i])) ++ // m2 = c ^ Exp mod p ++ m2.exp(t0.mod(c, p), values.Exp.Bytes(), p) ++ // m2 = m2 - m mod p ++ m2.modSub(t0.mod(m, p), p) ++ // m2 = m2 * Coeff mod p ++ m2.modMul(natFromBig(values.Coeff).expandFor(p), p) ++ // m2 = m2 * R mod N ++ R := natFromBig(values.R).expandFor(N) ++ m2.expandFor(N).modMul(R, N) ++ // m = m + m2 mod N ++ m.modAdd(m2, N) ++ } ++ ++ out := make([]byte, modulusSize(N)) ++ return m.fillBytes(out), nil + } + +-func decryptAndCheck(random io.Reader, priv *PrivateKey, c *big.Int) (m *big.Int, err error) { +- m, err = decrypt(random, priv, c) ++func decryptAndCheck(priv *PrivateKey, ciphertext []byte) (m []byte, err error) { ++ m, err = decrypt(priv, ciphertext) + if err != nil { + return nil, err + } + + // In order to defend against errors in the CRT computation, m^e is + // calculated, which should match the original ciphertext. +- check := encrypt(new(big.Int), &priv.PublicKey, m) +- if c.Cmp(check) != 0 { ++ check := encrypt(&priv.PublicKey, m) ++ if subtle.ConstantTimeCompare(ciphertext, check) != 1 { + return nil, errors.New("rsa: internal error") + } + return m, nil +@@ -587,9 +565,7 @@ func decryptAndCheck(random io.Reader, priv *PrivateKey, c *big.Int) (m *big.Int + // Encryption and decryption of a given message must use the same hash function + // and sha256.New() is a reasonable choice. + // +-// The random parameter, if not nil, is used to blind the private-key operation +-// and avoid timing side-channel attacks. Blinding is purely internal to this +-// function – the random data need not match that used when encrypting. ++// The random parameter is legacy and ignored, and it can be as nil. + // + // The label parameter must match the value given when encrypting. See + // EncryptOAEP for details. +@@ -603,9 +579,7 @@ func DecryptOAEP(hash hash.Hash, random io.Reader, priv *PrivateKey, ciphertext + return nil, ErrDecryption + } + +- c := new(big.Int).SetBytes(ciphertext) +- +- m, err := decrypt(random, priv, c) ++ em, err := decrypt(priv, ciphertext) + if err != nil { + return nil, err + } +@@ -614,10 +588,6 @@ func DecryptOAEP(hash hash.Hash, random io.Reader, priv *PrivateKey, ciphertext + lHash := hash.Sum(nil) + hash.Reset() + +- // We probably leak the number of leading zeros. +- // It's not clear that we can do anything about this. +- em := m.FillBytes(make([]byte, k)) +- + firstByteIsZero := subtle.ConstantTimeByteEq(em[0], 0) + + seed := em[1 : hash.Size()+1] +-- +2.40.0 diff --git a/meta/recipes-devtools/go/go-1.21/CVE-2023-24531_1.patch b/meta/recipes-devtools/go/go-1.21/CVE-2023-24531_1.patch new file mode 100644 index 0000000000..5f6d7e16a8 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.21/CVE-2023-24531_1.patch @@ -0,0 +1,252 @@ +From 0f717b5f7d32bb660c01ec0366bd53c9b4c5ab5d Mon Sep 17 00:00:00 2001 +From: Michael Matloob <matloob@golang.org> +Date: Mon, 24 Apr 2023 16:57:28 -0400 +Subject: [PATCH 1/2] cmd/go: sanitize go env outputs + +go env, without any arguments, outputs the environment variables in +the form of a script that can be run on the host OS. On Unix, single +quote the strings and place single quotes themselves outside the +single quoted strings. On windows use the set "var=val" syntax with +the quote starting before the variable. + +Fixes #58508 + +Change-Id: Iecd379a4af7285ea9b2024f0202250c74fd9a2bd +Reviewed-on: https://go-review.googlesource.com/c/go/+/488375 +TryBot-Result: Gopher Robot <gobot@golang.org> +Reviewed-by: Michael Matloob <matloob@golang.org> +Reviewed-by: Damien Neil <dneil@google.com> +Run-TryBot: Michael Matloob <matloob@golang.org> +Reviewed-by: Bryan Mills <bcmills@google.com> +Reviewed-by: Quim Muntal <quimmuntal@gmail.com> + +CVE: CVE-2023-24531 +Upstream-Status: Backport [f379e78951a405e7e99a60fb231eeedbf976c108] + +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/cmd/go/internal/envcmd/env.go | 60 ++++++++++++- + src/cmd/go/internal/envcmd/env_test.go | 94 +++++++++++++++++++++ + src/cmd/go/testdata/script/env_sanitize.txt | 5 ++ + 3 files changed, 157 insertions(+), 2 deletions(-) + create mode 100644 src/cmd/go/internal/envcmd/env_test.go + create mode 100644 src/cmd/go/testdata/script/env_sanitize.txt + +diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go +index 43b94e7..0ce8843 100644 +--- a/src/cmd/go/internal/envcmd/env.go ++++ b/src/cmd/go/internal/envcmd/env.go +@@ -6,6 +6,7 @@ + package envcmd + + import ( ++ "bytes" + "context" + "encoding/json" + "fmt" +@@ -17,6 +18,7 @@ import ( + "runtime" + "sort" + "strings" ++ "unicode" + "unicode/utf8" + + "cmd/go/internal/base" +@@ -379,9 +381,12 @@ func checkBuildConfig(add map[string]string, del map[string]bool) error { + func PrintEnv(w io.Writer, env []cfg.EnvVar) { + for _, e := range env { + if e.Name != "TERM" { ++ if runtime.GOOS != "plan9" && bytes.Contains([]byte(e.Value), []byte{0}) { ++ base.Fatalf("go: internal error: encountered null byte in environment variable %s on non-plan9 platform", e.Name) ++ } + switch runtime.GOOS { + default: +- fmt.Fprintf(w, "%s=\"%s\"\n", e.Name, e.Value) ++ fmt.Fprintf(w, "%s=%s\n", e.Name, shellQuote(e.Value)) + case "plan9": + if strings.IndexByte(e.Value, '\x00') < 0 { + fmt.Fprintf(w, "%s='%s'\n", e.Name, strings.ReplaceAll(e.Value, "'", "''")) +@@ -392,17 +397,68 @@ func PrintEnv(w io.Writer, env []cfg.EnvVar) { + if x > 0 { + fmt.Fprintf(w, " ") + } ++ // TODO(#59979): Does this need to be quoted like above? + fmt.Fprintf(w, "%s", s) + } + fmt.Fprintf(w, ")\n") + } + case "windows": +- fmt.Fprintf(w, "set %s=%s\n", e.Name, e.Value) ++ if hasNonGraphic(e.Value) { ++ base.Errorf("go: stripping unprintable or unescapable characters from %%%q%%", e.Name) ++ } ++ fmt.Fprintf(w, "set %s=%s\n", e.Name, batchEscape(e.Value)) + } + } + } + } + ++func hasNonGraphic(s string) bool { ++ for _, c := range []byte(s) { ++ if c == '\r' || c == '\n' || (!unicode.IsGraphic(rune(c)) && !unicode.IsSpace(rune(c))) { ++ return true ++ } ++ } ++ return false ++} ++ ++func shellQuote(s string) string { ++ var b bytes.Buffer ++ b.WriteByte('\'') ++ for _, x := range []byte(s) { ++ if x == '\'' { ++ // Close the single quoted string, add an escaped single quote, ++ // and start another single quoted string. ++ b.WriteString(`'\''`) ++ } else { ++ b.WriteByte(x) ++ } ++ } ++ b.WriteByte('\'') ++ return b.String() ++} ++ ++func batchEscape(s string) string { ++ var b bytes.Buffer ++ for _, x := range []byte(s) { ++ if x == '\r' || x == '\n' || (!unicode.IsGraphic(rune(x)) && !unicode.IsSpace(rune(x))) { ++ b.WriteRune(unicode.ReplacementChar) ++ continue ++ } ++ switch x { ++ case '%': ++ b.WriteString("%%") ++ case '<', '>', '|', '&', '^': ++ // These are special characters that need to be escaped with ^. See ++ // https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1. ++ b.WriteByte('^') ++ b.WriteByte(x) ++ default: ++ b.WriteByte(x) ++ } ++ } ++ return b.String() ++} ++ + func printEnvAsJSON(env []cfg.EnvVar) { + m := make(map[string]string) + for _, e := range env { +diff --git a/src/cmd/go/internal/envcmd/env_test.go b/src/cmd/go/internal/envcmd/env_test.go +new file mode 100644 +index 0000000..32d99fd +--- /dev/null ++++ b/src/cmd/go/internal/envcmd/env_test.go +@@ -0,0 +1,94 @@ ++// Copyright 2022 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++//go:build unix || windows ++ ++package envcmd ++ ++import ( ++ "bytes" ++ "cmd/go/internal/cfg" ++ "fmt" ++ "internal/testenv" ++ "os" ++ "os/exec" ++ "path/filepath" ++ "runtime" ++ "testing" ++ "unicode" ++) ++ ++func FuzzPrintEnvEscape(f *testing.F) { ++ f.Add(`$(echo 'cc"'; echo 'OOPS="oops')`) ++ f.Add("$(echo shell expansion 1>&2)") ++ f.Add("''") ++ f.Add(`C:\"Program Files"\`) ++ f.Add(`\\"Quoted Host"\\share`) ++ f.Add("\xfb") ++ f.Add("0") ++ f.Add("") ++ f.Add("''''''''") ++ f.Add("\r") ++ f.Add("\n") ++ f.Add("E,%") ++ f.Fuzz(func(t *testing.T, s string) { ++ t.Parallel() ++ ++ for _, c := range []byte(s) { ++ if c == 0 { ++ t.Skipf("skipping %q: contains a null byte. Null bytes can't occur in the environment"+ ++ " outside of Plan 9, which has different code path than Windows and Unix that this test"+ ++ " isn't testing.", s) ++ } ++ if c > unicode.MaxASCII { ++ t.Skipf("skipping %#q: contains a non-ASCII character %q", s, c) ++ } ++ if !unicode.IsGraphic(rune(c)) && !unicode.IsSpace(rune(c)) { ++ t.Skipf("skipping %#q: contains non-graphic character %q", s, c) ++ } ++ if runtime.GOOS == "windows" && c == '\r' || c == '\n' { ++ t.Skipf("skipping %#q on Windows: contains unescapable character %q", s, c) ++ } ++ } ++ ++ var b bytes.Buffer ++ if runtime.GOOS == "windows" { ++ b.WriteString("@echo off\n") ++ } ++ PrintEnv(&b, []cfg.EnvVar{{Name: "var", Value: s}}) ++ var want string ++ if runtime.GOOS == "windows" { ++ fmt.Fprintf(&b, "echo \"%%var%%\"\n") ++ want += "\"" + s + "\"\r\n" ++ } else { ++ fmt.Fprintf(&b, "printf '%%s\\n' \"$var\"\n") ++ want += s + "\n" ++ } ++ scriptfilename := "script.sh" ++ if runtime.GOOS == "windows" { ++ scriptfilename = "script.bat" ++ } ++ scriptfile := filepath.Join(t.TempDir(), scriptfilename) ++ if err := os.WriteFile(scriptfile, b.Bytes(), 0777); err != nil { ++ t.Fatal(err) ++ } ++ t.Log(b.String()) ++ var cmd *exec.Cmd ++ if runtime.GOOS == "windows" { ++ cmd = testenv.Command(t, "cmd.exe", "/C", scriptfile) ++ } else { ++ cmd = testenv.Command(t, "sh", "-c", scriptfile) ++ } ++ out, err := cmd.Output() ++ t.Log(string(out)) ++ if err != nil { ++ t.Fatal(err) ++ } ++ ++ if string(out) != want { ++ t.Fatalf("output of running PrintEnv script and echoing variable: got: %q, want: %q", ++ string(out), want) ++ } ++ }) ++} +diff --git a/src/cmd/go/testdata/script/env_sanitize.txt b/src/cmd/go/testdata/script/env_sanitize.txt +new file mode 100644 +index 0000000..cc4d23a +--- /dev/null ++++ b/src/cmd/go/testdata/script/env_sanitize.txt +@@ -0,0 +1,5 @@ ++env GOFLAGS='$(echo ''cc"''; echo ''OOPS="oops'')' ++go env ++[GOOS:darwin] stdout 'GOFLAGS=''\$\(echo ''\\''''cc"''\\''''; echo ''\\''''OOPS="oops''\\''''\)''' ++[GOOS:linux] stdout 'GOFLAGS=''\$\(echo ''\\''''cc"''\\''''; echo ''\\''''OOPS="oops''\\''''\)''' ++[GOOS:windows] stdout 'set GOFLAGS=\$\(echo ''cc"''; echo ''OOPS="oops''\)' +-- +2.35.5 + diff --git a/meta/recipes-devtools/go/go-1.21/CVE-2023-24531_2.patch b/meta/recipes-devtools/go/go-1.21/CVE-2023-24531_2.patch new file mode 100644 index 0000000000..eecc04c2e3 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.21/CVE-2023-24531_2.patch @@ -0,0 +1,47 @@ +From b2624f973692ca093348395c2418d1c422f2a162 Mon Sep 17 00:00:00 2001 +From: miller <millerresearch@gmail.com> +Date: Mon, 8 May 2023 16:56:21 +0100 +Subject: [PATCH 2/2] cmd/go: quote entries in list-valued variables for go env + in plan9 + +When 'go env' without an argument prints environment variables as +a script which can be executed by the shell, variables with a +list value in Plan 9 (such as GOPATH) need to be printed with each +element enclosed in single quotes in case it contains characters +significant to the Plan 9 shell (such as ' ' or '='). + +For #58508 + +Change-Id: Ia30f51307cc6d07a7e3ada6bf9d60bf9951982ff +Reviewed-on: https://go-review.googlesource.com/c/go/+/493535 +Run-TryBot: Cherry Mui <cherryyz@google.com> +Reviewed-by: Cherry Mui <cherryyz@google.com> +Reviewed-by: Russ Cox <rsc@golang.org> +TryBot-Result: Gopher Robot <gobot@golang.org> +Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> + +CVE: CVE-2023-24531 +Upstream-Status: Backport [05cc9e55876874462a4726ca0101c970838c80e5] + +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + src/cmd/go/internal/envcmd/env.go | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go +index 0ce8843..b48d0bd 100644 +--- a/src/cmd/go/internal/envcmd/env.go ++++ b/src/cmd/go/internal/envcmd/env.go +@@ -397,8 +397,7 @@ func PrintEnv(w io.Writer, env []cfg.EnvVar) { + if x > 0 { + fmt.Fprintf(w, " ") + } +- // TODO(#59979): Does this need to be quoted like above? +- fmt.Fprintf(w, "%s", s) ++ fmt.Fprintf(w, "'%s'", strings.ReplaceAll(s, "'", "''")) + } + fmt.Fprintf(w, ")\n") + } +-- +2.35.5 + diff --git a/meta/recipes-devtools/go/go-1.21/CVE-2023-39318.patch b/meta/recipes-devtools/go/go-1.21/CVE-2023-39318.patch new file mode 100644 index 0000000000..503a4a288a --- /dev/null +++ b/meta/recipes-devtools/go/go-1.21/CVE-2023-39318.patch @@ -0,0 +1,262 @@ +From 023b542edf38e2a1f87fcefb9f75ff2f99401b4c Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Thu, 3 Aug 2023 12:24:13 -0700 +Subject: [PATCH] [release-branch.go1.20] html/template: support HTML-like + comments in script contexts + +Per Appendix B.1.1 of the ECMAScript specification, support HTML-like +comments in script contexts. Also per section 12.5, support hashbang +comments. This brings our parsing in-line with how browsers treat these +comment types. + +Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for +reporting this issue. + +Fixes #62196 +Fixes #62395 +Fixes CVE-2023-39318 + +Change-Id: Id512702c5de3ae46cf648e268cb10e1eb392a181 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1976593 +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-by: Damien Neil <dneil@google.com> +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2014620 +Reviewed-on: https://go-review.googlesource.com/c/go/+/526098 +Run-TryBot: Cherry Mui <cherryyz@google.com> +TryBot-Result: Gopher Robot <gobot@golang.org> + +Upstream-Status: Backport from [https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c] +CVE: CVE-2023-39318 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + src/html/template/context.go | 6 ++- + src/html/template/escape.go | 5 ++- + src/html/template/escape_test.go | 10 +++++ + src/html/template/state_string.go | 26 +++++++------ + src/html/template/transition.go | 80 +++++++++++++++++++++++++-------------- + 5 files changed, 84 insertions(+), 43 deletions(-) + +diff --git a/src/html/template/context.go b/src/html/template/context.go +index f5f44a1..feb6517 100644 +--- a/src/html/template/context.go ++++ b/src/html/template/context.go +@@ -124,6 +124,10 @@ const ( + stateJSBlockCmt + // stateJSLineCmt occurs inside a JavaScript // line comment. + stateJSLineCmt ++ // stateJSHTMLOpenCmt occurs inside a JavaScript <!-- HTML-like comment. ++ stateJSHTMLOpenCmt ++ // stateJSHTMLCloseCmt occurs inside a JavaScript --> HTML-like comment. ++ stateJSHTMLCloseCmt + // stateCSS occurs inside a <style> element or style attribute. + stateCSS + // stateCSSDqStr occurs inside a CSS double quoted string. +@@ -149,7 +153,7 @@ const ( + // authors & maintainers, not for end-users or machines. + func isComment(s state) bool { + switch s { +- case stateHTMLCmt, stateJSBlockCmt, stateJSLineCmt, stateCSSBlockCmt, stateCSSLineCmt: ++ case stateHTMLCmt, stateJSBlockCmt, stateJSLineCmt, stateJSHTMLOpenCmt, stateJSHTMLCloseCmt, stateCSSBlockCmt, stateCSSLineCmt: + return true + } + return false +diff --git a/src/html/template/escape.go b/src/html/template/escape.go +index 1747ec9..b0085ce 100644 +--- a/src/html/template/escape.go ++++ b/src/html/template/escape.go +@@ -721,9 +721,12 @@ func (e *escaper) escapeText(c context, n *parse.TextNode) context { + if c.state != c1.state && isComment(c1.state) && c1.delim == delimNone { + // Preserve the portion between written and the comment start. + cs := i1 - 2 +- if c1.state == stateHTMLCmt { ++ if c1.state == stateHTMLCmt || c1.state == stateJSHTMLOpenCmt { + // "<!--" instead of "/*" or "//" + cs -= 2 ++ } else if c1.state == stateJSHTMLCloseCmt { ++ // "-->" instead of "/*" or "//" ++ cs -= 1 + } + b.Write(s[written:cs]) + written = i1 +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index 7853daa..bff38c6 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -503,6 +503,16 @@ func TestEscape(t *testing.T) { + "<script>var a/*b*///c\nd</script>", + "<script>var a \nd</script>", + }, ++ { ++ "JS HTML-like comments", ++ "<script>before <!-- beep\nbetween\nbefore-->boop\n</script>", ++ "<script>before \nbetween\nbefore\n</script>", ++ }, ++ { ++ "JS hashbang comment", ++ "<script>#! beep\n</script>", ++ "<script>\n</script>", ++ }, + { + "Special tags in <script> string literals", + `<script>var a = "asd < 123 <!-- 456 < fgh <script jkl < 789 </script"</script>`, +diff --git a/src/html/template/state_string.go b/src/html/template/state_string.go +index 05104be..b5cfe70 100644 +--- a/src/html/template/state_string.go ++++ b/src/html/template/state_string.go +@@ -25,21 +25,23 @@ func _() { + _ = x[stateJSRegexp-14] + _ = x[stateJSBlockCmt-15] + _ = x[stateJSLineCmt-16] +- _ = x[stateCSS-17] +- _ = x[stateCSSDqStr-18] +- _ = x[stateCSSSqStr-19] +- _ = x[stateCSSDqURL-20] +- _ = x[stateCSSSqURL-21] +- _ = x[stateCSSURL-22] +- _ = x[stateCSSBlockCmt-23] +- _ = x[stateCSSLineCmt-24] +- _ = x[stateError-25] +- _ = x[stateDead-26] ++ _ = x[stateJSHTMLOpenCmt-17] ++ _ = x[stateJSHTMLCloseCmt-18] ++ _ = x[stateCSS-19] ++ _ = x[stateCSSDqStr-20] ++ _ = x[stateCSSSqStr-21] ++ _ = x[stateCSSDqURL-22] ++ _ = x[stateCSSSqURL-23] ++ _ = x[stateCSSURL-24] ++ _ = x[stateCSSBlockCmt-25] ++ _ = x[stateCSSLineCmt-26] ++ _ = x[stateError-27] ++ _ = x[stateDead-28] + } + +-const _state_name = "stateTextstateTagstateAttrNamestateAfterNamestateBeforeValuestateHTMLCmtstateRCDATAstateAttrstateURLstateSrcsetstateJSstateJSDqStrstateJSSqStrstateJSBqStrstateJSRegexpstateJSBlockCmtstateJSLineCmtstateCSSstateCSSDqStrstateCSSSqStrstateCSSDqURLstateCSSSqURLstateCSSURLstateCSSBlockCmtstateCSSLineCmtstateErrorstateDead" ++const _state_name = "stateTextstateTagstateAttrNamestateAfterNamestateBeforeValuestateHTMLCmtstateRCDATAstateAttrstateURLstateSrcsetstateJSstateJSDqStrstateJSSqStrstateJSBqStrstateJSRegexpstateJSBlockCmtstateJSLineCmtstateJSHTMLOpenCmtstateJSHTMLCloseCmtstateCSSstateCSSDqStrstateCSSSqStrstateCSSDqURLstateCSSSqURLstateCSSURLstateCSSBlockCmtstateCSSLineCmtstateErrorstateDead" + +-var _state_index = [...]uint16{0, 9, 17, 30, 44, 60, 72, 83, 92, 100, 111, 118, 130, 142, 154, 167, 182, 196, 204, 217, 230, 243, 256, 267, 283, 298, 308, 317} ++var _state_index = [...]uint16{0, 9, 17, 30, 44, 60, 72, 83, 92, 100, 111, 118, 130, 142, 154, 167, 182, 196, 214, 233, 241, 254, 267, 280, 293, 304, 320, 335, 345, 354} + + func (i state) String() string { + if i >= state(len(_state_index)-1) { +diff --git a/src/html/template/transition.go b/src/html/template/transition.go +index e2660cc..3d2a37c 100644 +--- a/src/html/template/transition.go ++++ b/src/html/template/transition.go +@@ -14,32 +14,34 @@ import ( + // the updated context and the number of bytes consumed from the front of the + // input. + var transitionFunc = [...]func(context, []byte) (context, int){ +- stateText: tText, +- stateTag: tTag, +- stateAttrName: tAttrName, +- stateAfterName: tAfterName, +- stateBeforeValue: tBeforeValue, +- stateHTMLCmt: tHTMLCmt, +- stateRCDATA: tSpecialTagEnd, +- stateAttr: tAttr, +- stateURL: tURL, +- stateSrcset: tURL, +- stateJS: tJS, +- stateJSDqStr: tJSDelimited, +- stateJSSqStr: tJSDelimited, +- stateJSBqStr: tJSDelimited, +- stateJSRegexp: tJSDelimited, +- stateJSBlockCmt: tBlockCmt, +- stateJSLineCmt: tLineCmt, +- stateCSS: tCSS, +- stateCSSDqStr: tCSSStr, +- stateCSSSqStr: tCSSStr, +- stateCSSDqURL: tCSSStr, +- stateCSSSqURL: tCSSStr, +- stateCSSURL: tCSSStr, +- stateCSSBlockCmt: tBlockCmt, +- stateCSSLineCmt: tLineCmt, +- stateError: tError, ++ stateText: tText, ++ stateTag: tTag, ++ stateAttrName: tAttrName, ++ stateAfterName: tAfterName, ++ stateBeforeValue: tBeforeValue, ++ stateHTMLCmt: tHTMLCmt, ++ stateRCDATA: tSpecialTagEnd, ++ stateAttr: tAttr, ++ stateURL: tURL, ++ stateSrcset: tURL, ++ stateJS: tJS, ++ stateJSDqStr: tJSDelimited, ++ stateJSSqStr: tJSDelimited, ++ stateJSBqStr: tJSDelimited, ++ stateJSRegexp: tJSDelimited, ++ stateJSBlockCmt: tBlockCmt, ++ stateJSLineCmt: tLineCmt, ++ stateJSHTMLOpenCmt: tLineCmt, ++ stateJSHTMLCloseCmt: tLineCmt, ++ stateCSS: tCSS, ++ stateCSSDqStr: tCSSStr, ++ stateCSSSqStr: tCSSStr, ++ stateCSSDqURL: tCSSStr, ++ stateCSSSqURL: tCSSStr, ++ stateCSSURL: tCSSStr, ++ stateCSSBlockCmt: tBlockCmt, ++ stateCSSLineCmt: tLineCmt, ++ stateError: tError, + } + + var commentStart = []byte("<!--") +@@ -268,7 +270,7 @@ func tURL(c context, s []byte) (context, int) { + + // tJS is the context transition function for the JS state. + func tJS(c context, s []byte) (context, int) { +- i := bytes.IndexAny(s, "\"`'/") ++ i := bytes.IndexAny(s, "\"`'/<-#") + if i == -1 { + // Entire input is non string, comment, regexp tokens. + c.jsCtx = nextJSCtx(s, c.jsCtx) +@@ -298,6 +300,26 @@ func tJS(c context, s []byte) (context, int) { + err: errorf(ErrSlashAmbig, nil, 0, "'/' could start a division or regexp: %.32q", s[i:]), + }, len(s) + } ++ // ECMAScript supports HTML style comments for legacy reasons, see Appendix ++ // B.1.1 "HTML-like Comments". The handling of these comments is somewhat ++ // confusing. Multi-line comments are not supported, i.e. anything on lines ++ // between the opening and closing tokens is not considered a comment, but ++ // anything following the opening or closing token, on the same line, is ++ // ignored. As such we simply treat any line prefixed with "<!--" or "-->" ++ // as if it were actually prefixed with "//" and move on. ++ case '<': ++ if i+3 < len(s) && bytes.Equal(commentStart, s[i:i+4]) { ++ c.state, i = stateJSHTMLOpenCmt, i+3 ++ } ++ case '-': ++ if i+2 < len(s) && bytes.Equal(commentEnd, s[i:i+3]) { ++ c.state, i = stateJSHTMLCloseCmt, i+2 ++ } ++ // ECMAScript also supports "hashbang" comment lines, see Section 12.5. ++ case '#': ++ if i+1 < len(s) && s[i+1] == '!' { ++ c.state, i = stateJSLineCmt, i+1 ++ } + default: + panic("unreachable") + } +@@ -387,12 +409,12 @@ func tBlockCmt(c context, s []byte) (context, int) { + return c, i + 2 + } + +-// tLineCmt is the context transition function for //comment states. ++// tLineCmt is the context transition function for //comment states, and the JS HTML-like comment state. + func tLineCmt(c context, s []byte) (context, int) { + var lineTerminators string + var endState state + switch c.state { +- case stateJSLineCmt: ++ case stateJSLineCmt, stateJSHTMLOpenCmt, stateJSHTMLCloseCmt: + lineTerminators, endState = "\n\r\u2028\u2029", stateJS + case stateCSSLineCmt: + lineTerminators, endState = "\n\f\r", stateCSS +-- +2.35.7 + diff --git a/meta/recipes-devtools/go/go-1.21/CVE-2023-45289.patch b/meta/recipes-devtools/go/go-1.21/CVE-2023-45289.patch new file mode 100644 index 0000000000..f8ac64472f --- /dev/null +++ b/meta/recipes-devtools/go/go-1.21/CVE-2023-45289.patch @@ -0,0 +1,121 @@ +From 3a855208e3efed2e9d7c20ad023f1fa78afcc0be Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Thu, 11 Jan 2024 11:31:57 -0800 +Subject: [PATCH] [release-branch.go1.22] net/http, net/http/cookiejar: avoid + subdomain matches on IPv6 zones + +When deciding whether to forward cookies or sensitive headers +across a redirect, do not attempt to interpret an IPv6 address +as a domain name. + +Avoids a case where a maliciously-crafted redirect to an +IPv6 address with a scoped addressing zone could be +misinterpreted as a within-domain redirect. For example, +we could interpret "::1%.www.example.com" as a subdomain +of "www.example.com". + +Thanks to Juho Nurminen of Mattermost for reporting this issue. + +Fixes CVE-2023-45289 +Fixes #65859 +For #65065 + +Change-Id: I8f463f59f0e700c8a18733d2b264a8bcb3a19599 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2131938 +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2174344 +Reviewed-by: Carlos Amedee <amedee@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/569236 +Reviewed-by: Carlos Amedee <carlos@golang.org> +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> +Auto-Submit: Michael Knyszek <mknyszek@google.com> + +Upstream-Status: Backport [https://github.com/golang/go/commit/3a855208e3efed2e9d7c20ad023f1fa78afcc0be] +CVE: CVE-2023-45289 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + src/net/http/client.go | 6 ++++++ + src/net/http/client_test.go | 1 + + src/net/http/cookiejar/jar.go | 7 +++++++ + src/net/http/cookiejar/jar_test.go | 10 ++++++++++ + 4 files changed, 24 insertions(+) + +diff --git a/src/net/http/client.go b/src/net/http/client.go +index 22db96b..b2dd445 100644 +--- a/src/net/http/client.go ++++ b/src/net/http/client.go +@@ -1015,6 +1015,12 @@ func isDomainOrSubdomain(sub, parent string) bool { + if sub == parent { + return true + } ++ // If sub contains a :, it's probably an IPv6 address (and is definitely not a hostname). ++ // Don't check the suffix in this case, to avoid matching the contents of a IPv6 zone. ++ // For example, "::1%.www.example.com" is not a subdomain of "www.example.com". ++ if strings.ContainsAny(sub, ":%") { ++ return false ++ } + // If sub is "foo.example.com" and parent is "example.com", + // that means sub must end in "."+parent. + // Do it without allocating. +diff --git a/src/net/http/client_test.go b/src/net/http/client_test.go +index 9788c7a..7a0aa53 100644 +--- a/src/net/http/client_test.go ++++ b/src/net/http/client_test.go +@@ -1729,6 +1729,7 @@ func TestShouldCopyHeaderOnRedirect(t *testing.T) { + {"cookie2", "http://foo.com/", "http://bar.com/", false}, + {"authorization", "http://foo.com/", "http://bar.com/", false}, + {"www-authenticate", "http://foo.com/", "http://bar.com/", false}, ++ {"authorization", "http://foo.com/", "http://[::1%25.foo.com]/", false}, + + // But subdomains should work: + {"www-authenticate", "http://foo.com/", "http://foo.com/", true}, +diff --git a/src/net/http/cookiejar/jar.go b/src/net/http/cookiejar/jar.go +index e6583da..f2cf9c2 100644 +--- a/src/net/http/cookiejar/jar.go ++++ b/src/net/http/cookiejar/jar.go +@@ -362,6 +362,13 @@ func jarKey(host string, psl PublicSuffixList) string { + + // isIP reports whether host is an IP address. + func isIP(host string) bool { ++ if strings.ContainsAny(host, ":%") { ++ // Probable IPv6 address. ++ // Hostnames can't contain : or %, so this is definitely not a valid host. ++ // Treating it as an IP is the more conservative option, and avoids the risk ++ // of interpeting ::1%.www.example.com as a subtomain of www.example.com. ++ return true ++ } + return net.ParseIP(host) != nil + } + +diff --git a/src/net/http/cookiejar/jar_test.go b/src/net/http/cookiejar/jar_test.go +index 47fb1ab..fd8d40e 100644 +--- a/src/net/http/cookiejar/jar_test.go ++++ b/src/net/http/cookiejar/jar_test.go +@@ -251,6 +251,7 @@ var isIPTests = map[string]bool{ + "127.0.0.1": true, + "1.2.3.4": true, + "2001:4860:0:2001::68": true, ++ "::1%zone": true, + "example.com": false, + "1.1.1.300": false, + "www.foo.bar.net": false, +@@ -613,6 +614,15 @@ var basicsTests = [...]jarTest{ + {"http://www.host.test:1234/", "a=1"}, + }, + }, ++ { ++ "IPv6 zone is not treated as a host.", ++ "https://example.com/", ++ []string{"a=1"}, ++ "a=1", ++ []query{ ++ {"https://[::1%25.example.com]:80/", ""}, ++ }, ++ }, + } + + func TestBasics(t *testing.T) { +-- +2.25.1 + diff --git a/meta/recipes-devtools/go/go-1.21/CVE-2023-45290.patch b/meta/recipes-devtools/go/go-1.21/CVE-2023-45290.patch new file mode 100644 index 0000000000..81f2123f34 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.21/CVE-2023-45290.patch @@ -0,0 +1,270 @@ +From 041a47712e765e94f86d841c3110c840e76d8f82 Mon Sep 17 00:00:00 2001 +From: Damien Neil <dneil@google.com> +Date: Tue, 16 Jan 2024 15:37:52 -0800 +Subject: [PATCH] [release-branch.go1.22] net/textproto, mime/multipart: avoid + unbounded read in MIME header + +mime/multipart.Reader.ReadForm allows specifying the maximum amount +of memory that will be consumed by the form. While this limit is +correctly applied to the parsed form data structure, it was not +being applied to individual header lines in a form. + +For example, when presented with a form containing a header line +that never ends, ReadForm will continue to read the line until it +runs out of memory. + +Limit the amount of data consumed when reading a header. + +Fixes CVE-2023-45290 +Fixes #65850 +For #65383 + +Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435 +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2174345 +Reviewed-by: Carlos Amedee <amedee@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/569237 +Reviewed-by: Carlos Amedee <carlos@golang.org> +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> +Auto-Submit: Michael Knyszek <mknyszek@google.com> + +Upstream-Status: Backport [https://github.com/golang/go/commit/041a47712e765e94f86d841c3110c840e76d8f82] +CVE: CVE-2023-45290 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>--- + src/mime/multipart/formdata_test.go | 42 +++++++++++++++++++++++++ + src/net/textproto/reader.go | 48 ++++++++++++++++++++--------- + src/net/textproto/reader_test.go | 12 ++++++++ + 3 files changed, 87 insertions(+), 15 deletions(-) + +diff --git a/src/mime/multipart/formdata_test.go b/src/mime/multipart/formdata_test.go +index c78eeb7..f729da6 100644 +--- a/src/mime/multipart/formdata_test.go ++++ b/src/mime/multipart/formdata_test.go +@@ -421,6 +421,48 @@ func TestReadFormLimits(t *testing.T) { + } + } + ++func TestReadFormEndlessHeaderLine(t *testing.T) { ++ for _, test := range []struct { ++ name string ++ prefix string ++ }{{ ++ name: "name", ++ prefix: "X-", ++ }, { ++ name: "value", ++ prefix: "X-Header: ", ++ }, { ++ name: "continuation", ++ prefix: "X-Header: foo\r\n ", ++ }} { ++ t.Run(test.name, func(t *testing.T) { ++ const eol = "\r\n" ++ s := `--boundary` + eol ++ s += `Content-Disposition: form-data; name="a"` + eol ++ s += `Content-Type: text/plain` + eol ++ s += test.prefix ++ fr := io.MultiReader( ++ strings.NewReader(s), ++ neverendingReader('X'), ++ ) ++ r := NewReader(fr, "boundary") ++ _, err := r.ReadForm(1 << 20) ++ if err != ErrMessageTooLarge { ++ t.Fatalf("ReadForm(1 << 20): %v, want ErrMessageTooLarge", err) ++ } ++ }) ++ } ++} ++ ++type neverendingReader byte ++ ++func (r neverendingReader) Read(p []byte) (n int, err error) { ++ for i := range p { ++ p[i] = byte(r) ++ } ++ return len(p), nil ++} ++ + func BenchmarkReadForm(b *testing.B) { + for _, test := range []struct { + name string +diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go +index c6569c8..3ac4d4d 100644 +--- a/src/net/textproto/reader.go ++++ b/src/net/textproto/reader.go +@@ -16,6 +16,10 @@ import ( + "sync" + ) + ++// TODO: This should be a distinguishable error (ErrMessageTooLarge) ++// to allow mime/multipart to detect it. ++var errMessageTooLarge = errors.New("message too large") ++ + // A Reader implements convenience methods for reading requests + // or responses from a text protocol network connection. + type Reader struct { +@@ -37,13 +41,13 @@ func NewReader(r *bufio.Reader) *Reader { + // ReadLine reads a single line from r, + // eliding the final \n or \r\n from the returned string. + func (r *Reader) ReadLine() (string, error) { +- line, err := r.readLineSlice() ++ line, err := r.readLineSlice(-1) + return string(line), err + } + + // ReadLineBytes is like ReadLine but returns a []byte instead of a string. + func (r *Reader) ReadLineBytes() ([]byte, error) { +- line, err := r.readLineSlice() ++ line, err := r.readLineSlice(-1) + if line != nil { + buf := make([]byte, len(line)) + copy(buf, line) +@@ -52,7 +56,10 @@ func (r *Reader) ReadLineBytes() ([]byte, error) { + return line, err + } + +-func (r *Reader) readLineSlice() ([]byte, error) { ++// readLineSlice reads a single line from r, ++// up to lim bytes long (or unlimited if lim is less than 0), ++// eliding the final \r or \r\n from the returned string. ++func (r *Reader) readLineSlice(lim int64) ([]byte, error) { + r.closeDot() + var line []byte + for { +@@ -60,6 +67,9 @@ func (r *Reader) readLineSlice() ([]byte, error) { + if err != nil { + return nil, err + } ++ if lim >= 0 && int64(len(line))+int64(len(l)) > lim { ++ return nil, errMessageTooLarge ++ } + // Avoid the copy if the first call produced a full line. + if line == nil && !more { + return l, nil +@@ -92,7 +102,7 @@ func (r *Reader) readLineSlice() ([]byte, error) { + // Empty lines are never continued. + // + func (r *Reader) ReadContinuedLine() (string, error) { +- line, err := r.readContinuedLineSlice(noValidation) ++ line, err := r.readContinuedLineSlice(-1, noValidation) + return string(line), err + } + +@@ -113,7 +123,7 @@ func trim(s []byte) []byte { + // ReadContinuedLineBytes is like ReadContinuedLine but + // returns a []byte instead of a string. + func (r *Reader) ReadContinuedLineBytes() ([]byte, error) { +- line, err := r.readContinuedLineSlice(noValidation) ++ line, err := r.readContinuedLineSlice(-1, noValidation) + if line != nil { + buf := make([]byte, len(line)) + copy(buf, line) +@@ -126,13 +136,14 @@ func (r *Reader) ReadContinuedLineBytes() ([]byte, error) { + // returning a byte slice with all lines. The validateFirstLine function + // is run on the first read line, and if it returns an error then this + // error is returned from readContinuedLineSlice. +-func (r *Reader) readContinuedLineSlice(validateFirstLine func([]byte) error) ([]byte, error) { ++// It reads up to lim bytes of data (or unlimited if lim is less than 0). ++func (r *Reader) readContinuedLineSlice(lim int64, validateFirstLine func([]byte) error) ([]byte, error) { + if validateFirstLine == nil { + return nil, fmt.Errorf("missing validateFirstLine func") + } + + // Read the first line. +- line, err := r.readLineSlice() ++ line, err := r.readLineSlice(lim) + if err != nil { + return nil, err + } +@@ -160,13 +171,21 @@ func (r *Reader) readContinuedLineSlice(validateFirstLine func([]byte) error) ([ + // copy the slice into buf. + r.buf = append(r.buf[:0], trim(line)...) + ++ if lim < 0 { ++ lim = math.MaxInt64 ++ } ++ lim -= int64(len(r.buf)) ++ + // Read continuation lines. + for r.skipSpace() > 0 { +- line, err := r.readLineSlice() ++ r.buf = append(r.buf, ' ') ++ if int64(len(r.buf)) >= lim { ++ return nil, errMessageTooLarge ++ } ++ line, err := r.readLineSlice(lim - int64(len(r.buf))) + if err != nil { + break + } +- r.buf = append(r.buf, ' ') + r.buf = append(r.buf, trim(line)...) + } + return r.buf, nil +@@ -511,7 +530,8 @@ func readMIMEHeader(r *Reader, maxMemory, maxHeaders int64) (MIMEHeader, error) + + // The first line cannot start with a leading space. + if buf, err := r.R.Peek(1); err == nil && (buf[0] == ' ' || buf[0] == '\t') { +- line, err := r.readLineSlice() ++ const errorLimit = 80 // arbitrary limit on how much of the line we'll quote ++ line, err := r.readLineSlice(errorLimit) + if err != nil { + return m, err + } +@@ -519,7 +539,7 @@ func readMIMEHeader(r *Reader, maxMemory, maxHeaders int64) (MIMEHeader, error) + } + + for { +- kv, err := r.readContinuedLineSlice(mustHaveFieldNameColon) ++ kv, err := r.readContinuedLineSlice(maxMemory, mustHaveFieldNameColon) + if len(kv) == 0 { + return m, err + } +@@ -540,7 +560,7 @@ func readMIMEHeader(r *Reader, maxMemory, maxHeaders int64) (MIMEHeader, error) + + maxHeaders-- + if maxHeaders < 0 { +- return nil, errors.New("message too large") ++ return nil, errMessageTooLarge + } + + // backport 5c55ac9bf1e5f779220294c843526536605f42ab +@@ -567,9 +587,7 @@ func readMIMEHeader(r *Reader, maxMemory, maxHeaders int64) (MIMEHeader, error) + } + maxMemory -= int64(len(value)) + if maxMemory < 0 { +- // TODO: This should be a distinguishable error (ErrMessageTooLarge) +- // to allow mime/multipart to detect it. +- return m, errors.New("message too large") ++ return m, errMessageTooLarge + } + if vv == nil && len(strs) > 0 { + // More than likely this will be a single-element key. +diff --git a/src/net/textproto/reader_test.go b/src/net/textproto/reader_test.go +index 3ae0de1..db1ed91 100644 +--- a/src/net/textproto/reader_test.go ++++ b/src/net/textproto/reader_test.go +@@ -34,6 +34,18 @@ func TestReadLine(t *testing.T) { + } + } + ++func TestReadLineLongLine(t *testing.T) { ++ line := strings.Repeat("12345", 10000) ++ r := reader(line + "\r\n") ++ s, err := r.ReadLine() ++ if err != nil { ++ t.Fatalf("Line 1: %v", err) ++ } ++ if s != line { ++ t.Fatalf("%v-byte line does not match expected %v-byte line", len(s), len(line)) ++ } ++} ++ + func TestReadContinuedLine(t *testing.T) { + r := reader("line1\nline\n 2\nline3\n") + s, err := r.ReadContinuedLine() +-- +2.25.1 + diff --git a/meta/recipes-devtools/go/go_1.17.13.bb b/meta/recipes-devtools/go/go_1.17.13.bb index 34dc89bb0c..bb57c1c48a 100644 --- a/meta/recipes-devtools/go/go_1.17.13.bb +++ b/meta/recipes-devtools/go/go_1.17.13.bb @@ -11,7 +11,7 @@ export CXX_FOR_TARGET = "g++" # mips/rv64 doesn't support -buildmode=pie, so skip the QA checking for mips/riscv32 and its # variants. python() { - if 'mips' in d.getVar('TARGET_ARCH',True) or 'riscv32' in d.getVar('TARGET_ARCH',True): - d.appendVar('INSANE_SKIP:%s' % d.getVar('PN',True), " textrel") + if 'mips' in d.getVar('TARGET_ARCH') or 'riscv32' in d.getVar('TARGET_ARCH'): + d.appendVar('INSANE_SKIP:%s' % d.getVar('PN'), " textrel") } diff --git a/meta/recipes-devtools/json-c/json-c/CVE-2021-32292.patch b/meta/recipes-devtools/json-c/json-c/CVE-2021-32292.patch new file mode 100644 index 0000000000..28da522115 --- /dev/null +++ b/meta/recipes-devtools/json-c/json-c/CVE-2021-32292.patch @@ -0,0 +1,30 @@ +From da22ae6541584068f8169315274016920da11d8b Mon Sep 17 00:00:00 2001 +From: Marc <34656315+MarcT512@users.noreply.github.com> +Date: Fri, 7 Aug 2020 10:49:45 +0100 +Subject: [PATCH] Fix read past end of buffer + +Fixes: CVE-2021-32292 +Issue: https://github.com/json-c/json-c/issues/654 + +Upstream-Status: Backport [4e9e44e5258dee7654f74948b0dd5da39c28beec] +CVE: CVE-2021-32292 + +Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> +--- + apps/json_parse.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/apps/json_parse.c b/apps/json_parse.c +index bba4622..72b31a8 100644 +--- a/apps/json_parse.c ++++ b/apps/json_parse.c +@@ -82,7 +82,8 @@ static int parseit(int fd, int (*callback)(struct json_object *)) + int parse_end = json_tokener_get_parse_end(tok); + if (obj == NULL && jerr != json_tokener_continue) + { +- char *aterr = &buf[start_pos + parse_end]; ++ char *aterr = (start_pos + parse_end < sizeof(buf)) ? ++ &buf[start_pos + parse_end] : ""; + fflush(stdout); + int fail_offset = total_read - ret + start_pos + parse_end; + fprintf(stderr, "Failed at offset %d: %s %c\n", fail_offset, diff --git a/meta/recipes-devtools/json-c/json-c/run-ptest b/meta/recipes-devtools/json-c/json-c/run-ptest new file mode 100644 index 0000000000..9ee6095ea2 --- /dev/null +++ b/meta/recipes-devtools/json-c/json-c/run-ptest @@ -0,0 +1,20 @@ +#!/bin/sh + +# This script is used to run json-c test suites +cd tests + +ret_val=0 +for i in test*.test; do + # test_basic is not an own testcase, just + # contains common code of other tests + if [ "$i" != "test_basic.test" ]; then + if ./$i > json-c_test.log 2>&1 ; then + echo PASS: $i + else + ret_val=1 + echo FAIL: $i + fi + fi +done + +exit $ret_val diff --git a/meta/recipes-devtools/json-c/json-c_0.15.bb b/meta/recipes-devtools/json-c/json-c_0.15.bb index a4673a2f0e..b3679e0135 100644 --- a/meta/recipes-devtools/json-c/json-c_0.15.bb +++ b/meta/recipes-devtools/json-c/json-c_0.15.bb @@ -4,15 +4,31 @@ HOMEPAGE = "https://github.com/json-c/json-c/wiki" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://COPYING;md5=de54b60fbbc35123ba193fea8ee216f2" -SRC_URI = "https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz" +SRC_URI = " \ + https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz \ + file://run-ptest \ + file://CVE-2021-32292.patch \ +" SRC_URI[sha256sum] = "b8d80a1ddb718b3ba7492916237bbf86609e9709fb007e7f7d4322f02341a4c6" +# NVD uses full tag name including date +CVE_VERSION = "0.15-20200726" + UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/tags" UPSTREAM_CHECK_REGEX = "json-c-(?P<pver>\d+(\.\d+)+)-\d+" RPROVIDES:${PN} = "libjson" -inherit cmake +inherit cmake ptest + +do_install_ptest() { + install -d ${D}/${PTEST_PATH}/tests + install ${B}/tests/test* ${D}/${PTEST_PATH}/tests + install ${S}/tests/*.test ${D}/${PTEST_PATH}/tests + install ${S}/tests/*.expected ${D}/${PTEST_PATH}/tests + install ${S}/tests/test-defs.sh ${D}/${PTEST_PATH}/tests + install ${S}/tests/valid*json ${D}/${PTEST_PATH}/tests +} BBCLASSEXTEND = "native nativesdk" diff --git a/meta/recipes-devtools/libdnf/libdnf/0001-Fix-1558-Don-t-assume-inclusion-of-cstdint.patch b/meta/recipes-devtools/libdnf/libdnf/0001-Fix-1558-Don-t-assume-inclusion-of-cstdint.patch new file mode 100644 index 0000000000..277fd9fbf6 --- /dev/null +++ b/meta/recipes-devtools/libdnf/libdnf/0001-Fix-1558-Don-t-assume-inclusion-of-cstdint.patch @@ -0,0 +1,56 @@ +From 779ea105564b6d717300af2fcb02a399737a536f Mon Sep 17 00:00:00 2001 +From: ctxnop <ctxnop@gmail.com> +Date: Mon, 15 May 2023 19:30:16 +0200 +Subject: [PATCH] Fix #1558: Don't assume inclusion of cstdint + +With last versions of gcc, some headers don't include cstdint anymore, +but some sources assume that it is. + +Upstream-Status: Backport [https://github.com/rpm-software-management/libdnf/commit/779ea105564b6d717300af2fcb02a399737a536f] +Signed-off-by: ctxnop <ctxnop@gmail.com> +--- + libdnf/conf/ConfigMain.hpp | 1 + + libdnf/conf/ConfigRepo.hpp | 1 + + libdnf/conf/OptionSeconds.hpp | 2 ++ + 3 files changed, 4 insertions(+) + +diff --git a/libdnf/conf/ConfigMain.hpp b/libdnf/conf/ConfigMain.hpp +index 19395c71..59f65c48 100644 +--- a/libdnf/conf/ConfigMain.hpp ++++ b/libdnf/conf/ConfigMain.hpp +@@ -32,6 +32,7 @@ + #include "OptionString.hpp" + #include "OptionStringList.hpp" + ++#include <cstdint> + #include <memory> + + namespace libdnf { +diff --git a/libdnf/conf/ConfigRepo.hpp b/libdnf/conf/ConfigRepo.hpp +index 2b198441..84cafbad 100644 +--- a/libdnf/conf/ConfigRepo.hpp ++++ b/libdnf/conf/ConfigRepo.hpp +@@ -26,6 +26,7 @@ + #include "ConfigMain.hpp" + #include "OptionChild.hpp" + ++#include <cstdint> + #include <memory> + + namespace libdnf { +diff --git a/libdnf/conf/OptionSeconds.hpp b/libdnf/conf/OptionSeconds.hpp +index dc714b23..a80a973f 100644 +--- a/libdnf/conf/OptionSeconds.hpp ++++ b/libdnf/conf/OptionSeconds.hpp +@@ -25,6 +25,8 @@ + + #include "OptionNumber.hpp" + ++#include <cstdint> ++ + namespace libdnf { + + /** +-- +2.42.0 + diff --git a/meta/recipes-devtools/libdnf/libdnf/0001-libdnf-conf-OptionNumber.hpp-add-missing-cstdint-inc.patch b/meta/recipes-devtools/libdnf/libdnf/0001-libdnf-conf-OptionNumber.hpp-add-missing-cstdint-inc.patch new file mode 100644 index 0000000000..abb9504e6e --- /dev/null +++ b/meta/recipes-devtools/libdnf/libdnf/0001-libdnf-conf-OptionNumber.hpp-add-missing-cstdint-inc.patch @@ -0,0 +1,33 @@ +From f8af6399c4f6a65a35d33ecc191bb14094dc9e18 Mon Sep 17 00:00:00 2001 +From: Sergei Trofimovich <slyich@gmail.com> +Date: Fri, 27 May 2022 22:13:48 +0100 +Subject: [PATCH] libdnf/conf/OptionNumber.hpp: add missing <cstdint> include + +Without the change libdnf build fails on this week's gcc-13 snapshot as: + + In file included from /build/libdnf/libdnf/conf/ConfigMain.hpp:29, + from /build/libdnf/libdnf/conf/ConfigMain.cpp:21: + /build/libdnf/libdnf/conf/OptionNumber.hpp:94:41: error: 'int32_t' is not a member of 'std'; did you mean 'int32_t'? + 94 | extern template class OptionNumber<std::int32_t>; + | ^~~~~~~ + +Upstream-Status: Backport [https://github.com/rpm-software-management/libdnf/commit/f8af6399c4f6a65a35d33ecc191bb14094dc9e18] +--- + libdnf/conf/OptionNumber.hpp | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libdnf/conf/OptionNumber.hpp b/libdnf/conf/OptionNumber.hpp +index f7a7b3d6..a3a4dea6 100644 +--- a/libdnf/conf/OptionNumber.hpp ++++ b/libdnf/conf/OptionNumber.hpp +@@ -25,6 +25,7 @@ + + #include "Option.hpp" + ++#include <cstdint> + #include <functional> + + namespace libdnf { +-- +2.42.0 + diff --git a/meta/recipes-devtools/libdnf/libdnf/0001-libdnf-utils-sqlite3-Sqlite3.hpp-add-missing-cstdint.patch b/meta/recipes-devtools/libdnf/libdnf/0001-libdnf-utils-sqlite3-Sqlite3.hpp-add-missing-cstdint.patch new file mode 100644 index 0000000000..adde48ee46 --- /dev/null +++ b/meta/recipes-devtools/libdnf/libdnf/0001-libdnf-utils-sqlite3-Sqlite3.hpp-add-missing-cstdint.patch @@ -0,0 +1,36 @@ +From 24b5d7f154cac9e322dd3459f6d0a5016abbbb57 Mon Sep 17 00:00:00 2001 +From: Sergei Trofimovich <slyich@gmail.com> +Date: Fri, 27 May 2022 22:12:07 +0100 +Subject: [PATCH] libdnf/utils/sqlite3/Sqlite3.hpp: add missing <cstdint> + include + +Without the change libdnf build fails on this week's gcc-13 snapshot as: + + In file included from /build/libdnf/libdnf/sack/../transaction/Swdb.hpp:38, + from /build/libdnf/libdnf/sack/query.hpp:32, + from /build/libdnf/libdnf/dnf-sack-private.hpp:31, + from /build/libdnf/libdnf/hy-iutil.cpp:60: + /build/libdnf/libdnf/sack/../transaction/../utils/sqlite3/Sqlite3.hpp:100:33: error: 'std::int64_t' has not been declared + 100 | void bind(int pos, std::int64_t val) + | ^~~~~~~ + +Upstream-Status: Backport [https://github.com/rpm-software-management/libdnf/commit/24b5d7f154cac9e322dd3459f6d0a5016abbbb57] +--- + libdnf/utils/sqlite3/Sqlite3.hpp | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libdnf/utils/sqlite3/Sqlite3.hpp b/libdnf/utils/sqlite3/Sqlite3.hpp +index 3a7da23c..0403bb33 100644 +--- a/libdnf/utils/sqlite3/Sqlite3.hpp ++++ b/libdnf/utils/sqlite3/Sqlite3.hpp +@@ -27,6 +27,7 @@ + + #include <sqlite3.h> + ++#include <cstdint> + #include <map> + #include <memory> + #include <stdexcept> +-- +2.42.0 + diff --git a/meta/recipes-devtools/libdnf/libdnf_0.66.0.bb b/meta/recipes-devtools/libdnf/libdnf_0.66.0.bb index 2558f96851..bd06937ed8 100644 --- a/meta/recipes-devtools/libdnf/libdnf_0.66.0.bb +++ b/meta/recipes-devtools/libdnf/libdnf_0.66.0.bb @@ -11,6 +11,9 @@ SRC_URI = "git://github.com/rpm-software-management/libdnf;branch=dnf-4-master;p file://enable_test_data_dir_set.patch \ file://0001-drop-FindPythonInstDir.cmake.patch \ file://0001-libdnf-dnf-context.cpp-do-not-try-to-access-BDB-data.patch \ + file://0001-Fix-1558-Don-t-assume-inclusion-of-cstdint.patch \ + file://0001-libdnf-utils-sqlite3-Sqlite3.hpp-add-missing-cstdint.patch \ + file://0001-libdnf-conf-OptionNumber.hpp-add-missing-cstdint-inc.patch \ " SRCREV = "add5d5418b140a86d08667dd2b14793093984875" diff --git a/meta/recipes-devtools/llvm/llvm/0001-Support-Add-missing-cstdint-header-to-Signals.h.patch b/meta/recipes-devtools/llvm/llvm/0001-Support-Add-missing-cstdint-header-to-Signals.h.patch new file mode 100644 index 0000000000..fdb6307ab5 --- /dev/null +++ b/meta/recipes-devtools/llvm/llvm/0001-Support-Add-missing-cstdint-header-to-Signals.h.patch @@ -0,0 +1,31 @@ +From a94bf34221fc4519bd8ec72560c2d363ffe2de4c Mon Sep 17 00:00:00 2001 +From: Sergei Trofimovich <slyich@gmail.com> +Date: Mon, 23 May 2022 08:03:23 +0100 +Subject: [PATCH] [Support] Add missing <cstdint> header to Signals.h + +Without the change llvm build fails on this week's gcc-13 snapshot as: + + [ 0%] Building CXX object lib/Support/CMakeFiles/LLVMSupport.dir/Signals.cpp.o + In file included from llvm/lib/Support/Signals.cpp:14: + llvm/include/llvm/Support/Signals.h:119:8: error: variable or field 'CleanupOnSignal' declared void + 119 | void CleanupOnSignal(uintptr_t Context); + | ^~~~~~~~~~~~~~~ + +Upstream-Status: Backport [llvmorg-15.0.0 ff1681ddb303223973653f7f5f3f3435b48a1983] +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +--- + llvm/include/llvm/Support/Signals.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/llvm/include/llvm/Support/Signals.h b/llvm/include/llvm/Support/Signals.h +index 44f5a750ff5c..937e0572d4a7 100644 +--- a/llvm/include/llvm/Support/Signals.h ++++ b/llvm/include/llvm/Support/Signals.h +@@ -14,6 +14,7 @@ + #ifndef LLVM_SUPPORT_SIGNALS_H + #define LLVM_SUPPORT_SIGNALS_H + ++#include <cstdint> + #include <string> + + namespace llvm { diff --git a/meta/recipes-devtools/llvm/llvm_git.bb b/meta/recipes-devtools/llvm/llvm_git.bb index 9400bf0821..cedbfb138e 100644 --- a/meta/recipes-devtools/llvm/llvm_git.bb +++ b/meta/recipes-devtools/llvm/llvm_git.bb @@ -32,6 +32,7 @@ SRC_URI = "git://github.com/llvm/llvm-project.git;branch=${BRANCH};protocol=http file://0006-llvm-TargetLibraryInfo-Undefine-libc-functions-if-th.patch;striplevel=2 \ file://0007-llvm-allow-env-override-of-exe-path.patch;striplevel=2 \ file://0001-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch;striplevel=2 \ + file://0001-Support-Add-missing-cstdint-header-to-Signals.h.patch;striplevel=2 \ " UPSTREAM_CHECK_GITTAGREGEX = "llvmorg-(?P<pver>\d+(\.\d+)+)" diff --git a/meta/recipes-devtools/lua/lua_5.4.4.bb b/meta/recipes-devtools/lua/lua_5.4.4.bb index 0b2e754b31..a39d888ec2 100644 --- a/meta/recipes-devtools/lua/lua_5.4.4.bb +++ b/meta/recipes-devtools/lua/lua_5.4.4.bb @@ -57,3 +57,6 @@ do_install_ptest () { } BBCLASSEXTEND = "native nativesdk" + +inherit multilib_script +MULTILIB_SCRIPTS = "${PN}-dev:${includedir}/luaconf.h" diff --git a/meta/recipes-devtools/meson/meson/meson-wrapper b/meta/recipes-devtools/meson/meson/meson-wrapper index b65ba8e803..71c61db84f 100755 --- a/meta/recipes-devtools/meson/meson/meson-wrapper +++ b/meta/recipes-devtools/meson/meson/meson-wrapper @@ -13,20 +13,19 @@ fi # config is already in meson.cross. unset CC CXX CPP LD AR NM STRIP -for arg in "$@"; do - case "$arg" in - -*) continue ;; - *) SUBCMD="$arg"; break ;; - esac -done +case "$1" in +setup|configure|dist|install|introspect|init|test|wrap|subprojects|rewrite|compile|devenv|env2mfile|help) MESON_CMD="$1" ;; +*) echo meson-wrapper: Implicit setup command assumed; MESON_CMD=setup ;; +esac -if [ "$SUBCMD" = "setup" ] || [ -d "$SUBCMD" ]; then - MESON_SUB_OPTS=" \ +if [ "$MESON_CMD" = "setup" ]; then + MESON_SETUP_OPTS=" \ --cross-file="$OECORE_NATIVE_SYSROOT/usr/share/meson/${TARGET_PREFIX}meson.cross" \ --native-file="$OECORE_NATIVE_SYSROOT/usr/share/meson/meson.native" \ " + echo meson-wrapper: Running meson with setup options: \"$MESON_SETUP_OPTS\" fi exec "$OECORE_NATIVE_SYSROOT/usr/bin/meson.real" \ "$@" \ - $MESON_SUB_OPTS + $MESON_SETUP_OPTS diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2020-21528.patch b/meta/recipes-devtools/nasm/nasm/CVE-2020-21528.patch new file mode 100644 index 0000000000..2303744540 --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2020-21528.patch @@ -0,0 +1,47 @@ +From 93c774d482694643cafbc82578ac8b729fb5bc8b Mon Sep 17 00:00:00 2001 +From: Cyrill Gorcunov <gorcunov@gmail.com> +Date: Wed, 4 Nov 2020 13:08:06 +0300 +Subject: [PATCH] BR3392637: output/outieee: Fix nil dereference + +The handling been broken in commit 98578071. + +Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/93c774d482694643cafbc82578ac8b729fb5bc8b] + +CVE: CVE-2020-21528 + +Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com> +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + output/outieee.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/output/outieee.c b/output/outieee.c +index bff2f085..b3ccc5f6 100644 +--- a/output/outieee.c ++++ b/output/outieee.c +@@ -795,6 +795,23 @@ static int32_t ieee_segment(char *name, int *bits) + define_label(name, seg->index + 1, 0L, false); + ieee_seg_needs_update = NULL; + ++ /* ++ * In commit 98578071b9d71ecaa2344dd9c185237c1765041e ++ * we reworked labels significantly which in turn lead ++ * to the case where seg->name = NULL here and we get ++ * nil dereference in next segments definitions. ++ * ++ * Lets placate this case with explicit name setting ++ * if labels engine didn't set it yet. ++ * ++ * FIXME: Need to revisit this moment if such fix doesn't ++ * break anything but since IEEE 695 format is veeery ++ * old I don't expect there are many users left. In worst ++ * case this should only lead to a memory leak. ++ */ ++ if (!seg->name) ++ seg->name = nasm_strdup(name); ++ + if (seg->use32) + *bits = 32; + else +-- +2.40.0 diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch b/meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch new file mode 100644 index 0000000000..1bd49c9fd9 --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch @@ -0,0 +1,104 @@ +From b37677f7e40276bd8f504584bcba2c092f1146a8 Mon Sep 17 00:00:00 2001 +From: "H. Peter Anvin" <hpa@zytor.com> +Date: Mon, 7 Nov 2022 10:26:03 -0800 +Subject: [PATCH] quote_for_pmake: fix counter underrun resulting in segfault + +while (nbs--) { ... } ends with nbs == -1. Rather than a minimal fix, +introduce mempset() to make these kinds of errors less likely in the +future. + +Fixes: https://bugzilla.nasm.us/show_bug.cgi?id=3392815 +Reported-by: <13579and24680@gmail.com> +Signed-off-by: H. Peter Anvin <hpa@zytor.com> + +Upstream-Status: Backport +CVE: CVE-2022-4437 + +Reference to upstream patch: +[https://github.com/netwide-assembler/nasm/commit/2d4e6952417ec6f08b6f135d2b5d0e19b7dae30d] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + asm/nasm.c | 12 +++++------- + configure.ac | 1 + + include/compiler.h | 7 +++++++ + 3 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/asm/nasm.c b/asm/nasm.c +index 7a7f8b4..675cff4 100644 +--- a/asm/nasm.c ++++ b/asm/nasm.c +@@ -1,6 +1,6 @@ + /* ----------------------------------------------------------------------- * + * +- * Copyright 1996-2020 The NASM Authors - All Rights Reserved ++ * Copyright 1996-2022 The NASM Authors - All Rights Reserved + * See the file AUTHORS included with the NASM distribution for + * the specific copyright holders. + * +@@ -814,8 +814,7 @@ static char *quote_for_pmake(const char *str) + } + + /* Convert N backslashes at the end of filename to 2N backslashes */ +- if (nbs) +- n += nbs; ++ n += nbs; + + os = q = nasm_malloc(n); + +@@ -824,10 +823,10 @@ static char *quote_for_pmake(const char *str) + switch (*p) { + case ' ': + case '\t': +- while (nbs--) +- *q++ = '\\'; ++ q = mempset(q, '\\', nbs); + *q++ = '\\'; + *q++ = *p; ++ nbs = 0; + break; + case '$': + *q++ = *p; +@@ -849,9 +848,8 @@ static char *quote_for_pmake(const char *str) + break; + } + } +- while (nbs--) +- *q++ = '\\'; + ++ q = mempset(q, '\\', nbs); + *q = '\0'; + + return os; +diff --git a/configure.ac b/configure.ac +index 39680b1..940ebe2 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -199,6 +199,7 @@ AC_CHECK_FUNCS(strrchrnul) + AC_CHECK_FUNCS(iscntrl) + AC_CHECK_FUNCS(isascii) + AC_CHECK_FUNCS(mempcpy) ++AC_CHECK_FUNCS(mempset) + + AC_CHECK_FUNCS(getuid) + AC_CHECK_FUNCS(getgid) +diff --git a/include/compiler.h b/include/compiler.h +index db3d6d6..b64da6a 100644 +--- a/include/compiler.h ++++ b/include/compiler.h +@@ -256,6 +256,13 @@ static inline void *mempcpy(void *dst, const void *src, size_t n) + } + #endif + ++#ifndef HAVE_MEMPSET ++static inline void *mempset(void *dst, int c, size_t n) ++{ ++ return (char *)memset(dst, c, n) + n; ++} ++#endif ++ + /* + * Hack to support external-linkage inline functions + */ +-- +2.40.0 diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2022-46457.patch b/meta/recipes-devtools/nasm/nasm/CVE-2022-46457.patch new file mode 100644 index 0000000000..3502d572cd --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2022-46457.patch @@ -0,0 +1,50 @@ +From c8af73112027fad0ecbb277e9cba257678c405af Mon Sep 17 00:00:00 2001 +From: "H. Peter Anvin" <hpa@zytor.com> +Date: Wed, 7 Dec 2022 10:23:46 -0800 +Subject: [PATCH] outieee: fix segfault on empty input + +Fix the IEEE backend crashing if the input file is empty. + +Signed-off-by: H. Peter Anvin <hpa@zytor.com> + +Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/c8af73112027fad0ecbb277e9cba257678c405af] +CVE: CVE-2022-46457 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + output/outieee.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/output/outieee.c b/output/outieee.c +index cdb8333..8bc5eaa 100644 +--- a/output/outieee.c ++++ b/output/outieee.c +@@ -919,7 +919,7 @@ static void ieee_write_file(void) + * Write the section headers + */ + seg = seghead; +- if (!debuginfo && !strcmp(seg->name, "??LINE")) ++ if (!debuginfo && seg && !strcmp(seg->name, "??LINE")) + seg = seg->next; + while (seg) { + char buf[256]; +@@ -954,7 +954,7 @@ static void ieee_write_file(void) + /* + * write the start address if there is one + */ +- if (ieee_entry_seg) { ++ if (ieee_entry_seg && seghead) { + for (seg = seghead; seg; seg = seg->next) + if (seg->index == ieee_entry_seg) + break; +@@ -1067,7 +1067,7 @@ static void ieee_write_file(void) + * put out section data; + */ + seg = seghead; +- if (!debuginfo && !strcmp(seg->name, "??LINE")) ++ if (!debuginfo && seg && !strcmp(seg->name, "??LINE")) + seg = seg->next; + while (seg) { + if (seg->currentpos) { +-- +2.40.0 diff --git a/meta/recipes-devtools/nasm/nasm_2.15.05.bb b/meta/recipes-devtools/nasm/nasm_2.15.05.bb index edc17aeebf..aba061f56f 100644 --- a/meta/recipes-devtools/nasm/nasm_2.15.05.bb +++ b/meta/recipes-devtools/nasm/nasm_2.15.05.bb @@ -8,6 +8,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=90904486f8fbf1861cf42752e1a39efe" SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \ file://0001-stdlib-Add-strlcat.patch \ file://0002-Add-debug-prefix-map-option.patch \ + file://CVE-2022-44370.patch \ + file://CVE-2022-46457.patch \ + file://CVE-2020-21528.patch \ " SRC_URI[sha256sum] = "3c4b8339e5ab54b1bcb2316101f8985a5da50a3f9e504d43fa6f35668bee2fd0" diff --git a/meta/recipes-devtools/ninja/ninja_1.10.2.bb b/meta/recipes-devtools/ninja/ninja_1.10.2.bb index 7270321d6e..1509a54c9e 100644 --- a/meta/recipes-devtools/ninja/ninja_1.10.2.bb +++ b/meta/recipes-devtools/ninja/ninja_1.10.2.bb @@ -29,3 +29,6 @@ do_install() { } BBCLASSEXTEND = "native nativesdk" + +# This is a different Ninja +CVE_CHECK_IGNORE += "CVE-2021-4336" diff --git a/meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch b/meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch deleted file mode 100644 index b755a263a4..0000000000 --- a/meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 682fb48c137b687477008b68863c2a0b73ed47d1 Mon Sep 17 00:00:00 2001 -From: Fabio Berton <fabio.berton@ossystems.com.br> -Date: Fri, 9 Sep 2016 16:00:42 -0300 -Subject: [PATCH] handle read-only files - -Patch from: -https://github.com/darealshinji/patchelf/commit/40e66392bc4b96e9b4eda496827d26348a503509 - -Upstream-Status: Denied [https://github.com/NixOS/patchelf/pull/89] - -Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br> - ---- - src/patchelf.cc | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -Index: git/src/patchelf.cc -=================================================================== ---- git.orig/src/patchelf.cc -+++ git/src/patchelf.cc -@@ -534,9 +534,19 @@ void ElfFile<ElfFileParamNames>::sortShd - - static void writeFile(const std::string & fileName, const FileContents & contents) - { -+ struct stat st; -+ int fd; -+ - debug("writing %s\n", fileName.c_str()); - -- int fd = open(fileName.c_str(), O_CREAT | O_TRUNC | O_WRONLY, 0777); -+ if (stat(fileName.c_str(), &st) != 0) -+ error("stat"); -+ -+ if (chmod(fileName.c_str(), 0600) != 0) -+ error("chmod"); -+ -+ fd = open(fileName.c_str(), O_CREAT | O_TRUNC | O_WRONLY, 0777); -+ - if (fd == -1) - error("open"); - -@@ -551,8 +561,6 @@ static void writeFile(const std::string - bytesWritten += portion; - } - -- if (close(fd) >= 0) -- return; - /* - * Just ignore EINTR; a retry loop is the wrong thing to do. - * -@@ -561,9 +569,11 @@ static void writeFile(const std::string - * http://utcc.utoronto.ca/~cks/space/blog/unix/CloseEINTR - * https://sites.google.com/site/michaelsafyan/software-engineering/checkforeintrwheninvokingclosethinkagain - */ -- if (errno == EINTR) -- return; -- error("close"); -+ if ((close(fd) < 0) && errno != EINTR) -+ error("close"); -+ -+ if (chmod(fileName.c_str(), st.st_mode) != 0) -+ error("chmod"); - } - - diff --git a/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb b/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb index 0fa2c00f1d..82c7e807ac 100644 --- a/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb +++ b/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb @@ -5,7 +5,6 @@ HOMEPAGE = "https://github.com/NixOS/patchelf" LICENSE = "GPL-3.0-only" SRC_URI = "git://github.com/NixOS/patchelf;protocol=https;branch=master \ - file://handle-read-only-files.patch \ " SRCREV = "a35054504293f9ff64539850d1ed0bfd2f5399f2" diff --git a/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch b/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch index 8c8f3b717c..0ef9b27439 100644 --- a/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch +++ b/meta/recipes-devtools/perl-cross/files/0001-Makefile-check-the-file-if-patched-or-not.patch @@ -21,8 +21,8 @@ index f4a26f5..7bc748e 100644 # Original versions are not saved anymore; patch generally takes care of this, # and if that fails, reaching for the source tarball is the safest option. $(CROSSPATCHED): %.applied: %.patch -- patch -p1 -i $< && touch $@ -+ test ! -f $@ && (patch -p1 -i $< && touch $@) || echo "$@ exist" +- $(cpatch) -p1 -i $< && touch $@ ++ test ! -f $@ && ($(cpatch) -p1 -i $< && touch $@) || echo "$@ exist" # ---[ common ]----------------------------------------------------------------- diff --git a/meta/recipes-devtools/perl-cross/perlcross_1.3.7.bb b/meta/recipes-devtools/perl-cross/perlcross_1.5.2.bb index 99a9ca1027..ac4dff33bb 100644 --- a/meta/recipes-devtools/perl-cross/perlcross_1.3.7.bb +++ b/meta/recipes-devtools/perl-cross/perlcross_1.5.2.bb @@ -18,7 +18,7 @@ SRC_URI = "https://github.com/arsv/perl-cross/releases/download/${PV}/perl-cross " UPSTREAM_CHECK_URI = "https://github.com/arsv/perl-cross/releases/" -SRC_URI[perl-cross.sha256sum] = "77f13ca84a63025053852331b72d4046c1f90ded98bd45ccedea738621907335" +SRC_URI[perl-cross.sha256sum] = "584dc54c48dca25e032b676a15bef377c1fed9de318b4fc140292a5dbf326e90" S = "${WORKDIR}/perl-cross-${PV}" diff --git a/meta/recipes-devtools/perl/files/CVE-2023-31484.patch b/meta/recipes-devtools/perl/files/CVE-2023-31484.patch new file mode 100644 index 0000000000..1f7cbd0da1 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2023-31484.patch @@ -0,0 +1,29 @@ +From a625ec2cc3a0b6116c1f8b831d3480deb621c245 Mon Sep 17 00:00:00 2001 +From: Stig Palmquist <git@stig.io> +Date: Tue, 28 Feb 2023 11:54:06 +0100 +Subject: [PATCH] Add verify_SSL=>1 to HTTP::Tiny to verify https server + identity + +Upstream-Status: Backport [https://github.com/andk/cpanpm/commit/9c98370287f4e709924aee7c58ef21c85289a7f0] + +CVE: CVE-2023-31484 + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + cpan/CPAN/lib/CPAN/HTTP/Client.pm | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/cpan/CPAN/lib/CPAN/HTTP/Client.pm b/cpan/CPAN/lib/CPAN/HTTP/Client.pm +index 4fc792c..a616fee 100644 +--- a/cpan/CPAN/lib/CPAN/HTTP/Client.pm ++++ b/cpan/CPAN/lib/CPAN/HTTP/Client.pm +@@ -32,6 +32,7 @@ sub mirror { + + my $want_proxy = $self->_want_proxy($uri); + my $http = HTTP::Tiny->new( ++ verify_SSL => 1, + $want_proxy ? (proxy => $self->{proxy}) : () + ); + +-- +2.40.0 diff --git a/meta/recipes-devtools/perl/files/CVE-2023-31486-0001.patch b/meta/recipes-devtools/perl/files/CVE-2023-31486-0001.patch new file mode 100644 index 0000000000..d29996ddcb --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2023-31486-0001.patch @@ -0,0 +1,215 @@ +From 77f557ef84698efeb6eed04e4a9704eaf85b741d +From: Stig Palmquist <git@stig.io> +Date: Mon Jun 5 16:46:22 2023 +0200 +Subject: [PATCH] Change verify_SSL default to 1, add ENV var to enable + insecure default - Changes the `verify_SSL` default parameter from `0` to `1` + + Based on patch by Dominic Hargreaves: + https://salsa.debian.org/perl-team/interpreter/perl/-/commit/1490431e40e22052f75a0b3449f1f53cbd27ba92 + + CVE: CVE-2023-31486 + +- Add check for `$ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT}` that + enables the previous insecure default behaviour if set to `1`. + + This provides a workaround for users who encounter problems with the + new `verify_SSL` default. + + Example to disable certificate checks: + ``` + $ PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT=1 ./script.pl + ``` + +- Updates to documentation: + - Describe changing the verify_SSL value + - Describe the escape-hatch environment variable + - Remove rationale for not enabling verify_SSL + - Add missing certificate search paths + - Replace "SSL" with "TLS/SSL" where appropriate + - Use "machine-in-the-middle" instead of "man-in-the-middle" + +Upstream-Status: Backport [https://github.com/chansen/p5-http-tiny/commit/77f557ef84698efeb6eed04e4a9704eaf85b741d] + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + cpan/HTTP-Tiny/lib/HTTP/Tiny.pm | 86 ++++++++++++++++++++++----------- + 1 file changed, 57 insertions(+), 29 deletions(-) + +diff --git a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm +index 5803e45..1808c41 100644 +--- a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm ++++ b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm +@@ -39,10 +39,14 @@ sub _croak { require Carp; Carp::croak(@_) } + #pod C<$ENV{no_proxy}> —) + #pod * C<timeout> — Request timeout in seconds (default is 60) If a socket open, + #pod read or write takes longer than the timeout, an exception is thrown. +-#pod * C<verify_SSL> — A boolean that indicates whether to validate the SSL +-#pod certificate of an C<https> — connection (default is false) ++#pod * C<verify_SSL> — A boolean that indicates whether to validate the TLS/SSL ++#pod certificate of an C<https> — connection (default is true). Changed from false ++#pod to true in version 0.083. + #pod * C<SSL_options> — A hashref of C<SSL_*> — options to pass through to + #pod L<IO::Socket::SSL> ++#pod * C<$ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT}> - Changes the default ++#pod certificate verification behavior to not check server identity if set to 1. ++#pod Only effective if C<verify_SSL> is not set. Added in version 0.083. + #pod + #pod Passing an explicit C<undef> for C<proxy>, C<http_proxy> or C<https_proxy> will + #pod prevent getting the corresponding proxies from the environment. +@@ -108,11 +112,17 @@ sub timeout { + sub new { + my($class, %args) = @_; + ++ # Support lower case verify_ssl argument, but only if verify_SSL is not ++ # true. ++ if ( exists $args{verify_ssl} ) { ++ $args{verify_SSL} ||= $args{verify_ssl}; ++ } ++ + my $self = { + max_redirect => 5, + timeout => defined $args{timeout} ? $args{timeout} : 60, + keep_alive => 1, +- verify_SSL => $args{verify_SSL} || $args{verify_ssl} || 0, # no verification by default ++ verify_SSL => defined $args{verify_SSL} ? $args{verify_SSL} : _verify_SSL_default(), + no_proxy => $ENV{no_proxy}, + }; + +@@ -131,6 +141,13 @@ sub new { + return $self; + } + ++sub _verify_SSL_default { ++ my ($self) = @_; ++ # Check if insecure default certificate verification behaviour has been ++ # changed by the user by setting PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT=1 ++ return (($ENV{PERL_HTTP_TINY_INSECURE_BY_DEFAULT} || '') eq '1') ? 0 : 1; ++} ++ + sub _set_proxies { + my ($self) = @_; + +@@ -1038,7 +1055,7 @@ sub new { + timeout => 60, + max_line_size => 16384, + max_header_lines => 64, +- verify_SSL => 0, ++ verify_SSL => HTTP::Tiny::_verify_SSL_default(), + SSL_options => {}, + %args + }, $class; +@@ -2009,11 +2026,11 @@ proxy + timeout + verify_SSL + +-=head1 SSL SUPPORT ++=head1 TLS/SSL SUPPORT + + Direct C<https> connections are supported only if L<IO::Socket::SSL> 1.56 or + greater and L<Net::SSLeay> 1.49 or greater are installed. An exception will be +-thrown if new enough versions of these modules are not installed or if the SSL ++thrown if new enough versions of these modules are not installed or if the TLS + encryption fails. You can also use C<HTTP::Tiny::can_ssl()> utility function + that returns boolean to see if the required modules are installed. + +@@ -2021,7 +2038,7 @@ An C<https> connection may be made via an C<http> proxy that supports the CONNEC + command (i.e. RFC 2817). You may not proxy C<https> via a proxy that itself + requires C<https> to communicate. + +-SSL provides two distinct capabilities: ++TLS/SSL provides two distinct capabilities: + + =over 4 + +@@ -2035,24 +2052,17 @@ Verification of server identity + + =back + +-B<By default, HTTP::Tiny does not verify server identity>. +- +-Server identity verification is controversial and potentially tricky because it +-depends on a (usually paid) third-party Certificate Authority (CA) trust model +-to validate a certificate as legitimate. This discriminates against servers +-with self-signed certificates or certificates signed by free, community-driven +-CA's such as L<CAcert.org|http://cacert.org>. ++B<By default, HTTP::Tiny verifies server identity>. + +-By default, HTTP::Tiny does not make any assumptions about your trust model, +-threat level or risk tolerance. It just aims to give you an encrypted channel +-when you need one. ++This was changed in version 0.083 due to security concerns. The previous default ++behavior can be enabled by setting C<$ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT}> ++to 1. + +-Setting the C<verify_SSL> attribute to a true value will make HTTP::Tiny verify +-that an SSL connection has a valid SSL certificate corresponding to the host +-name of the connection and that the SSL certificate has been verified by a CA. +-Assuming you trust the CA, this will protect against a L<man-in-the-middle +-attack|http://en.wikipedia.org/wiki/Man-in-the-middle_attack>. If you are +-concerned about security, you should enable this option. ++Verification is done by checking that that the TLS/SSL connection has a valid ++certificate corresponding to the host name of the connection and that the ++certificate has been verified by a CA. Assuming you trust the CA, this will ++protect against L<machine-in-the-middle ++attacks|http://en.wikipedia.org/wiki/Machine-in-the-middle_attack>. + + Certificate verification requires a file containing trusted CA certificates. + +@@ -2060,9 +2070,7 @@ If the environment variable C<SSL_CERT_FILE> is present, HTTP::Tiny + will try to find a CA certificate file in that location. + + If the L<Mozilla::CA> module is installed, HTTP::Tiny will use the CA file +-included with it as a source of trusted CA's. (This means you trust Mozilla, +-the author of Mozilla::CA, the CPAN mirror where you got Mozilla::CA, the +-toolchain used to install it, and your operating system security, right?) ++included with it as a source of trusted CA's. + + If that module is not available, then HTTP::Tiny will search several + system-specific default locations for a CA certificate file: +@@ -2081,13 +2089,33 @@ system-specific default locations for a CA certificate file: + + /etc/ssl/ca-bundle.pem + ++=item * ++ ++/etc/openssl/certs/ca-certificates.crt ++ ++=item * ++ ++/etc/ssl/cert.pem ++ ++=item * ++ ++/usr/local/share/certs/ca-root-nss.crt ++ ++=item * ++ ++/etc/pki/tls/cacert.pem ++ ++=item * ++ ++/etc/certs/ca-certificates.crt ++ + =back + + An exception will be raised if C<verify_SSL> is true and no CA certificate file + is available. + +-If you desire complete control over SSL connections, the C<SSL_options> attribute +-lets you provide a hash reference that will be passed through to ++If you desire complete control over TLS/SSL connections, the C<SSL_options> ++attribute lets you provide a hash reference that will be passed through to + C<IO::Socket::SSL::start_SSL()>, overriding any options set by HTTP::Tiny. For + example, to provide your own trusted CA file: + +@@ -2097,7 +2125,7 @@ example, to provide your own trusted CA file: + + The C<SSL_options> attribute could also be used for such things as providing a + client certificate for authentication to a server or controlling the choice of +-cipher used for the SSL connection. See L<IO::Socket::SSL> documentation for ++cipher used for the TLS/SSL connection. See L<IO::Socket::SSL> documentation for + details. + + =head1 PROXY SUPPORT +-- +2.40.0 diff --git a/meta/recipes-devtools/perl/files/CVE-2023-31486-0002.patch b/meta/recipes-devtools/perl/files/CVE-2023-31486-0002.patch new file mode 100644 index 0000000000..45452be389 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2023-31486-0002.patch @@ -0,0 +1,36 @@ +From a22785783b17cbaa28afaee4a024d81a1903701d +From: Stig Palmquist <git@stig.io> +Date: Sun Jun 18 11:36:05 2023 +0200 +Subject: [PATCH] Fix incorrect env var name for verify_SSL default + +The variable to override the verify_SSL default differed slightly in the +documentation from what was checked for in the code. + +This commit makes the code use `PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT` +as documented, instead of `PERL_HTTP_TINY_INSECURE_BY_DEFAULT` which was +missing `SSL_` + +CVE: CVE-2023-31486 + +Upstream-Status: Backport [https://github.com/chansen/p5-http-tiny/commit/a22785783b17cbaa28afaee4a024d81a1903701d] + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + cpan/HTTP-Tiny/lib/HTTP/Tiny.pm | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm +index ebc34a1..65ac8ff 100644 +--- a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm ++++ b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm +@@ -148,7 +148,7 @@ sub _verify_SSL_default { + my ($self) = @_; + # Check if insecure default certificate verification behaviour has been + # changed by the user by setting PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT=1 +- return (($ENV{PERL_HTTP_TINY_INSECURE_BY_DEFAULT} || '') eq '1') ? 0 : 1; ++ return (($ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT} || '') eq '1') ? 0 : 1; + } + + sub _set_proxies { +-- +2.40.0 diff --git a/meta/recipes-devtools/perl/perl_5.34.1.bb b/meta/recipes-devtools/perl/perl_5.34.3.bb index 42bcb8b1bc..215990c8fa 100644 --- a/meta/recipes-devtools/perl/perl_5.34.1.bb +++ b/meta/recipes-devtools/perl/perl_5.34.3.bb @@ -18,6 +18,9 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://determinism.patch \ file://0001-cpan-Sys-Syslog-Makefile.PL-Fix-_PATH_LOG-for-determ.patch \ file://0001-Fix-build-with-gcc-12.patch \ + file://CVE-2023-31484.patch \ + file://CVE-2023-31486-0001.patch \ + file://CVE-2023-31486-0002.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \ @@ -26,7 +29,7 @@ SRC_URI:append:class-target = " \ file://encodefix.patch \ " -SRC_URI[perl.sha256sum] = "357951a491b0ba1ce3611263922feec78ccd581dddc24a446b033e25acf242a1" +SRC_URI[perl.sha256sum] = "5b12f62863332b2a5f54102af9cdf8c010877e4bf3294911edbd594b2a1e8ede" S = "${WORKDIR}/perl-${PV}" @@ -45,6 +48,9 @@ PACKAGECONFIG[gdbm] = ",-Ui_gdbm,gdbm" # Don't generate comments in enc2xs output files. They are not reproducible export ENC2XS_NO_COMMENTS = "1" +# Duplicate of CVE-2023-47038, which has already been patched as of perl_5.34.3 +CVE_CHECK_IGNORE:append = " CVE-2023-47100" + do_configure:prepend() { cp -rfp ${STAGING_DATADIR_NATIVE}/perl-cross/* ${S} } diff --git a/meta/recipes-devtools/pkgconf/pkgconf/0001-tuple-test-for-and-stop-string-processing-on-truncat.patch b/meta/recipes-devtools/pkgconf/pkgconf/0001-tuple-test-for-and-stop-string-processing-on-truncat.patch new file mode 100644 index 0000000000..c6ec7c94e1 --- /dev/null +++ b/meta/recipes-devtools/pkgconf/pkgconf/0001-tuple-test-for-and-stop-string-processing-on-truncat.patch @@ -0,0 +1,75 @@ +From 9368831d360c0e47df55d1bb25c3517269320c5f Mon Sep 17 00:00:00 2001 +From: Ariadne Conill <ariadne@dereferenced.org> +Date: Wed, 15 Mar 2023 16:12:43 +0800 +Subject: [PATCH] tuple: test for, and stop string processing, on truncation + +otherwise a buffer overflow occurs. +this has been a bug in pkgconf since the beginning, it seems. +instead of disclosing the bug correctly, a "hotshot" developer +decided to blog about it instead. sigh. + +https://nullprogram.com/blog/2023/01/18/ + +Upstream-Status: Backport [https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059] +CVE: CVE-2023-24056 +Signed-off-by: Hongxu Jia <hongxu.jia@eng.windriver.com> +--- + libpkgconf/tuple.c | 28 +++++++++++++++++++++++----- + 1 file changed, 23 insertions(+), 5 deletions(-) + +diff --git a/libpkgconf/tuple.c b/libpkgconf/tuple.c +index 2d550d8..b831070 100644 +--- a/libpkgconf/tuple.c ++++ b/libpkgconf/tuple.c +@@ -293,12 +293,21 @@ pkgconf_tuple_parse(const pkgconf_client_t *client, pkgconf_list_t *vars, const + } + } + ++ size_t remain = PKGCONF_BUFSIZE - (bptr - buf); + ptr += (pptr - ptr); + kv = pkgconf_tuple_find_global(client, varname); + if (kv != NULL) + { +- strncpy(bptr, kv, PKGCONF_BUFSIZE - (bptr - buf)); +- bptr += strlen(kv); ++ size_t nlen = pkgconf_strlcpy(bptr, kv, remain); ++ if (nlen > remain) ++ { ++ pkgconf_warn(client, "warning: truncating very long variable to 64KB\n"); ++ ++ bptr = buf + (PKGCONF_BUFSIZE - 1); ++ break; ++ } ++ ++ bptr += nlen; + } + else + { +@@ -306,12 +315,21 @@ pkgconf_tuple_parse(const pkgconf_client_t *client, pkgconf_list_t *vars, const + + if (kv != NULL) + { ++ size_t nlen; ++ + parsekv = pkgconf_tuple_parse(client, vars, kv); ++ nlen = pkgconf_strlcpy(bptr, parsekv, remain); ++ free(parsekv); + +- strncpy(bptr, parsekv, PKGCONF_BUFSIZE - (bptr - buf)); +- bptr += strlen(parsekv); ++ if (nlen > remain) ++ { ++ pkgconf_warn(client, "warning: truncating very long variable to 64KB\n"); + +- free(parsekv); ++ bptr = buf + (PKGCONF_BUFSIZE - 1); ++ break; ++ } ++ ++ bptr += nlen; + } + } + } +-- +2.27.0 + diff --git a/meta/recipes-devtools/pkgconf/pkgconf_1.8.0.bb b/meta/recipes-devtools/pkgconf/pkgconf_1.8.0.bb index 887e15e28c..cad0a0fa4f 100644 --- a/meta/recipes-devtools/pkgconf/pkgconf_1.8.0.bb +++ b/meta/recipes-devtools/pkgconf/pkgconf_1.8.0.bb @@ -16,6 +16,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=2214222ec1a820bd6cc75167a56925e0" SRC_URI = "\ https://distfiles.dereferenced.org/pkgconf/pkgconf-${PV}.tar.xz \ + file://0001-tuple-test-for-and-stop-string-processing-on-truncat.patch \ file://pkg-config-wrapper \ file://pkg-config-native.in \ file://pkg-config-esdk.in \ diff --git a/meta/recipes-devtools/pseudo/files/glibc238.patch b/meta/recipes-devtools/pseudo/files/glibc238.patch new file mode 100644 index 0000000000..76ca8c11eb --- /dev/null +++ b/meta/recipes-devtools/pseudo/files/glibc238.patch @@ -0,0 +1,72 @@ +glibc 2.38 would include __isoc23_strtol and similar symbols. This is trggerd by +_GNU_SOURCE but we have to set that for other definitions. Therefore play with defines +to turn this off within pseudo_wrappers.c. Elsewhere we can switch to _DEFAULT_SOURCE +rather than _GNU_SOURCE. + +Upstream-Status: Pending + +Index: git/pseudo_wrappers.c +=================================================================== +--- git.orig/pseudo_wrappers.c ++++ git/pseudo_wrappers.c +@@ -6,6 +6,15 @@ + * SPDX-License-Identifier: LGPL-2.1-only + * + */ ++/* glibc 2.38 would include __isoc23_strtol and similar symbols. This is trggerd by ++ * _GNU_SOURCE but we have to set that for other definitions. Therefore play with defines ++ * to turn this off. ++ */ ++#include <features.h> ++#undef __GLIBC_USE_ISOC2X ++#undef __GLIBC_USE_C2X_STRTOL ++#define __GLIBC_USE_C2X_STRTOL 0 ++ + #include <assert.h> + #include <stdlib.h> + #include <limits.h> +Index: git/pseudo_util.c +=================================================================== +--- git.orig/pseudo_util.c ++++ git/pseudo_util.c +@@ -8,6 +8,14 @@ + */ + /* we need access to RTLD_NEXT for a horrible workaround */ + #define _GNU_SOURCE ++/* glibc 2.38 would include __isoc23_strtol and similar symbols. This is trggerd by ++ * _GNU_SOURCE but we have to set that for other definitions. Therefore play with defines ++ * to turn this off. ++ */ ++#include <features.h> ++#undef __GLIBC_USE_ISOC2X ++#undef __GLIBC_USE_C2X_STRTOL ++#define __GLIBC_USE_C2X_STRTOL 0 + + #include <ctype.h> + #include <errno.h> +Index: git/pseudolog.c +=================================================================== +--- git.orig/pseudolog.c ++++ git/pseudolog.c +@@ -8,7 +8,7 @@ + */ + /* We need _XOPEN_SOURCE for strptime(), but if we define that, + * we then don't get S_IFSOCK... _GNU_SOURCE turns on everything. */ +-#define _GNU_SOURCE ++#define _DEFAULT_SOURCE + + #include <ctype.h> + #include <limits.h> +Index: git/pseudo_client.c +=================================================================== +--- git.orig/pseudo_client.c ++++ git/pseudo_client.c +@@ -6,7 +6,7 @@ + * SPDX-License-Identifier: LGPL-2.1-only + * + */ +-#define _GNU_SOURCE ++#define _DEFAULT_SOURCE + + #include <stdio.h> + #include <signal.h> diff --git a/meta/recipes-devtools/pseudo/pseudo_git.bb b/meta/recipes-devtools/pseudo/pseudo_git.bb index c34580b4ff..4dd9156238 100644 --- a/meta/recipes-devtools/pseudo/pseudo_git.bb +++ b/meta/recipes-devtools/pseudo/pseudo_git.bb @@ -2,6 +2,7 @@ require pseudo.inc SRC_URI = "git://git.yoctoproject.org/pseudo;branch=oe-core \ file://0001-configure-Prune-PIE-flags.patch \ + file://glibc238.patch \ file://fallback-passwd \ file://fallback-group \ " diff --git a/meta/recipes-devtools/python/python3-certifi/CVE-2022-23491.patch b/meta/recipes-devtools/python/python3-certifi/CVE-2022-23491.patch new file mode 100644 index 0000000000..94ca254549 --- /dev/null +++ b/meta/recipes-devtools/python/python3-certifi/CVE-2022-23491.patch @@ -0,0 +1,230 @@ +From 167413eefa9482a7777b3ccdcc70e511ef5fcc2b Mon Sep 17 00:00:00 2001 +From: Narpat Mali <narpat.mali@windriver.com> +Date: Thu, 2 Feb 2023 12:57:06 +0000 +Subject: [PATCH] Certifi is a curated collection of Root Certificates for + validating the trustworthiness of SSL certificates while verifying the + identity of TLS hosts. Certifi 2022.12.07 removes root certificates from + "TrustCor" from the root store. These are in the process of being removed + from Mozilla's trust store. TrustCor's root certificates are being removed + pursuant to an investigation prompted by media reporting that TrustCor's + ownership also operated a business that produced spyware. Conclusions of + Mozilla's investigation can be found in the linked google group discussion. + +CVE: CVE-2022-23491 + +Upstream-Status: Backport [https://github.com/certifi/python-certifi/commit/9e9e840925d7b8e76c76fdac1fab7e6e88c1c3b8] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + certifi/cacert.pem | 181 --------------------------------------------- + 1 file changed, 181 deletions(-) + +diff --git a/certifi/cacert.pem b/certifi/cacert.pem +index 6d0ccc0..6bae3e4 100644 +--- a/certifi/cacert.pem ++++ b/certifi/cacert.pem +@@ -694,37 +694,6 @@ BA6+C4OmF4O5MBKgxTMVBbkN+8cFduPYSo38NBejxiEovjBFMR7HeL5YYTisO+IB + ZQ== + -----END CERTIFICATE----- + +-# Issuer: CN=Network Solutions Certificate Authority O=Network Solutions L.L.C. +-# Subject: CN=Network Solutions Certificate Authority O=Network Solutions L.L.C. +-# Label: "Network Solutions Certificate Authority" +-# Serial: 116697915152937497490437556386812487904 +-# MD5 Fingerprint: d3:f3:a6:16:c0:fa:6b:1d:59:b1:2d:96:4d:0e:11:2e +-# SHA1 Fingerprint: 74:f8:a3:c3:ef:e7:b3:90:06:4b:83:90:3c:21:64:60:20:e5:df:ce +-# SHA256 Fingerprint: 15:f0:ba:00:a3:ac:7a:f3:ac:88:4c:07:2b:10:11:a0:77:bd:77:c0:97:f4:01:64:b2:f8:59:8a:bd:83:86:0c +------BEGIN CERTIFICATE----- +-MIID5jCCAs6gAwIBAgIQV8szb8JcFuZHFhfjkDFo4DANBgkqhkiG9w0BAQUFADBi +-MQswCQYDVQQGEwJVUzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMu +-MTAwLgYDVQQDEydOZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3Jp +-dHkwHhcNMDYxMjAxMDAwMDAwWhcNMjkxMjMxMjM1OTU5WjBiMQswCQYDVQQGEwJV +-UzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMuMTAwLgYDVQQDEydO +-ZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEiMA0GCSqG +-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkvH6SMG3G2I4rC7xGzuAnlt7e+foS0zwz +-c7MEL7xxjOWftiJgPl9dzgn/ggwbmlFQGiaJ3dVhXRncEg8tCqJDXRfQNJIg6nPP +-OCwGJgl6cvf6UDL4wpPTaaIjzkGxzOTVHzbRijr4jGPiFFlp7Q3Tf2vouAPlT2rl +-mGNpSAW+Lv8ztumXWWn4Zxmuk2GWRBXTcrA/vGp97Eh/jcOrqnErU2lBUzS1sLnF +-BgrEsEX1QV1uiUV7PTsmjHTC5dLRfbIR1PtYMiKagMnc/Qzpf14Dl847ABSHJ3A4 +-qY5usyd2mFHgBeMhqxrVhSI8KbWaFsWAqPS7azCPL0YCorEMIuDTAgMBAAGjgZcw +-gZQwHQYDVR0OBBYEFCEwyfsA106Y2oeqKtCnLrFAMadMMA4GA1UdDwEB/wQEAwIB +-BjAPBgNVHRMBAf8EBTADAQH/MFIGA1UdHwRLMEkwR6BFoEOGQWh0dHA6Ly9jcmwu +-bmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zQ2VydGlmaWNhdGVBdXRob3Jp +-dHkuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8 +-6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/ +-h1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH +-/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv +-wKeI8lN3s2Berq4o2jUsbzRF0ybh3uxbTydrFny9RAQYgrOJeRcQcT16ohZO9QHN +-pGxlaKFJdlxDydi8NmdspZS11My5vWo1ViHe2MPr+8ukYEywVaCge1ey +------END CERTIFICATE----- +- + # Issuer: CN=COMODO ECC Certification Authority O=COMODO CA Limited + # Subject: CN=COMODO ECC Certification Authority O=COMODO CA Limited + # Label: "COMODO ECC Certification Authority" +@@ -2385,46 +2354,6 @@ KoZIzj0EAwMDaAAwZQIxAOVpEslu28YxuglB4Zf4+/2a4n0Sye18ZNPLBSWLVtmg + xwy8p2Fp8fc74SrL+SvzZpA3 + -----END CERTIFICATE----- + +-# Issuer: CN=Staat der Nederlanden EV Root CA O=Staat der Nederlanden +-# Subject: CN=Staat der Nederlanden EV Root CA O=Staat der Nederlanden +-# Label: "Staat der Nederlanden EV Root CA" +-# Serial: 10000013 +-# MD5 Fingerprint: fc:06:af:7b:e8:1a:f1:9a:b4:e8:d2:70:1f:c0:f5:ba +-# SHA1 Fingerprint: 76:e2:7e:c1:4f:db:82:c1:c0:a6:75:b5:05:be:3d:29:b4:ed:db:bb +-# SHA256 Fingerprint: 4d:24:91:41:4c:fe:95:67:46:ec:4c:ef:a6:cf:6f:72:e2:8a:13:29:43:2f:9d:8a:90:7a:c4:cb:5d:ad:c1:5a +------BEGIN CERTIFICATE----- +-MIIFcDCCA1igAwIBAgIEAJiWjTANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJO +-TDEeMBwGA1UECgwVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSkwJwYDVQQDDCBTdGFh +-dCBkZXIgTmVkZXJsYW5kZW4gRVYgUm9vdCBDQTAeFw0xMDEyMDgxMTE5MjlaFw0y +-MjEyMDgxMTEwMjhaMFgxCzAJBgNVBAYTAk5MMR4wHAYDVQQKDBVTdGFhdCBkZXIg +-TmVkZXJsYW5kZW4xKTAnBgNVBAMMIFN0YWF0IGRlciBOZWRlcmxhbmRlbiBFViBS +-b290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA48d+ifkkSzrS +-M4M1LGns3Amk41GoJSt5uAg94JG6hIXGhaTK5skuU6TJJB79VWZxXSzFYGgEt9nC +-UiY4iKTWO0Cmws0/zZiTs1QUWJZV1VD+hq2kY39ch/aO5ieSZxeSAgMs3NZmdO3d +-Z//BYY1jTw+bbRcwJu+r0h8QoPnFfxZpgQNH7R5ojXKhTbImxrpsX23Wr9GxE46p +-rfNeaXUmGD5BKyF/7otdBwadQ8QpCiv8Kj6GyzyDOvnJDdrFmeK8eEEzduG/L13l +-pJhQDBXd4Pqcfzho0LKmeqfRMb1+ilgnQ7O6M5HTp5gVXJrm0w912fxBmJc+qiXb +-j5IusHsMX/FjqTf5m3VpTCgmJdrV8hJwRVXj33NeN/UhbJCONVrJ0yPr08C+eKxC +-KFhmpUZtcALXEPlLVPxdhkqHz3/KRawRWrUgUY0viEeXOcDPusBCAUCZSCELa6fS +-/ZbV0b5GnUngC6agIk440ME8MLxwjyx1zNDFjFE7PZQIZCZhfbnDZY8UnCHQqv0X +-cgOPvZuM5l5Tnrmd74K74bzickFbIZTTRTeU0d8JOV3nI6qaHcptqAqGhYqCvkIH +-1vI4gnPah1vlPNOePqc7nvQDs/nxfRN0Av+7oeX6AHkcpmZBiFxgV6YuCcS6/ZrP +-px9Aw7vMWgpVSzs4dlG4Y4uElBbmVvMCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB +-/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFP6rAJCYniT8qcwaivsnuL8wbqg7 +-MA0GCSqGSIb3DQEBCwUAA4ICAQDPdyxuVr5Os7aEAJSrR8kN0nbHhp8dB9O2tLsI +-eK9p0gtJ3jPFrK3CiAJ9Brc1AsFgyb/E6JTe1NOpEyVa/m6irn0F3H3zbPB+po3u +-2dfOWBfoqSmuc0iH55vKbimhZF8ZE/euBhD/UcabTVUlT5OZEAFTdfETzsemQUHS +-v4ilf0X8rLiltTMMgsT7B/Zq5SWEXwbKwYY5EdtYzXc7LMJMD16a4/CrPmEbUCTC +-wPTxGfARKbalGAKb12NMcIxHowNDXLldRqANb/9Zjr7dn3LDWyvfjFvO5QxGbJKy +-CqNMVEIYFRIYvdr8unRu/8G2oGTYqV9Vrp9canaW2HNnh/tNf1zuacpzEPuKqf2e +-vTY4SUmH9A4U8OmHuD+nT3pajnnUk+S7aFKErGzp85hwVXIy+TSrK0m1zSBi5Dp6 +-Z2Orltxtrpfs/J92VoguZs9btsmksNcFuuEnL5O7Jiqik7Ab846+HUCjuTaPPoIa +-Gl6I6lD4WeKDRikL40Rc4ZW2aZCaFG+XroHPaO+Zmr615+F/+PoTRxZMzG0IQOeL +-eG9QgkRQP2YGiqtDhFZKDyAthg710tvSeopLzaXoTvFeJiUBWSOgftL2fiFX1ye8 +-FVdMpEbB4IMeDExNH08GGeL5qPQ6gqGyeUN51q1veieQA6TqJIc/2b3Z6fJfUEkc +-7uzXLg== +------END CERTIFICATE----- +- + # Issuer: CN=IdenTrust Commercial Root CA 1 O=IdenTrust + # Subject: CN=IdenTrust Commercial Root CA 1 O=IdenTrust + # Label: "IdenTrust Commercial Root CA 1" +@@ -3032,116 +2961,6 @@ T8p+ck0LcIymSLumoRT2+1hEmRSuqguTaaApJUqlyyvdimYHFngVV3Eb7PVHhPOe + MTd61X8kreS8/f3MboPoDKi3QWwH3b08hpcv0g== + -----END CERTIFICATE----- + +-# Issuer: CN=TrustCor RootCert CA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority +-# Subject: CN=TrustCor RootCert CA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority +-# Label: "TrustCor RootCert CA-1" +-# Serial: 15752444095811006489 +-# MD5 Fingerprint: 6e:85:f1:dc:1a:00:d3:22:d5:b2:b2:ac:6b:37:05:45 +-# SHA1 Fingerprint: ff:bd:cd:e7:82:c8:43:5e:3c:6f:26:86:5c:ca:a8:3a:45:5b:c3:0a +-# SHA256 Fingerprint: d4:0e:9c:86:cd:8f:e4:68:c1:77:69:59:f4:9e:a7:74:fa:54:86:84:b6:c4:06:f3:90:92:61:f4:dc:e2:57:5c +------BEGIN CERTIFICATE----- +-MIIEMDCCAxigAwIBAgIJANqb7HHzA7AZMA0GCSqGSIb3DQEBCwUAMIGkMQswCQYD +-VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk +-MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U +-cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRydXN0Q29y +-IFJvb3RDZXJ0IENBLTEwHhcNMTYwMjA0MTIzMjE2WhcNMjkxMjMxMTcyMzE2WjCB +-pDELMAkGA1UEBhMCUEExDzANBgNVBAgMBlBhbmFtYTEUMBIGA1UEBwwLUGFuYW1h +-IENpdHkxJDAiBgNVBAoMG1RydXN0Q29yIFN5c3RlbXMgUy4gZGUgUi5MLjEnMCUG +-A1UECwweVHJ1c3RDb3IgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR8wHQYDVQQDDBZU +-cnVzdENvciBSb290Q2VydCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB +-CgKCAQEAv463leLCJhJrMxnHQFgKq1mqjQCj/IDHUHuO1CAmujIS2CNUSSUQIpid +-RtLByZ5OGy4sDjjzGiVoHKZaBeYei0i/mJZ0PmnK6bV4pQa81QBeCQryJ3pS/C3V +-seq0iWEk8xoT26nPUu0MJLq5nux+AHT6k61sKZKuUbS701e/s/OojZz0JEsq1pme +-9J7+wH5COucLlVPat2gOkEz7cD+PSiyU8ybdY2mplNgQTsVHCJCZGxdNuWxu72CV +-EY4hgLW9oHPY0LJ3xEXqWib7ZnZ2+AYfYW0PVcWDtxBWcgYHpfOxGgMFZA6dWorW +-hnAbJN7+KIor0Gqw/Hqi3LJ5DotlDwIDAQABo2MwYTAdBgNVHQ4EFgQU7mtJPHo/ +-DeOxCbeKyKsZn3MzUOcwHwYDVR0jBBgwFoAU7mtJPHo/DeOxCbeKyKsZn3MzUOcw +-DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD +-ggEBACUY1JGPE+6PHh0RU9otRCkZoB5rMZ5NDp6tPVxBb5UrJKF5mDo4Nvu7Zp5I +-/5CQ7z3UuJu0h3U/IJvOcs+hVcFNZKIZBqEHMwwLKeXx6quj7LUKdJDHfXLy11yf +-ke+Ri7fc7Waiz45mO7yfOgLgJ90WmMCV1Aqk5IGadZQ1nJBfiDcGrVmVCrDRZ9MZ +-yonnMlo2HD6CqFqTvsbQZJG2z9m2GM/bftJlo6bEjhcxwft+dtvTheNYsnd6djts +-L1Ac59v2Z3kf9YKVmgenFK+P3CghZwnS1k1aHBkcjndcw5QkPTJrS37UeJSDvjdN +-zl/HHk484IkzlQsPpTLWPFp5LBk= +------END CERTIFICATE----- +- +-# Issuer: CN=TrustCor RootCert CA-2 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority +-# Subject: CN=TrustCor RootCert CA-2 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority +-# Label: "TrustCor RootCert CA-2" +-# Serial: 2711694510199101698 +-# MD5 Fingerprint: a2:e1:f8:18:0b:ba:45:d5:c7:41:2a:bb:37:52:45:64 +-# SHA1 Fingerprint: b8:be:6d:cb:56:f1:55:b9:63:d4:12:ca:4e:06:34:c7:94:b2:1c:c0 +-# SHA256 Fingerprint: 07:53:e9:40:37:8c:1b:d5:e3:83:6e:39:5d:ae:a5:cb:83:9e:50:46:f1:bd:0e:ae:19:51:cf:10:fe:c7:c9:65 +------BEGIN CERTIFICATE----- +-MIIGLzCCBBegAwIBAgIIJaHfyjPLWQIwDQYJKoZIhvcNAQELBQAwgaQxCzAJBgNV +-BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw +-IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy +-dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEfMB0GA1UEAwwWVHJ1c3RDb3Ig +-Um9vdENlcnQgQ0EtMjAeFw0xNjAyMDQxMjMyMjNaFw0zNDEyMzExNzI2MzlaMIGk +-MQswCQYDVQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEg +-Q2l0eTEkMCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYD +-VQQLDB5UcnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRy +-dXN0Q29yIFJvb3RDZXJ0IENBLTIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK +-AoICAQCnIG7CKqJiJJWQdsg4foDSq8GbZQWU9MEKENUCrO2fk8eHyLAnK0IMPQo+ +-QVqedd2NyuCb7GgypGmSaIwLgQ5WoD4a3SwlFIIvl9NkRvRUqdw6VC0xK5mC8tkq +-1+9xALgxpL56JAfDQiDyitSSBBtlVkxs1Pu2YVpHI7TYabS3OtB0PAx1oYxOdqHp +-2yqlO/rOsP9+aij9JxzIsekp8VduZLTQwRVtDr4uDkbIXvRR/u8OYzo7cbrPb1nK +-DOObXUm4TOJXsZiKQlecdu/vvdFoqNL0Cbt3Nb4lggjEFixEIFapRBF37120Hape +-az6LMvYHL1cEksr1/p3C6eizjkxLAjHZ5DxIgif3GIJ2SDpxsROhOdUuxTTCHWKF +-3wP+TfSvPd9cW436cOGlfifHhi5qjxLGhF5DUVCcGZt45vz27Ud+ez1m7xMTiF88 +-oWP7+ayHNZ/zgp6kPwqcMWmLmaSISo5uZk3vFsQPeSghYA2FFn3XVDjxklb9tTNM +-g9zXEJ9L/cb4Qr26fHMC4P99zVvh1Kxhe1fVSntb1IVYJ12/+CtgrKAmrhQhJ8Z3 +-mjOAPF5GP/fDsaOGM8boXg25NSyqRsGFAnWAoOsk+xWq5Gd/bnc/9ASKL3x74xdh +-8N0JqSDIvgmk0H5Ew7IwSjiqqewYmgeCK9u4nBit2uBGF6zPXQIDAQABo2MwYTAd +-BgNVHQ4EFgQU2f4hQG6UnrybPZx9mCAZ5YwwYrIwHwYDVR0jBBgwFoAU2f4hQG6U +-nrybPZx9mCAZ5YwwYrIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYw +-DQYJKoZIhvcNAQELBQADggIBAJ5Fngw7tu/hOsh80QA9z+LqBrWyOrsGS2h60COX +-dKcs8AjYeVrXWoSK2BKaG9l9XE1wxaX5q+WjiYndAfrs3fnpkpfbsEZC89NiqpX+ +-MWcUaViQCqoL7jcjx1BRtPV+nuN79+TMQjItSQzL/0kMmx40/W5ulop5A7Zv2wnL +-/V9lFDfhOPXzYRZY5LVtDQsEGz9QLX+zx3oaFoBg+Iof6Rsqxvm6ARppv9JYx1RX +-CI/hOWB3S6xZhBqI8d3LT3jX5+EzLfzuQfogsL7L9ziUwOHQhQ+77Sxzq+3+knYa +-ZH9bDTMJBzN7Bj8RpFxwPIXAz+OQqIN3+tvmxYxoZxBnpVIt8MSZj3+/0WvitUfW +-2dCFmU2Umw9Lje4AWkcdEQOsQRivh7dvDDqPys/cA8GiCcjl/YBeyGBCARsaU1q7 +-N6a3vLqE6R5sGtRk2tRD/pOLS/IseRYQ1JMLiI+h2IYURpFHmygk71dSTlxCnKr3 +-Sewn6EAes6aJInKc9Q0ztFijMDvd1GpUk74aTfOTlPf8hAs/hCBcNANExdqtvArB +-As8e5ZTZ845b2EzwnexhF7sUMlQMAimTHpKG9n/v55IFDlndmQguLvqcAFLTxWYp +-5KeXRKQOKIETNcX2b2TmQcTVL8w0RSXPQQCWPUouwpaYT05KnJe32x+SMsj/D1Fu +-1uwJ +------END CERTIFICATE----- +- +-# Issuer: CN=TrustCor ECA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority +-# Subject: CN=TrustCor ECA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority +-# Label: "TrustCor ECA-1" +-# Serial: 9548242946988625984 +-# MD5 Fingerprint: 27:92:23:1d:0a:f5:40:7c:e9:e6:6b:9d:d8:f5:e7:6c +-# SHA1 Fingerprint: 58:d1:df:95:95:67:6b:63:c0:f0:5b:1c:17:4d:8b:84:0b:c8:78:bd +-# SHA256 Fingerprint: 5a:88:5d:b1:9c:01:d9:12:c5:75:93:88:93:8c:af:bb:df:03:1a:b2:d4:8e:91:ee:15:58:9b:42:97:1d:03:9c +------BEGIN CERTIFICATE----- +-MIIEIDCCAwigAwIBAgIJAISCLF8cYtBAMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD +-VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk +-MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U +-cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxFzAVBgNVBAMMDlRydXN0Q29y +-IEVDQS0xMB4XDTE2MDIwNDEyMzIzM1oXDTI5MTIzMTE3MjgwN1owgZwxCzAJBgNV +-BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw +-IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy +-dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAwwOVHJ1c3RDb3Ig +-RUNBLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPj+ARtZ+odnbb +-3w9U73NjKYKtR8aja+3+XzP4Q1HpGjORMRegdMTUpwHmspI+ap3tDvl0mEDTPwOA +-BoJA6LHip1GnHYMma6ve+heRK9jGrB6xnhkB1Zem6g23xFUfJ3zSCNV2HykVh0A5 +-3ThFEXXQmqc04L/NyFIduUd+Dbi7xgz2c1cWWn5DkR9VOsZtRASqnKmcp0yJF4Ou +-owReUoCLHhIlERnXDH19MURB6tuvsBzvgdAsxZohmz3tQjtQJvLsznFhBmIhVE5/ +-wZ0+fyCMgMsq2JdiyIMzkX2woloPV+g7zPIlstR8L+xNxqE6FXrntl019fZISjZF +-ZtS6mFjBAgMBAAGjYzBhMB0GA1UdDgQWBBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAf +-BgNVHSMEGDAWgBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAPBgNVHRMBAf8EBTADAQH/ +-MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEABT41XBVwm8nHc2Fv +-civUwo/yQ10CzsSUuZQRg2dd4mdsdXa/uwyqNsatR5Nj3B5+1t4u/ukZMjgDfxT2 +-AHMsWbEhBuH7rBiVDKP/mZb3Kyeb1STMHd3BOuCYRLDE5D53sXOpZCz2HAF8P11F +-hcCF5yWPldwX8zyfGm6wyuMdKulMY/okYWLW2n62HGz1Ah3UKt1VkOsqEUc8Ll50 +-soIipX1TH0XsJ5F95yIW6MBoNtjG8U+ARDL54dHRHareqKucBK+tIA5kmE2la8BI +-WJZpTdwHjFGTot+fDz2LYLSCjaoITmJF4PkL0uDgPFveXHEnJcLmA4GLEFPjx1Wi +-tJ/X5g== +------END CERTIFICATE----- +- + # Issuer: CN=SSL.com Root Certification Authority RSA O=SSL Corporation + # Subject: CN=SSL.com Root Certification Authority RSA O=SSL Corporation + # Label: "SSL.com Root Certification Authority RSA" +-- +2.34.1 + diff --git a/meta/recipes-devtools/python/python3-certifi/CVE-2023-37920.patch b/meta/recipes-devtools/python/python3-certifi/CVE-2023-37920.patch new file mode 100644 index 0000000000..62187ec469 --- /dev/null +++ b/meta/recipes-devtools/python/python3-certifi/CVE-2023-37920.patch @@ -0,0 +1,301 @@ +From 2dfddd74a75e4a1fa9bb901ba31a96e13b98a4e2 Mon Sep 17 00:00:00 2001 +From: Narpat Mali <narpat.mali@windriver.com> +Date: Wed, 2 Aug 2023 16:05:04 +0000 +Subject: [PATCH] Certifi is a curated collection of Root Certificates for + validating the trustworthiness of SSL certificates while verifying the + identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes + "e-Tugra" root certificates. e-Tugra's root certificates were subject to an + investigation prompted by reporting of security issues in their systems. + Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root + store. + +CVE: CVE-2023-37920 + +Upstream-Status: Backport [https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + certifi/cacert.pem | 257 ++++++++++++++++++++++++++++++++------------- + 1 file changed, 185 insertions(+), 72 deletions(-) + +diff --git a/certifi/cacert.pem b/certifi/cacert.pem +index 6bae3e4..1bec256 100644 +--- a/certifi/cacert.pem ++++ b/certifi/cacert.pem +@@ -879,34 +879,6 @@ uLjbvrW5KfnaNwUASZQDhETnv0Mxz3WLJdH0pmT1kvarBes96aULNmLazAZfNou2 + XjG4Kvte9nHfRCaexOYNkbQudZWAUWpLMKawYqGT8ZvYzsRjdT9ZR7E= + -----END CERTIFICATE----- + +-# Issuer: CN=Hongkong Post Root CA 1 O=Hongkong Post +-# Subject: CN=Hongkong Post Root CA 1 O=Hongkong Post +-# Label: "Hongkong Post Root CA 1" +-# Serial: 1000 +-# MD5 Fingerprint: a8:0d:6f:39:78:b9:43:6d:77:42:6d:98:5a:cc:23:ca +-# SHA1 Fingerprint: d6:da:a8:20:8d:09:d2:15:4d:24:b5:2f:cb:34:6e:b2:58:b2:8a:58 +-# SHA256 Fingerprint: f9:e6:7d:33:6c:51:00:2a:c0:54:c6:32:02:2d:66:dd:a2:e7:e3:ff:f1:0a:d0:61:ed:31:d8:bb:b4:10:cf:b2 +------BEGIN CERTIFICATE----- +-MIIDMDCCAhigAwIBAgICA+gwDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UEBhMCSEsx +-FjAUBgNVBAoTDUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdrb25nIFBvc3Qg +-Um9vdCBDQSAxMB4XDTAzMDUxNTA1MTMxNFoXDTIzMDUxNTA0NTIyOVowRzELMAkG +-A1UEBhMCSEsxFjAUBgNVBAoTDUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdr +-b25nIFBvc3QgUm9vdCBDQSAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC +-AQEArP84tulmAknjorThkPlAj3n54r15/gK97iSSHSL22oVyaf7XPwnU3ZG1ApzQ +-jVrhVcNQhrkpJsLj2aDxaQMoIIBFIi1WpztUlVYiWR8o3x8gPW2iNr4joLFutbEn +-PzlTCeqrauh0ssJlXI6/fMN4hM2eFvz1Lk8gKgifd/PFHsSaUmYeSF7jEAaPIpjh +-ZY4bXSNmO7ilMlHIhqqhqZ5/dpTCpmy3QfDVyAY45tQM4vM7TG1QjMSDJ8EThFk9 +-nnV0ttgCXjqQesBCNnLsak3c78QA3xMYV18meMjWCnl3v/evt3a5pQuEF10Q6m/h +-q5URX208o1xNg1vysxmKgIsLhwIDAQABoyYwJDASBgNVHRMBAf8ECDAGAQH/AgED +-MA4GA1UdDwEB/wQEAwIBxjANBgkqhkiG9w0BAQUFAAOCAQEADkbVPK7ih9legYsC +-mEEIjEy82tvuJxuC52pF7BaLT4Wg87JwvVqWuspube5Gi27nKi6Wsxkz67SfqLI3 +-7piol7Yutmcn1KZJ/RyTZXaeQi/cImyaT/JaFTmxcdcrUehtHJjA2Sr0oYJ71clB +-oiMBdDhViw+5LmeiIAQ32pwL0xch4I+XeTRvhEgCIDMb5jREn5Fw9IBehEPCKdJs +-EhTkYY2sEJCehFC78JZvRZ+K88psT/oROhUVRsPNH4NbLUES7VBnQRM9IauUiqpO +-fMGx+6fWtScvl6tu4B3i0RwsH0Ti/L6RoZz71ilTc4afU9hDDl3WY4JxHYB0yvbi +-AmvZWg== +------END CERTIFICATE----- +- + # Issuer: CN=SecureSign RootCA11 O=Japan Certification Services, Inc. + # Subject: CN=SecureSign RootCA11 O=Japan Certification Services, Inc. + # Label: "SecureSign RootCA11" +@@ -1836,50 +1808,6 @@ HL/EVlP6Y2XQ8xwOFvVrhlhNGNTkDY6lnVuR3HYkUD/GKvvZt5y11ubQ2egZixVx + SK236thZiNSQvxaz2emsWWFUyBy6ysHK4bkgTI86k4mloMy/0/Z1pHWWbVY= + -----END CERTIFICATE----- + +-# Issuer: CN=E-Tugra Certification Authority O=E-Tu\u011fra EBG Bili\u015fim Teknolojileri ve Hizmetleri A.\u015e. OU=E-Tugra Sertifikasyon Merkezi +-# Subject: CN=E-Tugra Certification Authority O=E-Tu\u011fra EBG Bili\u015fim Teknolojileri ve Hizmetleri A.\u015e. OU=E-Tugra Sertifikasyon Merkezi +-# Label: "E-Tugra Certification Authority" +-# Serial: 7667447206703254355 +-# MD5 Fingerprint: b8:a1:03:63:b0:bd:21:71:70:8a:6f:13:3a:bb:79:49 +-# SHA1 Fingerprint: 51:c6:e7:08:49:06:6e:f3:92:d4:5c:a0:0d:6d:a3:62:8f:c3:52:39 +-# SHA256 Fingerprint: b0:bf:d5:2b:b0:d7:d9:bd:92:bf:5d:4d:c1:3d:a2:55:c0:2c:54:2f:37:83:65:ea:89:39:11:f5:5e:55:f2:3c +------BEGIN CERTIFICATE----- +-MIIGSzCCBDOgAwIBAgIIamg+nFGby1MwDQYJKoZIhvcNAQELBQAwgbIxCzAJBgNV +-BAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBC +-aWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhpem1ldGxlcmkgQS7Fni4xJjAkBgNV +-BAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBNZXJrZXppMSgwJgYDVQQDDB9FLVR1 +-Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEzMDMwNTEyMDk0OFoXDTIz +-MDMwMzEyMDk0OFowgbIxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+ +-BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhp +-em1ldGxlcmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBN +-ZXJrZXppMSgwJgYDVQQDDB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5 +-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4vU/kwVRHoViVF56C/UY +-B4Oufq9899SKa6VjQzm5S/fDxmSJPZQuVIBSOTkHS0vdhQd2h8y/L5VMzH2nPbxH +-D5hw+IyFHnSOkm0bQNGZDbt1bsipa5rAhDGvykPL6ys06I+XawGb1Q5KCKpbknSF +-Q9OArqGIW66z6l7LFpp3RMih9lRozt6Plyu6W0ACDGQXwLWTzeHxE2bODHnv0ZEo +-q1+gElIwcxmOj+GMB6LDu0rw6h8VqO4lzKRG+Bsi77MOQ7osJLjFLFzUHPhdZL3D +-k14opz8n8Y4e0ypQBaNV2cvnOVPAmJ6MVGKLJrD3fY185MaeZkJVgkfnsliNZvcH +-fC425lAcP9tDJMW/hkd5s3kc91r0E+xs+D/iWR+V7kI+ua2oMoVJl0b+SzGPWsut +-dEcf6ZG33ygEIqDUD13ieU/qbIWGvaimzuT6w+Gzrt48Ue7LE3wBf4QOXVGUnhMM +-ti6lTPk5cDZvlsouDERVxcr6XQKj39ZkjFqzAQqptQpHF//vkUAqjqFGOjGY5RH8 +-zLtJVor8udBhmm9lbObDyz51Sf6Pp+KJxWfXnUYTTjF2OySznhFlhqt/7x3U+Lzn +-rFpct1pHXFXOVbQicVtbC/DP3KBhZOqp12gKY6fgDT+gr9Oq0n7vUaDmUStVkhUX +-U8u3Zg5mTPj5dUyQ5xJwx0UCAwEAAaNjMGEwHQYDVR0OBBYEFC7j27JJ0JxUeVz6 +-Jyr+zE7S6E5UMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAULuPbsknQnFR5 +-XPonKv7MTtLoTlQwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAF +-Nzr0TbdF4kV1JI+2d1LoHNgQk2Xz8lkGpD4eKexd0dCrfOAKkEh47U6YA5n+KGCR +-HTAduGN8qOY1tfrTYXbm1gdLymmasoR6d5NFFxWfJNCYExL/u6Au/U5Mh/jOXKqY +-GwXgAEZKgoClM4so3O0409/lPun++1ndYYRP0lSWE2ETPo+Aab6TR7U1Q9Jauz1c +-77NCR807VRMGsAnb/WP2OogKmW9+4c4bU2pEZiNRCHu8W1Ki/QY3OEBhj0qWuJA3 +-+GbHeJAAFS6LrVE1Uweoa2iu+U48BybNCAVwzDk/dr2l02cmAYamU9JgO3xDf1WK +-vJUawSg5TB9D0pH0clmKuVb8P7Sd2nCcdlqMQ1DujjByTd//SffGqWfZbawCEeI6 +-FiWnWAjLb1NBnEg4R2gz0dfHj9R0IdTDBZB6/86WiLEVKV0jq9BgoRJP3vQXzTLl +-yb/IQ639Lo7xr+L0mPoSHyDYwKcMhcWQ9DstliaxLL5Mq+ux0orJ23gTDx4JnW2P +-AJ8C2sH6H3p6CcRK5ogql5+Ji/03X186zjhZhkuvcQu02PJwT58yE+Owp1fl2tpD +-y4Q08ijE6m30Ku/Ba3ba+367hTzSU8JNvnHhRdH9I2cNE3X7z2VnIp2usAnRCf8d +-NL/+I5c30jn6PQ0GC7TbO6Orb1wdtn7os4I07QZcJA== +------END CERTIFICATE----- +- + # Issuer: CN=T-TeleSec GlobalRoot Class 2 O=T-Systems Enterprise Services GmbH OU=T-Systems Trust Center + # Subject: CN=T-TeleSec GlobalRoot Class 2 O=T-Systems Enterprise Services GmbH OU=T-Systems Trust Center + # Label: "T-TeleSec GlobalRoot Class 2" +@@ -4179,3 +4107,188 @@ AgGGMAoGCCqGSM49BAMDA2cAMGQCMBHervjcToiwqfAircJRQO9gcS3ujwLEXQNw + SaSS6sUUiHCm0w2wqsosQJz76YJumgIwK0eaB8bRwoF8yguWGEEbo/QwCZ61IygN + nxS2PFOiTAZpffpskcYqSUXm7LcT4Tps + -----END CERTIFICATE----- ++ ++# Issuer: CN=Sectigo Public Server Authentication Root E46 O=Sectigo Limited ++# Subject: CN=Sectigo Public Server Authentication Root E46 O=Sectigo Limited ++# Label: "Sectigo Public Server Authentication Root E46" ++# Serial: 88989738453351742415770396670917916916 ++# MD5 Fingerprint: 28:23:f8:b2:98:5c:37:16:3b:3e:46:13:4e:b0:b3:01 ++# SHA1 Fingerprint: ec:8a:39:6c:40:f0:2e:bc:42:75:d4:9f:ab:1c:1a:5b:67:be:d2:9a ++# SHA256 Fingerprint: c9:0f:26:f0:fb:1b:40:18:b2:22:27:51:9b:5c:a2:b5:3e:2c:a5:b3:be:5c:f1:8e:fe:1b:ef:47:38:0c:53:83 ++-----BEGIN CERTIFICATE----- ++MIICOjCCAcGgAwIBAgIQQvLM2htpN0RfFf51KBC49DAKBggqhkjOPQQDAzBfMQsw ++CQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1T ++ZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBFNDYwHhcN ++MjEwMzIyMDAwMDAwWhcNNDYwMzIxMjM1OTU5WjBfMQswCQYDVQQGEwJHQjEYMBYG ++A1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBT ++ZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBFNDYwdjAQBgcqhkjOPQIBBgUrgQQA ++IgNiAAR2+pmpbiDt+dd34wc7qNs9Xzjoq1WmVk/WSOrsfy2qw7LFeeyZYX8QeccC ++WvkEN/U0NSt3zn8gj1KjAIns1aeibVvjS5KToID1AZTc8GgHHs3u/iVStSBDHBv+ ++6xnOQ6OjQjBAMB0GA1UdDgQWBBTRItpMWfFLXyY4qp3W7usNw/upYTAOBgNVHQ8B ++Af8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNnADBkAjAn7qRa ++qCG76UeXlImldCBteU/IvZNeWBj7LRoAasm4PdCkT0RHlAFWovgzJQxC36oCMB3q ++4S6ILuH5px0CMk7yn2xVdOOurvulGu7t0vzCAxHrRVxgED1cf5kDW21USAGKcw== ++-----END CERTIFICATE----- ++ ++# Issuer: CN=Sectigo Public Server Authentication Root R46 O=Sectigo Limited ++# Subject: CN=Sectigo Public Server Authentication Root R46 O=Sectigo Limited ++# Label: "Sectigo Public Server Authentication Root R46" ++# Serial: 156256931880233212765902055439220583700 ++# MD5 Fingerprint: 32:10:09:52:00:d5:7e:6c:43:df:15:c0:b1:16:93:e5 ++# SHA1 Fingerprint: ad:98:f9:f3:e4:7d:75:3b:65:d4:82:b3:a4:52:17:bb:6e:f5:e4:38 ++# SHA256 Fingerprint: 7b:b6:47:a6:2a:ee:ac:88:bf:25:7a:a5:22:d0:1f:fe:a3:95:e0:ab:45:c7:3f:93:f6:56:54:ec:38:f2:5a:06 ++-----BEGIN CERTIFICATE----- ++MIIFijCCA3KgAwIBAgIQdY39i658BwD6qSWn4cetFDANBgkqhkiG9w0BAQwFADBf ++MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD ++Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw ++HhcNMjEwMzIyMDAwMDAwWhcNNDYwMzIxMjM1OTU5WjBfMQswCQYDVQQGEwJHQjEY ++MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1Ymxp ++YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB ++AQUAA4ICDwAwggIKAoICAQCTvtU2UnXYASOgHEdCSe5jtrch/cSV1UgrJnwUUxDa ++ef0rty2k1Cz66jLdScK5vQ9IPXtamFSvnl0xdE8H/FAh3aTPaE8bEmNtJZlMKpnz ++SDBh+oF8HqcIStw+KxwfGExxqjWMrfhu6DtK2eWUAtaJhBOqbchPM8xQljeSM9xf ++iOefVNlI8JhD1mb9nxc4Q8UBUQvX4yMPFF1bFOdLvt30yNoDN9HWOaEhUTCDsG3X ++ME6WW5HwcCSrv0WBZEMNvSE6Lzzpng3LILVCJ8zab5vuZDCQOc2TZYEhMbUjUDM3 ++IuM47fgxMMxF/mL50V0yeUKH32rMVhlATc6qu/m1dkmU8Sf4kaWD5QazYw6A3OAS ++VYCmO2a0OYctyPDQ0RTp5A1NDvZdV3LFOxxHVp3i1fuBYYzMTYCQNFu31xR13NgE ++SJ/AwSiItOkcyqex8Va3e0lMWeUgFaiEAin6OJRpmkkGj80feRQXEgyDet4fsZfu +++Zd4KKTIRJLpfSYFplhym3kT2BFfrsU4YjRosoYwjviQYZ4ybPUHNs2iTG7sijbt ++8uaZFURww3y8nDnAtOFr94MlI1fZEoDlSfB1D++N6xybVCi0ITz8fAr/73trdf+L ++HaAZBav6+CuBQug4urv7qv094PPK306Xlynt8xhW6aWWrL3DkJiy4Pmi1KZHQ3xt ++zwIDAQABo0IwQDAdBgNVHQ4EFgQUVnNYZJX5khqwEioEYnmhQBWIIUkwDgYDVR0P ++AQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAC9c ++mTz8Bl6MlC5w6tIyMY208FHVvArzZJ8HXtXBc2hkeqK5Duj5XYUtqDdFqij0lgVQ ++YKlJfp/imTYpE0RHap1VIDzYm/EDMrraQKFz6oOht0SmDpkBm+S8f74TlH7Kph52 ++gDY9hAaLMyZlbcp+nv4fjFg4exqDsQ+8FxG75gbMY/qB8oFM2gsQa6H61SilzwZA ++Fv97fRheORKkU55+MkIQpiGRqRxOF3yEvJ+M0ejf5lG5Nkc/kLnHvALcWxxPDkjB ++JYOcCj+esQMzEhonrPcibCTRAUH4WAP+JWgiH5paPHxsnnVI84HxZmduTILA7rpX ++DhjvLpr3Etiga+kFpaHpaPi8TD8SHkXoUsCjvxInebnMMTzD9joiFgOgyY9mpFui ++TdaBJQbpdqQACj7LzTWb4OE4y2BThihCQRxEV+ioratF4yUQvNs+ZUH7G6aXD+u5 ++dHn5HrwdVw1Hr8Mvn4dGp+smWg9WY7ViYG4A++MnESLn/pmPNPW56MORcr3Ywx65 ++LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp ++0XZ60Vzk50lJLVU3aPAaOpg+VBeHVOmmJ1CJeyAvP/+/oYtKR5j/K3tJPsMpRmAY ++QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL ++-----END CERTIFICATE----- ++ ++# Issuer: CN=SSL.com TLS RSA Root CA 2022 O=SSL Corporation ++# Subject: CN=SSL.com TLS RSA Root CA 2022 O=SSL Corporation ++# Label: "SSL.com TLS RSA Root CA 2022" ++# Serial: 148535279242832292258835760425842727825 ++# MD5 Fingerprint: d8:4e:c6:59:30:d8:fe:a0:d6:7a:5a:2c:2c:69:78:da ++# SHA1 Fingerprint: ec:2c:83:40:72:af:26:95:10:ff:0e:f2:03:ee:31:70:f6:78:9d:ca ++# SHA256 Fingerprint: 8f:af:7d:2e:2c:b4:70:9b:b8:e0:b3:36:66:bf:75:a5:dd:45:b5:de:48:0f:8e:a8:d4:bf:e6:be:bc:17:f2:ed ++-----BEGIN CERTIFICATE----- ++MIIFiTCCA3GgAwIBAgIQb77arXO9CEDii02+1PdbkTANBgkqhkiG9w0BAQsFADBO ++MQswCQYDVQQGEwJVUzEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMSUwIwYDVQQD ++DBxTU0wuY29tIFRMUyBSU0EgUm9vdCBDQSAyMDIyMB4XDTIyMDgyNTE2MzQyMloX ++DTQ2MDgxOTE2MzQyMVowTjELMAkGA1UEBhMCVVMxGDAWBgNVBAoMD1NTTCBDb3Jw ++b3JhdGlvbjElMCMGA1UEAwwcU1NMLmNvbSBUTFMgUlNBIFJvb3QgQ0EgMjAyMjCC ++AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANCkCXJPQIgSYT41I57u9nTP ++L3tYPc48DRAokC+X94xI2KDYJbFMsBFMF3NQ0CJKY7uB0ylu1bUJPiYYf7ISf5OY ++t6/wNr/y7hienDtSxUcZXXTzZGbVXcdotL8bHAajvI9AI7YexoS9UcQbOcGV0ins ++S657Lb85/bRi3pZ7QcacoOAGcvvwB5cJOYF0r/c0WRFXCsJbwST0MXMwgsadugL3 ++PnxEX4MN8/HdIGkWCVDi1FW24IBydm5MR7d1VVm0U3TZlMZBrViKMWYPHqIbKUBO ++L9975hYsLfy/7PO0+r4Y9ptJ1O4Fbtk085zx7AGL0SDGD6C1vBdOSHtRwvzpXGk3 ++R2azaPgVKPC506QVzFpPulJwoxJF3ca6TvvC0PeoUidtbnm1jPx7jMEWTO6Af77w ++dr5BUxIzrlo4QqvXDz5BjXYHMtWrifZOZ9mxQnUjbvPNQrL8VfVThxc7wDNY8VLS +++YCk8OjwO4s4zKTGkH8PnP2L0aPP2oOnaclQNtVcBdIKQXTbYxE3waWglksejBYS ++d66UNHsef8JmAOSqg+qKkK3ONkRN0VHpvB/zagX9wHQfJRlAUW7qglFA35u5CCoG ++AtUjHBPW6dvbxrB6y3snm/vg1UYk7RBLY0ulBY+6uB0rpvqR4pJSvezrZ5dtmi2f ++gTIFZzL7SAg/2SW4BCUvAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0j ++BBgwFoAU+y437uOEeicuzRk1sTN8/9REQrkwHQYDVR0OBBYEFPsuN+7jhHonLs0Z ++NbEzfP/UREK5MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAjYlt ++hEUY8U+zoO9opMAdrDC8Z2awms22qyIZZtM7QbUQnRC6cm4pJCAcAZli05bg4vsM ++QtfhWsSWTVTNj8pDU/0quOr4ZcoBwq1gaAafORpR2eCNJvkLTqVTJXojpBzOCBvf ++R4iyrT7gJ4eLSYwfqUdYe5byiB0YrrPRpgqU+tvT5TgKa3kSM/tKWTcWQA673vWJ ++DPFs0/dRa1419dvAJuoSc06pkZCmF8NsLzjUo3KUQyxi4U5cMj29TH0ZR6LDSeeW ++P4+a0zvkEdiLA9z2tmBVGKaBUfPhqBVq6+AL8BQx1rmMRTqoENjwuSfr98t67wVy ++lrXEj5ZzxOhWc5y8aVFjvO9nHEMaX3cZHxj4HCUp+UmZKbaSPaKDN7EgkaibMOlq ++bLQjk2UEqxHzDh1TJElTHaE/nUiSEeJ9DU/1172iWD54nR4fK/4huxoTtrEoZP2w ++AgDHbICivRZQIA9ygV/MlP+7mea6kMvq+cYMwq7FGc4zoWtcu358NFcXrfA/rs3q ++r5nsLFR+jM4uElZI7xc7P0peYNLcdDa8pUNjyw9bowJWCZ4kLOGGgYz+qxcs+sji ++Mho6/4UIyYOf8kpIEFR3N+2ivEC+5BB09+Rbu7nzifmPQdjH5FCQNYA+HLhNkNPU ++98OwoX6EyneSMSy4kLGCenROmxMmtNVQZlR4rmA= ++-----END CERTIFICATE----- ++ ++# Issuer: CN=SSL.com TLS ECC Root CA 2022 O=SSL Corporation ++# Subject: CN=SSL.com TLS ECC Root CA 2022 O=SSL Corporation ++# Label: "SSL.com TLS ECC Root CA 2022" ++# Serial: 26605119622390491762507526719404364228 ++# MD5 Fingerprint: 99:d7:5c:f1:51:36:cc:e9:ce:d9:19:2e:77:71:56:c5 ++# SHA1 Fingerprint: 9f:5f:d9:1a:54:6d:f5:0c:71:f0:ee:7a:bd:17:49:98:84:73:e2:39 ++# SHA256 Fingerprint: c3:2f:fd:9f:46:f9:36:d1:6c:36:73:99:09:59:43:4b:9a:d6:0a:af:bb:9e:7c:f3:36:54:f1:44:cc:1b:a1:43 ++-----BEGIN CERTIFICATE----- ++MIICOjCCAcCgAwIBAgIQFAP1q/s3ixdAW+JDsqXRxDAKBggqhkjOPQQDAzBOMQsw ++CQYDVQQGEwJVUzEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMSUwIwYDVQQDDBxT ++U0wuY29tIFRMUyBFQ0MgUm9vdCBDQSAyMDIyMB4XDTIyMDgyNTE2MzM0OFoXDTQ2 ++MDgxOTE2MzM0N1owTjELMAkGA1UEBhMCVVMxGDAWBgNVBAoMD1NTTCBDb3Jwb3Jh ++dGlvbjElMCMGA1UEAwwcU1NMLmNvbSBUTFMgRUNDIFJvb3QgQ0EgMjAyMjB2MBAG ++ByqGSM49AgEGBSuBBAAiA2IABEUpNXP6wrgjzhR9qLFNoFs27iosU8NgCTWyJGYm ++acCzldZdkkAZDsalE3D07xJRKF3nzL35PIXBz5SQySvOkkJYWWf9lCcQZIxPBLFN ++SeR7T5v15wj4A4j3p8OSSxlUgaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSME ++GDAWgBSJjy+j6CugFFR781a4Jl9nOAuc0DAdBgNVHQ4EFgQUiY8vo+groBRUe/NW ++uCZfZzgLnNAwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2gAMGUCMFXjIlbp ++15IkWE8elDIPDAI2wv2sdDJO4fscgIijzPvX6yv/N33w7deedWo1dlJF4AIxAMeN ++b0Igj762TVntd00pxCAgRWSGOlDGxK0tk/UYfXLtqc/ErFc2KAhl3zx5Zn6g6g== ++-----END CERTIFICATE----- ++ ++# Issuer: CN=Atos TrustedRoot Root CA ECC TLS 2021 O=Atos ++# Subject: CN=Atos TrustedRoot Root CA ECC TLS 2021 O=Atos ++# Label: "Atos TrustedRoot Root CA ECC TLS 2021" ++# Serial: 81873346711060652204712539181482831616 ++# MD5 Fingerprint: 16:9f:ad:f1:70:ad:79:d6:ed:29:b4:d1:c5:79:70:a8 ++# SHA1 Fingerprint: 9e:bc:75:10:42:b3:02:f3:81:f4:f7:30:62:d4:8f:c3:a7:51:b2:dd ++# SHA256 Fingerprint: b2:fa:e5:3e:14:cc:d7:ab:92:12:06:47:01:ae:27:9c:1d:89:88:fa:cb:77:5f:a8:a0:08:91:4e:66:39:88:a8 ++-----BEGIN CERTIFICATE----- ++MIICFTCCAZugAwIBAgIQPZg7pmY9kGP3fiZXOATvADAKBggqhkjOPQQDAzBMMS4w ++LAYDVQQDDCVBdG9zIFRydXN0ZWRSb290IFJvb3QgQ0EgRUNDIFRMUyAyMDIxMQ0w ++CwYDVQQKDARBdG9zMQswCQYDVQQGEwJERTAeFw0yMTA0MjIwOTI2MjNaFw00MTA0 ++MTcwOTI2MjJaMEwxLjAsBgNVBAMMJUF0b3MgVHJ1c3RlZFJvb3QgUm9vdCBDQSBF ++Q0MgVExTIDIwMjExDTALBgNVBAoMBEF0b3MxCzAJBgNVBAYTAkRFMHYwEAYHKoZI ++zj0CAQYFK4EEACIDYgAEloZYKDcKZ9Cg3iQZGeHkBQcfl+3oZIK59sRxUM6KDP/X ++tXa7oWyTbIOiaG6l2b4siJVBzV3dscqDY4PMwL502eCdpO5KTlbgmClBk1IQ1SQ4 ++AjJn8ZQSb+/Xxd4u/RmAo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR2 ++KCXWfeBmmnoJsmo7jjPXNtNPojAOBgNVHQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwMD ++aAAwZQIwW5kp85wxtolrbNa9d+F851F+uDrNozZffPc8dz7kUK2o59JZDCaOMDtu ++CCrCp1rIAjEAmeMM56PDr9NJLkaCI2ZdyQAUEv049OGYa3cpetskz2VAv9LcjBHo ++9H1/IISpQuQo ++-----END CERTIFICATE----- ++ ++# Issuer: CN=Atos TrustedRoot Root CA RSA TLS 2021 O=Atos ++# Subject: CN=Atos TrustedRoot Root CA RSA TLS 2021 O=Atos ++# Label: "Atos TrustedRoot Root CA RSA TLS 2021" ++# Serial: 111436099570196163832749341232207667876 ++# MD5 Fingerprint: d4:d3:46:b8:9a:c0:9c:76:5d:9e:3a:c3:b9:99:31:d2 ++# SHA1 Fingerprint: 18:52:3b:0d:06:37:e4:d6:3a:df:23:e4:98:fb:5b:16:fb:86:74:48 ++# SHA256 Fingerprint: 81:a9:08:8e:a5:9f:b3:64:c5:48:a6:f8:55:59:09:9b:6f:04:05:ef:bf:18:e5:32:4e:c9:f4:57:ba:00:11:2f ++-----BEGIN CERTIFICATE----- ++MIIFZDCCA0ygAwIBAgIQU9XP5hmTC/srBRLYwiqipDANBgkqhkiG9w0BAQwFADBM ++MS4wLAYDVQQDDCVBdG9zIFRydXN0ZWRSb290IFJvb3QgQ0EgUlNBIFRMUyAyMDIx ++MQ0wCwYDVQQKDARBdG9zMQswCQYDVQQGEwJERTAeFw0yMTA0MjIwOTIxMTBaFw00 ++MTA0MTcwOTIxMDlaMEwxLjAsBgNVBAMMJUF0b3MgVHJ1c3RlZFJvb3QgUm9vdCBD ++QSBSU0EgVExTIDIwMjExDTALBgNVBAoMBEF0b3MxCzAJBgNVBAYTAkRFMIICIjAN ++BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtoAOxHm9BYx9sKOdTSJNy/BBl01Z ++4NH+VoyX8te9j2y3I49f1cTYQcvyAh5x5en2XssIKl4w8i1mx4QbZFc4nXUtVsYv ++Ye+W/CBGvevUez8/fEc4BKkbqlLfEzfTFRVOvV98r61jx3ncCHvVoOX3W3WsgFWZ ++kmGbzSoXfduP9LVq6hdKZChmFSlsAvFr1bqjM9xaZ6cF4r9lthawEO3NUDPJcFDs ++GY6wx/J0W2tExn2WuZgIWWbeKQGb9Cpt0xU6kGpn8bRrZtkh68rZYnxGEFzedUln ++nkL5/nWpo63/dgpnQOPF943HhZpZnmKaau1Fh5hnstVKPNe0OwANwI8f4UDErmwh ++3El+fsqyjW22v5MvoVw+j8rtgI5Y4dtXz4U2OLJxpAmMkokIiEjxQGMYsluMWuPD ++0xeqqxmjLBvk1cbiZnrXghmmOxYsL3GHX0WelXOTwkKBIROW1527k2gV+p2kHYzy ++geBYBr3JtuP2iV2J+axEoctr+hbxx1A9JNr3w+SH1VbxT5Aw+kUJWdo0zuATHAR8 ++ANSbhqRAvNncTFd+rrcztl524WWLZt+NyteYr842mIycg5kDcPOvdO3GDjbnvezB ++c6eUWsuSZIKmAMFwoW4sKeFYV+xafJlrJaSQOoD0IJ2azsct+bJLKZWD6TWNp0lI ++pw9MGZHQ9b8Q4HECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU ++dEmZ0f+0emhFdcN+tNzMzjkz2ggwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB ++DAUAA4ICAQAjQ1MkYlxt/T7Cz1UAbMVWiLkO3TriJQ2VSpfKgInuKs1l+NsW4AmS ++4BjHeJi78+xCUvuppILXTdiK/ORO/auQxDh1MoSf/7OwKwIzNsAQkG8dnK/haZPs ++o0UvFJ/1TCplQ3IM98P4lYsU84UgYt1UU90s3BiVaU+DR3BAM1h3Egyi61IxHkzJ ++qM7F78PRreBrAwA0JrRUITWXAdxfG/F851X6LWh3e9NpzNMOa7pNdkTWwhWaJuyw ++xfW70Xp0wmzNxbVe9kzmWy2B27O3Opee7c9GslA9hGCZcbUztVdF5kJHdWoOsAgM ++rr3e97sPWD2PAzHoPYJQyi9eDF20l74gNAf0xBLh7tew2VktafcxBPTy+av5EzH4 ++AXcOPUIjJsyacmdRIXrMPIWo6iFqO9taPKU0nprALN+AnCng33eU0aKAQv9qTFsR ++0PXNor6uzFFcw9VUewyu1rkGd4Di7wcaaMxZUa1+XGdrudviB0JbuAEFWDlN5LuY ++o7Ey7Nmj1m+UI/87tyll5gfp77YZ6ufCOB0yiJA8EytuzO+rdwY0d4RPcuSBhPm5 ++dDTedk+SKlOxJTnbPP/lPqYO5Wue/9vsL3SD3460s6neFE3/MaNFcyT6lSnMEpcE ++oji2jbDwN/zIIX8/syQbPYtuzE2wFg2WHYMfRsCbvUOZ58SWLs5fyQ== ++-----END CERTIFICATE----- +-- +2.40.0 diff --git a/meta/recipes-devtools/python/python3-certifi_2021.10.8.bb b/meta/recipes-devtools/python/python3-certifi_2021.10.8.bb index 4c376da897..eb1574adf6 100644 --- a/meta/recipes-devtools/python/python3-certifi_2021.10.8.bb +++ b/meta/recipes-devtools/python/python3-certifi_2021.10.8.bb @@ -7,6 +7,10 @@ HOMEPAGE = " http://certifi.io/" LICENSE = "ISC" LIC_FILES_CHKSUM = "file://LICENSE;md5=67da0714c3f9471067b729eca6c9fbe8" +SRC_URI += "file://CVE-2022-23491.patch \ + file://CVE-2023-37920.patch \ + " + SRC_URI[sha256sum] = "78884e7c1d4b00ce3cea67b44566851c4343c120abd683433ce934a68ea58872" inherit pypi setuptools3 diff --git a/meta/recipes-devtools/python/python3-cryptography/CVE-2023-23931.patch b/meta/recipes-devtools/python/python3-cryptography/CVE-2023-23931.patch new file mode 100644 index 0000000000..5fc4878978 --- /dev/null +++ b/meta/recipes-devtools/python/python3-cryptography/CVE-2023-23931.patch @@ -0,0 +1,49 @@ +From 9fbf84efc861668755ab645530ec7be9cf3c6696 Mon Sep 17 00:00:00 2001 +From: Alex Gaynor <alex.gaynor@gmail.com> +Date: Tue, 7 Feb 2023 11:34:18 -0500 +Subject: [PATCH] Don't allow update_into to mutate immutable objects (#8230) + +CVE: CVE-2023-23931 + +Upstream-Status: Backport [https://github.com/pyca/cryptography/commit/9fbf84efc861668755ab645530ec7be9cf3c6696] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + src/cryptography/hazmat/backends/openssl/ciphers.py | 2 +- + tests/hazmat/primitives/test_ciphers.py | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py +index 286583f93..075d68fb9 100644 +--- a/src/cryptography/hazmat/backends/openssl/ciphers.py ++++ b/src/cryptography/hazmat/backends/openssl/ciphers.py +@@ -156,7 +156,7 @@ class _CipherContext: + data_processed = 0 + total_out = 0 + outlen = self._backend._ffi.new("int *") +- baseoutbuf = self._backend._ffi.from_buffer(buf) ++ baseoutbuf = self._backend._ffi.from_buffer(buf, require_writable=True) + baseinbuf = self._backend._ffi.from_buffer(data) + + while data_processed != total_data_len: +diff --git a/tests/hazmat/primitives/test_ciphers.py b/tests/hazmat/primitives/test_ciphers.py +index 02127dd9c..bf3b047de 100644 +--- a/tests/hazmat/primitives/test_ciphers.py ++++ b/tests/hazmat/primitives/test_ciphers.py +@@ -318,6 +318,14 @@ class TestCipherUpdateInto: + with pytest.raises(ValueError): + encryptor.update_into(b"testing", buf) + ++ def test_update_into_immutable(self, backend): ++ key = b"\x00" * 16 ++ c = ciphers.Cipher(AES(key), modes.ECB(), backend) ++ encryptor = c.encryptor() ++ buf = b"\x00" * 32 ++ with pytest.raises((TypeError, BufferError)): ++ encryptor.update_into(b"testing", buf) ++ + @pytest.mark.supported( + only_if=lambda backend: backend.cipher_supported( + AES(b"\x00" * 16), modes.GCM(b"\x00" * 12) +-- +2.40.0 diff --git a/meta/recipes-devtools/python/python3-cryptography/CVE-2023-49083.patch b/meta/recipes-devtools/python/python3-cryptography/CVE-2023-49083.patch new file mode 100644 index 0000000000..d398eea1d9 --- /dev/null +++ b/meta/recipes-devtools/python/python3-cryptography/CVE-2023-49083.patch @@ -0,0 +1,53 @@ +From 627ac5e314303acc00a19d58f09eb1eabd029fd1 Mon Sep 17 00:00:00 2001 +From: Alex Gaynor <alex.gaynor@gmail.com> +Date: Wed, 6 Dec 2023 08:04:53 +0000 +Subject: [PATCH] Fixed crash when loading a PKCS#7 bundle with no certificates + (#9926) + +CVE: CVE-2023-49083 + +Upstream-Status: Backport [https://github.com/pyca/cryptography/commit/1e7b4d074e14c4e694d3ce69ad6754a6039fd6ff] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + src/cryptography/hazmat/backends/openssl/backend.py | 5 ++++- + tests/hazmat/primitives/test_pkcs7.py | 6 ++++++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py +index 5606fe6..c43fea0 100644 +--- a/src/cryptography/hazmat/backends/openssl/backend.py ++++ b/src/cryptography/hazmat/backends/openssl/backend.py +@@ -2189,9 +2189,12 @@ class Backend(BackendInterface): + _Reasons.UNSUPPORTED_SERIALIZATION, + ) + ++ certs: list[x509.Certificate] = [] ++ if p7.d.sign == self._ffi.NULL: ++ return certs ++ + sk_x509 = p7.d.sign.cert + num = self._lib.sk_X509_num(sk_x509) +- certs = [] + for i in range(num): + x509 = self._lib.sk_X509_value(sk_x509, i) + self.openssl_assert(x509 != self._ffi.NULL) +diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py +index 91ac842..b98a9f1 100644 +--- a/tests/hazmat/primitives/test_pkcs7.py ++++ b/tests/hazmat/primitives/test_pkcs7.py +@@ -81,6 +81,12 @@ class TestPKCS7Loading(object): + mode="rb", + ) + ++ def test_load_pkcs7_empty_certificates(self): ++ der = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02" ++ ++ certificates = pkcs7.load_der_pkcs7_certificates(der) ++ assert certificates == [] ++ + + # We have no public verification API and won't be adding one until we get + # some requirements from users so this function exists to give us basic +-- +2.40.0 diff --git a/meta/recipes-devtools/python/python3-cryptography/CVE-2024-26130.patch b/meta/recipes-devtools/python/python3-cryptography/CVE-2024-26130.patch new file mode 100644 index 0000000000..ff113e8cc7 --- /dev/null +++ b/meta/recipes-devtools/python/python3-cryptography/CVE-2024-26130.patch @@ -0,0 +1,66 @@ +From 97d231672763cdb5959a3b191e692a362f1b9e55 Mon Sep 17 00:00:00 2001 +From: Alex Gaynor <alex.gaynor@gmail.com> +Date: Mon, 19 Feb 2024 11:50:28 -0500 +Subject: [PATCH] Fixes #10422 -- don't crash when a PKCS#12 key and cert don't + match (#10423) + +Upstream-Status: Backport [https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55] +CVE: CVE-2024-26130 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + .../hazmat/backends/openssl/backend.py | 9 +++++++++ + tests/hazmat/primitives/test_pkcs12.py | 18 ++++++++++++++++++ + 2 files changed, 27 insertions(+) + +diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py +index c43fea0..d687931 100644 +--- a/src/cryptography/hazmat/backends/openssl/backend.py ++++ b/src/cryptography/hazmat/backends/openssl/backend.py +@@ -2131,6 +2131,15 @@ class Backend(BackendInterface): + mac_iter, + 0, + ) ++ if p12 == self._ffi.NULL: ++ errors = self._consume_errors() ++ raise ValueError( ++ ( ++ "Failed to create PKCS12 (does the key match the " ++ "certificate?)" ++ ), ++ errors, ++ ) + + self.openssl_assert(p12 != self._ffi.NULL) + p12 = self._ffi.gc(p12, self._lib.PKCS12_free) +diff --git a/tests/hazmat/primitives/test_pkcs12.py b/tests/hazmat/primitives/test_pkcs12.py +index c5cfbc0..8af4c93 100644 +--- a/tests/hazmat/primitives/test_pkcs12.py ++++ b/tests/hazmat/primitives/test_pkcs12.py +@@ -25,6 +25,24 @@ from ...doubles import DummyKeySerializationEncryption + from ...utils import load_vectors_from_file + + ++ @pytest.mark.supported( ++ only_if=lambda backend: backend._lib.Cryptography_HAS_PKCS12_SET_MAC, ++ skip_message="Requires OpenSSL with PKCS12_set_mac", ++ ) ++ def test_set_mac_key_certificate_mismatch(self, backend): ++ cacert, _ = _load_ca(backend) ++ key = ec.generate_private_key(ec.SECP256R1()) ++ encryption = ( ++ serialization.PrivateFormat.PKCS12.encryption_builder() ++ .hmac_hash(hashes.SHA256()) ++ .build(b"password") ++ ) ++ ++ with pytest.raises(ValueError): ++ serialize_key_and_certificates( ++ b"name", key, cacert, [], encryption ++ ) ++ + @pytest.mark.skip_fips( + reason="PKCS12 unsupported in FIPS mode. So much bad crypto in it." + ) +-- +2.35.7 + diff --git a/meta/recipes-devtools/python/python3-cryptography_36.0.2.bb b/meta/recipes-devtools/python/python3-cryptography_36.0.2.bb index 9ef5ff39c8..83381f225c 100644 --- a/meta/recipes-devtools/python/python3-cryptography_36.0.2.bb +++ b/meta/recipes-devtools/python/python3-cryptography_36.0.2.bb @@ -17,6 +17,9 @@ SRC_URI += " \ file://0001-Cargo.toml-specify-pem-version.patch \ file://0002-Cargo.toml-edition-2018-2021.patch \ file://fix-leak-metric.patch \ + file://CVE-2023-23931.patch \ + file://CVE-2023-49083.patch \ + file://CVE-2024-26130.patch \ " inherit pypi python_setuptools3_rust diff --git a/meta/recipes-devtools/python/python3-git/0001-python3-git-CVE-2022-24439-fix-from-PR-1518.patch b/meta/recipes-devtools/python/python3-git/0001-python3-git-CVE-2022-24439-fix-from-PR-1518.patch deleted file mode 100644 index 16192b22c7..0000000000 --- a/meta/recipes-devtools/python/python3-git/0001-python3-git-CVE-2022-24439-fix-from-PR-1518.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 6ebe9231cd34dacd32a964859bc509aaa1e3f5fd Mon Sep 17 00:00:00 2001 -From: Narpat Mali <narpat.mali@windriver.com> -Date: Fri, 6 Jan 2023 14:13:10 +0000 -Subject: [PATCH] python3-git: CVE-2022-24439 fix from PR 1518 - -Fix command injection -Add `--` in some commands that receive user input -and if interpreted as options could lead to remote -code execution (RCE). - -There may be more commands that could benefit from `--` -so the input is never interpreted as an option, -but most of those aren't dangerous. - -Fixed commands: - -- push -- pull -- fetch -- clone/clone_from and friends -- archive (not sure if this one can be exploited, but it doesn't hurt - adding `--` :)) - -For anyone using GitPython and exposing any of the GitPython methods to users, -make sure to always validate the input (like if starts with `--`). -And for anyone allowing users to pass arbitrary options, be aware -that some options may lead fo RCE, like `--exc`, `--upload-pack`, -`--receive-pack`, `--config` (#1516). - -Ref #1517 - -CVE: CVE-2022-24439 - -Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/pull/1518] - -Signed-off-by: Narpat Mali <narpat.mali@windriver.com> ---- - git/remote.py | 6 +++--- - git/repo/base.py | 4 ++-- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/git/remote.py b/git/remote.py -index 56f3c5b..59681bc 100644 ---- a/git/remote.py -+++ b/git/remote.py -@@ -881,7 +881,7 @@ class Remote(LazyMixin, IterableObj): - else: - args = [refspec] - -- proc = self.repo.git.fetch(self, *args, as_process=True, with_stdout=False, -+ proc = self.repo.git.fetch("--", self, *args, as_process=True, with_stdout=False, - universal_newlines=True, v=verbose, **kwargs) - res = self._get_fetch_info_from_stderr(proc, progress, - kill_after_timeout=kill_after_timeout) -@@ -905,7 +905,7 @@ class Remote(LazyMixin, IterableObj): - # No argument refspec, then ensure the repo's config has a fetch refspec. - self._assert_refspec() - kwargs = add_progress(kwargs, self.repo.git, progress) -- proc = self.repo.git.pull(self, refspec, with_stdout=False, as_process=True, -+ proc = self.repo.git.pull("--", self, refspec, with_stdout=False, as_process=True, - universal_newlines=True, v=True, **kwargs) - res = self._get_fetch_info_from_stderr(proc, progress, - kill_after_timeout=kill_after_timeout) -@@ -945,7 +945,7 @@ class Remote(LazyMixin, IterableObj): - If the operation fails completely, the length of the returned IterableList will - be 0.""" - kwargs = add_progress(kwargs, self.repo.git, progress) -- proc = self.repo.git.push(self, refspec, porcelain=True, as_process=True, -+ proc = self.repo.git.push("--", self, refspec, porcelain=True, as_process=True, - universal_newlines=True, - kill_after_timeout=kill_after_timeout, - **kwargs) -diff --git a/git/repo/base.py b/git/repo/base.py -index 7713c91..f14f929 100644 ---- a/git/repo/base.py -+++ b/git/repo/base.py -@@ -1072,7 +1072,7 @@ class Repo(object): - multi = None - if multi_options: - multi = shlex.split(' '.join(multi_options)) -- proc = git.clone(multi, Git.polish_url(str(url)), clone_path, with_extended_output=True, as_process=True, -+ proc = git.clone("--", multi, Git.polish_url(str(url)), clone_path, with_extended_output=True, as_process=True, - v=True, universal_newlines=True, **add_progress(kwargs, git, progress)) - if progress: - handle_process_output(proc, None, to_progress_instance(progress).new_message_handler(), -@@ -1173,7 +1173,7 @@ class Repo(object): - if not isinstance(path, (tuple, list)): - path = [path] - # end assure paths is list -- self.git.archive(treeish, *path, **kwargs) -+ self.git.archive("--", treeish, *path, **kwargs) - return self - - def has_separate_working_tree(self) -> bool: --- -2.34.1 - diff --git a/meta/recipes-devtools/python/python3-git/0001-python3-git-CVE-2022-24439-fix-from-PR-1521.patch b/meta/recipes-devtools/python/python3-git/0001-python3-git-CVE-2022-24439-fix-from-PR-1521.patch deleted file mode 100644 index e3e66ec450..0000000000 --- a/meta/recipes-devtools/python/python3-git/0001-python3-git-CVE-2022-24439-fix-from-PR-1521.patch +++ /dev/null @@ -1,488 +0,0 @@ -From fe9b71628767610a238e47cd46b82d411a7e871a Mon Sep 17 00:00:00 2001 -From: Narpat Mali <narpat.mali@windriver.com> -Date: Sat, 7 Jan 2023 17:16:57 +0000 -Subject: [PATCH] python3-git: CVE-2022-24439 fix from PR 1521 - -Forbid unsafe protocol URLs in Repo.clone{,_from}() -Since the URL is passed directly to git clone, and the remote-ext helper -will happily execute shell commands, so by default disallow URLs that -contain a "::" unless a new unsafe_protocols kwarg is passed. -(CVE-2022-24439) - -Fixes #1515 - -CVE: CVE-2022-24439 - -Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/pull/1521] - -Signed-off-by: Narpat Mali <narpat.mali@windriver.com> ---- - git/cmd.py | 51 ++++++++++++++++++++++++-- - git/exc.py | 8 ++++ - git/objects/submodule/base.py | 19 ++++++---- - git/remote.py | 69 +++++++++++++++++++++++++++++++---- - git/repo/base.py | 44 ++++++++++++++++++---- - 5 files changed, 166 insertions(+), 25 deletions(-) - -diff --git a/git/cmd.py b/git/cmd.py -index 4f05698..77026d6 100644 ---- a/git/cmd.py -+++ b/git/cmd.py -@@ -4,6 +4,7 @@ - # This module is part of GitPython and is released under - # the BSD License: http://www.opensource.org/licenses/bsd-license.php - from __future__ import annotations -+import re - from contextlib import contextmanager - import io - import logging -@@ -31,7 +32,9 @@ from git.util import is_cygwin_git, cygpath, expand_path, remove_password_if_pre - - from .exc import ( - GitCommandError, -- GitCommandNotFound -+ GitCommandNotFound, -+ UnsafeOptionError, -+ UnsafeProtocolError - ) - from .util import ( - LazyMixin, -@@ -225,6 +228,8 @@ class Git(LazyMixin): - - _excluded_ = ('cat_file_all', 'cat_file_header', '_version_info') - -+ re_unsafe_protocol = re.compile("(.+)::.+") -+ - def __getstate__(self) -> Dict[str, Any]: - return slots_to_dict(self, exclude=self._excluded_) - -@@ -400,6 +405,44 @@ class Git(LazyMixin): - url = url.replace("\\\\", "\\").replace("\\", "/") - return url - -+ @classmethod -+ def check_unsafe_protocols(cls, url: str) -> None: -+ """ -+ Check for unsafe protocols. -+ Apart from the usual protocols (http, git, ssh), -+ Git allows "remote helpers" that have the form `<transport>::<address>`, -+ one of these helpers (`ext::`) can be used to invoke any arbitrary command. -+ See: -+ - https://git-scm.com/docs/gitremote-helpers -+ - https://git-scm.com/docs/git-remote-ext -+ """ -+ match = cls.re_unsafe_protocol.match(url) -+ if match: -+ protocol = match.group(1) -+ raise UnsafeProtocolError( -+ f"The `{protocol}::` protocol looks suspicious, use `allow_unsafe_protocols=True` to allow it." -+ ) -+ -+ @classmethod -+ def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None: -+ """ -+ Check for unsafe options. -+ Some options that are passed to `git <command>` can be used to execute -+ arbitrary commands, this are blocked by default. -+ """ -+ # Options can be of the form `foo` or `--foo bar` `--foo=bar`, -+ # so we need to check if they start with "--foo" or if they are equal to "foo". -+ bare_unsafe_options = [ -+ option.lstrip("-") -+ for option in unsafe_options -+ ] -+ for option in options: -+ for unsafe_option, bare_option in zip(unsafe_options, bare_unsafe_options): -+ if option.startswith(unsafe_option) or option == bare_option: -+ raise UnsafeOptionError( -+ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." -+ ) -+ - class AutoInterrupt(object): - """Kill/Interrupt the stored process instance once this instance goes out of scope. It is - used to prevent processes piling up in case iterators stop reading. -@@ -1068,12 +1111,12 @@ class Git(LazyMixin): - return args - - @classmethod -- def __unpack_args(cls, arg_list: Sequence[str]) -> List[str]: -+ def _unpack_args(cls, arg_list: Sequence[str]) -> List[str]: - - outlist = [] - if isinstance(arg_list, (list, tuple)): - for arg in arg_list: -- outlist.extend(cls.__unpack_args(arg)) -+ outlist.extend(cls._unpack_args(arg)) - else: - outlist.append(str(arg_list)) - -@@ -1154,7 +1197,7 @@ class Git(LazyMixin): - # Prepare the argument list - - opt_args = self.transform_kwargs(**opts_kwargs) -- ext_args = self.__unpack_args([a for a in args if a is not None]) -+ ext_args = self._unpack_args([a for a in args if a is not None]) - - if insert_after_this_arg is None: - args_list = opt_args + ext_args -diff --git a/git/exc.py b/git/exc.py -index e8ff784..5c96db2 100644 ---- a/git/exc.py -+++ b/git/exc.py -@@ -36,6 +36,14 @@ class NoSuchPathError(GitError, OSError): - """ Thrown if a path could not be access by the system. """ - - -+class UnsafeProtocolError(GitError): -+ """Thrown if unsafe protocols are passed without being explicitly allowed.""" -+ -+ -+class UnsafeOptionError(GitError): -+ """Thrown if unsafe options are passed without being explicitly allowed.""" -+ -+ - class CommandError(GitError): - """Base class for exceptions thrown at every stage of `Popen()` execution. - -diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py -index f782045..deb224e 100644 ---- a/git/objects/submodule/base.py -+++ b/git/objects/submodule/base.py -@@ -264,7 +264,8 @@ class Submodule(IndexObject, TraversableIterableObj): - # end - - @classmethod -- def _clone_repo(cls, repo: 'Repo', url: str, path: PathLike, name: str, **kwargs: Any) -> 'Repo': -+ def _clone_repo(cls, repo: 'Repo', url: str, path: PathLike, name: str, -+ allow_unsafe_options: bool = False, allow_unsafe_protocols: bool = False,**kwargs: Any) -> 'Repo': - """:return: Repo instance of newly cloned repository - :param repo: our parent repository - :param url: url to clone from -@@ -281,7 +282,8 @@ class Submodule(IndexObject, TraversableIterableObj): - module_checkout_path = osp.join(str(repo.working_tree_dir), path) - # end - -- clone = git.Repo.clone_from(url, module_checkout_path, **kwargs) -+ clone = git.Repo.clone_from(url, module_checkout_path, allow_unsafe_options=allow_unsafe_options, -+ allow_unsafe_protocols=allow_unsafe_protocols, **kwargs) - if cls._need_gitfile_submodules(repo.git): - cls._write_git_file_and_module_config(module_checkout_path, module_abspath) - # end -@@ -338,8 +340,8 @@ class Submodule(IndexObject, TraversableIterableObj): - @classmethod - def add(cls, repo: 'Repo', name: str, path: PathLike, url: Union[str, None] = None, - branch: Union[str, None] = None, no_checkout: bool = False, depth: Union[int, None] = None, -- env: Union[Mapping[str, str], None] = None, clone_multi_options: Union[Sequence[TBD], None] = None -- ) -> 'Submodule': -+ env: Union[Mapping[str, str], None] = None, clone_multi_options: Union[Sequence[TBD], None] = None, -+ allow_unsafe_options: bool = False, allow_unsafe_protocols: bool = False,) -> 'Submodule': - """Add a new submodule to the given repository. This will alter the index - as well as the .gitmodules file, but will not create a new commit. - If the submodule already exists, no matter if the configuration differs -@@ -447,7 +449,8 @@ class Submodule(IndexObject, TraversableIterableObj): - kwargs['multi_options'] = clone_multi_options - - # _clone_repo(cls, repo, url, path, name, **kwargs): -- mrepo = cls._clone_repo(repo, url, path, name, env=env, **kwargs) -+ mrepo = cls._clone_repo(repo, url, path, name, env=env, allow_unsafe_options=allow_unsafe_options, -+ allow_unsafe_protocols=allow_unsafe_protocols, **kwargs) - # END verify url - - ## See #525 for ensuring git urls in config-files valid under Windows. -@@ -484,7 +487,8 @@ class Submodule(IndexObject, TraversableIterableObj): - def update(self, recursive: bool = False, init: bool = True, to_latest_revision: bool = False, - progress: Union['UpdateProgress', None] = None, dry_run: bool = False, - force: bool = False, keep_going: bool = False, env: Union[Mapping[str, str], None] = None, -- clone_multi_options: Union[Sequence[TBD], None] = None) -> 'Submodule': -+ clone_multi_options: Union[Sequence[TBD], None] = None, allow_unsafe_options: bool = False, -+ allow_unsafe_protocols: bool = False) -> 'Submodule': - """Update the repository of this submodule to point to the checkout - we point at with the binsha of this instance. - -@@ -585,7 +589,8 @@ class Submodule(IndexObject, TraversableIterableObj): - (self.url, checkout_module_abspath, self.name)) - if not dry_run: - mrepo = self._clone_repo(self.repo, self.url, self.path, self.name, n=True, env=env, -- multi_options=clone_multi_options) -+ multi_options=clone_multi_options, allow_unsafe_options=allow_unsafe_options, -+ allow_unsafe_protocols=allow_unsafe_protocols) - # END handle dry-run - progress.update(END | CLONE, 0, 1, prefix + "Done cloning to %s" % checkout_module_abspath) - -diff --git a/git/remote.py b/git/remote.py -index 59681bc..cea6b99 100644 ---- a/git/remote.py -+++ b/git/remote.py -@@ -473,6 +473,23 @@ class Remote(LazyMixin, IterableObj): - __slots__ = ("repo", "name", "_config_reader") - _id_attribute_ = "name" - -+ unsafe_git_fetch_options = [ -+ # This option allows users to execute arbitrary commands. -+ # https://git-scm.com/docs/git-fetch#Documentation/git-fetch.txt---upload-packltupload-packgt -+ "--upload-pack", -+ ] -+ unsafe_git_pull_options = [ -+ # This option allows users to execute arbitrary commands. -+ # https://git-scm.com/docs/git-pull#Documentation/git-pull.txt---upload-packltupload-packgt -+ "--upload-pack" -+ ] -+ unsafe_git_push_options = [ -+ # This option allows users to execute arbitrary commands. -+ # https://git-scm.com/docs/git-push#Documentation/git-push.txt---execltgit-receive-packgt -+ "--receive-pack", -+ "--exec", -+ ] -+ - def __init__(self, repo: 'Repo', name: str) -> None: - """Initialize a remote instance - -@@ -549,7 +566,8 @@ class Remote(LazyMixin, IterableObj): - yield Remote(repo, section[lbound + 1:rbound]) - # END for each configuration section - -- def set_url(self, new_url: str, old_url: Optional[str] = None, **kwargs: Any) -> 'Remote': -+ def set_url(self, new_url: str, old_url: Optional[str] = None, -+ allow_unsafe_protocols: bool = False, **kwargs: Any) -> 'Remote': - """Configure URLs on current remote (cf command git remote set_url) - - This command manages URLs on the remote. -@@ -558,15 +576,17 @@ class Remote(LazyMixin, IterableObj): - :param old_url: when set, replaces this URL with new_url for the remote - :return: self - """ -+ if not allow_unsafe_protocols: -+ Git.check_unsafe_protocols(new_url) - scmd = 'set-url' - kwargs['insert_kwargs_after'] = scmd - if old_url: -- self.repo.git.remote(scmd, self.name, new_url, old_url, **kwargs) -+ self.repo.git.remote(scmd, "--", self.name, new_url, old_url, **kwargs) - else: -- self.repo.git.remote(scmd, self.name, new_url, **kwargs) -+ self.repo.git.remote(scmd, "--", self.name, new_url, **kwargs) - return self - -- def add_url(self, url: str, **kwargs: Any) -> 'Remote': -+ def add_url(self, url: str, allow_unsafe_protocols: bool = False, **kwargs: Any) -> 'Remote': - """Adds a new url on current remote (special case of git remote set_url) - - This command adds new URLs to a given remote, making it possible to have -@@ -575,7 +595,7 @@ class Remote(LazyMixin, IterableObj): - :param url: string being the URL to add as an extra remote URL - :return: self - """ -- return self.set_url(url, add=True) -+ return self.set_url(url, add=True, allow_unsafe_protocols=allow_unsafe_protocols) - - def delete_url(self, url: str, **kwargs: Any) -> 'Remote': - """Deletes a new url on current remote (special case of git remote set_url) -@@ -667,7 +687,7 @@ class Remote(LazyMixin, IterableObj): - return out_refs - - @ classmethod -- def create(cls, repo: 'Repo', name: str, url: str, **kwargs: Any) -> 'Remote': -+ def create(cls, repo: 'Repo', name: str, url: str, allow_unsafe_protocols: bool = False, *kwargs: Any) -> 'Remote': - """Create a new remote to the given repository - :param repo: Repository instance that is to receive the new remote - :param name: Desired name of the remote -@@ -677,7 +697,10 @@ class Remote(LazyMixin, IterableObj): - :raise GitCommandError: in case an origin with that name already exists""" - scmd = 'add' - kwargs['insert_kwargs_after'] = scmd -- repo.git.remote(scmd, name, Git.polish_url(url), **kwargs) -+ url = Git.polish_url(url) -+ if not allow_unsafe_protocols: -+ Git.check_unsafe_protocols(url) -+ repo.git.remote(scmd, "--", name, url, **kwargs) - return cls(repo, name) - - # add is an alias -@@ -840,6 +863,8 @@ class Remote(LazyMixin, IterableObj): - progress: Union[RemoteProgress, None, 'UpdateProgress'] = None, - verbose: bool = True, - kill_after_timeout: Union[None, float] = None, -+ allow_unsafe_protocols: bool = False, -+ allow_unsafe_options: bool = False, - **kwargs: Any) -> IterableList[FetchInfo]: - """Fetch the latest changes for this remote - -@@ -881,6 +906,14 @@ class Remote(LazyMixin, IterableObj): - else: - args = [refspec] - -+ if not allow_unsafe_protocols: -+ for ref in args: -+ if ref: -+ Git.check_unsafe_protocols(ref) -+ -+ if not allow_unsafe_options: -+ Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_fetch_options) -+ - proc = self.repo.git.fetch("--", self, *args, as_process=True, with_stdout=False, - universal_newlines=True, v=verbose, **kwargs) - res = self._get_fetch_info_from_stderr(proc, progress, -@@ -892,6 +925,8 @@ class Remote(LazyMixin, IterableObj): - def pull(self, refspec: Union[str, List[str], None] = None, - progress: Union[RemoteProgress, 'UpdateProgress', None] = None, - kill_after_timeout: Union[None, float] = None, -+ allow_unsafe_protocols: bool = False, -+ allow_unsafe_options: bool = False, - **kwargs: Any) -> IterableList[FetchInfo]: - """Pull changes from the given branch, being the same as a fetch followed - by a merge of branch with your local branch. -@@ -905,6 +940,15 @@ class Remote(LazyMixin, IterableObj): - # No argument refspec, then ensure the repo's config has a fetch refspec. - self._assert_refspec() - kwargs = add_progress(kwargs, self.repo.git, progress) -+ -+ refspec = Git._unpack_args(refspec or []) -+ if not allow_unsafe_protocols: -+ for ref in refspec: -+ Git.check_unsafe_protocols(ref) -+ -+ if not allow_unsafe_options: -+ Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_pull_options) -+ - proc = self.repo.git.pull("--", self, refspec, with_stdout=False, as_process=True, - universal_newlines=True, v=True, **kwargs) - res = self._get_fetch_info_from_stderr(proc, progress, -@@ -916,6 +960,8 @@ class Remote(LazyMixin, IterableObj): - def push(self, refspec: Union[str, List[str], None] = None, - progress: Union[RemoteProgress, 'UpdateProgress', Callable[..., RemoteProgress], None] = None, - kill_after_timeout: Union[None, float] = None, -+ allow_unsafe_protocols: bool = False, -+ allow_unsafe_options: bool = False, - **kwargs: Any) -> IterableList[PushInfo]: - """Push changes from source branch in refspec to target branch in refspec. - -@@ -945,6 +991,15 @@ class Remote(LazyMixin, IterableObj): - If the operation fails completely, the length of the returned IterableList will - be 0.""" - kwargs = add_progress(kwargs, self.repo.git, progress) -+ -+ refspec = Git._unpack_args(refspec or []) -+ if not allow_unsafe_protocols: -+ for ref in refspec: -+ Git.check_unsafe_protocols(ref) -+ -+ if not allow_unsafe_options: -+ Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_push_options) -+ - proc = self.repo.git.push("--", self, refspec, porcelain=True, as_process=True, - universal_newlines=True, - kill_after_timeout=kill_after_timeout, -diff --git a/git/repo/base.py b/git/repo/base.py -index f14f929..7b3565b 100644 ---- a/git/repo/base.py -+++ b/git/repo/base.py -@@ -24,7 +24,11 @@ from git.compat import ( - ) - from git.config import GitConfigParser - from git.db import GitCmdObjectDB --from git.exc import InvalidGitRepositoryError, NoSuchPathError, GitCommandError -+from git.exc import ( -+ GitCommandError, -+ InvalidGitRepositoryError, -+ NoSuchPathError, -+) - from git.index import IndexFile - from git.objects import Submodule, RootModule, Commit - from git.refs import HEAD, Head, Reference, TagReference -@@ -97,6 +101,18 @@ class Repo(object): - re_author_committer_start = re.compile(r'^(author|committer)') - re_tab_full_line = re.compile(r'^\t(.*)$') - -+ unsafe_git_clone_options = [ -+ # This option allows users to execute arbitrary commands. -+ # https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---upload-packltupload-packgt -+ "--upload-pack", -+ "-u", -+ # Users can override configuration variables -+ # like `protocol.allow` or `core.gitProxy` to execute arbitrary commands. -+ # https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt -+ "--config", -+ "-c", -+ ] -+ - # invariants - # represents the configuration level of a configuration file - config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") -@@ -1049,7 +1065,8 @@ class Repo(object): - @ classmethod - def _clone(cls, git: 'Git', url: PathLike, path: PathLike, odb_default_type: Type[GitCmdObjectDB], - progress: Union['RemoteProgress', 'UpdateProgress', Callable[..., 'RemoteProgress'], None] = None, -- multi_options: Optional[List[str]] = None, **kwargs: Any -+ multi_options: Optional[List[str]] = None, allow_unsafe_protocols: bool = False, -+ allow_unsafe_options: bool = False, **kwargs: Any - ) -> 'Repo': - odbt = kwargs.pop('odbt', odb_default_type) - -@@ -1072,6 +1089,12 @@ class Repo(object): - multi = None - if multi_options: - multi = shlex.split(' '.join(multi_options)) -+ -+ if not allow_unsafe_protocols: -+ Git.check_unsafe_protocols(str(url)) -+ if not allow_unsafe_options and multi_options: -+ Git.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options) -+ - proc = git.clone("--", multi, Git.polish_url(str(url)), clone_path, with_extended_output=True, as_process=True, - v=True, universal_newlines=True, **add_progress(kwargs, git, progress)) - if progress: -@@ -1107,7 +1130,9 @@ class Repo(object): - return repo - - def clone(self, path: PathLike, progress: Optional[Callable] = None, -- multi_options: Optional[List[str]] = None, **kwargs: Any) -> 'Repo': -+ multi_options: Optional[List[str]] = None, unsafe_protocols: bool = False, -+ allow_unsafe_protocols: bool = False, allow_unsafe_options: bool = False, -+ **kwargs: Any) -> 'Repo': - """Create a clone from this repository. - - :param path: is the full path of the new repo (traditionally ends with ./<name>.git). -@@ -1116,18 +1141,21 @@ class Repo(object): - option per list item which is passed exactly as specified to clone. - For example ['--config core.filemode=false', '--config core.ignorecase', - '--recurse-submodule=repo1_path', '--recurse-submodule=repo2_path'] -+ :param unsafe_protocols: Allow unsafe protocols to be used, like ex - :param kwargs: - * odbt = ObjectDatabase Type, allowing to determine the object database - implementation used by the returned Repo instance - * All remaining keyword arguments are given to the git-clone command - - :return: ``git.Repo`` (the newly cloned repo)""" -- return self._clone(self.git, self.common_dir, path, type(self.odb), progress, multi_options, **kwargs) -+ return self._clone(self.git, self.common_dir, path, type(self.odb), progress, multi_options, -+ allow_unsafe_protocols=allow_unsafe_protocols, allow_unsafe_options=allow_unsafe_options, **kwargs) - - @ classmethod - def clone_from(cls, url: PathLike, to_path: PathLike, progress: Optional[Callable] = None, -- env: Optional[Mapping[str, str]] = None, -- multi_options: Optional[List[str]] = None, **kwargs: Any) -> 'Repo': -+ env: Optional[Mapping[str, str]] = None, multi_options: Optional[List[str]] = None, -+ unsafe_protocols: bool = False, allow_unsafe_protocols: bool = False, -+ allow_unsafe_options: bool = False, **kwargs: Any) -> 'Repo': - """Create a clone from the given URL - - :param url: valid git url, see http://www.kernel.org/pub/software/scm/git/docs/git-clone.html#URLS -@@ -1140,12 +1168,14 @@ class Repo(object): - If you want to unset some variable, consider providing empty string - as its value. - :param multi_options: See ``clone`` method -+ :param unsafe_protocols: Allow unsafe protocols to be used, like ext - :param kwargs: see the ``clone`` method - :return: Repo instance pointing to the cloned directory""" - git = cls.GitCommandWrapperType(os.getcwd()) - if env is not None: - git.update_environment(**env) -- return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options, **kwargs) -+ return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options, -+ allow_unsafe_protocols=allow_unsafe_protocols, allow_unsafe_options=allow_unsafe_options, **kwargs) - - def archive(self, ostream: Union[TextIO, BinaryIO], treeish: Optional[str] = None, - prefix: Optional[str] = None, **kwargs: Any) -> Repo: --- -2.34.1 - diff --git a/meta/recipes-devtools/python/python3-git_3.1.27.bb b/meta/recipes-devtools/python/python3-git_3.1.37.bb index 1bd1426926..56a335a79e 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.27.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.37.bb @@ -6,17 +6,13 @@ access with big-files support." HOMEPAGE = "http://github.com/gitpython-developers/GitPython" SECTION = "devel/python" LICENSE = "BSD-3-Clause" -LIC_FILES_CHKSUM = "file://LICENSE;md5=8b8d26c37c1d5a04f9b0186edbebc183" +LIC_FILES_CHKSUM = "file://LICENSE;md5=5279a7ab369ba336989dcf2a107e5c8e" PYPI_PACKAGE = "GitPython" inherit pypi python_setuptools_build_meta -SRC_URI += "file://0001-python3-git-CVE-2022-24439-fix-from-PR-1518.patch \ - file://0001-python3-git-CVE-2022-24439-fix-from-PR-1521.patch \ - " - -SRC_URI[sha256sum] = "1c885ce809e8ba2d88a29befeb385fcea06338d3640712b59ca623c220bb5704" +SRC_URI[sha256sum] = "f9b9ddc0761c125d5780eab2d64be4873fc6817c2899cbcb34b02344bdc7bc54" DEPENDS += " ${PYTHON_PN}-gitdb" diff --git a/meta/recipes-devtools/python/python3-jinja2/run-ptest b/meta/recipes-devtools/python/python3-jinja2/run-ptest index 5cec711696..5817735a63 100644 --- a/meta/recipes-devtools/python/python3-jinja2/run-ptest +++ b/meta/recipes-devtools/python/python3-jinja2/run-ptest @@ -1,3 +1,3 @@ #!/bin/sh -pytest +pytest -o log_cli=true -o log_cli_level=INFO | sed -e 's/\[...%\]//g'| sed -e 's/PASSED/PASS/g'| sed -e 's/FAILED/FAIL/g'| sed -e 's/SKIPPED/SKIP/g'| awk '{if ($NF=="PASS" || $NF=="FAIL" || $NF=="SKIP" || $NF=="XFAIL" || $NF=="XPASS"){printf "%s: %s\n", $NF, $0}else{print}}'| awk '{if ($NF=="PASS" || $NF=="FAIL" || $NF=="SKIP" || $NF=="XFAIL" || $NF=="XPASS") {$NF="";print $0}else{print}}' diff --git a/meta/recipes-devtools/python/python3-jinja2_3.1.1.bb b/meta/recipes-devtools/python/python3-jinja2_3.1.3.bb index c38686a5c2..068e21bf5f 100644 --- a/meta/recipes-devtools/python/python3-jinja2_3.1.1.bb +++ b/meta/recipes-devtools/python/python3-jinja2_3.1.3.bb @@ -4,7 +4,7 @@ HOMEPAGE = "https://pypi.org/project/Jinja2/" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE.rst;md5=5dc88300786f1c214c1e9827a5229462" -SRC_URI[sha256sum] = "640bed4bb501cbd17194b3cace1dc2126f5b619cf068a726b98192a0fde74ae9" +SRC_URI[sha256sum] = "ac8bd6544d4bb2c9792bf3a159e80bba8fda7f07e81bc3aed565432d5925ba90" PYPI_PACKAGE = "Jinja2" diff --git a/meta/recipes-devtools/python/python3-pycryptodome/CVE-2023-52323.patch b/meta/recipes-devtools/python/python3-pycryptodome/CVE-2023-52323.patch new file mode 100644 index 0000000000..be3090eb8d --- /dev/null +++ b/meta/recipes-devtools/python/python3-pycryptodome/CVE-2023-52323.patch @@ -0,0 +1,436 @@ +From 73bbed822fadddf3c0ab4a945ee6ab16bbca6961 Mon Sep 17 00:00:00 2001 +From: Helder Eijs <helderijs@gmail.com> +Date: Thu, 1 Feb 2024 13:43:44 +0000 +Subject: [PATCH] Use constant-time (faster) padding decoding also for OAEP + +CVE: CVE-2023-52323 + +Upstream-Status: Backport [https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + lib/Crypto/Cipher/PKCS1_OAEP.py | 38 +++++------- + lib/Crypto/Cipher/PKCS1_v1_5.py | 31 +--------- + lib/Crypto/Cipher/_pkcs1_oaep_decode.py | 41 +++++++++++++ + src/pkcs1_decode.c | 79 +++++++++++++++++++++++-- + src/test/test_pkcs1.c | 22 +++---- + 5 files changed, 145 insertions(+), 66 deletions(-) + create mode 100644 lib/Crypto/Cipher/_pkcs1_oaep_decode.py + +diff --git a/lib/Crypto/Cipher/PKCS1_OAEP.py b/lib/Crypto/Cipher/PKCS1_OAEP.py +index 57a982b..6974584 100644 +--- a/lib/Crypto/Cipher/PKCS1_OAEP.py ++++ b/lib/Crypto/Cipher/PKCS1_OAEP.py +@@ -23,11 +23,13 @@ + from Crypto.Signature.pss import MGF1 + import Crypto.Hash.SHA1 + +-from Crypto.Util.py3compat import bord, _copy_bytes ++from Crypto.Util.py3compat import _copy_bytes + import Crypto.Util.number +-from Crypto.Util.number import ceil_div, bytes_to_long, long_to_bytes +-from Crypto.Util.strxor import strxor ++from Crypto.Util.number import ceil_div, bytes_to_long, long_to_bytes ++from Crypto.Util.strxor import strxor + from Crypto import Random ++from ._pkcs1_oaep_decode import oaep_decode ++ + + class PKCS1OAEP_Cipher: + """Cipher object for PKCS#1 v1.5 OAEP. +@@ -68,7 +70,7 @@ class PKCS1OAEP_Cipher: + if mgfunc: + self._mgf = mgfunc + else: +- self._mgf = lambda x,y: MGF1(x,y,self._hashObj) ++ self._mgf = lambda x, y: MGF1(x, y, self._hashObj) + + self._label = _copy_bytes(None, None, label) + self._randfunc = randfunc +@@ -105,7 +107,7 @@ class PKCS1OAEP_Cipher: + + # See 7.1.1 in RFC3447 + modBits = Crypto.Util.number.size(self._key.n) +- k = ceil_div(modBits, 8) # Convert from bits to bytes ++ k = ceil_div(modBits, 8) # Convert from bits to bytes + hLen = self._hashObj.digest_size + mLen = len(message) + +@@ -159,11 +161,11 @@ class PKCS1OAEP_Cipher: + + # See 7.1.2 in RFC3447 + modBits = Crypto.Util.number.size(self._key.n) +- k = ceil_div(modBits,8) # Convert from bits to bytes ++ k = ceil_div(modBits, 8) # Convert from bits to bytes + hLen = self._hashObj.digest_size + + # Step 1b and 1c +- if len(ciphertext) != k or k<hLen+2: ++ if len(ciphertext) != k or k < hLen+2: + raise ValueError("Ciphertext with incorrect length.") + # Step 2a (O2SIP) + ct_int = bytes_to_long(ciphertext) +@@ -173,8 +175,6 @@ class PKCS1OAEP_Cipher: + em = long_to_bytes(m_int, k) + # Step 3a + lHash = self._hashObj.new(self._label).digest() +- # Step 3b +- y = em[0] + # y must be 0, but we MUST NOT check it here in order not to + # allow attacks like Manger's (http://dl.acm.org/citation.cfm?id=704143) + maskedSeed = em[1:hLen+1] +@@ -187,22 +187,17 @@ class PKCS1OAEP_Cipher: + dbMask = self._mgf(seed, k-hLen-1) + # Step 3f + db = strxor(maskedDB, dbMask) +- # Step 3g +- one_pos = hLen + db[hLen:].find(b'\x01') +- lHash1 = db[:hLen] +- invalid = bord(y) | int(one_pos < hLen) +- hash_compare = strxor(lHash1, lHash) +- for x in hash_compare: +- invalid |= bord(x) +- for x in db[hLen:one_pos]: +- invalid |= bord(x) +- if invalid != 0: ++ # Step 3b + 3g ++ res = oaep_decode(em, lHash, db) ++ if res <= 0: + raise ValueError("Incorrect decryption.") + # Step 4 +- return db[one_pos + 1:] ++ return db[res:] ++ + + def new(key, hashAlgo=None, mgfunc=None, label=b'', randfunc=None): +- """Return a cipher object :class:`PKCS1OAEP_Cipher` that can be used to perform PKCS#1 OAEP encryption or decryption. ++ """Return a cipher object :class:`PKCS1OAEP_Cipher` ++ that can be used to perform PKCS#1 OAEP encryption or decryption. + + :param key: + The key object to use to encrypt or decrypt the message. +@@ -236,4 +231,3 @@ def new(key, hashAlgo=None, mgfunc=None, label=b'', randfunc=None): + if randfunc is None: + randfunc = Random.get_random_bytes + return PKCS1OAEP_Cipher(key, hashAlgo, mgfunc, label, randfunc) +- +diff --git a/lib/Crypto/Cipher/PKCS1_v1_5.py b/lib/Crypto/Cipher/PKCS1_v1_5.py +index d0d474a..94e99cf 100644 +--- a/lib/Crypto/Cipher/PKCS1_v1_5.py ++++ b/lib/Crypto/Cipher/PKCS1_v1_5.py +@@ -25,31 +25,7 @@ __all__ = ['new', 'PKCS115_Cipher'] + from Crypto import Random + from Crypto.Util.number import bytes_to_long, long_to_bytes + from Crypto.Util.py3compat import bord, is_bytes, _copy_bytes +- +-from Crypto.Util._raw_api import (load_pycryptodome_raw_lib, c_size_t, +- c_uint8_ptr) +- +- +-_raw_pkcs1_decode = load_pycryptodome_raw_lib("Crypto.Cipher._pkcs1_decode", +- """ +- int pkcs1_decode(const uint8_t *em, size_t len_em, +- const uint8_t *sentinel, size_t len_sentinel, +- size_t expected_pt_len, +- uint8_t *output); +- """) +- +- +-def _pkcs1_decode(em, sentinel, expected_pt_len, output): +- if len(em) != len(output): +- raise ValueError("Incorrect output length") +- +- ret = _raw_pkcs1_decode.pkcs1_decode(c_uint8_ptr(em), +- c_size_t(len(em)), +- c_uint8_ptr(sentinel), +- c_size_t(len(sentinel)), +- c_size_t(expected_pt_len), +- c_uint8_ptr(output)) +- return ret ++from ._pkcs1_oaep_decode import pkcs1_decode + + + class PKCS115_Cipher: +@@ -113,7 +89,6 @@ class PKCS115_Cipher: + continue + ps.append(new_byte) + ps = b"".join(ps) +- assert(len(ps) == k - mLen - 3) + # Step 2b + em = b'\x00\x02' + ps + b'\x00' + _copy_bytes(None, None, message) + # Step 3a (OS2IP) +@@ -185,14 +160,14 @@ class PKCS115_Cipher: + # Step 3 (not constant time when the sentinel is not a byte string) + output = bytes(bytearray(k)) + if not is_bytes(sentinel) or len(sentinel) > k: +- size = _pkcs1_decode(em, b'', expected_pt_len, output) ++ size = pkcs1_decode(em, b'', expected_pt_len, output) + if size < 0: + return sentinel + else: + return output[size:] + + # Step 3 (somewhat constant time) +- size = _pkcs1_decode(em, sentinel, expected_pt_len, output) ++ size = pkcs1_decode(em, sentinel, expected_pt_len, output) + return output[size:] + + +diff --git a/lib/Crypto/Cipher/_pkcs1_oaep_decode.py b/lib/Crypto/Cipher/_pkcs1_oaep_decode.py +new file mode 100644 +index 0000000..fc07528 +--- /dev/null ++++ b/lib/Crypto/Cipher/_pkcs1_oaep_decode.py +@@ -0,0 +1,41 @@ ++from Crypto.Util._raw_api import (load_pycryptodome_raw_lib, c_size_t, ++ c_uint8_ptr) ++ ++ ++_raw_pkcs1_decode = load_pycryptodome_raw_lib("Crypto.Cipher._pkcs1_decode", ++ """ ++ int pkcs1_decode(const uint8_t *em, size_t len_em, ++ const uint8_t *sentinel, size_t len_sentinel, ++ size_t expected_pt_len, ++ uint8_t *output); ++ ++ int oaep_decode(const uint8_t *em, ++ size_t em_len, ++ const uint8_t *lHash, ++ size_t hLen, ++ const uint8_t *db, ++ size_t db_len); ++ """) ++ ++ ++def pkcs1_decode(em, sentinel, expected_pt_len, output): ++ if len(em) != len(output): ++ raise ValueError("Incorrect output length") ++ ++ ret = _raw_pkcs1_decode.pkcs1_decode(c_uint8_ptr(em), ++ c_size_t(len(em)), ++ c_uint8_ptr(sentinel), ++ c_size_t(len(sentinel)), ++ c_size_t(expected_pt_len), ++ c_uint8_ptr(output)) ++ return ret ++ ++ ++def oaep_decode(em, lHash, db): ++ ret = _raw_pkcs1_decode.oaep_decode(c_uint8_ptr(em), ++ c_size_t(len(em)), ++ c_uint8_ptr(lHash), ++ c_size_t(len(lHash)), ++ c_uint8_ptr(db), ++ c_size_t(len(db))) ++ return ret +diff --git a/src/pkcs1_decode.c b/src/pkcs1_decode.c +index 207b198..74cb4a2 100644 +--- a/src/pkcs1_decode.c ++++ b/src/pkcs1_decode.c +@@ -130,7 +130,7 @@ STATIC size_t safe_select_idx(size_t in1, size_t in2, uint8_t choice) + * - in1[] is NOT equal to in2[] where neq_mask[] is 0xFF. + * Return non-zero otherwise. + */ +-STATIC uint8_t safe_cmp(const uint8_t *in1, const uint8_t *in2, ++STATIC uint8_t safe_cmp_masks(const uint8_t *in1, const uint8_t *in2, + const uint8_t *eq_mask, const uint8_t *neq_mask, + size_t len) + { +@@ -187,7 +187,7 @@ STATIC size_t safe_search(const uint8_t *in1, uint8_t c, size_t len) + return result; + } + +-#define EM_PREFIX_LEN 10 ++#define PKCS1_PREFIX_LEN 10 + + /* + * Decode and verify the PKCS#1 padding, then put either the plaintext +@@ -222,13 +222,13 @@ EXPORT_SYM int pkcs1_decode(const uint8_t *em, size_t len_em_output, + if (NULL == em || NULL == output || NULL == sentinel) { + return -1; + } +- if (len_em_output < (EM_PREFIX_LEN + 2)) { ++ if (len_em_output < (PKCS1_PREFIX_LEN + 2)) { + return -1; + } + if (len_sentinel > len_em_output) { + return -1; + } +- if (expected_pt_len > 0 && expected_pt_len > (len_em_output - EM_PREFIX_LEN - 1)) { ++ if (expected_pt_len > 0 && expected_pt_len > (len_em_output - PKCS1_PREFIX_LEN - 1)) { + return -1; + } + +@@ -240,7 +240,7 @@ EXPORT_SYM int pkcs1_decode(const uint8_t *em, size_t len_em_output, + memcpy(padded_sentinel + (len_em_output - len_sentinel), sentinel, len_sentinel); + + /** The first 10 bytes must follow the pattern **/ +- match = safe_cmp(em, ++ match = safe_cmp_masks(em, + (const uint8_t*)"\x00\x02" "\x00\x00\x00\x00\x00\x00\x00\x00", + (const uint8_t*)"\xFF\xFF" "\x00\x00\x00\x00\x00\x00\x00\x00", + (const uint8_t*)"\x00\x00" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF", +@@ -283,3 +283,72 @@ end: + free(padded_sentinel); + return result; + } ++ ++/* ++ * Decode and verify the OAEP padding in constant time. ++ * ++ * The function returns the number of bytes to ignore at the beginning ++ * of db (the rest is the plaintext), or -1 in case of problems. ++ */ ++ ++EXPORT_SYM int oaep_decode(const uint8_t *em, ++ size_t em_len, ++ const uint8_t *lHash, ++ size_t hLen, ++ const uint8_t *db, ++ size_t db_len) /* em_len - 1 - hLen */ ++{ ++ int result; ++ size_t one_pos, search_len, i; ++ uint8_t wrong_padding; ++ uint8_t *eq_mask = NULL; ++ uint8_t *neq_mask = NULL; ++ uint8_t *target_db = NULL; ++ ++ if (NULL == em || NULL == lHash || NULL == db) { ++ return -1; ++ } ++ ++ if (em_len < 2*hLen+2 || db_len != em_len-1-hLen) { ++ return -1; ++ } ++ ++ /* Allocate */ ++ eq_mask = (uint8_t*) calloc(1, db_len); ++ neq_mask = (uint8_t*) calloc(1, db_len); ++ target_db = (uint8_t*) calloc(1, db_len); ++ if (NULL == eq_mask || NULL == neq_mask || NULL == target_db) { ++ result = -1; ++ goto cleanup; ++ } ++ ++ /* Step 3g */ ++ search_len = db_len - hLen; ++ ++ one_pos = safe_search(db + hLen, 0x01, search_len); ++ if (SIZE_T_MAX == one_pos) { ++ result = -1; ++ goto cleanup; ++ } ++ ++ memset(eq_mask, 0xAA, db_len); ++ memcpy(target_db, lHash, hLen); ++ memset(eq_mask, 0xFF, hLen); ++ ++ for (i=0; i<search_len; i++) { ++ eq_mask[hLen + i] = propagate_ones(i < one_pos); ++ } ++ ++ wrong_padding = em[0]; ++ wrong_padding |= safe_cmp_masks(db, target_db, eq_mask, neq_mask, db_len); ++ set_if_match(&wrong_padding, one_pos, search_len); ++ ++ result = wrong_padding ? -1 : (int)(hLen + 1 + one_pos); ++ ++cleanup: ++ free(eq_mask); ++ free(neq_mask); ++ free(target_db); ++ ++ return result; ++} +diff --git a/src/test/test_pkcs1.c b/src/test/test_pkcs1.c +index 6ef63cb..69aaac5 100644 +--- a/src/test/test_pkcs1.c ++++ b/src/test/test_pkcs1.c +@@ -5,7 +5,7 @@ void set_if_match(uint8_t *flag, size_t term1, size_t term2); + void set_if_no_match(uint8_t *flag, size_t term1, size_t term2); + void safe_select(const uint8_t *in1, const uint8_t *in2, uint8_t *out, uint8_t choice, size_t len); + size_t safe_select_idx(size_t in1, size_t in2, uint8_t choice); +-uint8_t safe_cmp(const uint8_t *in1, const uint8_t *in2, ++uint8_t safe_cmp_masks(const uint8_t *in1, const uint8_t *in2, + const uint8_t *eq_mask, const uint8_t *neq_mask, + size_t len); + size_t safe_search(const uint8_t *in1, uint8_t c, size_t len); +@@ -80,29 +80,29 @@ void test_safe_select_idx() + assert(safe_select_idx(0x100004, 0x223344, 1) == 0x223344); + } + +-void test_safe_cmp() ++void test_safe_cmp_masks(void) + { + uint8_t res; + +- res = safe_cmp(onezero, onezero, ++ res = safe_cmp_masks(onezero, onezero, + (uint8_t*)"\xFF\xFF", + (uint8_t*)"\x00\x00", + 2); + assert(res == 0); + +- res = safe_cmp(onezero, zerozero, ++ res = safe_cmp_masks(onezero, zerozero, + (uint8_t*)"\xFF\xFF", + (uint8_t*)"\x00\x00", + 2); + assert(res != 0); + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\xFF\xFF", + (uint8_t*)"\x00\x00", + 2); + assert(res != 0); + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\xFF\x00", + (uint8_t*)"\x00\x00", + 2); +@@ -110,19 +110,19 @@ void test_safe_cmp() + + /** -- **/ + +- res = safe_cmp(onezero, onezero, ++ res = safe_cmp_masks(onezero, onezero, + (uint8_t*)"\x00\x00", + (uint8_t*)"\xFF\xFF", + 2); + assert(res != 0); + +- res = safe_cmp(oneone, zerozero, ++ res = safe_cmp_masks(oneone, zerozero, + (uint8_t*)"\x00\x00", + (uint8_t*)"\xFF\xFF", + 2); + assert(res == 0); + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\x00\x00", + (uint8_t*)"\x00\xFF", + 2); +@@ -130,7 +130,7 @@ void test_safe_cmp() + + /** -- **/ + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\xFF\x00", + (uint8_t*)"\x00\xFF", + 2); +@@ -158,7 +158,7 @@ int main(void) + test_set_if_no_match(); + test_safe_select(); + test_safe_select_idx(); +- test_safe_cmp(); ++ test_safe_cmp_masks(); + test_safe_search(); + return 0; + } +-- +2.40.0 diff --git a/meta/recipes-devtools/python/python3-pycryptodome_3.14.1.bb b/meta/recipes-devtools/python/python3-pycryptodome_3.14.1.bb index c0324590c2..1e6c514224 100644 --- a/meta/recipes-devtools/python/python3-pycryptodome_3.14.1.bb +++ b/meta/recipes-devtools/python/python3-pycryptodome_3.14.1.bb @@ -3,3 +3,4 @@ inherit setuptools3 SRC_URI[sha256sum] = "e04e40a7f8c1669195536a37979dd87da2c32dbdc73d6fe35f0077b0c17c803b" +SRC_URI += "file://CVE-2023-52323.patch" diff --git a/meta/recipes-devtools/python/python3-pycryptodomex/CVE-2023-52323.patch b/meta/recipes-devtools/python/python3-pycryptodomex/CVE-2023-52323.patch new file mode 100644 index 0000000000..56000b996e --- /dev/null +++ b/meta/recipes-devtools/python/python3-pycryptodomex/CVE-2023-52323.patch @@ -0,0 +1,436 @@ +From 8ed5cf533be298d40ec9f75a188738ad4c3a8417 Mon Sep 17 00:00:00 2001 +From: Narpat Mali <narpat.mali@windriver.com> +Date: Thu, 8 Feb 2024 09:09:35 +0000 +Subject: [PATCH] Use constant-time (faster) padding decoding also for OAEP + +CVE: CVE-2023-52323 + +Upstream-Status: Backport [https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + lib/Cryptodome/Cipher/PKCS1_OAEP.py | 38 +++++----- + lib/Cryptodome/Cipher/PKCS1_v1_5.py | 31 +------- + lib/Cryptodome/Cipher/_pkcs1_oaep_decode.py | 41 +++++++++++ + src/pkcs1_decode.c | 79 +++++++++++++++++++-- + src/test/test_pkcs1.c | 22 +++--- + 5 files changed, 145 insertions(+), 66 deletions(-) + create mode 100644 lib/Cryptodome/Cipher/_pkcs1_oaep_decode.py + +diff --git a/lib/Cryptodome/Cipher/PKCS1_OAEP.py b/lib/Cryptodome/Cipher/PKCS1_OAEP.py +index 7525c5d..653df04 100644 +--- a/lib/Cryptodome/Cipher/PKCS1_OAEP.py ++++ b/lib/Cryptodome/Cipher/PKCS1_OAEP.py +@@ -23,11 +23,13 @@ + from Cryptodome.Signature.pss import MGF1 + import Cryptodome.Hash.SHA1 + +-from Cryptodome.Util.py3compat import bord, _copy_bytes ++from Crypto.Util.py3compat import _copy_bytes + import Cryptodome.Util.number +-from Cryptodome.Util.number import ceil_div, bytes_to_long, long_to_bytes +-from Cryptodome.Util.strxor import strxor ++from Crypto.Util.number import ceil_div, bytes_to_long, long_to_bytes ++from Crypto.Util.strxor import strxor + from Cryptodome import Random ++from ._pkcs1_oaep_decode import oaep_decode ++ + + class PKCS1OAEP_Cipher: + """Cipher object for PKCS#1 v1.5 OAEP. +@@ -68,7 +70,7 @@ class PKCS1OAEP_Cipher: + if mgfunc: + self._mgf = mgfunc + else: +- self._mgf = lambda x,y: MGF1(x,y,self._hashObj) ++ self._mgf = lambda x, y: MGF1(x, y, self._hashObj) + + self._label = _copy_bytes(None, None, label) + self._randfunc = randfunc +@@ -105,7 +107,7 @@ class PKCS1OAEP_Cipher: + + # See 7.1.1 in RFC3447 + modBits = Cryptodome.Util.number.size(self._key.n) +- k = ceil_div(modBits, 8) # Convert from bits to bytes ++ k = ceil_div(modBits, 8) # Convert from bits to bytes + hLen = self._hashObj.digest_size + mLen = len(message) + +@@ -159,11 +161,11 @@ class PKCS1OAEP_Cipher: + + # See 7.1.2 in RFC3447 + modBits = Cryptodome.Util.number.size(self._key.n) +- k = ceil_div(modBits,8) # Convert from bits to bytes ++ k = ceil_div(modBits, 8) # Convert from bits to bytes + hLen = self._hashObj.digest_size + + # Step 1b and 1c +- if len(ciphertext) != k or k<hLen+2: ++ if len(ciphertext) != k or k < hLen+2: + raise ValueError("Ciphertext with incorrect length.") + # Step 2a (O2SIP) + ct_int = bytes_to_long(ciphertext) +@@ -173,8 +175,6 @@ class PKCS1OAEP_Cipher: + em = long_to_bytes(m_int, k) + # Step 3a + lHash = self._hashObj.new(self._label).digest() +- # Step 3b +- y = em[0] + # y must be 0, but we MUST NOT check it here in order not to + # allow attacks like Manger's (http://dl.acm.org/citation.cfm?id=704143) + maskedSeed = em[1:hLen+1] +@@ -187,22 +187,17 @@ class PKCS1OAEP_Cipher: + dbMask = self._mgf(seed, k-hLen-1) + # Step 3f + db = strxor(maskedDB, dbMask) +- # Step 3g +- one_pos = hLen + db[hLen:].find(b'\x01') +- lHash1 = db[:hLen] +- invalid = bord(y) | int(one_pos < hLen) +- hash_compare = strxor(lHash1, lHash) +- for x in hash_compare: +- invalid |= bord(x) +- for x in db[hLen:one_pos]: +- invalid |= bord(x) +- if invalid != 0: ++ # Step 3b + 3g ++ res = oaep_decode(em, lHash, db) ++ if res <= 0: + raise ValueError("Incorrect decryption.") + # Step 4 +- return db[one_pos + 1:] ++ return db[res:] ++ + + def new(key, hashAlgo=None, mgfunc=None, label=b'', randfunc=None): +- """Return a cipher object :class:`PKCS1OAEP_Cipher` that can be used to perform PKCS#1 OAEP encryption or decryption. ++ """Return a cipher object :class:`PKCS1OAEP_Cipher` ++ that can be used to perform PKCS#1 OAEP encryption or decryption. + + :param key: + The key object to use to encrypt or decrypt the message. +@@ -236,4 +231,3 @@ def new(key, hashAlgo=None, mgfunc=None, label=b'', randfunc=None): + if randfunc is None: + randfunc = Random.get_random_bytes + return PKCS1OAEP_Cipher(key, hashAlgo, mgfunc, label, randfunc) +- +diff --git a/lib/Cryptodome/Cipher/PKCS1_v1_5.py b/lib/Cryptodome/Cipher/PKCS1_v1_5.py +index 17ef9eb..f20a7ce 100644 +--- a/lib/Cryptodome/Cipher/PKCS1_v1_5.py ++++ b/lib/Cryptodome/Cipher/PKCS1_v1_5.py +@@ -25,31 +25,7 @@ __all__ = ['new', 'PKCS115_Cipher'] + from Cryptodome import Random + from Cryptodome.Util.number import bytes_to_long, long_to_bytes + from Cryptodome.Util.py3compat import bord, is_bytes, _copy_bytes +- +-from Cryptodome.Util._raw_api import (load_pycryptodome_raw_lib, c_size_t, +- c_uint8_ptr) +- +- +-_raw_pkcs1_decode = load_pycryptodome_raw_lib("Cryptodome.Cipher._pkcs1_decode", +- """ +- int pkcs1_decode(const uint8_t *em, size_t len_em, +- const uint8_t *sentinel, size_t len_sentinel, +- size_t expected_pt_len, +- uint8_t *output); +- """) +- +- +-def _pkcs1_decode(em, sentinel, expected_pt_len, output): +- if len(em) != len(output): +- raise ValueError("Incorrect output length") +- +- ret = _raw_pkcs1_decode.pkcs1_decode(c_uint8_ptr(em), +- c_size_t(len(em)), +- c_uint8_ptr(sentinel), +- c_size_t(len(sentinel)), +- c_size_t(expected_pt_len), +- c_uint8_ptr(output)) +- return ret ++from ._pkcs1_oaep_decode import pkcs1_decode + + + class PKCS115_Cipher: +@@ -113,7 +89,6 @@ class PKCS115_Cipher: + continue + ps.append(new_byte) + ps = b"".join(ps) +- assert(len(ps) == k - mLen - 3) + # Step 2b + em = b'\x00\x02' + ps + b'\x00' + _copy_bytes(None, None, message) + # Step 3a (OS2IP) +@@ -185,14 +160,14 @@ class PKCS115_Cipher: + # Step 3 (not constant time when the sentinel is not a byte string) + output = bytes(bytearray(k)) + if not is_bytes(sentinel) or len(sentinel) > k: +- size = _pkcs1_decode(em, b'', expected_pt_len, output) ++ size = pkcs1_decode(em, b'', expected_pt_len, output) + if size < 0: + return sentinel + else: + return output[size:] + + # Step 3 (somewhat constant time) +- size = _pkcs1_decode(em, sentinel, expected_pt_len, output) ++ size = pkcs1_decode(em, sentinel, expected_pt_len, output) + return output[size:] + + +diff --git a/lib/Cryptodome/Cipher/_pkcs1_oaep_decode.py b/lib/Cryptodome/Cipher/_pkcs1_oaep_decode.py +new file mode 100644 +index 0000000..fc07528 +--- /dev/null ++++ b/lib/Cryptodome/Cipher/_pkcs1_oaep_decode.py +@@ -0,0 +1,41 @@ ++from Crypto.Util._raw_api import (load_pycryptodome_raw_lib, c_size_t, ++ c_uint8_ptr) ++ ++ ++_raw_pkcs1_decode = load_pycryptodome_raw_lib("Crypto.Cipher._pkcs1_decode", ++ """ ++ int pkcs1_decode(const uint8_t *em, size_t len_em, ++ const uint8_t *sentinel, size_t len_sentinel, ++ size_t expected_pt_len, ++ uint8_t *output); ++ ++ int oaep_decode(const uint8_t *em, ++ size_t em_len, ++ const uint8_t *lHash, ++ size_t hLen, ++ const uint8_t *db, ++ size_t db_len); ++ """) ++ ++ ++def pkcs1_decode(em, sentinel, expected_pt_len, output): ++ if len(em) != len(output): ++ raise ValueError("Incorrect output length") ++ ++ ret = _raw_pkcs1_decode.pkcs1_decode(c_uint8_ptr(em), ++ c_size_t(len(em)), ++ c_uint8_ptr(sentinel), ++ c_size_t(len(sentinel)), ++ c_size_t(expected_pt_len), ++ c_uint8_ptr(output)) ++ return ret ++ ++ ++def oaep_decode(em, lHash, db): ++ ret = _raw_pkcs1_decode.oaep_decode(c_uint8_ptr(em), ++ c_size_t(len(em)), ++ c_uint8_ptr(lHash), ++ c_size_t(len(lHash)), ++ c_uint8_ptr(db), ++ c_size_t(len(db))) ++ return ret +diff --git a/src/pkcs1_decode.c b/src/pkcs1_decode.c +index 207b198..74cb4a2 100644 +--- a/src/pkcs1_decode.c ++++ b/src/pkcs1_decode.c +@@ -130,7 +130,7 @@ STATIC size_t safe_select_idx(size_t in1, size_t in2, uint8_t choice) + * - in1[] is NOT equal to in2[] where neq_mask[] is 0xFF. + * Return non-zero otherwise. + */ +-STATIC uint8_t safe_cmp(const uint8_t *in1, const uint8_t *in2, ++STATIC uint8_t safe_cmp_masks(const uint8_t *in1, const uint8_t *in2, + const uint8_t *eq_mask, const uint8_t *neq_mask, + size_t len) + { +@@ -187,7 +187,7 @@ STATIC size_t safe_search(const uint8_t *in1, uint8_t c, size_t len) + return result; + } + +-#define EM_PREFIX_LEN 10 ++#define PKCS1_PREFIX_LEN 10 + + /* + * Decode and verify the PKCS#1 padding, then put either the plaintext +@@ -222,13 +222,13 @@ EXPORT_SYM int pkcs1_decode(const uint8_t *em, size_t len_em_output, + if (NULL == em || NULL == output || NULL == sentinel) { + return -1; + } +- if (len_em_output < (EM_PREFIX_LEN + 2)) { ++ if (len_em_output < (PKCS1_PREFIX_LEN + 2)) { + return -1; + } + if (len_sentinel > len_em_output) { + return -1; + } +- if (expected_pt_len > 0 && expected_pt_len > (len_em_output - EM_PREFIX_LEN - 1)) { ++ if (expected_pt_len > 0 && expected_pt_len > (len_em_output - PKCS1_PREFIX_LEN - 1)) { + return -1; + } + +@@ -240,7 +240,7 @@ EXPORT_SYM int pkcs1_decode(const uint8_t *em, size_t len_em_output, + memcpy(padded_sentinel + (len_em_output - len_sentinel), sentinel, len_sentinel); + + /** The first 10 bytes must follow the pattern **/ +- match = safe_cmp(em, ++ match = safe_cmp_masks(em, + (const uint8_t*)"\x00\x02" "\x00\x00\x00\x00\x00\x00\x00\x00", + (const uint8_t*)"\xFF\xFF" "\x00\x00\x00\x00\x00\x00\x00\x00", + (const uint8_t*)"\x00\x00" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF", +@@ -283,3 +283,72 @@ end: + free(padded_sentinel); + return result; + } ++ ++/* ++ * Decode and verify the OAEP padding in constant time. ++ * ++ * The function returns the number of bytes to ignore at the beginning ++ * of db (the rest is the plaintext), or -1 in case of problems. ++ */ ++ ++EXPORT_SYM int oaep_decode(const uint8_t *em, ++ size_t em_len, ++ const uint8_t *lHash, ++ size_t hLen, ++ const uint8_t *db, ++ size_t db_len) /* em_len - 1 - hLen */ ++{ ++ int result; ++ size_t one_pos, search_len, i; ++ uint8_t wrong_padding; ++ uint8_t *eq_mask = NULL; ++ uint8_t *neq_mask = NULL; ++ uint8_t *target_db = NULL; ++ ++ if (NULL == em || NULL == lHash || NULL == db) { ++ return -1; ++ } ++ ++ if (em_len < 2*hLen+2 || db_len != em_len-1-hLen) { ++ return -1; ++ } ++ ++ /* Allocate */ ++ eq_mask = (uint8_t*) calloc(1, db_len); ++ neq_mask = (uint8_t*) calloc(1, db_len); ++ target_db = (uint8_t*) calloc(1, db_len); ++ if (NULL == eq_mask || NULL == neq_mask || NULL == target_db) { ++ result = -1; ++ goto cleanup; ++ } ++ ++ /* Step 3g */ ++ search_len = db_len - hLen; ++ ++ one_pos = safe_search(db + hLen, 0x01, search_len); ++ if (SIZE_T_MAX == one_pos) { ++ result = -1; ++ goto cleanup; ++ } ++ ++ memset(eq_mask, 0xAA, db_len); ++ memcpy(target_db, lHash, hLen); ++ memset(eq_mask, 0xFF, hLen); ++ ++ for (i=0; i<search_len; i++) { ++ eq_mask[hLen + i] = propagate_ones(i < one_pos); ++ } ++ ++ wrong_padding = em[0]; ++ wrong_padding |= safe_cmp_masks(db, target_db, eq_mask, neq_mask, db_len); ++ set_if_match(&wrong_padding, one_pos, search_len); ++ ++ result = wrong_padding ? -1 : (int)(hLen + 1 + one_pos); ++ ++cleanup: ++ free(eq_mask); ++ free(neq_mask); ++ free(target_db); ++ ++ return result; ++} +diff --git a/src/test/test_pkcs1.c b/src/test/test_pkcs1.c +index 6ef63cb..69aaac5 100644 +--- a/src/test/test_pkcs1.c ++++ b/src/test/test_pkcs1.c +@@ -5,7 +5,7 @@ void set_if_match(uint8_t *flag, size_t term1, size_t term2); + void set_if_no_match(uint8_t *flag, size_t term1, size_t term2); + void safe_select(const uint8_t *in1, const uint8_t *in2, uint8_t *out, uint8_t choice, size_t len); + size_t safe_select_idx(size_t in1, size_t in2, uint8_t choice); +-uint8_t safe_cmp(const uint8_t *in1, const uint8_t *in2, ++uint8_t safe_cmp_masks(const uint8_t *in1, const uint8_t *in2, + const uint8_t *eq_mask, const uint8_t *neq_mask, + size_t len); + size_t safe_search(const uint8_t *in1, uint8_t c, size_t len); +@@ -80,29 +80,29 @@ void test_safe_select_idx() + assert(safe_select_idx(0x100004, 0x223344, 1) == 0x223344); + } + +-void test_safe_cmp() ++void test_safe_cmp_masks(void) + { + uint8_t res; + +- res = safe_cmp(onezero, onezero, ++ res = safe_cmp_masks(onezero, onezero, + (uint8_t*)"\xFF\xFF", + (uint8_t*)"\x00\x00", + 2); + assert(res == 0); + +- res = safe_cmp(onezero, zerozero, ++ res = safe_cmp_masks(onezero, zerozero, + (uint8_t*)"\xFF\xFF", + (uint8_t*)"\x00\x00", + 2); + assert(res != 0); + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\xFF\xFF", + (uint8_t*)"\x00\x00", + 2); + assert(res != 0); + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\xFF\x00", + (uint8_t*)"\x00\x00", + 2); +@@ -110,19 +110,19 @@ void test_safe_cmp() + + /** -- **/ + +- res = safe_cmp(onezero, onezero, ++ res = safe_cmp_masks(onezero, onezero, + (uint8_t*)"\x00\x00", + (uint8_t*)"\xFF\xFF", + 2); + assert(res != 0); + +- res = safe_cmp(oneone, zerozero, ++ res = safe_cmp_masks(oneone, zerozero, + (uint8_t*)"\x00\x00", + (uint8_t*)"\xFF\xFF", + 2); + assert(res == 0); + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\x00\x00", + (uint8_t*)"\x00\xFF", + 2); +@@ -130,7 +130,7 @@ void test_safe_cmp() + + /** -- **/ + +- res = safe_cmp(onezero, oneone, ++ res = safe_cmp_masks(onezero, oneone, + (uint8_t*)"\xFF\x00", + (uint8_t*)"\x00\xFF", + 2); +@@ -158,7 +158,7 @@ int main(void) + test_set_if_no_match(); + test_safe_select(); + test_safe_select_idx(); +- test_safe_cmp(); ++ test_safe_cmp_masks(); + test_safe_search(); + return 0; + } +-- +2.40.0 diff --git a/meta/recipes-devtools/python/python3-pycryptodomex_3.14.1.bb b/meta/recipes-devtools/python/python3-pycryptodomex_3.14.1.bb index 79a3fee19c..31ad3fda5e 100644 --- a/meta/recipes-devtools/python/python3-pycryptodomex_3.14.1.bb +++ b/meta/recipes-devtools/python/python3-pycryptodomex_3.14.1.bb @@ -3,6 +3,8 @@ inherit setuptools3 SRC_URI[sha256sum] = "2ce76ed0081fd6ac8c74edc75b9d14eca2064173af79843c24fa62573263c1f2" +SRC_URI += "file://CVE-2023-52323.patch" + FILES:${PN}-tests = " \ ${PYTHON_SITEPACKAGES_DIR}/Cryptodome/SelfTest/ \ ${PYTHON_SITEPACKAGES_DIR}/Cryptodome/SelfTest/__pycache__/ \ diff --git a/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896.patch b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896.patch new file mode 100644 index 0000000000..9848072a94 --- /dev/null +++ b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896.patch @@ -0,0 +1,124 @@ +From ed61747f328ff6aa343881b269600308ab8eac93 Mon Sep 17 00:00:00 2001 +From: Narpat Mali <narpat.mali@windriver.com> +Date: Wed, 6 Sep 2023 10:32:38 +0000 +Subject: [PATCH] Improve the Smithy metadata matcher. + +Previously, metadata foo bar baz = 23 was accepted, but according to +the definition https://smithy.io/2.0/spec/idl.html#grammar-token-smithy-MetadataSection +it should be "metadata"<whitespace>Identifier/String<optional whitespace>. + +CVE: CVE-2022-40896 + +Upstream-Status: Backport [https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + pygments/lexers/smithy.py | 5 +- + tests/examplefiles/smithy/test.smithy | 12 +++++ + tests/examplefiles/smithy/test.smithy.output | 52 ++++++++++++++++++++ + 3 files changed, 67 insertions(+), 2 deletions(-) + +diff --git a/pygments/lexers/smithy.py b/pygments/lexers/smithy.py +index 0f0a912..c5e25cd 100644 +--- a/pygments/lexers/smithy.py ++++ b/pygments/lexers/smithy.py +@@ -58,8 +58,9 @@ class SmithyLexer(RegexLexer): + (words(aggregate_shapes, + prefix=r'^', suffix=r'(\s+' + identifier + r')'), + bygroups(Keyword.Declaration, Name.Class)), +- (r'^(metadata)(\s+.+)(\s*)(=)', +- bygroups(Keyword.Declaration, Name.Class, Whitespace, Name.Decorator)), ++ (r'^(metadata)(\s+)((?:\S+)|(?:\"[^"]+\"))(\s*)(=)', ++ bygroups(Keyword.Declaration, Whitespace, Name.Class, ++ Whitespace, Name.Decorator)), + (r"(true|false|null)", Keyword.Constant), + (r"(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)", Number), + (identifier + ":", Name.Label), +diff --git a/tests/examplefiles/smithy/test.smithy b/tests/examplefiles/smithy/test.smithy +index 3d20f06..9317fee 100644 +--- a/tests/examplefiles/smithy/test.smithy ++++ b/tests/examplefiles/smithy/test.smithy +@@ -2,6 +2,18 @@ $version: "1.0" + + namespace test + ++metadata "foo" = ["bar", "baz"] ++metadata validators = [ ++ { ++ name: "ValidatorName" ++ id: "ValidatorId" ++ message: "Some string" ++ configuration: { ++ selector: "operation" ++ } ++ } ++] ++ + /// Define how an HTTP request is serialized given a specific protocol, + /// authentication scheme, and set of input parameters. + @trait(selector: "operation") +diff --git a/tests/examplefiles/smithy/test.smithy.output b/tests/examplefiles/smithy/test.smithy.output +index 1f22489..db44a38 100644 +--- a/tests/examplefiles/smithy/test.smithy.output ++++ b/tests/examplefiles/smithy/test.smithy.output +@@ -7,6 +7,58 @@ + ' test' Name.Class + '\n\n' Text.Whitespace + ++'metadata' Keyword.Declaration ++' ' Text.Whitespace ++'"foo"' Name.Class ++' ' Text.Whitespace ++'=' Name.Decorator ++' ' Text.Whitespace ++'[' Text ++'"bar"' Literal.String.Double ++',' Punctuation ++' ' Text.Whitespace ++'"baz"' Literal.String.Double ++']' Text ++'\n' Text.Whitespace ++ ++'metadata' Keyword.Declaration ++' ' Text.Whitespace ++'validators' Name.Class ++' ' Text.Whitespace ++'=' Name.Decorator ++' ' Text.Whitespace ++'[' Text ++'\n ' Text.Whitespace ++'{' Text ++'\n ' Text.Whitespace ++'name:' Name.Label ++' ' Text.Whitespace ++'"ValidatorName"' Literal.String.Double ++'\n ' Text.Whitespace ++'id:' Name.Label ++' ' Text.Whitespace ++'"ValidatorId"' Literal.String.Double ++'\n ' Text.Whitespace ++'message:' Name.Label ++' ' Text.Whitespace ++'"Some string"' Literal.String.Double ++'\n ' Text.Whitespace ++'configuration:' Name.Label ++' ' Text.Whitespace ++'{' Text ++'\n ' Text.Whitespace ++'selector:' Name.Label ++' ' Text.Whitespace ++'"operation"' Literal.String.Double ++'\n ' Text.Whitespace ++'}' Text ++'\n ' Text.Whitespace ++'}' Text ++'\n' Text.Whitespace ++ ++']' Text ++'\n\n' Text.Whitespace ++ + '/// Define how an HTTP request is serialized given a specific protocol,' Comment.Multiline + '\n' Text.Whitespace + +-- +2.40.0 diff --git a/meta/recipes-devtools/python/python3-pygments_2.11.2.bb b/meta/recipes-devtools/python/python3-pygments_2.11.2.bb index 35d288c89e..6e787f23d2 100644 --- a/meta/recipes-devtools/python/python3-pygments_2.11.2.bb +++ b/meta/recipes-devtools/python/python3-pygments_2.11.2.bb @@ -7,6 +7,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=98419e351433ac106a24e3ad435930bc" inherit setuptools3 SRC_URI[sha256sum] = "4e426f72023d88d03b2fa258de560726ce890ff3b630f88c21cbb8b2503b8c6a" +SRC_URI += "file://CVE-2022-40896.patch" + DEPENDS += "\ ${PYTHON_PN} \ " diff --git a/meta/recipes-devtools/python/python3-pytest_7.1.1.bb b/meta/recipes-devtools/python/python3-pytest_7.1.1.bb index 1cb2fb01c0..90a4787c17 100644 --- a/meta/recipes-devtools/python/python3-pytest_7.1.1.bb +++ b/meta/recipes-devtools/python/python3-pytest_7.1.1.bb @@ -26,7 +26,7 @@ RDEPENDS:${PN}:class-target += " \ ${PYTHON_PN}-py \ ${PYTHON_PN}-setuptools \ ${PYTHON_PN}-six \ - ${PYTHON_PN}-toml \ + ${PYTHON_PN}-tomli \ ${PYTHON_PN}-wcwidth \ " diff --git a/meta/recipes-devtools/python/python3-requests/CVE-2023-32681.patch b/meta/recipes-devtools/python/python3-requests/CVE-2023-32681.patch new file mode 100644 index 0000000000..35b4241bde --- /dev/null +++ b/meta/recipes-devtools/python/python3-requests/CVE-2023-32681.patch @@ -0,0 +1,63 @@ +From cd0128c0becd8729d0f8733bf42fbd333d51f833 Mon Sep 17 00:00:00 2001 +From: Nate Prewitt <nate.prewitt@gmail.com> +Date: Mon, 5 Jun 2023 09:31:36 +0000 +Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q + +CVE: CVE-2023-32681 + +Upstream-Status: Backport [https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + requests/sessions.py | 4 +++- + tests/test_requests.py | 20 ++++++++++++++++++++ + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/requests/sessions.py b/requests/sessions.py +index 3f59cab..648cffa 100644 +--- a/requests/sessions.py ++++ b/requests/sessions.py +@@ -293,7 +293,9 @@ class SessionRedirectMixin(object): + except KeyError: + username, password = None, None + +- if username and password: ++ # urllib3 handles proxy authorization for us in the standard adapter. ++ # Avoid appending this to TLS tunneled requests where it may be leaked. ++ if not scheme.startswith('https') and username and password: + headers['Proxy-Authorization'] = _basic_auth_str(username, password) + + return new_proxies +diff --git a/tests/test_requests.py b/tests/test_requests.py +index 29b3aca..6a37777 100644 +--- a/tests/test_requests.py ++++ b/tests/test_requests.py +@@ -601,6 +601,26 @@ class TestRequests: + + assert sent_headers.get("Proxy-Authorization") == proxy_auth_value + ++ ++ @pytest.mark.parametrize( ++ "url,has_proxy_auth", ++ ( ++ ('http://example.com', True), ++ ('https://example.com', False), ++ ), ++ ) ++ def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth): ++ session = requests.Session() ++ proxies = { ++ 'http': 'http://test:pass@localhost:8080', ++ 'https': 'http://test:pass@localhost:8090', ++ } ++ req = requests.Request('GET', url) ++ prep = req.prepare() ++ session.rebuild_proxies(prep, proxies) ++ ++ assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth ++ + def test_basicauth_with_netrc(self, httpbin): + auth = ('user', 'pass') + wrong_auth = ('wronguser', 'wrongpass') +-- +2.40.0 diff --git a/meta/recipes-devtools/python/python3-requests_2.27.1.bb b/meta/recipes-devtools/python/python3-requests_2.27.1.bb index af52b7caf5..635a6af31f 100644 --- a/meta/recipes-devtools/python/python3-requests_2.27.1.bb +++ b/meta/recipes-devtools/python/python3-requests_2.27.1.bb @@ -3,6 +3,8 @@ HOMEPAGE = "http://python-requests.org" LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://LICENSE;md5=34400b68072d710fecd0a2940a0d1658" +SRC_URI += "file://CVE-2023-32681.patch" + SRC_URI[sha256sum] = "68d7c56fd5a8999887728ef304a6d12edc7be74f1cfa47714fc8b414525c9a61" inherit pypi setuptools3 diff --git a/meta/recipes-devtools/python/python3-setuptools-rust-native_1.1.2.bb b/meta/recipes-devtools/python/python3-setuptools-rust-native_1.1.2.bb index 8ec9a86f00..c11116a1f4 100644 --- a/meta/recipes-devtools/python/python3-setuptools-rust-native_1.1.2.bb +++ b/meta/recipes-devtools/python/python3-setuptools-rust-native_1.1.2.bb @@ -14,9 +14,7 @@ SRC_URI[sha256sum] = "a0adb9b503c0ffc4e8fe80b7c617898cefa78049983aaaea7f747e153a inherit cargo pypi python_setuptools_build_meta native -DEPENDS += "python3-setuptools-scm-native python3-wheel-native" - -RDEPENDS:${PN}:class-native += " \ +DEPENDS += " \ python3-semantic-version-native \ python3-setuptools-native \ python3-setuptools-scm-native \ diff --git a/meta/recipes-devtools/python/python3-urllib3_1.26.9.bb b/meta/recipes-devtools/python/python3-urllib3_1.26.18.bb index 95ae4a54a4..d384b5eb2f 100644 --- a/meta/recipes-devtools/python/python3-urllib3_1.26.9.bb +++ b/meta/recipes-devtools/python/python3-urllib3_1.26.18.bb @@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/shazow/urllib3" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c2823cb995439c984fd62a973d79815c" -SRC_URI[sha256sum] = "aabaf16477806a5e1dd19aa41f8c2b7950dd3c746362d7e3223dbe6de6ac448e" +SRC_URI[sha256sum] = "f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0" inherit pypi setuptools3 @@ -15,6 +15,7 @@ RDEPENDS:${PN} += "\ ${PYTHON_PN}-netclient \ ${PYTHON_PN}-pyopenssl \ ${PYTHON_PN}-threading \ + ${PYTHON_PN}-logging \ " CVE_PRODUCT = "urllib3" diff --git a/meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch b/meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch new file mode 100644 index 0000000000..199031d42a --- /dev/null +++ b/meta/recipes-devtools/python/python3/0001-test_storlines-skip-due-to-load-variability.patch @@ -0,0 +1,32 @@ +From 013ff01fdf2aa6ca69a7c80a2a2996630877e4ea Mon Sep 17 00:00:00 2001 +From: Trevor Gamblin <tgamblin@baylibre.com> +Date: Fri, 6 Oct 2023 10:59:44 -0400 +Subject: [PATCH] test_storlines: skip due to load variability + +This is yet another test that intermittently fails on the Yocto AB when +a worker is under heavy load, so skip it during testing. + +Upstream-Status: Inappropriate [OE-Specific] + +[YOCTO #14933] + +Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> +--- + Lib/test/test_ftplib.py | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Lib/test/test_ftplib.py b/Lib/test/test_ftplib.py +index 082a90d46b..508814d56a 100644 +--- a/Lib/test/test_ftplib.py ++++ b/Lib/test/test_ftplib.py +@@ -629,6 +629,7 @@ def test_storbinary_rest(self): + self.client.storbinary('stor', f, rest=r) + self.assertEqual(self.server.handler_instance.rest, str(r)) + ++ @unittest.skip('timing related test, dependent on load') + def test_storlines(self): + data = RETR_DATA.replace('\r\n', '\n').encode(self.client.encoding) + f = io.BytesIO(data) +-- +2.41.0 + diff --git a/meta/recipes-devtools/python/python3/get_module_deps3.py b/meta/recipes-devtools/python/python3/get_module_deps3.py index 0ca687d2eb..8e432b49af 100644 --- a/meta/recipes-devtools/python/python3/get_module_deps3.py +++ b/meta/recipes-devtools/python/python3/get_module_deps3.py @@ -32,7 +32,7 @@ def fix_path(dep_path): dep_path = dep_path[dep_path.find(pivot)+len(pivot):] if '/usr/bin' in dep_path: - dep_path = dep_path.replace('/usr/bin''${bindir}') + dep_path = dep_path.replace('/usr/bin','${bindir}') # Handle multilib, is there a better way? if '/usr/lib32' in dep_path: diff --git a/meta/recipes-devtools/python/python3_3.10.9.bb b/meta/recipes-devtools/python/python3_3.10.13.bb index d6b7a618c1..76e37e42a1 100644 --- a/meta/recipes-devtools/python/python3_3.10.9.bb +++ b/meta/recipes-devtools/python/python3_3.10.13.bb @@ -4,7 +4,7 @@ DESCRIPTION = "Python is a programming language that lets you work more quickly LICENSE = "PSF-2.0" SECTION = "devel/python" -LIC_FILES_CHKSUM = "file://LICENSE;md5=a1822df8d0f068628ca6090aedc5bfc8" +LIC_FILES_CHKSUM = "file://LICENSE;md5=fcf6b249c2641540219a727f35d8d2c2" SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://run-ptest \ @@ -35,6 +35,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://0001-setup.py-Do-not-detect-multiarch-paths-when-cross-co.patch \ file://deterministic_imports.patch \ file://0001-Avoid-shebang-overflow-on-python-config.py.patch \ + file://0001-test_storlines-skip-due-to-load-variability.patch \ " SRC_URI:append:class-native = " \ @@ -43,7 +44,7 @@ SRC_URI:append:class-native = " \ file://12-distutils-prefix-is-inside-staging-area.patch \ file://0001-Don-t-search-system-for-headers-libraries.patch \ " -SRC_URI[sha256sum] = "5ae03e308260164baba39921fdb4dbf8e6d03d8235a939d4582b33f0b5e46a83" +SRC_URI[sha256sum] = "5c88848668640d3e152b35b4536ef1c23b2ca4bd2c957ef1ecbb053f571dd3f6" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar" @@ -60,6 +61,8 @@ CVE_CHECK_IGNORE += "CVE-2020-15523 CVE-2022-26488" # The mailcap module is insecure by design, so this can't be fixed in a meaningful way. # The module will be removed in the future and flaws documented. CVE_CHECK_IGNORE += "CVE-2015-20107" +# Not an issue, in fact expected behaviour +CVE_CHECK_IGNORE += "CVE-2023-36632" PYTHON_MAJMIN = "3.10" diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index b68be447f1..4747310ae4 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc @@ -35,8 +35,6 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://CVE-2021-4206.patch \ file://CVE-2021-4207.patch \ file://CVE-2022-35414.patch \ - file://CVE-2021-3507_1.patch \ - file://CVE-2021-3507_2.patch \ file://CVE-2021-3929.patch \ file://CVE-2021-4158.patch \ file://CVE-2022-0358.patch \ @@ -93,6 +91,24 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://0021-target-ppc-implement-xs-n-maddqp-o-xs-n-msubqp-o.patch \ file://CVE-2022-3165.patch \ file://CVE-2022-4144.patch \ + file://0001-hw-display-qxl-Have-qxl_log_command-Return-early-if-.patch \ + file://0001-hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch \ + file://CVE-2023-0330.patch \ + file://CVE-2023-3301.patch \ + file://CVE-2023-3255.patch \ + file://CVE-2023-2861.patch \ + file://CVE-2020-14394.patch \ + file://CVE-2023-3354.patch \ + file://CVE-2023-3180.patch \ + file://CVE-2021-3638.patch \ + file://CVE-2023-1544.patch \ + file://CVE-2023-5088.patch \ + file://CVE-2024-24474.patch \ + file://CVE-2023-6693.patch \ + file://scsi-disk-allow-MODE-SELECT-block-desriptor-to-set-the-block-size.patch \ + file://scsi-disk-ensure-block-size-is-non-zero-and-changes-limited-to-bits-8-15.patch \ + file://CVE-2023-42467.patch \ + file://CVE-2023-6683.patch \ " UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" @@ -112,6 +128,15 @@ CVE_CHECK_IGNORE += "CVE-2007-0998" # https://bugzilla.redhat.com/show_bug.cgi?id=1609015#c11 CVE_CHECK_IGNORE += "CVE-2018-18438" +# As per https://nvd.nist.gov/vuln/detail/CVE-2023-0664 +# https://bugzilla.redhat.com/show_bug.cgi?id=2167423 +# this bug related to windows specific. +CVE_CHECK_IGNORE += "CVE-2023-0664" + +# As per https://bugzilla.redhat.com/show_bug.cgi?id=2203387 +# RHEL specific issue +CVE_CHECK_IGNORE += "CVE-2023-2680" + COMPATIBLE_HOST:mipsarchn32 = "null" COMPATIBLE_HOST:mipsarchn64 = "null" COMPATIBLE_HOST:riscv32 = "null" diff --git a/meta/recipes-devtools/qemu/qemu/0001-hw-display-qxl-Have-qxl_log_command-Return-early-if-.patch b/meta/recipes-devtools/qemu/qemu/0001-hw-display-qxl-Have-qxl_log_command-Return-early-if-.patch new file mode 100644 index 0000000000..cd846222c9 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0001-hw-display-qxl-Have-qxl_log_command-Return-early-if-.patch @@ -0,0 +1,57 @@ +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/61c34fc] + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From 61c34fc194b776ecadc39fb26b061331107e5599 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org> +Date: Mon, 28 Nov 2022 21:27:37 +0100 +Subject: [PATCH] hw/display/qxl: Have qxl_log_command Return early if no + log_cmd handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Only 3 command types are logged: no need to call qxl_phys2virt() +for the other types. Using different cases will help to pass +different structure sizes to qxl_phys2virt() in a pair of commits. + +Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> +Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> +Message-Id: <20221128202741.4945-2-philmd@linaro.org> +--- + hw/display/qxl-logger.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c +index 68bfa47568..1bcf803db6 100644 +--- a/hw/display/qxl-logger.c ++++ b/hw/display/qxl-logger.c +@@ -247,6 +247,16 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) + qxl_name(qxl_type, ext->cmd.type), + compat ? "(compat)" : ""); + ++ switch (ext->cmd.type) { ++ case QXL_CMD_DRAW: ++ break; ++ case QXL_CMD_SURFACE: ++ break; ++ case QXL_CMD_CURSOR: ++ break; ++ default: ++ goto out; ++ } + data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + if (!data) { + return 1; +@@ -269,6 +279,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) + qxl_log_cmd_cursor(qxl, data, ext->group_id); + break; + } ++out: + fprintf(stderr, "\n"); + return 0; + } +-- +2.34.1 + diff --git a/meta/recipes-devtools/qemu/qemu/0001-hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch b/meta/recipes-devtools/qemu/qemu/0001-hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch new file mode 100644 index 0000000000..ac51cf567a --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0001-hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch @@ -0,0 +1,217 @@ +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/8efec0e] + +Backport and rebase patch to fix compile error which imported by CVE-2022-4144.patch: + +../qemu-6.2.0/hw/display/qxl.c: In function 'qxl_phys2virt': +../qemu-6.2.0/hw/display/qxl.c:1477:67: error: 'size' undeclared (first use in this function); did you mean 'gsize'? + 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) { + | ^~~~ + | gsize +../qemu-6.2.0/hw/display/qxl.c:1477:67: note: each undeclared identifier is reported only once for each function it appears in + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From 8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org> +Date: Mon, 28 Nov 2022 21:27:39 +0100 +Subject: [PATCH] hw/display/qxl: Pass requested buffer size to qxl_phys2virt() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Currently qxl_phys2virt() doesn't check for buffer overrun. +In order to do so in the next commit, pass the buffer size +as argument. + +For QXLCursor in qxl_render_cursor() -> qxl_cursor() we +verify the size of the chunked data ahead, checking we can +access 'sizeof(QXLCursor) + chunk->data_size' bytes. +Since in the SPICE_CURSOR_TYPE_MONO case the cursor is +assumed to fit in one chunk, no change are required. +In SPICE_CURSOR_TYPE_ALPHA the ahead read is handled in +qxl_unpack_chunks(). + +Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> +Acked-by: Gerd Hoffmann <kraxel@redhat.com> +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> +Message-Id: <20221128202741.4945-4-philmd@linaro.org> +--- + hw/display/qxl-logger.c | 11 ++++++++--- + hw/display/qxl-render.c | 20 ++++++++++++++++---- + hw/display/qxl.c | 14 +++++++++----- + hw/display/qxl.h | 3 ++- + 4 files changed, 35 insertions(+), 13 deletions(-) + +diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c +index 1bcf803..35c38f6 100644 +--- a/hw/display/qxl-logger.c ++++ b/hw/display/qxl-logger.c +@@ -106,7 +106,7 @@ static int qxl_log_image(PCIQXLDevice *qxl, QXLPHYSICAL addr, int group_id) + QXLImage *image; + QXLImageDescriptor *desc; + +- image = qxl_phys2virt(qxl, addr, group_id); ++ image = qxl_phys2virt(qxl, addr, group_id, sizeof(QXLImage)); + if (!image) { + return 1; + } +@@ -214,7 +214,8 @@ int qxl_log_cmd_cursor(PCIQXLDevice *qxl, QXLCursorCmd *cmd, int group_id) + cmd->u.set.position.y, + cmd->u.set.visible ? "yes" : "no", + cmd->u.set.shape); +- cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id); ++ cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id, ++ sizeof(QXLCursor)); + if (!cursor) { + return 1; + } +@@ -236,6 +237,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) + { + bool compat = ext->flags & QXL_COMMAND_FLAG_COMPAT; + void *data; ++ size_t datasz; + int ret; + + if (!qxl->cmdlog) { +@@ -249,15 +251,18 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) + + switch (ext->cmd.type) { + case QXL_CMD_DRAW: ++ datasz = compat ? sizeof(QXLCompatDrawable) : sizeof(QXLDrawable); + break; + case QXL_CMD_SURFACE: ++ datasz = sizeof(QXLSurfaceCmd); + break; + case QXL_CMD_CURSOR: ++ datasz = sizeof(QXLCursorCmd); + break; + default: + goto out; + } +- data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, datasz); + if (!data) { + return 1; + } +diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c +index ca21700..fcfd40c 100644 +--- a/hw/display/qxl-render.c ++++ b/hw/display/qxl-render.c +@@ -107,7 +107,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) + qxl->guest_primary.resized = 0; + qxl->guest_primary.data = qxl_phys2virt(qxl, + qxl->guest_primary.surface.mem, +- MEMSLOT_GROUP_GUEST); ++ MEMSLOT_GROUP_GUEST, ++ qxl->guest_primary.abs_stride ++ * height); + if (!qxl->guest_primary.data) { + goto end; + } +@@ -228,7 +230,8 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, + if (offset == size) { + return; + } +- chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id); ++ chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id, ++ sizeof(QXLDataChunk) + chunk->data_size); + if (!chunk) { + return; + } +@@ -295,7 +298,8 @@ fail: + /* called from spice server thread context only */ + int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) + { +- QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, ++ sizeof(QXLCursorCmd)); + QXLCursor *cursor; + QEMUCursor *c; + +@@ -314,7 +318,15 @@ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) + } + switch (cmd->type) { + case QXL_CURSOR_SET: +- cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id); ++ /* First read the QXLCursor to get QXLDataChunk::data_size ... */ ++ cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, ++ sizeof(QXLCursor)); ++ if (!cursor) { ++ return 1; ++ } ++ /* Then read including the chunked data following QXLCursor. */ ++ cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, ++ sizeof(QXLCursor) + cursor->chunk.data_size); + if (!cursor) { + return 1; + } +diff --git a/hw/display/qxl.c b/hw/display/qxl.c +index ae8aa07..2a4b2d4 100644 +--- a/hw/display/qxl.c ++++ b/hw/display/qxl.c +@@ -274,7 +274,8 @@ static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay) + QXL_IO_MONITORS_CONFIG_ASYNC)); + } + +- cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST); ++ cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST, ++ sizeof(QXLMonitorsConfig)); + if (cfg != NULL && cfg->count == 1) { + qxl->guest_primary.resized = 1; + qxl->guest_head0_width = cfg->heads[0].width; +@@ -459,7 +460,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) + switch (le32_to_cpu(ext->cmd.type)) { + case QXL_CMD_SURFACE: + { +- QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, ++ sizeof(QXLSurfaceCmd)); + + if (!cmd) { + return 1; +@@ -494,7 +496,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) + } + case QXL_CMD_CURSOR: + { +- QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, ++ sizeof(QXLCursorCmd)); + + if (!cmd) { + return 1; +@@ -1463,7 +1466,8 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, + } + + /* can be also called from spice server thread context */ +-void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) ++void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, ++ size_t size) + { + uint64_t offset; + uint32_t slot; +@@ -1971,7 +1975,7 @@ static void qxl_dirty_surfaces(PCIQXLDevice *qxl) + } + + cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i], +- MEMSLOT_GROUP_GUEST); ++ MEMSLOT_GROUP_GUEST, sizeof(QXLSurfaceCmd)); + assert(cmd); + assert(cmd->type == QXL_SURFACE_CMD_CREATE); + qxl_dirty_one_surface(qxl, cmd->u.surface_create.data, +diff --git a/hw/display/qxl.h b/hw/display/qxl.h +index 30d21f4..4551c23 100644 +--- a/hw/display/qxl.h ++++ b/hw/display/qxl.h +@@ -147,7 +147,8 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) + #define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1) + + /* qxl.c */ +-void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); ++void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id, ++ size_t size); + void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) + GCC_FMT_ATTR(2, 3); + +-- +2.34.1 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-14394.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-14394.patch new file mode 100644 index 0000000000..aff91a7355 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-14394.patch @@ -0,0 +1,79 @@ +From effaf5a240e03020f4ae953e10b764622c3e87cc Mon Sep 17 00:00:00 2001 +From: Thomas Huth <thuth@redhat.com> +Date: Tue, 8 Aug 2023 10:44:51 +0000 +Subject: [PATCH] hw/usb/hcd-xhci: Fix unbounded loop in + xhci_ring_chain_length() (CVE-2020-14394) + +The loop condition in xhci_ring_chain_length() is under control of +the guest, and additionally the code does not check for failed DMA +transfers (e.g. if reaching the end of the RAM), so the loop there +could run for a very long time or even forever. Fix it by checking +the return value of dma_memory_read() and by introducing a maximum +loop length. + +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/646 +Message-Id: <20220804131300.96368-1-thuth@redhat.com> +Reviewed-by: Mauro Matteo Cascella <mcascell@redhat.com> +Acked-by: Gerd Hoffmann <kraxel@redhat.com> +Signed-off-by: Thomas Huth <thuth@redhat.com> + +CVE: CVE-2020-14394 + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/effaf5a240e03020f4ae953e10b764622c3e87cc] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + hw/usb/hcd-xhci.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c +index 14bdb8967..c63a36dcc 100644 +--- a/hw/usb/hcd-xhci.c ++++ b/hw/usb/hcd-xhci.c +@@ -21,6 +21,7 @@ + + #include "qemu/osdep.h" + #include "qemu/timer.h" ++#include "qemu/log.h" + #include "qemu/module.h" + #include "qemu/queue.h" + #include "migration/vmstate.h" +@@ -725,10 +726,14 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring) + bool control_td_set = 0; + uint32_t link_cnt = 0; + +- while (1) { ++ do { + TRBType type; +- dma_memory_read(xhci->as, dequeue, &trb, TRB_SIZE, +- MEMTXATTRS_UNSPECIFIED); ++ if (dma_memory_read(xhci->as, dequeue, &trb, TRB_SIZE, ++ MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) { ++ qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n", ++ __func__); ++ return -1; ++ } + le64_to_cpus(&trb.parameter); + le32_to_cpus(&trb.status); + le32_to_cpus(&trb.control); +@@ -762,7 +767,17 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring) + if (!control_td_set && !(trb.control & TRB_TR_CH)) { + return length; + } +- } ++ ++ /* ++ * According to the xHCI spec, Transfer Ring segments should have ++ * a maximum size of 64 kB (see chapter "6 Data Structures") ++ */ ++ } while (length < TRB_LINK_LIMIT * 65536 / TRB_SIZE); ++ ++ qemu_log_mask(LOG_GUEST_ERROR, "%s: exceeded maximum tranfer ring size!\n", ++ __func__); ++ ++ return -1; + } + + static void xhci_er_reset(XHCIState *xhci, int v) +-- +2.35.5 diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_1.patch deleted file mode 100644 index 4201610f4d..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_1.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 963ac2cd5186b28fbfdecd15ac43afe1dbaf871a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com> -Date: Thu, 18 Nov 2021 12:57:32 +0100 -Subject: [PATCH 1/2] hw/block/fdc: Prevent end-of-track overrun - (CVE-2021-3507) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Per the 82078 datasheet, if the end-of-track (EOT byte in -the FIFO) is more than the number of sectors per side, the -command is terminated unsuccessfully: - -* 5.2.5 DATA TRANSFER TERMINATION - - The 82078 supports terminal count explicitly through - the TC pin and implicitly through the underrun/over- - run and end-of-track (EOT) functions. For full sector - transfers, the EOT parameter can define the last - sector to be transferred in a single or multisector - transfer. If the last sector to be transferred is a par- - tial sector, the host can stop transferring the data in - mid-sector, and the 82078 will continue to complete - the sector as if a hardware TC was received. The - only difference between these implicit functions and - TC is that they return "abnormal termination" result - status. Such status indications can be ignored if they - were expected. - -* 6.1.3 READ TRACK - - This command terminates when the EOT specified - number of sectors have been read. If the 82078 - does not find an I D Address Mark on the diskette - after the second· occurrence of a pulse on the - INDX# pin, then it sets the IC code in Status Regis- - ter 0 to "01" (Abnormal termination), sets the MA bit - in Status Register 1 to "1", and terminates the com- - mand. - -* 6.1.6 VERIFY - - Refer to Table 6-6 and Table 6-7 for information - concerning the values of MT and EC versus SC and - EOT value. - -* Table 6·6. Result Phase Table - -* Table 6-7. Verify Command Result Phase Table - -Fix by aborting the transfer when EOT > # Sectors Per Side. - -Cc: qemu-stable@nongnu.org -Cc: Hervé Poussineau <hpoussin@reactos.org> -Fixes: baca51faff0 ("floppy driver: disk geometry auto detect") -Reported-by: Alexander Bulekov <alxndr@bu.edu> -Resolves: https://gitlab.com/qemu-project/qemu/-/issues/339 -Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> -Message-Id: <20211118115733.4038610-2-philmd@redhat.com> -Reviewed-by: Hanna Reitz <hreitz@redhat.com> -Signed-off-by: Kevin Wolf <kwolf@redhat.com> - -Upstream-Status: Backport [defac5e2fbddf8423a354ff0454283a2115e1367] -CVE: CVE-2021-3507 - -Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> ---- - hw/block/fdc.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/hw/block/fdc.c b/hw/block/fdc.c -index 21d18ac2e..24b05406e 100644 ---- a/hw/block/fdc.c -+++ b/hw/block/fdc.c -@@ -1529,6 +1529,14 @@ static void fdctrl_start_transfer(FDCtrl *fdctrl, int direction) - int tmp; - fdctrl->data_len = 128 << (fdctrl->fifo[5] > 7 ? 7 : fdctrl->fifo[5]); - tmp = (fdctrl->fifo[6] - ks + 1); -+ if (tmp < 0) { -+ FLOPPY_DPRINTF("invalid EOT: %d\n", tmp); -+ fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, FD_SR1_MA, 0x00); -+ fdctrl->fifo[3] = kt; -+ fdctrl->fifo[4] = kh; -+ fdctrl->fifo[5] = ks; -+ return; -+ } - if (fdctrl->fifo[0] & 0x80) - tmp += fdctrl->fifo[6]; - fdctrl->data_len *= tmp; --- -2.33.0 - diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch deleted file mode 100644 index 9f00d9c0d0..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch +++ /dev/null @@ -1,115 +0,0 @@ -From ec5725982f811d9728ad1f9940df0e9349397e67 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com> -Date: Thu, 18 Nov 2021 12:57:33 +0100 -Subject: [PATCH 2/2] tests/qtest/fdc-test: Add a regression test for - CVE-2021-3507 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Add the reproducer from https://gitlab.com/qemu-project/qemu/-/issues/339 - -Without the previous commit, when running 'make check-qtest-i386' -with QEMU configured with '--enable-sanitizers' we get: - - ==4028352==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000062a00 at pc 0x5626d03c491a bp 0x7ffdb4199410 sp 0x7ffdb4198bc0 - READ of size 786432 at 0x619000062a00 thread T0 - #0 0x5626d03c4919 in __asan_memcpy (qemu-system-i386+0x1e65919) - #1 0x5626d1c023cc in flatview_write_continue softmmu/physmem.c:2787:13 - #2 0x5626d1bf0c0f in flatview_write softmmu/physmem.c:2822:14 - #3 0x5626d1bf0798 in address_space_write softmmu/physmem.c:2914:18 - #4 0x5626d1bf0f37 in address_space_rw softmmu/physmem.c:2924:16 - #5 0x5626d1bf14c8 in cpu_physical_memory_rw softmmu/physmem.c:2933:5 - #6 0x5626d0bd5649 in cpu_physical_memory_write include/exec/cpu-common.h:82:5 - #7 0x5626d0bd0a07 in i8257_dma_write_memory hw/dma/i8257.c:452:9 - #8 0x5626d09f825d in fdctrl_transfer_handler hw/block/fdc.c:1616:13 - #9 0x5626d0a048b4 in fdctrl_start_transfer hw/block/fdc.c:1539:13 - #10 0x5626d09f4c3e in fdctrl_write_data hw/block/fdc.c:2266:13 - #11 0x5626d09f22f7 in fdctrl_write hw/block/fdc.c:829:9 - #12 0x5626d1c20bc5 in portio_write softmmu/ioport.c:207:17 - - 0x619000062a00 is located 0 bytes to the right of 512-byte region [0x619000062800,0x619000062a00) - allocated by thread T0 here: - #0 0x5626d03c66ec in posix_memalign (qemu-system-i386+0x1e676ec) - #1 0x5626d2b988d4 in qemu_try_memalign util/oslib-posix.c:210:11 - #2 0x5626d2b98b0c in qemu_memalign util/oslib-posix.c:226:27 - #3 0x5626d09fbaf0 in fdctrl_realize_common hw/block/fdc.c:2341:20 - #4 0x5626d0a150ed in isabus_fdc_realize hw/block/fdc-isa.c:113:5 - #5 0x5626d2367935 in device_set_realized hw/core/qdev.c:531:13 - - SUMMARY: AddressSanitizer: heap-buffer-overflow (qemu-system-i386+0x1e65919) in __asan_memcpy - Shadow bytes around the buggy address: - 0x0c32800044f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa - 0x0c3280004500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - 0x0c3280004510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - 0x0c3280004520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - 0x0c3280004530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - =>0x0c3280004540:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa - 0x0c3280004550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa - 0x0c3280004560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa - 0x0c3280004570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa - 0x0c3280004580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa - 0x0c3280004590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd - Shadow byte legend (one shadow byte represents 8 application bytes): - Addressable: 00 - Heap left redzone: fa - Freed heap region: fd - ==4028352==ABORTING - -[ kwolf: Added snapshot=on to prevent write file lock failure ] - -Reported-by: Alexander Bulekov <alxndr@bu.edu> -Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> -Reviewed-by: Alexander Bulekov <alxndr@bu.edu> -Signed-off-by: Kevin Wolf <kwolf@redhat.com> - -Upstream-Status: Backport [46609b90d9e3a6304def11038a76b58ff43f77bc] -CVE: CVE-2021-3507 - -Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> ---- - tests/qtest/fdc-test.c | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/tests/qtest/fdc-test.c b/tests/qtest/fdc-test.c -index 8f6eee84a..6f5850354 100644 ---- a/tests/qtest/fdc-test.c -+++ b/tests/qtest/fdc-test.c -@@ -583,6 +583,26 @@ static void test_cve_2021_20196(void) - qtest_quit(s); - } - -+static void test_cve_2021_3507(void) -+{ -+ QTestState *s; -+ -+ s = qtest_initf("-nographic -m 32M -nodefaults " -+ "-drive file=%s,format=raw,if=floppy,snapshot=on", -+ test_image); -+ qtest_outl(s, 0x9, 0x0a0206); -+ qtest_outw(s, 0x3f4, 0x1600); -+ qtest_outw(s, 0x3f4, 0x0000); -+ qtest_outw(s, 0x3f4, 0x0000); -+ qtest_outw(s, 0x3f4, 0x0000); -+ qtest_outw(s, 0x3f4, 0x0200); -+ qtest_outw(s, 0x3f4, 0x0200); -+ qtest_outw(s, 0x3f4, 0x0000); -+ qtest_outw(s, 0x3f4, 0x0000); -+ qtest_outw(s, 0x3f4, 0x0000); -+ qtest_quit(s); -+} -+ - int main(int argc, char **argv) - { - int fd; -@@ -614,6 +634,7 @@ int main(int argc, char **argv) - qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19); - qtest_add_func("/fdc/fuzz-registers", fuzz_registers); - qtest_add_func("/fdc/fuzz/cve_2021_20196", test_cve_2021_20196); -+ qtest_add_func("/fdc/fuzz/cve_2021_3507", test_cve_2021_3507); - - ret = g_test_run(); - --- -2.33.0 - diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3638.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3638.patch new file mode 100644 index 0000000000..3cbb34c54c --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3638.patch @@ -0,0 +1,88 @@ +From 205ccfd7a5ec86bd9a5678b8bd157562fc9a1643 Mon Sep 17 00:00:00 2001 +From: Philippe Mathieu-Daudé <philmd@redhat.com> +Date: Thu, 10 Aug 2023 07:30:54 +0000 +Subject: [PATCH] hw/display/ati_2d: Fix buffer overflow in ati_2d_blt + (CVE-2021-3638) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 + Content-Transfer-Encoding: 8bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When building QEMU with DEBUG_ATI defined then running with +'-device ati-vga,romfile="" -d unimp,guest_errors -trace ati\*' +we get: + + ati_mm_write 4 0x16c0 DP_CNTL <- 0x1 + ati_mm_write 4 0x146c DP_GUI_MASTER_CNTL <- 0x2 + ati_mm_write 4 0x16c8 DP_MIX <- 0xff0000 + ati_mm_write 4 0x16c4 DP_DATATYPE <- 0x2 + ati_mm_write 4 0x224 CRTC_OFFSET <- 0x0 + ati_mm_write 4 0x142c DST_PITCH_OFFSET <- 0xfe00000 + ati_mm_write 4 0x1420 DST_Y <- 0x3fff + ati_mm_write 4 0x1410 DST_HEIGHT <- 0x3fff + ati_mm_write 4 0x1588 DST_WIDTH_X <- 0x3fff3fff + ati_2d_blt: vram:0x7fff5fa00000 addr:0 ds:0x7fff61273800 stride:2560 bpp:32 rop:0xff + ati_2d_blt: 0 0 0, 0 127 0, (0,0) -> (16383,16383) 16383x16383 > ^ + ati_2d_blt: pixman_fill(dst:0x7fff5fa00000, stride:254, bpp:8, x:16383, y:16383, w:16383, h:16383, xor:0xff000000) + Thread 3 "qemu-system-i38" received signal SIGSEGV, Segmentation fault. + (gdb) bt + #0 0x00007ffff7f62ce0 in sse2_fill.lto_priv () at /lib64/libpixman-1.so.0 + #1 0x00007ffff7f09278 in pixman_fill () at /lib64/libpixman-1.so.0 + #2 0x0000555557b5a9af in ati_2d_blt (s=0x631000028800) at hw/display/ati_2d.c:196 + #3 0x0000555557b4b5a2 in ati_mm_write (opaque=0x631000028800, addr=5512, data=1073692671, size=4) at hw/display/ati.c:843 + #4 0x0000555558b90ec4 in memory_region_write_accessor (mr=0x631000039cc0, addr=5512, ..., size=4, ...) at softmmu/memory.c:492 + +Commit 584acf34cb0 ("ati-vga: Fix reverse bit blts") introduced +the local dst_x and dst_y which adjust the (x, y) coordinates +depending on the direction in the SRCCOPY ROP3 operation, but +forgot to address the same issue for the PATCOPY, BLACKNESS and +WHITENESS operations, which also call pixman_fill(). + +Fix that now by using the adjusted coordinates in the pixman_fill +call, and update the related debug printf(). + +Reported-by: Qiang Liu <qiangliu@zju.edu.cn> +Fixes: 584acf34cb0 ("ati-vga: Fix reverse bit blts") +Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> +Tested-by: Mauro Matteo Cascella <mcascell@redhat.com> +Message-Id: <20210906153103.1661195-1-philmd@redhat.com> +Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> + +CVE: CVE-2021-3638 + +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/205ccfd7a5ec86bd9a5678b8bd157562fc9a1643] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + hw/display/ati_2d.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c +index 4dc10ea79..692bec91d 100644 +--- a/hw/display/ati_2d.c ++++ b/hw/display/ati_2d.c +@@ -84,7 +84,7 @@ void ati_2d_blt(ATIVGAState *s) + DPRINTF("%d %d %d, %d %d %d, (%d,%d) -> (%d,%d) %dx%d %c %c\n", + s->regs.src_offset, s->regs.dst_offset, s->regs.default_offset, + s->regs.src_pitch, s->regs.dst_pitch, s->regs.default_pitch, +- s->regs.src_x, s->regs.src_y, s->regs.dst_x, s->regs.dst_y, ++ s->regs.src_x, s->regs.src_y, dst_x, dst_y, + s->regs.dst_width, s->regs.dst_height, + (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ? '>' : '<'), + (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ? 'v' : '^')); +@@ -180,11 +180,11 @@ void ati_2d_blt(ATIVGAState *s) + dst_stride /= sizeof(uint32_t); + DPRINTF("pixman_fill(%p, %d, %d, %d, %d, %d, %d, %x)\n", + dst_bits, dst_stride, bpp, +- s->regs.dst_x, s->regs.dst_y, ++ dst_x, dst_y, + s->regs.dst_width, s->regs.dst_height, + filler); + pixman_fill((uint32_t *)dst_bits, dst_stride, bpp, +- s->regs.dst_x, s->regs.dst_y, ++ dst_x, dst_y, + s->regs.dst_width, s->regs.dst_height, + filler); + if (dst_bits >= s->vga.vram_ptr + s->vga.vbe_start_addr && +-- +2.40.0 diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch new file mode 100644 index 0000000000..025075fd6d --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch @@ -0,0 +1,75 @@ +[Ubuntu note: remove fuzz-lsi53c895a-test.c changes since the file does not + exist for this release] +From b987718bbb1d0eabf95499b976212dd5f0120d75 Mon Sep 17 00:00:00 2001 +From: Thomas Huth <thuth@redhat.com> +Date: Mon, 22 May 2023 11:10:11 +0200 +Subject: [PATCH] hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI + controller (CVE-2023-0330) + +We cannot use the generic reentrancy guard in the LSI code, so +we have to manually prevent endless reentrancy here. The problematic +lsi_execute_script() function has already a way to detect whether +too many instructions have been executed - we just have to slightly +change the logic here that it also takes into account if the function +has been called too often in a reentrant way. + +The code in fuzz-lsi53c895a-test.c has been taken from an earlier +patch by Mauro Matteo Cascella. + +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1563 +Message-Id: <20230522091011.1082574-1-thuth@redhat.com> +Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> +Reviewed-by: Alexander Bulekov <alxndr@bu.edu> +Signed-off-by: Thomas Huth <thuth@redhat.com> + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/qemu/tree/debian/patches/CVE-2023-0330.patch?h=ubuntu/jammy-security +Upstream commit https://gitlab.com/qemu-project/qemu/-/commit/b987718bbb1d0eabf95499b976212dd5f0120d75] +CVE: CVE-2023-0330 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + hw/scsi/lsi53c895a.c | 23 +++++++++++++++------ + tests/qtest/fuzz-lsi53c895a-test.c | 33 ++++++++++++++++++++++++++++++ + 2 files changed, 50 insertions(+), 6 deletions(-) + +--- qemu-6.2+dfsg.orig/hw/scsi/lsi53c895a.c ++++ qemu-6.2+dfsg/hw/scsi/lsi53c895a.c +@@ -1135,15 +1135,24 @@ static void lsi_execute_script(LSIState + uint32_t addr, addr_high; + int opcode; + int insn_processed = 0; ++ static int reentrancy_level; ++ ++ reentrancy_level++; + + s->istat1 |= LSI_ISTAT1_SRUN; + again: +- if (++insn_processed > LSI_MAX_INSN) { +- /* Some windows drivers make the device spin waiting for a memory +- location to change. If we have been executed a lot of code then +- assume this is the case and force an unexpected device disconnect. +- This is apparently sufficient to beat the drivers into submission. +- */ ++ /* ++ * Some windows drivers make the device spin waiting for a memory location ++ * to change. If we have executed more than LSI_MAX_INSN instructions then ++ * assume this is the case and force an unexpected device disconnect. This ++ * is apparently sufficient to beat the drivers into submission. ++ * ++ * Another issue (CVE-2023-0330) can occur if the script is programmed to ++ * trigger itself again and again. Avoid this problem by stopping after ++ * being called multiple times in a reentrant way (8 is an arbitrary value ++ * which should be enough for all valid use cases). ++ */ ++ if (++insn_processed > LSI_MAX_INSN || reentrancy_level > 8) { + if (!(s->sien0 & LSI_SIST0_UDC)) { + qemu_log_mask(LOG_GUEST_ERROR, + "lsi_scsi: inf. loop with UDC masked"); +@@ -1597,6 +1606,8 @@ again: + } + } + trace_lsi_execute_script_stop(); ++ ++ reentrancy_level--; + } + + static uint8_t lsi_reg_readb(LSIState *s, int offset) diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch new file mode 100644 index 0000000000..b4781e1c18 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch @@ -0,0 +1,70 @@ +From e7d6e37675e422cfab2fe8c6bd411d2097228760 Mon Sep 17 00:00:00 2001 +From: Yuval Shaia <yuval.shaia.ml@gmail.com> +Date: Wed, 1 Mar 2023 16:29:26 +0200 +Subject: [PATCH] hw/pvrdma: Protect against buggy or malicious guest driver + +Guest driver allocates and initialize page tables to be used as a ring +of descriptors for CQ and async events. +The page table that represents the ring, along with the number of pages +in the page table is passed to the device. +Currently our device supports only one page table for a ring. + +Let's make sure that the number of page table entries the driver +reports, do not exceeds the one page table size. + +CVE: CVE-2023-1544 +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/85fc35afa93c] + +Reported-by: Soul Chen <soulchen8650@gmail.com> +Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com> +Fixes: CVE-2023-1544 +Message-ID: <20230301142926.18686-1-yuval.shaia.ml@gmail.com> +Signed-off-by: Thomas Huth <thuth@redhat.com> +(cherry picked from commit 85fc35afa93c7320d1641d344d0c5dfbe341d087) +Signed-off-by: Niranjan Pradhan <nirpradh@cisco.com> +--- + hw/rdma/vmw/pvrdma_main.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c +index 4fc6712025..55b338046e 100644 +--- a/hw/rdma/vmw/pvrdma_main.c ++++ b/hw/rdma/vmw/pvrdma_main.c +@@ -91,19 +91,33 @@ static int init_dev_ring(PvrdmaRing *ring, PvrdmaRingState **ring_state, + dma_addr_t dir_addr, uint32_t num_pages) + { + uint64_t *dir, *tbl; +- int rc = 0; ++ int max_pages, rc = 0; + + if (!num_pages) { + rdma_error_report("Ring pages count must be strictly positive"); + return -EINVAL; + } + ++ /* ++ * Make sure we can satisfy the requested number of pages in a single ++ * TARGET_PAGE_SIZE sized page table (taking into account that first entry ++ * is reserved for ring-state) ++ */ ++ max_pages = TARGET_PAGE_SIZE / sizeof(dma_addr_t) - 1; ++ if (num_pages > max_pages) { ++ rdma_error_report("Maximum pages on a single directory must not exceed %d\n", ++ max_pages); ++ return -EINVAL; ++ } ++ + dir = rdma_pci_dma_map(pci_dev, dir_addr, TARGET_PAGE_SIZE); + if (!dir) { + rdma_error_report("Failed to map to page directory (ring %s)", name); + rc = -ENOMEM; + goto out; + } ++ ++ /* We support only one page table for a ring */ + tbl = rdma_pci_dma_map(pci_dev, dir[0], TARGET_PAGE_SIZE); + if (!tbl) { + rdma_error_report("Failed to map to page table (ring %s)", name); +-- +2.35.6 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-2861.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-2861.patch new file mode 100644 index 0000000000..a86413fbad --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-2861.patch @@ -0,0 +1,180 @@ +From f6b0de53fb87ddefed348a39284c8e2f28dc4eda Mon Sep 17 00:00:00 2001 +From: Christian Schoenebeck <qemu_oss@crudebyte.com> +Date: Wed, 7 Jun 2023 18:29:33 +0200 +Subject: [PATCH] 9pfs: prevent opening special files (CVE-2023-2861) + +The 9p protocol does not specifically define how server shall behave when +client tries to open a special file, however from security POV it does +make sense for 9p server to prohibit opening any special file on host side +in general. A sane Linux 9p client for instance would never attempt to +open a special file on host side, it would always handle those exclusively +on its guest side. A malicious client however could potentially escape +from the exported 9p tree by creating and opening a device file on host +side. + +With QEMU this could only be exploited in the following unsafe setups: + + - Running QEMU binary as root AND 9p 'local' fs driver AND 'passthrough' + security model. + +or + + - Using 9p 'proxy' fs driver (which is running its helper daemon as + root). + +These setups were already discouraged for safety reasons before, +however for obvious reasons we are now tightening behaviour on this. + +Fixes: CVE-2023-2861 +Reported-by: Yanwu Shen <ywsPlz@gmail.com> +Reported-by: Jietao Xiao <shawtao1125@gmail.com> +Reported-by: Jinku Li <jkli@xidian.edu.cn> +Reported-by: Wenbo Shen <shenwenbo@zju.edu.cn> +Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> +Reviewed-by: Greg Kurz <groug@kaod.org> +Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> +Message-Id: <E1q6w7r-0000Q0-NM@lizzy.crudebyte.com> + +Upstream-Status: Backport from [https://github.com/qemu/qemu/commit/10fad73a2bf1c76c8aa9d6322755e5f877d83ce5] +CVE: CVE-2023-2861 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + fsdev/virtfs-proxy-helper.c | 27 +++++++++++++++++++++++-- + hw/9pfs/9p-util.h | 40 +++++++++++++++++++++++++++++++++++++ + 2 files changed, 65 insertions(+), 2 deletions(-) + +diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c +index 15c0e79b0..f9e4669a5 100644 +--- a/fsdev/virtfs-proxy-helper.c ++++ b/fsdev/virtfs-proxy-helper.c +@@ -26,6 +26,7 @@ + #include "qemu/xattr.h" + #include "9p-iov-marshal.h" + #include "hw/9pfs/9p-proxy.h" ++#include "hw/9pfs/9p-util.h" + #include "fsdev/9p-iov-marshal.h" + + #define PROGNAME "virtfs-proxy-helper" +@@ -338,6 +339,28 @@ static void resetugid(int suid, int sgid) + } + } + ++/* ++ * Open regular file or directory. Attempts to open any special file are ++ * rejected. ++ * ++ * returns file descriptor or -1 on error ++ */ ++static int open_regular(const char *pathname, int flags, mode_t mode) ++{ ++ int fd; ++ ++ fd = open(pathname, flags, mode); ++ if (fd < 0) { ++ return fd; ++ } ++ ++ if (close_if_special_file(fd) < 0) { ++ return -1; ++ } ++ ++ return fd; ++} ++ + /* + * send response in two parts + * 1) ProxyHeader +@@ -682,7 +705,7 @@ static int do_create(struct iovec *iovec) + if (ret < 0) { + goto unmarshal_err_out; + } +- ret = open(path.data, flags, mode); ++ ret = open_regular(path.data, flags, mode); + if (ret < 0) { + ret = -errno; + } +@@ -707,7 +730,7 @@ static int do_open(struct iovec *iovec) + if (ret < 0) { + goto err_out; + } +- ret = open(path.data, flags); ++ ret = open_regular(path.data, flags, 0); + if (ret < 0) { + ret = -errno; + } +diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h +index 546f46dc7..23000e917 100644 +--- a/hw/9pfs/9p-util.h ++++ b/hw/9pfs/9p-util.h +@@ -13,12 +13,16 @@ + #ifndef QEMU_9P_UTIL_H + #define QEMU_9P_UTIL_H + ++#include "qemu/error-report.h" ++ + #ifdef O_PATH + #define O_PATH_9P_UTIL O_PATH + #else + #define O_PATH_9P_UTIL 0 + #endif + ++#define qemu_fstat fstat ++ + static inline void close_preserve_errno(int fd) + { + int serrno = errno; +@@ -26,6 +30,38 @@ static inline void close_preserve_errno(int fd) + errno = serrno; + } + ++/** ++ * close_if_special_file() - Close @fd if neither regular file nor directory. ++ * ++ * @fd: file descriptor of open file ++ * Return: 0 on regular file or directory, -1 otherwise ++ * ++ * CVE-2023-2861: Prohibit opening any special file directly on host ++ * (especially device files), as a compromised client could potentially gain ++ * access outside exported tree under certain, unsafe setups. We expect ++ * client to handle I/O on special files exclusively on guest side. ++ */ ++static inline int close_if_special_file(int fd) ++{ ++ struct stat stbuf; ++ ++ if (qemu_fstat(fd, &stbuf) < 0) { ++ close_preserve_errno(fd); ++ return -1; ++ } ++ if (!S_ISREG(stbuf.st_mode) && !S_ISDIR(stbuf.st_mode)) { ++ error_report_once( ++ "9p: broken or compromised client detected; attempt to open " ++ "special file (i.e. neither regular file, nor directory)" ++ ); ++ close(fd); ++ errno = ENXIO; ++ return -1; ++ } ++ ++ return 0; ++} ++ + static inline int openat_dir(int dirfd, const char *name) + { + return openat(dirfd, name, +@@ -56,6 +92,10 @@ again: + return -1; + } + ++ if (close_if_special_file(fd) < 0) { ++ return -1; ++ } ++ + serrno = errno; + /* O_NONBLOCK was only needed to open the file. Let's drop it. We don't + * do that with O_PATH since fcntl(F_SETFL) isn't supported, and openat() +-- +2.35.7 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-3180.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-3180.patch new file mode 100644 index 0000000000..30080924c8 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-3180.patch @@ -0,0 +1,50 @@ +From 49f1e02bac166821c712534aaa775f50e1afe17f Mon Sep 17 00:00:00 2001 +From: zhenwei pi <pizhenwei@bytedance.com> +Date: Thu, 3 Aug 2023 10:43:13 +0800 +Subject: [PATCH] virtio-crypto: verify src&dst buffer length for sym request + +For symmetric algorithms, the length of ciphertext must be as same +as the plaintext. +The missing verification of the src_len and the dst_len in +virtio_crypto_sym_op_helper() may lead buffer overflow/divulged. + +This patch is originally written by Yiming Tao for QEMU-SECURITY, +resend it(a few changes of error message) in qemu-devel. + +Fixes: CVE-2023-3180 +Fixes: 04b9b37edda("virtio-crypto: add data queue processing handler") +Cc: Gonglei <arei.gonglei@huawei.com> +Cc: Mauro Matteo Cascella <mcascell@redhat.com> +Cc: Yiming Tao <taoym@zju.edu.cn> +Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> +Message-Id: <20230803024314.29962-2-pizhenwei@bytedance.com> +Reviewed-by: Michael S. Tsirkin <mst@redhat.com> +Signed-off-by: Michael S. Tsirkin <mst@redhat.com> +(cherry picked from commit 9d38a8434721a6479fe03fb5afb150ca793d3980) +Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/49f1e02bac166821c712534aaa775f50e1afe17f] +CVE: CVE-2023-3180 +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + hw/virtio/virtio-crypto.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c +index a1d122b9aa..ccaa704530 100644 +--- a/hw/virtio/virtio-crypto.c ++++ b/hw/virtio/virtio-crypto.c +@@ -635,6 +635,11 @@ virtio_crypto_sym_op_helper(VirtIODevice *vdev, + return NULL; + } + ++ if (unlikely(src_len != dst_len)) { ++ virtio_error(vdev, "sym request src len is different from dst len"); ++ return NULL; ++ } ++ + max_len = (uint64_t)iv_len + aad_len + src_len + dst_len + hash_result_len; + if (unlikely(max_len > vcrypto->conf.max_size)) { + virtio_error(vdev, "virtio-crypto too big length"); +-- +2.40.0 diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-3255.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-3255.patch new file mode 100644 index 0000000000..f030df111f --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-3255.patch @@ -0,0 +1,64 @@ +From d921fea338c1059a27ce7b75309d7a2e485f710b Mon Sep 17 00:00:00 2001 +From: Mauro Matteo Cascella <mcascell@redhat.com> +Date: Tue, 4 Jul 2023 10:41:22 +0200 +Subject: [PATCH] ui/vnc-clipboard: fix infinite loop in inflate_buffer + (CVE-2023-3255) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +A wrong exit condition may lead to an infinite loop when inflating a +valid zlib buffer containing some extra bytes in the `inflate_buffer` +function. The bug only occurs post-authentication. Return the buffer +immediately if the end of the compressed data has been reached +(Z_STREAM_END). + +Fixes: CVE-2023-3255 +Fixes: 0bf41cab ("ui/vnc: clipboard support") +Reported-by: Kevin Denis <kevin.denis@synacktiv.com> +Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> +Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> +Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com> +Message-ID: <20230704084210.101822-1-mcascell@redhat.com> + +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/d921fea338c1059a27ce7b75309d7a2e485f710b] + +CVE: CVE-2023-3255 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> + +--- + ui/vnc-clipboard.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c +index 8aeadfaa21..c759be3438 100644 +--- a/ui/vnc-clipboard.c ++++ b/ui/vnc-clipboard.c +@@ -50,8 +50,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size) + ret = inflate(&stream, Z_FINISH); + switch (ret) { + case Z_OK: +- case Z_STREAM_END: + break; ++ case Z_STREAM_END: ++ *size = stream.total_out; ++ inflateEnd(&stream); ++ return out; + case Z_BUF_ERROR: + out_len <<= 1; + if (out_len > (1 << 20)) { +@@ -66,11 +69,6 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size) + } + } + +- *size = stream.total_out; +- inflateEnd(&stream); +- +- return out; +- + err_end: + inflateEnd(&stream); + err: +-- +2.40.0 diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-3301.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-3301.patch new file mode 100644 index 0000000000..ffb5cd3861 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-3301.patch @@ -0,0 +1,60 @@ +From a0d7215e339b61c7d7a7b3fcf754954d80d93eb8 Mon Sep 17 00:00:00 2001 +From: Ani Sinha <anisinha@redhat.com> +Date: Mon, 19 Jun 2023 12:22:09 +0530 +Subject: [PATCH] vhost-vdpa: do not cleanup the vdpa/vhost-net structures if + peer nic is present + +When a peer nic is still attached to the vdpa backend, it is too early to free +up the vhost-net and vdpa structures. If these structures are freed here, then +QEMU crashes when the guest is being shut down. The following call chain +would result in an assertion failure since the pointer returned from +vhost_vdpa_get_vhost_net() would be NULL: + +do_vm_stop() -> vm_state_notify() -> virtio_set_status() -> +virtio_net_vhost_status() -> get_vhost_net(). + +Therefore, we defer freeing up the structures until at guest shutdown +time when qemu_cleanup() calls net_cleanup() which then calls +qemu_del_net_client() which would eventually call vhost_vdpa_cleanup() +again to free up the structures. This time, the loop in net_cleanup() +ensures that vhost_vdpa_cleanup() will be called one last time when +all the peer nics are detached and freed. + +All unit tests pass with this change. + +CC: imammedo@redhat.com +CC: jusual@redhat.com +CC: mst@redhat.com +Fixes: CVE-2023-3301 +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2128929 +Signed-off-by: Ani Sinha <anisinha@redhat.com> +Message-Id: <20230619065209.442185-1-anisinha@redhat.com> +Reviewed-by: Michael S. Tsirkin <mst@redhat.com> +Signed-off-by: Michael S. Tsirkin <mst@redhat.com> + +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/a0d7215e339b61c7d7a7b3fcf754954d80d93eb8] +CVE: CVE-2023-3301 + + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + net/vhost-vdpa.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/net/vhost-vdpa.c ++++ b/net/vhost-vdpa.c +@@ -140,6 +140,14 @@ static void vhost_vdpa_cleanup(NetClient + { + VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc); + ++ /* ++ * If a peer NIC is attached, do not cleanup anything. ++ * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup() ++ * when the guest is shutting down. ++ */ ++ if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) { ++ return; ++ } + if (s->vhost_net) { + vhost_net_cleanup(s->vhost_net); + g_free(s->vhost_net); diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-3354.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-3354.patch new file mode 100644 index 0000000000..250716fcfc --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-3354.patch @@ -0,0 +1,87 @@ +From 10be627d2b5ec2d6b3dce045144aa739eef678b4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com> +Date: Tue, 20 Jun 2023 09:45:34 +0100 +Subject: [PATCH] io: remove io watch if TLS channel is closed during handshake +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The TLS handshake make take some time to complete, during which time an +I/O watch might be registered with the main loop. If the owner of the +I/O channel invokes qio_channel_close() while the handshake is waiting +to continue the I/O watch must be removed. Failing to remove it will +later trigger the completion callback which the owner is not expecting +to receive. In the case of the VNC server, this results in a SEGV as +vnc_disconnect_start() tries to shutdown a client connection that is +already gone / NULL. + +CVE-2023-3354 +Reported-by: jiangyegen <jiangyegen@huawei.com> +Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/10be627d2b5ec2d6b3dce045144aa739eef678b4] +CVE: CVE-2023-3354 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + include/io/channel-tls.h | 1 + + io/channel-tls.c | 18 ++++++++++++------ + 2 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/include/io/channel-tls.h b/include/io/channel-tls.h +index 5672479e9..26c67f17e 100644 +--- a/include/io/channel-tls.h ++++ b/include/io/channel-tls.h +@@ -48,6 +48,7 @@ struct QIOChannelTLS { + QIOChannel *master; + QCryptoTLSSession *session; + QIOChannelShutdown shutdown; ++ guint hs_ioc_tag; + }; + + /** +diff --git a/io/channel-tls.c b/io/channel-tls.c +index 2ae1b92fc..34476e6b7 100644 +--- a/io/channel-tls.c ++++ b/io/channel-tls.c +@@ -195,12 +195,13 @@ static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, + } + + trace_qio_channel_tls_handshake_pending(ioc, status); +- qio_channel_add_watch_full(ioc->master, +- condition, +- qio_channel_tls_handshake_io, +- data, +- NULL, +- context); ++ ioc->hs_ioc_tag = ++ qio_channel_add_watch_full(ioc->master, ++ condition, ++ qio_channel_tls_handshake_io, ++ data, ++ NULL, ++ context); + } + } + +@@ -215,6 +216,7 @@ static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, + QIOChannelTLS *tioc = QIO_CHANNEL_TLS( + qio_task_get_source(task)); + ++ tioc->hs_ioc_tag = 0; + g_free(data); + qio_channel_tls_handshake_task(tioc, task, context); + +@@ -373,6 +375,10 @@ static int qio_channel_tls_close(QIOChannel *ioc, + { + QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); + ++ if (tioc->hs_ioc_tag) { ++ g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove); ++ } ++ + return qio_channel_close(tioc->master, errp); + } + +-- +2.25.1 + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch new file mode 100644 index 0000000000..d53683faa7 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch @@ -0,0 +1,46 @@ +From 7cfcc79b0ab800959716738aff9419f53fc68c9c Mon Sep 17 00:00:00 2001 +From: Thomas Huth <thuth@redhat.com> +Date: Mon, 25 Sep 2023 11:18:54 +0200 +Subject: [PATCH] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 + [CVE-2023-42467] + +We are doing things like + + nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE); + +in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if +the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes +with a division by 0 exception. Thus disallow block sizes of 256 +bytes to avoid this situation. + +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813 +CVE: 2023-42467 +Signed-off-by: Thomas Huth <thuth@redhat.com> +Message-ID: <20230925091854.49198-1-thuth@redhat.com> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + +CVE: CVE-2023-42467 +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c] +Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> +--- + hw/scsi/scsi-disk.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c +index e0d79c7966c..477ee2bcd47 100644 +--- a/hw/scsi/scsi-disk.c ++++ b/hw/scsi/scsi-disk.c +@@ -1628,9 +1628,10 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf) + * Since the existing code only checks/updates bits 8-15 of the block + * size, restrict ourselves to the same requirement for now to ensure + * that a block size set by a block descriptor and then read back by +- * a subsequent SCSI command will be the same ++ * a subsequent SCSI command will be the same. Also disallow a block ++ * size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE. + */ +- if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) { ++ if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) { + s->qdev.blocksize = bs; + trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize); + } +-- diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch new file mode 100644 index 0000000000..c5ea9d739a --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch @@ -0,0 +1,112 @@ +From 7d7512019fc40c577e2bdd61f114f31a9eb84a8e Mon Sep 17 00:00:00 2001 +From: Fiona Ebner <f.ebner@proxmox.com> +Date: Wed, 6 Sep 2023 15:09:21 +0200 +Subject: [PATCH] hw/ide: reset: cancel async DMA operation before resetting + state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If there is a pending DMA operation during ide_bus_reset(), the fact +that the IDEState is already reset before the operation is canceled +can be problematic. In particular, ide_dma_cb() might be called and +then use the reset IDEState which contains the signature after the +reset. When used to construct the IO operation this leads to +ide_get_sector() returning 0 and nsector being 1. This is particularly +bad, because a write command will thus destroy the first sector which +often contains a partition table or similar. + +Traces showing the unsolicited write happening with IDEState +0x5595af6949d0 being used after reset: + +> ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300 +> ahci_reset_port ahci(0x5595af6923f0)[0]: reset port +> ide_reset IDEstate 0x5595af6949d0 +> ide_reset IDEstate 0x5595af694da8 +> ide_bus_reset_aio aio_cancel +> dma_aio_cancel dbs=0x7f64600089a0 +> dma_blk_cb dbs=0x7f64600089a0 ret=0 +> dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30 +> ahci_populate_sglist ahci(0x5595af6923f0)[0] +> ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512 +> ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE +> dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1 +> dma_blk_cb dbs=0x7f6420802010 ret=0 + +> (gdb) p *qiov +> $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0, +> iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000", +> size = 512}}} +> (gdb) bt +> #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0, +> cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010) +> at ../block/block-backend.c:1682 +> #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>) +> at ../softmmu/dma-helpers.c:179 +> #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0, +> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, +> io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>, +> io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30, +> cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0, +> dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244 +> #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30, +> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, +> cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0) +> at ../softmmu/dma-helpers.c:280 +> #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>) +> at ../hw/ide/core.c:953 +> #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0) +> at ../softmmu/dma-helpers.c:107 +> #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127 +> #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10) +> at ../block/block-backend.c:1527 +> #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524 +> #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594 +> #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>, +> i1=<optimized out>) at ../util/coroutine-ucontext.c:177 + +CVE: CVE-2023-5088 +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e] + +Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> +Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> +Tested-by: simon.rowe@nutanix.com +Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com> +Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> +Signed-off-by: Sourav Pramanik <sourav.pramanik@kpit.com> +--- + hw/ide/core.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/hw/ide/core.c b/hw/ide/core.c +index b5e0dcd29b2..63ba665f3d2 100644 +--- a/hw/ide/core.c ++++ b/hw/ide/core.c +@@ -2515,19 +2515,19 @@ static void ide_dummy_transfer_stop(IDEState *s) + + void ide_bus_reset(IDEBus *bus) + { +- bus->unit = 0; +- bus->cmd = 0; +- ide_reset(&bus->ifs[0]); +- ide_reset(&bus->ifs[1]); +- ide_clear_hob(bus); +- +- /* pending async DMA */ ++ /* pending async DMA - needs the IDEState before it is reset */ + if (bus->dma->aiocb) { + trace_ide_bus_reset_aio(); + blk_aio_cancel(bus->dma->aiocb); + bus->dma->aiocb = NULL; + } + ++ bus->unit = 0; ++ bus->cmd = 0; ++ ide_reset(&bus->ifs[0]); ++ ide_reset(&bus->ifs[1]); ++ ide_clear_hob(bus); ++ + /* reset dma provider too */ + if (bus->dma->ops->reset) { + bus->dma->ops->reset(bus->dma); +-- diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-6683.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-6683.patch new file mode 100644 index 0000000000..e528574076 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-6683.patch @@ -0,0 +1,92 @@ +From 405484b29f6548c7b86549b0f961b906337aa68a Mon Sep 17 00:00:00 2001 +From: Fiona Ebner <f.ebner@proxmox.com> +Date: Wed, 24 Jan 2024 11:57:48 +0100 +Subject: [PATCH] ui/clipboard: mark type as not available when there is no + data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +With VNC, a client can send a non-extended VNC_MSG_CLIENT_CUT_TEXT +message with len=0. In qemu_clipboard_set_data(), the clipboard info +will be updated setting data to NULL (because g_memdup(data, size) +returns NULL when size is 0). If the client does not set the +VNC_ENCODING_CLIPBOARD_EXT feature when setting up the encodings, then +the 'request' callback for the clipboard peer is not initialized. +Later, because data is NULL, qemu_clipboard_request() can be reached +via vdagent_chr_write() and vdagent_clipboard_recv_request() and +there, the clipboard owner's 'request' callback will be attempted to +be called, but that is a NULL pointer. + +In particular, this can happen when using the KRDC (22.12.3) VNC +client. + +Another scenario leading to the same issue is with two clients (say +noVNC and KRDC): + +The noVNC client sets the extension VNC_FEATURE_CLIPBOARD_EXT and +initializes its cbpeer. + +The KRDC client does not, but triggers a vnc_client_cut_text() (note +it's not the _ext variant)). There, a new clipboard info with it as +the 'owner' is created and via qemu_clipboard_set_data() is called, +which in turn calls qemu_clipboard_update() with that info. + +In qemu_clipboard_update(), the notifier for the noVNC client will be +called, i.e. vnc_clipboard_notify() and also set vs->cbinfo for the +noVNC client. The 'owner' in that clipboard info is the clipboard peer +for the KRDC client, which did not initialize the 'request' function. +That sounds correct to me, it is the owner of that clipboard info. + +Then when noVNC sends a VNC_MSG_CLIENT_CUT_TEXT message (it did set +the VNC_FEATURE_CLIPBOARD_EXT feature correctly, so a check for it +passes), that clipboard info is passed to qemu_clipboard_request() and +the original segfault still happens. + +Fix the issue by handling updates with size 0 differently. In +particular, mark in the clipboard info that the type is not available. + +While at it, switch to g_memdup2(), because g_memdup() is deprecated. + +Cc: qemu-stable@nongnu.org +Fixes: CVE-2023-6683 +Reported-by: Markus Frank <m.frank@proxmox.com> +Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com> +Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> +Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> +Tested-by: Markus Frank <m.frank@proxmox.com> +Message-ID: <20240124105749.204610-1-f.ebner@proxmox.com> + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/405484b29f6548c7b86549b0f961b906337aa68a] +CVE: CVE-2023-6683 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + ui/clipboard.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/ui/clipboard.c b/ui/clipboard.c +index 3d14bffaf80..b3f6fa3c9e1 100644 +--- a/ui/clipboard.c ++++ b/ui/clipboard.c +@@ -163,9 +163,15 @@ void qemu_clipboard_set_data(QemuClipboardPeer *peer, + } + + g_free(info->types[type].data); +- info->types[type].data = g_memdup(data, size); +- info->types[type].size = size; +- info->types[type].available = true; ++ if (size) { ++ info->types[type].data = g_memdup2(data, size); ++ info->types[type].size = size; ++ info->types[type].available = true; ++ } else { ++ info->types[type].data = NULL; ++ info->types[type].size = 0; ++ info->types[type].available = false; ++ } + + if (update) { + qemu_clipboard_update(info); +-- +GitLab + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-6693.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-6693.patch new file mode 100644 index 0000000000..b91f2e6902 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-6693.patch @@ -0,0 +1,74 @@ +From 2220e8189fb94068dbad333228659fbac819abb0 Mon Sep 17 00:00:00 2001 +From: Jason Wang <jasowang@redhat.com> +Date: Tue, 2 Jan 2024 11:29:01 +0800 +Subject: [PATCH] virtio-net: correctly copy vnet header when flushing TX + +When HASH_REPORT is negotiated, the guest_hdr_len might be larger than +the size of the mergeable rx buffer header. Using +virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack +overflow in this case. Fixing this by using virtio_net_hdr_v1_hash +instead. + +Reported-by: Xiao Lei <leixiao.nop@zju.edu.cn> +Cc: Yuri Benditovich <yuri.benditovich@daynix.com> +Cc: qemu-stable@nongnu.org +Cc: Mauro Matteo Cascella <mcascell@redhat.com> +Fixes: CVE-2023-6693 +Fixes: e22f0603fb2f ("virtio-net: reference implementation of hash report") +Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> +Signed-off-by: Jason Wang <jasowang@redhat.com> + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/2220e8189fb94068dbad333228659fbac819abb0] +CVE: CVE-2023-6693 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + hw/net/virtio-net.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c +index e1f474883..42e66697f 100644 +--- a/hw/net/virtio-net.c ++++ b/hw/net/virtio-net.c +@@ -600,6 +600,11 @@ static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs, + + n->mergeable_rx_bufs = mergeable_rx_bufs; + ++ /* ++ * Note: when extending the vnet header, please make sure to ++ * change the vnet header copying logic in virtio_net_flush_tx() ++ * as well. ++ */ + if (version_1) { + n->guest_hdr_len = hash_report ? + sizeof(struct virtio_net_hdr_v1_hash) : +@@ -2520,7 +2525,7 @@ static int32_t virtio_net_flush_tx(VirtIONetQueue *q) + ssize_t ret; + unsigned int out_num; + struct iovec sg[VIRTQUEUE_MAX_SIZE], sg2[VIRTQUEUE_MAX_SIZE + 1], *out_sg; +- struct virtio_net_hdr_mrg_rxbuf mhdr; ++ struct virtio_net_hdr_v1_hash vhdr; + + elem = virtqueue_pop(q->tx_vq, sizeof(VirtQueueElement)); + if (!elem) { +@@ -2537,7 +2542,7 @@ static int32_t virtio_net_flush_tx(VirtIONetQueue *q) + } + + if (n->has_vnet_hdr) { +- if (iov_to_buf(out_sg, out_num, 0, &mhdr, n->guest_hdr_len) < ++ if (iov_to_buf(out_sg, out_num, 0, &vhdr, n->guest_hdr_len) < + n->guest_hdr_len) { + virtio_error(vdev, "virtio-net header incorrect"); + virtqueue_detach_element(q->tx_vq, elem, 0); +@@ -2545,8 +2550,8 @@ static int32_t virtio_net_flush_tx(VirtIONetQueue *q) + return -EINVAL; + } + if (n->needs_vnet_hdr_swap) { +- virtio_net_hdr_swap(vdev, (void *) &mhdr); +- sg2[0].iov_base = &mhdr; ++ virtio_net_hdr_swap(vdev, (void *) &vhdr); ++ sg2[0].iov_base = &vhdr; + sg2[0].iov_len = n->guest_hdr_len; + out_num = iov_copy(&sg2[1], ARRAY_SIZE(sg2) - 1, + out_sg, out_num, +-- +2.34.1 diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2024-24474.patch b/meta/recipes-devtools/qemu/qemu/CVE-2024-24474.patch new file mode 100644 index 0000000000..e890fe56cf --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2024-24474.patch @@ -0,0 +1,44 @@ +From 77668e4b9bca03a856c27ba899a2513ddf52bb52 Mon Sep 17 00:00:00 2001 +From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> +Date: Wed, 13 Sep 2023 21:44:09 +0100 +Subject: [PATCH] esp: restrict non-DMA transfer length to that of available + data + +In the case where a SCSI layer transfer is incorrectly terminated, it is +possible for a TI command to cause a SCSI buffer overflow due to the +expected transfer data length being less than the available data in the +FIFO. When this occurs the unsigned async_len variable underflows and +becomes a large offset which writes past the end of the allocated SCSI +buffer. + +Restrict the non-DMA transfer length to be the smallest of the expected +transfer length and the available FIFO data to ensure that it is no longer +possible for the SCSI buffer overflow to occur. + +Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1810 +Reviewed-by: Thomas Huth <thuth@redhat.com> +Message-ID: <20230913204410.65650-3-mark.cave-ayland@ilande.co.uk> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52] +CVE: CVE-2024-24474 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + hw/scsi/esp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c +index 4218a6a96054..9b11d8c5738a 100644 +--- a/hw/scsi/esp.c ++++ b/hw/scsi/esp.c +@@ -759,7 +759,8 @@ static void esp_do_nodma(ESPState *s) + } + + if (to_device) { +- len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ); ++ len = MIN(s->async_len, ESP_FIFO_SZ); ++ len = MIN(len, fifo8_num_used(&s->fifo)); + esp_fifo_pop_buf(&s->fifo, s->async_buf, len); + s->async_buf += len; + s->async_len -= len; diff --git a/meta/recipes-devtools/qemu/qemu/scsi-disk-allow-MODE-SELECT-block-desriptor-to-set-the-block-size.patch b/meta/recipes-devtools/qemu/qemu/scsi-disk-allow-MODE-SELECT-block-desriptor-to-set-the-block-size.patch new file mode 100644 index 0000000000..d8e48d07dd --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/scsi-disk-allow-MODE-SELECT-block-desriptor-to-set-the-block-size.patch @@ -0,0 +1,54 @@ +From 356c4c441ec01910314c5867c680bef80d1dd373 Mon Sep 17 00:00:00 2001 +From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> +Date: Wed, 22 Jun 2022 11:53:12 +0100 +Subject: [PATCH] scsi-disk: allow MODE SELECT block descriptor to set the + block size + +The MODE SELECT command can contain an optional block descriptor that can be used +to set the device block size. If the block descriptor is present then update the +block size on the SCSI device accordingly. + +This allows CDROMs to be used with A/UX which requires a CDROM drive which is +capable of switching from a 2048 byte sector size to a 512 byte sector size. + +Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> +Message-Id: <20220622105314.802852-13-mark.cave-ayland@ilande.co.uk> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + +Comment: Patch is refreshed +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/356c4c441ec01910314c5867c680bef80d1dd373] +Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> +--- + hw/scsi/scsi-disk.c | 6 ++++++ + hw/scsi/trace-events | 1 + + 2 files changed, 7 insertions(+) + +diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c +index db27e834dae3..f5cdb9ad4b54 100644 +--- a/hw/scsi/scsi-disk.c ++++ b/hw/scsi/scsi-disk.c +@@ -1616,6 +1616,12 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf) + goto invalid_param; + } + ++ /* Allow changing the block size */ ++ if (bd_len && p[6] != (s->qdev.blocksize >> 8)) { ++ s->qdev.blocksize = p[6] << 8; ++ trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize); ++ } ++ + len -= bd_len; + p += bd_len; + +diff --git a/hw/scsi/trace-events b/hw/scsi/trace-events +index 8e927ff62de1..ab238293f0da 100644 +--- a/hw/scsi/trace-events ++++ b/hw/scsi/trace-events +@@ -338,6 +338,7 @@scsi_disk_dma_command_READ(uint64_t lba, uint32_t len) "Read (sector %" PRId64 ", count %u)" + scsi_disk_dma_command_WRITE(const char *cmd, uint64_t lba, int len) "Write %s(sector %" PRId64 ", count %u)" + scsi_disk_new_request(uint32_t lun, uint32_t tag, const char *line) "Command: lun=%d tag=0x%x data=%s" + scsi_disk_aio_sgio_command(uint32_t tag, uint8_t cmd, uint64_t lba, int len, uint32_t timeout) "disk aio sgio: tag=0x%x cmd=0x%x (sector %" PRId64 ", count %d) timeout=%u" ++scsi_disk_mode_select_set_blocksize(int blocksize) "set block size to %d" + + # scsi-generic.c + scsi_generic_command_complete_noio(void *req, uint32_t tag, int statuc) "Command complete %p tag=0x%x status=%d" diff --git a/meta/recipes-devtools/qemu/qemu/scsi-disk-ensure-block-size-is-non-zero-and-changes-limited-to-bits-8-15.patch b/meta/recipes-devtools/qemu/qemu/scsi-disk-ensure-block-size-is-non-zero-and-changes-limited-to-bits-8-15.patch new file mode 100644 index 0000000000..1e1be683fc --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/scsi-disk-ensure-block-size-is-non-zero-and-changes-limited-to-bits-8-15.patch @@ -0,0 +1,67 @@ +From 55794c904df723109b228da28b5db778e0df3110 Mon Sep 17 00:00:00 2001 +From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> +Date: Sat, 30 Jul 2022 13:26:56 +0100 +Subject: [PATCH] scsi-disk: ensure block size is non-zero and changes limited + to bits 8-15 + +The existing code assumes that the block size can be generated from p[1] << 8 +in multiple places which ignores the top and bottom 8 bits. If the block size +is allowed to be set to an arbitrary value then this causes a mismatch +between the value written by the guest in the block descriptor and the value +subsequently read back using READ CAPACITY causing the guest to generate +requests that can crash QEMU. + +For now restrict block size changes to bits 8-15 and also ignore requests to +set the block size to 0 which causes the SCSI emulation to crash in at least +one place with a divide by zero error. + +Fixes: 356c4c441e ("scsi-disk: allow MODE SELECT block descriptor to set the block size") +Closes: https://gitlab.com/qemu-project/qemu/-/issues/1112 +Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> +Message-Id: <20220730122656.253448-3-mark.cave-ayland@ilande.co.uk> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + +Comment: Patch is refreshed +Upstream-Status: Backport [https://github.com/qemu/qemu/commit/55794c904df723109b228da28b5db778e0df3110] +Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> +--- + hw/scsi/scsi-disk.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c +index 3027ac3b1ed6..efee6739f9ad 100644 +--- a/hw/scsi/scsi-disk.c ++++ b/hw/scsi/scsi-disk.c +@@ -1532,7 +1532,7 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf) + int cmd = r->req.cmd.buf[0]; + int len = r->req.cmd.xfer; + int hdr_len = (cmd == MODE_SELECT ? 4 : 8); +- int bd_len; ++ int bd_len, bs; + int pass; + + /* We only support PF=1, SP=0. */ +@@ -1617,9 +1617,19 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf) + } + + /* Allow changing the block size */ +- if (bd_len && p[6] != (s->qdev.blocksize >> 8)) { +- s->qdev.blocksize = p[6] << 8; +- trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize); ++ if (bd_len) { ++ bs = p[5] << 16 | p[6] << 8 | p[7]; ++ ++ /* ++ * Since the existing code only checks/updates bits 8-15 of the block ++ * size, restrict ourselves to the same requirement for now to ensure ++ * that a block size set by a block descriptor and then read back by ++ * a subsequent SCSI command will be the same ++ */ ++ if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) { ++ s->qdev.blocksize = bs; ++ trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize); ++ } + } + + len -= bd_len; + diff --git a/meta/recipes-devtools/quilt/quilt.inc b/meta/recipes-devtools/quilt/quilt.inc index fce81016d8..72deb24915 100644 --- a/meta/recipes-devtools/quilt/quilt.inc +++ b/meta/recipes-devtools/quilt/quilt.inc @@ -14,6 +14,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/quilt/quilt-${PV}.tar.gz \ file://0001-tests-Allow-different-output-from-mv.patch \ file://fix-grep-3.8.patch \ file://faildiff-order.patch \ + file://0001-test-Fix-a-race-condition-in-merge.test.patch \ " SRC_URI:append:class-target = " file://gnu_patch_test_fix_target.patch" diff --git a/meta/recipes-devtools/quilt/quilt/0001-test-Fix-a-race-condition-in-merge.test.patch b/meta/recipes-devtools/quilt/quilt/0001-test-Fix-a-race-condition-in-merge.test.patch new file mode 100644 index 0000000000..01d4c8befc --- /dev/null +++ b/meta/recipes-devtools/quilt/quilt/0001-test-Fix-a-race-condition-in-merge.test.patch @@ -0,0 +1,48 @@ +From c1ce964f3e9312100a60f03c1e1fdd601e1911f2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?= + <congdanhqx@gmail.com> +Date: Tue, 28 Feb 2023 18:45:15 +0100 +Subject: [PATCH] test: Fix a race condition in merge.test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Just like commit 4dfe7f9, (test: Fix a race condition, 2023-01-20), +this fix a test race when stdout and stderr in any order. + +Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/quilt.git/commit/?id=c1ce964f3e9312100a60f03c1e1fdd601e1911f2] +Signed-off-by: Đoàn Trần Công Danh <congdanhqx@gmail.com> +Signed-off-by: Jean Delvare <jdelvare@suse.de> +--- + test/merge.test | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/test/merge.test b/test/merge.test +index c64b33d..2e67d4f 100644 +--- a/test/merge.test ++++ b/test/merge.test +@@ -39,8 +39,9 @@ Test the patch merging functionality of `quilt diff'. + > Applying patch %{P}c.diff + > Now at patch %{P}c.diff + +- $ quilt diff -P b.diff | grep -v "^\\(---\\|+++\\)" ++ $ quilt diff -P b.diff >/dev/null + > Warning: more recent patches modify files in patch %{P}b.diff ++ $ quilt diff -P b.diff 2>/dev/null | grep -v "^\\(---\\|+++\\)" + >~ Index: [^/]+/abc\.txt + > =================================================================== + > @@ -1,3 +1,3 @@ +@@ -49,8 +50,9 @@ Test the patch merging functionality of `quilt diff'. + > +b+ + > c + +- $ quilt diff --combine a.diff -P b.diff | grep -v "^\\(---\\|+++\\)" ++ $ quilt diff --combine a.diff -P b.diff >/dev/null + > Warning: more recent patches modify files in patch %{P}b.diff ++ $ quilt diff --combine a.diff -P b.diff 2>/dev/null | grep -v "^\\(---\\|+++\\)" + >~ Index: [^/]+/abc\.txt + > =================================================================== + > @@ -1,3 +1,3 @@ +-- +2.40.0 + diff --git a/meta/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch b/meta/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch new file mode 100644 index 0000000000..474d82db22 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch @@ -0,0 +1,173 @@ +From 785c0072c80c2f6e0839478453cf65fdeac15da0 Mon Sep 17 00:00:00 2001 +From: Khem Raj <raj.khem@gmail.com> +Date: Mon, 29 Aug 2022 19:53:28 -0700 +Subject: [PATCH] Add missing prototypes to function declarations + +With Clang 15+ compiler -Wstrict-prototypes is triggering warnings which +are turned into errors with -Werror, this fixes the problem by adding +missing prototypes + +Fixes errors like +| log.c:134:24: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] +| static void syslog_init() +| ^ +| void + +Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032858.html] +Signed-off-by: Khem Raj <raj.khem@gmail.com> +--- + checksum.c | 2 +- + exclude.c | 2 +- + hlink.c | 3 +-- + lib/pool_alloc.c | 2 +- + log.c | 2 +- + main.c | 2 +- + syscall.c | 4 ++-- + zlib/crc32.c | 2 +- + zlib/trees.c | 2 +- + zlib/zutil.c | 4 ++-- + 10 files changed, 12 insertions(+), 13 deletions(-) + +diff --git a/checksum.c b/checksum.c +index fb8c0a0..174c28c 100644 +--- a/checksum.c ++++ b/checksum.c +@@ -629,7 +629,7 @@ int sum_end(char *sum) + return csum_len_for_type(cursum_type, 0); + } + +-void init_checksum_choices() ++void init_checksum_choices(void) + { + #ifdef SUPPORT_XXH3 + char buf[32816]; +diff --git a/exclude.c b/exclude.c +index adc82e2..79f5a82 100644 +--- a/exclude.c ++++ b/exclude.c +@@ -358,7 +358,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end) + memcpy(partial_string_buf, s_start, partial_string_len); + } + +-void free_implied_include_partial_string() ++void free_implied_include_partial_string(void) + { + if (partial_string_buf) { + free(partial_string_buf); +diff --git a/hlink.c b/hlink.c +index 66810a3..6511dfb 100644 +--- a/hlink.c ++++ b/hlink.c +@@ -117,8 +117,7 @@ static void match_gnums(int32 *ndx_list, int ndx_count) + struct ht_int32_node *node = NULL; + int32 gnum, gnum_next; + +- qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)()) hlink_compare_gnum); +- ++ qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)(const void *, const void *)) hlink_compare_gnum); + for (from = 0; from < ndx_count; from++) { + file = hlink_flist->sorted[ndx_list[from]]; + gnum = F_HL_GNUM(file); +diff --git a/lib/pool_alloc.c b/lib/pool_alloc.c +index a1a7245..4eae062 100644 +--- a/lib/pool_alloc.c ++++ b/lib/pool_alloc.c +@@ -9,7 +9,7 @@ struct alloc_pool + size_t size; /* extent size */ + size_t quantum; /* allocation quantum */ + struct pool_extent *extents; /* top extent is "live" */ +- void (*bomb)(); /* called if malloc fails */ ++ void (*bomb)(const char *, const char *, int); /* called if malloc fails */ + int flags; + + /* statistical data */ +diff --git a/log.c b/log.c +index 44344e2..991e359 100644 +--- a/log.c ++++ b/log.c +@@ -131,7 +131,7 @@ static void logit(int priority, const char *buf) + } + } + +-static void syslog_init() ++static void syslog_init(void) + { + int options = LOG_PID; + +diff --git a/main.c b/main.c +index 9ebfbea..affa244 100644 +--- a/main.c ++++ b/main.c +@@ -244,7 +244,7 @@ void read_del_stats(int f) + stats.deleted_files += stats.deleted_specials = read_varint(f); + } + +-static void become_copy_as_user() ++static void become_copy_as_user(void) + { + char *gname; + uid_t uid; +diff --git a/syscall.c b/syscall.c +index d92074a..92ca86d 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -389,9 +389,9 @@ OFF_T do_lseek(int fd, OFF_T offset, int whence) + { + #ifdef HAVE_LSEEK64 + #if !SIZEOF_OFF64_T +- OFF_T lseek64(); ++ OFF_T lseek64(int fd, OFF_T offset, int whence); + #else +- off64_t lseek64(); ++ off64_t lseek64(int fd, off64_t offset, int whence); + #endif + return lseek64(fd, offset, whence); + #else +diff --git a/zlib/crc32.c b/zlib/crc32.c +index 05733f4..50c6c02 100644 +--- a/zlib/crc32.c ++++ b/zlib/crc32.c +@@ -187,7 +187,7 @@ local void write_table(out, table) + /* ========================================================================= + * This function can be used by asm versions of crc32() + */ +-const z_crc_t FAR * ZEXPORT get_crc_table() ++const z_crc_t FAR * ZEXPORT get_crc_table(void) + { + #ifdef DYNAMIC_CRC_TABLE + if (crc_table_empty) +diff --git a/zlib/trees.c b/zlib/trees.c +index 9c66770..0d9047e 100644 +--- a/zlib/trees.c ++++ b/zlib/trees.c +@@ -231,7 +231,7 @@ local void send_bits(s, value, length) + /* =========================================================================== + * Initialize the various 'constant' tables. + */ +-local void tr_static_init() ++local void tr_static_init(void) + { + #if defined(GEN_TREES_H) || !defined(STDC) + static int static_init_done = 0; +diff --git a/zlib/zutil.c b/zlib/zutil.c +index bbba7b2..61f8dc9 100644 +--- a/zlib/zutil.c ++++ b/zlib/zutil.c +@@ -27,12 +27,12 @@ z_const char * const z_errmsg[10] = { + ""}; + + +-const char * ZEXPORT zlibVersion() ++const char * ZEXPORT zlibVersion(void) + { + return ZLIB_VERSION; + } + +-uLong ZEXPORT zlibCompileFlags() ++uLong ZEXPORT zlibCompileFlags(void) + { + uLong flags; + +-- +2.37.2 + diff --git a/meta/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch b/meta/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch new file mode 100644 index 0000000000..1d9c4bfe48 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch @@ -0,0 +1,68 @@ +From e64a58387db46239902b610871a0eb81626e99ff Mon Sep 17 00:00:00 2001 +From: Paul Eggert <eggert@cs.ucla.edu> +Date: Thu, 18 Aug 2022 07:46:28 -0700 +Subject: [PATCH] Turn on -pedantic-errors at the end of 'configure' + +Problem reported by Khem Raj in: +https://lists.gnu.org/r/autoconf-patches/2022-08/msg00009.html +Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032862.html] +--- + configure.ac | 35 ++++++++++++++++++++--------------- + 1 file changed, 20 insertions(+), 15 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d185b2d3..7e9514f7 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1071,21 +1071,6 @@ elif test x"$ac_cv_header_popt_h" != x"yes"; then + with_included_popt=yes + fi + +-if test x"$GCC" = x"yes"; then +- if test x"$with_included_popt" != x"yes"; then +- # Turn pedantic warnings into errors to ensure an array-init overflow is an error. +- CFLAGS="$CFLAGS -pedantic-errors" +- else +- # Our internal popt code cannot be compiled with pedantic warnings as errors, so try to +- # turn off pedantic warnings (which will not lose the error for array-init overflow). +- # Older gcc versions don't understand -Wno-pedantic, so check if --help=warnings lists +- # -Wpedantic and use that as a flag. +- case `$CC --help=warnings 2>/dev/null | grep Wpedantic` in +- *-Wpedantic*) CFLAGS="$CFLAGS -pedantic-errors -Wno-pedantic" ;; +- esac +- fi +-fi +- + AC_MSG_CHECKING([whether to use included libpopt]) + if test x"$with_included_popt" = x"yes"; then + AC_MSG_RESULT($srcdir/popt) +@@ -1444,6 +1429,26 @@ case "$CC" in + ;; + esac + ++# Enable -pedantic-errors last, so that it doesn't mess up other ++# 'configure' tests. For example, Autoconf uses empty function ++# prototypes like 'int main () {}' which Clang 15's -pedantic-errors ++# would reject. Generally it's not a good idea to try to run ++# 'configure' itself with strict compiler checking. ++if test x"$GCC" = x"yes"; then ++ if test x"$with_included_popt" != x"yes"; then ++ # Turn pedantic warnings into errors to ensure an array-init overflow is an error. ++ CFLAGS="$CFLAGS -pedantic-errors" ++ else ++ # Our internal popt code cannot be compiled with pedantic warnings as errors, so try to ++ # turn off pedantic warnings (which will not lose the error for array-init overflow). ++ # Older gcc versions don't understand -Wno-pedantic, so check if --help=warnings lists ++ # -Wpedantic and use that as a flag. ++ case `$CC --help=warnings 2>/dev/null | grep Wpedantic` in ++ *-Wpedantic*) CFLAGS="$CFLAGS -pedantic-errors -Wno-pedantic" ;; ++ esac ++ fi ++fi ++ + AC_CONFIG_FILES([Makefile lib/dummy zlib/dummy popt/dummy shconfig]) + AC_OUTPUT + +-- +2.37.1 + diff --git a/meta/recipes-devtools/rsync/rsync_3.2.5.bb b/meta/recipes-devtools/rsync/rsync_3.2.5.bb index e43f35ea2f..983bdd5ab0 100644 --- a/meta/recipes-devtools/rsync/rsync_3.2.5.bb +++ b/meta/recipes-devtools/rsync/rsync_3.2.5.bb @@ -14,6 +14,8 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://rsyncd.conf \ file://makefile-no-rebuild.patch \ file://determism.patch \ + file://0001-Add-missing-prototypes-to-function-declarations.patch \ + file://0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch \ " SRC_URI[sha256sum] = "2ac4d21635cdf791867bc377c35ca6dda7f50d919a58be45057fd51600c69aba" diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2023-28755.patch b/meta/recipes-devtools/ruby/ruby/CVE-2023-28755.patch new file mode 100644 index 0000000000..d611c41dcc --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2023-28755.patch @@ -0,0 +1,68 @@ +From db4bb57d4af6d097a0c29490536793d95f1d8983 Mon Sep 17 00:00:00 2001 +From: Hiroshi SHIBATA <hsbt@ruby-lang.org> +Date: Mon, 24 Apr 2023 08:27:24 +0000 +Subject: [PATCH] Merge URI-0.12.1 + +CVE: CVE-2023-28755 + +Upstream-Status: Backport [https://github.com/ruby/ruby/commit/8ce4ab146498879b65e22f1be951b25eebb79300] + +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + lib/uri/rfc3986_parser.rb | 4 ++-- + lib/uri/version.rb | 2 +- + test/uri/test_common.rb | 11 +++++++++++ + 3 files changed, 14 insertions(+), 3 deletions(-) + +diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb +index 3e07de4..3c89311 100644 +--- a/lib/uri/rfc3986_parser.rb ++++ b/lib/uri/rfc3986_parser.rb +@@ -3,8 +3,8 @@ module URI + class RFC3986_Parser # :nodoc: + # URI defined in RFC3986 + # this regexp is modified not to host is not empty string +- RFC3986_URI = /\A(?<URI>(?<scheme>[A-Za-z][+\-.0-9A-Za-z]*):(?<hier-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*)@)?(?<host>(?<IP-literal>\[(?:(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:)?\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h+\.[!$&-.0-;=A-Z_a-z~]+))\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])+))?(?::(?<port>\d*))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*))*)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])+)(?:\/\g<segment>)*)?)|(?<path-rootless>\g<segment-nz>(?:\/\g<segment>)*)|(?<path-empty>))(?:\?(?<query>[^#]*))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*))?)\z/ +- RFC3986_relative_ref = /\A(?<relative-ref>(?<relative-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*)@)?(?<host>(?<IP-literal>\[(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:){,1}\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h+\.[!$&-.0-;=A-Z_a-z~]+)\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])+))?(?::(?<port>\d*))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*))*)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])+)(?:\/\g<segment>)*)?)|(?<path-noscheme>(?<segment-nz-nc>(?:%\h\h|[!$&-.0-9;=@-Z_a-z~])+)(?:\/\g<segment>)*)|(?<path-empty>))(?:\?(?<query>[^#]*))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*))?)\z/ ++ RFC3986_URI = /\A(?<URI>(?<scheme>[A-Za-z][+\-.0-9A-Za-z]*+):(?<hier-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*+)@)?(?<host>(?<IP-literal>\[(?:(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:)?\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h++\.[!$&-.0-;=A-Z_a-z~]++))\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])*+))(?::(?<port>\d*+))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*+))*+)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])++)(?:\/\g<segment>)*+)?)|(?<path-rootless>\g<segment-nz>(?:\/\g<segment>)*+)|(?<path-empty>))(?:\?(?<query>[^#]*+))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*+))?)\z/ ++ RFC3986_relative_ref = /\A(?<relative-ref>(?<relative-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*+)@)?(?<host>(?<IP-literal>\[(?:(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:){,1}\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h++\.[!$&-.0-;=A-Z_a-z~]++))\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])++))?(?::(?<port>\d*+))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*+))*+)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])++)(?:\/\g<segment>)*+)?)|(?<path-noscheme>(?<segment-nz-nc>(?:%\h\h|[!$&-.0-9;=@-Z_a-z~])++)(?:\/\g<segment>)*+)|(?<path-empty>))(?:\?(?<query>[^#]*+))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*+))?)\z/ + attr_reader :regexp + + def initialize +diff --git a/lib/uri/version.rb b/lib/uri/version.rb +index 82188e2..7497a7d 100644 +--- a/lib/uri/version.rb ++++ b/lib/uri/version.rb +@@ -1,6 +1,6 @@ + module URI + # :stopdoc: +- VERSION_CODE = '001100'.freeze ++ VERSION_CODE = '001201'.freeze + VERSION = VERSION_CODE.scan(/../).collect{|n| n.to_i}.join('.').freeze + # :startdoc: + end +diff --git a/test/uri/test_common.rb b/test/uri/test_common.rb +index 5e30cda..1d34783 100644 +--- a/test/uri/test_common.rb ++++ b/test/uri/test_common.rb +@@ -78,6 +78,17 @@ class TestCommon < Test::Unit::TestCase + assert_raise(NoMethodError) { Object.new.URI("http://www.ruby-lang.org/") } + end + ++ def test_parse_timeout ++ pre = ->(n) { ++ 'https://example.com/dir/' + 'a' * (n * 100) + '/##.jpg' ++ } ++ assert_linear_performance((1..10).map {|i| i * 100}, rehearsal: 1000, pre: pre) do |uri| ++ assert_raise(URI::InvalidURIError) do ++ URI.parse(uri) ++ end ++ end ++ end ++ + def test_encode_www_form_component + assert_equal("%00+%21%22%23%24%25%26%27%28%29*%2B%2C-.%2F09%3A%3B%3C%3D%3E%3F%40" \ + "AZ%5B%5C%5D%5E_%60az%7B%7C%7D%7E", +-- +2.35.5 + diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2023-28756.patch b/meta/recipes-devtools/ruby/ruby/CVE-2023-28756.patch new file mode 100644 index 0000000000..cf24b13f53 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2023-28756.patch @@ -0,0 +1,73 @@ +From 957bb7cb81995f26c671afce0ee50a5c660e540e Mon Sep 17 00:00:00 2001 +From: Hiroshi SHIBATA <hsbt@ruby-lang.org> +Date: Wed, 29 Mar 2023 13:28:25 +0900 +Subject: [PATCH] CVE-2023-28756 + +CVE: CVE-2023-28756 +Upstream-Status: Backport [https://github.com/ruby/ruby/commit/957bb7cb81995f26c671afce0ee50a5c660e540e] +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + lib/time.gemspec | 2 +- + lib/time.rb | 6 +++--- + test/test_time.rb | 9 +++++++++ + 3 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/lib/time.gemspec b/lib/time.gemspec +index 72fba34..bada91a 100644 +--- a/lib/time.gemspec ++++ b/lib/time.gemspec +@@ -1,6 +1,6 @@ + Gem::Specification.new do |spec| + spec.name = "time" +- spec.version = "0.2.0" ++ spec.version = "0.2.2" + spec.authors = ["Tanaka Akira"] + spec.email = ["akr@fsij.org"] + +diff --git a/lib/time.rb b/lib/time.rb +index bd20a1a..6a13212 100644 +--- a/lib/time.rb ++++ b/lib/time.rb +@@ -509,8 +509,8 @@ class Time + (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+ + (\d{2,})\s+ + (\d{2})\s* +- :\s*(\d{2})\s* +- (?::\s*(\d{2}))?\s+ ++ :\s*(\d{2}) ++ (?:\s*:\s*(\d\d))?\s+ + ([+-]\d{4}| + UT|GMT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|[A-IK-Z])/ix =~ date + # Since RFC 2822 permit comments, the regexp has no right anchor. +@@ -701,7 +701,7 @@ class Time + # + # If self is a UTC time, Z is used as TZD. [+-]hh:mm is used otherwise. + # +- # +fractional_digits+ specifies a number of digits to use for fractional ++ # +fraction_digits+ specifies a number of digits to use for fractional + # seconds. Its default value is 0. + # + # require 'time' +diff --git a/test/test_time.rb b/test/test_time.rb +index b50d841..23e8e10 100644 +--- a/test/test_time.rb ++++ b/test/test_time.rb +@@ -62,6 +62,15 @@ class TestTimeExtension < Test::Unit::TestCase # :nodoc: + assert_equal(true, t.utc?) + end + ++ def test_rfc2822_nonlinear ++ pre = ->(n) {"0 Feb 00 00 :00" + " " * n} ++ assert_linear_performance([100, 500, 5000, 50_000], pre: pre) do |s| ++ assert_raise(ArgumentError) do ++ Time.rfc2822(s) ++ end ++ end ++ end ++ + if defined?(Ractor) + def test_rfc2822_ractor + assert_ractor(<<~RUBY, require: 'time') +-- +2.25.1 + diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_1.patch b/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_1.patch new file mode 100644 index 0000000000..57a15d302e --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_1.patch @@ -0,0 +1,52 @@ +From 9c2eb12776c1b5df2517a7e618e5fe818cc3395e Mon Sep 17 00:00:00 2001 +From: Nobuyoshi Nakada <nobu@ruby-lang.org> +Date: Thu, 27 Jul 2023 15:53:01 +0800 +Subject: [PATCH] ruby: Fix quadratic backtracking on invalid relative URI + +Upstream-Status: Backport [https://github.com/ruby/uri/commit/9010ee2536adda10a0555ae1ed6fe2f5808e6bf1] +CVE: CVE-2023-36617 + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + lib/uri/rfc2396_parser.rb | 4 ++-- + test/uri/test_parser.rb | 12 ++++++++++++ + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/lib/uri/rfc2396_parser.rb b/lib/uri/rfc2396_parser.rb +index 76a8f99..00c66cf 100644 +--- a/lib/uri/rfc2396_parser.rb ++++ b/lib/uri/rfc2396_parser.rb +@@ -497,8 +497,8 @@ module URI + ret = {} + + # for URI::split +- ret[:ABS_URI] = Regexp.new('\A\s*' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED) +- ret[:REL_URI] = Regexp.new('\A\s*' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED) ++ ret[:ABS_URI] = Regexp.new('\A\s*+' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED) ++ ret[:REL_URI] = Regexp.new('\A\s*+' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED) + + # for URI::extract + ret[:URI_REF] = Regexp.new(pattern[:URI_REF]) +diff --git a/test/uri/test_parser.rb b/test/uri/test_parser.rb +index 03de137..01ed32a 100644 +--- a/test/uri/test_parser.rb ++++ b/test/uri/test_parser.rb +@@ -63,4 +63,16 @@ class URI::TestParser < Test::Unit::TestCase + assert_equal("\u3042", p1.unescape('%e3%81%82'.force_encoding(Encoding::US_ASCII))) + assert_equal("\xe3\x83\x90\xe3\x83\x90", p1.unescape("\xe3\x83\x90%e3%83%90")) + end ++ ++ def test_rfc2822_parse_relative_uri ++ pre = ->(length) { ++ " " * length + "\0" ++ } ++ parser = URI::RFC2396_Parser.new ++ assert_linear_performance((1..5).map {|i| 10**i}, pre: pre) do |uri| ++ assert_raise(URI::InvalidURIError) do ++ parser.split(uri) ++ end ++ end ++ end + end +-- +2.40.0 diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_2.patch b/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_2.patch new file mode 100644 index 0000000000..ff558183b6 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2023-36617_2.patch @@ -0,0 +1,47 @@ +From eea5868120509c245216c4b5c2d4b5db1c593d0e Mon Sep 17 00:00:00 2001 +From: Nobuyoshi Nakada <nobu@ruby-lang.org> +Date: Thu, 27 Jul 2023 16:16:30 +0800 +Subject: [PATCH] ruby: Fix quadratic backtracking on invalid port number + +Upstream-Status: Backport [https://github.com/ruby/uri/commit/9d7bcef1e6ad23c9c6e4932f297fb737888144c8] +CVE: CVE-2023-36617 +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + lib/uri/rfc3986_parser.rb | 2 +- + test/uri/test_parser.rb | 10 ++++++++++ + 2 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb +index 3c89311..cde3ea7 100644 +--- a/lib/uri/rfc3986_parser.rb ++++ b/lib/uri/rfc3986_parser.rb +@@ -101,7 +101,7 @@ module URI + QUERY: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, + FRAGMENT: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, + OPAQUE: /\A(?:[^\/].*)?\z/, +- PORT: /\A[\x09\x0a\x0c\x0d ]*\d*[\x09\x0a\x0c\x0d ]*\z/, ++ PORT: /\A[\x09\x0a\x0c\x0d ]*+\d*[\x09\x0a\x0c\x0d ]*\z/, + } + end + +diff --git a/test/uri/test_parser.rb b/test/uri/test_parser.rb +index 01ed32a..81c2210 100644 +--- a/test/uri/test_parser.rb ++++ b/test/uri/test_parser.rb +@@ -75,4 +75,14 @@ class URI::TestParser < Test::Unit::TestCase + end + end + end ++ ++ def test_rfc3986_port_check ++ pre = ->(length) {"\t" * length + "a"} ++ uri = URI.parse("http://my.example.com") ++ assert_linear_performance((1..5).map {|i| 10**i}, pre: pre) do |port| ++ assert_raise(URI::InvalidComponentError) do ++ uri.port = port ++ end ++ end ++ end + end +-- +2.40.0 diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch new file mode 100644 index 0000000000..6f4b35a786 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch @@ -0,0 +1,97 @@ +From da7a0c7553ef7250ca665a3fecdc01dbaacbb43d Mon Sep 17 00:00:00 2001 +From: Nobuyoshi Nakada <nobu@ruby-lang.org> +Date: Mon, 15 Apr 2024 11:40:00 +0000 +Subject: [PATCH] Filter marshaled objets + +CVE: CVE-2024-27281 +Upstream-Status: Backport [https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + lib/rdoc/store.rb | 45 ++++++++++++++++++++++++++------------------- + 1 file changed, 26 insertions(+), 19 deletions(-) + +diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb +index 5ba671c..c793e49 100644 +--- a/lib/rdoc/store.rb ++++ b/lib/rdoc/store.rb +@@ -556,9 +556,7 @@ class RDoc::Store + def load_cache + #orig_enc = @encoding + +- File.open cache_path, 'rb' do |io| +- @cache = Marshal.load io.read +- end ++ @cache = marshal_load(cache_path) + + load_enc = @cache[:encoding] + +@@ -615,9 +613,7 @@ class RDoc::Store + def load_class_data klass_name + file = class_file klass_name + +- File.open file, 'rb' do |io| +- Marshal.load io.read +- end ++ marshal_load(file) + rescue Errno::ENOENT => e + error = MissingFileError.new(self, file, klass_name) + error.set_backtrace e.backtrace +@@ -630,14 +626,10 @@ class RDoc::Store + def load_method klass_name, method_name + file = method_file klass_name, method_name + +- File.open file, 'rb' do |io| +- obj = Marshal.load io.read +- obj.store = self +- obj.parent = +- find_class_or_module(klass_name) || load_class(klass_name) unless +- obj.parent +- obj +- end ++ obj = marshal_load(file) ++ obj.store = self ++ obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name) ++ obj + rescue Errno::ENOENT => e + error = MissingFileError.new(self, file, klass_name + method_name) + error.set_backtrace e.backtrace +@@ -650,11 +642,9 @@ class RDoc::Store + def load_page page_name + file = page_file page_name + +- File.open file, 'rb' do |io| +- obj = Marshal.load io.read +- obj.store = self +- obj +- end ++ obj = marshal_load(file) ++ obj.store = self ++ obj + rescue Errno::ENOENT => e + error = MissingFileError.new(self, file, page_name) + error.set_backtrace e.backtrace +@@ -976,4 +966,21 @@ class RDoc::Store + @unique_modules + end + ++ private ++ def marshal_load(file) ++ File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)} ++ end ++ ++ MarshalFilter = proc do |obj| ++ case obj ++ when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text ++ else ++ unless obj.class.name.start_with?("RDoc::") ++ raise TypeError, "not permitted class: #{obj.class.name}" ++ end ++ end ++ obj ++ end ++ private_constant :MarshalFilter ++ + end +-- +2.35.5 diff --git a/meta/recipes-devtools/ruby/ruby_3.1.3.bb b/meta/recipes-devtools/ruby/ruby_3.1.3.bb index c8454da3a9..2ad3c9e207 100644 --- a/meta/recipes-devtools/ruby/ruby_3.1.3.bb +++ b/meta/recipes-devtools/ruby/ruby_3.1.3.bb @@ -29,6 +29,11 @@ SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \ file://0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch \ file://0006-Make-gemspecs-reproducible.patch \ file://0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch \ + file://CVE-2023-28756.patch \ + file://CVE-2023-28755.patch \ + file://CVE-2023-36617_1.patch \ + file://CVE-2023-36617_2.patch \ + file://CVE-2024-27281.patch \ " UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/" diff --git a/meta/recipes-devtools/run-postinsts/run-postinsts/run-postinsts.service b/meta/recipes-devtools/run-postinsts/run-postinsts/run-postinsts.service index 7f72f3388a..b6b81d5c1a 100644 --- a/meta/recipes-devtools/run-postinsts/run-postinsts/run-postinsts.service +++ b/meta/recipes-devtools/run-postinsts/run-postinsts/run-postinsts.service @@ -1,7 +1,7 @@ [Unit] Description=Run pending postinsts DefaultDependencies=no -After=systemd-remount-fs.service systemd-tmpfiles-setup.service tmp.mount +After=systemd-remount-fs.service systemd-tmpfiles-setup.service tmp.mount ldconfig.service Before=sysinit.target [Service] diff --git a/meta/recipes-devtools/rust/rust-common.inc b/meta/recipes-devtools/rust/rust-common.inc index ef70c48d0f..a73367bbd5 100644 --- a/meta/recipes-devtools/rust/rust-common.inc +++ b/meta/recipes-devtools/rust/rust-common.inc @@ -109,7 +109,7 @@ def llvm_features_from_target_fpu(d): # TARGET_FPU can be hard or soft. +soft-float tell llvm to use soft float # ABI. There is no option for hard. - fpu = d.getVar('TARGET_FPU', True) + fpu = d.getVar('TARGET_FPU') return ["+soft-float"] if fpu == "soft" else [] def llvm_features(d): @@ -119,12 +119,12 @@ def llvm_features(d): ## arm-unknown-linux-gnueabihf -DATA_LAYOUT[arm] = "e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64" -TARGET_ENDIAN[arm] = "little" -TARGET_POINTER_WIDTH[arm] = "32" -TARGET_C_INT_WIDTH[arm] = "32" -MAX_ATOMIC_WIDTH[arm] = "64" -FEATURES[arm] = "+v6,+vfp2" +DATA_LAYOUT[arm-eabi] = "e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64" +TARGET_ENDIAN[arm-eabi] = "little" +TARGET_POINTER_WIDTH[arm-eabi] = "32" +TARGET_C_INT_WIDTH[arm-eabi] = "32" +MAX_ATOMIC_WIDTH[arm-eabi] = "64" +FEATURES[arm-eabi] = "+v6,+vfp2" ## armv7-unknown-linux-gnueabihf DATA_LAYOUT[armv7-eabi] = "e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64" @@ -297,6 +297,12 @@ def rust_gen_target(d, thing, wd, features, cpu, arch, abi=""): sys = sys_for(d, thing) prefix = prefix_for(d, thing) + if thing == "TARGET": + abi = d.getVar('ABIEXTENSION') + # arm and armv7 have different targets in llvm + if arch == "arm" and target_is_armv7(d): + arch = 'armv7' + rust_arch = oe.rust.arch_to_rust_arch(arch) if abi: @@ -307,9 +313,13 @@ def rust_gen_target(d, thing, wd, features, cpu, arch, abi=""): features = features or d.getVarFlag('FEATURES', arch_abi) or "" features = features.strip() + llvm_target = d.getVar('RUST_TARGET_SYS') + if thing == "BUILD": + llvm_target = d.getVar('RUST_HOST_SYS') + # build tspec tspec = {} - tspec['llvm-target'] = d.getVar('RUST_TARGET_SYS', arch_abi) + tspec['llvm-target'] = llvm_target tspec['data-layout'] = d.getVarFlag('DATA_LAYOUT', arch_abi) tspec['max-atomic-width'] = int(d.getVarFlag('MAX_ATOMIC_WIDTH', arch_abi)) tspec['target-pointer-width'] = d.getVarFlag('TARGET_POINTER_WIDTH', arch_abi) diff --git a/meta/recipes-devtools/rust/rust-cross-canadian-common.inc b/meta/recipes-devtools/rust/rust-cross-canadian-common.inc index 1f21c8af26..df4901f1fa 100644 --- a/meta/recipes-devtools/rust/rust-cross-canadian-common.inc +++ b/meta/recipes-devtools/rust/rust-cross-canadian-common.inc @@ -27,9 +27,10 @@ DEBUG_PREFIX_MAP = "-fdebug-prefix-map=${WORKDIR}=/usr/src/debug/${PN}/${EXTENDP python do_rust_gen_targets () { wd = d.getVar('WORKDIR') + '/targets/' - rust_gen_target(d, 'TARGET', wd, d.getVar('TARGET_LLVM_FEATURES') or "", d.getVar('TARGET_LLVM_CPU'), d.getVar('TARGET_ARCH')) - rust_gen_target(d, 'HOST', wd, "", "generic", d.getVar('HOST_ARCH')) + # Order of BUILD, HOST, TARGET is important in case the files overwrite, most specific last rust_gen_target(d, 'BUILD', wd, "", "generic", d.getVar('BUILD_ARCH')) + rust_gen_target(d, 'HOST', wd, "", "generic", d.getVar('HOST_ARCH')) + rust_gen_target(d, 'TARGET', wd, d.getVar('TARGET_LLVM_FEATURES') or "", d.getVar('TARGET_LLVM_CPU'), d.getVar('TARGET_ARCH')) } INHIBIT_DEFAULT_RUST_DEPS = "1" diff --git a/meta/recipes-devtools/rust/rust-cross.inc b/meta/recipes-devtools/rust/rust-cross.inc index f6babfeeda..2e47a3aa5f 100644 --- a/meta/recipes-devtools/rust/rust-cross.inc +++ b/meta/recipes-devtools/rust/rust-cross.inc @@ -1,22 +1,9 @@ python do_rust_gen_targets () { wd = d.getVar('WORKDIR') + '/targets/' - # It is important 'TARGET' is last here so that it overrides our less - # informed choices for BUILD & HOST if TARGET happens to be the same as - # either of them. - for thing in ['BUILD', 'HOST', 'TARGET']: - bb.debug(1, "rust_gen_target for " + thing) - features = "" - cpu = "generic" - arch = d.getVar('{}_ARCH'.format(thing)) - abi = "" - if thing is "TARGET": - abi = d.getVar('ABIEXTENSION') - # arm and armv7 have different targets in llvm - if arch == "arm" and target_is_armv7(d): - arch = 'armv7' - features = d.getVar('TARGET_LLVM_FEATURES') or "" - cpu = d.getVar('TARGET_LLVM_CPU') - rust_gen_target(d, thing, wd, features, cpu, arch, abi) + # Order of BUILD, HOST, TARGET is important in case the files overwrite, most specific last + rust_gen_target(d, 'BUILD', wd, "", "generic", d.getVar('BUILD_ARCH')) + rust_gen_target(d, 'HOST', wd, "", "generic", d.getVar('HOST_ARCH')) + rust_gen_target(d, 'TARGET', wd, d.getVar('TARGET_LLVM_FEATURES') or "", d.getVar('TARGET_LLVM_CPU'), d.getVar('TARGET_ARCH')) } # Otherwise we'll depend on what we provide diff --git a/meta/recipes-devtools/rust/rust-llvm.inc b/meta/recipes-devtools/rust/rust-llvm.inc index 5c2ccdac9a..416a07cd40 100644 --- a/meta/recipes-devtools/rust/rust-llvm.inc +++ b/meta/recipes-devtools/rust/rust-llvm.inc @@ -3,7 +3,9 @@ LICENSE ?= "Apache-2.0-with-LLVM-exception" HOMEPAGE = "http://www.rust-lang.org" SRC_URI += "file://0002-llvm-allow-env-override-of-exe-path.patch;striplevel=2 \ - file://0001-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch;striplevel=2" + file://0001-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch;striplevel=2 \ + file://0003-Support-Add-missing-cstdint-header-to-Signals.h.patch;striplevel=2 \ +" S = "${RUSTSRC}/src/llvm-project/llvm" @@ -23,9 +25,11 @@ CXXFLAGS:remove = "-g" LLVM_DIR = "llvm${LLVM_RELEASE}" +RUST_LLVM_TARGETS ?= "ARM;AArch64;Mips;PowerPC;RISCV;X86" + EXTRA_OECMAKE = " \ -DCMAKE_BUILD_TYPE=Release \ - -DLLVM_TARGETS_TO_BUILD='ARM;AArch64;Mips;PowerPC;RISCV;X86' \ + -DLLVM_TARGETS_TO_BUILD='${RUST_LLVM_TARGETS}' \ -DLLVM_BUILD_DOCS=OFF \ -DLLVM_ENABLE_TERMINFO=OFF \ -DLLVM_ENABLE_ZLIB=OFF \ diff --git a/meta/recipes-devtools/rust/rust-llvm/0003-Support-Add-missing-cstdint-header-to-Signals.h.patch b/meta/recipes-devtools/rust/rust-llvm/0003-Support-Add-missing-cstdint-header-to-Signals.h.patch new file mode 100644 index 0000000000..6ed23aa9c5 --- /dev/null +++ b/meta/recipes-devtools/rust/rust-llvm/0003-Support-Add-missing-cstdint-header-to-Signals.h.patch @@ -0,0 +1,32 @@ +From a94bf34221fc4519bd8ec72560c2d363ffe2de4c Mon Sep 17 00:00:00 2001 +From: Sergei Trofimovich <slyich@gmail.com> +Date: Mon, 23 May 2022 08:03:23 +0100 +Subject: [PATCH] [Support] Add missing <cstdint> header to Signals.h + +Without the change llvm build fails on this week's gcc-13 snapshot as: + + [ 0%] Building CXX object lib/Support/CMakeFiles/LLVMSupport.dir/Signals.cpp.o + In file included from llvm/lib/Support/Signals.cpp:14: + llvm/include/llvm/Support/Signals.h:119:8: error: variable or field 'CleanupOnSignal' declared void + 119 | void CleanupOnSignal(uintptr_t Context); + | ^~~~~~~~~~~~~~~ + +Upstream-Status: Backport [llvmorg-15.0.0 ff1681ddb303223973653f7f5f3f3435b48a1983] +Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> +Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> +--- + llvm/include/llvm/Support/Signals.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/llvm/include/llvm/Support/Signals.h b/llvm/include/llvm/Support/Signals.h +index 44f5a750ff5c..937e0572d4a7 100644 +--- a/llvm/include/llvm/Support/Signals.h ++++ b/llvm/include/llvm/Support/Signals.h +@@ -14,6 +14,7 @@ + #ifndef LLVM_SUPPORT_SIGNALS_H + #define LLVM_SUPPORT_SIGNALS_H + ++#include <cstdint> + #include <string> + + namespace llvm { diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes-devtools/rust/rust-source.inc index ea70ad786f..c377a680a7 100644 --- a/meta/recipes-devtools/rust/rust-source.inc +++ b/meta/recipes-devtools/rust/rust-source.inc @@ -5,3 +5,6 @@ RUSTSRC = "${WORKDIR}/rustc-${PV}-src" UPSTREAM_CHECK_URI = "https://forge.rust-lang.org/infra/other-installation-methods.html" UPSTREAM_CHECK_REGEX = "rustc-(?P<pver>\d+(\.\d+)+)-src" + +#CVE-2024-24576 is specific to Microsoft Windows +CVE_CHECK_IGNORE += "CVE-2024-24576" diff --git a/meta/recipes-devtools/rust/rust.inc b/meta/recipes-devtools/rust/rust.inc index f39228e3c0..008b2ce4a4 100644 --- a/meta/recipes-devtools/rust/rust.inc +++ b/meta/recipes-devtools/rust/rust.inc @@ -79,7 +79,7 @@ python do_configure() { config = configparser.RawConfigParser() # [target.ARCH-poky-linux] - target_section = "target.{}".format(d.getVar('TARGET_SYS', True)) + target_section = "target.{}".format(d.getVar('TARGET_SYS')) config.add_section(target_section) llvm_config = d.expand("${YOCTO_ALTERNATE_EXE_PATH}") @@ -90,7 +90,7 @@ python do_configure() { # If we don't do this rust-native will compile it's own llvm for BUILD. # [target.${BUILD_ARCH}-unknown-linux-gnu] - target_section = "target.{}".format(d.getVar('SNAPSHOT_BUILD_SYS', True)) + target_section = "target.{}".format(d.getVar('SNAPSHOT_BUILD_SYS')) config.add_section(target_section) config.set(target_section, "llvm-config", e(llvm_config)) @@ -124,26 +124,26 @@ python do_configure() { config.set("build", "vendor", e(True)) if not "targets" in locals(): - targets = [d.getVar("TARGET_SYS", True)] + targets = [d.getVar("TARGET_SYS")] config.set("build", "target", e(targets)) if not "hosts" in locals(): - hosts = [d.getVar("HOST_SYS", True)] + hosts = [d.getVar("HOST_SYS")] config.set("build", "host", e(hosts)) # We can't use BUILD_SYS since that is something the rust snapshot knows # nothing about when trying to build some stage0 tools (like fabricate) - config.set("build", "build", e(d.getVar("SNAPSHOT_BUILD_SYS", True))) + config.set("build", "build", e(d.getVar("SNAPSHOT_BUILD_SYS"))) # [install] config.add_section("install") # ./x.py install doesn't have any notion of "destdir" # but we can prepend ${D} to all the directories instead - config.set("install", "prefix", e(d.getVar("D", True) + d.getVar("prefix", True))) - config.set("install", "bindir", e(d.getVar("D", True) + d.getVar("bindir", True))) - config.set("install", "libdir", e(d.getVar("D", True) + d.getVar("libdir", True))) - config.set("install", "datadir", e(d.getVar("D", True) + d.getVar("datadir", True))) - config.set("install", "mandir", e(d.getVar("D", True) + d.getVar("mandir", True))) + config.set("install", "prefix", e(d.getVar("D") + d.getVar("prefix"))) + config.set("install", "bindir", e(d.getVar("D") + d.getVar("bindir"))) + config.set("install", "libdir", e(d.getVar("D") + d.getVar("libdir"))) + config.set("install", "datadir", e(d.getVar("D") + d.getVar("datadir"))) + config.set("install", "mandir", e(d.getVar("D") + d.getVar("mandir"))) with open("config.toml", "w") as f: f.write('changelog-seen = 2\n\n') diff --git a/meta/recipes-devtools/strace/strace/0001-caps-abbrev.awk-fix-gawk-s-path.patch b/meta/recipes-devtools/strace/strace/0001-caps-abbrev.awk-fix-gawk-s-path.patch deleted file mode 100644 index 235e803641..0000000000 --- a/meta/recipes-devtools/strace/strace/0001-caps-abbrev.awk-fix-gawk-s-path.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 597cc206d982e7237eb93fdc33e8c4bb6bb2d796 Mon Sep 17 00:00:00 2001 -From: Robert Yang <liezhi.yang@windriver.com> -Date: Thu, 9 Feb 2017 01:27:49 -0800 -Subject: [PATCH] caps-abbrev.awk: fix gawk's path - -It should be /usr/bin/gawk as other scripts use in this package. - -Upstream-Status: Pending - -Signed-off-by: Robert Yang <liezhi.yang@windriver.com> - ---- - tests-m32/caps-abbrev.awk | 2 +- - tests-mx32/caps-abbrev.awk | 2 +- - tests/caps-abbrev.awk | 2 +- - 3 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/tests-m32/caps-abbrev.awk b/tests-m32/caps-abbrev.awk -index c00023b..a56cd56 100644 ---- a/tests-m32/caps-abbrev.awk -+++ b/tests-m32/caps-abbrev.awk -@@ -1,4 +1,4 @@ --#!/bin/gawk -+#!/usr/bin/gawk - # - # This file is part of caps strace test. - # -diff --git a/tests-mx32/caps-abbrev.awk b/tests-mx32/caps-abbrev.awk -index c00023b..a56cd56 100644 ---- a/tests-mx32/caps-abbrev.awk -+++ b/tests-mx32/caps-abbrev.awk -@@ -1,4 +1,4 @@ --#!/bin/gawk -+#!/usr/bin/gawk - # - # This file is part of caps strace test. - # -diff --git a/tests/caps-abbrev.awk b/tests/caps-abbrev.awk -index c00023b..a56cd56 100644 ---- a/tests/caps-abbrev.awk -+++ b/tests/caps-abbrev.awk -@@ -1,4 +1,4 @@ --#!/bin/gawk -+#!/usr/bin/gawk - # - # This file is part of caps strace test. - # diff --git a/meta/recipes-devtools/strace/strace/3bbfb541b258baec9eba674b5d8dc30007a61542.patch b/meta/recipes-devtools/strace/strace/3bbfb541b258baec9eba674b5d8dc30007a61542.patch new file mode 100644 index 0000000000..b4c6ff99de --- /dev/null +++ b/meta/recipes-devtools/strace/strace/3bbfb541b258baec9eba674b5d8dc30007a61542.patch @@ -0,0 +1,50 @@ +From 3bbfb541b258baec9eba674b5d8dc30007a61542 Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" <ldv@strace.io> +Date: Wed, 21 Jun 2023 08:00:00 +0000 +Subject: [PATCH] net: enhance getsockopt decoding + +When getsockopt syscall fails the kernel sometimes updates the optlen +argument, for example, NETLINK_LIST_MEMBERSHIPS updates it even if +optval is not writable. + +* src/net.c (SYS_FUNC(getsockopt)): Try to fetch and print optlen +argument on exiting syscall regardless of getsockopt exit status. + +Upstream-Status: Backport +--- + src/net.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/net.c b/src/net.c +index f68ccb947..7244b5e57 100644 +--- a/src/net.c ++++ b/src/net.c +@@ -1038,7 +1038,7 @@ SYS_FUNC(getsockopt) + } else { + ulen = get_tcb_priv_ulong(tcp); + +- if (syserror(tcp) || umove(tcp, tcp->u_arg[4], &rlen) < 0) { ++ if (umove(tcp, tcp->u_arg[4], &rlen) < 0) { + /* optval */ + printaddr(tcp->u_arg[3]); + tprint_arg_next(); +@@ -1047,6 +1047,19 @@ SYS_FUNC(getsockopt) + tprint_indirect_begin(); + PRINT_VAL_D(ulen); + tprint_indirect_end(); ++ } else if (syserror(tcp)) { ++ /* optval */ ++ printaddr(tcp->u_arg[3]); ++ tprint_arg_next(); ++ ++ /* optlen */ ++ tprint_indirect_begin(); ++ if (ulen != rlen) { ++ PRINT_VAL_D(ulen); ++ tprint_value_changed(); ++ } ++ PRINT_VAL_D(rlen); ++ tprint_indirect_end(); + } else { + /* optval */ + print_getsockopt(tcp, tcp->u_arg[1], tcp->u_arg[2], diff --git a/meta/recipes-devtools/strace/strace/f31c2f4494779e5c5f170ad10539bfc2dfafe967.patch b/meta/recipes-devtools/strace/strace/f31c2f4494779e5c5f170ad10539bfc2dfafe967.patch new file mode 100644 index 0000000000..a0843836c2 --- /dev/null +++ b/meta/recipes-devtools/strace/strace/f31c2f4494779e5c5f170ad10539bfc2dfafe967.patch @@ -0,0 +1,50 @@ +From f31c2f4494779e5c5f170ad10539bfc2dfafe967 Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" <ldv@strace.io> +Date: Sat, 24 Jun 2023 08:00:00 +0000 +Subject: [PATCH] tests: update sockopt-sol_netlink test + +Update sockopt-sol_netlink test that started to fail, likely +due to recent linux kernel commit f4e4534850a9 ("net/netlink: fix +NETLINK_LIST_MEMBERSHIPS length report"). + +* tests/sockopt-sol_netlink.c (main): Always print changing optlen value +on exiting syscall. + +Reported-by: Alexander Gordeev <agordeev@linux.ibm.com> +--- + tests/sockopt-sol_netlink.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +Upstream-Status: Backport + +diff --git a/tests/sockopt-sol_netlink.c b/tests/sockopt-sol_netlink.c +index 82b98adc23..1c33219ac5 100644 +--- a/tests/sockopt-sol_netlink.c ++++ b/tests/sockopt-sol_netlink.c +@@ -94,7 +94,10 @@ main(void) + printf("%p", val); + else + printf("[%d]", *val); +- printf(", [%d]) = %s\n", *len, errstr); ++ printf(", [%d", (int) sizeof(*val)); ++ if ((int) sizeof(*val) != *len) ++ printf(" => %d", *len); ++ printf("]) = %s\n", errstr); + + /* optlen larger than necessary - shortened */ + *len = sizeof(*val) + 1; +@@ -150,8 +153,12 @@ main(void) + /* optval EFAULT - print address */ + *len = sizeof(*val); + get_sockopt(fd, names[i].val, efault, len); +- printf("getsockopt(%d, SOL_NETLINK, %s, %p, [%d]) = %s\n", +- fd, names[i].str, efault, *len, errstr); ++ printf("getsockopt(%d, SOL_NETLINK, %s, %p", ++ fd, names[i].str, efault); ++ printf(", [%d", (int) sizeof(*val)); ++ if ((int) sizeof(*val) != *len) ++ printf(" => %d", *len); ++ printf("]) = %s\n", errstr); + + /* optlen EFAULT - print address */ + get_sockopt(fd, names[i].val, val, len + 1); diff --git a/meta/recipes-devtools/strace/strace/update-gawk-paths.patch b/meta/recipes-devtools/strace/strace/update-gawk-paths.patch index 0c683496ae..a16ede95c2 100644 --- a/meta/recipes-devtools/strace/strace/update-gawk-paths.patch +++ b/meta/recipes-devtools/strace/strace/update-gawk-paths.patch @@ -125,3 +125,33 @@ index dce78f5..573d9ea 100644 # # Copyright (c) 2014-2015 Dmitry V. Levin <ldv@strace.io> # Copyright (c) 2016 Elvira Khabirova <lineprinter0@gmail.com> +diff --git a/tests-m32/caps-abbrev.awk b/tests-m32/caps-abbrev.awk +index c00023b..a56cd56 100644 +--- a/tests-m32/caps-abbrev.awk ++++ b/tests-m32/caps-abbrev.awk +@@ -1,4 +1,4 @@ +-#!/bin/gawk ++#!/usr/bin/gawk + # + # This file is part of caps strace test. + # +diff --git a/tests-mx32/caps-abbrev.awk b/tests-mx32/caps-abbrev.awk +index c00023b..a56cd56 100644 +--- a/tests-mx32/caps-abbrev.awk ++++ b/tests-mx32/caps-abbrev.awk +@@ -1,4 +1,4 @@ +-#!/bin/gawk ++#!/usr/bin/gawk + # + # This file is part of caps strace test. + # +diff --git a/tests/caps-abbrev.awk b/tests/caps-abbrev.awk +index c00023b..a56cd56 100644 +--- a/tests/caps-abbrev.awk ++++ b/tests/caps-abbrev.awk +@@ -1,4 +1,4 @@ +-#!/bin/gawk ++#!/usr/bin/gawk + # + # This file is part of caps strace test. + # diff --git a/meta/recipes-devtools/strace/strace_5.16.bb b/meta/recipes-devtools/strace/strace_5.16.bb index 23ffa25d29..39082a5bc7 100644 --- a/meta/recipes-devtools/strace/strace_5.16.bb +++ b/meta/recipes-devtools/strace/strace_5.16.bb @@ -9,11 +9,12 @@ SRC_URI = "https://strace.io/files/${PV}/strace-${PV}.tar.xz \ file://update-gawk-paths.patch \ file://Makefile-ptest.patch \ file://run-ptest \ - file://0001-caps-abbrev.awk-fix-gawk-s-path.patch \ file://ptest-spacesave.patch \ file://0001-strace-fix-reproducibilty-issues.patch \ file://skip-load.patch \ file://0001-landlock-update-expected-string.patch \ + file://f31c2f4494779e5c5f170ad10539bfc2dfafe967.patch \ + file://3bbfb541b258baec9eba674b5d8dc30007a61542.patch \ " SRC_URI[sha256sum] = "dc7db230ff3e57c249830ba94acab2b862da1fcaac55417e9b85041a833ca285" diff --git a/meta/recipes-devtools/tcltk/tcl/run-ptest b/meta/recipes-devtools/tcltk/tcl/run-ptest index a62b703082..87e025fce1 100644 --- a/meta/recipes-devtools/tcltk/tcl/run-ptest +++ b/meta/recipes-devtools/tcltk/tcl/run-ptest @@ -4,8 +4,12 @@ export TZ="Europe/London" export TCL_LIBRARY=library +# Some tests are overly strict with timings and fail on loaded systems. +# See bugs #14825 #14882 #15081 #15321. +SKIPPED_TESTS='async-* cmdMZ-6.6 event-* exit-1.* socket-* socket_inet-*' + for i in `ls tests/*.test | awk -F/ '{print $2}'`; do - ./tcltest tests/all.tcl -file $i >$i.log 2>&1 + ./tcltest tests/all.tcl -file $i -skip "$SKIPPED_TESTS" >$i.log 2>&1 grep -q -F -e "Files with failing tests:" -e "Test files exiting with errors:" $i.log if [ $? -eq 0 ]; then echo "FAIL: $i" diff --git a/meta/recipes-devtools/tcltk/tcl_8.6.11.bb b/meta/recipes-devtools/tcltk/tcl_8.6.11.bb index 9f6b003ffb..f8f3d7dd3f 100644 --- a/meta/recipes-devtools/tcltk/tcl_8.6.11.bb +++ b/meta/recipes-devtools/tcltk/tcl_8.6.11.bb @@ -44,6 +44,12 @@ inherit autotools ptest binconfig AUTOTOOLS_SCRIPT_PATH = "${S}/unix" EXTRA_OECONF = "--enable-threads --disable-rpath --enable-man-suffix" +# Prevent installing copy of tzdata based on tzdata installation on the build host +# It doesn't install tzdata if one of the following files exist on the host: +# /usr/share/zoneinfo/UTC /usr/share/zoneinfo/GMT /usr/share/lib/zoneinfo/UTC /usr/share/lib/zoneinfo/GMT /usr/lib/zoneinfo/UTC /usr/lib/zoneinfo/GMT +# otherwise "/usr/lib/tcl8.6/tzdata" is included in tcl package +EXTRA_OECONF += "--with-tzdata=no" + do_install() { autotools_do_install oe_runmake 'DESTDIR=${D}' install-private-headers @@ -83,6 +89,11 @@ do_install_ptest() { cp -r ${S}/tests ${D}${PTEST_PATH} } +do_install_ptest:append:libc-musl () { + # Assumes locales other than provided by musl-locales + sed -i -e 's|SKIPPED_TESTS=|SKIPPED_TESTS="unixInit-3*"|' ${D}${PTEST_PATH}/run-ptest +} + # Fix some paths that might be used by Tcl extensions BINCONFIG_GLOB = "*Config.sh" diff --git a/meta/recipes-devtools/vala/vala.inc b/meta/recipes-devtools/vala/vala.inc index d3daee37dc..162e99bb03 100644 --- a/meta/recipes-devtools/vala/vala.inc +++ b/meta/recipes-devtools/vala/vala.inc @@ -50,6 +50,9 @@ do_install:append:class-target() { # vapi files. SYSROOT_DIRS += "${bindir_crossscripts}" +inherit multilib_script +MULTILIB_SCRIPTS = "${PN}:${bindir}/vala-gen-introspect-0.56" + SYSROOT_PREPROCESS_FUNCS:append:class-target = " vapigen_sysroot_preprocess" vapigen_sysroot_preprocess() { # Tweak the vapigen name in the vapigen pkgconfig file, so that it picks @@ -64,5 +67,5 @@ SSTATE_SCAN_FILES += "vapigen-wrapper" PACKAGE_PREPROCESS_FUNCS += "vala_package_preprocess" vala_package_preprocess () { - sed -i -e 's:${RECIPE_SYSROOT}::g;' ${PKGD}${bindir_crossscripts}/vapigen-wrapper + rm -rf ${PKGD}${bindir_crossscripts} } diff --git a/meta/recipes-devtools/valgrind/valgrind/remove-for-all b/meta/recipes-devtools/valgrind/valgrind/remove-for-all index cb8d10b18f..226f97b50e 100644 --- a/meta/recipes-devtools/valgrind/valgrind/remove-for-all +++ b/meta/recipes-devtools/valgrind/valgrind/remove-for-all @@ -1,8 +1,10 @@ none/tests/amd64/fb_test_amd64 gdbserver_tests/hginfo +memcheck/tests/linux/timerfd-syscall memcheck/tests/supp_unknown helgrind/tests/tls_threads drd/tests/bar_bad_xml drd/tests/pth_barrier_thr_cr drd/tests/thread_name_xml massif/tests/deep-D + diff --git a/meta/recipes-extended/bash/bash/0001-changes-to-SIGINT-handler-while-waiting-for-a-child-.patch b/meta/recipes-extended/bash/bash/0001-changes-to-SIGINT-handler-while-waiting-for-a-child-.patch new file mode 100644 index 0000000000..c12b4b7766 --- /dev/null +++ b/meta/recipes-extended/bash/bash/0001-changes-to-SIGINT-handler-while-waiting-for-a-child-.patch @@ -0,0 +1,229 @@ +From 7e84276e07c0835a8729d6fe1265e70eedb2a7f7 Mon Sep 17 00:00:00 2001 +From: Chet Ramey <chet.ramey@case.edu> +Date: Mon, 30 Oct 2023 12:16:07 -0400 +Subject: [PATCH] changes to SIGINT handler while waiting for a child; skip + vertical whitespace after translating an integer + +Upstream-Status: Backport +https://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=fe24a6a55e8850298b496c5b9d82f1866eba190e + +[Adjust and drop some codes to be applicable the tree] +Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> +--- + general.c | 5 +++-- + jobs.c | 26 ++++++++++++++++---------- + tests/redir.right | 4 ++-- + tests/redir11.sub | 2 ++ + tests/type.right | 16 ++++++++-------- + tests/type.tests | 24 ++++++++++++------------ + 6 files changed, 43 insertions(+), 34 deletions(-) + +diff --git a/general.c b/general.c +index 50d5216..68987e2 100644 +--- a/general.c ++++ b/general.c +@@ -262,8 +262,9 @@ legal_number (string, result) + if (errno || ep == string) + return 0; /* errno is set on overflow or underflow */ + +- /* Skip any trailing whitespace, since strtoimax does not. */ +- while (whitespace (*ep)) ++ /* Skip any trailing whitespace, since strtoimax does not, using the same ++ test that strtoimax uses for leading whitespace. */ ++ while (isspace ((unsigned char) *ep)) + ep++; + + /* If *string is not '\0' but *ep is '\0' on return, the entire string +diff --git a/jobs.c b/jobs.c +index 7c3b6e8..84dab4d 100644 +--- a/jobs.c ++++ b/jobs.c +@@ -2727,6 +2727,10 @@ wait_for_background_pids (ps) + #define INVALID_SIGNAL_HANDLER (SigHandler *)wait_for_background_pids + static SigHandler *old_sigint_handler = INVALID_SIGNAL_HANDLER; + ++/* The current SIGINT handler as set by restore_sigint_handler. Only valid ++ immediately after restore_sigint_handler, used for continuations. */ ++static SigHandler *cur_sigint_handler = INVALID_SIGNAL_HANDLER; ++ + static int wait_sigint_received; + static int child_caught_sigint; + +@@ -2743,6 +2747,7 @@ wait_sigint_cleanup () + static void + restore_sigint_handler () + { ++ cur_sigint_handler = old_sigint_handler; + if (old_sigint_handler != INVALID_SIGNAL_HANDLER) + { + set_signal_handler (SIGINT, old_sigint_handler); +@@ -2766,8 +2771,7 @@ wait_sigint_handler (sig) + restore_sigint_handler (); + /* If we got a SIGINT while in `wait', and SIGINT is trapped, do + what POSIX.2 says (see builtins/wait.def for more info). */ +- if (this_shell_builtin && this_shell_builtin == wait_builtin && +- signal_is_trapped (SIGINT) && ++ if (signal_is_trapped (SIGINT) && + ((sigint_handler = trap_to_sighandler (SIGINT)) == trap_handler)) + { + trap_handler (SIGINT); /* set pending_traps[SIGINT] */ +@@ -2792,6 +2796,8 @@ wait_sigint_handler (sig) + { + set_exit_status (128+SIGINT); + restore_sigint_handler (); ++ if (cur_sigint_handler == INVALID_SIGNAL_HANDLER) ++ set_sigint_handler (); /* XXX - only do this in one place */ + kill (getpid (), SIGINT); + } + +@@ -2934,15 +2940,15 @@ wait_for (pid, flags) + { + SigHandler *temp_sigint_handler; + +- temp_sigint_handler = set_signal_handler (SIGINT, wait_sigint_handler); +- if (temp_sigint_handler == wait_sigint_handler) +- { ++ temp_sigint_handler = old_sigint_handler; ++ old_sigint_handler = set_signal_handler (SIGINT, wait_sigint_handler); ++ if (old_sigint_handler == wait_sigint_handler) ++ { + #if defined (DEBUG) +- internal_warning ("wait_for: recursively setting old_sigint_handler to wait_sigint_handler: running_trap = %d", running_trap); ++ internal_debug ("wait_for: recursively setting old_sigint_handler to wait_sigint_handler: running_trap = %d", running_trap); + #endif +- } +- else +- old_sigint_handler = temp_sigint_handler; ++ old_sigint_handler = temp_sigint_handler; ++ } + waiting_for_child = 0; + if (old_sigint_handler == SIG_IGN) + set_signal_handler (SIGINT, old_sigint_handler); +@@ -4148,7 +4154,7 @@ set_job_status_and_cleanup (job) + SIGINT (if we reset the sighandler to the default). + In this case, we have to fix things up. What a crock. */ + if (temp_handler == trap_handler && signal_is_trapped (SIGINT) == 0) +- temp_handler = trap_to_sighandler (SIGINT); ++ temp_handler = trap_to_sighandler (SIGINT); + restore_sigint_handler (); + if (temp_handler == SIG_DFL) + termsig_handler (SIGINT); /* XXX */ +diff --git a/tests/redir.right b/tests/redir.right +index 8db1041..9e1403c 100644 +--- a/tests/redir.right ++++ b/tests/redir.right +@@ -154,10 +154,10 @@ foo + 1 + 7 + after: 42 +-./redir11.sub: line 53: $(ss= declare -i ss): ambiguous redirect ++./redir11.sub: line 55: $(ss= declare -i ss): ambiguous redirect + after: 42 + a+=3 + foo + foo +-./redir11.sub: line 75: 42: No such file or directory ++./redir11.sub: line 77: 42: No such file or directory + 42 +diff --git a/tests/redir11.sub b/tests/redir11.sub +index d417cdb..2a9f2b8 100644 +--- a/tests/redir11.sub ++++ b/tests/redir11.sub +@@ -56,6 +56,8 @@ foo() + a=4 b=7 foo + echo after: $a + ++exec 7>&- 4>&- ++ + unset a + typeset -i a + a=4 eval echo $(echo a+=3) +diff --git a/tests/type.right b/tests/type.right +index f876715..c09ab73 100644 +--- a/tests/type.right ++++ b/tests/type.right +@@ -24,15 +24,15 @@ func () + } + while + while is a shell keyword +-./type.tests: line 56: type: m: not found +-alias m='more' +-alias m='more' +-m is aliased to `more' ++./type.tests: line 56: type: morealias: not found ++alias morealias='more' ++alias morealias='more' ++morealias is aliased to `more' + alias +-alias m='more' +-alias m='more' +-alias m='more' +-m is aliased to `more' ++alias morealias='more' ++alias morealias='more' ++alias morealias='more' ++morealias is aliased to `more' + builtin + builtin is a shell builtin + /bin/sh +diff --git a/tests/type.tests b/tests/type.tests +index fd39c18..ddc1540 100644 +--- a/tests/type.tests ++++ b/tests/type.tests +@@ -25,8 +25,6 @@ type -r ${THIS_SH} + type notthere + command -v notthere + +-alias m=more +- + unset -f func 2>/dev/null + func() { echo this is func; } + +@@ -49,24 +47,26 @@ command -V func + command -v while + command -V while + ++alias morealias=more ++ + # the following two lines should produce the same output + # post-3.0 patch makes command -v silent, as posix specifies + # first test with alias expansion off (should all fail or produce no output) +-type -t m +-type m +-command -v m ++type -t morealias ++type morealias ++command -v morealias + alias -p +-alias m ++alias morealias + + # then test with alias expansion on + shopt -s expand_aliases +-type m +-type -t m +-command -v m ++type morealias ++type -t morealias ++command -v morealias + alias -p +-alias m ++alias morealias + +-command -V m ++command -V morealias + shopt -u expand_aliases + + command -v builtin +@@ -76,7 +76,7 @@ command -V /bin/sh + + unset -f func + type func +-unalias m ++unalias morealias + type m + + hash -r +-- +2.25.1 + diff --git a/meta/recipes-extended/bash/bash_5.1.16.bb b/meta/recipes-extended/bash/bash_5.1.16.bb index 11c2314fbf..ab1ecffb3d 100644 --- a/meta/recipes-extended/bash/bash_5.1.16.bb +++ b/meta/recipes-extended/bash/bash_5.1.16.bb @@ -16,6 +16,7 @@ SRC_URI = "${GNU_MIRROR}/bash/${BP}.tar.gz;name=tarball \ file://makerace.patch \ file://makerace2.patch \ file://CVE-2022-3715.patch \ + file://0001-changes-to-SIGINT-handler-while-waiting-for-a-child-.patch \ " SRC_URI[tarball.sha256sum] = "5bac17218d3911834520dad13cd1f85ab944e1c09ae1aba55906be1f8192f558" diff --git a/meta/recipes-extended/cpio/cpio-2.13/0001-Unset-need_charset_alias-when-building-for-musl.patch b/meta/recipes-extended/cpio/cpio-2.13/0001-Unset-need_charset_alias-when-building-for-musl.patch deleted file mode 100644 index 6ae213942c..0000000000 --- a/meta/recipes-extended/cpio/cpio-2.13/0001-Unset-need_charset_alias-when-building-for-musl.patch +++ /dev/null @@ -1,30 +0,0 @@ -From b9565dc2fe0c4f7daaec91b7e83bc7313dee2f4a Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@gmail.com> -Date: Mon, 13 Apr 2015 17:02:13 -0700 -Subject: [PATCH] Unset need_charset_alias when building for musl - -localcharset uses ac_cv_gnu_library_2_1 from glibc21.m4 -which actually shoudl be fixed in gnulib and then all downstream -projects will get it eventually. For now we apply the fix to -coreutils - -Upstream-Status: Pending - -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - lib/gnulib.mk | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -Index: cpio-2.11/gnu/Makefile.am -=================================================================== ---- cpio-2.11.orig/gnu/Makefile.am -+++ cpio-2.11/gnu/Makefile.am -@@ -734,7 +734,7 @@ install-exec-localcharset: all-local - case '$(host_os)' in \ - darwin[56]*) \ - need_charset_alias=true ;; \ -- darwin* | cygwin* | mingw* | pw32* | cegcc*) \ -+ darwin* | cygwin* | mingw* | pw32* | cegcc* | linux-musl*) \ - need_charset_alias=false ;; \ - *) \ - need_charset_alias=true ;; \ diff --git a/meta/recipes-extended/cpio/cpio-2.13/0002-src-global.c-Remove-superfluous-declaration-of-progr.patch b/meta/recipes-extended/cpio/cpio-2.13/0002-src-global.c-Remove-superfluous-declaration-of-progr.patch deleted file mode 100644 index 478324c1c4..0000000000 --- a/meta/recipes-extended/cpio/cpio-2.13/0002-src-global.c-Remove-superfluous-declaration-of-progr.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 33e6cb5a28fab3d99bd6818f8c01e6f33805390f Mon Sep 17 00:00:00 2001 -From: Sergey Poznyakoff <gray@gnu.org> -Date: Mon, 20 Jan 2020 07:45:39 +0200 -Subject: [PATCH] src/global.c: Remove superfluous declaration of program_name - -Upstream-Status: Backport (commit 641d3f4) -Signed-off-by: Richard Leitner <richard.leitner@skidata.com> ---- - src/global.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/src/global.c b/src/global.c -index fb3abe9..acf92bc 100644 ---- a/src/global.c -+++ b/src/global.c -@@ -184,9 +184,6 @@ unsigned int warn_option = 0; - /* Extract to standard output? */ - bool to_stdout_option = false; - --/* The name this program was run with. */ --char *program_name; -- - /* A pointer to either lstat or stat, depending on whether - dereferencing of symlinks is done for input files. */ - int (*xstat) (); --- -2.26.2 - diff --git a/meta/recipes-extended/cpio/cpio-2.13/CVE-2021-38185.patch b/meta/recipes-extended/cpio/cpio-2.13/CVE-2021-38185.patch deleted file mode 100644 index 6ceafeee49..0000000000 --- a/meta/recipes-extended/cpio/cpio-2.13/CVE-2021-38185.patch +++ /dev/null @@ -1,581 +0,0 @@ -GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted -pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers -an out-of-bounds heap write. - -CVE: CVE-2021-38185 -Upstream-Status: Backport -Signed-off-by: Ross Burton <ross.burton@arm.com> - -From e494c68a3a0951b1eaba77e2db93f71a890e15d8 Mon Sep 17 00:00:00 2001 -From: Sergey Poznyakoff <gray@gnu.org> -Date: Sat, 7 Aug 2021 12:52:21 +0300 -Subject: [PATCH 1/3] Rewrite dynamic string support. - -* src/dstring.c (ds_init): Take a single argument. -(ds_free): New function. -(ds_resize): Take a single argument. Use x2nrealloc to expand -the storage. -(ds_reset,ds_append,ds_concat,ds_endswith): New function. -(ds_fgetstr): Rewrite. In particular, this fixes integer overflow. -* src/dstring.h (dynamic_string): Keep both the allocated length -(ds_size) and index of the next free byte in the string (ds_idx). -(ds_init,ds_resize): Change signature. -(ds_len): New macro. -(ds_free,ds_reset,ds_append,ds_concat,ds_endswith): New protos. -* src/copyin.c: Use new ds_ functions. -* src/copyout.c: Likewise. -* src/copypass.c: Likewise. -* src/util.c: Likewise. ---- - src/copyin.c | 40 +++++++++++------------ - src/copyout.c | 16 ++++----- - src/copypass.c | 34 +++++++++---------- - src/dstring.c | 88 ++++++++++++++++++++++++++++++++++++-------------- - src/dstring.h | 31 +++++++++--------- - src/util.c | 6 ++-- - 6 files changed, 123 insertions(+), 92 deletions(-) - -diff --git a/src/copyin.c b/src/copyin.c -index b29f348..37e503a 100644 ---- a/src/copyin.c -+++ b/src/copyin.c -@@ -55,11 +55,12 @@ query_rename(struct cpio_file_stat* file_hdr, FILE *tty_in, FILE *tty_out, - char *str_res; /* Result for string function. */ - static dynamic_string new_name; /* New file name for rename option. */ - static int initialized_new_name = false; -+ - if (!initialized_new_name) -- { -- ds_init (&new_name, 128); -- initialized_new_name = true; -- } -+ { -+ ds_init (&new_name); -+ initialized_new_name = true; -+ } - - if (rename_flag) - { -@@ -779,37 +780,36 @@ long_format (struct cpio_file_stat *file_hdr, char const *link_name) - already in `save_patterns' (from the command line) are preserved. */ - - static void --read_pattern_file () -+read_pattern_file (void) - { -- int max_new_patterns; -- char **new_save_patterns; -- int new_num_patterns; -+ char **new_save_patterns = NULL; -+ size_t max_new_patterns; -+ size_t new_num_patterns; - int i; -- dynamic_string pattern_name; -+ dynamic_string pattern_name = DYNAMIC_STRING_INITIALIZER; - FILE *pattern_fp; - - if (num_patterns < 0) - num_patterns = 0; -- max_new_patterns = 1 + num_patterns; -- new_save_patterns = (char **) xmalloc (max_new_patterns * sizeof (char *)); - new_num_patterns = num_patterns; -- ds_init (&pattern_name, 128); -+ max_new_patterns = num_patterns; -+ new_save_patterns = xcalloc (max_new_patterns, sizeof (new_save_patterns[0])); - - pattern_fp = fopen (pattern_file_name, "r"); - if (pattern_fp == NULL) - open_fatal (pattern_file_name); - while (ds_fgetstr (pattern_fp, &pattern_name, '\n') != NULL) - { -- if (new_num_patterns >= max_new_patterns) -- { -- max_new_patterns += 1; -- new_save_patterns = (char **) -- xrealloc ((char *) new_save_patterns, -- max_new_patterns * sizeof (char *)); -- } -+ if (new_num_patterns == max_new_patterns) -+ new_save_patterns = x2nrealloc (new_save_patterns, -+ &max_new_patterns, -+ sizeof (new_save_patterns[0])); - new_save_patterns[new_num_patterns] = xstrdup (pattern_name.ds_string); - ++new_num_patterns; - } -+ -+ ds_free (&pattern_name); -+ - if (ferror (pattern_fp) || fclose (pattern_fp) == EOF) - close_error (pattern_file_name); - -@@ -1196,7 +1196,7 @@ swab_array (char *ptr, int count) - in the file system. */ - - void --process_copy_in () -+process_copy_in (void) - { - char done = false; /* True if trailer reached. */ - FILE *tty_in = NULL; /* Interactive file for rename option. */ -diff --git a/src/copyout.c b/src/copyout.c -index 8b0beb6..26e3dda 100644 ---- a/src/copyout.c -+++ b/src/copyout.c -@@ -594,9 +594,10 @@ assign_string (char **pvar, char *value) - The format of the header depends on the compatibility (-c) flag. */ - - void --process_copy_out () -+process_copy_out (void) - { -- dynamic_string input_name; /* Name of file read from stdin. */ -+ dynamic_string input_name = DYNAMIC_STRING_INITIALIZER; -+ /* Name of file read from stdin. */ - struct stat file_stat; /* Stat record for file. */ - struct cpio_file_stat file_hdr = CPIO_FILE_STAT_INITIALIZER; - /* Output header information. */ -@@ -605,7 +606,6 @@ process_copy_out () - char *orig_file_name = NULL; - - /* Initialize the copy out. */ -- ds_init (&input_name, 128); - file_hdr.c_magic = 070707; - - /* Check whether the output file might be a tape. */ -@@ -657,14 +657,9 @@ process_copy_out () - { - if (file_hdr.c_mode & CP_IFDIR) - { -- int len = strlen (input_name.ds_string); - /* Make sure the name ends with a slash */ -- if (input_name.ds_string[len-1] != '/') -- { -- ds_resize (&input_name, len + 2); -- input_name.ds_string[len] = '/'; -- input_name.ds_string[len+1] = 0; -- } -+ if (!ds_endswith (&input_name, '/')) -+ ds_append (&input_name, '/'); - } - } - -@@ -875,6 +870,7 @@ process_copy_out () - (unsigned long) blocks), (unsigned long) blocks); - } - cpio_file_stat_free (&file_hdr); -+ ds_free (&input_name); - } - - -diff --git a/src/copypass.c b/src/copypass.c -index dc13b5b..62f31c6 100644 ---- a/src/copypass.c -+++ b/src/copypass.c -@@ -48,10 +48,12 @@ set_copypass_perms (int fd, const char *name, struct stat *st) - If `link_flag', link instead of copying. */ - - void --process_copy_pass () -+process_copy_pass (void) - { -- dynamic_string input_name; /* Name of file from stdin. */ -- dynamic_string output_name; /* Name of new file. */ -+ dynamic_string input_name = DYNAMIC_STRING_INITIALIZER; -+ /* Name of file from stdin. */ -+ dynamic_string output_name = DYNAMIC_STRING_INITIALIZER; -+ /* Name of new file. */ - size_t dirname_len; /* Length of `directory_name'. */ - int res; /* Result of functions. */ - char *slash; /* For moving past slashes in input name. */ -@@ -65,25 +67,18 @@ process_copy_pass () - created files */ - - /* Initialize the copy pass. */ -- ds_init (&input_name, 128); - - dirname_len = strlen (directory_name); - if (change_directory_option && !ISSLASH (directory_name[0])) - { - char *pwd = xgetcwd (); -- -- dirname_len += strlen (pwd) + 1; -- ds_init (&output_name, dirname_len + 2); -- strcpy (output_name.ds_string, pwd); -- strcat (output_name.ds_string, "/"); -- strcat (output_name.ds_string, directory_name); -+ -+ ds_concat (&output_name, pwd); -+ ds_append (&output_name, '/'); - } -- else -- { -- ds_init (&output_name, dirname_len + 2); -- strcpy (output_name.ds_string, directory_name); -- } -- output_name.ds_string[dirname_len] = '/'; -+ ds_concat (&output_name, directory_name); -+ ds_append (&output_name, '/'); -+ dirname_len = ds_len (&output_name); - output_is_seekable = true; - - change_dir (); -@@ -116,8 +111,8 @@ process_copy_pass () - /* Make the name of the new file. */ - for (slash = input_name.ds_string; *slash == '/'; ++slash) - ; -- ds_resize (&output_name, dirname_len + strlen (slash) + 2); -- strcpy (output_name.ds_string + dirname_len + 1, slash); -+ ds_reset (&output_name, dirname_len); -+ ds_concat (&output_name, slash); - - existing_dir = false; - if (lstat (output_name.ds_string, &out_file_stat) == 0) -@@ -333,6 +328,9 @@ process_copy_pass () - (unsigned long) blocks), - (unsigned long) blocks); - } -+ -+ ds_free (&input_name); -+ ds_free (&output_name); - } - - /* Try and create a hard link from FILE_NAME to another file -diff --git a/src/dstring.c b/src/dstring.c -index e9c063f..358f356 100644 ---- a/src/dstring.c -+++ b/src/dstring.c -@@ -20,8 +20,8 @@ - #if defined(HAVE_CONFIG_H) - # include <config.h> - #endif -- - #include <stdio.h> -+#include <stdlib.h> - #if defined(HAVE_STRING_H) || defined(STDC_HEADERS) - #include <string.h> - #else -@@ -33,24 +33,41 @@ - /* Initialiaze dynamic string STRING with space for SIZE characters. */ - - void --ds_init (dynamic_string *string, int size) -+ds_init (dynamic_string *string) -+{ -+ memset (string, 0, sizeof *string); -+} -+ -+/* Free the dynamic string storage. */ -+ -+void -+ds_free (dynamic_string *string) - { -- string->ds_length = size; -- string->ds_string = (char *) xmalloc (size); -+ free (string->ds_string); - } - --/* Expand dynamic string STRING, if necessary, to hold SIZE characters. */ -+/* Expand dynamic string STRING, if necessary. */ - - void --ds_resize (dynamic_string *string, int size) -+ds_resize (dynamic_string *string) - { -- if (size > string->ds_length) -+ if (string->ds_idx == string->ds_size) - { -- string->ds_length = size; -- string->ds_string = (char *) xrealloc ((char *) string->ds_string, size); -+ string->ds_string = x2nrealloc (string->ds_string, &string->ds_size, -+ 1); - } - } - -+/* Reset the index of the dynamic string S to LEN. */ -+ -+void -+ds_reset (dynamic_string *s, size_t len) -+{ -+ while (len > s->ds_size) -+ ds_resize (s); -+ s->ds_idx = len; -+} -+ - /* Dynamic string S gets a string terminated by the EOS character - (which is removed) from file F. S will increase - in size during the function if the string from F is longer than -@@ -61,34 +78,50 @@ ds_resize (dynamic_string *string, int size) - char * - ds_fgetstr (FILE *f, dynamic_string *s, char eos) - { -- int insize; /* Amount needed for line. */ -- int strsize; /* Amount allocated for S. */ - int next_ch; - - /* Initialize. */ -- insize = 0; -- strsize = s->ds_length; -+ s->ds_idx = 0; - - /* Read the input string. */ -- next_ch = getc (f); -- while (next_ch != eos && next_ch != EOF) -+ while ((next_ch = getc (f)) != eos && next_ch != EOF) - { -- if (insize >= strsize - 1) -- { -- ds_resize (s, strsize * 2 + 2); -- strsize = s->ds_length; -- } -- s->ds_string[insize++] = next_ch; -- next_ch = getc (f); -+ ds_resize (s); -+ s->ds_string[s->ds_idx++] = next_ch; - } -- s->ds_string[insize++] = '\0'; -+ ds_resize (s); -+ s->ds_string[s->ds_idx] = '\0'; - -- if (insize == 1 && next_ch == EOF) -+ if (s->ds_idx == 0 && next_ch == EOF) - return NULL; - else - return s->ds_string; - } - -+void -+ds_append (dynamic_string *s, int c) -+{ -+ ds_resize (s); -+ s->ds_string[s->ds_idx] = c; -+ if (c) -+ { -+ s->ds_idx++; -+ ds_resize (s); -+ s->ds_string[s->ds_idx] = 0; -+ } -+} -+ -+void -+ds_concat (dynamic_string *s, char const *str) -+{ -+ size_t len = strlen (str); -+ while (len + 1 > s->ds_size) -+ ds_resize (s); -+ memcpy (s->ds_string + s->ds_idx, str, len); -+ s->ds_idx += len; -+ s->ds_string[s->ds_idx] = 0; -+} -+ - char * - ds_fgets (FILE *f, dynamic_string *s) - { -@@ -100,3 +133,10 @@ ds_fgetname (FILE *f, dynamic_string *s) - { - return ds_fgetstr (f, s, '\0'); - } -+ -+/* Return true if the dynamic string S ends with character C. */ -+int -+ds_endswith (dynamic_string *s, int c) -+{ -+ return (s->ds_idx > 0 && s->ds_string[s->ds_idx - 1] == c); -+} -diff --git a/src/dstring.h b/src/dstring.h -index b5135fe..f5b04ef 100644 ---- a/src/dstring.h -+++ b/src/dstring.h -@@ -17,10 +17,6 @@ - Software Foundation, Inc., 51 Franklin Street, Fifth Floor, - Boston, MA 02110-1301 USA. */ - --#ifndef NULL --#define NULL 0 --#endif -- - /* A dynamic string consists of record that records the size of an - allocated string and the pointer to that string. The actual string - is a normal zero byte terminated string that can be used with the -@@ -30,22 +26,25 @@ - - typedef struct - { -- int ds_length; /* Actual amount of storage allocated. */ -- char *ds_string; /* String. */ -+ size_t ds_size; /* Actual amount of storage allocated. */ -+ size_t ds_idx; /* Index of the next free byte in the string. */ -+ char *ds_string; /* String storage. */ - } dynamic_string; - -+#define DYNAMIC_STRING_INITIALIZER { 0, 0, NULL } - --/* Macros that look similar to the original string functions. -- WARNING: These macros work only on pointers to dynamic string records. -- If used with a real record, an "&" must be used to get the pointer. */ --#define ds_strlen(s) strlen ((s)->ds_string) --#define ds_strcmp(s1, s2) strcmp ((s1)->ds_string, (s2)->ds_string) --#define ds_strncmp(s1, s2, n) strncmp ((s1)->ds_string, (s2)->ds_string, n) --#define ds_index(s, c) index ((s)->ds_string, c) --#define ds_rindex(s, c) rindex ((s)->ds_string, c) -+void ds_init (dynamic_string *string); -+void ds_free (dynamic_string *string); -+void ds_reset (dynamic_string *s, size_t len); - --void ds_init (dynamic_string *string, int size); --void ds_resize (dynamic_string *string, int size); -+/* All functions below guarantee that s->ds_string[s->ds_idx] == '\0' */ - char *ds_fgetname (FILE *f, dynamic_string *s); - char *ds_fgets (FILE *f, dynamic_string *s); - char *ds_fgetstr (FILE *f, dynamic_string *s, char eos); -+void ds_append (dynamic_string *s, int c); -+void ds_concat (dynamic_string *s, char const *str); -+ -+#define ds_len(s) ((s)->ds_idx) -+ -+int ds_endswith (dynamic_string *s, int c); -+ -diff --git a/src/util.c b/src/util.c -index 4421b20..6d6bbaa 100644 ---- a/src/util.c -+++ b/src/util.c -@@ -846,11 +846,9 @@ get_next_reel (int tape_des) - FILE *tty_out; /* File for interacting with user. */ - int old_tape_des; - char *next_archive_name; -- dynamic_string new_name; -+ dynamic_string new_name = DYNAMIC_STRING_INITIALIZER; - char *str_res; - -- ds_init (&new_name, 128); -- - /* Open files for interactive communication. */ - tty_in = fopen (TTY_NAME, "r"); - if (tty_in == NULL) -@@ -925,7 +923,7 @@ get_next_reel (int tape_des) - error (PAXEXIT_FAILURE, 0, _("internal error: tape descriptor changed from %d to %d"), - old_tape_des, tape_des); - -- free (new_name.ds_string); -+ ds_free (&new_name); - fclose (tty_in); - fclose (tty_out); - } --- -2.25.1 - - -From fb7a51bf85b8e6f045cacb4fb783db4a414741bf Mon Sep 17 00:00:00 2001 -From: Sergey Poznyakoff <gray@gnu.org> -Date: Wed, 11 Aug 2021 18:10:38 +0300 -Subject: [PATCH 2/3] Fix previous commit - -* src/dstring.c (ds_reset,ds_concat): Don't call ds_resize in a -loop. ---- - src/dstring.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/dstring.c b/src/dstring.c -index 358f356..90c691c 100644 ---- a/src/dstring.c -+++ b/src/dstring.c -@@ -64,7 +64,7 @@ void - ds_reset (dynamic_string *s, size_t len) - { - while (len > s->ds_size) -- ds_resize (s); -+ s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1); - s->ds_idx = len; - } - -@@ -116,7 +116,7 @@ ds_concat (dynamic_string *s, char const *str) - { - size_t len = strlen (str); - while (len + 1 > s->ds_size) -- ds_resize (s); -+ s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1); - memcpy (s->ds_string + s->ds_idx, str, len); - s->ds_idx += len; - s->ds_string[s->ds_idx] = 0; --- -2.25.1 - - -From 86b37d74b15f9bb5fe62fd1642cc126d3ace0189 Mon Sep 17 00:00:00 2001 -From: Sergey Poznyakoff <gray@gnu.org> -Date: Wed, 18 Aug 2021 09:41:39 +0300 -Subject: [PATCH 3/3] Fix dynamic string reallocations - -* src/dstring.c (ds_resize): Take additional argument: number of -bytes to leave available after ds_idx. All uses changed. ---- - src/dstring.c | 18 ++++++++---------- - 1 file changed, 8 insertions(+), 10 deletions(-) - -diff --git a/src/dstring.c b/src/dstring.c -index 90c691c..0f597cc 100644 ---- a/src/dstring.c -+++ b/src/dstring.c -@@ -49,9 +49,9 @@ ds_free (dynamic_string *string) - /* Expand dynamic string STRING, if necessary. */ - - void --ds_resize (dynamic_string *string) -+ds_resize (dynamic_string *string, size_t len) - { -- if (string->ds_idx == string->ds_size) -+ while (len + string->ds_idx >= string->ds_size) - { - string->ds_string = x2nrealloc (string->ds_string, &string->ds_size, - 1); -@@ -63,8 +63,7 @@ ds_resize (dynamic_string *string) - void - ds_reset (dynamic_string *s, size_t len) - { -- while (len > s->ds_size) -- s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1); -+ ds_resize (s, len); - s->ds_idx = len; - } - -@@ -86,10 +85,10 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos) - /* Read the input string. */ - while ((next_ch = getc (f)) != eos && next_ch != EOF) - { -- ds_resize (s); -+ ds_resize (s, 0); - s->ds_string[s->ds_idx++] = next_ch; - } -- ds_resize (s); -+ ds_resize (s, 0); - s->ds_string[s->ds_idx] = '\0'; - - if (s->ds_idx == 0 && next_ch == EOF) -@@ -101,12 +100,12 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos) - void - ds_append (dynamic_string *s, int c) - { -- ds_resize (s); -+ ds_resize (s, 0); - s->ds_string[s->ds_idx] = c; - if (c) - { - s->ds_idx++; -- ds_resize (s); -+ ds_resize (s, 0); - s->ds_string[s->ds_idx] = 0; - } - } -@@ -115,8 +114,7 @@ void - ds_concat (dynamic_string *s, char const *str) - { - size_t len = strlen (str); -- while (len + 1 > s->ds_size) -- s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1); -+ ds_resize (s, len); - memcpy (s->ds_string + s->ds_idx, str, len); - s->ds_idx += len; - s->ds_string[s->ds_idx] = 0; --- -2.25.1 - diff --git a/meta/recipes-extended/cpio/cpio_2.13.bb b/meta/recipes-extended/cpio/cpio_2.14.bb index e72a114de9..c0b97ee166 100644 --- a/meta/recipes-extended/cpio/cpio_2.13.bb +++ b/meta/recipes-extended/cpio/cpio_2.14.bb @@ -7,13 +7,10 @@ LICENSE = "GPL-3.0-only" LIC_FILES_CHKSUM = "file://COPYING;md5=f27defe1e96c2e1ecd4e0c9be8967949" SRC_URI = "${GNU_MIRROR}/cpio/cpio-${PV}.tar.gz \ - file://0001-Unset-need_charset_alias-when-building-for-musl.patch \ - file://0002-src-global.c-Remove-superfluous-declaration-of-progr.patch \ - file://CVE-2021-38185.patch \ + file://0001-configure-Include-needed-header-for-major-minor-macr.patch \ " -SRC_URI[md5sum] = "389c5452d667c23b5eceb206f5000810" -SRC_URI[sha256sum] = "e87470d9c984317f658567c03bfefb6b0c829ff17dbf6b0de48d71a4c8f3db88" +SRC_URI[sha256sum] = "145a340fd9d55f0b84779a44a12d5f79d77c99663967f8cfa168d7905ca52454" inherit autotools gettext texinfo diff --git a/meta/recipes-extended/cpio/files/0001-configure-Include-needed-header-for-major-minor-macr.patch b/meta/recipes-extended/cpio/files/0001-configure-Include-needed-header-for-major-minor-macr.patch new file mode 100644 index 0000000000..360dd1ebd8 --- /dev/null +++ b/meta/recipes-extended/cpio/files/0001-configure-Include-needed-header-for-major-minor-macr.patch @@ -0,0 +1,47 @@ +From 8179be21e664cedb2e9d238cc2f6d04965e97275 Mon Sep 17 00:00:00 2001 +From: Sergey Poznyakoff <gray@gnu.org> +Date: Thu, 11 May 2023 10:18:44 +0300 +Subject: [PATCH] configure: Include needed header for major/minor macros + +This helps in avoiding the warning about implicit function declaration +which is elevated as error with newer compilers e.g. clang 16 + +Signed-off-by: Khem Raj <raj.khem@gmail.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=8179be21e664cedb2e9d238cc2f6d04965e97275] +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + configure.ac | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/configure.ac b/configure.ac +index de479e7..c601029 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -43,8 +43,22 @@ AC_TYPE_UID_T + AC_CHECK_TYPE(gid_t, int) + + AC_HEADER_DIRENT +-AX_COMPILE_CHECK_RETTYPE([major], [0]) +-AX_COMPILE_CHECK_RETTYPE([minor], [0]) ++AX_COMPILE_CHECK_RETTYPE([major], [0], [ ++#include <sys/types.h> ++#ifdef MAJOR_IN_MKDEV ++# include <sys/mkdev.h> ++#endif ++#ifdef MAJOR_IN_SYSMACROS ++# include <sys/sysmacros.h> ++#endif]) ++AX_COMPILE_CHECK_RETTYPE([minor], [0], [ ++#include <sys/types.h> ++#ifdef MAJOR_IN_MKDEV ++# include <sys/mkdev.h> ++#endif ++#ifdef MAJOR_IN_SYSMACROS ++# include <sys/sysmacros.h> ++#endif]) + + AC_CHECK_FUNCS([fchmod fchown]) + # This is needed for mingw build +-- +2.34.1 diff --git a/meta/recipes-extended/cracklib/cracklib_2.9.8.bb b/meta/recipes-extended/cracklib/cracklib_2.9.8.bb index 786940a7e0..a3db6eb394 100644 --- a/meta/recipes-extended/cracklib/cracklib_2.9.8.bb +++ b/meta/recipes-extended/cracklib/cracklib_2.9.8.bb @@ -9,7 +9,7 @@ DEPENDS = "cracklib-native zlib" EXTRA_OECONF = "--without-python --libdir=${base_libdir}" -SRC_URI = "git://github.com/cracklib/cracklib;protocol=https;branch=master \ +SRC_URI = "git://github.com/cracklib/cracklib;protocol=https;branch=main \ file://0001-packlib.c-support-dictionary-byte-order-dependent.patch \ file://0002-craklib-fix-testnum-and-teststr-failed.patch \ " diff --git a/meta/recipes-extended/cups/cups.inc b/meta/recipes-extended/cups/cups.inc index 4592980766..047ab33898 100644 --- a/meta/recipes-extended/cups/cups.inc +++ b/meta/recipes-extended/cups/cups.inc @@ -15,6 +15,10 @@ SRC_URI = "https://github.com/OpenPrinting/cups/releases/download/v${PV}/cups-${ file://0004-cups-fix-multilib-install-file-conflicts.patch \ file://volatiles.99_cups \ file://cups-volatiles.conf \ + file://CVE-2023-32324.patch \ + file://CVE-2023-34241.patch \ + file://CVE-2023-32360.patch \ + file://CVE-2023-4504.patch \ " UPSTREAM_CHECK_URI = "https://github.com/OpenPrinting/cups/releases" @@ -48,6 +52,7 @@ PACKAGECONFIG[gnutls] = "--with-tls=gnutls,--with-tls=no,gnutls" PACKAGECONFIG[pam] = "--enable-pam --with-pam-module=unix, --disable-pam, libpam" PACKAGECONFIG[systemd] = "--with-systemd=${systemd_system_unitdir},--without-systemd,systemd" PACKAGECONFIG[xinetd] = "--with-xinetd=${sysconfdir}/xinetd.d,--without-xinetd,xinetd" +PACKAGECONFIG[webif] = "--enable-webif,--disable-webif" EXTRA_OECONF = " \ --enable-dbus \ @@ -67,7 +72,7 @@ EXTRA_OECONF = " \ EXTRA_AUTORECONF += "--exclude=autoheader" do_install () { - oe_runmake "DESTDIR=${D}" install + oe_runmake "BUILDROOT=${D}" install # Remove /var/run from package as cupsd will populate it on startup rm -fr ${D}/${localstatedir}/run @@ -75,7 +80,7 @@ do_install () { rmdir ${D}/${libexecdir}/${BPN}/driver # Fix the pam configuration file permissions - if ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'true', 'false', d)}; then + if ${@bb.utils.contains('PACKAGECONFIG', 'pam', 'true', 'false', d)}; then chmod 0644 ${D}${sysconfdir}/pam.d/cups fi @@ -93,7 +98,7 @@ do_install () { fi } -PACKAGES =+ "${PN}-lib ${PN}-libimage" +PACKAGES =+ "${PN}-lib ${PN}-libimage ${PN}-webif" RDEPENDS:${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'procps', '', d)}" FILES:${PN} += "${libexecdir}/cups/" @@ -102,13 +107,10 @@ FILES:${PN}-lib = "${libdir}/libcups.so.*" FILES:${PN}-libimage = "${libdir}/libcupsimage.so.*" -#package the html for the webgui inside the main packages (~1MB uncompressed) +# put the html for the web interface into its own PACKAGE +FILES:${PN}-webif += "${datadir}/doc/cups/ ${datadir}/icons/" +RRECOMMENDS:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'webif', '${PN}-webif', '', d)}" -FILES:${PN} += "${datadir}/doc/cups/images \ - ${datadir}/doc/cups/*html \ - ${datadir}/doc/cups/*.css \ - ${datadir}/icons/ \ - " CONFFILES:${PN} += "${sysconfdir}/cups/cupsd.conf" MULTILIB_SCRIPTS = "${PN}-dev:${bindir}/cups-config" diff --git a/meta/recipes-extended/cups/cups/CVE-2023-32324.patch b/meta/recipes-extended/cups/cups/CVE-2023-32324.patch new file mode 100644 index 0000000000..40b89c9899 --- /dev/null +++ b/meta/recipes-extended/cups/cups/CVE-2023-32324.patch @@ -0,0 +1,36 @@ +From 07cbffd11107eed3aaf1c64e35552aec20f792da Mon Sep 17 00:00:00 2001 +From: Zdenek Dohnal <zdohnal@redhat.com> +Date: Thu, 1 Jun 2023 12:04:00 +0200 +Subject: [PATCH] cups/string.c: Return if `size` is 0 (fixes CVE-2023-32324) + +CVE: CVE-2023-32324 +Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/fd8bc2d32589] + +(cherry picked from commit fd8bc2d32589d1fd91fe1c0521be2a7c0462109e) +Signed-off-by: Sanjay Chitroda <schitrod@cisco.com> +--- + cups/string.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/cups/string.c b/cups/string.c +index 93cdad19..6ef58515 100644 +--- a/cups/string.c ++++ b/cups/string.c +@@ -1,6 +1,7 @@ + /* + * String functions for CUPS. + * ++ * Copyright © 2023 by OpenPrinting. + * Copyright © 2007-2019 by Apple Inc. + * Copyright © 1997-2007 by Easy Software Products. + * +@@ -730,6 +731,9 @@ _cups_strlcpy(char *dst, /* O - Destination string */ + size_t srclen; /* Length of source string */ + + ++ if (size == 0) ++ return (0); ++ + /* + * Figure out how much room is needed... + */ diff --git a/meta/recipes-extended/cups/cups/CVE-2023-32360.patch b/meta/recipes-extended/cups/cups/CVE-2023-32360.patch new file mode 100644 index 0000000000..c3db722f1f --- /dev/null +++ b/meta/recipes-extended/cups/cups/CVE-2023-32360.patch @@ -0,0 +1,35 @@ +From a0c8b9c9556882f00c68b9727a95a1b6d1452913 Mon Sep 17 00:00:00 2001 +From: Michael R Sweet <michael.r.sweet@gmail.com> +Date: Thu, 14 Sep 2023 09:16:45 +0000 +Subject: [PATCH] Require authentication for CUPS-Get-Document. + +CVE: CVE-2023-32360 + +Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + conf/cupsd.conf.in | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/conf/cupsd.conf.in b/conf/cupsd.conf.in +index b258849..08f5070 100644 +--- a/conf/cupsd.conf.in ++++ b/conf/cupsd.conf.in +@@ -68,7 +68,13 @@ IdleExitTimeout @EXIT_TIMEOUT@ + Order deny,allow + </Limit> + +- <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document> ++ <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job> ++ Require user @OWNER @SYSTEM ++ Order deny,allow ++ </Limit> ++ ++ <Limit CUPS-Get-Document> ++ AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + </Limit> +-- +2.35.5 diff --git a/meta/recipes-extended/cups/cups/CVE-2023-34241.patch b/meta/recipes-extended/cups/cups/CVE-2023-34241.patch new file mode 100644 index 0000000000..95b3925b36 --- /dev/null +++ b/meta/recipes-extended/cups/cups/CVE-2023-34241.patch @@ -0,0 +1,68 @@ +From ffd290b4ab247f82722927ba9b21358daa16dbf1 Mon Sep 17 00:00:00 2001 +From: Rose <83477269+AtariDreams@users.noreply.github.com> +Date: Thu, 1 Jun 2023 11:33:39 -0400 +Subject: [PATCH] Log result of httpGetHostname BEFORE closing the connection + +httpClose frees the memory of con->http. This is problematic because httpGetHostname then tries to access the memory it points to. + +We have to log the hostname first. + +Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/9809947a959e18409dcf562a3466ef246cb90cb2] +CVE: CVE-2023-34241 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + scheduler/client.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/scheduler/client.c b/scheduler/client.c +index e7e419f..441c1d7 100644 +--- a/scheduler/client.c ++++ b/scheduler/client.c +@@ -193,13 +193,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + /* + * Can't have an unresolved IP address with double-lookups enabled... + */ +- +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, +- "Name lookup failed - connection from %s closed!", ++ "Name lookup failed - closing connection from %s!", + httpGetHostname(con->http, NULL, 0)); + ++ httpClose(con->http); + free(con); + return; + } +@@ -235,11 +233,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + * with double-lookups enabled... + */ + +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, +- "IP lookup failed - connection from %s closed!", ++ "IP lookup failed - closing connection from %s!", + httpGetHostname(con->http, NULL, 0)); ++ ++ httpClose(con->http); + free(con); + return; + } +@@ -256,11 +254,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + + if (!hosts_access(&wrap_req)) + { +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, + "Connection from %s refused by /etc/hosts.allow and " + "/etc/hosts.deny rules.", httpGetHostname(con->http, NULL, 0)); ++ ++ httpClose(con->http); + free(con); + return; + } +-- +2.25.1 + diff --git a/meta/recipes-extended/cups/cups/CVE-2023-4504.patch b/meta/recipes-extended/cups/cups/CVE-2023-4504.patch new file mode 100644 index 0000000000..e52e43a209 --- /dev/null +++ b/meta/recipes-extended/cups/cups/CVE-2023-4504.patch @@ -0,0 +1,42 @@ +CVE: CVE-2023-4504 +Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/2431caddb7e6a87f04ac90b5c6366ad268b6ff31 ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +From 2431caddb7e6a87f04ac90b5c6366ad268b6ff31 Mon Sep 17 00:00:00 2001 +From: Zdenek Dohnal <zdohnal@redhat.com> +Date: Wed, 20 Sep 2023 14:45:17 +0200 +Subject: [PATCH] raster-interpret.c: Fix CVE-2023-4504 + +We didn't check for end of buffer if it looks there is an escaped +character - check for NULL terminator there and if found, return NULL +as return value and in `ptr`, because a lone backslash is not +a valid PostScript character. +--- + cups/raster-interpret.c | 14 +++++++++++++- + 1 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/cups/raster-interpret.c b/cups/raster-interpret.c +index 6fcf731b5..b8655c8c6 100644 +--- a/cups/raster-interpret.c ++++ b/cups/raster-interpret.c +@@ -1116,7 +1116,19 @@ scan_ps(_cups_ps_stack_t *st, /* I - Stack */ + + cur ++; + +- if (*cur == 'b') ++ /* ++ * Return NULL if we reached NULL terminator, a lone backslash ++ * is not a valid character in PostScript. ++ */ ++ ++ if (!*cur) ++ { ++ *ptr = NULL; ++ ++ return (NULL); ++ } ++ ++ if (*cur == 'b') + *valptr++ = '\b'; + else if (*cur == 'f') + *valptr++ = '\f'; diff --git a/meta/recipes-extended/diffutils/diffutils/0001-Skip-strip-trailing-cr-test-case.patch b/meta/recipes-extended/diffutils/diffutils/0001-Skip-strip-trailing-cr-test-case.patch index aac1c43465..32793233f9 100644 --- a/meta/recipes-extended/diffutils/diffutils/0001-Skip-strip-trailing-cr-test-case.patch +++ b/meta/recipes-extended/diffutils/diffutils/0001-Skip-strip-trailing-cr-test-case.patch @@ -1,4 +1,4 @@ -From bd7fb8be2ae2d75347cf7733302d5093046ffa85 Mon Sep 17 00:00:00 2001 +From f31395c931bc633206eccfcfaaaa5d15021a3e86 Mon Sep 17 00:00:00 2001 From: Peiran Hong <peiran.hong@windriver.com> Date: Thu, 5 Sep 2019 15:42:22 -0400 Subject: [PATCH] Skip strip-trailing-cr test case @@ -10,26 +10,20 @@ package. Upstream-Status: Inappropriate [embedded specific] Signed-off-by: Peiran Hong <peiran.hong@windriver.com> + --- - tests/Makefile.am | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) + tests/Makefile.am | 1 - + 1 file changed, 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am -index 83a7c9d..04d51b5 100644 +index 79bacfb..4adb4d7 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am -@@ -21,8 +21,10 @@ TESTS = \ +@@ -22,7 +22,6 @@ TESTS = \ stdin \ strcoll-0-names \ filename-quoting \ - strip-trailing-cr \ - colors -+# Skipping this test since it requires valgrind -+# and thus is too heavy for diffutils package -+# strip-trailing-cr - - XFAIL_TESTS = large-subopt - --- -2.21.0 - + timezone \ + colors \ + y2038-vs-32bit diff --git a/meta/recipes-extended/diffutils/diffutils/0001-mcontext-is-not-a-standard-layout-so-glibc-and-musl-.patch b/meta/recipes-extended/diffutils/diffutils/0001-mcontext-is-not-a-standard-layout-so-glibc-and-musl-.patch deleted file mode 100644 index 4928e1eaff..0000000000 --- a/meta/recipes-extended/diffutils/diffutils/0001-mcontext-is-not-a-standard-layout-so-glibc-and-musl-.patch +++ /dev/null @@ -1,33 +0,0 @@ -From f385ad6639380eb6dfa8b8eb4a5ba65dd12db744 Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@gmail.com> -Date: Fri, 25 Mar 2022 13:43:19 -0700 -Subject: [PATCH] mcontext is not a standard layout so glibc and musl differ - -This is already applied to libsigsegv upstream, hopefully next version -of grep will update its internal copy and we can drop this patch - -Upstream-Status: Backport [https://git.savannah.gnu.org/gitweb/?p=libsigsegv.git;a=commitdiff;h=a6ff69873110c0a8ba6f7fd90532dbc11224828c] - -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - lib/sigsegv.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/sigsegv.c b/lib/sigsegv.c -index 998c827..b6f4841 100644 ---- a/lib/sigsegv.c -+++ b/lib/sigsegv.c -@@ -219,8 +219,8 @@ int libsigsegv_version = LIBSIGSEGV_VERSION; - # define SIGSEGV_FAULT_STACKPOINTER ((ucontext_t *) ucp)->uc_mcontext.gp_regs[1] - # else /* 32-bit */ - /* both should be equivalent */ --# if 0 --# define SIGSEGV_FAULT_STACKPOINTER ((ucontext_t *) ucp)->uc_mcontext.regs->gpr[1] -+# if ! defined __GLIBC__ -+# define SIGSEGV_FAULT_STACKPOINTER ((ucontext_t *) ucp)->uc_regs->gregs[1] - # else - # define SIGSEGV_FAULT_STACKPOINTER ((ucontext_t *) ucp)->uc_mcontext.uc_regs->gregs[1] - # endif --- -2.35.1 - diff --git a/meta/recipes-extended/diffutils/diffutils_3.8.bb b/meta/recipes-extended/diffutils/diffutils_3.10.bb index 8889c83ee2..08e8305612 100644 --- a/meta/recipes-extended/diffutils/diffutils_3.8.bb +++ b/meta/recipes-extended/diffutils/diffutils_3.10.bb @@ -6,10 +6,9 @@ require diffutils.inc SRC_URI = "${GNU_MIRROR}/diffutils/diffutils-${PV}.tar.xz \ file://run-ptest \ file://0001-Skip-strip-trailing-cr-test-case.patch \ - file://0001-mcontext-is-not-a-standard-layout-so-glibc-and-musl-.patch \ " -SRC_URI[sha256sum] = "a6bdd7d1b31266d11c4f4de6c1b748d4607ab0231af5188fc2533d0ae2438fec" +SRC_URI[sha256sum] = "90e5e93cc724e4ebe12ede80df1634063c7a855692685919bfe60b556c9bd09e" EXTRA_OECONF += "ac_cv_path_PR_PROGRAM=${bindir}/pr --without-libsigsegv-prefix" diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch new file mode 100644 index 0000000000..bc157d6afb --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch @@ -0,0 +1,28 @@ +From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" <arnold@skeeve.com> +Date: Wed, 3 Aug 2022 13:00:54 +0300 +Subject: [PATCH] Smal bug fix in builtin.c. + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/gawk/tree/debian/patches/CVE-2023-4156.patch?h=ubuntu/jammy-security +Upstream commit https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212] +CVE: CVE-2023-4156 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + ChangeLog | 6 ++++++ + builtin.c | 5 ++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- gawk-5.1.0.orig/builtin.c ++++ gawk-5.1.0/builtin.c +@@ -957,7 +957,10 @@ check_pos: + s1++; + n0--; + } +- if (val >= num_args) { ++ // val could be less than zero if someone provides a field width ++ // so large that it causes integer overflow. Mainly fuzzers do this, ++ // but let's try to be good anyway. ++ if (val < 0 || val >= num_args) { + toofew = true; + break; + } diff --git a/meta/recipes-extended/gawk/gawk_5.1.1.bb b/meta/recipes-extended/gawk/gawk_5.1.1.bb index fe339805d0..0b0d0897bc 100644 --- a/meta/recipes-extended/gawk/gawk_5.1.1.bb +++ b/meta/recipes-extended/gawk/gawk_5.1.1.bb @@ -18,6 +18,7 @@ PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr" SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \ file://remove-sensitive-tests.patch \ file://run-ptest \ + file://CVE-2023-4156.patch \ " SRC_URI[sha256sum] = "6168d8d1dc8f74bd17d9dc22fa9634c49070f232343b744901da15fb4f06bffd" diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0001.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0001.patch new file mode 100644 index 0000000000..99fcc61b9b --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0001.patch @@ -0,0 +1,146 @@ +From ed607fedbcd41f4a0e71df6af4ba5b07dd630209 Mon Sep 17 00:00:00 2001 +From: Chris Liddell <chris.liddell@artifex.com> +Date: Wed, 7 Jun 2023 10:23:06 +0100 +Subject: [PATCH 1/2] Bug 706761: Don't "reduce" %pipe% file names for + permission validation + +For regular file names, we try to simplfy relative paths before we use them. + +Because the %pipe% device can, effectively, accept command line calls, we +shouldn't be simplifying that string, because the command line syntax can end +up confusing the path simplifying code. That can result in permitting a pipe +command which does not match what was originally permitted. + +Special case "%pipe" in the validation code so we always deal with the entire +string. + +Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5e65eeae225c7d02d447de5abaf4a8e6d234fcea] +CVE: CVE-2023-36664 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + base/gpmisc.c | 31 +++++++++++++++++++-------- + base/gslibctx.c | 56 ++++++++++++++++++++++++++++++++++++------------- + 2 files changed, 64 insertions(+), 23 deletions(-) + +diff --git a/base/gpmisc.c b/base/gpmisc.c +index 8b6458a..c61ab3f 100644 +--- a/base/gpmisc.c ++++ b/base/gpmisc.c +@@ -1076,16 +1076,29 @@ gp_validate_path_len(const gs_memory_t *mem, + && !memcmp(path + cdirstrl, dirsepstr, dirsepstrl)) { + prefix_len = 0; + } +- rlen = len+1; +- bufferfull = (char *)gs_alloc_bytes(mem->thread_safe_memory, rlen + prefix_len, "gp_validate_path"); +- if (bufferfull == NULL) +- return gs_error_VMerror; +- +- buffer = bufferfull + prefix_len; +- if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success) +- return gs_error_invalidfileaccess; +- buffer[rlen] = 0; + ++ /* "%pipe%" do not follow the normal rules for path definitions, so we ++ don't "reduce" them to avoid unexpected results ++ */ ++ if (len > 5 && memcmp(path, "%pipe", 5) != 0) { ++ bufferfull = buffer = (char *)gs_alloc_bytes(mem->thread_safe_memory, len + 1, "gp_validate_path"); ++ if (buffer == NULL) ++ return gs_error_VMerror; ++ memcpy(buffer, path, len); ++ buffer[len] = 0; ++ rlen = len; ++ } ++ else { ++ rlen = len+1; ++ bufferfull = (char *)gs_alloc_bytes(mem->thread_safe_memory, rlen + prefix_len, "gp_validate_path"); ++ if (bufferfull == NULL) ++ return gs_error_VMerror; ++ ++ buffer = bufferfull + prefix_len; ++ if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success) ++ return gs_error_invalidfileaccess; ++ buffer[rlen] = 0; ++ } + while (1) { + switch (mode[0]) + { +diff --git a/base/gslibctx.c b/base/gslibctx.c +index 5bf497b..5fdfe25 100644 +--- a/base/gslibctx.c ++++ b/base/gslibctx.c +@@ -734,14 +734,28 @@ gs_add_control_path_len_flags(const gs_memory_t *mem, gs_path_control_t type, co + return gs_error_rangecheck; + } + +- rlen = len+1; +- buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gp_validate_path"); +- if (buffer == NULL) +- return gs_error_VMerror; ++ /* "%pipe%" do not follow the normal rules for path definitions, so we ++ don't "reduce" them to avoid unexpected results ++ */ ++ if (len > 5 && memcmp(path, "%pipe", 5) != 0) { ++ buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_add_control_path_len"); ++ if (buffer == NULL) ++ return gs_error_VMerror; ++ memcpy(buffer, path, len); ++ buffer[len] = 0; ++ rlen = len; ++ } ++ else { ++ rlen = len + 1; + +- if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success) +- return gs_error_invalidfileaccess; +- buffer[rlen] = 0; ++ buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gs_add_control_path_len"); ++ if (buffer == NULL) ++ return gs_error_VMerror; ++ ++ if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success) ++ return gs_error_invalidfileaccess; ++ buffer[rlen] = 0; ++ } + + n = control->num; + for (i = 0; i < n; i++) +@@ -827,14 +841,28 @@ gs_remove_control_path_len_flags(const gs_memory_t *mem, gs_path_control_t type, + return gs_error_rangecheck; + } + +- rlen = len+1; +- buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gp_validate_path"); +- if (buffer == NULL) +- return gs_error_VMerror; ++ /* "%pipe%" do not follow the normal rules for path definitions, so we ++ don't "reduce" them to avoid unexpected results ++ */ ++ if (len > 5 && memcmp(path, "%pipe", 5) != 0) { ++ buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_remove_control_path_len"); ++ if (buffer == NULL) ++ return gs_error_VMerror; ++ memcpy(buffer, path, len); ++ buffer[len] = 0; ++ rlen = len; ++ } ++ else { ++ rlen = len+1; + +- if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success) +- return gs_error_invalidfileaccess; +- buffer[rlen] = 0; ++ buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gs_remove_control_path_len"); ++ if (buffer == NULL) ++ return gs_error_VMerror; ++ ++ if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success) ++ return gs_error_invalidfileaccess; ++ buffer[rlen] = 0; ++ } + + n = control->num; + for (i = 0; i < n; i++) { +-- +2.40.1 diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0002.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0002.patch new file mode 100644 index 0000000000..7d78e6b1b1 --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0002.patch @@ -0,0 +1,60 @@ +From f96350aeb7f8c2e3f7129866c694a24f241db18c Mon Sep 17 00:00:00 2001 +From: Chris Liddell <chris.liddell@artifex.com> +Date: Wed, 14 Jun 2023 09:08:12 +0100 +Subject: [PATCH 2/2] Bug 706778: 706761 revisit + +Two problems with the original commit. The first a silly typo inverting the +logic of a test. + +The second was forgetting that we actually actually validate two candidate +strings for pipe devices. One with the expected "%pipe%" prefix, the other +using the pipe character prefix: "|". + +This addresses both those. + +Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=fb342fdb60391073a69147cb71af1ac416a81099] +CVE: CVE-2023-36664 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + base/gpmisc.c | 2 +- + base/gslibctx.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/base/gpmisc.c b/base/gpmisc.c +index c61ab3f..e459f6a 100644 +--- a/base/gpmisc.c ++++ b/base/gpmisc.c +@@ -1080,7 +1080,7 @@ gp_validate_path_len(const gs_memory_t *mem, + /* "%pipe%" do not follow the normal rules for path definitions, so we + don't "reduce" them to avoid unexpected results + */ +- if (len > 5 && memcmp(path, "%pipe", 5) != 0) { ++ if (path[0] == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) { + bufferfull = buffer = (char *)gs_alloc_bytes(mem->thread_safe_memory, len + 1, "gp_validate_path"); + if (buffer == NULL) + return gs_error_VMerror; +diff --git a/base/gslibctx.c b/base/gslibctx.c +index 5fdfe25..2a1addf 100644 +--- a/base/gslibctx.c ++++ b/base/gslibctx.c +@@ -737,7 +737,7 @@ gs_add_control_path_len_flags(const gs_memory_t *mem, gs_path_control_t type, co + /* "%pipe%" do not follow the normal rules for path definitions, so we + don't "reduce" them to avoid unexpected results + */ +- if (len > 5 && memcmp(path, "%pipe", 5) != 0) { ++ if (path[0] == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) { + buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_add_control_path_len"); + if (buffer == NULL) + return gs_error_VMerror; +@@ -844,7 +844,7 @@ gs_remove_control_path_len_flags(const gs_memory_t *mem, gs_path_control_t type, + /* "%pipe%" do not follow the normal rules for path definitions, so we + don't "reduce" them to avoid unexpected results + */ +- if (len > 5 && memcmp(path, "%pipe", 5) != 0) { ++ if (path[0] == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) { + buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_remove_control_path_len"); + if (buffer == NULL) + return gs_error_VMerror; +-- +2.40.1 diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-38559.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-38559.patch new file mode 100644 index 0000000000..2b2b85fa27 --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-38559.patch @@ -0,0 +1,32 @@ +From 34b0eec257c3a597e0515946f17fb973a33a7b5b Mon Sep 17 00:00:00 2001 +From: Chris Liddell <chris.liddell@artifex.com> +Date: Mon, 17 Jul 2023 14:06:37 +0100 +Subject: [PATCH] Bug 706897: Copy pcx buffer overrun fix from + devices/gdevpcx.c + +Bounds check the buffer, before dereferencing the pointer. + +Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1fb9991bb95f1201abb5dea55f57f] + +CVE: CVE-2023-38559 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + base/gdevdevn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/base/gdevdevn.c b/base/gdevdevn.c +index f679127..66c771b 100644 +--- a/base/gdevdevn.c ++++ b/base/gdevdevn.c +@@ -1950,7 +1950,7 @@ devn_pcx_write_rle(const byte * from, const byte * end, int step, gp_file * file + byte data = *from; + + from += step; +- if (data != *from || from == end) { ++ if (from >= end || data != *from) { + if (data >= 0xc0) + gp_fputc(0xc1, file); + } else { +-- +2.40.0 diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-43115.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-43115.patch new file mode 100644 index 0000000000..979f354ed5 --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-43115.patch @@ -0,0 +1,62 @@ +From 8b0f20002536867bd73ff4552408a72597190cbe Mon Sep 17 00:00:00 2001 +From: Ken Sharp <ken.sharp@artifex.com> +Date: Thu, 24 Aug 2023 15:24:35 +0100 +Subject: [PATCH] IJS device - try and secure the IJS server startup + +Bug #707051 ""ijs" device can execute arbitrary commands" + +The problem is that the 'IJS' device needs to start the IJS server, and +that is indeed an arbitrary command line. There is (apparently) no way +to validate it. Indeed, this is covered quite clearly in the comments +at the start of the source: + + * WARNING: The ijs server can be selected on the gs command line + * which is a security risk, since any program can be run. + +Previously this used the awful LockSafetyParams hackery, which we +abandoned some time ago because it simply couldn't be made secure (it +was implemented in PostScript and was therefore vulnerable to PostScript +programs). + +This commit prevents PostScript programs switching to the IJS device +after SAFER has been activated, and prevents changes to the IjsServer +parameter after SAFER has been activated. + +SAFER is activated, unless explicitly disabled, before any user +PostScript is executed which means that the device and the server +invocation can only be configured on the command line. This does at +least provide minimal security against malicious PostScript programs. + +Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=8b0f20002536867bd73ff4552408a72597190cbe] + +CVE: CVE-2023-43115 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + devices/gdevijs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/devices/gdevijs.c b/devices/gdevijs.c +index 8cbd84b97..16f5a1752 100644 +--- a/devices/gdevijs.c ++++ b/devices/gdevijs.c +@@ -888,6 +888,8 @@ gsijs_initialize_device(gx_device *dev) + static const char rgb[] = "DeviceRGB"; + gx_device_ijs *ijsdev = (gx_device_ijs *)dev; + ++ if (ijsdev->memory->gs_lib_ctx->core->path_control_active) ++ return_error(gs_error_invalidaccess); + if (!ijsdev->ColorSpace) { + ijsdev->ColorSpace = gs_malloc(ijsdev->memory, sizeof(rgb), 1, + "gsijs_initialize"); +@@ -1326,7 +1328,7 @@ gsijs_put_params(gx_device *dev, gs_param_list *plist) + if (code >= 0) + code = gsijs_read_string(plist, "IjsServer", + ijsdev->IjsServer, sizeof(ijsdev->IjsServer), +- dev->LockSafetyParams, is_open); ++ ijsdev->memory->gs_lib_ctx->core->path_control_active, is_open); + + if (code >= 0) + code = gsijs_read_string_malloc(plist, "DeviceManufacturer", +-- +2.40.0 diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch new file mode 100644 index 0000000000..6fe5590892 --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46751.patch @@ -0,0 +1,41 @@ +From 5d2da96e81c7455338302c71a291088a8396245a Mon Sep 17 00:00:00 2001 +From: Chris Liddell <chris.liddell@artifex.com> +Date: Mon, 16 Oct 2023 16:49:40 +0100 +Subject: [PATCH] Bug 707264: Fix tiffsep(1) requirement for seekable output + files + +In the device initialization redesign, tiffsep and tiffsep1 lost the requirement +for the output files to be seekable. + +Fixing that highlighted a problem with the error handling in +gdev_prn_open_printer_seekable() where closing the erroring file would leave a +dangling pointer, and lead to a crash. + +Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5d2da96e81c7455338302c71a291088a8396245a] +CVE: CVE-2023-46751 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + base/gdevprn.c | 1 + + devices/gdevtsep.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/base/gdevprn.c ++++ b/base/gdevprn.c +@@ -1251,6 +1251,7 @@ gdev_prn_open_printer_seekable(gx_device + && !IS_LIBCTX_STDERR(pdev->memory, gp_get_file(ppdev->file))) { + + code = gx_device_close_output_file(pdev, ppdev->fname, ppdev->file); ++ ppdev->file = NULL; + if (code < 0) + return code; + } +--- a/devices/gdevtsep.c ++++ b/devices/gdevtsep.c +@@ -738,6 +738,7 @@ tiffsep_initialize_device_procs(gx_devic + { + gdev_prn_initialize_device_procs(dev); + ++ set_dev_proc(dev, output_page, gdev_prn_output_page_seekable); + set_dev_proc(dev, open_device, tiffsep_prn_open); + set_dev_proc(dev, close_device, tiffsep_prn_close); + set_dev_proc(dev, map_color_rgb, tiffsep_decode_color); diff --git a/meta/recipes-extended/ghostscript/ghostscript/cve-2023-28879.patch b/meta/recipes-extended/ghostscript/ghostscript/cve-2023-28879.patch new file mode 100644 index 0000000000..9b057d609a --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/cve-2023-28879.patch @@ -0,0 +1,60 @@ +From 37ed5022cecd584de868933b5b60da2e995b3179 Mon Sep 17 00:00:00 2001 +From: Ken Sharp <ken.sharp@artifex.com> +Date: Fri, 24 Mar 2023 13:19:57 +0000 +Subject: [PATCH] Graphics library - prevent buffer overrun in (T)BCP encoding + +Bug #706494 "Buffer Overflow in s_xBCPE_process" + +As described in detail in the bug report, if the write buffer is filled +to one byte less than full, and we then try to write an escaped +character, we overrun the buffer because we don't check before +writing two bytes to it. + +This just checks if we have two bytes before starting to write an +escaped character and exits if we don't (replacing the consumed byte +of the input). + +Up for further discussion; why do we even permit a BCP encoding filter +anyway ? I think we should remove this, at least when SAFER is true. +--- +CVE: CVE-2023-28879 + +Upstream-Status: Backport [see text] + +git://git.ghostscript.com/ghostpdl +cherry-pick + +Signed-off-by: Joe Slater <joe.slater@windriver.com> + +--- + base/sbcp.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/base/sbcp.c b/base/sbcp.c +index 979ae0992..47fc233ec 100644 +--- a/base/sbcp.c ++++ b/base/sbcp.c +@@ -1,4 +1,4 @@ +-/* Copyright (C) 2001-2021 Artifex Software, Inc. ++/* Copyright (C) 2001-2023 Artifex Software, Inc. + All Rights Reserved. + + This software is provided AS-IS with no warranty, either express or +@@ -50,6 +50,14 @@ s_xBCPE_process(stream_state * st, stream_cursor_read * pr, + byte ch = *++p; + + if (ch <= 31 && escaped[ch]) { ++ /* Make sure we have space to store two characters in the write buffer, ++ * if we don't then exit without consuming the input character, we'll process ++ * that on the next time round. ++ */ ++ if (pw->limit - q < 2) { ++ p--; ++ break; ++ } + if (p == rlimit) { + p--; + break; +-- +2.25.1 + diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb index 365420fb64..e99c740685 100644 --- a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb +++ b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb @@ -10,7 +10,7 @@ dot-matrix, inkjet and laser models. \ HOMEPAGE = "http://www.ghostscript.com" SECTION = "console/utils" -LICENSE = "GPL-3.0-only" +LICENSE = "AGPL-3.0-or-later" LIC_FILES_CHKSUM = "file://LICENSE;md5=f98ffa763e50cded76f49bce73aade16" DEPENDS = "ghostscript-native tiff jpeg fontconfig cups libpng" @@ -23,6 +23,9 @@ UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)\.tar" # however we use an external jpeg which doesn't have the issue. CVE_CHECK_IGNORE += "CVE-2013-6629" +# Issue in the GhostPCL. GhostPCL not part of this GhostScript recipe. +CVE_CHECK_IGNORE += "CVE-2023-38560" + def gs_verdir(v): return "".join(v.split(".")) @@ -34,6 +37,12 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d file://avoid-host-contamination.patch \ file://mkdir-p.patch \ file://CVE-2022-2085.patch \ + file://cve-2023-28879.patch \ + file://CVE-2023-36664-0001.patch \ + file://CVE-2023-36664-0002.patch \ + file://CVE-2023-38559.patch \ + file://CVE-2023-43115.patch \ + file://CVE-2023-46751.patch \ " SRC_URI = "${SRC_URI_BASE} \ diff --git a/meta/recipes-extended/less/less/CVE-2022-46663.patch b/meta/recipes-extended/less/less/CVE-2022-46663.patch new file mode 100644 index 0000000000..4d61a52fa6 --- /dev/null +++ b/meta/recipes-extended/less/less/CVE-2022-46663.patch @@ -0,0 +1,31 @@ +From a78e1351113cef564d790a730d657a321624d79c Mon Sep 17 00:00:00 2001 +From: Mark Nudelman <markn@greenwoodsoftware.com> +Date: Fri, 7 Oct 2022 19:25:46 -0700 +Subject: [PATCH] End OSC8 hyperlink on invalid embedded escape sequence. + + +CVE: CVE-2022-46663 +Upstream-Status: Backport [https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c] +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + line.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/line.c b/line.c +index 0ef9b07..9d49cf8 100644 +--- a/line.c ++++ b/line.c +@@ -633,8 +633,8 @@ ansi_step(pansi, ch) + /* Hyperlink ends with \7 or ESC-backslash. */ + if (ch == '\7') + return ANSI_END; +- if (pansi->prev_esc && ch == '\\') +- return ANSI_END; ++ if (pansi->prev_esc) ++ return (ch == '\\') ? ANSI_END : ANSI_ERR; + pansi->prev_esc = (ch == ESC); + return ANSI_MID; + } +-- +2.25.1 + diff --git a/meta/recipes-extended/less/less/CVE-2022-48624.patch b/meta/recipes-extended/less/less/CVE-2022-48624.patch new file mode 100644 index 0000000000..409730bd4f --- /dev/null +++ b/meta/recipes-extended/less/less/CVE-2022-48624.patch @@ -0,0 +1,41 @@ +From c6ac6de49698be84d264a0c4c0c40bb870b10144 Mon Sep 17 00:00:00 2001 +From: Mark Nudelman <markn@greenwoodsoftware.com> +Date: Sat, 25 Jun 2022 11:54:43 -0700 +Subject: [PATCH] Shell-quote filenames when invoking LESSCLOSE. + +Upstream-Status: Backport [https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144] +CVE: CVE-2022-48624 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + filename.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/filename.c b/filename.c +index 5824e385..dff20c08 100644 +--- a/filename.c ++++ b/filename.c +@@ -972,6 +972,8 @@ close_altfile(altfilename, filename) + { + #if HAVE_POPEN + char *lessclose; ++ char *qfilename; ++ char *qaltfilename; + FILE *fd; + char *cmd; + int len; +@@ -986,9 +988,13 @@ close_altfile(altfilename, filename) + error("LESSCLOSE ignored; must contain no more than 2 %%s", NULL_PARG); + return; + } +- len = (int) (strlen(lessclose) + strlen(filename) + strlen(altfilename) + 2); ++ qfilename = shell_quote(filename); ++ qaltfilename = shell_quote(altfilename); ++ len = (int) (strlen(lessclose) + strlen(qfilename) + strlen(qaltfilename) + 2); + cmd = (char *) ecalloc(len, sizeof(char)); +- SNPRINTF2(cmd, len, lessclose, filename, altfilename); ++ SNPRINTF2(cmd, len, lessclose, qfilename, qaltfilename); ++ free(qaltfilename); ++ free(qfilename); + fd = shellcmd(cmd); + free(cmd); + if (fd != NULL) diff --git a/meta/recipes-extended/less/less_600.bb b/meta/recipes-extended/less/less_600.bb index 9ebe39daab..f88127a9e3 100644 --- a/meta/recipes-extended/less/less_600.bb +++ b/meta/recipes-extended/less/less_600.bb @@ -26,6 +26,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464 \ DEPENDS = "ncurses" SRC_URI = "http://www.greenwoodsoftware.com/${BPN}/${BPN}-${PV}.tar.gz \ + file://CVE-2022-46663.patch \ + file://CVE-2022-48624.patch \ " SRC_URI[sha256sum] = "6633d6aa2b3cc717afb2c205778c7c42c4620f63b1d682f3d12c98af0be74d20" diff --git a/meta/recipes-extended/libarchive/libarchive_3.6.2.bb b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb index acc84de9da..0219ffa720 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.6.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb @@ -7,11 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d499814247adaee08d88080841cb5665" DEPENDS = "e2fsprogs-native" -PACKAGECONFIG ?= "zlib bz2 xz lzo zstd" - -PACKAGECONFIG:append:class-target = "\ - ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)} \ -" +PACKAGECONFIG ?= "zlib bz2 xz lzo zstd ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}" DEPENDS_BZIP2 = "bzip2-replacement-native" DEPENDS_BZIP2:class-target = "bzip2" @@ -37,6 +33,9 @@ UPSTREAM_CHECK_URI = "http://libarchive.org/" SRC_URI[sha256sum] = "ba6d02f15ba04aba9c23fd5f236bb234eab9d5209e95d1c4df85c44d5f19b9b3" +# upstream-wontfix: upstream has documented that reported function is not thread-safe +CVE_CHECK_IGNORE += "CVE-2023-30571" + inherit autotools update-alternatives pkgconfig CPPFLAGS += "-I${WORKDIR}/extra-includes" diff --git a/meta/recipes-extended/libnss-nis/libnss-nis.bb b/meta/recipes-extended/libnss-nis/libnss-nis.bb index d0afb3ca0a..f0e687c330 100644 --- a/meta/recipes-extended/libnss-nis/libnss-nis.bb +++ b/meta/recipes-extended/libnss-nis/libnss-nis.bb @@ -13,9 +13,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c" SECTION = "libs" DEPENDS += "libtirpc libnsl2" -PV = "3.1+git${SRCPV}" +PV = "3.2" -SRCREV = "062f31999b35393abf7595cb89dfc9590d5a42ad" +SRCREV = "cd0d391af9535b56e612ed227c1b89be269f3d59" SRC_URI = "git://github.com/thkukuk/libnss_nis;branch=master;protocol=https \ " diff --git a/meta/recipes-extended/logrotate/logrotate_3.20.1.bb b/meta/recipes-extended/logrotate/logrotate_3.20.1.bb index 35977535aa..3df6ebd26d 100644 --- a/meta/recipes-extended/logrotate/logrotate_3.20.1.bb +++ b/meta/recipes-extended/logrotate/logrotate_3.20.1.bb @@ -67,7 +67,6 @@ do_install(){ install -p -m 644 ${S}/examples/logrotate.conf ${D}${sysconfdir}/logrotate.conf install -p -m 644 ${S}/examples/btmp ${D}${sysconfdir}/logrotate.d/btmp install -p -m 644 ${S}/examples/wtmp ${D}${sysconfdir}/logrotate.d/wtmp - touch ${D}${localstatedir}/lib/logrotate.status if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then install -d ${D}${systemd_system_unitdir} diff --git a/meta/recipes-extended/lsof/lsof_4.94.0.bb b/meta/recipes-extended/lsof/lsof_4.94.0.bb index 62f42975af..d50959d73c 100644 --- a/meta/recipes-extended/lsof/lsof_4.94.0.bb +++ b/meta/recipes-extended/lsof/lsof_4.94.0.bb @@ -22,7 +22,7 @@ S = "${WORKDIR}/git" inherit update-alternatives -ALTERNATIVE_${PN} = "lsof" +ALTERNATIVE:${PN} = "lsof" ALTERNATIVE_LINK_NAME[lsof] = "${sbindir}/lsof" # Make our priority higher than busybox ALTERNATIVE_PRIORITY = "100" diff --git a/meta/recipes-extended/mdadm/files/0001-DDF-Cleanup-validate_geometry_ddf_container.patch b/meta/recipes-extended/mdadm/files/0001-DDF-Cleanup-validate_geometry_ddf_container.patch new file mode 100644 index 0000000000..cea435f83b --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0001-DDF-Cleanup-validate_geometry_ddf_container.patch @@ -0,0 +1,148 @@ +From ca458f4dcc4de9403298f67543466ce4bbc8f8ae Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 22 Jun 2022 14:25:07 -0600 +Subject: [PATCH 1/4] DDF: Cleanup validate_geometry_ddf_container() + +Move the function up so that the function declaration is not necessary +and remove the unused arguments to the function. + +No functional changes are intended but will help with a bug fix in the +next patch. + +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Acked-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> + +Upstream-Status: Backport + +Reference to upstream patch: +https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=679bd9508a30 + +Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> +--- + super-ddf.c | 88 ++++++++++++++++++++++++----------------------------- + 1 file changed, 39 insertions(+), 49 deletions(-) + +diff --git a/super-ddf.c b/super-ddf.c +index 3f304cd..65cf727 100644 +--- a/super-ddf.c ++++ b/super-ddf.c +@@ -503,13 +503,6 @@ struct ddf_super { + static int load_super_ddf_all(struct supertype *st, int fd, + void **sbp, char *devname); + static int get_svd_state(const struct ddf_super *, const struct vcl *); +-static int +-validate_geometry_ddf_container(struct supertype *st, +- int level, int layout, int raiddisks, +- int chunk, unsigned long long size, +- unsigned long long data_offset, +- char *dev, unsigned long long *freesize, +- int verbose); + + static int validate_geometry_ddf_bvd(struct supertype *st, + int level, int layout, int raiddisks, +@@ -3322,6 +3315,42 @@ static int reserve_space(struct supertype *st, int raiddisks, + return 1; + } + ++static int ++validate_geometry_ddf_container(struct supertype *st, ++ int level, int raiddisks, ++ unsigned long long data_offset, ++ char *dev, unsigned long long *freesize, ++ int verbose) ++{ ++ int fd; ++ unsigned long long ldsize; ++ ++ if (level != LEVEL_CONTAINER) ++ return 0; ++ if (!dev) ++ return 1; ++ ++ fd = dev_open(dev, O_RDONLY|O_EXCL); ++ if (fd < 0) { ++ if (verbose) ++ pr_err("ddf: Cannot open %s: %s\n", ++ dev, strerror(errno)); ++ return 0; ++ } ++ if (!get_dev_size(fd, dev, &ldsize)) { ++ close(fd); ++ return 0; ++ } ++ close(fd); ++ if (freesize) { ++ *freesize = avail_size_ddf(st, ldsize >> 9, INVALID_SECTORS); ++ if (*freesize == 0) ++ return 0; ++ } ++ ++ return 1; ++} ++ + static int validate_geometry_ddf(struct supertype *st, + int level, int layout, int raiddisks, + int *chunk, unsigned long long size, +@@ -3347,11 +3376,9 @@ static int validate_geometry_ddf(struct supertype *st, + level = LEVEL_CONTAINER; + if (level == LEVEL_CONTAINER) { + /* Must be a fresh device to add to a container */ +- return validate_geometry_ddf_container(st, level, layout, +- raiddisks, *chunk, +- size, data_offset, dev, +- freesize, +- verbose); ++ return validate_geometry_ddf_container(st, level, raiddisks, ++ data_offset, dev, ++ freesize, verbose); + } + + if (!dev) { +@@ -3449,43 +3476,6 @@ static int validate_geometry_ddf(struct supertype *st, + return 1; + } + +-static int +-validate_geometry_ddf_container(struct supertype *st, +- int level, int layout, int raiddisks, +- int chunk, unsigned long long size, +- unsigned long long data_offset, +- char *dev, unsigned long long *freesize, +- int verbose) +-{ +- int fd; +- unsigned long long ldsize; +- +- if (level != LEVEL_CONTAINER) +- return 0; +- if (!dev) +- return 1; +- +- fd = dev_open(dev, O_RDONLY|O_EXCL); +- if (fd < 0) { +- if (verbose) +- pr_err("ddf: Cannot open %s: %s\n", +- dev, strerror(errno)); +- return 0; +- } +- if (!get_dev_size(fd, dev, &ldsize)) { +- close(fd); +- return 0; +- } +- close(fd); +- if (freesize) { +- *freesize = avail_size_ddf(st, ldsize >> 9, INVALID_SECTORS); +- if (*freesize == 0) +- return 0; +- } +- +- return 1; +-} +- + static int validate_geometry_ddf_bvd(struct supertype *st, + int level, int layout, int raiddisks, + int *chunk, unsigned long long size, +-- +2.39.1 + diff --git a/meta/recipes-extended/mdadm/files/0001-mdadm-Fix-optional-write-behind-parameter.patch b/meta/recipes-extended/mdadm/files/0001-mdadm-Fix-optional-write-behind-parameter.patch new file mode 100644 index 0000000000..186d1e76f2 --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0001-mdadm-Fix-optional-write-behind-parameter.patch @@ -0,0 +1,45 @@ +From 41edf6f45895193f4a523cb0a08d639c9ff9ccc9 Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 22 Jun 2022 14:25:12 -0600 +Subject: [PATCH] mdadm: Fix optional --write-behind parameter + +The commit noted below changed the behaviour of --write-behind to +require an argument. This broke the 06wrmostly test with the error: + + mdadm: Invalid value for maximum outstanding write-behind writes: (null). + Must be between 0 and 16383. + +To fix this, check if optarg is NULL before parising it, as the origial +code did. + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=41edf6f45895193f4a523cb0a08d639c9ff9ccc9] + +Fixes: 60815698c0ac ("Refactor parse_num and use it to parse optarg.") +Cc: Mateusz Grzonka <mateusz.grzonka@intel.com> +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Acked-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + mdadm.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/mdadm.c b/mdadm.c +index d0c5e6de..56722ed9 100644 +--- a/mdadm.c ++++ b/mdadm.c +@@ -1201,8 +1201,9 @@ int main(int argc, char *argv[]) + case O(BUILD, WriteBehind): + case O(CREATE, WriteBehind): + s.write_behind = DEFAULT_MAX_WRITE_BEHIND; +- if (parse_num(&s.write_behind, optarg) != 0 || +- s.write_behind < 0 || s.write_behind > 16383) { ++ if (optarg && ++ (parse_num(&s.write_behind, optarg) != 0 || ++ s.write_behind < 0 || s.write_behind > 16383)) { + pr_err("Invalid value for maximum outstanding write-behind writes: %s.\n\tMust be between 0 and 16383.\n", + optarg); + exit(2); +-- +2.25.1 + diff --git a/meta/recipes-extended/mdadm/files/0001-tests-00raid0-add-a-test-that-validates-raid0-with-l.patch b/meta/recipes-extended/mdadm/files/0001-tests-00raid0-add-a-test-that-validates-raid0-with-l.patch new file mode 100644 index 0000000000..1c95834a7e --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0001-tests-00raid0-add-a-test-that-validates-raid0-with-l.patch @@ -0,0 +1,41 @@ +From 7539254342bc591717b0051734cc6c09c1b88640 Mon Sep 17 00:00:00 2001 +From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Date: Wed, 22 Jun 2022 14:25:13 -0600 +Subject: [PATCH] tests/00raid0: add a test that validates raid0 with layout + fails for 0.9 + +329dfc28debb disallows the creation of raid0 with layouts for 0.9 +metadata. This test confirms the new behavior. + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=7539254342bc591717b0051734cc6c09c1b88640] + +Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Signed-off-by: Himanshu Madhani <himanshu.madhani@oracle.com> +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + tests/00raid0 | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/tests/00raid0 b/tests/00raid0 +index 8bc18985..e6b21cc4 100644 +--- a/tests/00raid0 ++++ b/tests/00raid0 +@@ -6,11 +6,9 @@ check raid0 + testdev $md0 3 $mdsize2_l 512 + mdadm -S $md0 + +-# now with version-0.90 superblock ++# verify raid0 with layouts fail for 0.90 + mdadm -CR $md0 -e0.90 -l0 -n4 $dev0 $dev1 $dev2 $dev3 +-check raid0 +-testdev $md0 4 $mdsize0 512 +-mdadm -S $md0 ++check opposite_result + + # now with no superblock + mdadm -B $md0 -l0 -n5 $dev0 $dev1 $dev2 $dev3 $dev4 +-- +2.25.1 + diff --git a/meta/recipes-extended/mdadm/files/0001-tests-00readonly-Run-udevadm-settle-before-setting-r.patch b/meta/recipes-extended/mdadm/files/0001-tests-00readonly-Run-udevadm-settle-before-setting-r.patch new file mode 100644 index 0000000000..c621c082e8 --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0001-tests-00readonly-Run-udevadm-settle-before-setting-r.patch @@ -0,0 +1,39 @@ +From 39b381252c32275079344d30de18b76fda4bba26 Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 27 Jul 2022 15:52:45 -0600 +Subject: [PATCH] tests/00readonly: Run udevadm settle before setting ro + +In some recent kernel versions, 00readonly fails with: + + mdadm: failed to set readonly for /dev/md0: Device or resource busy + ERROR: array is not read-only! + +This was traced down to a race condition with udev holding a reference +to the block device at the same time as trying to set it read only. + +To fix this, call udevadm settle before setting the array read only. + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=39b381252c32275079344d30de18b76fda4bba26] + +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Signed-off-by: Jes Sorensen <jsorensen@fb.com> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + tests/00readonly | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tests/00readonly b/tests/00readonly +index 39202487..afe243b3 100644 +--- a/tests/00readonly ++++ b/tests/00readonly +@@ -12,6 +12,7 @@ do + $dev1 $dev2 $dev3 $dev4 --assume-clean + check nosync + check $level ++ udevadm settle + mdadm -ro $md0 + check readonly + state=$(cat /sys/block/md0/md/array_state) +-- +2.25.1 + diff --git a/meta/recipes-extended/mdadm/files/0001-tests-02lineargrow-clear-the-superblock-at-every-ite.patch b/meta/recipes-extended/mdadm/files/0001-tests-02lineargrow-clear-the-superblock-at-every-ite.patch new file mode 100644 index 0000000000..1a7104b76d --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0001-tests-02lineargrow-clear-the-superblock-at-every-ite.patch @@ -0,0 +1,33 @@ +From a2c832465fc75202e244327b2081231dfa974617 Mon Sep 17 00:00:00 2001 +From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Date: Wed, 22 Jun 2022 14:25:16 -0600 +Subject: [PATCH] tests/02lineargrow: clear the superblock at every iteration + +This fixes 02lineargrow test as prior metadata causes --add operation +to misbehave. + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=a2c832465fc75202e244327b2081231dfa974617] + +Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Signed-off-by: Himanshu Madhani <himanshu.madhani@oracle.com> +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + tests/02lineargrow | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tests/02lineargrow b/tests/02lineargrow +index e05c219d..595bf9f2 100644 +--- a/tests/02lineargrow ++++ b/tests/02lineargrow +@@ -20,4 +20,6 @@ do + testdev $md0 3 $sz 1 + + mdadm -S $md0 ++ mdadm --zero /dev/loop2 ++ mdadm --zero /dev/loop3 + done +-- +2.25.1 + diff --git a/meta/recipes-extended/mdadm/files/0001-tests-04update-metadata-avoid-passing-chunk-size-to.patch b/meta/recipes-extended/mdadm/files/0001-tests-04update-metadata-avoid-passing-chunk-size-to.patch new file mode 100644 index 0000000000..9098fb2540 --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0001-tests-04update-metadata-avoid-passing-chunk-size-to.patch @@ -0,0 +1,41 @@ +From de045db607b1ac4b70fc2a8878463e029c2ab1dc Mon Sep 17 00:00:00 2001 +From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Date: Wed, 22 Jun 2022 14:25:15 -0600 +Subject: [PATCH] tests/04update-metadata: avoid passing chunk size to raid1 + +'04update-metadata' test fails with error, "specifying chunk size is +forbidden for this level" added by commit, 5b30a34aa4b5e. Hence, +correcting the test to ignore passing chunk size to raid1. + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=de045db607b1ac4b70fc2a8878463e029c2ab1dc] + +Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Signed-off-by: Himanshu Madhani <himanshu.madhani@oracle.com> +[logang@deltatee.com: fix if/then style and dropped unrelated hunk] +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + tests/04update-metadata | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tests/04update-metadata b/tests/04update-metadata +index 08c14af7..2b72a303 100644 +--- a/tests/04update-metadata ++++ b/tests/04update-metadata +@@ -11,7 +11,11 @@ dlist="$dev0 $dev1 $dev2 $dev3" + for ls in linear/4 raid1/1 raid5/3 raid6/2 + do + s=${ls#*/} l=${ls%/*} +- mdadm -CR --assume-clean -e 0.90 $md0 --level $l -n 4 -c 64 $dlist ++ if [[ $l == 'raid1' ]]; then ++ mdadm -CR --assume-clean -e 0.90 $md0 --level $l -n 4 $dlist ++ else ++ mdadm -CR --assume-clean -e 0.90 $md0 --level $l -n 4 -c 64 $dlist ++ fi + testdev $md0 $s 19904 64 + mdadm -S $md0 + mdadm -A $md0 --update=metadata $dlist +-- +2.25.1 + diff --git a/meta/recipes-extended/mdadm/files/0001-tests-fix-raid0-tests-for-0.90-metadata.patch b/meta/recipes-extended/mdadm/files/0001-tests-fix-raid0-tests-for-0.90-metadata.patch new file mode 100644 index 0000000000..d2e7d8ee50 --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0001-tests-fix-raid0-tests-for-0.90-metadata.patch @@ -0,0 +1,102 @@ +From 14c2161edb77d7294199e8aa7daa9f9d1d0ad5d7 Mon Sep 17 00:00:00 2001 +From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Date: Wed, 22 Jun 2022 14:25:14 -0600 +Subject: [PATCH] tests: fix raid0 tests for 0.90 metadata + +Some of the test cases fail because raid0 creation fails with the error, +"0.90 metadata does not support layouts for RAID0" added by commit, +329dfc28debb. Fix some of the test cases by switching from raid0 to +linear level for 0.9 metadata where possible. + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=14c2161edb77d7294199e8aa7daa9f9d1d0ad5d7] + +Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> +Signed-off-by: Himanshu Madhani <himanshu.madhani@oracle.com> +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + tests/00raid0 | 4 ++-- + tests/00readonly | 4 ++++ + tests/03r0assem | 6 +++--- + tests/04r0update | 4 ++-- + tests/04update-metadata | 2 +- + 5 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/tests/00raid0 b/tests/00raid0 +index e6b21cc4..9b8896cb 100644 +--- a/tests/00raid0 ++++ b/tests/00raid0 +@@ -20,8 +20,8 @@ mdadm -S $md0 + # now same again with different chunk size + for chunk in 4 32 256 + do +- mdadm -CR $md0 -e0.90 -l raid0 --chunk $chunk -n3 $dev0 $dev1 $dev2 +- check raid0 ++ mdadm -CR $md0 -e0.90 -l linear --chunk $chunk -n3 $dev0 $dev1 $dev2 ++ check linear + testdev $md0 3 $mdsize0 $chunk + mdadm -S $md0 + +diff --git a/tests/00readonly b/tests/00readonly +index 28b0fa13..39202487 100644 +--- a/tests/00readonly ++++ b/tests/00readonly +@@ -4,6 +4,10 @@ for metadata in 0.9 1.0 1.1 1.2 + do + for level in linear raid0 raid1 raid4 raid5 raid6 raid10 + do ++ if [[ $metadata == "0.9" && $level == "raid0" ]]; ++ then ++ continue ++ fi + mdadm -CR $md0 -l $level -n 4 --metadata=$metadata \ + $dev1 $dev2 $dev3 $dev4 --assume-clean + check nosync +diff --git a/tests/03r0assem b/tests/03r0assem +index 6744e322..44df0645 100644 +--- a/tests/03r0assem ++++ b/tests/03r0assem +@@ -68,9 +68,9 @@ mdadm -S $md2 + ### Now for version 0... + + mdadm --zero-superblock $dev0 $dev1 $dev2 +-mdadm -CR $md2 -l0 --metadata=0.90 -n3 $dev0 $dev1 $dev2 +-check raid0 +-tst="testdev $md2 3 $mdsize0 512" ++mdadm -CR $md2 -llinear --metadata=0.90 -n3 $dev0 $dev1 $dev2 ++check linear ++tst="testdev $md2 3 $mdsize0 1" + $tst + + uuid=`mdadm -Db $md2 | sed 's/.*UUID=//'` +diff --git a/tests/04r0update b/tests/04r0update +index 73ee3b9f..b95efb06 100644 +--- a/tests/04r0update ++++ b/tests/04r0update +@@ -1,7 +1,7 @@ + + # create a raid0, re-assemble with a different super-minor +-mdadm -CR -e 0.90 $md0 -l0 -n3 $dev0 $dev1 $dev2 +-testdev $md0 3 $mdsize0 512 ++mdadm -CR -e 0.90 $md0 -llinear -n3 $dev0 $dev1 $dev2 ++testdev $md0 3 $mdsize0 1 + minor1=`mdadm -E $dev0 | sed -n -e 's/.*Preferred Minor : //p'` + mdadm -S /dev/md0 + +diff --git a/tests/04update-metadata b/tests/04update-metadata +index 232fc1ff..08c14af7 100644 +--- a/tests/04update-metadata ++++ b/tests/04update-metadata +@@ -8,7 +8,7 @@ set -xe + + dlist="$dev0 $dev1 $dev2 $dev3" + +-for ls in raid0/4 linear/4 raid1/1 raid5/3 raid6/2 ++for ls in linear/4 raid1/1 raid5/3 raid6/2 + do + s=${ls#*/} l=${ls%/*} + mdadm -CR --assume-clean -e 0.90 $md0 --level $l -n 4 -c 64 $dlist +-- +2.25.1 + diff --git a/meta/recipes-extended/mdadm/files/0002-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch b/meta/recipes-extended/mdadm/files/0002-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch new file mode 100644 index 0000000000..fafe88b49c --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0002-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch @@ -0,0 +1,56 @@ +From 14f110f0286d38e29ef5e51d7f72e049c2f18323 Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 22 Jun 2022 14:25:08 -0600 +Subject: [PATCH 2/4] DDF: Fix NULL pointer dereference in + validate_geometry_ddf() + +A relatively recent patch added a call to validate_geometry() in +Manage_add() that has level=LEVEL_CONTAINER and chunk=NULL. + +This causes some ddf tests to segfault which aborts the test suite. + +To fix this, avoid dereferencing chunk when the level is +LEVEL_CONTAINER or LEVEL_NONE. + +Fixes: 1f5d54a06df0 ("Manage: Call validate_geometry when adding drive to external container") +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Acked-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> + +Upstream-Status: Backport + +Reference to upstream patch: +https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=2b93288a5650 + +Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> +--- + super-ddf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/super-ddf.c b/super-ddf.c +index 65cf727..3ef1293 100644 +--- a/super-ddf.c ++++ b/super-ddf.c +@@ -3369,9 +3369,6 @@ static int validate_geometry_ddf(struct supertype *st, + * If given BVDs, we make an SVD, changing all the GUIDs in the process. + */ + +- if (*chunk == UnSet) +- *chunk = DEFAULT_CHUNK; +- + if (level == LEVEL_NONE) + level = LEVEL_CONTAINER; + if (level == LEVEL_CONTAINER) { +@@ -3381,6 +3378,9 @@ static int validate_geometry_ddf(struct supertype *st, + freesize, verbose); + } + ++ if (*chunk == UnSet) ++ *chunk = DEFAULT_CHUNK; ++ + if (!dev) { + mdu_array_info_t array = { + .level = level, +-- +2.39.1 + diff --git a/meta/recipes-extended/mdadm/files/0003-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch b/meta/recipes-extended/mdadm/files/0003-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch new file mode 100644 index 0000000000..a954ab027a --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0003-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch @@ -0,0 +1,91 @@ +From bd064da1469a6a07331b076a0294a8c6c3c38526 Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 22 Jun 2022 14:25:09 -0600 +Subject: [PATCH 3/4] mdadm/Grow: Fix use after close bug by closing after fork + +The test 07reshape-grow fails most of the time. But it succeeds around +1 in 5 times. When it does succeed, it causes the tests to die because +mdadm has segfaulted. + +The segfault was caused by mdadm attempting to repoen a file +descriptor that was already closed. The backtrace of the segfault +was: + + #0 __strncmp_avx2 () at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:101 + #1 0x000056146e31d44b in devnm2devid (devnm=0x0) at util.c:956 + #2 0x000056146e31dab4 in open_dev_flags (devnm=0x0, flags=0) + at util.c:1072 + #3 0x000056146e31db22 in open_dev (devnm=0x0) at util.c:1079 + #4 0x000056146e3202e8 in reopen_mddev (mdfd=4) at util.c:2244 + #5 0x000056146e329f36 in start_array (mdfd=4, + mddev=0x7ffc55342450 "/dev/md0", content=0x7ffc55342860, + st=0x56146fc78660, ident=0x7ffc55342f70, best=0x56146fc6f5d0, + bestcnt=10, chosen_drive=0, devices=0x56146fc706b0, okcnt=5, + sparecnt=0, rebuilding_cnt=0, journalcnt=0, c=0x7ffc55342e90, + clean=1, avail=0x56146fc78720 "\001\001\001\001\001", + start_partial_ok=0, err_ok=0, was_forced=0) + at Assemble.c:1206 + #6 0x000056146e32c36e in Assemble (st=0x56146fc78660, + mddev=0x7ffc55342450 "/dev/md0", ident=0x7ffc55342f70, + devlist=0x56146fc6e2d0, c=0x7ffc55342e90) + at Assemble.c:1914 + #7 0x000056146e312ac9 in main (argc=11, argv=0x7ffc55343238) + at mdadm.c:1510 + +The file descriptor was closed early in Grow_continue(). The noted commit +moved the close() call to close the fd above the fork which caused the +parent process to return with a closed fd. + +This meant reshape_array() and Grow_continue() would return in the parent +with the fd forked. The fd would eventually be passed to reopen_mddev() +which returned an unhandled NULL from fd2devnm() which would then be +dereferenced in devnm2devid. + +Fix this by moving the close() call below the fork. This appears to +fix the 07revert-grow test. While we're at it, switch to using +close_fd() to invalidate the file descriptor. + +Fixes: 77b72fa82813 ("mdadm/Grow: prevent md's fd from being occupied during delayed time") +Cc: Alex Wu <alexwu@synology.com> +Cc: BingJing Chang <bingjingc@synology.com> +Cc: Danny Shih <dannyshih@synology.com> +Cc: ChangSyun Peng <allenpeng@synology.com> +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Acked-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> + +Upstream-Status: Backport + +Reference to upstream patch: +https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=548e9b916f86 + +Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> +--- + Grow.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Grow.c b/Grow.c +index 9c6fc95..a8e4e83 100644 +--- a/Grow.c ++++ b/Grow.c +@@ -3501,7 +3501,6 @@ started: + return 0; + } + +- close(fd); + /* Now we just need to kick off the reshape and watch, while + * handling backups of the data... + * This is all done by a forked background process. +@@ -3522,6 +3521,9 @@ started: + break; + } + ++ /* Close unused file descriptor in the forked process */ ++ close_fd(&fd); ++ + /* If another array on the same devices is busy, the + * reshape will wait for them. This would mean that + * the first section that we suspend will stay suspended +-- +2.39.1 + diff --git a/meta/recipes-extended/mdadm/files/0004-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch b/meta/recipes-extended/mdadm/files/0004-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch new file mode 100644 index 0000000000..72cb40f782 --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0004-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch @@ -0,0 +1,42 @@ +From 2296a4a441b4b8546e2eb32403930f1bb8f3ee4a Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 22 Jun 2022 14:25:10 -0600 +Subject: [PATCH 4/4] monitor: Avoid segfault when calling NULL get_bad_blocks + +Not all struct superswitch implement a get_bad_blocks() function, +yet mdmon seems to call it without checking for NULL and thus +occasionally segfaults in the test 10ddf-geometry. + +Fix this by checking for NULL before calling it. + +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Acked-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> + +Upstream-Status: Backport + +Reference to upstream patch: +https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=9ae62977b51d + +Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> +--- + monitor.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/monitor.c b/monitor.c +index afc3e50..8e43c0d 100644 +--- a/monitor.c ++++ b/monitor.c +@@ -312,6 +312,9 @@ static int check_for_cleared_bb(struct active_array *a, struct mdinfo *mdi) + struct md_bb *bb; + int i; + ++ if (!ss->get_bad_blocks) ++ return -1; ++ + /* + * Get a list of bad blocks for an array, then read list of + * acknowledged bad blocks from kernel and compare it against metadata +-- +2.39.1 + diff --git a/meta/recipes-extended/mdadm/files/0005-mdadm-test-Mark-and-ignore-broken-test-failures.patch b/meta/recipes-extended/mdadm/files/0005-mdadm-test-Mark-and-ignore-broken-test-failures.patch new file mode 100644 index 0000000000..c55bfb125b --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0005-mdadm-test-Mark-and-ignore-broken-test-failures.patch @@ -0,0 +1,128 @@ +From feab1f72fcf032a4d21d0a69eb61b23a5ddb3352 Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 22 Jun 2022 14:25:18 -0600 +Subject: [PATCH 5/6] mdadm/test: Mark and ignore broken test failures + +Add functionality to continue if a test marked as broken fails. + +To mark a test as broken, a file with the same name but with the suffix +'.broken' should exist. The first line in the file will be printed with +a KNOWN BROKEN message; the rest of the file can describe the how the +test is broken. + +Also adds --skip-broken and --skip-always-broken to skip all the tests +that have a .broken file or to skip all tests whose .broken file's first +line contains the keyword always. + +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> + +Upstream-Status: Backport + +Reference to upstream patch: +https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=28520bf114b3 + +[OP: adjusted context for mdadm-4.2] +Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> +--- + test | 37 +++++++++++++++++++++++++++++++++++-- + 1 file changed, 35 insertions(+), 2 deletions(-) + +diff --git a/test b/test +index 8f189d9..ee8fba1 100755 +--- a/test ++++ b/test +@@ -10,6 +10,8 @@ devlist= + + savelogs=0 + exitonerror=1 ++ctrl_c_error=0 ++skipbroken=0 + prefix='[0-9][0-9]' + + # use loop devices by default if doesn't specify --dev +@@ -35,6 +37,7 @@ die() { + + ctrl_c() { + exitonerror=1 ++ ctrl_c_error=1 + } + + # mdadm always adds --quiet, and we want to see any unexpected messages +@@ -79,8 +82,21 @@ mdadm() { + do_test() { + _script=$1 + _basename=`basename $_script` ++ _broken=0 ++ + if [ -f "$_script" ] + then ++ if [ -f "${_script}.broken" ]; then ++ _broken=1 ++ _broken_msg=$(head -n1 "${_script}.broken" | tr -d '\n') ++ if [ "$skipbroken" == "all" ]; then ++ return ++ elif [ "$skipbroken" == "always" ] && ++ [[ "$_broken_msg" == *always* ]]; then ++ return ++ fi ++ fi ++ + rm -f $targetdir/stderr + # this might have been reset: restore the default. + echo 2000 > /proc/sys/dev/raid/speed_limit_max +@@ -97,10 +113,15 @@ do_test() { + else + save_log fail + _fail=1 ++ if [ "$_broken" == "1" ]; then ++ echo " (KNOWN BROKEN TEST: $_broken_msg)" ++ fi + fi + [ "$savelogs" == "1" ] && + mv -f $targetdir/log $logdir/$_basename.log +- [ "$_fail" == "1" -a "$exitonerror" == "1" ] && exit 1 ++ [ "$ctrl_c_error" == "1" ] && exit 1 ++ [ "$_fail" == "1" -a "$exitonerror" == "1" \ ++ -a "$_broken" == "0" ] && exit 1 + fi + } + +@@ -117,6 +138,8 @@ do_help() { + --logdir=directory Directory to save all logfiles in + --save-logs Usually use with --logdir together + --keep-going | --no-error Don't stop on error, ie. run all tests ++ --skip-broken Skip tests that are known to be broken ++ --skip-always-broken Skip tests that are known to always fail + --dev=loop|lvm|ram|disk Use loop devices (default), LVM, RAM or disk + --disks= Provide a bunch of physical devices for test + --volgroup=name LVM volume group for LVM test +@@ -211,6 +234,12 @@ parse_args() { + --keep-going | --no-error ) + exitonerror=0 + ;; ++ --skip-broken ) ++ skipbroken=all ++ ;; ++ --skip-always-broken ) ++ skipbroken=always ++ ;; + --disable-multipath ) + unset MULTIPATH + ;; +@@ -275,7 +304,11 @@ main() { + if [ $script == "$testdir/11spare-migration" ];then + continue + fi +- do_test $script ++ case $script in ++ *.broken) ;; ++ *) ++ do_test $script ++ esac + done + fi + +-- +2.39.1 + diff --git a/meta/recipes-extended/mdadm/files/0006-tests-Add-broken-files-for-all-broken-tests.patch b/meta/recipes-extended/mdadm/files/0006-tests-Add-broken-files-for-all-broken-tests.patch new file mode 100644 index 0000000000..115b23bac5 --- /dev/null +++ b/meta/recipes-extended/mdadm/files/0006-tests-Add-broken-files-for-all-broken-tests.patch @@ -0,0 +1,454 @@ +From fd1c26ba129b069d9f73afaefdbe53683de3814a Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe <logang@deltatee.com> +Date: Wed, 22 Jun 2022 14:25:19 -0600 +Subject: [PATCH 6/6] tests: Add broken files for all broken tests + +Each broken file contains the rough frequency of brokeness as well +as a brief explanation of what happens when it breaks. Estimates +of failure rates are not statistically significant and can vary +run to run. + +This is really just a view from my window. Tests were done on a +small VM with the default loop devices, not real hardware. We've +seen different kernel configurations can cause bugs to appear as well +(ie. different block schedulers). It may also be that different race +conditions will be seen on machines with different performance +characteristics. + +These annotations were done with the kernel currently in md/md-next: + + facef3b96c5b ("md: Notify sysfs sync_completed in md_reap_sync_thread()") + +Signed-off-by: Logan Gunthorpe <logang@deltatee.com> +Signed-off-by: Jes Sorensen <jes@trained-monkey.org> + +Upstream-Status: Backport + +Reference to upstream patch: +https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=daa86d663476 + +Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> +--- + tests/01r5integ.broken | 7 ++++ + tests/01raid6integ.broken | 7 ++++ + tests/04r5swap.broken | 7 ++++ + tests/07autoassemble.broken | 8 ++++ + tests/07autodetect.broken | 5 +++ + tests/07changelevelintr.broken | 9 +++++ + tests/07changelevels.broken | 9 +++++ + tests/07reshape5intr.broken | 45 ++++++++++++++++++++++ + tests/07revert-grow.broken | 31 +++++++++++++++ + tests/07revert-shrink.broken | 9 +++++ + tests/07testreshape5.broken | 12 ++++++ + tests/09imsm-assemble.broken | 6 +++ + tests/09imsm-create-fail-rebuild.broken | 5 +++ + tests/09imsm-overlap.broken | 7 ++++ + tests/10ddf-assemble-missing.broken | 6 +++ + tests/10ddf-fail-create-race.broken | 7 ++++ + tests/10ddf-fail-two-spares.broken | 5 +++ + tests/10ddf-incremental-wrong-order.broken | 9 +++++ + tests/14imsm-r1_2d-grow-r1_3d.broken | 5 +++ + tests/14imsm-r1_2d-takeover-r0_2d.broken | 6 +++ + tests/18imsm-r10_4d-takeover-r0_2d.broken | 5 +++ + tests/18imsm-r1_2d-takeover-r0_1d.broken | 6 +++ + tests/19raid6auto-repair.broken | 5 +++ + tests/19raid6repair.broken | 5 +++ + 24 files changed, 226 insertions(+) + create mode 100644 tests/01r5integ.broken + create mode 100644 tests/01raid6integ.broken + create mode 100644 tests/04r5swap.broken + create mode 100644 tests/07autoassemble.broken + create mode 100644 tests/07autodetect.broken + create mode 100644 tests/07changelevelintr.broken + create mode 100644 tests/07changelevels.broken + create mode 100644 tests/07reshape5intr.broken + create mode 100644 tests/07revert-grow.broken + create mode 100644 tests/07revert-shrink.broken + create mode 100644 tests/07testreshape5.broken + create mode 100644 tests/09imsm-assemble.broken + create mode 100644 tests/09imsm-create-fail-rebuild.broken + create mode 100644 tests/09imsm-overlap.broken + create mode 100644 tests/10ddf-assemble-missing.broken + create mode 100644 tests/10ddf-fail-create-race.broken + create mode 100644 tests/10ddf-fail-two-spares.broken + create mode 100644 tests/10ddf-incremental-wrong-order.broken + create mode 100644 tests/14imsm-r1_2d-grow-r1_3d.broken + create mode 100644 tests/14imsm-r1_2d-takeover-r0_2d.broken + create mode 100644 tests/18imsm-r10_4d-takeover-r0_2d.broken + create mode 100644 tests/18imsm-r1_2d-takeover-r0_1d.broken + create mode 100644 tests/19raid6auto-repair.broken + create mode 100644 tests/19raid6repair.broken + +diff --git a/tests/01r5integ.broken b/tests/01r5integ.broken +new file mode 100644 +index 0000000..2073763 +--- /dev/null ++++ b/tests/01r5integ.broken +@@ -0,0 +1,7 @@ ++fails rarely ++ ++Fails about 1 in every 30 runs with a sha mismatch error: ++ ++ c49ab26e1b01def7874af9b8a6d6d0c29fdfafe6 /dev/md0 does not match ++ 15dc2f73262f811ada53c65e505ceec9cf025cb9 /dev/md0 with /dev/loop3 ++ missing +diff --git a/tests/01raid6integ.broken b/tests/01raid6integ.broken +new file mode 100644 +index 0000000..1df735f +--- /dev/null ++++ b/tests/01raid6integ.broken +@@ -0,0 +1,7 @@ ++fails infrequently ++ ++Fails about 1 in 5 with a sha mismatch: ++ ++ 8286c2bc045ae2cfe9f8b7ae3a898fa25db6926f /dev/md0 does not match ++ a083a0738b58caab37fd568b91b177035ded37df /dev/md0 with /dev/loop2 and ++ /dev/loop3 missing +diff --git a/tests/04r5swap.broken b/tests/04r5swap.broken +new file mode 100644 +index 0000000..e38987d +--- /dev/null ++++ b/tests/04r5swap.broken +@@ -0,0 +1,7 @@ ++always fails ++ ++Fails with errors: ++ ++ mdadm: /dev/loop0 has no superblock - assembly aborted ++ ++ ERROR: no recovery happening +diff --git a/tests/07autoassemble.broken b/tests/07autoassemble.broken +new file mode 100644 +index 0000000..8be0940 +--- /dev/null ++++ b/tests/07autoassemble.broken +@@ -0,0 +1,8 @@ ++always fails ++ ++Prints lots of messages, but the array doesn't assemble. Error ++possibly related to: ++ ++ mdadm: /dev/md/1 is busy - skipping ++ mdadm: no recogniseable superblock on /dev/md/testing:0 ++ mdadm: /dev/md/2 is busy - skipping +diff --git a/tests/07autodetect.broken b/tests/07autodetect.broken +new file mode 100644 +index 0000000..294954a +--- /dev/null ++++ b/tests/07autodetect.broken +@@ -0,0 +1,5 @@ ++always fails ++ ++Fails with error: ++ ++ ERROR: no resync happening +diff --git a/tests/07changelevelintr.broken b/tests/07changelevelintr.broken +new file mode 100644 +index 0000000..284b490 +--- /dev/null ++++ b/tests/07changelevelintr.broken +@@ -0,0 +1,9 @@ ++always fails ++ ++Fails with errors: ++ ++ mdadm: this change will reduce the size of the array. ++ use --grow --array-size first to truncate array. ++ e.g. mdadm --grow /dev/md0 --array-size 56832 ++ ++ ERROR: no reshape happening +diff --git a/tests/07changelevels.broken b/tests/07changelevels.broken +new file mode 100644 +index 0000000..9b930d9 +--- /dev/null ++++ b/tests/07changelevels.broken +@@ -0,0 +1,9 @@ ++always fails ++ ++Fails with errors: ++ ++ mdadm: /dev/loop0 is smaller than given size. 18976K < 19968K + metadata ++ mdadm: /dev/loop1 is smaller than given size. 18976K < 19968K + metadata ++ mdadm: /dev/loop2 is smaller than given size. 18976K < 19968K + metadata ++ ++ ERROR: /dev/md0 isn't a block device. +diff --git a/tests/07reshape5intr.broken b/tests/07reshape5intr.broken +new file mode 100644 +index 0000000..efe52a6 +--- /dev/null ++++ b/tests/07reshape5intr.broken +@@ -0,0 +1,45 @@ ++always fails ++ ++This patch, recently added to md-next causes the test to always fail: ++ ++7e6ba434cc60 ("md: don't unregister sync_thread with reconfig_mutex ++held") ++ ++The new error is simply: ++ ++ ERROR: no reshape happening ++ ++Before the patch, the error seen is below. ++ ++-- ++ ++fails infrequently ++ ++Fails roughly 1 in 4 runs with errors: ++ ++ mdadm: Merging with already-assembled /dev/md/0 ++ mdadm: cannot re-read metadata from /dev/loop6 - aborting ++ ++ ERROR: no reshape happening ++ ++Also have seen a random deadlock: ++ ++ INFO: task mdadm:109702 blocked for more than 30 seconds. ++ Not tainted 5.18.0-rc3-eid-vmlocalyes-dbg-00095-g3c2b5427979d #2040 ++ "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. ++ task:mdadm state:D stack: 0 pid:109702 ppid: 1 flags:0x00004000 ++ Call Trace: ++ <TASK> ++ __schedule+0x67e/0x13b0 ++ schedule+0x82/0x110 ++ mddev_suspend+0x2e1/0x330 ++ suspend_lo_store+0xbd/0x140 ++ md_attr_store+0xcb/0x130 ++ sysfs_kf_write+0x89/0xb0 ++ kernfs_fop_write_iter+0x202/0x2c0 ++ new_sync_write+0x222/0x330 ++ vfs_write+0x3bc/0x4d0 ++ ksys_write+0xd9/0x180 ++ __x64_sys_write+0x43/0x50 ++ do_syscall_64+0x3b/0x90 ++ entry_SYSCALL_64_after_hwframe+0x44/0xae +diff --git a/tests/07revert-grow.broken b/tests/07revert-grow.broken +new file mode 100644 +index 0000000..9b6db86 +--- /dev/null ++++ b/tests/07revert-grow.broken +@@ -0,0 +1,31 @@ ++always fails ++ ++This patch, recently added to md-next causes the test to always fail: ++ ++7e6ba434cc60 ("md: don't unregister sync_thread with reconfig_mutex held") ++ ++The errors are: ++ ++ mdadm: No active reshape to revert on /dev/loop0 ++ ERROR: active raid5 not found ++ ++Before the patch, the error seen is below. ++ ++-- ++ ++fails rarely ++ ++Fails about 1 in every 30 runs with errors: ++ ++ mdadm: Merging with already-assembled /dev/md/0 ++ mdadm: backup file /tmp/md-backup inaccessible: No such file or directory ++ mdadm: failed to add /dev/loop1 to /dev/md/0: Invalid argument ++ mdadm: failed to add /dev/loop2 to /dev/md/0: Invalid argument ++ mdadm: failed to add /dev/loop3 to /dev/md/0: Invalid argument ++ mdadm: failed to add /dev/loop0 to /dev/md/0: Invalid argument ++ mdadm: /dev/md/0 assembled from 1 drive - need all 5 to start it ++ (use --run to insist). ++ ++ grep: /sys/block/md*/md/sync_action: No such file or directory ++ ++ ERROR: active raid5 not found +diff --git a/tests/07revert-shrink.broken b/tests/07revert-shrink.broken +new file mode 100644 +index 0000000..c33c39e +--- /dev/null ++++ b/tests/07revert-shrink.broken +@@ -0,0 +1,9 @@ ++always fails ++ ++Fails with errors: ++ ++ mdadm: this change will reduce the size of the array. ++ use --grow --array-size first to truncate array. ++ e.g. mdadm --grow /dev/md0 --array-size 53760 ++ ++ ERROR: active raid5 not found +diff --git a/tests/07testreshape5.broken b/tests/07testreshape5.broken +new file mode 100644 +index 0000000..a8ce03e +--- /dev/null ++++ b/tests/07testreshape5.broken +@@ -0,0 +1,12 @@ ++always fails ++ ++Test seems to run 'test_stripe' at $dir directory, but $dir is never ++set. If $dir is adjusted to $PWD, the test still fails with: ++ ++ mdadm: /dev/loop2 is not suitable for this array. ++ mdadm: create aborted ++ ++ return 1 ++ ++ cmp -s -n 8192 /dev/md0 /tmp/RandFile ++ ++ echo cmp failed ++ cmp failed ++ ++ exit 2 +diff --git a/tests/09imsm-assemble.broken b/tests/09imsm-assemble.broken +new file mode 100644 +index 0000000..a6d4d5c +--- /dev/null ++++ b/tests/09imsm-assemble.broken +@@ -0,0 +1,6 @@ ++fails infrequently ++ ++Fails roughly 1 in 10 runs with errors: ++ ++ mdadm: /dev/loop2 is still in use, cannot remove. ++ /dev/loop2 removal from /dev/md/container should have succeeded +diff --git a/tests/09imsm-create-fail-rebuild.broken b/tests/09imsm-create-fail-rebuild.broken +new file mode 100644 +index 0000000..40c4b29 +--- /dev/null ++++ b/tests/09imsm-create-fail-rebuild.broken +@@ -0,0 +1,5 @@ ++always fails ++ ++Fails with error: ++ ++ **Error**: Array size mismatch - expected 3072, actual 16384 +diff --git a/tests/09imsm-overlap.broken b/tests/09imsm-overlap.broken +new file mode 100644 +index 0000000..e7ccab7 +--- /dev/null ++++ b/tests/09imsm-overlap.broken +@@ -0,0 +1,7 @@ ++always fails ++ ++Fails with errors: ++ ++ **Error**: Offset mismatch - expected 15360, actual 0 ++ **Error**: Offset mismatch - expected 15360, actual 0 ++ /dev/md/vol3 failed check +diff --git a/tests/10ddf-assemble-missing.broken b/tests/10ddf-assemble-missing.broken +new file mode 100644 +index 0000000..bfd8d10 +--- /dev/null ++++ b/tests/10ddf-assemble-missing.broken +@@ -0,0 +1,6 @@ ++always fails ++ ++Fails with errors: ++ ++ ERROR: /dev/md/vol0 has unexpected state on /dev/loop10 ++ ERROR: unexpected number of online disks on /dev/loop10 +diff --git a/tests/10ddf-fail-create-race.broken b/tests/10ddf-fail-create-race.broken +new file mode 100644 +index 0000000..6c0df02 +--- /dev/null ++++ b/tests/10ddf-fail-create-race.broken +@@ -0,0 +1,7 @@ ++usually fails ++ ++Fails about 9 out of 10 times with many errors: ++ ++ mdadm: cannot open MISSING: No such file or directory ++ ERROR: non-degraded array found ++ ERROR: disk 0 not marked as failed in meta data +diff --git a/tests/10ddf-fail-two-spares.broken b/tests/10ddf-fail-two-spares.broken +new file mode 100644 +index 0000000..eeea56d +--- /dev/null ++++ b/tests/10ddf-fail-two-spares.broken +@@ -0,0 +1,5 @@ ++fails infrequently ++ ++Fails roughly 1 in 3 with error: ++ ++ ERROR: /dev/md/vol1 should be optimal in meta data +diff --git a/tests/10ddf-incremental-wrong-order.broken b/tests/10ddf-incremental-wrong-order.broken +new file mode 100644 +index 0000000..a5af3ba +--- /dev/null ++++ b/tests/10ddf-incremental-wrong-order.broken +@@ -0,0 +1,9 @@ ++always fails ++ ++Fails with errors: ++ ERROR: sha1sum of /dev/md/vol0 has changed ++ ERROR: /dev/md/vol0 has unexpected state on /dev/loop10 ++ ERROR: unexpected number of online disks on /dev/loop10 ++ ERROR: /dev/md/vol0 has unexpected state on /dev/loop8 ++ ERROR: unexpected number of online disks on /dev/loop8 ++ ERROR: sha1sum of /dev/md/vol0 has changed +diff --git a/tests/14imsm-r1_2d-grow-r1_3d.broken b/tests/14imsm-r1_2d-grow-r1_3d.broken +new file mode 100644 +index 0000000..4ef1d40 +--- /dev/null ++++ b/tests/14imsm-r1_2d-grow-r1_3d.broken +@@ -0,0 +1,5 @@ ++always fails ++ ++Fails with error: ++ ++ mdadm/tests/func.sh: line 325: dvsize/chunk: division by 0 (error token is "chunk") +diff --git a/tests/14imsm-r1_2d-takeover-r0_2d.broken b/tests/14imsm-r1_2d-takeover-r0_2d.broken +new file mode 100644 +index 0000000..89cd4e5 +--- /dev/null ++++ b/tests/14imsm-r1_2d-takeover-r0_2d.broken +@@ -0,0 +1,6 @@ ++always fails ++ ++Fails with error: ++ ++ tests/func.sh: line 325: dvsize/chunk: division by 0 (error token ++ is "chunk") +diff --git a/tests/18imsm-r10_4d-takeover-r0_2d.broken b/tests/18imsm-r10_4d-takeover-r0_2d.broken +new file mode 100644 +index 0000000..a27399f +--- /dev/null ++++ b/tests/18imsm-r10_4d-takeover-r0_2d.broken +@@ -0,0 +1,5 @@ ++fails rarely ++ ++Fails about 1 run in 100 with message: ++ ++ ERROR: size is wrong for /dev/md/vol0: 2 * 5120 (chunk=128) = 20480, not 0 +diff --git a/tests/18imsm-r1_2d-takeover-r0_1d.broken b/tests/18imsm-r1_2d-takeover-r0_1d.broken +new file mode 100644 +index 0000000..aa1982e +--- /dev/null ++++ b/tests/18imsm-r1_2d-takeover-r0_1d.broken +@@ -0,0 +1,6 @@ ++always fails ++ ++Fails with error: ++ ++ tests/func.sh: line 325: dvsize/chunk: division by 0 (error token ++ is "chunk") +diff --git a/tests/19raid6auto-repair.broken b/tests/19raid6auto-repair.broken +new file mode 100644 +index 0000000..e91a142 +--- /dev/null ++++ b/tests/19raid6auto-repair.broken +@@ -0,0 +1,5 @@ ++always fails ++ ++Fails with: ++ ++ "should detect errors" +diff --git a/tests/19raid6repair.broken b/tests/19raid6repair.broken +new file mode 100644 +index 0000000..e91a142 +--- /dev/null ++++ b/tests/19raid6repair.broken +@@ -0,0 +1,5 @@ ++always fails ++ ++Fails with: ++ ++ "should detect errors" +-- +2.39.1 + diff --git a/meta/recipes-extended/mdadm/files/run-ptest b/meta/recipes-extended/mdadm/files/run-ptest index fae8071d43..2380c322a9 100644 --- a/meta/recipes-extended/mdadm/files/run-ptest +++ b/meta/recipes-extended/mdadm/files/run-ptest @@ -2,6 +2,6 @@ mkdir -p /mdadm-testing-dir # make the test continue to execute even one fail -dir=. ./test --keep-going --disable-integrity +dir=. ./test --keep-going --disable-integrity --skip-broken rm -rf /mdadm-testing-dir/* diff --git a/meta/recipes-extended/mdadm/mdadm_4.2.bb b/meta/recipes-extended/mdadm/mdadm_4.2.bb index 19035caaec..e4b98f82c1 100644 --- a/meta/recipes-extended/mdadm/mdadm_4.2.bb +++ b/meta/recipes-extended/mdadm/mdadm_4.2.bb @@ -24,6 +24,18 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/raid/mdadm/${BPN}-${PV}.tar.xz \ file://0001-mdadm-skip-test-11spare-migration.patch \ file://0001-Fix-parsing-of-r-in-monitor-manager-mode.patch \ file://0001-Makefile-install-mdcheck.patch \ + file://0001-mdadm-Fix-optional-write-behind-parameter.patch \ + file://0001-tests-02lineargrow-clear-the-superblock-at-every-ite.patch \ + file://0001-tests-00raid0-add-a-test-that-validates-raid0-with-l.patch \ + file://0001-tests-fix-raid0-tests-for-0.90-metadata.patch \ + file://0001-tests-00readonly-Run-udevadm-settle-before-setting-r.patch \ + file://0001-tests-04update-metadata-avoid-passing-chunk-size-to.patch \ + file://0001-DDF-Cleanup-validate_geometry_ddf_container.patch \ + file://0002-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch \ + file://0003-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch \ + file://0004-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch \ + file://0005-mdadm-test-Mark-and-ignore-broken-test-failures.patch \ + file://0006-tests-Add-broken-files-for-all-broken-tests.patch \ " SRC_URI[sha256sum] = "461c215670864bb74a4d1a3620684aa2b2f8296dffa06743f26dda5557acf01d" @@ -93,10 +105,16 @@ do_install_ptest() { } RDEPENDS:${PN} += "bash" -RDEPENDS:${PN}-ptest += "bash e2fsprogs-mke2fs" +RDEPENDS:${PN}-ptest += " \ + bash \ + e2fsprogs-mke2fs \ + util-linux-lsblk \ + util-linux-losetup \ + util-linux-blockdev \ + strace \ +" RRECOMMENDS:${PN}-ptest += " \ coreutils \ - util-linux \ kernel-module-loop \ kernel-module-linear \ kernel-module-raid0 \ diff --git a/meta/recipes-extended/minicom/minicom/0001-Drop-superfluous-global-variable-definitions.patch b/meta/recipes-extended/minicom/minicom/0001-Drop-superfluous-global-variable-definitions.patch deleted file mode 100644 index 01b23898e7..0000000000 --- a/meta/recipes-extended/minicom/minicom/0001-Drop-superfluous-global-variable-definitions.patch +++ /dev/null @@ -1,35 +0,0 @@ -From b65152ebc03832972115e6d98e50cb6190d01793 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com> -Date: Mon, 3 Feb 2020 13:18:13 +0100 -Subject: [PATCH 1/3] Drop superfluous global variable definitions - -The file minicom.c, by including the minicom.h header, already defines -the global variables 'dial_user' and 'dial_pass'. The object file -minicom.o is always linked to dial.o. Thus the definitions in dial.c -can be dropped. - -This fixes linking with gcc 10 which uses -fno-common by default, -disallowing multiple global variable definitions. - -Upstream-Status: Backport [https://salsa.debian.org/minicom-team/minicom/-/commit/db269bba2a68fde03f5df45ac8372a8f1248ca96] -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - src/dial.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/src/dial.c b/src/dial.c -index eada5ee..d9d481f 100644 ---- a/src/dial.c -+++ b/src/dial.c -@@ -146,8 +146,6 @@ static int newtype; - /* Access to ".dialdir" denied? */ - static int dendd = 0; - static char *tagged; --char *dial_user; --char *dial_pass; - - /* Change the baud rate. Treat all characters in the given array as if - * they were key presses within the comm parameters dialog (C-A P) and --- -2.24.1 - diff --git a/meta/recipes-extended/minicom/minicom/0002-Drop-superfluous-global-variable-definitions.patch b/meta/recipes-extended/minicom/minicom/0002-Drop-superfluous-global-variable-definitions.patch deleted file mode 100644 index e86b470b7e..0000000000 --- a/meta/recipes-extended/minicom/minicom/0002-Drop-superfluous-global-variable-definitions.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 924bd2da3a00e030e29d82b74ef82900bd50b475 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com> -Date: Mon, 3 Feb 2020 13:18:33 +0100 -Subject: [PATCH 2/3] Drop superfluous global variable definitions - -The only place where the EXTERN macro mechanism is used to define the -global variables 'vt_outmap' and 'vt_inmap' is minicom.c (by defining -an empty EXTERN macro and including the minicom.h header). The file -vt100.c already defines these variables. The vt100.o object file is -always linked to minicom.o. Thus it is safe not to define the -variables in minicom.c and only declare them in the minicom.h header. - -This fixes linking with gcc 10 which uses -fno-common by default, -disallowing multiple global variable definitions. - -Upstream-Status: Backport [https://salsa.debian.org/minicom-team/minicom/-/commit/c69cad5b5dda85d361a3a0c1fddc65e933f26d11] -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - src/minicom.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/minicom.h b/src/minicom.h -index 061c013..0f9693b 100644 ---- a/src/minicom.h -+++ b/src/minicom.h -@@ -141,7 +141,7 @@ EXTERN int sbcolor; /* Status Bar Background Color */ - EXTERN int st_attr; /* Status Bar attributes. */ - - /* jl 04.09.97 conversion tables */ --EXTERN unsigned char vt_outmap[256], vt_inmap[256]; -+extern unsigned char vt_outmap[256], vt_inmap[256]; - - /* MARK updated 02/17/95 - history buffer */ - EXTERN int num_hist_lines; /* History buffer size */ --- -2.24.1 - diff --git a/meta/recipes-extended/minicom/minicom/0003-Drop-superfluous-global-variable-definitions.patch b/meta/recipes-extended/minicom/minicom/0003-Drop-superfluous-global-variable-definitions.patch deleted file mode 100644 index 3225a0c32a..0000000000 --- a/meta/recipes-extended/minicom/minicom/0003-Drop-superfluous-global-variable-definitions.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a4fc603b3641d2efe31479116eb7ba66932901c7 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com> -Date: Mon, 3 Feb 2020 13:21:41 +0100 -Subject: [PATCH 3/3] Drop superfluous global variable definitions - -The only place where the EXTERN macro mechanism is used to define the -global variables 'portfd_is_socket', 'portfd_is_connected' and -'portfd_sock_addr' is minicom.c (by defining an empty EXTERN macro and -including the minicom.h header). The source file sysdep1_s.c already -defines these variables. The sysdep1_s.o object file is always linked -to minicom.o. Thus it is safe to drop the definitions from minicom.c -and only declare the variables in the minicom.h header. - -This fixes linking with gcc 10 which uses -fno-common by default, -disallowing multiple global variable definitions. - -Upstream-Status: Backport [https://salsa.debian.org/minicom-team/minicom/-/commit/c8382374c5d340aa4115d527aed76e876ee5456b] -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - src/minicom.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/minicom.h b/src/minicom.h -index 0f9693b..1e7cb8c 100644 ---- a/src/minicom.h -+++ b/src/minicom.h -@@ -113,9 +113,9 @@ EXTERN char *dial_user; /* Our username there */ - EXTERN char *dial_pass; /* Our password */ - - #ifdef USE_SOCKET --EXTERN int portfd_is_socket; /* File descriptor is a unix socket */ --EXTERN int portfd_is_connected; /* 1 if the socket is connected */ --EXTERN struct sockaddr_un portfd_sock_addr; /* the unix socket address */ -+extern int portfd_is_socket; /* File descriptor is a unix socket */ -+extern int portfd_is_connected; /* 1 if the socket is connected */ -+extern struct sockaddr_un portfd_sock_addr; /* the unix socket address */ - #define portfd_connected ((portfd_is_socket && !portfd_is_connected) \ - ? -1 : portfd) - #else --- -2.24.1 - diff --git a/meta/recipes-extended/pam/libpam/0001-pam_motd-do-not-rely-on-all-filesystems-providing-a-.patch b/meta/recipes-extended/pam/libpam/0001-pam_motd-do-not-rely-on-all-filesystems-providing-a-.patch new file mode 100644 index 0000000000..94dcb04f0a --- /dev/null +++ b/meta/recipes-extended/pam/libpam/0001-pam_motd-do-not-rely-on-all-filesystems-providing-a-.patch @@ -0,0 +1,108 @@ +From 42404548721c653317c911c83d885e2fc7fbca70 Mon Sep 17 00:00:00 2001 +From: Per Jessen <per@jessen.ch> +Date: Fri, 22 Apr 2022 18:15:36 +0200 +Subject: [PATCH] pam_motd: do not rely on all filesystems providing a filetype + +When using scandir() to look for MOTD files to display, we wrongly +relied on all filesystems providing a filetype. This is a fix to divert +to lstat() when we have no filetype. To maintain MT safety, it isn't +possible to use lstat() in the scandir() filter function, so all of the +filtering has been moved to an additional loop after scanning all the +motd dirs. +Also, remove superfluous alphasort from scandir(), we are doing +a qsort() later. + +Resolves: https://github.com/linux-pam/linux-pam/issues/455 + +Upstream-Status: Backport [https://github.com/linux-pam/linux-pam/commit/42404548721c653317c911c83d885e2fc7fbca70] + +Signed-off-by: Per Jessen <per@jessen.ch> +Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> +--- + modules/pam_motd/pam_motd.c | 49 ++++++++++++++++++++++++++++++------- + 1 file changed, 40 insertions(+), 9 deletions(-) + +diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c +index 6ac8cba2..5ca486e4 100644 +--- a/modules/pam_motd/pam_motd.c ++++ b/modules/pam_motd/pam_motd.c +@@ -166,11 +166,6 @@ static int compare_strings(const void *a, const void *b) + } + } + +-static int filter_dirents(const struct dirent *d) +-{ +- return (d->d_type == DT_REG || d->d_type == DT_LNK); +-} +- + static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + char **motd_dir_path_split, unsigned int num_motd_dirs, int report_missing) + { +@@ -199,8 +194,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + + for (i = 0; i < num_motd_dirs; i++) { + int rv; +- rv = scandir(motd_dir_path_split[i], &(dirscans[i]), +- filter_dirents, alphasort); ++ rv = scandir(motd_dir_path_split[i], &(dirscans[i]), NULL, NULL); + if (rv < 0) { + if (errno != ENOENT || report_missing) { + pam_syslog(pamh, LOG_ERR, "error scanning directory %s: %m", +@@ -215,6 +209,41 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + if (dirscans_size_total == 0) + goto out; + ++ /* filter out unwanted names, directories, and complement data with lstat() */ ++ for (i = 0; i < num_motd_dirs; i++) { ++ struct dirent **d = dirscans[i]; ++ for (unsigned int j = 0; j < dirscans_sizes[i]; j++) { ++ int rc; ++ char *fullpath; ++ struct stat s; ++ ++ switch(d[j]->d_type) { /* the filetype determines how to proceed */ ++ case DT_REG: /* regular files and */ ++ case DT_LNK: /* symlinks */ ++ continue; /* are good. */ ++ case DT_UNKNOWN: /* for file systems that do not provide */ ++ /* a filetype, we use lstat() */ ++ if (join_dir_strings(&fullpath, motd_dir_path_split[i], ++ d[j]->d_name) <= 0) ++ break; ++ rc = lstat(fullpath, &s); ++ _pam_drop(fullpath); /* free the memory alloc'ed by join_dir_strings */ ++ if (rc != 0) /* if the lstat() somehow failed */ ++ break; ++ ++ if (S_ISREG(s.st_mode) || /* regular files and */ ++ S_ISLNK(s.st_mode)) continue; /* symlinks are good */ ++ break; ++ case DT_DIR: /* We don't want directories */ ++ default: /* nor anything else */ ++ break; ++ } ++ _pam_drop(d[j]); /* free memory */ ++ d[j] = NULL; /* indicate this one was dropped */ ++ dirscans_size_total--; ++ } ++ } ++ + /* Allocate space for all file names found in the directories, including duplicates. */ + if ((dirnames_all = calloc(dirscans_size_total, sizeof(*dirnames_all))) == NULL) { + pam_syslog(pamh, LOG_CRIT, "failed to allocate dirname array"); +@@ -225,8 +254,10 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + unsigned int j; + + for (j = 0; j < dirscans_sizes[i]; j++) { +- dirnames_all[i_dirnames] = dirscans[i][j]->d_name; +- i_dirnames++; ++ if (NULL != dirscans[i][j]) { ++ dirnames_all[i_dirnames] = dirscans[i][j]->d_name; ++ i_dirnames++; ++ } + } + } + +-- +2.39.0 + diff --git a/meta/recipes-extended/pam/libpam/CVE-2024-22365.patch b/meta/recipes-extended/pam/libpam/CVE-2024-22365.patch new file mode 100644 index 0000000000..e9e3a078e0 --- /dev/null +++ b/meta/recipes-extended/pam/libpam/CVE-2024-22365.patch @@ -0,0 +1,62 @@ +From 031bb5a5d0d950253b68138b498dc93be69a64cb Mon Sep 17 00:00:00 2001 +From: Matthias Gerstner <matthias.gerstner@suse.de> +Date: Wed, 27 Dec 2023 14:01:59 +0100 +Subject: [PATCH] pam_namespace: protect_dir(): use O_DIRECTORY to prevent + local DoS situations + +Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs +being placed in user controlled directories, causing the PAM module to +block indefinitely during `openat()`. + +Pass O_DIRECTORY to cause the `openat()` to fail if the path does not +refer to a directory. + +With this the check whether the final path element is a directory +becomes unnecessary, drop it. + +Upstream-Status: Backport [https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb] +CVE: CVE-2024-22365 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + modules/pam_namespace/pam_namespace.c | 18 +----------------- + 1 file changed, 1 insertion(+), 17 deletions(-) + +diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c +index 4d4188d..d6b1d3c 100644 +--- a/modules/pam_namespace/pam_namespace.c ++++ b/modules/pam_namespace/pam_namespace.c +@@ -1103,7 +1103,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, + int dfd = AT_FDCWD; + int dfd_next; + int save_errno; +- int flags = O_RDONLY; ++ int flags = O_RDONLY | O_DIRECTORY; + int rv = -1; + struct stat st; + +@@ -1157,22 +1157,6 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, + rv = openat(dfd, dir, flags); + } + +- if (rv != -1) { +- if (fstat(rv, &st) != 0) { +- save_errno = errno; +- close(rv); +- rv = -1; +- errno = save_errno; +- goto error; +- } +- if (!S_ISDIR(st.st_mode)) { +- close(rv); +- errno = ENOTDIR; +- rv = -1; +- goto error; +- } +- } +- + if (flags & O_NOFOLLOW) { + /* we are inside user-owned dir - protect */ + if (protect_mount(rv, p, idata) == -1) { +-- +2.25.1 + diff --git a/meta/recipes-extended/pam/libpam_1.5.2.bb b/meta/recipes-extended/pam/libpam_1.5.2.bb index dabd3256c8..20745aa837 100644 --- a/meta/recipes-extended/pam/libpam_1.5.2.bb +++ b/meta/recipes-extended/pam/libpam_1.5.2.bb @@ -25,6 +25,8 @@ SRC_URI = "https://github.com/linux-pam/linux-pam/releases/download/v${PV}/Linux file://run-ptest \ file://pam-volatiles.conf \ file://CVE-2022-28321-0002.patch \ + file://0001-pam_motd-do-not-rely-on-all-filesystems-providing-a-.patch \ + file://CVE-2024-22365.patch \ " SRC_URI[sha256sum] = "e4ec7131a91da44512574268f493c6d8ca105c87091691b8e9b56ca685d4f94d" diff --git a/meta/recipes-extended/procps/procps/CVE-2023-4016.patch b/meta/recipes-extended/procps/procps/CVE-2023-4016.patch new file mode 100644 index 0000000000..c530b1cfea --- /dev/null +++ b/meta/recipes-extended/procps/procps/CVE-2023-4016.patch @@ -0,0 +1,85 @@ +From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001 +From: Craig Small <csmall@dropbear.xyz> +Date: Thu, 10 Aug 2023 21:18:38 +1000 +Subject: [PATCH] ps: Fix possible buffer overflow in -C option + +ps allocates memory using malloc(length of arg * len of struct). +In certain strange circumstances, the arg length could be very large +and the multiplecation will overflow, allocating a small amount of +memory. + +Subsequent strncpy() will then write into unallocated memory. +The fix is to use calloc. It's slower but this is a one-time +allocation. Other malloc(x * y) calls have also been replaced +by calloc(x, y) + +References: + https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016 + https://nvd.nist.gov/vuln/detail/CVE-2023-4016 + https://gitlab.com/procps-ng/procps/-/issues/297 + https://bugs.debian.org/1042887 + +Signed-off-by: Craig Small <csmall@dropbear.xyz> + +CVE: CVE-2023-4016 +Upstream-Status: Backport [https://gitlab.com/procps-ng/procps/-/commit/2c933ecba3bb1d3041a5a7a53a7b4078a6003413] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> + +--- + NEWS | 1 + + ps/parser.c | 8 ++++---- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/NEWS b/NEWS +index b9509734..64fa3da8 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,3 +1,5 @@ ++ * ps: Fix buffer overflow in -C option CVE-2023-4016 Debian #1042887, issue #297 ++ + procps-ng-3.3.17 + --------------- + * library: Incremented to 8:3:0 +diff --git a/ps/parser.c b/ps/parser.c +index 248aa741..15873dfa 100644 +--- a/ps/parser.c ++++ b/ps/parser.c +@@ -184,7 +184,6 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s + const char *err; /* error code that could or did happen */ + /*** prepare to operate ***/ + node = malloc(sizeof(selection_node)); +- node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */ + node->n = 0; + buf = strdup(arg); + /*** sanity check and count items ***/ +@@ -205,6 +204,7 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s + } while (*++walk); + if(need_item) goto parse_error; + node->n = items; ++ node->u = calloc(items, sizeof(sel_union)); + /*** actually parse the list ***/ + walk = buf; + while(items--){ +@@ -1031,15 +1031,15 @@ static const char *parse_trailing_pids(void){ + thisarg = ps_argc - 1; /* we must be at the end now */ + + pidnode = malloc(sizeof(selection_node)); +- pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ ++ pidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ + pidnode->n = 0; + + grpnode = malloc(sizeof(selection_node)); +- grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ ++ grpnode->u = calloc(i,sizeof(sel_union)); /* waste is insignificant */ + grpnode->n = 0; + + sidnode = malloc(sizeof(selection_node)); +- sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ ++ sidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ + sidnode->n = 0; + + while(i--){ +-- +GitLab + diff --git a/meta/recipes-extended/procps/procps_3.3.17.bb b/meta/recipes-extended/procps/procps_3.3.17.bb index 0f5575c9ab..897f28f187 100644 --- a/meta/recipes-extended/procps/procps_3.3.17.bb +++ b/meta/recipes-extended/procps/procps_3.3.17.bb @@ -16,6 +16,7 @@ SRC_URI = "git://gitlab.com/procps-ng/procps.git;protocol=https;branch=master \ file://sysctl.conf \ file://0001-w.c-correct-musl-builds.patch \ file://0002-proc-escape.c-add-missing-include.patch \ + file://CVE-2023-4016.patch \ " SRCREV = "19a508ea121c0c4ac6d0224575a036de745eaaf8" diff --git a/meta/recipes-extended/psmisc/psmisc.inc b/meta/recipes-extended/psmisc/psmisc.inc index 12539dad53..44b82bd325 100644 --- a/meta/recipes-extended/psmisc/psmisc.inc +++ b/meta/recipes-extended/psmisc/psmisc.inc @@ -54,3 +54,5 @@ ALTERNATIVE_PRIORITY = "90" ALTERNATIVE:killall = "killall" ALTERNATIVE:fuser = "fuser" + +ALTERNATIVE:pstree = "pstree" diff --git a/meta/recipes-extended/screen/screen/CVE-2023-24626.patch b/meta/recipes-extended/screen/screen/CVE-2023-24626.patch new file mode 100644 index 0000000000..73caf9d81b --- /dev/null +++ b/meta/recipes-extended/screen/screen/CVE-2023-24626.patch @@ -0,0 +1,40 @@ +From e9ad41bfedb4537a6f0de20f00b27c7739f168f7 Mon Sep 17 00:00:00 2001 +From: Alexander Naumov <alexander_naumov@opensuse.org> +Date: Mon, 30 Jan 2023 17:22:25 +0200 +Subject: fix: missing signal sending permission check on failed query messages + +Signed-off-by: Alexander Naumov <alexander_naumov@opensuse.org> + +CVE: CVE-2023-24626 +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/screen.git/commit/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7] +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + socket.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/socket.c b/socket.c +index bb68b35..9d87445 100644 +--- a/socket.c ++++ b/socket.c +@@ -1285,11 +1285,16 @@ ReceiveMsg() + else + queryflag = -1; + +- Kill(m.m.command.apid, ++ if (CheckPid(m.m.command.apid)) { ++ Msg(0, "Query attempt with bad pid(%d)!", m.m.command.apid); ++ } ++ else { ++ Kill(m.m.command.apid, + (queryflag >= 0) + ? SIGCONT + : SIG_BYE); /* Send SIG_BYE if an error happened */ +- queryflag = -1; ++ queryflag = -1; ++ } + } + break; + case MSG_COMMAND: +-- +2.25.1 + diff --git a/meta/recipes-extended/screen/screen_4.9.0.bb b/meta/recipes-extended/screen/screen_4.9.0.bb index b36173b8de..19070d87d8 100644 --- a/meta/recipes-extended/screen/screen_4.9.0.bb +++ b/meta/recipes-extended/screen/screen_4.9.0.bb @@ -21,6 +21,7 @@ SRC_URI = "${GNU_MIRROR}/screen/screen-${PV}.tar.gz \ file://0002-comm.h-now-depends-on-term.h.patch \ file://0001-fix-for-multijob-build.patch \ file://0001-Remove-more-compatibility-stuff.patch \ + file://CVE-2023-24626.patch \ " SRC_URI[sha256sum] = "f9335281bb4d1538ed078df78a20c2f39d3af9a4e91c57d084271e0289c730f4" diff --git a/meta/recipes-extended/shadow/files/0001-Overhaul-valid_field.patch b/meta/recipes-extended/shadow/files/0001-Overhaul-valid_field.patch new file mode 100644 index 0000000000..ac08be515b --- /dev/null +++ b/meta/recipes-extended/shadow/files/0001-Overhaul-valid_field.patch @@ -0,0 +1,65 @@ +From 2eaea70111f65b16d55998386e4ceb4273c19eb4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com> +Date: Fri, 31 Mar 2023 14:46:50 +0200 +Subject: [PATCH] Overhaul valid_field() + +e5905c4b ("Added control character check") introduced checking for +control characters but had the logic inverted, so it rejects all +characters that are not control ones. + +Cast the character to `unsigned char` before passing to the character +checking functions to avoid UB. + +Use strpbrk(3) for the illegal character test and return early. + +Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/2eaea70111f65b16d55998386e4ceb4273c19eb4] + +Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> +--- + lib/fields.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/lib/fields.c b/lib/fields.c +index fb51b582..53929248 100644 +--- a/lib/fields.c ++++ b/lib/fields.c +@@ -37,26 +37,22 @@ int valid_field (const char *field, const char *illegal) + + /* For each character of field, search if it appears in the list + * of illegal characters. */ ++ if (illegal && NULL != strpbrk (field, illegal)) { ++ return -1; ++ } ++ ++ /* Search if there are non-printable or control characters */ + for (cp = field; '\0' != *cp; cp++) { +- if (strchr (illegal, *cp) != NULL) { ++ unsigned char c = *cp; ++ if (!isprint (c)) { ++ err = 1; ++ } ++ if (iscntrl (c)) { + err = -1; + break; + } + } + +- if (0 == err) { +- /* Search if there are non-printable or control characters */ +- for (cp = field; '\0' != *cp; cp++) { +- if (!isprint (*cp)) { +- err = 1; +- } +- if (!iscntrl (*cp)) { +- err = -1; +- break; +- } +- } +- } +- + return err; + } + +-- +2.34.1 + diff --git a/meta/recipes-extended/shadow/files/CVE-2023-29383.patch b/meta/recipes-extended/shadow/files/CVE-2023-29383.patch new file mode 100644 index 0000000000..f53341d3fc --- /dev/null +++ b/meta/recipes-extended/shadow/files/CVE-2023-29383.patch @@ -0,0 +1,53 @@ +From e5905c4b84d4fb90aefcd96ee618411ebfac663d Mon Sep 17 00:00:00 2001 +From: tomspiderlabs <128755403+tomspiderlabs@users.noreply.github.com> +Date: Thu, 23 Mar 2023 23:39:38 +0000 +Subject: [PATCH] Added control character check + +Added control character check, returning -1 (to "err") if control characters are present. + +CVE: CVE-2023-29383 +Upstream-Status: Backport + +Reference to upstream: +https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d + +Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> +--- + lib/fields.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/lib/fields.c b/lib/fields.c +index 640be931..fb51b582 100644 +--- a/lib/fields.c ++++ b/lib/fields.c +@@ -21,9 +21,9 @@ + * + * The supplied field is scanned for non-printable and other illegal + * characters. +- * + -1 is returned if an illegal character is present. +- * + 1 is returned if no illegal characters are present, but the field +- * contains a non-printable character. ++ * + -1 is returned if an illegal or control character is present. ++ * + 1 is returned if no illegal or control characters are present, ++ * but the field contains a non-printable character. + * + 0 is returned otherwise. + */ + int valid_field (const char *field, const char *illegal) +@@ -45,10 +45,13 @@ int valid_field (const char *field, const char *illegal) + } + + if (0 == err) { +- /* Search if there are some non-printable characters */ ++ /* Search if there are non-printable or control characters */ + for (cp = field; '\0' != *cp; cp++) { + if (!isprint (*cp)) { + err = 1; ++ } ++ if (!iscntrl (*cp)) { ++ err = -1; + break; + } + } +-- +2.34.1 + diff --git a/meta/recipes-extended/shadow/files/CVE-2023-4641-0001.patch b/meta/recipes-extended/shadow/files/CVE-2023-4641-0001.patch new file mode 100644 index 0000000000..2d3c462f4d --- /dev/null +++ b/meta/recipes-extended/shadow/files/CVE-2023-4641-0001.patch @@ -0,0 +1,36 @@ +From 58b6e97a9eef866e9e479fb781aaaf59fb11ef36 Mon Sep 17 00:00:00 2001 +From: Christian Göttsche <cgzones@googlemail.com> +Date: Mon Apr 25 12:17:40 2022 +0200 +Subject: [PATCH 1/2] passwd: erase password copy on all error branches + +CVE: CVE-2023-4641 + +Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/58b6e97a9eef866e9e479fb781aaaf59fb11ef36] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/passwd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/passwd.c b/src/passwd.c +index 80531ec..8c6f81a 100644 +--- a/src/passwd.c ++++ b/src/passwd.c +@@ -289,6 +289,7 @@ static int new_password (const struct passwd *pw) + cp = getpass (_("New password: ")); + if (NULL == cp) { + memzero (orig, sizeof orig); ++ memzero (pass, sizeof pass); + return -1; + } + if (warned && (strcmp (pass, cp) != 0)) { +@@ -316,6 +317,7 @@ static int new_password (const struct passwd *pw) + cp = getpass (_("Re-enter new password: ")); + if (NULL == cp) { + memzero (orig, sizeof orig); ++ memzero (pass, sizeof pass); + return -1; + } + if (strcmp (cp, pass) != 0) { +-- +2.40.0 diff --git a/meta/recipes-extended/shadow/files/CVE-2023-4641-0002.patch b/meta/recipes-extended/shadow/files/CVE-2023-4641-0002.patch new file mode 100644 index 0000000000..a37379d7a0 --- /dev/null +++ b/meta/recipes-extended/shadow/files/CVE-2023-4641-0002.patch @@ -0,0 +1,147 @@ +From 65c88a43a23c2391dcc90c0abda3e839e9c57904 Mon Sep 17 00:00:00 2001 +From: Alejandro Colomar <alx@kernel.org> +Date: Sat, 10 Jun 2023 16:20:05 +0200 +Subject: [PATCH 2/2] gpasswd(1): Fix password leak + +How to trigger this password leak? +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +When gpasswd(1) asks for the new password, it asks twice (as is usual +for confirming the new password). Each of those 2 password prompts +uses agetpass() to get the password. If the second agetpass() fails, +the first password, which has been copied into the 'static' buffer +'pass' via STRFCPY(), wasn't being zeroed. + +agetpass() is defined in <./libmisc/agetpass.c> (around line 91), and +can fail for any of the following reasons: + +- malloc(3) or readpassphrase(3) failure. + + These are going to be difficult to trigger. Maybe getting the system + to the limits of memory utilization at that exact point, so that the + next malloc(3) gets ENOMEM, and possibly even the OOM is triggered. + About readpassphrase(3), ENFILE and EINTR seem the only plausible + ones, and EINTR probably requires privilege or being the same user; + but I wouldn't discard ENFILE so easily, if a process starts opening + files. + +- The password is longer than PASS_MAX. + + The is plausible with physical access. However, at that point, a + keylogger will be a much simpler attack. + +And, the attacker must be able to know when the second password is being +introduced, which is not going to be easy. + +How to read the password after the leak? +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Provoking the leak yourself at the right point by entering a very long +password is easy, and inspecting the process stack at that point should +be doable. Try to find some consistent patterns. + +Then, search for those patterns in free memory, right after the victim +leaks their password. + +Once you get the leak, a program should read all the free memory +searching for patterns that gpasswd(1) leaves nearby the leaked +password. + +On 6/10/23 03:14, Seth Arnold wrote: +> An attacker process wouldn't be able to use malloc(3) for this task. +> There's a handful of tools available for userspace to allocate memory: +> +> - brk / sbrk +> - mmap MAP_ANONYMOUS +> - mmap /dev/zero +> - mmap some other file +> - shm_open +> - shmget +> +> Most of these return only pages of zeros to a process. Using mmap of an +> existing file, you can get some of the contents of the file demand-loaded +> into the memory space on the first use. +> +> The MAP_UNINITIALIZED flag only works if the kernel was compiled with +> CONFIG_MMAP_ALLOW_UNINITIALIZED. This is rare. +> +> malloc(3) doesn't zero memory, to our collective frustration, but all the +> garbage in the allocations is from previous allocations in the current +> process. It isn't leftover from other processes. +> +> The avenues available for reading the memory: +> - /dev/mem and /dev/kmem (requires root, not available with Secure Boot) +> - /proc/pid/mem (requires ptrace privileges, mediated by YAMA) +> - ptrace (requires ptrace privileges, mediated by YAMA) +> - causing memory to be swapped to disk, and then inspecting the swap +> +> These all require a certain amount of privileges. + +How to fix it? +~~~~~~~~~~~~~~ + +memzero(), which internally calls explicit_bzero(3), or whatever +alternative the system provides with a slightly different name, will +make sure that the buffer is zeroed in memory, and optimizations are not +allowed to impede this zeroing. + +This is not really 100% effective, since compilers may place copies of +the string somewhere hidden in the stack. Those copies won't get zeroed +by explicit_bzero(3). However, that's arguably a compiler bug, since +compilers should make everything possible to avoid optimizing strings +that are later passed to explicit_bzero(3). But we all know that +sometimes it's impossible to have perfect knowledge in the compiler, so +this is plausible. Nevertheless, there's nothing we can do against such +issues, except minimizing the time such passwords are stored in plain +text. + +Security concerns +~~~~~~~~~~~~~~~~~ + +We believe this isn't easy to exploit. Nevertheless, and since the fix +is trivial, this fix should probably be applied soon, and backported to +all supported distributions, to prevent someone else having more +imagination than us to find a way. + +Affected versions +~~~~~~~~~~~~~~~~~ + +All. Bug introduced in shadow 19990709. That's the second commit in +the git history. + +Fixes: 45c6603cc86c ("[svn-upgrade] Integrating new upstream version, shadow (19990709)") +Reported-by: Alejandro Colomar <alx@kernel.org> +Cc: Serge Hallyn <serge@hallyn.com> +Cc: Iker Pedrosa <ipedrosa@redhat.com> +Cc: Seth Arnold <seth.arnold@canonical.com> +Cc: Christian Brauner <christian@brauner.io> +Cc: Balint Reczey <rbalint@debian.org> +Cc: Sam James <sam@gentoo.org> +Cc: David Runge <dvzrv@archlinux.org> +Cc: Andreas Jaeger <aj@suse.de> +Cc: <~hallyn/shadow@lists.sr.ht> +Signed-off-by: Alejandro Colomar <alx@kernel.org> + +CVE: CVE-2023-4641 + +Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/gpasswd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/gpasswd.c b/src/gpasswd.c +index c7c9477..00ca569 100644 +--- a/src/gpasswd.c ++++ b/src/gpasswd.c +@@ -896,6 +896,7 @@ static void change_passwd (struct group *gr) + strzero (cp); + cp = getpass (_("Re-enter new password: ")); + if (NULL == cp) { ++ memzero (pass, sizeof pass); + exit (1); + } + +-- +2.40.0 diff --git a/meta/recipes-extended/shadow/files/login.defs_shadow-sysroot b/meta/recipes-extended/shadow/files/login.defs_shadow-sysroot index 8a68dd341a..09df77d2e7 100644 --- a/meta/recipes-extended/shadow/files/login.defs_shadow-sysroot +++ b/meta/recipes-extended/shadow/files/login.defs_shadow-sysroot @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: BSD-3-Clause OR Artistic-1.0 # # /etc/login.defs - Configuration control definitions for the shadow package. # diff --git a/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb b/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb index e05fa237a2..6580bd9166 100644 --- a/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb +++ b/meta/recipes-extended/shadow/shadow-sysroot_4.6.bb @@ -3,7 +3,7 @@ HOMEPAGE = "http://github.com/shadow-maint/shadow" BUGTRACKER = "http://github.com/shadow-maint/shadow/issues" SECTION = "base utils" LICENSE = "BSD-3-Clause | Artistic-1.0" -LIC_FILES_CHKSUM = "file://login.defs_shadow-sysroot;md5=25e2f2de4dfc8f966ac5cdfce45cd7d5" +LIC_FILES_CHKSUM = "file://login.defs_shadow-sysroot;endline=1;md5=ceddfb61608e4db87012499555184aed" DEPENDS = "base-passwd" diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc index 5106b95571..57b5002e8b 100644 --- a/meta/recipes-extended/shadow/shadow.inc +++ b/meta/recipes-extended/shadow/shadow.inc @@ -16,6 +16,10 @@ SRC_URI = "https://github.com/shadow-maint/shadow/releases/download/v${PV}/${BP} ${@bb.utils.contains('PACKAGECONFIG', 'pam', '${PAM_SRC_URI}', '', d)} \ file://shadow-relaxed-usernames.patch \ file://useradd \ + file://CVE-2023-29383.patch \ + file://0001-Overhaul-valid_field.patch \ + file://CVE-2023-4641-0001.patch \ + file://CVE-2023-4641-0002.patch \ " SRC_URI:append:class-target = " \ diff --git a/meta/recipes-extended/shadow/shadow_4.11.1.bb b/meta/recipes-extended/shadow/shadow_4.11.1.bb index 40b11345c9..d1a3fd5593 100644 --- a/meta/recipes-extended/shadow/shadow_4.11.1.bb +++ b/meta/recipes-extended/shadow/shadow_4.11.1.bb @@ -9,3 +9,6 @@ BBCLASSEXTEND = "native nativesdk" # Severity is low and marked as closed and won't fix. # https://bugzilla.redhat.com/show_bug.cgi?id=884658 CVE_CHECK_IGNORE += "CVE-2013-4235" + +# This is an issue for a different shadow +CVE_CHECK_IGNORE += "CVE-2016-15024" diff --git a/meta/recipes-extended/stress-ng/stress-ng-0.13.12/0001-Makefile-avoid-calling-sync.patch b/meta/recipes-extended/stress-ng/stress-ng-0.13.12/0001-Makefile-avoid-calling-sync.patch new file mode 100644 index 0000000000..fec8c524eb --- /dev/null +++ b/meta/recipes-extended/stress-ng/stress-ng-0.13.12/0001-Makefile-avoid-calling-sync.patch @@ -0,0 +1,35 @@ +From 1d1801902a4944c6f5fa521c19b32fbac7342a0c Mon Sep 17 00:00:00 2001 +From: Colin Ian King <colin.i.king@gmail.com> +Date: Sat, 6 Aug 2022 13:05:59 +0000 +Subject: [PATCH] Makefile: avoid calling sync + +Original commit message: +Makefile: use ld-gold if it is available + +Speed up linking by using ld-gold if is available. Add build +time detection to see if compiler allows it + +MJ: backported only the "sync" removal from Makefile as calling + it from do_compile in the middle of big OE world build harms + the build time. + +Upstream-Status: Backport [V0.14.04 c10e5c3f9f5560a085279f4c4b399c2f34cb897d] + +Signed-off-by: Colin Ian King <colin.i.king@gmail.com> +Signed-off-by: Martin Jansa <martin.jansa@gmail.com> +--- + Makefile | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/Makefile b/Makefile +index f8f71c54b..23db4c612 100644 +--- a/Makefile ++++ b/Makefile +@@ -425,7 +425,6 @@ OBJS += $(CONFIG_OBJS) + stress-ng: $(OBJS) + $(Q)echo "LD $@" + $(V)$(CC) $(CPPFLAGS) $(CFLAGS) $(OBJS) -lm $(LDFLAGS) -o $@ +- $(V)sync + + config.h: + +$(MAKE) -f Makefile.config STATIC=$(STATIC) -j diff --git a/meta/recipes-extended/stress-ng/stress-ng_0.13.12.bb b/meta/recipes-extended/stress-ng/stress-ng_0.13.12.bb index 807ecd3466..72dafddaf8 100644 --- a/meta/recipes-extended/stress-ng/stress-ng_0.13.12.bb +++ b/meta/recipes-extended/stress-ng/stress-ng_0.13.12.bb @@ -7,6 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" SRC_URI = "git://github.com/ColinIanKing/stress-ng.git;protocol=https;branch=master \ file://0001-stress-cpu-disable-float128-math-on-powerpc64-to-avo.patch \ + file://0001-Makefile-avoid-calling-sync.patch \ " SRCREV = "f59bcb2fe1e25042e77d5e4942f72bfa026fa305" S = "${WORKDIR}/git" diff --git a/meta/recipes-extended/sudo/files/0001-lib-util-mksigname.c-correctly-include-header-for-ou.patch b/meta/recipes-extended/sudo/files/0001-lib-util-mksigname.c-correctly-include-header-for-ou.patch deleted file mode 100644 index f63ed553be..0000000000 --- a/meta/recipes-extended/sudo/files/0001-lib-util-mksigname.c-correctly-include-header-for-ou.patch +++ /dev/null @@ -1,25 +0,0 @@ -From f993c5c88faacc43971899aae2168ffb3e34dc80 Mon Sep 17 00:00:00 2001 -From: Alexander Kanavin <alex@linutronix.de> -Date: Fri, 24 Sep 2021 13:36:24 +0200 -Subject: [PATCH] lib/util/mksigname.c: correctly include header for out of - tree builds - -Upstream-Status: Submitted [https://github.com/sudo-project/sudo/pull/123] -Signed-off-by: Alexander Kanavin <alex@linutronix.de> ---- - lib/util/mksigname.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/util/mksigname.c b/lib/util/mksigname.c -index de8b1ad..0a69e7e 100644 ---- a/lib/util/mksigname.c -+++ b/lib/util/mksigname.c -@@ -36,7 +36,7 @@ main(int argc, char *argv[]) - { - unsigned int i; - --#include "mksigname.h" -+#include "lib/util/mksigname.h" - - printf("const char *const sudo_sys_signame[] = {\n"); - for (i = 0; i < nitems(sudo_sys_signame); i++) { diff --git a/meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch b/meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch index f4fc376bb8..041c717e00 100644 --- a/meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch +++ b/meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch @@ -1,4 +1,7 @@ -sudo.conf.in: fix conflict with multilib +From 6e835350b7413210c410d3578cfab804186b7a4f Mon Sep 17 00:00:00 2001 +From: Kai Kang <kai.kang@windriver.com> +Date: Tue, 17 Nov 2020 11:13:40 +0800 +Subject: [PATCH] sudo.conf.in: fix conflict with multilib When pass ${libdir} to --libexecdir of sudo, it fails to install sudo and lib32-sudo at same time: @@ -12,12 +15,13 @@ Update the comments in sudo.conf.in to avoid the conflict. Signed-off-by: Kai Kang <kai.kang@windriver.com> Upstream-Status: Inappropriate [OE configuration specific] + --- examples/sudo.conf.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/examples/sudo.conf.in b/examples/sudo.conf.in -index 6535d3a..50afc8f 100644 +index 2187457..0908d24 100644 --- a/examples/sudo.conf.in +++ b/examples/sudo.conf.in @@ -4,7 +4,7 @@ @@ -33,8 +37,8 @@ index 6535d3a..50afc8f 100644 # The compiled-in value is usually sufficient and should only be changed # if you rename or move the sudo_intercept.so file. # --#Path intercept @plugindir@/sudo_intercept.so -+#Path intercept $plugindir/sudo_intercept.so +-#Path intercept @intercept_file@ ++#Path intercept $intercept_file # # Sudo noexec: @@ -42,8 +46,8 @@ index 6535d3a..50afc8f 100644 # The compiled-in value is usually sufficient and should only be changed # if you rename or move the sudo_noexec.so file. # --#Path noexec @plugindir@/sudo_noexec.so -+#Path noexec $plugindir/sudo_noexec.so +-#Path noexec @noexec_file@ ++#Path noexec $noexec_file # # Sudo plugin directory: @@ -55,7 +59,4 @@ index 6535d3a..50afc8f 100644 +#Path plugin_dir $plugindir # - # Sudo developer mode: --- -2.17.1 - + # Core dumps: diff --git a/meta/recipes-extended/sudo/sudo.inc b/meta/recipes-extended/sudo/sudo.inc index fd5bbf103d..d3b6bf1ad8 100644 --- a/meta/recipes-extended/sudo/sudo.inc +++ b/meta/recipes-extended/sudo/sudo.inc @@ -4,11 +4,10 @@ HOMEPAGE = "http://www.sudo.ws" BUGTRACKER = "http://www.sudo.ws/bugs/" SECTION = "admin" LICENSE = "ISC & BSD-3-Clause & BSD-2-Clause & Zlib" -LIC_FILES_CHKSUM = "file://LICENSE.md;md5=7aacba499777b719416b293d16f29c8c \ +LIC_FILES_CHKSUM = "file://LICENSE.md;md5=5100e20d35f9015f9eef6bdb27ba194f \ file://plugins/sudoers/redblack.c;beginline=1;endline=46;md5=03e35317699ba00b496251e0dfe9f109 \ file://lib/util/reallocarray.c;beginline=3;endline=15;md5=397dd45c7683e90b9f8bf24638cf03bf \ file://lib/util/fnmatch.c;beginline=3;endline=27;md5=004d7d2866ba1f5b41174906849d2e0f \ - file://lib/util/getcwd.c;beginline=2;endline=27;md5=50f8d9667750e18dea4e84a935c12009 \ file://lib/util/glob.c;beginline=2;endline=31;md5=2852f68687544e3eb8a0a61665506f0e \ file://lib/util/snprintf.c;beginline=3;endline=33;md5=b70df6179969e38fcf68da91b53b8029 \ file://include/sudo_queue.h;beginline=2;endline=27;md5=ad578e9664d17a010b63e4bc0576ee8d \ @@ -29,12 +28,12 @@ EXTRA_OECONF = "--with-editor=${base_bindir}/vi --with-env-editor" EXTRA_OECONF:append:libc-musl = " --disable-hardening " do_compile:prepend () { - # Remove build host references from sudo_usage.h + # Remove build host references from config.h sed -i \ -e 's,--with-libtool-sysroot=${STAGING_DIR_TARGET},,g' \ -e 's,--build=${BUILD_SYS},,g' \ -e 's,--host=${HOST_SYS},,g' \ - ${B}/src/sudo_usage.h + ${B}/config.h } # Explicitly create ${localstatedir}/lib before do_install to ensure diff --git a/meta/recipes-extended/sudo/sudo_1.9.12p1.bb b/meta/recipes-extended/sudo/sudo_1.9.15p2.bb index 1495b67b8b..431dfba3c2 100644 --- a/meta/recipes-extended/sudo/sudo_1.9.12p1.bb +++ b/meta/recipes-extended/sudo/sudo_1.9.15p2.bb @@ -3,12 +3,11 @@ require sudo.inc SRC_URI = "https://www.sudo.ws/dist/sudo-${PV}.tar.gz \ ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ file://0001-sudo.conf.in-fix-conflict-with-multilib.patch \ - file://0001-lib-util-mksigname.c-correctly-include-header-for-ou.patch \ " PAM_SRC_URI = "file://sudo.pam" -SRC_URI[sha256sum] = "475a18a8eb3da8b2917ceab063a6baf51ea09128c3c47e3e0e33ab7497bab7d8" +SRC_URI[sha256sum] = "199c0cdbfa7efcfffa9c88684a8e2fb206a62b70a316507e4a91c89c873bbcc8" DEPENDS += " virtual/crypt ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" RDEPENDS:${PN} += " ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-limits pam-plugin-keyinit', '', d)}" diff --git a/meta/recipes-extended/sysklogd/files/0001-syslogd.service-KillMode-process-is-not-recommended-.patch b/meta/recipes-extended/sysklogd/files/0001-syslogd.service-KillMode-process-is-not-recommended-.patch new file mode 100644 index 0000000000..6c7e7cea44 --- /dev/null +++ b/meta/recipes-extended/sysklogd/files/0001-syslogd.service-KillMode-process-is-not-recommended-.patch @@ -0,0 +1,33 @@ +From b732dd0001c66f3ff1e0aef919c84ca9f0f81252 Mon Sep 17 00:00:00 2001 +From: Joachim Wiberg <troglobit@gmail.com> +Date: Sat, 22 Apr 2023 07:40:24 +0200 +Subject: [PATCH 1/2] syslogd.service: KillMode=process is not recommended, + drop + +The default 'control-group' ensures all processes started by sysklogd +are stopped when the service is stopped, this is what we want. + +Signed-off-by: Joachim Wiberg <troglobit@gmail.com> + +Upstream-Status: Backport [https://github.com/troglobit/sysklogd/commit/c82c004de7e25e770039cba5d6a34c30dd548533] + +Signed-off-by: Changqing Li <changqing.li@windriver.com> +--- + syslogd.service.in | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/syslogd.service.in b/syslogd.service.in +index 91e080a..d614c5f 100644 +--- a/syslogd.service.in ++++ b/syslogd.service.in +@@ -9,7 +9,6 @@ EnvironmentFile=-@SYSCONFDIR@/default/syslogd + ExecStart=@SBINDIR@/syslogd -F -p /run/systemd/journal/syslog $SYSLOGD_OPTS + StandardOutput=null + Restart=on-failure +-KillMode=process + + [Install] + WantedBy=multi-user.target +-- +2.25.1 + diff --git a/meta/recipes-extended/sysklogd/files/0002-Fix-62-early-log-messages-lost-when-running-in-syste.patch b/meta/recipes-extended/sysklogd/files/0002-Fix-62-early-log-messages-lost-when-running-in-syste.patch new file mode 100644 index 0000000000..78ae57eeeb --- /dev/null +++ b/meta/recipes-extended/sysklogd/files/0002-Fix-62-early-log-messages-lost-when-running-in-syste.patch @@ -0,0 +1,75 @@ +From ba8156eab79784ef816958327e701923890e98f7 Mon Sep 17 00:00:00 2001 +From: Joachim Wiberg <troglobit@gmail.com> +Date: Sat, 22 Apr 2023 08:27:57 +0200 +Subject: [PATCH 2/2] Fix #62: early log messages lost when running in systemd + +This is a follow-up to d7576c7 which initially added support for running +in systemd based systems. Since the unit file sources the syslog.socket +we have /run/systemd/journal/syslog open already on descriptor 3. All +we need to do is verify that's the mode syslogd runs in. + +Signed-off-by: Joachim Wiberg <troglobit@gmail.com> + +Upstream-Status: Backport [https://github.com/troglobit/sysklogd/commit/7ec64e5f9c1bc284792d028647fb36ef3e64dff7] + +Signed-off-by: Changqing Li <changqing.li@windriver.com> +--- + src/syslogd.c | 21 +++++++++++++++------ + syslogd.service.in | 2 +- + 2 files changed, 16 insertions(+), 7 deletions(-) + +diff --git a/src/syslogd.c b/src/syslogd.c +index fa4303f..e96ca9a 100644 +--- a/src/syslogd.c ++++ b/src/syslogd.c +@@ -162,6 +162,7 @@ void untty(void); + static void parsemsg(const char *from, char *msg); + static int opensys(const char *file); + static void printsys(char *msg); ++static void unix_cb(int sd, void *arg); + static void logmsg(struct buf_msg *buffer); + static void fprintlog_first(struct filed *f, struct buf_msg *buffer); + static void fprintlog_successive(struct filed *f, int flags); +@@ -436,12 +437,20 @@ int main(int argc, char *argv[]) + .pe_serv = "syslog", + }); + +- /* Default to _PATH_LOG for the UNIX domain socket */ +- if (!pflag) +- addpeer(&(struct peer) { +- .pe_name = _PATH_LOG, +- .pe_mode = 0666, +- }); ++ /* Figure out where to read system log messages from */ ++ if (!pflag) { ++ /* Do we run under systemd-journald (Requires=syslog.socket)? */ ++ if (fcntl(3, F_GETFD) != -1) { ++ if (socket_register(3, NULL, unix_cb, NULL) == -1) ++ err(1, "failed registering syslog.socket (3)"); ++ } else { ++ /* Default to _PATH_LOG for the UNIX domain socket */ ++ addpeer(&(struct peer) { ++ .pe_name = _PATH_LOG, ++ .pe_mode = 0666, ++ }); ++ } ++ } + + if (!Foreground && !Debug) { + ppid = waitdaemon(30); +diff --git a/syslogd.service.in b/syslogd.service.in +index d614c5f..bc82af9 100644 +--- a/syslogd.service.in ++++ b/syslogd.service.in +@@ -6,7 +6,7 @@ Requires=syslog.socket + + [Service] + EnvironmentFile=-@SYSCONFDIR@/default/syslogd +-ExecStart=@SBINDIR@/syslogd -F -p /run/systemd/journal/syslog $SYSLOGD_OPTS ++ExecStart=@SBINDIR@/syslogd -F $SYSLOGD_OPTS + StandardOutput=null + Restart=on-failure + +-- +2.25.1 + diff --git a/meta/recipes-extended/sysklogd/sysklogd_2.3.0.bb b/meta/recipes-extended/sysklogd/sysklogd_2.3.0.bb index 7043f3d391..0dc5ef93e2 100644 --- a/meta/recipes-extended/sysklogd/sysklogd_2.3.0.bb +++ b/meta/recipes-extended/sysklogd/sysklogd_2.3.0.bb @@ -12,6 +12,8 @@ inherit update-rc.d update-alternatives systemd autotools SRC_URI = "git://github.com/troglobit/sysklogd.git;branch=master;protocol=https \ file://sysklogd \ + file://0001-syslogd.service-KillMode-process-is-not-recommended-.patch \ + file://0002-Fix-62-early-log-messages-lost-when-running-in-syste.patch \ " SRCREV = "03c2c9c68d5d02675326527774e7e9cba3490ba0" diff --git a/meta/recipes-extended/sysstat/sysstat/CVE-2023-33204.patch b/meta/recipes-extended/sysstat/sysstat/CVE-2023-33204.patch new file mode 100644 index 0000000000..3a12f7a3ed --- /dev/null +++ b/meta/recipes-extended/sysstat/sysstat/CVE-2023-33204.patch @@ -0,0 +1,80 @@ +From e806a902cc90a0b87da00854de8d5fd8222540fc Mon Sep 17 00:00:00 2001 +From: Pavel Kopylov <pkopylov@> +Date: Wed, 17 May 2023 11:33:45 +0200 +Subject: [PATCH] Fix an overflow which is still possible for some values. + +Upstream-Status: Backport [https://github.com/sysstat/sysstat/commit/954ff2e2673c] +CVE: CVE-2023-33204 + +Signed-off-by: Xiangyu Chen <xiangyu.chen@...> +Signed-off-by: Sanjay Chitroda <schitrod@...> +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + common.c | 18 ++++++++++-------- + common.h | 2 +- + sa_common.c | 4 ++-- + 3 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/common.c b/common.c +index db9b0ed..e05c5bb 100644 +--- a/common.c ++++ b/common.c +@@ -1640,17 +1640,19 @@ int parse_values(char *strargv, unsigned char bitmap[], int max_val, const char + * @val3 Third value. + *************************************************************************** + */ +-void check_overflow(size_t val1, size_t val2, size_t val3) ++void check_overflow(unsigned int val1, unsigned int val2, ++ unsigned int val3) + { +- if ((unsigned long long) val1 * +- (unsigned long long) val2 * +- (unsigned long long) val3 > UINT_MAX) { ++ if ((val1 != 0) && (val2 != 0) && (val3 != 0) && ++ (((unsigned long long) UINT_MAX / (unsigned long long) val1 < ++ (unsigned long long) val2) || ++ ((unsigned long long) UINT_MAX / ((unsigned long long) val1 * (unsigned long long) val2) < ++ (unsigned long long) val3))) { + #ifdef DEBUG +- fprintf(stderr, "%s: Overflow detected (%llu). Aborting...\n", +- __FUNCTION__, +- (unsigned long long) val1 * (unsigned long long) val2 * (unsigned long long) val3); ++ fprintf(stderr, "%s: Overflow detected (%u,%u,%u). Aborting...\n", ++ __FUNCTION__, val1, val2, val3); + #endif +- exit(4); ++ exit(4); + } + } + +diff --git a/common.h b/common.h +index 0ac5896..b2ffe9f 100644 +--- a/common.h ++++ b/common.h +@@ -256,7 +256,7 @@ int check_dir + + #ifndef SOURCE_SADC + void check_overflow +- (size_t, size_t, size_t); ++ (unsigned int, unsigned int, unsigned int); + int count_bits + (void *, int); + int count_csvalues +diff --git a/sa_common.c b/sa_common.c +index 1b8fcaa..1144cfe 100644 +--- a/sa_common.c ++++ b/sa_common.c +@@ -452,8 +452,8 @@ void allocate_structures(struct activity *act[]) + if (act[i]->nr_ini > 0) { + + /* Look for a possible overflow */ +- check_overflow((size_t) act[i]->msize, (size_t) act[i]->nr_ini, +- (size_t) act[i]->nr2); ++ check_overflow((unsigned int) act[i]->msize, (unsigned int) act[i]->nr_ini, ++ (unsigned int) act[i]->nr2); + + for (j = 0; j < 3; j++) { + SREALLOC(act[i]->buf[j], void, +-- +2.25.1 + diff --git a/meta/recipes-extended/sysstat/sysstat_12.4.5.bb b/meta/recipes-extended/sysstat/sysstat_12.4.5.bb index 3a3d1fb6ba..f8a950e8a2 100644 --- a/meta/recipes-extended/sysstat/sysstat_12.4.5.bb +++ b/meta/recipes-extended/sysstat/sysstat_12.4.5.bb @@ -3,6 +3,7 @@ require sysstat.inc LIC_FILES_CHKSUM = "file://COPYING;md5=a23a74b3f4caf9616230789d94217acb" SRC_URI += "file://0001-configure.in-remove-check-for-chkconfig.patch \ - file://CVE-2022-39377.patch" - + file://CVE-2022-39377.patch \ + file://CVE-2023-33204.patch \ + " SRC_URI[sha256sum] = "ef445acea301bbb996e410842f6290a8d049e884d4868cfef7e85dc04b7eee5b" diff --git a/meta/recipes-extended/tar/tar_1.34.bb b/meta/recipes-extended/tar/tar_1.35.bb index 7307cd57a2..4dbd418b60 100644 --- a/meta/recipes-extended/tar/tar_1.34.bb +++ b/meta/recipes-extended/tar/tar_1.35.bb @@ -4,11 +4,11 @@ or disk archive, and can restore individual files from the archive." HOMEPAGE = "http://www.gnu.org/software/tar/" SECTION = "base" LICENSE = "GPL-3.0-only" -LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" +LIC_FILES_CHKSUM = "file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464" SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2" -SRC_URI[sha256sum] = "b44cc67f8a1f6b0250b7c860e952b37e8ed932a90bd9b1862a511079255646ff" +SRC_URI[sha256sum] = "7edb8886a3dc69420a1446e1e2d061922b642f1cf632d2cd0f9ee7e690775985" inherit autotools gettext texinfo diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc index 1834665a1e..4734adcc08 100644 --- a/meta/recipes-extended/timezone/timezone.inc +++ b/meta/recipes-extended/timezone/timezone.inc @@ -6,13 +6,15 @@ SECTION = "base" LICENSE = "PD & BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba" -PV = "2022g" +PV = "2024a" -SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode \ - http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata \ +SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \ + http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \ " +S = "${WORKDIR}/tz" + UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones" -SRC_URI[tzcode.sha256sum] = "9610bb0b9656ff404c361a41f3286da53064b5469d84f00c9cb2314c8614da74" -SRC_URI[tzdata.sha256sum] = "4491db8281ae94a84d939e427bdd83dc389f26764d27d9a5c52d782c16764478" +SRC_URI[tzcode.sha256sum] = "80072894adff5a458f1d143e16e4ca1d8b2a122c9c5399da482cb68cba6a1ff8" +SRC_URI[tzdata.sha256sum] = "0d0434459acbd2059a7a8da1f3304a84a86591f6ed69c6248fffa502b6edffe3" diff --git a/meta/recipes-extended/timezone/tzcode-native.bb b/meta/recipes-extended/timezone/tzcode-native.bb index e3582ba674..d0b23a9d80 100644 --- a/meta/recipes-extended/timezone/tzcode-native.bb +++ b/meta/recipes-extended/timezone/tzcode-native.bb @@ -1,10 +1,7 @@ require timezone.inc -# SUMMARY = "tzcode, timezone zoneinfo utils -- zic, zdump, tzselect" -S = "${WORKDIR}" - inherit native EXTRA_OEMAKE += "cc='${CC}'" diff --git a/meta/recipes-extended/timezone/tzdata.bb b/meta/recipes-extended/timezone/tzdata.bb index 7f4322d867..dd1960ffa7 100644 --- a/meta/recipes-extended/timezone/tzdata.bb +++ b/meta/recipes-extended/timezone/tzdata.bb @@ -4,8 +4,6 @@ DEPENDS = "tzcode-native" inherit allarch -S = "${WORKDIR}" - DEFAULT_TIMEZONE ?= "Universal" INSTALL_TIMEZONE_FILE ?= "1" @@ -18,17 +16,21 @@ TZONES = " \ # "fat" is needed by e.g. MariaDB's mysql_tzinfo_to_sql ZIC_FMT ?= "slim" +do_configure[cleandirs] = "${B}" +B = "${WORKDIR}/build" + do_compile() { for zone in ${TZONES}; do - ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${WORKDIR}${datadir}/zoneinfo -L /dev/null ${S}/${zone} - ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${WORKDIR}${datadir}/zoneinfo/posix -L /dev/null ${S}/${zone} - ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${WORKDIR}${datadir}/zoneinfo/right -L ${S}/leapseconds ${S}/${zone} + ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${B}/zoneinfo -L /dev/null ${S}/${zone} + ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${B}/zoneinfo/posix -L /dev/null ${S}/${zone} + ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${B}/zoneinfo/right -L ${S}/leapseconds ${S}/${zone} done } do_install() { - install -d ${D}$exec_prefix ${D}${datadir}/zoneinfo - cp -pPR ${WORKDIR}$exec_prefix ${D}${base_prefix} + install -d ${D}${datadir}/zoneinfo + cp -pPR ${B}/zoneinfo/* ${D}${datadir}/zoneinfo + # libc is removing zoneinfo files from package cp -pP "${S}/zone.tab" ${D}${datadir}/zoneinfo cp -pP "${S}/zone1970.tab" ${D}${datadir}/zoneinfo diff --git a/meta/recipes-extended/unzip/unzip/0001-unix-configure-fix-detection-for-cross-compilation.patch b/meta/recipes-extended/unzip/unzip/0001-unix-configure-fix-detection-for-cross-compilation.patch new file mode 100644 index 0000000000..2fa7f481b7 --- /dev/null +++ b/meta/recipes-extended/unzip/unzip/0001-unix-configure-fix-detection-for-cross-compilation.patch @@ -0,0 +1,103 @@ +From 5cbf901b5c3b6a7d1d0ed91b6df4194bb6d25a40 Mon Sep 17 00:00:00 2001 +From: Chen Qi <Qi.Chen@windriver.com> +Date: Thu, 15 Jun 2023 07:14:17 -0700 +Subject: [PATCH] unix/configure: fix detection for cross compilation + +We're doing cross compilation, running a cross-compiled problem +on host to detemine feature is not correct. So we change runtime +check into compile-time check to detect the features. + +Upstream-Status: Inactive-Upstream + +Signed-off-by: Chen Qi <Qi.Chen@windriver.com> +--- + unix/configure | 44 +++++++++++++++----------------------------- + 1 file changed, 15 insertions(+), 29 deletions(-) + +diff --git a/unix/configure b/unix/configure +index 8fd82dd..68dee98 100755 +--- a/unix/configure ++++ b/unix/configure +@@ -259,6 +259,10 @@ cat > conftest.c << _EOF_ + #include <sys/stat.h> + #include <unistd.h> + #include <stdio.h> ++ ++_Static_assert(sizeof(off_t) < 8, "sizeof off_t < 8 failed"); ++_Static_assert(sizeof((struct stat){0}.st_size) < 8, "sizeof st_size < 8 failed"); ++ + int main() + { + off_t offset; +@@ -278,21 +282,10 @@ _EOF_ + # compile it + $CC $CFLAGS $LDFLAGS -o conftest conftest.c >/dev/null 2>/dev/null + if [ $? -ne 0 ]; then +- echo -- no Large File Support ++ echo -- yes we have Large File Support! ++ CFLAGSR="${CFLAGSR} -DLARGE_FILE_SUPPORT" + else +-# run it +- ./conftest +- r=$? +- if [ $r -eq 1 ]; then +- echo -- no Large File Support - no 64-bit off_t +- elif [ $r -eq 2 ]; then +- echo -- no Large File Support - no 64-bit stat +- elif [ $r -eq 3 ]; then +- echo -- yes we have Large File Support! +- CFLAGSR="${CFLAGSR} -DLARGE_FILE_SUPPORT" +- else +- echo -- no Large File Support - conftest returned $r +- fi ++ echo -- no Large File Support + fi + + # Added 11/24/2005 EG +@@ -302,6 +295,11 @@ cat > conftest.c << _EOF_ + #include <stdlib.h> + #include <stdio.h> + #include <wchar.h> ++ ++#ifndef __STDC_ISO_10646__ ++#error "__STDC_ISO_10646__ not defined ++#endif ++ + int main() + { + size_t wsize; +@@ -327,19 +325,8 @@ if [ $? -ne 0 ]; then + echo "-- no Unicode (wchar_t) support" + else + # have wide char support +-# run it +- ./conftest +- r=$? +- if [ $r -eq 0 ]; then +- echo -- no Unicode wchar_t support - wchar_t allocation error +- elif [ $r -eq 1 ]; then +- echo -- no Unicode support - wchar_t encoding unspecified +- elif [ $r -eq 2 ]; then +- echo -- have wchar_t with known UCS encoding - enabling Unicode support! +- CFLAGSR="${CFLAGSR} -DUNICODE_SUPPORT -DUNICODE_WCHAR" +- else +- echo "-- no Unicode (wchar_t) support - conftest returned $r" +- fi ++ echo -- have wchar_t with known UCS encoding - enabling Unicode support! ++ CFLAGSR="${CFLAGSR} -DUNICODE_SUPPORT -DUNICODE_WCHAR" + fi + + echo "Check for setlocale support (needed for UNICODE Native check)" +@@ -418,8 +405,7 @@ temp_link="link_$$" + echo "int main() { lchmod(\"${temp_file}\", 0666); }" \ + ) > conftest.c + ln -s "${temp_link}" "${temp_file}" && \ +- $CC $BFLAG $LDFLAGS -o conftest conftest.c >/dev/null 2>/dev/null && \ +- ./conftest ++ $CC -Werror=implicit-function-declaration $BFLAG $LDFLAGS -o conftest conftest.c >/dev/null + [ $? -ne 0 ] && CFLAGSR="${CFLAGSR} -DNO_LCHMOD" + rm -f "${temp_file}" + +-- +2.34.1 + diff --git a/meta/recipes-extended/unzip/unzip_6.0.bb b/meta/recipes-extended/unzip/unzip_6.0.bb index f35856cf61..e3fffa30ab 100644 --- a/meta/recipes-extended/unzip/unzip_6.0.bb +++ b/meta/recipes-extended/unzip/unzip_6.0.bb @@ -31,6 +31,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/infozip/UnZip%206.x%20%28latest%29/UnZip%206.0/ file://CVE-2021-4217.patch \ file://CVE-2022-0529.patch \ file://CVE-2022-0530.patch \ + file://0001-unix-configure-fix-detection-for-cross-compilation.patch \ " UPSTREAM_VERSION_UNKNOWN = "1" diff --git a/meta/recipes-extended/wget/wget.inc b/meta/recipes-extended/wget/wget.inc index 58cb5ca73d..30abaff7b7 100644 --- a/meta/recipes-extended/wget/wget.inc +++ b/meta/recipes-extended/wget/wget.inc @@ -7,7 +7,7 @@ FTP sites" HOMEPAGE = "https://www.gnu.org/software/wget/" SECTION = "console/network" LICENSE = "GPL-3.0-only" -LIC_FILES_CHKSUM = "file://COPYING;md5=c678957b0c8e964aa6c70fd77641a71e" +LIC_FILES_CHKSUM = "file://COPYING;md5=6f65012d1daf98cb09b386cfb68df26b" inherit autotools gettext texinfo update-alternatives pkgconfig diff --git a/meta/recipes-extended/wget/wget_1.21.3.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index f176a1546c..1d31b0116d 100644 --- a/meta/recipes-extended/wget/wget_1.21.3.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb @@ -2,6 +2,6 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ " -SRC_URI[sha256sum] = "5726bb8bc5ca0f6dc7110f6416e4bb7019e2d2ff5bf93d1ca2ffcc6656f220e5" +SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c" require wget.inc diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch new file mode 100644 index 0000000000..383634ad53 --- /dev/null +++ b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch @@ -0,0 +1,165 @@ +From f67c4d1f8bd2e3cbcb9eb49f5e897075e7426780 Mon Sep 17 00:00:00 2001 +From: Gabriel Corona <gabriel.corona@enst-bretagne.fr> +Date: Thu, 25 Aug 2022 23:51:45 +0200 +Subject: [PATCH] Disable special support for Thunderbird in xdg-email (fixes + CVE-2020-27748, CVE-2022-4055) + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xdg/xdg-utils/-/commit/f67c4d1f8bd2e3cbcb9eb49f5e897075e7426780] +CVE: CVE-2022-4055 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + scripts/xdg-email.in | 108 ------------------------------------------- + 1 file changed, 108 deletions(-) + +diff --git a/scripts/xdg-email.in b/scripts/xdg-email.in +index 13ba2d5..b700679 100644 +--- a/scripts/xdg-email.in ++++ b/scripts/xdg-email.in +@@ -30,76 +30,8 @@ _USAGE + + #@xdg-utils-common@ + +-run_thunderbird() +-{ +- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY +- THUNDERBIRD="$1" +- MAILTO=$(echo "$2" | sed 's/^mailto://') +- echo "$MAILTO" | grep -qs "^?" +- if [ "$?" = "0" ] ; then +- MAILTO=$(echo "$MAILTO" | sed 's/^?//') +- else +- MAILTO=$(echo "$MAILTO" | sed 's/^/to=/' | sed 's/?/\&/') +- fi +- +- MAILTO=$(echo "$MAILTO" | sed 's/&/\n/g') +- TO=$(/bin/echo -e $(echo "$MAILTO" | grep '^to=' | sed 's/^to=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) +- CC=$(/bin/echo -e $(echo "$MAILTO" | grep '^cc=' | sed 's/^cc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) +- BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) +- SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1) +- BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1) +- +- if [ -z "$TO" ] ; then +- NEWMAILTO= +- else +- NEWMAILTO="to='$TO'" +- fi +- if [ -n "$CC" ] ; then +- NEWMAILTO="${NEWMAILTO},cc='$CC'" +- fi +- if [ -n "$BCC" ] ; then +- NEWMAILTO="${NEWMAILTO},bcc='$BCC'" +- fi +- if [ -n "$SUBJECT" ] ; then +- NEWMAILTO="${NEWMAILTO},$SUBJECT" +- fi +- if [ -n "$BODY" ] ; then +- NEWMAILTO="${NEWMAILTO},$BODY" +- fi +- +- NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//') +- DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\"" +- "$THUNDERBIRD" -compose "$NEWMAILTO" +- if [ $? -eq 0 ]; then +- exit_success +- else +- exit_failure_operation_failed +- fi +-} +- + open_kde() + { +- if [ -n "$KDE_SESSION_VERSION" ] && [ "$KDE_SESSION_VERSION" -ge 5 ]; then +- local kreadconfig=kreadconfig$KDE_SESSION_VERSION +- else +- local kreadconfig=kreadconfig +- fi +- +- if which $kreadconfig >/dev/null 2>&1; then +- local profile=$($kreadconfig --file emaildefaults \ +- --group Defaults --key Profile) +- if [ -n "$profile" ]; then +- local client=$($kreadconfig --file emaildefaults \ +- --group "PROFILE_$profile" \ +- --key EmailClient \ +- | cut -d ' ' -f 1) +- +- if echo "$client" | grep -Eq 'thunderbird|icedove'; then +- run_thunderbird "$client" "$1" +- fi +- fi +- fi +- + local command + case "$KDE_SESSION_VERSION" in + '') command=kmailservice ;; +@@ -130,15 +62,6 @@ open_kde() + + open_gnome3() + { +- local client +- local desktop +- desktop=`xdg-mime query default "x-scheme-handler/mailto"` +- client=`desktop_file_to_binary "$desktop"` +- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 +- if [ $? -eq 0 ] ; then +- run_thunderbird "$client" "$1" +- fi +- + if gio help open 2>/dev/null 1>&2; then + DEBUG 1 "Running gio open \"$1\"" + gio open "$1" +@@ -159,13 +82,6 @@ open_gnome3() + + open_gnome() + { +- local client +- client=`gconftool-2 --get /desktop/gnome/url-handlers/mailto/command | cut -d ' ' -f 1` || "" +- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 +- if [ $? -eq 0 ] ; then +- run_thunderbird "$client" "$1" +- fi +- + if gio help open 2>/dev/null 1>&2; then + DEBUG 1 "Running gio open \"$1\"" + gio open "$1" +@@ -231,15 +147,6 @@ open_flatpak() + + open_generic() + { +- local client +- local desktop +- desktop=`xdg-mime query default "x-scheme-handler/mailto"` +- client=`desktop_file_to_binary "$desktop"` +- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 +- if [ $? -eq 0 ] ; then +- run_thunderbird "$client" "$1" +- fi +- + xdg-open "$1" + local ret=$? + +@@ -364,21 +271,6 @@ while [ $# -gt 0 ] ; do + shift + ;; + +- --attach) +- if [ -z "$1" ] ; then +- exit_failure_syntax "file argument missing for --attach option" +- fi +- check_input_file "$1" +- file=`readlink -f "$1"` # Normalize path +- if [ -z "$file" ] || [ ! -f "$file" ] ; then +- exit_failure_file_missing "file '$1' does not exist" +- fi +- +- url_encode "$file" +- options="${options}attach=${result}&" +- shift +- ;; +- + -*) + exit_failure_syntax "unexpected option '$parm'" + ;; +-- +2.25.1 + diff --git a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb index 73acf6b744..4d93180535 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb +++ b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb @@ -21,6 +21,7 @@ SRC_URI = "https://portland.freedesktop.org/download/${BPN}-${PV}.tar.gz \ file://0001-Reinstate-xdg-terminal.patch \ file://0001-Don-t-build-the-in-script-manual.patch \ file://1f199813e0eb0246f63b54e9e154970e609575af.patch \ + file://CVE-2022-4055.patch \ " SRC_URI[md5sum] = "902042508b626027a3709d105f0b63ff" diff --git a/meta/recipes-extended/zip/zip-3.0/0001-unix-configure-use-_Static_assert-to-do-correct-dete.patch b/meta/recipes-extended/zip/zip-3.0/0001-unix-configure-use-_Static_assert-to-do-correct-dete.patch new file mode 100644 index 0000000000..106f246a7c --- /dev/null +++ b/meta/recipes-extended/zip/zip-3.0/0001-unix-configure-use-_Static_assert-to-do-correct-dete.patch @@ -0,0 +1,96 @@ +From 9916fc6f1f93f3e092e3c6937c30dc8137c26d34 Mon Sep 17 00:00:00 2001 +From: Chen Qi <Qi.Chen@windriver.com> +Date: Thu, 15 Jun 2023 18:31:26 +0800 +Subject: [PATCH] unix/configure: use _Static_assert to do correct detection + +We're doing cross compilation, running a cross-compiled problem +on host to detemine feature is not correct. Use _Static_assert +to do the detection correctly. + +Upstream-Status: Inactive-Upstream + +Signed-off-by: Chen Qi <Qi.Chen@windriver.com> +--- + unix/configure | 42 ++++++++++++------------------------------ + 1 file changed, 12 insertions(+), 30 deletions(-) + +diff --git a/unix/configure b/unix/configure +index f2b3d02..f917086 100644 +--- a/unix/configure ++++ b/unix/configure +@@ -361,6 +361,10 @@ cat > conftest.c << _EOF_ + #include <sys/stat.h> + #include <unistd.h> + #include <stdio.h> ++ ++_Static_assert(sizeof((struct stat){0}.st_uid) == 2, "sizeof st_uid is not 16 bit"); ++_Static_assert(sizeof((struct stat){0}.st_gid) == 2, "sizeof st_gid is not 16 bit"); ++ + int main() + { + struct stat s; +@@ -385,21 +389,7 @@ if [ $? -ne 0 ]; then + echo -- UID/GID test failed on compile - disabling old 16-bit UID/GID support + CFLAGS="${CFLAGS} -DUIDGID_NOT_16BIT" + else +-# run it +- ./conftest +- r=$? +- if [ $r -eq 1 ]; then +- echo -- UID not 2 bytes - disabling old 16-bit UID/GID support +- CFLAGS="${CFLAGS} -DUIDGID_NOT_16BIT" +- elif [ $r -eq 2 ]; then +- echo -- GID not 2 bytes - disabling old 16-bit UID/GID support +- CFLAGS="${CFLAGS} -DUIDGID_NOT_16BIT" +- elif [ $r -eq 3 ]; then +- echo -- 16-bit UIDs and GIDs - keeping old 16-bit UID/GID support +- else +- echo -- test failed - conftest returned $r - disabling old 16-bit UID/GID support +- CFLAGS="${CFLAGS} -DUIDGID_NOT_16BIT" +- fi ++ echo -- 16-bit UIDs and GIDs - keeping old 16-bit UID/GID support + fi + + +@@ -417,6 +407,10 @@ cat > conftest.c << _EOF_ + #include <sys/stat.h> + #include <unistd.h> + #include <stdio.h> ++ ++_Static_assert(sizeof(off_t) < 8, "sizeof off_t < 8 failed"); ++_Static_assert(sizeof((struct stat){0}.st_size) < 8, "sizeof st_size < 8 failed"); ++ + int main() + { + off_t offset; +@@ -436,24 +430,12 @@ _EOF_ + # compile it + $CC -o conftest conftest.c >/dev/null 2>/dev/null + if [ $? -ne 0 ]; then +- echo -- no Large File Support ++ echo -- yes we have Large File Support! ++ CFLAGS="${CFLAGS} -DLARGE_FILE_SUPPORT" + else +-# run it +- ./conftest +- r=$? +- if [ $r -eq 1 ]; then +- echo -- no Large File Support - no 64-bit off_t +- elif [ $r -eq 2 ]; then +- echo -- no Large File Support - no 64-bit stat +- elif [ $r -eq 3 ]; then +- echo -- yes we have Large File Support! +- CFLAGS="${CFLAGS} -DLARGE_FILE_SUPPORT" +- else +- echo -- no Large File Support - conftest returned $r +- fi ++ echo -- no Large File Support + fi + +- + # Check for wide char for Unicode support + # Added 11/24/2005 EG + +-- +2.34.1 + diff --git a/meta/recipes-extended/zip/zip_3.0.bb b/meta/recipes-extended/zip/zip_3.0.bb index 07a67b9634..83e1e52e97 100644 --- a/meta/recipes-extended/zip/zip_3.0.bb +++ b/meta/recipes-extended/zip/zip_3.0.bb @@ -17,6 +17,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/infozip/Zip%203.x%20%28latest%29/3.0/zip30.tar. file://0001-configure-use-correct-CPP.patch \ file://0002-configure-support-PIC-code-build.patch \ file://0001-configure-Use-CFLAGS-and-LDFLAGS-when-doing-link-tes.patch \ + file://0001-unix-configure-use-_Static_assert-to-do-correct-dete.patch \ " UPSTREAM_VERSION_UNKNOWN = "1" diff --git a/meta/recipes-gnome/epiphany/epiphany_42.4.bb b/meta/recipes-gnome/epiphany/epiphany_42.4.bb index 9efd2800da..98923a3bdc 100644 --- a/meta/recipes-gnome/epiphany/epiphany_42.4.bb +++ b/meta/recipes-gnome/epiphany/epiphany_42.4.bb @@ -27,6 +27,7 @@ SRC_URI = "${GNOME_MIRROR}/${GNOMEBN}/${@oe.utils.trim_version("${PV}", 1)}/${GN file://0002-help-meson.build-disable-the-use-of-yelp.patch \ file://migrator.patch \ file://distributor.patch \ + file://CVE-2023-26081.patch \ " SRC_URI[archive.sha256sum] = "370938ad2920eeb28bc2435944776b7ba55a0e2ede65836f79818cfb7e8f0860" diff --git a/meta/recipes-gnome/epiphany/files/CVE-2023-26081.patch b/meta/recipes-gnome/epiphany/files/CVE-2023-26081.patch new file mode 100644 index 0000000000..af1e20bd8f --- /dev/null +++ b/meta/recipes-gnome/epiphany/files/CVE-2023-26081.patch @@ -0,0 +1,90 @@ +From 53363c3c8178bf9193dad9fa3516f4e10cff0ffd Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro <mcatanzaro@redhat.com> +Date: Fri, 3 Feb 2023 13:07:15 -0600 +Subject: [PATCH] Don't autofill passwords in sandboxed contexts + +If using the sandbox CSP or iframe tag, the web content is supposed to +be not trusted by the main resource origin. Therefore, we'd better +disable the password manager entirely so the untrusted web content +cannot exfiltrate passwords. + +https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x + +Part-of: <https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1275> + +Upstream-Status: Backport +[https://gitlab.gnome.org/GNOME/epiphany/-/commit/53363c3c8178bf9193dad9fa3516f4e10cff0ffd] +CVE: CVE-2023-26081 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + .../resources/js/ephy.js | 26 +++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/embed/web-process-extension/resources/js/ephy.js b/embed/web-process-extension/resources/js/ephy.js +index 38b806f..44d1792 100644 +--- a/embed/web-process-extension/resources/js/ephy.js ++++ b/embed/web-process-extension/resources/js/ephy.js +@@ -352,6 +352,12 @@ Ephy.hasModifiedForms = function() + } + }; + ++Ephy.isSandboxedWebContent = function() ++{ ++ // https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x ++ return self.origin === null || self.origin === 'null'; ++}; ++ + Ephy.PasswordManager = class PasswordManager + { + constructor(pageID, frameID) +@@ -385,6 +391,11 @@ Ephy.PasswordManager = class PasswordManager + + query(origin, targetOrigin, username, usernameField, passwordField) + { ++ if (Ephy.isSandboxedWebContent()) { ++ Ephy.log(`Not querying passwords for origin=${origin} because web content is sandboxed`); ++ return Promise.resolve(null); ++ } ++ + Ephy.log(`Querying passwords for origin=${origin}, targetOrigin=${targetOrigin}, username=${username}, usernameField=${usernameField}, passwordField=${passwordField}`); + + return new Promise((resolver, reject) => { +@@ -396,6 +407,11 @@ Ephy.PasswordManager = class PasswordManager + + save(origin, targetOrigin, username, password, usernameField, passwordField, isNew) + { ++ if (Ephy.isSandboxedWebContent()) { ++ Ephy.log(`Not saving password for origin=${origin} because web content is sandboxed`); ++ return; ++ } ++ + Ephy.log(`Saving password for origin=${origin}, targetOrigin=${targetOrigin}, username=${username}, usernameField=${usernameField}, passwordField=${passwordField}, isNew=${isNew}`); + + window.webkit.messageHandlers.passwordManagerSave.postMessage({ +@@ -407,6 +423,11 @@ Ephy.PasswordManager = class PasswordManager + // FIXME: Why is pageID a parameter here? + requestSave(origin, targetOrigin, username, password, usernameField, passwordField, isNew, pageID) + { ++ if (Ephy.isSandboxedWebContent()) { ++ Ephy.log(`Not requesting to save password for origin=${origin} because web content is sandboxed`); ++ return; ++ } ++ + Ephy.log(`Requesting to save password for origin=${origin}, targetOrigin=${targetOrigin}, username=${username}, usernameField=${usernameField}, passwordField=${passwordField}, isNew=${isNew}`); + + window.webkit.messageHandlers.passwordManagerRequestSave.postMessage({ +@@ -426,6 +447,11 @@ Ephy.PasswordManager = class PasswordManager + + queryUsernames(origin) + { ++ if (Ephy.isSandboxedWebContent()) { ++ Ephy.log(`Not querying usernames for origin=${origin} because web content is sandboxed`); ++ return Promise.resolve(null); ++ } ++ + Ephy.log(`Requesting usernames for origin=${origin}`); + + return new Promise((resolver, reject) => { +-- +2.35.5 + diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-Add-use_prebuilt_tools-option.patch b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-Add-use_prebuilt_tools-option.patch deleted file mode 100644 index 02cc9a2a70..0000000000 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-Add-use_prebuilt_tools-option.patch +++ /dev/null @@ -1,173 +0,0 @@ -From f81b60ebcbbfd9548c8aa1e388662c429068d1e3 Mon Sep 17 00:00:00 2001 -From: Alexander Kanavin <alex.kanavin@gmail.com> -Date: Sat, 8 May 2021 21:58:54 +0200 -Subject: [PATCH] Add use_prebuilt_tools option - -This allows using the gdk-pixbuf tools from the host to -build and install tests in a cross-compile scenarion. - -Upstream-Status: Submitted [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/119] -Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> - ---- - gdk-pixbuf/meson.build | 11 +++++++++-- - meson.build | 6 +++--- - meson_options.txt | 4 ++++ - tests/meson.build | 16 ++++++++-------- - thumbnailer/meson.build | 24 ++++++++++++++++++------ - 5 files changed, 42 insertions(+), 19 deletions(-) - -diff --git a/gdk-pixbuf/meson.build b/gdk-pixbuf/meson.build -index 54ff9dd..2e321cf 100644 ---- a/gdk-pixbuf/meson.build -+++ b/gdk-pixbuf/meson.build -@@ -342,13 +342,20 @@ foreach bin: gdkpixbuf_bin - include_directories: [ root_inc, gdk_pixbuf_inc ], - c_args: common_cflags + gdk_pixbuf_cflags, - install: true) -- meson.override_find_program(bin_name, bin) -+ if not get_option('use_prebuilt_tools') -+ meson.override_find_program(bin_name, bin) -+ endif - - # Used in tests - set_variable(bin_name.underscorify(), bin) - endforeach - --if not meson.is_cross_build() -+if get_option('use_prebuilt_tools') -+ gdk_pixbuf_query_loaders = find_program('gdk-pixbuf-query-loaders', required: true) -+ gdk_pixbuf_pixdata = find_program('gdk-pixbuf-pixdata', required: true) -+endif -+ -+if not meson.is_cross_build() or get_option('use_prebuilt_tools') - # The 'loaders.cache' used for testing, so we don't accidentally - # load the installed cache; we always build it by default - loaders_cache = custom_target('loaders.cache', -diff --git a/meson.build b/meson.build -index 813bd43..a93e6f7 100644 ---- a/meson.build -+++ b/meson.build -@@ -369,18 +369,18 @@ subdir('gdk-pixbuf') - # i18n - subdir('po') - --if not meson.is_cross_build() -+if not meson.is_cross_build() or get_option('use_prebuilt_tools') - if get_option('tests') - subdir('tests') - endif -- subdir('thumbnailer') - endif -+subdir('thumbnailer') - - # Documentation - build_docs = get_option('gtk_doc') or get_option('docs') - subdir('docs') - --if not meson.is_cross_build() -+if not meson.is_cross_build() or get_option('use_prebuilt_tools') - meson.add_install_script('build-aux/post-install.py', - gdk_pixbuf_bindir, - gdk_pixbuf_libdir, -diff --git a/meson_options.txt b/meson_options.txt -index d198d99..1c899e9 100644 ---- a/meson_options.txt -+++ b/meson_options.txt -@@ -53,4 +53,8 @@ option('gio_sniffing', - description: 'Perform file type detection using GIO (Unused on MacOS and Windows)', - type: 'boolean', - value: true) -+option('use_prebuilt_tools', -+ description: 'Use prebuilt gdk-pixbuf tools from the host for cross-compilation', -+ type: 'boolean', -+ value: false) - -diff --git a/tests/meson.build b/tests/meson.build -index 28c2525..d97c02d 100644 ---- a/tests/meson.build -+++ b/tests/meson.build -@@ -5,6 +5,12 @@ - # $PATH. Ideally we should use gnome.compile_resources() and let Meson deal with - # this problem: See https://github.com/mesonbuild/meson/issues/8266. - if enabled_loaders.contains('png') and host_system != 'windows' -+ -+ resources_deps = [loaders_cache,] -+ if not get_option('use_prebuilt_tools') -+ resources_deps += [gdk_pixbuf_pixdata,] -+ endif -+ - # Resources; we cannot use gnome.compile_resources() here, because we need to - # override the environment in order to use the utilities we just built instead - # of the system ones -@@ -21,10 +27,7 @@ if enabled_loaders.contains('png') and host_system != 'windows' - '@INPUT@', - '@OUTPUT@', - ], -- depends: [ -- gdk_pixbuf_pixdata, -- loaders_cache, -- ], -+ depends: resources_deps, - ) - - resources_h = custom_target('resources.h', -@@ -40,10 +43,7 @@ if enabled_loaders.contains('png') and host_system != 'windows' - '@INPUT@', - '@OUTPUT@', - ], -- depends: [ -- gdk_pixbuf_pixdata, -- loaders_cache, -- ], -+ depends: resources_deps, - ) - no_resources = false - else -diff --git a/thumbnailer/meson.build b/thumbnailer/meson.build -index b6a206d..9336c21 100644 ---- a/thumbnailer/meson.build -+++ b/thumbnailer/meson.build -@@ -6,13 +6,29 @@ bin = executable('gdk-pixbuf-thumbnailer', - ], - dependencies: gdk_pixbuf_deps + [ gdkpixbuf_dep ], - install: true) --meson.override_find_program('gdk-pixbuf-thumbnailer', bin) -+if not get_option('use_prebuilt_tools') -+ meson.override_find_program('gdk-pixbuf-thumbnailer', bin) -+endif - - gdk_pixbuf_print_mime_types = executable('gdk-pixbuf-print-mime-types', - 'gdk-pixbuf-print-mime-types.c', -+ install: true, - c_args: common_cflags, - dependencies: gdk_pixbuf_deps + [ gdkpixbuf_dep ]) - -+if get_option('use_prebuilt_tools') -+ gdk_pixbuf_print_mime_types = find_program('gdk-pixbuf-print-mime-types', required: true) -+endif -+ -+thumbnailer_deps = [loaders_cache,] -+ -+if not get_option('use_prebuilt_tools') -+ thumbnailer_deps += [ -+ gdk_pixbuf_print_mime_types, -+ gdk_pixbuf_pixdata, -+ ] -+endif -+ - custom_target('thumbnailer', - input: 'gdk-pixbuf-thumbnailer.thumbnailer.in', - output: 'gdk-pixbuf-thumbnailer.thumbnailer', -@@ -25,10 +41,6 @@ custom_target('thumbnailer', - '@INPUT@', - '@OUTPUT@', - ], -- depends: [ -- gdk_pixbuf_print_mime_types, -- gdk_pixbuf_pixdata, -- loaders_cache, -- ], -+ depends: thumbnailer_deps, - install: true, - install_dir: join_paths(gdk_pixbuf_datadir, 'thumbnailers')) diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch new file mode 100644 index 0000000000..7250fa3f62 --- /dev/null +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch @@ -0,0 +1,66 @@ +From 9d3b374e75692da3d1d05344a1693c85a3098f47 Mon Sep 17 00:00:00 2001 +From: Alexander Kanavin <alex@linutronix.de> +Date: Thu, 26 Jan 2023 20:29:46 +0100 +Subject: [PATCH] meson.build: allow (a subset of) tests in cross compile + settings + +There is no need to completely disable tests: most of them +do not require running target executables at build time, +and so can be built and installed. + +This requires inserting a couple of specific guards around +items that do require running target executables. + +Upstream-Status: Submitted [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/150] +Signed-off-by: Alexander Kanavin <alex@linutronix.de> +--- + meson.build | 6 +++--- + tests/meson.build | 10 ++++++---- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/meson.build b/meson.build +index 8a16c8f..7c8b20f 100644 +--- a/meson.build ++++ b/meson.build +@@ -369,10 +369,10 @@ subdir('gdk-pixbuf') + # i18n + subdir('po') + ++if get_option('tests') ++ subdir('tests') ++endif + if not meson.is_cross_build() +- if get_option('tests') +- subdir('tests') +- endif + subdir('thumbnailer') + endif + +diff --git a/tests/meson.build b/tests/meson.build +index 28c2525..c45e765 100644 +--- a/tests/meson.build ++++ b/tests/meson.build +@@ -4,7 +4,7 @@ + # gdk-pixbuf-pixdata from build directory because it needs all DLL locations in + # $PATH. Ideally we should use gnome.compile_resources() and let Meson deal with + # this problem: See https://github.com/mesonbuild/meson/issues/8266. +-if enabled_loaders.contains('png') and host_system != 'windows' ++if enabled_loaders.contains('png') and host_system != 'windows' and not meson.is_cross_build() + # Resources; we cannot use gnome.compile_resources() here, because we need to + # override the environment in order to use the utilities we just built instead + # of the system ones +@@ -166,9 +166,11 @@ endif + test_deps = gdk_pixbuf_deps + [ gdkpixbuf_dep, ] + test_args = [ '-k' ] + test_env = environment() +-test_env.set('G_TEST_SRCDIR', meson.current_source_dir()) +-test_env.set('G_TEST_BUILDDIR', meson.current_build_dir()) +-test_env.set('GDK_PIXBUF_MODULE_FILE', loaders_cache.full_path()) ++if not meson.is_cross_build() ++ test_env.set('G_TEST_SRCDIR', meson.current_source_dir()) ++ test_env.set('G_TEST_BUILDDIR', meson.current_build_dir()) ++ test_env.set('GDK_PIXBUF_MODULE_FILE', loaders_cache.full_path()) ++endif + + foreach test_name, test_data: installed_tests + test_sources = [ test_name + '.c', 'test-common.c' ] diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb index aa44515fbb..cca89a9059 100644 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb @@ -12,15 +12,14 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c \ SECTION = "libs" -DEPENDS = "glib-2.0 gdk-pixbuf-native shared-mime-info" -DEPENDS:remove:class-native = "gdk-pixbuf-native" +DEPENDS = "glib-2.0 shared-mime-info" MAJ_VER = "${@oe.utils.trim_version("${PV}", 2)}" SRC_URI = "${GNOME_MIRROR}/${BPN}/${MAJ_VER}/${BPN}-${PV}.tar.xz \ file://run-ptest \ file://fatal-loader.patch \ - file://0001-Add-use_prebuilt_tools-option.patch \ + file://0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch \ " SRC_URI[sha256sum] = "ee9b6c75d13ba096907a2e3c6b27b61bcd17f5c7ebeab5a5b439d2f2e39fe44b" @@ -46,14 +45,6 @@ PACKAGECONFIG[tests] = "-Dinstalled_tests=true,-Dinstalled_tests=false" EXTRA_OEMESON = "-Dman=false" -EXTRA_OEMESON:append:class-target = " \ - -Duse_prebuilt_tools=true \ -" - -EXTRA_OEMESON:append:class-nativesdk = " \ - -Duse_prebuilt_tools=true \ -" - PACKAGES =+ "${PN}-xlib" # For GIO image type sniffing @@ -115,10 +106,6 @@ do_install:append:class-native() { XDG_DATA_DIRS=${STAGING_DATADIR} \ GDK_PIXBUF_MODULE_FILE=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders.cache - create_wrapper ${D}/${bindir}/gdk-pixbuf-print-mime-types \ - XDG_DATA_DIRS=${STAGING_DATADIR} \ - GDK_PIXBUF_MODULE_FILE=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders.cache - create_wrapper ${D}/${libdir}/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders \ XDG_DATA_DIRS=${STAGING_DATADIR} \ GDK_PIXBUF_MODULE_FILE=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders.cache \ diff --git a/meta/recipes-gnome/librsvg/librsvg_2.52.7.bb b/meta/recipes-gnome/librsvg/librsvg_2.52.10.bb index 78eb93c635..21f502444b 100644 --- a/meta/recipes-gnome/librsvg/librsvg_2.52.7.bb +++ b/meta/recipes-gnome/librsvg/librsvg_2.52.10.bb @@ -20,7 +20,7 @@ SRC_URI += "file://0001-Makefile.am-pass-rust-target-to-cargo-also-when-not-.pat file://0001-system-deps-src-lib.rs-do-not-probe-into-harcoded-li.patch \ " -SRC_URI[archive.sha256sum] = "057c1eeeaf85c84e254bdb707459207f5840da5b4d52b4711c03140ed09e6887" +SRC_URI[archive.sha256sum] = "6292dfcd6a8e1ce1784e0188914546af1633081d1fae9e22f7cb017e7e84ba8f" # librsvg is still autotools-based, but is calling cargo from its automake-driven makefiles # so we cannot use cargo class directly, but still need bits and pieces from it @@ -73,3 +73,5 @@ FILES:librsvg-gtk = "${libdir}/gdk-pixbuf-2.0/*/*/*.so \ RRECOMMENDS:librsvg-gtk = "gdk-pixbuf-bin" PIXBUF_PACKAGES = "librsvg-gtk" + +TARGET_CC_ARCH += "${LDFLAGS}" diff --git a/meta/recipes-graphics/freetype/freetype/CVE-2023-2004.patch b/meta/recipes-graphics/freetype/freetype/CVE-2023-2004.patch new file mode 100644 index 0000000000..f600309d3e --- /dev/null +++ b/meta/recipes-graphics/freetype/freetype/CVE-2023-2004.patch @@ -0,0 +1,41 @@ +From e6fda039ad638866b7a6a5d046f03278ba1b7611 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg <wl@gnu.org> +Date: Mon, 14 Nov 2022 19:18:19 +0100 +Subject: [PATCH] * src/truetype/ttgxvar.c (tt_hvadvance_adjust): Integer + overflow. + +Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50462 + +Upstream-Status: Backport [https://github.com/freetype/freetype/commit/e6fda039ad638866b7a6a5d046f03278ba1b7611] +CVE: CVE-2023-2004 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/truetype/ttgxvar.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c +index 7f2db0c..8968111 100644 +--- a/src/truetype/ttgxvar.c ++++ b/src/truetype/ttgxvar.c +@@ -42,6 +42,7 @@ + #include <ft2build.h> + #include <freetype/internal/ftdebug.h> + #include FT_CONFIG_CONFIG_H ++#include <freetype/internal/ftcalc.h> + #include <freetype/internal/ftstream.h> + #include <freetype/internal/sfnt.h> + #include <freetype/tttags.h> +@@ -1147,7 +1148,7 @@ + delta == 1 ? "" : "s", + vertical ? "VVAR" : "HVAR" )); + +- *avalue += delta; ++ *avalue = ADD_INT( *avalue, delta ); + + Exit: + return error; +-- +2.25.1 + diff --git a/meta/recipes-graphics/freetype/freetype_2.11.1.bb b/meta/recipes-graphics/freetype/freetype_2.11.1.bb index d425e162bc..29f4d8dfb7 100644 --- a/meta/recipes-graphics/freetype/freetype_2.11.1.bb +++ b/meta/recipes-graphics/freetype/freetype_2.11.1.bb @@ -16,6 +16,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.xz \ file://CVE-2022-27404.patch \ file://CVE-2022-27405.patch \ file://CVE-2022-27406.patch \ + file://CVE-2023-2004.patch \ " SRC_URI[sha256sum] = "3333ae7cfda88429c97a7ae63b7d01ab398076c3b67182e960e5684050f2c5c8" diff --git a/meta/recipes-graphics/glslang/glslang_1.3.204.1.bb b/meta/recipes-graphics/glslang/glslang_1.3.204.1.bb index 2af406212f..ff08f251cd 100644 --- a/meta/recipes-graphics/glslang/glslang_1.3.204.1.bb +++ b/meta/recipes-graphics/glslang/glslang_1.3.204.1.bb @@ -9,7 +9,7 @@ LICENSE = "BSD-3-Clause & BSD-2-Clause & MIT & Apache-2.0 & GPL-3-with-bison-exc LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=2a2b5acd7bc4844964cfda45fe807dc3" SRCREV = "2742e959347ae2fac58acd0d022c92a0ff1f24bf" -SRC_URI = "git://github.com/KhronosGroup/glslang.git;protocol=https;branch=master \ +SRC_URI = "git://github.com/KhronosGroup/glslang.git;protocol=https;branch=main \ file://0001-generate-glslang-pkg-config.patch" PE = "1" UPSTREAM_CHECK_GITTAGREGEX = "sdk-(?P<pver>\d+(\.\d+)+)" diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz/CVE-2023-25193-pre1.patch b/meta/recipes-graphics/harfbuzz/harfbuzz/CVE-2023-25193-pre1.patch new file mode 100644 index 0000000000..6721b1bd70 --- /dev/null +++ b/meta/recipes-graphics/harfbuzz/harfbuzz/CVE-2023-25193-pre1.patch @@ -0,0 +1,135 @@ +From b29fbd16fa82b82bdf0dcb2f13a63f7dc23cf324 Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod <behdad@behdad.org> +Date: Mon, 6 Feb 2023 13:08:52 -0700 +Subject: [PATCH] [gsubgpos] Refactor skippy_iter.match() + +Upstream-Status: Backport from [https://github.com/harfbuzz/harfbuzz/commit/b29fbd16fa82b82bdf0dcb2f13a63f7dc23cf324] +Comment1: To backport the fix for CVE-2023-25193, add defination for MATCH, NOT_MATCH and SKIP. +Signed-off-by: Siddharth <sdoshi@mvista.com> +--- + src/hb-ot-layout-gsubgpos.hh | 94 +++++++++++++++++++++--------------- + 1 file changed, 54 insertions(+), 40 deletions(-) + +diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh +index d9a068c..d17a4da 100644 +--- a/src/hb-ot-layout-gsubgpos.hh ++++ b/src/hb-ot-layout-gsubgpos.hh +@@ -522,33 +522,52 @@ struct hb_ot_apply_context_t : + may_skip (const hb_glyph_info_t &info) const + { return matcher.may_skip (c, info); } + ++ enum match_t { ++ MATCH, ++ NOT_MATCH, ++ SKIP ++ }; ++ ++ match_t match (hb_glyph_info_t &info) ++ { ++ matcher_t::may_skip_t skip = matcher.may_skip (c, info); ++ if (unlikely (skip == matcher_t::SKIP_YES)) ++ return SKIP; ++ ++ matcher_t::may_match_t match = matcher.may_match (info, match_glyph_data); ++ if (match == matcher_t::MATCH_YES || ++ (match == matcher_t::MATCH_MAYBE && ++ skip == matcher_t::SKIP_NO)) ++ return MATCH; ++ ++ if (skip == matcher_t::SKIP_NO) ++ return NOT_MATCH; ++ ++ return SKIP; ++ } ++ + bool next (unsigned *unsafe_to = nullptr) + { + assert (num_items > 0); + while (idx + num_items < end) + { + idx++; +- const hb_glyph_info_t &info = c->buffer->info[idx]; +- +- matcher_t::may_skip_t skip = matcher.may_skip (c, info); +- if (unlikely (skip == matcher_t::SKIP_YES)) +- continue; +- +- matcher_t::may_match_t match = matcher.may_match (info, match_glyph_data); +- if (match == matcher_t::MATCH_YES || +- (match == matcher_t::MATCH_MAYBE && +- skip == matcher_t::SKIP_NO)) +- { +- num_items--; +- if (match_glyph_data) match_glyph_data++; +- return true; +- } +- +- if (skip == matcher_t::SKIP_NO) ++ switch (match (c->buffer->info[idx])) + { +- if (unsafe_to) +- *unsafe_to = idx + 1; +- return false; ++ case MATCH: ++ { ++ num_items--; ++ if (match_glyph_data) match_glyph_data++; ++ return true; ++ } ++ case NOT_MATCH: ++ { ++ if (unsafe_to) ++ *unsafe_to = idx + 1; ++ return false; ++ } ++ case SKIP: ++ continue; + } + } + if (unsafe_to) +@@ -561,27 +580,22 @@ struct hb_ot_apply_context_t : + while (idx > num_items - 1) + { + idx--; +- const hb_glyph_info_t &info = c->buffer->out_info[idx]; +- +- matcher_t::may_skip_t skip = matcher.may_skip (c, info); +- if (unlikely (skip == matcher_t::SKIP_YES)) +- continue; +- +- matcher_t::may_match_t match = matcher.may_match (info, match_glyph_data); +- if (match == matcher_t::MATCH_YES || +- (match == matcher_t::MATCH_MAYBE && +- skip == matcher_t::SKIP_NO)) +- { +- num_items--; +- if (match_glyph_data) match_glyph_data++; +- return true; +- } +- +- if (skip == matcher_t::SKIP_NO) ++ switch (match (c->buffer->out_info[idx])) + { +- if (unsafe_from) +- *unsafe_from = hb_max (1u, idx) - 1u; +- return false; ++ case MATCH: ++ { ++ num_items--; ++ if (match_glyph_data) match_glyph_data++; ++ return true; ++ } ++ case NOT_MATCH: ++ { ++ if (unsafe_from) ++ *unsafe_from = hb_max (1u, idx) - 1u; ++ return false; ++ } ++ case SKIP: ++ continue; + } + } + if (unsafe_from) +-- +2.25.1 + diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz/CVE-2023-25193.patch b/meta/recipes-graphics/harfbuzz/harfbuzz/CVE-2023-25193.patch new file mode 100644 index 0000000000..a1ec1422cc --- /dev/null +++ b/meta/recipes-graphics/harfbuzz/harfbuzz/CVE-2023-25193.patch @@ -0,0 +1,185 @@ +From 8708b9e081192786c027bb7f5f23d76dbe5c19e8 Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod <behdad@behdad.org> +Date: Mon, 6 Feb 2023 14:51:25 -0700 +Subject: [PATCH] [GPOS] Avoid O(n^2) behavior in mark-attachment + +Upstream-Status: Backport from [https://github.com/harfbuzz/harfbuzz/commit/8708b9e081192786c027bb7f5f23d76dbe5c19e8] +Comment1: The Original Patch [https://github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dc] causes regression and was reverted. This Patch completes the fix. +Comment2: The Patch contained files MarkBasePosFormat1.hh and MarkLigPosFormat1.hh which were moved from hb-ot-layout-gpos-table.hh as per https://github.com/harfbuzz/harfbuzz/commit/197d9a5c994eb41c8c89b7b958b26b1eacfeeb00 +CVE: CVE-2023-25193 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + src/hb-ot-layout-gpos-table.hh | 98 ++++++++++++++++++++++------------ + src/hb-ot-layout-gsubgpos.hh | 5 +- + 2 files changed, 68 insertions(+), 35 deletions(-) + +diff --git a/src/hb-ot-layout-gpos-table.hh b/src/hb-ot-layout-gpos-table.hh +index 2f9186a..46b09d0 100644 +--- a/src/hb-ot-layout-gpos-table.hh ++++ b/src/hb-ot-layout-gpos-table.hh +@@ -2150,6 +2150,25 @@ struct MarkBasePosFormat1 + + const Coverage &get_coverage () const { return this+markCoverage; } + ++ static inline bool accept (hb_buffer_t *buffer, unsigned idx) ++ { ++ /* We only want to attach to the first of a MultipleSubst sequence. ++ * https://github.com/harfbuzz/harfbuzz/issues/740 ++ * Reject others... ++ * ...but stop if we find a mark in the MultipleSubst sequence: ++ * https://github.com/harfbuzz/harfbuzz/issues/1020 */ ++ return !_hb_glyph_info_multiplied (&buffer->info[idx]) || ++ 0 == _hb_glyph_info_get_lig_comp (&buffer->info[idx]) || ++ (idx == 0 || ++ _hb_glyph_info_is_mark (&buffer->info[idx - 1]) || ++ !_hb_glyph_info_multiplied (&buffer->info[idx - 1]) || ++ _hb_glyph_info_get_lig_id (&buffer->info[idx]) != ++ _hb_glyph_info_get_lig_id (&buffer->info[idx - 1]) || ++ _hb_glyph_info_get_lig_comp (&buffer->info[idx]) != ++ _hb_glyph_info_get_lig_comp (&buffer->info[idx - 1]) + 1 ++ ); ++ } ++ + bool apply (hb_ot_apply_context_t *c) const + { + TRACE_APPLY (this); +@@ -2157,47 +2176,46 @@ struct MarkBasePosFormat1 + unsigned int mark_index = (this+markCoverage).get_coverage (buffer->cur().codepoint); + if (likely (mark_index == NOT_COVERED)) return_trace (false); + +- /* Now we search backwards for a non-mark glyph */ ++ /* Now we search backwards for a non-mark glyph. ++ * We don't use skippy_iter.prev() to avoid O(n^2) behavior. */ ++ + hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input; +- skippy_iter.reset (buffer->idx, 1); + skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks); +- do { +- unsigned unsafe_from; +- if (!skippy_iter.prev (&unsafe_from)) ++ unsigned j; ++ for (j = buffer->idx; j > c->last_base_until; j--) ++ { ++ auto match = skippy_iter.match (buffer->info[j - 1]); ++ if (match == skippy_iter.MATCH) + { +- buffer->unsafe_to_concat_from_outbuffer (unsafe_from, buffer->idx + 1); +- return_trace (false); ++ if (!accept (buffer, j - 1)) ++ match = skippy_iter.SKIP; + } ++ if (match == skippy_iter.MATCH) ++ { ++ c->last_base = (signed) j - 1; ++ break; ++ } ++ } ++ c->last_base_until = buffer->idx; ++ if (c->last_base == -1) ++ { ++ buffer->unsafe_to_concat_from_outbuffer (0, buffer->idx + 1); ++ return_trace (false); ++ } + +- /* We only want to attach to the first of a MultipleSubst sequence. +- * https://github.com/harfbuzz/harfbuzz/issues/740 +- * Reject others... +- * ...but stop if we find a mark in the MultipleSubst sequence: +- * https://github.com/harfbuzz/harfbuzz/issues/1020 */ +- if (!_hb_glyph_info_multiplied (&buffer->info[skippy_iter.idx]) || +- 0 == _hb_glyph_info_get_lig_comp (&buffer->info[skippy_iter.idx]) || +- (skippy_iter.idx == 0 || +- _hb_glyph_info_is_mark (&buffer->info[skippy_iter.idx - 1]) || +- _hb_glyph_info_get_lig_id (&buffer->info[skippy_iter.idx]) != +- _hb_glyph_info_get_lig_id (&buffer->info[skippy_iter.idx - 1]) || +- _hb_glyph_info_get_lig_comp (&buffer->info[skippy_iter.idx]) != +- _hb_glyph_info_get_lig_comp (&buffer->info[skippy_iter.idx - 1]) + 1 +- )) +- break; +- skippy_iter.reject (); +- } while (true); ++ unsigned idx = (unsigned) c->last_base; + + /* Checking that matched glyph is actually a base glyph by GDEF is too strong; disabled */ +- //if (!_hb_glyph_info_is_base_glyph (&buffer->info[skippy_iter.idx])) { return_trace (false); } ++ //if (!_hb_glyph_info_is_base_glyph (&buffer->info[idx])) { return_trace (false); } + +- unsigned int base_index = (this+baseCoverage).get_coverage (buffer->info[skippy_iter.idx].codepoint); ++ unsigned int base_index = (this+baseCoverage).get_coverage (buffer->info[idx].codepoint); + if (base_index == NOT_COVERED) + { +- buffer->unsafe_to_concat_from_outbuffer (skippy_iter.idx, buffer->idx + 1); ++ buffer->unsafe_to_concat_from_outbuffer (idx, buffer->idx + 1); + return_trace (false); + } + +- return_trace ((this+markArray).apply (c, mark_index, base_index, this+baseArray, classCount, skippy_iter.idx)); ++ return_trace ((this+markArray).apply (c, mark_index, base_index, this+baseArray, classCount, idx)); + } + + bool subset (hb_subset_context_t *c) const +@@ -2423,20 +2441,32 @@ struct MarkLigPosFormat1 + if (likely (mark_index == NOT_COVERED)) return_trace (false); + + /* Now we search backwards for a non-mark glyph */ ++ + hb_ot_apply_context_t::skipping_iterator_t &skippy_iter = c->iter_input; +- skippy_iter.reset (buffer->idx, 1); + skippy_iter.set_lookup_props (LookupFlag::IgnoreMarks); +- unsigned unsafe_from; +- if (!skippy_iter.prev (&unsafe_from)) ++ ++ unsigned j; ++ for (j = buffer->idx; j > c->last_base_until; j--) + { +- buffer->unsafe_to_concat_from_outbuffer (unsafe_from, buffer->idx + 1); ++ auto match = skippy_iter.match (buffer->info[j - 1]); ++ if (match == skippy_iter.MATCH) ++ { ++ c->last_base = (signed) j - 1; ++ break; ++ } ++ } ++ c->last_base_until = buffer->idx; ++ if (c->last_base == -1) ++ { ++ buffer->unsafe_to_concat_from_outbuffer (0, buffer->idx + 1); + return_trace (false); + } + ++ j = (unsigned) c->last_base; ++ + /* Checking that matched glyph is actually a ligature by GDEF is too strong; disabled */ +- //if (!_hb_glyph_info_is_ligature (&buffer->info[skippy_iter.idx])) { return_trace (false); } ++ //if (!_hb_glyph_info_is_ligature (&buffer->info[j])) { return_trace (false); } + +- unsigned int j = skippy_iter.idx; + unsigned int lig_index = (this+ligatureCoverage).get_coverage (buffer->info[j].codepoint); + if (lig_index == NOT_COVERED) + { +diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh +index 65de131..d9a068c 100644 +--- a/src/hb-ot-layout-gsubgpos.hh ++++ b/src/hb-ot-layout-gsubgpos.hh +@@ -641,6 +641,9 @@ struct hb_ot_apply_context_t : + uint32_t random_state; + + ++ signed last_base = -1; // GPOS uses ++ unsigned last_base_until = 0; // GPOS uses ++ + hb_ot_apply_context_t (unsigned int table_index_, + hb_font_t *font_, + hb_buffer_t *buffer_) : +@@ -673,7 +676,7 @@ struct hb_ot_apply_context_t : + iter_context.init (this, true); + } + +- void set_lookup_mask (hb_mask_t mask) { lookup_mask = mask; init_iters (); } ++ void set_lookup_mask (hb_mask_t mask) { lookup_mask = mask; last_base = -1; last_base_until = 0; init_iters (); } + void set_auto_zwj (bool auto_zwj_) { auto_zwj = auto_zwj_; init_iters (); } + void set_auto_zwnj (bool auto_zwnj_) { auto_zwnj = auto_zwnj_; init_iters (); } + void set_random (bool random_) { random = random_; } +-- +2.25.1 + diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz_4.0.1.bb b/meta/recipes-graphics/harfbuzz/harfbuzz_4.0.1.bb index bdbb322e42..f7dc61ebd5 100644 --- a/meta/recipes-graphics/harfbuzz/harfbuzz_4.0.1.bb +++ b/meta/recipes-graphics/harfbuzz/harfbuzz_4.0.1.bb @@ -13,7 +13,9 @@ UPSTREAM_CHECK_REGEX = "harfbuzz-(?P<pver>\d+(\.\d+)+).tar" SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BPN}-${PV}.tar.xz \ file://CVE-2022-33068.patch \ - file://0001-Fix-conditional.patch" + file://0001-Fix-conditional.patch \ + file://CVE-2023-25193-pre1.patch \ + file://CVE-2023-25193.patch" SRC_URI[sha256sum] = "98f68777272db6cd7a3d5152bac75083cd52a26176d87bc04c8b3929d33bce49" inherit meson pkgconfig lib_package gtk-doc gobject-introspection diff --git a/meta/recipes-graphics/jpeg/files/CVE-2023-2804-1.patch b/meta/recipes-graphics/jpeg/files/CVE-2023-2804-1.patch new file mode 100644 index 0000000000..fd8a66bca7 --- /dev/null +++ b/meta/recipes-graphics/jpeg/files/CVE-2023-2804-1.patch @@ -0,0 +1,103 @@ +From 42ce199c9cfe129e5e21afd48dfe757a6acf87c4 Mon Sep 17 00:00:00 2001 +From: DRC <information@libjpeg-turbo.org> +Date: Tue, 4 Apr 2023 19:06:20 -0500 +Subject: [PATCH] Decomp: Don't enable 2-pass color quant w/ RGB565 + +The 2-pass color quantization algorithm assumes 3-sample pixels. RGB565 +is the only 3-component colorspace that doesn't have 3-sample pixels, so +we need to treat it as a special case when determining whether to enable +2-pass color quantization. Otherwise, attempting to initialize 2-pass +color quantization with an RGB565 output buffer could cause +prescan_quantize() to read from uninitialized memory and subsequently +underflow/overflow the histogram array. + +djpeg is supposed to fail gracefully if both -rgb565 and -colors are +specified, because none of its destination managers (image writers) +support color quantization with RGB565. However, prescan_quantize() was +called before that could occur. It is possible but very unlikely that +these issues could have been reproduced in applications other than +djpeg. The issues involve the use of two features (12-bit precision and +RGB565) that are incompatible, and they also involve the use of two +rarely-used legacy features (RGB565 and color quantization) that don't +make much sense when combined. + +Fixes #668 +Fixes #671 +Fixes #680 + +CVE: CVE-2023-2804 +Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/42ce199c9cfe129e5e21afd48dfe757a6acf87c4] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + ChangeLog.md | 12 ++++++++++++ + jdmaster.c | 5 +++-- + jquant2.c | 5 +++-- + 3 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/ChangeLog.md b/ChangeLog.md +index 1c1e6538a..f1bfb3d87 100644 +--- a/ChangeLog.md ++++ b/ChangeLog.md +@@ -1,3 +1,15 @@ ++2.1.6 ++===== ++ ++### Significant changes relative to 2.1.5.1: ++ ++1. Fixed an oversight in 1.4 beta1[8] that caused various segfaults and buffer ++overruns when attempting to decompress various specially-crafted malformed ++12-bit-per-component JPEG images using a 12-bit-per-component build of djpeg ++(`-DWITH_12BIT=1`) with both color quantization and RGB565 color conversion ++enabled. ++ ++ + 2.1.5.1 + ======= + +diff --git a/jdmaster.c b/jdmaster.c +index a3690bf56..a9446adfd 100644 +--- a/jdmaster.c ++++ b/jdmaster.c +@@ -5,7 +5,7 @@ + * Copyright (C) 1991-1997, Thomas G. Lane. + * Modified 2002-2009 by Guido Vollbeding. + * libjpeg-turbo Modifications: +- * Copyright (C) 2009-2011, 2016, 2019, 2022, D. R. Commander. ++ * Copyright (C) 2009-2011, 2016, 2019, 2022-2023, D. R. Commander. + * Copyright (C) 2013, Linaro Limited. + * Copyright (C) 2015, Google, Inc. + * For conditions of distribution and use, see the accompanying README.ijg +@@ -480,7 +480,8 @@ master_selection(j_decompress_ptr cinfo) + if (cinfo->raw_data_out) + ERREXIT(cinfo, JERR_NOTIMPL); + /* 2-pass quantizer only works in 3-component color space. */ +- if (cinfo->out_color_components != 3) { ++ if (cinfo->out_color_components != 3 || ++ cinfo->out_color_space == JCS_RGB565) { + cinfo->enable_1pass_quant = TRUE; + cinfo->enable_external_quant = FALSE; + cinfo->enable_2pass_quant = FALSE; +diff --git a/jquant2.c b/jquant2.c +index 44efb18ca..1c14ef763 100644 +--- a/jquant2.c ++++ b/jquant2.c +@@ -4,7 +4,7 @@ + * This file was part of the Independent JPEG Group's software: + * Copyright (C) 1991-1996, Thomas G. Lane. + * libjpeg-turbo Modifications: +- * Copyright (C) 2009, 2014-2015, 2020, D. R. Commander. ++ * Copyright (C) 2009, 2014-2015, 2020, 2023, D. R. Commander. + * For conditions of distribution and use, see the accompanying README.ijg + * file. + * +@@ -1230,7 +1230,8 @@ jinit_2pass_quantizer(j_decompress_ptr cinfo) + cquantize->error_limiter = NULL; + + /* Make sure jdmaster didn't give me a case I can't handle */ +- if (cinfo->out_color_components != 3) ++ if (cinfo->out_color_components != 3 || ++ cinfo->out_color_space == JCS_RGB565) + ERREXIT(cinfo, JERR_NOTIMPL); + + /* Allocate the histogram/inverse colormap storage */ diff --git a/meta/recipes-graphics/jpeg/files/CVE-2023-2804-2.patch b/meta/recipes-graphics/jpeg/files/CVE-2023-2804-2.patch new file mode 100644 index 0000000000..af955a72f6 --- /dev/null +++ b/meta/recipes-graphics/jpeg/files/CVE-2023-2804-2.patch @@ -0,0 +1,75 @@ +From 2e1b8a462f7f9f9bf6cd25a8516caa8203cc4593 Mon Sep 17 00:00:00 2001 +From: DRC <information@libjpeg-turbo.org> +Date: Thu, 6 Apr 2023 18:33:41 -0500 +Subject: [PATCH] jpeg_crop_scanline: Fix calc w/sclg + 2x4,4x2 samp + +When computing the downsampled width for a particular component, +jpeg_crop_scanline() needs to take into account the fact that the +libjpeg code uses a combination of IDCT scaling and upsampling to +implement 4x2 and 2x4 upsampling with certain decompression scaling +factors. Failing to account for that led to incomplete upsampling of +4x2- or 2x4-subsampled components, which caused the color converter to +read from uninitialized memory. With 12-bit data precision, this caused +a buffer overrun or underrun and subsequent segfault if the +uninitialized memory contained a value that was outside of the valid +sample range (because the color converter uses the value as an array +index.) + +Fixes #669 + +CVE: CVE-2023-2804 +Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/2e1b8a462f7f9f9bf6cd25a8516caa8203cc4593] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + ChangeLog.md | 8 ++++++++ + jdapistd.c | 10 ++++++---- + 2 files changed, 14 insertions(+), 4 deletions(-) + +diff --git a/ChangeLog.md b/ChangeLog.md +index f1bfb3d87..0a075c3c5 100644 +--- a/ChangeLog.md ++++ b/ChangeLog.md +@@ -9,6 +9,14 @@ overruns when attempting to decompress various specially-crafted malformed + (`-DWITH_12BIT=1`) with both color quantization and RGB565 color conversion + enabled. + ++2. Fixed an issue whereby `jpeg_crop_scanline()` sometimes miscalculated the ++downsampled width for components with 4x2 or 2x4 subsampling factors if ++decompression scaling was enabled. This caused the components to be upsampled ++incompletely, which caused the color converter to read from uninitialized ++memory. With 12-bit data precision, this caused a buffer overrun or underrun ++and subsequent segfault if the sample value read from unitialized memory was ++outside of the valid sample range. ++ + + 2.1.5.1 + ======= +diff --git a/jdapistd.c b/jdapistd.c +index 02cd0cb93..96cded112 100644 +--- a/jdapistd.c ++++ b/jdapistd.c +@@ -4,7 +4,7 @@ + * This file was part of the Independent JPEG Group's software: + * Copyright (C) 1994-1996, Thomas G. Lane. + * libjpeg-turbo Modifications: +- * Copyright (C) 2010, 2015-2020, 2022, D. R. Commander. ++ * Copyright (C) 2010, 2015-2020, 2022-2023, D. R. Commander. + * Copyright (C) 2015, Google, Inc. + * For conditions of distribution and use, see the accompanying README.ijg + * file. +@@ -236,9 +236,11 @@ jpeg_crop_scanline(j_decompress_ptr cinfo, JDIMENSION *xoffset, + /* Set downsampled_width to the new output width. */ + orig_downsampled_width = compptr->downsampled_width; + compptr->downsampled_width = +- (JDIMENSION)jdiv_round_up((long)(cinfo->output_width * +- compptr->h_samp_factor), +- (long)cinfo->max_h_samp_factor); ++ (JDIMENSION)jdiv_round_up((long)cinfo->output_width * ++ (long)(compptr->h_samp_factor * ++ compptr->_DCT_scaled_size), ++ (long)(cinfo->max_h_samp_factor * ++ cinfo->_min_DCT_scaled_size)); + if (compptr->downsampled_width < 2 && orig_downsampled_width >= 2) + reinit_upsampler = TRUE; + diff --git a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.1.4.bb b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.1.5.1.bb index 1708fa97f0..86bf471eea 100644 --- a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.1.4.bb +++ b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.1.5.1.bb @@ -12,9 +12,11 @@ DEPENDS:append:x86:class-target = " nasm-native" SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}-${PV}.tar.gz \ file://0001-libjpeg-turbo-fix-package_qa-error.patch \ + file://CVE-2023-2804-1.patch \ + file://CVE-2023-2804-2.patch \ " -SRC_URI[sha256sum] = "d3ed26a1131a13686dfca4935e520eb7c90ae76fbc45d98bb50a8dc86230342b" +SRC_URI[sha256sum] = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf" UPSTREAM_CHECK_URI = "http://sourceforge.net/projects/libjpeg-turbo/files/" UPSTREAM_CHECK_REGEX = "/libjpeg-turbo/files/(?P<pver>(\d+[\.\-_]*)+)/" diff --git a/meta/recipes-graphics/kmscube/kmscube_git.bb b/meta/recipes-graphics/kmscube/kmscube_git.bb index 58ce26a3d5..98f110527e 100644 --- a/meta/recipes-graphics/kmscube/kmscube_git.bb +++ b/meta/recipes-graphics/kmscube/kmscube_git.bb @@ -6,7 +6,7 @@ OpenGL or OpenGL ES." HOMEPAGE = "https://cgit.freedesktop.org/mesa/kmscube/" LICENSE = "MIT" SECTION = "graphics" -DEPENDS = "virtual/libgles3 virtual/libgles2 virtual/egl libdrm" +DEPENDS = "virtual/libgles3 virtual/libgles2 virtual/egl libdrm virtual/libgbm" LIC_FILES_CHKSUM = "file://kmscube.c;beginline=1;endline=23;md5=8b309d4ee67b7315ff7381270dd631fb" @@ -20,7 +20,6 @@ S = "${WORKDIR}/git" inherit meson pkgconfig features_check REQUIRED_DISTRO_FEATURES = "opengl" -DEPENDS = "virtual/libgbm" PACKAGECONFIG ??= "" PACKAGECONFIG[gstreamer] = "-Dgstreamer=enabled,-Dgstreamer=disabled,gstreamer1.0 gstreamer1.0-plugins-base" diff --git a/meta/recipes-graphics/libsdl2/libsdl2/0001-Fix-potential-memory-leak-in-GLES_CreateTextur.patch b/meta/recipes-graphics/libsdl2/libsdl2/0001-Fix-potential-memory-leak-in-GLES_CreateTextur.patch new file mode 100644 index 0000000000..31bda54dd3 --- /dev/null +++ b/meta/recipes-graphics/libsdl2/libsdl2/0001-Fix-potential-memory-leak-in-GLES_CreateTextur.patch @@ -0,0 +1,40 @@ +From 3cf2048b647484cc3a6abd0d78be60cead47b42d Mon Sep 17 00:00:00 2001 +From: Changqing Li <changqing.li@windriver.com> +Date: Fri, 24 Feb 2023 16:59:19 +0800 +Subject: [PATCH] Fix potential memory leak in GLES_CreateTextur + +CVE: CVE-2022-4743 +Upstream-Status: Backport [https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b] + +Signed-off-by: Changqing Li <changqing.li@windriver.com> +--- + src/render/opengles/SDL_render_gles.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/render/opengles/SDL_render_gles.c b/src/render/opengles/SDL_render_gles.c +index a6b58f2..237b1d6 100644 +--- a/src/render/opengles/SDL_render_gles.c ++++ b/src/render/opengles/SDL_render_gles.c +@@ -368,6 +368,9 @@ GLES_CreateTexture(SDL_Renderer * renderer, SDL_Texture * texture) + renderdata->glGenTextures(1, &data->texture); + result = renderdata->glGetError(); + if (result != GL_NO_ERROR) { ++ if (texture->access == SDL_TEXTUREACCESS_STREAMING) { ++ SDL_free(data->pixels); ++ } + SDL_free(data); + return GLES_SetError("glGenTextures()", result); + } +@@ -396,6 +399,9 @@ GLES_CreateTexture(SDL_Renderer * renderer, SDL_Texture * texture) + + result = renderdata->glGetError(); + if (result != GL_NO_ERROR) { ++ if (texture->access == SDL_TEXTUREACCESS_STREAMING) { ++ SDL_free(data->pixels); ++ } + SDL_free(data); + return GLES_SetError("glTexImage2D()", result); + } +-- +2.25.1 + diff --git a/meta/recipes-graphics/libsdl2/libsdl2_2.0.20.bb b/meta/recipes-graphics/libsdl2/libsdl2_2.0.20.bb index c1c827af79..abcf232e25 100644 --- a/meta/recipes-graphics/libsdl2/libsdl2_2.0.20.bb +++ b/meta/recipes-graphics/libsdl2/libsdl2_2.0.20.bb @@ -24,6 +24,7 @@ PROVIDES = "virtual/libsdl2" SRC_URI = "http://www.libsdl.org/release/SDL2-${PV}.tar.gz \ file://optional-libunwind-generic.patch \ file://0001-sdlchecks.cmake-pass-cflags-to-the-appropriate-cmake.patch \ + file://0001-Fix-potential-memory-leak-in-GLES_CreateTextur.patch \ " SRC_URI:append:class-native = " file://0001-Disable-libunwind-in-native-OE-builds-by-not-looking.patch" diff --git a/meta/recipes-graphics/piglit/piglit/0001-cmake-use-proper-WAYLAND_INCLUDE_DIRS-variable.patch b/meta/recipes-graphics/piglit/piglit/0002-cmake-use-proper-WAYLAND_INCLUDE_DIRS-variable.patch index 5d6ec368ba..5d6ec368ba 100644 --- a/meta/recipes-graphics/piglit/piglit/0001-cmake-use-proper-WAYLAND_INCLUDE_DIRS-variable.patch +++ b/meta/recipes-graphics/piglit/piglit/0002-cmake-use-proper-WAYLAND_INCLUDE_DIRS-variable.patch diff --git a/meta/recipes-graphics/piglit/piglit/0002-tests-util-piglit-shader.c-do-not-hardcode-build-pat.patch b/meta/recipes-graphics/piglit/piglit/0003-tests-util-piglit-shader.c-do-not-hardcode-build-pat.patch index 16c7c5c803..16c7c5c803 100644 --- a/meta/recipes-graphics/piglit/piglit/0002-tests-util-piglit-shader.c-do-not-hardcode-build-pat.patch +++ b/meta/recipes-graphics/piglit/piglit/0003-tests-util-piglit-shader.c-do-not-hardcode-build-pat.patch diff --git a/meta/recipes-graphics/piglit/piglit/0005-cmake-Don-t-enable-GLX-if-tests-are-disabled.patch b/meta/recipes-graphics/piglit/piglit/0005-cmake-Don-t-enable-GLX-if-tests-are-disabled.patch new file mode 100644 index 0000000000..ef6fda0f4e --- /dev/null +++ b/meta/recipes-graphics/piglit/piglit/0005-cmake-Don-t-enable-GLX-if-tests-are-disabled.patch @@ -0,0 +1,32 @@ +From 13ff43fe760ac343b33d8e8c84b89886aac07116 Mon Sep 17 00:00:00 2001 +From: Tom Hochstein <tom.hochstein@nxp.com> +Date: Fri, 3 Jun 2022 10:44:29 -0500 +Subject: [PATCH] cmake: Don't enable GLX if tests are disabled + +Allow building for systems that don't support GLX. + +Upstream-Status: Submitted [https://gitlab.freedesktop.org/mesa/piglit/-/merge_requests/720] +Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com> +--- + CMakeLists.txt | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index e1aeb5ddf..85e171aba 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -134,10 +134,7 @@ if(PIGLIT_BUILD_CL_TESTS) + endif(PIGLIT_BUILD_CL_TESTS) + + IF(${CMAKE_SYSTEM_NAME} MATCHES "Linux") +- if(X11_FOUND AND OPENGL_gl_LIBRARY) +- # Assume the system has GLX. In the future, systems may exist +- # with libGL and libX11 but no GLX, but that world hasn't +- # arrived yet. ++ if(X11_FOUND AND OPENGL_gl_LIBRARY AND PIGLIT_BUILD_GLX_TESTS) + set(PIGLIT_HAS_GLX True) + add_definitions(-DPIGLIT_HAS_GLX) + endif() +-- +2.17.1 + diff --git a/meta/recipes-graphics/piglit/piglit_git.bb b/meta/recipes-graphics/piglit/piglit_git.bb index 3ae7a14e46..78a5d6248a 100644 --- a/meta/recipes-graphics/piglit/piglit_git.bb +++ b/meta/recipes-graphics/piglit/piglit_git.bb @@ -8,10 +8,11 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b2beded7103a3d8a442a2a0391d607b0" SRC_URI = "git://gitlab.freedesktop.org/mesa/piglit.git;protocol=https;branch=main \ file://0001-cmake-install-bash-completions-in-the-right-place.patch \ - file://0001-cmake-use-proper-WAYLAND_INCLUDE_DIRS-variable.patch \ file://0001-Add-a-missing-include-for-htobe32-definition.patch \ - file://0002-tests-util-piglit-shader.c-do-not-hardcode-build-pat.patch \ - " + file://0002-cmake-use-proper-WAYLAND_INCLUDE_DIRS-variable.patch \ + file://0003-tests-util-piglit-shader.c-do-not-hardcode-build-pat.patch \ + file://0005-cmake-Don-t-enable-GLX-if-tests-are-disabled.patch" + UPSTREAM_CHECK_COMMITS = "1" SRCREV = "2f80c7cc9c02d37574dc8ba3140b7dd8eb3cbf82" @@ -36,10 +37,12 @@ REQUIRED_DISTRO_FEATURES += "opengl" export TEMP = "${B}/temp/" do_compile[dirs] =+ "${B}/temp/" -PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'x11', d)}" +PACKAGECONFIG ??= "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11 glx', '', d)}" PACKAGECONFIG[freeglut] = "-DPIGLIT_USE_GLUT=1,-DPIGLIT_USE_GLUT=0,freeglut," +PACKAGECONFIG[glx] = "-DPIGLIT_BUILD_GLX_TESTS=ON,-DPIGLIT_BUILD_GLX_TESTS=OFF" +PACKAGECONFIG[opencl] = "-DPIGLIT_BUILD_CL_TESTS=ON,-DPIGLIT_BUILD_CL_TESTS=OFF,virtual/opencl-icd" PACKAGECONFIG[x11] = "-DPIGLIT_BUILD_GL_TESTS=ON,-DPIGLIT_BUILD_GL_TESTS=OFF,${X11_DEPS}, ${X11_RDEPS}" -PACKAGECONFIG[vulkan] = "-DPIGLIT_BUILD_VK_TESTS=ON,-DPIGLIT_BUILD_VK_TESTS=OFF,vulkan-loader" +PACKAGECONFIG[vulkan] = "-DPIGLIT_BUILD_VK_TESTS=ON,-DPIGLIT_BUILD_VK_TESTS=OFF,glslang-native vulkan-loader,glslang" export PIGLIT_BUILD_DIR = "../../../../git" diff --git a/meta/recipes-graphics/vulkan/vulkan-samples_git.bb b/meta/recipes-graphics/vulkan/vulkan-samples_git.bb index 3ad16490ce..ffb8d88ee6 100644 --- a/meta/recipes-graphics/vulkan/vulkan-samples_git.bb +++ b/meta/recipes-graphics/vulkan/vulkan-samples_git.bb @@ -5,7 +5,7 @@ LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://LICENSE;md5=48aa35cefb768436223a6e7f18dc2a2a" -SRC_URI = "gitsm://github.com/KhronosGroup/Vulkan-Samples.git;branch=master;protocol=https;lfs=0 \ +SRC_URI = "gitsm://github.com/KhronosGroup/Vulkan-Samples.git;branch=main;protocol=https;lfs=0 \ file://0001-CMakeLists.txt-do-not-hardcode-lib-as-installation-t.patch \ file://debugfix.patch \ " diff --git a/meta/recipes-graphics/waffle/waffle/0001-meson.build-request-native-wayland-scanner.patch b/meta/recipes-graphics/waffle/waffle/0001-meson.build-request-native-wayland-scanner.patch index 1b62db92e9..4b3a0e7c4a 100644 --- a/meta/recipes-graphics/waffle/waffle/0001-meson.build-request-native-wayland-scanner.patch +++ b/meta/recipes-graphics/waffle/waffle/0001-meson.build-request-native-wayland-scanner.patch @@ -1,4 +1,4 @@ -From 2195cec1e5bc66128d72049c11ff381ca4516a4b Mon Sep 17 00:00:00 2001 +From 0961787d2bf0d359a3ead89e9cec642818b32dea Mon Sep 17 00:00:00 2001 From: Alexander Kanavin <alex@linutronix.de> Date: Tue, 5 Jul 2022 11:51:39 +0200 Subject: [PATCH] meson.build: request native wayland-scanner @@ -8,15 +8,16 @@ try to use a cross-binary, and fail. Upstream-Status: Submitted [https://gitlab.freedesktop.org/mesa/waffle/-/merge_requests/110] Signed-off-by: Alexander Kanavin <alex@linutronix.de> + --- meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build -index 0bb6128..0b6da1f 100644 +index ca6a212..3177bde 100644 --- a/meson.build +++ b/meson.build -@@ -108,7 +108,7 @@ else +@@ -110,7 +110,7 @@ else 'wayland-egl', version : '>= 9.1', required : get_option('wayland'), ) dep_wayland_scanner = dependency( @@ -24,4 +25,4 @@ index 0bb6128..0b6da1f 100644 + 'wayland-scanner', version : '>= 1.15', required : get_option('wayland'), native: true, ) if dep_wayland_scanner.found() - prog_wayland_scanner = find_program(dep_wayland_scanner.get_pkgconfig_variable('wayland_scanner')) + prog_wayland_scanner = find_program(dep_wayland_scanner.get_variable(pkgconfig: 'wayland_scanner')) diff --git a/meta/recipes-graphics/waffle/waffle/0001-waffle-do-not-make-core-protocol-into-the-library.patch b/meta/recipes-graphics/waffle/waffle/0001-waffle-do-not-make-core-protocol-into-the-library.patch index 24b2de5d9c..60e6318f7a 100644 --- a/meta/recipes-graphics/waffle/waffle/0001-waffle-do-not-make-core-protocol-into-the-library.patch +++ b/meta/recipes-graphics/waffle/waffle/0001-waffle-do-not-make-core-protocol-into-the-library.patch @@ -1,4 +1,4 @@ -From 7610ec4b572d3a54d30fca6798f0c406f3fd8a46 Mon Sep 17 00:00:00 2001 +From 71f9399d6cea1e2e885a98b98d82eb628832a86e Mon Sep 17 00:00:00 2001 From: Alexander Kanavin <alex@linutronix.de> Date: Tue, 26 Oct 2021 08:52:17 +0200 Subject: [PATCH] waffle: do not make core protocol into the library @@ -9,28 +9,13 @@ wayland.xml from the host. Upstream-Status: Inappropriate [oe-core specific] Signed-off-by: Alexander Kanavin <alex@linutronix.de> + --- - meson.build | 4 ---- src/waffle/meson.build | 7 ------- - 2 files changed, 11 deletions(-) + 1 file changed, 7 deletions(-) -diff --git a/meson.build b/meson.build -index ffc02ff..0bb6128 100644 ---- a/meson.build -+++ b/meson.build -@@ -104,10 +104,6 @@ else - dep_wayland_client = dependency( - 'wayland-client', version : '>= 1.10', required : get_option('wayland'), - ) -- if dep_wayland_client.found() -- wayland_core_xml = join_paths(dep_wayland_client.get_pkgconfig_variable('pkgdatadir'), -- 'wayland.xml') -- endif - dep_wayland_egl = dependency( - 'wayland-egl', version : '>= 9.1', required : get_option('wayland'), - ) diff --git a/src/waffle/meson.build b/src/waffle/meson.build -index 01898c8..6245868 100644 +index e2636c7..3ff5762 100644 --- a/src/waffle/meson.build +++ b/src/waffle/meson.build @@ -88,12 +88,6 @@ if build_surfaceless diff --git a/meta/recipes-graphics/waffle/waffle_1.7.0.bb b/meta/recipes-graphics/waffle/waffle_1.7.2.bb index dc475908d0..cb917d8894 100644 --- a/meta/recipes-graphics/waffle/waffle_1.7.0.bb +++ b/meta/recipes-graphics/waffle/waffle_1.7.2.bb @@ -9,16 +9,16 @@ LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=4c5154407c2490750dd461c50ad94797 \ file://include/waffle-1/waffle.h;endline=24;md5=61dbf8697f61c78645e75a93c585b1bf" -SRC_URI = "git://gitlab.freedesktop.org/mesa/waffle.git;protocol=https;branch=master \ +SRC_URI = "git://gitlab.freedesktop.org/mesa/waffle.git;protocol=https;branch=maint-1.7 \ file://0001-waffle-do-not-make-core-protocol-into-the-library.patch \ file://0001-meson.build-request-native-wayland-scanner.patch \ " -SRCREV = "905c6c10f2483adf0cbfa024e2d3c2ed541fb300" +SRCREV = "f3b42a7216105498842bc6ba77d8481b90d6f5f9" S = "${WORKDIR}/git" inherit meson features_check lib_package bash-completion pkgconfig -DEPENDS:append = " python3 cmake-native" +DEPENDS:append = " python3" # This should be overridden per-machine to reflect the capabilities of the GL # stack. @@ -47,5 +47,5 @@ PACKAGECONFIG[surfaceless-egl] = "-Dsurfaceless_egl=enabled,-Dsurfaceless_egl=di # TODO: optionally build manpages and examples do_install:append() { - sed -i -e "s,${WORKDIR},,g" ${D}/${libdir}/cmake/Waffle/WaffleConfig.cmake + rm -rf ${D}${datadir}/zsh } diff --git a/meta/recipes-graphics/wayland/weston_10.0.2.bb b/meta/recipes-graphics/wayland/weston_10.0.2.bb index f81a33fd1e..e09f94d9bb 100644 --- a/meta/recipes-graphics/wayland/weston_10.0.2.bb +++ b/meta/recipes-graphics/wayland/weston_10.0.2.bb @@ -74,7 +74,7 @@ PACKAGECONFIG[webp] = "-Dimage-webp=true,-Dimage-webp=false,libwebp" # Weston with systemd-login support PACKAGECONFIG[systemd] = "-Dsystemd=true -Dlauncher-logind=true,-Dsystemd=false -Dlauncher-logind=false,systemd dbus" # Weston with Xwayland support (requires X11 and Wayland) -PACKAGECONFIG[xwayland] = "-Dxwayland=true,-Dxwayland=false" +PACKAGECONFIG[xwayland] = "-Dxwayland=true,-Dxwayland=false,xwayland" # colord CMS support PACKAGECONFIG[colord] = "-Dcolor-management-colord=true,-Dcolor-management-colord=false,colord" # Clients support diff --git a/meta/recipes-graphics/xorg-app/xdpyinfo_1.3.3.bb b/meta/recipes-graphics/xorg-app/xdpyinfo_1.3.4.bb index e75a840b7d..aaa8aa8903 100644 --- a/meta/recipes-graphics/xorg-app/xdpyinfo_1.3.3.bb +++ b/meta/recipes-graphics/xorg-app/xdpyinfo_1.3.4.bb @@ -15,6 +15,6 @@ PE = "1" SRC_URI += "file://disable-xkb.patch" SRC_URI_EXT = "xz" -SRC_URI[sha256sum] = "356d5fd62f3e98ee36d6becf1b32d4ab6112d618339fb4b592ccffbd9e0fc206" +SRC_URI[sha256sum] = "a8ada581dbd7266440d7c3794fa89edf6b99b8857fc2e8c31042684f3af4822b" EXTRA_OECONF = "--disable-xkb" diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch new file mode 100644 index 0000000000..c724cf8fdd --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch @@ -0,0 +1,111 @@ +From 304a654a0d57bf0f00d8998185f0360332cfa36c Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Sat, 10 Jun 2023 16:30:07 -0700 +Subject: [PATCH] InitExt.c: Add bounds checks for extension request, event, & + error codes + +Fixes CVE-2023-3138: X servers could return values from XQueryExtension +that would cause Xlib to write entries out-of-bounds of the arrays to +store them, though this would only overwrite other parts of the Display +struct, not outside the bounds allocated for that structure. + +Reported-by: Gregory James DUCK <gjduck@gmail.com> +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> + +CVE: CVE-2023-3138 +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c.patch] +Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> +--- + src/InitExt.c | 42 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +diff --git a/src/InitExt.c b/src/InitExt.c +index 4de46f15..afc00a6b 100644 +--- a/src/InitExt.c ++++ b/src/InitExt.c +@@ -33,6 +33,18 @@ from The Open Group. + #include <X11/Xos.h> + #include <stdio.h> + ++/* The X11 protocol spec reserves events 64 through 127 for extensions */ ++#ifndef LastExtensionEvent ++#define LastExtensionEvent 127 ++#endif ++ ++/* The X11 protocol spec reserves requests 128 through 255 for extensions */ ++#ifndef LastExtensionRequest ++#define FirstExtensionRequest 128 ++#define LastExtensionRequest 255 ++#endif ++ ++ + /* + * This routine is used to link a extension in so it will be called + * at appropriate times. +@@ -242,6 +254,12 @@ WireToEventType XESetWireToEvent( + WireToEventType proc) /* routine to call when converting event */ + { + register WireToEventType oldproc; ++ if (event_number < 0 || ++ event_number > LastExtensionEvent) { ++ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n", ++ event_number); ++ return (WireToEventType)_XUnknownWireEvent; ++ } + if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent; + LockDisplay (dpy); + oldproc = dpy->event_vec[event_number]; +@@ -263,6 +281,12 @@ WireToEventCookieType XESetWireToEventCookie( + ) + { + WireToEventCookieType oldproc; ++ if (extension < FirstExtensionRequest || ++ extension > LastExtensionRequest) { ++ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n", ++ extension); ++ return (WireToEventCookieType)_XUnknownWireEventCookie; ++ } + if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie; + LockDisplay (dpy); + oldproc = dpy->generic_event_vec[extension & 0x7F]; +@@ -284,6 +308,12 @@ CopyEventCookieType XESetCopyEventCookie( + ) + { + CopyEventCookieType oldproc; ++ if (extension < FirstExtensionRequest || ++ extension > LastExtensionRequest) { ++ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n", ++ extension); ++ return (CopyEventCookieType)_XUnknownCopyEventCookie; ++ } + if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie; + LockDisplay (dpy); + oldproc = dpy->generic_event_copy_vec[extension & 0x7F]; +@@ -305,6 +335,12 @@ EventToWireType XESetEventToWire( + EventToWireType proc) /* routine to call when converting event */ + { + register EventToWireType oldproc; ++ if (event_number < 0 || ++ event_number > LastExtensionEvent) { ++ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n", ++ event_number); ++ return (EventToWireType)_XUnknownNativeEvent; ++ } + if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent; + LockDisplay (dpy); + oldproc = dpy->wire_vec[event_number]; +@@ -325,6 +361,12 @@ WireToErrorType XESetWireToError( + WireToErrorType proc) /* routine to call when converting error */ + { + register WireToErrorType oldproc = NULL; ++ if (error_number < 0 || ++ error_number > LastExtensionError) { ++ fprintf(stderr, "Xlib: ignoring invalid extension error %d\n", ++ error_number); ++ return (WireToErrorType)_XDefaultWireError; ++ } + if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError; + LockDisplay (dpy); + if (!dpy->error_vec) { +-- +GitLab diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch new file mode 100644 index 0000000000..64f8776cc9 --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch @@ -0,0 +1,62 @@ +From 6858d468d9ca55fb4c5fd70b223dbc78a3358a7f Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Sun, 17 Sep 2023 14:19:40 -0700 +Subject: [PATCH] CVE-2023-43785: out-of-bounds memory access in + _XkbReadKeySyms() + +Make sure we allocate enough memory in the first place, and +also handle error returns from _XkbReadBufferCopyKeySyms() when +it detects out-of-bounds issues. + +Reported-by: Gregory James DUCK <gjduck@gmail.com> +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> + +Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6858d468d9ca55fb4c5fd70b223dbc78a3358a7f] +CVE: CVE-2023-43785 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + src/xkb/XKBGetMap.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c +index 2891d21..31199e4 100644 +--- a/src/xkb/XKBGetMap.c ++++ b/src/xkb/XKBGetMap.c +@@ -182,7 +182,8 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) + if (offset + newMap->nSyms >= map->size_syms) { + register int sz; + +- sz = map->size_syms + 128; ++ sz = offset + newMap->nSyms; ++ sz = ((sz + (unsigned) 128) / 128) * 128; + _XkbResizeArray(map->syms, map->size_syms, sz, KeySym); + if (map->syms == NULL) { + map->size_syms = 0; +@@ -191,8 +192,9 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) + map->size_syms = sz; + } + if (newMap->nSyms > 0) { +- _XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset], +- newMap->nSyms); ++ if (_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset], ++ newMap->nSyms) == 0) ++ return BadLength; + offset += newMap->nSyms; + } + else { +@@ -222,8 +224,10 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) + newSyms = XkbResizeKeySyms(xkb, i + rep->firstKeySym, tmp); + if (newSyms == NULL) + return BadAlloc; +- if (newMap->nSyms > 0) +- _XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms); ++ if (newMap->nSyms > 0) { ++ if (_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms) == 0) ++ return BadLength; ++ } + else + newSyms[0] = NoSymbol; + oldMap->kt_index[0] = newMap->ktIndex[0]; +-- +2.35.7 + diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch new file mode 100644 index 0000000000..db5b7067aa --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch @@ -0,0 +1,41 @@ +From 204c3393c4c90a29ed6bef64e43849536e863a86 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Thu, 7 Sep 2023 15:54:30 -0700 +Subject: [PATCH] CVE-2023-43786: stack exhaustion from infinite recursion in + PutSubImage() + +When splitting a single line of pixels into chunks to send to the +X server, be sure to take into account the number of bits per pixel, +so we don't just loop forever trying to send more pixels than fit in +the given request size and not breaking them down into a small enough +chunk to fix. + +Fixes: "almost complete rewrite" (Dec. 12, 1987) from X11R2 +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> + +Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/204c3393c4c90a29ed6bef64e43849536e863a86] +CVE: CVE-2023-43786 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + src/PutImage.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/PutImage.c b/src/PutImage.c +index 857ee91..a6db7b4 100644 +--- a/src/PutImage.c ++++ b/src/PutImage.c +@@ -914,8 +914,9 @@ PutSubImage ( + req_width, req_height - SubImageHeight, + dest_bits_per_pixel, dest_scanline_pad); + } else { +- int SubImageWidth = (((Available << 3) / dest_scanline_pad) +- * dest_scanline_pad) - left_pad; ++ int SubImageWidth = ((((Available << 3) / dest_scanline_pad) ++ * dest_scanline_pad) - left_pad) ++ / dest_bits_per_pixel; + + PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y, + (unsigned int) SubImageWidth, 1, +-- +2.35.7 + diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch new file mode 100644 index 0000000000..e46b3a2b24 --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch @@ -0,0 +1,45 @@ +From 73a37d5f2fcadd6540159b432a70d80f442ddf4a Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Thu, 7 Sep 2023 15:55:04 -0700 +Subject: [PATCH] XPutImage: clip images to maximum height & width allowed by + protocol + +The PutImage request specifies height & width of the image as CARD16 +(unsigned 16-bit integer), same as the maximum dimensions of an X11 +Drawable, which the image is being copied to. + +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> + +Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/73a37d5f2fcadd6540159b432a70d80f442ddf4a] +CVE: CVE-2023-43786 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + src/PutImage.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/PutImage.c b/src/PutImage.c +index a6db7b4..ba411e3 100644 +--- a/src/PutImage.c ++++ b/src/PutImage.c +@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group. + #include "Xlibint.h" + #include "Xutil.h" + #include <stdio.h> ++#include <limits.h> + #include "Cr.h" + #include "ImUtil.h" + #include "reallocarray.h" +@@ -962,6 +963,10 @@ XPutImage ( + height = image->height - req_yoffset; + if ((width <= 0) || (height <= 0)) + return 0; ++ if (width > USHRT_MAX) ++ width = USHRT_MAX; ++ if (height > USHRT_MAX) ++ height = USHRT_MAX; + + if ((image->bits_per_pixel == 1) || (image->format != ZPixmap)) { + dest_bits_per_pixel = 1; +-- +2.35.7 + diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch new file mode 100644 index 0000000000..2f47fe0bf2 --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch @@ -0,0 +1,51 @@ +From b4031fc023816aca07fbd592ed97010b9b48784b Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Thu, 7 Sep 2023 16:12:27 -0700 +Subject: [PATCH] XCreatePixmap: trigger BadValue error for out-of-range + dimensions + +The CreatePixmap request specifies height & width of the image as CARD16 +(unsigned 16-bit integer), so if either is larger than that, set it to 0 +so the X server returns a BadValue error as the protocol requires. + +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> + +Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/b4031fc023816aca07fbd592ed97010b9b48784b] +CVE: CVE-2023-43786 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + src/CrPixmap.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/src/CrPixmap.c b/src/CrPixmap.c +index cdf3120..3cb2ca6 100644 +--- a/src/CrPixmap.c ++++ b/src/CrPixmap.c +@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group. + #include <config.h> + #endif + #include "Xlibint.h" ++#include <limits.h> + + #ifdef USE_DYNAMIC_XCURSOR + void +@@ -47,6 +48,16 @@ Pixmap XCreatePixmap ( + Pixmap pid; + register xCreatePixmapReq *req; + ++ /* ++ * Force a BadValue X Error if the requested dimensions are larger ++ * than the X11 protocol has room for, since that's how callers expect ++ * to get notified of errors. ++ */ ++ if (width > USHRT_MAX) ++ width = 0; ++ if (height > USHRT_MAX) ++ height = 0; ++ + LockDisplay(dpy); + GetReq(CreatePixmap, req); + req->drawable = d; +-- +2.35.7 + diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch new file mode 100644 index 0000000000..4b5cd694ab --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch @@ -0,0 +1,63 @@ +From 7916869d16bdd115ac5be30a67c3749907aea6a0 Mon Sep 17 00:00:00 2001 +From: Yair Mizrahi <yairm@jfrog.com> +Date: Thu, 7 Sep 2023 16:15:32 -0700 +Subject: [PATCH] CVE-2023-43787: Integer overflow in XCreateImage() leading to + a heap overflow + +When the format is `Pixmap` it calculates the size of the image data as: + ROUNDUP((bits_per_pixel * width), image->bitmap_pad); +There is no validation on the `width` of the image, and so this +calculation exceeds the capacity of a 4-byte integer, causing an overflow. + +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> + +Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/7916869d16bdd115ac5be30a67c3749907aea6a0] +CVE: CVE-2023-43787 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + src/ImUtil.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/src/ImUtil.c b/src/ImUtil.c +index 36f08a0..fbfad33 100644 +--- a/src/ImUtil.c ++++ b/src/ImUtil.c +@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group. + #include <X11/Xlibint.h> + #include <X11/Xutil.h> + #include <stdio.h> ++#include <limits.h> + #include "ImUtil.h" + + static int _XDestroyImage(XImage *); +@@ -361,13 +362,22 @@ XImage *XCreateImage ( + /* + * compute per line accelerator. + */ +- { +- if (format == ZPixmap) ++ if (format == ZPixmap) { ++ if ((INT_MAX / bits_per_pixel) < width) { ++ Xfree(image); ++ return NULL; ++ } ++ + min_bytes_per_line = +- ROUNDUP((bits_per_pixel * width), image->bitmap_pad); +- else ++ ROUNDUP((bits_per_pixel * width), image->bitmap_pad); ++ } else { ++ if ((INT_MAX - offset) < width) { ++ Xfree(image); ++ return NULL; ++ } ++ + min_bytes_per_line = +- ROUNDUP((width + offset), image->bitmap_pad); ++ ROUNDUP((width + offset), image->bitmap_pad); + } + if (image_bytes_per_line == 0) { + image->bytes_per_line = min_bytes_per_line; +-- +2.35.7 + diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb b/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb index 3e6b50c0a3..d783f60103 100644 --- a/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb +++ b/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb @@ -17,6 +17,12 @@ SRC_URI = "${XORG_MIRROR}/individual/lib/${XORG_PN}-${PV}.tar.xz" SRC_URI += "file://disable_tests.patch \ file://CVE-2022-3554.patch \ file://CVE-2022-3555.patch \ + file://CVE-2023-3138.patch \ + file://CVE-2023-43785.patch \ + file://CVE-2023-43786-0001.patch \ + file://CVE-2023-43786-0002.patch \ + file://CVE-2023-43786-0003.patch \ + file://CVE-2023-43787.patch \ " SRC_URI[sha256sum] = "2ffd417266fb875028fdc0ef349694f63dbcd76d0b0cfacfb52e6151f4b60989" diff --git a/meta/recipes-graphics/xorg-lib/libxpm_3.5.13.bb b/meta/recipes-graphics/xorg-lib/libxpm_3.5.17.bb index 4f0a5d7ba0..7bc494a690 100644 --- a/meta/recipes-graphics/xorg-lib/libxpm_3.5.13.bb +++ b/meta/recipes-graphics/xorg-lib/libxpm_3.5.17.bb @@ -11,17 +11,18 @@ an extension of the monochrome XBM bitmap specificied in the X \ protocol." LICENSE = "MIT" -LIC_FILES_CHKSUM = "file://COPYING;md5=51f4270b012ecd4ab1a164f5f4ed6cf7" +LIC_FILES_CHKSUM = "file://COPYING;md5=903942ebc9d807dfb68540f40bae5aff" DEPENDS += "libxext libsm libxt gettext-native" PE = "1" XORG_PN = "libXpm" +XORG_EXT = "tar.xz" +EXTRA_OECONF += "--disable-open-zfile" PACKAGES =+ "sxpm cxpm" FILES:cxpm = "${bindir}/cxpm" FILES:sxpm = "${bindir}/sxpm" -SRC_URI[md5sum] = "6f0ecf8d103d528cfc803aa475137afa" -SRC_URI[sha256sum] = "9cd1da57588b6cb71450eff2273ef6b657537a9ac4d02d0014228845b935ac25" +SRC_URI[sha256sum] = "64b31f81019e7d388c822b0b28af8d51c4622b83f1f0cb6fa3fc95e271226e43" BBCLASSEXTEND = "native" diff --git a/meta/recipes-graphics/xorg-lib/pixman_0.40.0.bb b/meta/recipes-graphics/xorg-lib/pixman_0.40.0.bb index c56733eefd..63fd6d2978 100644 --- a/meta/recipes-graphics/xorg-lib/pixman_0.40.0.bb +++ b/meta/recipes-graphics/xorg-lib/pixman_0.40.0.bb @@ -19,7 +19,7 @@ UPSTREAM_CHECK_REGEX = "pixman-(?P<pver>\d+\.(\d*[02468])+(\.\d+)+)" PE = "1" -LICENSE = "MIT & MIT & PD" +LICENSE = "MIT & PD" LIC_FILES_CHKSUM = "file://COPYING;md5=14096c769ae0cbb5fcb94ec468be11b3 \ file://pixman/pixman-matrix.c;endline=21;md5=4a018dff3e4e25302724c88ff95c2456 \ file://pixman/pixman-arm-neon-asm.h;endline=24;md5=9a9cc1e51abbf1da58f4d9528ec9d49b \ diff --git a/meta/recipes-graphics/xorg-lib/xorg-lib-common.inc b/meta/recipes-graphics/xorg-lib/xorg-lib-common.inc index 60bc8c76fa..68137c4147 100644 --- a/meta/recipes-graphics/xorg-lib/xorg-lib-common.inc +++ b/meta/recipes-graphics/xorg-lib/xorg-lib-common.inc @@ -6,8 +6,9 @@ LICENSE = "MIT" DEPENDS = "util-macros" XORG_PN = "${BPN}" +XORG_EXT ?= "tar.bz2" -SRC_URI = "${XORG_MIRROR}/individual/lib/${XORG_PN}-${PV}.tar.bz2" +SRC_URI = "${XORG_MIRROR}/individual/lib/${XORG_PN}-${PV}.${XORG_EXT}" S = "${WORKDIR}/${XORG_PN}-${PV}" diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc index 6b11c79be6..ecb164ddf7 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc @@ -28,6 +28,8 @@ CVE_CHECK_IGNORE += "CVE-2011-4613" # impossible or difficult to exploit. There is currently no upstream patch # available for this flaw. CVE_CHECK_IGNORE += "CVE-2020-25697" +# This is specific to XQuartz, which is the macOS X server port +CVE_CHECK_IGNORE += "CVE-2022-3553" S = "${WORKDIR}/${XORG_PN}-${PV}" diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch new file mode 100644 index 0000000000..508588481e --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch @@ -0,0 +1,84 @@ +From 541ab2ecd41d4d8689e71855d93e492bc554719a Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Tue, 3 Oct 2023 11:53:05 +1000 +Subject: [PATCH] Xi/randr: fix handling of PropModeAppend/Prepend + +The handling of appending/prepending properties was incorrect, with at +least two bugs: the property length was set to the length of the new +part only, i.e. appending or prepending N elements to a property with P +existing elements always resulted in the property having N elements +instead of N + P. + +Second, when pre-pending a value to a property, the offset for the old +values was incorrect, leaving the new property with potentially +uninitalized values and/or resulting in OOB memory writes. +For example, prepending a 3 element value to a 5 element property would +result in this 8 value array: + [N, N, N, ?, ?, P, P, P ] P, P + ^OOB write + +The XI2 code is a copy/paste of the RandR code, so the bug exists in +both. + +CVE-2023-5367, ZDI-CAN-22153 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/541ab2ecd41d4d8689e71855d93e492bc554719a] +CVE: CVE-2023-5367 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/xiproperty.c | 4 ++-- + randr/rrproperty.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c +index 066ba21fba..d315f04d0e 100644 +--- a/Xi/xiproperty.c ++++ b/Xi/xiproperty.c +@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, + XIDestroyDeviceProperty(prop); + return BadAlloc; + } +- new_value.size = len; ++ new_value.size = total_len; + new_value.type = type; + new_value.format = format; + +@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, + case PropModePrepend: + new_data = new_value.data; + old_data = (void *) (((char *) new_value.data) + +- (prop_value->size * size_in_bytes)); ++ (len * size_in_bytes)); + break; + } + if (new_data) +diff --git a/randr/rrproperty.c b/randr/rrproperty.c +index c2fb9585c6..25469f57b2 100644 +--- a/randr/rrproperty.c ++++ b/randr/rrproperty.c +@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, + RRDestroyOutputProperty(prop); + return BadAlloc; + } +- new_value.size = len; ++ new_value.size = total_len; + new_value.type = type; + new_value.format = format; + +@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, + case PropModePrepend: + new_data = new_value.data; + old_data = (void *) (((char *) new_value.data) + +- (prop_value->size * size_in_bytes)); ++ (len * size_in_bytes)); + break; + } + if (new_data) +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5380.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5380.patch new file mode 100644 index 0000000000..57e2a5abdf --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5380.patch @@ -0,0 +1,102 @@ +From 564ccf2ce9616620456102727acb8b0256b7bbd7 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Thu, 5 Oct 2023 12:19:45 +1000 +Subject: [PATCH] mi: reset the PointerWindows reference on screen switch + +PointerWindows[] keeps a reference to the last window our sprite +entered - changes are usually handled by CheckMotion(). + +If we switch between screens via XWarpPointer our +dev->spriteInfo->sprite->win is set to the new screen's root window. +If there's another window at the cursor location CheckMotion() will +trigger the right enter/leave events later. If there is not, it skips +that process and we never trigger LeaveWindow() - PointerWindows[] for +the device still refers to the previous window. + +If that window is destroyed we have a dangling reference that will +eventually cause a use-after-free bug when checking the window hierarchy +later. + +To trigger this, we require: +- two protocol screens +- XWarpPointer to the other screen's root window +- XDestroyWindow before entering any other window + +This is a niche bug so we hack around it by making sure we reset the +PointerWindows[] entry so we cannot have a dangling pointer. This +doesn't handle Enter/Leave events correctly but the previous code didn't +either. + +CVE-2023-5380, ZDI-CAN-21608 + +This vulnerability was discovered by: +Sri working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> +Reviewed-by: Adam Jackson <ajax@redhat.com> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/564ccf2ce9616620456102727acb8b0256b7bbd7] +CVE: CVE-2023-5380 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + dix/enterleave.h | 2 -- + include/eventstr.h | 3 +++ + mi/mipointer.c | 17 +++++++++++++++-- + 3 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/dix/enterleave.h b/dix/enterleave.h +index 4b833d8a3b..e8af924c68 100644 +--- a/dix/enterleave.h ++++ b/dix/enterleave.h +@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev, + + extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode); + +-extern void LeaveWindow(DeviceIntPtr dev); +- + extern void CoreFocusEvent(DeviceIntPtr kbd, + int type, int mode, int detail, WindowPtr pWin); + +diff --git a/include/eventstr.h b/include/eventstr.h +index 93308f9b24..a9926eaeef 100644 +--- a/include/eventstr.h ++++ b/include/eventstr.h +@@ -335,4 +335,7 @@ union _InternalEvent { + GestureEvent gesture_event; + }; + ++extern void ++LeaveWindow(DeviceIntPtr dev); ++ + #endif +diff --git a/mi/mipointer.c b/mi/mipointer.c +index a638f25d4a..8cf0035140 100644 +--- a/mi/mipointer.c ++++ b/mi/mipointer.c +@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y) + #ifdef PANORAMIX + && noPanoramiXExtension + #endif +- ) +- UpdateSpriteForScreen(pDev, pScreen); ++ ) { ++ DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER); ++ /* Hack for CVE-2023-5380: if we're moving ++ * screens PointerWindows[] keeps referring to the ++ * old window. If that gets destroyed we have a UAF ++ * bug later. Only happens when jumping from a window ++ * to the root window on the other screen. ++ * Enter/Leave events are incorrect for that case but ++ * too niche to fix. ++ */ ++ LeaveWindow(pDev); ++ if (master) ++ LeaveWindow(master); ++ UpdateSpriteForScreen(pDev, pScreen); ++ } + } + + /** +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6377.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6377.patch new file mode 100644 index 0000000000..0abd5914fa --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6377.patch @@ -0,0 +1,79 @@ +From 0c1a93d319558fe3ab2d94f51d174b4f93810afd Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Tue, 28 Nov 2023 15:19:04 +1000 +Subject: [PATCH] Xi: allocate enough XkbActions for our buttons + +button->xkb_acts is supposed to be an array sufficiently large for all +our buttons, not just a single XkbActions struct. Allocating +insufficient memory here means when we memcpy() later in +XkbSetDeviceInfo we write into memory that wasn't ours to begin with, +leading to the usual security ooopsiedaisies. + +CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd] +CVE: CVE-2023-6377 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/exevents.c | 12 ++++++------ + dix/devices.c | 10 ++++++++++ + 2 files changed, 16 insertions(+), 6 deletions(-) + +diff --git a/Xi/exevents.c b/Xi/exevents.c +index dcd4efb3bc..54ea11a938 100644 +--- a/Xi/exevents.c ++++ b/Xi/exevents.c +@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + } + + if (from->button->xkb_acts) { +- if (!to->button->xkb_acts) { +- to->button->xkb_acts = calloc(1, sizeof(XkbAction)); +- if (!to->button->xkb_acts) +- FatalError("[Xi] not enough memory for xkb_acts.\n"); +- } ++ size_t maxbuttons = max(to->button->numButtons, from->button->numButtons); ++ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts, ++ maxbuttons, ++ sizeof(XkbAction)); ++ memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction)); + memcpy(to->button->xkb_acts, from->button->xkb_acts, +- sizeof(XkbAction)); ++ from->button->numButtons * sizeof(XkbAction)); + } + else { + free(to->button->xkb_acts); +diff --git a/dix/devices.c b/dix/devices.c +index b063128df0..3f3224d626 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -2539,6 +2539,8 @@ RecalculateMasterButtons(DeviceIntPtr slave) + + if (master->button && master->button->numButtons != maxbuttons) { + int i; ++ int last_num_buttons = master->button->numButtons; ++ + DeviceChangedEvent event = { + .header = ET_Internal, + .type = ET_DeviceChanged, +@@ -2549,6 +2551,14 @@ RecalculateMasterButtons(DeviceIntPtr slave) + }; + + master->button->numButtons = maxbuttons; ++ if (last_num_buttons < maxbuttons) { ++ master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts, ++ maxbuttons, ++ sizeof(XkbAction)); ++ memset(&master->button->xkb_acts[last_num_buttons], ++ 0, ++ (maxbuttons - last_num_buttons) * sizeof(XkbAction)); ++ } + + memcpy(&event.buttons.names, master->button->labels, maxbuttons * + sizeof(Atom)); +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6478.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6478.patch new file mode 100644 index 0000000000..6392eae3f8 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6478.patch @@ -0,0 +1,63 @@ +From 14f480010a93ff962fef66a16412fafff81ad632 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Mon, 27 Nov 2023 16:27:49 +1000 +Subject: [PATCH] randr: avoid integer truncation in length check of + ProcRRChange*Property + +Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty. +See also xserver@8f454b79 where this same bug was fixed for the core +protocol and XI. + +This fixes an OOB read and the resulting information disclosure. + +Length calculation for the request was clipped to a 32-bit integer. With +the correct stuff->nUnits value the expected request size was +truncated, passing the REQUEST_FIXED_SIZE check. + +The server then proceeded with reading at least stuff->num_items bytes +(depending on stuff->format) from the request and stuffing whatever it +finds into the property. In the process it would also allocate at least +stuff->nUnits bytes, i.e. 4GB. + +CVE-2023-6478, ZDI-CAN-22561 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632] +CVE: CVE-2023-6478 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + randr/rrproperty.c | 2 +- + randr/rrproviderproperty.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/randr/rrproperty.c b/randr/rrproperty.c +index 25469f57b2..c4fef8a1f6 100644 +--- a/randr/rrproperty.c ++++ b/randr/rrproperty.c +@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr client) + char format, mode; + unsigned long len; + int sizeInBytes; +- int totalSize; ++ uint64_t totalSize; + int err; + + REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq); +diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c +index b79c17f9bf..90c5a9a933 100644 +--- a/randr/rrproviderproperty.c ++++ b/randr/rrproviderproperty.c +@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr client) + char format, mode; + unsigned long len; + int sizeInBytes; +- int totalSize; ++ uint64_t totalSize; + int err; + + REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq); +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6816.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6816.patch new file mode 100644 index 0000000000..0bfff268e7 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6816.patch @@ -0,0 +1,55 @@ +From 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Thu, 14 Dec 2023 11:29:49 +1000 +Subject: [PATCH] dix: allocate enough space for logical button maps + +Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for +each logical button currently down. Since buttons can be arbitrarily mapped +to anything up to 255 make sure we have enough bits for the maximum mapping. + +CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3] +CVE: CVE-2023-6816 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/xiquerypointer.c | 3 +-- + dix/enterleave.c | 5 +++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c +index 5b77b1a444..2b05ac5f39 100644 +--- a/Xi/xiquerypointer.c ++++ b/Xi/xiquerypointer.c +@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client) + if (pDev->button) { + int i; + +- rep.buttons_len = +- bytes_to_int32(bits_to_bytes(pDev->button->numButtons)); ++ rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */ + rep.length += rep.buttons_len; + buttons = calloc(rep.buttons_len, 4); + if (!buttons) +diff --git a/dix/enterleave.c b/dix/enterleave.c +index 867ec74363..ded8679d76 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail, + + mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER); + +- /* XI 2 event */ +- btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0; ++ /* XI 2 event contains the logical button map - maps are CARD8 ++ * so we need 256 bits for the possibly maximum mapping */ ++ btlen = (mouse->button) ? bits_to_bytes(256) : 0; + btlen = bytes_to_int32(btlen); + len = sizeof(xXIFocusInEvent) + btlen * 4; + +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-1.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-1.patch new file mode 100644 index 0000000000..80ebc64e59 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-1.patch @@ -0,0 +1,87 @@ +From ece23be888a93b741aa1209d1dbf64636109d6a5 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Mon, 18 Dec 2023 14:27:50 +1000 +Subject: [PATCH] dix: Allocate sufficient xEvents for our DeviceStateNotify + +If a device has both a button class and a key class and numButtons is +zero, we can get an OOB write due to event under-allocation. + +This function seems to assume a device has either keys or buttons, not +both. It has two virtually identical code paths, both of which assume +they're applying to the first event in the sequence. + +A device with both a key and button class triggered a logic bug - only +one xEvent was allocated but the deviceStateNotify pointer was pushed on +once per type. So effectively this logic code: + + int count = 1; + if (button && nbuttons > 32) count++; + if (key && nbuttons > 0) count++; + if (key && nkeys > 32) count++; // this is basically always true + // count is at 2 for our keys + zero button device + + ev = alloc(count * sizeof(xEvent)); + FixDeviceStateNotify(ev); + if (button) + FixDeviceStateNotify(ev++); + if (key) + FixDeviceStateNotify(ev++); // santa drops into the wrong chimney here + +If the device has more than 3 valuators, the OOB is pushed back - we're +off by one so it will happen when the last deviceValuator event is +written instead. + +Fix this by allocating the maximum number of events we may allocate. +Note that the current behavior is not protocol-correct anyway, this +patch fixes only the allocation issue. + +Note that this issue does not trigger if the device has at least one +button. While the server does not prevent a button class with zero +buttons, it is very unlikely. + +CVE-2024-0229, ZDI-CAN-22678 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/ece23be888a93b741aa1209d1dbf64636109d6a5] +CVE: CVE-2024-0229 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + dix/enterleave.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/dix/enterleave.c b/dix/enterleave.c +index ded8679d76..17964b00a4 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -675,7 +675,8 @@ static void + DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + { + int evcount = 1; +- deviceStateNotify *ev, *sev; ++ deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3]; ++ deviceStateNotify *ev; + deviceKeyStateNotify *kev; + deviceButtonStateNotify *bev; + +@@ -714,7 +715,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + } + } + +- sev = ev = xallocarray(evcount, sizeof(xEvent)); ++ ev = sev; + FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first); + + if (b != NULL) { +@@ -770,7 +771,6 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + + DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount, + DeviceStateNotifyMask, NullGrab); +- free(sev); + } + + void +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-2.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-2.patch new file mode 100644 index 0000000000..65df74376b --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-2.patch @@ -0,0 +1,221 @@ +From 219c54b8a3337456ce5270ded6a67bcde53553d5 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Mon, 18 Dec 2023 12:26:20 +1000 +Subject: [PATCH] dix: fix DeviceStateNotify event calculation + +The previous code only made sense if one considers buttons and keys to +be mutually exclusive on a device. That is not necessarily true, causing +a number of issues. + +This function allocates and fills in the number of xEvents we need to +send the device state down the wire. This is split across multiple +32-byte devices including one deviceStateNotify event and optional +deviceKeyStateNotify, deviceButtonStateNotify and (possibly multiple) +deviceValuator events. + +The previous behavior would instead compose a sequence +of [state, buttonstate, state, keystate, valuator...]. This is not +protocol correct, and on top of that made the code extremely convoluted. + +Fix this by streamlining: add both button and key into the deviceStateNotify +and then append the key state and button state, followed by the +valuators. Finally, the deviceValuator events contain up to 6 valuators +per event but we only ever sent through 3 at a time. Let's double that +troughput. + +CVE-2024-0229, ZDI-CAN-22678 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/219c54b8a3337456ce5270ded6a67bcde53553d5] +CVE: CVE-2024-0229 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + dix/enterleave.c | 121 ++++++++++++++++++++--------------------------- + 1 file changed, 52 insertions(+), 69 deletions(-) + +diff --git a/dix/enterleave.c b/dix/enterleave.c +index 17964b00a4..7b7ba1098b 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -615,9 +615,15 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, + + ev->type = DeviceValuator; + ev->deviceid = dev->id; +- ev->num_valuators = nval < 3 ? nval : 3; ++ ev->num_valuators = nval < 6 ? nval : 6; + ev->first_valuator = first; + switch (ev->num_valuators) { ++ case 6: ++ ev->valuator2 = v->axisVal[first + 5]; ++ case 5: ++ ev->valuator2 = v->axisVal[first + 4]; ++ case 4: ++ ev->valuator2 = v->axisVal[first + 3]; + case 3: + ev->valuator2 = v->axisVal[first + 2]; + case 2: +@@ -626,7 +632,6 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, + ev->valuator0 = v->axisVal[first]; + break; + } +- first += ev->num_valuators; + } + + static void +@@ -646,7 +651,7 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k, + ev->num_buttons = b->numButtons; + memcpy((char *) ev->buttons, (char *) b->down, 4); + } +- else if (k) { ++ if (k) { + ev->classes_reported |= (1 << KeyClass); + ev->num_keys = k->xkbInfo->desc->max_key_code - + k->xkbInfo->desc->min_key_code; +@@ -670,15 +675,26 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k, + } + } + +- ++/** ++ * The device state notify event is split across multiple 32-byte events. ++ * The first one contains the first 32 button state bits, the first 32 ++ * key state bits, and the first 3 valuator values. ++ * ++ * If a device has more than that, the server sends out: ++ * - one deviceButtonStateNotify for buttons 32 and above ++ * - one deviceKeyStateNotify for keys 32 and above ++ * - one deviceValuator event per 6 valuators above valuator 4 ++ * ++ * All events but the last one have the deviceid binary ORed with MORE_EVENTS, ++ */ + static void + DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + { ++ /* deviceStateNotify, deviceKeyStateNotify, deviceButtonStateNotify ++ * and one deviceValuator for each 6 valuators */ ++ deviceStateNotify sev[3 + (MAX_VALUATORS + 6)/6]; + int evcount = 1; +- deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3]; +- deviceStateNotify *ev; +- deviceKeyStateNotify *kev; +- deviceButtonStateNotify *bev; ++ deviceStateNotify *ev = sev; + + KeyClassPtr k; + ButtonClassPtr b; +@@ -691,82 +707,49 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + + if ((b = dev->button) != NULL) { + nbuttons = b->numButtons; +- if (nbuttons > 32) ++ if (nbuttons > 32) /* first 32 are encoded in deviceStateNotify */ + evcount++; + } + if ((k = dev->key) != NULL) { + nkeys = k->xkbInfo->desc->max_key_code - k->xkbInfo->desc->min_key_code; +- if (nkeys > 32) ++ if (nkeys > 32) /* first 32 are encoded in deviceStateNotify */ + evcount++; +- if (nbuttons > 0) { +- evcount++; +- } + } + if ((v = dev->valuator) != NULL) { + nval = v->numAxes; +- +- if (nval > 3) +- evcount++; +- if (nval > 6) { +- if (!(k && b)) +- evcount++; +- if (nval > 9) +- evcount += ((nval - 7) / 3); +- } ++ /* first three are encoded in deviceStateNotify, then ++ * it's 6 per deviceValuator event */ ++ evcount += ((nval - 3) + 6)/6; + } + +- ev = sev; +- FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first); +- +- if (b != NULL) { +- FixDeviceStateNotify(dev, ev++, NULL, b, v, first); +- first += 3; +- nval -= 3; +- if (nbuttons > 32) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- bev = (deviceButtonStateNotify *) ev++; +- bev->type = DeviceButtonStateNotify; +- bev->deviceid = dev->id; +- memcpy((char *) &bev->buttons[4], (char *) &b->down[4], +- DOWN_LENGTH - 4); +- } +- if (nval > 0) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); +- first += 3; +- nval -= 3; +- } ++ BUG_RETURN(evcount <= ARRAY_SIZE(sev)); ++ ++ FixDeviceStateNotify(dev, ev, k, b, v, first); ++ ++ if (b != NULL && nbuttons > 32) { ++ deviceButtonStateNotify *bev = (deviceButtonStateNotify *) ++ev; ++ (ev - 1)->deviceid |= MORE_EVENTS; ++ bev->type = DeviceButtonStateNotify; ++ bev->deviceid = dev->id; ++ memcpy((char *) &bev->buttons[4], (char *) &b->down[4], ++ DOWN_LENGTH - 4); + } + +- if (k != NULL) { +- FixDeviceStateNotify(dev, ev++, k, NULL, v, first); +- first += 3; +- nval -= 3; +- if (nkeys > 32) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- kev = (deviceKeyStateNotify *) ev++; +- kev->type = DeviceKeyStateNotify; +- kev->deviceid = dev->id; +- memmove((char *) &kev->keys[0], (char *) &k->down[4], 28); +- } +- if (nval > 0) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); +- first += 3; +- nval -= 3; +- } ++ if (k != NULL && nkeys > 32) { ++ deviceKeyStateNotify *kev = (deviceKeyStateNotify *) ++ev; ++ (ev - 1)->deviceid |= MORE_EVENTS; ++ kev->type = DeviceKeyStateNotify; ++ kev->deviceid = dev->id; ++ memmove((char *) &kev->keys[0], (char *) &k->down[4], 28); + } + ++ first = 3; ++ nval -= 3; + while (nval > 0) { +- FixDeviceStateNotify(dev, ev++, NULL, NULL, v, first); +- first += 3; +- nval -= 3; +- if (nval > 0) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); +- first += 3; +- nval -= 3; +- } ++ ev->deviceid |= MORE_EVENTS; ++ FixDeviceValuator(dev, (deviceValuator *) ++ev, v, first); ++ first += 6; ++ nval -= 6; + } + + DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount, +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-3.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-3.patch new file mode 100644 index 0000000000..742c122fa8 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-3.patch @@ -0,0 +1,41 @@ +From df3c65706eb169d5938df0052059f3e0d5981b74 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Thu, 21 Dec 2023 13:48:10 +1000 +Subject: [PATCH] Xi: when creating a new ButtonClass, set the number of + buttons + +There's a racy sequence where a master device may copy the button class +from the slave, without ever initializing numButtons. This leads to a +device with zero buttons but a button class which is invalid. + +Let's copy the numButtons value from the source - by definition if we +don't have a button class yet we do not have any other slave devices +with more than this number of buttons anyway. + +CVE-2024-0229, ZDI-CAN-22678 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/df3c65706eb169d5938df0052059f3e0d5981b74] +CVE: CVE-2024-0229 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/exevents.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Xi/exevents.c b/Xi/exevents.c +index 54ea11a938..e161714682 100644 +--- a/Xi/exevents.c ++++ b/Xi/exevents.c +@@ -605,6 +605,7 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + to->button = calloc(1, sizeof(ButtonClassRec)); + if (!to->button) + FatalError("[Xi] no memory for class shift.\n"); ++ to->button->numButtons = from->button->numButtons; + } + else + classes->button = NULL; +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-4.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-4.patch new file mode 100644 index 0000000000..d1a6214793 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-4.patch @@ -0,0 +1,45 @@ +From 37539cb0bfe4ed96d4499bf371e6b1a474a740fe Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Thu, 21 Dec 2023 14:10:11 +1000 +Subject: [PATCH] Xi: require a pointer and keyboard device for + XIAttachToMaster + +If we remove a master device and specify which other master devices +attached slaves should be returned to, enforce that those two are +indeeed a pointer and a keyboard. + +Otherwise we can try to attach the keyboards to pointers and vice versa, +leading to possible crashes later. + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/37539cb0bfe4ed96d4499bf371e6b1a474a740fe] +CVE: CVE-2024-0229 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/xichangehierarchy.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c +index 504defe566..d2d985848d 100644 +--- a/Xi/xichangehierarchy.c ++++ b/Xi/xichangehierarchy.c +@@ -270,7 +270,7 @@ remove_master(ClientPtr client, xXIRemoveMasterInfo * r, int flags[MAXDEVICES]) + if (rc != Success) + goto unwind; + +- if (!IsMaster(newptr)) { ++ if (!IsMaster(newptr) || !IsPointerDevice(newptr)) { + client->errorValue = r->return_pointer; + rc = BadDevice; + goto unwind; +@@ -281,7 +281,7 @@ remove_master(ClientPtr client, xXIRemoveMasterInfo * r, int flags[MAXDEVICES]) + if (rc != Success) + goto unwind; + +- if (!IsMaster(newkeybd)) { ++ if (!IsMaster(newkeybd) || !IsKeyboardDevice(newkeybd)) { + client->errorValue = r->return_keyboard; + rc = BadDevice; + goto unwind; +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0408.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0408.patch new file mode 100644 index 0000000000..c8f75d8a7e --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0408.patch @@ -0,0 +1,64 @@ +From e5e8586a12a3ec915673edffa10dc8fe5e15dac3 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan <ofourdan@redhat.com> +Date: Wed, 6 Dec 2023 12:09:41 +0100 +Subject: [PATCH] glx: Call XACE hooks on the GLX buffer + +The XSELINUX code will label resources at creation by checking the +access mode. When the access mode is DixCreateAccess, it will call the +function to label the new resource SELinuxLabelResource(). + +However, GLX buffers do not go through the XACE hooks when created, +hence leaving the resource actually unlabeled. + +When, later, the client tries to create another resource using that +drawable (like a GC for example), the XSELINUX code would try to use +the security ID of that object which has never been labeled, get a NULL +pointer and crash when checking whether the requested permissions are +granted for subject security ID. + +To avoid the issue, make sure to call the XACE hooks when creating the +GLX buffers. + +Credit goes to Donn Seeley <donn@xmission.com> for providing the patch. + +CVE-2024-0408 + +Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> +Acked-by: Peter Hutterer <peter.hutterer@who-t.net> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/e5e8586a12a3ec915673edffa10dc8fe5e15dac3] +CVE: CVE-2024-0408 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + glx/glxcmds.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/glx/glxcmds.c b/glx/glxcmds.c +index fc26a2e345..1e46d0c723 100644 +--- a/glx/glxcmds.c ++++ b/glx/glxcmds.c +@@ -48,6 +48,7 @@ + #include "indirect_util.h" + #include "protocol-versions.h" + #include "glxvndabi.h" ++#include "xace.h" + + static char GLXServerVendorName[] = "SGI"; + +@@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId, + if (!pPixmap) + return BadAlloc; + ++ err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP, ++ pPixmap, RT_NONE, NULL, DixCreateAccess); ++ if (err != Success) { ++ (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap); ++ return err; ++ } ++ + /* Assign the pixmap the same id as the pbuffer and add it as a + * resource so it and the DRI2 drawable will be reclaimed when the + * pbuffer is destroyed. */ +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0409.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0409.patch new file mode 100644 index 0000000000..9763e0b562 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0409.patch @@ -0,0 +1,46 @@ +From 2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan <ofourdan@redhat.com> +Date: Wed, 6 Dec 2023 11:51:56 +0100 +Subject: [PATCH] ephyr,xwayland: Use the proper private key for cursor + +The cursor in DIX is actually split in two parts, the cursor itself and +the cursor bits, each with their own devPrivates. + +The cursor itself includes the cursor bits, meaning that the cursor bits +devPrivates in within structure of the cursor. + +Both Xephyr and Xwayland were using the private key for the cursor bits +to store the data for the cursor, and when using XSELINUX which comes +with its own special devPrivates, the data stored in that cursor bits' +devPrivates would interfere with the XSELINUX devPrivates data and the +SELINUX security ID would point to some other unrelated data, causing a +crash in the XSELINUX code when trying to (re)use the security ID. + +CVE-2024-0409 + +Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> +Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7] +CVE: CVE-2024-0409 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + hw/kdrive/ephyr/ephyrcursor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/kdrive/ephyr/ephyrcursor.c b/hw/kdrive/ephyr/ephyrcursor.c +index f991899..3f192d0 100644 +--- a/hw/kdrive/ephyr/ephyrcursor.c ++++ b/hw/kdrive/ephyr/ephyrcursor.c +@@ -246,7 +246,7 @@ miPointerSpriteFuncRec EphyrPointerSpriteFuncs = { + Bool + ephyrCursorInit(ScreenPtr screen) + { +- if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR_BITS, ++ if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR, + sizeof(ephyrCursorRec))) + return FALSE; + +-- +2.25.1 + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21885.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21885.patch new file mode 100644 index 0000000000..7c8fbcc3ec --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21885.patch @@ -0,0 +1,113 @@ +From 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Thu, 4 Jan 2024 10:01:24 +1000 +Subject: [PATCH] Xi: flush hierarchy events after adding/removing master + devices + +The `XISendDeviceHierarchyEvent()` function allocates space to store up +to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`. + +If a device with a given ID was removed and a new device with the same +ID added both in the same operation, the single device ID will lead to +two info structures being written to `info`. + +Since this case can occur for every device ID at once, a total of two +times `MAXDEVICES` info structures might be written to the allocation. + +To avoid it, once one add/remove master is processed, send out the +device hierarchy event for the current state and continue. That event +thus only ever has exactly one of either added/removed in it (and +optionally slave attached/detached). + +CVE-2024-21885, ZDI-CAN-22744 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1] +CVE: CVE-2024-21885 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/xichangehierarchy.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c +index d2d985848d..72d00451e3 100644 +--- a/Xi/xichangehierarchy.c ++++ b/Xi/xichangehierarchy.c +@@ -416,6 +416,11 @@ ProcXIChangeHierarchy(ClientPtr client) + size_t len; /* length of data remaining in request */ + int rc = Success; + int flags[MAXDEVICES] = { 0 }; ++ enum { ++ NO_CHANGE, ++ FLUSH, ++ CHANGED, ++ } changes = NO_CHANGE; + + REQUEST(xXIChangeHierarchyReq); + REQUEST_AT_LEAST_SIZE(xXIChangeHierarchyReq); +@@ -465,8 +470,9 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = add_master(client, c, flags); + if (rc != Success) + goto unwind; +- } ++ changes = FLUSH; + break; ++ } + case XIRemoveMaster: + { + xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any; +@@ -475,8 +481,9 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = remove_master(client, r, flags); + if (rc != Success) + goto unwind; +- } ++ changes = FLUSH; + break; ++ } + case XIDetachSlave: + { + xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any; +@@ -485,8 +492,9 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = detach_slave(client, c, flags); + if (rc != Success) + goto unwind; +- } ++ changes = CHANGED; + break; ++ } + case XIAttachSlave: + { + xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any; +@@ -495,16 +503,25 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = attach_slave(client, c, flags); + if (rc != Success) + goto unwind; ++ changes = CHANGED; ++ break; + } ++ default: + break; + } + ++ if (changes == FLUSH) { ++ XISendDeviceHierarchyEvent(flags); ++ memset(flags, 0, sizeof(flags)); ++ changes = NO_CHANGE; ++ } ++ + len -= any->length * 4; + any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4); + } + + unwind: +- +- XISendDeviceHierarchyEvent(flags); ++ if (changes != NO_CHANGE) ++ XISendDeviceHierarchyEvent(flags); + return rc; + } +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-1.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-1.patch new file mode 100644 index 0000000000..1e1c782963 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-1.patch @@ -0,0 +1,74 @@ +From bc1fdbe46559dd947674375946bbef54dd0ce36b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jexposit@redhat.com> +Date: Fri, 22 Dec 2023 18:28:31 +0100 +Subject: [PATCH] Xi: do not keep linked list pointer during recursion + +The `DisableDevice()` function is called whenever an enabled device +is disabled and it moves the device from the `inputInfo.devices` linked +list to the `inputInfo.off_devices` linked list. + +However, its link/unlink operation has an issue during the recursive +call to `DisableDevice()` due to the `prev` pointer pointing to a +removed device. + +This issue leads to a length mismatch between the total number of +devices and the number of device in the list, leading to a heap +overflow and, possibly, to local privilege escalation. + +Simplify the code that checked whether the device passed to +`DisableDevice()` was in `inputInfo.devices` or not and find the +previous device after the recursion. + +CVE-2024-21886, ZDI-CAN-22840 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b] +CVE: CVE-2024-21886 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + dix/devices.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/dix/devices.c b/dix/devices.c +index dca98c8d1b..389d28a23c 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -453,14 +453,20 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) + { + DeviceIntPtr *prev, other; + BOOL enabled; ++ BOOL dev_in_devices_list = FALSE; + int flags[MAXDEVICES] = { 0 }; + + if (!dev->enabled) + return TRUE; + +- for (prev = &inputInfo.devices; +- *prev && (*prev != dev); prev = &(*prev)->next); +- if (*prev != dev) ++ for (other = inputInfo.devices; other; other = other->next) { ++ if (other == dev) { ++ dev_in_devices_list = TRUE; ++ break; ++ } ++ } ++ ++ if (!dev_in_devices_list) + return FALSE; + + TouchEndPhysicallyActiveTouches(dev); +@@ -511,6 +517,9 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) + LeaveWindow(dev); + SetFocusOut(dev); + ++ for (prev = &inputInfo.devices; ++ *prev && (*prev != dev); prev = &(*prev)->next); ++ + *prev = dev->next; + dev->next = inputInfo.off_devices; + inputInfo.off_devices = dev; +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-2.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-2.patch new file mode 100644 index 0000000000..af607df4f0 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-2.patch @@ -0,0 +1,57 @@ +From 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Fri, 5 Jan 2024 09:40:27 +1000 +Subject: [PATCH] dix: when disabling a master, float disabled slaved devices + too + +Disabling a master device floats all slave devices but we didn't do this +to already-disabled slave devices. As a result those devices kept their +reference to the master device resulting in access to already freed +memory if the master device was removed before the corresponding slave +device. + +And to match this behavior, also forcibly reset that pointer during +CloseDownDevices(). + +Related to CVE-2024-21886, ZDI-CAN-22840 + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8] +CVE: CVE-2024-21886 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + dix/devices.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/dix/devices.c b/dix/devices.c +index 389d28a23c..84a6406d13 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -483,6 +483,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) + flags[other->id] |= XISlaveDetached; + } + } ++ ++ for (other = inputInfo.off_devices; other; other = other->next) { ++ if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) { ++ AttachDevice(NULL, other, NULL); ++ flags[other->id] |= XISlaveDetached; ++ } ++ } + } + else { + for (other = inputInfo.devices; other; other = other->next) { +@@ -1088,6 +1095,11 @@ CloseDownDevices(void) + dev->master = NULL; + } + ++ for (dev = inputInfo.off_devices; dev; dev = dev->next) { ++ if (!IsMaster(dev) && !IsFloating(dev)) ++ dev->master = NULL; ++ } ++ + CloseDeviceList(&inputInfo.devices); + CloseDeviceList(&inputInfo.off_devices); + +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31080.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31080.patch new file mode 100644 index 0000000000..40296903cd --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31080.patch @@ -0,0 +1,49 @@ +From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Fri, 22 Mar 2024 18:51:45 -0700 +Subject: [PATCH] Xi: ProcXIGetSelectedEvents needs to use unswapped length to + send reply + +CVE-2024-31080 + +Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762 +Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.") +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> +Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/96798fc1967491c80a4d0c8d9e0a80586cb2152b] +CVE: CVE-2024-31080 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/xiselectev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c +index edcb8a0d36..ac14949871 100644 +--- a/Xi/xiselectev.c ++++ b/Xi/xiselectev.c +@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client) + InputClientsPtr others = NULL; + xXIEventMask *evmask = NULL; + DeviceIntPtr dev; ++ uint32_t length; + + REQUEST(xXIGetSelectedEventsReq); + REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq); +@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client) + } + } + ++ /* save the value before SRepXIGetSelectedEvents swaps it */ ++ length = reply.length; + WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply); + + if (reply.num_masks) +- WriteToClient(client, reply.length * 4, buffer); ++ WriteToClient(client, length * 4, buffer); + + free(buffer); + return Success; +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch new file mode 100644 index 0000000000..4380004700 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch @@ -0,0 +1,47 @@ +From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Fri, 22 Mar 2024 18:56:27 -0700 +Subject: [PATCH] Xi: ProcXIPassiveGrabDevice needs to use unswapped length to + send reply + +CVE-2024-31081 + +Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.") +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> +Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/3e77295f888c67fc7645db5d0c00926a29ffecee] +CVE: CVE-2024-31081 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + Xi/xipassivegrab.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c +index c9ac2f8553..896233bec2 100644 +--- a/Xi/xipassivegrab.c ++++ b/Xi/xipassivegrab.c +@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) + GrabParameters param; + void *tmp; + int mask_len; ++ uint32_t length; + + REQUEST(xXIPassiveGrabDeviceReq); + REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq, +@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client) + } + } + ++ /* save the value before SRepXIPassiveGrabDevice swaps it */ ++ length = rep.length; + WriteReplyToClient(client, sizeof(rep), &rep); + if (rep.num_modifiers) +- WriteToClient(client, rep.length * 4, modifiers_failed); ++ WriteToClient(client, length * 4, modifiers_failed); + + out: + free(modifiers_failed); +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.6.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb index 256903ce5f..b9eed92103 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.6.bb +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb @@ -2,8 +2,24 @@ require xserver-xorg.inc SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \ file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \ + file://CVE-2023-5367.patch \ + file://CVE-2023-5380.patch \ + file://CVE-2023-6377.patch \ + file://CVE-2023-6478.patch \ + file://CVE-2023-6816.patch \ + file://CVE-2024-0229-1.patch \ + file://CVE-2024-0229-2.patch \ + file://CVE-2024-0229-3.patch \ + file://CVE-2024-0229-4.patch \ + file://CVE-2024-21885.patch \ + file://CVE-2024-21886-1.patch \ + file://CVE-2024-21886-2.patch \ + file://CVE-2024-0408.patch \ + file://CVE-2024-0409.patch \ + file://CVE-2024-31080.patch \ + file://CVE-2024-31081.patch \ " -SRC_URI[sha256sum] = "1eb86ed674d042b6c8b1f9135e59395cbbca35ed551b122f73a7d8bb3bb22484" +SRC_URI[sha256sum] = "38aadb735650c8024ee25211c190bf8aad844c5f59632761ab1ef4c4d5aeb152" # These extensions are now integrated into the server, so declare the migration # path for in-place upgrades. diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2023-5367.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-5367.patch new file mode 100644 index 0000000000..d4da1ecb4b --- /dev/null +++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-5367.patch @@ -0,0 +1,85 @@ +CVE: CVE-2023-5367 +Upstream-Status: Backport [ https://gitlab.freedesktop.org/xorg/xserver/-/commit/541ab2ecd41d4d8689e71855d93e492bc554719a ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + + +From 541ab2ecd41d4d8689e71855d93e492bc554719a Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Tue, 3 Oct 2023 11:53:05 +1000 +Subject: [PATCH] Xi/randr: fix handling of PropModeAppend/Prepend + +The handling of appending/prepending properties was incorrect, with at +least two bugs: the property length was set to the length of the new +part only, i.e. appending or prepending N elements to a property with P +existing elements always resulted in the property having N elements +instead of N + P. + +Second, when pre-pending a value to a property, the offset for the old +values was incorrect, leaving the new property with potentially +uninitalized values and/or resulting in OOB memory writes. +For example, prepending a 3 element value to a 5 element property would +result in this 8 value array: + [N, N, N, ?, ?, P, P, P ] P, P + ^OOB write + +The XI2 code is a copy/paste of the RandR code, so the bug exists in +both. + +CVE-2023-5367, ZDI-CAN-22153 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> +--- + Xi/xiproperty.c | 4 ++-- + randr/rrproperty.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c +index 066ba21fba..d315f04d0e 100644 +--- a/Xi/xiproperty.c ++++ b/Xi/xiproperty.c +@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, + XIDestroyDeviceProperty(prop); + return BadAlloc; + } +- new_value.size = len; ++ new_value.size = total_len; + new_value.type = type; + new_value.format = format; + +@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, + case PropModePrepend: + new_data = new_value.data; + old_data = (void *) (((char *) new_value.data) + +- (prop_value->size * size_in_bytes)); ++ (len * size_in_bytes)); + break; + } + if (new_data) +diff --git a/randr/rrproperty.c b/randr/rrproperty.c +index c2fb9585c6..25469f57b2 100644 +--- a/randr/rrproperty.c ++++ b/randr/rrproperty.c +@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, + RRDestroyOutputProperty(prop); + return BadAlloc; + } +- new_value.size = len; ++ new_value.size = total_len; + new_value.type = type; + new_value.format = format; + +@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, + case PropModePrepend: + new_data = new_value.data; + old_data = (void *) (((char *) new_value.data) + +- (prop_value->size * size_in_bytes)); ++ (len * size_in_bytes)); + break; + } + if (new_data) +-- +GitLab + diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6377.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6377.patch new file mode 100644 index 0000000000..f650f495a3 --- /dev/null +++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6377.patch @@ -0,0 +1,82 @@ +CVE: CVE-2023-6377 +Upstream-Status: Backport [ https://gitlab.freedesktop.org/xorg/xserver/-/commit/19e9f199950aaa4b9b7696936d1b067475da999c ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + + +From 19e9f199950aaa4b9b7696936d1b067475da999c Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Tue, 28 Nov 2023 15:19:04 +1000 +Subject: [PATCH] Xi: allocate enough XkbActions for our buttons + +button->xkb_acts is supposed to be an array sufficiently large for all +our buttons, not just a single XkbActions struct. Allocating +insufficient memory here means when we memcpy() later in +XkbSetDeviceInfo we write into memory that wasn't ours to begin with, +leading to the usual security ooopsiedaisies. + +CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +(cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd) +--- + Xi/exevents.c | 12 ++++++------ + dix/devices.c | 10 ++++++++++ + 2 files changed, 16 insertions(+), 6 deletions(-) + +diff --git a/Xi/exevents.c b/Xi/exevents.c +index dcd4efb3bc..54ea11a938 100644 +--- a/Xi/exevents.c ++++ b/Xi/exevents.c +@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + } + + if (from->button->xkb_acts) { +- if (!to->button->xkb_acts) { +- to->button->xkb_acts = calloc(1, sizeof(XkbAction)); +- if (!to->button->xkb_acts) +- FatalError("[Xi] not enough memory for xkb_acts.\n"); +- } ++ size_t maxbuttons = max(to->button->numButtons, from->button->numButtons); ++ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts, ++ maxbuttons, ++ sizeof(XkbAction)); ++ memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction)); + memcpy(to->button->xkb_acts, from->button->xkb_acts, +- sizeof(XkbAction)); ++ from->button->numButtons * sizeof(XkbAction)); + } + else { + free(to->button->xkb_acts); +diff --git a/dix/devices.c b/dix/devices.c +index 7150734a58..20fef16923 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -2530,6 +2530,8 @@ RecalculateMasterButtons(DeviceIntPtr slave) + + if (master->button && master->button->numButtons != maxbuttons) { + int i; ++ int last_num_buttons = master->button->numButtons; ++ + DeviceChangedEvent event = { + .header = ET_Internal, + .type = ET_DeviceChanged, +@@ -2540,6 +2542,14 @@ RecalculateMasterButtons(DeviceIntPtr slave) + }; + + master->button->numButtons = maxbuttons; ++ if (last_num_buttons < maxbuttons) { ++ master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts, ++ maxbuttons, ++ sizeof(XkbAction)); ++ memset(&master->button->xkb_acts[last_num_buttons], ++ 0, ++ (maxbuttons - last_num_buttons) * sizeof(XkbAction)); ++ } + + memcpy(&event.buttons.names, master->button->labels, maxbuttons * + sizeof(Atom)); +-- +GitLab + diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6478.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6478.patch new file mode 100644 index 0000000000..23fbc0e9e2 --- /dev/null +++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6478.patch @@ -0,0 +1,66 @@ +CVE: CVE-2023-6478 +Upstream-Status: Backport [ https://gitlab.freedesktop.org/xorg/xserver/-/commit/aaf854fb25541380cc38a221c15f0e8372f48872 ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + + +From aaf854fb25541380cc38a221c15f0e8372f48872 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Mon, 27 Nov 2023 16:27:49 +1000 +Subject: [PATCH] randr: avoid integer truncation in length check of + ProcRRChange*Property + +Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty. +See also xserver@8f454b79 where this same bug was fixed for the core +protocol and XI. + +This fixes an OOB read and the resulting information disclosure. + +Length calculation for the request was clipped to a 32-bit integer. With +the correct stuff->nUnits value the expected request size was +truncated, passing the REQUEST_FIXED_SIZE check. + +The server then proceeded with reading at least stuff->num_items bytes +(depending on stuff->format) from the request and stuffing whatever it +finds into the property. In the process it would also allocate at least +stuff->nUnits bytes, i.e. 4GB. + +CVE-2023-6478, ZDI-CAN-22561 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +(cherry picked from commit 14f480010a93ff962fef66a16412fafff81ad632) +--- + randr/rrproperty.c | 2 +- + randr/rrproviderproperty.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/randr/rrproperty.c b/randr/rrproperty.c +index 25469f57b2..c4fef8a1f6 100644 +--- a/randr/rrproperty.c ++++ b/randr/rrproperty.c +@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr client) + char format, mode; + unsigned long len; + int sizeInBytes; +- int totalSize; ++ uint64_t totalSize; + int err; + + REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq); +diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c +index b79c17f9bf..90c5a9a933 100644 +--- a/randr/rrproviderproperty.c ++++ b/randr/rrproviderproperty.c +@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr client) + char format, mode; + unsigned long len; + int sizeInBytes; +- int totalSize; ++ uint64_t totalSize; + int err; + + REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq); +-- +GitLab + diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6816.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6816.patch new file mode 100644 index 0000000000..5c68bfb3c1 --- /dev/null +++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2023-6816.patch @@ -0,0 +1,57 @@ +CVE: CVE-2023-6816 +Upstream-Status: Backport [ https://gitlab.freedesktop.org/xorg/xserver/-/commit/b5cb27032d3e486ba84a491e1420e85171c4c0a3 ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +From b5cb27032d3e486ba84a491e1420e85171c4c0a3 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer <peter.hutterer@who-t.net> +Date: Thu, 14 Dec 2023 11:29:49 +1000 +Subject: [PATCH] dix: allocate enough space for logical button maps + +Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for +each logical button currently down. Since buttons can be arbitrarily mapped +to anything up to 255 make sure we have enough bits for the maximum mapping. + +CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +(cherry picked from commit 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3) +--- + Xi/xiquerypointer.c | 3 +-- + dix/enterleave.c | 5 +++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c +index 5b77b1a444..2b05ac5f39 100644 +--- a/Xi/xiquerypointer.c ++++ b/Xi/xiquerypointer.c +@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client) + if (pDev->button) { + int i; + +- rep.buttons_len = +- bytes_to_int32(bits_to_bytes(pDev->button->numButtons)); ++ rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */ + rep.length += rep.buttons_len; + buttons = calloc(rep.buttons_len, 4); + if (!buttons) +diff --git a/dix/enterleave.c b/dix/enterleave.c +index 867ec74363..ded8679d76 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail, + + mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER); + +- /* XI 2 event */ +- btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0; ++ /* XI 2 event contains the logical button map - maps are CARD8 ++ * so we need 256 bits for the possibly maximum mapping */ ++ btlen = (mouse->button) ? bits_to_bytes(256) : 0; + btlen = bytes_to_int32(btlen); + len = sizeof(xXIFocusInEvent) + btlen * 4; + +-- +GitLab + diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-0408.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-0408.patch new file mode 100644 index 0000000000..9063cd00b2 --- /dev/null +++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-0408.patch @@ -0,0 +1,65 @@ +CVE: CVE-2024-0408 +Upstream-Status: Backport [ https://gitlab.freedesktop.org/xorg/xserver/-/commit/4093057b98bc5a178f130c9ba6b0b28385e24ae5 ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +From 4093057b98bc5a178f130c9ba6b0b28385e24ae5 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan <ofourdan@redhat.com> +Date: Wed, 6 Dec 2023 12:09:41 +0100 +Subject: [PATCH] glx: Call XACE hooks on the GLX buffer + +The XSELINUX code will label resources at creation by checking the +access mode. When the access mode is DixCreateAccess, it will call the +function to label the new resource SELinuxLabelResource(). + +However, GLX buffers do not go through the XACE hooks when created, +hence leaving the resource actually unlabeled. + +When, later, the client tries to create another resource using that +drawable (like a GC for example), the XSELINUX code would try to use +the security ID of that object which has never been labeled, get a NULL +pointer and crash when checking whether the requested permissions are +granted for subject security ID. + +To avoid the issue, make sure to call the XACE hooks when creating the +GLX buffers. + +Credit goes to Donn Seeley <donn@xmission.com> for providing the patch. + +CVE-2024-0408 + +Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> +Acked-by: Peter Hutterer <peter.hutterer@who-t.net> +(cherry picked from commit e5e8586a12a3ec915673edffa10dc8fe5e15dac3) +--- + glx/glxcmds.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/glx/glxcmds.c b/glx/glxcmds.c +index fc26a2e345..1e46d0c723 100644 +--- a/glx/glxcmds.c ++++ b/glx/glxcmds.c +@@ -48,6 +48,7 @@ + #include "indirect_util.h" + #include "protocol-versions.h" + #include "glxvndabi.h" ++#include "xace.h" + + static char GLXServerVendorName[] = "SGI"; + +@@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId, + if (!pPixmap) + return BadAlloc; + ++ err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP, ++ pPixmap, RT_NONE, NULL, DixCreateAccess); ++ if (err != Success) { ++ (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap); ++ return err; ++ } ++ + /* Assign the pixmap the same id as the pbuffer and add it as a + * resource so it and the DRI2 drawable will be reclaimed when the + * pbuffer is destroyed. */ +-- +GitLab + diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-0409.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-0409.patch new file mode 100644 index 0000000000..de3396a410 --- /dev/null +++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-0409.patch @@ -0,0 +1,47 @@ +CVE: CVE-2024-0409 +Upstream-Status: Backport [ https://gitlab.freedesktop.org/xorg/xserver/-/commit/51be9e767a02cdc6a524dc895dcc81abb689d50b ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +From 51be9e767a02cdc6a524dc895dcc81abb689d50b Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan <ofourdan@redhat.com> +Date: Wed, 6 Dec 2023 11:51:56 +0100 +Subject: [PATCH] ephyr,xwayland: Use the proper private key for cursor + +The cursor in DIX is actually split in two parts, the cursor itself and +the cursor bits, each with their own devPrivates. + +The cursor itself includes the cursor bits, meaning that the cursor bits +devPrivates in within structure of the cursor. + +Both Xephyr and Xwayland were using the private key for the cursor bits +to store the data for the cursor, and when using XSELINUX which comes +with its own special devPrivates, the data stored in that cursor bits' +devPrivates would interfere with the XSELINUX devPrivates data and the +SELINUX security ID would point to some other unrelated data, causing a +crash in the XSELINUX code when trying to (re)use the security ID. + +CVE-2024-0409 + +Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> +Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> +(cherry picked from commit 2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7) +--- + hw/xwayland/xwayland-cursor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/xwayland/xwayland-cursor.c b/hw/xwayland/xwayland-cursor.c +index e3c1aaa50c..bd94b0cfbb 100644 +--- a/hw/xwayland/xwayland-cursor.c ++++ b/hw/xwayland/xwayland-cursor.c +@@ -431,7 +431,7 @@ static miPointerScreenFuncRec xwl_pointer_screen_funcs = { + Bool + xwl_screen_init_cursor(struct xwl_screen *xwl_screen) + { +- if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR_BITS, 0)) ++ if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR, 0)) + return FALSE; + + return miPointerInitialize(xwl_screen->screen, +-- +GitLab + diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.7.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb index dd32bd0111..133c65fbc3 100644 --- a/meta/recipes-graphics/xwayland/xwayland_22.1.7.bb +++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb @@ -9,8 +9,15 @@ HOMEPAGE = "https://fedoraproject.org/wiki/Changes/XwaylandStandalone" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://COPYING;md5=5df87950af51ac2c5822094553ea1880" -SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz" -SRC_URI[sha256sum] = "d53afac6c71953f5cf66d03d289dacd8961da5bd309c1dff125d5955d9db5f76" +SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \ + file://CVE-2023-5367.patch \ + file://CVE-2023-6377.patch \ + file://CVE-2023-6478.patch \ + file://CVE-2023-6816.patch \ + file://CVE-2024-0408.patch \ + file://CVE-2024-0409.patch \ +" +SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73" UPSTREAM_CHECK_REGEX = "xwayland-(?P<pver>\d+(\.(?!90\d)\d+)+)\.tar" diff --git a/meta/recipes-kernel/blktrace/blktrace/0001-bno_plot.py-btt_plot.py-Ask-for-python3-specifically.patch b/meta/recipes-kernel/blktrace/blktrace/0001-bno_plot.py-btt_plot.py-Ask-for-python3-specifically.patch new file mode 100644 index 0000000000..e2305a1111 --- /dev/null +++ b/meta/recipes-kernel/blktrace/blktrace/0001-bno_plot.py-btt_plot.py-Ask-for-python3-specifically.patch @@ -0,0 +1,35 @@ +From 6f4769e6e2c5cdc1262891470995e6dead937c7a Mon Sep 17 00:00:00 2001 +From: Sakib Sajal <sakib.sajal@windriver.com> +Date: Mon, 26 Jun 2023 17:57:36 -0400 +Subject: [PATCH] bno_plot.py, btt_plot.py: Ask for python3 specifically + +python2 is deprecated, use python3. + +Upstream-Status: Denied [https://www.spinics.net/lists/linux-btrace/msg01364.html] + +Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> +--- + btt/bno_plot.py | 2 +- + btt/btt_plot.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/btt/bno_plot.py b/btt/bno_plot.py +index 3aa4e19..d7d7159 100644 +--- a/btt/bno_plot.py ++++ b/btt/bno_plot.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python3 + # + # btt blkno plotting interface + # +diff --git a/btt/btt_plot.py b/btt/btt_plot.py +index 40bc71f..8620d31 100755 +--- a/btt/btt_plot.py ++++ b/btt/btt_plot.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python3 + # + # btt_plot.py: Generate matplotlib plots for BTT generate data files + # diff --git a/meta/recipes-kernel/blktrace/blktrace_git.bb b/meta/recipes-kernel/blktrace/blktrace_git.bb index bba5e04504..1c0856be7b 100644 --- a/meta/recipes-kernel/blktrace/blktrace_git.bb +++ b/meta/recipes-kernel/blktrace/blktrace_git.bb @@ -14,7 +14,9 @@ SRCREV = "366d30b9cdb20345c5d064af850d686da79b89eb" PV = "1.3.0+git${SRCPV}" -SRC_URI = "git://git.kernel.dk/blktrace.git;branch=master" +SRC_URI = "git://git.kernel.dk/blktrace.git;branch=master \ + file://0001-bno_plot.py-btt_plot.py-Ask-for-python3-specifically.patch \ + " S = "${WORKDIR}/git" diff --git a/meta/recipes-kernel/kmod/kmod/ptest.patch b/meta/recipes-kernel/kmod/kmod/ptest.patch deleted file mode 100644 index 831dbcb909..0000000000 --- a/meta/recipes-kernel/kmod/kmod/ptest.patch +++ /dev/null @@ -1,25 +0,0 @@ -Add 'install-ptest' rule. - -Signed-off-by: Tudor Florea <tudor.florea@enea.com> -Upstream-Status: Pending - -diff -ruN a/Makefile.am b/Makefile.am ---- a/Makefile.am 2013-07-12 17:11:05.278331557 +0200 -+++ b/Makefile.am 2013-07-12 17:14:27.033788016 +0200 -@@ -204,6 +204,16 @@ - - distclean-local: $(DISTCLEAN_LOCAL_HOOKS) - -+install-ptest: -+ @$(MKDIR_P) $(DESTDIR)/testsuite -+ @for file in $(TESTSUITE); do \ -+ install $$file $(DESTDIR)/testsuite; \ -+ done; -+ @sed -e 's/^Makefile/_Makefile/' < Makefile > $(DESTDIR)/Makefile -+ @$(MKDIR_P) $(DESTDIR)/tools -+ @cp $(noinst_SCRIPTS) $(noinst_PROGRAMS) $(DESTDIR)/tools -+ @cp -r testsuite/rootfs testsuite/.libs $(DESTDIR)/testsuite -+ - # ------------------------------------------------------------------------------ - # custom release helpers - # ------------------------------------------------------------------------------ diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20221214.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20240220.bb index c2354e627f..425b351dc1 100644 --- a/meta/recipes-kernel/linux-firmware/linux-firmware_20221214.bb +++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20240220.bb @@ -12,12 +12,15 @@ LICENSE = "\ & Firmware-amdgpu \ & Firmware-amd-ucode \ & Firmware-amlogic_vdec \ + & Firmware-amphion_vpu \ & Firmware-atheros_firmware \ & Firmware-atmel \ & Firmware-broadcom_bcm43xx \ & Firmware-ca0132 \ & Firmware-cavium \ & Firmware-chelsio_firmware \ + & Firmware-cirrus \ + & Firmware-cnm \ & Firmware-cw1200 \ & Firmware-cypress \ & Firmware-dib0700 \ @@ -30,21 +33,26 @@ LICENSE = "\ & Firmware-i915 \ & Firmware-ibt_firmware \ & Firmware-ice \ + & Firmware-ice_enhanced \ & Firmware-it913x \ & Firmware-iwlwifi_firmware \ & Firmware-IntcSST2 \ & Firmware-kaweth \ & Firmware-Lontium \ & Firmware-Marvell \ + & Firmware-mediatek \ + & Firmware-microchip \ & Firmware-moxa \ & Firmware-myri10ge_firmware \ & Firmware-netronome \ & Firmware-nvidia \ + & Firmware-nxp_mc_firmware \ & Firmware-OLPC \ & Firmware-ath9k-htc \ & Firmware-phanfw \ & Firmware-qat \ & Firmware-qcom \ + & Firmware-qcom-yamato \ & Firmware-qla1280 \ & Firmware-qla2xxx \ & Firmware-qualcommAthos_ar3k \ @@ -70,9 +78,10 @@ LICENSE = "\ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \ file://LICENCE.adsp_sst;md5=615c45b91a5a4a9fe046d6ab9a2df728 \ file://LICENCE.agere;md5=af0133de6b4a9b2522defd5f188afd31 \ - file://LICENSE.amdgpu;md5=44c1166d052226cb2d6c8d7400090203 \ + file://LICENSE.amdgpu;md5=a2589a05ea5b6bd2b7f4f623c7e7a649 \ file://LICENSE.amd-ucode;md5=6ca90c57f7b248de1e25c7f68ffc4698 \ file://LICENSE.amlogic_vdec;md5=dc44f59bf64a81643e500ad3f39a468a \ + file://LICENSE.amphion_vpu;md5=2bcdc00527b2d0542bd92b52aaec2b60 \ file://LICENCE.atheros_firmware;md5=30a14c7823beedac9fa39c64fdd01a13 \ file://LICENSE.atmel;md5=aa74ac0c60595dee4d4e239107ea77a3 \ file://LICENCE.broadcom_bcm43xx;md5=3160c14df7228891b868060e1951dfbc \ @@ -80,6 +89,8 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \ file://LICENCE.cadence;md5=009f46816f6956cfb75ede13d3e1cee0 \ file://LICENCE.cavium;md5=c37aaffb1ebe5939b2580d073a95daea \ file://LICENCE.chelsio_firmware;md5=819aa8c3fa453f1b258ed8d168a9d903 \ + file://LICENSE.cirrus;md5=662ea2c1a8888f7d79ed7f27c27472e1 \ + file://LICENCE.cnm;md5=93b67e6bac7f8fec22b96b8ad0a1a9d0 \ file://LICENCE.cw1200;md5=f0f770864e7a8444a5c5aa9d12a3a7ed \ file://LICENCE.cypress;md5=48cd9436c763bf873961f9ed7b5c147b \ file://LICENSE.dib0700;md5=f7411825c8a555a1a3e5eab9ca773431 \ @@ -92,6 +103,7 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \ file://LICENSE.i915;md5=2b0b2e0d20984affd4490ba2cba02570 \ file://LICENCE.ibt_firmware;md5=fdbee1ddfe0fb7ab0b2fcd6b454a366b \ file://LICENSE.ice;md5=742ab4850f2670792940e6d15c974b2f \ + file://LICENSE.ice_enhanced;md5=f305cfc31b64f95f774f9edd9df0224d \ file://LICENCE.IntcSST2;md5=9e7d8bea77612d7cc7d9e9b54b623062 \ file://LICENCE.it913x;md5=1fbf727bfb6a949810c4dbfa7e6ce4f8 \ file://LICENCE.iwlwifi_firmware;md5=2ce6786e0fc11ac6e36b54bb9b799f1b \ @@ -99,16 +111,19 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \ file://LICENSE.Lontium;md5=4ec8dc582ff7295f39e2ca6a7b0be2b6 \ file://LICENCE.Marvell;md5=28b6ed8bd04ba105af6e4dcd6e997772 \ file://LICENCE.mediatek;md5=7c1976b63217d76ce47d0a11d8a79cf2 \ + file://LICENCE.microchip;md5=db753b00305675dfbf120e3f24a47277 \ file://LICENCE.moxa;md5=1086614767d8ccf744a923289d3d4261 \ file://LICENCE.myri10ge_firmware;md5=42e32fb89f6b959ca222e25ac8df8fed \ file://LICENCE.Netronome;md5=4add08f2577086d44447996503cddf5f \ file://LICENCE.nvidia;md5=4428a922ed3ba2ceec95f076a488ce07 \ file://LICENCE.NXP;md5=58bb8ba632cd729b9ba6183bc6aed36f \ + file://LICENSE.nxp_mc_firmware;md5=9dc97e4b279b3858cae8879ae2fe5dd7 \ file://LICENCE.OLPC;md5=5b917f9d8c061991be4f6f5f108719cd \ file://LICENCE.open-ath9k-htc-firmware;md5=1b33c9f4d17bc4d457bdb23727046837 \ file://LICENCE.phanfw;md5=954dcec0e051f9409812b561ea743bfa \ - file://LICENCE.qat_firmware;md5=9e7d8bea77612d7cc7d9e9b54b623062 \ + file://LICENCE.qat_firmware;md5=72de83dfd9b87be7685ed099a39fbea4 \ file://LICENSE.qcom;md5=164e3362a538eb11d3ac51e8e134294b \ + file://LICENSE.qcom_yamato;md5=d0de0eeccaf1843a850bf7a6777eec5c \ file://LICENCE.qla1280;md5=d6895732e622d950609093223a2c4f5d \ file://LICENCE.qla2xxx;md5=505855e921b75f1be4a437ad9b79dff0 \ file://LICENSE.QualcommAtheros_ar3k;md5=b5fe244fb2b532311de1472a3bc06da5 \ @@ -132,7 +147,7 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \ " # WHENCE checksum is defined separately to ease overriding it if # class-devupstream is selected. -WHENCE_CHKSUM = "bf7c716d16e48fe118c6209f99b13253" +WHENCE_CHKSUM = "a344e6c28970fc7daafa81c10247aeb6" # These are not common licenses, set NO_GENERIC_LICENSE for them # so that the license files will be copied from fetched source @@ -142,6 +157,7 @@ NO_GENERIC_LICENSE[Firmware-agere] = "LICENCE.agere" NO_GENERIC_LICENSE[Firmware-amdgpu] = "LICENSE.amdgpu" NO_GENERIC_LICENSE[Firmware-amd-ucode] = "LICENSE.amd-ucode" NO_GENERIC_LICENSE[Firmware-amlogic_vdec] = "LICENSE.amlogic_vdec" +NO_GENERIC_LICENSE[Firmware-amphion_vpu] = "LICENSE.amphion_vpu" NO_GENERIC_LICENSE[Firmware-atheros_firmware] = "LICENCE.atheros_firmware" NO_GENERIC_LICENSE[Firmware-atmel] = "LICENSE.atmel" NO_GENERIC_LICENSE[Firmware-broadcom_bcm43xx] = "LICENCE.broadcom_bcm43xx" @@ -149,6 +165,8 @@ NO_GENERIC_LICENSE[Firmware-ca0132] = "LICENCE.ca0132" NO_GENERIC_LICENSE[Firmware-cadence] = "LICENCE.cadence" NO_GENERIC_LICENSE[Firmware-cavium] = "LICENCE.cavium" NO_GENERIC_LICENSE[Firmware-chelsio_firmware] = "LICENCE.chelsio_firmware" +NO_GENERIC_LICENSE[Firmware-cirrus] = "LICENSE.cirrus" +NO_GENERIC_LICENSE[Firmware-cnm] = "LICENCE.cnm" NO_GENERIC_LICENSE[Firmware-cw1200] = "LICENCE.cw1200" NO_GENERIC_LICENSE[Firmware-cypress] = "LICENCE.cypress" NO_GENERIC_LICENSE[Firmware-dib0700] = "LICENSE.dib0700" @@ -161,6 +179,7 @@ NO_GENERIC_LICENSE[Firmware-hfi1_firmware] = "LICENSE.hfi1_firmware" NO_GENERIC_LICENSE[Firmware-i915] = "LICENSE.i915" NO_GENERIC_LICENSE[Firmware-ibt_firmware] = "LICENCE.ibt_firmware" NO_GENERIC_LICENSE[Firmware-ice] = "LICENSE.ice" +NO_GENERIC_LICENSE[Firmware-ice_enhanced] = "LICENSE.ice_enhanced" NO_GENERIC_LICENSE[Firmware-IntcSST2] = "LICENCE.IntcSST2" NO_GENERIC_LICENSE[Firmware-it913x] = "LICENCE.it913x" NO_GENERIC_LICENSE[Firmware-iwlwifi_firmware] = "LICENCE.iwlwifi_firmware" @@ -168,15 +187,18 @@ NO_GENERIC_LICENSE[Firmware-kaweth] = "LICENCE.kaweth" NO_GENERIC_LICENSE[Firmware-Lontium] = "LICENSE.Lontium" NO_GENERIC_LICENSE[Firmware-Marvell] = "LICENCE.Marvell" NO_GENERIC_LICENSE[Firmware-mediatek] = "LICENCE.mediatek" +NO_GENERIC_LICENSE[Firmware-microchip] = "LICENCE.microchip" NO_GENERIC_LICENSE[Firmware-moxa] = "LICENCE.moxa" NO_GENERIC_LICENSE[Firmware-myri10ge_firmware] = "LICENCE.myri10ge_firmware" NO_GENERIC_LICENSE[Firmware-netronome] = "LICENCE.Netronome" NO_GENERIC_LICENSE[Firmware-nvidia] = "LICENCE.nvidia" +NO_GENERIC_LICENSE[Firmware-nxp_mc_firmware] = "LICENSE.nxp_mc_firmware" NO_GENERIC_LICENSE[Firmware-OLPC] = "LICENCE.OLPC" NO_GENERIC_LICENSE[Firmware-ath9k-htc] = "LICENCE.open-ath9k-htc-firmware" NO_GENERIC_LICENSE[Firmware-phanfw] = "LICENCE.phanfw" NO_GENERIC_LICENSE[Firmware-qat] = "LICENCE.qat_firmware" NO_GENERIC_LICENSE[Firmware-qcom] = "LICENSE.qcom" +NO_GENERIC_LICENSE[Firmware-qcom-yamato] = "LICENSE.qcom_yamato" NO_GENERIC_LICENSE[Firmware-qla1280] = "LICENCE.qla1280" NO_GENERIC_LICENSE[Firmware-qla2xxx] = "LICENCE.qla2xxx" NO_GENERIC_LICENSE[Firmware-qualcommAthos_ar3k] = "LICENSE.QualcommAtheros_ar3k" @@ -209,7 +231,7 @@ SRC_URI:class-devupstream = "git://git.kernel.org/pub/scm/linux/kernel/git/firmw # Pin this to the 20220509 release, override this in local.conf SRCREV:class-devupstream ?= "b19cbdca78ab2adfd210c91be15a22568e8b8cae" -SRC_URI[sha256sum] = "e793783e92acbde549965521462d1d1327827360664cf242dbda08f075654331" +SRC_URI[sha256sum] = "bf0f239dc0801e9d6bf5d5fb3e2f549575632cf4688f4348184199cb02c2bcd7" inherit allarch @@ -220,24 +242,34 @@ do_compile() { } do_install() { - oe_runmake 'DESTDIR=${D}' 'FIRMWAREDIR=${nonarch_base_libdir}/firmware' install + # install-nodedup avoids rdfind dependency + oe_runmake 'DESTDIR=${D}' 'FIRMWAREDIR=${nonarch_base_libdir}/firmware' install-nodedup cp GPL-2 LICEN[CS]E.* WHENCE ${D}${nonarch_base_libdir}/firmware/ } -PACKAGES =+ "${PN}-ralink-license ${PN}-ralink \ +PACKAGES =+ "${PN}-amphion-vpu-license ${PN}-amphion-vpu \ + ${PN}-cw1200-license ${PN}-cw1200 \ + ${PN}-ralink-license ${PN}-ralink \ ${PN}-mt7601u-license ${PN}-mt7601u \ + ${PN}-mt7650-license ${PN}-mt7650 \ + ${PN}-mt76x2-license ${PN}-mt76x2 \ ${PN}-radeon-license ${PN}-radeon \ ${PN}-amdgpu-license ${PN}-amdgpu \ ${PN}-marvell-license ${PN}-pcie8897 ${PN}-pcie8997 \ + ${PN}-mediatek-license ${PN}-mediatek \ + ${PN}-microchip-license ${PN}-microchip \ + ${PN}-moxa-license ${PN}-moxa \ ${PN}-sd8686 ${PN}-sd8688 ${PN}-sd8787 ${PN}-sd8797 ${PN}-sd8801 \ ${PN}-sd8887 ${PN}-sd8897 ${PN}-sd8997 ${PN}-usb8997 \ ${PN}-ti-connectivity-license ${PN}-wlcommon ${PN}-wl12xx ${PN}-wl18xx \ + ${PN}-ti-keystone-license ${PN}-ti-keystone \ ${PN}-vt6656-license ${PN}-vt6656 \ ${PN}-rs9113 ${PN}-rs9116 \ ${PN}-rtl-license ${PN}-rtl8188 ${PN}-rtl8192cu ${PN}-rtl8192ce ${PN}-rtl8192su ${PN}-rtl8723 ${PN}-rtl8821 \ ${PN}-rtl8761 \ ${PN}-rtl8168 \ + ${PN}-rtl8822 \ ${PN}-cypress-license \ ${PN}-broadcom-license \ ${PN}-bcm-0bb4-0306 \ @@ -273,7 +305,9 @@ PACKAGES =+ "${PN}-ralink-license ${PN}-ralink \ ${PN}-bcm4373 \ ${PN}-bcm43xx \ ${PN}-bcm43xx-hdr \ - ${PN}-atheros-license ${PN}-ar9170 ${PN}-ath6k ${PN}-ath9k ${PN}-ath3k \ + ${PN}-cirrus-license ${PN}-cirrus \ + ${PN}-cnm-license ${PN}-cnm \ + ${PN}-atheros-license ${PN}-ar5523 ${PN}-ar9170 ${PN}-ath6k ${PN}-ath9k ${PN}-ath3k \ ${PN}-gplv2-license ${PN}-carl9170 \ ${PN}-ar3k-license ${PN}-ar3k ${PN}-ath10k-license ${PN}-ath10k ${PN}-ath11k ${PN}-qca \ \ @@ -299,34 +333,64 @@ PACKAGES =+ "${PN}-ralink-license ${PN}-ralink \ ${PN}-ibt-misc \ ${PN}-i915-license ${PN}-i915 \ ${PN}-ice-license ${PN}-ice \ + ${PN}-ice-enhanced-license ${PN}-ice-enhanced \ ${PN}-adsp-sst-license ${PN}-adsp-sst \ ${PN}-bnx2-mips \ ${PN}-liquidio \ ${PN}-nvidia-license \ ${PN}-nvidia-tegra-k1 ${PN}-nvidia-tegra \ ${PN}-nvidia-gpu \ + ${PN}-nxp-mc-license ${PN}-nxp-mc \ ${PN}-netronome-license ${PN}-netronome \ + ${PN}-olpc-license ${PN}-olpc \ + ${PN}-phanfw-license ${PN}-phanfw \ ${PN}-qat ${PN}-qat-license \ - ${PN}-qcom-license \ + ${PN}-qcom-license ${PN}-qcom-yamato-license \ ${PN}-qcom-venus-1.8 ${PN}-qcom-venus-4.2 ${PN}-qcom-venus-5.2 ${PN}-qcom-venus-5.4 \ ${PN}-qcom-vpu-1.0 ${PN}-qcom-vpu-2.0 \ ${PN}-qcom-adreno-a2xx ${PN}-qcom-adreno-a3xx ${PN}-qcom-adreno-a4xx ${PN}-qcom-adreno-a530 \ ${PN}-qcom-adreno-a630 ${PN}-qcom-adreno-a650 ${PN}-qcom-adreno-a660 \ - ${PN}-qcom-apq8096-audio ${PN}-qcom-apq8096-modem \ + ${PN}-qcom-apq8016-modem ${PN}-qcom-apq8016-wifi \ + ${PN}-qcom-apq8096-adreno ${PN}-qcom-apq8096-audio ${PN}-qcom-apq8096-modem \ ${PN}-qcom-sc8280xp-lenovo-x13s-compat \ ${PN}-qcom-sc8280xp-lenovo-x13s-audio \ ${PN}-qcom-sc8280xp-lenovo-x13s-adreno \ ${PN}-qcom-sc8280xp-lenovo-x13s-compute \ ${PN}-qcom-sc8280xp-lenovo-x13s-sensors \ - ${PN}-qcom-sdm845-audio ${PN}-qcom-sdm845-compute ${PN}-qcom-sdm845-modem \ - ${PN}-qcom-sm8250-audio ${PN}-qcom-sm8250-compute \ + ${PN}-qcom-sdm845-adreno ${PN}-qcom-sdm845-audio ${PN}-qcom-sdm845-compute ${PN}-qcom-sdm845-modem \ + ${PN}-qcom-sm8250-adreno ${PN}-qcom-sm8250-audio ${PN}-qcom-sm8250-compute \ + ${PN}-qla2xxx ${PN}-qla2xxx-license \ ${PN}-amlogic-vdec-license ${PN}-amlogic-vdec \ ${PN}-lt9611uxc ${PN}-lontium-license \ ${PN}-whence-license \ + ${PN}-wl1251-license ${PN}-wl1251 \ + ${PN}-xc4000-license ${PN}-xc4000 \ + ${PN}-xc5000-license ${PN}-xc5000 \ + ${PN}-xc5000c-license ${PN}-xc5000c \ ${PN}-license \ " +# For Amphion VPU +LICENSE:${PN}-amphion-vpu = "Firmware-amphion_vpu" +LICENSE:${PN}-amphion-vpu-license = "Firmware-amphion_vpu" + +FILES:${PN}-amphion-vpu = "${nonarch_base_libdir}/firmware/amphion/*" +FILES:${PN}-amphion-vpu-license = " \ + ${nonarch_base_libdir}/firmware/LICENSE.amphion_vpu \ +" +RDEPENDS:${PN}-amphion-vpu += "${PN}-amphion-vpu-license" + +# For cw1200 +LICENSE:${PN}-cw1200 = "Firmware-cw1200" +LICENSE:${PN}-cw1200-license = "Firmware-cw1200" + +FILES:${PN}-cw1200 = "${nonarch_base_libdir}/firmware/wsm_22.bin" +FILES:${PN}-cw1200-license = "${nonarch_base_libdir}/firmware/LICENCE.cw1200" + +RDEPENDS:${PN}-cw1200 += "${PN}-cw1200-license" + # For atheros +LICENSE:${PN}-ar5523 = "Firmware-atheros_firmware" LICENSE:${PN}-ar9170 = "Firmware-atheros_firmware" LICENSE:${PN}-ath3k = "Firmware-atheros_firmware" LICENSE:${PN}-ath6k = "Firmware-atheros_firmware" @@ -334,6 +398,9 @@ LICENSE:${PN}-ath9k = "Firmware-atheros_firmware" LICENSE:${PN}-atheros-license = "Firmware-atheros_firmware" FILES:${PN}-atheros-license = "${nonarch_base_libdir}/firmware/LICENCE.atheros_firmware" +FILES:${PN}-ar5523 = " \ + ${nonarch_base_libdir}/firmware/ar5523.bin \ +" FILES:${PN}-ar9170 = " \ ${nonarch_base_libdir}/firmware/ar9170*.fw \ " @@ -352,6 +419,7 @@ FILES:${PN}-ath9k = " \ ${nonarch_base_libdir}/firmware/ath9k_htc/htc_9271-1.4.0.fw \ " +RDEPENDS:${PN}-ar5523 += "${PN}-atheros-license" RDEPENDS:${PN}-ar9170 += "${PN}-atheros-license" RDEPENDS:${PN}-ath6k += "${PN}-atheros-license" RDEPENDS:${PN}-ath9k += "${PN}-atheros-license" @@ -414,12 +482,74 @@ LICENSE:${PN}-mt7601u-license = "Firmware-ralink_a_mediatek_company_firmware" FILES:${PN}-mt7601u-license = "${nonarch_base_libdir}/firmware/LICENCE.ralink_a_mediatek_company_firmware" FILES:${PN}-mt7601u = " \ + ${nonarch_base_libdir}/firmware/mediatek/mt7601u.bin \ ${nonarch_base_libdir}/firmware/mt7601u.bin \ " - RDEPENDS:${PN}-mt7601u += "${PN}-mt7601u-license" +# For MediaTek Bluetooth USB driver 7650 +LICENSE:${PN}-mt7650 = "Firmware-ralink_a_mediatek_company_firmware" +LICENSE:${PN}-mt7650-license = "Firmware-ralink_a_mediatek_company_firmware" + +FILES:${PN}-mt7650-license = " \ + ${nonarch_base_libdir}/firmware/LICENCE.ralink_a_mediatek_company_firmware \ +" +FILES:${PN}-mt7650 = " \ + ${nonarch_base_libdir}/firmware/mediatek/mt7650.bin \ + ${nonarch_base_libdir}/firmware/mt7650.bin \ +" +RDEPENDS:${PN}-mt7650 += "${PN}-mt7650-license" + +# For MediaTek MT76x2 Wireless MACs +LICENSE:${PN}-mt76x2 = "Firmware-ralink_a_mediatek_company_firmware" +LICENSE:${PN}-mt76x2-license = "Firmware-ralink_a_mediatek_company_firmware" + +FILES:${PN}-mt76x2-license = " \ + ${nonarch_base_libdir}/firmware/LICENCE.ralink_a_mediatek_company_firmware \ +" +FILES:${PN}-mt76x2 = " \ + ${nonarch_base_libdir}/firmware/mediatek/mt7662.bin \ + ${nonarch_base_libdir}/firmware/mt7662.bin \ + ${nonarch_base_libdir}/firmware/mediatek/mt7662_rom_patch.bin \ + ${nonarch_base_libdir}/firmware/mt7662_rom_patch.bin \ +" +RDEPENDS:${PN}-mt76x2 += "${PN}-mt76x2-license" + +# For MediaTek +LICENSE:${PN}-mediatek = "Firmware-mediatek" +LICENSE:${PN}-mediatek-license = "Firmware-mediatek" + +FILES:${PN}-mediatek = " \ + ${nonarch_base_libdir}/firmware/mediatek/* \ + ${nonarch_base_libdir}/firmware/vpu_d.bin \ + ${nonarch_base_libdir}/firmware/vpu_p.bin \ +" +FILES:${PN}-mediatek-license = " \ + ${nonarch_base_libdir}/firmware/LICENCE.mediatek \ +" +RDEPENDS:${PN}-mediatek += "${PN}-mediatek-license" + +# For Microchip +LICENSE:${PN}-microchip = "Firmware-microchip" +LICENSE:${PN}-microchip-license = "Firmware-microchip" + +FILES:${PN}-microchip = "${nonarch_base_libdir}/firmware/microchip/*" +FILES:${PN}-microchip-license = " \ + ${nonarch_base_libdir}/firmware/LICENCE.microchip \ +" +RDEPENDS:${PN}-microchip += "${PN}-microchip-license" + +# For MOXA +LICENSE:${PN}-moxa = "Firmware-moxa" +LICENSE:${PN}-moxa-license = "Firmware-moxa" + +FILES:${PN}-moxa = "${nonarch_base_libdir}/firmware/moxa" +FILES:${PN}-moxa-license = "${nonarch_base_libdir}/firmware/LICENCE.moxa" + +RDEPENDS:${PN}-moxa += "${PN}-moxa-license" + # For radeon + LICENSE:${PN}-radeon = "Firmware-radeon" LICENSE:${PN}-radeon-license = "Firmware-radeon" @@ -538,6 +668,16 @@ FILES:${PN}-netronome = " \ RDEPENDS:${PN}-netronome += "${PN}-netronome-license" +# For nxp-mc +LICENSE:${PN}-nxp-mc = "Firmware-nxp_mc_firmware" +LICENSE:${PN}-nxp-mc-license = "Firmware-nxp_mc_firmware" + +FILES:${PN}-nxp-mc= "${nonarch_base_libdir}/firmware/dpaa2/mc/*" +FILES:${PN}-nxp-mc-license = " \ + ${nonarch_base_libdir}/firmware/LICENSE.nxp_mc_firmware \ +" +RDEPENDS:${PN}-nxp-mc += "${PN}-nxp-mc-license" + # For Nvidia LICENSE:${PN}-nvidia-gpu = "Firmware-nvidia" LICENSE:${PN}-nvidia-tegra = "Firmware-nvidia" @@ -560,6 +700,37 @@ RDEPENDS:${PN}-nvidia-gpu += "${PN}-nvidia-license" RDEPENDS:${PN}-nvidia-tegra += "${PN}-nvidia-license" RDEPENDS:${PN}-nvidia-tegra-k1 += "${PN}-nvidia-license" +# For OLPC +LICENSE:${PN}-olpc = "Firmware-OLPC" +LICENSE:${PN}-olpc-license = "Firmware-OLPC" + +FILES:${PN}-olpc = " \ + ${nonarch_base_libdir}/firmware/libertas/lbtf_sdio.bin \ + ${nonarch_base_libdir}/firmware/lbtf_usb.bin \ + ${nonarch_base_libdir}/firmware/libertas/usb8388_olpc.bin \ +" +FILES:${PN}-olpc-license = "${nonarch_base_libdir}/firmware/LICENCE.OLPC" + +RDEPENDS:${PN}-olpc += "${PN}-olpc-license" + +# For phanfw +LICENSE:${PN}-phanfw = "Firmware-phanfw" +LICENSE:${PN}-phanfw-license = "Firmware-phanfw" + +FILES:${PN}-phanfw = "${nonarch_base_libdir}/firmware/phanfw.bin" +FILES:${PN}-phanfw-license = "${nonarch_base_libdir}/firmware/LICENCE.phanfw" + +RDEPENDS:${PN}-phanfw += "${PN}-phanfw-license" + +# For qla2xxx +LICENSE:${PN}-qla2xxx = "Firmware-qla2xxx" +LICENSE:${PN}-qla2xxx-license = "Firmware-qla2xxx" + +FILES:${PN}-qla2xxx = "${nonarch_base_libdir}/firmware/ql2*" +FILES:${PN}-qla2xxx-license = "${nonarch_base_libdir}/firmware/LICENCE.qla2xxx" + +RDEPENDS:${PN}-qla2xxx += "${PN}-qla2xxx-license" + # For RSI RS911x WiFi LICENSE:${PN}-rs9113 = "WHENCE" LICENSE:${PN}-rs9116 = "WHENCE" @@ -578,6 +749,7 @@ LICENSE:${PN}-rtl8192su = "Firmware-rtlwifi_firmware" LICENSE:${PN}-rtl8723 = "Firmware-rtlwifi_firmware" LICENSE:${PN}-rtl8761 = "Firmware-rtlwifi_firmware" LICENSE:${PN}-rtl8821 = "Firmware-rtlwifi_firmware" +LICENSE:${PN}-rtl8822 = "Firmware-rtlwifi_firmware" LICENSE:${PN}-rtl-license = "Firmware-rtlwifi_firmware" LICENSE:${PN}-rtl8168 = "WHENCE" @@ -608,6 +780,11 @@ FILES:${PN}-rtl8761 = " \ FILES:${PN}-rtl8168 = " \ ${nonarch_base_libdir}/firmware/rtl_nic/rtl8168*.fw \ " +FILES:${PN}-rtl8822 = " \ + ${nonarch_base_libdir}/firmware/rtl_bt/rtl8822*.bin \ + ${nonarch_base_libdir}/firmware/rtw88/rtw8822*.bin \ + ${nonarch_base_libdir}/firmware/rtlwifi/rtl8822*.bin \ +" RDEPENDS:${PN}-rtl8188 += "${PN}-rtl-license" RDEPENDS:${PN}-rtl8192ce += "${PN}-rtl-license" @@ -616,8 +793,21 @@ RDEPENDS:${PN}-rtl8192su = "${PN}-rtl-license" RDEPENDS:${PN}-rtl8723 += "${PN}-rtl-license" RDEPENDS:${PN}-rtl8821 += "${PN}-rtl-license" RDEPENDS:${PN}-rtl8761 += "${PN}-rtl-license" +RDEPENDS:${PN}-rtl8822 += "${PN}-rtl-license" RDEPENDS:${PN}-rtl8168 += "${PN}-whence-license" +# For TI wl1251 +LICENSE:${PN}-wl1251 = "Firmware-wl1251" +LICENSE:${PN}-wl1251-license = "Firmware-wl1251" + +FILES:${PN}-wl1251 = " \ + ${nonarch_base_libdir}/firmware/ti-connectivity/wl1251-fw.bin \ + ${nonarch_base_libdir}/firmware/ti-connectivity/wl1251-nvs.bin \ +" +FILES:${PN}-wl1251-license = "${nonarch_base_libdir}/firmware/LICENCE.wl1251" + +RDEPENDS:${PN}-wl1251 += "${PN}-wl1251-license" + # For ti-connectivity LICENSE:${PN}-wlcommon = "Firmware-ti-connectivity" LICENSE:${PN}-wl12xx = "Firmware-ti-connectivity" @@ -647,6 +837,16 @@ FILES:${PN}-wl18xx = " \ RDEPENDS:${PN}-wl12xx = "${PN}-ti-connectivity-license ${PN}-wlcommon" RDEPENDS:${PN}-wl18xx = "${PN}-ti-connectivity-license ${PN}-wlcommon" +# For ti-keystone +LICENSE:${PN}-ti-keystone = "Firmware-ti-keystone" +LICENSE:${PN}-ti-keystone-license = "Firmware-ti-keystone" + +FILES:${PN}-ti-keystone = "${nonarch_base_libdir}/firmware/ti-keystone/*" +FILES:${PN}-ti-keystone-license = " \ + ${nonarch_base_libdir}/firmware/LICENCE.ti-keystone \ +" +RDEPENDS:${PN}-ti-keystone += "${PN}-ti-keystone-license" + # For vt6656 LICENSE:${PN}-vt6656 = "Firmware-via_vt6656" LICENSE:${PN}-vt6656-license = "Firmware-via_vt6656" @@ -658,6 +858,35 @@ FILES:${PN}-vt6656 = " \ RDEPENDS:${PN}-vt6656 = "${PN}-vt6656-license" +# For xc4000 +LICENSE:${PN}-xc4000 = "Firmware-xc4000" +LICENSE:${PN}-xc4000-license = "Firmware-xc4000" + +FILES:${PN}-xc4000 = "${nonarch_base_libdir}/firmware/dvb-fe-xc4000-1.4.1.fw" +FILES:${PN}-xc4000-license = "${nonarch_base_libdir}/firmware/LICENCE.xc4000" + +RDEPENDS:${PN}-xc4000 += "${PN}-xc4000-license" + +# For xc5000 +LICENSE:${PN}-xc5000 = "Firmware-xc5000" +LICENSE:${PN}-xc5000-license = "Firmware-xc5000" + +FILES:${PN}-xc5000 = "${nonarch_base_libdir}/firmware/dvb-fe-xc5000-1.6.114.fw" +FILES:${PN}-xc5000-license = "${nonarch_base_libdir}/firmware/LICENCE.xc5000" + +RDEPENDS:${PN}-xc5000 += "${PN}-xc5000-license" + +# For xc5000c +LICENSE:${PN}-xc5000c = "Firmware-xc5000c" +LICENSE:${PN}-xc5000c-license = "Firmware-xc5000c" + +FILES:${PN}-xc5000c = " \ + ${nonarch_base_libdir}/firmware/dvb-fe-xc5000c-4.1.30.7.fw \ +" +FILES:${PN}-xc5000c-license = "${nonarch_base_libdir}/firmware/LICENCE.xc5000c" + +RDEPENDS:${PN}-xc5000c += "${PN}-xc5000c-license" + # For broadcom # for i in `grep brcm WHENCE | grep ^File | sed 's/File: brcm.//g'`; do pkg=`echo $i | sed 's/-[sp40].*//g; s/\.bin//g; s/brcmfmac/bcm/g; s/_hdr/-hdr/g; s/BCM/bcm-0bb4-0306/g'`; echo -e " \${PN}-$pkg \\"; done | sort -u @@ -814,6 +1043,24 @@ FILES:${PN}-whence-license = "${nonarch_base_libdir}/firmware/WHENCE" RDEPENDS:${PN}-bnx2-mips += "${PN}-whence-license" +# For cirrus +LICENSE:${PN}-cirrus = "Firmware-cirrus" +LICENSE:${PN}-cirrus-license = "Firmware-cirrus" + +FILES:${PN}-cirrus = "${nonarch_base_libdir}/firmware/cirrus/*" +FILES:${PN}-cirrus-license = "${nonarch_base_libdir}/firmware/LICENSE.cirrus" + +RDEPENDS:${PN}-cirrus += "${PN}-cirrus-license" + +# For cnm +LICENSE:${PN}-cnm = "Firmware-cnm" +LICENSE:${PN}-cnm-license = "Firmware-cnm" + +FILES:${PN}-cnm = "${nonarch_base_libdir}/firmware/cnm/wave521c_k3_codec_fw.bin" +FILES:${PN}-cnm-license = "${nonarch_base_libdir}/firmware/LICENCE.cnm" + +RDEPENDS:${PN}-cnm += "${PN}-cnm-license" + # For imx-sdma LICENSE:${PN}-imx-sdma-imx6q = "Firmware-imx-sdma_firmware" LICENSE:${PN}-imx-sdma-imx7d = "Firmware-imx-sdma_firmware" @@ -962,10 +1209,26 @@ FILES:${PN}-i915-license = "${nonarch_base_libdir}/firmware/LICENSE.i915" FILES:${PN}-i915 = "${nonarch_base_libdir}/firmware/i915" RDEPENDS:${PN}-i915 = "${PN}-i915-license" +# For ice-enhanced +LICENSE:${PN}-ice-enhanced = "Firmware-ice_enhanced" +LICENSE:${PN}-ice-enhanced-license = "Firmware-ice_enhanced" + +FILES:${PN}-ice-enhanced = " \ + ${nonarch_base_libdir}/firmware/intel/ice/ddp-comms/* \ + ${nonarch_base_libdir}/firmware/intel/ice/ddp-wireless_edge/* \ +" +FILES:${PN}-ice-enhanced-license = " \ + ${nonarch_base_libdir}/firmware/LICENSE.ice_enhanced \ +" +RDEPENDS:${PN}-ice-enhanced = "${PN}-ice-enhanced-license" + LICENSE:${PN}-ice = "Firmware-ice" LICENSE:${PN}-ice-license = "Firmware-ice" FILES:${PN}-ice-license = "${nonarch_base_libdir}/firmware/LICENSE.ice" -FILES:${PN}-ice = "${nonarch_base_libdir}/firmware/intel/ice" +FILES:${PN}-ice = " \ + ${nonarch_base_libdir}/firmware/intel/ice/ddp/* \ + ${nonarch_base_libdir}/firmware/intel/ice/ddp-lag/* \ +" RDEPENDS:${PN}-ice = "${PN}-ice-license" FILES:${PN}-adsp-sst-license = "${nonarch_base_libdir}/firmware/LICENCE.adsp_sst" @@ -983,20 +1246,55 @@ RDEPENDS:${PN}-qat = "${PN}-qat-license" # For QCOM VPU/GPU and SDM845 LICENSE:${PN}-qcom-license = "Firmware-qcom" +LICENSE:${PN}-qcom-yamato-license = "Firmware-qcom-yamato" +LICENSE:${PN}-qcom-venus-1.8 = "Firmware-qcom" +LICENSE:${PN}-qcom-venus-4.2 = "Firmware-qcom" +LICENSE:${PN}-qcom-venus-5.2 = "Firmware-qcom" +LICENSE:${PN}-qcom-venus-5.4 = "Firmware-qcom" +LICENSE:${PN}-qcom-vpu-1.0 = "Firmware-qcom" +LICENSE:${PN}-qcom-vpu-2.0 = "Firmware-qcom" +LICENSE:${PN}-qcom-adreno-a2xx = "Firmware-qcom Firmware-qcom-yamato" +LICENSE:${PN}-qcom-adreno-a3xx = "Firmware-qcom" +LICENSE:${PN}-qcom-adreno-a4xx = "Firmware-qcom" +LICENSE:${PN}-qcom-adreno-a530 = "Firmware-qcom" +LICENSE:${PN}-qcom-adreno-a630 = "Firmware-qcom" +LICENSE:${PN}-qcom-adreno-a650 = "Firmware-qcom" +LICENSE:${PN}-qcom-adreno-a660 = "Firmware-qcom" +LICENSE:${PN}-qcom-apq8016-modem = "Firmware-qcom" +LICENSE:${PN}-qcom-apq8016-wifi = "Firmware-qcom" +LICENSE:${PN}-qcom-apq8096-audio = "Firmware-qcom" +LICENSE:${PN}-qcom-apq8096-adreno = "Firmware-qcom" +LICENSE:${PN}-qcom-apq8096-modem = "Firmware-qcom" +LICENSE:${PN}-qcom-sc8280xp-lenovo-x13s-audio = "Firmware-qcom" +LICENSE:${PN}-qcom-sc8280xp-lenovo-x13s-adreno = "Firmware-qcom" +LICENSE:${PN}-qcom-sc8280xp-lenovo-x13s-compute = "Firmware-qcom" +LICENSE:${PN}-qcom-sc8280xp-lenovo-x13s-sensors = "Firmware-qcom" +LICENSE:${PN}-qcom-sdm845-audio = "Firmware-qcom" +LICENSE:${PN}-qcom-sdm845-adreno = "Firmware-qcom" +LICENSE:${PN}-qcom-sdm845-compute = "Firmware-qcom" +LICENSE:${PN}-qcom-sdm845-modem = "Firmware-qcom" +LICENSE:${PN}-qcom-sm8250-audio = "Firmware-qcom" +LICENSE:${PN}-qcom-sm8250-adreno = "Firmware-qcom" +LICENSE:${PN}-qcom-sm8250-compute = "Firmware-qcom" + FILES:${PN}-qcom-license = "${nonarch_base_libdir}/firmware/LICENSE.qcom ${nonarch_base_libdir}/firmware/qcom/NOTICE.txt" +FILES:${PN}-qcom-yamato-license = "${nonarch_base_libdir}/firmware/LICENSE.qcom_yamato" FILES:${PN}-qcom-venus-1.8 = "${nonarch_base_libdir}/firmware/qcom/venus-1.8/*" FILES:${PN}-qcom-venus-4.2 = "${nonarch_base_libdir}/firmware/qcom/venus-4.2/*" FILES:${PN}-qcom-venus-5.2 = "${nonarch_base_libdir}/firmware/qcom/venus-5.2/*" FILES:${PN}-qcom-venus-5.4 = "${nonarch_base_libdir}/firmware/qcom/venus-5.4/*" FILES:${PN}-qcom-vpu-1.0 = "${nonarch_base_libdir}/firmware/qcom/vpu-1.0/*" FILES:${PN}-qcom-vpu-2.0 = "${nonarch_base_libdir}/firmware/qcom/vpu-2.0/*" -FILES:${PN}-qcom-adreno-a2xx = "${nonarch_base_libdir}/firmware/qcom/leia_*.fw" +FILES:${PN}-qcom-adreno-a2xx = "${nonarch_base_libdir}/firmware/qcom/leia_*.fw ${nonarch_base_libdir}/firmware/qcom/yamato_*.fw" FILES:${PN}-qcom-adreno-a3xx = "${nonarch_base_libdir}/firmware/qcom/a3*_*.fw ${nonarch_base_libdir}/firmware/a300_*.fw" FILES:${PN}-qcom-adreno-a4xx = "${nonarch_base_libdir}/firmware/qcom/a4*_*.fw" -FILES:${PN}-qcom-adreno-a530 = "${nonarch_base_libdir}/firmware/qcom/a530*.* ${nonarch_base_libdir}/firmware/qcom/apq8096/a530*.*" -FILES:${PN}-qcom-adreno-a630 = "${nonarch_base_libdir}/firmware/qcom/a630*.* ${nonarch_base_libdir}/firmware/qcom/sdm845/a630*.*" -FILES:${PN}-qcom-adreno-a650 = "${nonarch_base_libdir}/firmware/qcom/a650*.* ${nonarch_base_libdir}/firmware/qcom/sm8250/a650*.*" +FILES:${PN}-qcom-adreno-a530 = "${nonarch_base_libdir}/firmware/qcom/a530*.fw*" +FILES:${PN}-qcom-adreno-a630 = "${nonarch_base_libdir}/firmware/qcom/a630*.*" +FILES:${PN}-qcom-adreno-a650 = "${nonarch_base_libdir}/firmware/qcom/a650*.*" FILES:${PN}-qcom-adreno-a660 = "${nonarch_base_libdir}/firmware/qcom/a660*.*" +FILES:${PN}-qcom-apq8016-modem = "${nonarch_base_libdir}/firmware/qcom/apq8016/mba.mbn ${nonarch_base_libdir}/firmware/qcom/apq8016/modem.mbn" +FILES:${PN}-qcom-apq8016-wifi = "${nonarch_base_libdir}/firmware/qcom/apq8016/wcnss.mbn ${nonarch_base_libdir}/firmware/qcom/apq8016/WCNSS*" +FILES:${PN}-qcom-apq8096-adreno = "${nonarch_base_libdir}/firmware/qcom/apq8096/a530_zap.mbn ${nonarch_base_libdir}/firmware/qcom/a530_zap.mdt" FILES:${PN}-qcom-apq8096-audio = "${nonarch_base_libdir}/firmware/qcom/apq8096/adsp*.*" FILES:${PN}-qcom-apq8096-modem = "${nonarch_base_libdir}/firmware/qcom/apq8096/mba.mbn ${nonarch_base_libdir}/firmware/qcom/apq8096/modem*.* ${nonarch_base_libdir}/firmware/qcom/apq8096/wlanmdsp.mbn" FILES:${PN}-qcom-sc8280xp-lenovo-x13s-compat = "${nonarch_base_libdir}/firmware/qcom/LENOVO/21BX" @@ -1004,24 +1302,29 @@ FILES:${PN}-qcom-sc8280xp-lenovo-x13s-audio = "${nonarch_base_libdir}/firmware/q FILES:${PN}-qcom-sc8280xp-lenovo-x13s-adreno = "${nonarch_base_libdir}/firmware/qcom/sc8280xp/LENOVO/21BX/qcdxkmsuc8280.mbn" FILES:${PN}-qcom-sc8280xp-lenovo-x13s-compute = "${nonarch_base_libdir}/firmware/qcom/sc8280xp/LENOVO/21BX/*cdsp*.*" FILES:${PN}-qcom-sc8280xp-lenovo-x13s-sensors = "${nonarch_base_libdir}/firmware/qcom/sc8280xp/LENOVO/21BX/*slpi*.*" +FILES:${PN}-qcom-sdm845-adreno = "${nonarch_base_libdir}/firmware/qcom/sdm845/a630*.*" FILES:${PN}-qcom-sdm845-audio = "${nonarch_base_libdir}/firmware/qcom/sdm845/adsp*.*" FILES:${PN}-qcom-sdm845-compute = "${nonarch_base_libdir}/firmware/qcom/sdm845/cdsp*.*" FILES:${PN}-qcom-sdm845-modem = "${nonarch_base_libdir}/firmware/qcom/sdm845/mba.mbn ${nonarch_base_libdir}/firmware/qcom/sdm845/modem*.* ${nonarch_base_libdir}/firmware/qcom/sdm845/wlanmdsp.mbn" +FILES:${PN}-qcom-sm8250-adreno = "${nonarch_base_libdir}/firmware/qcom/sm8250/a650*.*" FILES:${PN}-qcom-sm8250-audio = "${nonarch_base_libdir}/firmware/qcom/sm8250/adsp*.*" FILES:${PN}-qcom-sm8250-compute = "${nonarch_base_libdir}/firmware/qcom/sm8250/cdsp*.*" + RDEPENDS:${PN}-qcom-venus-1.8 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-venus-4.2 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-venus-5.2 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-venus-5.4 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-vpu-1.0 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-vpu-2.0 = "${PN}-qcom-license" -RDEPENDS:${PN}-qcom-adreno-a2xx = "${PN}-qcom-license" +RDEPENDS:${PN}-qcom-adreno-a2xx = "${PN}-qcom-license ${PN}-qcom-yamato-license" RDEPENDS:${PN}-qcom-adreno-a3xx = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-adreno-a4xx = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-adreno-a530 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-adreno-a630 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-adreno-a650 = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-adreno-a660 = "${PN}-qcom-license" +RDEPENDS:${PN}-qcom-apq8016-modem = "${PN}-qcom-license" +RDEPENDS:${PN}-qcom-apq8016-wifi = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-apq8096-audio = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-apq8096-modem = "${PN}-qcom-license" RDEPENDS:${PN}-qcom-sc8280xp-lenovo-x13s-audio = "${PN}-qcom-license" @@ -1059,6 +1362,8 @@ LICENSE:${PN} = "\ & Firmware-ca0132 \ & Firmware-cavium \ & Firmware-chelsio_firmware \ + & Firmware-cirrus \ + & Firmware-cnm \ & Firmware-cw1200 \ & Firmware-dib0700 \ & Firmware-e100 \ diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc new file mode 100644 index 0000000000..c34928e100 --- /dev/null +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -0,0 +1,6 @@ +# https://nvd.nist.gov/vuln/detail/CVE-2022-39188 +# Patched in kernel since v5.19 b67fbebd4cf980aecbcc750e1462128bffe8ae15 +# Backported in version v5.4.212 c9c5501e815132530d741ec9fdd22657f91656bc +# Backported in version v5.10.141 895428ee124ad70b9763259308354877b725c31d +# Backported in version v5.15.65 3ffb97fce282df03723995f5eed6a559d008078e +CVE_CHECK_IGNORE += "CVE-2022-39188" diff --git a/meta/recipes-kernel/linux/cve-exclusion_5.10.inc b/meta/recipes-kernel/linux/cve-exclusion_5.10.inc new file mode 100644 index 0000000000..4d959c90b1 --- /dev/null +++ b/meta/recipes-kernel/linux/cve-exclusion_5.10.inc @@ -0,0 +1,7565 @@ + +# Auto-generated CVE metadata, DO NOT EDIT BY HAND. +# Generated at 2024-02-21 03:55:27.305577 for version 5.10.209 + +python check_kernel_cve_status_version() { + this_version = "5.10.209" + kernel_version = d.getVar("LINUX_VERSION") + if kernel_version != this_version: + bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version)) +} +do_cve_check[prefuncs] += "check_kernel_cve_status_version" + +# fixed-version: Fixed after version 2.6.12rc2 +CVE_CHECK_IGNORE += "CVE-2003-1604" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2004-0230" + +# CVE-2005-3660 has no known resolution + +# fixed-version: Fixed after version 2.6.26rc5 +CVE_CHECK_IGNORE += "CVE-2006-3635" + +# fixed-version: Fixed after version 2.6.19rc3 +CVE_CHECK_IGNORE += "CVE-2006-5331" + +# fixed-version: Fixed after version 2.6.19rc2 +CVE_CHECK_IGNORE += "CVE-2006-6128" + +# CVE-2007-3719 has no known resolution + +# fixed-version: Fixed after version 2.6.12rc2 +CVE_CHECK_IGNORE += "CVE-2007-4774" + +# fixed-version: Fixed after version 2.6.24rc6 +CVE_CHECK_IGNORE += "CVE-2007-6761" + +# fixed-version: Fixed after version 2.6.20rc5 +CVE_CHECK_IGNORE += "CVE-2007-6762" + +# CVE-2008-2544 has no known resolution + +# CVE-2008-4609 has no known resolution + +# fixed-version: Fixed after version 2.6.25rc1 +CVE_CHECK_IGNORE += "CVE-2008-7316" + +# fixed-version: Fixed after version 2.6.31rc6 +CVE_CHECK_IGNORE += "CVE-2009-2692" + +# fixed-version: Fixed after version 2.6.23rc9 +CVE_CHECK_IGNORE += "CVE-2010-0008" + +# fixed-version: Fixed after version 2.6.36rc5 +CVE_CHECK_IGNORE += "CVE-2010-3432" + +# CVE-2010-4563 has no known resolution + +# fixed-version: Fixed after version 2.6.37rc6 +CVE_CHECK_IGNORE += "CVE-2010-4648" + +# fixed-version: Fixed after version 2.6.38rc1 +CVE_CHECK_IGNORE += "CVE-2010-5313" + +# CVE-2010-5321 has no known resolution + +# fixed-version: Fixed after version 2.6.35rc1 +CVE_CHECK_IGNORE += "CVE-2010-5328" + +# fixed-version: Fixed after version 2.6.39rc1 +CVE_CHECK_IGNORE += "CVE-2010-5329" + +# fixed-version: Fixed after version 2.6.34rc7 +CVE_CHECK_IGNORE += "CVE-2010-5331" + +# fixed-version: Fixed after version 2.6.37rc1 +CVE_CHECK_IGNORE += "CVE-2010-5332" + +# fixed-version: Fixed after version 3.2rc1 +CVE_CHECK_IGNORE += "CVE-2011-4098" + +# fixed-version: Fixed after version 3.3rc1 +CVE_CHECK_IGNORE += "CVE-2011-4131" + +# fixed-version: Fixed after version 3.2rc1 +CVE_CHECK_IGNORE += "CVE-2011-4915" + +# CVE-2011-4916 has no known resolution + +# CVE-2011-4917 has no known resolution + +# fixed-version: Fixed after version 3.2rc1 +CVE_CHECK_IGNORE += "CVE-2011-5321" + +# fixed-version: Fixed after version 3.1rc1 +CVE_CHECK_IGNORE += "CVE-2011-5327" + +# fixed-version: Fixed after version 3.7rc2 +CVE_CHECK_IGNORE += "CVE-2012-0957" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-2119" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-2136" + +# fixed-version: Fixed after version 3.5rc2 +CVE_CHECK_IGNORE += "CVE-2012-2137" + +# fixed-version: Fixed after version 3.4rc6 +CVE_CHECK_IGNORE += "CVE-2012-2313" + +# fixed-version: Fixed after version 3.4rc6 +CVE_CHECK_IGNORE += "CVE-2012-2319" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2012-2372" + +# fixed-version: Fixed after version 3.4rc1 +CVE_CHECK_IGNORE += "CVE-2012-2375" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-2390" + +# fixed-version: Fixed after version 3.5rc4 +CVE_CHECK_IGNORE += "CVE-2012-2669" + +# fixed-version: Fixed after version 2.6.34rc1 +CVE_CHECK_IGNORE += "CVE-2012-2744" + +# fixed-version: Fixed after version 3.4rc3 +CVE_CHECK_IGNORE += "CVE-2012-2745" + +# fixed-version: Fixed after version 3.5rc6 +CVE_CHECK_IGNORE += "CVE-2012-3364" + +# fixed-version: Fixed after version 3.4rc5 +CVE_CHECK_IGNORE += "CVE-2012-3375" + +# fixed-version: Fixed after version 3.5rc5 +CVE_CHECK_IGNORE += "CVE-2012-3400" + +# fixed-version: Fixed after version 3.6rc2 +CVE_CHECK_IGNORE += "CVE-2012-3412" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-3430" + +# fixed-version: Fixed after version 2.6.19rc4 +CVE_CHECK_IGNORE += "CVE-2012-3510" + +# fixed-version: Fixed after version 3.5rc6 +CVE_CHECK_IGNORE += "CVE-2012-3511" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-3520" + +# fixed-version: Fixed after version 3.0rc1 +CVE_CHECK_IGNORE += "CVE-2012-3552" + +# Skipping CVE-2012-4220, no affected_versions + +# Skipping CVE-2012-4221, no affected_versions + +# Skipping CVE-2012-4222, no affected_versions + +# fixed-version: Fixed after version 3.4rc1 +CVE_CHECK_IGNORE += "CVE-2012-4398" + +# fixed-version: Fixed after version 2.6.36rc4 +CVE_CHECK_IGNORE += "CVE-2012-4444" + +# fixed-version: Fixed after version 3.7rc6 +CVE_CHECK_IGNORE += "CVE-2012-4461" + +# fixed-version: Fixed after version 3.6rc5 +CVE_CHECK_IGNORE += "CVE-2012-4467" + +# fixed-version: Fixed after version 3.7rc3 +CVE_CHECK_IGNORE += "CVE-2012-4508" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2012-4530" + +# CVE-2012-4542 has no known resolution + +# fixed-version: Fixed after version 3.7rc4 +CVE_CHECK_IGNORE += "CVE-2012-4565" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2012-5374" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2012-5375" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-5517" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2012-6536" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2012-6537" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2012-6538" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6539" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6540" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6541" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6542" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6543" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6544" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6545" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6546" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-6547" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-6548" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-6549" + +# fixed-version: Fixed after version 3.3rc1 +CVE_CHECK_IGNORE += "CVE-2012-6638" + +# fixed-version: Fixed after version 3.6rc2 +CVE_CHECK_IGNORE += "CVE-2012-6647" + +# fixed-version: Fixed after version 3.6 +CVE_CHECK_IGNORE += "CVE-2012-6657" + +# fixed-version: Fixed after version 3.6rc5 +CVE_CHECK_IGNORE += "CVE-2012-6689" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-6701" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2012-6703" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-6704" + +# fixed-version: Fixed after version 3.4rc1 +CVE_CHECK_IGNORE += "CVE-2012-6712" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-0160" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-0190" + +# fixed-version: Fixed after version 3.8rc7 +CVE_CHECK_IGNORE += "CVE-2013-0216" + +# fixed-version: Fixed after version 3.8rc7 +CVE_CHECK_IGNORE += "CVE-2013-0217" + +# fixed-version: Fixed after version 3.8 +CVE_CHECK_IGNORE += "CVE-2013-0228" + +# fixed-version: Fixed after version 3.8rc7 +CVE_CHECK_IGNORE += "CVE-2013-0231" + +# fixed-version: Fixed after version 3.8rc6 +CVE_CHECK_IGNORE += "CVE-2013-0268" + +# fixed-version: Fixed after version 3.8 +CVE_CHECK_IGNORE += "CVE-2013-0290" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2013-0309" + +# fixed-version: Fixed after version 3.5 +CVE_CHECK_IGNORE += "CVE-2013-0310" + +# fixed-version: Fixed after version 3.7rc8 +CVE_CHECK_IGNORE += "CVE-2013-0311" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-0313" + +# fixed-version: Fixed after version 3.11rc7 +CVE_CHECK_IGNORE += "CVE-2013-0343" + +# fixed-version: Fixed after version 3.8rc6 +CVE_CHECK_IGNORE += "CVE-2013-0349" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-0871" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-0913" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-0914" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-1059" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-1763" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-1767" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2013-1772" + +# fixed-version: Fixed after version 3.3rc1 +CVE_CHECK_IGNORE += "CVE-2013-1773" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-1774" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1792" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-1796" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-1797" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-1798" + +# fixed-version: Fixed after version 3.8rc6 +CVE_CHECK_IGNORE += "CVE-2013-1819" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2013-1826" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2013-1827" + +# fixed-version: Fixed after version 3.9rc2 +CVE_CHECK_IGNORE += "CVE-2013-1828" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1848" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1858" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1860" + +# fixed-version: Fixed after version 3.7rc3 +CVE_CHECK_IGNORE += "CVE-2013-1928" + +# fixed-version: Fixed after version 3.9rc6 +CVE_CHECK_IGNORE += "CVE-2013-1929" + +# Skipping CVE-2013-1935, no affected_versions + +# fixed-version: Fixed after version 3.0rc1 +CVE_CHECK_IGNORE += "CVE-2013-1943" + +# fixed-version: Fixed after version 3.9rc5 +CVE_CHECK_IGNORE += "CVE-2013-1956" + +# fixed-version: Fixed after version 3.9rc5 +CVE_CHECK_IGNORE += "CVE-2013-1957" + +# fixed-version: Fixed after version 3.9rc5 +CVE_CHECK_IGNORE += "CVE-2013-1958" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-1959" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-1979" + +# fixed-version: Fixed after version 3.8rc2 +CVE_CHECK_IGNORE += "CVE-2013-2015" + +# fixed-version: Fixed after version 2.6.34 +CVE_CHECK_IGNORE += "CVE-2013-2017" + +# fixed-version: Fixed after version 3.8rc4 +CVE_CHECK_IGNORE += "CVE-2013-2058" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2094" + +# fixed-version: Fixed after version 2.6.34rc4 +CVE_CHECK_IGNORE += "CVE-2013-2128" + +# fixed-version: Fixed after version 3.11rc3 +CVE_CHECK_IGNORE += "CVE-2013-2140" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2141" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2146" + +# fixed-version: Fixed after version 3.12rc3 +CVE_CHECK_IGNORE += "CVE-2013-2147" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-2148" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-2164" + +# Skipping CVE-2013-2188, no affected_versions + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-2206" + +# Skipping CVE-2013-2224, no affected_versions + +# fixed-version: Fixed after version 3.10 +CVE_CHECK_IGNORE += "CVE-2013-2232" + +# fixed-version: Fixed after version 3.10 +CVE_CHECK_IGNORE += "CVE-2013-2234" + +# fixed-version: Fixed after version 3.9rc6 +CVE_CHECK_IGNORE += "CVE-2013-2237" + +# Skipping CVE-2013-2239, no affected_versions + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-2546" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-2547" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-2548" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2596" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-2634" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-2635" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-2636" + +# fixed-version: Fixed after version 3.10rc4 +CVE_CHECK_IGNORE += "CVE-2013-2850" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-2851" + +# fixed-version: Fixed after version 3.10rc6 +CVE_CHECK_IGNORE += "CVE-2013-2852" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2888" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2889" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2890" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2891" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2892" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2893" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2894" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2895" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2896" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2897" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2898" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2899" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-2929" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-2930" + +# fixed-version: Fixed after version 3.9 +CVE_CHECK_IGNORE += "CVE-2013-3076" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3222" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3223" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3224" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3225" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3226" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3227" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3228" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3229" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3230" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3231" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3232" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3233" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3234" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3235" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3236" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3237" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3301" + +# fixed-version: Fixed after version 3.8rc3 +CVE_CHECK_IGNORE += "CVE-2013-3302" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4125" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4127" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4129" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4162" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4163" + +# fixed-version: Fixed after version 3.11rc5 +CVE_CHECK_IGNORE += "CVE-2013-4205" + +# fixed-version: Fixed after version 3.10rc4 +CVE_CHECK_IGNORE += "CVE-2013-4220" + +# fixed-version: Fixed after version 3.10rc5 +CVE_CHECK_IGNORE += "CVE-2013-4247" + +# fixed-version: Fixed after version 3.11rc6 +CVE_CHECK_IGNORE += "CVE-2013-4254" + +# fixed-version: Fixed after version 3.12rc4 +CVE_CHECK_IGNORE += "CVE-2013-4270" + +# fixed-version: Fixed after version 3.12rc6 +CVE_CHECK_IGNORE += "CVE-2013-4299" + +# fixed-version: Fixed after version 3.11 +CVE_CHECK_IGNORE += "CVE-2013-4300" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2013-4312" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-4343" + +# fixed-version: Fixed after version 3.13rc2 +CVE_CHECK_IGNORE += "CVE-2013-4345" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-4348" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-4350" + +# fixed-version: Fixed after version 3.12rc4 +CVE_CHECK_IGNORE += "CVE-2013-4387" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2013-4470" + +# fixed-version: Fixed after version 3.10rc1 +CVE_CHECK_IGNORE += "CVE-2013-4483" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4511" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4512" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4513" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4514" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4515" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4516" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-4563" + +# fixed-version: Fixed after version 3.13rc7 +CVE_CHECK_IGNORE += "CVE-2013-4579" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-4587" + +# fixed-version: Fixed after version 2.6.33rc4 +CVE_CHECK_IGNORE += "CVE-2013-4588" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2013-4591" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2013-4592" + +# Skipping CVE-2013-4737, no affected_versions + +# Skipping CVE-2013-4738, no affected_versions + +# Skipping CVE-2013-4739, no affected_versions + +# fixed-version: Fixed after version 3.10rc5 +CVE_CHECK_IGNORE += "CVE-2013-5634" + +# fixed-version: Fixed after version 3.6rc6 +CVE_CHECK_IGNORE += "CVE-2013-6282" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6367" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6368" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6376" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6378" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6380" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6381" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6382" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-6383" + +# Skipping CVE-2013-6392, no affected_versions + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-6431" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6432" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2013-6885" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7026" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2013-7027" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7263" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7264" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7265" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7266" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7267" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7268" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7269" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7270" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7271" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7281" + +# fixed-version: Fixed after version 3.13rc7 +CVE_CHECK_IGNORE += "CVE-2013-7339" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7348" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2013-7421" + +# CVE-2013-7445 has no known resolution + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2013-7446" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2013-7470" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-0038" + +# fixed-version: Fixed after version 3.14rc5 +CVE_CHECK_IGNORE += "CVE-2014-0049" + +# fixed-version: Fixed after version 3.14 +CVE_CHECK_IGNORE += "CVE-2014-0055" + +# fixed-version: Fixed after version 3.14rc4 +CVE_CHECK_IGNORE += "CVE-2014-0069" + +# fixed-version: Fixed after version 3.14 +CVE_CHECK_IGNORE += "CVE-2014-0077" + +# fixed-version: Fixed after version 3.14rc7 +CVE_CHECK_IGNORE += "CVE-2014-0100" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-0101" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-0102" + +# fixed-version: Fixed after version 3.14rc7 +CVE_CHECK_IGNORE += "CVE-2014-0131" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-0155" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-0181" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-0196" + +# fixed-version: Fixed after version 2.6.33rc5 +CVE_CHECK_IGNORE += "CVE-2014-0203" + +# fixed-version: Fixed after version 2.6.37rc1 +CVE_CHECK_IGNORE += "CVE-2014-0205" + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-0206" + +# Skipping CVE-2014-0972, no affected_versions + +# fixed-version: Fixed after version 3.13 +CVE_CHECK_IGNORE += "CVE-2014-1438" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2014-1444" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2014-1445" + +# fixed-version: Fixed after version 3.13rc7 +CVE_CHECK_IGNORE += "CVE-2014-1446" + +# fixed-version: Fixed after version 3.13rc8 +CVE_CHECK_IGNORE += "CVE-2014-1690" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-1737" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-1738" + +# fixed-version: Fixed after version 3.15rc6 +CVE_CHECK_IGNORE += "CVE-2014-1739" + +# fixed-version: Fixed after version 3.14rc2 +CVE_CHECK_IGNORE += "CVE-2014-1874" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-2038" + +# fixed-version: Fixed after version 3.14rc3 +CVE_CHECK_IGNORE += "CVE-2014-2039" + +# fixed-version: Fixed after version 3.14rc7 +CVE_CHECK_IGNORE += "CVE-2014-2309" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-2523" + +# fixed-version: Fixed after version 3.14 +CVE_CHECK_IGNORE += "CVE-2014-2568" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-2580" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-2672" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-2673" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-2678" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-2706" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-2739" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-2851" + +# fixed-version: Fixed after version 3.2rc7 +CVE_CHECK_IGNORE += "CVE-2014-2889" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-3122" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-3144" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-3145" + +# fixed-version: Fixed after version 3.15 +CVE_CHECK_IGNORE += "CVE-2014-3153" + +# fixed-version: Fixed after version 3.17rc4 +CVE_CHECK_IGNORE += "CVE-2014-3180" + +# fixed-version: Fixed after version 3.17rc3 +CVE_CHECK_IGNORE += "CVE-2014-3181" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3182" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3183" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3184" + +# fixed-version: Fixed after version 3.17rc3 +CVE_CHECK_IGNORE += "CVE-2014-3185" + +# fixed-version: Fixed after version 3.17rc3 +CVE_CHECK_IGNORE += "CVE-2014-3186" + +# Skipping CVE-2014-3519, no affected_versions + +# fixed-version: Fixed after version 3.16rc7 +CVE_CHECK_IGNORE += "CVE-2014-3534" + +# fixed-version: Fixed after version 2.6.36rc1 +CVE_CHECK_IGNORE += "CVE-2014-3535" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3601" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3610" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3611" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-3631" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2014-3645" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3646" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3647" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3673" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3687" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3688" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3690" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-3917" + +# fixed-version: Fixed after version 3.15 +CVE_CHECK_IGNORE += "CVE-2014-3940" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-4014" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-4027" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-4157" + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-4171" + +# Skipping CVE-2014-4322, no affected_versions + +# Skipping CVE-2014-4323, no affected_versions + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-4508" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-4608" + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-4611" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4652" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4653" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4654" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4655" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4656" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-4667" + +# fixed-version: Fixed after version 3.16rc4 +CVE_CHECK_IGNORE += "CVE-2014-4699" + +# fixed-version: Fixed after version 3.16rc6 +CVE_CHECK_IGNORE += "CVE-2014-4943" + +# fixed-version: Fixed after version 3.16rc7 +CVE_CHECK_IGNORE += "CVE-2014-5045" + +# fixed-version: Fixed after version 3.16 +CVE_CHECK_IGNORE += "CVE-2014-5077" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2014-5206" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2014-5207" + +# Skipping CVE-2014-5332, no affected_versions + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-5471" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-5472" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6410" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6416" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6417" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6418" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-7145" + +# Skipping CVE-2014-7207, no affected_versions + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-7283" + +# fixed-version: Fixed after version 3.15rc7 +CVE_CHECK_IGNORE += "CVE-2014-7284" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-7822" + +# fixed-version: Fixed after version 3.18rc3 +CVE_CHECK_IGNORE += "CVE-2014-7825" + +# fixed-version: Fixed after version 3.18rc3 +CVE_CHECK_IGNORE += "CVE-2014-7826" + +# fixed-version: Fixed after version 3.18rc5 +CVE_CHECK_IGNORE += "CVE-2014-7841" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-7842" + +# fixed-version: Fixed after version 3.18rc5 +CVE_CHECK_IGNORE += "CVE-2014-7843" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-7970" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-7975" + +# fixed-version: Fixed after version 3.18rc3 +CVE_CHECK_IGNORE += "CVE-2014-8086" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8133" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8134" + +# fixed-version: Fixed after version 4.0rc7 +CVE_CHECK_IGNORE += "CVE-2014-8159" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-8160" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2014-8171" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2014-8172" + +# fixed-version: Fixed after version 3.13rc5 +CVE_CHECK_IGNORE += "CVE-2014-8173" + +# Skipping CVE-2014-8181, no affected_versions + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-8369" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-8480" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-8481" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8559" + +# fixed-version: Fixed after version 3.14rc3 +CVE_CHECK_IGNORE += "CVE-2014-8709" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-8884" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8989" + +# fixed-version: Fixed after version 3.18rc6 +CVE_CHECK_IGNORE += "CVE-2014-9090" + +# fixed-version: Fixed after version 3.18rc6 +CVE_CHECK_IGNORE += "CVE-2014-9322" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9419" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9420" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9428" + +# fixed-version: Fixed after version 3.19rc4 +CVE_CHECK_IGNORE += "CVE-2014-9529" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9584" + +# fixed-version: Fixed after version 3.19rc4 +CVE_CHECK_IGNORE += "CVE-2014-9585" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9644" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9683" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9710" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-9715" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2014-9717" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9728" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9729" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9730" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9731" + +# Skipping CVE-2014-9777, no affected_versions + +# Skipping CVE-2014-9778, no affected_versions + +# Skipping CVE-2014-9779, no affected_versions + +# Skipping CVE-2014-9780, no affected_versions + +# Skipping CVE-2014-9781, no affected_versions + +# Skipping CVE-2014-9782, no affected_versions + +# Skipping CVE-2014-9783, no affected_versions + +# Skipping CVE-2014-9784, no affected_versions + +# Skipping CVE-2014-9785, no affected_versions + +# Skipping CVE-2014-9786, no affected_versions + +# Skipping CVE-2014-9787, no affected_versions + +# Skipping CVE-2014-9788, no affected_versions + +# Skipping CVE-2014-9789, no affected_versions + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-9803" + +# Skipping CVE-2014-9863, no affected_versions + +# Skipping CVE-2014-9864, no affected_versions + +# Skipping CVE-2014-9865, no affected_versions + +# Skipping CVE-2014-9866, no affected_versions + +# Skipping CVE-2014-9867, no affected_versions + +# Skipping CVE-2014-9868, no affected_versions + +# Skipping CVE-2014-9869, no affected_versions + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2014-9870" + +# Skipping CVE-2014-9871, no affected_versions + +# Skipping CVE-2014-9872, no affected_versions + +# Skipping CVE-2014-9873, no affected_versions + +# Skipping CVE-2014-9874, no affected_versions + +# Skipping CVE-2014-9875, no affected_versions + +# Skipping CVE-2014-9876, no affected_versions + +# Skipping CVE-2014-9877, no affected_versions + +# Skipping CVE-2014-9878, no affected_versions + +# Skipping CVE-2014-9879, no affected_versions + +# Skipping CVE-2014-9880, no affected_versions + +# Skipping CVE-2014-9881, no affected_versions + +# Skipping CVE-2014-9882, no affected_versions + +# Skipping CVE-2014-9883, no affected_versions + +# Skipping CVE-2014-9884, no affected_versions + +# Skipping CVE-2014-9885, no affected_versions + +# Skipping CVE-2014-9886, no affected_versions + +# Skipping CVE-2014-9887, no affected_versions + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2014-9888" + +# Skipping CVE-2014-9889, no affected_versions + +# Skipping CVE-2014-9890, no affected_versions + +# Skipping CVE-2014-9891, no affected_versions + +# Skipping CVE-2014-9892, no affected_versions + +# Skipping CVE-2014-9893, no affected_versions + +# Skipping CVE-2014-9894, no affected_versions + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2014-9895" + +# Skipping CVE-2014-9896, no affected_versions + +# Skipping CVE-2014-9897, no affected_versions + +# Skipping CVE-2014-9898, no affected_versions + +# Skipping CVE-2014-9899, no affected_versions + +# Skipping CVE-2014-9900, no affected_versions + +# fixed-version: Fixed after version 3.14rc4 +CVE_CHECK_IGNORE += "CVE-2014-9903" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2014-9904" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-9914" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-9922" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9940" + +# fixed-version: Fixed after version 3.19rc6 +CVE_CHECK_IGNORE += "CVE-2015-0239" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2015-0274" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-0275" + +# Skipping CVE-2015-0777, no affected_versions + +# Skipping CVE-2015-1328, no affected_versions + +# fixed-version: Fixed after version 4.2rc5 +CVE_CHECK_IGNORE += "CVE-2015-1333" + +# fixed-version: Fixed after version 4.4rc5 +CVE_CHECK_IGNORE += "CVE-2015-1339" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2015-1350" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-1420" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-1421" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-1465" + +# fixed-version: Fixed after version 3.19rc5 +CVE_CHECK_IGNORE += "CVE-2015-1573" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-1593" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2015-1805" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-2041" + +# fixed-version: Fixed after version 3.19 +CVE_CHECK_IGNORE += "CVE-2015-2042" + +# fixed-version: Fixed after version 4.0rc4 +CVE_CHECK_IGNORE += "CVE-2015-2150" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-2666" + +# fixed-version: Fixed after version 4.0rc3 +CVE_CHECK_IGNORE += "CVE-2015-2672" + +# fixed-version: Fixed after version 4.0rc6 +CVE_CHECK_IGNORE += "CVE-2015-2686" + +# fixed-version: Fixed after version 4.0rc3 +CVE_CHECK_IGNORE += "CVE-2015-2830" + +# CVE-2015-2877 has no known resolution + +# fixed-version: Fixed after version 4.0rc7 +CVE_CHECK_IGNORE += "CVE-2015-2922" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-2925" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-3212" + +# fixed-version: Fixed after version 2.6.33rc8 +CVE_CHECK_IGNORE += "CVE-2015-3214" + +# fixed-version: Fixed after version 4.2rc2 +CVE_CHECK_IGNORE += "CVE-2015-3288" + +# fixed-version: Fixed after version 4.2rc3 +CVE_CHECK_IGNORE += "CVE-2015-3290" + +# fixed-version: Fixed after version 4.2rc3 +CVE_CHECK_IGNORE += "CVE-2015-3291" + +# fixed-version: Fixed after version 4.0rc5 +CVE_CHECK_IGNORE += "CVE-2015-3331" + +# Skipping CVE-2015-3332, no affected_versions + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-3339" + +# fixed-version: Fixed after version 4.1rc2 +CVE_CHECK_IGNORE += "CVE-2015-3636" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-4001" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-4002" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-4003" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-4004" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-4036" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-4167" + +# fixed-version: Fixed after version 3.13rc5 +CVE_CHECK_IGNORE += "CVE-2015-4170" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-4176" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-4177" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-4178" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-4692" + +# fixed-version: Fixed after version 4.1rc6 +CVE_CHECK_IGNORE += "CVE-2015-4700" + +# fixed-version: Fixed after version 4.2rc7 +CVE_CHECK_IGNORE += "CVE-2015-5156" + +# fixed-version: Fixed after version 4.2rc3 +CVE_CHECK_IGNORE += "CVE-2015-5157" + +# fixed-version: Fixed after version 4.3rc3 +CVE_CHECK_IGNORE += "CVE-2015-5257" + +# fixed-version: Fixed after version 4.3rc3 +CVE_CHECK_IGNORE += "CVE-2015-5283" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-5307" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-5327" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-5364" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-5366" + +# fixed-version: Fixed after version 4.2rc6 +CVE_CHECK_IGNORE += "CVE-2015-5697" + +# fixed-version: Fixed after version 4.1rc3 +CVE_CHECK_IGNORE += "CVE-2015-5706" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-5707" + +# fixed-version: Fixed after version 4.2rc5 +CVE_CHECK_IGNORE += "CVE-2015-6252" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-6526" + +# CVE-2015-6619 has no known resolution + +# CVE-2015-6646 has no known resolution + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-6937" + +# Skipping CVE-2015-7312, no affected_versions + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2015-7509" + +# fixed-version: Fixed after version 4.4rc7 +CVE_CHECK_IGNORE += "CVE-2015-7513" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-7515" + +# fixed-version: Fixed after version 4.4rc8 +CVE_CHECK_IGNORE += "CVE-2015-7550" + +# Skipping CVE-2015-7553, no affected_versions + +# fixed-version: Fixed after version 4.5rc2 +CVE_CHECK_IGNORE += "CVE-2015-7566" + +# fixed-version: Fixed after version 4.3rc4 +CVE_CHECK_IGNORE += "CVE-2015-7613" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-7799" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2015-7833" + +# Skipping CVE-2015-7837, no affected_versions + +# fixed-version: Fixed after version 4.3rc7 +CVE_CHECK_IGNORE += "CVE-2015-7872" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-7884" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-7885" + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2015-7990" + +# Skipping CVE-2015-8019, no affected_versions + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8104" + +# fixed-version: Fixed after version 4.0rc3 +CVE_CHECK_IGNORE += "CVE-2015-8215" + +# fixed-version: Fixed after version 2.6.34rc1 +CVE_CHECK_IGNORE += "CVE-2015-8324" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8374" + +# fixed-version: Fixed after version 4.4rc3 +CVE_CHECK_IGNORE += "CVE-2015-8539" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8543" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8550" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8551" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8552" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8553" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8569" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8575" + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2015-8660" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2015-8709" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-8746" + +# fixed-version: Fixed after version 4.3rc4 +CVE_CHECK_IGNORE += "CVE-2015-8767" + +# fixed-version: Fixed after version 4.4rc5 +CVE_CHECK_IGNORE += "CVE-2015-8785" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8787" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8812" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8816" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-8830" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8839" + +# fixed-version: Fixed after version 4.4rc3 +CVE_CHECK_IGNORE += "CVE-2015-8844" + +# fixed-version: Fixed after version 4.4rc3 +CVE_CHECK_IGNORE += "CVE-2015-8845" + +# Skipping CVE-2015-8937, no affected_versions + +# Skipping CVE-2015-8938, no affected_versions + +# Skipping CVE-2015-8939, no affected_versions + +# Skipping CVE-2015-8940, no affected_versions + +# Skipping CVE-2015-8941, no affected_versions + +# Skipping CVE-2015-8942, no affected_versions + +# Skipping CVE-2015-8943, no affected_versions + +# Skipping CVE-2015-8944, no affected_versions + +# fixed-version: Fixed after version 4.1rc2 +CVE_CHECK_IGNORE += "CVE-2015-8950" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2015-8952" + +# fixed-version: Fixed after version 4.3 +CVE_CHECK_IGNORE += "CVE-2015-8953" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-8955" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-8956" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8961" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8962" + +# fixed-version: Fixed after version 4.4 +CVE_CHECK_IGNORE += "CVE-2015-8963" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8964" + +# fixed-version: Fixed after version 4.4rc8 +CVE_CHECK_IGNORE += "CVE-2015-8966" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-8967" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8970" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-9004" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-9016" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-9289" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-0617" + +# fixed-version: Fixed after version 4.5rc2 +CVE_CHECK_IGNORE += "CVE-2016-0723" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-0728" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-0758" + +# Skipping CVE-2016-0774, no affected_versions + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2016-0821" + +# fixed-version: Fixed after version 4.0rc5 +CVE_CHECK_IGNORE += "CVE-2016-0823" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2016-10044" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10088" + +# fixed-version: Fixed after version 4.9 +CVE_CHECK_IGNORE += "CVE-2016-10147" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-10150" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10153" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10154" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-10200" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10208" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-10229" + +# fixed-version: Fixed after version 4.8rc6 +CVE_CHECK_IGNORE += "CVE-2016-10318" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2016-10723" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10741" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10764" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-10905" + +# fixed-version: Fixed after version 4.5rc6 +CVE_CHECK_IGNORE += "CVE-2016-10906" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-10907" + +# fixed-version: Fixed after version 4.7rc5 +CVE_CHECK_IGNORE += "CVE-2016-1237" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-1575" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-1576" + +# fixed-version: Fixed after version 4.7rc3 +CVE_CHECK_IGNORE += "CVE-2016-1583" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2016-2053" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2069" + +# fixed-version: Fixed after version 4.4 +CVE_CHECK_IGNORE += "CVE-2016-2070" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2085" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-2117" + +# fixed-version: Fixed after version 4.5 +CVE_CHECK_IGNORE += "CVE-2016-2143" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-2184" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-2185" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-2186" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-2187" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2016-2188" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2383" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2384" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2543" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2544" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2545" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2546" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2547" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2548" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2549" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2550" + +# fixed-version: Fixed after version 4.5rc2 +CVE_CHECK_IGNORE += "CVE-2016-2782" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2847" + +# Skipping CVE-2016-2853, no affected_versions + +# Skipping CVE-2016-2854, no affected_versions + +# fixed-version: Fixed after version 4.5 +CVE_CHECK_IGNORE += "CVE-2016-3044" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2016-3070" + +# fixed-version: Fixed after version 4.6rc2 +CVE_CHECK_IGNORE += "CVE-2016-3134" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3135" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3136" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3137" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3138" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2016-3139" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3140" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3156" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3157" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3672" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3689" + +# Skipping CVE-2016-3695, no affected_versions + +# Skipping CVE-2016-3699, no affected_versions + +# Skipping CVE-2016-3707, no affected_versions + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-3713" + +# CVE-2016-3775 has no known resolution + +# CVE-2016-3802 has no known resolution + +# CVE-2016-3803 has no known resolution + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2016-3841" + +# fixed-version: Fixed after version 4.8rc2 +CVE_CHECK_IGNORE += "CVE-2016-3857" + +# fixed-version: Fixed after version 4.5 +CVE_CHECK_IGNORE += "CVE-2016-3951" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3955" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-3961" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4440" + +# fixed-version: Fixed after version 4.7rc4 +CVE_CHECK_IGNORE += "CVE-2016-4470" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4482" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4485" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4486" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-4557" + +# fixed-version: Fixed after version 4.6rc7 +CVE_CHECK_IGNORE += "CVE-2016-4558" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-4565" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-4568" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4569" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4578" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4580" + +# fixed-version: Fixed after version 4.6rc7 +CVE_CHECK_IGNORE += "CVE-2016-4581" + +# fixed-version: Fixed after version 4.7rc4 +CVE_CHECK_IGNORE += "CVE-2016-4794" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-4805" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4913" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4951" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4997" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4998" + +# fixed-version: Fixed after version 4.9rc2 +CVE_CHECK_IGNORE += "CVE-2016-5195" + +# fixed-version: Fixed after version 4.7rc3 +CVE_CHECK_IGNORE += "CVE-2016-5243" + +# fixed-version: Fixed after version 4.7rc3 +CVE_CHECK_IGNORE += "CVE-2016-5244" + +# Skipping CVE-2016-5340, no affected_versions + +# Skipping CVE-2016-5342, no affected_versions + +# Skipping CVE-2016-5343, no affected_versions + +# Skipping CVE-2016-5344, no affected_versions + +# fixed-version: Fixed after version 4.7 +CVE_CHECK_IGNORE += "CVE-2016-5400" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-5412" + +# fixed-version: Fixed after version 4.7 +CVE_CHECK_IGNORE += "CVE-2016-5696" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-5728" + +# fixed-version: Fixed after version 4.7rc6 +CVE_CHECK_IGNORE += "CVE-2016-5828" + +# fixed-version: Fixed after version 4.7rc5 +CVE_CHECK_IGNORE += "CVE-2016-5829" + +# CVE-2016-5870 has no known resolution + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-6130" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-6136" + +# fixed-version: Fixed after version 4.7rc7 +CVE_CHECK_IGNORE += "CVE-2016-6156" + +# fixed-version: Fixed after version 4.7 +CVE_CHECK_IGNORE += "CVE-2016-6162" + +# fixed-version: Fixed after version 4.7rc7 +CVE_CHECK_IGNORE += "CVE-2016-6187" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-6197" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-6198" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-6213" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-6327" + +# fixed-version: Fixed after version 4.8rc3 +CVE_CHECK_IGNORE += "CVE-2016-6480" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-6516" + +# Skipping CVE-2016-6753, no affected_versions + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2016-6786" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2016-6787" + +# fixed-version: Fixed after version 4.8rc5 +CVE_CHECK_IGNORE += "CVE-2016-6828" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-7039" + +# fixed-version: Fixed after version 4.9rc3 +CVE_CHECK_IGNORE += "CVE-2016-7042" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-7097" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-7117" + +# Skipping CVE-2016-7118, no affected_versions + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-7425" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-7910" + +# fixed-version: Fixed after version 4.7rc7 +CVE_CHECK_IGNORE += "CVE-2016-7911" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-7912" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-7913" + +# fixed-version: Fixed after version 4.6rc4 +CVE_CHECK_IGNORE += "CVE-2016-7914" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-7915" + +# fixed-version: Fixed after version 4.6rc7 +CVE_CHECK_IGNORE += "CVE-2016-7916" + +# fixed-version: Fixed after version 4.5rc6 +CVE_CHECK_IGNORE += "CVE-2016-7917" + +# fixed-version: Fixed after version 4.9 +CVE_CHECK_IGNORE += "CVE-2016-8399" + +# Skipping CVE-2016-8401, no affected_versions + +# Skipping CVE-2016-8402, no affected_versions + +# Skipping CVE-2016-8403, no affected_versions + +# Skipping CVE-2016-8404, no affected_versions + +# fixed-version: Fixed after version 4.10rc6 +CVE_CHECK_IGNORE += "CVE-2016-8405" + +# Skipping CVE-2016-8406, no affected_versions + +# Skipping CVE-2016-8407, no affected_versions + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-8630" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-8632" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-8633" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2016-8636" + +# fixed-version: Fixed after version 4.9rc6 +CVE_CHECK_IGNORE += "CVE-2016-8645" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2016-8646" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-8650" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-8655" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2016-8658" + +# CVE-2016-8660 has no known resolution + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-8666" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-9083" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-9084" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-9120" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2016-9178" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2016-9191" + +# fixed-version: Fixed after version 4.9rc3 +CVE_CHECK_IGNORE += "CVE-2016-9313" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-9555" + +# fixed-version: Fixed after version 4.9 +CVE_CHECK_IGNORE += "CVE-2016-9576" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-9588" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2016-9604" + +# Skipping CVE-2016-9644, no affected_versions + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-9685" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-9754" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-9755" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-9756" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-9777" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-9793" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-9794" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-9806" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-9919" + +# Skipping CVE-2017-0403, no affected_versions + +# Skipping CVE-2017-0404, no affected_versions + +# Skipping CVE-2017-0426, no affected_versions + +# Skipping CVE-2017-0427, no affected_versions + +# CVE-2017-0507 has no known resolution + +# CVE-2017-0508 has no known resolution + +# Skipping CVE-2017-0510, no affected_versions + +# Skipping CVE-2017-0528, no affected_versions + +# Skipping CVE-2017-0537, no affected_versions + +# CVE-2017-0564 has no known resolution + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-0605" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-0627" + +# CVE-2017-0630 has no known resolution + +# CVE-2017-0749 has no known resolution + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2017-0750" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-0786" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-0861" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000111" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000112" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000251" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000252" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000253" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000255" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-1000363" + +# fixed-version: Fixed after version 4.12rc6 +CVE_CHECK_IGNORE += "CVE-2017-1000364" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-1000365" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000370" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000371" + +# fixed-version: Fixed after version 4.12rc6 +CVE_CHECK_IGNORE += "CVE-2017-1000379" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000380" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2017-1000405" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-1000407" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-1000410" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-10661" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-10662" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-10663" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-10810" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-10911" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-11089" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-11176" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-11472" + +# fixed-version: Fixed after version 4.13rc2 +CVE_CHECK_IGNORE += "CVE-2017-11473" + +# fixed-version: Fixed after version 4.13 +CVE_CHECK_IGNORE += "CVE-2017-11600" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2017-12134" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-12146" + +# fixed-version: Fixed after version 4.14rc2 +CVE_CHECK_IGNORE += "CVE-2017-12153" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-12154" + +# fixed-version: Fixed after version 4.9rc6 +CVE_CHECK_IGNORE += "CVE-2017-12168" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-12188" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-12190" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-12192" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-12193" + +# fixed-version: Fixed after version 4.13rc4 +CVE_CHECK_IGNORE += "CVE-2017-12762" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-13080" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-13166" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2017-13167" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2017-13168" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2017-13215" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-13216" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2017-13220" + +# CVE-2017-13221 has no known resolution + +# CVE-2017-13222 has no known resolution + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-13305" + +# fixed-version: Fixed after version 4.13rc7 +CVE_CHECK_IGNORE += "CVE-2017-13686" + +# CVE-2017-13693 has no known resolution + +# CVE-2017-13694 has no known resolution + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2017-13695" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2017-13715" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-14051" + +# fixed-version: Fixed after version 4.12rc3 +CVE_CHECK_IGNORE += "CVE-2017-14106" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2017-14140" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-14156" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-14340" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-14489" + +# fixed-version: Fixed after version 4.13 +CVE_CHECK_IGNORE += "CVE-2017-14497" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-14954" + +# fixed-version: Fixed after version 4.14rc2 +CVE_CHECK_IGNORE += "CVE-2017-14991" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2017-15102" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-15115" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2017-15116" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-15121" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-15126" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-15127" + +# fixed-version: Fixed after version 4.14rc8 +CVE_CHECK_IGNORE += "CVE-2017-15128" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-15129" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-15265" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-15274" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-15299" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-15306" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-15537" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-15649" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2017-15868" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-15951" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16525" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16526" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16527" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-16528" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16529" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16530" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16531" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16532" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16533" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16534" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-16535" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16536" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16537" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-16538" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-16643" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-16644" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-16645" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16646" + +# fixed-version: Fixed after version 4.14 +CVE_CHECK_IGNORE += "CVE-2017-16647" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16648" + +# fixed-version: Fixed after version 4.14 +CVE_CHECK_IGNORE += "CVE-2017-16649" + +# fixed-version: Fixed after version 4.14 +CVE_CHECK_IGNORE += "CVE-2017-16650" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16911" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16912" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16913" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16914" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-16939" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16994" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-16995" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-16996" + +# fixed-version: Fixed after version 4.13rc7 +CVE_CHECK_IGNORE += "CVE-2017-17052" + +# fixed-version: Fixed after version 4.13rc7 +CVE_CHECK_IGNORE += "CVE-2017-17053" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17448" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17449" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17450" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17558" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17712" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17741" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17805" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17806" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-17807" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17852" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17853" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17854" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17855" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17856" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17857" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-17862" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17863" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17864" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2017-17975" + +# fixed-version: Fixed after version 4.11rc7 +CVE_CHECK_IGNORE += "CVE-2017-18017" + +# fixed-version: Fixed after version 4.15rc7 +CVE_CHECK_IGNORE += "CVE-2017-18075" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18079" + +# CVE-2017-18169 has no known resolution + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2017-18174" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18193" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-18200" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2017-18202" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18203" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18204" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2017-18208" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18216" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18218" + +# fixed-version: Fixed after version 4.12rc4 +CVE_CHECK_IGNORE += "CVE-2017-18221" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-18222" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18224" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-18232" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18241" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-18249" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18255" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18257" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2017-18261" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-18270" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-18344" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-18360" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-18379" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18509" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18549" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18550" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2017-18551" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18552" + +# fixed-version: Fixed after version 4.15rc6 +CVE_CHECK_IGNORE += "CVE-2017-18595" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-2583" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-2584" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-2596" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-2618" + +# fixed-version: Fixed after version 2.6.25rc1 +CVE_CHECK_IGNORE += "CVE-2017-2634" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-2636" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2017-2647" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-2671" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-5123" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5546" + +# fixed-version: Fixed after version 4.10rc5 +CVE_CHECK_IGNORE += "CVE-2017-5547" + +# fixed-version: Fixed after version 4.10rc5 +CVE_CHECK_IGNORE += "CVE-2017-5548" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5549" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5550" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5551" + +# fixed-version: Fixed after version 4.10rc6 +CVE_CHECK_IGNORE += "CVE-2017-5576" + +# fixed-version: Fixed after version 4.10rc6 +CVE_CHECK_IGNORE += "CVE-2017-5577" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-5669" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-5715" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-5753" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-5754" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-5897" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-5967" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-5970" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2017-5972" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-5986" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-6001" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6074" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-6214" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6345" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6346" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-6347" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6348" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-6353" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-6874" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2017-6951" + +# fixed-version: Fixed after version 4.11rc5 +CVE_CHECK_IGNORE += "CVE-2017-7184" + +# fixed-version: Fixed after version 4.11rc5 +CVE_CHECK_IGNORE += "CVE-2017-7187" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7261" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-7273" + +# fixed-version: Fixed after version 4.11rc4 +CVE_CHECK_IGNORE += "CVE-2017-7277" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7294" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7308" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-7346" + +# CVE-2017-7369 has no known resolution + +# fixed-version: Fixed after version 4.11rc4 +CVE_CHECK_IGNORE += "CVE-2017-7374" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2017-7472" + +# fixed-version: Fixed after version 4.11 +CVE_CHECK_IGNORE += "CVE-2017-7477" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-7482" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-7487" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2017-7495" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-7518" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-7533" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-7541" + +# fixed-version: Fixed after version 4.13rc2 +CVE_CHECK_IGNORE += "CVE-2017-7542" + +# fixed-version: Fixed after version 4.13 +CVE_CHECK_IGNORE += "CVE-2017-7558" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7616" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2017-7618" + +# fixed-version: Fixed after version 4.11 +CVE_CHECK_IGNORE += "CVE-2017-7645" + +# fixed-version: Fixed after version 4.11rc7 +CVE_CHECK_IGNORE += "CVE-2017-7889" + +# fixed-version: Fixed after version 4.11 +CVE_CHECK_IGNORE += "CVE-2017-7895" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2017-7979" + +# fixed-version: Fixed after version 4.11rc4 +CVE_CHECK_IGNORE += "CVE-2017-8061" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-8062" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8063" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8064" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8065" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8066" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8067" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-8068" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-8069" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-8070" + +# fixed-version: Fixed after version 4.10rc7 +CVE_CHECK_IGNORE += "CVE-2017-8071" + +# fixed-version: Fixed after version 4.10rc7 +CVE_CHECK_IGNORE += "CVE-2017-8072" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-8106" + +# fixed-version: Fixed after version 3.19rc6 +CVE_CHECK_IGNORE += "CVE-2017-8240" + +# CVE-2017-8242 has no known resolution + +# CVE-2017-8244 has no known resolution + +# CVE-2017-8245 has no known resolution + +# CVE-2017-8246 has no known resolution + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-8797" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-8824" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-8831" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-8890" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-8924" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-8925" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-9059" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9074" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9075" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9076" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9077" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-9150" + +# fixed-version: Fixed after version 4.12rc3 +CVE_CHECK_IGNORE += "CVE-2017-9211" + +# fixed-version: Fixed after version 4.12rc3 +CVE_CHECK_IGNORE += "CVE-2017-9242" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-9605" + +# fixed-version: Fixed after version 4.3rc7 +CVE_CHECK_IGNORE += "CVE-2017-9725" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-9984" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-9985" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-9986" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2018-1000004" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-1000026" + +# fixed-version: Fixed after version 4.15 +CVE_CHECK_IGNORE += "CVE-2018-1000028" + +# fixed-version: Fixed after version 4.16 +CVE_CHECK_IGNORE += "CVE-2018-1000199" + +# fixed-version: Fixed after version 4.17rc5 +CVE_CHECK_IGNORE += "CVE-2018-1000200" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-1000204" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-10021" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-10074" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2018-10087" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2018-10124" + +# fixed-version: Fixed after version 4.17rc4 +CVE_CHECK_IGNORE += "CVE-2018-10322" + +# fixed-version: Fixed after version 4.17rc4 +CVE_CHECK_IGNORE += "CVE-2018-10323" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2018-1065" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2018-1066" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2018-10675" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-1068" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-10840" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-10853" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-1087" + +# CVE-2018-10872 has no known resolution + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10876" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10877" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10878" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10879" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10880" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10881" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10882" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10883" + +# fixed-version: Fixed after version 2.6.36rc1 +CVE_CHECK_IGNORE += "CVE-2018-10901" + +# fixed-version: Fixed after version 4.18rc6 +CVE_CHECK_IGNORE += "CVE-2018-10902" + +# fixed-version: Fixed after version 4.14rc2 +CVE_CHECK_IGNORE += "CVE-2018-1091" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1092" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1093" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2018-10938" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1094" + +# fixed-version: Fixed after version 4.17rc3 +CVE_CHECK_IGNORE += "CVE-2018-10940" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1095" + +# fixed-version: Fixed after version 4.17rc2 +CVE_CHECK_IGNORE += "CVE-2018-1108" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-1118" + +# fixed-version: Fixed after version 4.17rc6 +CVE_CHECK_IGNORE += "CVE-2018-1120" + +# CVE-2018-1121 has no known resolution + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2018-11232" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-1128" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-1129" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-1130" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-11412" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-11506" + +# fixed-version: Fixed after version 4.17rc5 +CVE_CHECK_IGNORE += "CVE-2018-11508" + +# CVE-2018-11987 has no known resolution + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2018-12126" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2018-12127" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2018-12130" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2018-12207" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-12232" + +# fixed-version: Fixed after version 4.18rc2 +CVE_CHECK_IGNORE += "CVE-2018-12233" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-12633" + +# fixed-version: Fixed after version 4.18rc2 +CVE_CHECK_IGNORE += "CVE-2018-12714" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-12896" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-12904" + +# CVE-2018-12928 has no known resolution + +# CVE-2018-12929 has no known resolution + +# CVE-2018-12930 has no known resolution + +# CVE-2018-12931 has no known resolution + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13053" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-13093" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-13094" + +# fixed-version: Fixed after version 4.18rc3 +CVE_CHECK_IGNORE += "CVE-2018-13095" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13096" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13097" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13098" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13099" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13100" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-13405" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-13406" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14609" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14610" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14611" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14612" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14613" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14614" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14615" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14616" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14617" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2018-14619" + +# fixed-version: Fixed after version 4.20rc6 +CVE_CHECK_IGNORE += "CVE-2018-14625" + +# fixed-version: Fixed after version 4.19rc6 +CVE_CHECK_IGNORE += "CVE-2018-14633" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2018-14634" + +# fixed-version: Fixed after version 4.19rc4 +CVE_CHECK_IGNORE += "CVE-2018-14641" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-14646" + +# fixed-version: Fixed after version 4.19rc2 +CVE_CHECK_IGNORE += "CVE-2018-14656" + +# fixed-version: Fixed after version 4.18rc8 +CVE_CHECK_IGNORE += "CVE-2018-14678" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-14734" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-15471" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-15572" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-15594" + +# fixed-version: Fixed after version 4.18rc5 +CVE_CHECK_IGNORE += "CVE-2018-16276" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2018-16597" + +# fixed-version: Fixed after version 4.19rc2 +CVE_CHECK_IGNORE += "CVE-2018-16658" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-16862" + +# fixed-version: Fixed after version 4.20rc3 +CVE_CHECK_IGNORE += "CVE-2018-16871" + +# fixed-version: Fixed after version 5.0rc5 +CVE_CHECK_IGNORE += "CVE-2018-16880" + +# fixed-version: Fixed after version 4.20 +CVE_CHECK_IGNORE += "CVE-2018-16882" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2018-16884" + +# CVE-2018-16885 has no known resolution + +# fixed-version: Fixed after version 4.19rc4 +CVE_CHECK_IGNORE += "CVE-2018-17182" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-17972" + +# CVE-2018-17977 has no known resolution + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-18021" + +# fixed-version: Fixed after version 4.19 +CVE_CHECK_IGNORE += "CVE-2018-18281" + +# fixed-version: Fixed after version 4.15rc6 +CVE_CHECK_IGNORE += "CVE-2018-18386" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-18397" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-18445" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-18559" + +# CVE-2018-18653 has no known resolution + +# fixed-version: Fixed after version 4.17rc4 +CVE_CHECK_IGNORE += "CVE-2018-18690" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2018-18710" + +# fixed-version: Fixed after version 4.20rc2 +CVE_CHECK_IGNORE += "CVE-2018-18955" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-19406" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-19407" + +# fixed-version: Fixed after version 4.20rc6 +CVE_CHECK_IGNORE += "CVE-2018-19824" + +# fixed-version: Fixed after version 4.20rc3 +CVE_CHECK_IGNORE += "CVE-2018-19854" + +# fixed-version: Fixed after version 4.20 +CVE_CHECK_IGNORE += "CVE-2018-19985" + +# fixed-version: Fixed after version 4.20rc6 +CVE_CHECK_IGNORE += "CVE-2018-20169" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-20449" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2018-20509" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2018-20510" + +# fixed-version: Fixed after version 4.19rc5 +CVE_CHECK_IGNORE += "CVE-2018-20511" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2018-20669" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2018-20784" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2018-20836" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2018-20854" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-20855" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-20856" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-20961" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-20976" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-21008" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2018-25015" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-25020" + +# CVE-2018-3574 has no known resolution + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-3620" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-3639" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-3646" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2018-3665" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-3693" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-5332" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-5333" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-5344" + +# fixed-version: Fixed after version 4.18rc7 +CVE_CHECK_IGNORE += "CVE-2018-5390" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-5391" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-5703" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-5750" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-5803" + +# fixed-version: Fixed after version 4.17rc6 +CVE_CHECK_IGNORE += "CVE-2018-5814" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-5848" + +# Skipping CVE-2018-5856, no affected_versions + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2018-5873" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-5953" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-5995" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-6412" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-6554" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-6555" + +# CVE-2018-6559 has no known resolution + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2018-6927" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2018-7191" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-7273" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2018-7480" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2018-7492" + +# fixed-version: Fixed after version 4.16rc2 +CVE_CHECK_IGNORE += "CVE-2018-7566" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-7740" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-7754" + +# fixed-version: Fixed after version 4.19rc5 +CVE_CHECK_IGNORE += "CVE-2018-7755" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-7757" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-7995" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-8043" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-8087" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-8781" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-8822" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-8897" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-9363" + +# fixed-version: Fixed after version 4.17rc3 +CVE_CHECK_IGNORE += "CVE-2018-9385" + +# fixed-version: Fixed after version 4.17rc3 +CVE_CHECK_IGNORE += "CVE-2018-9415" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2018-9422" + +# fixed-version: Fixed after version 4.15rc6 +CVE_CHECK_IGNORE += "CVE-2018-9465" + +# fixed-version: Fixed after version 4.18rc5 +CVE_CHECK_IGNORE += "CVE-2018-9516" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2018-9517" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2018-9518" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2018-9568" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-0136" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0145" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0146" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0147" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0148" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-0149" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-0154" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-0155" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-10124" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-10125" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-10126" + +# CVE-2019-10140 has no known resolution + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-10142" + +# fixed-version: Fixed after version 5.3rc3 +CVE_CHECK_IGNORE += "CVE-2019-10207" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-10220" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-10638" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-10639" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2019-11085" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-11091" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-11135" + +# fixed-version: Fixed after version 4.8rc5 +CVE_CHECK_IGNORE += "CVE-2019-11190" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-11191" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-1125" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-11477" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-11478" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-11479" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-11486" + +# fixed-version: Fixed after version 5.1rc5 +CVE_CHECK_IGNORE += "CVE-2019-11487" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-11599" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-11683" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-11810" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-11811" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-11815" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-11833" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-11884" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-12378" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12379" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-12380" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-12381" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12382" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12454" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12455" + +# CVE-2019-12456 has no known resolution + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12614" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-12615" + +# fixed-version: Fixed after version 5.2rc7 +CVE_CHECK_IGNORE += "CVE-2019-12817" + +# fixed-version: Fixed after version 5.0 +CVE_CHECK_IGNORE += "CVE-2019-12818" + +# fixed-version: Fixed after version 5.0rc8 +CVE_CHECK_IGNORE += "CVE-2019-12819" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2019-12881" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-12984" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-13233" + +# fixed-version: Fixed after version 5.2 +CVE_CHECK_IGNORE += "CVE-2019-13272" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-13631" + +# fixed-version: Fixed after version 5.3rc2 +CVE_CHECK_IGNORE += "CVE-2019-13648" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-14283" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-14284" + +# fixed-version: Fixed after version 5.5rc7 +CVE_CHECK_IGNORE += "CVE-2019-14615" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2019-14763" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14814" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14815" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14816" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-14821" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14835" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-14895" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2019-14896" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2019-14897" + +# CVE-2019-14898 has no known resolution + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-14901" + +# fixed-version: Fixed after version 5.3rc8 +CVE_CHECK_IGNORE += "CVE-2019-15030" + +# fixed-version: Fixed after version 5.3rc8 +CVE_CHECK_IGNORE += "CVE-2019-15031" + +# fixed-version: Fixed after version 5.2rc2 +CVE_CHECK_IGNORE += "CVE-2019-15090" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-15098" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-15099" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-15117" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-15118" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15211" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15212" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15213" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15214" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15215" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-15216" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15217" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15218" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15219" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15220" + +# fixed-version: Fixed after version 5.2 +CVE_CHECK_IGNORE += "CVE-2019-15221" + +# fixed-version: Fixed after version 5.3rc3 +CVE_CHECK_IGNORE += "CVE-2019-15222" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15223" + +# CVE-2019-15239 has no known resolution + +# CVE-2019-15290 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-15291" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-15292" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-15504" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-15505" + +# fixed-version: Fixed after version 5.3rc6 +CVE_CHECK_IGNORE += "CVE-2019-15538" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-15666" + +# CVE-2019-15791 has no known resolution + +# CVE-2019-15792 has no known resolution + +# CVE-2019-15793 has no known resolution + +# CVE-2019-15794 needs backporting (fixed from 5.12) + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15807" + +# CVE-2019-15902 has no known resolution + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-15916" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-15917" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15918" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15919" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15920" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-15921" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-15922" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-15923" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-15924" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15925" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15926" + +# fixed-version: Fixed after version 5.0rc2 +CVE_CHECK_IGNORE += "CVE-2019-15927" + +# CVE-2019-16089 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-16229" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-16230" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-16231" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-16232" + +# fixed-version: Fixed after version 5.4rc5 +CVE_CHECK_IGNORE += "CVE-2019-16233" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-16234" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-16413" + +# fixed-version: Fixed after version 5.3rc7 +CVE_CHECK_IGNORE += "CVE-2019-16714" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-16746" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2019-16921" + +# fixed-version: Fixed after version 5.0 +CVE_CHECK_IGNORE += "CVE-2019-16994" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-16995" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17052" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17053" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17054" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17055" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17056" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-17075" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-17133" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-17351" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-17666" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-18198" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-18282" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18660" + +# fixed-version: Fixed after version 4.17rc5 +CVE_CHECK_IGNORE += "CVE-2019-18675" + +# CVE-2019-18680 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18683" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18786" + +# fixed-version: Fixed after version 5.1rc7 +CVE_CHECK_IGNORE += "CVE-2019-18805" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-18806" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-18807" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18808" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18809" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-18810" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-18811" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-18812" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-18813" + +# fixed-version: Fixed after version 5.7rc7 +CVE_CHECK_IGNORE += "CVE-2019-18814" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-18885" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19036" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-19037" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2019-19039" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19043" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19044" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19045" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19046" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19047" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19048" + +# fixed-version: Fixed after version 5.4rc5 +CVE_CHECK_IGNORE += "CVE-2019-19049" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19050" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19051" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19052" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19053" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19054" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19055" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19056" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19057" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19058" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19059" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19060" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19061" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19062" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19063" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19064" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19065" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19066" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19067" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19068" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19069" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19070" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19071" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19072" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19073" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19074" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19075" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19076" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19077" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19078" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-19079" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19080" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19081" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19082" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19083" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-19227" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19241" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19252" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19318" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19319" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19332" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19338" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2019-19377" + +# CVE-2019-19378 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19447" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2019-19448" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2019-19449" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2019-19462" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19523" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-19524" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19525" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19526" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19527" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19528" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19529" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-19530" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19531" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19532" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19533" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19534" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19535" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19536" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-19537" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19543" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19602" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19767" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2019-19768" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2019-19769" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2019-19770" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19807" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19813" + +# CVE-2019-19814 has no known resolution + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-19815" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19816" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19922" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-19927" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-19947" + +# fixed-version: Fixed after version 5.5rc2 +CVE_CHECK_IGNORE += "CVE-2019-19965" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19966" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-1999" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-20054" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-20095" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-20096" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2019-2024" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2019-2025" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-20422" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2019-2054" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2019-20636" + +# CVE-2019-20794 has no known resolution + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-20806" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2019-20810" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-20811" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-20812" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-20908" + +# fixed-version: Fixed after version 5.3rc2 +CVE_CHECK_IGNORE += "CVE-2019-20934" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-2101" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-2181" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2019-2182" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-2213" + +# fixed-version: Fixed after version 5.3rc2 +CVE_CHECK_IGNORE += "CVE-2019-2214" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2019-2215" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-25044" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-25045" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2019-3016" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-3459" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-3460" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2019-3701" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-3819" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2019-3837" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-3846" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-3874" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-3882" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-3887" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-3892" + +# fixed-version: Fixed after version 2.6.35rc1 +CVE_CHECK_IGNORE += "CVE-2019-3896" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-3900" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2019-3901" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-5108" + +# Skipping CVE-2019-5489, no affected_versions + +# fixed-version: Fixed after version 5.0rc2 +CVE_CHECK_IGNORE += "CVE-2019-6133" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-6974" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-7221" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-7222" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2019-7308" + +# fixed-version: Fixed after version 5.0rc8 +CVE_CHECK_IGNORE += "CVE-2019-8912" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-8956" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-8980" + +# fixed-version: Fixed after version 5.0rc4 +CVE_CHECK_IGNORE += "CVE-2019-9003" + +# fixed-version: Fixed after version 5.0rc7 +CVE_CHECK_IGNORE += "CVE-2019-9162" + +# fixed-version: Fixed after version 5.0 +CVE_CHECK_IGNORE += "CVE-2019-9213" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2019-9245" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2019-9444" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9445" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-9453" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2019-9454" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2019-9455" + +# fixed-version: Fixed after version 4.16rc6 +CVE_CHECK_IGNORE += "CVE-2019-9456" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2019-9457" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2019-9458" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9466" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9500" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9503" + +# fixed-version: Fixed after version 5.2 +CVE_CHECK_IGNORE += "CVE-2019-9506" + +# fixed-version: Fixed after version 5.1rc2 +CVE_CHECK_IGNORE += "CVE-2019-9857" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-0009" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2020-0030" + +# fixed-version: Fixed after version 5.5rc2 +CVE_CHECK_IGNORE += "CVE-2020-0041" + +# fixed-version: Fixed after version 4.3rc7 +CVE_CHECK_IGNORE += "CVE-2020-0066" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2020-0067" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-0110" + +# fixed-version: Fixed after version 5.7rc4 +CVE_CHECK_IGNORE += "CVE-2020-0255" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2020-0305" + +# CVE-2020-0347 has no known resolution + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-0404" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-0423" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2020-0427" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2020-0429" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2020-0430" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2020-0431" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-0432" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2020-0433" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2020-0435" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-0444" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-0465" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2020-0466" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-0543" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10135" + +# fixed-version: Fixed after version 5.5rc5 +CVE_CHECK_IGNORE += "CVE-2020-10690" + +# CVE-2020-10708 has no known resolution + +# fixed-version: Fixed after version 5.7rc6 +CVE_CHECK_IGNORE += "CVE-2020-10711" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2020-10720" + +# fixed-version: Fixed after version 5.7 +CVE_CHECK_IGNORE += "CVE-2020-10732" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2020-10742" + +# fixed-version: Fixed after version 5.7rc4 +CVE_CHECK_IGNORE += "CVE-2020-10751" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10757" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10766" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10767" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10768" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2020-10769" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2020-10773" + +# CVE-2020-10774 has no known resolution + +# fixed-version: Fixed after version 5.8rc6 +CVE_CHECK_IGNORE += "CVE-2020-10781" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-10942" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11494" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11565" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11608" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11609" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11668" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2020-11669" + +# CVE-2020-11725 has no known resolution + +# fixed-version: Fixed after version 5.7rc4 +CVE_CHECK_IGNORE += "CVE-2020-11884" + +# CVE-2020-11935 has no known resolution + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2020-12114" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-12351" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-12352" + +# CVE-2020-12362 needs backporting (fixed from 5.11rc1) + +# CVE-2020-12363 needs backporting (fixed from 5.11rc1) + +# CVE-2020-12364 needs backporting (fixed from 5.11rc1) + +# fixed-version: Fixed after version 5.7rc3 +CVE_CHECK_IGNORE += "CVE-2020-12464" + +# fixed-version: Fixed after version 5.6rc6 +CVE_CHECK_IGNORE += "CVE-2020-12465" + +# fixed-version: Fixed after version 5.5rc7 +CVE_CHECK_IGNORE += "CVE-2020-12652" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-12653" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-12654" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-12655" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-12656" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-12657" + +# fixed-version: Fixed after version 5.7rc2 +CVE_CHECK_IGNORE += "CVE-2020-12659" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-12768" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2020-12769" + +# fixed-version: Fixed after version 5.7rc3 +CVE_CHECK_IGNORE += "CVE-2020-12770" + +# fixed-version: Fixed after version 5.8rc2 +CVE_CHECK_IGNORE += "CVE-2020-12771" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-12826" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-12888" + +# fixed-version: Fixed after version 5.10rc4 +CVE_CHECK_IGNORE += "CVE-2020-12912" + +# fixed-version: Fixed after version 5.7rc6 +CVE_CHECK_IGNORE += "CVE-2020-13143" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-13974" + +# CVE-2020-14304 has no known resolution + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2020-14305" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2020-14314" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-14331" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-14351" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2020-14353" + +# fixed-version: Fixed after version 5.8rc5 +CVE_CHECK_IGNORE += "CVE-2020-14356" + +# fixed-version: Fixed after version 5.6rc6 +CVE_CHECK_IGNORE += "CVE-2020-14381" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-14385" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-14386" + +# fixed-version: Fixed after version 5.9rc6 +CVE_CHECK_IGNORE += "CVE-2020-14390" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2020-14416" + +# fixed-version: Fixed after version 5.8rc3 +CVE_CHECK_IGNORE += "CVE-2020-15393" + +# fixed-version: Fixed after version 5.8rc2 +CVE_CHECK_IGNORE += "CVE-2020-15436" + +# fixed-version: Fixed after version 5.8rc7 +CVE_CHECK_IGNORE += "CVE-2020-15437" + +# fixed-version: Fixed after version 5.8rc3 +CVE_CHECK_IGNORE += "CVE-2020-15780" + +# CVE-2020-15802 has no known resolution + +# fixed-version: Fixed after version 5.8rc6 +CVE_CHECK_IGNORE += "CVE-2020-15852" + +# cpe-stable-backport: Backported in 5.10.68 +CVE_CHECK_IGNORE += "CVE-2020-16119" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-16120" + +# fixed-version: Fixed after version 5.8 +CVE_CHECK_IGNORE += "CVE-2020-16166" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2020-1749" + +# fixed-version: Fixed after version 5.8rc4 +CVE_CHECK_IGNORE += "CVE-2020-24394" + +# fixed-version: Fixed after version 5.8 +CVE_CHECK_IGNORE += "CVE-2020-24490" + +# CVE-2020-24502 has no known resolution + +# CVE-2020-24503 has no known resolution + +# CVE-2020-24504 needs backporting (fixed from 5.12rc1) + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2020-24586" + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2020-24587" + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2020-24588" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2020-25211" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-25212" + +# CVE-2020-25220 has no known resolution + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-25221" + +# fixed-version: Fixed after version 5.9rc5 +CVE_CHECK_IGNORE += "CVE-2020-25284" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-25285" + +# cpe-stable-backport: Backported in 5.10.20 +CVE_CHECK_IGNORE += "CVE-2020-25639" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-25641" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2020-25643" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2020-25645" + +# fixed-version: Fixed after version 5.10rc2 +CVE_CHECK_IGNORE += "CVE-2020-25656" + +# CVE-2020-25661 has no known resolution + +# CVE-2020-25662 has no known resolution + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-25668" + +# fixed-version: Fixed after version 5.10rc5 +CVE_CHECK_IGNORE += "CVE-2020-25669" + +# cpe-stable-backport: Backported in 5.10.30 +CVE_CHECK_IGNORE += "CVE-2020-25670" + +# cpe-stable-backport: Backported in 5.10.30 +CVE_CHECK_IGNORE += "CVE-2020-25671" + +# cpe-stable-backport: Backported in 5.10.30 +CVE_CHECK_IGNORE += "CVE-2020-25672" + +# cpe-stable-backport: Backported in 5.10.30 +CVE_CHECK_IGNORE += "CVE-2020-25673" + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-25704" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-25705" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-26088" + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2020-26139" + +# CVE-2020-26140 has no known resolution + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2020-26141" + +# CVE-2020-26142 has no known resolution + +# CVE-2020-26143 has no known resolution + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2020-26145" + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2020-26147" + +# cpe-stable-backport: Backported in 5.10.47 +CVE_CHECK_IGNORE += "CVE-2020-26541" + +# cpe-stable-backport: Backported in 5.10.40 +CVE_CHECK_IGNORE += "CVE-2020-26555" + +# CVE-2020-26556 has no known resolution + +# CVE-2020-26557 has no known resolution + +# cpe-stable-backport: Backported in 5.10.40 +CVE_CHECK_IGNORE += "CVE-2020-26558" + +# CVE-2020-26559 has no known resolution + +# CVE-2020-26560 has no known resolution + +# fixed-version: Fixed after version 5.6 +CVE_CHECK_IGNORE += "CVE-2020-27066" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2020-27067" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-27068" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27152" + +# cpe-stable-backport: Backported in 5.10.25 +CVE_CHECK_IGNORE += "CVE-2020-27170" + +# cpe-stable-backport: Backported in 5.10.25 +CVE_CHECK_IGNORE += "CVE-2020-27171" + +# fixed-version: Fixed after version 5.9 +CVE_CHECK_IGNORE += "CVE-2020-27194" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-2732" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2020-27418" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27673" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27675" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27777" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27784" + +# fixed-version: Fixed after version 5.7rc6 +CVE_CHECK_IGNORE += "CVE-2020-27786" + +# cpe-stable-backport: Backported in 5.10.4 +CVE_CHECK_IGNORE += "CVE-2020-27815" + +# cpe-stable-backport: Backported in 5.10.82 +CVE_CHECK_IGNORE += "CVE-2020-27820" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27825" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-27830" + +# fixed-version: Fixed after version 5.10rc6 +CVE_CHECK_IGNORE += "CVE-2020-27835" + +# fixed-version: Fixed after version 5.9rc6 +CVE_CHECK_IGNORE += "CVE-2020-28097" + +# cpe-stable-backport: Backported in 5.10.7 +CVE_CHECK_IGNORE += "CVE-2020-28374" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-28588" + +# fixed-version: Fixed after version 5.9 +CVE_CHECK_IGNORE += "CVE-2020-28915" + +# fixed-version: Fixed after version 5.10rc5 +CVE_CHECK_IGNORE += "CVE-2020-28941" + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-28974" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-29368" + +# fixed-version: Fixed after version 5.8rc7 +CVE_CHECK_IGNORE += "CVE-2020-29369" + +# fixed-version: Fixed after version 5.6rc7 +CVE_CHECK_IGNORE += "CVE-2020-29370" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2020-29371" + +# fixed-version: Fixed after version 5.7rc3 +CVE_CHECK_IGNORE += "CVE-2020-29372" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-29373" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-29374" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-29534" + +# cpe-stable-backport: Backported in 5.10.4 +CVE_CHECK_IGNORE += "CVE-2020-29568" + +# cpe-stable-backport: Backported in 5.10.4 +CVE_CHECK_IGNORE += "CVE-2020-29569" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-29660" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-29661" + +# cpe-stable-backport: Backported in 5.10.4 +CVE_CHECK_IGNORE += "CVE-2020-35499" + +# CVE-2020-35501 has no known resolution + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-35508" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2020-35513" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-35519" + +# cpe-stable-backport: Backported in 5.10.6 +CVE_CHECK_IGNORE += "CVE-2020-36158" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-36310" + +# fixed-version: Fixed after version 5.9rc5 +CVE_CHECK_IGNORE += "CVE-2020-36311" + +# fixed-version: Fixed after version 5.9rc5 +CVE_CHECK_IGNORE += "CVE-2020-36312" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-36313" + +# cpe-stable-backport: Backported in 5.10.6 +CVE_CHECK_IGNORE += "CVE-2020-36322" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-36385" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-36386" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-36387" + +# cpe-stable-backport: Backported in 5.10.96 +CVE_CHECK_IGNORE += "CVE-2020-36516" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-36557" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-36558" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-36691" + +# fixed-version: Fixed after version 5.10 +CVE_CHECK_IGNORE += "CVE-2020-36694" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-36766" + +# cpe-stable-backport: Backported in 5.10.61 +CVE_CHECK_IGNORE += "CVE-2020-3702" + +# fixed-version: Fixed after version 5.10rc5 +CVE_CHECK_IGNORE += "CVE-2020-4788" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2020-7053" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2020-8428" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2020-8647" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-8648" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2020-8649" + +# fixed-version: Fixed after version 5.10rc4 +CVE_CHECK_IGNORE += "CVE-2020-8694" + +# CVE-2020-8832 has no known resolution + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2020-8834" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-8835" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-8992" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-9383" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-9391" + +# cpe-stable-backport: Backported in 5.10.40 +CVE_CHECK_IGNORE += "CVE-2021-0129" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2021-0342" + +# CVE-2021-0399 has no known resolution + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-0447" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2021-0448" + +# cpe-stable-backport: Backported in 5.10.19 +CVE_CHECK_IGNORE += "CVE-2021-0512" + +# fixed-version: Fixed after version 5.8 +CVE_CHECK_IGNORE += "CVE-2021-0605" + +# CVE-2021-0606 has no known resolution + +# CVE-2021-0695 has no known resolution + +# cpe-stable-backport: Backported in 5.10.7 +CVE_CHECK_IGNORE += "CVE-2021-0707" + +# cpe-stable-backport: Backported in 5.10.55 +CVE_CHECK_IGNORE += "CVE-2021-0920" + +# CVE-2021-0924 has no known resolution + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2021-0929" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2021-0935" + +# CVE-2021-0936 has no known resolution + +# cpe-stable-backport: Backported in 5.10.31 +CVE_CHECK_IGNORE += "CVE-2021-0937" + +# fixed-version: Fixed after version 5.10rc4 +CVE_CHECK_IGNORE += "CVE-2021-0938" + +# cpe-stable-backport: Backported in 5.10.28 +CVE_CHECK_IGNORE += "CVE-2021-0941" + +# CVE-2021-0961 has no known resolution + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2021-1048" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2021-20177" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2021-20194" + +# CVE-2021-20219 has no known resolution + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2021-20226" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2021-20239" + +# fixed-version: Fixed after version 4.5rc5 +CVE_CHECK_IGNORE += "CVE-2021-20261" + +# fixed-version: Fixed after version 4.5rc3 +CVE_CHECK_IGNORE += "CVE-2021-20265" + +# cpe-stable-backport: Backported in 5.10.10 +CVE_CHECK_IGNORE += "CVE-2021-20268" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2021-20292" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2021-20317" + +# cpe-stable-backport: Backported in 5.10.68 +CVE_CHECK_IGNORE += "CVE-2021-20320" + +# cpe-stable-backport: Backported in 5.10.73 +CVE_CHECK_IGNORE += "CVE-2021-20321" + +# cpe-stable-backport: Backported in 5.10.65 +CVE_CHECK_IGNORE += "CVE-2021-20322" + +# cpe-stable-backport: Backported in 5.10.17 +CVE_CHECK_IGNORE += "CVE-2021-21781" + +# cpe-stable-backport: Backported in 5.10.47 +CVE_CHECK_IGNORE += "CVE-2021-22543" + +# cpe-stable-backport: Backported in 5.10.31 +CVE_CHECK_IGNORE += "CVE-2021-22555" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-22600" + +# cpe-stable-backport: Backported in 5.10.32 +CVE_CHECK_IGNORE += "CVE-2021-23133" + +# fixed-version: only affects 5.12rc7 onwards +CVE_CHECK_IGNORE += "CVE-2021-23134" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2021-26401" + +# cpe-stable-backport: Backported in 5.10.13 +CVE_CHECK_IGNORE += "CVE-2021-26708" + +# cpe-stable-backport: Backported in 5.10.18 +CVE_CHECK_IGNORE += "CVE-2021-26930" + +# cpe-stable-backport: Backported in 5.10.18 +CVE_CHECK_IGNORE += "CVE-2021-26931" + +# cpe-stable-backport: Backported in 5.10.18 +CVE_CHECK_IGNORE += "CVE-2021-26932" + +# CVE-2021-26934 has no known resolution + +# cpe-stable-backport: Backported in 5.10.21 +CVE_CHECK_IGNORE += "CVE-2021-27363" + +# cpe-stable-backport: Backported in 5.10.21 +CVE_CHECK_IGNORE += "CVE-2021-27364" + +# cpe-stable-backport: Backported in 5.10.21 +CVE_CHECK_IGNORE += "CVE-2021-27365" + +# cpe-stable-backport: Backported in 5.10.21 +CVE_CHECK_IGNORE += "CVE-2021-28038" + +# cpe-stable-backport: Backported in 5.10.21 +CVE_CHECK_IGNORE += "CVE-2021-28039" + +# cpe-stable-backport: Backported in 5.10.24 +CVE_CHECK_IGNORE += "CVE-2021-28375" + +# cpe-stable-backport: Backported in 5.10.24 +CVE_CHECK_IGNORE += "CVE-2021-28660" + +# cpe-stable-backport: Backported in 5.10.27 +CVE_CHECK_IGNORE += "CVE-2021-28688" + +# cpe-stable-backport: Backported in 5.10.43 +CVE_CHECK_IGNORE += "CVE-2021-28691" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-28711" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-28712" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-28713" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-28714" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-28715" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-28950" + +# cpe-stable-backport: Backported in 5.10.26 +CVE_CHECK_IGNORE += "CVE-2021-28951" + +# cpe-stable-backport: Backported in 5.10.26 +CVE_CHECK_IGNORE += "CVE-2021-28952" + +# cpe-stable-backport: Backported in 5.10.26 +CVE_CHECK_IGNORE += "CVE-2021-28964" + +# cpe-stable-backport: Backported in 5.10.26 +CVE_CHECK_IGNORE += "CVE-2021-28971" + +# cpe-stable-backport: Backported in 5.10.26 +CVE_CHECK_IGNORE += "CVE-2021-28972" + +# cpe-stable-backport: Backported in 5.10.29 +CVE_CHECK_IGNORE += "CVE-2021-29154" + +# cpe-stable-backport: Backported in 5.10.32 +CVE_CHECK_IGNORE += "CVE-2021-29155" + +# cpe-stable-backport: Backported in 5.10.27 +CVE_CHECK_IGNORE += "CVE-2021-29264" + +# cpe-stable-backport: Backported in 5.10.24 +CVE_CHECK_IGNORE += "CVE-2021-29265" + +# cpe-stable-backport: Backported in 5.10.26 +CVE_CHECK_IGNORE += "CVE-2021-29266" + +# cpe-stable-backport: Backported in 5.10.27 +CVE_CHECK_IGNORE += "CVE-2021-29646" + +# cpe-stable-backport: Backported in 5.10.27 +CVE_CHECK_IGNORE += "CVE-2021-29647" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-29648" + +# cpe-stable-backport: Backported in 5.10.27 +CVE_CHECK_IGNORE += "CVE-2021-29649" + +# cpe-stable-backport: Backported in 5.10.27 +CVE_CHECK_IGNORE += "CVE-2021-29650" + +# cpe-stable-backport: Backported in 5.10.28 +CVE_CHECK_IGNORE += "CVE-2021-29657" + +# cpe-stable-backport: Backported in 5.10.21 +CVE_CHECK_IGNORE += "CVE-2021-30002" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-30178" + +# cpe-stable-backport: Backported in 5.10.37 +CVE_CHECK_IGNORE += "CVE-2021-31440" + +# cpe-stable-backport: Backported in 5.10.10 +CVE_CHECK_IGNORE += "CVE-2021-3178" + +# cpe-stable-backport: Backported in 5.10.35 +CVE_CHECK_IGNORE += "CVE-2021-31829" + +# cpe-stable-backport: Backported in 5.10.27 +CVE_CHECK_IGNORE += "CVE-2021-31916" + +# CVE-2021-32078 needs backporting (fixed from 5.13rc1) + +# cpe-stable-backport: Backported in 5.10.37 +CVE_CHECK_IGNORE += "CVE-2021-32399" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-32606" + +# cpe-stable-backport: Backported in 5.10.24 +CVE_CHECK_IGNORE += "CVE-2021-33033" + +# cpe-stable-backport: Backported in 5.10.37 +CVE_CHECK_IGNORE += "CVE-2021-33034" + +# CVE-2021-33061 needs backporting (fixed from 5.18rc1) + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2021-33098" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-33135" + +# fixed-version: only affects 5.12rc8 onwards +CVE_CHECK_IGNORE += "CVE-2021-33200" + +# cpe-stable-backport: Backported in 5.10.12 +CVE_CHECK_IGNORE += "CVE-2021-3347" + +# cpe-stable-backport: Backported in 5.10.13 +CVE_CHECK_IGNORE += "CVE-2021-3348" + +# cpe-stable-backport: Backported in 5.10.46 +CVE_CHECK_IGNORE += "CVE-2021-33624" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2021-33630" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2021-33631" + +# cpe-stable-backport: Backported in 5.10.130 +CVE_CHECK_IGNORE += "CVE-2021-33655" + +# cpe-stable-backport: Backported in 5.10.127 +CVE_CHECK_IGNORE += "CVE-2021-33656" + +# cpe-stable-backport: Backported in 5.10.52 +CVE_CHECK_IGNORE += "CVE-2021-33909" + +# fixed-version: Fixed after version 5.10 +CVE_CHECK_IGNORE += "CVE-2021-3411" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2021-3428" + +# cpe-stable-backport: Backported in 5.10.19 +CVE_CHECK_IGNORE += "CVE-2021-3444" + +# cpe-stable-backport: Backported in 5.10.56 +CVE_CHECK_IGNORE += "CVE-2021-34556" + +# cpe-stable-backport: Backported in 5.10.46 +CVE_CHECK_IGNORE += "CVE-2021-34693" + +# cpe-stable-backport: Backported in 5.10.28 +CVE_CHECK_IGNORE += "CVE-2021-3483" + +# cpe-stable-backport: Backported in 5.10.62 +CVE_CHECK_IGNORE += "CVE-2021-34866" + +# cpe-stable-backport: Backported in 5.10.37 +CVE_CHECK_IGNORE += "CVE-2021-3489" + +# cpe-stable-backport: Backported in 5.10.37 +CVE_CHECK_IGNORE += "CVE-2021-3490" + +# cpe-stable-backport: Backported in 5.10.37 +CVE_CHECK_IGNORE += "CVE-2021-3491" + +# CVE-2021-3492 has no known resolution + +# CVE-2021-3493 needs backporting (fixed from 5.11rc1) + +# cpe-stable-backport: Backported in 5.10.42 +CVE_CHECK_IGNORE += "CVE-2021-34981" + +# cpe-stable-backport: Backported in 5.10.32 +CVE_CHECK_IGNORE += "CVE-2021-3501" + +# cpe-stable-backport: Backported in 5.10.47 +CVE_CHECK_IGNORE += "CVE-2021-35039" + +# cpe-stable-backport: Backported in 5.10.36 +CVE_CHECK_IGNORE += "CVE-2021-3506" + +# CVE-2021-3542 has no known resolution + +# cpe-stable-backport: Backported in 5.10.36 +CVE_CHECK_IGNORE += "CVE-2021-3543" + +# cpe-stable-backport: Backported in 5.10.56 +CVE_CHECK_IGNORE += "CVE-2021-35477" + +# cpe-stable-backport: Backported in 5.10.43 +CVE_CHECK_IGNORE += "CVE-2021-3564" + +# cpe-stable-backport: Backported in 5.10.43 +CVE_CHECK_IGNORE += "CVE-2021-3573" + +# cpe-stable-backport: Backported in 5.10.43 +CVE_CHECK_IGNORE += "CVE-2021-3587" + +# cpe-stable-backport: Backported in 5.10.16 +CVE_CHECK_IGNORE += "CVE-2021-3600" + +# cpe-stable-backport: Backported in 5.10.50 +CVE_CHECK_IGNORE += "CVE-2021-3609" + +# cpe-stable-backport: Backported in 5.10.20 +CVE_CHECK_IGNORE += "CVE-2021-3612" + +# fixed-version: Fixed after version 5.5rc7 +CVE_CHECK_IGNORE += "CVE-2021-3635" + +# cpe-stable-backport: Backported in 5.10.80 +CVE_CHECK_IGNORE += "CVE-2021-3640" + +# cpe-stable-backport: Backported in 5.10.60 +CVE_CHECK_IGNORE += "CVE-2021-3653" + +# cpe-stable-backport: Backported in 5.10.51 +CVE_CHECK_IGNORE += "CVE-2021-3655" + +# cpe-stable-backport: Backported in 5.10.60 +CVE_CHECK_IGNORE += "CVE-2021-3656" + +# cpe-stable-backport: Backported in 5.10.30 +CVE_CHECK_IGNORE += "CVE-2021-3659" + +# CVE-2021-3669 needs backporting (fixed from 5.15rc1) + +# cpe-stable-backport: Backported in 5.10.54 +CVE_CHECK_IGNORE += "CVE-2021-3679" + +# CVE-2021-3714 has no known resolution + +# fixed-version: Fixed after version 5.6 +CVE_CHECK_IGNORE += "CVE-2021-3715" + +# cpe-stable-backport: Backported in 5.10.54 +CVE_CHECK_IGNORE += "CVE-2021-37159" + +# cpe-stable-backport: Backported in 5.10.59 +CVE_CHECK_IGNORE += "CVE-2021-3732" + +# fixed-version: only affects 5.14rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-3736" + +# cpe-stable-backport: Backported in 5.10.62 +CVE_CHECK_IGNORE += "CVE-2021-3739" + +# cpe-stable-backport: Backported in 5.10.46 +CVE_CHECK_IGNORE += "CVE-2021-3743" + +# cpe-stable-backport: Backported in 5.10.71 +CVE_CHECK_IGNORE += "CVE-2021-3744" + +# cpe-stable-backport: Backported in 5.10.80 +CVE_CHECK_IGNORE += "CVE-2021-3752" + +# cpe-stable-backport: Backported in 5.10.62 +CVE_CHECK_IGNORE += "CVE-2021-3753" + +# cpe-stable-backport: Backported in 5.10.54 +CVE_CHECK_IGNORE += "CVE-2021-37576" + +# cpe-stable-backport: Backported in 5.10.154 +CVE_CHECK_IGNORE += "CVE-2021-3759" + +# cpe-stable-backport: Backported in 5.10.76 +CVE_CHECK_IGNORE += "CVE-2021-3760" + +# cpe-stable-backport: Backported in 5.10.71 +CVE_CHECK_IGNORE += "CVE-2021-3764" + +# cpe-stable-backport: Backported in 5.10.77 +CVE_CHECK_IGNORE += "CVE-2021-3772" + +# cpe-stable-backport: Backported in 5.10.52 +CVE_CHECK_IGNORE += "CVE-2021-38160" + +# cpe-stable-backport: Backported in 5.10.60 +CVE_CHECK_IGNORE += "CVE-2021-38166" + +# cpe-stable-backport: Backported in 5.10.44 +CVE_CHECK_IGNORE += "CVE-2021-38198" + +# cpe-stable-backport: Backported in 5.10.52 +CVE_CHECK_IGNORE += "CVE-2021-38199" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-38200" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-38201" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-38202" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-38203" + +# cpe-stable-backport: Backported in 5.10.54 +CVE_CHECK_IGNORE += "CVE-2021-38204" + +# cpe-stable-backport: Backported in 5.10.59 +CVE_CHECK_IGNORE += "CVE-2021-38205" + +# cpe-stable-backport: Backported in 5.10.46 +CVE_CHECK_IGNORE += "CVE-2021-38206" + +# cpe-stable-backport: Backported in 5.10.46 +CVE_CHECK_IGNORE += "CVE-2021-38207" + +# cpe-stable-backport: Backported in 5.10.43 +CVE_CHECK_IGNORE += "CVE-2021-38208" + +# cpe-stable-backport: Backported in 5.10.35 +CVE_CHECK_IGNORE += "CVE-2021-38209" + +# cpe-stable-backport: Backported in 5.10.71 +CVE_CHECK_IGNORE += "CVE-2021-38300" + +# CVE-2021-3847 has no known resolution + +# CVE-2021-3864 has no known resolution + +# CVE-2021-3892 has no known resolution + +# cpe-stable-backport: Backported in 5.10.75 +CVE_CHECK_IGNORE += "CVE-2021-3894" + +# cpe-stable-backport: Backported in 5.10.76 +CVE_CHECK_IGNORE += "CVE-2021-3896" + +# cpe-stable-backport: Backported in 5.10.91 +CVE_CHECK_IGNORE += "CVE-2021-3923" + +# cpe-stable-backport: Backported in 5.10.62 +CVE_CHECK_IGNORE += "CVE-2021-39633" + +# fixed-version: Fixed after version 5.9rc8 +CVE_CHECK_IGNORE += "CVE-2021-39634" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2021-39636" + +# cpe-stable-backport: Backported in 5.10.7 +CVE_CHECK_IGNORE += "CVE-2021-39648" + +# cpe-stable-backport: Backported in 5.10.24 +CVE_CHECK_IGNORE += "CVE-2021-39656" + +# cpe-stable-backport: Backported in 5.10.11 +CVE_CHECK_IGNORE += "CVE-2021-39657" + +# cpe-stable-backport: Backported in 5.10.85 +CVE_CHECK_IGNORE += "CVE-2021-39685" + +# cpe-stable-backport: Backported in 5.10.80 +CVE_CHECK_IGNORE += "CVE-2021-39686" + +# cpe-stable-backport: Backported in 5.10.85 +CVE_CHECK_IGNORE += "CVE-2021-39698" + +# fixed-version: Fixed after version 4.18rc6 +CVE_CHECK_IGNORE += "CVE-2021-39711" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2021-39713" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-39714" + +# CVE-2021-39800 has no known resolution + +# CVE-2021-39801 has no known resolution + +# CVE-2021-39802 has no known resolution + +# cpe-stable-backport: Backported in 5.10.83 +CVE_CHECK_IGNORE += "CVE-2021-4001" + +# cpe-stable-backport: Backported in 5.10.82 +CVE_CHECK_IGNORE += "CVE-2021-4002" + +# CVE-2021-4023 needs backporting (fixed from 5.15rc1) + +# cpe-stable-backport: Backported in 5.10.71 +CVE_CHECK_IGNORE += "CVE-2021-4028" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-4032" + +# cpe-stable-backport: Backported in 5.10.146 +CVE_CHECK_IGNORE += "CVE-2021-4037" + +# cpe-stable-backport: Backported in 5.10.63 +CVE_CHECK_IGNORE += "CVE-2021-40490" + +# cpe-stable-backport: Backported in 5.10.84 +CVE_CHECK_IGNORE += "CVE-2021-4083" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-4090" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-4093" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-4095" + +# cpe-stable-backport: Backported in 5.10.68 +CVE_CHECK_IGNORE += "CVE-2021-41073" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-4135" + +# cpe-stable-backport: Backported in 5.10.78 +CVE_CHECK_IGNORE += "CVE-2021-4148" + +# cpe-stable-backport: Backported in 5.10.75 +CVE_CHECK_IGNORE += "CVE-2021-4149" + +# CVE-2021-4150 needs backporting (fixed from 5.15rc7) + +# cpe-stable-backport: Backported in 5.10.52 +CVE_CHECK_IGNORE += "CVE-2021-4154" + +# cpe-stable-backport: Backported in 5.10.91 +CVE_CHECK_IGNORE += "CVE-2021-4155" + +# cpe-stable-backport: Backported in 5.10.38 +CVE_CHECK_IGNORE += "CVE-2021-4157" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2021-4159" + +# cpe-stable-backport: Backported in 5.10.73 +CVE_CHECK_IGNORE += "CVE-2021-41864" + +# cpe-stable-backport: Backported in 5.10.111 +CVE_CHECK_IGNORE += "CVE-2021-4197" + +# cpe-stable-backport: Backported in 5.10.61 +CVE_CHECK_IGNORE += "CVE-2021-42008" + +# cpe-stable-backport: Backported in 5.10.82 +CVE_CHECK_IGNORE += "CVE-2021-4202" + +# cpe-stable-backport: Backported in 5.10.71 +CVE_CHECK_IGNORE += "CVE-2021-4203" + +# CVE-2021-4204 needs backporting (fixed from 5.17rc1) + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2021-4218" + +# cpe-stable-backport: Backported in 5.10.67 +CVE_CHECK_IGNORE += "CVE-2021-42252" + +# cpe-stable-backport: Backported in 5.10.77 +CVE_CHECK_IGNORE += "CVE-2021-42327" + +# cpe-stable-backport: Backported in 5.10.78 +CVE_CHECK_IGNORE += "CVE-2021-42739" + +# cpe-stable-backport: Backported in 5.10.76 +CVE_CHECK_IGNORE += "CVE-2021-43056" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-43057" + +# cpe-stable-backport: Backported in 5.10.77 +CVE_CHECK_IGNORE += "CVE-2021-43267" + +# cpe-stable-backport: Backported in 5.10.76 +CVE_CHECK_IGNORE += "CVE-2021-43389" + +# cpe-stable-backport: Backported in 5.10.84 +CVE_CHECK_IGNORE += "CVE-2021-43975" + +# cpe-stable-backport: Backported in 5.10.94 +CVE_CHECK_IGNORE += "CVE-2021-43976" + +# cpe-stable-backport: Backported in 5.10.89 +CVE_CHECK_IGNORE += "CVE-2021-44733" + +# cpe-stable-backport: Backported in 5.10.200 +CVE_CHECK_IGNORE += "CVE-2021-44879" + +# cpe-stable-backport: Backported in 5.10.91 +CVE_CHECK_IGNORE += "CVE-2021-45095" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2021-45100" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2021-45402" + +# cpe-stable-backport: Backported in 5.10.89 +CVE_CHECK_IGNORE += "CVE-2021-45469" + +# fixed-version: only affects 5.13rc4 onwards +CVE_CHECK_IGNORE += "CVE-2021-45480" + +# cpe-stable-backport: Backported in 5.10.51 +CVE_CHECK_IGNORE += "CVE-2021-45485" + +# cpe-stable-backport: Backported in 5.10.37 +CVE_CHECK_IGNORE += "CVE-2021-45486" + +# cpe-stable-backport: Backported in 5.10.80 +CVE_CHECK_IGNORE += "CVE-2021-45868" + +# cpe-stable-backport: Backported in 5.10.64 +CVE_CHECK_IGNORE += "CVE-2021-46283" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-0001" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-0002" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-0168" + +# cpe-stable-backport: Backported in 5.10.146 +CVE_CHECK_IGNORE += "CVE-2022-0171" + +# cpe-stable-backport: Backported in 5.10.93 +CVE_CHECK_IGNORE += "CVE-2022-0185" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-0264" + +# cpe-stable-backport: Backported in 5.10.54 +CVE_CHECK_IGNORE += "CVE-2022-0286" + +# cpe-stable-backport: Backported in 5.10.75 +CVE_CHECK_IGNORE += "CVE-2022-0322" + +# cpe-stable-backport: Backported in 5.10.95 +CVE_CHECK_IGNORE += "CVE-2022-0330" + +# CVE-2022-0382 needs backporting (fixed from 5.16) + +# CVE-2022-0400 has no known resolution + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-0433" + +# cpe-stable-backport: Backported in 5.10.100 +CVE_CHECK_IGNORE += "CVE-2022-0435" + +# CVE-2022-0480 needs backporting (fixed from 5.15rc1) + +# cpe-stable-backport: Backported in 5.10.100 +CVE_CHECK_IGNORE += "CVE-2022-0487" + +# cpe-stable-backport: Backported in 5.10.97 +CVE_CHECK_IGNORE += "CVE-2022-0492" + +# cpe-stable-backport: Backported in 5.10.115 +CVE_CHECK_IGNORE += "CVE-2022-0494" + +# CVE-2022-0500 needs backporting (fixed from 5.17rc1) + +# cpe-stable-backport: Backported in 5.10.100 +CVE_CHECK_IGNORE += "CVE-2022-0516" + +# cpe-stable-backport: Backported in 5.10.96 +CVE_CHECK_IGNORE += "CVE-2022-0617" + +# cpe-stable-backport: Backported in 5.10.76 +CVE_CHECK_IGNORE += "CVE-2022-0644" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-0646" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-0742" + +# fixed-version: Fixed after version 5.8rc6 +CVE_CHECK_IGNORE += "CVE-2022-0812" + +# cpe-stable-backport: Backported in 5.10.102 +CVE_CHECK_IGNORE += "CVE-2022-0847" + +# cpe-stable-backport: Backported in 5.10.50 +CVE_CHECK_IGNORE += "CVE-2022-0850" + +# fixed-version: only affects 5.17rc6 onwards +CVE_CHECK_IGNORE += "CVE-2022-0854" + +# cpe-stable-backport: Backported in 5.10.106 +CVE_CHECK_IGNORE += "CVE-2022-0995" + +# CVE-2022-0998 needs backporting (fixed from 5.17rc1) + +# cpe-stable-backport: Backported in 5.10.106 +CVE_CHECK_IGNORE += "CVE-2022-1011" + +# cpe-stable-backport: Backported in 5.10.119 +CVE_CHECK_IGNORE += "CVE-2022-1012" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-1015" + +# cpe-stable-backport: Backported in 5.10.109 +CVE_CHECK_IGNORE += "CVE-2022-1016" + +# fixed-version: only affects 5.12rc3 onwards +CVE_CHECK_IGNORE += "CVE-2022-1043" + +# cpe-stable-backport: Backported in 5.10.109 +CVE_CHECK_IGNORE += "CVE-2022-1048" + +# cpe-stable-backport: Backported in 5.10.97 +CVE_CHECK_IGNORE += "CVE-2022-1055" + +# CVE-2022-1116 has no known resolution + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-1158" + +# cpe-stable-backport: Backported in 5.10.121 +CVE_CHECK_IGNORE += "CVE-2022-1184" + +# cpe-stable-backport: Backported in 5.10.89 +CVE_CHECK_IGNORE += "CVE-2022-1195" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-1198" + +# cpe-stable-backport: Backported in 5.10.106 +CVE_CHECK_IGNORE += "CVE-2022-1199" + +# cpe-stable-backport: Backported in 5.10.112 +CVE_CHECK_IGNORE += "CVE-2022-1204" + +# fixed-version: only affects 5.17rc4 onwards +CVE_CHECK_IGNORE += "CVE-2022-1205" + +# CVE-2022-1247 has no known resolution + +# CVE-2022-1263 needs backporting (fixed from 5.18rc3) + +# CVE-2022-1280 needs backporting (fixed from 5.15rc1) + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-1353" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2022-1419" + +# cpe-stable-backport: Backported in 5.10.134 +CVE_CHECK_IGNORE += "CVE-2022-1462" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-1508" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-1516" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-1651" + +# cpe-stable-backport: Backported in 5.10.118 +CVE_CHECK_IGNORE += "CVE-2022-1652" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-1671" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2022-1678" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2022-1679" + +# cpe-stable-backport: Backported in 5.10.118 +CVE_CHECK_IGNORE += "CVE-2022-1729" + +# cpe-stable-backport: Backported in 5.10.115 +CVE_CHECK_IGNORE += "CVE-2022-1734" + +# cpe-stable-backport: Backported in 5.10.117 +CVE_CHECK_IGNORE += "CVE-2022-1786" + +# cpe-stable-backport: Backported in 5.10.119 +CVE_CHECK_IGNORE += "CVE-2022-1789" + +# cpe-stable-backport: Backported in 5.10.114 +CVE_CHECK_IGNORE += "CVE-2022-1836" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-1852" + +# fixed-version: only affects 5.17rc8 onwards +CVE_CHECK_IGNORE += "CVE-2022-1882" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-1943" + +# cpe-stable-backport: Backported in 5.10.120 +CVE_CHECK_IGNORE += "CVE-2022-1966" + +# cpe-stable-backport: Backported in 5.10.120 +CVE_CHECK_IGNORE += "CVE-2022-1972" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-1973" + +# cpe-stable-backport: Backported in 5.10.115 +CVE_CHECK_IGNORE += "CVE-2022-1974" + +# cpe-stable-backport: Backported in 5.10.115 +CVE_CHECK_IGNORE += "CVE-2022-1975" + +# fixed-version: only affects 5.18rc2 onwards +CVE_CHECK_IGNORE += "CVE-2022-1976" + +# fixed-version: only affects 5.13rc7 onwards +CVE_CHECK_IGNORE += "CVE-2022-1998" + +# cpe-stable-backport: Backported in 5.10.102 +CVE_CHECK_IGNORE += "CVE-2022-20008" + +# cpe-stable-backport: Backported in 5.10.85 +CVE_CHECK_IGNORE += "CVE-2022-20132" + +# cpe-stable-backport: Backported in 5.10.64 +CVE_CHECK_IGNORE += "CVE-2022-20141" + +# CVE-2022-20148 needs backporting (fixed from 5.16rc1) + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-20153" + +# cpe-stable-backport: Backported in 5.10.90 +CVE_CHECK_IGNORE += "CVE-2022-20154" + +# cpe-stable-backport: Backported in 5.10.108 +CVE_CHECK_IGNORE += "CVE-2022-20158" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2022-20166" + +# cpe-stable-backport: Backported in 5.10.108 +CVE_CHECK_IGNORE += "CVE-2022-20368" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-20369" + +# CVE-2022-20409 needs backporting (fixed from 5.12rc1) + +# cpe-stable-backport: Backported in 5.10.142 +CVE_CHECK_IGNORE += "CVE-2022-20421" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2022-20422" + +# fixed-version: only affects 5.17rc4 onwards +CVE_CHECK_IGNORE += "CVE-2022-20423" + +# CVE-2022-20424 needs backporting (fixed from 5.12rc1) + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2022-20565" + +# cpe-stable-backport: Backported in 5.10.135 +CVE_CHECK_IGNORE += "CVE-2022-20566" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2022-20567" + +# CVE-2022-20568 needs backporting (fixed from 5.12rc1) + +# cpe-stable-backport: Backported in 5.10.120 +CVE_CHECK_IGNORE += "CVE-2022-20572" + +# cpe-stable-backport: Backported in 5.10.120 +CVE_CHECK_IGNORE += "CVE-2022-2078" + +# cpe-stable-backport: Backported in 5.10.123 +CVE_CHECK_IGNORE += "CVE-2022-21123" + +# cpe-stable-backport: Backported in 5.10.123 +CVE_CHECK_IGNORE += "CVE-2022-21125" + +# cpe-stable-backport: Backported in 5.10.123 +CVE_CHECK_IGNORE += "CVE-2022-21166" + +# fixed-version: Fixed after version 4.20 +CVE_CHECK_IGNORE += "CVE-2022-21385" + +# cpe-stable-backport: Backported in 5.10.119 +CVE_CHECK_IGNORE += "CVE-2022-21499" + +# cpe-stable-backport: Backported in 5.10.134 +CVE_CHECK_IGNORE += "CVE-2022-21505" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2022-2153" + +# cpe-stable-backport: Backported in 5.10.170 +CVE_CHECK_IGNORE += "CVE-2022-2196" + +# CVE-2022-2209 has no known resolution + +# cpe-stable-backport: Backported in 5.10.95 +CVE_CHECK_IGNORE += "CVE-2022-22942" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23036" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23037" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23038" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23039" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23040" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23041" + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23042" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-2308" + +# cpe-stable-backport: Backported in 5.10.129 +CVE_CHECK_IGNORE += "CVE-2022-2318" + +# CVE-2022-23222 needs backporting (fixed from 5.17rc1) + +# CVE-2022-2327 needs backporting (fixed from 5.12rc1) + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-2380" + +# cpe-stable-backport: Backported in 5.10.133 +CVE_CHECK_IGNORE += "CVE-2022-23816" + +# CVE-2022-23825 has no known resolution + +# cpe-stable-backport: Backported in 5.10.105 +CVE_CHECK_IGNORE += "CVE-2022-23960" + +# fixed-version: only affects 5.14rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-24122" + +# cpe-stable-backport: Backported in 5.10.96 +CVE_CHECK_IGNORE += "CVE-2022-24448" + +# cpe-stable-backport: Backported in 5.10.104 +CVE_CHECK_IGNORE += "CVE-2022-24958" + +# cpe-stable-backport: Backported in 5.10.96 +CVE_CHECK_IGNORE += "CVE-2022-24959" + +# cpe-stable-backport: Backported in 5.10.120 +CVE_CHECK_IGNORE += "CVE-2022-2503" + +# cpe-stable-backport: Backported in 5.10.101 +CVE_CHECK_IGNORE += "CVE-2022-25258" + +# CVE-2022-25265 has no known resolution + +# cpe-stable-backport: Backported in 5.10.101 +CVE_CHECK_IGNORE += "CVE-2022-25375" + +# cpe-stable-backport: Backported in 5.10.103 +CVE_CHECK_IGNORE += "CVE-2022-25636" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2022-2585" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2022-2586" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2022-2588" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-2590" + +# cpe-stable-backport: Backported in 5.10.150 +CVE_CHECK_IGNORE += "CVE-2022-2602" + +# cpe-stable-backport: Backported in 5.10.129 +CVE_CHECK_IGNORE += "CVE-2022-26365" + +# cpe-stable-backport: Backported in 5.10.136 +CVE_CHECK_IGNORE += "CVE-2022-26373" + +# cpe-stable-backport: Backported in 5.10.113 +CVE_CHECK_IGNORE += "CVE-2022-2639" + +# cpe-stable-backport: Backported in 5.10.109 +CVE_CHECK_IGNORE += "CVE-2022-26490" + +# cpe-stable-backport: Backported in 5.10.143 +CVE_CHECK_IGNORE += "CVE-2022-2663" + +# CVE-2022-26878 has no known resolution + +# cpe-stable-backport: Backported in 5.10.103 +CVE_CHECK_IGNORE += "CVE-2022-26966" + +# cpe-stable-backport: Backported in 5.10.103 +CVE_CHECK_IGNORE += "CVE-2022-27223" + +# cpe-stable-backport: Backported in 5.10.108 +CVE_CHECK_IGNORE += "CVE-2022-27666" + +# CVE-2022-27672 needs backporting (fixed from 6.2) + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-2785" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-27950" + +# cpe-stable-backport: Backported in 5.10.109 +CVE_CHECK_IGNORE += "CVE-2022-28356" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-28388" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-28389" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-28390" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-2873" + +# fixed-version: only affects 5.17rc3 onwards +CVE_CHECK_IGNORE += "CVE-2022-28796" + +# cpe-stable-backport: Backported in 5.10.117 +CVE_CHECK_IGNORE += "CVE-2022-28893" + +# cpe-stable-backport: Backported in 5.10.140 +CVE_CHECK_IGNORE += "CVE-2022-2905" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-29156" + +# cpe-stable-backport: Backported in 5.10.97 +CVE_CHECK_IGNORE += "CVE-2022-2938" + +# cpe-stable-backport: Backported in 5.10.113 +CVE_CHECK_IGNORE += "CVE-2022-29581" + +# cpe-stable-backport: Backported in 5.10.111 +CVE_CHECK_IGNORE += "CVE-2022-29582" + +# cpe-stable-backport: Backported in 5.10.120 +CVE_CHECK_IGNORE += "CVE-2022-2959" + +# CVE-2022-2961 has no known resolution + +# cpe-stable-backport: Backported in 5.10.101 +CVE_CHECK_IGNORE += "CVE-2022-2964" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-2977" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-2978" + +# cpe-stable-backport: Backported in 5.10.133 +CVE_CHECK_IGNORE += "CVE-2022-29900" + +# cpe-stable-backport: Backported in 5.10.133 +CVE_CHECK_IGNORE += "CVE-2022-29901" + +# CVE-2022-2991 needs backporting (fixed from 5.15rc1) + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-29968" + +# cpe-stable-backport: Backported in 5.10.140 +CVE_CHECK_IGNORE += "CVE-2022-3028" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-30594" + +# cpe-stable-backport: Backported in 5.10.145 +CVE_CHECK_IGNORE += "CVE-2022-3061" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3077" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-3078" + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3103" + +# cpe-stable-backport: Backported in 5.10.122 +CVE_CHECK_IGNORE += "CVE-2022-3104" + +# cpe-stable-backport: Backported in 5.10.91 +CVE_CHECK_IGNORE += "CVE-2022-3105" + +# cpe-stable-backport: Backported in 5.10.88 +CVE_CHECK_IGNORE += "CVE-2022-3106" + +# cpe-stable-backport: Backported in 5.10.108 +CVE_CHECK_IGNORE += "CVE-2022-3107" + +# CVE-2022-3108 needs backporting (fixed from 5.17rc1) + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3110" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-3111" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-3112" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-3113" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3114" + +# cpe-stable-backport: Backported in 5.10.121 +CVE_CHECK_IGNORE += "CVE-2022-3115" + +# cpe-stable-backport: Backported in 5.10.156 +CVE_CHECK_IGNORE += "CVE-2022-3169" + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3170" + +# CVE-2022-3176 needs backporting (fixed from 5.17rc1) + +# cpe-stable-backport: Backported in 5.10.111 +CVE_CHECK_IGNORE += "CVE-2022-3202" + +# cpe-stable-backport: Backported in 5.10.120 +CVE_CHECK_IGNORE += "CVE-2022-32250" + +# cpe-stable-backport: Backported in 5.10.125 +CVE_CHECK_IGNORE += "CVE-2022-32296" + +# CVE-2022-3238 has no known resolution + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2022-3239" + +# cpe-stable-backport: Backported in 5.10.122 +CVE_CHECK_IGNORE += "CVE-2022-32981" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-3303" + +# CVE-2022-3344 needs backporting (fixed from 6.1rc7) + +# cpe-stable-backport: Backported in 5.10.129 +CVE_CHECK_IGNORE += "CVE-2022-33740" + +# cpe-stable-backport: Backported in 5.10.129 +CVE_CHECK_IGNORE += "CVE-2022-33741" + +# cpe-stable-backport: Backported in 5.10.129 +CVE_CHECK_IGNORE += "CVE-2022-33742" + +# cpe-stable-backport: Backported in 5.10.129 +CVE_CHECK_IGNORE += "CVE-2022-33743" + +# cpe-stable-backport: Backported in 5.10.129 +CVE_CHECK_IGNORE += "CVE-2022-33744" + +# cpe-stable-backport: Backported in 5.10.114 +CVE_CHECK_IGNORE += "CVE-2022-33981" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2022-3424" + +# fixed-version: only affects 5.18rc2 onwards +CVE_CHECK_IGNORE += "CVE-2022-3435" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-34494" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-34495" + +# cpe-stable-backport: Backported in 5.10.130 +CVE_CHECK_IGNORE += "CVE-2022-34918" + +# cpe-stable-backport: Backported in 5.10.156 +CVE_CHECK_IGNORE += "CVE-2022-3521" + +# CVE-2022-3522 needs backporting (fixed from 6.1rc1) + +# CVE-2022-3523 needs backporting (fixed from 6.1rc1) + +# cpe-stable-backport: Backported in 5.10.154 +CVE_CHECK_IGNORE += "CVE-2022-3524" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3526" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3531" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3532" + +# CVE-2022-3533 has no known resolution + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2022-3534" + +# cpe-stable-backport: Backported in 5.10.150 +CVE_CHECK_IGNORE += "CVE-2022-3535" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3541" + +# cpe-stable-backport: Backported in 5.10.150 +CVE_CHECK_IGNORE += "CVE-2022-3542" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3543" + +# CVE-2022-3544 has no known resolution + +# cpe-stable-backport: Backported in 5.10.160 +CVE_CHECK_IGNORE += "CVE-2022-3545" + +# cpe-stable-backport: Backported in 5.10.154 +CVE_CHECK_IGNORE += "CVE-2022-3564" + +# cpe-stable-backport: Backported in 5.10.150 +CVE_CHECK_IGNORE += "CVE-2022-3565" + +# CVE-2022-3566 needs backporting (fixed from 6.1rc1) + +# CVE-2022-3567 needs backporting (fixed from 6.1rc1) + +# cpe-stable-backport: Backported in 5.10.121 +CVE_CHECK_IGNORE += "CVE-2022-3577" + +# cpe-stable-backport: Backported in 5.10.143 +CVE_CHECK_IGNORE += "CVE-2022-3586" + +# cpe-stable-backport: Backported in 5.10.150 +CVE_CHECK_IGNORE += "CVE-2022-3594" + +# CVE-2022-3595 needs backporting (fixed from 6.1rc1) + +# CVE-2022-3606 has no known resolution + +# cpe-stable-backport: Backported in 5.10.132 +CVE_CHECK_IGNORE += "CVE-2022-36123" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3619" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-3621" + +# cpe-stable-backport: Backported in 5.10.159 +CVE_CHECK_IGNORE += "CVE-2022-3623" + +# CVE-2022-3624 needs backporting (fixed from 6.0rc1) + +# cpe-stable-backport: Backported in 5.10.138 +CVE_CHECK_IGNORE += "CVE-2022-3625" + +# cpe-stable-backport: Backported in 5.10.154 +CVE_CHECK_IGNORE += "CVE-2022-3628" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2022-36280" + +# cpe-stable-backport: Backported in 5.10.138 +CVE_CHECK_IGNORE += "CVE-2022-3629" + +# fixed-version: only affects 5.19rc6 onwards +CVE_CHECK_IGNORE += "CVE-2022-3630" + +# cpe-stable-backport: Backported in 5.10.138 +CVE_CHECK_IGNORE += "CVE-2022-3633" + +# cpe-stable-backport: Backported in 5.10.138 +CVE_CHECK_IGNORE += "CVE-2022-3635" + +# CVE-2022-3636 needs backporting (fixed from 5.19rc1) + +# fixed-version: only affects 5.19 onwards +CVE_CHECK_IGNORE += "CVE-2022-3640" + +# cpe-stable-backport: Backported in 5.10.193 +CVE_CHECK_IGNORE += "CVE-2022-36402" + +# CVE-2022-3642 has no known resolution + +# cpe-stable-backport: Backported in 5.10.159 +CVE_CHECK_IGNORE += "CVE-2022-3643" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-3646" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-3649" + +# cpe-stable-backport: Backported in 5.10.134 +CVE_CHECK_IGNORE += "CVE-2022-36879" + +# cpe-stable-backport: Backported in 5.10.135 +CVE_CHECK_IGNORE += "CVE-2022-36946" + +# cpe-stable-backport: Backported in 5.10.170 +CVE_CHECK_IGNORE += "CVE-2022-3707" + +# CVE-2022-38096 has no known resolution + +# CVE-2022-38457 needs backporting (fixed from 6.2rc4) + +# CVE-2022-3903 needs backporting (fixed from 6.1rc2) + +# fixed-version: only affects 5.18 onwards +CVE_CHECK_IGNORE += "CVE-2022-3910" + +# CVE-2022-39188 needs backporting (fixed from 5.19rc8) + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2022-39189" + +# cpe-stable-backport: Backported in 5.10.140 +CVE_CHECK_IGNORE += "CVE-2022-39190" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3977" + +# cpe-stable-backport: Backported in 5.10.145 +CVE_CHECK_IGNORE += "CVE-2022-39842" + +# CVE-2022-40133 needs backporting (fixed from 6.2rc4) + +# cpe-stable-backport: Backported in 5.10.143 +CVE_CHECK_IGNORE += "CVE-2022-40307" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-40476" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-40768" + +# cpe-stable-backport: Backported in 5.10.142 +CVE_CHECK_IGNORE += "CVE-2022-4095" + +# cpe-stable-backport: Backported in 5.10.189 +CVE_CHECK_IGNORE += "CVE-2022-40982" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2022-41218" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2022-41222" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-4127" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-4128" + +# cpe-stable-backport: Backported in 5.10.166 +CVE_CHECK_IGNORE += "CVE-2022-4129" + +# fixed-version: only affects 5.17rc2 onwards +CVE_CHECK_IGNORE += "CVE-2022-4139" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-41674" + +# CVE-2022-41848 has no known resolution + +# cpe-stable-backport: Backported in 5.10.150 +CVE_CHECK_IGNORE += "CVE-2022-41849" + +# cpe-stable-backport: Backported in 5.10.150 +CVE_CHECK_IGNORE += "CVE-2022-41850" + +# cpe-stable-backport: Backported in 5.10.112 +CVE_CHECK_IGNORE += "CVE-2022-41858" + +# fixed-version: only affects 5.16rc7 onwards +CVE_CHECK_IGNORE += "CVE-2022-42328" + +# fixed-version: only affects 5.16rc7 onwards +CVE_CHECK_IGNORE += "CVE-2022-42329" + +# cpe-stable-backport: Backported in 5.10.146 +CVE_CHECK_IGNORE += "CVE-2022-42432" + +# cpe-stable-backport: Backported in 5.10.181 +CVE_CHECK_IGNORE += "CVE-2022-4269" + +# cpe-stable-backport: Backported in 5.10.141 +CVE_CHECK_IGNORE += "CVE-2022-42703" + +# cpe-stable-backport: Backported in 5.10.149 +CVE_CHECK_IGNORE += "CVE-2022-42719" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-42720" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-42721" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-42722" + +# cpe-stable-backport: Backported in 5.10.154 +CVE_CHECK_IGNORE += "CVE-2022-42895" + +# cpe-stable-backport: Backported in 5.10.154 +CVE_CHECK_IGNORE += "CVE-2022-42896" + +# cpe-stable-backport: Backported in 5.10.148 +CVE_CHECK_IGNORE += "CVE-2022-43750" + +# cpe-stable-backport: Backported in 5.10.158 +CVE_CHECK_IGNORE += "CVE-2022-4378" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2022-4379" + +# cpe-stable-backport: Backported in 5.10.165 +CVE_CHECK_IGNORE += "CVE-2022-4382" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-43945" + +# CVE-2022-44032 needs backporting (fixed from 6.4rc1) + +# CVE-2022-44033 needs backporting (fixed from 6.4rc1) + +# CVE-2022-44034 needs backporting (fixed from 6.4rc1) + +# CVE-2022-4543 has no known resolution + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-45869" + +# CVE-2022-45884 has no known resolution + +# CVE-2022-45885 has no known resolution + +# cpe-stable-backport: Backported in 5.10.183 +CVE_CHECK_IGNORE += "CVE-2022-45886" + +# cpe-stable-backport: Backported in 5.10.183 +CVE_CHECK_IGNORE += "CVE-2022-45887" + +# fixed-version: only affects 5.14rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-45888" + +# cpe-stable-backport: Backported in 5.10.183 +CVE_CHECK_IGNORE += "CVE-2022-45919" + +# cpe-stable-backport: Backported in 5.10.161 +CVE_CHECK_IGNORE += "CVE-2022-45934" + +# cpe-stable-backport: Backported in 5.10.142 +CVE_CHECK_IGNORE += "CVE-2022-4662" + +# CVE-2022-4696 needs backporting (fixed from 5.12rc1) + +# cpe-stable-backport: Backported in 5.10.136 +CVE_CHECK_IGNORE += "CVE-2022-4744" + +# cpe-stable-backport: Backported in 5.10.157 +CVE_CHECK_IGNORE += "CVE-2022-47518" + +# cpe-stable-backport: Backported in 5.10.157 +CVE_CHECK_IGNORE += "CVE-2022-47519" + +# cpe-stable-backport: Backported in 5.10.157 +CVE_CHECK_IGNORE += "CVE-2022-47520" + +# cpe-stable-backport: Backported in 5.10.157 +CVE_CHECK_IGNORE += "CVE-2022-47521" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2022-47929" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-47938" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-47939" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-47940" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-47941" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-47942" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-47943" + +# CVE-2022-47946 needs backporting (fixed from 5.12rc2) + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-4842" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-48423" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-48424" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-48425" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-48502" + +# cpe-stable-backport: Backported in 5.10.118 +CVE_CHECK_IGNORE += "CVE-2022-48619" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2023-0030" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2023-0045" + +# cpe-stable-backport: Backported in 5.10.80 +CVE_CHECK_IGNORE += "CVE-2023-0047" + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-0122" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-0160" + +# cpe-stable-backport: Backported in 5.10.164 +CVE_CHECK_IGNORE += "CVE-2023-0179" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-0210" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2023-0240" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2023-0266" + +# CVE-2023-0386 needs backporting (fixed from 6.2rc6) + +# cpe-stable-backport: Backported in 5.10.164 +CVE_CHECK_IGNORE += "CVE-2023-0394" + +# cpe-stable-backport: Backported in 5.10.165 +CVE_CHECK_IGNORE += "CVE-2023-0458" + +# cpe-stable-backport: Backported in 5.10.170 +CVE_CHECK_IGNORE += "CVE-2023-0459" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2023-0461" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-0468" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-0469" + +# cpe-stable-backport: Backported in 5.10.152 +CVE_CHECK_IGNORE += "CVE-2023-0590" + +# CVE-2023-0597 needs backporting (fixed from 6.2rc1) + +# cpe-stable-backport: Backported in 5.10.153 +CVE_CHECK_IGNORE += "CVE-2023-0615" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1032" + +# cpe-stable-backport: Backported in 5.10.166 +CVE_CHECK_IGNORE += "CVE-2023-1073" + +# cpe-stable-backport: Backported in 5.10.166 +CVE_CHECK_IGNORE += "CVE-2023-1074" + +# CVE-2023-1075 needs backporting (fixed from 6.2rc7) + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-1076" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-1077" + +# cpe-stable-backport: Backported in 5.10.168 +CVE_CHECK_IGNORE += "CVE-2023-1078" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-1079" + +# cpe-stable-backport: Backported in 5.10.137 +CVE_CHECK_IGNORE += "CVE-2023-1095" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-1118" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1192" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1193" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1194" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1195" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-1206" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2023-1249" + +# cpe-stable-backport: Backported in 5.10.80 +CVE_CHECK_IGNORE += "CVE-2023-1252" + +# cpe-stable-backport: Backported in 5.10.169 +CVE_CHECK_IGNORE += "CVE-2023-1281" + +# CVE-2023-1295 needs backporting (fixed from 5.12rc1) + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-1380" + +# cpe-stable-backport: Backported in 5.10.157 +CVE_CHECK_IGNORE += "CVE-2023-1382" + +# cpe-stable-backport: Backported in 5.10.10 +CVE_CHECK_IGNORE += "CVE-2023-1390" + +# CVE-2023-1476 has no known resolution + +# cpe-stable-backport: Backported in 5.10.169 +CVE_CHECK_IGNORE += "CVE-2023-1513" + +# cpe-stable-backport: Backported in 5.10.102 +CVE_CHECK_IGNORE += "CVE-2023-1582" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1583" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-1611" + +# cpe-stable-backport: Backported in 5.10.111 +CVE_CHECK_IGNORE += "CVE-2023-1637" + +# fixed-version: only affects 5.14rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1652" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-1670" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-1829" + +# cpe-stable-backport: Backported in 5.10.118 +CVE_CHECK_IGNORE += "CVE-2023-1838" + +# cpe-stable-backport: Backported in 5.10.176 +CVE_CHECK_IGNORE += "CVE-2023-1855" + +# cpe-stable-backport: Backported in 5.10.178 +CVE_CHECK_IGNORE += "CVE-2023-1859" + +# CVE-2023-1872 needs backporting (fixed from 5.18rc2) + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-1989" + +# cpe-stable-backport: Backported in 5.10.176 +CVE_CHECK_IGNORE += "CVE-2023-1990" + +# fixed-version: only affects 5.19rc7 onwards +CVE_CHECK_IGNORE += "CVE-2023-1998" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-2002" + +# cpe-stable-backport: Backported in 5.10.157 +CVE_CHECK_IGNORE += "CVE-2023-2006" + +# CVE-2023-2007 needs backporting (fixed from 6.0rc1) + +# cpe-stable-backport: Backported in 5.10.127 +CVE_CHECK_IGNORE += "CVE-2023-2008" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2019" + +# cpe-stable-backport: Backported in 5.10.189 +CVE_CHECK_IGNORE += "CVE-2023-20569" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-20588" + +# cpe-stable-backport: Backported in 5.10.187 +CVE_CHECK_IGNORE += "CVE-2023-20593" + +# CVE-2023-20928 needs backporting (fixed from 6.0rc1) + +# CVE-2023-20937 has no known resolution + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-20938" + +# CVE-2023-20941 has no known resolution + +# fixed-version: only affects 5.14rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-21102" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-21106" + +# cpe-stable-backport: Backported in 5.10.184 +CVE_CHECK_IGNORE += "CVE-2023-2124" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-21255" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-21264" + +# CVE-2023-21400 has no known resolution + +# cpe-stable-backport: Backported in 5.10.179 +CVE_CHECK_IGNORE += "CVE-2023-2156" + +# cpe-stable-backport: Backported in 5.10.168 +CVE_CHECK_IGNORE += "CVE-2023-2162" + +# cpe-stable-backport: Backported in 5.10.179 +CVE_CHECK_IGNORE += "CVE-2023-2163" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2166" + +# CVE-2023-2176 needs backporting (fixed from 6.3rc1) + +# cpe-stable-backport: Backported in 5.10.135 +CVE_CHECK_IGNORE += "CVE-2023-2177" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-2194" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2235" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2236" + +# cpe-stable-backport: Backported in 5.10.179 +CVE_CHECK_IGNORE += "CVE-2023-2248" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-2269" + +# CVE-2023-22995 needs backporting (fixed from 5.17rc1) + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-22996" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-22997" + +# cpe-stable-backport: Backported in 5.10.171 +CVE_CHECK_IGNORE += "CVE-2023-22998" + +# fixed-version: only affects 5.12rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-22999" + +# CVE-2023-23000 needs backporting (fixed from 5.17rc1) + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-23001" + +# cpe-stable-backport: Backported in 5.10.94 +CVE_CHECK_IGNORE += "CVE-2023-23002" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-23003" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-23004" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-23005" + +# cpe-stable-backport: Backported in 5.10.90 +CVE_CHECK_IGNORE += "CVE-2023-23006" + +# CVE-2023-23039 has no known resolution + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2023-23454" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2023-23455" + +# cpe-stable-backport: Backported in 5.10.166 +CVE_CHECK_IGNORE += "CVE-2023-23559" + +# CVE-2023-23586 needs backporting (fixed from 5.12rc1) + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2430" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-2483" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-25012" + +# cpe-stable-backport: Backported in 5.10.179 +CVE_CHECK_IGNORE += "CVE-2023-2513" + +# fixed-version: only affects 5.14rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-25775" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2598" + +# CVE-2023-26242 has no known resolution + +# CVE-2023-2640 has no known resolution + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-26544" + +# cpe-stable-backport: Backported in 5.10.169 +CVE_CHECK_IGNORE += "CVE-2023-26545" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-26605" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-26606" + +# cpe-stable-backport: Backported in 5.10.156 +CVE_CHECK_IGNORE += "CVE-2023-26607" + +# cpe-stable-backport: Backported in 5.10.159 +CVE_CHECK_IGNORE += "CVE-2023-28327" + +# cpe-stable-backport: Backported in 5.10.163 +CVE_CHECK_IGNORE += "CVE-2023-28328" + +# cpe-stable-backport: Backported in 5.10.110 +CVE_CHECK_IGNORE += "CVE-2023-28410" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-28464" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-28466" + +# cpe-stable-backport: Backported in 5.10.143 +CVE_CHECK_IGNORE += "CVE-2023-2860" + +# cpe-stable-backport: Backported in 5.10.51 +CVE_CHECK_IGNORE += "CVE-2023-28772" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-28866" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-2898" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-2985" + +# cpe-stable-backport: Backported in 5.10.153 +CVE_CHECK_IGNORE += "CVE-2023-3006" + +# Skipping CVE-2023-3022, no affected_versions + +# cpe-stable-backport: Backported in 5.10.176 +CVE_CHECK_IGNORE += "CVE-2023-30456" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-30772" + +# cpe-stable-backport: Backported in 5.10.181 +CVE_CHECK_IGNORE += "CVE-2023-3090" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2023-3106" + +# Skipping CVE-2023-3108, no affected_versions + +# CVE-2023-31081 has no known resolution + +# CVE-2023-31082 has no known resolution + +# CVE-2023-31083 needs backporting (fixed from 6.6rc1) + +# CVE-2023-31084 needs backporting (fixed from 6.4rc3) + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2023-31085" + +# cpe-stable-backport: Backported in 5.10.184 +CVE_CHECK_IGNORE += "CVE-2023-3111" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-3117" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-31248" + +# cpe-stable-backport: Backported in 5.10.181 +CVE_CHECK_IGNORE += "CVE-2023-3141" + +# cpe-stable-backport: Backported in 5.10.179 +CVE_CHECK_IGNORE += "CVE-2023-31436" + +# cpe-stable-backport: Backported in 5.10.115 +CVE_CHECK_IGNORE += "CVE-2023-3159" + +# cpe-stable-backport: Backported in 5.10.168 +CVE_CHECK_IGNORE += "CVE-2023-3161" + +# cpe-stable-backport: Backported in 5.10.183 +CVE_CHECK_IGNORE += "CVE-2023-3212" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-3220" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-32233" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-32247" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-32248" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-32250" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-32252" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-32254" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-32257" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-32258" + +# cpe-stable-backport: Backported in 5.10.168 +CVE_CHECK_IGNORE += "CVE-2023-32269" + +# CVE-2023-32629 has no known resolution + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-3268" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3269" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3312" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3317" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-33203" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-33250" + +# cpe-stable-backport: Backported in 5.10.177 +CVE_CHECK_IGNORE += "CVE-2023-33288" + +# cpe-stable-backport: Backported in 5.10.185 +CVE_CHECK_IGNORE += "CVE-2023-3338" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3355" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3357" + +# cpe-stable-backport: Backported in 5.10.166 +CVE_CHECK_IGNORE += "CVE-2023-3358" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3359" + +# CVE-2023-3389 needs backporting (fixed from 6.0rc1) + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-3390" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-33951" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-33952" + +# CVE-2023-3397 has no known resolution + +# cpe-stable-backport: Backported in 5.10.184 +CVE_CHECK_IGNORE += "CVE-2023-34255" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-34256" + +# fixed-version: only affects 6.1 onwards +CVE_CHECK_IGNORE += "CVE-2023-34319" + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2023-34324" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3439" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-35001" + +# cpe-stable-backport: Backported in 5.10.168 +CVE_CHECK_IGNORE += "CVE-2023-3567" + +# CVE-2023-35693 has no known resolution + +# cpe-stable-backport: Backported in 5.10.183 +CVE_CHECK_IGNORE += "CVE-2023-35788" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-35823" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-35824" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-35826" + +# cpe-stable-backport: Backported in 5.10.199 +CVE_CHECK_IGNORE += "CVE-2023-35827" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-35828" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2023-35829" + +# cpe-stable-backport: Backported in 5.10.185 +CVE_CHECK_IGNORE += "CVE-2023-3609" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-3610" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-3611" + +# CVE-2023-3640 has no known resolution + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-37453" + +# CVE-2023-37454 has no known resolution + +# cpe-stable-backport: Backported in 5.10.192 +CVE_CHECK_IGNORE += "CVE-2023-3772" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3773" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-3776" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-3777" + +# cpe-stable-backport: Backported in 5.10.154 +CVE_CHECK_IGNORE += "CVE-2023-3812" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38409" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38426" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38427" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38428" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38429" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38430" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38431" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38432" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-3863" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3865" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3866" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3867" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-39189" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-39191" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-39192" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-39193" + +# cpe-stable-backport: Backported in 5.10.192 +CVE_CHECK_IGNORE += "CVE-2023-39194" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-39197" + +# cpe-stable-backport: Backported in 5.10.208 +CVE_CHECK_IGNORE += "CVE-2023-39198" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-4004" + +# CVE-2023-4010 has no known resolution + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-4015" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-40283" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-40791" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-4128" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-4132" + +# CVE-2023-4133 needs backporting (fixed from 6.3) + +# CVE-2023-4134 needs backporting (fixed from 6.5rc1) + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-4147" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4155" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4194" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-4206" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-4207" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-4208" + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2023-4244" + +# cpe-stable-backport: Backported in 5.10.190 +CVE_CHECK_IGNORE += "CVE-2023-4273" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-42752" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-42753" + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2023-42754" + +# cpe-stable-backport: Backported in 5.10.197 +CVE_CHECK_IGNORE += "CVE-2023-42755" + +# fixed-version: only affects 6.4rc6 onwards +CVE_CHECK_IGNORE += "CVE-2023-42756" + +# cpe-stable-backport: Backported in 5.10.121 +CVE_CHECK_IGNORE += "CVE-2023-4385" + +# cpe-stable-backport: Backported in 5.10.118 +CVE_CHECK_IGNORE += "CVE-2023-4387" + +# cpe-stable-backport: Backported in 5.10.112 +CVE_CHECK_IGNORE += "CVE-2023-4389" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4394" + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-44466" + +# cpe-stable-backport: Backported in 5.10.118 +CVE_CHECK_IGNORE += "CVE-2023-4459" + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2023-4563" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4569" + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-45862" + +# cpe-stable-backport: Backported in 5.10.200 +CVE_CHECK_IGNORE += "CVE-2023-45863" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-45871" + +# fixed-version: only affects 6.5rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-45898" + +# fixed-version: only affects 6.4rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4610" + +# fixed-version: only affects 6.4rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4611" + +# CVE-2023-4622 needs backporting (fixed from 6.5rc1) + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-4623" + +# cpe-stable-backport: Backported in 5.10.199 +CVE_CHECK_IGNORE += "CVE-2023-46343" + +# cpe-stable-backport: Backported in 5.10.199 +CVE_CHECK_IGNORE += "CVE-2023-46813" + +# cpe-stable-backport: Backported in 5.10.209 +CVE_CHECK_IGNORE += "CVE-2023-46838" + +# cpe-stable-backport: Backported in 5.10.202 +CVE_CHECK_IGNORE += "CVE-2023-46862" + +# CVE-2023-47233 has no known resolution + +# cpe-stable-backport: Backported in 5.10.53 +CVE_CHECK_IGNORE += "CVE-2023-4732" + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2023-4881" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-4921" + +# CVE-2023-50431 needs backporting (fixed from 6.8rc1) + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-5090" + +# cpe-stable-backport: Backported in 5.10.192 +CVE_CHECK_IGNORE += "CVE-2023-51042" + +# cpe-stable-backport: Backported in 5.10.188 +CVE_CHECK_IGNORE += "CVE-2023-51043" + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-5158" + +# cpe-stable-backport: Backported in 5.10.206 +CVE_CHECK_IGNORE += "CVE-2023-51779" + +# cpe-stable-backport: Backported in 5.10.199 +CVE_CHECK_IGNORE += "CVE-2023-5178" + +# cpe-stable-backport: Backported in 5.10.205 +CVE_CHECK_IGNORE += "CVE-2023-51780" + +# cpe-stable-backport: Backported in 5.10.205 +CVE_CHECK_IGNORE += "CVE-2023-51781" + +# cpe-stable-backport: Backported in 5.10.205 +CVE_CHECK_IGNORE += "CVE-2023-51782" + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2023-5197" + +# cpe-stable-backport: Backported in 5.10.208 +CVE_CHECK_IGNORE += "CVE-2023-52340" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-5345" + +# fixed-version: only affects 6.2 onwards +CVE_CHECK_IGNORE += "CVE-2023-5633" + +# cpe-stable-backport: Backported in 5.10.199 +CVE_CHECK_IGNORE += "CVE-2023-5717" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-5972" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6039" + +# cpe-stable-backport: Backported in 5.10.208 +CVE_CHECK_IGNORE += "CVE-2023-6040" + +# fixed-version: only affects 6.6rc3 onwards +CVE_CHECK_IGNORE += "CVE-2023-6111" + +# cpe-stable-backport: Backported in 5.10.203 +CVE_CHECK_IGNORE += "CVE-2023-6121" + +# cpe-stable-backport: Backported in 5.10.195 +CVE_CHECK_IGNORE += "CVE-2023-6176" + +# fixed-version: only affects 6.6rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6200" + +# CVE-2023-6238 has no known resolution + +# CVE-2023-6240 has no known resolution + +# CVE-2023-6270 has no known resolution + +# CVE-2023-6356 has no known resolution + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6531" + +# CVE-2023-6535 has no known resolution + +# CVE-2023-6536 has no known resolution + +# cpe-stable-backport: Backported in 5.10.192 +CVE_CHECK_IGNORE += "CVE-2023-6546" + +# CVE-2023-6560 needs backporting (fixed from 6.7rc4) + +# cpe-stable-backport: Backported in 5.10.206 +CVE_CHECK_IGNORE += "CVE-2023-6606" + +# CVE-2023-6610 needs backporting (fixed from 6.7rc7) + +# fixed-version: only affects 5.11rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6622" + +# fixed-version: only affects 6.7rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6679" + +# cpe-stable-backport: Backported in 5.10.204 +CVE_CHECK_IGNORE += "CVE-2023-6817" + +# cpe-stable-backport: Backported in 5.10.209 +CVE_CHECK_IGNORE += "CVE-2023-6915" + +# cpe-stable-backport: Backported in 5.10.204 +CVE_CHECK_IGNORE += "CVE-2023-6931" + +# cpe-stable-backport: Backported in 5.10.203 +CVE_CHECK_IGNORE += "CVE-2023-6932" + +# CVE-2023-7042 has no known resolution + +# cpe-stable-backport: Backported in 5.10.173 +CVE_CHECK_IGNORE += "CVE-2023-7192" + +# fixed-version: only affects 6.5rc6 onwards +CVE_CHECK_IGNORE += "CVE-2024-0193" + +# CVE-2024-0340 needs backporting (fixed from 6.4rc6) + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-0443" + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-0562" + +# CVE-2024-0564 has no known resolution + +# CVE-2024-0565 needs backporting (fixed from 6.7rc6) + +# fixed-version: only affects 6.4rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-0582" + +# cpe-stable-backport: Backported in 5.10.203 +CVE_CHECK_IGNORE += "CVE-2024-0584" + +# CVE-2024-0607 needs backporting (fixed from 6.7rc2) + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-0639" + +# cpe-stable-backport: Backported in 5.10.198 +CVE_CHECK_IGNORE += "CVE-2024-0641" + +# cpe-stable-backport: Backported in 5.10.208 +CVE_CHECK_IGNORE += "CVE-2024-0646" + +# cpe-stable-backport: Backported in 5.10.180 +CVE_CHECK_IGNORE += "CVE-2024-0775" + +# CVE-2024-0841 has no known resolution + +# fixed-version: only affects 5.13rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-1085" + +# CVE-2024-1086 needs backporting (fixed from 6.8rc2) + +# CVE-2024-1312 needs backporting (fixed from 6.5rc4) + +# CVE-2024-21803 has no known resolution + +# CVE-2024-22099 has no known resolution + +# CVE-2024-22386 has no known resolution + +# fixed-version: only affects 5.15rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-22705" + +# CVE-2024-23196 has no known resolution + +# CVE-2024-23307 has no known resolution + +# CVE-2024-23848 has no known resolution + +# CVE-2024-23849 needs backporting (fixed from 6.8rc2) + +# CVE-2024-23850 has no known resolution + +# CVE-2024-23851 has no known resolution + +# CVE-2024-24855 has no known resolution + +# CVE-2024-24857 has no known resolution + +# CVE-2024-24858 has no known resolution + +# CVE-2024-24859 has no known resolution + +# CVE-2024-24860 has no known resolution + +# CVE-2024-24861 has no known resolution + +# CVE-2024-24864 has no known resolution + diff --git a/meta/recipes-kernel/linux/cve-exclusion_5.15.inc b/meta/recipes-kernel/linux/cve-exclusion_5.15.inc new file mode 100644 index 0000000000..922d7f457f --- /dev/null +++ b/meta/recipes-kernel/linux/cve-exclusion_5.15.inc @@ -0,0 +1,7753 @@ + +# Auto-generated CVE metadata, DO NOT EDIT BY HAND. +# Generated at 2024-03-08 10:36:30.059302 for version 5.15.150 + +python check_kernel_cve_status_version() { + this_version = "5.15.150" + kernel_version = d.getVar("LINUX_VERSION") + if kernel_version != this_version: + bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version)) +} +do_cve_check[prefuncs] += "check_kernel_cve_status_version" + +# fixed-version: Fixed after version 2.6.12rc2 +CVE_CHECK_IGNORE += "CVE-2003-1604" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2004-0230" + +# CVE-2005-3660 has no known resolution + +# fixed-version: Fixed after version 2.6.26rc5 +CVE_CHECK_IGNORE += "CVE-2006-3635" + +# fixed-version: Fixed after version 2.6.19rc3 +CVE_CHECK_IGNORE += "CVE-2006-5331" + +# fixed-version: Fixed after version 2.6.19rc2 +CVE_CHECK_IGNORE += "CVE-2006-6128" + +# CVE-2007-3719 has no known resolution + +# fixed-version: Fixed after version 2.6.12rc2 +CVE_CHECK_IGNORE += "CVE-2007-4774" + +# fixed-version: Fixed after version 2.6.24rc6 +CVE_CHECK_IGNORE += "CVE-2007-6761" + +# fixed-version: Fixed after version 2.6.20rc5 +CVE_CHECK_IGNORE += "CVE-2007-6762" + +# CVE-2008-2544 has no known resolution + +# CVE-2008-4609 has no known resolution + +# fixed-version: Fixed after version 2.6.25rc1 +CVE_CHECK_IGNORE += "CVE-2008-7316" + +# fixed-version: Fixed after version 2.6.31rc6 +CVE_CHECK_IGNORE += "CVE-2009-2692" + +# fixed-version: Fixed after version 2.6.23rc9 +CVE_CHECK_IGNORE += "CVE-2010-0008" + +# fixed-version: Fixed after version 2.6.36rc5 +CVE_CHECK_IGNORE += "CVE-2010-3432" + +# CVE-2010-4563 has no known resolution + +# fixed-version: Fixed after version 2.6.37rc6 +CVE_CHECK_IGNORE += "CVE-2010-4648" + +# fixed-version: Fixed after version 2.6.38rc1 +CVE_CHECK_IGNORE += "CVE-2010-5313" + +# CVE-2010-5321 has no known resolution + +# fixed-version: Fixed after version 2.6.35rc1 +CVE_CHECK_IGNORE += "CVE-2010-5328" + +# fixed-version: Fixed after version 2.6.39rc1 +CVE_CHECK_IGNORE += "CVE-2010-5329" + +# fixed-version: Fixed after version 2.6.34rc7 +CVE_CHECK_IGNORE += "CVE-2010-5331" + +# fixed-version: Fixed after version 2.6.37rc1 +CVE_CHECK_IGNORE += "CVE-2010-5332" + +# fixed-version: Fixed after version 3.2rc1 +CVE_CHECK_IGNORE += "CVE-2011-4098" + +# fixed-version: Fixed after version 3.3rc1 +CVE_CHECK_IGNORE += "CVE-2011-4131" + +# fixed-version: Fixed after version 3.2rc1 +CVE_CHECK_IGNORE += "CVE-2011-4915" + +# CVE-2011-4916 has no known resolution + +# CVE-2011-4917 has no known resolution + +# fixed-version: Fixed after version 3.2rc1 +CVE_CHECK_IGNORE += "CVE-2011-5321" + +# fixed-version: Fixed after version 3.1rc1 +CVE_CHECK_IGNORE += "CVE-2011-5327" + +# fixed-version: Fixed after version 3.7rc2 +CVE_CHECK_IGNORE += "CVE-2012-0957" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-2119" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-2136" + +# fixed-version: Fixed after version 3.5rc2 +CVE_CHECK_IGNORE += "CVE-2012-2137" + +# fixed-version: Fixed after version 3.4rc6 +CVE_CHECK_IGNORE += "CVE-2012-2313" + +# fixed-version: Fixed after version 3.4rc6 +CVE_CHECK_IGNORE += "CVE-2012-2319" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2012-2372" + +# fixed-version: Fixed after version 3.4rc1 +CVE_CHECK_IGNORE += "CVE-2012-2375" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-2390" + +# fixed-version: Fixed after version 3.5rc4 +CVE_CHECK_IGNORE += "CVE-2012-2669" + +# fixed-version: Fixed after version 2.6.34rc1 +CVE_CHECK_IGNORE += "CVE-2012-2744" + +# fixed-version: Fixed after version 3.4rc3 +CVE_CHECK_IGNORE += "CVE-2012-2745" + +# fixed-version: Fixed after version 3.5rc6 +CVE_CHECK_IGNORE += "CVE-2012-3364" + +# fixed-version: Fixed after version 3.4rc5 +CVE_CHECK_IGNORE += "CVE-2012-3375" + +# fixed-version: Fixed after version 3.5rc5 +CVE_CHECK_IGNORE += "CVE-2012-3400" + +# fixed-version: Fixed after version 3.6rc2 +CVE_CHECK_IGNORE += "CVE-2012-3412" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-3430" + +# fixed-version: Fixed after version 2.6.19rc4 +CVE_CHECK_IGNORE += "CVE-2012-3510" + +# fixed-version: Fixed after version 3.5rc6 +CVE_CHECK_IGNORE += "CVE-2012-3511" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-3520" + +# fixed-version: Fixed after version 3.0rc1 +CVE_CHECK_IGNORE += "CVE-2012-3552" + +# Skipping CVE-2012-4220, no affected_versions + +# Skipping CVE-2012-4221, no affected_versions + +# Skipping CVE-2012-4222, no affected_versions + +# fixed-version: Fixed after version 3.4rc1 +CVE_CHECK_IGNORE += "CVE-2012-4398" + +# fixed-version: Fixed after version 2.6.36rc4 +CVE_CHECK_IGNORE += "CVE-2012-4444" + +# fixed-version: Fixed after version 3.7rc6 +CVE_CHECK_IGNORE += "CVE-2012-4461" + +# fixed-version: Fixed after version 3.6rc5 +CVE_CHECK_IGNORE += "CVE-2012-4467" + +# fixed-version: Fixed after version 3.7rc3 +CVE_CHECK_IGNORE += "CVE-2012-4508" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2012-4530" + +# CVE-2012-4542 has no known resolution + +# fixed-version: Fixed after version 3.7rc4 +CVE_CHECK_IGNORE += "CVE-2012-4565" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2012-5374" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2012-5375" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-5517" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2012-6536" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2012-6537" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2012-6538" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6539" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6540" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6541" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6542" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6543" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6544" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6545" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2012-6546" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-6547" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-6548" + +# fixed-version: Fixed after version 3.6rc1 +CVE_CHECK_IGNORE += "CVE-2012-6549" + +# fixed-version: Fixed after version 3.3rc1 +CVE_CHECK_IGNORE += "CVE-2012-6638" + +# fixed-version: Fixed after version 3.6rc2 +CVE_CHECK_IGNORE += "CVE-2012-6647" + +# fixed-version: Fixed after version 3.6 +CVE_CHECK_IGNORE += "CVE-2012-6657" + +# fixed-version: Fixed after version 3.6rc5 +CVE_CHECK_IGNORE += "CVE-2012-6689" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-6701" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2012-6703" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2012-6704" + +# fixed-version: Fixed after version 3.4rc1 +CVE_CHECK_IGNORE += "CVE-2012-6712" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-0160" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-0190" + +# fixed-version: Fixed after version 3.8rc7 +CVE_CHECK_IGNORE += "CVE-2013-0216" + +# fixed-version: Fixed after version 3.8rc7 +CVE_CHECK_IGNORE += "CVE-2013-0217" + +# fixed-version: Fixed after version 3.8 +CVE_CHECK_IGNORE += "CVE-2013-0228" + +# fixed-version: Fixed after version 3.8rc7 +CVE_CHECK_IGNORE += "CVE-2013-0231" + +# fixed-version: Fixed after version 3.8rc6 +CVE_CHECK_IGNORE += "CVE-2013-0268" + +# fixed-version: Fixed after version 3.8 +CVE_CHECK_IGNORE += "CVE-2013-0290" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2013-0309" + +# fixed-version: Fixed after version 3.5 +CVE_CHECK_IGNORE += "CVE-2013-0310" + +# fixed-version: Fixed after version 3.7rc8 +CVE_CHECK_IGNORE += "CVE-2013-0311" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-0313" + +# fixed-version: Fixed after version 3.11rc7 +CVE_CHECK_IGNORE += "CVE-2013-0343" + +# fixed-version: Fixed after version 3.8rc6 +CVE_CHECK_IGNORE += "CVE-2013-0349" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-0871" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-0913" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-0914" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-1059" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-1763" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-1767" + +# fixed-version: Fixed after version 3.5rc1 +CVE_CHECK_IGNORE += "CVE-2013-1772" + +# fixed-version: Fixed after version 3.3rc1 +CVE_CHECK_IGNORE += "CVE-2013-1773" + +# fixed-version: Fixed after version 3.8rc5 +CVE_CHECK_IGNORE += "CVE-2013-1774" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1792" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-1796" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-1797" + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-1798" + +# fixed-version: Fixed after version 3.8rc6 +CVE_CHECK_IGNORE += "CVE-2013-1819" + +# fixed-version: Fixed after version 3.6rc7 +CVE_CHECK_IGNORE += "CVE-2013-1826" + +# fixed-version: Fixed after version 3.6rc3 +CVE_CHECK_IGNORE += "CVE-2013-1827" + +# fixed-version: Fixed after version 3.9rc2 +CVE_CHECK_IGNORE += "CVE-2013-1828" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1848" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1858" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-1860" + +# fixed-version: Fixed after version 3.7rc3 +CVE_CHECK_IGNORE += "CVE-2013-1928" + +# fixed-version: Fixed after version 3.9rc6 +CVE_CHECK_IGNORE += "CVE-2013-1929" + +# Skipping CVE-2013-1935, no affected_versions + +# fixed-version: Fixed after version 3.0rc1 +CVE_CHECK_IGNORE += "CVE-2013-1943" + +# fixed-version: Fixed after version 3.9rc5 +CVE_CHECK_IGNORE += "CVE-2013-1956" + +# fixed-version: Fixed after version 3.9rc5 +CVE_CHECK_IGNORE += "CVE-2013-1957" + +# fixed-version: Fixed after version 3.9rc5 +CVE_CHECK_IGNORE += "CVE-2013-1958" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-1959" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-1979" + +# fixed-version: Fixed after version 3.8rc2 +CVE_CHECK_IGNORE += "CVE-2013-2015" + +# fixed-version: Fixed after version 2.6.34 +CVE_CHECK_IGNORE += "CVE-2013-2017" + +# fixed-version: Fixed after version 3.8rc4 +CVE_CHECK_IGNORE += "CVE-2013-2058" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2094" + +# fixed-version: Fixed after version 2.6.34rc4 +CVE_CHECK_IGNORE += "CVE-2013-2128" + +# fixed-version: Fixed after version 3.11rc3 +CVE_CHECK_IGNORE += "CVE-2013-2140" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2141" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2146" + +# fixed-version: Fixed after version 3.12rc3 +CVE_CHECK_IGNORE += "CVE-2013-2147" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-2148" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-2164" + +# Skipping CVE-2013-2188, no affected_versions + +# fixed-version: Fixed after version 3.9rc4 +CVE_CHECK_IGNORE += "CVE-2013-2206" + +# Skipping CVE-2013-2224, no affected_versions + +# fixed-version: Fixed after version 3.10 +CVE_CHECK_IGNORE += "CVE-2013-2232" + +# fixed-version: Fixed after version 3.10 +CVE_CHECK_IGNORE += "CVE-2013-2234" + +# fixed-version: Fixed after version 3.9rc6 +CVE_CHECK_IGNORE += "CVE-2013-2237" + +# Skipping CVE-2013-2239, no affected_versions + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-2546" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-2547" + +# fixed-version: Fixed after version 3.9rc1 +CVE_CHECK_IGNORE += "CVE-2013-2548" + +# fixed-version: Fixed after version 3.9rc8 +CVE_CHECK_IGNORE += "CVE-2013-2596" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-2634" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-2635" + +# fixed-version: Fixed after version 3.9rc3 +CVE_CHECK_IGNORE += "CVE-2013-2636" + +# fixed-version: Fixed after version 3.10rc4 +CVE_CHECK_IGNORE += "CVE-2013-2850" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-2851" + +# fixed-version: Fixed after version 3.10rc6 +CVE_CHECK_IGNORE += "CVE-2013-2852" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2888" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2889" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2890" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2891" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2892" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2893" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2894" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2895" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2896" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-2897" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2898" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-2899" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-2929" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-2930" + +# fixed-version: Fixed after version 3.9 +CVE_CHECK_IGNORE += "CVE-2013-3076" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3222" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3223" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3224" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3225" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3226" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3227" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3228" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3229" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3230" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3231" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3232" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3233" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3234" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3235" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3236" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3237" + +# fixed-version: Fixed after version 3.9rc7 +CVE_CHECK_IGNORE += "CVE-2013-3301" + +# fixed-version: Fixed after version 3.8rc3 +CVE_CHECK_IGNORE += "CVE-2013-3302" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4125" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4127" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4129" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4162" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2013-4163" + +# fixed-version: Fixed after version 3.11rc5 +CVE_CHECK_IGNORE += "CVE-2013-4205" + +# fixed-version: Fixed after version 3.10rc4 +CVE_CHECK_IGNORE += "CVE-2013-4220" + +# fixed-version: Fixed after version 3.10rc5 +CVE_CHECK_IGNORE += "CVE-2013-4247" + +# fixed-version: Fixed after version 3.11rc6 +CVE_CHECK_IGNORE += "CVE-2013-4254" + +# fixed-version: Fixed after version 3.12rc4 +CVE_CHECK_IGNORE += "CVE-2013-4270" + +# fixed-version: Fixed after version 3.12rc6 +CVE_CHECK_IGNORE += "CVE-2013-4299" + +# fixed-version: Fixed after version 3.11 +CVE_CHECK_IGNORE += "CVE-2013-4300" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2013-4312" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-4343" + +# fixed-version: Fixed after version 3.13rc2 +CVE_CHECK_IGNORE += "CVE-2013-4345" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-4348" + +# fixed-version: Fixed after version 3.12rc2 +CVE_CHECK_IGNORE += "CVE-2013-4350" + +# fixed-version: Fixed after version 3.12rc4 +CVE_CHECK_IGNORE += "CVE-2013-4387" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2013-4470" + +# fixed-version: Fixed after version 3.10rc1 +CVE_CHECK_IGNORE += "CVE-2013-4483" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4511" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4512" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4513" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4514" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4515" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-4516" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-4563" + +# fixed-version: Fixed after version 3.13rc7 +CVE_CHECK_IGNORE += "CVE-2013-4579" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-4587" + +# fixed-version: Fixed after version 2.6.33rc4 +CVE_CHECK_IGNORE += "CVE-2013-4588" + +# fixed-version: Fixed after version 3.8rc1 +CVE_CHECK_IGNORE += "CVE-2013-4591" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2013-4592" + +# Skipping CVE-2013-4737, no affected_versions + +# Skipping CVE-2013-4738, no affected_versions + +# Skipping CVE-2013-4739, no affected_versions + +# fixed-version: Fixed after version 3.10rc5 +CVE_CHECK_IGNORE += "CVE-2013-5634" + +# fixed-version: Fixed after version 3.6rc6 +CVE_CHECK_IGNORE += "CVE-2013-6282" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6367" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6368" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6376" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6378" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6380" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6381" + +# fixed-version: Fixed after version 3.13rc4 +CVE_CHECK_IGNORE += "CVE-2013-6382" + +# fixed-version: Fixed after version 3.12 +CVE_CHECK_IGNORE += "CVE-2013-6383" + +# Skipping CVE-2013-6392, no affected_versions + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2013-6431" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-6432" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2013-6885" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7026" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2013-7027" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7263" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7264" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7265" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7266" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7267" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7268" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7269" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7270" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7271" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7281" + +# fixed-version: Fixed after version 3.13rc7 +CVE_CHECK_IGNORE += "CVE-2013-7339" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2013-7348" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2013-7421" + +# CVE-2013-7445 has no known resolution + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2013-7446" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2013-7470" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-0038" + +# fixed-version: Fixed after version 3.14rc5 +CVE_CHECK_IGNORE += "CVE-2014-0049" + +# fixed-version: Fixed after version 3.14 +CVE_CHECK_IGNORE += "CVE-2014-0055" + +# fixed-version: Fixed after version 3.14rc4 +CVE_CHECK_IGNORE += "CVE-2014-0069" + +# fixed-version: Fixed after version 3.14 +CVE_CHECK_IGNORE += "CVE-2014-0077" + +# fixed-version: Fixed after version 3.14rc7 +CVE_CHECK_IGNORE += "CVE-2014-0100" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-0101" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-0102" + +# fixed-version: Fixed after version 3.14rc7 +CVE_CHECK_IGNORE += "CVE-2014-0131" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-0155" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-0181" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-0196" + +# fixed-version: Fixed after version 2.6.33rc5 +CVE_CHECK_IGNORE += "CVE-2014-0203" + +# fixed-version: Fixed after version 2.6.37rc1 +CVE_CHECK_IGNORE += "CVE-2014-0205" + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-0206" + +# Skipping CVE-2014-0972, no affected_versions + +# fixed-version: Fixed after version 3.13 +CVE_CHECK_IGNORE += "CVE-2014-1438" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2014-1444" + +# fixed-version: Fixed after version 3.12rc7 +CVE_CHECK_IGNORE += "CVE-2014-1445" + +# fixed-version: Fixed after version 3.13rc7 +CVE_CHECK_IGNORE += "CVE-2014-1446" + +# fixed-version: Fixed after version 3.13rc8 +CVE_CHECK_IGNORE += "CVE-2014-1690" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-1737" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2014-1738" + +# fixed-version: Fixed after version 3.15rc6 +CVE_CHECK_IGNORE += "CVE-2014-1739" + +# fixed-version: Fixed after version 3.14rc2 +CVE_CHECK_IGNORE += "CVE-2014-1874" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-2038" + +# fixed-version: Fixed after version 3.14rc3 +CVE_CHECK_IGNORE += "CVE-2014-2039" + +# fixed-version: Fixed after version 3.14rc7 +CVE_CHECK_IGNORE += "CVE-2014-2309" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-2523" + +# fixed-version: Fixed after version 3.14 +CVE_CHECK_IGNORE += "CVE-2014-2568" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-2580" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-2672" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-2673" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-2678" + +# fixed-version: Fixed after version 3.14rc6 +CVE_CHECK_IGNORE += "CVE-2014-2706" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-2739" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-2851" + +# fixed-version: Fixed after version 3.2rc7 +CVE_CHECK_IGNORE += "CVE-2014-2889" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-3122" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-3144" + +# fixed-version: Fixed after version 3.15rc2 +CVE_CHECK_IGNORE += "CVE-2014-3145" + +# fixed-version: Fixed after version 3.15 +CVE_CHECK_IGNORE += "CVE-2014-3153" + +# fixed-version: Fixed after version 3.17rc4 +CVE_CHECK_IGNORE += "CVE-2014-3180" + +# fixed-version: Fixed after version 3.17rc3 +CVE_CHECK_IGNORE += "CVE-2014-3181" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3182" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3183" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3184" + +# fixed-version: Fixed after version 3.17rc3 +CVE_CHECK_IGNORE += "CVE-2014-3185" + +# fixed-version: Fixed after version 3.17rc3 +CVE_CHECK_IGNORE += "CVE-2014-3186" + +# Skipping CVE-2014-3519, no affected_versions + +# fixed-version: Fixed after version 3.16rc7 +CVE_CHECK_IGNORE += "CVE-2014-3534" + +# fixed-version: Fixed after version 2.6.36rc1 +CVE_CHECK_IGNORE += "CVE-2014-3535" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-3601" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3610" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3611" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-3631" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2014-3645" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3646" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-3647" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3673" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3687" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3688" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-3690" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-3917" + +# fixed-version: Fixed after version 3.15 +CVE_CHECK_IGNORE += "CVE-2014-3940" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-4014" + +# fixed-version: Fixed after version 3.14rc1 +CVE_CHECK_IGNORE += "CVE-2014-4027" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-4157" + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-4171" + +# Skipping CVE-2014-4322, no affected_versions + +# Skipping CVE-2014-4323, no affected_versions + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-4508" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-4608" + +# fixed-version: Fixed after version 3.16rc3 +CVE_CHECK_IGNORE += "CVE-2014-4611" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4652" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4653" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4654" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4655" + +# fixed-version: Fixed after version 3.16rc2 +CVE_CHECK_IGNORE += "CVE-2014-4656" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-4667" + +# fixed-version: Fixed after version 3.16rc4 +CVE_CHECK_IGNORE += "CVE-2014-4699" + +# fixed-version: Fixed after version 3.16rc6 +CVE_CHECK_IGNORE += "CVE-2014-4943" + +# fixed-version: Fixed after version 3.16rc7 +CVE_CHECK_IGNORE += "CVE-2014-5045" + +# fixed-version: Fixed after version 3.16 +CVE_CHECK_IGNORE += "CVE-2014-5077" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2014-5206" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2014-5207" + +# Skipping CVE-2014-5332, no affected_versions + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-5471" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-5472" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6410" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6416" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6417" + +# fixed-version: Fixed after version 3.17rc5 +CVE_CHECK_IGNORE += "CVE-2014-6418" + +# fixed-version: Fixed after version 3.17rc2 +CVE_CHECK_IGNORE += "CVE-2014-7145" + +# Skipping CVE-2014-7207, no affected_versions + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-7283" + +# fixed-version: Fixed after version 3.15rc7 +CVE_CHECK_IGNORE += "CVE-2014-7284" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-7822" + +# fixed-version: Fixed after version 3.18rc3 +CVE_CHECK_IGNORE += "CVE-2014-7825" + +# fixed-version: Fixed after version 3.18rc3 +CVE_CHECK_IGNORE += "CVE-2014-7826" + +# fixed-version: Fixed after version 3.18rc5 +CVE_CHECK_IGNORE += "CVE-2014-7841" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-7842" + +# fixed-version: Fixed after version 3.18rc5 +CVE_CHECK_IGNORE += "CVE-2014-7843" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-7970" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-7975" + +# fixed-version: Fixed after version 3.18rc3 +CVE_CHECK_IGNORE += "CVE-2014-8086" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8133" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8134" + +# fixed-version: Fixed after version 4.0rc7 +CVE_CHECK_IGNORE += "CVE-2014-8159" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-8160" + +# fixed-version: Fixed after version 3.12rc1 +CVE_CHECK_IGNORE += "CVE-2014-8171" + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2014-8172" + +# fixed-version: Fixed after version 3.13rc5 +CVE_CHECK_IGNORE += "CVE-2014-8173" + +# Skipping CVE-2014-8181, no affected_versions + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-8369" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-8480" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-8481" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8559" + +# fixed-version: Fixed after version 3.14rc3 +CVE_CHECK_IGNORE += "CVE-2014-8709" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2014-8884" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-8989" + +# fixed-version: Fixed after version 3.18rc6 +CVE_CHECK_IGNORE += "CVE-2014-9090" + +# fixed-version: Fixed after version 3.18rc6 +CVE_CHECK_IGNORE += "CVE-2014-9322" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9419" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9420" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9428" + +# fixed-version: Fixed after version 3.19rc4 +CVE_CHECK_IGNORE += "CVE-2014-9529" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9584" + +# fixed-version: Fixed after version 3.19rc4 +CVE_CHECK_IGNORE += "CVE-2014-9585" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9644" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9683" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9710" + +# fixed-version: Fixed after version 3.15rc1 +CVE_CHECK_IGNORE += "CVE-2014-9715" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2014-9717" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9728" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9729" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9730" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2014-9731" + +# Skipping CVE-2014-9777, no affected_versions + +# Skipping CVE-2014-9778, no affected_versions + +# Skipping CVE-2014-9779, no affected_versions + +# Skipping CVE-2014-9780, no affected_versions + +# Skipping CVE-2014-9781, no affected_versions + +# Skipping CVE-2014-9782, no affected_versions + +# Skipping CVE-2014-9783, no affected_versions + +# Skipping CVE-2014-9784, no affected_versions + +# Skipping CVE-2014-9785, no affected_versions + +# Skipping CVE-2014-9786, no affected_versions + +# Skipping CVE-2014-9787, no affected_versions + +# Skipping CVE-2014-9788, no affected_versions + +# Skipping CVE-2014-9789, no affected_versions + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-9803" + +# Skipping CVE-2014-9863, no affected_versions + +# Skipping CVE-2014-9864, no affected_versions + +# Skipping CVE-2014-9865, no affected_versions + +# Skipping CVE-2014-9866, no affected_versions + +# Skipping CVE-2014-9867, no affected_versions + +# Skipping CVE-2014-9868, no affected_versions + +# Skipping CVE-2014-9869, no affected_versions + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2014-9870" + +# Skipping CVE-2014-9871, no affected_versions + +# Skipping CVE-2014-9872, no affected_versions + +# Skipping CVE-2014-9873, no affected_versions + +# Skipping CVE-2014-9874, no affected_versions + +# Skipping CVE-2014-9875, no affected_versions + +# Skipping CVE-2014-9876, no affected_versions + +# Skipping CVE-2014-9877, no affected_versions + +# Skipping CVE-2014-9878, no affected_versions + +# Skipping CVE-2014-9879, no affected_versions + +# Skipping CVE-2014-9880, no affected_versions + +# Skipping CVE-2014-9881, no affected_versions + +# Skipping CVE-2014-9882, no affected_versions + +# Skipping CVE-2014-9883, no affected_versions + +# Skipping CVE-2014-9884, no affected_versions + +# Skipping CVE-2014-9885, no affected_versions + +# Skipping CVE-2014-9886, no affected_versions + +# Skipping CVE-2014-9887, no affected_versions + +# fixed-version: Fixed after version 3.13rc1 +CVE_CHECK_IGNORE += "CVE-2014-9888" + +# Skipping CVE-2014-9889, no affected_versions + +# Skipping CVE-2014-9890, no affected_versions + +# Skipping CVE-2014-9891, no affected_versions + +# Skipping CVE-2014-9892, no affected_versions + +# Skipping CVE-2014-9893, no affected_versions + +# Skipping CVE-2014-9894, no affected_versions + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2014-9895" + +# Skipping CVE-2014-9896, no affected_versions + +# Skipping CVE-2014-9897, no affected_versions + +# Skipping CVE-2014-9898, no affected_versions + +# Skipping CVE-2014-9899, no affected_versions + +# Skipping CVE-2014-9900, no affected_versions + +# fixed-version: Fixed after version 3.14rc4 +CVE_CHECK_IGNORE += "CVE-2014-9903" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2014-9904" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2014-9914" + +# fixed-version: Fixed after version 3.18rc2 +CVE_CHECK_IGNORE += "CVE-2014-9922" + +# fixed-version: Fixed after version 3.19rc1 +CVE_CHECK_IGNORE += "CVE-2014-9940" + +# fixed-version: Fixed after version 3.19rc6 +CVE_CHECK_IGNORE += "CVE-2015-0239" + +# fixed-version: Fixed after version 3.15rc5 +CVE_CHECK_IGNORE += "CVE-2015-0274" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-0275" + +# Skipping CVE-2015-0777, no affected_versions + +# Skipping CVE-2015-1328, no affected_versions + +# fixed-version: Fixed after version 4.2rc5 +CVE_CHECK_IGNORE += "CVE-2015-1333" + +# fixed-version: Fixed after version 4.4rc5 +CVE_CHECK_IGNORE += "CVE-2015-1339" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2015-1350" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-1420" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-1421" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-1465" + +# fixed-version: Fixed after version 3.19rc5 +CVE_CHECK_IGNORE += "CVE-2015-1573" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-1593" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2015-1805" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-2041" + +# fixed-version: Fixed after version 3.19 +CVE_CHECK_IGNORE += "CVE-2015-2042" + +# fixed-version: Fixed after version 4.0rc4 +CVE_CHECK_IGNORE += "CVE-2015-2150" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-2666" + +# fixed-version: Fixed after version 4.0rc3 +CVE_CHECK_IGNORE += "CVE-2015-2672" + +# fixed-version: Fixed after version 4.0rc6 +CVE_CHECK_IGNORE += "CVE-2015-2686" + +# fixed-version: Fixed after version 4.0rc3 +CVE_CHECK_IGNORE += "CVE-2015-2830" + +# CVE-2015-2877 has no known resolution + +# fixed-version: Fixed after version 4.0rc7 +CVE_CHECK_IGNORE += "CVE-2015-2922" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-2925" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-3212" + +# fixed-version: Fixed after version 2.6.33rc8 +CVE_CHECK_IGNORE += "CVE-2015-3214" + +# fixed-version: Fixed after version 4.2rc2 +CVE_CHECK_IGNORE += "CVE-2015-3288" + +# fixed-version: Fixed after version 4.2rc3 +CVE_CHECK_IGNORE += "CVE-2015-3290" + +# fixed-version: Fixed after version 4.2rc3 +CVE_CHECK_IGNORE += "CVE-2015-3291" + +# fixed-version: Fixed after version 4.0rc5 +CVE_CHECK_IGNORE += "CVE-2015-3331" + +# Skipping CVE-2015-3332, no affected_versions + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-3339" + +# fixed-version: Fixed after version 4.1rc2 +CVE_CHECK_IGNORE += "CVE-2015-3636" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-4001" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-4002" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-4003" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-4004" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-4036" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-4167" + +# fixed-version: Fixed after version 3.13rc5 +CVE_CHECK_IGNORE += "CVE-2015-4170" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-4176" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-4177" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-4178" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-4692" + +# fixed-version: Fixed after version 4.1rc6 +CVE_CHECK_IGNORE += "CVE-2015-4700" + +# fixed-version: Fixed after version 4.2rc7 +CVE_CHECK_IGNORE += "CVE-2015-5156" + +# fixed-version: Fixed after version 4.2rc3 +CVE_CHECK_IGNORE += "CVE-2015-5157" + +# fixed-version: Fixed after version 4.3rc3 +CVE_CHECK_IGNORE += "CVE-2015-5257" + +# fixed-version: Fixed after version 4.3rc3 +CVE_CHECK_IGNORE += "CVE-2015-5283" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-5307" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-5327" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-5364" + +# fixed-version: Fixed after version 4.1rc7 +CVE_CHECK_IGNORE += "CVE-2015-5366" + +# fixed-version: Fixed after version 4.2rc6 +CVE_CHECK_IGNORE += "CVE-2015-5697" + +# fixed-version: Fixed after version 4.1rc3 +CVE_CHECK_IGNORE += "CVE-2015-5706" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-5707" + +# fixed-version: Fixed after version 4.2rc5 +CVE_CHECK_IGNORE += "CVE-2015-6252" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-6526" + +# CVE-2015-6619 has no known resolution + +# CVE-2015-6646 has no known resolution + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-6937" + +# Skipping CVE-2015-7312, no affected_versions + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2015-7509" + +# fixed-version: Fixed after version 4.4rc7 +CVE_CHECK_IGNORE += "CVE-2015-7513" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-7515" + +# fixed-version: Fixed after version 4.4rc8 +CVE_CHECK_IGNORE += "CVE-2015-7550" + +# Skipping CVE-2015-7553, no affected_versions + +# fixed-version: Fixed after version 4.5rc2 +CVE_CHECK_IGNORE += "CVE-2015-7566" + +# fixed-version: Fixed after version 4.3rc4 +CVE_CHECK_IGNORE += "CVE-2015-7613" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-7799" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2015-7833" + +# Skipping CVE-2015-7837, no affected_versions + +# fixed-version: Fixed after version 4.3rc7 +CVE_CHECK_IGNORE += "CVE-2015-7872" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-7884" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-7885" + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2015-7990" + +# Skipping CVE-2015-8019, no affected_versions + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8104" + +# fixed-version: Fixed after version 4.0rc3 +CVE_CHECK_IGNORE += "CVE-2015-8215" + +# fixed-version: Fixed after version 2.6.34rc1 +CVE_CHECK_IGNORE += "CVE-2015-8324" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8374" + +# fixed-version: Fixed after version 4.4rc3 +CVE_CHECK_IGNORE += "CVE-2015-8539" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8543" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8550" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8551" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8552" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8553" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8569" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8575" + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2015-8660" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2015-8709" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-8746" + +# fixed-version: Fixed after version 4.3rc4 +CVE_CHECK_IGNORE += "CVE-2015-8767" + +# fixed-version: Fixed after version 4.4rc5 +CVE_CHECK_IGNORE += "CVE-2015-8785" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8787" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8812" + +# fixed-version: Fixed after version 4.4rc6 +CVE_CHECK_IGNORE += "CVE-2015-8816" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-8830" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8839" + +# fixed-version: Fixed after version 4.4rc3 +CVE_CHECK_IGNORE += "CVE-2015-8844" + +# fixed-version: Fixed after version 4.4rc3 +CVE_CHECK_IGNORE += "CVE-2015-8845" + +# Skipping CVE-2015-8937, no affected_versions + +# Skipping CVE-2015-8938, no affected_versions + +# Skipping CVE-2015-8939, no affected_versions + +# Skipping CVE-2015-8940, no affected_versions + +# Skipping CVE-2015-8941, no affected_versions + +# Skipping CVE-2015-8942, no affected_versions + +# Skipping CVE-2015-8943, no affected_versions + +# Skipping CVE-2015-8944, no affected_versions + +# fixed-version: Fixed after version 4.1rc2 +CVE_CHECK_IGNORE += "CVE-2015-8950" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2015-8952" + +# fixed-version: Fixed after version 4.3 +CVE_CHECK_IGNORE += "CVE-2015-8953" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2015-8955" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-8956" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8961" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2015-8962" + +# fixed-version: Fixed after version 4.4 +CVE_CHECK_IGNORE += "CVE-2015-8963" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8964" + +# fixed-version: Fixed after version 4.4rc8 +CVE_CHECK_IGNORE += "CVE-2015-8966" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2015-8967" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2015-8970" + +# fixed-version: Fixed after version 3.19rc7 +CVE_CHECK_IGNORE += "CVE-2015-9004" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2015-9016" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2015-9289" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-0617" + +# fixed-version: Fixed after version 4.5rc2 +CVE_CHECK_IGNORE += "CVE-2016-0723" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-0728" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-0758" + +# Skipping CVE-2016-0774, no affected_versions + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2016-0821" + +# fixed-version: Fixed after version 4.0rc5 +CVE_CHECK_IGNORE += "CVE-2016-0823" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2016-10044" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10088" + +# fixed-version: Fixed after version 4.9 +CVE_CHECK_IGNORE += "CVE-2016-10147" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-10150" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10153" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10154" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-10200" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10208" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-10229" + +# fixed-version: Fixed after version 4.8rc6 +CVE_CHECK_IGNORE += "CVE-2016-10318" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2016-10723" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10741" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-10764" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-10905" + +# fixed-version: Fixed after version 4.5rc6 +CVE_CHECK_IGNORE += "CVE-2016-10906" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-10907" + +# fixed-version: Fixed after version 4.7rc5 +CVE_CHECK_IGNORE += "CVE-2016-1237" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-1575" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-1576" + +# fixed-version: Fixed after version 4.7rc3 +CVE_CHECK_IGNORE += "CVE-2016-1583" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2016-2053" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2069" + +# fixed-version: Fixed after version 4.4 +CVE_CHECK_IGNORE += "CVE-2016-2070" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2085" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-2117" + +# fixed-version: Fixed after version 4.5 +CVE_CHECK_IGNORE += "CVE-2016-2143" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-2184" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-2185" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-2186" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-2187" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2016-2188" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2383" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2384" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2543" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2544" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2545" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2546" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2547" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2548" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2549" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2016-2550" + +# fixed-version: Fixed after version 4.5rc2 +CVE_CHECK_IGNORE += "CVE-2016-2782" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2016-2847" + +# Skipping CVE-2016-2853, no affected_versions + +# Skipping CVE-2016-2854, no affected_versions + +# fixed-version: Fixed after version 4.5 +CVE_CHECK_IGNORE += "CVE-2016-3044" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2016-3070" + +# fixed-version: Fixed after version 4.6rc2 +CVE_CHECK_IGNORE += "CVE-2016-3134" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3135" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3136" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3137" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3138" + +# fixed-version: Fixed after version 3.17rc1 +CVE_CHECK_IGNORE += "CVE-2016-3139" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3140" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3156" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3157" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3672" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-3689" + +# Skipping CVE-2016-3695, no affected_versions + +# Skipping CVE-2016-3699, no affected_versions + +# Skipping CVE-2016-3707, no affected_versions + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-3713" + +# CVE-2016-3775 has no known resolution + +# CVE-2016-3802 has no known resolution + +# CVE-2016-3803 has no known resolution + +# fixed-version: Fixed after version 4.4rc4 +CVE_CHECK_IGNORE += "CVE-2016-3841" + +# fixed-version: Fixed after version 4.8rc2 +CVE_CHECK_IGNORE += "CVE-2016-3857" + +# fixed-version: Fixed after version 4.5 +CVE_CHECK_IGNORE += "CVE-2016-3951" + +# fixed-version: Fixed after version 4.6rc3 +CVE_CHECK_IGNORE += "CVE-2016-3955" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-3961" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4440" + +# fixed-version: Fixed after version 4.7rc4 +CVE_CHECK_IGNORE += "CVE-2016-4470" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4482" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4485" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4486" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-4557" + +# fixed-version: Fixed after version 4.6rc7 +CVE_CHECK_IGNORE += "CVE-2016-4558" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-4565" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-4568" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4569" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4578" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4580" + +# fixed-version: Fixed after version 4.6rc7 +CVE_CHECK_IGNORE += "CVE-2016-4581" + +# fixed-version: Fixed after version 4.7rc4 +CVE_CHECK_IGNORE += "CVE-2016-4794" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-4805" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-4913" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4951" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4997" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-4998" + +# fixed-version: Fixed after version 4.9rc2 +CVE_CHECK_IGNORE += "CVE-2016-5195" + +# fixed-version: Fixed after version 4.7rc3 +CVE_CHECK_IGNORE += "CVE-2016-5243" + +# fixed-version: Fixed after version 4.7rc3 +CVE_CHECK_IGNORE += "CVE-2016-5244" + +# Skipping CVE-2016-5340, no affected_versions + +# Skipping CVE-2016-5342, no affected_versions + +# Skipping CVE-2016-5343, no affected_versions + +# Skipping CVE-2016-5344, no affected_versions + +# fixed-version: Fixed after version 4.7 +CVE_CHECK_IGNORE += "CVE-2016-5400" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-5412" + +# fixed-version: Fixed after version 4.7 +CVE_CHECK_IGNORE += "CVE-2016-5696" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-5728" + +# fixed-version: Fixed after version 4.7rc6 +CVE_CHECK_IGNORE += "CVE-2016-5828" + +# fixed-version: Fixed after version 4.7rc5 +CVE_CHECK_IGNORE += "CVE-2016-5829" + +# CVE-2016-5870 has no known resolution + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2016-6130" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-6136" + +# fixed-version: Fixed after version 4.7rc7 +CVE_CHECK_IGNORE += "CVE-2016-6156" + +# fixed-version: Fixed after version 4.7 +CVE_CHECK_IGNORE += "CVE-2016-6162" + +# fixed-version: Fixed after version 4.7rc7 +CVE_CHECK_IGNORE += "CVE-2016-6187" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-6197" + +# fixed-version: Fixed after version 4.6 +CVE_CHECK_IGNORE += "CVE-2016-6198" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-6213" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-6327" + +# fixed-version: Fixed after version 4.8rc3 +CVE_CHECK_IGNORE += "CVE-2016-6480" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-6516" + +# Skipping CVE-2016-6753, no affected_versions + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2016-6786" + +# fixed-version: Fixed after version 4.0rc1 +CVE_CHECK_IGNORE += "CVE-2016-6787" + +# fixed-version: Fixed after version 4.8rc5 +CVE_CHECK_IGNORE += "CVE-2016-6828" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-7039" + +# fixed-version: Fixed after version 4.9rc3 +CVE_CHECK_IGNORE += "CVE-2016-7042" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-7097" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-7117" + +# Skipping CVE-2016-7118, no affected_versions + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2016-7425" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2016-7910" + +# fixed-version: Fixed after version 4.7rc7 +CVE_CHECK_IGNORE += "CVE-2016-7911" + +# fixed-version: Fixed after version 4.6rc5 +CVE_CHECK_IGNORE += "CVE-2016-7912" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-7913" + +# fixed-version: Fixed after version 4.6rc4 +CVE_CHECK_IGNORE += "CVE-2016-7914" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-7915" + +# fixed-version: Fixed after version 4.6rc7 +CVE_CHECK_IGNORE += "CVE-2016-7916" + +# fixed-version: Fixed after version 4.5rc6 +CVE_CHECK_IGNORE += "CVE-2016-7917" + +# fixed-version: Fixed after version 4.9 +CVE_CHECK_IGNORE += "CVE-2016-8399" + +# Skipping CVE-2016-8401, no affected_versions + +# Skipping CVE-2016-8402, no affected_versions + +# Skipping CVE-2016-8403, no affected_versions + +# Skipping CVE-2016-8404, no affected_versions + +# fixed-version: Fixed after version 4.10rc6 +CVE_CHECK_IGNORE += "CVE-2016-8405" + +# Skipping CVE-2016-8406, no affected_versions + +# Skipping CVE-2016-8407, no affected_versions + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-8630" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-8632" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-8633" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2016-8636" + +# fixed-version: Fixed after version 4.9rc6 +CVE_CHECK_IGNORE += "CVE-2016-8645" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2016-8646" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-8650" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-8655" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2016-8658" + +# CVE-2016-8660 has no known resolution + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-8666" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-9083" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-9084" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-9120" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2016-9178" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2016-9191" + +# fixed-version: Fixed after version 4.9rc3 +CVE_CHECK_IGNORE += "CVE-2016-9313" + +# fixed-version: Fixed after version 4.9rc4 +CVE_CHECK_IGNORE += "CVE-2016-9555" + +# fixed-version: Fixed after version 4.9 +CVE_CHECK_IGNORE += "CVE-2016-9576" + +# fixed-version: Fixed after version 4.10rc1 +CVE_CHECK_IGNORE += "CVE-2016-9588" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2016-9604" + +# Skipping CVE-2016-9644, no affected_versions + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2016-9685" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-9754" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-9755" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-9756" + +# fixed-version: Fixed after version 4.9rc7 +CVE_CHECK_IGNORE += "CVE-2016-9777" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-9793" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-9794" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2016-9806" + +# fixed-version: Fixed after version 4.9rc8 +CVE_CHECK_IGNORE += "CVE-2016-9919" + +# Skipping CVE-2017-0403, no affected_versions + +# Skipping CVE-2017-0404, no affected_versions + +# Skipping CVE-2017-0426, no affected_versions + +# Skipping CVE-2017-0427, no affected_versions + +# CVE-2017-0507 has no known resolution + +# CVE-2017-0508 has no known resolution + +# Skipping CVE-2017-0510, no affected_versions + +# Skipping CVE-2017-0528, no affected_versions + +# Skipping CVE-2017-0537, no affected_versions + +# CVE-2017-0564 has no known resolution + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-0605" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-0627" + +# CVE-2017-0630 has no known resolution + +# CVE-2017-0749 has no known resolution + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2017-0750" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-0786" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-0861" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000111" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000112" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000251" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000252" + +# fixed-version: Fixed after version 4.1rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000253" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000255" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-1000363" + +# fixed-version: Fixed after version 4.12rc6 +CVE_CHECK_IGNORE += "CVE-2017-1000364" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-1000365" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000370" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-1000371" + +# fixed-version: Fixed after version 4.12rc6 +CVE_CHECK_IGNORE += "CVE-2017-1000379" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-1000380" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2017-1000405" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-1000407" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-1000410" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-10661" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-10662" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-10663" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-10810" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-10911" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-11089" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-11176" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-11472" + +# fixed-version: Fixed after version 4.13rc2 +CVE_CHECK_IGNORE += "CVE-2017-11473" + +# fixed-version: Fixed after version 4.13 +CVE_CHECK_IGNORE += "CVE-2017-11600" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2017-12134" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-12146" + +# fixed-version: Fixed after version 4.14rc2 +CVE_CHECK_IGNORE += "CVE-2017-12153" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-12154" + +# fixed-version: Fixed after version 4.9rc6 +CVE_CHECK_IGNORE += "CVE-2017-12168" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-12188" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-12190" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-12192" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-12193" + +# fixed-version: Fixed after version 4.13rc4 +CVE_CHECK_IGNORE += "CVE-2017-12762" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-13080" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-13166" + +# fixed-version: Fixed after version 4.5rc4 +CVE_CHECK_IGNORE += "CVE-2017-13167" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2017-13168" + +# fixed-version: Fixed after version 4.5rc1 +CVE_CHECK_IGNORE += "CVE-2017-13215" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-13216" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2017-13220" + +# CVE-2017-13221 has no known resolution + +# CVE-2017-13222 has no known resolution + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-13305" + +# fixed-version: Fixed after version 4.13rc7 +CVE_CHECK_IGNORE += "CVE-2017-13686" + +# CVE-2017-13693 has no known resolution + +# CVE-2017-13694 has no known resolution + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2017-13695" + +# fixed-version: Fixed after version 4.3rc1 +CVE_CHECK_IGNORE += "CVE-2017-13715" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-14051" + +# fixed-version: Fixed after version 4.12rc3 +CVE_CHECK_IGNORE += "CVE-2017-14106" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2017-14140" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-14156" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-14340" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-14489" + +# fixed-version: Fixed after version 4.13 +CVE_CHECK_IGNORE += "CVE-2017-14497" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-14954" + +# fixed-version: Fixed after version 4.14rc2 +CVE_CHECK_IGNORE += "CVE-2017-14991" + +# fixed-version: Fixed after version 4.9rc1 +CVE_CHECK_IGNORE += "CVE-2017-15102" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-15115" + +# fixed-version: Fixed after version 4.2rc1 +CVE_CHECK_IGNORE += "CVE-2017-15116" + +# fixed-version: Fixed after version 3.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-15121" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-15126" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2017-15127" + +# fixed-version: Fixed after version 4.14rc8 +CVE_CHECK_IGNORE += "CVE-2017-15128" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-15129" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-15265" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-15274" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-15299" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-15306" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-15537" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-15649" + +# fixed-version: Fixed after version 3.19rc3 +CVE_CHECK_IGNORE += "CVE-2017-15868" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-15951" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16525" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16526" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16527" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2017-16528" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16529" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16530" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16531" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16532" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-16533" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2017-16534" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-16535" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16536" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16537" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-16538" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-16643" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-16644" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2017-16645" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16646" + +# fixed-version: Fixed after version 4.14 +CVE_CHECK_IGNORE += "CVE-2017-16647" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16648" + +# fixed-version: Fixed after version 4.14 +CVE_CHECK_IGNORE += "CVE-2017-16649" + +# fixed-version: Fixed after version 4.14 +CVE_CHECK_IGNORE += "CVE-2017-16650" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16911" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16912" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16913" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-16914" + +# fixed-version: Fixed after version 4.14rc7 +CVE_CHECK_IGNORE += "CVE-2017-16939" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-16994" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-16995" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-16996" + +# fixed-version: Fixed after version 4.13rc7 +CVE_CHECK_IGNORE += "CVE-2017-17052" + +# fixed-version: Fixed after version 4.13rc7 +CVE_CHECK_IGNORE += "CVE-2017-17053" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17448" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17449" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17450" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17558" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17712" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17741" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17805" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-17806" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-17807" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17852" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17853" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17854" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17855" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17856" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17857" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-17862" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17863" + +# fixed-version: Fixed after version 4.15rc5 +CVE_CHECK_IGNORE += "CVE-2017-17864" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2017-17975" + +# fixed-version: Fixed after version 4.11rc7 +CVE_CHECK_IGNORE += "CVE-2017-18017" + +# fixed-version: Fixed after version 4.15rc7 +CVE_CHECK_IGNORE += "CVE-2017-18075" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18079" + +# CVE-2017-18169 has no known resolution + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2017-18174" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18193" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-18200" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2017-18202" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18203" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18204" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2017-18208" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18216" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18218" + +# fixed-version: Fixed after version 4.12rc4 +CVE_CHECK_IGNORE += "CVE-2017-18221" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-18222" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-18224" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-18232" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18241" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-18249" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18255" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18257" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2017-18261" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-18270" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2017-18344" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-18360" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2017-18379" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18509" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18549" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-18550" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2017-18551" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-18552" + +# fixed-version: Fixed after version 4.15rc6 +CVE_CHECK_IGNORE += "CVE-2017-18595" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-2583" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-2584" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-2596" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-2618" + +# fixed-version: Fixed after version 2.6.25rc1 +CVE_CHECK_IGNORE += "CVE-2017-2634" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-2636" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2017-2647" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-2671" + +# fixed-version: Fixed after version 4.14rc5 +CVE_CHECK_IGNORE += "CVE-2017-5123" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5546" + +# fixed-version: Fixed after version 4.10rc5 +CVE_CHECK_IGNORE += "CVE-2017-5547" + +# fixed-version: Fixed after version 4.10rc5 +CVE_CHECK_IGNORE += "CVE-2017-5548" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5549" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5550" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-5551" + +# fixed-version: Fixed after version 4.10rc6 +CVE_CHECK_IGNORE += "CVE-2017-5576" + +# fixed-version: Fixed after version 4.10rc6 +CVE_CHECK_IGNORE += "CVE-2017-5577" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-5669" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-5715" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2017-5753" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-5754" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-5897" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-5967" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-5970" + +# fixed-version: Fixed after version 4.4rc1 +CVE_CHECK_IGNORE += "CVE-2017-5972" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-5986" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-6001" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6074" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-6214" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6345" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6346" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-6347" + +# fixed-version: Fixed after version 4.10 +CVE_CHECK_IGNORE += "CVE-2017-6348" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-6353" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-6874" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2017-6951" + +# fixed-version: Fixed after version 4.11rc5 +CVE_CHECK_IGNORE += "CVE-2017-7184" + +# fixed-version: Fixed after version 4.11rc5 +CVE_CHECK_IGNORE += "CVE-2017-7187" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7261" + +# fixed-version: Fixed after version 4.10rc4 +CVE_CHECK_IGNORE += "CVE-2017-7273" + +# fixed-version: Fixed after version 4.11rc4 +CVE_CHECK_IGNORE += "CVE-2017-7277" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7294" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7308" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-7346" + +# CVE-2017-7369 has no known resolution + +# fixed-version: Fixed after version 4.11rc4 +CVE_CHECK_IGNORE += "CVE-2017-7374" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2017-7472" + +# fixed-version: Fixed after version 4.11 +CVE_CHECK_IGNORE += "CVE-2017-7477" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-7482" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-7487" + +# fixed-version: Fixed after version 4.7rc1 +CVE_CHECK_IGNORE += "CVE-2017-7495" + +# fixed-version: Fixed after version 4.12rc7 +CVE_CHECK_IGNORE += "CVE-2017-7518" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-7533" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-7541" + +# fixed-version: Fixed after version 4.13rc2 +CVE_CHECK_IGNORE += "CVE-2017-7542" + +# fixed-version: Fixed after version 4.13 +CVE_CHECK_IGNORE += "CVE-2017-7558" + +# fixed-version: Fixed after version 4.11rc6 +CVE_CHECK_IGNORE += "CVE-2017-7616" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2017-7618" + +# fixed-version: Fixed after version 4.11 +CVE_CHECK_IGNORE += "CVE-2017-7645" + +# fixed-version: Fixed after version 4.11rc7 +CVE_CHECK_IGNORE += "CVE-2017-7889" + +# fixed-version: Fixed after version 4.11 +CVE_CHECK_IGNORE += "CVE-2017-7895" + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2017-7979" + +# fixed-version: Fixed after version 4.11rc4 +CVE_CHECK_IGNORE += "CVE-2017-8061" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-8062" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8063" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8064" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8065" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8066" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2017-8067" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-8068" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-8069" + +# fixed-version: Fixed after version 4.10rc8 +CVE_CHECK_IGNORE += "CVE-2017-8070" + +# fixed-version: Fixed after version 4.10rc7 +CVE_CHECK_IGNORE += "CVE-2017-8071" + +# fixed-version: Fixed after version 4.10rc7 +CVE_CHECK_IGNORE += "CVE-2017-8072" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2017-8106" + +# fixed-version: Fixed after version 3.19rc6 +CVE_CHECK_IGNORE += "CVE-2017-8240" + +# CVE-2017-8242 has no known resolution + +# CVE-2017-8244 has no known resolution + +# CVE-2017-8245 has no known resolution + +# CVE-2017-8246 has no known resolution + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-8797" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2017-8824" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-8831" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-8890" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-8924" + +# fixed-version: Fixed after version 4.11rc2 +CVE_CHECK_IGNORE += "CVE-2017-8925" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-9059" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9074" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9075" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9076" + +# fixed-version: Fixed after version 4.12rc2 +CVE_CHECK_IGNORE += "CVE-2017-9077" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2017-9150" + +# fixed-version: Fixed after version 4.12rc3 +CVE_CHECK_IGNORE += "CVE-2017-9211" + +# fixed-version: Fixed after version 4.12rc3 +CVE_CHECK_IGNORE += "CVE-2017-9242" + +# fixed-version: Fixed after version 4.12rc5 +CVE_CHECK_IGNORE += "CVE-2017-9605" + +# fixed-version: Fixed after version 4.3rc7 +CVE_CHECK_IGNORE += "CVE-2017-9725" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-9984" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2017-9985" + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2017-9986" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2018-1000004" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-1000026" + +# fixed-version: Fixed after version 4.15 +CVE_CHECK_IGNORE += "CVE-2018-1000028" + +# fixed-version: Fixed after version 4.16 +CVE_CHECK_IGNORE += "CVE-2018-1000199" + +# fixed-version: Fixed after version 4.17rc5 +CVE_CHECK_IGNORE += "CVE-2018-1000200" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-1000204" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-10021" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-10074" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2018-10087" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2018-10124" + +# fixed-version: Fixed after version 4.17rc4 +CVE_CHECK_IGNORE += "CVE-2018-10322" + +# fixed-version: Fixed after version 4.17rc4 +CVE_CHECK_IGNORE += "CVE-2018-10323" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2018-1065" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2018-1066" + +# fixed-version: Fixed after version 4.13rc6 +CVE_CHECK_IGNORE += "CVE-2018-10675" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-1068" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-10840" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-10853" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-1087" + +# CVE-2018-10872 has no known resolution + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10876" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10877" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10878" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10879" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10880" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10881" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10882" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-10883" + +# fixed-version: Fixed after version 2.6.36rc1 +CVE_CHECK_IGNORE += "CVE-2018-10901" + +# fixed-version: Fixed after version 4.18rc6 +CVE_CHECK_IGNORE += "CVE-2018-10902" + +# fixed-version: Fixed after version 4.14rc2 +CVE_CHECK_IGNORE += "CVE-2018-1091" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1092" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1093" + +# fixed-version: Fixed after version 4.13rc5 +CVE_CHECK_IGNORE += "CVE-2018-10938" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1094" + +# fixed-version: Fixed after version 4.17rc3 +CVE_CHECK_IGNORE += "CVE-2018-10940" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-1095" + +# fixed-version: Fixed after version 4.17rc2 +CVE_CHECK_IGNORE += "CVE-2018-1108" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-1118" + +# fixed-version: Fixed after version 4.17rc6 +CVE_CHECK_IGNORE += "CVE-2018-1120" + +# CVE-2018-1121 has no known resolution + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2018-11232" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-1128" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-1129" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-1130" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-11412" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-11506" + +# fixed-version: Fixed after version 4.17rc5 +CVE_CHECK_IGNORE += "CVE-2018-11508" + +# CVE-2018-11987 has no known resolution + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2018-12126" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2018-12127" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2018-12130" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2018-12207" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-12232" + +# fixed-version: Fixed after version 4.18rc2 +CVE_CHECK_IGNORE += "CVE-2018-12233" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-12633" + +# fixed-version: Fixed after version 4.18rc2 +CVE_CHECK_IGNORE += "CVE-2018-12714" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-12896" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-12904" + +# CVE-2018-12928 has no known resolution + +# CVE-2018-12929 has no known resolution + +# CVE-2018-12930 has no known resolution + +# CVE-2018-12931 has no known resolution + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13053" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-13093" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-13094" + +# fixed-version: Fixed after version 4.18rc3 +CVE_CHECK_IGNORE += "CVE-2018-13095" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13096" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13097" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13098" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13099" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-13100" + +# fixed-version: Fixed after version 4.18rc4 +CVE_CHECK_IGNORE += "CVE-2018-13405" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-13406" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14609" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14610" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14611" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14612" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14613" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14614" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14615" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14616" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-14617" + +# fixed-version: Fixed after version 4.15rc4 +CVE_CHECK_IGNORE += "CVE-2018-14619" + +# fixed-version: Fixed after version 4.20rc6 +CVE_CHECK_IGNORE += "CVE-2018-14625" + +# fixed-version: Fixed after version 4.19rc6 +CVE_CHECK_IGNORE += "CVE-2018-14633" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2018-14634" + +# fixed-version: Fixed after version 4.19rc4 +CVE_CHECK_IGNORE += "CVE-2018-14641" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-14646" + +# fixed-version: Fixed after version 4.19rc2 +CVE_CHECK_IGNORE += "CVE-2018-14656" + +# fixed-version: Fixed after version 4.18rc8 +CVE_CHECK_IGNORE += "CVE-2018-14678" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-14734" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-15471" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-15572" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-15594" + +# fixed-version: Fixed after version 4.18rc5 +CVE_CHECK_IGNORE += "CVE-2018-16276" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2018-16597" + +# fixed-version: Fixed after version 4.19rc2 +CVE_CHECK_IGNORE += "CVE-2018-16658" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-16862" + +# fixed-version: Fixed after version 4.20rc3 +CVE_CHECK_IGNORE += "CVE-2018-16871" + +# fixed-version: Fixed after version 5.0rc5 +CVE_CHECK_IGNORE += "CVE-2018-16880" + +# fixed-version: Fixed after version 4.20 +CVE_CHECK_IGNORE += "CVE-2018-16882" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2018-16884" + +# CVE-2018-16885 has no known resolution + +# fixed-version: Fixed after version 4.19rc4 +CVE_CHECK_IGNORE += "CVE-2018-17182" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-17972" + +# CVE-2018-17977 has no known resolution + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-18021" + +# fixed-version: Fixed after version 4.19 +CVE_CHECK_IGNORE += "CVE-2018-18281" + +# fixed-version: Fixed after version 4.15rc6 +CVE_CHECK_IGNORE += "CVE-2018-18386" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-18397" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2018-18445" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-18559" + +# CVE-2018-18653 has no known resolution + +# fixed-version: Fixed after version 4.17rc4 +CVE_CHECK_IGNORE += "CVE-2018-18690" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2018-18710" + +# fixed-version: Fixed after version 4.20rc2 +CVE_CHECK_IGNORE += "CVE-2018-18955" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-19406" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2018-19407" + +# fixed-version: Fixed after version 4.20rc6 +CVE_CHECK_IGNORE += "CVE-2018-19824" + +# fixed-version: Fixed after version 4.20rc3 +CVE_CHECK_IGNORE += "CVE-2018-19854" + +# fixed-version: Fixed after version 4.20 +CVE_CHECK_IGNORE += "CVE-2018-19985" + +# fixed-version: Fixed after version 4.20rc6 +CVE_CHECK_IGNORE += "CVE-2018-20169" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-20449" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2018-20509" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2018-20510" + +# fixed-version: Fixed after version 4.19rc5 +CVE_CHECK_IGNORE += "CVE-2018-20511" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2018-20669" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2018-20784" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2018-20836" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2018-20854" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-20855" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-20856" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-20961" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-20976" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2018-21008" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2018-25015" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-25020" + +# CVE-2018-3574 has no known resolution + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-3620" + +# fixed-version: Fixed after version 4.17rc7 +CVE_CHECK_IGNORE += "CVE-2018-3639" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-3646" + +# fixed-version: Fixed after version 3.7rc1 +CVE_CHECK_IGNORE += "CVE-2018-3665" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-3693" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-5332" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-5333" + +# fixed-version: Fixed after version 4.15rc8 +CVE_CHECK_IGNORE += "CVE-2018-5344" + +# fixed-version: Fixed after version 4.18rc7 +CVE_CHECK_IGNORE += "CVE-2018-5390" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-5391" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-5703" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-5750" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-5803" + +# fixed-version: Fixed after version 4.17rc6 +CVE_CHECK_IGNORE += "CVE-2018-5814" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-5848" + +# Skipping CVE-2018-5856, no affected_versions + +# fixed-version: Fixed after version 4.11rc8 +CVE_CHECK_IGNORE += "CVE-2018-5873" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-5953" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-5995" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-6412" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-6554" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2018-6555" + +# CVE-2018-6559 has no known resolution + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2018-6927" + +# fixed-version: Fixed after version 4.14rc6 +CVE_CHECK_IGNORE += "CVE-2018-7191" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-7273" + +# fixed-version: Fixed after version 4.11rc1 +CVE_CHECK_IGNORE += "CVE-2018-7480" + +# fixed-version: Fixed after version 4.15rc3 +CVE_CHECK_IGNORE += "CVE-2018-7492" + +# fixed-version: Fixed after version 4.16rc2 +CVE_CHECK_IGNORE += "CVE-2018-7566" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-7740" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2018-7754" + +# fixed-version: Fixed after version 4.19rc5 +CVE_CHECK_IGNORE += "CVE-2018-7755" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-7757" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2018-7995" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-8043" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2018-8087" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-8781" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-8822" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2018-8897" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2018-9363" + +# fixed-version: Fixed after version 4.17rc3 +CVE_CHECK_IGNORE += "CVE-2018-9385" + +# fixed-version: Fixed after version 4.17rc3 +CVE_CHECK_IGNORE += "CVE-2018-9415" + +# fixed-version: Fixed after version 4.6rc1 +CVE_CHECK_IGNORE += "CVE-2018-9422" + +# fixed-version: Fixed after version 4.15rc6 +CVE_CHECK_IGNORE += "CVE-2018-9465" + +# fixed-version: Fixed after version 4.18rc5 +CVE_CHECK_IGNORE += "CVE-2018-9516" + +# fixed-version: Fixed after version 4.14rc1 +CVE_CHECK_IGNORE += "CVE-2018-9517" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2018-9518" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2018-9568" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-0136" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0145" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0146" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0147" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-0148" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-0149" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-0154" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-0155" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-10124" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-10125" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-10126" + +# CVE-2019-10140 has no known resolution + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-10142" + +# fixed-version: Fixed after version 5.3rc3 +CVE_CHECK_IGNORE += "CVE-2019-10207" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-10220" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-10638" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-10639" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2019-11085" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-11091" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-11135" + +# fixed-version: Fixed after version 4.8rc5 +CVE_CHECK_IGNORE += "CVE-2019-11190" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-11191" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-1125" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-11477" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-11478" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-11479" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-11486" + +# fixed-version: Fixed after version 5.1rc5 +CVE_CHECK_IGNORE += "CVE-2019-11487" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-11599" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-11683" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-11810" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-11811" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-11815" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-11833" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-11884" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-12378" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12379" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-12380" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-12381" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12382" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12454" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12455" + +# CVE-2019-12456 has no known resolution + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-12614" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-12615" + +# fixed-version: Fixed after version 5.2rc7 +CVE_CHECK_IGNORE += "CVE-2019-12817" + +# fixed-version: Fixed after version 5.0 +CVE_CHECK_IGNORE += "CVE-2019-12818" + +# fixed-version: Fixed after version 5.0rc8 +CVE_CHECK_IGNORE += "CVE-2019-12819" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2019-12881" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-12984" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-13233" + +# fixed-version: Fixed after version 5.2 +CVE_CHECK_IGNORE += "CVE-2019-13272" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-13631" + +# fixed-version: Fixed after version 5.3rc2 +CVE_CHECK_IGNORE += "CVE-2019-13648" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-14283" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-14284" + +# fixed-version: Fixed after version 5.5rc7 +CVE_CHECK_IGNORE += "CVE-2019-14615" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2019-14763" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14814" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14815" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14816" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-14821" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-14835" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-14895" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2019-14896" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2019-14897" + +# CVE-2019-14898 has no known resolution + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-14901" + +# fixed-version: Fixed after version 5.3rc8 +CVE_CHECK_IGNORE += "CVE-2019-15030" + +# fixed-version: Fixed after version 5.3rc8 +CVE_CHECK_IGNORE += "CVE-2019-15031" + +# fixed-version: Fixed after version 5.2rc2 +CVE_CHECK_IGNORE += "CVE-2019-15090" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-15098" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-15099" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-15117" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-15118" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15211" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15212" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15213" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15214" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15215" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-15216" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15217" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15218" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15219" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15220" + +# fixed-version: Fixed after version 5.2 +CVE_CHECK_IGNORE += "CVE-2019-15221" + +# fixed-version: Fixed after version 5.3rc3 +CVE_CHECK_IGNORE += "CVE-2019-15222" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15223" + +# CVE-2019-15239 has no known resolution + +# CVE-2019-15290 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-15291" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-15292" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-15504" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-15505" + +# fixed-version: Fixed after version 5.3rc6 +CVE_CHECK_IGNORE += "CVE-2019-15538" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-15666" + +# CVE-2019-15791 has no known resolution + +# CVE-2019-15792 has no known resolution + +# CVE-2019-15793 has no known resolution + +# fixed-version: Fixed after version 5.12 +CVE_CHECK_IGNORE += "CVE-2019-15794" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2019-15807" + +# CVE-2019-15902 has no known resolution + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-15916" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-15917" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15918" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15919" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-15920" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-15921" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-15922" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-15923" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-15924" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15925" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-15926" + +# fixed-version: Fixed after version 5.0rc2 +CVE_CHECK_IGNORE += "CVE-2019-15927" + +# CVE-2019-16089 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-16229" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-16230" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-16231" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-16232" + +# fixed-version: Fixed after version 5.4rc5 +CVE_CHECK_IGNORE += "CVE-2019-16233" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-16234" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-16413" + +# fixed-version: Fixed after version 5.3rc7 +CVE_CHECK_IGNORE += "CVE-2019-16714" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-16746" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2019-16921" + +# fixed-version: Fixed after version 5.0 +CVE_CHECK_IGNORE += "CVE-2019-16994" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-16995" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17052" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17053" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17054" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17055" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-17056" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-17075" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-17133" + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-17351" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-17666" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-18198" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-18282" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18660" + +# fixed-version: Fixed after version 4.17rc5 +CVE_CHECK_IGNORE += "CVE-2019-18675" + +# CVE-2019-18680 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18683" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18786" + +# fixed-version: Fixed after version 5.1rc7 +CVE_CHECK_IGNORE += "CVE-2019-18805" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-18806" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-18807" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18808" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-18809" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-18810" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-18811" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-18812" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-18813" + +# fixed-version: Fixed after version 5.7rc7 +CVE_CHECK_IGNORE += "CVE-2019-18814" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-18885" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19036" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-19037" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2019-19039" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19043" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19044" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19045" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19046" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19047" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19048" + +# fixed-version: Fixed after version 5.4rc5 +CVE_CHECK_IGNORE += "CVE-2019-19049" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19050" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19051" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19052" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19053" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19054" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19055" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19056" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19057" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19058" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19059" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19060" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19061" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19062" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19063" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19064" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19065" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19066" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19067" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19068" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19069" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19070" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19071" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19072" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19073" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19074" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19075" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19076" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19077" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19078" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-19079" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19080" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19081" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19082" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19083" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-19227" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19241" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19252" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19318" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19319" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19332" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19338" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2019-19377" + +# CVE-2019-19378 has no known resolution + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19447" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2019-19448" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2019-19449" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2019-19462" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19523" + +# fixed-version: Fixed after version 5.4rc8 +CVE_CHECK_IGNORE += "CVE-2019-19524" + +# fixed-version: Fixed after version 5.4rc2 +CVE_CHECK_IGNORE += "CVE-2019-19525" + +# fixed-version: Fixed after version 5.4rc4 +CVE_CHECK_IGNORE += "CVE-2019-19526" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19527" + +# fixed-version: Fixed after version 5.4rc3 +CVE_CHECK_IGNORE += "CVE-2019-19528" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19529" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-19530" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19531" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2019-19532" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19533" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19534" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19535" + +# fixed-version: Fixed after version 5.3rc4 +CVE_CHECK_IGNORE += "CVE-2019-19536" + +# fixed-version: Fixed after version 5.3rc5 +CVE_CHECK_IGNORE += "CVE-2019-19537" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19543" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19602" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2019-19767" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2019-19768" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2019-19769" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2019-19770" + +# fixed-version: Fixed after version 5.4rc7 +CVE_CHECK_IGNORE += "CVE-2019-19807" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19813" + +# CVE-2019-19814 has no known resolution + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2019-19815" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19816" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-19922" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-19927" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-19947" + +# fixed-version: Fixed after version 5.5rc2 +CVE_CHECK_IGNORE += "CVE-2019-19965" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-19966" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-1999" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-20054" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-20095" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-20096" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2019-2024" + +# fixed-version: Fixed after version 4.20rc5 +CVE_CHECK_IGNORE += "CVE-2019-2025" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-20422" + +# fixed-version: Fixed after version 4.8rc1 +CVE_CHECK_IGNORE += "CVE-2019-2054" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2019-20636" + +# CVE-2019-20794 has no known resolution + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-20806" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2019-20810" + +# fixed-version: Fixed after version 5.1rc3 +CVE_CHECK_IGNORE += "CVE-2019-20811" + +# fixed-version: Fixed after version 5.5rc3 +CVE_CHECK_IGNORE += "CVE-2019-20812" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2019-20908" + +# fixed-version: Fixed after version 5.3rc2 +CVE_CHECK_IGNORE += "CVE-2019-20934" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-2101" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-2181" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2019-2182" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-2213" + +# fixed-version: Fixed after version 5.3rc2 +CVE_CHECK_IGNORE += "CVE-2019-2214" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2019-2215" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-25044" + +# fixed-version: Fixed after version 5.1 +CVE_CHECK_IGNORE += "CVE-2019-25045" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2019-3016" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-3459" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-3460" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2019-3701" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-3819" + +# fixed-version: Fixed after version 3.18rc1 +CVE_CHECK_IGNORE += "CVE-2019-3837" + +# fixed-version: Fixed after version 5.2rc6 +CVE_CHECK_IGNORE += "CVE-2019-3846" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-3874" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-3882" + +# fixed-version: Fixed after version 5.1rc4 +CVE_CHECK_IGNORE += "CVE-2019-3887" + +# fixed-version: Fixed after version 5.1rc6 +CVE_CHECK_IGNORE += "CVE-2019-3892" + +# fixed-version: Fixed after version 2.6.35rc1 +CVE_CHECK_IGNORE += "CVE-2019-3896" + +# fixed-version: Fixed after version 5.2rc4 +CVE_CHECK_IGNORE += "CVE-2019-3900" + +# fixed-version: Fixed after version 4.6rc6 +CVE_CHECK_IGNORE += "CVE-2019-3901" + +# fixed-version: Fixed after version 5.3 +CVE_CHECK_IGNORE += "CVE-2019-5108" + +# Skipping CVE-2019-5489, no affected_versions + +# fixed-version: Fixed after version 5.0rc2 +CVE_CHECK_IGNORE += "CVE-2019-6133" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-6974" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-7221" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-7222" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2019-7308" + +# fixed-version: Fixed after version 5.0rc8 +CVE_CHECK_IGNORE += "CVE-2019-8912" + +# fixed-version: Fixed after version 5.0rc6 +CVE_CHECK_IGNORE += "CVE-2019-8956" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-8980" + +# fixed-version: Fixed after version 5.0rc4 +CVE_CHECK_IGNORE += "CVE-2019-9003" + +# fixed-version: Fixed after version 5.0rc7 +CVE_CHECK_IGNORE += "CVE-2019-9162" + +# fixed-version: Fixed after version 5.0 +CVE_CHECK_IGNORE += "CVE-2019-9213" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2019-9245" + +# fixed-version: Fixed after version 4.15rc2 +CVE_CHECK_IGNORE += "CVE-2019-9444" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9445" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2019-9453" + +# fixed-version: Fixed after version 4.15rc9 +CVE_CHECK_IGNORE += "CVE-2019-9454" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2019-9455" + +# fixed-version: Fixed after version 4.16rc6 +CVE_CHECK_IGNORE += "CVE-2019-9456" + +# fixed-version: Fixed after version 4.13rc1 +CVE_CHECK_IGNORE += "CVE-2019-9457" + +# fixed-version: Fixed after version 4.19rc7 +CVE_CHECK_IGNORE += "CVE-2019-9458" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9466" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9500" + +# fixed-version: Fixed after version 5.1rc1 +CVE_CHECK_IGNORE += "CVE-2019-9503" + +# fixed-version: Fixed after version 5.2 +CVE_CHECK_IGNORE += "CVE-2019-9506" + +# fixed-version: Fixed after version 5.1rc2 +CVE_CHECK_IGNORE += "CVE-2019-9857" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-0009" + +# fixed-version: Fixed after version 4.16rc3 +CVE_CHECK_IGNORE += "CVE-2020-0030" + +# fixed-version: Fixed after version 5.5rc2 +CVE_CHECK_IGNORE += "CVE-2020-0041" + +# fixed-version: Fixed after version 4.3rc7 +CVE_CHECK_IGNORE += "CVE-2020-0066" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2020-0067" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-0110" + +# fixed-version: Fixed after version 5.7rc4 +CVE_CHECK_IGNORE += "CVE-2020-0255" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2020-0305" + +# CVE-2020-0347 has no known resolution + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-0404" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-0423" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2020-0427" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2020-0429" + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2020-0430" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2020-0431" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-0432" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2020-0433" + +# fixed-version: Fixed after version 4.19rc1 +CVE_CHECK_IGNORE += "CVE-2020-0435" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-0444" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-0465" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2020-0466" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-0543" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10135" + +# fixed-version: Fixed after version 5.5rc5 +CVE_CHECK_IGNORE += "CVE-2020-10690" + +# CVE-2020-10708 has no known resolution + +# fixed-version: Fixed after version 5.7rc6 +CVE_CHECK_IGNORE += "CVE-2020-10711" + +# fixed-version: Fixed after version 5.2rc3 +CVE_CHECK_IGNORE += "CVE-2020-10720" + +# fixed-version: Fixed after version 5.7 +CVE_CHECK_IGNORE += "CVE-2020-10732" + +# fixed-version: Fixed after version 3.16rc1 +CVE_CHECK_IGNORE += "CVE-2020-10742" + +# fixed-version: Fixed after version 5.7rc4 +CVE_CHECK_IGNORE += "CVE-2020-10751" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10757" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10766" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10767" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-10768" + +# fixed-version: Fixed after version 5.0rc3 +CVE_CHECK_IGNORE += "CVE-2020-10769" + +# fixed-version: Fixed after version 5.4rc6 +CVE_CHECK_IGNORE += "CVE-2020-10773" + +# CVE-2020-10774 has no known resolution + +# fixed-version: Fixed after version 5.8rc6 +CVE_CHECK_IGNORE += "CVE-2020-10781" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-10942" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11494" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11565" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11608" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11609" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-11668" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2020-11669" + +# CVE-2020-11725 has no known resolution + +# fixed-version: Fixed after version 5.7rc4 +CVE_CHECK_IGNORE += "CVE-2020-11884" + +# CVE-2020-11935 has no known resolution + +# fixed-version: Fixed after version 5.3rc1 +CVE_CHECK_IGNORE += "CVE-2020-12114" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-12351" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-12352" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-12362" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-12363" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-12364" + +# fixed-version: Fixed after version 5.7rc3 +CVE_CHECK_IGNORE += "CVE-2020-12464" + +# fixed-version: Fixed after version 5.6rc6 +CVE_CHECK_IGNORE += "CVE-2020-12465" + +# fixed-version: Fixed after version 5.5rc7 +CVE_CHECK_IGNORE += "CVE-2020-12652" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-12653" + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2020-12654" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-12655" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-12656" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-12657" + +# fixed-version: Fixed after version 5.7rc2 +CVE_CHECK_IGNORE += "CVE-2020-12659" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-12768" + +# fixed-version: Fixed after version 5.5rc6 +CVE_CHECK_IGNORE += "CVE-2020-12769" + +# fixed-version: Fixed after version 5.7rc3 +CVE_CHECK_IGNORE += "CVE-2020-12770" + +# fixed-version: Fixed after version 5.8rc2 +CVE_CHECK_IGNORE += "CVE-2020-12771" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-12826" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-12888" + +# fixed-version: Fixed after version 5.10rc4 +CVE_CHECK_IGNORE += "CVE-2020-12912" + +# fixed-version: Fixed after version 5.7rc6 +CVE_CHECK_IGNORE += "CVE-2020-13143" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-13974" + +# CVE-2020-14304 has no known resolution + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2020-14305" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2020-14314" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-14331" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-14351" + +# fixed-version: Fixed after version 4.14rc3 +CVE_CHECK_IGNORE += "CVE-2020-14353" + +# fixed-version: Fixed after version 5.8rc5 +CVE_CHECK_IGNORE += "CVE-2020-14356" + +# fixed-version: Fixed after version 5.6rc6 +CVE_CHECK_IGNORE += "CVE-2020-14381" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-14385" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-14386" + +# fixed-version: Fixed after version 5.9rc6 +CVE_CHECK_IGNORE += "CVE-2020-14390" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2020-14416" + +# fixed-version: Fixed after version 5.8rc3 +CVE_CHECK_IGNORE += "CVE-2020-15393" + +# fixed-version: Fixed after version 5.8rc2 +CVE_CHECK_IGNORE += "CVE-2020-15436" + +# fixed-version: Fixed after version 5.8rc7 +CVE_CHECK_IGNORE += "CVE-2020-15437" + +# fixed-version: Fixed after version 5.8rc3 +CVE_CHECK_IGNORE += "CVE-2020-15780" + +# CVE-2020-15802 has no known resolution + +# fixed-version: Fixed after version 5.8rc6 +CVE_CHECK_IGNORE += "CVE-2020-15852" + +# fixed-version: Fixed after version 5.15rc2 +CVE_CHECK_IGNORE += "CVE-2020-16119" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-16120" + +# fixed-version: Fixed after version 5.8 +CVE_CHECK_IGNORE += "CVE-2020-16166" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2020-1749" + +# fixed-version: Fixed after version 5.8rc4 +CVE_CHECK_IGNORE += "CVE-2020-24394" + +# fixed-version: Fixed after version 5.8 +CVE_CHECK_IGNORE += "CVE-2020-24490" + +# CVE-2020-24502 has no known resolution + +# CVE-2020-24503 has no known resolution + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2020-24504" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2020-24586" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2020-24587" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2020-24588" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2020-25211" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-25212" + +# CVE-2020-25220 has no known resolution + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-25221" + +# fixed-version: Fixed after version 5.9rc5 +CVE_CHECK_IGNORE += "CVE-2020-25284" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-25285" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2020-25639" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2020-25641" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2020-25643" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2020-25645" + +# fixed-version: Fixed after version 5.10rc2 +CVE_CHECK_IGNORE += "CVE-2020-25656" + +# CVE-2020-25661 has no known resolution + +# CVE-2020-25662 has no known resolution + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-25668" + +# fixed-version: Fixed after version 5.10rc5 +CVE_CHECK_IGNORE += "CVE-2020-25669" + +# fixed-version: Fixed after version 5.12rc7 +CVE_CHECK_IGNORE += "CVE-2020-25670" + +# fixed-version: Fixed after version 5.12rc7 +CVE_CHECK_IGNORE += "CVE-2020-25671" + +# fixed-version: Fixed after version 5.12rc7 +CVE_CHECK_IGNORE += "CVE-2020-25672" + +# fixed-version: Fixed after version 5.12rc7 +CVE_CHECK_IGNORE += "CVE-2020-25673" + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-25704" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-25705" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-26088" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2020-26139" + +# CVE-2020-26140 has no known resolution + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2020-26141" + +# CVE-2020-26142 has no known resolution + +# CVE-2020-26143 has no known resolution + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2020-26145" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2020-26147" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2020-26541" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2020-26555" + +# CVE-2020-26556 has no known resolution + +# CVE-2020-26557 has no known resolution + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2020-26558" + +# CVE-2020-26559 has no known resolution + +# CVE-2020-26560 has no known resolution + +# fixed-version: Fixed after version 5.6 +CVE_CHECK_IGNORE += "CVE-2020-27066" + +# fixed-version: Fixed after version 4.14rc4 +CVE_CHECK_IGNORE += "CVE-2020-27067" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-27068" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27152" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2020-27170" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2020-27171" + +# fixed-version: Fixed after version 5.9 +CVE_CHECK_IGNORE += "CVE-2020-27194" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-2732" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2020-27418" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27673" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27675" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27777" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27784" + +# fixed-version: Fixed after version 5.7rc6 +CVE_CHECK_IGNORE += "CVE-2020-27786" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-27815" + +# cpe-stable-backport: Backported in 5.15.5 +CVE_CHECK_IGNORE += "CVE-2020-27820" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-27825" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-27830" + +# fixed-version: Fixed after version 5.10rc6 +CVE_CHECK_IGNORE += "CVE-2020-27835" + +# fixed-version: Fixed after version 5.9rc6 +CVE_CHECK_IGNORE += "CVE-2020-28097" + +# fixed-version: Fixed after version 5.11rc4 +CVE_CHECK_IGNORE += "CVE-2020-28374" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-28588" + +# fixed-version: Fixed after version 5.9 +CVE_CHECK_IGNORE += "CVE-2020-28915" + +# fixed-version: Fixed after version 5.10rc5 +CVE_CHECK_IGNORE += "CVE-2020-28941" + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-28974" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-29368" + +# fixed-version: Fixed after version 5.8rc7 +CVE_CHECK_IGNORE += "CVE-2020-29369" + +# fixed-version: Fixed after version 5.6rc7 +CVE_CHECK_IGNORE += "CVE-2020-29370" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2020-29371" + +# fixed-version: Fixed after version 5.7rc3 +CVE_CHECK_IGNORE += "CVE-2020-29372" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-29373" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-29374" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-29534" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-29568" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-29569" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-29660" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-29661" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-35499" + +# CVE-2020-35501 has no known resolution + +# fixed-version: Fixed after version 5.10rc3 +CVE_CHECK_IGNORE += "CVE-2020-35508" + +# fixed-version: Fixed after version 4.17rc1 +CVE_CHECK_IGNORE += "CVE-2020-35513" + +# fixed-version: Fixed after version 5.10rc7 +CVE_CHECK_IGNORE += "CVE-2020-35519" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-36158" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-36310" + +# fixed-version: Fixed after version 5.9rc5 +CVE_CHECK_IGNORE += "CVE-2020-36311" + +# fixed-version: Fixed after version 5.9rc5 +CVE_CHECK_IGNORE += "CVE-2020-36312" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-36313" + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2020-36322" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2020-36385" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-36386" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-36387" + +# cpe-stable-backport: Backported in 5.15.19 +CVE_CHECK_IGNORE += "CVE-2020-36516" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-36557" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-36558" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2020-36691" + +# fixed-version: Fixed after version 5.10 +CVE_CHECK_IGNORE += "CVE-2020-36694" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2020-36766" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2020-3702" + +# fixed-version: Fixed after version 5.10rc5 +CVE_CHECK_IGNORE += "CVE-2020-4788" + +# fixed-version: Fixed after version 5.2rc1 +CVE_CHECK_IGNORE += "CVE-2020-7053" + +# fixed-version: Fixed after version 5.5 +CVE_CHECK_IGNORE += "CVE-2020-8428" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2020-8647" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-8648" + +# fixed-version: Fixed after version 5.6rc5 +CVE_CHECK_IGNORE += "CVE-2020-8649" + +# fixed-version: Fixed after version 5.10rc4 +CVE_CHECK_IGNORE += "CVE-2020-8694" + +# CVE-2020-8832 has no known resolution + +# fixed-version: Fixed after version 4.18rc1 +CVE_CHECK_IGNORE += "CVE-2020-8834" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2020-8835" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2020-8992" + +# fixed-version: Fixed after version 5.6rc4 +CVE_CHECK_IGNORE += "CVE-2020-9383" + +# fixed-version: Fixed after version 5.6rc3 +CVE_CHECK_IGNORE += "CVE-2020-9391" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-0129" + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2021-0342" + +# CVE-2021-0399 has no known resolution + +# fixed-version: Fixed after version 4.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-0447" + +# fixed-version: Fixed after version 5.9rc7 +CVE_CHECK_IGNORE += "CVE-2021-0448" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-0512" + +# fixed-version: Fixed after version 5.8 +CVE_CHECK_IGNORE += "CVE-2021-0605" + +# CVE-2021-0606 has no known resolution + +# CVE-2021-0695 has no known resolution + +# fixed-version: Fixed after version 5.11rc3 +CVE_CHECK_IGNORE += "CVE-2021-0707" + +# fixed-version: Fixed after version 5.14rc4 +CVE_CHECK_IGNORE += "CVE-2021-0920" + +# CVE-2021-0924 has no known resolution + +# fixed-version: Fixed after version 5.6rc1 +CVE_CHECK_IGNORE += "CVE-2021-0929" + +# fixed-version: Fixed after version 4.16rc7 +CVE_CHECK_IGNORE += "CVE-2021-0935" + +# CVE-2021-0936 has no known resolution + +# fixed-version: Fixed after version 5.12rc8 +CVE_CHECK_IGNORE += "CVE-2021-0937" + +# fixed-version: Fixed after version 5.10rc4 +CVE_CHECK_IGNORE += "CVE-2021-0938" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-0941" + +# CVE-2021-0961 has no known resolution + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2021-1048" + +# fixed-version: Fixed after version 5.5rc1 +CVE_CHECK_IGNORE += "CVE-2021-20177" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2021-20194" + +# CVE-2021-20219 has no known resolution + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2021-20226" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2021-20239" + +# fixed-version: Fixed after version 4.5rc5 +CVE_CHECK_IGNORE += "CVE-2021-20261" + +# fixed-version: Fixed after version 4.5rc3 +CVE_CHECK_IGNORE += "CVE-2021-20265" + +# fixed-version: Fixed after version 5.11rc5 +CVE_CHECK_IGNORE += "CVE-2021-20268" + +# fixed-version: Fixed after version 5.9rc1 +CVE_CHECK_IGNORE += "CVE-2021-20292" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2021-20317" + +# fixed-version: Fixed after version 5.15rc3 +CVE_CHECK_IGNORE += "CVE-2021-20320" + +# fixed-version: Fixed after version 5.15rc5 +CVE_CHECK_IGNORE += "CVE-2021-20321" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-20322" + +# fixed-version: Fixed after version 5.11rc7 +CVE_CHECK_IGNORE += "CVE-2021-21781" + +# fixed-version: Fixed after version 5.13 +CVE_CHECK_IGNORE += "CVE-2021-22543" + +# fixed-version: Fixed after version 5.12rc8 +CVE_CHECK_IGNORE += "CVE-2021-22555" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-22600" + +# fixed-version: Fixed after version 5.12rc8 +CVE_CHECK_IGNORE += "CVE-2021-23133" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-23134" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2021-26401" + +# fixed-version: Fixed after version 5.11rc7 +CVE_CHECK_IGNORE += "CVE-2021-26708" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-26930" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-26931" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-26932" + +# CVE-2021-26934 has no known resolution + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2021-27363" + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2021-27364" + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2021-27365" + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2021-28038" + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2021-28039" + +# fixed-version: Fixed after version 5.12rc3 +CVE_CHECK_IGNORE += "CVE-2021-28375" + +# fixed-version: Fixed after version 5.12rc3 +CVE_CHECK_IGNORE += "CVE-2021-28660" + +# fixed-version: Fixed after version 5.12rc6 +CVE_CHECK_IGNORE += "CVE-2021-28688" + +# fixed-version: Fixed after version 5.13rc6 +CVE_CHECK_IGNORE += "CVE-2021-28691" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-28711" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-28712" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-28713" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-28714" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-28715" + +# fixed-version: Fixed after version 5.12rc4 +CVE_CHECK_IGNORE += "CVE-2021-28950" + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2021-28951" + +# fixed-version: Fixed after version 5.12rc4 +CVE_CHECK_IGNORE += "CVE-2021-28952" + +# fixed-version: Fixed after version 5.12rc4 +CVE_CHECK_IGNORE += "CVE-2021-28964" + +# fixed-version: Fixed after version 5.12rc4 +CVE_CHECK_IGNORE += "CVE-2021-28971" + +# fixed-version: Fixed after version 5.12rc4 +CVE_CHECK_IGNORE += "CVE-2021-28972" + +# fixed-version: Fixed after version 5.12rc7 +CVE_CHECK_IGNORE += "CVE-2021-29154" + +# fixed-version: Fixed after version 5.12rc8 +CVE_CHECK_IGNORE += "CVE-2021-29155" + +# fixed-version: Fixed after version 5.12rc3 +CVE_CHECK_IGNORE += "CVE-2021-29264" + +# fixed-version: Fixed after version 5.12rc3 +CVE_CHECK_IGNORE += "CVE-2021-29265" + +# fixed-version: Fixed after version 5.12rc4 +CVE_CHECK_IGNORE += "CVE-2021-29266" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2021-29646" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2021-29647" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2021-29648" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2021-29649" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2021-29650" + +# fixed-version: Fixed after version 5.12rc6 +CVE_CHECK_IGNORE += "CVE-2021-29657" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-30002" + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2021-30178" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-31440" + +# fixed-version: Fixed after version 5.11rc5 +CVE_CHECK_IGNORE += "CVE-2021-3178" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-31829" + +# fixed-version: Fixed after version 5.12rc5 +CVE_CHECK_IGNORE += "CVE-2021-31916" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-32078" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-32399" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2021-32606" + +# fixed-version: Fixed after version 5.12rc3 +CVE_CHECK_IGNORE += "CVE-2021-33033" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-33034" + +# CVE-2021-33061 needs backporting (fixed from 5.18rc1) + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2021-33098" + +# cpe-stable-backport: Backported in 5.15.29 +CVE_CHECK_IGNORE += "CVE-2021-33135" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2021-33200" + +# fixed-version: Fixed after version 5.11rc6 +CVE_CHECK_IGNORE += "CVE-2021-3347" + +# fixed-version: Fixed after version 5.11rc6 +CVE_CHECK_IGNORE += "CVE-2021-3348" + +# fixed-version: Fixed after version 5.13rc7 +CVE_CHECK_IGNORE += "CVE-2021-33624" + +# fixed-version: Fixed after version 5.4rc1 +CVE_CHECK_IGNORE += "CVE-2021-33630" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2021-33631" + +# cpe-stable-backport: Backported in 5.15.54 +CVE_CHECK_IGNORE += "CVE-2021-33655" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-33656" + +# fixed-version: Fixed after version 5.14rc3 +CVE_CHECK_IGNORE += "CVE-2021-33909" + +# fixed-version: Fixed after version 5.10 +CVE_CHECK_IGNORE += "CVE-2021-3411" + +# fixed-version: Fixed after version 5.9rc2 +CVE_CHECK_IGNORE += "CVE-2021-3428" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-3444" + +# fixed-version: Fixed after version 5.14rc4 +CVE_CHECK_IGNORE += "CVE-2021-34556" + +# fixed-version: Fixed after version 5.13rc7 +CVE_CHECK_IGNORE += "CVE-2021-34693" + +# fixed-version: Fixed after version 5.12rc6 +CVE_CHECK_IGNORE += "CVE-2021-3483" + +# fixed-version: Fixed after version 5.14 +CVE_CHECK_IGNORE += "CVE-2021-34866" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2021-3489" + +# fixed-version: Fixed after version 5.13rc4 +CVE_CHECK_IGNORE += "CVE-2021-3490" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-3491" + +# CVE-2021-3492 has no known resolution + +# fixed-version: Fixed after version 5.11rc1 +CVE_CHECK_IGNORE += "CVE-2021-3493" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-34981" + +# fixed-version: Fixed after version 5.12rc8 +CVE_CHECK_IGNORE += "CVE-2021-3501" + +# fixed-version: Fixed after version 5.13 +CVE_CHECK_IGNORE += "CVE-2021-35039" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-3506" + +# CVE-2021-3542 has no known resolution + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-3543" + +# fixed-version: Fixed after version 5.14rc4 +CVE_CHECK_IGNORE += "CVE-2021-35477" + +# fixed-version: Fixed after version 5.13rc5 +CVE_CHECK_IGNORE += "CVE-2021-3564" + +# fixed-version: Fixed after version 5.13rc5 +CVE_CHECK_IGNORE += "CVE-2021-3573" + +# fixed-version: Fixed after version 5.13rc5 +CVE_CHECK_IGNORE += "CVE-2021-3587" + +# fixed-version: Fixed after version 5.11 +CVE_CHECK_IGNORE += "CVE-2021-3600" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-3609" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-3612" + +# fixed-version: Fixed after version 5.5rc7 +CVE_CHECK_IGNORE += "CVE-2021-3635" + +# cpe-stable-backport: Backported in 5.15.3 +CVE_CHECK_IGNORE += "CVE-2021-3640" + +# fixed-version: Fixed after version 5.14rc7 +CVE_CHECK_IGNORE += "CVE-2021-3653" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-3655" + +# fixed-version: Fixed after version 5.14rc7 +CVE_CHECK_IGNORE += "CVE-2021-3656" + +# fixed-version: Fixed after version 5.12rc7 +CVE_CHECK_IGNORE += "CVE-2021-3659" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-3669" + +# fixed-version: Fixed after version 5.14rc3 +CVE_CHECK_IGNORE += "CVE-2021-3679" + +# CVE-2021-3714 has no known resolution + +# fixed-version: Fixed after version 5.6 +CVE_CHECK_IGNORE += "CVE-2021-3715" + +# fixed-version: Fixed after version 5.14rc3 +CVE_CHECK_IGNORE += "CVE-2021-37159" + +# fixed-version: Fixed after version 5.14rc6 +CVE_CHECK_IGNORE += "CVE-2021-3732" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-3736" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-3739" + +# fixed-version: Fixed after version 5.13rc7 +CVE_CHECK_IGNORE += "CVE-2021-3743" + +# fixed-version: Fixed after version 5.15rc4 +CVE_CHECK_IGNORE += "CVE-2021-3744" + +# cpe-stable-backport: Backported in 5.15.3 +CVE_CHECK_IGNORE += "CVE-2021-3752" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-3753" + +# fixed-version: Fixed after version 5.14rc3 +CVE_CHECK_IGNORE += "CVE-2021-37576" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-3759" + +# fixed-version: Fixed after version 5.15rc6 +CVE_CHECK_IGNORE += "CVE-2021-3760" + +# fixed-version: Fixed after version 5.15rc4 +CVE_CHECK_IGNORE += "CVE-2021-3764" + +# fixed-version: Fixed after version 5.15 +CVE_CHECK_IGNORE += "CVE-2021-3772" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-38160" + +# fixed-version: Fixed after version 5.14rc6 +CVE_CHECK_IGNORE += "CVE-2021-38166" + +# fixed-version: Fixed after version 5.13rc6 +CVE_CHECK_IGNORE += "CVE-2021-38198" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-38199" + +# fixed-version: Fixed after version 5.13rc7 +CVE_CHECK_IGNORE += "CVE-2021-38200" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-38201" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-38202" + +# fixed-version: Fixed after version 5.14rc2 +CVE_CHECK_IGNORE += "CVE-2021-38203" + +# fixed-version: Fixed after version 5.14rc3 +CVE_CHECK_IGNORE += "CVE-2021-38204" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-38205" + +# fixed-version: Fixed after version 5.13rc7 +CVE_CHECK_IGNORE += "CVE-2021-38206" + +# fixed-version: Fixed after version 5.13rc7 +CVE_CHECK_IGNORE += "CVE-2021-38207" + +# fixed-version: Fixed after version 5.13rc5 +CVE_CHECK_IGNORE += "CVE-2021-38208" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-38209" + +# fixed-version: Fixed after version 5.15rc4 +CVE_CHECK_IGNORE += "CVE-2021-38300" + +# CVE-2021-3847 has no known resolution + +# CVE-2021-3864 has no known resolution + +# CVE-2021-3892 has no known resolution + +# fixed-version: Fixed after version 5.15rc6 +CVE_CHECK_IGNORE += "CVE-2021-3894" + +# fixed-version: Fixed after version 5.15rc6 +CVE_CHECK_IGNORE += "CVE-2021-3896" + +# cpe-stable-backport: Backported in 5.15.14 +CVE_CHECK_IGNORE += "CVE-2021-3923" + +# fixed-version: Fixed after version 5.14 +CVE_CHECK_IGNORE += "CVE-2021-39633" + +# fixed-version: Fixed after version 5.9rc8 +CVE_CHECK_IGNORE += "CVE-2021-39634" + +# fixed-version: Fixed after version 4.16rc1 +CVE_CHECK_IGNORE += "CVE-2021-39636" + +# fixed-version: Fixed after version 5.11rc3 +CVE_CHECK_IGNORE += "CVE-2021-39648" + +# fixed-version: Fixed after version 5.12rc3 +CVE_CHECK_IGNORE += "CVE-2021-39656" + +# fixed-version: Fixed after version 5.11rc4 +CVE_CHECK_IGNORE += "CVE-2021-39657" + +# cpe-stable-backport: Backported in 5.15.8 +CVE_CHECK_IGNORE += "CVE-2021-39685" + +# cpe-stable-backport: Backported in 5.15.2 +CVE_CHECK_IGNORE += "CVE-2021-39686" + +# cpe-stable-backport: Backported in 5.15.8 +CVE_CHECK_IGNORE += "CVE-2021-39698" + +# fixed-version: Fixed after version 4.18rc6 +CVE_CHECK_IGNORE += "CVE-2021-39711" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2021-39713" + +# fixed-version: Fixed after version 4.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-39714" + +# CVE-2021-39800 has no known resolution + +# CVE-2021-39801 has no known resolution + +# CVE-2021-39802 has no known resolution + +# cpe-stable-backport: Backported in 5.15.5 +CVE_CHECK_IGNORE += "CVE-2021-4001" + +# cpe-stable-backport: Backported in 5.15.5 +CVE_CHECK_IGNORE += "CVE-2021-4002" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-4023" + +# fixed-version: Fixed after version 5.15rc4 +CVE_CHECK_IGNORE += "CVE-2021-4028" + +# fixed-version: Fixed after version 5.15rc7 +CVE_CHECK_IGNORE += "CVE-2021-4032" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2021-4037" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-40490" + +# cpe-stable-backport: Backported in 5.15.7 +CVE_CHECK_IGNORE += "CVE-2021-4083" + +# cpe-stable-backport: Backported in 5.15.5 +CVE_CHECK_IGNORE += "CVE-2021-4090" + +# fixed-version: Fixed after version 5.15rc7 +CVE_CHECK_IGNORE += "CVE-2021-4093" + +# CVE-2021-4095 needs backporting (fixed from 5.17rc1) + +# fixed-version: Fixed after version 5.15rc2 +CVE_CHECK_IGNORE += "CVE-2021-41073" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-4135" + +# fixed-version: Fixed after version 5.15 +CVE_CHECK_IGNORE += "CVE-2021-4148" + +# fixed-version: Fixed after version 5.15rc6 +CVE_CHECK_IGNORE += "CVE-2021-4149" + +# fixed-version: Fixed after version 5.15rc7 +CVE_CHECK_IGNORE += "CVE-2021-4150" + +# fixed-version: Fixed after version 5.14rc2 +CVE_CHECK_IGNORE += "CVE-2021-4154" + +# cpe-stable-backport: Backported in 5.15.14 +CVE_CHECK_IGNORE += "CVE-2021-4155" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-4157" + +# fixed-version: Fixed after version 5.7rc1 +CVE_CHECK_IGNORE += "CVE-2021-4159" + +# fixed-version: Fixed after version 5.15rc5 +CVE_CHECK_IGNORE += "CVE-2021-41864" + +# cpe-stable-backport: Backported in 5.15.14 +CVE_CHECK_IGNORE += "CVE-2021-4197" + +# fixed-version: Fixed after version 5.14rc7 +CVE_CHECK_IGNORE += "CVE-2021-42008" + +# cpe-stable-backport: Backported in 5.15.5 +CVE_CHECK_IGNORE += "CVE-2021-4202" + +# fixed-version: Fixed after version 5.15rc4 +CVE_CHECK_IGNORE += "CVE-2021-4203" + +# CVE-2021-4204 needs backporting (fixed from 5.17rc1) + +# fixed-version: Fixed after version 5.8rc1 +CVE_CHECK_IGNORE += "CVE-2021-4218" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2021-42252" + +# fixed-version: Fixed after version 5.15 +CVE_CHECK_IGNORE += "CVE-2021-42327" + +# cpe-stable-backport: Backported in 5.15.1 +CVE_CHECK_IGNORE += "CVE-2021-42739" + +# fixed-version: Fixed after version 5.15rc6 +CVE_CHECK_IGNORE += "CVE-2021-43056" + +# fixed-version: Fixed after version 5.15rc3 +CVE_CHECK_IGNORE += "CVE-2021-43057" + +# fixed-version: Fixed after version 5.15 +CVE_CHECK_IGNORE += "CVE-2021-43267" + +# fixed-version: Fixed after version 5.15rc6 +CVE_CHECK_IGNORE += "CVE-2021-43389" + +# cpe-stable-backport: Backported in 5.15.7 +CVE_CHECK_IGNORE += "CVE-2021-43975" + +# cpe-stable-backport: Backported in 5.15.17 +CVE_CHECK_IGNORE += "CVE-2021-43976" + +# cpe-stable-backport: Backported in 5.15.12 +CVE_CHECK_IGNORE += "CVE-2021-44733" + +# cpe-stable-backport: Backported in 5.15.17 +CVE_CHECK_IGNORE += "CVE-2021-44879" + +# cpe-stable-backport: Backported in 5.15.14 +CVE_CHECK_IGNORE += "CVE-2021-45095" + +# cpe-stable-backport: Backported in 5.15.12 +CVE_CHECK_IGNORE += "CVE-2021-45100" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-45402" + +# cpe-stable-backport: Backported in 5.15.12 +CVE_CHECK_IGNORE += "CVE-2021-45469" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2021-45480" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2021-45485" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2021-45486" + +# cpe-stable-backport: Backported in 5.15.3 +CVE_CHECK_IGNORE += "CVE-2021-45868" + +# fixed-version: Fixed after version 5.13rc7 +CVE_CHECK_IGNORE += "CVE-2021-46283" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-0001" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-0002" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-0168" + +# cpe-stable-backport: Backported in 5.15.70 +CVE_CHECK_IGNORE += "CVE-2022-0171" + +# cpe-stable-backport: Backported in 5.15.16 +CVE_CHECK_IGNORE += "CVE-2022-0185" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2022-0264" + +# fixed-version: Fixed after version 5.14rc2 +CVE_CHECK_IGNORE += "CVE-2022-0286" + +# fixed-version: Fixed after version 5.15rc6 +CVE_CHECK_IGNORE += "CVE-2022-0322" + +# cpe-stable-backport: Backported in 5.15.18 +CVE_CHECK_IGNORE += "CVE-2022-0330" + +# cpe-stable-backport: Backported in 5.15.14 +CVE_CHECK_IGNORE += "CVE-2022-0382" + +# CVE-2022-0400 has no known resolution + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-0433" + +# cpe-stable-backport: Backported in 5.15.23 +CVE_CHECK_IGNORE += "CVE-2022-0435" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2022-0480" + +# cpe-stable-backport: Backported in 5.15.23 +CVE_CHECK_IGNORE += "CVE-2022-0487" + +# cpe-stable-backport: Backported in 5.15.20 +CVE_CHECK_IGNORE += "CVE-2022-0492" + +# cpe-stable-backport: Backported in 5.15.27 +CVE_CHECK_IGNORE += "CVE-2022-0494" + +# cpe-stable-backport: Backported in 5.15.37 +CVE_CHECK_IGNORE += "CVE-2022-0500" + +# cpe-stable-backport: Backported in 5.15.23 +CVE_CHECK_IGNORE += "CVE-2022-0516" + +# cpe-stable-backport: Backported in 5.15.19 +CVE_CHECK_IGNORE += "CVE-2022-0617" + +# fixed-version: Fixed after version 5.15rc7 +CVE_CHECK_IGNORE += "CVE-2022-0644" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-0646" + +# cpe-stable-backport: Backported in 5.15.27 +CVE_CHECK_IGNORE += "CVE-2022-0742" + +# fixed-version: Fixed after version 5.8rc6 +CVE_CHECK_IGNORE += "CVE-2022-0812" + +# cpe-stable-backport: Backported in 5.15.25 +CVE_CHECK_IGNORE += "CVE-2022-0847" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2022-0850" + +# fixed-version: only affects 5.17rc6 onwards +CVE_CHECK_IGNORE += "CVE-2022-0854" + +# cpe-stable-backport: Backported in 5.15.29 +CVE_CHECK_IGNORE += "CVE-2022-0995" + +# CVE-2022-0998 needs backporting (fixed from 5.17rc1) + +# cpe-stable-backport: Backported in 5.15.29 +CVE_CHECK_IGNORE += "CVE-2022-1011" + +# cpe-stable-backport: Backported in 5.15.41 +CVE_CHECK_IGNORE += "CVE-2022-1012" + +# cpe-stable-backport: Backported in 5.15.32 +CVE_CHECK_IGNORE += "CVE-2022-1015" + +# cpe-stable-backport: Backported in 5.15.32 +CVE_CHECK_IGNORE += "CVE-2022-1016" + +# fixed-version: Fixed after version 5.14rc7 +CVE_CHECK_IGNORE += "CVE-2022-1043" + +# cpe-stable-backport: Backported in 5.15.32 +CVE_CHECK_IGNORE += "CVE-2022-1048" + +# cpe-stable-backport: Backported in 5.15.20 +CVE_CHECK_IGNORE += "CVE-2022-1055" + +# CVE-2022-1116 has no known resolution + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-1158" + +# cpe-stable-backport: Backported in 5.15.46 +CVE_CHECK_IGNORE += "CVE-2022-1184" + +# cpe-stable-backport: Backported in 5.15.12 +CVE_CHECK_IGNORE += "CVE-2022-1195" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-1198" + +# cpe-stable-backport: Backported in 5.15.29 +CVE_CHECK_IGNORE += "CVE-2022-1199" + +# cpe-stable-backport: Backported in 5.15.35 +CVE_CHECK_IGNORE += "CVE-2022-1204" + +# fixed-version: only affects 5.17rc4 onwards +CVE_CHECK_IGNORE += "CVE-2022-1205" + +# CVE-2022-1247 has no known resolution + +# cpe-stable-backport: Backported in 5.15.34 +CVE_CHECK_IGNORE += "CVE-2022-1263" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2022-1280" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-1353" + +# fixed-version: Fixed after version 5.6rc2 +CVE_CHECK_IGNORE += "CVE-2022-1419" + +# cpe-stable-backport: Backported in 5.15.58 +CVE_CHECK_IGNORE += "CVE-2022-1462" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2022-1508" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-1516" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-1651" + +# cpe-stable-backport: Backported in 5.15.42 +CVE_CHECK_IGNORE += "CVE-2022-1652" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-1671" + +# fixed-version: Fixed after version 4.20rc1 +CVE_CHECK_IGNORE += "CVE-2022-1678" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-1679" + +# cpe-stable-backport: Backported in 5.15.42 +CVE_CHECK_IGNORE += "CVE-2022-1729" + +# cpe-stable-backport: Backported in 5.15.39 +CVE_CHECK_IGNORE += "CVE-2022-1734" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2022-1786" + +# cpe-stable-backport: Backported in 5.15.44 +CVE_CHECK_IGNORE += "CVE-2022-1789" + +# cpe-stable-backport: Backported in 5.15.37 +CVE_CHECK_IGNORE += "CVE-2022-1836" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-1852" + +# fixed-version: only affects 5.17rc8 onwards +CVE_CHECK_IGNORE += "CVE-2022-1882" + +# cpe-stable-backport: Backported in 5.15.40 +CVE_CHECK_IGNORE += "CVE-2022-1943" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-1966" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-1972" + +# cpe-stable-backport: Backported in 5.15.46 +CVE_CHECK_IGNORE += "CVE-2022-1973" + +# cpe-stable-backport: Backported in 5.15.39 +CVE_CHECK_IGNORE += "CVE-2022-1974" + +# cpe-stable-backport: Backported in 5.15.39 +CVE_CHECK_IGNORE += "CVE-2022-1975" + +# fixed-version: only affects 5.18rc2 onwards +CVE_CHECK_IGNORE += "CVE-2022-1976" + +# cpe-stable-backport: Backported in 5.15.20 +CVE_CHECK_IGNORE += "CVE-2022-1998" + +# cpe-stable-backport: Backported in 5.15.25 +CVE_CHECK_IGNORE += "CVE-2022-20008" + +# cpe-stable-backport: Backported in 5.15.8 +CVE_CHECK_IGNORE += "CVE-2022-20132" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2022-20141" + +# cpe-stable-backport: Backported in 5.15.3 +CVE_CHECK_IGNORE += "CVE-2022-20148" + +# fixed-version: Fixed after version 5.13rc1 +CVE_CHECK_IGNORE += "CVE-2022-20153" + +# cpe-stable-backport: Backported in 5.15.13 +CVE_CHECK_IGNORE += "CVE-2022-20154" + +# cpe-stable-backport: Backported in 5.15.31 +CVE_CHECK_IGNORE += "CVE-2022-20158" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2022-20166" + +# cpe-stable-backport: Backported in 5.15.31 +CVE_CHECK_IGNORE += "CVE-2022-20368" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-20369" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2022-20409" + +# cpe-stable-backport: Backported in 5.15.66 +CVE_CHECK_IGNORE += "CVE-2022-20421" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-20422" + +# fixed-version: only affects 5.17rc4 onwards +CVE_CHECK_IGNORE += "CVE-2022-20423" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2022-20424" + +# fixed-version: Fixed after version 5.9rc4 +CVE_CHECK_IGNORE += "CVE-2022-20565" + +# cpe-stable-backport: Backported in 5.15.59 +CVE_CHECK_IGNORE += "CVE-2022-20566" + +# fixed-version: Fixed after version 4.16rc5 +CVE_CHECK_IGNORE += "CVE-2022-20567" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2022-20568" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-20572" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-2078" + +# cpe-stable-backport: Backported in 5.15.48 +CVE_CHECK_IGNORE += "CVE-2022-21123" + +# cpe-stable-backport: Backported in 5.15.48 +CVE_CHECK_IGNORE += "CVE-2022-21125" + +# cpe-stable-backport: Backported in 5.15.48 +CVE_CHECK_IGNORE += "CVE-2022-21166" + +# fixed-version: Fixed after version 4.20 +CVE_CHECK_IGNORE += "CVE-2022-21385" + +# cpe-stable-backport: Backported in 5.15.42 +CVE_CHECK_IGNORE += "CVE-2022-21499" + +# cpe-stable-backport: Backported in 5.15.58 +CVE_CHECK_IGNORE += "CVE-2022-21505" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-2153" + +# cpe-stable-backport: Backported in 5.15.96 +CVE_CHECK_IGNORE += "CVE-2022-2196" + +# CVE-2022-2209 has no known resolution + +# cpe-stable-backport: Backported in 5.15.18 +CVE_CHECK_IGNORE += "CVE-2022-22942" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23036" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23037" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23038" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23039" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23040" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23041" + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23042" + +# cpe-stable-backport: Backported in 5.15.72 +CVE_CHECK_IGNORE += "CVE-2022-2308" + +# cpe-stable-backport: Backported in 5.15.53 +CVE_CHECK_IGNORE += "CVE-2022-2318" + +# cpe-stable-backport: Backported in 5.15.37 +CVE_CHECK_IGNORE += "CVE-2022-23222" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2022-2327" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-2380" + +# cpe-stable-backport: Backported in 5.15.57 +CVE_CHECK_IGNORE += "CVE-2022-23816" + +# CVE-2022-23825 has no known resolution + +# cpe-stable-backport: Backported in 5.15.28 +CVE_CHECK_IGNORE += "CVE-2022-23960" + +# cpe-stable-backport: Backported in 5.15.19 +CVE_CHECK_IGNORE += "CVE-2022-24122" + +# cpe-stable-backport: Backported in 5.15.19 +CVE_CHECK_IGNORE += "CVE-2022-24448" + +# cpe-stable-backport: Backported in 5.15.27 +CVE_CHECK_IGNORE += "CVE-2022-24958" + +# cpe-stable-backport: Backported in 5.15.19 +CVE_CHECK_IGNORE += "CVE-2022-24959" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-2503" + +# cpe-stable-backport: Backported in 5.15.24 +CVE_CHECK_IGNORE += "CVE-2022-25258" + +# CVE-2022-25265 has no known resolution + +# cpe-stable-backport: Backported in 5.15.24 +CVE_CHECK_IGNORE += "CVE-2022-25375" + +# cpe-stable-backport: Backported in 5.15.26 +CVE_CHECK_IGNORE += "CVE-2022-25636" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-2585" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-2586" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-2588" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-2590" + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-2602" + +# cpe-stable-backport: Backported in 5.15.53 +CVE_CHECK_IGNORE += "CVE-2022-26365" + +# cpe-stable-backport: Backported in 5.15.60 +CVE_CHECK_IGNORE += "CVE-2022-26373" + +# cpe-stable-backport: Backported in 5.15.36 +CVE_CHECK_IGNORE += "CVE-2022-2639" + +# cpe-stable-backport: Backported in 5.15.32 +CVE_CHECK_IGNORE += "CVE-2022-26490" + +# cpe-stable-backport: Backported in 5.15.68 +CVE_CHECK_IGNORE += "CVE-2022-2663" + +# CVE-2022-26878 has no known resolution + +# cpe-stable-backport: Backported in 5.15.26 +CVE_CHECK_IGNORE += "CVE-2022-26966" + +# cpe-stable-backport: Backported in 5.15.26 +CVE_CHECK_IGNORE += "CVE-2022-27223" + +# cpe-stable-backport: Backported in 5.15.29 +CVE_CHECK_IGNORE += "CVE-2022-27666" + +# cpe-stable-backport: Backported in 5.15.94 +CVE_CHECK_IGNORE += "CVE-2022-27672" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-2785" + +# cpe-stable-backport: Backported in 5.15.25 +CVE_CHECK_IGNORE += "CVE-2022-27950" + +# cpe-stable-backport: Backported in 5.15.32 +CVE_CHECK_IGNORE += "CVE-2022-28356" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-28388" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-28389" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-28390" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-2873" + +# fixed-version: only affects 5.17rc3 onwards +CVE_CHECK_IGNORE += "CVE-2022-28796" + +# cpe-stable-backport: Backported in 5.15.41 +CVE_CHECK_IGNORE += "CVE-2022-28893" + +# cpe-stable-backport: Backported in 5.15.64 +CVE_CHECK_IGNORE += "CVE-2022-2905" + +# cpe-stable-backport: Backported in 5.15.26 +CVE_CHECK_IGNORE += "CVE-2022-29156" + +# cpe-stable-backport: Backported in 5.15.19 +CVE_CHECK_IGNORE += "CVE-2022-2938" + +# cpe-stable-backport: Backported in 5.15.36 +CVE_CHECK_IGNORE += "CVE-2022-29581" + +# cpe-stable-backport: Backported in 5.15.34 +CVE_CHECK_IGNORE += "CVE-2022-29582" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-2959" + +# CVE-2022-2961 has no known resolution + +# cpe-stable-backport: Backported in 5.15.24 +CVE_CHECK_IGNORE += "CVE-2022-2964" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-2977" + +# cpe-stable-backport: Backported in 5.15.73 +CVE_CHECK_IGNORE += "CVE-2022-2978" + +# cpe-stable-backport: Backported in 5.15.57 +CVE_CHECK_IGNORE += "CVE-2022-29900" + +# cpe-stable-backport: Backported in 5.15.57 +CVE_CHECK_IGNORE += "CVE-2022-29901" + +# fixed-version: Fixed after version 5.15rc1 +CVE_CHECK_IGNORE += "CVE-2022-2991" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-29968" + +# cpe-stable-backport: Backported in 5.15.64 +CVE_CHECK_IGNORE += "CVE-2022-3028" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-30594" + +# cpe-stable-backport: Backported in 5.15.70 +CVE_CHECK_IGNORE += "CVE-2022-3061" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-3077" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-3078" + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3103" + +# cpe-stable-backport: Backported in 5.15.47 +CVE_CHECK_IGNORE += "CVE-2022-3104" + +# cpe-stable-backport: Backported in 5.15.14 +CVE_CHECK_IGNORE += "CVE-2022-3105" + +# cpe-stable-backport: Backported in 5.15.11 +CVE_CHECK_IGNORE += "CVE-2022-3106" + +# cpe-stable-backport: Backported in 5.15.31 +CVE_CHECK_IGNORE += "CVE-2022-3107" + +# cpe-stable-backport: Backported in 5.15.27 +CVE_CHECK_IGNORE += "CVE-2022-3108" + +# cpe-stable-backport: Backported in 5.15.47 +CVE_CHECK_IGNORE += "CVE-2022-3110" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-3111" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-3112" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-3113" + +# CVE-2022-3114 needs backporting (fixed from 5.19rc1) + +# cpe-stable-backport: Backported in 5.15.46 +CVE_CHECK_IGNORE += "CVE-2022-3115" + +# cpe-stable-backport: Backported in 5.15.80 +CVE_CHECK_IGNORE += "CVE-2022-3169" + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3170" + +# cpe-stable-backport: Backported in 5.15.65 +CVE_CHECK_IGNORE += "CVE-2022-3176" + +# cpe-stable-backport: Backported in 5.15.34 +CVE_CHECK_IGNORE += "CVE-2022-3202" + +# cpe-stable-backport: Backported in 5.15.45 +CVE_CHECK_IGNORE += "CVE-2022-32250" + +# cpe-stable-backport: Backported in 5.15.41 +CVE_CHECK_IGNORE += "CVE-2022-32296" + +# CVE-2022-3238 has no known resolution + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2022-3239" + +# cpe-stable-backport: Backported in 5.15.47 +CVE_CHECK_IGNORE += "CVE-2022-32981" + +# cpe-stable-backport: Backported in 5.15.68 +CVE_CHECK_IGNORE += "CVE-2022-3303" + +# cpe-stable-backport: Backported in 5.15.81 +CVE_CHECK_IGNORE += "CVE-2022-3344" + +# cpe-stable-backport: Backported in 5.15.53 +CVE_CHECK_IGNORE += "CVE-2022-33740" + +# cpe-stable-backport: Backported in 5.15.53 +CVE_CHECK_IGNORE += "CVE-2022-33741" + +# cpe-stable-backport: Backported in 5.15.53 +CVE_CHECK_IGNORE += "CVE-2022-33742" + +# cpe-stable-backport: Backported in 5.15.53 +CVE_CHECK_IGNORE += "CVE-2022-33743" + +# cpe-stable-backport: Backported in 5.15.53 +CVE_CHECK_IGNORE += "CVE-2022-33744" + +# cpe-stable-backport: Backported in 5.15.37 +CVE_CHECK_IGNORE += "CVE-2022-33981" + +# cpe-stable-backport: Backported in 5.15.86 +CVE_CHECK_IGNORE += "CVE-2022-3424" + +# fixed-version: only affects 5.18rc2 onwards +CVE_CHECK_IGNORE += "CVE-2022-3435" + +# cpe-stable-backport: Backported in 5.15.47 +CVE_CHECK_IGNORE += "CVE-2022-34494" + +# cpe-stable-backport: Backported in 5.15.47 +CVE_CHECK_IGNORE += "CVE-2022-34495" + +# cpe-stable-backport: Backported in 5.15.54 +CVE_CHECK_IGNORE += "CVE-2022-34918" + +# cpe-stable-backport: Backported in 5.15.80 +CVE_CHECK_IGNORE += "CVE-2022-3521" + +# CVE-2022-3522 needs backporting (fixed from 6.1rc1) + +# CVE-2022-3523 needs backporting (fixed from 6.1rc1) + +# cpe-stable-backport: Backported in 5.15.77 +CVE_CHECK_IGNORE += "CVE-2022-3524" + +# cpe-stable-backport: Backported in 5.15.35 +CVE_CHECK_IGNORE += "CVE-2022-3526" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3531" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3532" + +# CVE-2022-3533 has no known resolution + +# cpe-stable-backport: Backported in 5.15.86 +CVE_CHECK_IGNORE += "CVE-2022-3534" + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-3535" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3541" + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-3542" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2022-3543" + +# CVE-2022-3544 has no known resolution + +# cpe-stable-backport: Backported in 5.15.84 +CVE_CHECK_IGNORE += "CVE-2022-3545" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2022-3564" + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-3565" + +# CVE-2022-3566 needs backporting (fixed from 6.1rc1) + +# CVE-2022-3567 needs backporting (fixed from 6.1rc1) + +# cpe-stable-backport: Backported in 5.15.46 +CVE_CHECK_IGNORE += "CVE-2022-3577" + +# cpe-stable-backport: Backported in 5.15.68 +CVE_CHECK_IGNORE += "CVE-2022-3586" + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-3594" + +# CVE-2022-3595 needs backporting (fixed from 6.1rc1) + +# CVE-2022-3606 has no known resolution + +# cpe-stable-backport: Backported in 5.15.56 +CVE_CHECK_IGNORE += "CVE-2022-36123" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2022-3619" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-3621" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2022-3623" + +# CVE-2022-3624 needs backporting (fixed from 6.0rc1) + +# cpe-stable-backport: Backported in 5.15.63 +CVE_CHECK_IGNORE += "CVE-2022-3625" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2022-3628" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2022-36280" + +# cpe-stable-backport: Backported in 5.15.63 +CVE_CHECK_IGNORE += "CVE-2022-3629" + +# fixed-version: only affects 5.19rc6 onwards +CVE_CHECK_IGNORE += "CVE-2022-3630" + +# cpe-stable-backport: Backported in 5.15.63 +CVE_CHECK_IGNORE += "CVE-2022-3633" + +# cpe-stable-backport: Backported in 5.15.63 +CVE_CHECK_IGNORE += "CVE-2022-3635" + +# CVE-2022-3636 needs backporting (fixed from 5.19rc1) + +# fixed-version: only affects 5.19 onwards +CVE_CHECK_IGNORE += "CVE-2022-3640" + +# cpe-stable-backport: Backported in 5.15.129 +CVE_CHECK_IGNORE += "CVE-2022-36402" + +# CVE-2022-3642 has no known resolution + +# cpe-stable-backport: Backported in 5.15.83 +CVE_CHECK_IGNORE += "CVE-2022-3643" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-3646" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-3649" + +# cpe-stable-backport: Backported in 5.15.58 +CVE_CHECK_IGNORE += "CVE-2022-36879" + +# cpe-stable-backport: Backported in 5.15.59 +CVE_CHECK_IGNORE += "CVE-2022-36946" + +# cpe-stable-backport: Backported in 5.15.96 +CVE_CHECK_IGNORE += "CVE-2022-3707" + +# CVE-2022-38096 has no known resolution + +# CVE-2022-38457 needs backporting (fixed from 6.2rc4) + +# CVE-2022-3903 needs backporting (fixed from 6.1rc2) + +# fixed-version: only affects 5.18 onwards +CVE_CHECK_IGNORE += "CVE-2022-3910" + +# CVE-2022-39188 needs backporting (fixed from 5.19rc8) + +# cpe-stable-backport: Backported in 5.15.60 +CVE_CHECK_IGNORE += "CVE-2022-39189" + +# cpe-stable-backport: Backported in 5.15.64 +CVE_CHECK_IGNORE += "CVE-2022-39190" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-3977" + +# cpe-stable-backport: Backported in 5.15.70 +CVE_CHECK_IGNORE += "CVE-2022-39842" + +# CVE-2022-40133 needs backporting (fixed from 6.2rc4) + +# cpe-stable-backport: Backported in 5.15.68 +CVE_CHECK_IGNORE += "CVE-2022-40307" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-40476" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-40768" + +# cpe-stable-backport: Backported in 5.15.66 +CVE_CHECK_IGNORE += "CVE-2022-4095" + +# cpe-stable-backport: Backported in 5.15.125 +CVE_CHECK_IGNORE += "CVE-2022-40982" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2022-41218" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2022-41222" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-4127" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2022-4128" + +# cpe-stable-backport: Backported in 5.15.91 +CVE_CHECK_IGNORE += "CVE-2022-4129" + +# fixed-version: only affects 5.17rc2 onwards +CVE_CHECK_IGNORE += "CVE-2022-4139" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-41674" + +# CVE-2022-41848 has no known resolution + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-41849" + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-41850" + +# cpe-stable-backport: Backported in 5.15.35 +CVE_CHECK_IGNORE += "CVE-2022-41858" + +# fixed-version: only affects 5.16rc7 onwards +CVE_CHECK_IGNORE += "CVE-2022-42328" + +# fixed-version: only affects 5.16rc7 onwards +CVE_CHECK_IGNORE += "CVE-2022-42329" + +# cpe-stable-backport: Backported in 5.15.71 +CVE_CHECK_IGNORE += "CVE-2022-42432" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2022-4269" + +# cpe-stable-backport: Backported in 5.15.65 +CVE_CHECK_IGNORE += "CVE-2022-42703" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-42719" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-42720" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-42721" + +# cpe-stable-backport: Backported in 5.15.74 +CVE_CHECK_IGNORE += "CVE-2022-42722" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2022-42895" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2022-42896" + +# cpe-stable-backport: Backported in 5.15.73 +CVE_CHECK_IGNORE += "CVE-2022-43750" + +# cpe-stable-backport: Backported in 5.15.82 +CVE_CHECK_IGNORE += "CVE-2022-4378" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2022-4379" + +# cpe-stable-backport: Backported in 5.15.90 +CVE_CHECK_IGNORE += "CVE-2022-4382" + +# cpe-stable-backport: Backported in 5.15.75 +CVE_CHECK_IGNORE += "CVE-2022-43945" + +# CVE-2022-44032 needs backporting (fixed from 6.4rc1) + +# CVE-2022-44033 needs backporting (fixed from 6.4rc1) + +# CVE-2022-44034 needs backporting (fixed from 6.4rc1) + +# CVE-2022-4543 has no known resolution + +# cpe-stable-backport: Backported in 5.15.82 +CVE_CHECK_IGNORE += "CVE-2022-45869" + +# CVE-2022-45884 has no known resolution + +# CVE-2022-45885 has no known resolution + +# cpe-stable-backport: Backported in 5.15.116 +CVE_CHECK_IGNORE += "CVE-2022-45886" + +# cpe-stable-backport: Backported in 5.15.116 +CVE_CHECK_IGNORE += "CVE-2022-45887" + +# CVE-2022-45888 needs backporting (fixed from 6.2rc1) + +# cpe-stable-backport: Backported in 5.15.116 +CVE_CHECK_IGNORE += "CVE-2022-45919" + +# cpe-stable-backport: Backported in 5.15.85 +CVE_CHECK_IGNORE += "CVE-2022-45934" + +# cpe-stable-backport: Backported in 5.15.66 +CVE_CHECK_IGNORE += "CVE-2022-4662" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2022-4696" + +# cpe-stable-backport: Backported in 5.15.12 +CVE_CHECK_IGNORE += "CVE-2022-4744" + +# cpe-stable-backport: Backported in 5.15.81 +CVE_CHECK_IGNORE += "CVE-2022-47518" + +# cpe-stable-backport: Backported in 5.15.81 +CVE_CHECK_IGNORE += "CVE-2022-47519" + +# cpe-stable-backport: Backported in 5.15.81 +CVE_CHECK_IGNORE += "CVE-2022-47520" + +# cpe-stable-backport: Backported in 5.15.81 +CVE_CHECK_IGNORE += "CVE-2022-47521" + +# cpe-stable-backport: Backported in 5.15.88 +CVE_CHECK_IGNORE += "CVE-2022-47929" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-47938" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-47939" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2022-47940" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2022-47941" + +# cpe-stable-backport: Backported in 5.15.62 +CVE_CHECK_IGNORE += "CVE-2022-47942" + +# cpe-stable-backport: Backported in 5.15.62 +CVE_CHECK_IGNORE += "CVE-2022-47943" + +# fixed-version: Fixed after version 5.12rc2 +CVE_CHECK_IGNORE += "CVE-2022-47946" + +# cpe-stable-backport: Backported in 5.15.90 +CVE_CHECK_IGNORE += "CVE-2022-4842" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2022-48423" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2022-48424" + +# cpe-stable-backport: Backported in 5.15.113 +CVE_CHECK_IGNORE += "CVE-2022-48425" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2022-48502" + +# cpe-stable-backport: Backported in 5.15.42 +CVE_CHECK_IGNORE += "CVE-2022-48619" + +# fixed-version: Fixed after version 5.0rc1 +CVE_CHECK_IGNORE += "CVE-2023-0030" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2023-0045" + +# cpe-stable-backport: Backported in 5.15.3 +CVE_CHECK_IGNORE += "CVE-2023-0047" + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-0122" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-0160" + +# cpe-stable-backport: Backported in 5.15.89 +CVE_CHECK_IGNORE += "CVE-2023-0179" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2023-0210" + +# fixed-version: Fixed after version 5.10rc1 +CVE_CHECK_IGNORE += "CVE-2023-0240" + +# cpe-stable-backport: Backported in 5.15.88 +CVE_CHECK_IGNORE += "CVE-2023-0266" + +# cpe-stable-backport: Backported in 5.15.91 +CVE_CHECK_IGNORE += "CVE-2023-0386" + +# cpe-stable-backport: Backported in 5.15.89 +CVE_CHECK_IGNORE += "CVE-2023-0394" + +# cpe-stable-backport: Backported in 5.15.90 +CVE_CHECK_IGNORE += "CVE-2023-0458" + +# cpe-stable-backport: Backported in 5.15.96 +CVE_CHECK_IGNORE += "CVE-2023-0459" + +# cpe-stable-backport: Backported in 5.15.88 +CVE_CHECK_IGNORE += "CVE-2023-0461" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-0468" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-0469" + +# cpe-stable-backport: Backported in 5.15.76 +CVE_CHECK_IGNORE += "CVE-2023-0590" + +# CVE-2023-0597 needs backporting (fixed from 6.2rc1) + +# cpe-stable-backport: Backported in 5.15.77 +CVE_CHECK_IGNORE += "CVE-2023-0615" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1032" + +# cpe-stable-backport: Backported in 5.15.91 +CVE_CHECK_IGNORE += "CVE-2023-1073" + +# cpe-stable-backport: Backported in 5.15.91 +CVE_CHECK_IGNORE += "CVE-2023-1074" + +# CVE-2023-1075 needs backporting (fixed from 6.2rc7) + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-1076" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-1077" + +# cpe-stable-backport: Backported in 5.15.94 +CVE_CHECK_IGNORE += "CVE-2023-1078" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-1079" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2023-1095" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-1118" + +# cpe-stable-backport: Backported in 5.15.113 +CVE_CHECK_IGNORE += "CVE-2023-1192" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-1193" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-1194" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1195" + +# cpe-stable-backport: Backported in 5.15.124 +CVE_CHECK_IGNORE += "CVE-2023-1206" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2023-1249" + +# cpe-stable-backport: Backported in 5.15.3 +CVE_CHECK_IGNORE += "CVE-2023-1252" + +# cpe-stable-backport: Backported in 5.15.95 +CVE_CHECK_IGNORE += "CVE-2023-1281" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2023-1295" + +# cpe-stable-backport: Backported in 5.15.110 +CVE_CHECK_IGNORE += "CVE-2023-1380" + +# cpe-stable-backport: Backported in 5.15.81 +CVE_CHECK_IGNORE += "CVE-2023-1382" + +# fixed-version: Fixed after version 5.11rc4 +CVE_CHECK_IGNORE += "CVE-2023-1390" + +# CVE-2023-1476 has no known resolution + +# cpe-stable-backport: Backported in 5.15.95 +CVE_CHECK_IGNORE += "CVE-2023-1513" + +# cpe-stable-backport: Backported in 5.15.25 +CVE_CHECK_IGNORE += "CVE-2023-1582" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-1583" + +# cpe-stable-backport: Backported in 5.15.106 +CVE_CHECK_IGNORE += "CVE-2023-1611" + +# cpe-stable-backport: Backported in 5.15.34 +CVE_CHECK_IGNORE += "CVE-2023-1637" + +# cpe-stable-backport: Backported in 5.15.91 +CVE_CHECK_IGNORE += "CVE-2023-1652" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-1670" + +# cpe-stable-backport: Backported in 5.15.100 +CVE_CHECK_IGNORE += "CVE-2023-1829" + +# cpe-stable-backport: Backported in 5.15.42 +CVE_CHECK_IGNORE += "CVE-2023-1838" + +# cpe-stable-backport: Backported in 5.15.104 +CVE_CHECK_IGNORE += "CVE-2023-1855" + +# cpe-stable-backport: Backported in 5.15.108 +CVE_CHECK_IGNORE += "CVE-2023-1859" + +# CVE-2023-1872 needs backporting (fixed from 5.18rc2) + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-1989" + +# cpe-stable-backport: Backported in 5.15.104 +CVE_CHECK_IGNORE += "CVE-2023-1990" + +# fixed-version: only affects 5.19rc7 onwards +CVE_CHECK_IGNORE += "CVE-2023-1998" + +# cpe-stable-backport: Backported in 5.15.110 +CVE_CHECK_IGNORE += "CVE-2023-2002" + +# cpe-stable-backport: Backported in 5.15.81 +CVE_CHECK_IGNORE += "CVE-2023-2006" + +# CVE-2023-2007 needs backporting (fixed from 6.0rc1) + +# cpe-stable-backport: Backported in 5.15.51 +CVE_CHECK_IGNORE += "CVE-2023-2008" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2023-2019" + +# cpe-stable-backport: Backported in 5.15.125 +CVE_CHECK_IGNORE += "CVE-2023-20569" + +# cpe-stable-backport: Backported in 5.15.126 +CVE_CHECK_IGNORE += "CVE-2023-20588" + +# cpe-stable-backport: Backported in 5.15.122 +CVE_CHECK_IGNORE += "CVE-2023-20593" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2023-20928" + +# CVE-2023-20937 has no known resolution + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-20938" + +# CVE-2023-20941 has no known resolution + +# cpe-stable-backport: Backported in 5.15.90 +CVE_CHECK_IGNORE += "CVE-2023-21102" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-21106" + +# cpe-stable-backport: Backported in 5.15.117 +CVE_CHECK_IGNORE += "CVE-2023-2124" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-21255" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-21264" + +# CVE-2023-21400 has no known resolution + +# cpe-stable-backport: Backported in 5.15.109 +CVE_CHECK_IGNORE += "CVE-2023-2156" + +# cpe-stable-backport: Backported in 5.15.93 +CVE_CHECK_IGNORE += "CVE-2023-2162" + +# cpe-stable-backport: Backported in 5.15.109 +CVE_CHECK_IGNORE += "CVE-2023-2163" + +# cpe-stable-backport: Backported in 5.15.83 +CVE_CHECK_IGNORE += "CVE-2023-2166" + +# CVE-2023-2176 needs backporting (fixed from 6.3rc1) + +# cpe-stable-backport: Backported in 5.15.59 +CVE_CHECK_IGNORE += "CVE-2023-2177" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-2194" + +# cpe-stable-backport: Backported in 5.15.104 +CVE_CHECK_IGNORE += "CVE-2023-2235" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2236" + +# cpe-stable-backport: Backported in 5.15.109 +CVE_CHECK_IGNORE += "CVE-2023-2248" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-2269" + +# CVE-2023-22995 needs backporting (fixed from 5.17rc1) + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-22996" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-22997" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2023-22998" + +# cpe-stable-backport: Backported in 5.15.17 +CVE_CHECK_IGNORE += "CVE-2023-22999" + +# CVE-2023-23000 needs backporting (fixed from 5.17rc1) + +# cpe-stable-backport: Backported in 5.15.17 +CVE_CHECK_IGNORE += "CVE-2023-23001" + +# cpe-stable-backport: Backported in 5.15.17 +CVE_CHECK_IGNORE += "CVE-2023-23002" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-23003" + +# cpe-stable-backport: Backported in 5.15.100 +CVE_CHECK_IGNORE += "CVE-2023-23004" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-23005" + +# cpe-stable-backport: Backported in 5.15.13 +CVE_CHECK_IGNORE += "CVE-2023-23006" + +# CVE-2023-23039 has no known resolution + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2023-23454" + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2023-23455" + +# cpe-stable-backport: Backported in 5.15.91 +CVE_CHECK_IGNORE += "CVE-2023-23559" + +# fixed-version: Fixed after version 5.12rc1 +CVE_CHECK_IGNORE += "CVE-2023-23586" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2430" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-2483" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-25012" + +# cpe-stable-backport: Backported in 5.15.61 +CVE_CHECK_IGNORE += "CVE-2023-2513" + +# cpe-stable-backport: Backported in 5.15.144 +CVE_CHECK_IGNORE += "CVE-2023-25775" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-2598" + +# CVE-2023-26242 has no known resolution + +# CVE-2023-2640 has no known resolution + +# cpe-stable-backport: Backported in 5.15.87 +CVE_CHECK_IGNORE += "CVE-2023-26544" + +# cpe-stable-backport: Backported in 5.15.95 +CVE_CHECK_IGNORE += "CVE-2023-26545" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-26605" + +# cpe-stable-backport: Backported in 5.15.86 +CVE_CHECK_IGNORE += "CVE-2023-26606" + +# cpe-stable-backport: Backported in 5.15.80 +CVE_CHECK_IGNORE += "CVE-2023-26607" + +# cpe-stable-backport: Backported in 5.15.83 +CVE_CHECK_IGNORE += "CVE-2023-28327" + +# cpe-stable-backport: Backported in 5.15.86 +CVE_CHECK_IGNORE += "CVE-2023-28328" + +# cpe-stable-backport: Backported in 5.15.33 +CVE_CHECK_IGNORE += "CVE-2023-28410" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-28464" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-28466" + +# cpe-stable-backport: Backported in 5.15.68 +CVE_CHECK_IGNORE += "CVE-2023-2860" + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2023-28772" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-28866" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-2898" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-2985" + +# cpe-stable-backport: Backported in 5.15.77 +CVE_CHECK_IGNORE += "CVE-2023-3006" + +# Skipping CVE-2023-3022, no affected_versions + +# cpe-stable-backport: Backported in 5.15.104 +CVE_CHECK_IGNORE += "CVE-2023-30456" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-30772" + +# cpe-stable-backport: Backported in 5.15.113 +CVE_CHECK_IGNORE += "CVE-2023-3090" + +# fixed-version: Fixed after version 4.8rc7 +CVE_CHECK_IGNORE += "CVE-2023-3106" + +# Skipping CVE-2023-3108, no affected_versions + +# CVE-2023-31081 has no known resolution + +# CVE-2023-31082 has no known resolution + +# CVE-2023-31083 needs backporting (fixed from 6.6rc1) + +# CVE-2023-31084 needs backporting (fixed from 6.4rc3) + +# cpe-stable-backport: Backported in 5.15.135 +CVE_CHECK_IGNORE += "CVE-2023-31085" + +# cpe-stable-backport: Backported in 5.15.63 +CVE_CHECK_IGNORE += "CVE-2023-3111" + +# cpe-stable-backport: Backported in 5.15.118 +CVE_CHECK_IGNORE += "CVE-2023-3117" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-31248" + +# cpe-stable-backport: Backported in 5.15.113 +CVE_CHECK_IGNORE += "CVE-2023-3141" + +# cpe-stable-backport: Backported in 5.15.109 +CVE_CHECK_IGNORE += "CVE-2023-31436" + +# cpe-stable-backport: Backported in 5.15.39 +CVE_CHECK_IGNORE += "CVE-2023-3159" + +# cpe-stable-backport: Backported in 5.15.93 +CVE_CHECK_IGNORE += "CVE-2023-3161" + +# cpe-stable-backport: Backported in 5.15.116 +CVE_CHECK_IGNORE += "CVE-2023-3212" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-3220" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-32233" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-32247" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-32248" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-32250" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-32252" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-32254" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-32257" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-32258" + +# cpe-stable-backport: Backported in 5.15.93 +CVE_CHECK_IGNORE += "CVE-2023-32269" + +# CVE-2023-32629 has no known resolution + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-3268" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3269" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3312" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3317" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-33203" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-33250" + +# cpe-stable-backport: Backported in 5.15.105 +CVE_CHECK_IGNORE += "CVE-2023-33288" + +# cpe-stable-backport: Backported in 5.15.118 +CVE_CHECK_IGNORE += "CVE-2023-3338" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-3355" + +# cpe-stable-backport: Backported in 5.15.86 +CVE_CHECK_IGNORE += "CVE-2023-3357" + +# cpe-stable-backport: Backported in 5.15.91 +CVE_CHECK_IGNORE += "CVE-2023-3358" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3359" + +# CVE-2023-3389 needs backporting (fixed from 6.0rc1) + +# cpe-stable-backport: Backported in 5.15.118 +CVE_CHECK_IGNORE += "CVE-2023-3390" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-33951" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-33952" + +# CVE-2023-3397 has no known resolution + +# cpe-stable-backport: Backported in 5.15.117 +CVE_CHECK_IGNORE += "CVE-2023-34255" + +# cpe-stable-backport: Backported in 5.15.112 +CVE_CHECK_IGNORE += "CVE-2023-34256" + +# fixed-version: only affects 6.1 onwards +CVE_CHECK_IGNORE += "CVE-2023-34319" + +# cpe-stable-backport: Backported in 5.15.135 +CVE_CHECK_IGNORE += "CVE-2023-34324" + +# CVE-2023-3439 needs backporting (fixed from 5.18rc5) + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-35001" + +# cpe-stable-backport: Backported in 5.15.93 +CVE_CHECK_IGNORE += "CVE-2023-3567" + +# CVE-2023-35693 has no known resolution + +# cpe-stable-backport: Backported in 5.15.116 +CVE_CHECK_IGNORE += "CVE-2023-35788" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-35823" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-35824" + +# fixed-version: only affects 5.18rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-35826" + +# cpe-stable-backport: Backported in 5.15.136 +CVE_CHECK_IGNORE += "CVE-2023-35827" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-35828" + +# cpe-stable-backport: Backported in 5.15.111 +CVE_CHECK_IGNORE += "CVE-2023-35829" + +# cpe-stable-backport: Backported in 5.15.118 +CVE_CHECK_IGNORE += "CVE-2023-3609" + +# cpe-stable-backport: Backported in 5.15.119 +CVE_CHECK_IGNORE += "CVE-2023-3610" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-3611" + +# CVE-2023-3640 has no known resolution + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-37453" + +# CVE-2023-37454 has no known resolution + +# cpe-stable-backport: Backported in 5.15.128 +CVE_CHECK_IGNORE += "CVE-2023-3772" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-3773" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-3776" + +# cpe-stable-backport: Backported in 5.15.123 +CVE_CHECK_IGNORE += "CVE-2023-3777" + +# cpe-stable-backport: Backported in 5.15.78 +CVE_CHECK_IGNORE += "CVE-2023-3812" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-38409" + +# cpe-stable-backport: Backported in 5.15.113 +CVE_CHECK_IGNORE += "CVE-2023-38426" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-38427" + +# cpe-stable-backport: Backported in 5.15.113 +CVE_CHECK_IGNORE += "CVE-2023-38428" + +# cpe-stable-backport: Backported in 5.15.113 +CVE_CHECK_IGNORE += "CVE-2023-38429" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-38430" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-38431" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-38432" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-3863" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-3865" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-3866" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-3867" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-39189" + +# fixed-version: only affects 5.19rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-39191" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-39192" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-39193" + +# cpe-stable-backport: Backported in 5.15.128 +CVE_CHECK_IGNORE += "CVE-2023-39194" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-39197" + +# cpe-stable-backport: Backported in 5.15.128 +CVE_CHECK_IGNORE += "CVE-2023-39198" + +# cpe-stable-backport: Backported in 5.15.123 +CVE_CHECK_IGNORE += "CVE-2023-4004" + +# CVE-2023-4010 has no known resolution + +# cpe-stable-backport: Backported in 5.15.124 +CVE_CHECK_IGNORE += "CVE-2023-4015" + +# cpe-stable-backport: Backported in 5.15.126 +CVE_CHECK_IGNORE += "CVE-2023-40283" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-40791" + +# cpe-stable-backport: Backported in 5.15.126 +CVE_CHECK_IGNORE += "CVE-2023-4128" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-4132" + +# CVE-2023-4133 needs backporting (fixed from 6.3) + +# CVE-2023-4134 needs backporting (fixed from 6.5rc1) + +# cpe-stable-backport: Backported in 5.15.124 +CVE_CHECK_IGNORE += "CVE-2023-4147" + +# CVE-2023-4155 needs backporting (fixed from 6.5rc6) + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4194" + +# cpe-stable-backport: Backported in 5.15.126 +CVE_CHECK_IGNORE += "CVE-2023-4206" + +# cpe-stable-backport: Backported in 5.15.126 +CVE_CHECK_IGNORE += "CVE-2023-4207" + +# cpe-stable-backport: Backported in 5.15.126 +CVE_CHECK_IGNORE += "CVE-2023-4208" + +# cpe-stable-backport: Backported in 5.15.134 +CVE_CHECK_IGNORE += "CVE-2023-4244" + +# cpe-stable-backport: Backported in 5.15.128 +CVE_CHECK_IGNORE += "CVE-2023-4273" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-42752" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-42753" + +# cpe-stable-backport: Backported in 5.15.134 +CVE_CHECK_IGNORE += "CVE-2023-42754" + +# cpe-stable-backport: Backported in 5.15.133 +CVE_CHECK_IGNORE += "CVE-2023-42755" + +# fixed-version: only affects 6.4rc6 onwards +CVE_CHECK_IGNORE += "CVE-2023-42756" + +# cpe-stable-backport: Backported in 5.15.46 +CVE_CHECK_IGNORE += "CVE-2023-4385" + +# cpe-stable-backport: Backported in 5.15.42 +CVE_CHECK_IGNORE += "CVE-2023-4387" + +# cpe-stable-backport: Backported in 5.15.35 +CVE_CHECK_IGNORE += "CVE-2023-4389" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4394" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-44466" + +# cpe-stable-backport: Backported in 5.15.42 +CVE_CHECK_IGNORE += "CVE-2023-4459" + +# cpe-stable-backport: Backported in 5.15.134 +CVE_CHECK_IGNORE += "CVE-2023-4563" + +# cpe-stable-backport: Backported in 5.15.128 +CVE_CHECK_IGNORE += "CVE-2023-4569" + +# cpe-stable-backport: Backported in 5.15.100 +CVE_CHECK_IGNORE += "CVE-2023-45862" + +# cpe-stable-backport: Backported in 5.15.99 +CVE_CHECK_IGNORE += "CVE-2023-45863" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-45871" + +# fixed-version: only affects 6.5rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-45898" + +# fixed-version: only affects 6.4rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4610" + +# fixed-version: only affects 6.4rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-4611" + +# CVE-2023-4622 needs backporting (fixed from 6.5rc1) + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-4623" + +# cpe-stable-backport: Backported in 5.15.137 +CVE_CHECK_IGNORE += "CVE-2023-46343" + +# cpe-stable-backport: Backported in 5.15.137 +CVE_CHECK_IGNORE += "CVE-2023-46813" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-46838" + +# cpe-stable-backport: Backported in 5.15.140 +CVE_CHECK_IGNORE += "CVE-2023-46862" + +# CVE-2023-47233 has no known resolution + +# fixed-version: Fixed after version 5.14rc1 +CVE_CHECK_IGNORE += "CVE-2023-4732" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-4881" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-4921" + +# CVE-2023-50431 needs backporting (fixed from 6.8rc1) + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-5090" + +# cpe-stable-backport: Backported in 5.15.128 +CVE_CHECK_IGNORE += "CVE-2023-51042" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2023-51043" + +# cpe-stable-backport: Backported in 5.15.135 +CVE_CHECK_IGNORE += "CVE-2023-5158" + +# cpe-stable-backport: Backported in 5.15.146 +CVE_CHECK_IGNORE += "CVE-2023-51779" + +# cpe-stable-backport: Backported in 5.15.137 +CVE_CHECK_IGNORE += "CVE-2023-5178" + +# cpe-stable-backport: Backported in 5.15.144 +CVE_CHECK_IGNORE += "CVE-2023-51780" + +# cpe-stable-backport: Backported in 5.15.144 +CVE_CHECK_IGNORE += "CVE-2023-51781" + +# cpe-stable-backport: Backported in 5.15.144 +CVE_CHECK_IGNORE += "CVE-2023-51782" + +# cpe-stable-backport: Backported in 5.15.134 +CVE_CHECK_IGNORE += "CVE-2023-5197" + +# cpe-stable-backport: Backported in 5.15.147 +CVE_CHECK_IGNORE += "CVE-2023-52340" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2023-52429" + +# fixed-version: only affects 6.5rc6 onwards +CVE_CHECK_IGNORE += "CVE-2023-52433" + +# CVE-2023-52434 needs backporting (fixed from 6.7rc6) + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2023-52435" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52436" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52438" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52439" + +# fixed-version: only affects 5.17rc4 onwards +CVE_CHECK_IGNORE += "CVE-2023-52440" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-52441" + +# cpe-stable-backport: Backported in 5.15.145 +CVE_CHECK_IGNORE += "CVE-2023-52442" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52443" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52444" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52445" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52446" + +# CVE-2023-52447 needs backporting (fixed from 6.8rc1) + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52448" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52449" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52450" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52451" + +# CVE-2023-52452 needs backporting (fixed from 6.8rc1) + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52453" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52454" + +# fixed-version: only affects 6.3rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52455" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52456" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52457" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52458" + +# fixed-version: only affects 6.6rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52459" + +# fixed-version: only affects 6.7rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52460" + +# fixed-version: only affects 6.7rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52461" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-52462" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52463" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-52464" + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-5345" + +# fixed-version: only affects 6.2 onwards +CVE_CHECK_IGNORE += "CVE-2023-5633" + +# cpe-stable-backport: Backported in 5.15.137 +CVE_CHECK_IGNORE += "CVE-2023-5717" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-5972" + +# CVE-2023-6039 needs backporting (fixed from 6.5rc5) + +# cpe-stable-backport: Backported in 5.15.147 +CVE_CHECK_IGNORE += "CVE-2023-6040" + +# fixed-version: only affects 6.6rc3 onwards +CVE_CHECK_IGNORE += "CVE-2023-6111" + +# cpe-stable-backport: Backported in 5.15.141 +CVE_CHECK_IGNORE += "CVE-2023-6121" + +# cpe-stable-backport: Backported in 5.15.132 +CVE_CHECK_IGNORE += "CVE-2023-6176" + +# fixed-version: only affects 6.6rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6200" + +# CVE-2023-6238 has no known resolution + +# CVE-2023-6240 has no known resolution + +# CVE-2023-6270 has no known resolution + +# CVE-2023-6356 has no known resolution + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6531" + +# CVE-2023-6535 has no known resolution + +# CVE-2023-6536 has no known resolution + +# cpe-stable-backport: Backported in 5.15.128 +CVE_CHECK_IGNORE += "CVE-2023-6546" + +# CVE-2023-6560 needs backporting (fixed from 6.7rc4) + +# cpe-stable-backport: Backported in 5.15.146 +CVE_CHECK_IGNORE += "CVE-2023-6606" + +# CVE-2023-6610 needs backporting (fixed from 6.7rc7) + +# cpe-stable-backport: Backported in 5.15.143 +CVE_CHECK_IGNORE += "CVE-2023-6622" + +# fixed-version: only affects 6.7rc1 onwards +CVE_CHECK_IGNORE += "CVE-2023-6679" + +# cpe-stable-backport: Backported in 5.15.143 +CVE_CHECK_IGNORE += "CVE-2023-6817" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2023-6915" + +# cpe-stable-backport: Backported in 5.15.143 +CVE_CHECK_IGNORE += "CVE-2023-6931" + +# cpe-stable-backport: Backported in 5.15.142 +CVE_CHECK_IGNORE += "CVE-2023-6932" + +# CVE-2023-7042 has no known resolution + +# cpe-stable-backport: Backported in 5.15.100 +CVE_CHECK_IGNORE += "CVE-2023-7192" + +# fixed-version: only affects 6.5rc6 onwards +CVE_CHECK_IGNORE += "CVE-2024-0193" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-0340" + +# fixed-version: only affects 6.2rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-0443" + +# cpe-stable-backport: Backported in 5.15.64 +CVE_CHECK_IGNORE += "CVE-2024-0562" + +# CVE-2024-0564 has no known resolution + +# CVE-2024-0565 needs backporting (fixed from 6.7rc6) + +# fixed-version: only affects 6.4rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-0582" + +# cpe-stable-backport: Backported in 5.15.142 +CVE_CHECK_IGNORE += "CVE-2024-0584" + +# cpe-stable-backport: Backported in 5.15.140 +CVE_CHECK_IGNORE += "CVE-2024-0607" + +# cpe-stable-backport: Backported in 5.15.121 +CVE_CHECK_IGNORE += "CVE-2024-0639" + +# cpe-stable-backport: Backported in 5.15.135 +CVE_CHECK_IGNORE += "CVE-2024-0641" + +# cpe-stable-backport: Backported in 5.15.147 +CVE_CHECK_IGNORE += "CVE-2024-0646" + +# cpe-stable-backport: Backported in 5.15.112 +CVE_CHECK_IGNORE += "CVE-2024-0775" + +# CVE-2024-0841 has no known resolution + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2024-1085" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-1086" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-1151" + +# CVE-2024-1312 needs backporting (fixed from 6.5rc4) + +# CVE-2024-21803 has no known resolution + +# CVE-2024-22099 has no known resolution + +# CVE-2024-22386 has no known resolution + +# cpe-stable-backport: Backported in 5.15.146 +CVE_CHECK_IGNORE += "CVE-2024-22705" + +# CVE-2024-23196 has no known resolution + +# CVE-2024-23307 has no known resolution + +# CVE-2024-23848 has no known resolution + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-23849" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-23850" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-23851" + +# CVE-2024-24855 needs backporting (fixed from 6.5rc2) + +# CVE-2024-24857 has no known resolution + +# CVE-2024-24858 has no known resolution + +# CVE-2024-24859 has no known resolution + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2024-24860" + +# CVE-2024-24861 has no known resolution + +# CVE-2024-24864 has no known resolution + +# CVE-2024-25739 has no known resolution + +# CVE-2024-25740 has no known resolution + +# CVE-2024-25741 has no known resolution + +# CVE-2024-25744 needs backporting (fixed from 6.7rc5) + +# fixed-version: only affects 6.5rc4 onwards +CVE_CHECK_IGNORE += "CVE-2024-26581" + +# fixed-version: only affects 6.0rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-26582" + +# CVE-2024-26583 needs backporting (fixed from 6.8rc5) + +# CVE-2024-26584 needs backporting (fixed from 6.8rc5) + +# CVE-2024-26585 needs backporting (fixed from 6.8rc5) + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2024-26586" + +# CVE-2024-26587 needs backporting (fixed from 6.8rc1) + +# CVE-2024-26588 needs backporting (fixed from 6.8rc1) + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2024-26589" + +# fixed-version: only affects 5.16rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-26590" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2024-26591" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-26592" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-26593" + +# cpe-stable-backport: Backported in 5.15.149 +CVE_CHECK_IGNORE += "CVE-2024-26594" + +# CVE-2024-26595 needs backporting (fixed from 6.8rc1) + +# fixed-version: only affects 6.1rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-26596" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2024-26597" + +# cpe-stable-backport: Backported in 5.15.148 +CVE_CHECK_IGNORE += "CVE-2024-26598" + +# fixed-version: only affects 5.17rc1 onwards +CVE_CHECK_IGNORE += "CVE-2024-26599" + diff --git a/meta/recipes-kernel/linux/generate-cve-exclusions.py b/meta/recipes-kernel/linux/generate-cve-exclusions.py new file mode 100755 index 0000000000..b9b87f245d --- /dev/null +++ b/meta/recipes-kernel/linux/generate-cve-exclusions.py @@ -0,0 +1,101 @@ +#! /usr/bin/env python3 + +# Generate granular CVE status metadata for a specific version of the kernel +# using data from linuxkernelcves.com. +# +# SPDX-License-Identifier: GPL-2.0-only + +import argparse +import datetime +import json +import pathlib +import re + +from packaging.version import Version + + +def parse_version(s): + """ + Parse the version string and either return a packaging.version.Version, or + None if the string was unset or "unk". + """ + if s and s != "unk": + # packaging.version.Version doesn't approve of versions like v5.12-rc1-dontuse + s = s.replace("-dontuse", "") + return Version(s) + return None + + +def main(argp=None): + parser = argparse.ArgumentParser() + parser.add_argument("datadir", type=pathlib.Path, help="Path to a clone of https://github.com/nluedtke/linux_kernel_cves") + parser.add_argument("version", type=Version, help="Kernel version number to generate data for, such as 6.1.38") + + args = parser.parse_args(argp) + datadir = args.datadir + version = args.version + base_version = f"{version.major}.{version.minor}" + + with open(datadir / "data" / "kernel_cves.json", "r") as f: + cve_data = json.load(f) + + with open(datadir / "data" / "stream_fixes.json", "r") as f: + stream_data = json.load(f) + + print(f""" +# Auto-generated CVE metadata, DO NOT EDIT BY HAND. +# Generated at {datetime.datetime.now()} for version {version} + +python check_kernel_cve_status_version() {{ + this_version = "{version}" + kernel_version = d.getVar("LINUX_VERSION") + if kernel_version != this_version: + bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version)) +}} +do_cve_check[prefuncs] += "check_kernel_cve_status_version" +""") + + for cve, data in cve_data.items(): + if "affected_versions" not in data: + print(f"# Skipping {cve}, no affected_versions") + print() + continue + + affected = data["affected_versions"] + first_affected, last_affected = re.search(r"(.+) to (.+)", affected).groups() + first_affected = parse_version(first_affected) + last_affected = parse_version(last_affected) + + handled = False + if not last_affected: + print(f"# {cve} has no known resolution") + elif first_affected and version < first_affected: + print(f"# fixed-version: only affects {first_affected} onwards") + handled = True + elif last_affected < version: + print(f"# fixed-version: Fixed after version {last_affected}") + handled = True + else: + if cve in stream_data: + backport_data = stream_data[cve] + if base_version in backport_data: + backport_ver = Version(backport_data[base_version]["fixed_version"]) + if backport_ver <= version: + print(f"# cpe-stable-backport: Backported in {backport_ver}") + handled = True + else: + # TODO print a note that the kernel needs bumping + print(f"# {cve} needs backporting (fixed from {backport_ver})") + else: + print(f"# {cve} needs backporting (fixed from {last_affected})") + else: + print(f"# {cve} needs backporting (fixed from {last_affected})") + + if handled: + print(f'CVE_CHECK_IGNORE += "{cve}"') + + print() + + +if __name__ == "__main__": + main() diff --git a/meta/recipes-kernel/linux/kernel-devsrc.bb b/meta/recipes-kernel/linux/kernel-devsrc.bb index f8f717199c..ed9746f837 100644 --- a/meta/recipes-kernel/linux/kernel-devsrc.bb +++ b/meta/recipes-kernel/linux/kernel-devsrc.bb @@ -334,7 +334,7 @@ do_install[lockfiles] = "${TMPDIR}/kernel-scripts.lock" FILES:${PN} = "${KERNEL_BUILD_ROOT} ${KERNEL_SRC_PATH}" FILES:${PN}-dbg += "${KERNEL_BUILD_ROOT}*/build/scripts/*/.debug/*" -RDEPENDS:${PN} = "bc python3 flex bison ${TCLIBC}-utils" +RDEPENDS:${PN} = "bc python3-core flex bison ${TCLIBC}-utils" # 4.15+ needs these next two RDEPENDS RDEPENDS:${PN} += "openssl-dev util-linux" # and x86 needs a bit more for 4.15+ diff --git a/meta/recipes-kernel/linux/linux-yocto-dev.bb b/meta/recipes-kernel/linux/linux-yocto-dev.bb index 403993486b..94800aeaca 100644 --- a/meta/recipes-kernel/linux/linux-yocto-dev.bb +++ b/meta/recipes-kernel/linux/linux-yocto-dev.bb @@ -10,8 +10,6 @@ inherit kernel require recipes-kernel/linux/linux-yocto.inc -# for ncurses tests -inherit pkgconfig # provide this .inc to set specific revisions include recipes-kernel/linux/linux-yocto-dev-revisions.inc diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb b/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb index 4391c45fa9..95aa8a29b2 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb @@ -11,13 +11,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "609783e001b7bddeb8d66711b1a0617d6d40557e" -SRCREV_meta ?= "a4d33186b2f3b4c22b1fc57db5f161168863080f" +SRCREV_machine ?= "d4e1591e2a700e5317e604af9c46dc9f92d87527" +SRCREV_meta ?= "b890cbbdcbc8498d1c84ec782bb5de8a51eb7d6d" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.10;destsuffix=${KMETA}" -LINUX_VERSION ?= "5.10.160" +LINUX_VERSION ?= "5.10.210" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.15.bb b/meta/recipes-kernel/linux/linux-yocto-rt_5.15.bb index d4f5b1cb20..00c03411b1 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_5.15.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.15.bb @@ -11,13 +11,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "62705725902924fafa34c7bcb4c18f2e3b7d473c" -SRCREV_meta ?= "ed03f6685c020866c2f32c4b14c4f343792146d5" +SRCREV_machine ?= "da32201bc41d994b0300c6b4738505f4875dc190" +SRCREV_meta ?= "bef59dc5a78b4d101d1be23d4b36a73fd849241a" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.15;destsuffix=${KMETA}" -LINUX_VERSION ?= "5.15.87" +LINUX_VERSION ?= "5.15.150" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb index e7565e1cb8..832d030031 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb @@ -6,7 +6,7 @@ KCONFIG_MODE = "--allnoconfig" require recipes-kernel/linux/linux-yocto.inc -LINUX_VERSION ?= "5.10.160" +LINUX_VERSION ?= "5.10.210" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -15,9 +15,9 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine:qemuarm ?= "16e60c5bf21350952be933d49fde64889174b5cf" -SRCREV_machine ?= "fb5efade4aa75991204b037c02c0b50f30fa1c18" -SRCREV_meta ?= "a4d33186b2f3b4c22b1fc57db5f161168863080f" +SRCREV_machine:qemuarm ?= "0f8e37aa2c623070ac74f73e6d41ed51fab54b4c" +SRCREV_machine ?= "2c2439238ab602a10ad6d7aa6b210562ee1df595" +SRCREV_meta ?= "b890cbbdcbc8498d1c84ec782bb5de8a51eb7d6d" PV = "${LINUX_VERSION}+git${SRCPV}" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.15.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_5.15.bb index a0af388e73..2051d1c0a1 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.15.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.15.bb @@ -5,7 +5,7 @@ KCONFIG_MODE = "--allnoconfig" require recipes-kernel/linux/linux-yocto.inc -LINUX_VERSION ?= "5.15.87" +LINUX_VERSION ?= "5.15.150" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -14,8 +14,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "6d10c8fe87e2037c751157ca8677588fa6e0f214" -SRCREV_meta ?= "ed03f6685c020866c2f32c4b14c4f343792146d5" +SRCREV_machine ?= "540fc92dd7359025bb09962431565b5a9627536b" +SRCREV_meta ?= "bef59dc5a78b4d101d1be23d4b36a73fd849241a" PV = "${LINUX_VERSION}+git${SRCPV}" diff --git a/meta/recipes-kernel/linux/linux-yocto.inc b/meta/recipes-kernel/linux/linux-yocto.inc index 7ea661e138..4943d5ab57 100644 --- a/meta/recipes-kernel/linux/linux-yocto.inc +++ b/meta/recipes-kernel/linux/linux-yocto.inc @@ -46,7 +46,6 @@ LINUX_VERSION_EXTENSION ??= "-yocto-${LINUX_KERNEL_TYPE}" # Pick up shared functions inherit kernel inherit kernel-yocto -inherit pkgconfig B = "${WORKDIR}/linux-${PACKAGE_ARCH}-${LINUX_KERNEL_TYPE}-build" @@ -70,3 +69,6 @@ do_devshell:prepend() { d.setVarFlag("PKG_CONFIG_SYSROOT_DIR", "unexport", "1") d.appendVar("OE_TERMINAL_EXPORTS", " PKG_CONFIG_DIR PKG_CONFIG_PATH PKG_CONFIG_LIBDIR PKG_CONFIG_SYSROOT_DIR") } + +# CVE exclusion +include recipes-kernel/linux/cve-exclusion.inc diff --git a/meta/recipes-kernel/linux/linux-yocto_5.10.bb b/meta/recipes-kernel/linux/linux-yocto_5.10.bb index c37b7f63c8..48fb4868fb 100644 --- a/meta/recipes-kernel/linux/linux-yocto_5.10.bb +++ b/meta/recipes-kernel/linux/linux-yocto_5.10.bb @@ -1,6 +1,7 @@ KBRANCH ?= "v5.10/standard/base" require recipes-kernel/linux/linux-yocto.inc +include cve-exclusion_5.10.inc # board specific branches KBRANCH:qemuarm ?= "v5.10/standard/arm-versatile-926ejs" @@ -13,23 +14,23 @@ KBRANCH:qemux86 ?= "v5.10/standard/base" KBRANCH:qemux86-64 ?= "v5.10/standard/base" KBRANCH:qemumips64 ?= "v5.10/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "2bb2a540cf1d7af197613bd84e4ebe676dbcebb3" -SRCREV_machine:qemuarm64 ?= "a985b377a910a67793055f0037899488f012bdbb" -SRCREV_machine:qemumips ?= "19ba1e5a948b1ad4e12da79c243257308e40927f" -SRCREV_machine:qemuppc ?= "7eb969488b7e00cdd5971ff0f89c85bdef9a6922" -SRCREV_machine:qemuriscv64 ?= "56918b5f8355ccd5a9bc51ed4b058d4d92fab15b" -SRCREV_machine:qemuriscv32 ?= "56918b5f8355ccd5a9bc51ed4b058d4d92fab15b" -SRCREV_machine:qemux86 ?= "56918b5f8355ccd5a9bc51ed4b058d4d92fab15b" -SRCREV_machine:qemux86-64 ?= "56918b5f8355ccd5a9bc51ed4b058d4d92fab15b" -SRCREV_machine:qemumips64 ?= "be75e1ae0d7d66ed258fc648a82d09ac996d1aee" -SRCREV_machine ?= "56918b5f8355ccd5a9bc51ed4b058d4d92fab15b" -SRCREV_meta ?= "a4d33186b2f3b4c22b1fc57db5f161168863080f" +SRCREV_machine:qemuarm ?= "b1aa548003c2c76a8aa7d7ad83c7070cac5a4f21" +SRCREV_machine:qemuarm64 ?= "32d0647cd0dfa7361a5dfdde34d39192f179f6bf" +SRCREV_machine:qemumips ?= "8780d18791f93bacc3a7d0529fdeb4e31adacafa" +SRCREV_machine:qemuppc ?= "9353fbbd955b1f29e56876aa332473e1029e9e96" +SRCREV_machine:qemuriscv64 ?= "ee0d8dfb898ca2dc199437e79efaa02723ff9378" +SRCREV_machine:qemuriscv32 ?= "ee0d8dfb898ca2dc199437e79efaa02723ff9378" +SRCREV_machine:qemux86 ?= "ee0d8dfb898ca2dc199437e79efaa02723ff9378" +SRCREV_machine:qemux86-64 ?= "ee0d8dfb898ca2dc199437e79efaa02723ff9378" +SRCREV_machine:qemumips64 ?= "136942e72021d05bd1d93389d94a20f763dd8336" +SRCREV_machine ?= "ee0d8dfb898ca2dc199437e79efaa02723ff9378" +SRCREV_meta ?= "b890cbbdcbc8498d1c84ec782bb5de8a51eb7d6d" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRANCH}; \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.10;destsuffix=${KMETA}" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "5.10.160" +LINUX_VERSION ?= "5.10.210" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" DEPENDS += "openssl-native util-linux-native" diff --git a/meta/recipes-kernel/linux/linux-yocto_5.15.bb b/meta/recipes-kernel/linux/linux-yocto_5.15.bb index a3895dde78..101aceb3dc 100644 --- a/meta/recipes-kernel/linux/linux-yocto_5.15.bb +++ b/meta/recipes-kernel/linux/linux-yocto_5.15.bb @@ -1,6 +1,7 @@ KBRANCH ?= "v5.15/standard/base" require recipes-kernel/linux/linux-yocto.inc +include cve-exclusion_5.15.inc # board specific branches KBRANCH:qemuarm ?= "v5.15/standard/arm-versatile-926ejs" @@ -13,24 +14,24 @@ KBRANCH:qemux86 ?= "v5.15/standard/base" KBRANCH:qemux86-64 ?= "v5.15/standard/base" KBRANCH:qemumips64 ?= "v5.15/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "7463f1ff9674e97fa6bed05983d4828a219994d9" -SRCREV_machine:qemuarm64 ?= "09ebb2096efb9e23a1e2c47bf1926dbae0e3f051" -SRCREV_machine:qemumips ?= "a7058de4f88d9a7a3b3253a31bba703eaf6f78ea" -SRCREV_machine:qemuppc ?= "e43b0b8b142f689bc2e2297a5ca221fb0f802eb5" -SRCREV_machine:qemuriscv64 ?= "9768cdc48a9d6cdd9ce0aedc0037d45cfb3f1665" -SRCREV_machine:qemuriscv32 ?= "9768cdc48a9d6cdd9ce0aedc0037d45cfb3f1665" -SRCREV_machine:qemux86 ?= "9768cdc48a9d6cdd9ce0aedc0037d45cfb3f1665" -SRCREV_machine:qemux86-64 ?= "9768cdc48a9d6cdd9ce0aedc0037d45cfb3f1665" -SRCREV_machine:qemumips64 ?= "75a87ddede429ee1070118f54d38183ee4c81b59" -SRCREV_machine ?= "9768cdc48a9d6cdd9ce0aedc0037d45cfb3f1665" -SRCREV_meta ?= "ed03f6685c020866c2f32c4b14c4f343792146d5" +SRCREV_machine:qemuarm ?= "f7ce03f6b5de6a323b165e8adbaa3caae8646c20" +SRCREV_machine:qemuarm64 ?= "db39986a84e0bcfe5a488ab8dca114ed27e469ce" +SRCREV_machine:qemumips ?= "695cf3a24eaedc1e40393947afc22f8dc8324b47" +SRCREV_machine:qemuppc ?= "3dfb435f3fb9ec38c60d1eeeeebf63b6a88308d3" +SRCREV_machine:qemuriscv64 ?= "7c82dac028864e8a608e70d3ac2dbc05b3cd1e14" +SRCREV_machine:qemuriscv32 ?= "7c82dac028864e8a608e70d3ac2dbc05b3cd1e14" +SRCREV_machine:qemux86 ?= "7c82dac028864e8a608e70d3ac2dbc05b3cd1e14" +SRCREV_machine:qemux86-64 ?= "7c82dac028864e8a608e70d3ac2dbc05b3cd1e14" +SRCREV_machine:qemumips64 ?= "2f830b0a13ad4dbe738960d9e7d255ac411064b4" +SRCREV_machine ?= "7c82dac028864e8a608e70d3ac2dbc05b3cd1e14" +SRCREV_meta ?= "bef59dc5a78b4d101d1be23d4b36a73fd849241a" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the <version>/base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "d57287729e229188e7d07ef0117fe927664e08cb" +SRCREV_machine:class-devupstream ?= "80efc6265290d34b75921bf7294e0d9c5a8749dc" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v5.15/base" @@ -38,7 +39,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.15;destsuffix=${KMETA}" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "5.15.87" +LINUX_VERSION ?= "5.15.150" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" DEPENDS += "openssl-native util-linux-native" diff --git a/meta/recipes-kernel/lttng/babeltrace2_2.0.4.bb b/meta/recipes-kernel/lttng/babeltrace2_2.0.5.bb index b48f07ea0d..7ece3140f7 100644 --- a/meta/recipes-kernel/lttng/babeltrace2_2.0.4.bb +++ b/meta/recipes-kernel/lttng/babeltrace2_2.0.5.bb @@ -12,7 +12,7 @@ SRC_URI = "git://git.efficios.com/babeltrace.git;branch=stable-2.0 \ file://0001-tests-do-not-run-test-applications-from-.libs.patch \ file://0001-Make-manpages-multilib-identical.patch \ " -SRCREV = "23e8cf4e6fdc1d0b230e964dafac08a57e6228e6" +SRCREV = "66e76d1ea601705928899138f02730a3a2a3153d" UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>2(\.\d+)+)$" S = "${WORKDIR}/git" @@ -28,6 +28,7 @@ FILES:${PN}-staticdev += "${libdir}/babeltrace2/plugins/*.a" FILES:${PN} += "${libdir}/babeltrace2/plugins/*.so" ASNEEDED = "" +LDFLAGS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld ptest', ' -fuse-ld=bfd ', '', d)}" RDEPENDS:${PN}-ptest += "bash gawk python3" diff --git a/meta/recipes-kernel/lttng/lttng-modules/fix-jbd2-upper-bound-for-v5.10.163.patch b/meta/recipes-kernel/lttng/lttng-modules/fix-jbd2-upper-bound-for-v5.10.163.patch deleted file mode 100644 index bfc49294b0..0000000000 --- a/meta/recipes-kernel/lttng/lttng-modules/fix-jbd2-upper-bound-for-v5.10.163.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 4fd2615b87b3cac0fd5bdc5fc82db05f6fcfdecf Mon Sep 17 00:00:00 2001 -From: Michael Jeanson <mjeanson@efficios.com> -Date: Tue, 17 Jan 2023 12:16:04 -0500 -Subject: [PATCH] fix: jbd2 upper bound for v5.10.163 - -Use the correct upper bound of 5,11,0. - -Change-Id: I435b44b940c7346ed8c3ef0d445365ed156702d0 -Signed-off-by: Michael Jeanson <mjeanson@efficios.com> -Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> - -Upstream-Status: Backport -Signed-off-by: Armin Kuster <akuster@mvista.com> - ---- - include/instrumentation/events/jbd2.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/include/instrumentation/events/jbd2.h b/include/instrumentation/events/jbd2.h -index f7993511..9b77ab92 100644 ---- a/include/instrumentation/events/jbd2.h -+++ b/include/instrumentation/events/jbd2.h -@@ -28,7 +28,7 @@ LTTNG_TRACEPOINT_EVENT(jbd2_checkpoint, - ) - - #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,2,0) \ -- || LTTNG_KERNEL_RANGE(5,10,163, 6,0,0) \ -+ || LTTNG_KERNEL_RANGE(5,10,163, 5,11,0) \ - || LTTNG_KERNEL_RANGE(5,15,87, 5,16,0) \ - || LTTNG_KERNEL_RANGE(6,0,18, 6,1,0) \ - || LTTNG_KERNEL_RANGE(6,1,4, 6,2,0)) -@@ -97,7 +97,7 @@ LTTNG_TRACEPOINT_EVENT_INSTANCE(jbd2_commit, jbd2_drop_transaction, - #endif - - #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,2,0) \ -- || LTTNG_KERNEL_RANGE(5,10,163, 6,0,0) \ -+ || LTTNG_KERNEL_RANGE(5,10,163, 5,11,0) \ - || LTTNG_KERNEL_RANGE(5,15,87, 5,16,0) \ - || LTTNG_KERNEL_RANGE(6,0,18, 6,1,0) \ - || LTTNG_KERNEL_RANGE(6,1,4, 6,2,0)) -@@ -140,7 +140,7 @@ LTTNG_TRACEPOINT_EVENT(jbd2_submit_inode_data, - ) - - #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,2,0) \ -- || LTTNG_KERNEL_RANGE(5,10,163, 6,0,0) \ -+ || LTTNG_KERNEL_RANGE(5,10,163, 5,11,0) \ - || LTTNG_KERNEL_RANGE(5,15,87, 5,16,0) \ - || LTTNG_KERNEL_RANGE(6,0,18, 6,1,0) \ - || LTTNG_KERNEL_RANGE(6,1,4, 6,2,0)) --- -2.35.4 - diff --git a/meta/recipes-kernel/lttng/lttng-modules/fix-jbd2-use-the-correct-print-format-v5.10.163.patch b/meta/recipes-kernel/lttng/lttng-modules/fix-jbd2-use-the-correct-print-format-v5.10.163.patch deleted file mode 100644 index 8067cffaab..0000000000 --- a/meta/recipes-kernel/lttng/lttng-modules/fix-jbd2-use-the-correct-print-format-v5.10.163.patch +++ /dev/null @@ -1,61 +0,0 @@ -From dd7be14bd04c1de309ba267097b03a308da87dae Mon Sep 17 00:00:00 2001 -From: Michael Jeanson <mjeanson@efficios.com> -Date: Tue, 17 Jan 2023 11:03:12 -0500 -Subject: [PATCH] fix: jbd2: use the correct print format (v5.10.163) - -See upstream commit : - - commit d87a7b4c77a997d5388566dd511ca8e6b8e8a0a8 - Author: Bixuan Cui <cuibixuan@linux.alibaba.com> - Date: Tue Oct 11 19:33:44 2022 +0800 - - jbd2: use the correct print format - - The print format error was found when using ftrace event: - <...>-1406 [000] .... 23599442.895823: jbd2_end_commit: dev 252,8 transaction -1866216965 sync 0 head -1866217368 - <...>-1406 [000] .... 23599442.896299: jbd2_start_commit: dev 252,8 transaction -1866216964 sync 0 - - Use the correct print format for transaction, head and tid. - -Change-Id: I7601f5cbb86495c2607be7b11e02724c90b3ebf9 -Signed-off-by: Michael Jeanson <mjeanson@efficios.com> -Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> - -Upstream-Status: Backport -Signed-off-by: Armin Kuster <akuster@mvista.com> - ---- - include/instrumentation/events/jbd2.h | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/include/instrumentation/events/jbd2.h b/include/instrumentation/events/jbd2.h -index d5d8ea0c..f7993511 100644 ---- a/include/instrumentation/events/jbd2.h -+++ b/include/instrumentation/events/jbd2.h -@@ -28,6 +28,7 @@ LTTNG_TRACEPOINT_EVENT(jbd2_checkpoint, - ) - - #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,2,0) \ -+ || LTTNG_KERNEL_RANGE(5,10,163, 6,0,0) \ - || LTTNG_KERNEL_RANGE(5,15,87, 5,16,0) \ - || LTTNG_KERNEL_RANGE(6,0,18, 6,1,0) \ - || LTTNG_KERNEL_RANGE(6,1,4, 6,2,0)) -@@ -96,6 +97,7 @@ LTTNG_TRACEPOINT_EVENT_INSTANCE(jbd2_commit, jbd2_drop_transaction, - #endif - - #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,2,0) \ -+ || LTTNG_KERNEL_RANGE(5,10,163, 6,0,0) \ - || LTTNG_KERNEL_RANGE(5,15,87, 5,16,0) \ - || LTTNG_KERNEL_RANGE(6,0,18, 6,1,0) \ - || LTTNG_KERNEL_RANGE(6,1,4, 6,2,0)) -@@ -138,6 +140,7 @@ LTTNG_TRACEPOINT_EVENT(jbd2_submit_inode_data, - ) - - #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,2,0) \ -+ || LTTNG_KERNEL_RANGE(5,10,163, 6,0,0) \ - || LTTNG_KERNEL_RANGE(5,15,87, 5,16,0) \ - || LTTNG_KERNEL_RANGE(6,0,18, 6,1,0) \ - || LTTNG_KERNEL_RANGE(6,1,4, 6,2,0)) --- -2.35.4 - diff --git a/meta/recipes-kernel/lttng/lttng-modules_2.13.8.bb b/meta/recipes-kernel/lttng/lttng-modules_2.13.9.bb index 3cfc1bc58e..a08386b053 100644 --- a/meta/recipes-kernel/lttng/lttng-modules_2.13.8.bb +++ b/meta/recipes-kernel/lttng/lttng-modules_2.13.9.bb @@ -11,14 +11,12 @@ include lttng-platforms.inc SRC_URI = "https://lttng.org/files/${BPN}/${BPN}-${PV}.tar.bz2 \ file://0009-Rename-genhd-wrapper-to-blkdev.patch \ - file://fix-jbd2-use-the-correct-print-format-v5.10.163.patch \ - file://fix-jbd2-upper-bound-for-v5.10.163.patch \ " # Use :append here so that the patch is applied also when using devupstream SRC_URI:append = " file://0001-src-Kbuild-change-missing-CONFIG_TRACEPOINTS-to-warn.patch" -SRC_URI[sha256sum] = "f525d3d48ea3a475cb535339c201666d0e4c75ec8c46d29837bcf381ea02cb19" +SRC_URI[sha256sum] = "bf808b113544287cfe837a6382887fa66354ef5cc8216460cebbef3d27dc3581" export INSTALL_MOD_DIR="kernel/lttng-modules" diff --git a/meta/recipes-kernel/lttng/lttng-tools/determinism.patch b/meta/recipes-kernel/lttng/lttng-tools/determinism.patch deleted file mode 100644 index 0a897a8e13..0000000000 --- a/meta/recipes-kernel/lttng/lttng-tools/determinism.patch +++ /dev/null @@ -1,64 +0,0 @@ -This is a bit ugly. Specifing abs_builddir as an RPATH is plain wrong when -cross compiling. Sadly, removing the rpath makes libtool/automake do -weird things and breaks the build as shared libs are no longer generated. - -We already try and delete the RPATH at do_install with chrpath however -that does leave the path in the string table so it doesn't help us -with reproducibility. - -Instead, hack in a bogus but harmless path, then delete it later in -our do_install. Ultimately we may want to pass a specific path to use -to configure if we really do need to set an RPATH at all. It is unclear -to me whether the tests need that or not. - -Fixes reproducibility issues for lttng-tools. - -Upstream-Status: Submitted [https://bugs.lttng.org/issues/1361 - needs discussion with upstream about the correct solution] -RP 2021/3/1 - -Index: lttng-tools-2.12.2/tests/regression/ust/ust-dl/Makefile.am -=================================================================== ---- lttng-tools-2.12.2.orig/tests/regression/ust/ust-dl/Makefile.am -+++ lttng-tools-2.12.2/tests/regression/ust/ust-dl/Makefile.am -@@ -27,16 +27,16 @@ noinst_LTLIBRARIES = libzzz.la libbar.la - - libzzz_la_SOURCES = libzzz.c libzzz.h - libzzz_la_LDFLAGS = -module -shared -avoid-version \ -- -rpath $(abs_builddir) -+ -rpath /usr/lib - - libbar_la_SOURCES = libbar.c libbar.h - libbar_la_LDFLAGS = -module -shared -avoid-version \ -- -rpath $(abs_builddir) -+ -rpath /usr/lib - libbar_la_LIBADD = libzzz.la - - libfoo_la_SOURCES = libfoo.c libfoo.h - libfoo_la_LDFLAGS = -module -shared -avoid-version \ -- -rpath $(abs_builddir) -+ -rpath /usr/lib - libfoo_la_LIBADD = libbar.la - - CLEANFILES = libfoo.so libfoo.so.debug libbar.so libbar.so.debug \ -@@ -44,7 +44,7 @@ CLEANFILES = libfoo.so libfoo.so.debug l - - libtp_la_SOURCES = libbar-tp.h libbar-tp.c libfoo-tp.h libfoo-tp.c \ - libzzz-tp.h libzzz-tp.c --libtp_la_LDFLAGS = -module -shared -rpath $(abs_builddir) -+libtp_la_LDFLAGS = -module -shared -rpath /usr/lib - - # Extract debug symbols - libfoo.so.debug: libfoo.la -Index: lttng-tools-2.12.2/tests/utils/testapp/userspace-probe-elf-binary/Makefile.am -=================================================================== ---- lttng-tools-2.12.2.orig/tests/utils/testapp/userspace-probe-elf-binary/Makefile.am -+++ lttng-tools-2.12.2/tests/utils/testapp/userspace-probe-elf-binary/Makefile.am -@@ -5,7 +5,7 @@ AM_CFLAGS += -O0 - noinst_LTLIBRARIES = libfoo.la - - libfoo_la_SOURCES = foo.c foo.h --libfoo_la_LDFLAGS = -shared -module -avoid-version -rpath $(abs_builddir)/.libs/ -+libfoo_la_LDFLAGS = -shared -module -avoid-version -rpath /usr/lib - - noinst_PROGRAMS = userspace-probe-elf-binary - userspace_probe_elf_binary_SOURCES = userspace-probe-elf-binary.c diff --git a/meta/recipes-kernel/lttng/lttng-tools_2.13.8.bb b/meta/recipes-kernel/lttng/lttng-tools_2.13.9.bb index a814eb79f9..1f6929e307 100644 --- a/meta/recipes-kernel/lttng/lttng-tools_2.13.8.bb +++ b/meta/recipes-kernel/lttng/lttng-tools_2.13.9.bb @@ -35,11 +35,10 @@ SRC_URI = "https://lttng.org/files/lttng-tools/lttng-tools-${PV}.tar.bz2 \ file://0001-tests-do-not-strip-a-helper-library.patch \ file://run-ptest \ file://lttng-sessiond.service \ - file://determinism.patch \ file://disable-tests.patch \ " -SRC_URI[sha256sum] = "b1e959579b260790930b20f3c7aa7cefb8a40e0de80d4a777c2bf78c6b353dc1" +SRC_URI[sha256sum] = "8d94dc95b608cf70216b01203a3f8242b97a232db2e23421a2f43708da08f337" inherit autotools ptest pkgconfig useradd python3-dir manpages systemd diff --git a/meta/recipes-kernel/lttng/lttng-ust_2.13.5.bb b/meta/recipes-kernel/lttng/lttng-ust_2.13.6.bb index 916408bff0..424b0fa645 100644 --- a/meta/recipes-kernel/lttng/lttng-ust_2.13.5.bb +++ b/meta/recipes-kernel/lttng/lttng-ust_2.13.6.bb @@ -34,7 +34,7 @@ SRC_URI = "https://lttng.org/files/lttng-ust/lttng-ust-${PV}.tar.bz2 \ file://0001-Makefile.am-update-rpath-link.patch \ " -SRC_URI[sha256sum] = "f1d7bb4984a3dc5dacd3b7bcb4c10c04b041b0eecd7cba1fef3d8f86aff02bd6" +SRC_URI[sha256sum] = "e7e04596dd73ac7aa99e27cd000f949dbb0fed51bd29099f9b08a25c1df0ced5" CVE_PRODUCT = "ust" diff --git a/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb b/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb index 0e420a25d9..8727d003f9 100644 --- a/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb +++ b/meta/recipes-kernel/make-mod-scripts/make-mod-scripts_1.0.bb @@ -3,7 +3,7 @@ HOMEPAGE = "https://www.yoctoproject.org/" LICENSE = "GPL-2.0-only" LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-only;md5=801f80980d171dd6425610833a22dbe6" -inherit kernel-arch +inherit kernel-arch linux-kernel-base inherit pkgconfig PACKAGE_ARCH = "${MACHINE_ARCH}" @@ -21,6 +21,9 @@ DEPENDS += "gmp-native" EXTRA_OEMAKE = " HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" HOSTCPP="${BUILD_CPP}"" EXTRA_OEMAKE += " HOSTCXX="${BUILD_CXX} ${BUILD_CXXFLAGS} ${BUILD_LDFLAGS}" CROSS_COMPILE=${TARGET_PREFIX}" +KERNEL_LOCALVERSION = "${@get_kernellocalversion_file("${STAGING_KERNEL_BUILDDIR}")}" +export LOCALVERSION="${KERNEL_LOCALVERSION}" + # Build some host tools under work-shared. CC, LD, and AR are probably # not used, but this is the historical way of invoking "make scripts". # diff --git a/meta/recipes-kernel/perf/perf/sort-pmuevents.py b/meta/recipes-kernel/perf/perf/sort-pmuevents.py index 0362f2d8fa..0a87e553ab 100755 --- a/meta/recipes-kernel/perf/perf/sort-pmuevents.py +++ b/meta/recipes-kernel/perf/perf/sort-pmuevents.py @@ -36,10 +36,10 @@ with open(infile, 'r') as file: preamble_regex = re.compile( '^(.*?)^(struct|const struct|static struct|static const struct)', re.MULTILINE | re.DOTALL ) preamble = re.search( preamble_regex, data ) -struct_block_regex = re.compile( '^(struct|const struct|static struct|static const struct).*?(\w+) (.*?)\[\] = {(.*?)^};', re.MULTILINE | re.DOTALL ) -field_regex = re.compile( '{.*?},', re.MULTILINE | re.DOTALL ) -cpuid_regex = re.compile( '\.cpuid = (.*?),', re.MULTILINE | re.DOTALL ) -name_regex = re.compile( '\.name = (.*?),', re.MULTILINE | re.DOTALL ) +struct_block_regex = re.compile(r'^(struct|const struct|static struct|static const struct).*?(\w+) (.*?)\[\] = {(.*?)^};', re.MULTILINE | re.DOTALL ) +field_regex = re.compile(r'{.*?},', re.MULTILINE | re.DOTALL ) +cpuid_regex = re.compile(r'\.cpuid = (.*?),', re.MULTILINE | re.DOTALL ) +name_regex = re.compile(r'\.name = (.*?),', re.MULTILINE | re.DOTALL ) # create a dictionary structure to store all the structs, their # types and then their fields. diff --git a/meta/recipes-kernel/systemtap/systemtap/0001-bpf-translate.cxx-Prevent-Werror-maybe-uninitialized.patch b/meta/recipes-kernel/systemtap/systemtap/0001-bpf-translate.cxx-Prevent-Werror-maybe-uninitialized.patch new file mode 100644 index 0000000000..130eefab5d --- /dev/null +++ b/meta/recipes-kernel/systemtap/systemtap/0001-bpf-translate.cxx-Prevent-Werror-maybe-uninitialized.patch @@ -0,0 +1,53 @@ +From df3425f51a512f65522522daf1f78c7fab0a63fd Mon Sep 17 00:00:00 2001 +From: Aaron Merey <amerey@redhat.com> +Date: Fri, 25 Feb 2022 19:18:29 -0500 +Subject: [PATCH] bpf-translate.cxx: Prevent -Werror=maybe-uninitialized + +Two variables in bpf-translate.cxx can trigger -Werror=maybe-uninitialized. +The code is designed so that uninitialized uses are not actually possible, +but to convince gcc of this we move a throw statement and initialize one +of the variables with a value. + +Upstream-Status: Backport [https://sourceware.org/git/?p=systemtap.git;a=commit;h=df3425f51a512f65522522daf1f78c7fab0a63fd] + +Signed-off-by: Li Wang <li.wang@windriver.com> +--- + bpf-translate.cxx | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/bpf-translate.cxx b/bpf-translate.cxx +index 3f45c721f..1b63d6078 100644 +--- a/bpf-translate.cxx ++++ b/bpf-translate.cxx +@@ -1203,7 +1203,7 @@ bpf_unparser::emit_asm_arg (const asm_stmt &stmt, const std::string &arg, + { + /* arg is a register number */ + std::string reg = arg[0] == 'r' ? arg.substr(1) : arg; +- unsigned long num; ++ unsigned long num = ULONG_MAX; + bool parsed = false; + try { + num = stoul(reg, 0, 0); +@@ -1941,8 +1941,6 @@ bpf_unparser::visit_foreach_loop(foreach_loop* s) + for (unsigned k = 0; k < arraydecl->index_types.size(); k++) + { + auto type = arraydecl->index_types[k]; +- if (type != pe_long && type != pe_string) +- throw SEMANTIC_ERROR(_("unhandled foreach index type"), s->tok); + int this_column_size; + // PR23875: foreach should handle string keys + if (type == pe_long) +@@ -1953,6 +1951,10 @@ bpf_unparser::visit_foreach_loop(foreach_loop* s) + { + this_column_size = BPF_MAXSTRINGLEN; + } ++ else ++ { ++ throw SEMANTIC_ERROR(_("unhandled foreach index type"), s->tok); ++ } + if (info.sort_column == k + 1) // record sort column + { + info.sort_column_size = this_column_size; +-- +2.25.1 + diff --git a/meta/recipes-kernel/systemtap/systemtap_git.bb b/meta/recipes-kernel/systemtap/systemtap_git.bb index ce86d5274d..c84fc27001 100644 --- a/meta/recipes-kernel/systemtap/systemtap_git.bb +++ b/meta/recipes-kernel/systemtap/systemtap_git.bb @@ -9,6 +9,7 @@ require systemtap_git.inc SRC_URI += "file://0001-improve-reproducibility-for-c-compiling.patch \ file://0001-staprun-address-ncurses-6.3-failures.patch \ file://0001-gcc12-c-compatibility-re-tweak-for-rhel6-use-functio.patch \ + file://0001-bpf-translate.cxx-Prevent-Werror-maybe-uninitialized.patch \ " DEPENDS = "elfutils" diff --git a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2022.08.12.bb b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2024.01.23.bb index 357e79d7e1..8fde236ab4 100644 --- a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2022.08.12.bb +++ b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2024.01.23.bb @@ -5,7 +5,7 @@ LICENSE = "ISC" LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c" SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz" -SRC_URI[sha256sum] = "59c8f7d17966db71b27f90e735ee8f5b42ca3527694a8c5e6e9b56bd379c3b84" +SRC_URI[sha256sum] = "c8a61c9acf76fa7eb4239e89f640dee3e87098d9f69b4d3518c9c60fc6d20c55" inherit bin_package allarch @@ -13,7 +13,7 @@ do_install() { install -d -m0755 ${D}${nonarch_libdir}/crda install -d -m0755 ${D}${sysconfdir}/wireless-regdb/pubkeys install -m 0644 regulatory.bin ${D}${nonarch_libdir}/crda/regulatory.bin - install -m 0644 sforshee.key.pub.pem ${D}${sysconfdir}/wireless-regdb/pubkeys/sforshee.key.pub.pem + install -m 0644 wens.key.pub.pem ${D}${sysconfdir}/wireless-regdb/pubkeys/wens.key.pub.pem install -m 0644 -D regulatory.db ${D}${nonarch_base_libdir}/firmware/regulatory.db install -m 0644 regulatory.db.p7s ${D}${nonarch_base_libdir}/firmware/regulatory.db.p7s diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch index 23573bb6b3..97fcfd993a 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch @@ -4,7 +4,7 @@ Date: Sat, 12 Nov 2022 16:12:00 +0100 Subject: [PATCH] avcodec/rpzaenc: stop accessing out of bounds frame Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/92f9b28ed84a77138105475beba16c146bdaf984] - +CVE: CVE-2022-3964 Signed-off-by: <narpat.mali@windriver.com> --- diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch index 6e237fdd52..8ebf1f69c4 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch @@ -5,6 +5,7 @@ Subject: [PATCH] avcodec/smcenc: stop accessing out of bounds frame Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/13c13109759090b7f7182480d075e13b36ed8edd] +CVE: CVE-2022-3965 Signed-off-by: <narpat.mali@windriver.com> --- diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-48434.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-48434.patch new file mode 100644 index 0000000000..3cd374dc39 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-48434.patch @@ -0,0 +1,130 @@ +From e40c964a0678908e2c756741343ed50d6a99ee12 Mon Sep 17 00:00:00 2001 +From: Anton Khirnov <anton@khirnov.net> +Date: Fri, 28 Apr 2023 11:45:30 +0000 +Subject: [PATCH] lavc/pthread_frame: avoid leaving stale hwaccel state in + worker threads + +This state is not refcounted, so make sure it always has a well-defined +owner. + +Remove the block added in 091341f, as +this commit also solves that issue in a more general way. + +CVE:CVE-2022-48434 + +Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/cc867f2c09d2b69cee8a0eccd62aff002cbbfe11] + +Signed-off-by: Narpat Mali <narpat.mali@windriver.com> +--- + libavcodec/pthread_frame.c | 46 +++++++++++++++++++++++++++++--------- + 1 file changed, 35 insertions(+), 11 deletions(-) + +diff --git a/libavcodec/pthread_frame.c b/libavcodec/pthread_frame.c +index 85a6bc9..e40dced 100644 +--- a/libavcodec/pthread_frame.c ++++ b/libavcodec/pthread_frame.c +@@ -145,6 +145,12 @@ typedef struct FrameThreadContext { + * Set for the first N packets, where N is the number of threads. + * While it is set, ff_thread_en/decode_frame won't return any results. + */ ++ ++ /* hwaccel state is temporarily stored here in order to transfer its ownership ++ * to the next decoding thread without the need for extra synchronization */ ++ const AVHWAccel *stash_hwaccel; ++ void *stash_hwaccel_context; ++ void *stash_hwaccel_priv; + } FrameThreadContext; + + #if FF_API_THREAD_SAFE_CALLBACKS +@@ -229,9 +235,17 @@ FF_ENABLE_DEPRECATION_WARNINGS + ff_thread_finish_setup(avctx); + + if (p->hwaccel_serializing) { ++ /* wipe hwaccel state to avoid stale pointers lying around; ++ * the state was transferred to FrameThreadContext in ++ * ff_thread_finish_setup(), so nothing is leaked */ ++ avctx->hwaccel = NULL; ++ avctx->hwaccel_context = NULL; ++ avctx->internal->hwaccel_priv_data = NULL; ++ + p->hwaccel_serializing = 0; + pthread_mutex_unlock(&p->parent->hwaccel_mutex); + } ++ av_assert0(!avctx->hwaccel); + + if (p->async_serializing) { + p->async_serializing = 0; +@@ -294,14 +308,10 @@ static int update_context_from_thread(AVCodecContext *dst, AVCodecContext *src, + dst->color_range = src->color_range; + dst->chroma_sample_location = src->chroma_sample_location; + +- dst->hwaccel = src->hwaccel; +- dst->hwaccel_context = src->hwaccel_context; +- + dst->channels = src->channels; + dst->sample_rate = src->sample_rate; + dst->sample_fmt = src->sample_fmt; + dst->channel_layout = src->channel_layout; +- dst->internal->hwaccel_priv_data = src->internal->hwaccel_priv_data; + + if (!!dst->hw_frames_ctx != !!src->hw_frames_ctx || + (dst->hw_frames_ctx && dst->hw_frames_ctx->data != src->hw_frames_ctx->data)) { +@@ -442,6 +452,12 @@ static int submit_packet(PerThreadContext *p, AVCodecContext *user_avctx, + pthread_mutex_unlock(&p->mutex); + return err; + } ++ ++ /* transfer hwaccel state stashed from previous thread, if any */ ++ av_assert0(!p->avctx->hwaccel); ++ FFSWAP(const AVHWAccel*, p->avctx->hwaccel, fctx->stash_hwaccel); ++ FFSWAP(void*, p->avctx->hwaccel_context, fctx->stash_hwaccel_context); ++ FFSWAP(void*, p->avctx->internal->hwaccel_priv_data, fctx->stash_hwaccel_priv); + } + + av_packet_unref(p->avpkt); +@@ -647,6 +663,14 @@ void ff_thread_finish_setup(AVCodecContext *avctx) { + async_lock(p->parent); + } + ++ /* save hwaccel state for passing to the next thread; ++ * this is done here so that this worker thread can wipe its own hwaccel ++ * state after decoding, without requiring synchronization */ ++ av_assert0(!p->parent->stash_hwaccel); ++ p->parent->stash_hwaccel = avctx->hwaccel; ++ p->parent->stash_hwaccel_context = avctx->hwaccel_context; ++ p->parent->stash_hwaccel_priv = avctx->internal->hwaccel_priv_data; ++ + pthread_mutex_lock(&p->progress_mutex); + if(atomic_load(&p->state) == STATE_SETUP_FINISHED){ + av_log(avctx, AV_LOG_WARNING, "Multiple ff_thread_finish_setup() calls\n"); +@@ -700,13 +724,6 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count) + + park_frame_worker_threads(fctx, thread_count); + +- if (fctx->prev_thread && avctx->internal->hwaccel_priv_data != +- fctx->prev_thread->avctx->internal->hwaccel_priv_data) { +- if (update_context_from_thread(avctx, fctx->prev_thread->avctx, 1) < 0) { +- av_log(avctx, AV_LOG_ERROR, "Failed to update user thread.\n"); +- } +- } +- + if (fctx->prev_thread && fctx->prev_thread != fctx->threads) + if (update_context_from_thread(fctx->threads->avctx, fctx->prev_thread->avctx, 0) < 0) { + av_log(avctx, AV_LOG_ERROR, "Final thread update failed\n"); +@@ -760,6 +777,13 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count) + av_freep(&fctx->threads); + ff_pthread_free(fctx, thread_ctx_offsets); + ++ /* if we have stashed hwaccel state, move it to the user-facing context, ++ * so it will be freed in avcodec_close() */ ++ av_assert0(!avctx->hwaccel); ++ FFSWAP(const AVHWAccel*, avctx->hwaccel, fctx->stash_hwaccel); ++ FFSWAP(void*, avctx->hwaccel_context, fctx->stash_hwaccel_context); ++ FFSWAP(void*, avctx->internal->hwaccel_priv_data, fctx->stash_hwaccel_priv); ++ + av_freep(&avctx->internal->thread_ctx); + } + +-- +2.40.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb index 4bcbda9976..1295d5cdf1 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb @@ -28,10 +28,17 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch \ file://0001-avcodec-vp3-Add-missing-check-for-av_malloc.patch \ file://0001-avformat-nutdec-Add-check-for-avformat_new_stream.patch \ - " + file://CVE-2022-48434.patch \ + " SRC_URI[sha256sum] = "ef2efae259ce80a240de48ec85ecb062cecca26e4352ffb3fda562c21a93007b" +# CVE-2023-39018 issue belongs to ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI) +# and not ffmepg itself. +# https://security-tracker.debian.org/tracker/CVE-2023-39018 +# https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018 +CVE_CHECK_IGNORE += "CVE-2023-39018" + # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717 ARM_INSTRUCTION_SET:armv4 = "arm" ARM_INSTRUCTION_SET:armv5 = "arm" diff --git a/meta/recipes-multimedia/flac/files/CVE-2020-22219.patch b/meta/recipes-multimedia/flac/files/CVE-2020-22219.patch new file mode 100644 index 0000000000..e042872dc0 --- /dev/null +++ b/meta/recipes-multimedia/flac/files/CVE-2020-22219.patch @@ -0,0 +1,197 @@ +From 579ff6922089cbbbd179619e40e622e279bd719f Mon Sep 17 00:00:00 2001 +From: Martijn van Beurden <mvanb1@gmail.com> +Date: Wed, 3 Aug 2022 13:52:19 +0200 +Subject: [PATCH] flac: Add and use _nofree variants of safe_realloc functions + +Parts of the code use realloc like + +x = safe_realloc(x, somesize); + +when this is the case, the safe_realloc variant used must free the +old memory block in case it fails, otherwise it will leak. However, +there are also instances in the code where handling is different: + +if (0 == (x = safe_realloc(y, somesize))) + return false + +in this case, y should not be freed, as y is not set to NULL we +could encounter double frees. Here the safe_realloc_nofree +functions are used. + +Upstream-Status: Backport [https://github.com/xiph/flac/commit/21fe95ee828b0b9b944f6aa0bb02d24fbb981815] +CVE: CVE-2020-22219 + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + include/share/alloc.h | 41 +++++++++++++++++++++++++++++++---- + src/flac/encode.c | 4 ++-- + src/flac/foreign_metadata.c | 2 +- + src/libFLAC/bitwriter.c | 2 +- + src/libFLAC/metadata_object.c | 2 +- + src/plugin_common/tags.c | 2 +- + src/share/utf8/iconvert.c | 2 +- + 7 files changed, 44 insertions(+), 11 deletions(-) + +diff --git a/include/share/alloc.h b/include/share/alloc.h +index 914de9b..55bdd1d 100644 +--- a/include/share/alloc.h ++++ b/include/share/alloc.h +@@ -161,17 +161,30 @@ static inline void *safe_realloc_(void *ptr, size_t size) + free(oldptr); + return newptr; + } +-static inline void *safe_realloc_add_2op_(void *ptr, size_t size1, size_t size2) ++static inline void *safe_realloc_nofree_add_2op_(void *ptr, size_t size1, size_t size2) ++{ ++ size2 += size1; ++ if(size2 < size1) ++ return 0; ++ return realloc(ptr, size2); ++} ++ ++static inline void *safe_realloc_add_3op_(void *ptr, size_t size1, size_t size2, size_t size3) + { + size2 += size1; + if(size2 < size1) { + free(ptr); + return 0; + } +- return realloc(ptr, size2); ++ size3 += size2; ++ if(size3 < size2) { ++ free(ptr); ++ return 0; ++ } ++ return safe_realloc_(ptr, size3); + } + +-static inline void *safe_realloc_add_3op_(void *ptr, size_t size1, size_t size2, size_t size3) ++static inline void *safe_realloc_nofree_add_3op_(void *ptr, size_t size1, size_t size2, size_t size3) + { + size2 += size1; + if(size2 < size1) +@@ -182,7 +195,7 @@ static inline void *safe_realloc_add_3op_(void *ptr, size_t size1, size_t size2, + return realloc(ptr, size3); + } + +-static inline void *safe_realloc_add_4op_(void *ptr, size_t size1, size_t size2, size_t size3, size_t size4) ++static inline void *safe_realloc_nofree_add_4op_(void *ptr, size_t size1, size_t size2, size_t size3, size_t size4) + { + size2 += size1; + if(size2 < size1) +@@ -205,6 +218,15 @@ static inline void *safe_realloc_mul_2op_(void *ptr, size_t size1, size_t size2) + return safe_realloc_(ptr, size1*size2); + } + ++static inline void *safe_realloc_nofree_mul_2op_(void *ptr, size_t size1, size_t size2) ++{ ++ if(!size1 || !size2) ++ return realloc(ptr, 0); /* preserve POSIX realloc(ptr, 0) semantics */ ++ if(size1 > SIZE_MAX / size2) ++ return 0; ++ return realloc(ptr, size1*size2); ++} ++ + /* size1 * (size2 + size3) */ + static inline void *safe_realloc_muladd2_(void *ptr, size_t size1, size_t size2, size_t size3) + { +@@ -216,4 +238,15 @@ static inline void *safe_realloc_muladd2_(void *ptr, size_t size1, size_t size2, + return safe_realloc_mul_2op_(ptr, size1, size2); + } + ++/* size1 * (size2 + size3) */ ++static inline void *safe_realloc_nofree_muladd2_(void *ptr, size_t size1, size_t size2, size_t size3) ++{ ++ if(!size1 || (!size2 && !size3)) ++ return realloc(ptr, 0); /* preserve POSIX realloc(ptr, 0) semantics */ ++ size2 += size3; ++ if(size2 < size3) ++ return 0; ++ return safe_realloc_nofree_mul_2op_(ptr, size1, size2); ++} ++ + #endif +diff --git a/src/flac/encode.c b/src/flac/encode.c +index a9b907f..f87250c 100644 +--- a/src/flac/encode.c ++++ b/src/flac/encode.c +@@ -1743,10 +1743,10 @@ static void static_metadata_clear(static_metadata_t *m) + static FLAC__bool static_metadata_append(static_metadata_t *m, FLAC__StreamMetadata *d, FLAC__bool needs_delete) + { + void *x; +- if(0 == (x = safe_realloc_muladd2_(m->metadata, sizeof(*m->metadata), /*times (*/m->num_metadata, /*+*/1/*)*/))) ++ if(0 == (x = safe_realloc_nofree_muladd2_(m->metadata, sizeof(*m->metadata), /*times (*/m->num_metadata, /*+*/1/*)*/))) + return false; + m->metadata = (FLAC__StreamMetadata**)x; +- if(0 == (x = safe_realloc_muladd2_(m->needs_delete, sizeof(*m->needs_delete), /*times (*/m->num_metadata, /*+*/1/*)*/))) ++ if(0 == (x = safe_realloc_nofree_muladd2_(m->needs_delete, sizeof(*m->needs_delete), /*times (*/m->num_metadata, /*+*/1/*)*/))) + return false; + m->needs_delete = (FLAC__bool*)x; + m->metadata[m->num_metadata] = d; +diff --git a/src/flac/foreign_metadata.c b/src/flac/foreign_metadata.c +index 9ad9c18..fdfb3cf 100644 +--- a/src/flac/foreign_metadata.c ++++ b/src/flac/foreign_metadata.c +@@ -75,7 +75,7 @@ static FLAC__bool copy_data_(FILE *fin, FILE *fout, size_t size, const char **er + + static FLAC__bool append_block_(foreign_metadata_t *fm, FLAC__off_t offset, FLAC__uint32 size, const char **error) + { +- foreign_block_t *fb = safe_realloc_muladd2_(fm->blocks, sizeof(foreign_block_t), /*times (*/fm->num_blocks, /*+*/1/*)*/); ++ foreign_block_t *fb = safe_realloc_nofree_muladd2_(fm->blocks, sizeof(foreign_block_t), /*times (*/fm->num_blocks, /*+*/1/*)*/); + if(fb) { + fb[fm->num_blocks].offset = offset; + fb[fm->num_blocks].size = size; +diff --git a/src/libFLAC/bitwriter.c b/src/libFLAC/bitwriter.c +index 6e86585..a510b0d 100644 +--- a/src/libFLAC/bitwriter.c ++++ b/src/libFLAC/bitwriter.c +@@ -124,7 +124,7 @@ FLAC__bool bitwriter_grow_(FLAC__BitWriter *bw, uint32_t bits_to_add) + FLAC__ASSERT(new_capacity > bw->capacity); + FLAC__ASSERT(new_capacity >= bw->words + ((bw->bits + bits_to_add + FLAC__BITS_PER_WORD - 1) / FLAC__BITS_PER_WORD)); + +- new_buffer = safe_realloc_mul_2op_(bw->buffer, sizeof(bwword), /*times*/new_capacity); ++ new_buffer = safe_realloc_nofree_mul_2op_(bw->buffer, sizeof(bwword), /*times*/new_capacity); + if(new_buffer == 0) + return false; + bw->buffer = new_buffer; +diff --git a/src/libFLAC/metadata_object.c b/src/libFLAC/metadata_object.c +index de8e513..aef65be 100644 +--- a/src/libFLAC/metadata_object.c ++++ b/src/libFLAC/metadata_object.c +@@ -98,7 +98,7 @@ static FLAC__bool free_copy_bytes_(FLAC__byte **to, const FLAC__byte *from, uint + /* realloc() failure leaves entry unchanged */ + static FLAC__bool ensure_null_terminated_(FLAC__byte **entry, uint32_t length) + { +- FLAC__byte *x = safe_realloc_add_2op_(*entry, length, /*+*/1); ++ FLAC__byte *x = safe_realloc_nofree_add_2op_(*entry, length, /*+*/1); + if (x != NULL) { + x[length] = '\0'; + *entry = x; +diff --git a/src/plugin_common/tags.c b/src/plugin_common/tags.c +index ae440c5..dfa10d3 100644 +--- a/src/plugin_common/tags.c ++++ b/src/plugin_common/tags.c +@@ -317,7 +317,7 @@ FLAC__bool FLAC_plugin__tags_add_tag_utf8(FLAC__StreamMetadata *tags, const char + const size_t value_len = strlen(value); + const size_t separator_len = strlen(separator); + FLAC__byte *new_entry; +- if(0 == (new_entry = safe_realloc_add_4op_(entry->entry, entry->length, /*+*/value_len, /*+*/separator_len, /*+*/1))) ++ if(0 == (new_entry = safe_realloc_nofree_add_4op_(entry->entry, entry->length, /*+*/value_len, /*+*/separator_len, /*+*/1))) + return false; + memcpy(new_entry+entry->length, separator, separator_len); + entry->length += separator_len; +diff --git a/src/share/utf8/iconvert.c b/src/share/utf8/iconvert.c +index 8ab53c1..876c06e 100644 +--- a/src/share/utf8/iconvert.c ++++ b/src/share/utf8/iconvert.c +@@ -149,7 +149,7 @@ int iconvert(const char *fromcode, const char *tocode, + iconv_close(cd1); + return ret; + } +- newbuf = safe_realloc_add_2op_(utfbuf, (ob - utfbuf), /*+*/1); ++ newbuf = safe_realloc_nofree_add_2op_(utfbuf, (ob - utfbuf), /*+*/1); + if (!newbuf) + goto fail; + ob = (ob - utfbuf) + newbuf; +-- +2.40.0 diff --git a/meta/recipes-multimedia/flac/flac_1.3.4.bb b/meta/recipes-multimedia/flac/flac_1.3.4.bb index 012da0a0a0..1a44718bba 100644 --- a/meta/recipes-multimedia/flac/flac_1.3.4.bb +++ b/meta/recipes-multimedia/flac/flac_1.3.4.bb @@ -15,6 +15,7 @@ LIC_FILES_CHKSUM = "file://COPYING.FDL;md5=ad1419ecc56e060eccf8184a87c4285f \ DEPENDS = "libogg" SRC_URI = "http://downloads.xiph.org/releases/flac/${BP}.tar.xz \ + file://CVE-2020-22219.patch \ " SRC_URI[sha256sum] = "8ff0607e75a322dd7cd6ec48f4f225471404ae2730d0ea945127b1355155e737" diff --git a/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.7.bb index 9db31c18e4..2409ea25e1 100644 --- a/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.7.bb @@ -12,7 +12,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${PV} file://0001-connect-has-a-different-signature-on-musl.patch \ " -SRC_URI[sha256sum] = "5684436121b8bae07fd00b74395f95e44b5f26323dce4fa045fa665676807bba" +SRC_URI[sha256sum] = "2df2ddfee05f6ce978207de9086ca22f00fc36e04f74a11869074da178585e35" DEPENDS = "json-glib glib-2.0 glib-2.0-native gstreamer1.0 gstreamer1.0-plugins-base" RRECOMMENDS:${PN} = "git" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.7.bb index e5925c6510..f3f53893b6 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.7.bb @@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=69333daa044cb77e486cc36129f7a770 \ " SRC_URI = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${PV}.tar.xz" -SRC_URI[sha256sum] = "b152e3cc49d014899f53c39d8a6224a44e1399b4cf76aa5f9a903fdf9793c3cc" +SRC_URI[sha256sum] = "65e776e366f7f3549a9a829418817f464dcc5dc9845220c64a886683d8841b56" S = "${WORKDIR}/gst-libav-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.7.bb index ec5efcd408..bcbe0206d7 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.7.bb @@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c \ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-omx/gst-omx-${PV}.tar.xz" -SRC_URI[sha256sum] = "bcccbc02548cdc123fd49944dd44a4f1adc5d107e36f010d320eb526e2107806" +SRC_URI[sha256sum] = "e3dd418e3235db044104c1cb024f609e57035251fd1718e4e3e5d64780af1805" S = "${WORKDIR}/gst-omx-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40474.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40474.patch new file mode 100644 index 0000000000..dd5886863d --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40474.patch @@ -0,0 +1,118 @@ +From ce17e968e4cf900d28ca5b46f6e095febc42b4f0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> +Date: Thu, 10 Aug 2023 15:45:01 +0300 +Subject: [PATCH] mxfdemux: Fix integer overflow causing out of bounds writes + when handling invalid uncompressed video + +Check ahead of time when parsing the track information whether +width, height and bpp are valid and usable without overflows. + +Fixes ZDI-CAN-21660, CVE-2023-40474 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2896 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ce17e968e4cf900d28ca5b46f6e095febc42b4f0] +CVE: CVE-2023-40474 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst/mxf/mxfup.c | 51 +++++++++++++++++---- + 1 file changed, 43 insertions(+), 8 deletions(-) + +diff --git a/gst/mxf/mxfup.c b/gst/mxf/mxfup.c +index d72ed22cb7..0c0178c1c9 100644 +--- a/gst/mxf/mxfup.c ++++ b/gst/mxf/mxfup.c +@@ -118,6 +118,8 @@ mxf_up_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + gpointer mapping_data, GstBuffer ** outbuf) + { + MXFUPMappingData *data = mapping_data; ++ gsize expected_in_stride = 0, out_stride = 0; ++ gsize expected_in_size = 0, out_size = 0; + + /* SMPTE 384M 7.1 */ + if (key->u[12] != 0x15 || (key->u[14] != 0x01 && key->u[14] != 0x02 +@@ -146,22 +148,25 @@ mxf_up_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + } + } + +- if (gst_buffer_get_size (buffer) != data->bpp * data->width * data->height) { ++ // Checked for overflows when parsing the descriptor ++ expected_in_stride = data->bpp * data->width; ++ out_stride = GST_ROUND_UP_4 (expected_in_stride); ++ expected_in_size = expected_in_stride * data->height; ++ out_size = out_stride * data->height; ++ ++ if (gst_buffer_get_size (buffer) != expected_in_size) { + GST_ERROR ("Invalid buffer size"); + gst_buffer_unref (buffer); + return GST_FLOW_ERROR; + } + +- if (data->bpp != 4 +- || GST_ROUND_UP_4 (data->width * data->bpp) != data->width * data->bpp) { ++ if (data->bpp != 4 || out_stride != expected_in_stride) { + guint y; + GstBuffer *ret; + GstMapInfo inmap, outmap; + guint8 *indata, *outdata; + +- ret = +- gst_buffer_new_and_alloc (GST_ROUND_UP_4 (data->width * data->bpp) * +- data->height); ++ ret = gst_buffer_new_and_alloc (out_size); + gst_buffer_map (buffer, &inmap, GST_MAP_READ); + gst_buffer_map (ret, &outmap, GST_MAP_WRITE); + indata = inmap.data; +@@ -169,8 +174,8 @@ mxf_up_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + + for (y = 0; y < data->height; y++) { + memcpy (outdata, indata, data->width * data->bpp); +- outdata += GST_ROUND_UP_4 (data->width * data->bpp); +- indata += data->width * data->bpp; ++ outdata += out_stride; ++ indata += expected_in_stride; + } + + gst_buffer_unmap (buffer, &inmap); +@@ -378,6 +383,36 @@ mxf_up_create_caps (MXFMetadataTimelineTrack * track, GstTagList ** tags, + return NULL; + } + ++ if (caps) { ++ MXFUPMappingData *data = *mapping_data; ++ gsize expected_in_stride = 0, out_stride = 0; ++ gsize expected_in_size = 0, out_size = 0; ++ ++ // Do some checking of the parameters to see if they're valid and ++ // we can actually work with them. ++ if (data->image_start_offset > data->image_end_offset) { ++ GST_WARNING ("Invalid image start/end offset"); ++ g_free (data); ++ *mapping_data = NULL; ++ gst_clear_caps (&caps); ++ ++ return NULL; ++ } ++ ++ if (!g_size_checked_mul (&expected_in_stride, data->bpp, data->width) || ++ (out_stride = GST_ROUND_UP_4 (expected_in_stride)) < expected_in_stride ++ || !g_size_checked_mul (&expected_in_size, expected_in_stride, ++ data->height) ++ || !g_size_checked_mul (&out_size, out_stride, data->height)) { ++ GST_ERROR ("Invalid resolution or bit depth"); ++ g_free (data); ++ *mapping_data = NULL; ++ gst_clear_caps (&caps); ++ ++ return NULL; ++ } ++ } ++ + return caps; + } + +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40475.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40475.patch new file mode 100644 index 0000000000..ab9ac7afaa --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40475.patch @@ -0,0 +1,49 @@ +From 72742dee30cce7bf909639f82de119871566ce39 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> +Date: Thu, 10 Aug 2023 15:47:03 +0300 +Subject: [PATCH] mxfdemux: Check number of channels for AES3 audio + +Only up to 8 channels are allowed and using a higher number would cause +integer overflows when copying the data, and lead to out of bound +writes. + +Also check that each buffer is at least 4 bytes long to avoid another +overflow. + +Fixes ZDI-CAN-21661, CVE-2023-40475 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2897 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/72742dee30cce7bf909639f82de119871566ce39] +CVE: CVE-2023-40475 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst/mxf/mxfd10.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/gst/mxf/mxfd10.c b/gst/mxf/mxfd10.c +index 03854d9303..0ad0d2d283 100644 +--- a/gst/mxf/mxfd10.c ++++ b/gst/mxf/mxfd10.c +@@ -101,7 +101,7 @@ mxf_d10_sound_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + gst_buffer_map (buffer, &map, GST_MAP_READ); + + /* Now transform raw AES3 into raw audio, see SMPTE 331M */ +- if ((map.size - 4) % 32 != 0) { ++ if (map.size < 4 || (map.size - 4) % 32 != 0) { + gst_buffer_unmap (buffer, &map); + GST_ERROR ("Invalid D10 sound essence buffer size"); + return GST_FLOW_ERROR; +@@ -201,6 +201,7 @@ mxf_d10_create_caps (MXFMetadataTimelineTrack * track, GstTagList ** tags, + GstAudioFormat audio_format; + + if (s->channel_count == 0 || ++ s->channel_count > 8 || + s->quantization_bits == 0 || + s->audio_sampling_rate.n == 0 || s->audio_sampling_rate.d == 0) { + GST_ERROR ("Invalid descriptor"); +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40476.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40476.patch new file mode 100644 index 0000000000..7810e98024 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40476.patch @@ -0,0 +1,44 @@ +From 1b51467ea640bcc73c97f3186350d72cbfba5cb4 Mon Sep 17 00:00:00 2001 +From: Nicolas Dufresne <nicolas.dufresne@collabora.com> +Date: Wed, 9 Aug 2023 12:49:19 -0400 +Subject: [PATCH] h265parser: Fix possible overflow using max_sub_layers_minus1 + +This fixes a possible overflow that can be triggered by an invalid value of +max_sub_layers_minus1 being set in the bitstream. The bitstream uses 3 bits, +but the allowed range is 0 to 6 only. + +Fixes ZDI-CAN-21768, CVE-2023-40476 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2895 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5364> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ff91a3d8d6f7e2412c44663bf30fad5c7fdbc9d9] +CVE: CVE-2023-40476 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> + +--- + gst-libs/gst/codecparsers/gsth265parser.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/gst-libs/gst/codecparsers/gsth265parser.c b/gst-libs/gst/codecparsers/gsth265parser.c +index a4e7549..3db1c38 100644 +--- a/gst-libs/gst/codecparsers/gsth265parser.c ++++ b/gst-libs/gst/codecparsers/gsth265parser.c +@@ -1670,6 +1670,7 @@ gst_h265_parse_vps (GstH265NalUnit * nalu, GstH265VPS * vps) + + READ_UINT8 (&nr, vps->max_layers_minus1, 6); + READ_UINT8 (&nr, vps->max_sub_layers_minus1, 3); ++ CHECK_ALLOWED (vps->max_sub_layers_minus1, 0, 6); + READ_UINT8 (&nr, vps->temporal_id_nesting_flag, 1); + + /* skip reserved_0xffff_16bits */ +@@ -1849,6 +1850,7 @@ gst_h265_parse_sps (GstH265Parser * parser, GstH265NalUnit * nalu, + sps->vps = vps; + + READ_UINT8 (&nr, sps->max_sub_layers_minus1, 3); ++ CHECK_ALLOWED (sps->max_sub_layers_minus1, 0, 6); + READ_UINT8 (&nr, sps->temporal_id_nesting_flag, 1); + + if (!gst_h265_parse_profile_tier_level (&sps->profile_tier_level, &nr, diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch new file mode 100644 index 0000000000..5070d6b865 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch @@ -0,0 +1,38 @@ +From 1db83d3f745332cbda6adf954b2c53a10caa205e Mon Sep 17 00:00:00 2001 +From: Benjamin Gaignard <benjamin.gaignard@collabora.com> +Date: Wed, 4 Oct 2023 11:14:38 +0200 +Subject: [PATCH] codecparsers: av1: Clip max tile rows and cols values + +Clip tile rows and cols to 64 as describe in AV1 specification. + +Fixes ZDI-CAN-22226 / CVE-2023-44429 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3015 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5634> + +CVE: CVE-2023-44429 + +Upstream-Status: Backport +[https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1db83d3f745332cbda6adf954b2c53a10caa205e] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst-libs/gst/codecparsers/gstav1parser.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/gst-libs/gst/codecparsers/gstav1parser.c b/gst-libs/gst/codecparsers/gstav1parser.c +index 7b9378c..68f8a76 100644 +--- a/gst-libs/gst/codecparsers/gstav1parser.c ++++ b/gst-libs/gst/codecparsers/gstav1parser.c +@@ -2219,6 +2219,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br, + ((parser->state.mi_cols + 31) >> 5) : ((parser->state.mi_cols + 15) >> 4); + sb_rows = seq_header->use_128x128_superblock ? ((parser->state.mi_rows + + 31) >> 5) : ((parser->state.mi_rows + 15) >> 4); ++ sb_cols = MIN (GST_AV1_MAX_TILE_COLS, sb_cols); ++ sb_rows = MIN (GST_AV1_MAX_TILE_ROWS, sb_rows); + sb_shift = seq_header->use_128x128_superblock ? 5 : 4; + sb_size = sb_shift + 2; + max_tile_width_sb = GST_AV1_MAX_TILE_WIDTH >> sb_size; +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb index 80766b9166..504cfce1fd 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb @@ -10,8 +10,12 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad file://0002-avoid-including-sys-poll.h-directly.patch \ file://0003-ensure-valid-sentinals-for-gst_structure_get-etc.patch \ file://0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch \ + file://CVE-2023-40474.patch \ + file://CVE-2023-40475.patch \ + file://CVE-2023-40476.patch \ + file://CVE-2023-44429.patch \ " -SRC_URI[sha256sum] = "f431214b0754d7037adcde93c3195106196588973e5b32dcb24938805f866363" +SRC_URI[sha256sum] = "87251beebfd1325e5118cc67774061f6e8971761ca65a9e5957919610080d195" S = "${WORKDIR}/gst-plugins-bad-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb index c37b542c57..8dfa70aea3 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb @@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba file://0003-viv-fb-Make-sure-config.h-is-included.patch \ file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \ " -SRC_URI[sha256sum] = "11f911ef65f3095d7cf698a1ad1fc5242ac3ad6c9270465fb5c9e7f4f9c19b35" +SRC_URI[sha256sum] = "fde6696a91875095d82c1012b5777c28ba926047ffce08508e12c1d2c66f0057" S = "${WORKDIR}/gst-plugins-base-${PV}" @@ -21,7 +21,8 @@ inherit gobject-introspection # opengl packageconfig factored out to make it easy for distros # and BSP layers to choose OpenGL APIs/platforms/window systems -PACKAGECONFIG_GL ?= "${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'gles2 egl', '', d)}" +PACKAGECONFIG_X11 = "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'opengl glx', '', d)}" +PACKAGECONFIG_GL ?= "${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'gles2 egl ${PACKAGECONFIG_X11}', '', d)}" PACKAGECONFIG ??= " \ ${GSTREAMER_ORC} \ @@ -32,7 +33,7 @@ PACKAGECONFIG ??= " \ " OPENGL_APIS = 'opengl gles2' -OPENGL_PLATFORMS = 'egl' +OPENGL_PLATFORMS = 'egl glx' X11DEPENDS = "virtual/libx11 libsm libxrender libxv" X11ENABLEOPTS = "-Dx11=enabled -Dxvideo=enabled -Dxshm=enabled" @@ -61,6 +62,7 @@ PACKAGECONFIG[gles2] = ",,virtual/libgles2" # OpenGL platform packageconfigs PACKAGECONFIG[egl] = ",,virtual/egl" +PACKAGECONFIG[glx] = ",,virtual/libgl" # OpenGL window systems (except for X11) PACKAGECONFIG[gbm] = ",,virtual/libgbm libgudev libdrm" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.7.bb index 80aed01973..dfb0c0f342 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.7.bb @@ -8,7 +8,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-go file://0001-qt-include-ext-qt-gstqtgl.h-instead-of-gst-gl-gstglf.patch \ " -SRC_URI[sha256sum] = "e83ab4d12ca24959489bbb0ec4fac9b90e32f741d49cda357cb554b2cb8b97f9" +SRC_URI[sha256sum] = "599f093cc833a1e346939ab6e78a3f8046855b6da13520aae80dd385434f4ab2" S = "${WORKDIR}/gst-plugins-good-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.7.bb index f765e626c9..1068bb4d80 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.7.bb @@ -14,7 +14,7 @@ LICENSE_FLAGS = "commercial" SRC_URI = " \ https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${PV}.tar.xz \ " -SRC_URI[sha256sum] = "af67d8ba7cab230f64d0594352112c2c443e2aa36a87c35f9f98a43d11430b87" +SRC_URI[sha256sum] = "e761665bb3c66fb35ff3567a283b3763b494acf0fe1df8f4abeda047b22dbc55" S = "${WORKDIR}/gst-plugins-ugly-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.7.bb index 05e9ace276..83445fab09 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.7.bb @@ -8,7 +8,7 @@ LICENSE = "LGPL-2.1-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=c34deae4e395ca07e725ab0076a5f740" SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz" -SRC_URI[sha256sum] = "27487652318659cfd7dc42784b713c78d29cc7a7df4fb397134c8c125f65e3b2" +SRC_URI[sha256sum] = "a63db0cb502308446db3d3b0a23772f1966f9f2b98fddc22fca49560a0575adc" DEPENDS = "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject" RDEPENDS:${PN} += "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.7.bb index c9cf42903d..2901be69d2 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.7.bb @@ -10,7 +10,7 @@ PNREAL = "gst-rtsp-server" SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz" -SRC_URI[sha256sum] = "ba398a7ddd559cce56ef4b91f448d174e0dccad98a493563d2d59c41a2ef39c5" +SRC_URI[sha256sum] = "2c8f46aa9df2245e5b39a2082be8e9d3edc0f61bc34f667803d7a21da1b51987" S = "${WORKDIR}/${PNREAL}-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.7.bb index 716f50ebe1..21676bddde 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.7.bb @@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=4fbd65380cdd255951079008b364516c" SRC_URI = "https://gstreamer.freedesktop.org/src/${REALPN}/${REALPN}-${PV}.tar.xz" -SRC_URI[sha256sum] = "510c6fb4ff3f676d7946ce1800e04ccf5aabe5a586d4e164d1961808fab8c94b" +SRC_URI[sha256sum] = "40b9747408c7066a1344adae001d2d53203adda012814944a1c0a5cff3f33dd6" S = "${WORKDIR}/${REALPN}-${PV}" DEPENDS = "libva gstreamer1.0 gstreamer1.0-plugins-base gstreamer1.0-plugins-bad" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch deleted file mode 100644 index f1fac2df57..0000000000 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch +++ /dev/null @@ -1,300 +0,0 @@ -From e1e2d8d58c1e09e065849cdb1f6466c0537a7c51 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> -Date: Tue, 21 Jun 2022 11:51:35 +0300 -Subject: [PATCH] bin: Fix race conditions in tests - -The latency messages are non-deterministic and can arrive before/after -async-done or during state-changes as they are posted by e.g. sinks from -their streaming thread but bins are finishing asynchronous state changes -from a secondary helper thread. - -To solve this, expect latency messages at any time and assert that we -receive one at some point during the test. - -Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643> - -Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643] -Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com> ---- - .../gstreamer/tests/check/gst/gstbin.c | 132 ++++++++++++------ - 1 file changed, 92 insertions(+), 40 deletions(-) - -diff --git a/subprojects/gstreamer/tests/check/gst/gstbin.c b/subprojects/gstreamer/tests/check/gst/gstbin.c -index e366d5fe20f..88ff44db0c3 100644 ---- a/subprojects/gstreamer/tests/check/gst/gstbin.c -+++ b/subprojects/gstreamer/tests/check/gst/gstbin.c -@@ -27,50 +27,95 @@ - #include <gst/base/gstbasesrc.h> - - static void --pop_async_done (GstBus * bus) -+pop_async_done (GstBus * bus, gboolean * had_latency) - { - GstMessage *message; -+ GstMessageType types = GST_MESSAGE_ASYNC_DONE; -+ -+ if (!*had_latency) -+ types |= GST_MESSAGE_LATENCY; - - GST_DEBUG ("popping async-done message"); -- message = gst_bus_poll (bus, GST_MESSAGE_ASYNC_DONE, -1); - -- fail_unless (message && GST_MESSAGE_TYPE (message) -- == GST_MESSAGE_ASYNC_DONE, "did not get GST_MESSAGE_ASYNC_DONE"); -+ do { -+ message = gst_bus_poll (bus, types, -1); - -- gst_message_unref (message); -- GST_DEBUG ("popped message"); -+ fail_unless (message); -+ GST_DEBUG ("popped message %s", -+ gst_message_type_get_name (GST_MESSAGE_TYPE (message))); -+ -+ if (GST_MESSAGE_TYPE (message) == GST_MESSAGE_LATENCY) { -+ fail_unless (*had_latency == FALSE); -+ *had_latency = TRUE; -+ gst_clear_message (&message); -+ types &= ~GST_MESSAGE_LATENCY; -+ continue; -+ } -+ -+ fail_unless (GST_MESSAGE_TYPE (message) -+ == GST_MESSAGE_ASYNC_DONE, "did not get GST_MESSAGE_ASYNC_DONE"); -+ -+ gst_clear_message (&message); -+ break; -+ } while (TRUE); - } - - static void --pop_latency (GstBus * bus) -+pop_latency (GstBus * bus, gboolean * had_latency) - { - GstMessage *message; - -- GST_DEBUG ("popping async-done message"); -+ if (*had_latency) -+ return; -+ -+ GST_DEBUG ("popping latency message"); - message = gst_bus_poll (bus, GST_MESSAGE_LATENCY, -1); - -- fail_unless (message && GST_MESSAGE_TYPE (message) -+ fail_unless (message); -+ fail_unless (GST_MESSAGE_TYPE (message) - == GST_MESSAGE_LATENCY, "did not get GST_MESSAGE_LATENCY"); - -- gst_message_unref (message); -- GST_DEBUG ("popped message"); -+ GST_DEBUG ("popped message %s", -+ gst_message_type_get_name (GST_MESSAGE_TYPE (message))); -+ gst_clear_message (&message); -+ -+ *had_latency = TRUE; - } - - static void --pop_state_changed (GstBus * bus, int count) -+pop_state_changed (GstBus * bus, int count, gboolean * had_latency) - { - GstMessage *message; -- -+ GstMessageType types = GST_MESSAGE_STATE_CHANGED; - int i; - -+ if (!*had_latency) -+ types |= GST_MESSAGE_LATENCY; -+ - GST_DEBUG ("popping %d messages", count); - for (i = 0; i < count; ++i) { -- message = gst_bus_poll (bus, GST_MESSAGE_STATE_CHANGED, -1); -- -- fail_unless (message && GST_MESSAGE_TYPE (message) -- == GST_MESSAGE_STATE_CHANGED, "did not get GST_MESSAGE_STATE_CHANGED"); -- -- gst_message_unref (message); -+ do { -+ message = gst_bus_poll (bus, types, -1); -+ -+ fail_unless (message); -+ GST_DEBUG ("popped message %s", -+ gst_message_type_get_name (GST_MESSAGE_TYPE (message))); -+ -+ if (GST_MESSAGE_TYPE (message) == GST_MESSAGE_LATENCY) { -+ fail_unless (*had_latency == FALSE); -+ *had_latency = TRUE; -+ gst_clear_message (&message); -+ types &= ~GST_MESSAGE_LATENCY; -+ continue; -+ } -+ -+ fail_unless (GST_MESSAGE_TYPE (message) -+ == GST_MESSAGE_STATE_CHANGED, -+ "did not get GST_MESSAGE_STATE_CHANGED"); -+ -+ gst_message_unref (message); -+ break; -+ } while (TRUE); - } - GST_DEBUG ("popped %d messages", count); - } -@@ -538,6 +583,7 @@ GST_START_TEST (test_message_state_changed_children) - GstBus *bus; - GstStateChangeReturn ret; - GstState current, pending; -+ gboolean had_latency = FALSE; - - pipeline = GST_PIPELINE (gst_pipeline_new (NULL)); - fail_unless (pipeline != NULL, "Could not create pipeline"); -@@ -576,7 +622,7 @@ GST_START_TEST (test_message_state_changed_children) - ASSERT_OBJECT_REFCOUNT (sink, "sink", 2); - ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 2); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - fail_if (gst_bus_have_pending (bus), "unexpected pending messages"); - - ASSERT_OBJECT_REFCOUNT (bus, "bus", 2); -@@ -619,9 +665,9 @@ GST_START_TEST (test_message_state_changed_children) - * its state_change message */ - ASSERT_OBJECT_REFCOUNT_BETWEEN (pipeline, "pipeline", 3, 4); - -- pop_state_changed (bus, 3); -- pop_async_done (bus); -- pop_latency (bus); -+ pop_state_changed (bus, 3, &had_latency); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - fail_if ((gst_bus_pop (bus)) != NULL); - - ASSERT_OBJECT_REFCOUNT_BETWEEN (bus, "bus", 2, 3); -@@ -648,7 +694,7 @@ GST_START_TEST (test_message_state_changed_children) - ASSERT_OBJECT_REFCOUNT_BETWEEN (sink, "sink", 2, 4); - ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 3); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - fail_if ((gst_bus_pop (bus)) != NULL); - - ASSERT_OBJECT_REFCOUNT (bus, "bus", 2); -@@ -669,7 +715,7 @@ GST_START_TEST (test_message_state_changed_children) - ASSERT_OBJECT_REFCOUNT_BETWEEN (sink, "sink", 3, 4); - ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 3); - -- pop_state_changed (bus, 6); -+ pop_state_changed (bus, 6, &had_latency); - fail_if ((gst_bus_pop (bus)) != NULL); - - ASSERT_OBJECT_REFCOUNT (src, "src", 1); -@@ -696,6 +742,7 @@ GST_START_TEST (test_watch_for_state_change) - GstElement *src, *sink, *bin; - GstBus *bus; - GstStateChangeReturn ret; -+ gboolean had_latency = FALSE; - - bin = gst_element_factory_make ("bin", NULL); - fail_unless (bin != NULL, "Could not create bin"); -@@ -722,9 +769,9 @@ GST_START_TEST (test_watch_for_state_change) - GST_CLOCK_TIME_NONE); - fail_unless (ret == GST_STATE_CHANGE_SUCCESS); - -- pop_state_changed (bus, 6); -- pop_async_done (bus); -- pop_latency (bus); -+ pop_state_changed (bus, 6, &had_latency); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - - fail_unless (gst_bus_have_pending (bus) == FALSE, - "Unexpected messages on bus"); -@@ -732,16 +779,17 @@ GST_START_TEST (test_watch_for_state_change) - ret = gst_element_set_state (GST_ELEMENT (bin), GST_STATE_PLAYING); - fail_unless (ret == GST_STATE_CHANGE_SUCCESS); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - -+ had_latency = FALSE; - /* this one might return either SUCCESS or ASYNC, likely SUCCESS */ - ret = gst_element_set_state (GST_ELEMENT (bin), GST_STATE_PAUSED); - gst_element_get_state (GST_ELEMENT (bin), NULL, NULL, GST_CLOCK_TIME_NONE); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - if (ret == GST_STATE_CHANGE_ASYNC) { -- pop_async_done (bus); -- pop_latency (bus); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - } - - fail_unless (gst_bus_have_pending (bus) == FALSE, -@@ -898,6 +946,7 @@ GST_START_TEST (test_children_state_change_order_flagged_sink) - GstStateChangeReturn ret; - GstState current, pending; - GstBus *bus; -+ gboolean had_latency = FALSE; - - pipeline = gst_pipeline_new (NULL); - fail_unless (pipeline != NULL, "Could not create pipeline"); -@@ -951,10 +1000,11 @@ GST_START_TEST (test_children_state_change_order_flagged_sink) - ASSERT_STATE_CHANGE_MSG (bus, sink, GST_STATE_READY, GST_STATE_PAUSED, 107); - #else - -- pop_state_changed (bus, 2); /* pop remaining ready => paused messages off the bus */ -+ pop_state_changed (bus, 2, &had_latency); /* pop remaining ready => paused messages off the bus */ - ASSERT_STATE_CHANGE_MSG (bus, pipeline, GST_STATE_READY, GST_STATE_PAUSED, - 108); -- pop_async_done (bus); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - #endif - /* PAUSED => PLAYING */ - GST_DEBUG ("popping PAUSED -> PLAYING messages"); -@@ -972,8 +1022,8 @@ GST_START_TEST (test_children_state_change_order_flagged_sink) - fail_if (ret != GST_STATE_CHANGE_SUCCESS, "State change to READY failed"); - - /* TODO: do we need to check downwards state change order as well? */ -- pop_state_changed (bus, 4); /* pop playing => paused messages off the bus */ -- pop_state_changed (bus, 4); /* pop paused => ready messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop playing => paused messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop paused => ready messages off the bus */ - - while (GST_OBJECT_REFCOUNT_VALUE (pipeline) > 1) - THREAD_SWITCH (); -@@ -1002,6 +1052,7 @@ GST_START_TEST (test_children_state_change_order_semi_sink) - GstStateChangeReturn ret; - GstState current, pending; - GstBus *bus; -+ gboolean had_latency = FALSE; - - /* (2) Now again, but check other code path where we don't have - * a proper sink correctly flagged as such, but a 'semi-sink' */ -@@ -1056,10 +1107,11 @@ GST_START_TEST (test_children_state_change_order_semi_sink) - ASSERT_STATE_CHANGE_MSG (bus, src, GST_STATE_READY, GST_STATE_PAUSED, 206); - ASSERT_STATE_CHANGE_MSG (bus, sink, GST_STATE_READY, GST_STATE_PAUSED, 207); - #else -- pop_state_changed (bus, 2); /* pop remaining ready => paused messages off the bus */ -+ pop_state_changed (bus, 2, &had_latency); /* pop remaining ready => paused messages off the bus */ - ASSERT_STATE_CHANGE_MSG (bus, pipeline, GST_STATE_READY, GST_STATE_PAUSED, - 208); -- pop_async_done (bus); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - - /* PAUSED => PLAYING */ - GST_DEBUG ("popping PAUSED -> PLAYING messages"); -@@ -1076,8 +1128,8 @@ GST_START_TEST (test_children_state_change_order_semi_sink) - fail_if (ret != GST_STATE_CHANGE_SUCCESS, "State change to READY failed"); - - /* TODO: do we need to check downwards state change order as well? */ -- pop_state_changed (bus, 4); /* pop playing => paused messages off the bus */ -- pop_state_changed (bus, 4); /* pop paused => ready messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop playing => paused messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop paused => ready messages off the bus */ - - GST_DEBUG ("waiting for pipeline to reach refcount 1"); - while (GST_OBJECT_REFCOUNT_VALUE (pipeline) > 1) --- -GitLab - diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.7.bb index ce9c1c116f..6d002198ae 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.7.bb @@ -21,9 +21,8 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${PV}.tar.x file://0002-tests-add-support-for-install-the-tests.patch;striplevel=3 \ file://0003-tests-use-a-dictionaries-for-environment.patch;striplevel=3 \ file://0004-tests-add-helper-script-to-run-the-installed_tests.patch;striplevel=3 \ - file://0005-bin-Fix-race-conditions-in-tests.patch;striplevel=3 \ " -SRC_URI[sha256sum] = "5a19083faaf361d21fc391124f78ba6d609be55845a82fa8f658230e5fa03dff" +SRC_URI[sha256sum] = "1757184a07b9703219e8b1961f81cb1dd64320d147fc045ac8eb499efbea79be" PACKAGECONFIG ??= "${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \ check \ diff --git a/meta/recipes-multimedia/libpng/files/run-ptest b/meta/recipes-multimedia/libpng/files/run-ptest new file mode 100644 index 0000000000..9ab5d0c1f4 --- /dev/null +++ b/meta/recipes-multimedia/libpng/files/run-ptest @@ -0,0 +1,29 @@ +#!/bin/sh + +set -eux + +./pngfix pngtest.png &> log.txt 2>&1 + +if grep -i "OK" log.txt 2>&1 ; then + echo "PASS: pngfix passed" +else + echo "FAIL: pngfix failed" +fi +rm -f log.txt + +./pngtest pngtest.png &> log.txt 2>&1 + +if grep -i "PASS" log.txt 2>&1 ; then + echo "PASS: pngtest passed" +else + echo "FAIL: pngtest failed" +fi +rm -f log.txt + +for i in pngstest timepng; do + if "./${i}" pngtest.png 2>&1; then + echo "PASS: $i" + else + echo "FAIL: $i" + fi +done diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.39.bb b/meta/recipes-multimedia/libpng/libpng_1.6.39.bb index d9dcf379e9..94db1d3f6b 100644 --- a/meta/recipes-multimedia/libpng/libpng_1.6.39.bb +++ b/meta/recipes-multimedia/libpng/libpng_1.6.39.bb @@ -10,7 +10,11 @@ DEPENDS = "zlib" LIBV = "16" -SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz" +SRC_URI = "\ + ${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \ + file://run-ptest \ + " + SRC_URI[sha256sum] = "1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937" MIRRORS += "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/ ${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/older-releases/" @@ -19,7 +23,7 @@ UPSTREAM_CHECK_URI = "http://libpng.org/pub/png/libpng.html" BINCONFIG = "${bindir}/libpng-config ${bindir}/libpng16-config" -inherit autotools binconfig-disabled pkgconfig +inherit autotools binconfig-disabled pkgconfig ptest # Work around missing symbols EXTRA_OECONF:append:class-target = " ${@bb.utils.contains("TUNE_FEATURES", "neon", "--enable-arm-neon=on", "--enable-arm-neon=off", d)}" @@ -32,3 +36,11 @@ BBCLASSEXTEND = "native nativesdk" # CVE-2019-17371 is actually a memory leak in gif2png 2.x CVE_CHECK_IGNORE += "CVE-2019-17371" + +do_install_ptest() { + install -m644 "${S}/pngtest.png" "${D}${PTEST_PATH}" + install -m755 "${B}/.libs/pngfix" "${D}${PTEST_PATH}" + install -m755 "${B}/.libs/pngtest" "${D}${PTEST_PATH}" + install -m755 "${B}/.libs/pngstest" "${D}${PTEST_PATH}" + install -m755 "${B}/.libs/timepng" "${D}${PTEST_PATH}" +} diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch new file mode 100644 index 0000000000..c5fba4d6b5 --- /dev/null +++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch @@ -0,0 +1,46 @@ +From 0754562e13d2e63a248a1c82f90b30bc0ffe307c Mon Sep 17 00:00:00 2001 +From: Alex Stewart <alex.stewart@ni.com> +Date: Tue, 10 Oct 2023 16:10:34 -0400 +Subject: [PATCH] mat4/mat5: fix int overflow in dataend calculation + +The clang sanitizer warns of a possible signed integer overflow when +calculating the `dataend` value in `mat4_read_header()`. + +``` +src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in +src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in +``` + +Cast the offending `rows` and `cols` ints to `sf_count_t` (the type of +`dataend` before performing the calculation, to avoid the issue. + +CVE: CVE-2022-33065 +Fixes: https://github.com/libsndfile/libsndfile/issues/789 +Fixes: https://github.com/libsndfile/libsndfile/issues/833 + +Signed-off-by: Alex Stewart <alex.stewart@ni.com> + +Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/commit/0754562e13d2e63a248a1c82f90b30bc0ffe307c] +CVE: CVE-2022-33065 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + src/mat4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/mat4.c b/src/mat4.c +index 0b1b414..575683b 100644 +--- a/src/mat4.c ++++ b/src/mat4.c +@@ -320,7 +320,7 @@ mat4_read_header (SF_PRIVATE *psf) + psf->filelength - psf->dataoffset, psf->sf.channels * psf->sf.frames * psf->bytewidth) ; + } + else if ((psf->filelength - psf->dataoffset) > psf->sf.channels * psf->sf.frames * psf->bytewidth) +- psf->dataend = psf->dataoffset + rows * cols * psf->bytewidth ; ++ psf->dataend = psf->dataoffset + (sf_count_t) rows * (sf_count_t) cols * psf->bytewidth ; + + psf->datalength = psf->filelength - psf->dataoffset - psf->dataend ; + +-- +2.40.1 diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb b/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb index f6ea585e34..0c654fd853 100644 --- a/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb +++ b/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb @@ -11,6 +11,7 @@ LICENSE = "LGPL-2.1-only" SRC_URI = "https://github.com/libsndfile/libsndfile/releases/download/${PV}/libsndfile-${PV}.tar.bz2 \ file://noopus.patch \ file://0001-flac-Fix-improper-buffer-reusing-732.patch \ + file://CVE-2022-33065.patch \ " UPSTREAM_CHECK_URI = "https://github.com/libsndfile/libsndfile/releases/" diff --git a/meta/recipes-multimedia/libtiff/tiff/0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch b/meta/recipes-multimedia/libtiff/tiff/0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch index 37859c9192..17b37be041 100644 --- a/meta/recipes-multimedia/libtiff/tiff/0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch +++ b/meta/recipes-multimedia/libtiff/tiff/0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch @@ -23,9 +23,10 @@ This MR will close the following issues: #149, #150, #152, #168 (to be checked) It also fixes the old bug at http://bugzilla.maptools.org/show_bug.cgi?id=2599, for which the limitation of `NumberOfInks = SPP` was introduced, which is in my opinion not necessary and does not solve the general issue. -CVE: CVE-2022-3599 -Upstream-Status: Backport +CVE: CVE-2022-3599 CVE-2022-4645 +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246.patch] Signed-off-by: Ross Burton <ross.burton@arm.com> +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> --- libtiff/tif_dir.c | 119 ++++++++++++++++++++++++----------------- libtiff/tif_dir.h | 2 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2022-40090.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-40090.patch new file mode 100644 index 0000000000..fe48dc6028 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-40090.patch @@ -0,0 +1,569 @@ +From c7caec9a4d8f24c17e667480d2c7d0d51c9fae41 Mon Sep 17 00:00:00 2001 +From: Su Laus <sulau@freenet.de> +Date: Thu, 6 Oct 2022 10:11:05 +0000 +Subject: [PATCH] Improved IFD-Loop Handling (fixes #455) + +IFD infinite looping was not fixed by MR 20 (see #455). +An improved IFD loop handling is proposed. + +Basic approach: + +- The order in the entire chain must be checked, and not only whether an offset has already been read once. +- To do this, pairs of directory number and offset are stored and checked. +- The offset of a directory number can change. +- TIFFAdvanceDirectory() must also perform an IFD loop check. +- TIFFCheckDirOffset() is replaced by _TIFFCheckDirNumberAndOffset(). + +Rules for the check: + +- If an offset is already in the list, it must have the same IFD number. Otherwise it is an IDF loop. +- If the offset is not in the list and the IFD number is greater than there are list entries, a new list entry is added. +- Otherwise, the offset of the IFD number is updated. + +Reference is also made to old bugzilla bug 2772 and MR 20, which did not solve the general issue. +This MR closes #455 + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/c7caec9a4d8f24c17e667480d2c7d0d51c9fae41] +CVE: CVE-2022-40090 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + libtiff/tif_close.c | 6 +- + libtiff/tif_dir.c | 129 +++++++++++++++++++++++++----------- + libtiff/tif_dir.h | 2 + + libtiff/tif_dirread.c | 147 +++++++++++++++++++++++++++++++++--------- + libtiff/tif_open.c | 3 +- + libtiff/tiffiop.h | 3 +- + 6 files changed, 219 insertions(+), 71 deletions(-) + +diff --git a/libtiff/tif_close.c b/libtiff/tif_close.c +index 0fe7af4..2fe2bde 100644 +--- a/libtiff/tif_close.c ++++ b/libtiff/tif_close.c +@@ -52,8 +52,10 @@ TIFFCleanup(TIFF* tif) + (*tif->tif_cleanup)(tif); + TIFFFreeDirectory(tif); + +- if (tif->tif_dirlist) +- _TIFFfree(tif->tif_dirlist); ++ if (tif->tif_dirlistoff) ++ _TIFFfree(tif->tif_dirlistoff); ++ if (tif->tif_dirlistdirn) ++ _TIFFfree(tif->tif_dirlistdirn); + + /* + * Clean up client info links. +diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c +index 1402c8e..6d4bf58 100644 +--- a/libtiff/tif_dir.c ++++ b/libtiff/tif_dir.c +@@ -1511,12 +1511,22 @@ TIFFDefaultDirectory(TIFF* tif) + } + + static int +-TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off) ++TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdiroff, uint64_t* off, uint16_t* nextdirnum) + { + static const char module[] = "TIFFAdvanceDirectory"; ++ ++ /* Add this directory to the directory list, if not already in. */ ++ if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff)) { ++ TIFFErrorExt(tif->tif_clientdata, module, "Starting directory %"PRIu16" at offset 0x%"PRIx64" (%"PRIu64") might cause an IFD loop", ++ *nextdirnum, *nextdiroff, *nextdiroff); ++ *nextdiroff = 0; ++ *nextdirnum = 0; ++ return(0); ++ } ++ + if (isMapped(tif)) + { +- uint64_t poff=*nextdir; ++ uint64_t poff=*nextdiroff; + if (!(tif->tif_flags&TIFF_BIGTIFF)) + { + tmsize_t poffa,poffb,poffc,poffd; +@@ -1527,7 +1537,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off) + if (((uint64_t)poffa != poff) || (poffb < poffa) || (poffb < (tmsize_t)sizeof(uint16_t)) || (poffb > tif->tif_size)) + { + TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory count"); +- *nextdir=0; ++ *nextdiroff=0; + return(0); + } + _TIFFmemcpy(&dircount,tif->tif_base+poffa,sizeof(uint16_t)); +@@ -1545,7 +1555,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off) + _TIFFmemcpy(&nextdir32,tif->tif_base+poffc,sizeof(uint32_t)); + if (tif->tif_flags&TIFF_SWAB) + TIFFSwabLong(&nextdir32); +- *nextdir=nextdir32; ++ *nextdiroff=nextdir32; + } + else + { +@@ -1577,11 +1587,10 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off) + } + if (off!=NULL) + *off=(uint64_t)poffc; +- _TIFFmemcpy(nextdir,tif->tif_base+poffc,sizeof(uint64_t)); ++ _TIFFmemcpy(nextdiroff,tif->tif_base+poffc,sizeof(uint64_t)); + if (tif->tif_flags&TIFF_SWAB) +- TIFFSwabLong8(nextdir); ++ TIFFSwabLong8(nextdiroff); + } +- return(1); + } + else + { +@@ -1589,7 +1598,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off) + { + uint16_t dircount; + uint32_t nextdir32; +- if (!SeekOK(tif, *nextdir) || ++ if (!SeekOK(tif, *nextdiroff) || + !ReadOK(tif, &dircount, sizeof (uint16_t))) { + TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count", + tif->tif_name); +@@ -1610,13 +1619,13 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off) + } + if (tif->tif_flags & TIFF_SWAB) + TIFFSwabLong(&nextdir32); +- *nextdir=nextdir32; ++ *nextdiroff=nextdir32; + } + else + { + uint64_t dircount64; + uint16_t dircount16; +- if (!SeekOK(tif, *nextdir) || ++ if (!SeekOK(tif, *nextdiroff) || + !ReadOK(tif, &dircount64, sizeof (uint64_t))) { + TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count", + tif->tif_name); +@@ -1636,17 +1645,27 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off) + else + (void) TIFFSeekFile(tif, + dircount16*20, SEEK_CUR); +- if (!ReadOK(tif, nextdir, sizeof (uint64_t))) { ++ if (!ReadOK(tif, nextdiroff, sizeof (uint64_t))) { + TIFFErrorExt(tif->tif_clientdata, module, + "%s: Error fetching directory link", + tif->tif_name); + return (0); + } + if (tif->tif_flags & TIFF_SWAB) +- TIFFSwabLong8(nextdir); ++ TIFFSwabLong8(nextdiroff); + } +- return (1); + } ++ if (*nextdiroff != 0) { ++ (*nextdirnum)++; ++ /* Check next directory for IFD looping and if so, set it as last directory. */ ++ if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff)) { ++ TIFFWarningExt(tif->tif_clientdata, module, "the next directory %"PRIu16" at offset 0x%"PRIx64" (%"PRIu64") might be an IFD loop. Treating directory %"PRIu16" as last directory", ++ *nextdirnum, *nextdiroff, *nextdiroff, *nextdirnum-1); ++ *nextdiroff = 0; ++ (*nextdirnum)--; ++ } ++ } ++ return (1); + } + + /* +@@ -1656,14 +1675,16 @@ uint16_t + TIFFNumberOfDirectories(TIFF* tif) + { + static const char module[] = "TIFFNumberOfDirectories"; +- uint64_t nextdir; ++ uint64_t nextdiroff; ++ uint16_t nextdirnum; + uint16_t n; + if (!(tif->tif_flags&TIFF_BIGTIFF)) +- nextdir = tif->tif_header.classic.tiff_diroff; ++ nextdiroff = tif->tif_header.classic.tiff_diroff; + else +- nextdir = tif->tif_header.big.tiff_diroff; ++ nextdiroff = tif->tif_header.big.tiff_diroff; ++ nextdirnum = 0; + n = 0; +- while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL)) ++ while (nextdiroff != 0 && TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum)) + { + if (n != 65535) { + ++n; +@@ -1686,28 +1707,30 @@ TIFFNumberOfDirectories(TIFF* tif) + int + TIFFSetDirectory(TIFF* tif, uint16_t dirn) + { +- uint64_t nextdir; ++ uint64_t nextdiroff; ++ uint16_t nextdirnum; + uint16_t n; + + if (!(tif->tif_flags&TIFF_BIGTIFF)) +- nextdir = tif->tif_header.classic.tiff_diroff; ++ nextdiroff = tif->tif_header.classic.tiff_diroff; + else +- nextdir = tif->tif_header.big.tiff_diroff; +- for (n = dirn; n > 0 && nextdir != 0; n--) +- if (!TIFFAdvanceDirectory(tif, &nextdir, NULL)) ++ nextdiroff = tif->tif_header.big.tiff_diroff; ++ nextdirnum = 0; ++ for (n = dirn; n > 0 && nextdiroff != 0; n--) ++ if (!TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum)) + return (0); +- tif->tif_nextdiroff = nextdir; ++ /* If the n-th directory could not be reached (does not exist), ++ * return here without touching anything further. */ ++ if (nextdiroff == 0 || n > 0) ++ return (0); ++ ++ tif->tif_nextdiroff = nextdiroff; + /* + * Set curdir to the actual directory index. The + * -1 is because TIFFReadDirectory will increment + * tif_curdir after successfully reading the directory. + */ + tif->tif_curdir = (dirn - n) - 1; +- /* +- * Reset tif_dirnumber counter and start new list of seen directories. +- * We need this to prevent IFD loops. +- */ +- tif->tif_dirnumber = 0; + return (TIFFReadDirectory(tif)); + } + +@@ -1720,13 +1743,42 @@ TIFFSetDirectory(TIFF* tif, uint16_t dirn) + int + TIFFSetSubDirectory(TIFF* tif, uint64_t diroff) + { +- tif->tif_nextdiroff = diroff; +- /* +- * Reset tif_dirnumber counter and start new list of seen directories. +- * We need this to prevent IFD loops. ++ /* Match nextdiroff and curdir for consistent IFD-loop checking. ++ * Only with TIFFSetSubDirectory() the IFD list can be corrupted with invalid offsets ++ * within the main IFD tree. ++ * In the case of several subIFDs of a main image, ++ * there are two possibilities that are not even mutually exclusive. ++ * a.) The subIFD tag contains an array with all offsets of the subIFDs. ++ * b.) The SubIFDs are concatenated with their NextIFD parameters. ++ * (refer to https://www.awaresystems.be/imaging/tiff/specification/TIFFPM6.pdf.) + */ +- tif->tif_dirnumber = 0; +- return (TIFFReadDirectory(tif)); ++ int retval; ++ uint16_t curdir = 0; ++ int8_t probablySubIFD = 0; ++ if (diroff == 0) { ++ /* Special case to invalidate the tif_lastdiroff member. */ ++ tif->tif_curdir = 65535; ++ } else { ++ if (!_TIFFGetDirNumberFromOffset(tif, diroff, &curdir)) { ++ /* Non-existing offsets might point to a SubIFD or invalid IFD.*/ ++ probablySubIFD = 1; ++ } ++ /* -1 because TIFFReadDirectory() will increment tif_curdir. */ ++ tif->tif_curdir = curdir - 1; ++ } ++ ++ tif->tif_nextdiroff = diroff; ++ retval = TIFFReadDirectory(tif); ++ /* If failed, curdir was not incremented in TIFFReadDirectory(), so set it back. */ ++ if (!retval )tif->tif_curdir++; ++ if (retval && probablySubIFD) { ++ /* Reset IFD list to start new one for SubIFD chain and also start SubIFD chain with tif_curdir=0. */ ++ tif->tif_dirnumber = 0; ++ tif->tif_curdir = 0; /* first directory of new chain */ ++ /* add this offset to new IFD list */ ++ _TIFFCheckDirNumberAndOffset(tif, tif->tif_curdir, diroff); ++ } ++ return (retval); + } + + /* +@@ -1750,12 +1802,15 @@ TIFFLastDirectory(TIFF* tif) + + /* + * Unlink the specified directory from the directory chain. ++ * Note: First directory starts with number dirn=1. ++ * This is different to TIFFSetDirectory() where the first directory starts with zero. + */ + int + TIFFUnlinkDirectory(TIFF* tif, uint16_t dirn) + { + static const char module[] = "TIFFUnlinkDirectory"; + uint64_t nextdir; ++ uint16_t nextdirnum; + uint64_t off; + uint16_t n; + +@@ -1779,19 +1834,21 @@ TIFFUnlinkDirectory(TIFF* tif, uint16_t dirn) + nextdir = tif->tif_header.big.tiff_diroff; + off = 8; + } ++ nextdirnum = 0; /* First directory is dirn=0 */ ++ + for (n = dirn-1; n > 0; n--) { + if (nextdir == 0) { + TIFFErrorExt(tif->tif_clientdata, module, "Directory %"PRIu16" does not exist", dirn); + return (0); + } +- if (!TIFFAdvanceDirectory(tif, &nextdir, &off)) ++ if (!TIFFAdvanceDirectory(tif, &nextdir, &off, &nextdirnum)) + return (0); + } + /* + * Advance to the directory to be unlinked and fetch + * the offset of the directory that follows. + */ +- if (!TIFFAdvanceDirectory(tif, &nextdir, NULL)) ++ if (!TIFFAdvanceDirectory(tif, &nextdir, NULL, &nextdirnum)) + return (0); + /* + * Go back and patch the link field of the preceding +diff --git a/libtiff/tif_dir.h b/libtiff/tif_dir.h +index 900dec1..f1a5125 100644 +--- a/libtiff/tif_dir.h ++++ b/libtiff/tif_dir.h +@@ -302,6 +302,8 @@ extern int _TIFFMergeFields(TIFF*, const TIFFField[], uint32_t); + extern const TIFFField* _TIFFFindOrRegisterField(TIFF *, uint32_t, TIFFDataType); + extern TIFFField* _TIFFCreateAnonField(TIFF *, uint32_t, TIFFDataType); + extern int _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag); ++extern int _TIFFCheckDirNumberAndOffset(TIFF *tif, uint16_t dirn, uint64_t diroff); ++extern int _TIFFGetDirNumberFromOffset(TIFF *tif, uint64_t diroff, uint16_t *dirn); + + #if defined(__cplusplus) + } +diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c +index d7cccbe..f07de60 100644 +--- a/libtiff/tif_dirread.c ++++ b/libtiff/tif_dirread.c +@@ -154,7 +154,6 @@ static void TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16_t tagid, uint32_t* + + static int EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16_t dircount); + static void MissingRequired(TIFF*, const char*); +-static int TIFFCheckDirOffset(TIFF* tif, uint64_t diroff); + static int CheckDirCount(TIFF*, TIFFDirEntry*, uint32_t); + static uint16_t TIFFFetchDirectory(TIFF* tif, uint64_t diroff, TIFFDirEntry** pdir, uint64_t* nextdiroff); + static int TIFFFetchNormalTag(TIFF*, TIFFDirEntry*, int recover); +@@ -3590,12 +3589,19 @@ TIFFReadDirectory(TIFF* tif) + int bitspersample_read = FALSE; + int color_channels; + +- tif->tif_diroff=tif->tif_nextdiroff; +- if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff)) +- return 0; /* last offset or bad offset (IFD looping) */ +- (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */ +- tif->tif_curdir++; +- nextdiroff = tif->tif_nextdiroff; ++ if (tif->tif_nextdiroff == 0) { ++ /* In this special case, tif_diroff needs also to be set to 0. */ ++ tif->tif_diroff = tif->tif_nextdiroff; ++ return 0; /* last offset, thus no checking necessary */ ++ } ++ ++ nextdiroff = tif->tif_nextdiroff; ++ /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL reading of the directory. Otherwise, invalid IFD offsets could corrupt the IFD list. */ ++ if (!_TIFFCheckDirNumberAndOffset(tif, tif->tif_curdir + 1, nextdiroff)) { ++ TIFFWarningExt(tif->tif_clientdata, module, ++ "Didn't read next directory due to IFD looping at offset 0x%"PRIx64" (%"PRIu64") to offset 0x%"PRIx64" (%"PRIu64")", tif->tif_diroff, tif->tif_diroff, nextdiroff, nextdiroff); ++ return 0; /* bad offset (IFD looping) */ ++ } + dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff); + if (!dircount) + { +@@ -3603,6 +3609,11 @@ TIFFReadDirectory(TIFF* tif) + "Failed to read directory at offset %" PRIu64, nextdiroff); + return 0; + } ++ /* Set global values after a valid directory has been fetched. ++ * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the beginning. */ ++ tif->tif_curdir++; ++ (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */ ++ + TIFFReadDirectoryCheckOrder(tif,dir,dircount); + + /* +@@ -4687,53 +4698,127 @@ MissingRequired(TIFF* tif, const char* tagname) + } + + /* +- * Check the directory offset against the list of already seen directory +- * offsets. This is a trick to prevent IFD looping. The one can create TIFF +- * file with looped directory pointers. We will maintain a list of already +- * seen directories and check every IFD offset against that list. ++ * Check the directory number and offset against the list of already seen ++ * directory numbers and offsets. This is a trick to prevent IFD looping. ++ * The one can create TIFF file with looped directory pointers. We will ++ * maintain a list of already seen directories and check every IFD offset ++ * and its IFD number against that list. However, the offset of an IFD number ++ * can change - e.g. when writing updates to file. ++ * Returns 1 if all is ok; 0 if last directory or IFD loop is encountered, ++ * or an error has occured. + */ +-static int +-TIFFCheckDirOffset(TIFF* tif, uint64_t diroff) ++int ++_TIFFCheckDirNumberAndOffset(TIFF *tif, uint16_t dirn, uint64_t diroff) + { + uint16_t n; + + if (diroff == 0) /* no more directories */ + return 0; + if (tif->tif_dirnumber == 65535) { +- TIFFErrorExt(tif->tif_clientdata, "TIFFCheckDirOffset", +- "Cannot handle more than 65535 TIFF directories"); +- return 0; ++ TIFFErrorExt(tif->tif_clientdata, "_TIFFCheckDirNumberAndOffset", ++ "Cannot handle more than 65535 TIFF directories"); ++ return 0; + } + +- for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlist; n++) { +- if (tif->tif_dirlist[n] == diroff) +- return 0; ++ /* Check if offset is already in the list: ++ * - yes: check, if offset is at the same IFD number - if not, it is an IFD loop ++ * - no: add to list or update offset at that IFD number ++ */ ++ for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlistdirn && tif->tif_dirlistoff; n++) { ++ if (tif->tif_dirlistoff[n] == diroff) { ++ if (tif->tif_dirlistdirn[n] == dirn) { ++ return 1; ++ } else { ++ TIFFWarningExt(tif->tif_clientdata, "_TIFFCheckDirNumberAndOffset", ++ "TIFF directory %"PRIu16" has IFD looping to directory %"PRIu16" at offset 0x%"PRIx64" (%"PRIu64")", ++ dirn-1, tif->tif_dirlistdirn[n], diroff, diroff); ++ return 0; ++ } ++ } ++ } ++ /* Check if offset of an IFD has been changed and update offset of that IFD number. */ ++ if (dirn < tif->tif_dirnumber && tif->tif_dirlistdirn && tif->tif_dirlistoff) { ++ /* tif_dirlistdirn can have IFD numbers dirn in random order */ ++ for (n = 0; n < tif->tif_dirnumber; n++) { ++ if (tif->tif_dirlistdirn[n] == dirn) { ++ tif->tif_dirlistoff[n] = diroff; ++ return 1; ++ } ++ } + } + ++ /* Add IFD offset and dirn to IFD directory list */ + tif->tif_dirnumber++; + +- if (tif->tif_dirlist == NULL || tif->tif_dirnumber > tif->tif_dirlistsize) { +- uint64_t* new_dirlist; +- ++ if (tif->tif_dirlistoff == NULL || tif->tif_dirlistdirn == NULL || tif->tif_dirnumber > tif->tif_dirlistsize) { ++ uint64_t *new_dirlist; + /* + * XXX: Reduce memory allocation granularity of the dirlist + * array. + */ +- new_dirlist = (uint64_t*)_TIFFCheckRealloc(tif, tif->tif_dirlist, +- tif->tif_dirnumber, 2 * sizeof(uint64_t), "for IFD list"); ++ if (tif->tif_dirnumber >= 32768) ++ tif->tif_dirlistsize = 65535; ++ else ++ tif->tif_dirlistsize = 2 * tif->tif_dirnumber; ++ ++ new_dirlist = (uint64_t *)_TIFFCheckRealloc(tif, tif->tif_dirlistoff, ++ tif->tif_dirlistsize, sizeof(uint64_t), "for IFD offset list"); + if (!new_dirlist) + return 0; +- if( tif->tif_dirnumber >= 32768 ) +- tif->tif_dirlistsize = 65535; +- else +- tif->tif_dirlistsize = 2 * tif->tif_dirnumber; +- tif->tif_dirlist = new_dirlist; ++ tif->tif_dirlistoff = new_dirlist; ++ new_dirlist = (uint64_t *)_TIFFCheckRealloc(tif, tif->tif_dirlistdirn, ++ tif->tif_dirlistsize, sizeof(uint16_t), "for IFD dirnumber list"); ++ if (!new_dirlist) ++ return 0; ++ tif->tif_dirlistdirn = (uint16_t *)new_dirlist; + } + +- tif->tif_dirlist[tif->tif_dirnumber - 1] = diroff; ++ tif->tif_dirlistoff[tif->tif_dirnumber - 1] = diroff; ++ tif->tif_dirlistdirn[tif->tif_dirnumber - 1] = dirn; + + return 1; +-} ++} /* --- _TIFFCheckDirNumberAndOffset() ---*/ ++ ++/* ++ * Retrieve the matching IFD directory number of a given IFD offset ++ * from the list of directories already seen. ++ * Returns 1 if the offset was in the list and the directory number ++ * can be returned. ++ * Otherwise returns 0 or if an error occured. ++ */ ++int ++_TIFFGetDirNumberFromOffset(TIFF *tif, uint64_t diroff, uint16_t* dirn) ++{ ++ uint16_t n; ++ ++ if (diroff == 0) /* no more directories */ ++ return 0; ++ if (tif->tif_dirnumber == 65535) { ++ TIFFErrorExt(tif->tif_clientdata, "_TIFFGetDirNumberFromOffset", ++ "Cannot handle more than 65535 TIFF directories"); ++ return 0; ++ } ++ ++ /* Check if offset is already in the list and return matching directory number. ++ * Otherwise update IFD list using TIFFNumberOfDirectories() ++ * and search again in IFD list. ++ */ ++ for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlistoff && tif->tif_dirlistdirn; n++) { ++ if (tif->tif_dirlistoff[n] == diroff) { ++ *dirn = tif->tif_dirlistdirn[n]; ++ return 1; ++ } ++ } ++ TIFFNumberOfDirectories(tif); ++ for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlistoff && tif->tif_dirlistdirn; n++) { ++ if (tif->tif_dirlistoff[n] == diroff) { ++ *dirn = tif->tif_dirlistdirn[n]; ++ return 1; ++ } ++ } ++ return 0; ++} /*--- _TIFFGetDirNumberFromOffset() ---*/ ++ + + /* + * Check the count field of a directory entry against a known value. The +diff --git a/libtiff/tif_open.c b/libtiff/tif_open.c +index 9724162..f047c73 100644 +--- a/libtiff/tif_open.c ++++ b/libtiff/tif_open.c +@@ -354,7 +354,8 @@ TIFFClientOpen( + if (!TIFFDefaultDirectory(tif)) + goto bad; + tif->tif_diroff = 0; +- tif->tif_dirlist = NULL; ++ tif->tif_dirlistoff = NULL; ++ tif->tif_dirlistdirn = NULL; + tif->tif_dirlistsize = 0; + tif->tif_dirnumber = 0; + return (tif); +diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h +index c1d0276..9459fe8 100644 +--- a/libtiff/tiffiop.h ++++ b/libtiff/tiffiop.h +@@ -117,7 +117,8 @@ struct tiff { + #define TIFF_CHOPPEDUPARRAYS 0x4000000U /* set when allocChoppedUpStripArrays() has modified strip array */ + uint64_t tif_diroff; /* file offset of current directory */ + uint64_t tif_nextdiroff; /* file offset of following directory */ +- uint64_t* tif_dirlist; /* list of offsets to already seen directories to prevent IFD looping */ ++ uint64_t* tif_dirlistoff; /* list of offsets to already seen directories to prevent IFD looping */ ++ uint16_t* tif_dirlistdirn; /* list of directory numbers to already seen directories to prevent IFD looping */ + uint16_t tif_dirlistsize; /* number of entries in offset list */ + uint16_t tif_dirnumber; /* number of already seen directories */ + TIFFDirectory tif_dir; /* internal rep of current directory */ +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2022-48281.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-48281.patch new file mode 100644 index 0000000000..4f8dc35251 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-48281.patch @@ -0,0 +1,26 @@ +From 97d65859bc29ee334012e9c73022d8a8e55ed586 Mon Sep 17 00:00:00 2001 +From: Su Laus <sulau@freenet.de> +Date: Sat, 21 Jan 2023 15:58:10 +0000 +Subject: [PATCH] tiffcrop: Correct simple copy paste error. Fix #488. + + +Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.2.0-1+deb11u4.debian.tar.xz] +CVE: CVE-2022-48281 +Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> +--- + tools/tiffcrop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: tiff-4.2.0/tools/tiffcrop.c +=================================================================== +--- tiff-4.2.0.orig/tools/tiffcrop.c ++++ tiff-4.2.0/tools/tiffcrop.c +@@ -7516,7 +7516,7 @@ processCropSelections(struct image_data + crop_buff = (unsigned char *)limitMalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES); + else + { +- prev_cropsize = seg_buffs[0].size; ++ prev_cropsize = seg_buffs[1].size; + if (prev_cropsize < cropsize) + { + next_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES); diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-0795_0796_0797_0798_0799.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-0795_0796_0797_0798_0799.patch new file mode 100644 index 0000000000..498d5ec8ab --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-0795_0796_0797_0798_0799.patch @@ -0,0 +1,162 @@ +From 7808740e100ba30ffb791044f3b14dec3e85ed6f Mon Sep 17 00:00:00 2001 +From: Markus Koschany <apo@debian.org> +Date: Tue, 21 Feb 2023 14:26:43 +0100 +Subject: [PATCH] CVE-2023-0795 + +This is also the fix for CVE-2023-0796, CVE-2023-0797, CVE-2023-0798, +CVE-2023-0799. + +Bug-Debian: https://bugs.debian.org/1031632 +Origin: https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68 + +Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz ] +CVE: CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799 +Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> + +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + tools/tiffcrop.c | 51 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 30 insertions(+), 21 deletions(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index adf0f84..deba170 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -269,7 +269,6 @@ struct region { + uint32_t width; /* width in pixels */ + uint32_t length; /* length in pixels */ + uint32_t buffsize; /* size of buffer needed to hold the cropped region */ +- unsigned char *buffptr; /* address of start of the region */ + }; + + /* Cropping parameters from command line and image data +@@ -524,7 +523,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t, + static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t, + uint32_t, uint32_t, uint8_t *, uint8_t *); + static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *, +- unsigned char **); ++ unsigned char **, int); + static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, + unsigned char *); + static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, +@@ -5219,7 +5218,6 @@ initCropMasks (struct crop_mask *cps) + cps->regionlist[i].width = 0; + cps->regionlist[i].length = 0; + cps->regionlist[i].buffsize = 0; +- cps->regionlist[i].buffptr = NULL; + cps->zonelist[i].position = 0; + cps->zonelist[i].total = 0; + } +@@ -6511,8 +6509,13 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b + (uint16_t) (image->adjustments & ROTATE_ANY)); + return (-1); + } +- +- if (rotateImage(rotation, image, &image->width, &image->length, work_buff_ptr)) ++ ++ /* Dummy variable in order not to switch two times the ++ * image->width,->length within rotateImage(), ++ * but switch xres, yres there. */ ++ uint32_t width = image->width; ++ uint32_t length = image->length; ++ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, TRUE)) + { + TIFFError ("correct_orientation", "Unable to rotate image"); + return (-1); +@@ -6580,7 +6583,6 @@ extractCompositeRegions(struct image_data *image, struct crop_mask *crop, + /* These should not be needed for composite images */ + crop->regionlist[i].width = crop_width; + crop->regionlist[i].length = crop_length; +- crop->regionlist[i].buffptr = crop_buff; + + src_rowsize = ((img_width * bps * spp) + 7) / 8; + dst_rowsize = (((crop_width * bps * count) + 7) / 8); +@@ -6817,7 +6819,6 @@ extractSeparateRegion(struct image_data *image, struct crop_mask *crop, + + crop->regionlist[region].width = crop_width; + crop->regionlist[region].length = crop_length; +- crop->regionlist[region].buffptr = crop_buff; + + src = read_buff; + dst = crop_buff; +@@ -7695,7 +7696,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ + { + if (rotateImage(crop->rotation, image, &crop->combined_width, +- &crop->combined_length, &crop_buff)) ++ &crop->combined_length, &crop_buff, FALSE)) + { + TIFFError("processCropSelections", + "Failed to rotate composite regions by %"PRIu32" degrees", crop->rotation); +@@ -7805,7 +7806,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + * ToDo: Therefore rotateImage() and its usage has to be reworked (e.g. like mirrorImage()) !! + */ + if (rotateImage(crop->rotation, image, &crop->regionlist[i].width, +- &crop->regionlist[i].length, &crop_buff)) ++ &crop->regionlist[i].length, &crop_buff, FALSE)) + { + TIFFError("processCropSelections", + "Failed to rotate crop region by %"PRIu16" degrees", crop->rotation); +@@ -7937,7 +7938,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop, + if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ + { + if (rotateImage(crop->rotation, image, &crop->combined_width, +- &crop->combined_length, crop_buff_ptr)) ++ &crop->combined_length, crop_buff_ptr, TRUE)) + { + TIFFError("createCroppedImage", + "Failed to rotate image or cropped selection by %"PRIu16" degrees", crop->rotation); +@@ -8600,7 +8601,7 @@ rotateContigSamples32bits(uint16_t rotation, uint16_t spp, uint16_t bps, uint32_ + /* Rotate an image by a multiple of 90 degrees clockwise */ + static int + rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, +- uint32_t *img_length, unsigned char **ibuff_ptr) ++ uint32_t *img_length, unsigned char **ibuff_ptr, int rot_image_params) + { + int shift_width; + uint32_t bytes_per_pixel, bytes_per_sample; +@@ -8791,11 +8792,15 @@ rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, + + *img_width = length; + *img_length = width; +- image->width = length; +- image->length = width; +- res_temp = image->xres; +- image->xres = image->yres; +- image->yres = res_temp; ++ /* Only toggle image parameters if whole input image is rotated. */ ++ if (rot_image_params) ++ { ++ image->width = length; ++ image->length = width; ++ res_temp = image->xres; ++ image->xres = image->yres; ++ image->yres = res_temp; ++ } + break; + + case 270: if ((bps % 8) == 0) /* byte aligned data */ +@@ -8868,11 +8873,15 @@ rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, + + *img_width = length; + *img_length = width; +- image->width = length; +- image->length = width; +- res_temp = image->xres; +- image->xres = image->yres; +- image->yres = res_temp; ++ /* Only toggle image parameters if whole input image is rotated. */ ++ if (rot_image_params) ++ { ++ image->width = length; ++ image->length = width; ++ res_temp = image->xres; ++ image->xres = image->yres; ++ image->yres = res_temp; ++ } + break; + default: + break; +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-0800_0801_0802_0803_0804.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-0800_0801_0802_0803_0804.patch new file mode 100644 index 0000000000..8372bc35f2 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-0800_0801_0802_0803_0804.patch @@ -0,0 +1,128 @@ +From 82a7fbb1fa7228499ffeb3a57a1d106a9626d57c Mon Sep 17 00:00:00 2001 +From: Su Laus <sulau@freenet.de> +Date: Sun, 5 Feb 2023 15:53:15 +0000 +Subject: [PATCH] tiffcrop: added check for assumption on composite images + (fixes #496) + +tiffcrop: For composite images with more than one region, the combined_length or combined_width always needs to be equal, respectively. Otherwise, even the first section/region copy action might cause buffer overrun. This is now checked before the first copy action. + +Closes #496, #497, #498, #500, #501. + +Upstream-Status: Backport [import from fedora https://src.fedoraproject.org/rpms/libtiff/c/91856895aadf3cce6353f40c2feef9bf0b486440 ] +CVE: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804 +Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> +--- + tools/tiffcrop.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 66 insertions(+), 2 deletions(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index 84e26ac6..480b927c 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -5329,18 +5329,39 @@ + + crop->regionlist[i].buffsize = buffsize; + crop->bufftotal += buffsize; ++ /* For composite images with more than one region, the ++ * combined_length or combined_width always needs to be equal, ++ * respectively. ++ * Otherwise, even the first section/region copy ++ * action might cause buffer overrun. */ + if (crop->img_mode == COMPOSITE_IMAGES) + { + switch (crop->edge_ref) + { + case EDGE_LEFT: + case EDGE_RIGHT: ++ if (i > 0 && zlength != crop->combined_length) ++ { ++ TIFFError( ++ "computeInputPixelOffsets", ++ "Only equal length regions can be combined for " ++ "-E left or right"); ++ return (-1); ++ } + crop->combined_length = zlength; + crop->combined_width += zwidth; + break; + case EDGE_BOTTOM: + case EDGE_TOP: /* width from left, length from top */ + default: ++ if (i > 0 && zwidth != crop->combined_width) ++ { ++ TIFFError("computeInputPixelOffsets", ++ "Only equal width regions can be " ++ "combined for -E " ++ "top or bottom"); ++ return (-1); ++ } + crop->combined_width = zwidth; + crop->combined_length += zlength; + break; +@@ -6546,6 +6567,46 @@ + crop->combined_width = 0; + crop->combined_length = 0; + ++ /* If there is more than one region, check beforehand whether all the width ++ * and length values of the regions are the same, respectively. */ ++ switch (crop->edge_ref) ++ { ++ default: ++ case EDGE_TOP: ++ case EDGE_BOTTOM: ++ for (i = 1; i < crop->selections; i++) ++ { ++ uint32_t crop_width0 = ++ crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1; ++ uint32_t crop_width1 = ++ crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1; ++ if (crop_width0 != crop_width1) ++ { ++ TIFFError("extractCompositeRegions", ++ "Only equal width regions can be combined for -E " ++ "top or bottom"); ++ return (1); ++ } ++ } ++ break; ++ case EDGE_LEFT: ++ case EDGE_RIGHT: ++ for (i = 1; i < crop->selections; i++) ++ { ++ uint32_t crop_length0 = ++ crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1; ++ uint32_t crop_length1 = ++ crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1; ++ if (crop_length0 != crop_length1) ++ { ++ TIFFError("extractCompositeRegions", ++ "Only equal length regions can be combined for " ++ "-E left or right"); ++ return (1); ++ } ++ } ++ } ++ + for (i = 0; i < crop->selections; i++) + { + /* rows, columns, width, length are expressed in pixels */ +@@ -6570,7 +6631,8 @@ + default: + case EDGE_TOP: + case EDGE_BOTTOM: +- if ((i > 0) && (crop_width != crop->regionlist[i - 1].width)) ++ if ((crop->selections > i + 1) && ++ (crop_width != crop->regionlist[i + 1].width)) + { + TIFFError ("extractCompositeRegions", + "Only equal width regions can be combined for -E top or bottom"); +@@ -6651,7 +6713,8 @@ + break; + case EDGE_LEFT: /* splice the pieces of each row together, side by side */ + case EDGE_RIGHT: +- if ((i > 0) && (crop_length != crop->regionlist[i - 1].length)) ++ if ((crop->selections > i + 1) && ++ (crop_length != crop->regionlist[i + 1].length)) + { + TIFFError ("extractCompositeRegions", + "Only equal length regions can be combined for -E left or right"); diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-1916.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-1916.patch new file mode 100644 index 0000000000..6722781a3a --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-1916.patch @@ -0,0 +1,99 @@ +From 848434a81c443f59ec90d41218eba6e48a450a11 Mon Sep 17 00:00:00 2001 +From: zhailiangliang <zhailiangliang@loongson.cn> +Date: Thu, 16 Mar 2023 16:16:54 +0800 +Subject: [PATCH] Fix heap-buffer-overflow in function extractImageSection + +CVE: CVE-2023-1916 +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/848434a81c443f59ec90d41218eba6e48a450a11 https://gitlab.com/libtiff/libtiff/-/merge_requests/535] +Signed-off-by: Marek Vasut <marex@denx.de> +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + tools/tiffcrop.c | 44 ++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 40 insertions(+), 4 deletions(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index 05ba4d2..8a08536 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -5700,6 +5700,15 @@ getCropOffsets(struct image_data *image, struct crop_mask *crop, struct dump_opt + crop->combined_width += (uint32_t)zwidth; + else + crop->combined_width = (uint32_t)zwidth; ++ ++ /* When the degrees clockwise rotation is 90 or 270, check the boundary */ ++ if (((crop->rotation == 90) || (crop->rotation == 270)) ++ && ((crop->combined_length > image->width) || (crop->combined_width > image->length))) ++ { ++ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size"); ++ return -1; ++ } ++ + break; + case EDGE_BOTTOM: /* width from left, zones from bottom to top */ + zwidth = offsets.crop_width; +@@ -5735,6 +5744,15 @@ getCropOffsets(struct image_data *image, struct crop_mask *crop, struct dump_opt + else + crop->combined_length = (uint32_t)zlength; + crop->combined_width = (uint32_t)zwidth; ++ ++ /* When the degrees clockwise rotation is 90 or 270, check the boundary */ ++ if (((crop->rotation == 90) || (crop->rotation == 270)) ++ && ((crop->combined_length > image->width) || (crop->combined_width > image->length))) ++ { ++ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size"); ++ return -1; ++ } ++ + break; + case EDGE_RIGHT: /* zones from right to left, length from top */ + zlength = offsets.crop_length; +@@ -5772,6 +5790,15 @@ getCropOffsets(struct image_data *image, struct crop_mask *crop, struct dump_opt + crop->combined_width += (uint32_t)zwidth; + else + crop->combined_width = (uint32_t)zwidth; ++ ++ /* When the degrees clockwise rotation is 90 or 270, check the boundary */ ++ if (((crop->rotation == 90) || (crop->rotation == 270)) ++ && ((crop->combined_length > image->width) || (crop->combined_width > image->length))) ++ { ++ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size"); ++ return -1; ++ } ++ + break; + case EDGE_TOP: /* width from left, zones from top to bottom */ + default: +@@ -5818,7 +5845,16 @@ getCropOffsets(struct image_data *image, struct crop_mask *crop, struct dump_opt + else + crop->combined_length = (uint32_t)zlength; + crop->combined_width = (uint32_t)zwidth; +- break; ++ ++ /* When the degrees clockwise rotation is 90 or 270, check the boundary */ ++ if (((crop->rotation == 90) || (crop->rotation == 270)) ++ && ((crop->combined_length > image->width) || (crop->combined_width > image->length))) ++ { ++ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size"); ++ return -1; ++ } ++ ++ break; + } /* end switch statement */ + + buffsize = (uint32_t) +@@ -7016,9 +7052,9 @@ extractImageSection(struct image_data *image, struct pageseg *section, + * regardless of the way the data are organized in the input file. + * Furthermore, bytes and bits are arranged in buffer according to COMPRESSION=1 and FILLORDER=1 + */ +- img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */ +- full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ +- trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */ ++ img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */ ++ full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ ++ trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */ + + #ifdef DEVELMODE + TIFFError ("", "First row: %"PRIu32", last row: %"PRIu32", First col: %"PRIu32", last col: %"PRIu32"\n", +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-25433.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-25433.patch new file mode 100644 index 0000000000..285aa3d1c4 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-25433.patch @@ -0,0 +1,195 @@ +From 9c22495e5eeeae9e00a1596720c969656bb8d678 Mon Sep 17 00:00:00 2001 +From: Su_Laus <sulau@freenet.de> +Date: Fri, 3 Feb 2023 15:31:31 +0100 +Subject: [PATCH] CVE-2023-25433 + +tiffcrop correctly update buffersize after rotateImage() +fix#520 rotateImage() set up a new buffer and calculates its size +individually. Therefore, seg_buffs[] size needs to be updated accordingly. +Before this fix, the seg_buffs buffer size was calculated with a different +formula than within rotateImage(). + +Closes #520. + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678 && https://gitlab.com/libtiff/libtiff/-/commit/688012dca2c39033aa2dc7bcea9796787cfd1b44] +CVE: CVE-2023-25433 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + tools/tiffcrop.c | 78 +++++++++++++++++++++++++++++++++++++----------- + 1 file changed, 60 insertions(+), 18 deletions(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index eee26bf..cbd24cc 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -523,7 +523,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t, + static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t, + uint32_t, uint32_t, uint8_t *, uint8_t *); + static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *, +- unsigned char **, int); ++ unsigned char **, size_t *); + static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, + unsigned char *); + static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, +@@ -6515,7 +6515,7 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b + * but switch xres, yres there. */ + uint32_t width = image->width; + uint32_t length = image->length; +- if (rotateImage(rotation, image, &width, &length, work_buff_ptr, TRUE)) ++ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL)) + { + TIFFError ("correct_orientation", "Unable to rotate image"); + return (-1); +@@ -7695,16 +7695,19 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + + if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ + { ++ /* rotateImage() set up a new buffer and calculates its size ++ * individually. Therefore, seg_buffs size needs to be updated ++ * accordingly. */ ++ size_t rot_buf_size = 0; + if (rotateImage(crop->rotation, image, &crop->combined_width, +- &crop->combined_length, &crop_buff, FALSE)) ++ &crop->combined_length, &crop_buff, &rot_buf_size)) + { + TIFFError("processCropSelections", + "Failed to rotate composite regions by %"PRIu32" degrees", crop->rotation); + return (-1); + } + seg_buffs[0].buffer = crop_buff; +- seg_buffs[0].size = (((crop->combined_width * image->bps + 7 ) / 8) +- * image->spp) * crop->combined_length; ++ seg_buffs[0].size = rot_buf_size; + } + } + else /* Separated Images */ +@@ -7804,9 +7807,13 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + { + /* rotateImage() changes image->width, ->length, ->xres and ->yres, what it schouldn't do here, when more than one section is processed. + * ToDo: Therefore rotateImage() and its usage has to be reworked (e.g. like mirrorImage()) !! +- */ +- if (rotateImage(crop->rotation, image, &crop->regionlist[i].width, +- &crop->regionlist[i].length, &crop_buff, FALSE)) ++ * Furthermore, rotateImage() set up a new buffer and calculates ++ * its size individually. Therefore, seg_buffs size needs to be ++ * updated accordingly. */ ++ size_t rot_buf_size = 0; ++ if (rotateImage( ++ crop->rotation, image, &crop->regionlist[i].width, ++ &crop->regionlist[i].length, &crop_buff, &rot_buf_size)) + { + TIFFError("processCropSelections", + "Failed to rotate crop region by %"PRIu16" degrees", crop->rotation); +@@ -7817,8 +7824,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + crop->combined_width = total_width; + crop->combined_length = total_length; + seg_buffs[i].buffer = crop_buff; +- seg_buffs[i].size = (((crop->regionlist[i].width * image->bps + 7 ) / 8) +- * image->spp) * crop->regionlist[i].length; ++ seg_buffs[i].size = rot_buf_size; + } + } /* for crop->selections loop */ + } /* Separated Images (else case) */ +@@ -7827,7 +7833,6 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + + /* Copy the crop section of the data from the current image into a buffer + * and adjust the IFD values to reflect the new size. If no cropping is +- * required, use the original read buffer as the crop buffer. + * + * There is quite a bit of redundancy between this routine and the more + * specialized processCropSelections, but this provides +@@ -7938,7 +7943,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop, + if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ + { + if (rotateImage(crop->rotation, image, &crop->combined_width, +- &crop->combined_length, crop_buff_ptr, TRUE)) ++ &crop->combined_length, crop_buff_ptr, NULL)) + { + TIFFError("createCroppedImage", + "Failed to rotate image or cropped selection by %"PRIu16" degrees", crop->rotation); +@@ -8600,14 +8605,16 @@ rotateContigSamples32bits(uint16_t rotation, uint16_t spp, uint16_t bps, uint32_ + + /* Rotate an image by a multiple of 90 degrees clockwise */ + static int +-rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, +- uint32_t *img_length, unsigned char **ibuff_ptr, int rot_image_params) ++rotateImage(uint16_t rotation, struct image_data *image, ++ uint32_t *img_width,uint32_t *img_length, ++ unsigned char **ibuff_ptr, size_t *rot_buf_size) + { + int shift_width; + uint32_t bytes_per_pixel, bytes_per_sample; + uint32_t row, rowsize, src_offset, dst_offset; + uint32_t i, col, width, length; +- uint32_t colsize, buffsize, col_offset, pix_offset; ++ uint32_t colsize, col_offset, pix_offset; ++ tmsize_t buffsize; + unsigned char *ibuff; + unsigned char *src; + unsigned char *dst; +@@ -8620,12 +8627,41 @@ rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, + spp = image->spp; + bps = image->bps; + ++ if ((spp != 0 && bps != 0 && ++ width > (uint32_t)((UINT32_MAX - 7) / spp / bps)) || ++ (spp != 0 && bps != 0 && ++ length > (uint32_t)((UINT32_MAX - 7) / spp / bps))) ++ { ++ TIFFError("rotateImage", "Integer overflow detected."); ++ return (-1); ++ } ++ + rowsize = ((bps * spp * width) + 7) / 8; + colsize = ((bps * spp * length) + 7) / 8; + if ((colsize * width) > (rowsize * length)) +- buffsize = (colsize + 1) * width; ++{ ++ if (((tmsize_t)colsize + 1) != 0 && ++ (tmsize_t)width > ((TIFF_TMSIZE_T_MAX - NUM_BUFF_OVERSIZE_BYTES) / ++ ((tmsize_t)colsize + 1))) ++ { ++ TIFFError("rotateImage", ++ "Integer overflow when calculating buffer size."); ++ return (-1); ++ } ++ buffsize = ((tmsize_t)colsize + 1) * width; ++ } + else +- buffsize = (rowsize + 1) * length; ++ { ++ if (((tmsize_t)rowsize + 1) != 0 && ++ (tmsize_t)length > ((TIFF_TMSIZE_T_MAX - NUM_BUFF_OVERSIZE_BYTES) / ++ ((tmsize_t)rowsize + 1))) ++ { ++ TIFFError("rotateImage", ++ "Integer overflow when calculating buffer size."); ++ return (-1); ++ } ++ buffsize = (rowsize + 1) * length; ++ } + + bytes_per_sample = (bps + 7) / 8; + bytes_per_pixel = ((bps * spp) + 7) / 8; +@@ -8648,11 +8684,17 @@ rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, + /* Add 3 padding bytes for extractContigSamplesShifted32bits */ + if (!(rbuff = (unsigned char *)limitMalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES))) + { +- TIFFError("rotateImage", "Unable to allocate rotation buffer of %1u bytes", buffsize + NUM_BUFF_OVERSIZE_BYTES); ++ TIFFError("rotateImage", ++ "Unable to allocate rotation buffer of %" TIFF_SSIZE_FORMAT ++ " bytes ", ++ buffsize + NUM_BUFF_OVERSIZE_BYTES); + return (-1); + } + _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES); + ++ if (rot_buf_size != NULL) ++ *rot_buf_size = buffsize; ++ + ibuff = *ibuff_ptr; + switch (rotation) + { +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-25434-CVE-2023-25435.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-25434-CVE-2023-25435.patch new file mode 100644 index 0000000000..e214277504 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-25434-CVE-2023-25435.patch @@ -0,0 +1,94 @@ +From 69818e2f2d246e6631ac2a2da692c3706b849c38 Mon Sep 17 00:00:00 2001 +From: Su_Laus <sulau@freenet.de> +Date: Sun, 29 Jan 2023 11:09:26 +0100 +Subject: [PATCH] CVE-2023-25434 & CVE-2023-25435 + +tiffcrop: Amend rotateImage() not to toggle the input (main) +image width and length parameters when only cropped image sections are +rotated. Remove buffptr from region structure because never used. + +Closes #492 #493 #494 #495 #499 #518 #519 + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38] +CVE: CVE-2023-25434 & CVE-2023-25435 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + tools/tiffcrop.c | 27 ++++++++++++++++----------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index cbd24cc..b811fbb 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -523,7 +523,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t, + static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t, + uint32_t, uint32_t, uint8_t *, uint8_t *); + static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *, +- unsigned char **, size_t *); ++ unsigned char **, size_t *, int); + static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, + unsigned char *); + static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, +@@ -6513,10 +6513,11 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b + /* Dummy variable in order not to switch two times the + * image->width,->length within rotateImage(), + * but switch xres, yres there. */ +- uint32_t width = image->width; +- uint32_t length = image->length; +- if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL)) +- { ++ uint32_t width = image->width; ++ uint32_t length = image->length; ++ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL, ++ TRUE)) ++ { + TIFFError ("correct_orientation", "Unable to rotate image"); + return (-1); + } +@@ -7700,7 +7701,8 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + * accordingly. */ + size_t rot_buf_size = 0; + if (rotateImage(crop->rotation, image, &crop->combined_width, +- &crop->combined_length, &crop_buff, &rot_buf_size)) ++ &crop->combined_length, &crop_buff, &rot_buf_size, ++ FALSE)) + { + TIFFError("processCropSelections", + "Failed to rotate composite regions by %"PRIu32" degrees", crop->rotation); +@@ -7811,9 +7813,10 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + * its size individually. Therefore, seg_buffs size needs to be + * updated accordingly. */ + size_t rot_buf_size = 0; +- if (rotateImage( +- crop->rotation, image, &crop->regionlist[i].width, +- &crop->regionlist[i].length, &crop_buff, &rot_buf_size)) ++ if (rotateImage(crop->rotation, image, ++ &crop->regionlist[i].width, ++ &crop->regionlist[i].length, &crop_buff, ++ &rot_buf_size, FALSE)) + { + TIFFError("processCropSelections", + "Failed to rotate crop region by %"PRIu16" degrees", crop->rotation); +@@ -7943,7 +7946,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop, + if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ + { + if (rotateImage(crop->rotation, image, &crop->combined_width, +- &crop->combined_length, crop_buff_ptr, NULL)) ++ &crop->combined_length, crop_buff_ptr, NULL, TRUE)) + { + TIFFError("createCroppedImage", + "Failed to rotate image or cropped selection by %"PRIu16" degrees", crop->rotation); +@@ -8607,7 +8610,9 @@ rotateContigSamples32bits(uint16_t rotation, uint16_t spp, uint16_t bps, uint32_ + static int + rotateImage(uint16_t rotation, struct image_data *image, + uint32_t *img_width,uint32_t *img_length, +- unsigned char **ibuff_ptr, size_t *rot_buf_size) ++ unsigned char **ibuff_ptr, size_t *rot_buf_size, ++ int rot_image_params) ++ + { + int shift_width; + uint32_t bytes_per_pixel, bytes_per_sample; +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-26965.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-26965.patch new file mode 100644 index 0000000000..2162493e34 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-26965.patch @@ -0,0 +1,97 @@ +From ec8ef90c1f573c9eb1f17d6a056aa0015f184acf Mon Sep 17 00:00:00 2001 +From: Su_Laus <sulau@freenet.de> +Date: Tue, 14 Feb 2023 20:43:43 +0100 +Subject: [PATCH] tiffcrop: Do not reuse input buffer for subsequent images. + Fix issue 527 + +Reuse of read_buff within loadImage() from previous image is quite unsafe, because other functions (like rotateImage() etc.) reallocate that buffer with different size without updating the local prev_readsize value. + +Closes #527 + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/ec8ef90c1f573c9eb1f17d6a056aa0015f184acf] +CVE: CVE-2023-26965 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + tools/tiffcrop.c | 47 +++++++++++++++-------------------------------- + 1 file changed, 15 insertions(+), 32 deletions(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index b811fbb..ce77c74 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -6066,9 +6066,7 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c + uint32_t tw = 0, tl = 0; /* Tile width and length */ + tmsize_t tile_rowsize = 0; + unsigned char *read_buff = NULL; +- unsigned char *new_buff = NULL; + int readunit = 0; +- static tmsize_t prev_readsize = 0; + + TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps); + TIFFGetFieldDefaulted(in, TIFFTAG_SAMPLESPERPIXEL, &spp); +@@ -6361,47 +6359,32 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c + } + + read_buff = *read_ptr; +- /* +3 : add a few guard bytes since reverseSamples16bits() can read a bit */ +- /* outside buffer */ +- if (!read_buff) +- { +- if( buffsize > 0xFFFFFFFFU - 3 ) ++ /* +3 : add a few guard bytes since reverseSamples16bits() can read a bit ++ * outside buffer */ ++ /* Reuse of read_buff from previous image is quite unsafe, because other ++ * functions (like rotateImage() etc.) reallocate that buffer with different ++ * size without updating the local prev_readsize value. */ ++ if (read_buff) + { +- TIFFError("loadImage", "Unable to allocate/reallocate read buffer"); +- return (-1); ++ _TIFFfree(read_buff); + } +- read_buff = (unsigned char *)limitMalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES); +- } +- else ++ if (buffsize > 0xFFFFFFFFU - 3) + { +- if (prev_readsize < buffsize) +- { +- if( buffsize > 0xFFFFFFFFU - 3 ) +- { +- TIFFError("loadImage", "Unable to allocate/reallocate read buffer"); +- return (-1); +- } +- new_buff = _TIFFrealloc(read_buff, buffsize + NUM_BUFF_OVERSIZE_BYTES); +- if (!new_buff) +- { +- free (read_buff); +- read_buff = (unsigned char *)limitMalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES); +- } +- else +- read_buff = new_buff; +- } ++ TIFFError("loadImage", "Required read buffer size too large"); ++ return (-1); + } +- if (!read_buff) ++ read_buff = ++ (unsigned char *)limitMalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES); ++ if (!read_buff) + { +- TIFFError("loadImage", "Unable to allocate/reallocate read buffer"); +- return (-1); ++ TIFFError("loadImage", "Unable to allocate read buffer"); ++ return (-1); + } + + read_buff[buffsize] = 0; + read_buff[buffsize+1] = 0; + read_buff[buffsize+2] = 0; + +- prev_readsize = buffsize; + *read_ptr = read_buff; + + /* N.B. The read functions used copy separate plane data into a buffer as interleaved +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-26966.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-26966.patch new file mode 100644 index 0000000000..85764304f9 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-26966.patch @@ -0,0 +1,35 @@ +From b0e1c25dd1d065200c8d8f59ad0afe014861a1b9 Mon Sep 17 00:00:00 2001 +From: Su_Laus <sulau@freenet.de> +Date: Thu, 16 Feb 2023 12:03:16 +0100 +Subject: [PATCH] tif_luv: Check and correct for NaN data in uv_encode(). + +Closes #530 + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/b0e1c25dd1d065200c8d8f59ad0afe014861a1b9] +CVE: CVE-2023-26966 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + libtiff/tif_luv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c +index 13765ea..40b2719 100644 +--- a/libtiff/tif_luv.c ++++ b/libtiff/tif_luv.c +@@ -908,6 +908,13 @@ uv_encode(double u, double v, int em) /* encode (u',v') coordinates */ + { + register int vi, ui; + ++ /* check for NaN */ ++ if (u != u || v != v) ++ { ++ u = U_NEU; ++ v = V_NEU; ++ } ++ + if (v < UV_VSTART) + return oog_encode(u, v); + vi = tiff_itrunc((v - UV_VSTART)*(1./UV_SQSIZ), em); +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-2908.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-2908.patch new file mode 100644 index 0000000000..cf94fd23d8 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-2908.patch @@ -0,0 +1,33 @@ +From 8c0859a80444c90b8dfb862a9f16de74e16f0a9e Mon Sep 17 00:00:00 2001 +From: xiaoxiaoafeifei <lliangliang2007@163.com> +Date: Fri, 21 Apr 2023 13:01:34 +0000 +Subject: [PATCH] countInkNamesString(): fix `UndefinedBehaviorSanitizer`: + applying zero offset to null pointer + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f] +CVE: CVE-2023-2908 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + libtiff/tif_dir.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c +index 349dfe4..1402c8e 100644 +--- a/libtiff/tif_dir.c ++++ b/libtiff/tif_dir.c +@@ -145,10 +145,10 @@ static uint16_t + countInkNamesString(TIFF *tif, uint32_t slen, const char *s) + { + uint16_t i = 0; +- const char *ep = s + slen; +- const char *cp = s; + + if (slen > 0) { ++ const char *ep = s + slen; ++ const char *cp = s; + do { + for (; cp < ep && *cp != '\0'; cp++) {} + if (cp >= ep) +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3316.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3316.patch new file mode 100644 index 0000000000..1aa4ba45ac --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3316.patch @@ -0,0 +1,59 @@ +From d63de61b1ec3385f6383ef9a1f453e4b8b11d536 Mon Sep 17 00:00:00 2001 +From: Su_Laus <sulau@freenet.de> +Date: Fri, 3 Feb 2023 17:38:55 +0100 +Subject: [PATCH] TIFFClose() avoid NULL pointer dereferencing. fix#515 + +Closes #515 + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/d63de61b1ec3385f6383ef9a1f453e4b8b11d536] +CVE: CVE-2023-3316 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + libtiff/tif_close.c | 11 +++++++---- + tools/tiffcrop.c | 5 ++++- + 2 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/libtiff/tif_close.c b/libtiff/tif_close.c +index 674518a..0fe7af4 100644 +--- a/libtiff/tif_close.c ++++ b/libtiff/tif_close.c +@@ -118,13 +118,16 @@ TIFFCleanup(TIFF* tif) + */ + + void +-TIFFClose(TIFF* tif) ++TIFFClose(TIFF *tif) + { +- TIFFCloseProc closeproc = tif->tif_closeproc; +- thandle_t fd = tif->tif_clientdata; ++ if (tif != NULL) ++ { ++ TIFFCloseProc closeproc = tif->tif_closeproc; ++ thandle_t fd = tif->tif_clientdata; + + TIFFCleanup(tif); +- (void) (*closeproc)(fd); ++ (void)(*closeproc)(fd); ++ } + } + + /* vim: set ts=8 sts=8 sw=8 noet: */ +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index ce77c74..cd49660 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -2548,7 +2548,10 @@ main(int argc, char* argv[]) + } + } + +- TIFFClose(out); ++ if (out != NULL) ++ { ++ TIFFClose(out); ++ } + + return (0); + } /* end main */ +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3576.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3576.patch new file mode 100644 index 0000000000..b17dd72170 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3576.patch @@ -0,0 +1,35 @@ +From 881a070194783561fd209b7c789a4e75566f7f37 Mon Sep 17 00:00:00 2001 +From: zhailiangliang <zhailiangliang@loongson.cn> +Date: Tue, 7 Mar 2023 15:02:08 +0800 +Subject: [PATCH] Fix memory leak in tiffcrop.c + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37] +CVE: CVE-2023-3576 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + tools/tiffcrop.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index cd49660..0d02f56 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -7839,8 +7839,13 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop, + + read_buff = *read_buff_ptr; + ++ /* Memory is freed before crop_buff_ptr is overwritten */ ++ if (*crop_buff_ptr != NULL) ++ { ++ _TIFFfree(*crop_buff_ptr); ++ } ++ + /* process full image, no crop buffer needed */ +- crop_buff = read_buff; + *crop_buff_ptr = read_buff; + crop->combined_width = image->width; + crop->combined_length = image->length; +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3618.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3618.patch new file mode 100644 index 0000000000..4179145722 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-3618.patch @@ -0,0 +1,47 @@ +From b5c7d4c4e03333ac16b5cfb11acaaeaa493334f8 Mon Sep 17 00:00:00 2001 +From: Su_Laus <sulau@freenet.de> +Date: Fri, 5 May 2023 19:43:46 +0200 +Subject: [PATCH] Consider error return of writeSelections(). Fixes #553 + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/b5c7d4c4e03333ac16b5cfb11acaaeaa493334f8] +CVE: CVE-2023-3618 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + tools/tiffcrop.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index 0d02f56..8cbeb68 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -2459,9 +2459,15 @@ main(int argc, char* argv[]) + { /* Whole image or sections not based on output page size */ + if (crop.selections > 0) + { +- writeSelections(in, &out, &crop, &image, &dump, seg_buffs, +- mp, argv[argc - 1], &next_page, total_pages); +- } ++ if (writeSelections(in, &out, &crop, &image, &dump, ++ seg_buffs, mp, argv[argc - 1], ++ &next_page, total_pages)) ++ { ++ TIFFError("main", ++ "Unable to write new image selections"); ++ exit(EXIT_FAILURE); ++ } ++ } + else /* One file all images and sections */ + { + if (update_output_file (&out, mp, crop.exp_mode, argv[argc - 1], +@@ -7842,7 +7848,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop, + /* Memory is freed before crop_buff_ptr is overwritten */ + if (*crop_buff_ptr != NULL) + { +- _TIFFfree(*crop_buff_ptr); ++ _TIFFfree(*crop_buff_ptr); + } + + /* process full image, no crop buffer needed */ +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-40745.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-40745.patch new file mode 100644 index 0000000000..cb4656fd46 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-40745.patch @@ -0,0 +1,34 @@ +From 4fc16f649fa2875d5c388cf2edc295510a247ee5 Mon Sep 17 00:00:00 2001 +From: Arie Haenel <arie.haenel@jct.ac.il> +Date: Wed, 19 Jul 2023 19:34:25 +0000 +Subject: [PATCH] tiffcp: fix memory corruption (overflow) on hostile images + (fixes #591) + +Upstream-Status: Backport from [https://gitlab.com/libtiff/libtiff/-/commit/4fc16f649fa2875d5c388cf2edc295510a247ee5] +CVE: CVE-2023-40745 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + tools/tiffcp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index 57eef90..34b6ef2 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -1577,6 +1577,13 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)"); + return 0; + } ++ ++ if ( (imagew - tilew * spp) > INT_MAX ){ ++ TIFFError(TIFFFileName(in), ++ "Error, image raster scan line size is too large"); ++ return 0; ++ } ++ + iskew = imagew - tilew*spp; + tilebuf = limitMalloc(tilesize); + if (tilebuf == 0) +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-41175.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-41175.patch new file mode 100644 index 0000000000..06645bed68 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-41175.patch @@ -0,0 +1,69 @@ +From 6e2dac5f904496d127c92ddc4e56eccfca25c2ee Mon Sep 17 00:00:00 2001 +From: Arie Haenel <arie.haenel@jct.ac.il> +Date: Wed, 19 Jul 2023 19:40:01 +0000 +Subject: [PATCH] raw2tiff: fix integer overflow and bypass of the check (fixes #592) + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/6e2dac5f904496d127c92ddc4e56eccfca25c2ee] +CVE: CVE-2023-41175 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + tools/raw2tiff.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/tools/raw2tiff.c b/tools/raw2tiff.c +index dfee715..253c023 100644 +--- a/tools/raw2tiff.c ++++ b/tools/raw2tiff.c +@@ -36,6 +36,7 @@ + #include <sys/types.h> + #include <math.h> + #include <ctype.h> ++#include <limits.h> + + #ifdef HAVE_UNISTD_H + # include <unistd.h> +@@ -101,6 +102,7 @@ main(int argc, char* argv[]) + int fd; + char *outfilename = NULL; + TIFF *out; ++ uint32_t temp_limit_check = 0; /* temp for integer overflow checking*/ + + uint32_t row, col, band; + int c; +@@ -212,6 +214,33 @@ main(int argc, char* argv[]) + if (guessSize(fd, dtype, hdr_size, nbands, swab, &width, &length) < 0) + return EXIT_FAILURE; + ++ /* check for integer overflow in */ ++ /* hdr_size + (*width) * (*length) * nbands * depth */ ++ ++ if ((width == 0) || (length == 0) ){ ++ fprintf(stderr, "Too large nbands value specified.\n"); ++ return (EXIT_FAILURE); ++ } ++ ++ temp_limit_check = nbands * depth; ++ ++ if ( !temp_limit_check || length > ( UINT_MAX / temp_limit_check ) ) { ++ fprintf(stderr, "Too large length size specified.\n"); ++ return (EXIT_FAILURE); ++ } ++ temp_limit_check = temp_limit_check * length; ++ ++ if ( !temp_limit_check || width > ( UINT_MAX / temp_limit_check ) ) { ++ fprintf(stderr, "Too large width size specified.\n"); ++ return (EXIT_FAILURE); ++ } ++ temp_limit_check = temp_limit_check * width; ++ ++ if ( !temp_limit_check || hdr_size > ( UINT_MAX - temp_limit_check ) ) { ++ fprintf(stderr, "Too large header size specified.\n"); ++ return (EXIT_FAILURE); ++ } ++ + if (outfilename == NULL) + outfilename = argv[optind+1]; + out = TIFFOpen(outfilename, "w"); +-- +2.25.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-52356.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-52356.patch new file mode 100644 index 0000000000..4eb7d79c8f --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-52356.patch @@ -0,0 +1,54 @@ +CVE: CVE-2023-52356 +Upstream-Status: Backport [upstream : https://gitlab.com/libtiff/libtiff/-/commit/51558511bdbbcffdce534db21dbaf5d54b31638a +ubuntu : http://archive.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_4.3.0-6ubuntu0.8.debian.tar.xz ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +[Ubuntu note: Backport of the following patch from upstream, with a few changes +to match the current version of the file in the present Ubuntu release: + . using TIFFErrorExt instead of TIFFErrorExtR (the latter did not exist yet); +-- Rodrigo Figueiredo Zaiden] + +Backport of: + +From 51558511bdbbcffdce534db21dbaf5d54b31638a Mon Sep 17 00:00:00 2001 +From: Even Rouault <even.rouault@spatialys.com> +Date: Tue, 31 Oct 2023 15:58:41 +0100 +Subject: [PATCH] TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of + col/row (fixes #622) + +--- + libtiff/tif_getimage.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + + +--- tiff-4.3.0.orig/libtiff/tif_getimage.c ++++ tiff-4.3.0/libtiff/tif_getimage.c +@@ -2942,6 +2942,13 @@ TIFFReadRGBAStripExt(TIFF* tif, uint32_t + } + + if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif, stop_on_error, emsg)) { ++ if (row >= img.height) ++ { ++ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), ++ "Invalid row passed to TIFFReadRGBAStrip()."); ++ TIFFRGBAImageEnd(&img); ++ return (0); ++ } + + img.row_offset = row; + img.col_offset = 0; +@@ -3018,6 +3025,14 @@ TIFFReadRGBATileExt(TIFF* tif, uint32_t + return( 0 ); + } + ++ if (col >= img.width || row >= img.height) ++ { ++ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), ++ "Invalid row/col passed to TIFFReadRGBATile()."); ++ TIFFRGBAImageEnd(&img); ++ return (0); ++ } ++ + /* + * The TIFFRGBAImageGet() function doesn't allow us to get off the + * edge of the image, even to fill an otherwise valid tile. So we diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6228.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6228.patch new file mode 100644 index 0000000000..f15cc96e19 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6228.patch @@ -0,0 +1,31 @@ +From 1e7d217a323eac701b134afc4ae39b6bdfdbc96a Mon Sep 17 00:00:00 2001 +From: Su_Laus <sulau@freenet.de> +Date: Wed, 17 Jan 2024 06:38:24 +0000 +Subject: [PATCH] codec of input image is available, independently from codec + check of output image and return with error if not. + +Fixes #606. + +CVE: CVE-2023-6228 +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/1e7d217a323eac701b134afc4ae39b6bdfdbc96a] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + tools/tiffcp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index 34b6ef2..17c6524 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -724,6 +724,8 @@ tiffcp(TIFF* in, TIFF* out) + else + CopyField(TIFFTAG_COMPRESSION, compression); + TIFFGetFieldDefaulted(in, TIFFTAG_COMPRESSION, &input_compression); ++ if (!TIFFIsCODECConfigured(input_compression)) ++ return FALSE; + TIFFGetFieldDefaulted(in, TIFFTAG_PHOTOMETRIC, &input_photometric); + if (input_compression == COMPRESSION_JPEG) { + /* Force conversion to RGB */ +-- +2.40.0 diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-1.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-1.patch new file mode 100644 index 0000000000..453df897ac --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-1.patch @@ -0,0 +1,178 @@ +CVE: CVE-2023-6277 +Upstream-Status: Backport [upstream : https://gitlab.com/libtiff/libtiff/-/commit/5320c9d89c054fa805d037d84c57da874470b01a +ubuntu : http://archive.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_4.3.0-6ubuntu0.8.debian.tar.xz ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +[Ubuntu note: Backport of the following patch from upstream, with a few changes +to match the current version of the file in the present Ubuntu release: + . using TIFFWarningExt instead of TIFFWarningExtR (the latter did not exist yet); + . calling _TIFFfree(data) instead of _TIFFfreeExt(tif, data) (the latter did not exist yet); +-- Rodrigo Figueiredo Zaiden] + +Backport of: + +From 5320c9d89c054fa805d037d84c57da874470b01a Mon Sep 17 00:00:00 2001 +From: Su Laus <sulau@freenet.de> +Date: Tue, 31 Oct 2023 15:43:29 +0000 +Subject: [PATCH] Prevent some out-of-memory attacks + +Some small fuzzer files fake large amounts of data and provoke out-of-memory situations. For non-compressed data content / tags, out-of-memory can be prevented by comparing with the file size. + +At image reading, data size of some tags / data structures (StripByteCounts, StripOffsets, StripArray, TIFF directory) is compared with file size to prevent provoked out-of-memory attacks. + +See issue https://gitlab.com/libtiff/libtiff/-/issues/614#note_1602683857 +--- + libtiff/tif_dirread.c | 92 ++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 90 insertions(+), 2 deletions(-) + +--- tiff-4.3.0.orig/libtiff/tif_dirread.c ++++ tiff-4.3.0/libtiff/tif_dirread.c +@@ -866,6 +866,21 @@ static enum TIFFReadDirEntryErr TIFFRead + datasize=(*count)*typesize; + assert((tmsize_t)datasize>0); + ++ /* Before allocating a huge amount of memory for corrupted files, check if ++ * size of requested memory is not greater than file size. ++ */ ++ uint64_t filesize = TIFFGetFileSize(tif); ++ if (datasize > filesize) ++ { ++ TIFFWarningExt(tif->tif_clientdata, "ReadDirEntryArray", ++ "Requested memory size for tag %d (0x%x) %" PRIu32 ++ " is greather than filesize %" PRIu64 ++ ". Memory not allocated, tag not read", ++ direntry->tdir_tag, direntry->tdir_tag, datasize, ++ filesize); ++ return (TIFFReadDirEntryErrAlloc); ++ } ++ + if( isMapped(tif) && datasize > (uint64_t)tif->tif_size ) + return TIFFReadDirEntryErrIo; + +@@ -4593,6 +4608,20 @@ EstimateStripByteCounts(TIFF* tif, TIFFD + if( !_TIFFFillStrilesInternal( tif, 0 ) ) + return -1; + ++ /* Before allocating a huge amount of memory for corrupted files, check if ++ * size of requested memory is not greater than file size. */ ++ uint64_t filesize = TIFFGetFileSize(tif); ++ uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t); ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt(tif->tif_clientdata, module, ++ "Requested memory size for StripByteCounts of %" PRIu64 ++ " is greather than filesize %" PRIu64 ++ ". Memory not allocated", ++ allocsize, filesize); ++ return -1; ++ } ++ + if (td->td_stripbytecount_p) + _TIFFfree(td->td_stripbytecount_p); + td->td_stripbytecount_p = (uint64_t*) +@@ -4603,9 +4632,7 @@ EstimateStripByteCounts(TIFF* tif, TIFFD + + if (td->td_compression != COMPRESSION_NONE) { + uint64_t space; +- uint64_t filesize; + uint16_t n; +- filesize = TIFFGetFileSize(tif); + if (!(tif->tif_flags&TIFF_BIGTIFF)) + space=sizeof(TIFFHeaderClassic)+2+dircount*12+4; + else +@@ -4913,6 +4940,20 @@ TIFFFetchDirectory(TIFF* tif, uint64_t d + dircount16 = (uint16_t)dircount64; + dirsize = 20; + } ++ /* Before allocating a huge amount of memory for corrupted files, check ++ * if size of requested memory is not greater than file size. */ ++ uint64_t filesize = TIFFGetFileSize(tif); ++ uint64_t allocsize = (uint64_t)dircount16 * dirsize; ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt( ++ tif->tif_clientdata, module, ++ "Requested memory size for TIFF directory of %" PRIu64 ++ " is greather than filesize %" PRIu64 ++ ". Memory not allocated, TIFF directory not read", ++ allocsize, filesize); ++ return 0; ++ } + origdir = _TIFFCheckMalloc(tif, dircount16, + dirsize, "to read TIFF directory"); + if (origdir == NULL) +@@ -5016,6 +5057,20 @@ TIFFFetchDirectory(TIFF* tif, uint64_t d + "Sanity check on directory count failed, zero tag directories not supported"); + return 0; + } ++ /* Before allocating a huge amount of memory for corrupted files, check ++ * if size of requested memory is not greater than file size. */ ++ uint64_t filesize = TIFFGetFileSize(tif); ++ uint64_t allocsize = (uint64_t)dircount16 * dirsize; ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt( ++ tif->tif_clientdata, module, ++ "Requested memory size for TIFF directory of %" PRIu64 ++ " is greather than filesize %" PRIu64 ++ ". Memory not allocated, TIFF directory not read", ++ allocsize, filesize); ++ return 0; ++ } + origdir = _TIFFCheckMalloc(tif, dircount16, + dirsize, + "to read TIFF directory"); +@@ -5059,6 +5114,8 @@ TIFFFetchDirectory(TIFF* tif, uint64_t d + } + } + } ++ /* No check against filesize needed here because "dir" should have same size ++ * than "origdir" checked above. */ + dir = (TIFFDirEntry*)_TIFFCheckMalloc(tif, dircount16, + sizeof(TIFFDirEntry), + "to read TIFF directory"); +@@ -5853,6 +5910,20 @@ TIFFFetchStripThing(TIFF* tif, TIFFDirEn + return(0); + } + ++ /* Before allocating a huge amount of memory for corrupted files, check ++ * if size of requested memory is not greater than file size. */ ++ uint64_t filesize = TIFFGetFileSize(tif); ++ uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t); ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt(tif->tif_clientdata, module, ++ "Requested memory size for StripArray of %" PRIu64 ++ " is greather than filesize %" PRIu64 ++ ". Memory not allocated", ++ allocsize, filesize); ++ _TIFFfree(data); ++ return (0); ++ } + resizeddata=(uint64_t*)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t), "for strip array"); + if (resizeddata==0) { + _TIFFfree(data); +@@ -5948,6 +6019,23 @@ static void allocChoppedUpStripArrays(TI + } + bytecount = last_offset + last_bytecount - offset; + ++ /* Before allocating a huge amount of memory for corrupted files, check if ++ * size of StripByteCount and StripOffset tags is not greater than ++ * file size. ++ */ ++ uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2; ++ uint64_t filesize = TIFFGetFileSize(tif); ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt(tif->tif_clientdata, "allocChoppedUpStripArrays", ++ "Requested memory size for StripByteCount and " ++ "StripOffsets %" PRIu64 ++ " is greather than filesize %" PRIu64 ++ ". Memory not allocated", ++ allocsize, filesize); ++ return; ++ } ++ + newcounts = (uint64_t*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64_t), + "for chopped \"StripByteCounts\" array"); + newoffsets = (uint64_t*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64_t), diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-2.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-2.patch new file mode 100644 index 0000000000..ad39c1c4dd --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-2.patch @@ -0,0 +1,151 @@ +CVE: CVE-2023-6277 +Upstream-Status: Backport [upstream : https://gitlab.com/libtiff/libtiff/-/commit/0b025324711213a75e38b52f7e7ba60235f108aa +ubuntu : http://archive.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_4.3.0-6ubuntu0.8.debian.tar.xz ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +[Ubuntu note: Backport of the following patch from upstream, with a few changes +to match the current version of the file in the present Ubuntu release: + . using TIFFWarningExt instead of TIFFWarningExtR (the latter did not exist yet); +-- Rodrigo Figueiredo Zaiden] + +Backport of: + +From 0b025324711213a75e38b52f7e7ba60235f108aa Mon Sep 17 00:00:00 2001 +From: Even Rouault <even.rouault@spatialys.com> +Date: Tue, 31 Oct 2023 19:47:22 +0100 +Subject: [PATCH] tif_dirread.c: only issue TIFFGetFileSize() for large enough + RAM requests + +Ammends 5320c9d89c054fa805d037d84c57da874470b01a + +This fixes a performance regression caught by the GDAL regression test +suite. +--- + libtiff/tif_dirread.c | 83 +++++++++++++++++++++++++------------------ + 1 file changed, 48 insertions(+), 35 deletions(-) + +--- tiff-4.3.0.orig/libtiff/tif_dirread.c ++++ tiff-4.3.0/libtiff/tif_dirread.c +@@ -866,19 +866,22 @@ static enum TIFFReadDirEntryErr TIFFRead + datasize=(*count)*typesize; + assert((tmsize_t)datasize>0); + +- /* Before allocating a huge amount of memory for corrupted files, check if +- * size of requested memory is not greater than file size. +- */ +- uint64_t filesize = TIFFGetFileSize(tif); +- if (datasize > filesize) ++ if (datasize > 100 * 1024 * 1024) + { +- TIFFWarningExt(tif->tif_clientdata, "ReadDirEntryArray", +- "Requested memory size for tag %d (0x%x) %" PRIu32 +- " is greather than filesize %" PRIu64 +- ". Memory not allocated, tag not read", +- direntry->tdir_tag, direntry->tdir_tag, datasize, +- filesize); +- return (TIFFReadDirEntryErrAlloc); ++ /* Before allocating a huge amount of memory for corrupted files, check ++ * if size of requested memory is not greater than file size. ++ */ ++ const uint64_t filesize = TIFFGetFileSize(tif); ++ if (datasize > filesize) ++ { ++ TIFFWarningExt(tif->tif_clientdata, "ReadDirEntryArray", ++ "Requested memory size for tag %d (0x%x) %" PRIu32 ++ " is greater than filesize %" PRIu64 ++ ". Memory not allocated, tag not read", ++ direntry->tdir_tag, direntry->tdir_tag, datasize, ++ filesize); ++ return (TIFFReadDirEntryErrAlloc); ++ } + } + + if( isMapped(tif) && datasize > (uint64_t)tif->tif_size ) +@@ -4608,18 +4611,22 @@ EstimateStripByteCounts(TIFF* tif, TIFFD + if( !_TIFFFillStrilesInternal( tif, 0 ) ) + return -1; + +- /* Before allocating a huge amount of memory for corrupted files, check if +- * size of requested memory is not greater than file size. */ +- uint64_t filesize = TIFFGetFileSize(tif); +- uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t); +- if (allocsize > filesize) ++ const uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t); ++ uint64_t filesize = 0; ++ if (allocsize > 100 * 1024 * 1024) + { +- TIFFWarningExt(tif->tif_clientdata, module, +- "Requested memory size for StripByteCounts of %" PRIu64 +- " is greather than filesize %" PRIu64 +- ". Memory not allocated", +- allocsize, filesize); +- return -1; ++ /* Before allocating a huge amount of memory for corrupted files, check ++ * if size of requested memory is not greater than file size. */ ++ filesize = TIFFGetFileSize(tif); ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt( ++ tif->tif_clientdata, module, ++ "Requested memory size for StripByteCounts of %" PRIu64 ++ " is greater than filesize %" PRIu64 ". Memory not allocated", ++ allocsize, filesize); ++ return -1; ++ } + } + + if (td->td_stripbytecount_p) +@@ -4666,11 +4673,13 @@ EstimateStripByteCounts(TIFF* tif, TIFFD + return -1; + space+=datasize; + } ++ if (filesize == 0) ++ filesize = TIFFGetFileSize(tif); + if( filesize < space ) +- /* we should perhaps return in error ? */ +- space = filesize; +- else +- space = filesize - space; ++ /* we should perhaps return in error ? */ ++ space = filesize; ++ else ++ space = filesize - space; + if (td->td_planarconfig == PLANARCONFIG_SEPARATE) + space /= td->td_samplesperpixel; + for (strip = 0; strip < td->td_nstrips; strip++) +@@ -4940,19 +4949,23 @@ TIFFFetchDirectory(TIFF* tif, uint64_t d + dircount16 = (uint16_t)dircount64; + dirsize = 20; + } +- /* Before allocating a huge amount of memory for corrupted files, check +- * if size of requested memory is not greater than file size. */ +- uint64_t filesize = TIFFGetFileSize(tif); +- uint64_t allocsize = (uint64_t)dircount16 * dirsize; +- if (allocsize > filesize) ++ const uint64_t allocsize = (uint64_t)dircount16 * dirsize; ++ if (allocsize > 100 * 1024 * 1024) + { +- TIFFWarningExt( +- tif->tif_clientdata, module, +- "Requested memory size for TIFF directory of %" PRIu64 +- " is greather than filesize %" PRIu64 +- ". Memory not allocated, TIFF directory not read", +- allocsize, filesize); +- return 0; ++ /* Before allocating a huge amount of memory for corrupted files, ++ * check if size of requested memory is not greater than file size. ++ */ ++ const uint64_t filesize = TIFFGetFileSize(tif); ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt( ++ tif->tif_clientdata, module, ++ "Requested memory size for TIFF directory of %" PRIu64 ++ " is greater than filesize %" PRIu64 ++ ". Memory not allocated, TIFF directory not read", ++ allocsize, filesize); ++ return 0; ++ } + } + origdir = _TIFFCheckMalloc(tif, dircount16, + dirsize, "to read TIFF directory"); diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-3.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-3.patch new file mode 100644 index 0000000000..71eba2f34e --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-3.patch @@ -0,0 +1,46 @@ +CVE: CVE-2023-6277 +Upstream-Status: Backport [upstream : https://gitlab.com/libtiff/libtiff/-/commit/de7bfd7d4377c266f81849579f696fa1ad5ba6c3 +ubuntu : http://archive.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_4.3.0-6ubuntu0.8.debian.tar.xz ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +Backport of: + +From de7bfd7d4377c266f81849579f696fa1ad5ba6c3 Mon Sep 17 00:00:00 2001 +From: Even Rouault <even.rouault@spatialys.com> +Date: Tue, 31 Oct 2023 20:13:45 +0100 +Subject: [PATCH] TIFFFetchDirectory(): remove useless allocsize vs filesize + check + +CoverityScan rightly points that the max value for dircount16 * dirsize +is 4096 * 20. That's small enough not to do any check +--- + libtiff/tif_dirread.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +--- tiff-4.3.0.orig/libtiff/tif_dirread.c ++++ tiff-4.3.0/libtiff/tif_dirread.c +@@ -4949,24 +4949,6 @@ TIFFFetchDirectory(TIFF* tif, uint64_t d + dircount16 = (uint16_t)dircount64; + dirsize = 20; + } +- const uint64_t allocsize = (uint64_t)dircount16 * dirsize; +- if (allocsize > 100 * 1024 * 1024) +- { +- /* Before allocating a huge amount of memory for corrupted files, +- * check if size of requested memory is not greater than file size. +- */ +- const uint64_t filesize = TIFFGetFileSize(tif); +- if (allocsize > filesize) +- { +- TIFFWarningExt( +- tif->tif_clientdata, module, +- "Requested memory size for TIFF directory of %" PRIu64 +- " is greater than filesize %" PRIu64 +- ". Memory not allocated, TIFF directory not read", +- allocsize, filesize); +- return 0; +- } +- } + origdir = _TIFFCheckMalloc(tif, dircount16, + dirsize, "to read TIFF directory"); + if (origdir == NULL) diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-4.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-4.patch new file mode 100644 index 0000000000..61f48726e4 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2023-6277-4.patch @@ -0,0 +1,93 @@ +CVE: CVE-2023-6277 +Upstream-Status: Backport [upstream : https://gitlab.com/libtiff/libtiff/-/commit/dbb825a8312f30e63a06c272010967d51af5c35a +ubuntu : http://archive.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_4.3.0-6ubuntu0.8.debian.tar.xz ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +[Ubuntu note: Backport of the following patch from upstream, with a few changes +to match the current version of the file in the present Ubuntu release: + . using TIFFWarningExt instead of TIFFWarningExtR (the latter did not exist yet); + . calling _TIFFfree(data) instead of _TIFFfreeExt(tif, data) (the latter did not exist yet); +-- Rodrigo Figueiredo Zaiden] + +Backport of: + +From dbb825a8312f30e63a06c272010967d51af5c35a Mon Sep 17 00:00:00 2001 +From: Even Rouault <even.rouault@spatialys.com> +Date: Tue, 31 Oct 2023 21:30:58 +0100 +Subject: [PATCH] tif_dirread.c: only issue TIFFGetFileSize() for large enough + RAM requests + +--- + libtiff/tif_dirread.c | 54 +++++++++++++++++++++++++------------------ + 1 file changed, 31 insertions(+), 23 deletions(-) + +--- tiff-4.3.0.orig/libtiff/tif_dirread.c ++++ tiff-4.3.0/libtiff/tif_dirread.c +@@ -5905,19 +5905,24 @@ TIFFFetchStripThing(TIFF* tif, TIFFDirEn + return(0); + } + +- /* Before allocating a huge amount of memory for corrupted files, check +- * if size of requested memory is not greater than file size. */ +- uint64_t filesize = TIFFGetFileSize(tif); +- uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t); +- if (allocsize > filesize) ++ const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t); ++ if (allocsize > 100 * 1024 * 1024) + { +- TIFFWarningExt(tif->tif_clientdata, module, +- "Requested memory size for StripArray of %" PRIu64 +- " is greather than filesize %" PRIu64 +- ". Memory not allocated", +- allocsize, filesize); +- _TIFFfree(data); +- return (0); ++ /* Before allocating a huge amount of memory for corrupted files, ++ * check if size of requested memory is not greater than file size. ++ */ ++ const uint64_t filesize = TIFFGetFileSize(tif); ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt( ++ tif->tif_clientdata, module, ++ "Requested memory size for StripArray of %" PRIu64 ++ " is greater than filesize %" PRIu64 ++ ". Memory not allocated", ++ allocsize, filesize); ++ _TIFFfree(data); ++ return (0); ++ } + } + resizeddata=(uint64_t*)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t), "for strip array"); + if (resizeddata==0) { +@@ -6018,17 +6023,20 @@ static void allocChoppedUpStripArrays(TI + * size of StripByteCount and StripOffset tags is not greater than + * file size. + */ +- uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2; +- uint64_t filesize = TIFFGetFileSize(tif); +- if (allocsize > filesize) ++ const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2; ++ if (allocsize > 100 * 1024 * 1024) + { +- TIFFWarningExt(tif->tif_clientdata, "allocChoppedUpStripArrays", +- "Requested memory size for StripByteCount and " +- "StripOffsets %" PRIu64 +- " is greather than filesize %" PRIu64 +- ". Memory not allocated", +- allocsize, filesize); +- return; ++ const uint64_t filesize = TIFFGetFileSize(tif); ++ if (allocsize > filesize) ++ { ++ TIFFWarningExt(tif->tif_clientdata, "allocChoppedUpStripArrays", ++ "Requested memory size for StripByteCount and " ++ "StripOffsets %" PRIu64 ++ " is greater than filesize %" PRIu64 ++ ". Memory not allocated", ++ allocsize, filesize); ++ return; ++ } + } + + newcounts = (uint64_t*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64_t), diff --git a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb index ef4fa97585..b4af179e76 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb @@ -32,6 +32,27 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://0001-tiffcrop-S-option-Make-decision-simpler.patch \ file://0001-tiffcrop-disable-incompatibility-of-Z-X-Y-z-options-.patch \ file://0001-tiffcrop-subroutines-require-a-larger-buffer-fixes-2.patch \ + file://CVE-2022-48281.patch \ + file://CVE-2023-0800_0801_0802_0803_0804.patch \ + file://CVE-2023-0795_0796_0797_0798_0799.patch \ + file://CVE-2023-25433.patch \ + file://CVE-2023-25434-CVE-2023-25435.patch \ + file://CVE-2023-26965.patch \ + file://CVE-2023-2908.patch \ + file://CVE-2023-3316.patch \ + file://CVE-2023-3576.patch \ + file://CVE-2023-3618.patch \ + file://CVE-2023-26966.patch \ + file://CVE-2022-40090.patch \ + file://CVE-2023-1916.patch \ + file://CVE-2023-40745.patch \ + file://CVE-2023-41175.patch \ + file://CVE-2023-6228.patch \ + file://CVE-2023-52356.patch \ + file://CVE-2023-6277-1.patch \ + file://CVE-2023-6277-2.patch \ + file://CVE-2023-6277-3.patch \ + file://CVE-2023-6277-4.patch \ " SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8" diff --git a/meta/recipes-multimedia/webp/files/CVE-2023-1999.patch b/meta/recipes-multimedia/webp/files/CVE-2023-1999.patch new file mode 100644 index 0000000000..895d01ea7d --- /dev/null +++ b/meta/recipes-multimedia/webp/files/CVE-2023-1999.patch @@ -0,0 +1,60 @@ +From a486d800b60d0af4cc0836bf7ed8f21e12974129 Mon Sep 17 00:00:00 2001 +From: James Zern <jzern@google.com> +Date: Wed, 22 Feb 2023 22:15:47 -0800 +Subject: [PATCH] EncodeAlphaInternal: clear result->bw on error + +This avoids a double free should the function fail prior to +VP8BitWriterInit() and a previous trial result's buffer carried over. +Previously in ApplyFiltersAndEncode() trial.bw (with a previous +iteration's buffer) would be freed, followed by best.bw pointing to the +same buffer. + +Since: +187d379d add a fallback to ALPHA_NO_COMPRESSION + +In addition, check the return value of VP8BitWriterInit() in this +function. + +Bug: webp:603 +Change-Id: Ic258381ee26c8c16bc211d157c8153831c8c6910 + +CVE: CVE-2023-1999 + +Upstream-Status: Backport [https://github.com/webmproject/libwebp/commit/a486d800b60d0af4cc0836bf7ed8f21e12974129] + +Signed-off-by: Soumya <soumya.sambu@windriver.com> +--- + src/enc/alpha_enc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/enc/alpha_enc.c b/src/enc/alpha_enc.c +index f7c0269..7d20558 100644 +--- a/src/enc/alpha_enc.c ++++ b/src/enc/alpha_enc.c +@@ -13,6 +13,7 @@ + + #include <assert.h> + #include <stdlib.h> ++#include <string.h> + + #include "src/enc/vp8i_enc.h" + #include "src/dsp/dsp.h" +@@ -148,6 +149,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height, + } + } else { + VP8LBitWriterWipeOut(&tmp_bw); ++ memset(&result->bw, 0, sizeof(result->bw)); + return 0; + } + } +@@ -162,7 +164,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height, + header = method | (filter << 2); + if (reduce_levels) header |= ALPHA_PREPROCESSED_LEVELS << 4; + +- VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size); ++ if (!VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size)) ok = 0; + ok = ok && VP8BitWriterAppend(&result->bw, &header, ALPHA_HEADER_LEN); + ok = ok && VP8BitWriterAppend(&result->bw, output, output_size); + +-- +2.40.0 diff --git a/meta/recipes-multimedia/webp/files/CVE-2023-4863-0001.patch b/meta/recipes-multimedia/webp/files/CVE-2023-4863-0001.patch new file mode 100644 index 0000000000..e623569352 --- /dev/null +++ b/meta/recipes-multimedia/webp/files/CVE-2023-4863-0001.patch @@ -0,0 +1,366 @@ +From 902bc9190331343b2017211debcec8d2ab87e17a Mon Sep 17 00:00:00 2001 +From: Vincent Rabaud <vrabaud@google.com> +Date: Thu, 7 Sep 2023 21:16:03 +0200 +Subject: [PATCH 1/2] Fix OOB write in BuildHuffmanTable. + +First, BuildHuffmanTable is called to check if the data is valid. +If it is and the table is not big enough, more memory is allocated. + +This will make sure that valid (but unoptimized because of unbalanced +codes) streams are still decodable. + +Bug: chromium:1479274 +Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741 + +CVE: CVE-2023-4863 + +Upstream-Status: Backport [https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/dec/vp8l_dec.c | 46 ++++++++++--------- + src/dec/vp8li_dec.h | 2 +- + src/utils/huffman_utils.c | 97 +++++++++++++++++++++++++++++++-------- + src/utils/huffman_utils.h | 27 +++++++++-- + 4 files changed, 129 insertions(+), 43 deletions(-) + +diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c +index 1348055..186b0b2 100644 +--- a/src/dec/vp8l_dec.c ++++ b/src/dec/vp8l_dec.c +@@ -253,11 +253,11 @@ static int ReadHuffmanCodeLengths( + int symbol; + int max_symbol; + int prev_code_len = DEFAULT_CODE_LENGTH; +- HuffmanCode table[1 << LENGTHS_TABLE_BITS]; ++ HuffmanTables tables; + +- if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS, +- code_length_code_lengths, +- NUM_CODE_LENGTH_CODES)) { ++ if (!VP8LHuffmanTablesAllocate(1 << LENGTHS_TABLE_BITS, &tables) || ++ !VP8LBuildHuffmanTable(&tables, LENGTHS_TABLE_BITS, ++ code_length_code_lengths, NUM_CODE_LENGTH_CODES)) { + goto End; + } + +@@ -277,7 +277,7 @@ static int ReadHuffmanCodeLengths( + int code_len; + if (max_symbol-- == 0) break; + VP8LFillBitWindow(br); +- p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK]; ++ p = &tables.curr_segment->start[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK]; + VP8LSetBitPos(br, br->bit_pos_ + p->bits); + code_len = p->value; + if (code_len < kCodeLengthLiterals) { +@@ -300,6 +300,7 @@ static int ReadHuffmanCodeLengths( + ok = 1; + + End: ++ VP8LHuffmanTablesDeallocate(&tables); + if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR; + return ok; + } +@@ -307,7 +308,8 @@ static int ReadHuffmanCodeLengths( + // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman + // tree. + static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec, +- int* const code_lengths, HuffmanCode* const table) { ++ int* const code_lengths, ++ HuffmanTables* const table) { + int ok = 0; + int size = 0; + VP8LBitReader* const br = &dec->br_; +@@ -362,8 +364,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, + VP8LMetadata* const hdr = &dec->hdr_; + uint32_t* huffman_image = NULL; + HTreeGroup* htree_groups = NULL; +- HuffmanCode* huffman_tables = NULL; +- HuffmanCode* huffman_table = NULL; ++ HuffmanTables* huffman_tables = &hdr->huffman_tables_; + int num_htree_groups = 1; + int num_htree_groups_max = 1; + int max_alphabet_size = 0; +@@ -372,6 +373,10 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, + int* mapping = NULL; + int ok = 0; + ++ // Check the table has been 0 initialized (through InitMetadata). ++ assert(huffman_tables->root.start == NULL); ++ assert(huffman_tables->curr_segment == NULL); ++ + if (allow_recursion && VP8LReadBits(br, 1)) { + // use meta Huffman codes. + const int huffman_precision = VP8LReadBits(br, 3) + 2; +@@ -434,16 +439,15 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, + + code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size, + sizeof(*code_lengths)); +- huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size, +- sizeof(*huffman_tables)); + htree_groups = VP8LHtreeGroupsNew(num_htree_groups); + +- if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) { ++ if (htree_groups == NULL || code_lengths == NULL || ++ !VP8LHuffmanTablesAllocate(num_htree_groups * table_size, ++ huffman_tables)) { + dec->status_ = VP8_STATUS_OUT_OF_MEMORY; + goto Error; + } + +- huffman_table = huffman_tables; + for (i = 0; i < num_htree_groups_max; ++i) { + // If the index "i" is unused in the Huffman image, just make sure the + // coefficients are valid but do not store them. +@@ -468,19 +472,20 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, + int max_bits = 0; + for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) { + int alphabet_size = kAlphabetSize[j]; +- htrees[j] = huffman_table; + if (j == 0 && color_cache_bits > 0) { + alphabet_size += (1 << color_cache_bits); + } +- size = ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_table); ++ size = ++ ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables); ++ htrees[j] = huffman_tables->curr_segment->curr_table; + if (size == 0) { + goto Error; + } + if (is_trivial_literal && kLiteralMap[j] == 1) { +- is_trivial_literal = (huffman_table->bits == 0); ++ is_trivial_literal = (htrees[j]->bits == 0); + } +- total_size += huffman_table->bits; +- huffman_table += size; ++ total_size += htrees[j]->bits; ++ huffman_tables->curr_segment->curr_table += size; + if (j <= ALPHA) { + int local_max_bits = code_lengths[0]; + int k; +@@ -515,14 +520,13 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, + hdr->huffman_image_ = huffman_image; + hdr->num_htree_groups_ = num_htree_groups; + hdr->htree_groups_ = htree_groups; +- hdr->huffman_tables_ = huffman_tables; + + Error: + WebPSafeFree(code_lengths); + WebPSafeFree(mapping); + if (!ok) { + WebPSafeFree(huffman_image); +- WebPSafeFree(huffman_tables); ++ VP8LHuffmanTablesDeallocate(huffman_tables); + VP8LHtreeGroupsFree(htree_groups); + } + return ok; +@@ -1358,7 +1362,7 @@ static void ClearMetadata(VP8LMetadata* const hdr) { + assert(hdr != NULL); + + WebPSafeFree(hdr->huffman_image_); +- WebPSafeFree(hdr->huffman_tables_); ++ VP8LHuffmanTablesDeallocate(&hdr->huffman_tables_); + VP8LHtreeGroupsFree(hdr->htree_groups_); + VP8LColorCacheClear(&hdr->color_cache_); + VP8LColorCacheClear(&hdr->saved_color_cache_); +@@ -1673,7 +1677,7 @@ int VP8LDecodeImage(VP8LDecoder* const dec) { + + if (dec == NULL) return 0; + +- assert(dec->hdr_.huffman_tables_ != NULL); ++ assert(dec->hdr_.huffman_tables_.root.start != NULL); + assert(dec->hdr_.htree_groups_ != NULL); + assert(dec->hdr_.num_htree_groups_ > 0); + +diff --git a/src/dec/vp8li_dec.h b/src/dec/vp8li_dec.h +index 72b2e86..32540a4 100644 +--- a/src/dec/vp8li_dec.h ++++ b/src/dec/vp8li_dec.h +@@ -51,7 +51,7 @@ typedef struct { + uint32_t* huffman_image_; + int num_htree_groups_; + HTreeGroup* htree_groups_; +- HuffmanCode* huffman_tables_; ++ HuffmanTables huffman_tables_; + } VP8LMetadata; + + typedef struct VP8LDecoder VP8LDecoder; +diff --git a/src/utils/huffman_utils.c b/src/utils/huffman_utils.c +index 0cba0fb..9efd628 100644 +--- a/src/utils/huffman_utils.c ++++ b/src/utils/huffman_utils.c +@@ -177,21 +177,24 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits, + if (num_open < 0) { + return 0; + } +- if (root_table == NULL) continue; + for (; count[len] > 0; --count[len]) { + HuffmanCode code; + if ((key & mask) != low) { +- table += table_size; ++ if (root_table != NULL) table += table_size; + table_bits = NextTableBitSize(count, len, root_bits); + table_size = 1 << table_bits; + total_size += table_size; + low = key & mask; +- root_table[low].bits = (uint8_t)(table_bits + root_bits); +- root_table[low].value = (uint16_t)((table - root_table) - low); ++ if (root_table != NULL) { ++ root_table[low].bits = (uint8_t)(table_bits + root_bits); ++ root_table[low].value = (uint16_t)((table - root_table) - low); ++ } ++ } ++ if (root_table != NULL) { ++ code.bits = (uint8_t)(len - root_bits); ++ code.value = (uint16_t)sorted[symbol++]; ++ ReplicateValue(&table[key >> root_bits], step, table_size, code); + } +- code.bits = (uint8_t)(len - root_bits); +- code.value = (uint16_t)sorted[symbol++]; +- ReplicateValue(&table[key >> root_bits], step, table_size, code); + key = GetNextKey(key, len); + } + } +@@ -211,25 +214,83 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits, + ((1 << MAX_CACHE_BITS) + NUM_LITERAL_CODES + NUM_LENGTH_CODES) + // Cut-off value for switching between heap and stack allocation. + #define SORTED_SIZE_CUTOFF 512 +-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits, ++int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits, + const int code_lengths[], int code_lengths_size) { +- int total_size; ++ const int total_size = ++ BuildHuffmanTable(NULL, root_bits, code_lengths, code_lengths_size, NULL); + assert(code_lengths_size <= MAX_CODE_LENGTHS_SIZE); +- if (root_table == NULL) { +- total_size = BuildHuffmanTable(NULL, root_bits, +- code_lengths, code_lengths_size, NULL); +- } else if (code_lengths_size <= SORTED_SIZE_CUTOFF) { ++ if (total_size == 0 || root_table == NULL) return total_size; ++ ++ if (root_table->curr_segment->curr_table + total_size >= ++ root_table->curr_segment->start + root_table->curr_segment->size) { ++ // If 'root_table' does not have enough memory, allocate a new segment. ++ // The available part of root_table->curr_segment is left unused because we ++ // need a contiguous buffer. ++ const int segment_size = root_table->curr_segment->size; ++ struct HuffmanTablesSegment* next = ++ (HuffmanTablesSegment*)WebPSafeMalloc(1, sizeof(*next)); ++ if (next == NULL) return 0; ++ // Fill the new segment. ++ // We need at least 'total_size' but if that value is small, it is better to ++ // allocate a big chunk to prevent more allocations later. 'segment_size' is ++ // therefore chosen (any other arbitrary value could be chosen). ++ next->size = total_size > segment_size ? total_size : segment_size; ++ next->start = ++ (HuffmanCode*)WebPSafeMalloc(next->size, sizeof(*next->start)); ++ if (next->start == NULL) { ++ WebPSafeFree(next); ++ return 0; ++ } ++ next->curr_table = next->start; ++ next->next = NULL; ++ // Point to the new segment. ++ root_table->curr_segment->next = next; ++ root_table->curr_segment = next; ++ } ++ if (code_lengths_size <= SORTED_SIZE_CUTOFF) { + // use local stack-allocated array. + uint16_t sorted[SORTED_SIZE_CUTOFF]; +- total_size = BuildHuffmanTable(root_table, root_bits, +- code_lengths, code_lengths_size, sorted); +- } else { // rare case. Use heap allocation. ++ BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits, ++ code_lengths, code_lengths_size, sorted); ++ } else { // rare case. Use heap allocation. + uint16_t* const sorted = + (uint16_t*)WebPSafeMalloc(code_lengths_size, sizeof(*sorted)); + if (sorted == NULL) return 0; +- total_size = BuildHuffmanTable(root_table, root_bits, +- code_lengths, code_lengths_size, sorted); ++ BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits, ++ code_lengths, code_lengths_size, sorted); + WebPSafeFree(sorted); + } + return total_size; + } ++ ++int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables) { ++ // Have 'segment' point to the first segment for now, 'root'. ++ HuffmanTablesSegment* const root = &huffman_tables->root; ++ huffman_tables->curr_segment = root; ++ // Allocate root. ++ root->start = (HuffmanCode*)WebPSafeMalloc(size, sizeof(*root->start)); ++ if (root->start == NULL) return 0; ++ root->curr_table = root->start; ++ root->next = NULL; ++ root->size = size; ++ return 1; ++} ++ ++void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables) { ++ HuffmanTablesSegment *current, *next; ++ if (huffman_tables == NULL) return; ++ // Free the root node. ++ current = &huffman_tables->root; ++ next = current->next; ++ WebPSafeFree(current->start); ++ current->start = NULL; ++ current->next = NULL; ++ current = next; ++ // Free the following nodes. ++ while (current != NULL) { ++ next = current->next; ++ WebPSafeFree(current->start); ++ WebPSafeFree(current); ++ current = next; ++ } ++} +diff --git a/src/utils/huffman_utils.h b/src/utils/huffman_utils.h +index 13b7ad1..98415c5 100644 +--- a/src/utils/huffman_utils.h ++++ b/src/utils/huffman_utils.h +@@ -43,6 +43,29 @@ typedef struct { + // or non-literal symbol otherwise + } HuffmanCode32; + ++// Contiguous memory segment of HuffmanCodes. ++typedef struct HuffmanTablesSegment { ++ HuffmanCode* start; ++ // Pointer to where we are writing into the segment. Starts at 'start' and ++ // cannot go beyond 'start' + 'size'. ++ HuffmanCode* curr_table; ++ // Pointer to the next segment in the chain. ++ struct HuffmanTablesSegment* next; ++ int size; ++} HuffmanTablesSegment; ++ ++// Chained memory segments of HuffmanCodes. ++typedef struct HuffmanTables { ++ HuffmanTablesSegment root; ++ // Currently processed segment. At first, this is 'root'. ++ HuffmanTablesSegment* curr_segment; ++} HuffmanTables; ++ ++// Allocates a HuffmanTables with 'size' contiguous HuffmanCodes. Returns 0 on ++// memory allocation error, 1 otherwise. ++int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables); ++void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables); ++ + #define HUFFMAN_PACKED_BITS 6 + #define HUFFMAN_PACKED_TABLE_SIZE (1u << HUFFMAN_PACKED_BITS) + +@@ -78,9 +101,7 @@ void VP8LHtreeGroupsFree(HTreeGroup* const htree_groups); + // the huffman table. + // Returns built table size or 0 in case of error (invalid tree or + // memory error). +-// If root_table is NULL, it returns 0 if a lookup cannot be built, something +-// > 0 otherwise (but not the table size). +-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits, ++int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits, + const int code_lengths[], int code_lengths_size); + + #ifdef __cplusplus +-- +2.40.0 + diff --git a/meta/recipes-multimedia/webp/files/CVE-2023-4863-0002.patch b/meta/recipes-multimedia/webp/files/CVE-2023-4863-0002.patch new file mode 100644 index 0000000000..231894e882 --- /dev/null +++ b/meta/recipes-multimedia/webp/files/CVE-2023-4863-0002.patch @@ -0,0 +1,53 @@ +From 95ea5226c870449522240ccff26f0b006037c520 Mon Sep 17 00:00:00 2001 +From: Vincent Rabaud <vrabaud@google.com> +Date: Mon, 11 Sep 2023 16:06:08 +0200 +Subject: [PATCH 2/2] Fix invalid incremental decoding check. + +The first condition is only necessary if we have not read enough +(enough being defined by src_last, not src_end which is the end +of the image). +The second condition now fits the comment below: "if not +incremental, and we are past the end of buffer". + +BUG=oss-fuzz:62136 + +Change-Id: I0700f67c62db8e1c02c2e429a069a71e606a5e4f + +CVE: CVE-2023-4863 + +Upstream-Status: Backport [https://github.com/webmproject/libwebp/commit/95ea5226c870449522240ccff26f0b006037c520] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/dec/vp8l_dec.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c +index 186b0b2..59a9e64 100644 +--- a/src/dec/vp8l_dec.c ++++ b/src/dec/vp8l_dec.c +@@ -1241,9 +1241,20 @@ static int DecodeImageData(VP8LDecoder* const dec, uint32_t* const data, + } + + br->eos_ = VP8LIsEndOfStream(br); +- if (dec->incremental_ && br->eos_ && src < src_end) { ++ // In incremental decoding: ++ // br->eos_ && src < src_last: if 'br' reached the end of the buffer and ++ // 'src_last' has not been reached yet, there is not enough data. 'dec' has to ++ // be reset until there is more data. ++ // !br->eos_ && src < src_last: this cannot happen as either the buffer is ++ // fully read, either enough has been read to reach 'src_last'. ++ // src >= src_last: 'src_last' is reached, all is fine. 'src' can actually go ++ // beyond 'src_last' in case the image is cropped and an LZ77 goes further. ++ // The buffer might have been enough or there is some left. 'br->eos_' does ++ // not matter. ++ assert(!dec->incremental_ || (br->eos_ && src < src_last) || src >= src_last); ++ if (dec->incremental_ && br->eos_ && src < src_last) { + RestoreState(dec); +- } else if (!br->eos_) { ++ } else if ((dec->incremental_ && src >= src_last) || !br->eos_) { + // Process the remaining rows corresponding to last row-block. + if (process_func != NULL) { + process_func(dec, row > last_row ? last_row : row); +-- +2.40.0 diff --git a/meta/recipes-multimedia/webp/libwebp_1.2.4.bb b/meta/recipes-multimedia/webp/libwebp_1.2.4.bb index 263589846a..a6cdc0c510 100644 --- a/meta/recipes-multimedia/webp/libwebp_1.2.4.bb +++ b/meta/recipes-multimedia/webp/libwebp_1.2.4.bb @@ -13,7 +13,11 @@ LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://COPYING;md5=6e8dee932c26f2dab503abf70c96d8bb \ file://PATENTS;md5=c6926d0cb07d296f886ab6e0cc5a85b7" -SRC_URI = "http://downloads.webmproject.org/releases/webp/${BP}.tar.gz" +SRC_URI = "http://downloads.webmproject.org/releases/webp/${BP}.tar.gz \ + file://CVE-2023-1999.patch \ + file://CVE-2023-4863-0001.patch \ + file://CVE-2023-4863-0002.patch \ + " SRC_URI[sha256sum] = "7bf5a8a28cc69bcfa8cb214f2c3095703c6b73ac5fba4d5480c205331d9494df" UPSTREAM_CHECK_URI = "http://downloads.webmproject.org/releases/webp/index.html" diff --git a/meta/recipes-rt/rt-tests/files/rt_bmark.py b/meta/recipes-rt/rt-tests/files/rt_bmark.py index 3b84447a0f..2a4eed412f 100755 --- a/meta/recipes-rt/rt-tests/files/rt_bmark.py +++ b/meta/recipes-rt/rt-tests/files/rt_bmark.py @@ -265,7 +265,7 @@ cmd = ("cyclictest", "-d", str(interval_delta), "-l", str(loop_count) ) -rex = re.compile(b"C:\s*(\d+).*Min:\s*(\d+).*Avg:\s*(\d+).*Max:\s*(\d+)") +rex = re.compile(r"C:\s*(\d+).*Min:\s*(\d+).*Avg:\s*(\d+).*Max:\s*(\d+)") def run_cyclictest_once(): res = subprocess.check_output(cmd) diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-32888.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-32888.patch new file mode 100644 index 0000000000..1a6b685450 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-32888.patch @@ -0,0 +1,41 @@ +CVE: CVE-2022-32888 +Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/a3dd7dc] + +[1]: https://support.apple.com/en-us/HT213446 +[2]: https://bugs.webkit.org/show_bug.cgi?id=242047 + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From a3dd7dc5f60b87a7cfd14c372e40ebd339076763 Mon Sep 17 00:00:00 2001 +From: Yusuke Suzuki <ysuzuki@apple.com> +Date: Mon, 27 Jun 2022 21:34:55 -0700 +Subject: [PATCH] [JSC] Drop wasm stale assertion + https://bugs.webkit.org/show_bug.cgi?id=242047 rdar://95866655 + +Reviewed by Mark Lam. + +This patch drops stale assertion in addDelegateToUnreachable. + +* Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp: +(JSC::Wasm::LLIntGenerator::addDelegateToUnreachable): + +Canonical link: https://commits.webkit.org/251902@main +--- + Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp b/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp +index 39fb39b3331f..d0d2b9725991 100644 +--- a/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp ++++ b/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp +@@ -1182,7 +1182,6 @@ auto LLIntGenerator::addDelegateToUnreachable(ControlType& target, ControlType& + + ControlTry& tryData = std::get<ControlTry>(data); + m_codeBlock->addExceptionHandler({ HandlerType::Delegate, tryData.m_try->location(), delegateLabel->location(), 0, m_tryDepth, targetDepth }); +- checkConsistency(); + return { }; + } + +-- +2.34.1 + diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-32923.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-32923.patch new file mode 100644 index 0000000000..60342a14f8 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-32923.patch @@ -0,0 +1,435 @@ +CVE: CVE-2022-32923 +Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/ef76e31] + +[1]: https://support.apple.com/en-us/HT213495 +[2]: https://bugs.webkit.org/show_bug.cgi?id=242964 + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From ef76e31a2a066c3d65a9c94a9e2cd88133260c1f Mon Sep 17 00:00:00 2001 +From: Yusuke Suzuki <ysuzuki@apple.com> +Date: Wed, 20 Jul 2022 19:30:48 -0700 +Subject: [PATCH] [JSC] BakcwardPropagationPhase should carry NaN / Infinity + handling https://bugs.webkit.org/show_bug.cgi?id=242964 rdar://96791603 + +Reviewed by Mark Lam. + +For correctness, we should carry NaN / Infinity handling to make it more clear in the code generation site. + +* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp: +(JSC::DFG::BackwardsPropagationPhase::propagate): +* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp: +(JSC::DFG::FixupPhase::fixupArithDivInt32): +(JSC::DFG::FixupPhase::fixupArithDiv): +* Source/JavaScriptCore/dfg/DFGGraph.h: +* Source/JavaScriptCore/dfg/DFGNode.h: +* Source/JavaScriptCore/dfg/DFGNodeFlags.cpp: +(JSC::DFG::dumpNodeFlags): +* Source/JavaScriptCore/dfg/DFGNodeFlags.h: +(JSC::DFG::bytecodeCanIgnoreNaNAndInfinity): +(JSC::DFG::nodeCanSpeculateInt32ForDiv): +* Source/JavaScriptCore/dfg/DFGNodeType.h: + +Canonical link: https://commits.webkit.org/252675@main +--- + .../dfg/DFGBackwardsPropagationPhase.cpp | 51 +++++++++++-------- + Source/JavaScriptCore/dfg/DFGFixupPhase.cpp | 6 ++- + Source/JavaScriptCore/dfg/DFGGraph.h | 11 ++++ + Source/JavaScriptCore/dfg/DFGNode.h | 12 +++-- + Source/JavaScriptCore/dfg/DFGNodeFlags.cpp | 10 ++-- + Source/JavaScriptCore/dfg/DFGNodeFlags.h | 37 +++++++++++--- + Source/JavaScriptCore/dfg/DFGNodeType.h | 3 +- + 7 files changed, 91 insertions(+), 39 deletions(-) + +diff --git a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp +index 306ea5d6b974..83a08aff7c20 100644 +--- a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp ++++ b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp +@@ -272,7 +272,7 @@ private: + case ValueBitNot: + case ArithBitNot: { + flags |= NodeBytecodeUsesAsInt; +- flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther); ++ flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity | NodeBytecodeUsesAsOther); + flags &= ~NodeBytecodeUsesAsArrayIndex; + node->child1()->mergeFlags(flags); + break; +@@ -291,7 +291,7 @@ private: + case BitURShift: + case ArithIMul: { + flags |= NodeBytecodeUsesAsInt; +- flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther); ++ flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity | NodeBytecodeUsesAsOther); + flags &= ~NodeBytecodeUsesAsArrayIndex; + node->child1()->mergeFlags(flags); + node->child2()->mergeFlags(flags); +@@ -308,9 +308,9 @@ private: + + case StringSlice: { + node->child1()->mergeFlags(NodeBytecodeUsesAsValue); +- node->child2()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex); ++ node->child2()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex | NodeBytecodeNeedsNaNOrInfinity); + if (node->child3()) +- node->child3()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex); ++ node->child3()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex | NodeBytecodeNeedsNaNOrInfinity); + break; + } + +@@ -320,11 +320,11 @@ private: + if (node->numChildren() == 2) + m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsValue); + else if (node->numChildren() == 3) { +- m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex); ++ m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex | NodeBytecodeNeedsNaNOrInfinity); + m_graph.varArgChild(node, 2)->mergeFlags(NodeBytecodeUsesAsValue); + } else if (node->numChildren() == 4) { +- m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex); +- m_graph.varArgChild(node, 2)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex); ++ m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex | NodeBytecodeNeedsNaNOrInfinity); ++ m_graph.varArgChild(node, 2)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex | NodeBytecodeNeedsNaNOrInfinity); + m_graph.varArgChild(node, 3)->mergeFlags(NodeBytecodeUsesAsValue); + } + break; +@@ -345,6 +345,7 @@ private: + flags |= NodeBytecodeUsesAsNumber; + if (!m_allowNestedOverflowingAdditions) + flags |= NodeBytecodeUsesAsNumber; ++ flags |= NodeBytecodeNeedsNaNOrInfinity; + + node->child1()->mergeFlags(flags); + node->child2()->mergeFlags(flags); +@@ -359,6 +360,7 @@ private: + flags |= NodeBytecodeUsesAsNumber; + if (!m_allowNestedOverflowingAdditions) + flags |= NodeBytecodeUsesAsNumber; ++ flags |= NodeBytecodeNeedsNaNOrInfinity; + + node->child1()->mergeFlags(flags); + node->child2()->mergeFlags(flags); +@@ -366,7 +368,7 @@ private: + } + + case ArithClz32: { +- flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther | ~NodeBytecodeUsesAsArrayIndex); ++ flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity | NodeBytecodeUsesAsOther | ~NodeBytecodeUsesAsArrayIndex); + flags |= NodeBytecodeUsesAsInt; + node->child1()->mergeFlags(flags); + break; +@@ -380,6 +382,7 @@ private: + flags |= NodeBytecodeUsesAsNumber; + if (!m_allowNestedOverflowingAdditions) + flags |= NodeBytecodeUsesAsNumber; ++ flags |= NodeBytecodeNeedsNaNOrInfinity; + + node->child1()->mergeFlags(flags); + node->child2()->mergeFlags(flags); +@@ -387,6 +390,7 @@ private: + } + + case ArithNegate: { ++ // negation does not care about NaN, Infinity, -Infinity are converted into 0 if the result is evaluated under the integer context. + flags &= ~NodeBytecodeUsesAsOther; + + node->child1()->mergeFlags(flags); +@@ -401,6 +405,7 @@ private: + flags |= NodeBytecodeUsesAsNumber; + if (!m_allowNestedOverflowingAdditions) + flags |= NodeBytecodeUsesAsNumber; ++ flags |= NodeBytecodeNeedsNaNOrInfinity; + + node->child1()->mergeFlags(flags); + break; +@@ -421,7 +426,7 @@ private: + + node->mergeFlags(flags); + +- flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero; ++ flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity; + flags &= ~NodeBytecodeUsesAsOther; + + node->child1()->mergeFlags(flags); +@@ -431,7 +436,13 @@ private: + + case ValueDiv: + case ArithDiv: { +- flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero; ++ // ArithDiv / ValueDiv need to have NodeBytecodeUsesAsNumber even if it is used in the context of integer. ++ // For example, ++ // ((@x / @y) + @z) | 0 ++ // In this context, (@x / @y) can have integer context at first, but the result can be different if div ++ // generates NaN. Div and Mod are operations that can produce NaN / Infinity though only taking binary Int32 operands. ++ // Thus, we always need to check for overflow since it can affect downstream calculations. ++ flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity; + flags &= ~NodeBytecodeUsesAsOther; + + node->child1()->mergeFlags(flags); +@@ -441,7 +452,7 @@ private: + + case ValueMod: + case ArithMod: { +- flags |= NodeBytecodeUsesAsNumber; ++ flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity; + flags &= ~NodeBytecodeUsesAsOther; + + node->child1()->mergeFlags(flags); +@@ -452,7 +463,7 @@ private: + case EnumeratorGetByVal: + case GetByVal: { + m_graph.varArgChild(node, 0)->mergeFlags(NodeBytecodeUsesAsValue); +- m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex); ++ m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeNeedsNaNOrInfinity | NodeBytecodeUsesAsArrayIndex); + break; + } + +@@ -461,13 +472,13 @@ private: + // Negative zero is not observable. NaN versus undefined are only observable + // in that you would get a different exception message. So, like, whatever: we + // claim here that NaN v. undefined is observable. +- node->child1()->mergeFlags(NodeBytecodeUsesAsInt | NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsArrayIndex); ++ node->child1()->mergeFlags(NodeBytecodeUsesAsInt | NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeNeedsNaNOrInfinity | NodeBytecodeUsesAsArrayIndex); + break; + } + + case ToString: + case CallStringConstructor: { +- node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther); ++ node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeNeedsNaNOrInfinity); + break; + } + +@@ -487,15 +498,15 @@ private: + case CompareBelowEq: + case CompareEq: + case CompareStrictEq: { +- node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther); +- node->child2()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther); ++ node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeNeedsNaNOrInfinity); ++ node->child2()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeNeedsNaNOrInfinity); + break; + } + + case PutByValDirect: + case PutByVal: { + m_graph.varArgChild(node, 0)->mergeFlags(NodeBytecodeUsesAsValue); +- m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex); ++ m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex | NodeBytecodeNeedsNaNOrInfinity); + m_graph.varArgChild(node, 2)->mergeFlags(NodeBytecodeUsesAsValue); + break; + } +@@ -508,20 +519,20 @@ private: + // then -0 and 0 are treated the same. We don't need NodeBytecodeUsesAsOther + // because if all of the cases are integers then NaN and undefined are + // treated the same (i.e. they will take default). +- node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsInt); ++ node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsInt | NodeBytecodeNeedsNaNOrInfinity); + break; + case SwitchChar: { + // We don't need NodeBytecodeNeedsNegZero because if the cases are all strings + // then -0 and 0 are treated the same. We don't need NodeBytecodeUsesAsOther + // because if all of the cases are single-character strings then NaN + // and undefined are treated the same (i.e. they will take default). +- node->child1()->mergeFlags(NodeBytecodeUsesAsNumber); ++ node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNaNOrInfinity); + break; + } + case SwitchString: + // We don't need NodeBytecodeNeedsNegZero because if the cases are all strings + // then -0 and 0 are treated the same. +- node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther); ++ node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeNeedsNaNOrInfinity); + break; + case SwitchCell: + // There is currently no point to being clever here since this is used for switching +diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp +index e8bee58ada15..b679539de2e6 100644 +--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp ++++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp +@@ -81,7 +81,9 @@ private: + if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) { + fixIntOrBooleanEdge(leftChild); + fixIntOrBooleanEdge(rightChild); +- if (bytecodeCanTruncateInteger(node->arithNodeFlags())) ++ // We need to be careful about skipping overflow check because div / mod can generate non integer values ++ // from (Int32, Int32) inputs. For now, we always check non-zero divisor. ++ if (bytecodeCanTruncateInteger(node->arithNodeFlags()) && bytecodeCanIgnoreNaNAndInfinity(node->arithNodeFlags()) && bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())) + node->setArithMode(Arith::Unchecked); + else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())) + node->setArithMode(Arith::CheckOverflow); +@@ -122,7 +124,7 @@ private: + + void fixupArithDiv(Node* node, Edge& leftChild, Edge& rightChild) + { +- if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) { ++ if (m_graph.divShouldSpeculateInt32(node, FixupPass)) { + fixupArithDivInt32(node, leftChild, rightChild); + return; + } +diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h +index ca566d3a484e..284c87672849 100644 +--- a/Source/JavaScriptCore/dfg/DFGGraph.h ++++ b/Source/JavaScriptCore/dfg/DFGGraph.h +@@ -373,6 +373,17 @@ public: + + return shouldSpeculateInt52ForAdd(left) && shouldSpeculateInt52ForAdd(right); + } ++ ++ bool divShouldSpeculateInt32(Node* node, PredictionPass pass) ++ { ++ // Even if inputs are Int32, div can generate NaN or Infinity. ++ // Thus, Overflow in div can be caused by these non integer values as well as actual Int32 overflow. ++ Node* left = node->child1().node(); ++ Node* right = node->child2().node(); ++ ++ return Node::shouldSpeculateInt32OrBooleanForArithmetic(left, right) ++ && nodeCanSpeculateInt32ForDiv(node->arithNodeFlags(), node->sourceFor(pass)); ++ } + + bool binaryArithShouldSpeculateInt32(Node* node, PredictionPass pass) + { +diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h +index f9ff50658e93..04509a3846ca 100644 +--- a/Source/JavaScriptCore/dfg/DFGNode.h ++++ b/Source/JavaScriptCore/dfg/DFGNode.h +@@ -3308,21 +3308,25 @@ public: + out.printf(", @%u", child3()->index()); + } + +- NodeOrigin origin; ++ NO_UNIQUE_ADDRESS NodeOrigin origin; + ++private: ++ NO_UNIQUE_ADDRESS NodeType m_op; ++ ++ NO_UNIQUE_ADDRESS unsigned m_index { std::numeric_limits<unsigned>::max() }; ++ ++public: + // References to up to 3 children, or links to a variable length set of children. + AdjacencyList children; + + private: + friend class B3::SparseCollection<Node>; + +- unsigned m_index { std::numeric_limits<unsigned>::max() }; +- unsigned m_op : 10; // real type is NodeType +- unsigned m_flags : 21; + // The virtual register number (spill location) associated with this . + VirtualRegister m_virtualRegister; + // The number of uses of the result of this operation (+1 for 'must generate' nodes, which have side-effects). + unsigned m_refCount; ++ NodeFlags m_flags; + // The prediction ascribed to this node after propagation. + SpeculatedType m_prediction { SpecNone }; + // Immediate values, accesses type-checked via accessors above. +diff --git a/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp b/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp +index 88242947f6ef..0c53cd976c5c 100644 +--- a/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp ++++ b/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp +@@ -74,12 +74,14 @@ void dumpNodeFlags(PrintStream& actualOut, NodeFlags flags) + out.print(comma, "VarArgs"); + + if (flags & NodeResultMask) { +- if (!(flags & NodeBytecodeUsesAsNumber) && !(flags & NodeBytecodeNeedsNegZero)) ++ if (!(flags & NodeBytecodeUsesAsNumber)) + out.print(comma, "PureInt"); +- else if (!(flags & NodeBytecodeUsesAsNumber)) +- out.print(comma, "PureInt(w/ neg zero)"); +- else if (!(flags & NodeBytecodeNeedsNegZero)) ++ else + out.print(comma, "PureNum"); ++ if (flags & NodeBytecodeNeedsNegZero) ++ out.print(comma, "NeedsNegZero"); ++ if (flags & NodeBytecodeNeedsNaNOrInfinity) ++ out.print(comma, "NeedsNaNOrInfinity"); + if (flags & NodeBytecodeUsesAsOther) + out.print(comma, "UseAsOther"); + } +diff --git a/Source/JavaScriptCore/dfg/DFGNodeFlags.h b/Source/JavaScriptCore/dfg/DFGNodeFlags.h +index 2ebe3544f601..aa60db7e6ba0 100644 +--- a/Source/JavaScriptCore/dfg/DFGNodeFlags.h ++++ b/Source/JavaScriptCore/dfg/DFGNodeFlags.h +@@ -61,18 +61,19 @@ namespace JSC { namespace DFG { + #define NodeBytecodeUseBottom 0x00000 + #define NodeBytecodeUsesAsNumber 0x04000 // The result of this computation may be used in a context that observes fractional, or bigger-than-int32, results. + #define NodeBytecodeNeedsNegZero 0x08000 // The result of this computation may be used in a context that observes -0. +-#define NodeBytecodeUsesAsOther 0x10000 // The result of this computation may be used in a context that distinguishes between NaN and other things (like undefined). +-#define NodeBytecodeUsesAsInt 0x20000 // The result of this computation is known to be used in a context that prefers, but does not require, integer values. +-#define NodeBytecodeUsesAsArrayIndex 0x40000 // The result of this computation is known to be used in a context that strongly prefers integer values, to the point that we should avoid using doubles if at all possible. +-#define NodeBytecodeUsesAsValue (NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther) +-#define NodeBytecodeBackPropMask (NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex) ++#define NodeBytecodeNeedsNaNOrInfinity 0x10000 // The result of this computation may be used in a context that observes NaN or Infinity. ++#define NodeBytecodeUsesAsOther 0x20000 // The result of this computation may be used in a context that distinguishes between NaN and other things (like undefined). ++#define NodeBytecodeUsesAsInt 0x40000 // The result of this computation is known to be used in a context that prefers, but does not require, integer values. ++#define NodeBytecodeUsesAsArrayIndex 0x80000 // The result of this computation is known to be used in a context that strongly prefers integer values, to the point that we should avoid using doubles if at all possible. ++#define NodeBytecodeUsesAsValue (NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity | NodeBytecodeUsesAsOther) ++#define NodeBytecodeBackPropMask (NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeNeedsNaNOrInfinity | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex) + + #define NodeArithFlagsMask (NodeBehaviorMask | NodeBytecodeBackPropMask) + +-#define NodeIsFlushed 0x80000 // Computed by CPSRethreadingPhase, will tell you which local nodes are backwards-reachable from a Flush. ++#define NodeIsFlushed 0x100000 // Computed by CPSRethreadingPhase, will tell you which local nodes are backwards-reachable from a Flush. + +-#define NodeMiscFlag1 0x100000 +-#define NodeMiscFlag2 0x200000 ++#define NodeMiscFlag1 0x200000 ++#define NodeMiscFlag2 0x400000 + + typedef uint32_t NodeFlags; + +@@ -91,6 +92,11 @@ static inline bool bytecodeCanIgnoreNegativeZero(NodeFlags flags) + return !(flags & NodeBytecodeNeedsNegZero); + } + ++static inline bool bytecodeCanIgnoreNaNAndInfinity(NodeFlags flags) ++{ ++ return !(flags & NodeBytecodeNeedsNaNOrInfinity); ++} ++ + enum RareCaseProfilingSource { + BaselineRareCase, // Comes from slow case counting in the baseline JIT. + DFGRareCase, // Comes from OSR exit profiles. +@@ -147,6 +153,21 @@ static inline bool nodeCanSpeculateInt32(NodeFlags flags, RareCaseProfilingSourc + return true; + } + ++static inline bool nodeCanSpeculateInt32ForDiv(NodeFlags flags, RareCaseProfilingSource source) ++{ ++ if (nodeMayOverflowInt32(flags, source)) { ++ if (bytecodeUsesAsNumber(flags)) ++ return false; ++ if (!bytecodeCanIgnoreNaNAndInfinity(flags)) ++ return false; ++ } ++ ++ if (nodeMayNegZero(flags, source)) ++ return bytecodeCanIgnoreNegativeZero(flags); ++ ++ return true; ++} ++ + static inline bool nodeCanSpeculateInt52(NodeFlags flags, RareCaseProfilingSource source) + { + if (nodeMayOverflowInt52(flags, source)) +diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h +index 8f885b570665..aad4d559ccf7 100644 +--- a/Source/JavaScriptCore/dfg/DFGNodeType.h ++++ b/Source/JavaScriptCore/dfg/DFGNodeType.h +@@ -567,7 +567,7 @@ namespace JSC { namespace DFG { + + // This enum generates a monotonically increasing id for all Node types, + // and is used by the subsequent enum to fill out the id (as accessed via the NodeIdMask). +-enum NodeType { ++enum NodeType : uint16_t { + #define DFG_OP_ENUM(opcode, flags) opcode, + FOR_EACH_DFG_OP(DFG_OP_ENUM) + #undef DFG_OP_ENUM +@@ -577,6 +577,7 @@ enum NodeType { + #define DFG_OP_COUNT(opcode, flags) + 1 + constexpr unsigned numberOfNodeTypes = FOR_EACH_DFG_OP(DFG_OP_COUNT); + #undef DFG_OP_COUNT ++static_assert(numberOfNodeTypes <= UINT16_MAX); + + // Specifies the default flags for each node. + inline NodeFlags defaultFlags(NodeType op) +-- +2.34.1 + diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-42867.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-42867.patch new file mode 100644 index 0000000000..bf06809051 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-42867.patch @@ -0,0 +1,104 @@ +From f67a882170609d15836204a689dc552322fbe653 Mon Sep 17 00:00:00 2001 +From: Yogita Urade <yogita.urade@windriver.com> +Date: Wed, 7 Jun 2023 08:15:11 +0000 +Subject: [oe-core][kirkstone][PATCH 1/1] RenderElement::updateFillImages + should take pointer arguments like other similar functions + https://bugs.webkit.org/show_bug.cgi?id=247317 rdar://100273147 + +Reviewed by Alan Baradlay. + +* Source/WebCore/rendering/RenderElement.cpp: +(WebCore::RenderElement::updateFillImages): +(WebCore::RenderElement::styleDidChange): +* Source/WebCore/rendering/RenderElement.h: + +Canonical link: https://commits.webkit.org/256215@main + +CVE: CVE-2022-42867 + +Upstream-Status: Backport +[https://github.com/WebKit/WebKit/commit/091a04e55c801ac6ba13f4b328fbee2eece853fc] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + Source/WebCore/rendering/RenderElement.cpp | 27 ++++++++++++++-------- + Source/WebCore/rendering/RenderElement.h | 2 +- + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/Source/WebCore/rendering/RenderElement.cpp b/Source/WebCore/rendering/RenderElement.cpp +index da43bf3d..931686b8 100644 +--- a/Source/WebCore/rendering/RenderElement.cpp ++++ b/Source/WebCore/rendering/RenderElement.cpp +@@ -358,7 +358,7 @@ inline bool RenderElement::shouldRepaintForStyleDifference(StyleDifference diff) + return diff == StyleDifference::Repaint || (diff == StyleDifference::RepaintIfTextOrBorderOrOutline && hasImmediateNonWhitespaceTextChildOrBorderOrOutline()); + } + +-void RenderElement::updateFillImages(const FillLayer* oldLayers, const FillLayer& newLayers) ++void RenderElement::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers) + { + auto fillImagesAreIdentical = [](const FillLayer* layer1, const FillLayer* layer2) -> bool { + if (layer1 == layer2) +@@ -379,7 +379,7 @@ void RenderElement::updateFillImages(const FillLayer* oldLayers, const FillLayer + }; + + auto isRegisteredWithNewFillImages = [&]() -> bool { +- for (auto* layer = &newLayers; layer; layer = layer->next()) { ++ for (auto* layer = newLayers; layer; layer = layer->next()) { + if (layer->image() && !layer->image()->hasClient(*this)) + return false; + } +@@ -388,11 +388,11 @@ void RenderElement::updateFillImages(const FillLayer* oldLayers, const FillLayer + + // If images have the same characteristics and this element is already registered as a + // client to the new images, there is nothing to do. +- if (fillImagesAreIdentical(oldLayers, &newLayers) && isRegisteredWithNewFillImages()) ++ if (fillImagesAreIdentical(oldLayers, newLayers) && isRegisteredWithNewFillImages()) + return; + + // Add before removing, to avoid removing all clients of an image that is in both sets. +- for (auto* layer = &newLayers; layer; layer = layer->next()) { ++ for (auto* layer = newLayers; layer; layer = layer->next()) { + if (layer->image()) + layer->image()->addClient(*this); + } +@@ -937,11 +937,20 @@ static inline bool areCursorsEqual(const RenderStyle* a, const RenderStyle* b) + + void RenderElement::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle) + { +- updateFillImages(oldStyle ? &oldStyle->backgroundLayers() : nullptr, m_style.backgroundLayers()); +- updateFillImages(oldStyle ? &oldStyle->maskLayers() : nullptr, m_style.maskLayers()); +- updateImage(oldStyle ? oldStyle->borderImage().image() : nullptr, m_style.borderImage().image()); +- updateImage(oldStyle ? oldStyle->maskBoxImage().image() : nullptr, m_style.maskBoxImage().image()); +- updateShapeImage(oldStyle ? oldStyle->shapeOutside() : nullptr, m_style.shapeOutside()); ++ auto registerImages = [this](auto* style, auto* oldStyle) { ++ if (!style && !oldStyle) ++ return; ++ updateFillImages(oldStyle ? &oldStyle->backgroundLayers() : nullptr, style ? &style->backgroundLayers() : nullptr); ++ updateFillImages(oldStyle ? &oldStyle->maskLayers() : nullptr, style ? &style->maskLayers() : nullptr); ++ updateImage(oldStyle ? oldStyle->borderImage().image() : nullptr, style ? style->borderImage().image() : nullptr); ++ updateImage(oldStyle ? oldStyle->maskBoxImage().image() : nullptr, style ? style->maskBoxImage().image() : nullptr); ++ updateShapeImage(oldStyle ? oldStyle->shapeOutside() : nullptr, style ? style->shapeOutside() : nullptr); ++ }; ++ ++ registerImages(&style(), oldStyle); ++ ++ // Are there other pseudo-elements that need the resources to be registered? ++ registerImages(style().getCachedPseudoStyle(PseudoId::FirstLine), oldStyle ? oldStyle->getCachedPseudoStyle(PseudoId::FirstLine) : nullptr); + + SVGRenderSupport::styleChanged(*this, oldStyle); + +diff --git a/Source/WebCore/rendering/RenderElement.h b/Source/WebCore/rendering/RenderElement.h +index f376cecb..d6ba2cdf 100644 +--- a/Source/WebCore/rendering/RenderElement.h ++++ b/Source/WebCore/rendering/RenderElement.h +@@ -349,7 +349,7 @@ private: + bool shouldRepaintForStyleDifference(StyleDifference) const; + bool hasImmediateNonWhitespaceTextChildOrBorderOrOutline() const; + +- void updateFillImages(const FillLayer*, const FillLayer&); ++ void updateFillImages(const FillLayer*, const FillLayer*); + void updateImage(StyleImage*, StyleImage*); + void updateShapeImage(const ShapeValue*, const ShapeValue*); + +-- +2.35.5 diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46691.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46691.patch new file mode 100644 index 0000000000..ff9df40433 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46691.patch @@ -0,0 +1,43 @@ +From fd57a49d07c9c285780495344073350182fd7c7c Mon Sep 17 00:00:00 2001 +From: Yijia Huang <hyjorc1@gmail.com> +Date: Mon, 10 Oct 2022 15:42:34 -0700 +Subject: [PATCH] [JSC] Should model BigInt with side effects + https://bugs.webkit.org/show_bug.cgi?id=246291 rdar://100494823 + +Reviewed by Yusuke Suzuki. + +Operations with two BigInt operands have side effects, +which should not be hoisted from loops. + +* Source/JavaScriptCore/dfg/DFGClobberize.cpp: +(JSC::DFG::doesWrites): +* Source/JavaScriptCore/dfg/DFGClobberize.h: +(JSC::DFG::clobberize): + +Canonical link: https://commits.webkit.org/255368@main + +CVE: CVE-2022-46691 + +Upstream-Status: Backport +[https://github.com/WebKit/WebKit/commit/fd57a49d07c9c285780495344073350182fd7c7c] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + Source/JavaScriptCore/dfg/DFGClobberize.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h +index 0363ab20dcd8..4b1bcfea1fd7 100644 +--- a/Source/JavaScriptCore/dfg/DFGClobberize.h ++++ b/Source/JavaScriptCore/dfg/DFGClobberize.h +@@ -811,6 +811,8 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu + case ValueBitRShift: + // FIXME: this use of single-argument isBinaryUseKind would prevent us from specializing (for example) for a HeapBigInt left-operand and a BigInt32 right-operand. + if (node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(BigInt32Use) || node->isBinaryUseKind(HeapBigIntUse)) { ++ read(World); ++ write(SideState); + def(PureValue(node)); + return; + } +-- +2.40.0 diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46699.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46699.patch new file mode 100644 index 0000000000..0752b9c0e2 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46699.patch @@ -0,0 +1,136 @@ +From 28686e63de0d3d7270a49b0d6b656467bc4fbf68 Mon Sep 17 00:00:00 2001 +From: Justin Michaud <justin_michaud@apple.com> +Date: Wed, 9 Nov 2022 19:20:41 -0800 +Subject: [PATCH] Error() ICs should not cache special properties. + https://bugs.webkit.org/show_bug.cgi?id=247699 + +Reviewed by Yusuke Suzuki. + +HasOwnProperty/DeleteProperty are not always cacheable for special Error() +properties like column. These special properties are materialized on-demand +in materializeErrorInfoIfNeeded, but this function's behaviour can be changed +by Error.stackTraceLimit without causing a structure transition or firing watchpoints. + +That is, we cannot cache property misses, and we cannot assume HasOwnProperty is deterministic +for a given structure if we are using one of these properties. + +* Source/JavaScriptCore/runtime/ErrorInstance.cpp: +(JSC::ErrorInstance::deleteProperty): +* Source/JavaScriptCore/runtime/ErrorInstance.h: + +Canonical link: https://commits.webkit.org/256519@main + +CVE: CVE-2022-46699 + +Upstream-Status: Backport +[https://github.com/WebKit/WebKit/commit/28686e63de0d3d7270a49b0d6b656467bc4fbf68] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + JSTests/stress/delete-cache-error.js | 19 ++++++++++++++++++ + .../get-own-property-slot-cache-error.js | 6 ++++++ + JSTests/stress/get-property-cache-error.js | 20 +++++++++++++++++++ + .../JavaScriptCore/runtime/ErrorInstance.cpp | 4 +++- + Source/JavaScriptCore/runtime/ErrorInstance.h | 3 ++- + 5 files changed, 50 insertions(+), 2 deletions(-) + create mode 100644 JSTests/stress/delete-cache-error.js + create mode 100644 JSTests/stress/get-own-property-slot-cache-error.js + create mode 100644 JSTests/stress/get-property-cache-error.js + +diff --git a/JSTests/stress/delete-cache-error.js b/JSTests/stress/delete-cache-error.js +new file mode 100644 +index 000000000000..d77c09185a13 +--- /dev/null ++++ b/JSTests/stress/delete-cache-error.js +@@ -0,0 +1,19 @@ ++delete Error.stackTraceLimit ++ ++// sourceURL is not materialized ++function cacheColumn(o) { ++ delete o.sourceURL ++} ++noInline(cacheColumn) ++ ++for (let i = 0; i < 200; ++i) { ++ let e = Error() ++ cacheColumn(e) ++ if (e.sourceURL !== undefined) ++ throw "Test failed on iteration " + i + " " + e.sourceURL ++ ++ if (i == 197) { ++ // now it is ++ Error.stackTraceLimit = 10 ++ } ++} +\ No newline at end of file +diff --git a/JSTests/stress/get-own-property-slot-cache-error.js b/JSTests/stress/get-own-property-slot-cache-error.js +new file mode 100644 +index 000000000000..f8202213bf79 +--- /dev/null ++++ b/JSTests/stress/get-own-property-slot-cache-error.js +@@ -0,0 +1,6 @@ ++delete Error.stackTraceLimit ++// GetOwnPropertySlot does not materializeErrorInfoIfNeeded because stackString is null. ++Object.hasOwn(Error(), "column") ++Error.stackTraceLimit = 10 ++// Now it does ++Object.hasOwn(Error(), "column") +\ No newline at end of file +diff --git a/JSTests/stress/get-property-cache-error.js b/JSTests/stress/get-property-cache-error.js +new file mode 100644 +index 000000000000..b35272ea6fe2 +--- /dev/null ++++ b/JSTests/stress/get-property-cache-error.js +@@ -0,0 +1,20 @@ ++// GetOwnPropertySlot does not materializeErrorInfoIfNeeded because stackString is null. ++delete Error.stackTraceLimit ++expected = undefined ++ ++function cacheColumn(o) { ++ return o.column ++} ++noInline(cacheColumn) ++ ++for (let i = 0; i < 1000; ++i) { ++ let val = cacheColumn(Error()) ++ if (val !== expected) ++ throw "Test failed on iteration " + i + ": " + val ++ ++ if (i == 900) { ++ // now it does ++ Error.stackTraceLimit = 10 ++ expected = 32 ++ } ++} +\ No newline at end of file +diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.cpp b/Source/JavaScriptCore/runtime/ErrorInstance.cpp +index ddf96869e84a..8e5373257d34 100644 +--- a/Source/JavaScriptCore/runtime/ErrorInstance.cpp ++++ b/Source/JavaScriptCore/runtime/ErrorInstance.cpp +@@ -303,7 +303,9 @@ bool ErrorInstance::deleteProperty(JSCell* cell, JSGlobalObject* globalObject, P + { + VM& vm = globalObject->vm(); + ErrorInstance* thisObject = jsCast<ErrorInstance*>(cell); +- thisObject->materializeErrorInfoIfNeeded(vm, propertyName); ++ bool materializedProperties = thisObject->materializeErrorInfoIfNeeded(vm, propertyName); ++ if (materializedProperties) ++ slot.disableCaching(); + return Base::deleteProperty(thisObject, globalObject, propertyName, slot); + } + +diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h +index 28807b4ea33e..2afb153a7442 100644 +--- a/Source/JavaScriptCore/runtime/ErrorInstance.h ++++ b/Source/JavaScriptCore/runtime/ErrorInstance.h +@@ -30,7 +30,8 @@ namespace JSC { + class ErrorInstance : public JSNonFinalObject { + public: + using Base = JSNonFinalObject; +- static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetOwnSpecialPropertyNames | OverridesPut; ++ ++ static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetOwnSpecialPropertyNames | OverridesPut | GetOwnPropertySlotIsImpureForPropertyAbsence; + static constexpr bool needsDestruction = true; + + static void destroy(JSCell* cell) +-- +2.40.0 diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46700.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46700.patch new file mode 100644 index 0000000000..242b8337fa --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-46700.patch @@ -0,0 +1,67 @@ +From 86fbeb6fcd638e2350b09a43dde355f9830e75da Mon Sep 17 00:00:00 2001 +From: David Degazio <d_degazio@apple.com> +Date: Tue, 8 Nov 2022 19:54:33 -0800 +Subject: [PATCH] Intl.Locale.prototype.hourCycles leaks empty JSValue to + script https://bugs.webkit.org/show_bug.cgi?id=247562 rdar://102031379 + +Reviewed by Mark Lam. + +We currently don't check if IntlLocale::hourCycles returns a null JSArray, which allows it +to be encoded as an empty JSValue and exposed to user code. This patch throws a TypeError +when udatpg_open returns a failed status. + +* JSTests/stress/intl-locale-invalid-hourCycles.js: Added. +(main): +* Source/JavaScriptCore/runtime/IntlLocale.cpp: +(JSC::IntlLocale::hourCycles): + +Canonical link: https://commits.webkit.org/256473@main + +CVE:CVE-2022-46700 + +Upstream-Status: Backport +[https://github.com/WebKit/WebKit/commit/86fbeb6fcd638e2350b09a43dde355f9830e75da] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + JSTests/stress/intl-locale-invalid-hourCycles.js | 12 ++++++++++++ + Source/JavaScriptCore/runtime/IntlLocale.cpp | 4 +++- + 2 files changed, 15 insertions(+), 1 deletion(-) + create mode 100644 JSTests/stress/intl-locale-invalid-hourCycles.js + +diff --git a/JSTests/stress/intl-locale-invalid-hourCycles.js b/JSTests/stress/intl-locale-invalid-hourCycles.js +new file mode 100644 +index 000000000000..7b94eb844764 +--- /dev/null ++++ b/JSTests/stress/intl-locale-invalid-hourCycles.js +@@ -0,0 +1,12 @@ ++function main() { ++ const v24 = new Intl.Locale("trimEnd", { 'numberingSystem': "foobar" }); ++ let empty = v24.hourCycles; ++ print(empty); ++} ++ ++try { ++ main(); ++} catch (e) { ++ if (!(e instanceof TypeError)) ++ throw e; ++} +diff --git a/Source/JavaScriptCore/runtime/IntlLocale.cpp b/Source/JavaScriptCore/runtime/IntlLocale.cpp +index c3c346163a18..bef424727a8a 100644 +--- a/Source/JavaScriptCore/runtime/IntlLocale.cpp ++++ b/Source/JavaScriptCore/runtime/IntlLocale.cpp +@@ -632,8 +632,10 @@ JSArray* IntlLocale::hourCycles(JSGlobalObject* globalObject) + + UErrorCode status = U_ZERO_ERROR; + auto generator = std::unique_ptr<UDateTimePatternGenerator, ICUDeleter<udatpg_close>>(udatpg_open(m_localeID.data(), &status)); +- if (U_FAILURE(status)) ++ if (U_FAILURE(status)) { ++ throwTypeError(globalObject, scope, "invalid locale"_s); + return nullptr; ++ } + + // Use "j" skeleton and parse pattern to retrieve the configured hour-cycle information. + constexpr const UChar skeleton[] = { 'j', 0 }; +-- +2.40.0 diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-48503.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-48503.patch new file mode 100644 index 0000000000..b67751736d --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-48503.patch @@ -0,0 +1,225 @@ +From 612c245823a515c8c70c2ad486957bd8a850f0f9 Mon Sep 17 00:00:00 2001 +From: Yusuke Suzuki <ysuzuki@apple.com> +Date: Tue, 5 Sep 2023 08:40:19 +0000 +Subject: [PATCH] [JSC] Refactor wasm section ordering code + https://bugs.webkit.org/show_bug.cgi?id=241931 rdar://83326477 + +Reviewed by Keith Miller. + +This patch refactors existing validateOrder code since it is too adhoc right now. + +* Source/JavaScriptCore/wasm/WasmModuleInformation.h: +(JSC::Wasm::ModuleInformation::dataSegmentsCount const): +* Source/JavaScriptCore/wasm/WasmSectionParser.cpp: +(JSC::Wasm::SectionParser::parseData): +(JSC::Wasm::SectionParser::parseDataCount): +* Source/JavaScriptCore/wasm/WasmSectionParser.h: +* Source/JavaScriptCore/wasm/WasmSections.h: +(JSC::Wasm::orderingNumber): +(JSC::Wasm::isKnownSection): +(JSC::Wasm::validateOrder): +(JSC::Wasm::makeString): +* Source/JavaScriptCore/wasm/WasmStreamingParser.cpp: +(JSC::Wasm::StreamingParser::parseSectionPayload): +(JSC::Wasm::StreamingParser::finalize): + +Canonical link: https://commits.webkit.org/251800@main + +CVE: CVE-2022-48503 + +Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/612c245823a515c8c70c2ad486957bd8a850f0f9] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + .../wasm/WasmModuleInformation.h | 4 +- + .../JavaScriptCore/wasm/WasmSectionParser.cpp | 3 ++ + .../JavaScriptCore/wasm/WasmSectionParser.h | 2 +- + Source/JavaScriptCore/wasm/WasmSections.h | 52 +++++++++++-------- + .../wasm/WasmStreamingParser.cpp | 11 +++- + 5 files changed, 45 insertions(+), 27 deletions(-) + +diff --git a/Source/JavaScriptCore/wasm/WasmModuleInformation.h b/Source/JavaScriptCore/wasm/WasmModuleInformation.h +index ae6bbeed..f9f1baf7 100644 +--- a/Source/JavaScriptCore/wasm/WasmModuleInformation.h ++++ b/Source/JavaScriptCore/wasm/WasmModuleInformation.h +@@ -86,7 +86,7 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> { + uint32_t memoryCount() const { return memory ? 1 : 0; } + uint32_t tableCount() const { return tables.size(); } + uint32_t elementCount() const { return elements.size(); } +- uint32_t dataSegmentsCount() const { return numberOfDataSegments; } ++ uint32_t dataSegmentsCount() const { return numberOfDataSegments.value_or(0); } + + const TableInformation& table(unsigned index) const { return tables[index]; } + +@@ -131,7 +131,7 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> { + Vector<CustomSection> customSections; + Ref<NameSection> nameSection; + BranchHints branchHints; +- uint32_t numberOfDataSegments { 0 }; ++ std::optional<uint32_t> numberOfDataSegments; + + BitVector m_declaredFunctions; + BitVector m_declaredExceptions; +diff --git a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp +index 5b511811..c55ee3c0 100644 +--- a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp ++++ b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp +@@ -768,6 +768,8 @@ auto SectionParser::parseData() -> PartialResult + uint32_t segmentCount; + WASM_PARSER_FAIL_IF(!parseVarUInt32(segmentCount), "can't get Data section's count"); + WASM_PARSER_FAIL_IF(segmentCount > maxDataSegments, "Data section's count is too big ", segmentCount, " maximum ", maxDataSegments); ++ if (m_info->numberOfDataSegments) ++ WASM_PARSER_FAIL_IF(segmentCount != m_info->numberOfDataSegments.value(), "Data section's count ", segmentCount, " is different from Data Count section's count ", m_info->numberOfDataSegments.value()); + WASM_PARSER_FAIL_IF(!m_info->data.tryReserveCapacity(segmentCount), "can't allocate enough memory for Data section's ", segmentCount, " segments"); + + for (uint32_t segmentNumber = 0; segmentNumber < segmentCount; ++segmentNumber) { +@@ -847,6 +849,7 @@ auto SectionParser::parseDataCount() -> PartialResult + { + uint32_t numberOfDataSegments; + WASM_PARSER_FAIL_IF(!parseVarUInt32(numberOfDataSegments), "can't get Data Count section's count"); ++ WASM_PARSER_FAIL_IF(numberOfDataSegments > maxDataSegments, "Data Count section's count is too big ", numberOfDataSegments , " maximum ", maxDataSegments); + + m_info->numberOfDataSegments = numberOfDataSegments; + return { }; +diff --git a/Source/JavaScriptCore/wasm/WasmSectionParser.h b/Source/JavaScriptCore/wasm/WasmSectionParser.h +index 91fd3ed8..4d7dcbac 100644 +--- a/Source/JavaScriptCore/wasm/WasmSectionParser.h ++++ b/Source/JavaScriptCore/wasm/WasmSectionParser.h +@@ -44,7 +44,7 @@ public: + { + } + +-#define WASM_SECTION_DECLARE_PARSER(NAME, ID, DESCRIPTION) PartialResult WARN_UNUSED_RETURN parse ## NAME(); ++#define WASM_SECTION_DECLARE_PARSER(NAME, ID, ORDERING, DESCRIPTION) PartialResult WARN_UNUSED_RETURN parse ## NAME(); + FOR_EACH_KNOWN_WASM_SECTION(WASM_SECTION_DECLARE_PARSER) + #undef WASM_SECTION_DECLARE_PARSER + +diff --git a/Source/JavaScriptCore/wasm/WasmSections.h b/Source/JavaScriptCore/wasm/WasmSections.h +index bef20701..b422a587 100644 +--- a/Source/JavaScriptCore/wasm/WasmSections.h ++++ b/Source/JavaScriptCore/wasm/WasmSections.h +@@ -33,20 +33,21 @@ IGNORE_RETURN_TYPE_WARNINGS_BEGIN + + namespace JSC { namespace Wasm { + ++// macro(Name, ID, OrderingNumber, Description). + #define FOR_EACH_KNOWN_WASM_SECTION(macro) \ +- macro(Type, 1, "Function signature declarations") \ +- macro(Import, 2, "Import declarations") \ +- macro(Function, 3, "Function declarations") \ +- macro(Table, 4, "Indirect function table and other tables") \ +- macro(Memory, 5, "Memory attributes") \ +- macro(Global, 6, "Global declarations") \ +- macro(Export, 7, "Exports") \ +- macro(Start, 8, "Start function declaration") \ +- macro(Element, 9, "Elements section") \ +- macro(Code, 10, "Function bodies (code)") \ +- macro(Data, 11, "Data segments") \ +- macro(DataCount, 12, "Data count") \ +- macro(Exception, 13, "Exception declarations") \ ++ macro(Type, 1, 1, "Function signature declarations") \ ++ macro(Import, 2, 2, "Import declarations") \ ++ macro(Function, 3, 3, "Function declarations") \ ++ macro(Table, 4, 4, "Indirect function table and other tables") \ ++ macro(Memory, 5, 5, "Memory attributes") \ ++ macro(Global, 6, 7, "Global declarations") \ ++ macro(Export, 7, 8, "Exports") \ ++ macro(Start, 8, 9, "Start function declaration") \ ++ macro(Element, 9, 10, "Elements section") \ ++ macro(Code, 10, 12, "Function bodies (code)") \ ++ macro(Data, 11, 13, "Data segments") \ ++ macro(DataCount, 12, 11, "Data count") \ ++ macro(Exception, 13, 6, "Exception declarations") \ + + enum class Section : uint8_t { + // It's important that Begin is less than every other section number and that Custom is greater. +@@ -54,18 +55,29 @@ enum class Section : uint8_t { + // Also, Begin is not a real section but is used as a marker for validating the ordering + // of sections. + Begin = 0, +-#define DEFINE_WASM_SECTION_ENUM(NAME, ID, DESCRIPTION) NAME = ID, ++#define DEFINE_WASM_SECTION_ENUM(NAME, ID, ORDERING, DESCRIPTION) NAME = ID, + FOR_EACH_KNOWN_WASM_SECTION(DEFINE_WASM_SECTION_ENUM) + #undef DEFINE_WASM_SECTION_ENUM + Custom + }; + static_assert(static_cast<uint8_t>(Section::Begin) < static_cast<uint8_t>(Section::Type), "Begin should come before the first known section."); + ++inline unsigned orderingNumber(Section section) ++{ ++ switch (section) { ++#define ORDERING_OF_SECTION(NAME, ID, ORDERING, DESCRIPTION) case Section::NAME: return ORDERING; ++ FOR_EACH_KNOWN_WASM_SECTION(ORDERING_OF_SECTION) ++#undef VALIDATE_SECTION ++ default: ++ return static_cast<unsigned>(section); ++ } ++} ++ + template<typename Int> + inline bool isKnownSection(Int section) + { + switch (section) { +-#define VALIDATE_SECTION(NAME, ID, DESCRIPTION) case static_cast<Int>(Section::NAME): return true; ++#define VALIDATE_SECTION(NAME, ID, ORDERING, DESCRIPTION) case static_cast<Int>(Section::NAME): return true; + FOR_EACH_KNOWN_WASM_SECTION(VALIDATE_SECTION) + #undef VALIDATE_SECTION + default: +@@ -89,13 +101,7 @@ inline bool decodeSection(uint8_t sectionByte, Section& section) + inline bool validateOrder(Section previousKnown, Section next) + { + ASSERT(isKnownSection(previousKnown) || previousKnown == Section::Begin); +- if (previousKnown == Section::DataCount && next == Section::Code) +- return true; +- if (previousKnown == Section::Exception) +- return next >= Section::Global; +- if (next == Section::Exception) +- return previousKnown <= Section::Memory; +- return static_cast<uint8_t>(previousKnown) < static_cast<uint8_t>(next); ++ return orderingNumber(previousKnown) < orderingNumber(next); + } + + inline const char* makeString(Section section) +@@ -105,7 +111,7 @@ inline const char* makeString(Section section) + return "Begin"; + case Section::Custom: + return "Custom"; +-#define STRINGIFY_SECTION_NAME(NAME, ID, DESCRIPTION) case Section::NAME: return #NAME; ++#define STRINGIFY_SECTION_NAME(NAME, ID, ORDERING, DESCRIPTION) case Section::NAME: return #NAME; + FOR_EACH_KNOWN_WASM_SECTION(STRINGIFY_SECTION_NAME) + #undef STRINGIFY_SECTION_NAME + } +diff --git a/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp b/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp +index fa552eff..25e7e32d 100644 +--- a/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp ++++ b/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp +@@ -161,7 +161,7 @@ auto StreamingParser::parseSectionPayload(Vector<uint8_t>&& data) -> State + { + SectionParser parser(data.data(), data.size(), m_offset, m_info.get()); + switch (m_section) { +-#define WASM_SECTION_PARSE(NAME, ID, DESCRIPTION) \ ++#define WASM_SECTION_PARSE(NAME, ID, ORDERING, DESCRIPTION) \ + case Section::NAME: { \ + WASM_STREAMING_PARSER_FAIL_IF_HELPER_FAILS(parser.parse ## NAME()); \ + break; \ +@@ -393,9 +393,18 @@ auto StreamingParser::finalize() -> State + m_state = fail("Number of functions parsed (", m_functionCount, ") does not match the number of declared functions (", m_info->functions.size(), ")"); + break; + } ++ ++ if (m_info->numberOfDataSegments) { ++ if (UNLIKELY(m_info->data.size() != m_info->numberOfDataSegments.value())) { ++ m_state = fail("Data section's count ", m_info->data.size(), " is different from Data Count section's count ", m_info->numberOfDataSegments.value()); ++ break; ++ } ++ } ++ + if (m_remaining.isEmpty()) { + if (UNLIKELY(Options::useEagerWebAssemblyModuleHashing())) + m_info->nameSection->setHash(m_hasher.computeHexDigest()); ++ + m_state = State::Finished; + m_client.didFinishParsing(); + } else +-- +2.40.0 diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2023-23529.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2023-23529.patch new file mode 100644 index 0000000000..f2e9808ab4 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2023-23529.patch @@ -0,0 +1,65 @@ +CVE: CVE-2023-23529 +Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/6cc943c] + +With the help from webkit maillist, backport and rebase patch to fix +CVE-2023-23529. + +https://lists.webkit.org/pipermail/webkit-gtk/2023-August/003931.html + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From 6cc943c3323a1a1368934c812e5e8ec08f54dcd4 Mon Sep 17 00:00:00 2001 +From: Yusuke Suzuki <ysuzuki@apple.com> +Date: Fri, 17 Feb 2023 10:39:19 -0800 +Subject: [PATCH] Cherry-pick 259548.63@safari-7615-branch (1b2eb138ef92). + rdar://105598149 + + [JSC] ToThis object folding should check if AbstractValue is always an object + https://bugs.webkit.org/show_bug.cgi?id=251944 + rdar://105175786 + + Reviewed by Geoffrey Garen and Mark Lam. + + ToThis can become Identity for strict mode if it is just primitive values or its object does not have toThis function overriding. + This is correct, but folding ToThis to Undefined etc. (not Identity) needs to check that an input only contains objects. + This patch adds appropriate checks to prevent from converting ToThis(GlobalObject | Int32) to Undefined for example. + + * Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h: + (JSC::DFG::isToThisAnIdentity): + + Canonical link: https://commits.webkit.org/259548.63@safari-7615-branch + +Canonical link: https://commits.webkit.org/260455@main +--- + .../JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h +index 928328ffab826..82481455e651d 100644 +--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h ++++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h +@@ -209,7 +209,8 @@ inline ToThisResult isToThisAnIdentity(VM& vm, ECMAMode ecmaMode, AbstractValue& + } + } + +- if ((ecmaMode.isStrict() || (valueForNode.m_type && !(valueForNode.m_type & ~SpecObject))) && valueForNode.m_structure.isFinite()) { ++ bool onlyObjects = valueForNode.m_type && !(valueForNode.m_type & ~SpecObject); ++ if ((ecmaMode.isStrict() || onlyObjects) && valueForNode.m_structure.isFinite()) { + bool allStructuresAreJSScope = !valueForNode.m_structure.isClear(); + bool overridesToThis = false; + valueForNode.m_structure.forEach([&](RegisteredStructure structure) { +@@ -226,9 +227,13 @@ inline ToThisResult isToThisAnIdentity(VM& vm, ECMAMode ecmaMode, AbstractValue& + // If all the structures are JSScope's ones, we know the details of JSScope::toThis() operation. + allStructuresAreJSScope &= structure->classInfo()->methodTable.toThis == JSScope::info()->methodTable.toThis; + }); ++ ++ // This is correct for strict mode even if this can have non objects, since the right semantics is Identity. + if (!overridesToThis) + return ToThisResult::Identity; +- if (allStructuresAreJSScope) { ++ ++ // But this folding is available only if input is always an object. ++ if (onlyObjects && allStructuresAreJSScope) { + if (ecmaMode.isStrict()) + return ToThisResult::Undefined; + return ToThisResult::GlobalThis; diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2023-32439.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2023-32439.patch new file mode 100644 index 0000000000..f8d7b613fa --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2023-32439.patch @@ -0,0 +1,127 @@ +From ebefb9e6b7e7440ab6bb29452f4ac6350bd8b975 Mon Sep 17 00:00:00 2001 +From: Yijia Huang <yijia_huang@apple.com> +Date: Tue, 26 Sep 2023 09:23:31 +0000 +Subject: [PATCH] Cherry-pick 263909@main (52fe95e5805c). + https://bugs.webkit.org/show_bug.cgi?id=256567 + + EnumeratorNextUpdateIndexAndMode and HasIndexedProperty should have different heap location kinds + https://bugs.webkit.org/show_bug.cgi?id=256567 + rdar://109089013 + + Reviewed by Yusuke Suzuki. + + EnumeratorNextUpdateIndexAndMode and HasIndexedProperty are different DFG nodes. However, + they might introduce the same heap location kind in DFGClobberize.h which might lead to + hash collision. We should introduce a new locationn kind for EnumeratorNextUpdateIndexAndMode. + + * JSTests/stress/heap-location-collision-dfg-clobberize.js: Added. + (foo): + * Source/JavaScriptCore/dfg/DFGClobberize.h: + (JSC::DFG::clobberize): + * Source/JavaScriptCore/dfg/DFGHeapLocation.cpp: + (WTF::printInternal): + * Source/JavaScriptCore/dfg/DFGHeapLocation.h: + + Canonical link: https://commits.webkit.org/263909@main + +Canonical link: https://commits.webkit.org/260527.376@webkitglib/2.40 + +CVE: CVE-2023-32439 + +Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/ebefb9e] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + .../stress/heap-location-collision-dfg-clobberize.js | 12 ++++++++++++ + Source/JavaScriptCore/dfg/DFGClobberize.h | 7 ++++--- + Source/JavaScriptCore/dfg/DFGHeapLocation.cpp | 4 ++++ + Source/JavaScriptCore/dfg/DFGHeapLocation.h | 1 + + 4 files changed, 21 insertions(+), 3 deletions(-) + create mode 100644 JSTests/stress/heap-location-collision-dfg-clobberize.js + +diff --git a/JSTests/stress/heap-location-collision-dfg-clobberize.js b/JSTests/stress/heap-location-collision-dfg-clobberize.js +new file mode 100644 +index 00000000..ed40601e +--- /dev/null ++++ b/JSTests/stress/heap-location-collision-dfg-clobberize.js +@@ -0,0 +1,12 @@ ++//@ runDefault("--watchdog=300", "--watchdog-exception-ok") ++const arr = [0]; ++ ++function foo() { ++ for (let _ in arr) { ++ 0 in arr; ++ while(1); ++ } ++} ++ ++ ++foo(); +diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h +index f96e21d2..af3e864b 100644 +--- a/Source/JavaScriptCore/dfg/DFGClobberize.h ++++ b/Source/JavaScriptCore/dfg/DFGClobberize.h +@@ -371,6 +371,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu + + read(JSObject_butterfly); + ArrayMode mode = node->arrayMode(); ++ LocationKind locationKind = node->op() == EnumeratorNextUpdateIndexAndMode ? EnumeratorNextUpdateIndexAndModeLoc : HasIndexedPropertyLoc; + switch (mode.type()) { + case Array::ForceExit: { + write(SideState); +@@ -380,7 +381,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu + if (mode.isInBounds()) { + read(Butterfly_publicLength); + read(IndexedInt32Properties); +- def(HeapLocation(HasIndexedPropertyLoc, IndexedInt32Properties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node)); ++ def(HeapLocation(locationKind, IndexedInt32Properties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node)); + return; + } + break; +@@ -390,7 +391,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu + if (mode.isInBounds()) { + read(Butterfly_publicLength); + read(IndexedDoubleProperties); +- def(HeapLocation(HasIndexedPropertyLoc, IndexedDoubleProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node)); ++ def(HeapLocation(locationKind, IndexedDoubleProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node)); + return; + } + break; +@@ -400,7 +401,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu + if (mode.isInBounds()) { + read(Butterfly_publicLength); + read(IndexedContiguousProperties); +- def(HeapLocation(HasIndexedPropertyLoc, IndexedContiguousProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node)); ++ def(HeapLocation(locationKind, IndexedContiguousProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node)); + return; + } + break; +diff --git a/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp b/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp +index 0661e5b8..698a6d4b 100644 +--- a/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp ++++ b/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp +@@ -134,6 +134,10 @@ void printInternal(PrintStream& out, LocationKind kind) + out.print("HasIndexedPorpertyLoc"); + return; + ++ case EnumeratorNextUpdateIndexAndModeLoc: ++ out.print("EnumeratorNextUpdateIndexAndModeLoc"); ++ return; ++ + case IndexedPropertyDoubleLoc: + out.print("IndexedPropertyDoubleLoc"); + return; +diff --git a/Source/JavaScriptCore/dfg/DFGHeapLocation.h b/Source/JavaScriptCore/dfg/DFGHeapLocation.h +index 40fb7167..7238491b 100644 +--- a/Source/JavaScriptCore/dfg/DFGHeapLocation.h ++++ b/Source/JavaScriptCore/dfg/DFGHeapLocation.h +@@ -46,6 +46,7 @@ enum LocationKind { + DirectArgumentsLoc, + GetterLoc, + GlobalVariableLoc, ++ EnumeratorNextUpdateIndexAndModeLoc, + HasIndexedPropertyLoc, + IndexedPropertyDoubleLoc, + IndexedPropertyDoubleSaneChainLoc, +-- +2.40.0 diff --git a/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb b/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb index 7b2c5c6e36..f4b8456749 100644 --- a/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb +++ b/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb @@ -15,6 +15,15 @@ SRC_URI = "https://www.webkitgtk.org/releases/${BP}.tar.xz \ file://0001-Fix-build-without-opengl-or-es.patch \ file://reproducibility.patch \ file://0001-When-building-introspection-files-do-not-quote-CFLAG.patch \ + file://CVE-2022-32888.patch \ + file://CVE-2022-32923.patch \ + file://CVE-2022-46691.patch \ + file://CVE-2022-46699.patch \ + file://CVE-2022-42867.patch \ + file://CVE-2022-46700.patch \ + file://CVE-2023-23529.patch \ + file://CVE-2022-48503.patch \ + file://CVE-2023-32439.patch \ " SRC_URI[sha256sum] = "0ad9fb6bf28308fe3889faf184bd179d13ac1b46835d2136edbab2c133d00437" diff --git a/meta/recipes-sato/webkit/wpebackend-fdo_1.14.0.bb b/meta/recipes-sato/webkit/wpebackend-fdo_1.14.2.bb index 708201043b..b3d7b229c8 100644 --- a/meta/recipes-sato/webkit/wpebackend-fdo_1.14.0.bb +++ b/meta/recipes-sato/webkit/wpebackend-fdo_1.14.2.bb @@ -13,7 +13,7 @@ inherit meson features_check pkgconfig REQUIRED_DISTRO_FEATURES = "opengl" SRC_URI = "https://wpewebkit.org/releases/${BPN}-${PV}.tar.xz" -SRC_URI[sha256sum] = "e75b0cb2c7145448416e8696013d8883f675c66c11ed750e06865efec5809155" +SRC_URI[sha256sum] = "93c9766ae9864eeaeaee2b0a74f22cbca08df42c1a1bdb55b086f2528e380d38" # Especially helps compiling with clang which enable this as error when # using c++11 diff --git a/meta/recipes-support/apr/apr-util/0001-Fix-error-handling-in-gdbm.patch b/meta/recipes-support/apr/apr-util/0001-Fix-error-handling-in-gdbm.patch deleted file mode 100644 index 6f27876a7f..0000000000 --- a/meta/recipes-support/apr/apr-util/0001-Fix-error-handling-in-gdbm.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 6b638fa9afbeb54dfa19378e391465a5284ce1ad Mon Sep 17 00:00:00 2001 -From: Changqing Li <changqing.li@windriver.com> -Date: Wed, 12 Sep 2018 17:16:36 +0800 -Subject: [PATCH] Fix error handling in gdbm - -Only check for gdbm_errno if the return value of the called gdbm_* -function says so. This fixes apr-util with gdbm 1.14, which does not -seem to always reset gdbm_errno. - -Also make the gdbm driver return error codes starting with -APR_OS_START_USEERR instead of always returning APR_EGENERAL. This is -what the berkleydb driver already does. - -Also ensure that dsize is 0 if dptr == NULL. - -Upstream-Status: Backport [https://svn.apache.org/viewvc?view=revision&revision=1825311] - -Signed-off-by: Changqing Li <changqing.li@windriver.com> ---- - dbm/apr_dbm_gdbm.c | 47 +++++++++++++++++++++++++++++------------------ - 1 file changed, 29 insertions(+), 18 deletions(-) - -diff --git a/dbm/apr_dbm_gdbm.c b/dbm/apr_dbm_gdbm.c -index 749447a..1c86327 100644 ---- a/dbm/apr_dbm_gdbm.c -+++ b/dbm/apr_dbm_gdbm.c -@@ -36,13 +36,25 @@ - static apr_status_t g2s(int gerr) - { - if (gerr == -1) { -- /* ### need to fix this */ -- return APR_EGENERAL; -+ if (gdbm_errno == GDBM_NO_ERROR) -+ return APR_SUCCESS; -+ return APR_OS_START_USEERR + gdbm_errno; - } - - return APR_SUCCESS; - } - -+static apr_status_t gdat2s(datum d) -+{ -+ if (d.dptr == NULL) { -+ if (gdbm_errno == GDBM_NO_ERROR || gdbm_errno == GDBM_ITEM_NOT_FOUND) -+ return APR_SUCCESS; -+ return APR_OS_START_USEERR + gdbm_errno; -+ } -+ -+ return APR_SUCCESS; -+} -+ - static apr_status_t datum_cleanup(void *dptr) - { - if (dptr) -@@ -53,22 +65,15 @@ static apr_status_t datum_cleanup(void *dptr) - - static apr_status_t set_error(apr_dbm_t *dbm, apr_status_t dbm_said) - { -- apr_status_t rv = APR_SUCCESS; - -- /* ### ignore whatever the DBM said (dbm_said); ask it explicitly */ -+ dbm->errcode = dbm_said; - -- if ((dbm->errcode = gdbm_errno) == GDBM_NO_ERROR) { -+ if (dbm_said == APR_SUCCESS) - dbm->errmsg = NULL; -- } -- else { -- dbm->errmsg = gdbm_strerror(gdbm_errno); -- rv = APR_EGENERAL; /* ### need something better */ -- } -- -- /* captured it. clear it now. */ -- gdbm_errno = GDBM_NO_ERROR; -+ else -+ dbm->errmsg = gdbm_strerror(dbm_said - APR_OS_START_USEERR); - -- return rv; -+ return dbm_said; - } - - /* -------------------------------------------------------------------------- -@@ -107,7 +112,7 @@ static apr_status_t vt_gdbm_open(apr_dbm_t **pdb, const char *pathname, - NULL); - - if (file == NULL) -- return APR_EGENERAL; /* ### need a better error */ -+ return APR_OS_START_USEERR + gdbm_errno; /* ### need a better error */ - - /* we have an open database... return it */ - *pdb = apr_pcalloc(pool, sizeof(**pdb)); -@@ -141,10 +146,12 @@ static apr_status_t vt_gdbm_fetch(apr_dbm_t *dbm, apr_datum_t key, - if (pvalue->dptr) - apr_pool_cleanup_register(dbm->pool, pvalue->dptr, datum_cleanup, - apr_pool_cleanup_null); -+ else -+ pvalue->dsize = 0; - - /* store the error info into DBM, and return a status code. Also, note - that *pvalue should have been cleared on error. */ -- return set_error(dbm, APR_SUCCESS); -+ return set_error(dbm, gdat2s(rd)); - } - - static apr_status_t vt_gdbm_store(apr_dbm_t *dbm, apr_datum_t key, -@@ -201,9 +208,11 @@ static apr_status_t vt_gdbm_firstkey(apr_dbm_t *dbm, apr_datum_t *pkey) - if (pkey->dptr) - apr_pool_cleanup_register(dbm->pool, pkey->dptr, datum_cleanup, - apr_pool_cleanup_null); -+ else -+ pkey->dsize = 0; - - /* store any error info into DBM, and return a status code. */ -- return set_error(dbm, APR_SUCCESS); -+ return set_error(dbm, gdat2s(rd)); - } - - static apr_status_t vt_gdbm_nextkey(apr_dbm_t *dbm, apr_datum_t *pkey) -@@ -221,9 +230,11 @@ static apr_status_t vt_gdbm_nextkey(apr_dbm_t *dbm, apr_datum_t *pkey) - if (pkey->dptr) - apr_pool_cleanup_register(dbm->pool, pkey->dptr, datum_cleanup, - apr_pool_cleanup_null); -+ else -+ pkey->dsize = 0; - - /* store any error info into DBM, and return a status code. */ -- return set_error(dbm, APR_SUCCESS); -+ return set_error(dbm, gdat2s(rd)); - } - - static void vt_gdbm_freedatum(apr_dbm_t *dbm, apr_datum_t data) --- -2.7.4 - diff --git a/meta/recipes-support/apr/apr-util_1.6.1.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb index b851d46351..7c6fcc699b 100644 --- a/meta/recipes-support/apr/apr-util_1.6.1.bb +++ b/meta/recipes-support/apr/apr-util_1.6.3.bb @@ -13,11 +13,9 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \ file://configfix.patch \ file://configure_fixes.patch \ file://run-ptest \ - file://0001-Fix-error-handling-in-gdbm.patch \ -" + " -SRC_URI[md5sum] = "bd502b9a8670a8012c4d90c31a84955f" -SRC_URI[sha256sum] = "b65e40713da57d004123b6319828be7f1273fbc6490e145874ee1177e112c459" +SRC_URI[sha256sum] = "2b74d8932703826862ca305b094eef2983c27b39d5c9414442e9976a9acf1983" EXTRA_OECONF = "--with-apr=${STAGING_BINDIR_CROSS}/apr-1-config \ --without-odbc \ diff --git a/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch b/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch index abff4e9331..a274f3a16e 100644 --- a/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch +++ b/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch @@ -1,14 +1,15 @@ -From 2bbe20b4f69e84e7a18bc79d382486953f479328 Mon Sep 17 00:00:00 2001 +From 225abf37cd0b49960664b59f08e515a4c4ea5ad0 Mon Sep 17 00:00:00 2001 From: Jeremy Puhlman <jpuhlman@mvista.com> Date: Thu, 26 Mar 2020 18:30:36 +0000 Subject: [PATCH] Add option to disable timed dependant tests -The disabled tests rely on timing to pass correctly. On a virtualized +The disabled tests rely on timing to pass correctly. On a virtualized system under heavy load, these tests randomly fail because they miss a timer or other timing related issues. Upstream-Status: Pending Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> + --- configure.in | 6 ++++++ include/apr.h.in | 1 + @@ -16,10 +17,10 @@ Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/configure.in b/configure.in -index d9f32d6..f0c5661 100644 +index bfd488b..3663220 100644 --- a/configure.in +++ b/configure.in -@@ -2886,6 +2886,12 @@ AC_ARG_ENABLE(timedlocks, +@@ -3023,6 +3023,12 @@ AC_ARG_ENABLE(timedlocks, ) AC_SUBST(apr_has_timedlocks) @@ -45,10 +46,10 @@ index ee99def..c46a5f4 100644 #define APR_PROCATTR_USER_SET_REQUIRES_PASSWORD @apr_procattr_user_set_requires_password@ diff --git a/test/testlock.c b/test/testlock.c -index a43f477..6233d0b 100644 +index e3437c1..04e01b9 100644 --- a/test/testlock.c +++ b/test/testlock.c -@@ -396,13 +396,13 @@ abts_suite *testlock(abts_suite *suite) +@@ -535,7 +535,7 @@ abts_suite *testlock(abts_suite *suite) abts_run_test(suite, threads_not_impl, NULL); #else abts_run_test(suite, test_thread_mutex, NULL); @@ -56,6 +57,8 @@ index a43f477..6233d0b 100644 +#if APR_HAS_TIMEDLOCKS && APR_HAVE_TIME_DEPENDANT_TESTS abts_run_test(suite, test_thread_timedmutex, NULL); #endif + abts_run_test(suite, test_thread_nestedmutex, NULL); +@@ -543,7 +543,7 @@ abts_suite *testlock(abts_suite *suite) abts_run_test(suite, test_thread_rwlock, NULL); abts_run_test(suite, test_cond, NULL); abts_run_test(suite, test_timeoutcond, NULL); @@ -63,7 +66,4 @@ index a43f477..6233d0b 100644 +#if APR_HAS_TIMEDLOCKS && APR_HAVE_TIME_DEPENDANT_TESTS abts_run_test(suite, test_timeoutmutex, NULL); #endif - #endif --- -2.23.0 - + #ifdef WIN32 diff --git a/meta/recipes-support/apr/apr/0001-add-AC_CACHE_CHECK-for-strerror_r-return-type.patch b/meta/recipes-support/apr/apr/0001-add-AC_CACHE_CHECK-for-strerror_r-return-type.patch deleted file mode 100644 index d0a9bd9129..0000000000 --- a/meta/recipes-support/apr/apr/0001-add-AC_CACHE_CHECK-for-strerror_r-return-type.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 8ca3c3306f1a149e51a3be6a4b1e47e9aee88262 Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@gmail.com> -Date: Tue, 23 Aug 2022 22:42:03 -0700 -Subject: [PATCH] add AC_CACHE_CHECK for strerror_r return type - -APR's configure script uses AC_TRY_RUN to detect whether the return type -of strerror_r is int. When cross-compiling this defaults to no. - -This commit adds an AC_CACHE_CHECK so users who cross-compile APR may -influence the outcome with a configure variable. - -Upstream-Status: Backport [https://svn.apache.org/viewvc?view=revision&revision=1875065] -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - build/apr_common.m4 | 11 ++++------- - 1 file changed, 4 insertions(+), 7 deletions(-) - -diff --git a/build/apr_common.m4 b/build/apr_common.m4 -index cbf2a4c..42e75cf 100644 ---- a/build/apr_common.m4 -+++ b/build/apr_common.m4 -@@ -525,8 +525,9 @@ dnl string. - dnl - dnl - AC_DEFUN([APR_CHECK_STRERROR_R_RC], [ --AC_MSG_CHECKING(for type of return code from strerror_r) --AC_TRY_RUN([ -+AC_CACHE_CHECK([whether return code from strerror_r has type int], -+[ac_cv_strerror_r_rc_int], -+[AC_TRY_RUN([ - #include <errno.h> - #include <string.h> - #include <stdio.h> -@@ -542,14 +543,10 @@ main() - }], [ - ac_cv_strerror_r_rc_int=yes ], [ - ac_cv_strerror_r_rc_int=no ], [ -- ac_cv_strerror_r_rc_int=no ] ) -+ ac_cv_strerror_r_rc_int=no ] ) ] ) - if test "x$ac_cv_strerror_r_rc_int" = xyes; then - AC_DEFINE(STRERROR_R_RC_INT, 1, [Define if strerror returns int]) -- msg="int" --else -- msg="pointer" - fi --AC_MSG_RESULT([$msg]) - ] ) - - dnl --- -2.37.2 - diff --git a/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch b/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch index fa6202da79..a78b16284f 100644 --- a/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch +++ b/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch @@ -1,4 +1,4 @@ -From ee728971fd9d2da39356f1574d58d5daa3b24520 Mon Sep 17 00:00:00 2001 +From 316b81c462f065927d7fec56aadd5c8cb94d1cf0 Mon Sep 17 00:00:00 2001 From: Khem Raj <raj.khem@gmail.com> Date: Fri, 26 Aug 2022 00:28:08 -0700 Subject: [PATCH] configure: Remove runtime test for mmap that can map @@ -10,24 +10,25 @@ mutexes Upstream-Status: Inappropriate [Cross-compile specific] Signed-off-by: Khem Raj <raj.khem@gmail.com> + --- - configure.in | 32 -------------------------------- - 1 file changed, 32 deletions(-) + configure.in | 30 ------------------------------ + 1 file changed, 30 deletions(-) diff --git a/configure.in b/configure.in -index a99049d..f1f55c7 100644 +index 3663220..dce9789 100644 --- a/configure.in +++ b/configure.in -@@ -1182,38 +1182,6 @@ AC_CHECK_FUNCS([mmap munmap shm_open shm_unlink shmget shmat shmdt shmctl \ +@@ -1303,36 +1303,6 @@ AC_CHECK_FUNCS([mmap munmap shm_open shm_unlink shmget shmat shmdt shmctl \ APR_CHECK_DEFINE(MAP_ANON, sys/mman.h) AC_CHECK_FILE(/dev/zero) -# Not all systems can mmap /dev/zero (such as HP-UX). Check for that. -if test "$ac_cv_func_mmap" = "yes" && -- test "$ac_cv_file__dev_zero" = "yes"; then -- AC_MSG_CHECKING(for mmap that can map /dev/zero) -- AC_TRY_RUN([ --#include <sys/types.h> +- test "$ac_cv_file__dev_zero" = "yes"; then +- AC_CACHE_CHECK([for mmap that can map /dev/zero], +- [ac_cv_mmap__dev_zero], +- [AC_TRY_RUN([#include <sys/types.h> -#include <sys/stat.h> -#include <fcntl.h> -#ifdef HAVE_SYS_MMAN_H @@ -49,14 +50,9 @@ index a99049d..f1f55c7 100644 - return 3; - } - return 0; -- }], [], [ac_cv_file__dev_zero=no], [ac_cv_file__dev_zero=no]) -- -- AC_MSG_RESULT($ac_cv_file__dev_zero) +- }], [], [ac_cv_file__dev_zero=no], [ac_cv_file__dev_zero=no])]) -fi - # Now we determine which one is our anonymous shmem preference. haveshmgetanon="0" havemmapzero="0" --- -2.37.2 - diff --git a/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch b/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch index 72e706f966..d63423f3a1 100644 --- a/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch +++ b/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch @@ -1,8 +1,7 @@ -From 5925b20da8bbc34d9bf5a5dca123ef38864d43c6 Mon Sep 17 00:00:00 2001 +From 689a8db96a6d1e1cae9cbfb35d05ac82140a6555 Mon Sep 17 00:00:00 2001 From: Hongxu Jia <hongxu.jia@windriver.com> Date: Tue, 30 Jan 2018 09:39:06 +0800 -Subject: [PATCH 2/7] apr: Remove workdir path references from installed apr - files +Subject: [PATCH] apr: Remove workdir path references from installed apr files Upstream-Status: Inappropriate [configuration] @@ -14,20 +13,23 @@ packages at target run time, the workdir path caused confusion. Rebase to 1.6.3 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> + --- - apr-config.in | 26 ++------------------------ - 1 file changed, 2 insertions(+), 24 deletions(-) + apr-config.in | 32 ++------------------------------ + 1 file changed, 2 insertions(+), 30 deletions(-) diff --git a/apr-config.in b/apr-config.in -index 84b4073..bbbf651 100644 +index bed47ca..47874e5 100644 --- a/apr-config.in +++ b/apr-config.in -@@ -152,14 +152,7 @@ while test $# -gt 0; do +@@ -164,16 +164,7 @@ while test $# -gt 0; do flags="$flags $LDFLAGS" ;; --includes) - if test "$location" = "installed"; then flags="$flags -I$includedir $EXTRA_INCLUDES" +- elif test "$location" = "crosscompile"; then +- flags="$flags -I$APR_TARGET_DIR/$includedir $EXTRA_INCLUDES" - elif test "$location" = "source"; then - flags="$flags -I$APR_SOURCE_DIR/include $EXTRA_INCLUDES" - else @@ -37,13 +39,15 @@ index 84b4073..bbbf651 100644 ;; --srcdir) echo $APR_SOURCE_DIR -@@ -181,29 +174,14 @@ while test $# -gt 0; do +@@ -197,33 +188,14 @@ while test $# -gt 0; do exit 0 ;; --link-ld) - if test "$location" = "installed"; then - ### avoid using -L if libdir is a "standard" location like /usr/lib - flags="$flags -L$libdir -l${APR_LIBNAME}" +- elif test "$location" = "crosscompile"; then +- flags="$flags -L$APR_TARGET_DIR/$libdir -l${APR_LIBNAME}" - else - ### this surely can't work since the library is in .libs? - flags="$flags -L$APR_BUILD_DIR -l${APR_LIBNAME}" @@ -62,6 +66,8 @@ index 84b4073..bbbf651 100644 - # Since the user is specifying they are linking with libtool, we - # *know* that -R will be recognized by libtool. - flags="$flags -L$libdir -R$libdir -l${APR_LIBNAME}" +- elif test "$location" = "crosscompile"; then +- flags="$flags -L${APR_TARGET_DIR}/$libdir -l${APR_LIBNAME}" - else - flags="$flags $LA_FILE" - fi @@ -69,6 +75,3 @@ index 84b4073..bbbf651 100644 ;; --shlib-path-var) echo "$SHLIBPATH_VAR" --- -1.8.3.1 - diff --git a/meta/recipes-support/apr/apr/0003-Makefile.in-configure.in-support-cross-compiling.patch b/meta/recipes-support/apr/apr/0003-Makefile.in-configure.in-support-cross-compiling.patch deleted file mode 100644 index 4dd53bd8eb..0000000000 --- a/meta/recipes-support/apr/apr/0003-Makefile.in-configure.in-support-cross-compiling.patch +++ /dev/null @@ -1,63 +0,0 @@ -From d5028c10f156c224475b340cfb1ba025d6797243 Mon Sep 17 00:00:00 2001 -From: Hongxu Jia <hongxu.jia@windriver.com> -Date: Fri, 2 Feb 2018 15:51:42 +0800 -Subject: [PATCH 3/7] Makefile.in/configure.in: support cross compiling - -While cross compiling, the tools/gen_test_char could not -be executed at build time, use AX_PROG_CC_FOR_BUILD to -build native tools/gen_test_char - -Upstream-Status: Submitted [https://github.com/apache/apr/pull/8] - -Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> ---- - Makefile.in | 10 +++------- - configure.in | 3 +++ - 2 files changed, 6 insertions(+), 7 deletions(-) - -diff --git a/Makefile.in b/Makefile.in -index 5fb760e..8675f90 100644 ---- a/Makefile.in -+++ b/Makefile.in -@@ -46,7 +46,7 @@ LT_VERSION = @LT_VERSION@ - - CLEAN_TARGETS = apr-config.out apr.exp exports.c export_vars.c .make.dirs \ - build/apr_rules.out tools/gen_test_char@EXEEXT@ \ -- tools/gen_test_char.o tools/gen_test_char.lo \ -+ tools/gen_test_char.o \ - include/private/apr_escape_test_char.h - DISTCLEAN_TARGETS = config.cache config.log config.status \ - include/apr.h include/arch/unix/apr_private.h \ -@@ -131,13 +131,9 @@ check: $(TARGET_LIB) - etags: - etags `find . -name '*.[ch]'` - --OBJECTS_gen_test_char = tools/gen_test_char.lo $(LOCAL_LIBS) --tools/gen_test_char.lo: tools/gen_test_char.c -+tools/gen_test_char@EXEEXT@: tools/gen_test_char.c - $(APR_MKDIR) tools -- $(LT_COMPILE) -- --tools/gen_test_char@EXEEXT@: $(OBJECTS_gen_test_char) -- $(LINK_PROG) $(OBJECTS_gen_test_char) $(ALL_LIBS) -+ $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $< -o $@ - - include/private/apr_escape_test_char.h: tools/gen_test_char@EXEEXT@ - $(APR_MKDIR) include/private -diff --git a/configure.in b/configure.in -index 719f331..361120f 100644 ---- a/configure.in -+++ b/configure.in -@@ -183,6 +183,9 @@ dnl can only be used once within a configure script, so this prevents a - dnl preload section from invoking the macro to get compiler info. - AC_PROG_CC - -+dnl Check build CC for gen_test_char compiling which is executed at build time. -+AX_PROG_CC_FOR_BUILD -+ - dnl AC_PROG_SED is only avaliable in recent autoconf versions. - dnl Use AC_CHECK_PROG instead if AC_PROG_SED is not present. - ifdef([AC_PROG_SED], --- -1.8.3.1 - diff --git a/meta/recipes-support/apr/apr/0006-apr-fix-off_t-size-doesn-t-match-in-glibc-when-cross.patch b/meta/recipes-support/apr/apr/0006-apr-fix-off_t-size-doesn-t-match-in-glibc-when-cross.patch deleted file mode 100644 index d1a2ebe881..0000000000 --- a/meta/recipes-support/apr/apr/0006-apr-fix-off_t-size-doesn-t-match-in-glibc-when-cross.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 49661ea3858cf8494926cccf57d3e8c6dcb47117 Mon Sep 17 00:00:00 2001 -From: Dengke Du <dengke.du@windriver.com> -Date: Wed, 14 Dec 2016 18:13:08 +0800 -Subject: [PATCH] apr: fix off_t size doesn't match in glibc when cross - compiling - -In configure.in, it contains the following: - - APR_CHECK_SIZEOF_EXTENDED([#include <sys/types.h>], off_t, 8) - -the macro "APR_CHECK_SIZEOF_EXTENDED" was defined in build/apr_common.m4, -it use the "AC_TRY_RUN" macro, this macro let the off_t to 8, when cross -compiling enable. - -So it was hardcoded for cross compiling, we should detect it dynamic based on -the sysroot's glibc. We change it to the following: - - AC_CHECK_SIZEOF(off_t) - -The same for the following hardcoded types for cross compiling: - - pid_t 8 - ssize_t 8 - size_t 8 - off_t 8 - -Change the above correspondingly. - -Signed-off-by: Dengke Du <dengke.du@windriver.com> - -Upstream-Status: Pending - ---- - configure.in | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/configure.in b/configure.in -index 27b8539..fb408d1 100644 ---- a/configure.in -+++ b/configure.in -@@ -1801,7 +1801,7 @@ else - socklen_t_value="int" - fi - --APR_CHECK_SIZEOF_EXTENDED([#include <sys/types.h>], pid_t, 8) -+AC_CHECK_SIZEOF(pid_t) - - if test "$ac_cv_sizeof_pid_t" = "$ac_cv_sizeof_short"; then - pid_t_fmt='#define APR_PID_T_FMT "hd"' -@@ -1873,7 +1873,7 @@ APR_CHECK_TYPES_FMT_COMPATIBLE(size_t, unsigned long, lu, [size_t_fmt="lu"], [ - APR_CHECK_TYPES_FMT_COMPATIBLE(size_t, unsigned int, u, [size_t_fmt="u"]) - ]) - --APR_CHECK_SIZEOF_EXTENDED([#include <sys/types.h>], ssize_t, 8) -+AC_CHECK_SIZEOF(ssize_t) - - dnl the else cases below should no longer occur; - AC_MSG_CHECKING([which format to use for apr_ssize_t]) -@@ -1891,7 +1891,7 @@ fi - - ssize_t_fmt="#define APR_SSIZE_T_FMT \"$ssize_t_fmt\"" - --APR_CHECK_SIZEOF_EXTENDED([#include <stddef.h>], size_t, 8) -+AC_CHECK_SIZEOF(size_t) - - # else cases below should no longer occur; - AC_MSG_CHECKING([which format to use for apr_size_t]) -@@ -1909,7 +1909,7 @@ fi - - size_t_fmt="#define APR_SIZE_T_FMT \"$size_t_fmt\"" - --APR_CHECK_SIZEOF_EXTENDED([#include <sys/types.h>], off_t, 8) -+AC_CHECK_SIZEOF(off_t) - - if test "${ac_cv_sizeof_off_t}${apr_cv_use_lfs64}" = "4yes"; then - # Enable LFS diff --git a/meta/recipes-support/apr/apr/CVE-2021-35940.patch b/meta/recipes-support/apr/apr/CVE-2021-35940.patch deleted file mode 100644 index 00befdacee..0000000000 --- a/meta/recipes-support/apr/apr/CVE-2021-35940.patch +++ /dev/null @@ -1,58 +0,0 @@ - -SECURITY: CVE-2021-35940 (cve.mitre.org) - -Restore fix for CVE-2017-12613 which was missing in 1.7.x branch, though -was addressed in 1.6.x in 1.6.3 and later via r1807976. - -The fix was merged back to 1.7.x in r1891198. - -Since this was a regression in 1.7.0, a new CVE name has been assigned -to track this, CVE-2021-35940. - -Thanks to Iveta Cesalova <icesalov redhat.com> for reporting this issue. - -https://svn.apache.org/viewvc?view=revision&revision=1891198 - -Upstream-Status: Backport -CVE: CVE-2021-35940 -Signed-off-by: Armin Kuster <akuster@mvista.com> - - -Index: time/unix/time.c -=================================================================== ---- a/time/unix/time.c (revision 1891197) -+++ b/time/unix/time.c (revision 1891198) -@@ -142,6 +142,9 @@ - static const int dayoffset[12] = - {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275}; - -+ if (xt->tm_mon < 0 || xt->tm_mon >= 12) -+ return APR_EBADDATE; -+ - /* shift new year to 1st March in order to make leap year calc easy */ - - if (xt->tm_mon < 2) -Index: time/win32/time.c -=================================================================== ---- a/time/win32/time.c (revision 1891197) -+++ b/time/win32/time.c (revision 1891198) -@@ -54,6 +54,9 @@ - static const int dayoffset[12] = - {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334}; - -+ if (tm->wMonth < 1 || tm->wMonth > 12) -+ return APR_EBADDATE; -+ - /* Note; the caller is responsible for filling in detailed tm_usec, - * tm_gmtoff and tm_isdst data when applicable. - */ -@@ -228,6 +231,9 @@ - static const int dayoffset[12] = - {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275}; - -+ if (xt->tm_mon < 0 || xt->tm_mon >= 12) -+ return APR_EBADDATE; -+ - /* shift new year to 1st March in order to make leap year calc easy */ - - if (xt->tm_mon < 2) diff --git a/meta/recipes-support/apr/apr/autoconf270.patch b/meta/recipes-support/apr/apr/autoconf270.patch deleted file mode 100644 index 9f7b5c624c..0000000000 --- a/meta/recipes-support/apr/apr/autoconf270.patch +++ /dev/null @@ -1,22 +0,0 @@ -With autoconf 2.70 confdefs.h is already included. Including it twice generates -compiler warnings and since this macros is to error on warnings, it breaks. - -Fix by not including the file. - -Upstream-Status: Pending -RP - 2021/1/28 - -Index: apr-1.7.0/build/apr_common.m4 -=================================================================== ---- apr-1.7.0.orig/build/apr_common.m4 -+++ apr-1.7.0/build/apr_common.m4 -@@ -505,8 +505,7 @@ AC_DEFUN([APR_TRY_COMPILE_NO_WARNING], - fi - AC_COMPILE_IFELSE( - [AC_LANG_SOURCE( -- [#include "confdefs.h" -- ] -+ [] - [[$1]] - [int main(int argc, const char *const *argv) {] - [[$2]] diff --git a/meta/recipes-support/apr/apr/libtoolize_check.patch b/meta/recipes-support/apr/apr/libtoolize_check.patch index 740792e6b0..80ce43caa4 100644 --- a/meta/recipes-support/apr/apr/libtoolize_check.patch +++ b/meta/recipes-support/apr/apr/libtoolize_check.patch @@ -1,6 +1,7 @@ +From 17835709bc55657b7af1f7c99b3f572b819cf97e Mon Sep 17 00:00:00 2001 From: Helmut Grohne <helmut@subdivi.de> -Subject: check for libtoolize rather than libtool -Last-Update: 2014-09-19 +Date: Tue, 7 Feb 2023 07:04:00 +0000 +Subject: [PATCH] check for libtoolize rather than libtool libtool is now in package libtool-bin, but apr only needs libtoolize. @@ -8,14 +9,22 @@ Upstream-Status: Pending [ from debian: https://sources.debian.org/data/main/a/a Signed-off-by: Robert Yang <liezhi.yang@windriver.com> ---- apr.orig/build/buildcheck.sh -+++ apr/build/buildcheck.sh -@@ -39,11 +39,11 @@ fi +--- + build/buildcheck.sh | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/build/buildcheck.sh b/build/buildcheck.sh +index 44921b5..08bc8a8 100755 +--- a/build/buildcheck.sh ++++ b/build/buildcheck.sh +@@ -39,13 +39,11 @@ fi # ltmain.sh (GNU libtool 1.1361 2004/01/02 23:10:52) 1.5a # output is multiline from 1.5 onwards -# Require libtool 1.4 or newer --libtool=`build/PrintPath glibtool1 glibtool libtool libtool15 libtool14` +-if test -z "$libtool"; then +- libtool=`build/PrintPath glibtool1 glibtool libtool libtool15 libtool14` +-fi -lt_pversion=`$libtool --version 2>/dev/null|sed -e 's/([^)]*)//g;s/^[^0-9]*//;s/[- ].*//g;q'` +# Require libtoolize 1.4 or newer +libtoolize=`build/PrintPath glibtoolize1 glibtoolize libtoolize libtoolize15 libtoolize14` diff --git a/meta/recipes-support/apr/apr_1.7.0.bb b/meta/recipes-support/apr/apr_1.7.2.bb index cb4bb936d7..c9059c9921 100644 --- a/meta/recipes-support/apr/apr_1.7.0.bb +++ b/meta/recipes-support/apr/apr_1.7.2.bb @@ -16,21 +16,15 @@ BBCLASSEXTEND = "native nativesdk" SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.bz2 \ file://run-ptest \ file://0002-apr-Remove-workdir-path-references-from-installed-ap.patch \ - file://0003-Makefile.in-configure.in-support-cross-compiling.patch \ file://0004-Fix-packet-discards-HTTP-redirect.patch \ file://0005-configure.in-fix-LTFLAGS-to-make-it-work-with-ccache.patch \ - file://0006-apr-fix-off_t-size-doesn-t-match-in-glibc-when-cross.patch \ file://0007-explicitly-link-libapr-against-phtread-to-make-gold-.patch \ file://libtoolize_check.patch \ file://0001-Add-option-to-disable-timed-dependant-tests.patch \ - file://autoconf270.patch \ - file://0001-add-AC_CACHE_CHECK-for-strerror_r-return-type.patch \ file://0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch \ - file://CVE-2021-35940.patch \ " -SRC_URI[md5sum] = "7a14a83d664e87599ea25ff4432e48a7" -SRC_URI[sha256sum] = "e2e148f0b2e99b8e5c6caa09f6d4fb4dd3e83f744aa72a952f94f5a14436f7ea" +SRC_URI[sha256sum] = "75e77cc86776c030c0a5c408dfbd0bf2a0b75eed5351e52d5439fa1e5509a43e" inherit autotools-brokensep lib_package binconfig multilib_header ptest multilib_script diff --git a/meta/recipes-support/attr/acl/run-ptest b/meta/recipes-support/attr/acl/run-ptest index 4312823365..3af75c84fe 100644 --- a/meta/recipes-support/attr/acl/run-ptest +++ b/meta/recipes-support/attr/acl/run-ptest @@ -7,4 +7,10 @@ mkdir -p /tmp/acl-ptest/test cp test/test.* /tmp/acl-ptest/test +set +e make test-suite.log +exitcode=$? +if [ $exitcode -ne 0 -a -e test-suite.log ]; then + cat test-suite.log +fi +exit $exitcode diff --git a/meta/recipes-support/attr/acl_2.3.1.bb b/meta/recipes-support/attr/acl_2.3.1.bb index aca04a9aac..c2c9ba9069 100644 --- a/meta/recipes-support/attr/acl_2.3.1.bb +++ b/meta/recipes-support/attr/acl_2.3.1.bb @@ -62,6 +62,7 @@ RDEPENDS:${PN}-ptest = "acl \ bash \ coreutils \ perl \ + perl-module-constant \ perl-module-filehandle \ perl-module-getopt-std \ perl-module-posix \ diff --git a/meta/recipes-support/attr/attr.inc b/meta/recipes-support/attr/attr.inc index a4e38f2b19..56028edb12 100644 --- a/meta/recipes-support/attr/attr.inc +++ b/meta/recipes-support/attr/attr.inc @@ -50,6 +50,7 @@ do_install_ptest() { RDEPENDS:${PN}-ptest = "attr \ coreutils \ + perl-module-constant \ perl-module-filehandle \ perl-module-getopt-std \ perl-module-posix \ diff --git a/meta/recipes-support/attr/attr/run-ptest b/meta/recipes-support/attr/attr/run-ptest index f64244f239..3e7a3a17a0 100644 --- a/meta/recipes-support/attr/attr/run-ptest +++ b/meta/recipes-support/attr/attr/run-ptest @@ -1,3 +1,10 @@ #!/bin/sh +set +e make test-suite.log +exitcode=$? +if [ $exitcode -ne 0 -a -e test-suite.log ]; then + cat test-suite.log +fi +exit $exitcode + diff --git a/meta/recipes-support/bmap-tools/bmap-tools_git.bb b/meta/recipes-support/bmap-tools/bmap-tools_git.bb index 78c51e7731..89b7bf2b93 100644 --- a/meta/recipes-support/bmap-tools/bmap-tools_git.bb +++ b/meta/recipes-support/bmap-tools/bmap-tools_git.bb @@ -9,7 +9,7 @@ SECTION = "console/utils" LICENSE = "GPL-2.0-only" LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" -SRC_URI = "git://github.com/intel/${BPN};branch=master;protocol=https" +SRC_URI = "git://github.com/intel/${BPN};branch=main;protocol=https" SRCREV = "c0673962a8ec1624b5189dc1d24f33fe4f06785a" S = "${WORKDIR}/git" diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch new file mode 100644 index 0000000000..d357cee76c --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch @@ -0,0 +1,280 @@ +From 076a2f629119222aeeb50f5a03bf9f9052fabb9a Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 27 Dec 2022 11:50:20 +0100 +Subject: [PATCH] share: add sharing of HSTS cache among handles + +Closes #10138 + +CVE: CVE-2023-23914 CVE-2023-23915 +Upstream-Status: Backport [https://github.com/curl/curl/commit/076a2f629119222aeeb50f5a03bf9f9052fabb9a] +Comment: Refreshed hunk from hsts.c and urldata.h +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + include/curl/curl.h | 1 + + lib/hsts.c | 15 +++++++++ + lib/hsts.h | 2 ++ + lib/setopt.c | 48 ++++++++++++++++++++++++----- + lib/share.c | 32 +++++++++++++++++-- + lib/share.h | 6 +++- + lib/transfer.c | 3 ++ + lib/url.c | 6 +++- + lib/urldata.h | 2 ++ + 9 files changed, 109 insertions(+), 11 deletions(-) + +--- a/include/curl/curl.h ++++ b/include/curl/curl.h +@@ -2953,6 +2953,7 @@ typedef enum { + CURL_LOCK_DATA_SSL_SESSION, + CURL_LOCK_DATA_CONNECT, + CURL_LOCK_DATA_PSL, ++ CURL_LOCK_DATA_HSTS, + CURL_LOCK_DATA_LAST + } curl_lock_data; + +--- a/lib/hsts.c ++++ b/lib/hsts.c +@@ -37,6 +37,7 @@ + #include "parsedate.h" + #include "rand.h" + #include "rename.h" ++#include "share.h" + #include "strtoofft.h" + + /* The last 3 #include files should be in this order */ +@@ -561,4 +562,18 @@ + return CURLE_OK; + } + ++void Curl_hsts_loadfiles(struct Curl_easy *data) ++{ ++ struct curl_slist *l = data->set.hstslist; ++ if(l) { ++ Curl_share_lock(data, CURL_LOCK_DATA_HSTS, CURL_LOCK_ACCESS_SINGLE); ++ ++ while(l) { ++ (void)Curl_hsts_loadfile(data, data->hsts, l->data); ++ l = l->next; ++ } ++ Curl_share_unlock(data, CURL_LOCK_DATA_HSTS); ++ } ++} ++ + #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_HSTS */ +--- a/lib/hsts.h ++++ b/lib/hsts.h +@@ -59,9 +59,11 @@ CURLcode Curl_hsts_loadfile(struct Curl_ + struct hsts *h, const char *file); + CURLcode Curl_hsts_loadcb(struct Curl_easy *data, + struct hsts *h); ++void Curl_hsts_loadfiles(struct Curl_easy *data); + #else + #define Curl_hsts_cleanup(x) + #define Curl_hsts_loadcb(x,y) CURLE_OK + #define Curl_hsts_save(x,y,z) ++#define Curl_hsts_loadfiles(x) + #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_HSTS */ + #endif /* HEADER_CURL_HSTS_H */ +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -2260,9 +2260,14 @@ CURLcode Curl_vsetopt(struct Curl_easy * + data->cookies = NULL; + #endif + ++#ifndef CURL_DISABLE_HSTS ++ if(data->share->hsts == data->hsts) ++ data->hsts = NULL; ++#endif ++#ifdef USE_SSL + if(data->share->sslsession == data->state.session) + data->state.session = NULL; +- ++#endif + #ifdef USE_LIBPSL + if(data->psl == &data->share->psl) + data->psl = data->multi? &data->multi->psl: NULL; +@@ -2296,10 +2301,19 @@ CURLcode Curl_vsetopt(struct Curl_easy * + data->cookies = data->share->cookies; + } + #endif /* CURL_DISABLE_HTTP */ ++#ifndef CURL_DISABLE_HSTS ++ if(data->share->hsts) { ++ /* first free the private one if any */ ++ Curl_hsts_cleanup(&data->hsts); ++ data->hsts = data->share->hsts; ++ } ++#endif /* CURL_DISABLE_HTTP */ ++#ifdef USE_SSL + if(data->share->sslsession) { + data->set.general_ssl.max_ssl_sessions = data->share->max_ssl_sessions; + data->state.session = data->share->sslsession; + } ++#endif + #ifdef USE_LIBPSL + if(data->share->specifier & (1 << CURL_LOCK_DATA_PSL)) + data->psl = &data->share->psl; +@@ -3049,19 +3063,39 @@ CURLcode Curl_vsetopt(struct Curl_easy * + case CURLOPT_HSTSWRITEDATA: + data->set.hsts_write_userp = va_arg(param, void *); + break; +- case CURLOPT_HSTS: ++ case CURLOPT_HSTS: { ++ struct curl_slist *h; + if(!data->hsts) { + data->hsts = Curl_hsts_init(); + if(!data->hsts) + return CURLE_OUT_OF_MEMORY; + } + argptr = va_arg(param, char *); +- result = Curl_setstropt(&data->set.str[STRING_HSTS], argptr); +- if(result) +- return result; +- if(argptr) +- (void)Curl_hsts_loadfile(data, data->hsts, argptr); ++ if(argptr) { ++ result = Curl_setstropt(&data->set.str[STRING_HSTS], argptr); ++ if(result) ++ return result; ++ /* this needs to build a list of file names to read from, so that it can ++ read them later, as we might get a shared HSTS handle to load them ++ into */ ++ h = curl_slist_append(data->set.hstslist, argptr); ++ if(!h) { ++ curl_slist_free_all(data->set.hstslist); ++ data->set.hstslist = NULL; ++ return CURLE_OUT_OF_MEMORY; ++ } ++ data->set.hstslist = h; /* store the list for later use */ ++ } ++ else { ++ /* clear the list of HSTS files */ ++ curl_slist_free_all(data->set.hstslist); ++ data->set.hstslist = NULL; ++ if(!data->share || !data->share->hsts) ++ /* throw away the HSTS cache unless shared */ ++ Curl_hsts_cleanup(&data->hsts); ++ } + break; ++ } + case CURLOPT_HSTS_CTRL: + arg = va_arg(param, long); + if(arg & CURLHSTS_ENABLE) { +--- a/lib/share.c ++++ b/lib/share.c +@@ -29,9 +29,11 @@ + #include "share.h" + #include "psl.h" + #include "vtls/vtls.h" +-#include "curl_memory.h" ++#include "hsts.h" + +-/* The last #include file should be: */ ++/* The last 3 #include files should be in this order */ ++#include "curl_printf.h" ++#include "curl_memory.h" + #include "memdebug.h" + + struct Curl_share * +@@ -89,6 +91,18 @@ curl_share_setopt(struct Curl_share *sha + #endif + break; + ++ case CURL_LOCK_DATA_HSTS: ++#ifndef CURL_DISABLE_HSTS ++ if(!share->hsts) { ++ share->hsts = Curl_hsts_init(); ++ if(!share->hsts) ++ res = CURLSHE_NOMEM; ++ } ++#else /* CURL_DISABLE_HSTS */ ++ res = CURLSHE_NOT_BUILT_IN; ++#endif ++ break; ++ + case CURL_LOCK_DATA_SSL_SESSION: + #ifdef USE_SSL + if(!share->sslsession) { +@@ -141,6 +155,16 @@ curl_share_setopt(struct Curl_share *sha + #endif + break; + ++ case CURL_LOCK_DATA_HSTS: ++#ifndef CURL_DISABLE_HSTS ++ if(share->hsts) { ++ Curl_hsts_cleanup(&share->hsts); ++ } ++#else /* CURL_DISABLE_HSTS */ ++ res = CURLSHE_NOT_BUILT_IN; ++#endif ++ break; ++ + case CURL_LOCK_DATA_SSL_SESSION: + #ifdef USE_SSL + Curl_safefree(share->sslsession); +@@ -207,6 +231,10 @@ curl_share_cleanup(struct Curl_share *sh + Curl_cookie_cleanup(share->cookies); + #endif + ++#ifndef CURL_DISABLE_HSTS ++ Curl_hsts_cleanup(&share->hsts); ++#endif ++ + #ifdef USE_SSL + if(share->sslsession) { + size_t i; +--- a/lib/share.h ++++ b/lib/share.h +@@ -59,10 +59,14 @@ struct Curl_share { + #ifdef USE_LIBPSL + struct PslCache psl; + #endif +- ++#ifndef CURL_DISABLE_HSTS ++ struct hsts *hsts; ++#endif ++#ifdef USE_SSL + struct Curl_ssl_session *sslsession; + size_t max_ssl_sessions; + long sessionage; ++#endif + }; + + CURLSHcode Curl_share_lock(struct Curl_easy *, curl_lock_data, +--- a/lib/transfer.c ++++ b/lib/transfer.c +@@ -1398,6 +1398,9 @@ CURLcode Curl_pretransfer(struct Curl_ea + if(data->state.resolve) + result = Curl_loadhostpairs(data); + ++ /* If there is a list of hsts files to read */ ++ Curl_hsts_loadfiles(data); ++ + if(!result) { + /* Allow data->set.use_port to set which port to use. This needs to be + * disabled for example when we follow Location: headers to URLs using +--- a/lib/url.c ++++ b/lib/url.c +@@ -434,7 +434,11 @@ CURLcode Curl_close(struct Curl_easy **d + Curl_altsvc_save(data, data->asi, data->set.str[STRING_ALTSVC]); + Curl_altsvc_cleanup(&data->asi); + Curl_hsts_save(data, data->hsts, data->set.str[STRING_HSTS]); +- Curl_hsts_cleanup(&data->hsts); ++#ifndef CURL_DISABLE_HSTS ++ if(!data->share || !data->share->hsts) ++ Curl_hsts_cleanup(&data->hsts); ++ curl_slist_free_all(data->set.hstslist); /* clean up list */ ++#endif + #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH) + Curl_http_auth_cleanup_digest(data); + #endif +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -1670,6 +1670,8 @@ + + void *seek_client; /* pointer to pass to the seek callback */ + #ifndef CURL_DISABLE_HSTS ++ struct curl_slist *hstslist; /* list of HSTS files set by ++ curl_easy_setopt(HSTS) calls */ + curl_hstsread_callback hsts_read; + void *hsts_read_userp; + curl_hstswrite_callback hsts_write; diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch new file mode 100644 index 0000000000..668972cb3f --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch @@ -0,0 +1,23 @@ +From 0bf8b796a0ea98395b390c7807187982215f5c11 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 27 Dec 2022 11:50:23 +0100 +Subject: [PATCH] tool_operate: share HSTS between handles + +CVE: CVE-2023-23914 CVE-2023-23915 +Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/ca17cfed2df001356cfe2841f166569bac0f5e8c] +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + src/tool_operate.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/src/tool_operate.c ++++ b/src/tool_operate.c +@@ -2722,6 +2722,7 @@ CURLcode operate(struct GlobalConfig *gl + curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION); + curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT); + curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_PSL); ++ curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_HSTS); + + /* Get the required arguments for each operation */ + do { diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch new file mode 100644 index 0000000000..4422b26834 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch @@ -0,0 +1,45 @@ +From ca02a77f05bd5cef20618c8f741aa48b7be0a648 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 27 Dec 2022 11:50:23 +0100 +Subject: [PATCH] hsts: handle adding the same host name again + +It will then use the largest expire time of the two entries. + +CVE: CVE-2023-23914 CVE-2023-23915 +Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/e077b30a42272d964d76e5b815a0af7dc65d8360] +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + lib/hsts.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/lib/hsts.c b/lib/hsts.c +index 339237be1c621..8d6723ee587d2 100644 +--- a/lib/hsts.c ++++ b/lib/hsts.c +@@ -426,14 +426,23 @@ static CURLcode hsts_add(struct hsts *h, char *line) + if(2 == rc) { + time_t expires = strcmp(date, UNLIMITED) ? Curl_getdate_capped(date) : + TIME_T_MAX; +- CURLcode result; ++ CURLcode result = CURLE_OK; + char *p = host; + bool subdomain = FALSE; ++ struct stsentry *e; + if(p[0] == '.') { + p++; + subdomain = TRUE; + } +- result = hsts_create(h, p, subdomain, expires); ++ /* only add it if not already present */ ++ e = Curl_hsts(h, p, subdomain); ++ if(!e) ++ result = hsts_create(h, p, subdomain, expires); ++ else { ++ /* the same host name, use the largest expire time */ ++ if(expires > e->expires) ++ e->expires = expires; ++ } + if(result) + return result; + } diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch new file mode 100644 index 0000000000..865b3f93a5 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch @@ -0,0 +1,48 @@ +From dc0725244a3163f1e2d5f51165db3a1a430f3ba0 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 27 Dec 2022 11:50:23 +0100 +Subject: [PATCH] runtests: support crlf="yes" for verify/proxy + +CVE: CVE-2023-23914 CVE-2023-23915 +Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/fd7e1a557e414dd803c9225e37a2ca84e1df2269] +Comment: Refreshed hunk from FILEFORMAT.md +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + tests/FILEFORMAT.md | 4 ++-- + tests/runtests.pl | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/tests/FILEFORMAT.md ++++ b/tests/FILEFORMAT.md +@@ -540,14 +540,14 @@ + One perl op per line that operates on the protocol dump. This is pretty + advanced. Example: `s/^EPRT .*/EPRT stripped/`. + +-### `<protocol [nonewline="yes"]>` ++### `<protocol [nonewline="yes"][crlf="yes"]>` + + the protocol dump curl should transmit, if 'nonewline' is set, we will cut off + the trailing newline of this given data before comparing with the one actually + sent by the client The `<strip>` and `<strippart>` rules are applied before + comparisons are made. + +-### `<proxy [nonewline="yes"]>` ++### `<proxy [nonewline="yes"][crlf="yes"]>` + + The protocol dump curl should transmit to a HTTP proxy (when the http-proxy + server is used), if 'nonewline' is set, we will cut off the trailing newline +--- a/tests/runtests.pl ++++ b/tests/runtests.pl +@@ -4744,6 +4744,11 @@ sub singletest { + } + } + ++ if($hash{'crlf'} || ++ ($has_hyper && ($keywords{"HTTP"} || $keywords{"HTTPS"}))) { ++ map subNewlines(0, \$_), @protstrip; ++ } ++ + $res = compare($testnum, $testname, "proxy", \@out, \@protstrip); + if($res) { + return $errorreturncode; diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch new file mode 100644 index 0000000000..1a363f0b4b --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch @@ -0,0 +1,118 @@ +From ea5aaaa5ede53819f8bc7ae767fc2d13d3704d37 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 27 Dec 2022 11:50:23 +0100 +Subject: [PATCH] test446: verify hsts with two URLs + +CVE: CVE-2023-23914 CVE-2023-23915 +Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/7e89dfd463597701dd1defcad7be54f7d3c9d55d] +Comment: Refreshed hunk from Makefile.inc +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> +Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +--- + tests/data/Makefile.inc | 2 +- + tests/data/test446 | 84 +++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 85 insertions(+), 1 deletion(-) + create mode 100644 tests/data/test446 + +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 3a6356bd122bc..fe1bb1c74c2ab 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -72,6 +72,7 @@ + \ + test430 test431 test432 test433 test434 test435 test436 \ + \ ++test446 \ + test490 test491 test492 test493 test494 \ + \ + test500 test501 test502 test503 test504 test505 test506 test507 test508 \ +diff --git a/tests/data/test446 b/tests/data/test446 +new file mode 100644 +index 0000000000000..0e2dfdcfe33b6 +--- /dev/null ++++ b/tests/data/test446 +@@ -0,0 +1,84 @@ ++<?xml version="1.0" encoding="ISO-8859-1"?> ++<testcase> ++<info> ++<keywords> ++HTTP ++HTTP proxy ++HSTS ++trailing-dot ++</keywords> ++</info> ++ ++<reply> ++ ++# we use this as response to a CONNECT ++<connect nocheck="yes"> ++HTTP/1.1 200 OK ++ ++</connect> ++<data crlf="yes"> ++HTTP/1.1 200 OK ++Content-Length: 6 ++Strict-Transport-Security: max-age=604800 ++ ++-foo- ++</data> ++<data2 crlf="yes"> ++HTTP/1.1 200 OK ++Content-Length: 6 ++Strict-Transport-Security: max-age=6048000 ++ ++-baa- ++</data2> ++</reply> ++ ++<client> ++<server> ++https ++http-proxy ++</server> ++<features> ++HSTS ++proxy ++https ++debug ++</features> ++<setenv> ++CURL_HSTS_HTTP=yes ++CURL_TIME=2000000000 ++</setenv> ++ ++<name> ++HSTS with two URLs ++</name> ++<command> ++-x http://%HOSTIP:%PROXYPORT --hsts log/hsts%TESTNUMBER http://this.hsts.example./%TESTNUMBER http://another.example.com/%TESTNUMBER0002 ++</command> ++</client> ++ ++<verify> ++# we let it CONNECT to the server to confirm HSTS but deny from there ++<proxy crlf="yes"> ++GET http://this.hsts.example./%TESTNUMBER HTTP/1.1 ++Host: this.hsts.example. ++User-Agent: curl/%VERSION ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://another.example.com/%TESTNUMBER0002 HTTP/1.1 ++Host: another.example.com ++User-Agent: curl/%VERSION ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++</proxy> ++ ++<file name="log/hsts%TESTNUMBER" mode="text"> ++# Your HSTS cache. https://curl.se/docs/hsts.html ++# This file was generated by libcurl! Edit at your own risk. ++this.hsts.example "20330525 03:33:20" ++another.example.com "20330727 03:33:20" ++</file> ++ ++</verify> ++</testcase> diff --git a/meta/recipes-support/curl/curl/CVE-2023-23916.patch b/meta/recipes-support/curl/curl/CVE-2023-23916.patch new file mode 100644 index 0000000000..a57d275902 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-23916.patch @@ -0,0 +1,219 @@ +From 119fb187192a9ea13dc90d9d20c215fc82799ab9 Mon Sep 17 00:00:00 2001 +From: Patrick Monnerat <patrick@monnerat.net> +Date: Mon, 13 Feb 2023 08:33:09 +0100 +Subject: [PATCH] content_encoding: do not reset stage counter for each header + +Test 418 verifies + +Closes #10492 + +CVE: CVE-2023-23916 +Upstream-Status: Backport [https://github.com/curl/curl/commit/119fb187192a9ea13dc.patch] +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> +--- + lib/content_encoding.c | 7 +- + lib/urldata.h | 1 + + tests/data/Makefile.inc | 2 +- + tests/data/test387 | 2 +- + tests/data/test418 | 152 ++++++++++++++++++++++++++++++++++++++++ + 5 files changed, 158 insertions(+), 6 deletions(-) + create mode 100644 tests/data/test418 + +--- a/lib/content_encoding.c ++++ b/lib/content_encoding.c +@@ -1037,7 +1037,6 @@ CURLcode Curl_build_unencoding_stack(str + const char *enclist, int maybechunked) + { + struct SingleRequest *k = &data->req; +- int counter = 0; + + do { + const char *name; +@@ -1072,9 +1071,9 @@ CURLcode Curl_build_unencoding_stack(str + if(!encoding) + encoding = &error_encoding; /* Defer error at stack use. */ + +- if(++counter >= MAX_ENCODE_STACK) { +- failf(data, "Reject response due to %u content encodings", +- counter); ++ if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) { ++ failf(data, "Reject response due to more than %u content encodings", ++ MAX_ENCODE_STACK); + return CURLE_BAD_CONTENT_ENCODING; + } + /* Stack the unencoding stage. */ +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -682,6 +682,7 @@ struct SingleRequest { + struct dohdata *doh; /* DoH specific data for this request */ + #endif + unsigned char setcookies; ++ unsigned char writer_stack_depth; /* Unencoding stack depth. */ + BIT(header); /* incoming data has HTTP header */ + BIT(content_range); /* set TRUE if Content-Range: was found */ + BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -69,6 +69,7 @@ + \ + test400 test401 test402 test403 test404 test405 test406 test407 test408 \ + test409 test410 \ ++test418 \ + \ + test430 test431 test432 test433 test434 test435 test436 \ + \ +--- /dev/null ++++ b/tests/data/test418 +@@ -0,0 +1,152 @@ ++<testcase> ++<info> ++<keywords> ++HTTP ++gzip ++</keywords> ++</info> ++ ++# ++# Server-side ++<reply> ++<data nocheck="yes"> ++HTTP/1.1 200 OK ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++Transfer-Encoding: gzip ++ ++-foo- ++</data> ++</reply> ++ ++# ++# Client-side ++<client> ++<server> ++http ++</server> ++ <name> ++Response with multiple Transfer-Encoding headers ++ </name> ++ <command> ++http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS ++</command> ++</client> ++ ++# ++# Verify data after the test has been "shot" ++<verify> ++<protocol crlf="yes"> ++GET /%TESTNUMBER HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++</protocol> ++ ++# CURLE_BAD_CONTENT_ENCODING is 61 ++<errorcode> ++61 ++</errorcode> ++<stderr mode="text"> ++curl: (61) Reject response due to more than 5 content encodings ++</stderr> ++</verify> ++</testcase> diff --git a/meta/recipes-support/curl/curl/CVE-2023-27533.patch b/meta/recipes-support/curl/curl/CVE-2023-27533.patch new file mode 100644 index 0000000000..b69b20c85a --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-27533.patch @@ -0,0 +1,208 @@ +From 538b1e79a6e7b0bb829ab4cecc828d32105d0684 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Mon, 6 Mar 2023 12:07:33 +0100 +Subject: [PATCH] telnet: parse telnet options without sscanf & only accept option arguments in ascii + +To avoid embedded telnet negotiation commands etc. + +Reported-by: Harry Sintonen +Closes #10728 + +CVE: CVE-2023-27533 +Upstream-Status: Backport [https://github.com/curl/curl/commit/0c28ba2faae2d7da780a66d2446045a560192cdc && https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684] + +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + lib/telnet.c | 149 +++++++++++++++++++++++++++++++-------------------- + 1 file changed, 91 insertions(+), 58 deletions(-) + +diff --git a/lib/telnet.c b/lib/telnet.c +index e709973..3ecd680 100644 +--- a/lib/telnet.c ++++ b/lib/telnet.c +@@ -768,22 +768,32 @@ static void printsub(struct Curl_easy *data, + } + } + ++static bool str_is_nonascii(const char *str) ++{ ++ size_t len = strlen(str); ++ while(len--) { ++ if(*str & 0x80) ++ return TRUE; ++ str++; ++ } ++ return FALSE; ++} ++ + static CURLcode check_telnet_options(struct Curl_easy *data) + { + struct curl_slist *head; + struct curl_slist *beg; +- char option_keyword[128] = ""; +- char option_arg[256] = ""; + struct TELNET *tn = data->req.p.telnet; +- struct connectdata *conn = data->conn; + CURLcode result = CURLE_OK; +- int binary_option; + + /* Add the user name as an environment variable if it + was given on the command line */ + if(data->state.aptr.user) { +- msnprintf(option_arg, sizeof(option_arg), "USER,%s", conn->user); +- beg = curl_slist_append(tn->telnet_vars, option_arg); ++ char buffer[256]; ++ if(str_is_nonascii(data->conn->user)) ++ return CURLE_BAD_FUNCTION_ARGUMENT; ++ msnprintf(buffer, sizeof(buffer), "USER,%s", data->conn->user); ++ beg = curl_slist_append(tn->telnet_vars, buffer); + if(!beg) { + curl_slist_free_all(tn->telnet_vars); + tn->telnet_vars = NULL; +@@ -793,68 +803,91 @@ static CURLcode check_telnet_options(struct Curl_easy *data) + tn->us_preferred[CURL_TELOPT_NEW_ENVIRON] = CURL_YES; + } + +- for(head = data->set.telnet_options; head; head = head->next) { +- if(sscanf(head->data, "%127[^= ]%*[ =]%255s", +- option_keyword, option_arg) == 2) { +- +- /* Terminal type */ +- if(strcasecompare(option_keyword, "TTYPE")) { +- strncpy(tn->subopt_ttype, option_arg, 31); +- tn->subopt_ttype[31] = 0; /* String termination */ +- tn->us_preferred[CURL_TELOPT_TTYPE] = CURL_YES; ++ for(head = data->set.telnet_options; head && !result; head = head->next) { ++ size_t olen; ++ char *option = head->data; ++ char *arg; ++ char *sep = strchr(option, '='); ++ if(sep) { ++ olen = sep - option; ++ arg = ++sep; ++ if(str_is_nonascii(arg)) + continue; +- } ++ switch(olen) { ++ case 5: ++ /* Terminal type */ ++ if(strncasecompare(option, "TTYPE", 5)) { ++ strncpy(tn->subopt_ttype, arg, 31); ++ tn->subopt_ttype[31] = 0; /* String termination */ ++ tn->us_preferred[CURL_TELOPT_TTYPE] = CURL_YES; ++ } ++ else ++ result = CURLE_UNKNOWN_OPTION; ++ break; + +- /* Display variable */ +- if(strcasecompare(option_keyword, "XDISPLOC")) { +- strncpy(tn->subopt_xdisploc, option_arg, 127); +- tn->subopt_xdisploc[127] = 0; /* String termination */ +- tn->us_preferred[CURL_TELOPT_XDISPLOC] = CURL_YES; +- continue; +- } ++ case 8: ++ /* Display variable */ ++ if(strncasecompare(option, "XDISPLOC", 8)) { ++ strncpy(tn->subopt_xdisploc, arg, 127); ++ tn->subopt_xdisploc[127] = 0; /* String termination */ ++ tn->us_preferred[CURL_TELOPT_XDISPLOC] = CURL_YES; ++ } ++ else ++ result = CURLE_UNKNOWN_OPTION; ++ break; + +- /* Environment variable */ +- if(strcasecompare(option_keyword, "NEW_ENV")) { +- beg = curl_slist_append(tn->telnet_vars, option_arg); +- if(!beg) { +- result = CURLE_OUT_OF_MEMORY; +- break; ++ case 7: ++ /* Environment variable */ ++ if(strncasecompare(option, "NEW_ENV", 7)) { ++ beg = curl_slist_append(tn->telnet_vars, arg); ++ if(!beg) { ++ result = CURLE_OUT_OF_MEMORY; ++ break; ++ } ++ tn->telnet_vars = beg; ++ tn->us_preferred[CURL_TELOPT_NEW_ENVIRON] = CURL_YES; + } +- tn->telnet_vars = beg; +- tn->us_preferred[CURL_TELOPT_NEW_ENVIRON] = CURL_YES; +- continue; +- } ++ else ++ result = CURLE_UNKNOWN_OPTION; ++ break; + +- /* Window Size */ +- if(strcasecompare(option_keyword, "WS")) { +- if(sscanf(option_arg, "%hu%*[xX]%hu", +- &tn->subopt_wsx, &tn->subopt_wsy) == 2) +- tn->us_preferred[CURL_TELOPT_NAWS] = CURL_YES; +- else { +- failf(data, "Syntax error in telnet option: %s", head->data); +- result = CURLE_SETOPT_OPTION_SYNTAX; +- break; ++ case 2: ++ /* Window Size */ ++ if(strncasecompare(option, "WS", 2)) { ++ if(sscanf(arg, "%hu%*[xX]%hu", ++ &tn->subopt_wsx, &tn->subopt_wsy) == 2) ++ tn->us_preferred[CURL_TELOPT_NAWS] = CURL_YES; ++ else { ++ failf(data, "Syntax error in telnet option: %s", head->data); ++ result = CURLE_SETOPT_OPTION_SYNTAX; ++ } + } +- continue; +- } ++ else ++ result = CURLE_UNKNOWN_OPTION; ++ break; + +- /* To take care or not of the 8th bit in data exchange */ +- if(strcasecompare(option_keyword, "BINARY")) { +- binary_option = atoi(option_arg); +- if(binary_option != 1) { +- tn->us_preferred[CURL_TELOPT_BINARY] = CURL_NO; +- tn->him_preferred[CURL_TELOPT_BINARY] = CURL_NO; ++ case 6: ++ /* To take care or not of the 8th bit in data exchange */ ++ if(strncasecompare(option, "BINARY", 6)) { ++ int binary_option = atoi(arg); ++ if(binary_option != 1) { ++ tn->us_preferred[CURL_TELOPT_BINARY] = CURL_NO; ++ tn->him_preferred[CURL_TELOPT_BINARY] = CURL_NO; ++ } + } +- continue; ++ else ++ result = CURLE_UNKNOWN_OPTION; ++ break; ++ default: ++ failf(data, "Unknown telnet option %s", head->data); ++ result = CURLE_UNKNOWN_OPTION; ++ break; + } +- +- failf(data, "Unknown telnet option %s", head->data); +- result = CURLE_UNKNOWN_OPTION; +- break; + } +- failf(data, "Syntax error in telnet option: %s", head->data); +- result = CURLE_SETOPT_OPTION_SYNTAX; +- break; ++ else { ++ failf(data, "Syntax error in telnet option: %s", head->data); ++ result = CURLE_SETOPT_OPTION_SYNTAX; ++ } + } + + if(result) { +-- +2.25.1 + diff --git a/meta/recipes-support/curl/curl/CVE-2023-27534.patch b/meta/recipes-support/curl/curl/CVE-2023-27534.patch new file mode 100644 index 0000000000..9109faaf88 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-27534.patch @@ -0,0 +1,122 @@ +From 4e2b52b5f7a3bf50a0f1494155717b02cc1df6d6 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 9 Mar 2023 16:22:11 +0100 +Subject: [PATCH] curl_path: create the new path with dynbuf + +CVE: CVE-2023-27534 +Upstream-Status: Backport [https://github.com/curl/curl/commit/4e2b52b5f7a3bf50a0f1494155717b02cc1df6d6] + +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + lib/curl_path.c | 71 ++++++++++++++++++++++++------------------------- + 1 file changed, 35 insertions(+), 36 deletions(-) + +diff --git a/lib/curl_path.c b/lib/curl_path.c +index a1669d1..b9c470f 100644 +--- a/lib/curl_path.c ++++ b/lib/curl_path.c +@@ -30,66 +30,65 @@ + #include "escape.h" + #include "memdebug.h" + ++#define MAX_SSHPATH_LEN 100000 /* arbitrary */ ++ + /* figure out the path to work with in this particular request */ + CURLcode Curl_getworkingpath(struct Curl_easy *data, + char *homedir, /* when SFTP is used */ + char **path) /* returns the allocated + real path to work with */ + { +- char *real_path = NULL; + char *working_path; + size_t working_path_len; ++ struct dynbuf npath; + CURLcode result = + Curl_urldecode(data->state.up.path, 0, &working_path, + &working_path_len, REJECT_ZERO); + if(result) + return result; + ++ /* new path to switch to in case we need to */ ++ Curl_dyn_init(&npath, MAX_SSHPATH_LEN); ++ + /* Check for /~/, indicating relative to the user's home directory */ +- if(data->conn->handler->protocol & CURLPROTO_SCP) { +- real_path = malloc(working_path_len + 1); +- if(!real_path) { ++ if((data->conn->handler->protocol & CURLPROTO_SCP) && ++ (working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) { ++ /* It is referenced to the home directory, so strip the leading '/~/' */ ++ if(Curl_dyn_addn(&npath, &working_path[3], working_path_len - 3)) { + free(working_path); + return CURLE_OUT_OF_MEMORY; + } +- if((working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) +- /* It is referenced to the home directory, so strip the leading '/~/' */ +- memcpy(real_path, working_path + 3, working_path_len - 2); +- else +- memcpy(real_path, working_path, 1 + working_path_len); + } +- else if(data->conn->handler->protocol & CURLPROTO_SFTP) { +- if((working_path_len > 1) && (working_path[1] == '~')) { +- size_t homelen = strlen(homedir); +- real_path = malloc(homelen + working_path_len + 1); +- if(!real_path) { +- free(working_path); +- return CURLE_OUT_OF_MEMORY; +- } +- /* It is referenced to the home directory, so strip the +- leading '/' */ +- memcpy(real_path, homedir, homelen); +- real_path[homelen] = '/'; +- real_path[homelen + 1] = '\0'; +- if(working_path_len > 3) { +- memcpy(real_path + homelen + 1, working_path + 3, +- 1 + working_path_len -3); +- } ++ else if((data->conn->handler->protocol & CURLPROTO_SFTP) && ++ (working_path_len > 2) && !memcmp(working_path, "/~/", 3)) { ++ size_t len; ++ const char *p; ++ int copyfrom = 3; ++ if(Curl_dyn_add(&npath, homedir)) { ++ free(working_path); ++ return CURLE_OUT_OF_MEMORY; + } +- else { +- real_path = malloc(working_path_len + 1); +- if(!real_path) { +- free(working_path); +- return CURLE_OUT_OF_MEMORY; +- } +- memcpy(real_path, working_path, 1 + working_path_len); ++ /* Copy a separating '/' if homedir does not end with one */ ++ len = Curl_dyn_len(&npath); ++ p = Curl_dyn_ptr(&npath); ++ if(len && (p[len-1] != '/')) ++ copyfrom = 2; ++ ++ if(Curl_dyn_addn(&npath, ++ &working_path[copyfrom], working_path_len - copyfrom)) { ++ free(working_path); ++ return CURLE_OUT_OF_MEMORY; + } + } + +- free(working_path); ++ if(Curl_dyn_len(&npath)) { ++ free(working_path); + +- /* store the pointer for the caller to receive */ +- *path = real_path; ++ /* store the pointer for the caller to receive */ ++ *path = Curl_dyn_ptr(&npath); ++ } ++ else ++ *path = working_path; + + return CURLE_OK; + } +-- +2.25.1 + diff --git a/meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch b/meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch new file mode 100644 index 0000000000..57e1cb9e13 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch @@ -0,0 +1,196 @@ +From ed5095ed94281989e103c72e032200b83be37878 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 6 Oct 2022 00:49:10 +0200 +Subject: [PATCH] strcase: add and use Curl_timestrcmp + +This is a strcmp() alternative function for comparing "secrets", +designed to take the same time no matter the content to not leak +match/non-match info to observers based on how fast it is. + +The time this function takes is only a function of the shortest input +string. + +Reported-by: Trail of Bits + +Closes #9658 + +Upstream-Status: Backport from [https://github.com/curl/curl/commit/ed5095ed94281989e103c72e032200b83be37878] +Comment: to backport fix for CVE-2023-27535, add function Curl_timestrcmp. +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + lib/netrc.c | 6 +++--- + lib/strcase.c | 22 ++++++++++++++++++++++ + lib/strcase.h | 1 + + lib/url.c | 33 +++++++++++++-------------------- + lib/vauth/digest_sspi.c | 4 ++-- + lib/vtls/vtls.c | 4 ++-- + 6 files changed, 43 insertions(+), 27 deletions(-) + +diff --git a/lib/netrc.c b/lib/netrc.c +index 0a4ae2c..b771b60 100644 +--- a/lib/netrc.c ++++ b/lib/netrc.c +@@ -140,9 +140,9 @@ static int parsenetrc(const char *host, + /* we are now parsing sub-keywords concerning "our" host */ + if(state_login) { + if(specific_login) { +- state_our_login = strcasecompare(login, tok); ++ state_our_login = !Curl_timestrcmp(login, tok); + } +- else if(!login || strcmp(login, tok)) { ++ else if(!login || Curl_timestrcmp(login, tok)) { + if(login_alloc) { + free(login); + login_alloc = FALSE; +@@ -158,7 +158,7 @@ static int parsenetrc(const char *host, + } + else if(state_password) { + if((state_our_login || !specific_login) +- && (!password || strcmp(password, tok))) { ++ && (!password || Curl_timestrcmp(password, tok))) { + if(password_alloc) { + free(password); + password_alloc = FALSE; +diff --git a/lib/strcase.c b/lib/strcase.c +index 692a3f1..be085b3 100644 +--- a/lib/strcase.c ++++ b/lib/strcase.c +@@ -141,6 +141,28 @@ bool Curl_safecmp(char *a, char *b) + return !a && !b; + } + ++/* ++ * Curl_timestrcmp() returns 0 if the two strings are identical. The time this ++ * function spends is a function of the shortest string, not of the contents. ++ */ ++int Curl_timestrcmp(const char *a, const char *b) ++{ ++ int match = 0; ++ int i = 0; ++ ++ if(a && b) { ++ while(1) { ++ match |= a[i]^b[i]; ++ if(!a[i] || !b[i]) ++ break; ++ i++; ++ } ++ } ++ else ++ return a || b; ++ return match; ++} ++ + /* --- public functions --- */ + + int curl_strequal(const char *first, const char *second) +diff --git a/lib/strcase.h b/lib/strcase.h +index 382b80a..c6979da 100644 +--- a/lib/strcase.h ++++ b/lib/strcase.h +@@ -48,5 +48,6 @@ void Curl_strntoupper(char *dest, const char *src, size_t n); + void Curl_strntolower(char *dest, const char *src, size_t n); + + bool Curl_safecmp(char *a, char *b); ++int Curl_timestrcmp(const char *first, const char *second); + + #endif /* HEADER_CURL_STRCASE_H */ +diff --git a/lib/url.c b/lib/url.c +index df4377d..c397b57 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -930,19 +930,10 @@ socks_proxy_info_matches(const struct proxy_info *data, + /* the user information is case-sensitive + or at least it is not defined as case-insensitive + see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */ +- if(!data->user != !needle->user) +- return FALSE; +- /* curl_strequal does a case insentive comparison, so do not use it here! */ +- if(data->user && +- needle->user && +- strcmp(data->user, needle->user) != 0) +- return FALSE; +- if(!data->passwd != !needle->passwd) +- return FALSE; ++ + /* curl_strequal does a case insentive comparison, so do not use it here! */ +- if(data->passwd && +- needle->passwd && +- strcmp(data->passwd, needle->passwd) != 0) ++ if(Curl_timestrcmp(data->user, needle->user) || ++ Curl_timestrcmp(data->passwd, needle->passwd)) + return FALSE; + return TRUE; + } +@@ -1341,10 +1332,10 @@ ConnectionExists(struct Curl_easy *data, + if(!(needle->handler->flags & PROTOPT_CREDSPERREQUEST)) { + /* This protocol requires credentials per connection, + so verify that we're using the same name and password as well */ +- if(strcmp(needle->user, check->user) || +- strcmp(needle->passwd, check->passwd) || +- !Curl_safecmp(needle->sasl_authzid, check->sasl_authzid) || +- !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) { ++ if(Curl_timestrcmp(needle->user, check->user) || ++ Curl_timestrcmp(needle->passwd, check->passwd) || ++ Curl_timestrcmp(needle->sasl_authzid, check->sasl_authzid) || ++ Curl_timestrcmp(needle->oauth_bearer, check->oauth_bearer)) { + /* one of them was different */ + continue; + } +@@ -1420,8 +1411,8 @@ ConnectionExists(struct Curl_easy *data, + possible. (Especially we must not reuse the same connection if + partway through a handshake!) */ + if(wantNTLMhttp) { +- if(strcmp(needle->user, check->user) || +- strcmp(needle->passwd, check->passwd)) { ++ if(Curl_timestrcmp(needle->user, check->user) || ++ Curl_timestrcmp(needle->passwd, check->passwd)) { + + /* we prefer a credential match, but this is at least a connection + that can be reused and "upgraded" to NTLM */ +@@ -1443,8 +1434,10 @@ ConnectionExists(struct Curl_easy *data, + if(!check->http_proxy.user || !check->http_proxy.passwd) + continue; + +- if(strcmp(needle->http_proxy.user, check->http_proxy.user) || +- strcmp(needle->http_proxy.passwd, check->http_proxy.passwd)) ++ if(Curl_timestrcmp(needle->http_proxy.user, ++ check->http_proxy.user) || ++ Curl_timestrcmp(needle->http_proxy.passwd, ++ check->http_proxy.passwd)) + continue; + } + else if(check->proxy_ntlm_state != NTLMSTATE_NONE) { +diff --git a/lib/vauth/digest_sspi.c b/lib/vauth/digest_sspi.c +index 94f8f8c..a413419 100644 +--- a/lib/vauth/digest_sspi.c ++++ b/lib/vauth/digest_sspi.c +@@ -429,8 +429,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data, + has changed then delete that context. */ + if((userp && !digest->user) || (!userp && digest->user) || + (passwdp && !digest->passwd) || (!passwdp && digest->passwd) || +- (userp && digest->user && strcmp(userp, digest->user)) || +- (passwdp && digest->passwd && strcmp(passwdp, digest->passwd))) { ++ (userp && digest->user && Curl_timestrcmp(userp, digest->user)) || ++ (passwdp && digest->passwd && Curl_timestrcmp(passwdp, digest->passwd))) { + if(digest->http_context) { + s_pSecFn->DeleteSecurityContext(digest->http_context); + Curl_safefree(digest->http_context); +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c +index e2d3438..881c8d2 100644 +--- a/lib/vtls/vtls.c ++++ b/lib/vtls/vtls.c +@@ -146,8 +146,8 @@ Curl_ssl_config_matches(struct ssl_primary_config *data, + Curl_safecmp(data->random_file, needle->random_file) && + Curl_safecmp(data->egdsocket, needle->egdsocket) && + #ifdef USE_TLS_SRP +- Curl_safecmp(data->username, needle->username) && +- Curl_safecmp(data->password, needle->password) && ++ !Curl_timestrcmp(data->username, needle->username) && ++ !Curl_timestrcmp(data->password, needle->password) && + (data->authtype == needle->authtype) && + #endif + Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) && +-- +2.35.7 + diff --git a/meta/recipes-support/curl/curl/CVE-2023-27535_and_CVE-2023-27538.patch b/meta/recipes-support/curl/curl/CVE-2023-27535_and_CVE-2023-27538.patch new file mode 100644 index 0000000000..4e701edfff --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-27535_and_CVE-2023-27538.patch @@ -0,0 +1,170 @@ +From 8f4608468b890dce2dad9f91d5607ee7e9c1aba1 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 9 Mar 2023 17:47:06 +0100 +Subject: [PATCH] ftp: add more conditions for connection reuse + +Reported-by: Harry Sintonen +Closes #10730 + +Upstream-Status: Backport from [https://github.com/curl/curl/commit/8f4608468b890dce2dad9f91d5607ee7e9c1aba1, https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb] +Comment: Backport for CVE-2023-27535 also fixes CVE-2023-27538 in the file "lib/url.c". +CVE: CVE-2023-27535, CVE-2023-27538 +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +--- + lib/ftp.c | 28 ++++++++++++++++++++++++++-- + lib/ftp.h | 5 +++++ + lib/setopt.c | 2 +- + lib/url.c | 19 ++++++++++++++++--- + lib/urldata.h | 4 ++-- + 5 files changed, 50 insertions(+), 8 deletions(-) + +diff --git a/lib/ftp.c b/lib/ftp.c +index c6efaed..93bbaeb 100644 +--- a/lib/ftp.c ++++ b/lib/ftp.c +@@ -4097,6 +4097,8 @@ static CURLcode ftp_disconnect(struct Curl_easy *data, + } + + freedirs(ftpc); ++ Curl_safefree(ftpc->account); ++ Curl_safefree(ftpc->alternative_to_user); + Curl_safefree(ftpc->prevpath); + Curl_safefree(ftpc->server_os); + Curl_pp_disconnect(pp); +@@ -4364,11 +4366,31 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data, + { + char *type; + struct FTP *ftp; ++ struct ftp_conn *ftpc = &conn->proto.ftpc; + +- data->req.p.ftp = ftp = calloc(sizeof(struct FTP), 1); ++ ftp = calloc(sizeof(struct FTP), 1); + if(!ftp) + return CURLE_OUT_OF_MEMORY; + ++ /* clone connection related data that is FTP specific */ ++ if(data->set.str[STRING_FTP_ACCOUNT]) { ++ ftpc->account = strdup(data->set.str[STRING_FTP_ACCOUNT]); ++ if(!ftpc->account) { ++ free(ftp); ++ return CURLE_OUT_OF_MEMORY; ++ } ++ } ++ if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]) { ++ ftpc->alternative_to_user = ++ strdup(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]); ++ if(!ftpc->alternative_to_user) { ++ Curl_safefree(ftpc->account); ++ free(ftp); ++ return CURLE_OUT_OF_MEMORY; ++ } ++ } ++ data->req.p.ftp = ftp; ++ + ftp->path = &data->state.up.path[1]; /* don't include the initial slash */ + + /* FTP URLs support an extension like ";type=<typecode>" that +@@ -4403,7 +4425,9 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data, + /* get some initial data into the ftp struct */ + ftp->transfer = PPTRANSFER_BODY; + ftp->downloadsize = 0; +- conn->proto.ftpc.known_filesize = -1; /* unknown size for now */ ++ ftpc->known_filesize = -1; /* unknown size for now */ ++ ftpc->use_ssl = data->set.use_ssl; ++ ftpc->ccc = data->set.ftp_ccc; + + return CURLE_OK; + } +diff --git a/lib/ftp.h b/lib/ftp.h +index 1cfdac0..afca25b 100644 +--- a/lib/ftp.h ++++ b/lib/ftp.h +@@ -115,6 +115,8 @@ struct FTP { + struct */ + struct ftp_conn { + struct pingpong pp; ++ char *account; ++ char *alternative_to_user; + char *entrypath; /* the PWD reply when we logged on */ + char *file; /* url-decoded file name (or path) */ + char **dirs; /* realloc()ed array for path components */ +@@ -144,6 +146,9 @@ struct ftp_conn { + ftpstate state; /* always use ftp.c:state() to change state! */ + ftpstate state_saved; /* transfer type saved to be reloaded after + data connection is established */ ++ unsigned char use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or ++ IMAP or POP3 or others! (type: curl_usessl)*/ ++ unsigned char ccc; /* ccc level for this connection */ + curl_off_t retr_size_saved; /* Size of retrieved file saved */ + char *server_os; /* The target server operating system. */ + curl_off_t known_filesize; /* file size is different from -1, if wildcard +diff --git a/lib/setopt.c b/lib/setopt.c +index 29a78a4..89d0150 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -2304,7 +2304,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) + arg = va_arg(param, long); + if((arg < CURLUSESSL_NONE) || (arg >= CURLUSESSL_LAST)) + return CURLE_BAD_FUNCTION_ARGUMENT; +- data->set.use_ssl = (curl_usessl)arg; ++ data->set.use_ssl = (unsigned char)arg; + break; + + case CURLOPT_SSL_OPTIONS: +diff --git a/lib/url.c b/lib/url.c +index c397b57..280171c 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -1347,11 +1347,24 @@ ConnectionExists(struct Curl_easy *data, + (check->httpversion >= 20) && + (data->state.httpwant < CURL_HTTP_VERSION_2_0)) + continue; +- +- if(get_protocol_family(needle->handler) == PROTO_FAMILY_SSH) { +- if(!ssh_config_matches(needle, check)) ++#ifdef USE_SSH ++ else if(get_protocol_family(needle->handler) & PROTO_FAMILY_SSH) { ++ if(!ssh_config_matches(needle, check)) + continue; + } ++#endif ++#ifndef CURL_DISABLE_FTP ++ else if(get_protocol_family(needle->handler) & PROTO_FAMILY_FTP) { ++ /* Also match ACCOUNT, ALTERNATIVE-TO-USER, USE_SSL and CCC options */ ++ if(Curl_timestrcmp(needle->proto.ftpc.account, ++ check->proto.ftpc.account) || ++ Curl_timestrcmp(needle->proto.ftpc.alternative_to_user, ++ check->proto.ftpc.alternative_to_user) || ++ (needle->proto.ftpc.use_ssl != check->proto.ftpc.use_ssl) || ++ (needle->proto.ftpc.ccc != check->proto.ftpc.ccc)) ++ continue; ++ } ++#endif + + if((needle->handler->flags&PROTOPT_SSL) + #ifndef CURL_DISABLE_PROXY +diff --git a/lib/urldata.h b/lib/urldata.h +index 69eb2ee..6e6122a 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -1748,8 +1748,6 @@ struct UserDefined { + enum CURL_NETRC_OPTION + use_netrc; /* defined in include/curl.h */ + #endif +- curl_usessl use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or +- IMAP or POP3 or others! */ + long new_file_perms; /* Permissions to use when creating remote files */ + long new_directory_perms; /* Permissions to use when creating remote dirs */ + long ssh_auth_types; /* allowed SSH auth types */ +@@ -1877,6 +1875,8 @@ struct UserDefined { + BIT(http09_allowed); /* allow HTTP/0.9 responses */ + BIT(mail_rcpt_allowfails); /* allow RCPT TO command to fail for some + recipients */ ++ unsigned char use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or ++ IMAP or POP3 or others! (type: curl_usessl)*/ + }; + + struct Names { +-- +2.35.7 + diff --git a/meta/recipes-support/curl/curl/CVE-2023-27536.patch b/meta/recipes-support/curl/curl/CVE-2023-27536.patch new file mode 100644 index 0000000000..d3d1d2dc2e --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-27536.patch @@ -0,0 +1,53 @@ +From cb49e67303dbafbab1cebf4086e3ec15b7d56ee5 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Fri, 10 Mar 2023 09:22:43 +0100 +Subject: [PATCH] url: only reuse connections with same GSS delegation + +Upstream-Status: Backport from [https://github.com/curl/curl/commit/cb49e67303dbafbab1cebf4086e3ec15b7d56ee5] +CVE: CVE-2023-27536 +Signed-off-by: Signed-off-by: Mingli Yu <mingli.yu@windriver.com> +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> +Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> +--- + lib/url.c | 6 ++++++ + lib/urldata.h | 1 + + 2 files changed, 7 insertions(+) + +diff --git a/lib/url.c b/lib/url.c +index 280171c..c6413a1 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -1341,6 +1341,11 @@ ConnectionExists(struct Curl_easy *data, + } + } + ++ /* GSS delegation differences do not actually affect every connection ++ and auth method, but this check takes precaution before efficiency */ ++ if(needle->gssapi_delegation != check->gssapi_delegation) ++ continue; ++ + /* If multiplexing isn't enabled on the h2 connection and h1 is + explicitly requested, handle it: */ + if((needle->handler->protocol & PROTO_FAMILY_HTTP) && +@@ -1813,6 +1818,7 @@ static struct connectdata *allocate_conn(struct Curl_easy *data) + conn->fclosesocket = data->set.fclosesocket; + conn->closesocket_client = data->set.closesocket_client; + conn->lastused = Curl_now(); /* used now */ ++ conn->gssapi_delegation = data->set.gssapi_delegation; + + return conn; + error: +diff --git a/lib/urldata.h b/lib/urldata.h +index 6e6122a..602c735 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -1131,6 +1131,7 @@ struct connectdata { + int socks5_gssapi_enctype; + #endif + unsigned short localport; ++ long gssapi_delegation; /* inherited from set.gssapi_delegation */ + }; + + /* The end of connectdata. */ +-- +2.35.7 diff --git a/meta/recipes-support/curl/curl/CVE-2023-28319.patch b/meta/recipes-support/curl/curl/CVE-2023-28319.patch new file mode 100644 index 0000000000..c0bca9a56e --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-28319.patch @@ -0,0 +1,33 @@ +From 8e21b1a05f3c0ee098dbcb6c3d84cb61f102a122 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Mon, 8 May 2023 14:33:54 +0200 +Subject: [PATCH] libssh2: free fingerprint better + +Reported-by: Wei Chong Tan +Closes #11088 + +CVE: CVE-2023-28319 +Upstream-Status: Backport [https://github.com/curl/curl/commit/8e21b1a05f3c0ee098dbcb6c] +Comments: Hunks Refreshed +Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> +--- + lib/vssh/libssh2.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c +index bfcc94e160178..dd39a844c646b 100644 +--- a/lib/vssh/libssh2.c ++++ b/lib/vssh/libssh2.c +@@ -695,11 +695,10 @@ + */ + if((pub_pos != b64_pos) || + Curl_strncasecompare(fingerprint_b64, pubkey_sha256, pub_pos) != 1) { +- free(fingerprint_b64); +- + failf(data, + "Denied establishing ssh session: mismatch sha256 fingerprint. " + "Remote %s is not equal to %s", fingerprint_b64, pubkey_sha256); ++ free(fingerprint_b64); + state(data, SSH_SESSION_FREE); + sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION; + return sshc->actualcode; diff --git a/meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch b/meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch new file mode 100644 index 0000000000..2ba74aaaa9 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch @@ -0,0 +1,197 @@ +From f446258f0269a62289cca0210157cb8558d0edc3 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 16 May 2023 23:40:42 +0200 +Subject: [PATCH] hostip: include easy_lock.h before using + GLOBAL_INIT_IS_THREADSAFE + +Since that header file is the only place that define can be defined. + +Reported-by: Marc Deslauriers + +Follow-up to 13718030ad4b3209 + +Closes #11121 + +Upstream-Status: Backport [https://github.com/curl/curl/commit/f446258f0269a62289cca0210157cb8558d0edc3] +CVE: CVE-2023-28320 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + lib/easy_lock.h | 109 ++++++++++++++++++++++++++++++++++++++++++++++++ + lib/hostip.c | 10 ++--- + lib/hostip.h | 9 ---- + 3 files changed, 113 insertions(+), 15 deletions(-) + create mode 100644 lib/easy_lock.h + +diff --git a/lib/easy_lock.h b/lib/easy_lock.h +new file mode 100644 +index 0000000..6399a39 +--- /dev/null ++++ b/lib/easy_lock.h +@@ -0,0 +1,109 @@ ++#ifndef HEADER_CURL_EASY_LOCK_H ++#define HEADER_CURL_EASY_LOCK_H ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++ ++#include "curl_setup.h" ++ ++#define GLOBAL_INIT_IS_THREADSAFE ++ ++#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600 ++ ++#ifdef __MINGW32__ ++#ifndef __MINGW64_VERSION_MAJOR ++#if (__MINGW32_MAJOR_VERSION < 5) || \ ++ (__MINGW32_MAJOR_VERSION == 5 && __MINGW32_MINOR_VERSION == 0) ++/* mingw >= 5.0.1 defines SRWLOCK, and slightly different from MS define */ ++typedef PVOID SRWLOCK, *PSRWLOCK; ++#endif ++#endif ++#ifndef SRWLOCK_INIT ++#define SRWLOCK_INIT NULL ++#endif ++#endif /* __MINGW32__ */ ++ ++#define curl_simple_lock SRWLOCK ++#define CURL_SIMPLE_LOCK_INIT SRWLOCK_INIT ++ ++#define curl_simple_lock_lock(m) AcquireSRWLockExclusive(m) ++#define curl_simple_lock_unlock(m) ReleaseSRWLockExclusive(m) ++ ++#elif defined(HAVE_ATOMIC) && defined(HAVE_STDATOMIC_H) ++#include <stdatomic.h> ++#if defined(HAVE_SCHED_YIELD) ++#include <sched.h> ++#endif ++ ++#define curl_simple_lock atomic_int ++#define CURL_SIMPLE_LOCK_INIT 0 ++ ++/* a clang-thing */ ++#ifndef __has_builtin ++#define __has_builtin(x) 0 ++#endif ++ ++#ifndef __INTEL_COMPILER ++/* The Intel compiler tries to look like GCC *and* clang *and* lies in its ++ __has_builtin() function, so override it. */ ++ ++/* if GCC on i386/x86_64 or if the built-in is present */ ++#if ( (defined(__GNUC__) && !defined(__clang__)) && \ ++ (defined(__i386__) || defined(__x86_64__))) || \ ++ __has_builtin(__builtin_ia32_pause) ++#define HAVE_BUILTIN_IA32_PAUSE ++#endif ++ ++#endif ++ ++static inline void curl_simple_lock_lock(curl_simple_lock *lock) ++{ ++ for(;;) { ++ if(!atomic_exchange_explicit(lock, true, memory_order_acquire)) ++ break; ++ /* Reduce cache coherency traffic */ ++ while(atomic_load_explicit(lock, memory_order_relaxed)) { ++ /* Reduce load (not mandatory) */ ++#ifdef HAVE_BUILTIN_IA32_PAUSE ++ __builtin_ia32_pause(); ++#elif defined(__aarch64__) ++ __asm__ volatile("yield" ::: "memory"); ++#elif defined(HAVE_SCHED_YIELD) ++ sched_yield(); ++#endif ++ } ++ } ++} ++ ++static inline void curl_simple_lock_unlock(curl_simple_lock *lock) ++{ ++ atomic_store_explicit(lock, false, memory_order_release); ++} ++ ++#else ++ ++#undef GLOBAL_INIT_IS_THREADSAFE ++ ++#endif ++ ++#endif /* HEADER_CURL_EASY_LOCK_H */ +diff --git a/lib/hostip.c b/lib/hostip.c +index e15c17a..c2e0962 100644 +--- a/lib/hostip.c ++++ b/lib/hostip.c +@@ -72,6 +72,8 @@ + #include <SystemConfiguration/SCDynamicStoreCopySpecific.h> + #endif + ++#include "easy_lock.h" ++ + #if defined(CURLRES_SYNCH) && \ + defined(HAVE_ALARM) && \ + defined(SIGALRM) && \ +@@ -81,10 +83,6 @@ + #define USE_ALARM_TIMEOUT + #endif + +-#ifdef USE_ALARM_TIMEOUT +-#include "easy_lock.h" +-#endif +- + #define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */ + + /* +@@ -260,8 +258,8 @@ void Curl_hostcache_prune(struct Curl_easy *data) + /* Beware this is a global and unique instance. This is used to store the + return address that we can jump back to from inside a signal handler. This + is not thread-safe stuff. */ +-sigjmp_buf curl_jmpenv; +-curl_simple_lock curl_jmpenv_lock; ++static sigjmp_buf curl_jmpenv; ++static curl_simple_lock curl_jmpenv_lock; + #endif + + /* lookup address, returns entry if found and not stale */ +diff --git a/lib/hostip.h b/lib/hostip.h +index 1db5981..a46bdc6 100644 +--- a/lib/hostip.h ++++ b/lib/hostip.h +@@ -189,15 +189,6 @@ Curl_cache_addr(struct Curl_easy *data, struct Curl_addrinfo *addr, + #define CURL_INADDR_NONE INADDR_NONE + #endif + +-#ifdef HAVE_SIGSETJMP +-/* Forward-declaration of variable defined in hostip.c. Beware this +- * is a global and unique instance. This is used to store the return +- * address that we can jump back to from inside a signal handler. +- * This is not thread-safe stuff. +- */ +-extern sigjmp_buf curl_jmpenv; +-#endif +- + /* + * Function provided by the resolver backend to set DNS servers to use. + */ +-- +2.25.1 + diff --git a/meta/recipes-support/curl/curl/CVE-2023-28320.patch b/meta/recipes-support/curl/curl/CVE-2023-28320.patch new file mode 100644 index 0000000000..1e0fc7534a --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-28320.patch @@ -0,0 +1,83 @@ +From 13718030ad4b3209a7583b4f27f683cd3a6fa5f2 Mon Sep 17 00:00:00 2001 +From: Harry Sintonen <sintonen@iki.fi> +Date: Tue, 25 Apr 2023 09:22:26 +0200 +Subject: [PATCH] hostip: add locks around use of global buffer for alarm() + +When building with the sync name resolver and timeout ability we now +require thread-safety to be present to enable it. + +Closes #11030 + +CVE: CVE-2023-28320 +Upstream-Status: Backport [https://github.com/curl/curl/commit/13718030ad4b3209a7583b] +Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> +--- + lib/hostip.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/lib/hostip.c b/lib/hostip.c +index 2381290fdd43e..e410cda69ae6e 100644 +--- a/lib/hostip.c ++++ b/lib/hostip.c +@@ -70,12 +70,19 @@ + #include <SystemConfiguration/SCDynamicStoreCopySpecific.h> + #endif + +-#if defined(CURLRES_SYNCH) && \ +- defined(HAVE_ALARM) && defined(SIGALRM) && defined(HAVE_SIGSETJMP) ++#if defined(CURLRES_SYNCH) && \ ++ defined(HAVE_ALARM) && \ ++ defined(SIGALRM) && \ ++ defined(HAVE_SIGSETJMP) && \ ++ defined(GLOBAL_INIT_IS_THREADSAFE) + /* alarm-based timeouts can only be used with all the dependencies satisfied */ + #define USE_ALARM_TIMEOUT + #endif + ++#ifdef USE_ALARM_TIMEOUT ++#include "easy_lock.h" ++#endif ++ + #define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */ + + /* +@@ -254,11 +261,12 @@ void Curl_hostcache_prune(struct Curl_easy *data) + Curl_share_unlock(data, CURL_LOCK_DATA_DNS); + } + +-#ifdef HAVE_SIGSETJMP ++#ifdef USE_ALARM_TIMEOUT + /* Beware this is a global and unique instance. This is used to store the + return address that we can jump back to from inside a signal handler. This + is not thread-safe stuff. */ + sigjmp_buf curl_jmpenv; ++curl_simple_lock curl_jmpenv_lock; + #endif + + /* lookup address, returns entry if found and not stale */ +@@ -832,7 +840,6 @@ enum resolve_t Curl_resolv(struct Curl_easy *data, + static + void alarmfunc(int sig) + { +- /* this is for "-ansi -Wall -pedantic" to stop complaining! (rabe) */ + (void)sig; + siglongjmp(curl_jmpenv, 1); + } +@@ -912,6 +919,8 @@ enum resolve_t Curl_resolv_timeout(struct Curl_easy *data, + This should be the last thing we do before calling Curl_resolv(), + as otherwise we'd have to worry about variables that get modified + before we invoke Curl_resolv() (and thus use "volatile"). */ ++ curl_simple_lock_lock(&curl_jmpenv_lock); ++ + if(sigsetjmp(curl_jmpenv, 1)) { + /* this is coming from a siglongjmp() after an alarm signal */ + failf(data, "name lookup timed out"); +@@ -980,6 +989,8 @@ enum resolve_t Curl_resolv_timeout(struct Curl_easy *data, + #endif + #endif /* HAVE_SIGACTION */ + ++ curl_simple_lock_unlock(&curl_jmpenv_lock); ++ + /* switch back the alarm() to either zero or to what it was before minus + the time we spent until now! */ + if(prev_alarm) { diff --git a/meta/recipes-support/curl/curl/CVE-2023-28321.patch b/meta/recipes-support/curl/curl/CVE-2023-28321.patch new file mode 100644 index 0000000000..bcd8b112db --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-28321.patch @@ -0,0 +1,302 @@ +From 199f2d440d8659b42670c1b796220792b01a97bf Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Mon, 24 Apr 2023 21:07:02 +0200 +Subject: [PATCH] hostcheck: fix host name wildcard checking + +The leftmost "label" of the host name can now only match against single +'*'. Like the browsers have worked for a long time. + +- extended unit test 1397 for this +- move some SOURCE variables from unit/Makefile.am to unit/Makefile.inc + +Reported-by: Hiroki Kurosawa +Closes #11018 + +CVE: CVE-2023-28321 +Upstream-Status: Backport [https://github.com/curl/curl/commit/199f2d440d8659b42] +Comments: Hunks removed as changes already exist +Removed hunks from files: +tests/unit/Makefile.am +tests/unit/Makefile.inc +Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> +--- + lib/vtls/hostcheck.c | 50 +++++++-------- + tests/data/test1397 | 10 ++- + tests/unit/Makefile.am | 94 ---------------------------- + tests/unit/Makefile.inc | 94 ++++++++++++++++++++++++++++ + tests/unit/unit1397.c | 134 ++++++++++++++++++++++++---------------- + 5 files changed, 202 insertions(+), 180 deletions(-) + +diff --git a/lib/vtls/hostcheck.c b/lib/vtls/hostcheck.c +index e827dc58f378c..d061c6356f97f 100644 +--- a/lib/vtls/hostcheck.c ++++ b/lib/vtls/hostcheck.c +@@ -71,7 +71,12 @@ static bool pmatch(const char *hostname, size_t hostlen, + * apparent distinction between a name and an IP. We need to detect the use of + * an IP address and not wildcard match on such names. + * ++ * Only match on "*" being used for the leftmost label, not "a*", "a*b" nor ++ * "*b". ++ * + * Return TRUE on a match. FALSE if not. ++ * ++ * @unittest: 1397 + */ + + static bool hostmatch(const char *hostname, +@@ -79,53 +84,42 @@ static bool hostmatch(const char *hostname, + const char *pattern, + size_t patternlen) + { +- const char *pattern_label_end, *wildcard, *hostname_label_end; +- size_t prefixlen, suffixlen; ++ const char *pattern_label_end; + +- /* normalize pattern and hostname by stripping off trailing dots */ ++ DEBUGASSERT(pattern); + DEBUGASSERT(patternlen); ++ DEBUGASSERT(hostname); ++ DEBUGASSERT(hostlen); ++ ++ /* normalize pattern and hostname by stripping off trailing dots */ + if(hostname[hostlen-1]=='.') + hostlen--; + if(pattern[patternlen-1]=='.') + patternlen--; + +- wildcard = memchr(pattern, '*', patternlen); +- if(!wildcard) ++ if(strncmp(pattern, "*.", 2)) + return pmatch(hostname, hostlen, pattern, patternlen); + + /* detect IP address as hostname and fail the match if so */ +- if(Curl_host_is_ipnum(hostname)) ++ else if(Curl_host_is_ipnum(hostname)) + return FALSE; + + /* We require at least 2 dots in the pattern to avoid too wide wildcard + match. */ + pattern_label_end = memchr(pattern, '.', patternlen); + if(!pattern_label_end || +- (memrchr(pattern, '.', patternlen) == pattern_label_end) || +- strncasecompare(pattern, "xn--", 4)) ++ (memrchr(pattern, '.', patternlen) == pattern_label_end)) + return pmatch(hostname, hostlen, pattern, patternlen); +- +- hostname_label_end = memchr(hostname, '.', hostlen); +- if(!hostname_label_end) +- return FALSE; + else { +- size_t skiphost = hostname_label_end - hostname; +- size_t skiplen = pattern_label_end - pattern; +- if(!pmatch(hostname_label_end, hostlen - skiphost, +- pattern_label_end, patternlen - skiplen)) +- return FALSE; ++ const char *hostname_label_end = memchr(hostname, '.', hostlen); ++ if(hostname_label_end) { ++ size_t skiphost = hostname_label_end - hostname; ++ size_t skiplen = pattern_label_end - pattern; ++ return pmatch(hostname_label_end, hostlen - skiphost, ++ pattern_label_end, patternlen - skiplen); ++ } + } +- /* The wildcard must match at least one character, so the left-most +- label of the hostname is at least as large as the left-most label +- of the pattern. */ +- if(hostname_label_end - hostname < pattern_label_end - pattern) +- return FALSE; +- +- prefixlen = wildcard - pattern; +- suffixlen = pattern_label_end - (wildcard + 1); +- return strncasecompare(pattern, hostname, prefixlen) && +- strncasecompare(wildcard + 1, hostname_label_end - suffixlen, +- suffixlen) ? TRUE : FALSE; ++ return FALSE; + } + + /* +diff --git a/tests/data/test1397 b/tests/data/test1397 +index 84f962abebee3..f31b2c2a3f330 100644 +--- a/tests/data/test1397 ++++ b/tests/data/test1397 +@@ -2,8 +2,7 @@ + <info> + <keywords> + unittest +-ssl +-wildcard ++Curl_cert_hostcheck + </keywords> + </info> + +@@ -16,9 +15,8 @@ none + <features> + unittest + </features> +- <name> +-Check wildcard certificate matching function Curl_cert_hostcheck +- </name> ++<name> ++Curl_cert_hostcheck unit tests ++</name> + </client> +- + </testcase> +diff --git a/tests/unit/unit1397.c b/tests/unit/unit1397.c +index 2f3d3aa4d09e1..3ae75618d5d10 100644 +--- a/tests/unit/unit1397.c ++++ b/tests/unit/unit1397.c +@@ -23,7 +23,6 @@ + ***************************************************************************/ + #include "curlcheck.h" + +-#include "vtls/hostcheck.h" /* from the lib dir */ + + static CURLcode unit_setup(void) + { +@@ -32,63 +31,94 @@ static CURLcode unit_setup(void) + + static void unit_stop(void) + { +- /* done before shutting down and exiting */ + } + +-UNITTEST_START +- + /* only these backends define the tested functions */ +-#if defined(USE_OPENSSL) || defined(USE_GSKIT) +- +- /* here you start doing things and checking that the results are good */ ++#if defined(USE_OPENSSL) || defined(USE_GSKIT) || defined(USE_SCHANNEL) ++#include "vtls/hostcheck.h" ++struct testcase { ++ const char *host; ++ const char *pattern; ++ bool match; ++}; + +-fail_unless(Curl_cert_hostcheck(STRCONST("www.example.com"), +- STRCONST("www.example.com")), "good 1"); +-fail_unless(Curl_cert_hostcheck(STRCONST("*.example.com"), +- STRCONST("www.example.com")), +- "good 2"); +-fail_unless(Curl_cert_hostcheck(STRCONST("xxx*.example.com"), +- STRCONST("xxxwww.example.com")), "good 3"); +-fail_unless(Curl_cert_hostcheck(STRCONST("f*.example.com"), +- STRCONST("foo.example.com")), "good 4"); +-fail_unless(Curl_cert_hostcheck(STRCONST("192.168.0.0"), +- STRCONST("192.168.0.0")), "good 5"); ++static struct testcase tests[] = { ++ {"", "", FALSE}, ++ {"a", "", FALSE}, ++ {"", "b", FALSE}, ++ {"a", "b", FALSE}, ++ {"aa", "bb", FALSE}, ++ {"\xff", "\xff", TRUE}, ++ {"aa.aa.aa", "aa.aa.bb", FALSE}, ++ {"aa.aa.aa", "aa.aa.aa", TRUE}, ++ {"aa.aa.aa", "*.aa.bb", FALSE}, ++ {"aa.aa.aa", "*.aa.aa", TRUE}, ++ {"192.168.0.1", "192.168.0.1", TRUE}, ++ {"192.168.0.1", "*.168.0.1", FALSE}, ++ {"192.168.0.1", "*.0.1", FALSE}, ++ {"h.ello", "*.ello", FALSE}, ++ {"h.ello.", "*.ello", FALSE}, ++ {"h.ello", "*.ello.", FALSE}, ++ {"h.e.llo", "*.e.llo", TRUE}, ++ {"h.e.llo", " *.e.llo", FALSE}, ++ {" h.e.llo", "*.e.llo", TRUE}, ++ {"h.e.llo.", "*.e.llo", TRUE}, ++ {"*.e.llo.", "*.e.llo", TRUE}, ++ {"************.e.llo.", "*.e.llo", TRUE}, ++ {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ++ "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB" ++ "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC" ++ "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD" ++ "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" ++ ".e.llo.", "*.e.llo", TRUE}, ++ {"\xfe\xfe.e.llo.", "*.e.llo", TRUE}, ++ {"h.e.llo.", "*.e.llo.", TRUE}, ++ {"h.e.llo", "*.e.llo.", TRUE}, ++ {".h.e.llo", "*.e.llo.", FALSE}, ++ {"h.e.llo", "*.*.llo.", FALSE}, ++ {"h.e.llo", "h.*.llo", FALSE}, ++ {"h.e.llo", "h.e.*", FALSE}, ++ {"hello", "*.ello", FALSE}, ++ {"hello", "**llo", FALSE}, ++ {"bar.foo.example.com", "*.example.com", FALSE}, ++ {"foo.example.com", "*.example.com", TRUE}, ++ {"baz.example.net", "b*z.example.net", FALSE}, ++ {"foobaz.example.net", "*baz.example.net", FALSE}, ++ {"xn--l8j.example.local", "x*.example.local", FALSE}, ++ {"xn--l8j.example.net", "*.example.net", TRUE}, ++ {"xn--l8j.example.net", "*j.example.net", FALSE}, ++ {"xn--l8j.example.net", "xn--l8j.example.net", TRUE}, ++ {"xn--l8j.example.net", "xn--l8j.*.net", FALSE}, ++ {"xl8j.example.net", "*.example.net", TRUE}, ++ {"fe80::3285:a9ff:fe46:b619", "*::3285:a9ff:fe46:b619", FALSE}, ++ {"fe80::3285:a9ff:fe46:b619", "fe80::3285:a9ff:fe46:b619", TRUE}, ++ {NULL, NULL, FALSE} ++}; + +-fail_if(Curl_cert_hostcheck(STRCONST("xxx.example.com"), +- STRCONST("www.example.com")), "bad 1"); +-fail_if(Curl_cert_hostcheck(STRCONST("*"), +- STRCONST("www.example.com")),"bad 2"); +-fail_if(Curl_cert_hostcheck(STRCONST("*.*.com"), +- STRCONST("www.example.com")), "bad 3"); +-fail_if(Curl_cert_hostcheck(STRCONST("*.example.com"), +- STRCONST("baa.foo.example.com")), "bad 4"); +-fail_if(Curl_cert_hostcheck(STRCONST("f*.example.com"), +- STRCONST("baa.example.com")), "bad 5"); +-fail_if(Curl_cert_hostcheck(STRCONST("*.com"), +- STRCONST("example.com")), "bad 6"); +-fail_if(Curl_cert_hostcheck(STRCONST("*fail.com"), +- STRCONST("example.com")), "bad 7"); +-fail_if(Curl_cert_hostcheck(STRCONST("*.example."), +- STRCONST("www.example.")), "bad 8"); +-fail_if(Curl_cert_hostcheck(STRCONST("*.example."), +- STRCONST("www.example")), "bad 9"); +-fail_if(Curl_cert_hostcheck(STRCONST(""), STRCONST("www")), "bad 10"); +-fail_if(Curl_cert_hostcheck(STRCONST("*"), STRCONST("www")), "bad 11"); +-fail_if(Curl_cert_hostcheck(STRCONST("*.168.0.0"), +- STRCONST("192.168.0.0")), "bad 12"); +-fail_if(Curl_cert_hostcheck(STRCONST("www.example.com"), +- STRCONST("192.168.0.0")), "bad 13"); +- +-#ifdef ENABLE_IPV6 +-fail_if(Curl_cert_hostcheck(STRCONST("*::3285:a9ff:fe46:b619"), +- STRCONST("fe80::3285:a9ff:fe46:b619")), "bad 14"); +-fail_unless(Curl_cert_hostcheck(STRCONST("fe80::3285:a9ff:fe46:b619"), +- STRCONST("fe80::3285:a9ff:fe46:b619")), +- "good 6"); +-#endif ++UNITTEST_START ++{ ++ int i; ++ for(i = 0; tests[i].host; i++) { ++ if(tests[i].match != Curl_cert_hostcheck(tests[i].pattern, ++ strlen(tests[i].pattern), ++ tests[i].host, ++ strlen(tests[i].host))) { ++ fprintf(stderr, ++ "HOST: %s\n" ++ "PTRN: %s\n" ++ "did %sMATCH\n", ++ tests[i].host, ++ tests[i].pattern, ++ tests[i].match ? "NOT ": ""); ++ unitfail++; ++ } ++ } ++} + +-#endif ++UNITTEST_STOP ++#else + +- /* you end the test code like this: */ ++UNITTEST_START + + UNITTEST_STOP ++#endif diff --git a/meta/recipes-support/curl/curl/CVE-2023-28322-1.patch b/meta/recipes-support/curl/curl/CVE-2023-28322-1.patch new file mode 100644 index 0000000000..547127001d --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-28322-1.patch @@ -0,0 +1,84 @@ +From efbf02111aa66bda9288506b7d5cc0226bf5453e Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Sun, 12 Feb 2023 13:24:08 +0100 +Subject: [PATCH] smb: return error on upload without size + +The protocol needs to know the size ahead of time, this is now a known +restriction and not a bug. + +Also output a clearer error if the URL path does not contain proper +share. + +Ref: #7896 +Closes #10484 + +CVE: CVE-2023-28322 +Upstream-Status: Backport [https://github.com/curl/curl/commit/efbf02111aa66bda9288506b7d5cc0226bf5453e] +Comments: Hunks refreshed +Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> +--- + docs/KNOWN_BUGS | 5 ----- + docs/URL-SYNTAX.md | 3 +++ + lib/smb.c | 6 ++++++ + 3 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/docs/KNOWN_BUGS b/docs/KNOWN_BUGS +index cbf5be352a279..a515e7a59bdfd 100644 +--- a/docs/KNOWN_BUGS ++++ b/docs/KNOWN_BUGS +@@ -58,7 +58,6 @@ + 5.7 Visual Studio project gaps + 5.8 configure finding libs in wrong directory + 5.9 Utilize Requires.private directives in libcurl.pc +- 5.10 curl hangs on SMB upload over stdin + 5.11 configure --with-gssapi with Heimdal is ignored on macOS + 5.12 flaky Windows CI builds + +@@ -332,10 +331,6 @@ problems may have been fixed or changed somewhat since this was written. + + https://github.com/curl/curl/issues/864 + +-5.10 curl hangs on SMB upload over stdin +- +- See https://github.com/curl/curl/issues/7896 +- + 5.11 configure --with-gssapi with Heimdal is ignored on macOS + + ... unless you also pass --with-gssapi-libs +diff --git a/docs/URL-SYNTAX.md b/docs/URL-SYNTAX.md +index 691fcceacd66c..802bbdef96979 100644 +--- a/docs/URL-SYNTAX.md ++++ b/docs/URL-SYNTAX.md +@@ -360,6 +360,9 @@ share and directory or the share to upload to and as such, may not be omitted. + If the user name is embedded in the URL then it must contain the domain name + and as such, the backslash must be URL encoded as %2f. + ++When uploading to SMB, the size of the file needs to be known ahead of time, ++meaning that you can upload a file passed to curl over a pipe like stdin. ++ + curl supports SMB version 1 (only) + + ## SMTP +diff --git a/lib/smb.c b/lib/smb.c +index 8a76763c157ce..dc0abe784bcee 100644 +--- a/lib/smb.c ++++ b/lib/smb.c +@@ -763,6 +763,11 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done) + void *msg = NULL; + const struct smb_nt_create_response *smb_m; + ++ if(data->set.upload && (data->state.infilesize < 0)) { ++ failf(data, "SMB upload needs to know the size up front"); ++ return CURLE_SEND_ERROR; ++ } ++ + /* Start the request */ + if(req->state == SMB_REQUESTING) { + result = smb_send_tree_connect(data); +@@ -993,6 +998,7 @@ static CURLcode smb_parse_url_path(struct Curl_easy *data, + /* The share must be present */ + if(!slash) { + Curl_safefree(smbc->share); ++ failf(data, "missing share in URL path for SMB"); + return CURLE_URL_MALFORMAT; + } diff --git a/meta/recipes-support/curl/curl/CVE-2023-28322-2.patch b/meta/recipes-support/curl/curl/CVE-2023-28322-2.patch new file mode 100644 index 0000000000..f2134dd1c3 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-28322-2.patch @@ -0,0 +1,436 @@ +From 7815647d6582c0a4900be2e1de6c5e61272c496b Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 25 Apr 2023 08:28:01 +0200 +Subject: [PATCH] lib: unify the upload/method handling + +By making sure we set state.upload based on the set.method value and not +independently as set.upload, we reduce confusion and mixup risks, both +internally and externally. + +Closes #11017 + +CVE: CVE-2023-28322 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7815647d6582c0a4900be2e1de] +Comments: Hunks refreshed +Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> +--- + lib/curl_rtmp.c | 4 ++-- + lib/file.c | 4 ++-- + lib/ftp.c | 8 ++++---- + lib/http.c | 4 ++-- + lib/imap.c | 6 +++--- + lib/rtsp.c | 4 ++-- + lib/setopt.c | 6 ++---- + lib/smb.c | 6 +++--- + lib/smtp.c | 4 ++-- + lib/tftp.c | 8 ++++---- + lib/transfer.c | 4 ++-- + lib/urldata.h | 2 +- + lib/vssh/libssh.c | 6 +++--- + lib/vssh/libssh2.c | 6 +++--- + lib/vssh/wolfssh.c | 2 +- + 15 files changed, 36 insertions(+), 38 deletions(-) + +diff --git a/lib/curl_rtmp.c b/lib/curl_rtmp.c +index 2679a2cdc1afe..406fb42ac0f44 100644 +--- a/lib/curl_rtmp.c ++++ b/lib/curl_rtmp.c +@@ -231,7 +231,7 @@ static CURLcode rtmp_connect(struct Curl_easy *data, bool *done) + /* We have to know if it's a write before we send the + * connect request packet + */ +- if(data->set.upload) ++ if(data->state.upload) + r->Link.protocol |= RTMP_FEATURE_WRITE; + + /* For plain streams, use the buffer toggle trick to keep data flowing */ +@@ -263,7 +263,7 @@ static CURLcode rtmp_do(struct Curl_easy *data, bool *done) + if(!RTMP_ConnectStream(r, 0)) + return CURLE_FAILED_INIT; + +- if(data->set.upload) { ++ if(data->state.upload) { + Curl_pgrsSetUploadSize(data, data->state.infilesize); + Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET); + } +diff --git a/lib/file.c b/lib/file.c +index 51c5d07ce40ab..c751e8861a99b 100644 +--- a/lib/file.c ++++ b/lib/file.c +@@ -240,7 +240,7 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done) + file->freepath = real_path; /* free this when done */ + + file->fd = fd; +- if(!data->set.upload && (fd == -1)) { ++ if(!data->state.upload && (fd == -1)) { + failf(data, "Couldn't open file %s", data->state.up.path); + file_done(data, CURLE_FILE_COULDNT_READ_FILE, FALSE); + return CURLE_FILE_COULDNT_READ_FILE; +@@ -422,7 +422,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done) + + Curl_pgrsStartNow(data); + +- if(data->set.upload) ++ if(data->state.upload) + return file_upload(data); + + file = data->req.p.file; +diff --git a/lib/ftp.c b/lib/ftp.c +index f50d7baf622f8..4ff68cc454cbc 100644 +--- a/lib/ftp.c ++++ b/lib/ftp.c +@@ -1348,7 +1348,7 @@ static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data) + data->set.str[STRING_CUSTOMREQUEST]? + data->set.str[STRING_CUSTOMREQUEST]: + (data->state.list_only?"NLST":"LIST")); +- else if(data->set.upload) ++ else if(data->state.upload) + result = Curl_pp_sendf(data, &ftpc->pp, "PRET STOR %s", + conn->proto.ftpc.file); + else +@@ -3384,7 +3384,7 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status, + /* the response code from the transfer showed an error already so no + use checking further */ + ; +- else if(data->set.upload) { ++ else if(data->state.upload) { + if((-1 != data->state.infilesize) && + (data->state.infilesize != data->req.writebytecount) && + !data->set.crlf && +@@ -3640,7 +3640,7 @@ static CURLcode ftp_do_more(struct Curl_easy *data, int *completep) + connected back to us */ + } + } +- else if(data->set.upload) { ++ else if(data->state.upload) { + result = ftp_nb_type(data, conn, data->state.prefer_ascii, + FTP_STOR_TYPE); + if(result) +@@ -4233,7 +4233,7 @@ + ftpc->file = NULL; /* instead of point to a zero byte, + we make it a NULL pointer */ + +- if(data->set.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) { ++ if(data->state.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) { + /* We need a file name when uploading. Return error! */ + failf(data, "Uploading to a URL without a file name!"); + free(rawPath); +diff --git a/lib/http.c b/lib/http.c +index 80e43f6f361e8..bffdd3468536d 100644 +--- a/lib/http.c ++++ b/lib/http.c +@@ -2033,7 +2033,7 @@ + Curl_HttpReq httpreq = data->state.httpreq; + const char *request; + if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) && +- data->set.upload) ++ data->state.upload) + httpreq = HTTPREQ_PUT; + + /* Now set the 'request' pointer to the proper request string */ +@@ -2423,7 +2423,7 @@ CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn, + if((conn->handler->protocol & PROTO_FAMILY_HTTP) && + (((httpreq == HTTPREQ_POST_MIME || httpreq == HTTPREQ_POST_FORM) && + http->postsize < 0) || +- ((data->set.upload || httpreq == HTTPREQ_POST) && ++ ((data->state.upload || httpreq == HTTPREQ_POST) && + data->state.infilesize == -1))) { + if(conn->bits.authneg) + /* don't enable chunked during auth neg */ +diff --git a/lib/imap.c b/lib/imap.c +index c2f675d4b2618..1952e66a1efcd 100644 +--- a/lib/imap.c ++++ b/lib/imap.c +@@ -1511,11 +1511,11 @@ static CURLcode imap_done(struct Curl_easy *data, CURLcode status, + result = status; /* use the already set error code */ + } + else if(!data->set.connect_only && !imap->custom && +- (imap->uid || imap->mindex || data->set.upload || ++ (imap->uid || imap->mindex || data->state.upload || + data->set.mimepost.kind != MIMEKIND_NONE)) { + /* Handle responses after FETCH or APPEND transfer has finished */ + +- if(!data->set.upload && data->set.mimepost.kind == MIMEKIND_NONE) ++ if(!data->state.upload && data->set.mimepost.kind == MIMEKIND_NONE) + state(data, IMAP_FETCH_FINAL); + else { + /* End the APPEND command first by sending an empty line */ +@@ -1581,7 +1581,7 @@ static CURLcode imap_perform(struct Curl_easy *data, bool *connected, + selected = TRUE; + + /* Start the first command in the DO phase */ +- if(data->set.upload || data->set.mimepost.kind != MIMEKIND_NONE) ++ if(data->state.upload || data->set.mimepost.kind != MIMEKIND_NONE) + /* APPEND can be executed directly */ + result = imap_perform_append(data); + else if(imap->custom && (selected || !imap->mailbox)) +diff --git a/lib/rtsp.c b/lib/rtsp.c +index ea99d720ec4eb..ccd7264b00e74 100644 +--- a/lib/rtsp.c ++++ b/lib/rtsp.c +@@ -493,7 +493,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done) + rtspreq == RTSPREQ_SET_PARAMETER || + rtspreq == RTSPREQ_GET_PARAMETER) { + +- if(data->set.upload) { ++ if(data->state.upload) { + putsize = data->state.infilesize; + data->state.httpreq = HTTPREQ_PUT; + +@@ -512,7 +512,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done) + result = + Curl_dyn_addf(&req_buffer, + "Content-Length: %" CURL_FORMAT_CURL_OFF_T"\r\n", +- (data->set.upload ? putsize : postsize)); ++ (data->state.upload ? putsize : postsize)); + if(result) + return result; + } +diff --git a/lib/setopt.c b/lib/setopt.c +index 38f5711e44191..0c3b9634d1192 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -333,8 +333,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) + * We want to sent data to the remote host. If this is HTTP, that equals + * using the PUT request. + */ +- data->set.upload = (0 != va_arg(param, long)) ? TRUE : FALSE; +- if(data->set.upload) { ++ arg = va_arg(param, long); ++ if(arg) { + /* If this is HTTP, PUT is what's needed to "upload" */ + data->set.method = HTTPREQ_PUT; + data->set.opt_no_body = FALSE; /* this is implied */ +@@ -625,7 +625,6 @@ + } + else + data->set.method = HTTPREQ_GET; +- data->set.upload = FALSE; + break; + + case CURLOPT_HTTPPOST: +@@ -888,7 +887,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) + */ + if(va_arg(param, long)) { + data->set.method = HTTPREQ_GET; +- data->set.upload = FALSE; /* switch off upload */ + data->set.opt_no_body = FALSE; /* this is implied */ + } + break; +diff --git a/lib/smb.c b/lib/smb.c +index a1e444ee6b97e..d6822213529bc 100644 +--- a/lib/smb.c ++++ b/lib/smb.c +@@ -530,7 +530,7 @@ static CURLcode smb_send_open(struct Curl_easy *data) + byte_count = strlen(req->path); + msg.name_length = smb_swap16((unsigned short)byte_count); + msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL); +- if(data->set.upload) { ++ if(data->state.upload) { + msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE); + msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF); + } +@@ -762,7 +762,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done) + void *msg = NULL; + const struct smb_nt_create_response *smb_m; + +- if(data->set.upload && (data->state.infilesize < 0)) { ++ if(data->state.upload && (data->state.infilesize < 0)) { + failf(data, "SMB upload needs to know the size up front"); + return CURLE_SEND_ERROR; + } +@@ -813,7 +813,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done) + smb_m = (const struct smb_nt_create_response*) msg; + req->fid = smb_swap16(smb_m->fid); + data->req.offset = 0; +- if(data->set.upload) { ++ if(data->state.upload) { + data->req.size = data->state.infilesize; + Curl_pgrsSetUploadSize(data, data->req.size); + next_state = SMB_UPLOAD; +diff --git a/lib/smtp.c b/lib/smtp.c +index 7a030308d4689..c182cace742d7 100644 +--- a/lib/smtp.c ++++ b/lib/smtp.c +@@ -1419,7 +1419,7 @@ static CURLcode smtp_done(struct Curl_easy *data, CURLcode status, + result = status; /* use the already set error code */ + } + else if(!data->set.connect_only && data->set.mail_rcpt && +- (data->set.upload || data->set.mimepost.kind)) { ++ (data->state.upload || data->set.mimepost.kind)) { + /* Calculate the EOB taking into account any terminating CRLF from the + previous line of the email or the CRLF of the DATA command when there + is "no mail data". RFC-5321, sect. 4.1.1.4. +@@ -1511,7 +1511,7 @@ static CURLcode smtp_perform(struct Curl_easy *data, bool *connected, + smtp->eob = 2; + + /* Start the first command in the DO phase */ +- if((data->set.upload || data->set.mimepost.kind) && data->set.mail_rcpt) ++ if((data->state.upload || data->set.mimepost.kind) && data->set.mail_rcpt) + /* MAIL transfer */ + result = smtp_perform_mail(data); + else +diff --git a/lib/tftp.c b/lib/tftp.c +index 164d3c723c5b9..8ed1b887b4d21 100644 +--- a/lib/tftp.c ++++ b/lib/tftp.c +@@ -370,7 +370,7 @@ static CURLcode tftp_parse_option_ack(struct tftp_state_data *state, + + /* tsize should be ignored on upload: Who cares about the size of the + remote file? */ +- if(!data->set.upload) { ++ if(!data->state.upload) { + if(!tsize) { + failf(data, "invalid tsize -:%s:- value in OACK packet", value); + return CURLE_TFTP_ILLEGAL; +@@ -451,7 +451,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state, + return result; + } + +- if(data->set.upload) { ++ if(data->state.upload) { + /* If we are uploading, send an WRQ */ + setpacketevent(&state->spacket, TFTP_EVENT_WRQ); + state->data->req.upload_fromhere = +@@ -486,7 +486,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state, + if(!data->set.tftp_no_options) { + char buf[64]; + /* add tsize option */ +- if(data->set.upload && (data->state.infilesize != -1)) ++ if(data->state.upload && (data->state.infilesize != -1)) + msnprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T, + data->state.infilesize); + else +@@ -540,7 +540,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state, + break; + + case TFTP_EVENT_OACK: +- if(data->set.upload) { ++ if(data->state.upload) { + result = tftp_connect_for_tx(state, event); + } + else { +diff --git a/lib/transfer.c b/lib/transfer.c +index e9ab8fbf09510..cb69f3365855a 100644 +--- a/lib/transfer.c ++++ b/lib/transfer.c +@@ -1293,6 +1293,7 @@ void Curl_init_CONNECT(struct Curl_easy *data) + { + data->state.fread_func = data->set.fread_func_set; + data->state.in = data->set.in_set; ++ data->state.upload = (data->state.httpreq == HTTPREQ_PUT); + } + + /* +@@ -1767,7 +1767,6 @@ + data->state.httpreq != HTTPREQ_POST_MIME) || + !(data->set.keep_post & CURL_REDIR_POST_303))) { + data->state.httpreq = HTTPREQ_GET; +- data->set.upload = false; + infof(data, "Switch to %s", + data->set.opt_no_body?"HEAD":"GET"); + } +@@ -1770,7 +1770,7 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url) + + /* if we're talking upload, we can't do the checks below, unless the protocol + is HTTP as when uploading over HTTP we will still get a response */ +- if(data->set.upload && ++ if(data->state.upload && + !(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP))) + return CURLE_OK; + +diff --git a/lib/urldata.h b/lib/urldata.h +index cca992a0295aa..a8580bdb66fe8 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -1487,6 +1487,7 @@ + BIT(url_alloc); /* URL string is malloc()'ed */ + BIT(referer_alloc); /* referer string is malloc()ed */ + BIT(wildcard_resolve); /* Set to true if any resolve change is a wildcard */ ++ BIT(upload); /* upload request */ + }; + + /* +@@ -1838,7 +1839,6 @@ struct UserDefined { + BIT(http_auto_referer); /* set "correct" referer when following + location: */ + BIT(opt_no_body); /* as set with CURLOPT_NOBODY */ +- BIT(upload); /* upload request */ + BIT(verbose); /* output verbosity */ + BIT(krb); /* Kerberos connection requested */ + BIT(reuse_forbid); /* forbidden to be reused, close after use */ +diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c +index b31f741ba9492..d60edaa303642 100644 +--- a/lib/vssh/libssh.c ++++ b/lib/vssh/libssh.c +@@ -1209,7 +1209,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block) + } + + case SSH_SFTP_TRANS_INIT: +- if(data->set.upload) ++ if(data->state.upload) + state(data, SSH_SFTP_UPLOAD_INIT); + else { + if(protop->path[strlen(protop->path)-1] == '/') +@@ -1802,7 +1802,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block) + /* Functions from the SCP subsystem cannot handle/return SSH_AGAIN */ + ssh_set_blocking(sshc->ssh_session, 1); + +- if(data->set.upload) { ++ if(data->state.upload) { + if(data->state.infilesize < 0) { + failf(data, "SCP requires a known file size for upload"); + sshc->actualcode = CURLE_UPLOAD_FAILED; +@@ -1907,7 +1907,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block) + break; + } + case SSH_SCP_DONE: +- if(data->set.upload) ++ if(data->state.upload) + state(data, SSH_SCP_SEND_EOF); + else + state(data, SSH_SCP_CHANNEL_FREE); +diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c +index f1154dc47a74e..f2e5352d1fd3a 100644 +--- a/lib/vssh/libssh2.c ++++ b/lib/vssh/libssh2.c +@@ -2019,7 +2019,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block) + } + + case SSH_SFTP_TRANS_INIT: +- if(data->set.upload) ++ if(data->state.upload) + state(data, SSH_SFTP_UPLOAD_INIT); + else { + if(sshp->path[strlen(sshp->path)-1] == '/') +@@ -2691,7 +2691,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block) + break; + } + +- if(data->set.upload) { ++ if(data->state.upload) { + if(data->state.infilesize < 0) { + failf(data, "SCP requires a known file size for upload"); + sshc->actualcode = CURLE_UPLOAD_FAILED; +@@ -2831,7 +2831,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block) + break; + + case SSH_SCP_DONE: +- if(data->set.upload) ++ if(data->state.upload) + state(data, SSH_SCP_SEND_EOF); + else + state(data, SSH_SCP_CHANNEL_FREE); +diff --git a/lib/vssh/wolfssh.c b/lib/vssh/wolfssh.c +index 17d59ecd23bc8..2ca91b7363b1d 100644 +--- a/lib/vssh/wolfssh.c ++++ b/lib/vssh/wolfssh.c +@@ -557,7 +557,7 @@ static CURLcode wssh_statemach_act(struct Curl_easy *data, bool *block) + } + break; + case SSH_SFTP_TRANS_INIT: +- if(data->set.upload) ++ if(data->state.upload) + state(data, SSH_SFTP_UPLOAD_INIT); + else { + if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/') diff --git a/meta/recipes-support/curl/curl/CVE-2023-38545.patch b/meta/recipes-support/curl/curl/CVE-2023-38545.patch new file mode 100644 index 0000000000..c198d29c04 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-38545.patch @@ -0,0 +1,133 @@ +From fb4415d8aee6c1045be932a34fe6107c2f5ed147 Mon Sep 17 00:00:00 2001 +From: Jay Satiro <raysatiro@yahoo.com> +Date: Wed, 11 Oct 2023 07:34:19 +0200 +Subject: [PATCH] socks: return error if hostname too long for remote resolve + +Prior to this change the state machine attempted to change the remote +resolve to a local resolve if the hostname was longer than 255 +characters. Unfortunately that did not work as intended and caused a +security issue. + +Upstream-Status: Backport [https://github.com/curl/curl/commit/fb4415d8aee6c1045be932a34fe6107c2f5ed147] + +CVE: CVE-2023-38545 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + lib/socks.c | 8 +++--- + tests/data/Makefile.inc | 2 +- + tests/data/test722 | 64 +++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 69 insertions(+), 5 deletions(-) + create mode 100644 tests/data/test722 + +diff --git a/lib/socks.c b/lib/socks.c +index a014aa6..2215c02 100644 +--- a/lib/socks.c ++++ b/lib/socks.c +@@ -536,9 +536,9 @@ CURLproxycode Curl_SOCKS5(const char *proxy_user, + + /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */ + if(!socks5_resolve_local && hostname_len > 255) { +- infof(data, "SOCKS5: server resolving disabled for hostnames of " +- "length > 255 [actual len=%zu]", hostname_len); +- socks5_resolve_local = TRUE; ++ failf(data, "SOCKS5: the destination hostname is too long to be " ++ "resolved remotely by the proxy."); ++ return CURLPX_LONG_HOSTNAME; + } + + if(auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI)) +@@ -879,7 +879,7 @@ CURLproxycode Curl_SOCKS5(const char *proxy_user, + } + else { + socksreq[len++] = 3; +- socksreq[len++] = (char) hostname_len; /* one byte address length */ ++ socksreq[len++] = (unsigned char) hostname_len; /* one byte length */ + memcpy(&socksreq[len], hostname, hostname_len); /* address w/o NULL */ + len += hostname_len; + } +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 3064b39..47117b6 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -99,7 +99,7 @@ test670 test671 test672 test673 test674 test675 test676 test677 test678 \ + \ + test700 test701 test702 test703 test704 test705 test706 test707 test708 \ + test709 test710 test711 test712 test713 test714 test715 test716 test717 \ +-test718 test719 test720 test721 \ ++test718 test719 test720 test721 test722 \ + \ + test800 test801 test802 test803 test804 test805 test806 test807 test808 \ + test809 test810 test811 test812 test813 test814 test815 test816 test817 \ +diff --git a/tests/data/test722 b/tests/data/test722 +new file mode 100644 +index 0000000..05bcf28 +--- /dev/null ++++ b/tests/data/test722 +@@ -0,0 +1,64 @@ ++<testcase> ++<info> ++<keywords> ++HTTP ++HTTP GET ++SOCKS5 ++SOCKS5h ++followlocation ++</keywords> ++</info> ++ ++# ++# Server-side ++<reply> ++# The hostname in this redirect is 256 characters and too long (> 255) for ++# SOCKS5 remote resolve. curl must return error CURLE_PROXY in this case. ++<data> ++HTTP/1.1 301 Moved Permanently ++Location: http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/ ++Content-Length: 0 ++Connection: close ++ ++</data> ++</reply> ++ ++# ++# Client-side ++<client> ++<features> ++proxy ++</features> ++<server> ++http ++socks5 ++</server> ++ <name> ++SOCKS5h with HTTP redirect to hostname too long ++ </name> ++ <command> ++--no-progress-meter --location --proxy socks5h://%HOSTIP:%SOCKSPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER ++</command> ++</client> ++ ++# ++# Verify data after the test has been "shot" ++<verify> ++<protocol crlf="yes"> ++GET /%TESTNUMBER HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++</protocol> ++<errorcode> ++97 ++</errorcode> ++# the error message is verified because error code CURLE_PROXY (97) may be ++# returned for any number of reasons and we need to make sure it is ++# specifically for the reason below so that we know the check is working. ++<stderr mode="text"> ++curl: (97) SOCKS5: the destination hostname is too long to be resolved remotely by the proxy. ++</stderr> ++</verify> ++</testcase> +-- +2.40.0 diff --git a/meta/recipes-support/curl/curl/CVE-2023-38546.patch b/meta/recipes-support/curl/curl/CVE-2023-38546.patch new file mode 100644 index 0000000000..1b2f1e7a7d --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-38546.patch @@ -0,0 +1,137 @@ +From 61275672b46d9abb3285740467b882e22ed75da8 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 14 Sep 2023 23:28:32 +0200 +Subject: [PATCH] cookie: remove unnecessary struct fields + +Plus: reduce the hash table size from 256 to 63. It seems unlikely to +make much of a speed difference for most use cases but saves 1.5KB of +data per instance. + +Closes #11862 + +Upstream-Status: Backport [https://github.com/curl/curl/commit/61275672b46d9abb32857404] + +CVE: CVE-2023-38546 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + lib/cookie.c | 13 +------------ + lib/cookie.h | 13 ++++--------- + lib/easy.c | 4 +--- + 3 files changed, 6 insertions(+), 24 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index e0470a1..38d8d6c 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -115,7 +115,6 @@ static void freecookie(struct Cookie *co) + free(co->name); + free(co->value); + free(co->maxage); +- free(co->version); + free(co); + } + +@@ -707,11 +706,7 @@ Curl_cookie_add(struct Curl_easy *data, + } + } + else if(strcasecompare("version", name)) { +- strstore(&co->version, whatptr); +- if(!co->version) { +- badcookie = TRUE; +- break; +- } ++ /* just ignore */ + } + else if(strcasecompare("max-age", name)) { + /* +@@ -1132,7 +1127,6 @@ Curl_cookie_add(struct Curl_easy *data, + free(clist->path); + free(clist->spath); + free(clist->expirestr); +- free(clist->version); + free(clist->maxage); + + *clist = *co; /* then store all the new data */ +@@ -1210,9 +1204,6 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy *data, + c = calloc(1, sizeof(struct CookieInfo)); + if(!c) + return NULL; /* failed to get memory */ +- c->filename = strdup(file?file:"none"); /* copy the name just in case */ +- if(!c->filename) +- goto fail; /* failed to get memory */ + /* + * Initialize the next_expiration time to signal that we don't have enough + * information yet. +@@ -1363,7 +1354,6 @@ static struct Cookie *dup_cookie(struct Cookie *src) + CLONE(name); + CLONE(value); + CLONE(maxage); +- CLONE(version); + d->expires = src->expires; + d->tailmatch = src->tailmatch; + d->secure = src->secure; +@@ -1579,7 +1569,6 @@ void Curl_cookie_cleanup(struct CookieInfo *c) + { + if(c) { + unsigned int i; +- free(c->filename); + for(i = 0; i < COOKIE_HASH_SIZE; i++) + Curl_cookie_freelist(c->cookies[i]); + free(c); /* free the base struct as well */ +diff --git a/lib/cookie.h b/lib/cookie.h +index 7411980..645600a 100644 +--- a/lib/cookie.h ++++ b/lib/cookie.h +@@ -34,11 +34,7 @@ struct Cookie { + char *domain; /* domain = <this> */ + curl_off_t expires; /* expires = <this> */ + char *expirestr; /* the plain text version */ +- +- /* RFC 2109 keywords. Version=1 means 2109-compliant cookie sending */ +- char *version; /* Version = <value> */ + char *maxage; /* Max-Age = <value> */ +- + bool tailmatch; /* whether we do tail-matching of the domain name */ + bool secure; /* whether the 'secure' keyword was used */ + bool livecookie; /* updated from a server, not a stored file */ +@@ -54,18 +50,17 @@ struct Cookie { + #define COOKIE_PREFIX__SECURE (1<<0) + #define COOKIE_PREFIX__HOST (1<<1) + +-#define COOKIE_HASH_SIZE 256 ++#define COOKIE_HASH_SIZE 63 + + struct CookieInfo { + /* linked list of cookies we know of */ + struct Cookie *cookies[COOKIE_HASH_SIZE]; + +- char *filename; /* file we read from/write to */ +- long numcookies; /* number of cookies in the "jar" */ ++ curl_off_t next_expiration; /* the next time at which expiration happens */ ++ int numcookies; /* number of cookies in the "jar" */ ++ int lastct; /* last creation-time used in the jar */ + bool running; /* state info, for cookie adding information */ + bool newsession; /* new session, discard session cookies on load */ +- int lastct; /* last creation-time used in the jar */ +- curl_off_t next_expiration; /* the next time at which expiration happens */ + }; + + /* This is the maximum line length we accept for a cookie line. RFC 2109 +diff --git a/lib/easy.c b/lib/easy.c +index 0e23561..31abf9e 100644 +--- a/lib/easy.c ++++ b/lib/easy.c +@@ -841,9 +841,7 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data) + if(data->cookies) { + /* If cookies are enabled in the parent handle, we enable them + in the clone as well! */ +- outcurl->cookies = Curl_cookie_init(data, +- data->cookies->filename, +- outcurl->cookies, ++ outcurl->cookies = Curl_cookie_init(data, NULL, outcurl->cookies, + data->set.cookiesession); + if(!outcurl->cookies) + goto fail; +-- +2.40.0 diff --git a/meta/recipes-support/curl/curl/CVE-2023-46218.patch b/meta/recipes-support/curl/curl/CVE-2023-46218.patch new file mode 100644 index 0000000000..d7d7908ea0 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-46218.patch @@ -0,0 +1,52 @@ +Backport of: + +From 2b0994c29a721c91c572cff7808c572a24d251eb Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 23 Nov 2023 08:15:47 +0100 +Subject: [PATCH] cookie: lowercase the domain names before PSL checks + +Reported-by: Harry Sintonen + +Closes #12387 + +CVE: CVE-2023-46218 +Upstream-Status: Backport [https://github.com/curl/curl/commit/2b0994c29a721c91c57] +Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> +--- + lib/cookie.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -1044,15 +1044,23 @@ Curl_cookie_add(struct Curl_easy *data, + * dereference it. + */ + if(data && (domain && co->domain && !Curl_host_is_ipnum(co->domain))) { +- const psl_ctx_t *psl = Curl_psl_use(data); +- int acceptable; +- +- if(psl) { +- acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain); +- Curl_psl_release(data); ++ bool acceptable = FALSE; ++ char lcase[256]; ++ char lcookie[256]; ++ size_t dlen = strlen(domain); ++ size_t clen = strlen(co->domain); ++ if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) { ++ const psl_ctx_t *psl = Curl_psl_use(data); ++ if(psl) { ++ /* the PSL check requires lowercase domain name and pattern */ ++ Curl_strntolower(lcase, domain, dlen + 1); ++ Curl_strntolower(lcookie, co->domain, clen + 1); ++ acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie); ++ Curl_psl_release(data); ++ } ++ else ++ acceptable = !bad_domain(domain); + } +- else +- acceptable = !bad_domain(domain); + + if(!acceptable) { + infof(data, "cookie '%s' dropped, domain '%s' must not " diff --git a/meta/recipes-support/curl/curl/CVE-2023-46219-0001.patch b/meta/recipes-support/curl/curl/CVE-2023-46219-0001.patch new file mode 100644 index 0000000000..55e8f6fac9 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-46219-0001.patch @@ -0,0 +1,42 @@ +From 0c667188e0c6cda615a036b8a2b4125f2c404dde Mon Sep 17 00:00:00 2001 +From: SaltyMilk <soufiane.elmelcaoui@gmail.com> +Date: Mon, 10 Jul 2023 21:43:28 +0200 +Subject: [PATCH] fopen: optimize + +Closes #11419 + +CVE: CVE-2023-46219 + +Upstream-Status: Backport [https://github.com/curl/curl/commit/0c667188e0c6] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + lib/fopen.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/lib/fopen.c b/lib/fopen.c +index ad3691b..92f39cf 100644 +--- a/lib/fopen.c ++++ b/lib/fopen.c +@@ -56,13 +56,13 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, + int fd = -1; + *tempname = NULL; + +- if(stat(filename, &sb) == -1 || !S_ISREG(sb.st_mode)) { +- /* a non-regular file, fallback to direct fopen() */ +- *fh = fopen(filename, FOPEN_WRITETEXT); +- if(*fh) +- return CURLE_OK; ++ *fh = fopen(filename, FOPEN_WRITETEXT); ++ if(!*fh) + goto fail; +- } ++ if(fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)) ++ return CURLE_OK; ++ fclose(*fh); ++ *fh = NULL; + + result = Curl_rand_hex(data, randsuffix, sizeof(randsuffix)); + if(result) +-- +2.40.0 diff --git a/meta/recipes-support/curl/curl/CVE-2023-46219-0002.patch b/meta/recipes-support/curl/curl/CVE-2023-46219-0002.patch new file mode 100644 index 0000000000..f432fabbb1 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-46219-0002.patch @@ -0,0 +1,133 @@ +From 73b65e94f3531179de45c6f3c836a610e3d0a846 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 23 Nov 2023 08:23:17 +0100 +Subject: [PATCH] fopen: create short(er) temporary file name + +Only using random letters in the name plus a ".tmp" extension. Not by +appending characters to the final file name. + +Reported-by: Maksymilian Arciemowicz + +Closes #12388 + +CVE: CVE-2023-46219 + +Upstream-Status: Backport [https://github.com/curl/curl/commit/73b65e94f3531179] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + lib/fopen.c | 63 +++++++++++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 59 insertions(+), 4 deletions(-) + +diff --git a/lib/fopen.c b/lib/fopen.c +index 92f39cf..1670e32 100644 +--- a/lib/fopen.c ++++ b/lib/fopen.c +@@ -39,6 +39,50 @@ + #include "curl_memory.h" + #include "memdebug.h" + ++ ++/* ++ The dirslash() function breaks a null-terminated pathname string into ++ directory and filename components then returns the directory component up ++ to, *AND INCLUDING*, a final '/'. If there is no directory in the path, ++ this instead returns a "" string. ++ This function returns a pointer to malloc'ed memory. ++ The input path to this function is expected to have a file name part. ++*/ ++ ++#ifdef _WIN32 ++#define PATHSEP "\\" ++#define IS_SEP(x) (((x) == '/') || ((x) == '\\')) ++#elif defined(MSDOS) || defined(__EMX__) || defined(OS2) ++#define PATHSEP "\\" ++#define IS_SEP(x) ((x) == '\\') ++#else ++#define PATHSEP "/" ++#define IS_SEP(x) ((x) == '/') ++#endif ++ ++static char *dirslash(const char *path) ++{ ++ size_t n; ++ struct dynbuf out; ++ DEBUGASSERT(path); ++ Curl_dyn_init(&out, CURL_MAX_INPUT_LENGTH); ++ n = strlen(path); ++ if(n) { ++ /* find the rightmost path separator, if any */ ++ while(n && !IS_SEP(path[n-1])) ++ --n; ++ /* skip over all the path separators, if any */ ++ while(n && IS_SEP(path[n-1])) ++ --n; ++ } ++ if(Curl_dyn_addn(&out, path, n)) ++ return NULL; ++ /* if there was a directory, append a single trailing slash */ ++ if(n && Curl_dyn_addn(&out, PATHSEP, 1)) ++ return NULL; ++ return Curl_dyn_ptr(&out); ++} ++ + /* + * Curl_fopen() opens a file for writing with a temp name, to be renamed + * to the final name when completed. If there is an existing file using this +@@ -50,25 +94,34 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, + FILE **fh, char **tempname) + { + CURLcode result = CURLE_WRITE_ERROR; +- unsigned char randsuffix[9]; ++ unsigned char randbuf[41]; + char *tempstore = NULL; + struct_stat sb; + int fd = -1; ++ char *dir; + *tempname = NULL; + ++ dir = dirslash(filename); ++ if(!dir) ++ goto fail; ++ + *fh = fopen(filename, FOPEN_WRITETEXT); + if(!*fh) + goto fail; +- if(fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)) ++ if(fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)){ ++ free(dir); + return CURLE_OK; ++ } + fclose(*fh); + *fh = NULL; + +- result = Curl_rand_hex(data, randsuffix, sizeof(randsuffix)); ++ result = Curl_rand_hex(data, randbuf, sizeof(randbuf)); + if(result) + goto fail; + +- tempstore = aprintf("%s.%s.tmp", filename, randsuffix); ++ /* The temp file name should not end up too long for the target file ++ system */ ++ tempstore = aprintf("%s%s.tmp", dir, randbuf); + if(!tempstore) { + result = CURLE_OUT_OF_MEMORY; + goto fail; +@@ -95,6 +148,7 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, + if(!*fh) + goto fail; + ++ free(dir); + *tempname = tempstore; + return CURLE_OK; + +@@ -107,6 +161,7 @@ fail: + free(tempstore); + + *tempname = NULL; ++ free(dir); + return result; + } + +-- +2.40.0 diff --git a/meta/recipes-support/curl/curl/CVE-2023-46219-0003.patch b/meta/recipes-support/curl/curl/CVE-2023-46219-0003.patch new file mode 100644 index 0000000000..3b6f756549 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2023-46219-0003.patch @@ -0,0 +1,81 @@ +From f27b8dba73295cb5296a50f2c19c0739b502eb94 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Fri, 24 Nov 2023 09:46:32 +0100 +Subject: [PATCH] fopen: allocate the dir after fopen + +Move the allocation of the directory name down to after the fopen() call +to allow that shortcut code path to avoid a superfluous malloc+free +cycle. + +Follow-up to 73b65e94f35311 + +Closes #12398 + +CVE: CVE-2023-46219 + +Upstream-Status: Backport [https://github.com/curl/curl/commit/f27b8dba73295cb529] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + lib/fopen.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/lib/fopen.c b/lib/fopen.c +index 1670e32..b663f8b 100644 +--- a/lib/fopen.c ++++ b/lib/fopen.c +@@ -98,18 +98,13 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, + char *tempstore = NULL; + struct_stat sb; + int fd = -1; +- char *dir; ++ char *dir = NULL; + *tempname = NULL; + +- dir = dirslash(filename); +- if(!dir) +- goto fail; +- + *fh = fopen(filename, FOPEN_WRITETEXT); + if(!*fh) + goto fail; + if(fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)){ +- free(dir); + return CURLE_OK; + } + fclose(*fh); +@@ -119,9 +114,13 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, + if(result) + goto fail; + +- /* The temp file name should not end up too long for the target file +- system */ +- tempstore = aprintf("%s%s.tmp", dir, randbuf); ++ dir = dirslash(filename); ++ if(dir) { ++ /* The temp file name should not end up too long for the target file ++ system */ ++ tempstore = aprintf("%s%s.tmp", dir, randbuf); ++ free(dir); ++ } + if(!tempstore) { + result = CURLE_OUT_OF_MEMORY; + goto fail; +@@ -148,7 +147,6 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, + if(!*fh) + goto fail; + +- free(dir); + *tempname = tempstore; + return CURLE_OK; + +@@ -161,7 +159,6 @@ fail: + free(tempstore); + + *tempname = NULL; +- free(dir); + return result; + } + +-- +2.40.0 diff --git a/meta/recipes-support/curl/curl/CVE-2024-2398.patch b/meta/recipes-support/curl/curl/CVE-2024-2398.patch new file mode 100644 index 0000000000..ea55117f4d --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2024-2398.patch @@ -0,0 +1,89 @@ +Backport of: + +From deca8039991886a559b67bcd6701db800a5cf764 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing <stefan@eissing.org> +Date: Wed, 6 Mar 2024 09:36:08 +0100 +Subject: [PATCH] http2: push headers better cleanup + +- provide common cleanup method for push headers + +Closes #13054 + +Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches/CVE-2024-2398.patch?h=ubuntu/jammy-security +Upstream commit https://github.com/curl/curl/commit/deca8039991886a559b67bcd6701db800a5cf764] +CVE: CVE-2024-2398 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + lib/http2.c | 34 +++++++++++++++------------------- + 1 file changed, 15 insertions(+), 19 deletions(-) + +--- a/lib/http2.c ++++ b/lib/http2.c +@@ -555,6 +555,15 @@ static int set_transfer_url(struct Curl_ + return 0; + } + ++static void free_push_headers(struct HTTP *stream) ++{ ++ size_t i; ++ for(i = 0; i<stream->push_headers_used; i++) ++ free(stream->push_headers[i]); ++ Curl_safefree(stream->push_headers); ++ stream->push_headers_used = 0; ++} ++ + static int push_promise(struct Curl_easy *data, + struct connectdata *conn, + const nghttp2_push_promise *frame) +@@ -568,7 +577,6 @@ static int push_promise(struct Curl_easy + struct curl_pushheaders heads; + CURLMcode rc; + struct http_conn *httpc; +- size_t i; + /* clone the parent */ + struct Curl_easy *newhandle = duphandle(data); + if(!newhandle) { +@@ -604,11 +612,7 @@ static int push_promise(struct Curl_easy + Curl_set_in_callback(data, false); + + /* free the headers again */ +- for(i = 0; i<stream->push_headers_used; i++) +- free(stream->push_headers[i]); +- free(stream->push_headers); +- stream->push_headers = NULL; +- stream->push_headers_used = 0; ++ free_push_headers(stream); + + if(rv) { + DEBUGASSERT((rv > CURL_PUSH_OK) && (rv <= CURL_PUSH_ERROROUT)); +@@ -1045,10 +1049,10 @@ static int on_header(nghttp2_session *se + stream->push_headers_alloc) { + char **headp; + stream->push_headers_alloc *= 2; +- headp = Curl_saferealloc(stream->push_headers, +- stream->push_headers_alloc * sizeof(char *)); ++ headp = realloc(stream->push_headers, ++ stream->push_headers_alloc * sizeof(char *)); + if(!headp) { +- stream->push_headers = NULL; ++ free_push_headers(stream); + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; + } + stream->push_headers = headp; +@@ -1214,15 +1218,7 @@ void Curl_http2_done(struct Curl_easy *d + setup */ + Curl_dyn_free(&http->header_recvbuf); + Curl_dyn_free(&http->trailer_recvbuf); +- if(http->push_headers) { +- /* if they weren't used and then freed before */ +- for(; http->push_headers_used > 0; --http->push_headers_used) { +- free(http->push_headers[http->push_headers_used - 1]); +- } +- free(http->push_headers); +- http->push_headers = NULL; +- } +- ++ free_push_headers(http); + if(!(data->conn->handler->protocol&PROTO_FAMILY_HTTP) || + !httpc->h2) /* not HTTP/2 ? */ + return; diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb index 13f157ead8..72d8544e08 100644 --- a/meta/recipes-support/curl/curl_7.82.0.bb +++ b/meta/recipes-support/curl/curl_7.82.0.bb @@ -34,12 +34,39 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2022-42915.patch \ file://CVE-2022-43551.patch \ file://CVE-2022-43552.patch \ + file://CVE-2023-23914_5-1.patch \ + file://CVE-2023-23914_5-2.patch \ + file://CVE-2023-23914_5-3.patch \ + file://CVE-2023-23914_5-4.patch \ + file://CVE-2023-23914_5-5.patch \ + file://CVE-2023-23916.patch \ + file://CVE-2023-27533.patch \ + file://CVE-2023-27534.patch \ + file://CVE-2023-27535-pre1.patch \ + file://CVE-2023-27535_and_CVE-2023-27538.patch \ + file://CVE-2023-27536.patch \ + file://CVE-2023-28319.patch \ + file://CVE-2023-28320.patch \ + file://CVE-2023-28320-fol1.patch \ + file://CVE-2023-28321.patch \ + file://CVE-2023-28322-1.patch \ + file://CVE-2023-28322-2.patch \ + file://CVE-2023-38545.patch \ + file://CVE-2023-38546.patch \ + file://CVE-2023-46218.patch \ + file://CVE-2023-46219-0001.patch \ + file://CVE-2023-46219-0002.patch \ + file://CVE-2023-46219-0003.patch \ + file://CVE-2024-2398.patch \ " SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c" # Curl has used many names over the years... CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl" +# This CVE reports that apple had to upgrade curl because of other already reported CVEs +CVE_CHECK_IGNORE += "CVE-2023-42915" + inherit autotools pkgconfig binconfig multilib_header # Entropy source for random PACKAGECONFIG option @@ -53,14 +80,16 @@ PACKAGECONFIG:class-nativesdk = "ipv6 openssl proxy random threaded-resolver ver PACKAGECONFIG[ares] = "--enable-ares,--disable-ares,c-ares,,,threaded-resolver" PACKAGECONFIG[brotli] = "--with-brotli,--without-brotli,brotli" PACKAGECONFIG[builtinmanual] = "--enable-manual,--disable-manual" +# Don't use this in production +PACKAGECONFIG[debug] = "--enable-debug,--disable-debug" PACKAGECONFIG[dict] = "--enable-dict,--disable-dict," PACKAGECONFIG[gnutls] = "--with-gnutls,--without-gnutls,gnutls" PACKAGECONFIG[gopher] = "--enable-gopher,--disable-gopher," PACKAGECONFIG[imap] = "--enable-imap,--disable-imap," PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," PACKAGECONFIG[krb5] = "--with-gssapi,--without-gssapi,krb5" -PACKAGECONFIG[ldap] = "--enable-ldap,--disable-ldap," -PACKAGECONFIG[ldaps] = "--enable-ldaps,--disable-ldaps," +PACKAGECONFIG[ldap] = "--enable-ldap,--disable-ldap,openldap" +PACKAGECONFIG[ldaps] = "--enable-ldaps,--disable-ldaps,openldap" PACKAGECONFIG[libgsasl] = "--with-libgsasl,--without-libgsasl,libgsasl" PACKAGECONFIG[libidn] = "--with-libidn2,--without-libidn2,libidn2" PACKAGECONFIG[libssh2] = "--with-libssh2,--without-libssh2,libssh2" @@ -89,9 +118,7 @@ EXTRA_OECONF = " \ --enable-crypto-auth \ --with-ca-bundle=${sysconfdir}/ssl/certs/ca-certificates.crt \ --without-libpsl \ - --enable-debug \ --enable-optimize \ - --disable-curldebug \ ${@'--without-ssl' if (bb.utils.filter('PACKAGECONFIG', 'gnutls mbedtls nss openssl', d) == '') else ''} \ " diff --git a/meta/recipes-support/fribidi/fribidi_1.0.12.bb b/meta/recipes-support/fribidi/fribidi_1.0.13.bb index b29c47822f..cdcac9315b 100644 --- a/meta/recipes-support/fribidi/fribidi_1.0.12.bb +++ b/meta/recipes-support/fribidi/fribidi_1.0.13.bb @@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a916467b91076e631dd8edb7424769c7" SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/v${PV}/${BP}.tar.xz \ " -SRC_URI[sha256sum] = "0cd233f97fc8c67bb3ac27ce8440def5d3ffacf516765b91c2cc654498293495" +SRC_URI[sha256sum] = "7fa16c80c81bd622f7b198d31356da139cc318a63fc7761217af4130903f54a2" UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/releases" diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2023-0361.patch b/meta/recipes-support/gnutls/gnutls/CVE-2023-0361.patch new file mode 100644 index 0000000000..943f4ca704 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2023-0361.patch @@ -0,0 +1,85 @@ +From 80a6ce8ddb02477cd724cd5b2944791aaddb702a Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin <asosedkin@redhat.com> +Date: Tue, 9 Aug 2022 16:05:53 +0200 +Subject: [PATCH] auth/rsa: side-step potential side-channel + +Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com> +Signed-off-by: Hubert Kario <hkario@redhat.com> +Tested-by: Hubert Kario <hkario@redhat.com> +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/80a6ce8ddb02477cd724cd5b2944791aaddb702a + https://gitlab.com/gnutls/gnutls/-/commit/4b7ff428291c7ed77c6d2635577c83a43bbae558] +CVE: CVE-2023-0361 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> +--- + lib/auth/rsa.c | 30 +++--------------------------- + 1 file changed, 3 insertions(+), 27 deletions(-) + +diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c +index 8108ee8..858701f 100644 +--- a/lib/auth/rsa.c ++++ b/lib/auth/rsa.c +@@ -155,13 +155,10 @@ static int + proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + size_t _data_size) + { +- const char attack_error[] = "auth_rsa: Possible PKCS #1 attack\n"; + gnutls_datum_t ciphertext; + int ret, dsize; + ssize_t data_size = _data_size; + volatile uint8_t ver_maj, ver_min; +- volatile uint8_t check_ver_min; +- volatile uint32_t ok; + + #ifdef ENABLE_SSL3 + if (get_num_version(session) == GNUTLS_SSL3) { +@@ -187,7 +184,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + + ver_maj = _gnutls_get_adv_version_major(session); + ver_min = _gnutls_get_adv_version_minor(session); +- check_ver_min = (session->internals.allow_wrong_pms == 0); + + session->key.key.data = gnutls_malloc(GNUTLS_MASTER_SIZE); + if (session->key.key.data == NULL) { +@@ -206,10 +202,9 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + return ret; + } + +- ret = +- gnutls_privkey_decrypt_data2(session->internals.selected_key, +- 0, &ciphertext, session->key.key.data, +- session->key.key.size); ++ gnutls_privkey_decrypt_data2(session->internals.selected_key, ++ 0, &ciphertext, session->key.key.data, ++ session->key.key.size); + /* After this point, any conditional on failure that cause differences + * in execution may create a timing or cache access pattern side + * channel that can be used as an oracle, so treat very carefully */ +@@ -225,25 +220,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + * Vlastimil Klima, Ondej Pokorny and Tomas Rosa. + */ + +- /* ok is 0 in case of error and 1 in case of success. */ +- +- /* if ret < 0 */ +- ok = CONSTCHECK_EQUAL(ret, 0); +- /* session->key.key.data[0] must equal ver_maj */ +- ok &= CONSTCHECK_EQUAL(session->key.key.data[0], ver_maj); +- /* if check_ver_min then session->key.key.data[1] must equal ver_min */ +- ok &= CONSTCHECK_NOT_EQUAL(check_ver_min, 0) & +- CONSTCHECK_EQUAL(session->key.key.data[1], ver_min); +- +- if (ok) { +- /* call logging function unconditionally so all branches are +- * indistinguishable for timing and cache access when debug +- * logging is disabled */ +- _gnutls_no_log("%s", attack_error); +- } else { +- _gnutls_debug_log("%s", attack_error); +- } +- + /* This is here to avoid the version check attack + * discussed above. + */ +-- +2.25.1 + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2023-5981.patch b/meta/recipes-support/gnutls/gnutls/CVE-2023-5981.patch new file mode 100644 index 0000000000..33e498b8e5 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2023-5981.patch @@ -0,0 +1,206 @@ +Backport of: + +From 29d6298d0b04cfff970b993915db71ba3f580b6d Mon Sep 17 00:00:00 2001 +From: Daiki Ueno <ueno@gnu.org> +Date: Mon, 23 Oct 2023 09:26:57 +0900 +Subject: [PATCH] auth/rsa_psk: side-step potential side-channel + +This removes branching that depends on secret data, porting changes +for regular RSA key exchange from +4804febddc2ed958e5ae774de2a8f85edeeff538 and +80a6ce8ddb02477cd724cd5b2944791aaddb702a. This also removes the +allow_wrong_pms as it was used sorely to control debug output +depending on the branching. + +Signed-off-by: Daiki Ueno <ueno@gnu.org> + +Upstream-Status: Backport [import from debian https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gnutls28/3.7.3-4ubuntu1.3/gnutls28_3.7.3-4ubuntu1.3.debian.tar.xz +Upstream-Commit: https://gitlab.com/gnutls/gnutls/-/commit/29d6298d0b04cfff970b993915db71ba3f580b6d] +CVE: CVE-2023-5981 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + lib/auth/rsa.c | 2 +- + lib/auth/rsa_psk.c | 90 ++++++++++++++++++---------------------------- + lib/gnutls_int.h | 4 --- + lib/priority.c | 1 - + 4 files changed, 35 insertions(+), 62 deletions(-) + +--- a/lib/auth/rsa.c ++++ b/lib/auth/rsa.c +@@ -207,7 +207,7 @@ proc_rsa_client_kx(gnutls_session_t sess + session->key.key.size); + /* After this point, any conditional on failure that cause differences + * in execution may create a timing or cache access pattern side +- * channel that can be used as an oracle, so treat very carefully */ ++ * channel that can be used as an oracle, so tread carefully */ + + /* Error handling logic: + * In case decryption fails then don't inform the peer. Just use the +--- a/lib/auth/rsa_psk.c ++++ b/lib/auth/rsa_psk.c +@@ -264,14 +264,13 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_se + { + gnutls_datum_t username; + psk_auth_info_t info; +- gnutls_datum_t plaintext; + gnutls_datum_t ciphertext; + gnutls_datum_t pwd_psk = { NULL, 0 }; + int ret, dsize; +- int randomize_key = 0; + ssize_t data_size = _data_size; + gnutls_psk_server_credentials_t cred; + gnutls_datum_t premaster_secret = { NULL, 0 }; ++ volatile uint8_t ver_maj, ver_min; + + cred = (gnutls_psk_server_credentials_t) + _gnutls_get_cred(session, GNUTLS_CRD_PSK); +@@ -327,71 +326,47 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_se + } + ciphertext.size = dsize; + +- ret = +- gnutls_privkey_decrypt_data(session->internals.selected_key, 0, +- &ciphertext, &plaintext); +- if (ret < 0 || plaintext.size != GNUTLS_MASTER_SIZE) { +- /* In case decryption fails then don't inform +- * the peer. Just use a random key. (in order to avoid +- * attack against pkcs-1 formatting). +- */ +- gnutls_assert(); +- _gnutls_debug_log +- ("auth_rsa_psk: Possible PKCS #1 format attack\n"); +- if (ret >= 0) { +- gnutls_free(plaintext.data); +- } +- randomize_key = 1; +- } else { +- /* If the secret was properly formatted, then +- * check the version number. +- */ +- if (_gnutls_get_adv_version_major(session) != +- plaintext.data[0] +- || (session->internals.allow_wrong_pms == 0 +- && _gnutls_get_adv_version_minor(session) != +- plaintext.data[1])) { +- /* No error is returned here, if the version number check +- * fails. We proceed normally. +- * That is to defend against the attack described in the paper +- * "Attacking RSA-based sessions in SSL/TLS" by Vlastimil Klima, +- * Ondej Pokorny and Tomas Rosa. +- */ +- gnutls_assert(); +- _gnutls_debug_log +- ("auth_rsa: Possible PKCS #1 version check format attack\n"); +- } +- } ++ ver_maj = _gnutls_get_adv_version_major(session); ++ ver_min = _gnutls_get_adv_version_minor(session); + ++ premaster_secret.data = gnutls_malloc(GNUTLS_MASTER_SIZE); ++ if (premaster_secret.data == NULL) { ++ gnutls_assert(); ++ return GNUTLS_E_MEMORY_ERROR; ++ } ++ premaster_secret.size = GNUTLS_MASTER_SIZE; + +- if (randomize_key != 0) { +- premaster_secret.size = GNUTLS_MASTER_SIZE; +- premaster_secret.data = +- gnutls_malloc(premaster_secret.size); +- if (premaster_secret.data == NULL) { +- gnutls_assert(); +- return GNUTLS_E_MEMORY_ERROR; +- } +- +- /* we do not need strong random numbers here. +- */ +- ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data, +- premaster_secret.size); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } +- } else { +- premaster_secret.data = plaintext.data; +- premaster_secret.size = plaintext.size; ++ /* Fallback value when decryption fails. Needs to be unpredictable. */ ++ ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data, ++ premaster_secret.size); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; + } + ++ gnutls_privkey_decrypt_data2(session->internals.selected_key, 0, ++ &ciphertext, premaster_secret.data, ++ premaster_secret.size); ++ /* After this point, any conditional on failure that cause differences ++ * in execution may create a timing or cache access pattern side ++ * channel that can be used as an oracle, so tread carefully */ ++ ++ /* Error handling logic: ++ * In case decryption fails then don't inform the peer. Just use the ++ * random key previously generated. (in order to avoid attack against ++ * pkcs-1 formatting). ++ * ++ * If we get version mismatches no error is returned either. We ++ * proceed normally. This is to defend against the attack described ++ * in the paper "Attacking RSA-based sessions in SSL/TLS" by ++ * Vlastimil Klima, Ondej Pokorny and Tomas Rosa. ++ */ ++ + /* This is here to avoid the version check attack + * discussed above. + */ +- +- premaster_secret.data[0] = _gnutls_get_adv_version_major(session); +- premaster_secret.data[1] = _gnutls_get_adv_version_minor(session); ++ premaster_secret.data[0] = ver_maj; ++ premaster_secret.data[1] = ver_min; + + /* find the key of this username + */ +--- a/lib/gnutls_int.h ++++ b/lib/gnutls_int.h +@@ -974,7 +974,6 @@ struct gnutls_priority_st { + bool _no_etm; + bool _no_ext_master_secret; + bool _allow_key_usage_violation; +- bool _allow_wrong_pms; + bool _dumbfw; + unsigned int _dh_prime_bits; /* old (deprecated) variable */ + +@@ -992,7 +991,6 @@ struct gnutls_priority_st { + (x)->no_etm = 1; \ + (x)->no_ext_master_secret = 1; \ + (x)->allow_key_usage_violation = 1; \ +- (x)->allow_wrong_pms = 1; \ + (x)->dumbfw = 1 + + #define ENABLE_PRIO_COMPAT(x) \ +@@ -1001,7 +999,6 @@ struct gnutls_priority_st { + (x)->_no_etm = 1; \ + (x)->_no_ext_master_secret = 1; \ + (x)->_allow_key_usage_violation = 1; \ +- (x)->_allow_wrong_pms = 1; \ + (x)->_dumbfw = 1 + + /* DH and RSA parameters types. +@@ -1126,7 +1123,6 @@ typedef struct { + bool no_etm; + bool no_ext_master_secret; + bool allow_key_usage_violation; +- bool allow_wrong_pms; + bool dumbfw; + + /* old (deprecated) variable. This is used for both srp_prime_bits +--- a/lib/priority.c ++++ b/lib/priority.c +@@ -690,7 +690,6 @@ gnutls_priority_set(gnutls_session_t ses + COPY_TO_INTERNALS(no_etm); + COPY_TO_INTERNALS(no_ext_master_secret); + COPY_TO_INTERNALS(allow_key_usage_violation); +- COPY_TO_INTERNALS(allow_wrong_pms); + COPY_TO_INTERNALS(dumbfw); + COPY_TO_INTERNALS(dh_prime_bits); + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2024-0553.patch b/meta/recipes-support/gnutls/gnutls/CVE-2024-0553.patch new file mode 100644 index 0000000000..f15c470879 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2024-0553.patch @@ -0,0 +1,125 @@ +From 40dbbd8de499668590e8af51a15799fbc430595e Mon Sep 17 00:00:00 2001 +From: Daiki Ueno <ueno@gnu.org> +Date: Wed, 10 Jan 2024 19:13:17 +0900 +Subject: [PATCH] rsa-psk: minimize branching after decryption + +This moves any non-trivial code between gnutls_privkey_decrypt_data2 +and the function return in _gnutls_proc_rsa_psk_client_kx up until the +decryption. This also avoids an extra memcpy to session->key.key. + +Signed-off-by: Daiki Ueno <ueno@gnu.org> + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/40dbbd8de499668590e8af51a15799fbc430595e] +CVE: CVE-2024-0553 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + lib/auth/rsa_psk.c | 68 ++++++++++++++++++++++++---------------------- + 1 file changed, 35 insertions(+), 33 deletions(-) + +diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c +index 93c2dc9..c6cfb92 100644 +--- a/lib/auth/rsa_psk.c ++++ b/lib/auth/rsa_psk.c +@@ -269,7 +269,6 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data, + int ret, dsize; + ssize_t data_size = _data_size; + gnutls_psk_server_credentials_t cred; +- gnutls_datum_t premaster_secret = { NULL, 0 }; + volatile uint8_t ver_maj, ver_min; + + cred = (gnutls_psk_server_credentials_t) +@@ -329,24 +328,48 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data, + ver_maj = _gnutls_get_adv_version_major(session); + ver_min = _gnutls_get_adv_version_minor(session); + +- premaster_secret.data = gnutls_malloc(GNUTLS_MASTER_SIZE); +- if (premaster_secret.data == NULL) { ++ /* Find the key of this username. A random value will be ++ * filled in if the key is not found. ++ */ ++ ret = _gnutls_psk_pwd_find_entry(session, info->username, ++ strlen(info->username), &pwd_psk); ++ if (ret < 0) ++ return gnutls_assert_val(ret); ++ ++ /* Allocate memory for premaster secret, and fill in the ++ * fields except the decryption result. ++ */ ++ session->key.key.size = 2 + GNUTLS_MASTER_SIZE + 2 + pwd_psk.size; ++ session->key.key.data = gnutls_malloc(session->key.key.size); ++ if (session->key.key.data == NULL) { + gnutls_assert(); ++ _gnutls_free_key_datum(&pwd_psk); ++ /* No need to zeroize, as the secret is not copied in yet */ ++ _gnutls_free_datum(&session->key.key); + return GNUTLS_E_MEMORY_ERROR; + } +- premaster_secret.size = GNUTLS_MASTER_SIZE; + + /* Fallback value when decryption fails. Needs to be unpredictable. */ +- ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data, +- premaster_secret.size); ++ ret = gnutls_rnd(GNUTLS_RND_NONCE, session->key.key.data + 2, ++ GNUTLS_MASTER_SIZE); + if (ret < 0) { + gnutls_assert(); +- goto cleanup; ++ _gnutls_free_key_datum(&pwd_psk); ++ /* No need to zeroize, as the secret is not copied in yet */ ++ _gnutls_free_datum(&session->key.key); ++ return ret; + } + ++ _gnutls_write_uint16(GNUTLS_MASTER_SIZE, session->key.key.data); ++ _gnutls_write_uint16(pwd_psk.size, ++ &session->key.key.data[2 + GNUTLS_MASTER_SIZE]); ++ memcpy(&session->key.key.data[2 + GNUTLS_MASTER_SIZE + 2], pwd_psk.data, ++ pwd_psk.size); ++ _gnutls_free_key_datum(&pwd_psk); ++ + gnutls_privkey_decrypt_data2(session->internals.selected_key, 0, +- &ciphertext, premaster_secret.data, +- premaster_secret.size); ++ &ciphertext, session->key.key.data + 2, ++ GNUTLS_MASTER_SIZE); + /* After this point, any conditional on failure that cause differences + * in execution may create a timing or cache access pattern side + * channel that can be used as an oracle, so tread carefully */ +@@ -365,31 +388,10 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data, + /* This is here to avoid the version check attack + * discussed above. + */ +- premaster_secret.data[0] = ver_maj; +- premaster_secret.data[1] = ver_min; ++ session->key.key.data[2] = ver_maj; ++ session->key.key.data[3] = ver_min; + +- /* find the key of this username +- */ +- ret = +- _gnutls_psk_pwd_find_entry(session, info->username, strlen(info->username), &pwd_psk); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } +- +- ret = +- set_rsa_psk_session_key(session, &pwd_psk, &premaster_secret); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } +- +- ret = 0; +- cleanup: +- _gnutls_free_key_datum(&pwd_psk); +- _gnutls_free_temp_key_datum(&premaster_secret); +- +- return ret; ++ return 0; + } + + static int +-- +2.25.1 + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2024-0567.patch b/meta/recipes-support/gnutls/gnutls/CVE-2024-0567.patch new file mode 100644 index 0000000000..49c4531a9b --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2024-0567.patch @@ -0,0 +1,184 @@ +From 9edbdaa84e38b1bfb53a7d72c1de44f8de373405 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno <ueno@gnu.org> +Date: Thu, 11 Jan 2024 15:45:11 +0900 +Subject: [PATCH] x509: detect loop in certificate chain + +There can be a loop in a certificate chain, when multiple CA +certificates are cross-signed with each other, such as A → B, B → C, +and C → A. Previously, the verification logic was not capable of +handling this scenario while sorting the certificates in the chain in +_gnutls_sort_clist, resulting in an assertion failure. This patch +properly detects such loop and aborts further processing in a graceful +manner. + +Signed-off-by: Daiki Ueno <ueno@gnu.org> + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/9edbdaa84e38b1bfb53a7d72c1de44f8de373405] +CVE: CVE-2024-0567 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + lib/x509/common.c | 4 ++ + tests/test-chains.h | 125 ++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 129 insertions(+) + +diff --git a/lib/x509/common.c b/lib/x509/common.c +index fad9da5..6367b03 100644 +--- a/lib/x509/common.c ++++ b/lib/x509/common.c +@@ -1790,6 +1790,10 @@ unsigned int _gnutls_sort_clist(gnutls_x509_crt_t *clist, + break; + } + ++ if (insorted[prev]) { /* loop detected */ ++ break; ++ } ++ + sorted[i] = clist[prev]; + insorted[prev] = 1; + } +diff --git a/tests/test-chains.h b/tests/test-chains.h +index dd7ccf0..09a5461 100644 +--- a/tests/test-chains.h ++++ b/tests/test-chains.h +@@ -4263,6 +4263,129 @@ static const char *rsa_sha1_not_in_trusted_ca[] = { + NULL + }; + ++static const char *cross_signed[] = { ++ /* server (signed by A1) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBqDCCAVqgAwIBAgIUejlil+8DBffazcnMNwyOOP6yCCowBQYDK2VwMBoxGDAW\n" ++ "BgNVBAMTD0ludGVybWVkaWF0ZSBBMTAgFw0yNDAxMTEwNjI3MjJaGA85OTk5MTIz\n" ++ "MTIzNTk1OVowNzEbMBkGA1UEChMSR251VExTIHRlc3Qgc2VydmVyMRgwFgYDVQQD\n" ++ "Ew90ZXN0LmdudXRscy5vcmcwKjAFBgMrZXADIQA1ZVS0PcNeTPQMZ+FuVz82AHrj\n" ++ "qL5hWEpCDgpG4M4fxaOBkjCBjzAMBgNVHRMBAf8EAjAAMBoGA1UdEQQTMBGCD3Rl\n" ++ "c3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAOBgNVHQ8BAf8EBAMC\n" ++ "B4AwHQYDVR0OBBYEFGtEUv+JSt+zPoO3lu0IiObZVoiNMB8GA1UdIwQYMBaAFPnY\n" ++ "v6Pw0IvKSqIlb6ewHyEAmTA3MAUGAytlcANBAAS2lyc87kH/aOvNKzPjqDwUYxPA\n" ++ "CfYjyaKea2d0DZLBM5+Bjnj/4aWwTKgVTJzWhLJcLtaSdVHrXqjr9NhEhQ0=\n" ++ "-----END CERTIFICATE-----\n", ++ /* A1 (signed by A) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBUjCCAQSgAwIBAgIUe/R+NVp04e74ySw2qgI6KZgFR20wBQYDK2VwMBExDzAN\n" ++ "BgNVBAMTBlJvb3QgQTAgFw0yNDAxMTEwNjI1MDFaGA85OTk5MTIzMTIzNTk1OVow\n" ++ "GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEExMCowBQYDK2VwAyEAlkTNqwz973sy\n" ++ "u3whMjSiUMs77CZu5YA7Gi5KcakExrKjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n" ++ "VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBT52L+j8NCLykqiJW+nsB8hAJkwNzAfBgNV\n" ++ "HSMEGDAWgBRbYgOkRGsd3Z74+CauX4htzLg0lzAFBgMrZXADQQBM0NBaFVPd3cTJ\n" ++ "DSaZNT34fsHuJk4eagpn8mBxKQpghq4s8Ap+nYtp2KiXjcizss53PeLXVnkfyLi0\n" ++ "TLVBHvUJ\n" ++ "-----END CERTIFICATE-----\n", ++ /* A (signed by B) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBSDCB+6ADAgECAhQtdJpg+qlPcLoRW8iiztJUD4xNvDAFBgMrZXAwETEPMA0G\n" ++ "A1UEAxMGUm9vdCBCMCAXDTI0MDExMTA2MTk1OVoYDzk5OTkxMjMxMjM1OTU5WjAR\n" ++ "MQ8wDQYDVQQDEwZSb290IEEwKjAFBgMrZXADIQA0vDYyg3tgotSETL1Wq2hBs32p\n" ++ "WbnINkmOSNmOiZlGHKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n" ++ "AgQwHQYDVR0OBBYEFFtiA6REax3dnvj4Jq5fiG3MuDSXMB8GA1UdIwQYMBaAFJFA\n" ++ "s2rg6j8w9AKItRnOOOjG2FG6MAUGAytlcANBAPv674p9ek5GjRcRfVQhgN+kQlHU\n" ++ "u774wL3Vx3fWA1E7+WchdMzcHrPoa5OKtKmxjIKUTO4SeDZL/AVpvulrWwk=\n" ++ "-----END CERTIFICATE-----\n", ++ /* A (signed by C) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBSDCB+6ADAgECAhReNpCiVn7eFDUox3mvM5qE942AVzAFBgMrZXAwETEPMA0G\n" ++ "A1UEAxMGUm9vdCBDMCAXDTI0MDExMTA2MjEyMVoYDzk5OTkxMjMxMjM1OTU5WjAR\n" ++ "MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n" ++ "3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n" ++ "AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFEh/\n" ++ "XKjIuMeEavX5QVoy39Q+GhnwMAUGAytlcANBAIwghH3gelXty8qtoTGIEJb0+EBv\n" ++ "BH4YOUh7TamxjxkjvvIhDA7ZdheofFb7NrklJco7KBcTATUSOvxakYRP9Q8=\n" ++ "-----END CERTIFICATE-----\n", ++ /* B1 (signed by B) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBUjCCAQSgAwIBAgIUfpmrVDc1XBA5/7QYMyGBuB9mTtUwBQYDK2VwMBExDzAN\n" ++ "BgNVBAMTBlJvb3QgQjAgFw0yNDAxMTEwNjI1MjdaGA85OTk5MTIzMTIzNTk1OVow\n" ++ "GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEIxMCowBQYDK2VwAyEAh6ZTuJWsweVB\n" ++ "a5fsye5iq89kWDC2Y/Hlc0htLmjzMP+jYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n" ++ "VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBTMQu37PKyLjKfPODZgxYCaayff+jAfBgNV\n" ++ "HSMEGDAWgBSRQLNq4Oo/MPQCiLUZzjjoxthRujAFBgMrZXADQQBblmguY+lnYvOK\n" ++ "rAZJnqpEUGfm1tIFyu3rnlE7WOVcXRXMIoNApLH2iHIipQjlvNWuSBFBTC1qdewh\n" ++ "/e+0cgQB\n" ++ "-----END CERTIFICATE-----\n", ++ /* B (signed by A) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBSDCB+6ADAgECAhRpEm+dWNX6DMZh/nottkFfFFrXXDAFBgMrZXAwETEPMA0G\n" ++ "A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTcyNloYDzk5OTkxMjMxMjM1OTU5WjAR\n" ++ "MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n" ++ "3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n" ++ "AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFFti\n" ++ "A6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAFvmcK3Ida5ViVYDzxKVLPcPsCHe\n" ++ "3hxz99lBrerJC9iJSvRYTJoPBvjTxDYnBn5EFrQYMrUED+6i71lmGXNU9gs=\n" ++ "-----END CERTIFICATE-----\n", ++ /* B (signed by C) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBSDCB+6ADAgECAhReNpCiVn7eFDUox3mvM5qE942AVzAFBgMrZXAwETEPMA0G\n" ++ "A1UEAxMGUm9vdCBDMCAXDTI0MDExMTA2MjEyMVoYDzk5OTkxMjMxMjM1OTU5WjAR\n" ++ "MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n" ++ "3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n" ++ "AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFEh/\n" ++ "XKjIuMeEavX5QVoy39Q+GhnwMAUGAytlcANBAIwghH3gelXty8qtoTGIEJb0+EBv\n" ++ "BH4YOUh7TamxjxkjvvIhDA7ZdheofFb7NrklJco7KBcTATUSOvxakYRP9Q8=\n" ++ "-----END CERTIFICATE-----\n", ++ /* C1 (signed by C) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBUjCCAQSgAwIBAgIUSKsfY1wD3eD2VmaaK1wt5naPckMwBQYDK2VwMBExDzAN\n" ++ "BgNVBAMTBlJvb3QgQzAgFw0yNDAxMTEwNjI1NDdaGA85OTk5MTIzMTIzNTk1OVow\n" ++ "GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEMxMCowBQYDK2VwAyEA/t7i1chZlKkV\n" ++ "qxJOrmmyATn8XnpK+nV/iT4OMHSHfAyjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n" ++ "VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBRmpF3JjoP3NiBzE5J5ANT0bvfRmjAfBgNV\n" ++ "HSMEGDAWgBRIf1yoyLjHhGr1+UFaMt/UPhoZ8DAFBgMrZXADQQAeRBXv6WCTOp0G\n" ++ "3wgd8bbEGrrILfpi+qH7aj/MywgkPIlppDYRQ3jL6ASd+So/408dlE0DV9DXKBi0\n" ++ "725XUUYO\n" ++ "-----END CERTIFICATE-----\n", ++ /* C (signed by A) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBSDCB+6ADAgECAhRvbZv3SRTjDOiAbyFWHH4y0yMZkjAFBgMrZXAwETEPMA0G\n" ++ "A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTg1MVoYDzk5OTkxMjMxMjM1OTU5WjAR\n" ++ "MQ8wDQYDVQQDEwZSb290IEMwKjAFBgMrZXADIQDxm6Ubhsa0gSa1vBCIO5e+qZEH\n" ++ "8Oocz+buNHfIJbh5NaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n" ++ "AgQwHQYDVR0OBBYEFEh/XKjIuMeEavX5QVoy39Q+GhnwMB8GA1UdIwQYMBaAFFti\n" ++ "A6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAPl+SyiOfXJnjSWx8hFMhJ7w92mn\n" ++ "tkGifCFHBpUhYcBIMeMtLw0RBLXqaaN0EKlTFimiEkLClsU7DKYrpEEJegs=\n" ++ "-----END CERTIFICATE-----\n", ++ /* C (signed by B) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBSDCB+6ADAgECAhQU1OJWRVOLrGrgJiLwexd1/MwKkTAFBgMrZXAwETEPMA0G\n" ++ "A1UEAxMGUm9vdCBCMCAXDTI0MDExMTA2MjAzMFoYDzk5OTkxMjMxMjM1OTU5WjAR\n" ++ "MQ8wDQYDVQQDEwZSb290IEMwKjAFBgMrZXADIQDxm6Ubhsa0gSa1vBCIO5e+qZEH\n" ++ "8Oocz+buNHfIJbh5NaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n" ++ "AgQwHQYDVR0OBBYEFEh/XKjIuMeEavX5QVoy39Q+GhnwMB8GA1UdIwQYMBaAFJFA\n" ++ "s2rg6j8w9AKItRnOOOjG2FG6MAUGAytlcANBALXeyuj8vj6Q8j4l17VzZwmJl0gN\n" ++ "bCGoKMl0J/0NiN/fQRIsdbwQDh0RUN/RN3I6DTtB20ER6f3VdnzAh8nXkQ4=\n" ++ "-----END CERTIFICATE-----\n", ++ NULL ++}; ++ ++static const char *cross_signed_ca[] = { ++ /* A (self-signed) */ ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBJzCB2qADAgECAhQs1Ur+gzPs1ISxs3Tbs700q0CZcjAFBgMrZXAwETEPMA0G\n" ++ "A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTYwMFoYDzk5OTkxMjMxMjM1OTU5WjAR\n" ++ "MQ8wDQYDVQQDEwZSb290IEEwKjAFBgMrZXADIQA0vDYyg3tgotSETL1Wq2hBs32p\n" ++ "WbnINkmOSNmOiZlGHKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n" ++ "AgQwHQYDVR0OBBYEFFtiA6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAHrVv7E9\n" ++ "5scuOVCH9gNRRm8Z9SUoLakRHAPnySdg6z/kI3vOgA/OM7reArpnW8l1H2FapgpL\n" ++ "bDeZ2XJH+BdVFwg=\n" ++ "-----END CERTIFICATE-----\n", ++ NULL ++}; ++ + #if defined __clang__ || __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5) + # pragma GCC diagnostic push + # pragma GCC diagnostic ignored "-Wunused-variable" +@@ -4442,6 +4565,8 @@ static struct + rsa_sha1_not_in_trusted, rsa_sha1_not_in_trusted_ca, + GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_MEDIUM), + GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL, 1620118136, 1}, ++ { "cross signed - ok", cross_signed, cross_signed_ca, 0, 0, 0, ++ 1704955300 }, + { NULL, NULL, NULL, 0, 0} + }; + +-- +2.25.1 + diff --git a/meta/recipes-support/gnutls/gnutls_3.7.4.bb b/meta/recipes-support/gnutls/gnutls_3.7.4.bb index fb06337efb..b290022781 100644 --- a/meta/recipes-support/gnutls/gnutls_3.7.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.7.4.bb @@ -22,6 +22,10 @@ SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}" SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar.xz \ file://arm_eabi.patch \ file://CVE-2022-2509.patch \ + file://CVE-2023-0361.patch \ + file://CVE-2023-5981.patch \ + file://CVE-2024-0553.patch \ + file://CVE-2024-0567.patch \ " SRC_URI[sha256sum] = "e6adbebcfbc95867de01060d93c789938cf89cc1d1f6ef9ef661890f6217451f" diff --git a/meta/recipes-support/iso-codes/iso-codes_4.12.0.bb b/meta/recipes-support/iso-codes/iso-codes_4.15.0.bb index ea7c43cdae..b789a99035 100644 --- a/meta/recipes-support/iso-codes/iso-codes_4.12.0.bb +++ b/meta/recipes-support/iso-codes/iso-codes_4.15.0.bb @@ -9,7 +9,7 @@ LICENSE = "LGPL-2.1-only" LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c" SRC_URI = "git://salsa.debian.org/iso-codes-team/iso-codes.git;protocol=https;branch=main;" -SRCREV = "5e4dddbd1f8902ab0252ccbb19b783cc0359505a" +SRCREV = "69ba16daef3c5c5e3c18f2d919e25296a4b946be" # inherit gettext cannot be used, because it adds gettext-native to BASEDEPENDS which # are inhibited by allarch diff --git a/meta/recipes-support/libassuan/libassuan_2.5.5.bb b/meta/recipes-support/libassuan/libassuan_2.5.6.bb index 2bab3ac955..7e899e7399 100644 --- a/meta/recipes-support/libassuan/libassuan_2.5.5.bb +++ b/meta/recipes-support/libassuan/libassuan_2.5.6.bb @@ -20,7 +20,7 @@ SRC_URI = "${GNUPG_MIRROR}/libassuan/libassuan-${PV}.tar.bz2 \ file://libassuan-add-pkgconfig-support.patch \ " -SRC_URI[sha256sum] = "8e8c2fcc982f9ca67dcbb1d95e2dc746b1739a4668bc20b3a3c5be632edb34e4" +SRC_URI[sha256sum] = "e9fd27218d5394904e4e39788f9b1742711c3e6b41689a31aa3380bd5aa4f426" BINCONFIG = "${bindir}/libassuan-config" diff --git a/meta/recipes-support/libbsd/libbsd_0.11.5.bb b/meta/recipes-support/libbsd/libbsd_0.11.5.bb index bb8766a070..21af37882f 100644 --- a/meta/recipes-support/libbsd/libbsd_0.11.5.bb +++ b/meta/recipes-support/libbsd/libbsd_0.11.5.bb @@ -29,6 +29,13 @@ HOMEPAGE = "https://libbsd.freedesktop.org/wiki/" # License: public-domain-Colin-Plumb LICENSE = "BSD-3-Clause & BSD-4-Clause & ISC & PD" LICENSE:${PN} = "BSD-3-Clause & ISC & PD" +LICENSE:${PN}-dbg = "BSD-3-Clause & ISC & PD" +LICENSE:${PN}-dev = "BSD-3-Clause & ISC & PD" +LICENSE:${PN}-doc = "BSD-3-Clause & BSD-4-Clause & ISC & PD" +LICENSE:${PN}-locale = "BSD-3-Clause & ISC & PD" +LICENSE:${PN}-src = "BSD-3-Clause & ISC & PD" +LICENSE:${PN}-staticdev = "BSD-3-Clause & ISC & PD" + LIC_FILES_CHKSUM = "file://COPYING;md5=0b31944ca2c1075410a30f0c17379d3b" SECTION = "libs" diff --git a/meta/recipes-support/libcap/files/CVE-2023-2602.patch b/meta/recipes-support/libcap/files/CVE-2023-2602.patch new file mode 100644 index 0000000000..1ad5aeb826 --- /dev/null +++ b/meta/recipes-support/libcap/files/CVE-2023-2602.patch @@ -0,0 +1,45 @@ +From bc6b36682f188020ee4770fae1d41bde5b2c97bb Mon Sep 17 00:00:00 2001 +From: "Andrew G. Morgan" <morgan@kernel.org> +Date: Wed, 3 May 2023 19:18:36 -0700 +Subject: Correct the check of pthread_create()'s return value. + +This function returns a positive number (errno) on error, so the code +wasn't previously freeing some memory in this situation. + +Discussion: + + https://stackoverflow.com/a/3581020/14760867 + +Credit for finding this bug in libpsx goes to David Gstir of +X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security +audit of the libcap source code in April of 2023. The audit +was sponsored by the Open Source Technology Improvement Fund +(https://ostif.org/). + +Audit ref: LCAP-CR-23-01 (CVE-2023-2602) + +Signed-off-by: Andrew G. Morgan <morgan@kernel.org> + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb] +CVE: CVE-2023-2602 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + psx/psx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/psx/psx.c b/psx/psx.c +index d9c0485..65eb2aa 100644 +--- a/psx/psx.c ++++ b/psx/psx.c +@@ -516,7 +516,7 @@ int __wrap_pthread_create(pthread_t *thread, const pthread_attr_t *attr, + pthread_sigmask(SIG_BLOCK, &sigbit, NULL); + + int ret = __real_pthread_create(thread, attr, _psx_start_fn, starter); +- if (ret == -1) { ++ if (ret > 0) { + psx_new_state(_PSX_CREATE, _PSX_IDLE); + memset(starter, 0, sizeof(*starter)); + free(starter); +-- +2.25.1 + diff --git a/meta/recipes-support/libcap/files/CVE-2023-2603.patch b/meta/recipes-support/libcap/files/CVE-2023-2603.patch new file mode 100644 index 0000000000..e09be78640 --- /dev/null +++ b/meta/recipes-support/libcap/files/CVE-2023-2603.patch @@ -0,0 +1,60 @@ +From 422bec25ae4a1ab03fd4d6f728695ed279173b18 Mon Sep 17 00:00:00 2001 +From: "Andrew G. Morgan" <morgan@kernel.org> +Date: Wed, 3 May 2023 19:44:22 -0700 +Subject: Large strings can confuse libcap's internal strdup code. + +Avoid something subtle with really long strings: 1073741823 should +be enough for anybody. This is an improved fix over something attempted +in libcap-2.55 to address some static analysis findings. + +Reviewing the library, cap_proc_root() and cap_launcher_set_chroot() +are the only two calls where the library is potentially exposed to a +user controlled string input. + +Credit for finding this bug in libcap goes to Richard Weinberger of +X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security audit +of the libcap source code in April of 2023. The audit was sponsored +by the Open Source Technology Improvement Fund (https://ostif.org/). + +Audit ref: LCAP-CR-23-02 (CVE-2023-2603) + +Signed-off-by: Andrew G. Morgan <morgan@kernel.org> + +Upstream-Status: Backport [https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=422bec25ae4a1ab03fd4d6f728695ed279173b18] +CVE: CVE-2023-2603 +Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> + +--- + libcap/cap_alloc.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/libcap/cap_alloc.c b/libcap/cap_alloc.c +index c826e7a..25f9981 100644 +--- a/libcap/cap_alloc.c ++++ b/libcap/cap_alloc.c +@@ -105,15 +105,17 @@ char *_libcap_strdup(const char *old) + errno = EINVAL; + return NULL; + } +- len = strlen(old) + 1 + 2*sizeof(__u32); +- if (len < sizeof(struct _cap_alloc_s)) { +- len = sizeof(struct _cap_alloc_s); +- } +- if ((len & 0xffffffff) != len) { ++ ++ len = strlen(old); ++ if ((len & 0x3fffffff) != len) { + _cap_debug("len is too long for libcap to manage"); + errno = EINVAL; + return NULL; + } ++ len += 1 + 2*sizeof(__u32); ++ if (len < sizeof(struct _cap_alloc_s)) { ++ len = sizeof(struct _cap_alloc_s); ++ } + + raw_data = calloc(1, len); + if (raw_data == NULL) { +-- +2.25.1 + diff --git a/meta/recipes-support/libcap/libcap_2.66.bb b/meta/recipes-support/libcap/libcap_2.66.bb index c50e9d8cc7..7534063b7d 100644 --- a/meta/recipes-support/libcap/libcap_2.66.bb +++ b/meta/recipes-support/libcap/libcap_2.66.bb @@ -16,6 +16,8 @@ DEPENDS = "hostperl-runtime-native gperf-native" SRC_URI = "${KERNELORG_MIRROR}/linux/libs/security/linux-privs/${BPN}2/${BPN}-${PV}.tar.xz \ file://0001-ensure-the-XATTR_NAME_CAPS-is-defined-when-it-is-use.patch \ file://0002-tests-do-not-run-target-executables.patch \ + file://CVE-2023-2602.patch \ + file://CVE-2023-2603.patch \ " SRC_URI:append:class-nativesdk = " \ file://0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch \ diff --git a/meta/recipes-support/libgit2/libgit2/CVE-2024-24575.patch b/meta/recipes-support/libgit2/libgit2/CVE-2024-24575.patch new file mode 100644 index 0000000000..d3957ac5d0 --- /dev/null +++ b/meta/recipes-support/libgit2/libgit2/CVE-2024-24575.patch @@ -0,0 +1,56 @@ +From c9d31b711e8906cf248566f43142f20b03e20cbf Mon Sep 17 00:00:00 2001 +From: Edward Thomson <ethomson@edwardthomson.com> +Date: Fri, 17 Nov 2023 16:54:47 +0000 +Subject: [PATCH] revparse: fix parsing bug for trailing `@` + +When parsing a revspec that ends with a trailing `@`, explicitly stop +parsing. Introduce a sentinel variable to explicitly stop parsing. + +Prior to this, we would set `spec` to `HEAD`, but were looping on the +value of `spec[pos]`, so we would continue walking the (new) `spec` +at offset `pos`, looking for a NUL. This is obviously an out-of-bounds +read. + +Credit to Michael Rodler (@f0rki) and Amazon AWS Security. + +CVE: CVE-2024-24575 + +Upstream-Status: Backport [https://github.com/libgit2/libgit2/commit/c9d31b711e8906cf248566f43142f20b03e20cbf] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/revparse.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/revparse.c b/src/revparse.c +index 9bc28e9fc..d3bbe840b 100644 +--- a/src/revparse.c ++++ b/src/revparse.c +@@ -685,6 +685,7 @@ static int revparse( + git_object *base_rev = NULL; + + bool should_return_reference = true; ++ bool parsed = false; + + GIT_ASSERT_ARG(object_out); + GIT_ASSERT_ARG(reference_out); +@@ -694,7 +695,7 @@ static int revparse( + *object_out = NULL; + *reference_out = NULL; + +- while (spec[pos]) { ++ while (!parsed && spec[pos]) { + switch (spec[pos]) { + case '^': + should_return_reference = false; +@@ -801,6 +802,8 @@ static int revparse( + break; + } else if (spec[pos+1] == '\0') { + spec = "HEAD"; ++ identifier_len = 4; ++ parsed = true; + break; + } + /* fall through */ +-- +2.40.0 diff --git a/meta/recipes-support/libgit2/libgit2/CVE-2024-24577.patch b/meta/recipes-support/libgit2/libgit2/CVE-2024-24577.patch new file mode 100644 index 0000000000..3469f9d099 --- /dev/null +++ b/meta/recipes-support/libgit2/libgit2/CVE-2024-24577.patch @@ -0,0 +1,52 @@ +From eb4c1716cd92bf56f2770653a915d5fc01eab8f3 Mon Sep 17 00:00:00 2001 +From: Edward Thomson <ethomson@edwardthomson.com> +Date: Sat, 16 Dec 2023 11:19:07 +0000 +Subject: [PATCH] index: correct index has_dir_name check + +`has_dir_name` is used to check for directory/file collisions, +and attempts to determine whether the index contains a file with +a directory name that is a proper subset of the new index entry +that we're trying to add. + +To determine directory name, the function would walk the path string +backwards to identify a `/`, stopping at the end of the string. However, +the function assumed that the strings did not start with a `/`. If the +paths contain only a single `/` at the beginning of the string, then the +function would continue the loop, erroneously, when they should have +stopped at the first character. + +Correct the order of the tests to terminate properly. + +Credit to Michael Rodler (@f0rki) and Amazon AWS Security. + +CVE: CVE-2024-24577 + +Upstream-Status: Backport [https://github.com/libgit2/libgit2/commit/eb4c1716cd92bf56f2770653a915d5fc01eab8f3] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + src/index.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/index.c b/src/index.c +index aa97c6421..e8ff82e1a 100644 +--- a/src/index.c ++++ b/src/index.c +@@ -1148,10 +1148,13 @@ static int has_dir_name(git_index *index, + size_t len, pos; + + for (;;) { +- if (*--slash == '/') +- break; ++ slash--; ++ + if (slash <= entry->path) + return 0; ++ ++ if (*slash == '/') ++ break; + } + len = slash - name; + +-- +2.40.0 diff --git a/meta/recipes-support/libgit2/libgit2_1.4.3.bb b/meta/recipes-support/libgit2/libgit2_1.4.5.bb index 7e27b5b018..ad8b9a536a 100644 --- a/meta/recipes-support/libgit2/libgit2_1.4.3.bb +++ b/meta/recipes-support/libgit2/libgit2_1.4.5.bb @@ -5,8 +5,11 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=e5a9227de4cb6afb5d35ed7b0fdf480d" DEPENDS = "curl openssl zlib libssh2 libgcrypt libpcre2" -SRC_URI = "git://github.com/libgit2/libgit2.git;branch=maint/v1.4;protocol=https" -SRCREV = "465bbf88ea939a965fbcbade72870c61f815e457" +SRC_URI = "git://github.com/libgit2/libgit2.git;branch=maint/v1.4;protocol=https \ + file://CVE-2024-24575.patch \ + file://CVE-2024-24577.patch \ + " +SRCREV = "cd6f679af401eda1f172402006ef8265f8bd58ea" S = "${WORKDIR}/git" diff --git a/meta/recipes-support/libksba/libksba_1.6.3.bb b/meta/recipes-support/libksba/libksba_1.6.4.bb index dc39693be4..f9636f9433 100644 --- a/meta/recipes-support/libksba/libksba_1.6.3.bb +++ b/meta/recipes-support/libksba/libksba_1.6.4.bb @@ -24,7 +24,7 @@ UPSTREAM_CHECK_URI = "https://gnupg.org/download/index.html" SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ file://ksba-add-pkgconfig-support.patch" -SRC_URI[sha256sum] = "3f72c68db30971ebbf14367527719423f0a4d5f8103fc9f4a1c01a9fa440de5c" +SRC_URI[sha256sum] = "bbb43f032b9164d86c781ffe42213a83bf4f2fee91455edfa4654521b8b03b6b" do_configure:prepend () { # Else these could be used in preference to those in aclocal-copy diff --git a/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.75.bb b/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.76.bb index 9c99af7c91..ad3c34ab9e 100644 --- a/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.75.bb +++ b/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.76.bb @@ -7,7 +7,7 @@ SECTION = "net" DEPENDS = "file" SRC_URI = "${GNU_MIRROR}/libmicrohttpd/${BPN}-${PV}.tar.gz" -SRC_URI[sha256sum] = "9278907a6f571b391aab9644fd646a5108ed97311ec66f6359cebbedb0a4e3bb" +SRC_URI[sha256sum] = "f0b1547b5a42a6c0f724e8e1c1cb5ce9c4c35fb495e7d780b9930d35011ceb4c" inherit autotools lib_package pkgconfig gettext diff --git a/meta/recipes-support/libpcre/libpcre2/CVE-2022-41409.patch b/meta/recipes-support/libpcre/libpcre2/CVE-2022-41409.patch new file mode 100644 index 0000000000..833348cdf1 --- /dev/null +++ b/meta/recipes-support/libpcre/libpcre2/CVE-2022-41409.patch @@ -0,0 +1,75 @@ +From 94e1c001761373b7d9450768aa15d04c25547a35 Mon Sep 17 00:00:00 2001 +From: Philip Hazel <Philip.Hazel@gmail.com> +Date: Tue, 16 Aug 2022 17:00:45 +0100 +Subject: [PATCH] Diagnose negative repeat value in pcre2test subject line + +CVE: CVE-2022-41409 +Upstream-Status: Backport [https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35] + +Signed-off-by: Peter Marko <peter.marko@siemens.com> + +--- + ChangeLog | 3 +++ + src/pcre2test.c | 4 ++-- + testdata/testinput2 | 3 +++ + testdata/testoutput2 | 4 ++++ + 4 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index eab50eb7..276eb57a 100644 +--- a/ChangeLog ++++ b/ChangeLog +index eab50eb7..276eb57a 100644 +@@ -1,6 +1,9 @@ + Change Log for PCRE2 + -------------------- + ++20. A negative repeat value in a pcre2test subject line was not being ++diagnosed, leading to infinite looping. ++ + + Version 10.40 15-April-2022 + --------------------------- +diff --git a/src/pcre2test.c b/src/pcre2test.c +index 08f86096..f6f5d66c 100644 +--- a/src/pcre2test.c ++++ b/src/pcre2test.c +@@ -6781,9 +6781,9 @@ while ((c = *p++) != 0) + } + + i = (int32_t)li; +- if (i-- == 0) ++ if (i-- <= 0) + { +- fprintf(outfile, "** Zero repeat not allowed\n"); ++ fprintf(outfile, "** Zero or negative repeat not allowed\n"); + return PR_OK; + } + +diff --git a/testdata/testinput2 b/testdata/testinput2 +index d37d8f30..717ba2ae 100644 +--- a/testdata/testinput2 ++++ b/testdata/testinput2 +@@ -5932,4 +5932,7 @@ a)"xI + /[Aa]{2,3}/BI + aabcd + ++-- ++ \[X]{-10} ++ + # End of testinput2 +diff --git a/testdata/testoutput2 b/testdata/testoutput2 +index ce090f8c..d2188d3c 100644 +--- a/testdata/testoutput2 ++++ b/testdata/testoutput2 +@@ -17746,6 +17746,10 @@ Subject length lower bound = 2 + aabcd + 0: aa + ++-- ++ \[X]{-10} ++** Zero or negative repeat not allowed ++ + # End of testinput2 + Error -70: PCRE2_ERROR_BADDATA (unknown error number) + Error -62: bad serialized data diff --git a/meta/recipes-support/libpcre/libpcre2_10.40.bb b/meta/recipes-support/libpcre/libpcre2_10.40.bb index 3843d43b69..74c12ecec2 100644 --- a/meta/recipes-support/libpcre/libpcre2_10.40.bb +++ b/meta/recipes-support/libpcre/libpcre2_10.40.bb @@ -11,6 +11,7 @@ LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENCE;md5=41bfb977e4933c506588724ce69bf5d2" SRC_URI = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \ + file://CVE-2022-41409.patch \ " UPSTREAM_CHECK_URI = "https://github.com/PhilipHazel/pcre2/releases" diff --git a/meta/recipes-support/libseccomp/files/run-ptest b/meta/recipes-support/libseccomp/files/run-ptest index 54b4a63cd2..63c79f09c4 100644 --- a/meta/recipes-support/libseccomp/files/run-ptest +++ b/meta/recipes-support/libseccomp/files/run-ptest @@ -1,4 +1,7 @@ #!/bin/sh cd tests +sed -i 's/SUCCESS/PASS/g; s/FAILURE/FAIL/g; s/SKIPPED/SKIP/g' regression +sed -i 's/"Test %s result: %s\\n" "$1" "$2"/"%s: %s\\n" "$2" "$1"/g' regression +sed -i 's/"Test %s result: %s %s\\n" "$1" "$2" "$3"/"%s: %s %s\\n" "$2" "$1" "$3"/g' regression ./regression -a diff --git a/meta/recipes-support/libssh2/files/0001-Don-t-let-host-enviroment-to-decide-if-a-test-is-bui.patch b/meta/recipes-support/libssh2/files/0001-Don-t-let-host-enviroment-to-decide-if-a-test-is-bui.patch deleted file mode 100644 index b1204e49eb..0000000000 --- a/meta/recipes-support/libssh2/files/0001-Don-t-let-host-enviroment-to-decide-if-a-test-is-bui.patch +++ /dev/null @@ -1,44 +0,0 @@ -From f6abce5ba41a412a247250dcd80e387e53474466 Mon Sep 17 00:00:00 2001 -From: Your Name <you@example.com> -Date: Mon, 28 Dec 2020 02:08:03 +0000 -Subject: [PATCH] Don't let host enviroment to decide if a test is build - -test ssh2.sh need sshd, for cross compile, we need it on target, so -don't use SSHD on host to decide weither to build a test - -Upstream-Status: Inappropriate[oe specific] - -Signed-off-by: Changqing Li <changqing.li@windriver.com> - ---- - tests/Makefile.am | 6 +----- - 1 file changed, 1 insertion(+), 5 deletions(-) - -diff --git a/tests/Makefile.am b/tests/Makefile.am -index dc0922f..6cbc35d 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -1,16 +1,12 @@ - AM_CPPFLAGS = -I$(top_srcdir)/src -I$(top_srcdir)/include -I$(top_builddir)/src - LDADD = ../src/libssh2.la - --if SSHD - noinst_PROGRAMS = ssh2 - ssh2_SOURCES = ssh2.c --endif - - ctests = simple$(EXEEXT) - TESTS = $(ctests) mansyntax.sh --if SSHD - TESTS += ssh2.sh --endif - check_PROGRAMS = $(ctests) - - TESTS_ENVIRONMENT = SSHD=$(SSHD) EXEEXT=$(EXEEXT) -@@ -38,4 +34,4 @@ if OPENSSL - # EXTRA_DIST += test_public_key_auth_succeeds_with_correct_encrypted_ed25519_key.c - # EXTRA_DIST += test_public_key_auth_succeeds_with_correct_ed25519_key_from_mem.c - EXTRA_DIST += test_public_key_auth_succeeds_with_correct_rsa_openssh_key.c --endif -\ No newline at end of file -+endif diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2020-22218.patch b/meta/recipes-support/libssh2/libssh2/CVE-2020-22218.patch new file mode 100644 index 0000000000..066233fcae --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2020-22218.patch @@ -0,0 +1,34 @@ +CVE: CVE-2020-22218 +Upstream-Status: Backport [ https://github.com/libssh2/libssh2/commit/642eec48ff3adfdb7a9e562b6d7fc865d1733f45 ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + + +From 642eec48ff3adfdb7a9e562b6d7fc865d1733f45 Mon Sep 17 00:00:00 2001 +From: lutianxiong <lutianxiong@huawei.com> +Date: Fri, 29 May 2020 01:25:40 +0800 +Subject: [PATCH] transport.c: fix use-of-uninitialized-value (#476) + +file:transport.c + +notes: +return error if malloc(0) + +credit: +lutianxiong +--- + src/transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/transport.c b/src/transport.c +index 96fca6b8cc..adf96c2437 100644 +--- a/src/transport.c ++++ b/src/transport.c +@@ -472,7 +472,7 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session) + /* Get a packet handle put data into. We get one to + hold all data, including padding and MAC. */ + p->payload = LIBSSH2_ALLOC(session, total_num); +- if(!p->payload) { ++ if(total_num == 0 || !p->payload) { + return LIBSSH2_ERROR_ALLOC; + } + p->total_num = total_num; diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch b/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch new file mode 100644 index 0000000000..c7a228217f --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch @@ -0,0 +1,459 @@ +From d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a Mon Sep 17 00:00:00 2001 +From: Michael Buckley <michael@buckleyisms.com> +Date: Thu, 30 Nov 2023 15:08:02 -0800 +Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" + +Refs: +https://terrapin-attack.com/ https://seclists.org/oss-sec/2023/q4/292 +https://osv.dev/list?ecosystem=&q=CVE-2023-48795 GHSA-45x7-px36-x8w8 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795 + +Fixes #1290 +Closes #1291 + +CVE: CVE-2023-48795 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a] + +Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> +--- + src/kex.c | 64 +++++++++++++++++++++------------- + src/libssh2_priv.h | 18 +++++++--- + src/packet.c | 85 +++++++++++++++++++++++++++++++++++++++++++--- + src/packet.h | 2 +- + src/session.c | 3 ++ + src/transport.c | 12 ++++++- + 6 files changed, 150 insertions(+), 34 deletions(-) + +diff --git a/src/kex.c b/src/kex.c +index 9f3ef79..e040dcd 100644 +--- a/src/kex.c ++++ b/src/kex.c +@@ -3026,6 +3026,13 @@ kex_method_ssh_curve25519_sha256 = { + }; + #endif + ++static const LIBSSH2_KEX_METHOD ++kex_method_strict_client_extension = { ++ "kex-strict-c-v00@openssh.com", ++ NULL, ++ 0, ++}; ++ + static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = { + #if LIBSSH2_ED25519 + &kex_method_ssh_curve25519_sha256, +@@ -3043,6 +3050,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = { + &kex_method_diffie_helman_group14_sha1, + &kex_method_diffie_helman_group1_sha1, + &kex_method_diffie_helman_group_exchange_sha1, ++ &kex_method_strict_client_extension, + NULL + }; + +@@ -3281,13 +3289,13 @@ static int kexinit(LIBSSH2_SESSION * session) + return 0; + } + +-/* kex_agree_instr ++/* _libssh2_kex_agree_instr + * Kex specific variant of strstr() + * Needle must be precede by BOL or ',', and followed by ',' or EOL + */ +-static unsigned char * +-kex_agree_instr(unsigned char *haystack, unsigned long haystack_len, +- const unsigned char *needle, unsigned long needle_len) ++unsigned char * ++_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len, ++ const unsigned char *needle, size_t needle_len) + { + unsigned char *s; + unsigned char *end_haystack; +@@ -3371,7 +3379,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session, + while(s && *s) { + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); +- if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) { + const LIBSSH2_HOSTKEY_METHOD *method = + (const LIBSSH2_HOSTKEY_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3405,9 +3413,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session, + } + + while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) { +- s = kex_agree_instr(hostkey, hostkey_len, +- (unsigned char *) (*hostkeyp)->name, +- strlen((*hostkeyp)->name)); ++ s = _libssh2_kex_agree_instr(hostkey, hostkey_len, ++ (unsigned char *) (*hostkeyp)->name, ++ strlen((*hostkeyp)->name)); + if(s) { + /* So far so good, but does it suit our purposes? (Encrypting vs + Signing) */ +@@ -3442,13 +3450,19 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex, + const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods; + unsigned char *s; + ++ const unsigned char *strict = ++ (unsigned char *)"kex-strict-s-v00@openssh.com"; ++ ++ if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) { ++ session->kex_strict = 1; ++ } + if(session->kex_prefs) { + s = (unsigned char *) session->kex_prefs; + + while(s && *s) { + unsigned char *q, *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); +- q = kex_agree_instr(kex, kex_len, s, method_len); ++ q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len); + if(q) { + const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3482,9 +3496,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex, + } + + while(*kexp && (*kexp)->name) { +- s = kex_agree_instr(kex, kex_len, +- (unsigned char *) (*kexp)->name, +- strlen((*kexp)->name)); ++ s = _libssh2_kex_agree_instr(kex, kex_len, ++ (unsigned char *) (*kexp)->name, ++ strlen((*kexp)->name)); + if(s) { + /* We've agreed on a key exchange method, + * Can we agree on a hostkey that works with this kex? +@@ -3528,7 +3542,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session, + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); + +- if(kex_agree_instr(crypt, crypt_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) { + const LIBSSH2_CRYPT_METHOD *method = + (const LIBSSH2_CRYPT_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3550,9 +3564,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session, + } + + while(*cryptp && (*cryptp)->name) { +- s = kex_agree_instr(crypt, crypt_len, +- (unsigned char *) (*cryptp)->name, +- strlen((*cryptp)->name)); ++ s = _libssh2_kex_agree_instr(crypt, crypt_len, ++ (unsigned char *) (*cryptp)->name, ++ strlen((*cryptp)->name)); + if(s) { + endpoint->crypt = *cryptp; + return 0; +@@ -3583,7 +3597,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session, + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); + +- if(kex_agree_instr(mac, mac_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) { + const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *) + kex_get_method_by_name((char *) s, method_len, + (const LIBSSH2_COMMON_METHOD **) +@@ -3604,8 +3618,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session, + } + + while(*macp && (*macp)->name) { +- s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name, +- strlen((*macp)->name)); ++ s = _libssh2_kex_agree_instr(mac, mac_len, ++ (unsigned char *) (*macp)->name, ++ strlen((*macp)->name)); + if(s) { + endpoint->mac = *macp; + return 0; +@@ -3636,7 +3651,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session, + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); + +- if(kex_agree_instr(comp, comp_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) { + const LIBSSH2_COMP_METHOD *method = + (const LIBSSH2_COMP_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3658,8 +3673,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session, + } + + while(*compp && (*compp)->name) { +- s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name, +- strlen((*compp)->name)); ++ s = _libssh2_kex_agree_instr(comp, comp_len, ++ (unsigned char *) (*compp)->name, ++ strlen((*compp)->name)); + if(s) { + endpoint->comp = *compp; + return 0; +@@ -3856,7 +3872,8 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, + session->local.kexinit = key_state->oldlocal; + session->local.kexinit_len = key_state->oldlocal_len; + key_state->state = libssh2_NB_state_idle; +- session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; ++ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; ++ session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; + session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; + return -1; + } +@@ -3904,6 +3921,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, + session->remote.kexinit = NULL; + } + ++ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; + session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; + session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; + +diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h +index da488b7..7faeab6 100644 +--- a/src/libssh2_priv.h ++++ b/src/libssh2_priv.h +@@ -640,6 +640,9 @@ struct _LIBSSH2_SESSION + unsigned char server_hostkey_sha256[SHA256_DIGEST_LENGTH]; + int server_hostkey_sha256_valid; + ++ /* Whether to use the OpenSSH Strict KEX extension */ ++ int kex_strict; ++ + /* (remote as source of data -- packet_read ) */ + libssh2_endpoint_data remote; + +@@ -809,6 +812,7 @@ struct _LIBSSH2_SESSION + int fullpacket_macstate; + size_t fullpacket_payload_len; + int fullpacket_packet_type; ++ uint32_t fullpacket_required_type; + + /* State variables used in libssh2_sftp_init() */ + libssh2_nonblocking_states sftpInit_state; +@@ -856,10 +860,11 @@ struct _LIBSSH2_SESSION + }; + + /* session.state bits */ +-#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000001 +-#define LIBSSH2_STATE_NEWKEYS 0x00000002 +-#define LIBSSH2_STATE_AUTHENTICATED 0x00000004 +-#define LIBSSH2_STATE_KEX_ACTIVE 0x00000008 ++#define LIBSSH2_STATE_INITIAL_KEX 0x00000001 ++#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000002 ++#define LIBSSH2_STATE_NEWKEYS 0x00000004 ++#define LIBSSH2_STATE_AUTHENTICATED 0x00000008 ++#define LIBSSH2_STATE_KEX_ACTIVE 0x00000010 + + /* session.flag helpers */ + #ifdef MSG_NOSIGNAL +@@ -1076,6 +1081,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer, + int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, + key_exchange_state_t * state); + ++unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack, ++ size_t haystack_len, ++ const unsigned char *needle, ++ size_t needle_len); ++ + /* Let crypt.c/hostkey.c expose their method structs */ + const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void); + const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void); +diff --git a/src/packet.c b/src/packet.c +index 04937d6..786ba40 100644 +--- a/src/packet.c ++++ b/src/packet.c +@@ -467,14 +467,13 @@ packet_x11_open(LIBSSH2_SESSION * session, unsigned char *data, + * layer when it has received a packet. + * + * The input pointer 'data' is pointing to allocated data that this function +- * is asked to deal with so on failure OR success, it must be freed fine. +- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN. ++ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN. + * + * This function will always be called with 'datalen' greater than zero. + */ + int + _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, +- size_t datalen, int macstate) ++ size_t datalen, int macstate, uint32_t seq) + { + int rc = 0; + unsigned char *message = NULL; +@@ -517,6 +516,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, + break; + } + ++ if(session->state & LIBSSH2_STATE_INITIAL_KEX) { ++ if(msg == SSH_MSG_KEXINIT) { ++ if(!session->kex_strict) { ++ if(datalen < 17) { ++ LIBSSH2_FREE(session, data); ++ session->packAdd_state = libssh2_NB_state_idle; ++ return _libssh2_error(session, ++ LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "Data too short extracting kex"); ++ } ++ else { ++ const unsigned char *strict = ++ (unsigned char *)"kex-strict-s-v00@openssh.com"; ++ struct string_buf buf; ++ unsigned char *algs = NULL; ++ size_t algs_len = 0; ++ ++ buf.data = (unsigned char *)data; ++ buf.dataptr = buf.data; ++ buf.len = datalen; ++ buf.dataptr += 17; /* advance past type and cookie */ ++ ++ if(_libssh2_get_string(&buf, &algs, &algs_len)) { ++ LIBSSH2_FREE(session, data); ++ session->packAdd_state = libssh2_NB_state_idle; ++ return _libssh2_error(session, ++ LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "Algs too short"); ++ } ++ ++ if(algs_len == 0 || ++ _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) { ++ session->kex_strict = 1; ++ } ++ } ++ } ++ ++ if(session->kex_strict && seq) { ++ LIBSSH2_FREE(session, data); ++ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED; ++ session->packAdd_state = libssh2_NB_state_idle; ++ libssh2_session_disconnect(session, "strict KEX violation: " ++ "KEXINIT was not the first packet"); ++ ++ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, ++ "strict KEX violation: " ++ "KEXINIT was not the first packet"); ++ } ++ } ++ ++ if(session->kex_strict && session->fullpacket_required_type && ++ session->fullpacket_required_type != msg) { ++ LIBSSH2_FREE(session, data); ++ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED; ++ session->packAdd_state = libssh2_NB_state_idle; ++ libssh2_session_disconnect(session, "strict KEX violation: " ++ "unexpected packet type"); ++ ++ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, ++ "strict KEX violation: " ++ "unexpected packet type"); ++ } ++ } ++ + if(session->packAdd_state == libssh2_NB_state_allocated) { + /* A couple exceptions to the packet adding rule: */ + switch(msg) { +@@ -1118,7 +1181,16 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type, + + return 0; + } +- packet = _libssh2_list_next(&packet->node); ++ else if(session->kex_strict && ++ (session->state & LIBSSH2_STATE_INITIAL_KEX)) { ++ libssh2_session_disconnect(session, "strict KEX violation: " ++ "unexpected packet type"); ++ ++ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, ++ "strict KEX violation: " ++ "unexpected packet type"); ++ } ++ packet = _libssh2_list_next(&packet->node); + } + return -1; + } +@@ -1179,7 +1251,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type, + } + + while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) { +- int ret = _libssh2_transport_read(session); ++ int ret; ++ session->fullpacket_required_type = packet_type; ++ ret = _libssh2_transport_read(session); ++ session->fullpacket_required_type = 0; + if(ret == LIBSSH2_ERROR_EAGAIN) + return ret; + else if(ret < 0) { +diff --git a/src/packet.h b/src/packet.h +index 79018bc..08ea2a2 100644 +--- a/src/packet.h ++++ b/src/packet.h +@@ -71,6 +71,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session, + int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data, + unsigned long data_len); + int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, +- size_t datalen, int macstate); ++ size_t datalen, int macstate, uint32_t seq); + + #endif /* __LIBSSH2_PACKET_H */ +diff --git a/src/session.c b/src/session.c +index 212560b..019b9ed 100644 +--- a/src/session.c ++++ b/src/session.c +@@ -500,6 +500,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)), + session->abstract = abstract; + session->api_timeout = 0; /* timeout-free API by default */ + session->api_block_mode = 1; /* blocking API by default */ ++ session->state = LIBSSH2_STATE_INITIAL_KEX; ++ session->fullpacket_required_type = 0; + _libssh2_debug(session, LIBSSH2_TRACE_TRANS, + "New session resource allocated"); + _libssh2_init_if_needed(); +@@ -1171,6 +1173,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason, + const char *desc, const char *lang) + { + int rc; ++ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; + session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; + BLOCK_ADJUST(rc, session, + session_disconnect(session, reason, desc, lang)); +diff --git a/src/transport.c b/src/transport.c +index 1074fc2..6823b63 100644 +--- a/src/transport.c ++++ b/src/transport.c +@@ -168,6 +168,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + struct transportpacket *p = &session->packet; + int rc; + int compressed; ++ uint32_t seq = session->remote.seqno; + + if(session->fullpacket_state == libssh2_NB_state_idle) { + session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED; +@@ -240,7 +241,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + if(session->fullpacket_state == libssh2_NB_state_created) { + rc = _libssh2_packet_add(session, p->payload, + session->fullpacket_payload_len, +- session->fullpacket_macstate); ++ session->fullpacket_macstate, seq); + if(rc == LIBSSH2_ERROR_EAGAIN) + return rc; + if(rc) { +@@ -251,6 +252,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + + session->fullpacket_state = libssh2_NB_state_idle; + ++ if(session->kex_strict && ++ session->fullpacket_packet_type == SSH_MSG_NEWKEYS) { ++ session->remote.seqno = 0; ++ } ++ + return session->fullpacket_packet_type; + } + +@@ -892,6 +898,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session, + + session->local.seqno++; + ++ if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) { ++ session->local.seqno = 0; ++ } ++ + ret = LIBSSH2_SEND(session, p->outbuf, total_length, + LIBSSH2_SOCKET_SEND_FLAGS(session)); + if(ret < 0) +-- +2.40.0 diff --git a/meta/recipes-support/libssh2/libssh2/fix-ssh2-test.patch b/meta/recipes-support/libssh2/libssh2/fix-ssh2-test.patch new file mode 100644 index 0000000000..ee916c42d4 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/fix-ssh2-test.patch @@ -0,0 +1,23 @@ +In 8.8 OpenSSH disabled sha1 rsa-sha keys out of the box, +so we need to re-enable them as a workaround for the test +suite until upstream updates the tests. + +See: https://github.com/libssh2/libssh2/issues/630 + +Upstream-Status: Backport [alternative fixes merged upstream] + +Patch taken from https://github.com/mirror-rpm/libssh2/commit/47f7114f7d0780f3075bad51a71881f45cc933c5 + +--- a/tests/ssh2.sh ++++ b/tests/ssh2.sh +@@ -25,7 +25,8 @@ $SSHD -f /dev/null -h "$srcdir"/etc/host + -o 'Port 4711' \ + -o 'Protocol 2' \ + -o "AuthorizedKeysFile $srcdir/etc/user.pub" \ +- -o 'UsePrivilegeSeparation no' \ ++ -o 'HostKeyAlgorithms +ssh-rsa' \ ++ -o 'PubkeyAcceptedAlgorithms +ssh-rsa' \ + -o 'StrictModes no' \ + -D \ + $libssh2_sshd_params & + diff --git a/meta/recipes-support/libssh2/files/run-ptest b/meta/recipes-support/libssh2/libssh2/run-ptest index 9e2fce2d24..5e7426f79d 100644 --- a/meta/recipes-support/libssh2/files/run-ptest +++ b/meta/recipes-support/libssh2/libssh2/run-ptest @@ -2,8 +2,7 @@ ptestdir=$(dirname "$(readlink -f "$0")") cd tests -# omit ssh2.sh until https://github.com/libssh2/libssh2/issues/630 is fixed -for test in simple mansyntax.sh +for test in simple mansyntax.sh ssh2.sh do ./../test-driver --test-name $test --log-file ../$test.log --trs-file ../$test.trs --color-tests no --enable-hard-errors yes --expect-failure no -- ./$test done diff --git a/meta/recipes-support/libssh2/libssh2_1.10.0.bb b/meta/recipes-support/libssh2/libssh2_1.10.0.bb index 072d6819c0..8fd77996d5 100644 --- a/meta/recipes-support/libssh2/libssh2_1.10.0.bb +++ b/meta/recipes-support/libssh2/libssh2_1.10.0.bb @@ -8,11 +8,12 @@ LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://COPYING;md5=3e089ad0cf27edf1e7f261dfcd06acc7" SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ + file://fix-ssh2-test.patch \ file://run-ptest \ + file://CVE-2020-22218.patch \ + file://CVE-2023-48795.patch \ " -SRC_URI:append:ptest = " file://0001-Don-t-let-host-enviroment-to-decide-if-a-test-is-bui.patch" - SRC_URI[sha256sum] = "2d64e90f3ded394b91d3a2e774ca203a4179f69aebee03003e5a6fa621e41d51" inherit autotools pkgconfig ptest diff --git a/meta/recipes-support/nghttp2/nghttp2/CVE-2023-35945.patch b/meta/recipes-support/nghttp2/nghttp2/CVE-2023-35945.patch new file mode 100644 index 0000000000..e03915fda8 --- /dev/null +++ b/meta/recipes-support/nghttp2/nghttp2/CVE-2023-35945.patch @@ -0,0 +1,151 @@ +From ce385d3f55a4b76da976b3bdf71fe2deddf315ba Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> +Date: Thu, 24 Aug 2023 09:34:26 +0000 +Subject: [PATCH] Fix memory leak + +This commit fixes memory leak that happens when PUSH_PROMISE or +HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback +fails with a fatal error. For example, if GOAWAY frame has been +received, a HEADERS frame that opens new stream cannot be sent. + +This issue has already been made public via CVE-2023-35945 [1] issued +by envoyproxy/envoy project. During embargo period, the patch to fix +this bug was accidentally submitted to nghttp2/nghttp2 repository [2]. +And they decided to disclose CVE early. I was notified just 1.5 hours +before disclosure. I had no time to respond. + +PoC described in [1] is quite simple, but I think it is not enough to +trigger this bug. While it is true that receiving GOAWAY prevents a +client from opening new stream, and nghttp2 enters error handling +branch, in order to cause the memory leak, +nghttp2_session_close_stream function must return a fatal error. +nghttp2 defines 2 fatal error codes: + +- NGHTTP2_ERR_NOMEM +- NGHTTP2_ERR_CALLBACK_FAILURE + +NGHTTP2_ERR_NOMEM, as its name suggests, indicates out of memory. It +is unlikely that a process gets short of memory with this simple PoC +scenario unless application does something memory heavy processing. + +NGHTTP2_ERR_CALLBACK_FAILURE is returned from application defined +callback function (nghttp2_on_stream_close_callback, in this case), +which indicates something fatal happened inside a callback, and a +connection must be closed immediately without any further action. As +nghttp2_on_stream_close_error_callback documentation says, any error +code other than 0 or NGHTTP2_ERR_CALLBACK_FAILURE is treated as fatal +error code. More specifically, it is treated as if +NGHTTP2_ERR_CALLBACK_FAILURE is returned. I guess that envoy returns +NGHTTP2_ERR_CALLBACK_FAILURE or other error code which is translated +into NGHTTP2_ERR_CALLBACK_FAILURE. + +[1] https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r +[2] https://github.com/nghttp2/nghttp2/pull/1929 + +CVE: CVE-2023-35945 + +Upstream-Status: Backport [https://github.com/nghttp2/nghttp2/commit/ce385d3f55a4b76da976b3bdf71fe2deddf315ba] + +Signed-off-by: Yogita Urade <yogita.urade@windriver.com> +--- + lib/nghttp2_session.c | 10 +++++----- + tests/nghttp2_session_test.c | 34 ++++++++++++++++++++++++++++++++++ + 2 files changed, 39 insertions(+), 5 deletions(-) + +diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c +index 380a47c..2d9285f 100644 +--- a/lib/nghttp2_session.c ++++ b/lib/nghttp2_session.c +@@ -2940,6 +2940,7 @@ static ssize_t nghttp2_session_mem_send_internal(nghttp2_session *session, + if (rv < 0) { + int32_t opened_stream_id = 0; + uint32_t error_code = NGHTTP2_INTERNAL_ERROR; ++ int rv2 = 0; + + DEBUGF("send: frame preparation failed with %s\n", + nghttp2_strerror(rv)); +@@ -2982,19 +2983,18 @@ static ssize_t nghttp2_session_mem_send_internal(nghttp2_session *session, + } + if (opened_stream_id) { + /* careful not to override rv */ +- int rv2; + rv2 = nghttp2_session_close_stream(session, opened_stream_id, + error_code); +- +- if (nghttp2_is_fatal(rv2)) { +- return rv2; +- } + } + + nghttp2_outbound_item_free(item, mem); + nghttp2_mem_free(mem, item); + active_outbound_item_reset(aob, mem); + ++ if (nghttp2_is_fatal(rv2)) { ++ return rv2; ++ } ++ + if (rv == NGHTTP2_ERR_HEADER_COMP) { + /* If header compression error occurred, should terminiate + connection. */ +diff --git a/tests/nghttp2_session_test.c b/tests/nghttp2_session_test.c +index cb6bdf7..c2778bc 100644 +--- a/tests/nghttp2_session_test.c ++++ b/tests/nghttp2_session_test.c +@@ -584,6 +584,15 @@ static int on_stream_close_callback(nghttp2_session *session, int32_t stream_id, + return 0; + } + ++static int fatal_error_on_stream_close_callback(nghttp2_session *session, ++ int32_t stream_id, ++ uint32_t error_code, ++ void *user_data) { ++ on_stream_close_callback(session, stream_id, error_code, user_data); ++ ++ return NGHTTP2_ERR_CALLBACK_FAILURE; ++} ++ + static ssize_t pack_extension_callback(nghttp2_session *session, uint8_t *buf, + size_t len, const nghttp2_frame *frame, + void *user_data) { +@@ -3906,6 +3915,8 @@ void test_nghttp2_session_on_goaway_received(void) { + nghttp2_frame frame; + int i; + nghttp2_mem *mem; ++ const uint8_t *data; ++ ssize_t datalen; + + mem = nghttp2_mem_default(); + user_data.frame_recv_cb_called = 0; +@@ -3947,6 +3958,29 @@ void test_nghttp2_session_on_goaway_received(void) { + + nghttp2_frame_goaway_free(&frame.goaway, mem); + nghttp2_session_del(session); ++ ++ /* Make sure that no memory leak when stream_close callback fails ++ with a fatal error */ ++ memset(&callbacks, 0, sizeof(nghttp2_session_callbacks)); ++ callbacks.on_stream_close_callback = fatal_error_on_stream_close_callback; ++ ++ memset(&user_data, 0, sizeof(user_data)); ++ ++ nghttp2_session_client_new(&session, &callbacks, &user_data); ++ ++ nghttp2_frame_goaway_init(&frame.goaway, 0, NGHTTP2_NO_ERROR, NULL, 0); ++ ++ CU_ASSERT(0 == nghttp2_session_on_goaway_received(session, &frame)); ++ ++ nghttp2_submit_request(session, NULL, reqnv, ARRLEN(reqnv), NULL, NULL); ++ ++ datalen = nghttp2_session_mem_send(session, &data); ++ ++ CU_ASSERT(NGHTTP2_ERR_CALLBACK_FAILURE == datalen); ++ CU_ASSERT(1 == user_data.stream_close_cb_called); ++ ++ nghttp2_frame_goaway_free(&frame.goaway, mem); ++ nghttp2_session_del(session); + } + + void test_nghttp2_session_on_window_update_received(void) { +-- +2.35.5 diff --git a/meta/recipes-support/nghttp2/nghttp2/CVE-2023-44487.patch b/meta/recipes-support/nghttp2/nghttp2/CVE-2023-44487.patch new file mode 100644 index 0000000000..3cba83307c --- /dev/null +++ b/meta/recipes-support/nghttp2/nghttp2/CVE-2023-44487.patch @@ -0,0 +1,927 @@ +From 72b4af6143681f528f1d237b21a9a7aee1738832 Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> +Date: Sun, 1 Oct 2023 00:05:01 +0900 +Subject: [PATCH] Rework session management + +CVE: CVE-2023-44487 + +Upstream-Status: Backport [https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832] + +Signed-off-by: Zahir Hussain zahir.basha@kpit.com +Signed-off-by: aszh07 <mail2szahir@gmail.com> +--- +CMakeLists.txt | 4 ++ +cmakeconfig.h.in | 9 +++ +configure.ac | 21 +++++++ +doc/Makefile.am | 1 + +lib/CMakeLists.txt | 2 + +lib/Makefile.am | 4 ++ +lib/includes/nghttp2/nghttp2.h | 17 ++++++ +lib/nghttp2_option.c | 7 +++ +lib/nghttp2_ratelim.c | 75 ++++++++++++++++++++++++ +lib/nghttp2_ratelim.h | 57 ++++++++++++++++++ +lib/nghttp2_session.c | 34 ++++++++++- +lib/nghttp2_session.h | 12 +++- +lib/nghttp2_time.c | 62 ++++++++++++++++++++ +lib/nghttp2_time.h | 38 ++++++++++++ +tests/nghttp2_ratelim_test.c | 101 ++++++++++++++++++++++++++++++++ +tests/nghttp2_ratelim_test.h | 35 +++++++++++ +tests/nghttp2_session_test.c | 103 +++++++++++++++++++++++++++++++++ +tests/nghttp2_session_test.h | 1 + +tests/CMakeLists.txt | 1 + +tests/Makefile.am | 6 +- +lib/nghttp2_option.h | 6 ++ +tests/main.c | 7 ++- +22 files changed, 598 insertions(+), 5 deletions(-) +create mode 100644 lib/nghttp2_ratelim.c +create mode 100644 lib/nghttp2_ratelim.h +create mode 100644 lib/nghttp2_time.c +create mode 100644 lib/nghttp2_time.h +create mode 100644 tests/nghttp2_ratelim_test.c +create mode 100644 tests/nghttp2_ratelim_test.h + +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -262,6 +262,7 @@ check_include_file("netinet/in.h" HAVE + check_include_file("pwd.h" HAVE_PWD_H) + check_include_file("sys/socket.h" HAVE_SYS_SOCKET_H) + check_include_file("sys/time.h" HAVE_SYS_TIME_H) ++check_include_file("sysinfoapi.h" HAVE_SYSINFOAPI_H) + check_include_file("syslog.h" HAVE_SYSLOG_H) + check_include_file("time.h" HAVE_TIME_H) + check_include_file("unistd.h" HAVE_UNISTD_H) +@@ -302,8 +303,11 @@ check_type_size("time_t" SIZEOF_TIME_T) + include(CheckFunctionExists) + check_function_exists(_Exit HAVE__EXIT) + check_function_exists(accept4 HAVE_ACCEPT4) ++check_function_exists(clock_gettime HAVE_CLOCK_GETTIME) + check_function_exists(mkostemp HAVE_MKOSTEMP) + ++check_symbol_exists(GetTickCount64 sysinfoapi.h HAVE_GETTICKCOUNT64) ++ + include(CheckSymbolExists) + # XXX does this correctly detect initgroups (un)availability on cygwin? + check_symbol_exists(initgroups grp.h HAVE_DECL_INITGROUPS) +--- a/cmakeconfig.h.in ++++ b/cmakeconfig.h.in +@@ -34,9 +34,15 @@ + /* Define to 1 if you have the `accept4` function. */ + #cmakedefine HAVE_ACCEPT4 1 + ++/* Define to 1 if you have the `clock_gettime` function. */ ++#cmakedefine HAVE_CLOCK_GETTIME 1 ++ + /* Define to 1 if you have the `mkostemp` function. */ + #cmakedefine HAVE_MKOSTEMP 1 + ++/* Define to 1 if you have the `GetTickCount64` function. */ ++#cmakedefine HAVE_GETTICKCOUNT64 1 ++ + /* Define to 1 if you have the `initgroups` function. */ + #cmakedefine01 HAVE_DECL_INITGROUPS + +@@ -73,6 +79,9 @@ + /* Define to 1 if you have the <sys/time.h> header file. */ + #cmakedefine HAVE_SYS_TIME_H 1 + ++/* Define to 1 if you have the <sysinfoapi.h> header file. */ ++#cmakedefine HAVE_SYSINFOAPI_H 1 ++ + /* Define to 1 if you have the <syslog.h> header file. */ + #cmakedefine HAVE_SYSLOG_H 1 + +--- a/configure.ac ++++ b/configure.ac +@@ -607,6 +607,7 @@ AC_CHECK_HEADERS([ \ + string.h \ + sys/socket.h \ + sys/time.h \ ++ sysinfoapi.h \ + syslog.h \ + time.h \ + unistd.h \ +@@ -681,6 +682,7 @@ AC_FUNC_STRNLEN + AC_CHECK_FUNCS([ \ + _Exit \ + accept4 \ ++ clock_gettime \ + dup2 \ + getcwd \ + getpwnam \ +@@ -706,6 +708,25 @@ AC_CHECK_FUNCS([ \ + AC_CHECK_FUNC([timerfd_create], + [have_timerfd_create=yes], [have_timerfd_create=no]) + ++AC_MSG_CHECKING([checking for GetTickCount64]) ++AC_LINK_IFELSE([AC_LANG_PROGRAM( ++[[ ++#include <sysinfoapi.h> ++]], ++[[ ++GetTickCount64(); ++]])], ++[have_gettickcount64=yes], ++[have_gettickcount64=no]) ++ ++if test "x${have_gettickcount64}" = "xyes"; then ++ AC_MSG_RESULT([yes]) ++ AC_DEFINE([HAVE_GETTICKCOUNT64], [1], ++ [Define to 1 if you have `GetTickCount64` function.]) ++else ++ AC_MSG_RESULT([no]) ++fi ++ + # For cygwin: we can link initgroups, so AC_CHECK_FUNCS succeeds, but + # cygwin disables initgroups due to feature test macro magic with our + # configuration. FreeBSD declares initgroups() in unistd.h. +--- a/doc/Makefile.am ++++ b/doc/Makefile.am +@@ -69,6 +69,7 @@ APIDOCS= \ + nghttp2_option_set_user_recv_extension_type.rst \ + nghttp2_option_set_max_outbound_ack.rst \ + nghttp2_option_set_max_settings.rst \ ++ nghttp2_option_set_stream_reset_rate_limit.rst \ + nghttp2_pack_settings_payload.rst \ + nghttp2_priority_spec_check_default.rst \ + nghttp2_priority_spec_default_init.rst \ +--- a/lib/CMakeLists.txt ++++ b/lib/CMakeLists.txt +@@ -23,6 +23,8 @@ set(NGHTTP2_SOURCES + nghttp2_mem.c + nghttp2_http.c + nghttp2_rcbuf.c ++ nghttp2_ratelim.c ++ nghttp2_time.c + nghttp2_debug.c + ) + +--- a/lib/Makefile.am ++++ b/lib/Makefile.am +@@ -49,6 +49,8 @@ OBJECTS = nghttp2_pq.c nghttp2_map.c ngh + nghttp2_mem.c \ + nghttp2_http.c \ + nghttp2_rcbuf.c \ ++ nghttp2_ratelim.c \ ++ nghttp2_time.c \ + nghttp2_debug.c + + HFILES = nghttp2_pq.h nghttp2_int.h nghttp2_map.h nghttp2_queue.h \ +@@ -65,6 +67,8 @@ HFILES = nghttp2_pq.h nghttp2_int.h nght + nghttp2_mem.h \ + nghttp2_http.h \ + nghttp2_rcbuf.h \ ++ nghttp2_ratelim.h \ ++ nghttp2_time.h \ + nghttp2_debug.h + + libnghttp2_la_SOURCES = $(HFILES) $(OBJECTS) +--- a/lib/includes/nghttp2/nghttp2.h ++++ b/lib/includes/nghttp2/nghttp2.h +@@ -2763,6 +2763,23 @@ nghttp2_session_client_new2(nghttp2_sess + /** + * @function + * ++ * This function sets the rate limit for the incoming stream reset ++ * (RST_STREAM frame). It is server use only. It is a token-bucket ++ * based rate limiter. |burst| specifies the number of tokens that is ++ * initially available. The maximum number of tokens is capped to ++ * this value. |rate| specifies the number of tokens that are ++ * regenerated per second. An incoming RST_STREAM consumes one token. ++ * If there is no token available, GOAWAY is sent to tear down the ++ * connection. |burst| and |rate| default to 1000 and 33 ++ * respectively. ++ */ ++NGHTTP2_EXTERN void ++nghttp2_option_set_stream_reset_rate_limit(nghttp2_option *option, ++ uint64_t burst, uint64_t rate); ++ ++/** ++ * @function ++ * + * Like `nghttp2_session_server_new()`, but with additional options + * specified in the |option|. + * +--- a/lib/nghttp2_option.c ++++ b/lib/nghttp2_option.c +@@ -126,3 +126,10 @@ void nghttp2_option_set_max_settings(ngh + option->opt_set_mask |= NGHTTP2_OPT_MAX_SETTINGS; + option->max_settings = val; + } ++ ++void nghttp2_option_set_stream_reset_rate_limit(nghttp2_option *option, ++ uint64_t burst, uint64_t rate) { ++ option->opt_set_mask |= NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT; ++ option->stream_reset_burst = burst; ++ option->stream_reset_rate = rate; ++} +--- /dev/null ++++ b/lib/nghttp2_ratelim.c +@@ -0,0 +1,75 @@ ++/* ++ * nghttp2 - HTTP/2 C Library ++ * ++ * Copyright (c) 2023 nghttp2 contributors ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining ++ * a copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sublicense, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF ++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE ++ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION ++ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION ++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++#include "nghttp2_ratelim.h" ++#include "nghttp2_helper.h" ++ ++void nghttp2_ratelim_init(nghttp2_ratelim *rl, uint64_t burst, uint64_t rate) { ++ rl->val = rl->burst = burst; ++ rl->rate = rate; ++ rl->tstamp = 0; ++} ++ ++void nghttp2_ratelim_update(nghttp2_ratelim *rl, uint64_t tstamp) { ++ uint64_t d, gain; ++ ++ if (tstamp == rl->tstamp) { ++ return; ++ } ++ ++ if (tstamp > rl->tstamp) { ++ d = tstamp - rl->tstamp; ++ } else { ++ d = 1; ++ } ++ ++ rl->tstamp = tstamp; ++ ++ if (UINT64_MAX / d < rl->rate) { ++ rl->val = rl->burst; ++ ++ return; ++ } ++ ++ gain = rl->rate * d; ++ ++ if (UINT64_MAX - gain < rl->val) { ++ rl->val = rl->burst; ++ ++ return; ++ } ++ ++ rl->val += gain; ++ rl->val = nghttp2_min(rl->val, rl->burst); ++} ++ ++int nghttp2_ratelim_drain(nghttp2_ratelim *rl, uint64_t n) { ++ if (rl->val < n) { ++ return -1; ++ } ++ ++ rl->val -= n; ++ ++ return 0; ++} +--- /dev/null ++++ b/lib/nghttp2_ratelim.h +@@ -0,0 +1,57 @@ ++/* ++ * nghttp2 - HTTP/2 C Library ++ * ++ * Copyright (c) 2023 nghttp2 contributors ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining ++ * a copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sublicense, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF ++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE ++ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION ++ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION ++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++#ifndef NGHTTP2_RATELIM_H ++#define NGHTTP2_RATELIM_H ++ ++#ifdef HAVE_CONFIG_H ++# include <config.h> ++#endif /* HAVE_CONFIG_H */ ++ ++#include <nghttp2/nghttp2.h> ++ ++typedef struct nghttp2_ratelim { ++ /* burst is the maximum value of val. */ ++ uint64_t burst; ++ /* rate is the amount of value that is regenerated per 1 tstamp. */ ++ uint64_t rate; ++ /* val is the amount of value available to drain. */ ++ uint64_t val; ++ /* tstamp is the last timestamp in second resolution that is known ++ to this object. */ ++ uint64_t tstamp; ++} nghttp2_ratelim; ++ ++/* nghttp2_ratelim_init initializes |rl| with the given parameters. */ ++void nghttp2_ratelim_init(nghttp2_ratelim *rl, uint64_t burst, uint64_t rate); ++ ++/* nghttp2_ratelim_update updates rl->val with the current |tstamp| ++ given in second resolution. */ ++void nghttp2_ratelim_update(nghttp2_ratelim *rl, uint64_t tstamp); ++ ++/* nghttp2_ratelim_drain drains |n| from rl->val. It returns 0 if it ++ succeeds, or -1. */ ++int nghttp2_ratelim_drain(nghttp2_ratelim *rl, uint64_t n); ++ ++#endif /* NGHTTP2_RATELIM_H */ +--- a/lib/nghttp2_session.c ++++ b/lib/nghttp2_session.c +@@ -36,6 +36,7 @@ + #include "nghttp2_option.h" + #include "nghttp2_http.h" + #include "nghttp2_pq.h" ++#include "nghttp2_time.h" + #include "nghttp2_debug.h" + + /* +@@ -443,6 +444,10 @@ static int session_new(nghttp2_session * + NGHTTP2_DEFAULT_MAX_CONCURRENT_STREAMS; + (*session_ptr)->pending_enable_push = 1; + ++ nghttp2_ratelim_init(&(*session_ptr)->stream_reset_ratelim, ++ NGHTTP2_DEFAULT_STREAM_RESET_BURST, ++ NGHTTP2_DEFAULT_STREAM_RESET_RATE); ++ + if (server) { + (*session_ptr)->server = 1; + } +@@ -527,6 +532,12 @@ static int session_new(nghttp2_session * + option->max_settings) { + (*session_ptr)->max_settings = option->max_settings; + } ++ ++ if (option->opt_set_mask & NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT) { ++ nghttp2_ratelim_init(&(*session_ptr)->stream_reset_ratelim, ++ option->stream_reset_burst, ++ option->stream_reset_rate); ++ } + } + + rv = nghttp2_hd_deflate_init2(&(*session_ptr)->hd_deflater, +@@ -4144,6 +4155,23 @@ static int session_process_priority_fram + return nghttp2_session_on_priority_received(session, frame); + } + ++static int session_update_stream_reset_ratelim(nghttp2_session *session) { ++ if (!session->server || (session->goaway_flags & NGHTTP2_GOAWAY_SUBMITTED)) { ++ return 0; ++ } ++ ++ nghttp2_ratelim_update(&session->stream_reset_ratelim, ++ nghttp2_time_now_sec()); ++ ++ if (nghttp2_ratelim_drain(&session->stream_reset_ratelim, 1) == 0) { ++ return 0; ++ } ++ ++ return nghttp2_session_add_goaway(session, session->last_recv_stream_id, ++ NGHTTP2_INTERNAL_ERROR, NULL, 0, ++ NGHTTP2_GOAWAY_AUX_NONE); ++} ++ + int nghttp2_session_on_rst_stream_received(nghttp2_session *session, + nghttp2_frame *frame) { + int rv; +@@ -4173,7 +4201,8 @@ int nghttp2_session_on_rst_stream_receiv + if (nghttp2_is_fatal(rv)) { + return rv; + } +- return 0; ++ ++ return session_update_stream_reset_ratelim(session); + } + + static int session_process_rst_stream_frame(nghttp2_session *session) { +@@ -6965,6 +6994,9 @@ int nghttp2_session_add_goaway(nghttp2_s + nghttp2_mem_free(mem, item); + return rv; + } ++ ++ session->goaway_flags |= NGHTTP2_GOAWAY_SUBMITTED; ++ + return 0; + } + +--- a/lib/nghttp2_session.h ++++ b/lib/nghttp2_session.h +@@ -39,6 +39,7 @@ + #include "nghttp2_buf.h" + #include "nghttp2_callbacks.h" + #include "nghttp2_mem.h" ++#include "nghttp2_ratelim.h" + + /* The global variable for tests where we want to disable strict + preface handling. */ +@@ -102,6 +103,10 @@ typedef struct { + /* The default value of maximum number of concurrent streams. */ + #define NGHTTP2_DEFAULT_MAX_CONCURRENT_STREAMS 0xffffffffu + ++/* The default values for stream reset rate limiter. */ ++#define NGHTTP2_DEFAULT_STREAM_RESET_BURST 1000 ++#define NGHTTP2_DEFAULT_STREAM_RESET_RATE 33 ++ + /* Internal state when receiving incoming frame */ + typedef enum { + /* Receiving frame header */ +@@ -176,7 +181,9 @@ typedef enum { + /* Flag means GOAWAY was sent */ + NGHTTP2_GOAWAY_SENT = 0x4, + /* Flag means GOAWAY was received */ +- NGHTTP2_GOAWAY_RECV = 0x8 ++ NGHTTP2_GOAWAY_RECV = 0x8, ++ /* Flag means GOAWAY has been submitted at least once */ ++ NGHTTP2_GOAWAY_SUBMITTED = 0x10 + } nghttp2_goaway_flag; + + /* nghttp2_inflight_settings stores the SETTINGS entries which local +@@ -230,6 +237,9 @@ struct nghttp2_session { + /* Queue of In-flight SETTINGS values. SETTINGS bearing ACK is not + considered as in-flight. */ + nghttp2_inflight_settings *inflight_settings_head; ++ /* Stream reset rate limiter. If receiving excessive amount of ++ stream resets, GOAWAY will be sent. */ ++ nghttp2_ratelim stream_reset_ratelim; + /* The number of outgoing streams. This will be capped by + remote_settings.max_concurrent_streams. */ + size_t num_outgoing_streams; +--- /dev/null ++++ b/lib/nghttp2_time.c +@@ -0,0 +1,62 @@ ++/* ++ * nghttp2 - HTTP/2 C Library ++ * ++ * Copyright (c) 2023 nghttp2 contributors ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining ++ * a copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sublicense, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF ++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE ++ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION ++ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION ++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++#include "nghttp2_time.h" ++ ++#ifdef HAVE_TIME_H ++# include <time.h> ++#endif /* HAVE_TIME_H */ ++ ++#ifdef HAVE_SYSINFOAPI_H ++# include <sysinfoapi.h> ++#endif /* HAVE_SYSINFOAPI_H */ ++ ++#ifndef HAVE_GETTICKCOUNT64 ++static uint64_t time_now_sec(void) { ++ time_t t = time(NULL); ++ ++ if (t == -1) { ++ return 0; ++ } ++ ++ return (uint64_t)t; ++} ++#endif /* HAVE_GETTICKCOUNT64 */ ++ ++#ifdef HAVE_CLOCK_GETTIME ++uint64_t nghttp2_time_now_sec(void) { ++ struct timespec tp; ++ int rv = clock_gettime(CLOCK_MONOTONIC, &tp); ++ ++ if (rv == -1) { ++ return time_now_sec(); ++ } ++ ++ return (uint64_t)tp.tv_sec; ++} ++#elif defined(HAVE_GETTICKCOUNT64) ++uint64_t nghttp2_time_now_sec(void) { return GetTickCount64() / 1000; } ++#else /* !HAVE_CLOCK_GETTIME && !HAVE_GETTICKCOUNT64 */ ++uint64_t nghttp2_time_now_sec(void) { return time_now_sec(); } ++#endif /* !HAVE_CLOCK_GETTIME && !HAVE_GETTICKCOUNT64 */ +--- /dev/null ++++ b/lib/nghttp2_time.h +@@ -0,0 +1,38 @@ ++/* ++ * nghttp2 - HTTP/2 C Library ++ * ++ * Copyright (c) 2023 nghttp2 contributors ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining ++ * a copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sublicense, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF ++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE ++ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION ++ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION ++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++#ifndef NGHTTP2_TIME_H ++#define NGHTTP2_TIME_H ++ ++#ifdef HAVE_CONFIG_H ++# include <config.h> ++#endif /* HAVE_CONFIG_H */ ++ ++#include <nghttp2/nghttp2.h> ++ ++/* nghttp2_time_now_sec returns seconds from implementation-specific ++ timepoint. If it is unable to get seconds, it returns 0. */ ++uint64_t nghttp2_time_now_sec(void); ++ ++#endif /* NGHTTP2_TIME_H */ +--- /dev/null ++++ b/tests/nghttp2_ratelim_test.c +@@ -0,0 +1,101 @@ ++/* ++ * nghttp2 - HTTP/2 C Library ++ * ++ * Copyright (c) 2023 nghttp2 contributors ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining ++ * a copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sublicense, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF ++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE ++ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION ++ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION ++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++#include "nghttp2_ratelim_test.h" ++ ++#include <stdio.h> ++ ++#include <CUnit/CUnit.h> ++ ++#include "nghttp2_ratelim.h" ++ ++void test_nghttp2_ratelim_update(void) { ++ nghttp2_ratelim rl; ++ ++ nghttp2_ratelim_init(&rl, 1000, 21); ++ ++ CU_ASSERT(1000 == rl.val); ++ CU_ASSERT(1000 == rl.burst); ++ CU_ASSERT(21 == rl.rate); ++ CU_ASSERT(0 == rl.tstamp); ++ ++ nghttp2_ratelim_update(&rl, 999); ++ ++ CU_ASSERT(1000 == rl.val); ++ CU_ASSERT(999 == rl.tstamp); ++ ++ nghttp2_ratelim_drain(&rl, 100); ++ ++ CU_ASSERT(900 == rl.val); ++ ++ nghttp2_ratelim_update(&rl, 1000); ++ ++ CU_ASSERT(921 == rl.val); ++ ++ nghttp2_ratelim_update(&rl, 1002); ++ ++ CU_ASSERT(963 == rl.val); ++ ++ nghttp2_ratelim_update(&rl, 1004); ++ ++ CU_ASSERT(1000 == rl.val); ++ CU_ASSERT(1004 == rl.tstamp); ++ ++ /* timer skew */ ++ nghttp2_ratelim_init(&rl, 1000, 21); ++ nghttp2_ratelim_update(&rl, 1); ++ ++ CU_ASSERT(1000 == rl.val); ++ ++ nghttp2_ratelim_update(&rl, 0); ++ ++ CU_ASSERT(1000 == rl.val); ++ ++ /* rate * duration overflow */ ++ nghttp2_ratelim_init(&rl, 1000, 100); ++ nghttp2_ratelim_drain(&rl, 999); ++ ++ CU_ASSERT(1 == rl.val); ++ ++ nghttp2_ratelim_update(&rl, UINT64_MAX); ++ ++ CU_ASSERT(1000 == rl.val); ++ ++ /* val + rate * duration overflow */ ++ nghttp2_ratelim_init(&rl, UINT64_MAX - 1, 2); ++ nghttp2_ratelim_update(&rl, 1); ++ ++ CU_ASSERT(UINT64_MAX - 1 == rl.val); ++} ++ ++void test_nghttp2_ratelim_drain(void) { ++ nghttp2_ratelim rl; ++ ++ nghttp2_ratelim_init(&rl, 100, 7); ++ ++ CU_ASSERT(-1 == nghttp2_ratelim_drain(&rl, 101)); ++ CU_ASSERT(0 == nghttp2_ratelim_drain(&rl, 51)); ++ CU_ASSERT(0 == nghttp2_ratelim_drain(&rl, 49)); ++ CU_ASSERT(-1 == nghttp2_ratelim_drain(&rl, 1)); ++} +--- /dev/null ++++ b/tests/nghttp2_ratelim_test.h +@@ -0,0 +1,35 @@ ++/* ++ * nghttp2 - HTTP/2 C Library ++ * ++ * Copyright (c) 2023 nghttp2 contributors ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining ++ * a copy of this software and associated documentation files (the ++ * "Software"), to deal in the Software without restriction, including ++ * without limitation the rights to use, copy, modify, merge, publish, ++ * distribute, sublicense, and/or sell copies of the Software, and to ++ * permit persons to whom the Software is furnished to do so, subject to ++ * the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF ++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE ++ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION ++ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION ++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ */ ++#ifndef NGHTTP2_RATELIM_TEST_H ++#define NGHTTP2_RATELIM_TEST_H ++ ++#ifdef HAVE_CONFIG_H ++# include <config.h> ++#endif /* HAVE_CONFIG_H */ ++ ++void test_nghttp2_ratelim_update(void); ++void test_nghttp2_ratelim_drain(void); ++ ++#endif /* NGHTTP2_RATELIM_TEST_H */ +--- a/tests/nghttp2_session_test.c ++++ b/tests/nghttp2_session_test.c +@@ -10813,6 +10813,109 @@ void test_nghttp2_session_set_stream_use + nghttp2_session_del(session); + } + ++void test_nghttp2_session_stream_reset_ratelim(void) { ++ nghttp2_session *session; ++ nghttp2_session_callbacks callbacks; ++ nghttp2_frame frame; ++ ssize_t rv; ++ nghttp2_bufs bufs; ++ nghttp2_buf *buf; ++ nghttp2_mem *mem; ++ size_t i; ++ nghttp2_hd_deflater deflater; ++ size_t nvlen; ++ nghttp2_nv *nva; ++ int32_t stream_id; ++ nghttp2_outbound_item *item; ++ nghttp2_option *option; ++ ++ mem = nghttp2_mem_default(); ++ frame_pack_bufs_init(&bufs); ++ ++ memset(&callbacks, 0, sizeof(nghttp2_session_callbacks)); ++ callbacks.send_callback = null_send_callback; ++ ++ nghttp2_option_new(&option); ++ nghttp2_option_set_stream_reset_rate_limit( ++ option, NGHTTP2_DEFAULT_STREAM_RESET_BURST, 0); ++ ++ nghttp2_session_server_new2(&session, &callbacks, NULL, option); ++ ++ nghttp2_frame_settings_init(&frame.settings, NGHTTP2_FLAG_NONE, NULL, 0); ++ rv = nghttp2_frame_pack_settings(&bufs, &frame.settings); ++ ++ CU_ASSERT(0 == rv); ++ ++ nghttp2_frame_settings_free(&frame.settings, mem); ++ ++ buf = &bufs.head->buf; ++ rv = nghttp2_session_mem_recv(session, buf->pos, nghttp2_buf_len(buf)); ++ ++ CU_ASSERT((ssize_t)nghttp2_buf_len(buf) == rv); ++ ++ /* Send SETTINGS ACK */ ++ rv = nghttp2_session_send(session); ++ ++ CU_ASSERT(0 == rv); ++ ++ nghttp2_hd_deflate_init(&deflater, mem); ++ ++ for (i = 0; i < NGHTTP2_DEFAULT_STREAM_RESET_BURST + 2; ++i) { ++ stream_id = (int32_t)(i * 2 + 1); ++ ++ nghttp2_bufs_reset(&bufs); ++ ++ /* HEADERS */ ++ nvlen = ARRLEN(reqnv); ++ nghttp2_nv_array_copy(&nva, reqnv, nvlen, mem); ++ nghttp2_frame_headers_init(&frame.headers, NGHTTP2_FLAG_END_HEADERS, ++ stream_id, NGHTTP2_HCAT_HEADERS, NULL, nva, ++ nvlen); ++ rv = nghttp2_frame_pack_headers(&bufs, &frame.headers, &deflater); ++ ++ CU_ASSERT(0 == rv); ++ ++ nghttp2_frame_headers_free(&frame.headers, mem); ++ ++ buf = &bufs.head->buf; ++ rv = nghttp2_session_mem_recv(session, buf->pos, nghttp2_buf_len(buf)); ++ ++ CU_ASSERT((ssize_t)nghttp2_buf_len(buf) == rv); ++ ++ nghttp2_bufs_reset(&bufs); ++ ++ /* RST_STREAM */ ++ nghttp2_frame_rst_stream_init(&frame.rst_stream, stream_id, ++ NGHTTP2_NO_ERROR); ++ nghttp2_frame_pack_rst_stream(&bufs, &frame.rst_stream); ++ nghttp2_frame_rst_stream_free(&frame.rst_stream); ++ ++ buf = &bufs.head->buf; ++ rv = nghttp2_session_mem_recv(session, buf->pos, nghttp2_buf_len(buf)); ++ ++ CU_ASSERT((ssize_t)nghttp2_buf_len(buf) == rv); ++ ++ if (i < NGHTTP2_DEFAULT_STREAM_RESET_BURST) { ++ CU_ASSERT(0 == nghttp2_outbound_queue_size(&session->ob_reg)); ++ ++ continue; ++ } ++ ++ CU_ASSERT(1 == nghttp2_outbound_queue_size(&session->ob_reg)); ++ ++ item = nghttp2_session_get_next_ob_item(session); ++ ++ CU_ASSERT(NGHTTP2_GOAWAY == item->frame.hd.type); ++ CU_ASSERT(NGHTTP2_DEFAULT_STREAM_RESET_BURST * 2 + 1 == ++ item->frame.goaway.last_stream_id); ++ } ++ ++ nghttp2_hd_deflate_free(&deflater); ++ nghttp2_session_del(session); ++ nghttp2_bufs_free(&bufs); ++ nghttp2_option_del(option); ++} ++ + static void check_nghttp2_http_recv_headers_fail( + nghttp2_session *session, nghttp2_hd_deflater *deflater, int32_t stream_id, + int stream_state, const nghttp2_nv *nva, size_t nvlen) { +--- a/tests/nghttp2_session_test.h ++++ b/tests/nghttp2_session_test.h +@@ -160,6 +160,7 @@ void test_nghttp2_session_removed_closed + void test_nghttp2_session_pause_data(void); + void test_nghttp2_session_no_closed_streams(void); + void test_nghttp2_session_set_stream_user_data(void); ++void test_nghttp2_session_stream_reset_ratelim(void); + void test_nghttp2_http_mandatory_headers(void); + void test_nghttp2_http_content_length(void); + void test_nghttp2_http_content_length_mismatch(void); +--- a/tests/CMakeLists.txt ++++ b/tests/CMakeLists.txt +@@ -21,6 +21,7 @@ if(HAVE_CUNIT) + nghttp2_npn_test.c + nghttp2_helper_test.c + nghttp2_buf_test.c ++ nghttp2_ratelim_test.c + ) + + add_executable(main EXCLUDE_FROM_ALL +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -40,14 +40,16 @@ OBJECTS = main.c nghttp2_pq_test.c nghtt + nghttp2_hd_test.c \ + nghttp2_npn_test.c \ + nghttp2_helper_test.c \ +- nghttp2_buf_test.c ++ nghttp2_buf_test.c \ ++ nghttp2_ratelim_test.c + + HFILES = nghttp2_pq_test.h nghttp2_map_test.h nghttp2_queue_test.h \ + nghttp2_session_test.h \ + nghttp2_frame_test.h nghttp2_stream_test.h nghttp2_hd_test.h \ + nghttp2_npn_test.h nghttp2_helper_test.h \ + nghttp2_test_helper.h \ +- nghttp2_buf_test.h ++ nghttp2_buf_test.h \ ++ nghttp2_ratelim_test.h + + main_SOURCES = $(HFILES) $(OBJECTS) + +--- a/lib/nghttp2_option.h ++++ b/lib/nghttp2_option.h +@@ -68,6 +68,7 @@ typedef enum { + NGHTTP2_OPT_NO_CLOSED_STREAMS = 1 << 10, + NGHTTP2_OPT_MAX_OUTBOUND_ACK = 1 << 11, + NGHTTP2_OPT_MAX_SETTINGS = 1 << 12, ++ NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT = 1 << 15, + } nghttp2_option_flag; + + /** +@@ -75,6 +76,11 @@ typedef enum { + */ + struct nghttp2_option { + /** ++ * NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT ++ */ ++ uint64_t stream_reset_burst; ++ uint64_t stream_reset_rate; ++ /** + * NGHTTP2_OPT_MAX_SEND_HEADER_BLOCK_LENGTH + */ + size_t max_send_header_block_length; +--- a/tests/main.c ++++ b/tests/main.c +@@ -40,6 +40,7 @@ + #include "nghttp2_npn_test.h" + #include "nghttp2_helper_test.h" + #include "nghttp2_buf_test.h" ++#include "nghttp2_ratelim_test.h" + + extern int nghttp2_enable_strict_preface; + +@@ -323,6 +324,8 @@ int main() { + test_nghttp2_session_no_closed_streams) || + !CU_add_test(pSuite, "session_set_stream_user_data", + test_nghttp2_session_set_stream_user_data) || ++ !CU_add_test(pSuite, "session_stream_reset_ratelim", ++ test_nghttp2_session_stream_reset_ratelim) || + !CU_add_test(pSuite, "http_mandatory_headers", + test_nghttp2_http_mandatory_headers) || + !CU_add_test(pSuite, "http_content_length", +@@ -418,7 +421,9 @@ int main() { + !CU_add_test(pSuite, "bufs_advance", test_nghttp2_bufs_advance) || + !CU_add_test(pSuite, "bufs_next_present", + test_nghttp2_bufs_next_present) || +- !CU_add_test(pSuite, "bufs_realloc", test_nghttp2_bufs_realloc)) { ++ !CU_add_test(pSuite, "bufs_realloc", test_nghttp2_bufs_realloc) || ++ !CU_add_test(pSuite, "ratelim_update", test_nghttp2_ratelim_update) || ++ !CU_add_test(pSuite, "ratelim_drain", test_nghttp2_ratelim_drain)) { + CU_cleanup_registry(); + return (int)CU_get_error(); + } diff --git a/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0001.patch b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0001.patch new file mode 100644 index 0000000000..e1d909b0d1 --- /dev/null +++ b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0001.patch @@ -0,0 +1,110 @@ +From 00201ecd8f982da3b67d4f6868af72a1b03b14e0 Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> +Date: Sat, 9 Mar 2024 16:26:42 +0900 +Subject: [PATCH] Limit CONTINUATION frames following an incoming HEADER frame + +CVE: CVE-2024-28182 + +Upstream-Status: Backport [https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + lib/includes/nghttp2/nghttp2.h | 7 ++++++- + lib/nghttp2_helper.c | 2 ++ + lib/nghttp2_session.c | 7 +++++++ + lib/nghttp2_session.h | 10 ++++++++++ + 4 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/lib/includes/nghttp2/nghttp2.h b/lib/includes/nghttp2/nghttp2.h +index 2bd35f4..6cc8c0c 100644 +--- a/lib/includes/nghttp2/nghttp2.h ++++ b/lib/includes/nghttp2/nghttp2.h +@@ -440,7 +440,12 @@ typedef enum { + * exhaustion on server side to send these frames forever and does + * not read network. + */ +- NGHTTP2_ERR_FLOODED = -904 ++ NGHTTP2_ERR_FLOODED = -904, ++ /** ++ * When a local endpoint receives too many CONTINUATION frames ++ * following a HEADER frame. ++ */ ++ NGHTTP2_ERR_TOO_MANY_CONTINUATIONS = -905, + } nghttp2_error; + + /** +diff --git a/lib/nghttp2_helper.c b/lib/nghttp2_helper.c +index 588e269..98989f6 100644 +--- a/lib/nghttp2_helper.c ++++ b/lib/nghttp2_helper.c +@@ -336,6 +336,8 @@ const char *nghttp2_strerror(int error_code) { + "closed"; + case NGHTTP2_ERR_TOO_MANY_SETTINGS: + return "SETTINGS frame contained more than the maximum allowed entries"; ++ case NGHTTP2_ERR_TOO_MANY_CONTINUATIONS: ++ return "Too many CONTINUATION frames following a HEADER frame"; + default: + return "Unknown error code"; + } +diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c +index 5c834fa..537127c 100644 +--- a/lib/nghttp2_session.c ++++ b/lib/nghttp2_session.c +@@ -464,6 +464,7 @@ static int session_new(nghttp2_session **session_ptr, + (*session_ptr)->max_send_header_block_length = NGHTTP2_MAX_HEADERSLEN; + (*session_ptr)->max_outbound_ack = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM; + (*session_ptr)->max_settings = NGHTTP2_DEFAULT_MAX_SETTINGS; ++ (*session_ptr)->max_continuations = NGHTTP2_DEFAULT_MAX_CONTINUATIONS; + + if (option) { + if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) && +@@ -6307,6 +6308,8 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in, + } + } + session_inbound_frame_reset(session); ++ ++ session->num_continuations = 0; + } + break; + } +@@ -6428,6 +6431,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in, + } + #endif /* DEBUGBUILD */ + ++ if (++session->num_continuations > session->max_continuations) { ++ return NGHTTP2_ERR_TOO_MANY_CONTINUATIONS; ++ } ++ + readlen = inbound_frame_buf_read(iframe, in, last); + in += readlen; + +diff --git a/lib/nghttp2_session.h b/lib/nghttp2_session.h +index 5f71a16..9a00b0e 100644 +--- a/lib/nghttp2_session.h ++++ b/lib/nghttp2_session.h +@@ -107,6 +107,10 @@ typedef struct { + #define NGHTTP2_DEFAULT_STREAM_RESET_BURST 1000 + #define NGHTTP2_DEFAULT_STREAM_RESET_RATE 33 + ++/* The default max number of CONTINUATION frames following an incoming ++ HEADER frame. */ ++#define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8 ++ + /* Internal state when receiving incoming frame */ + typedef enum { + /* Receiving frame header */ +@@ -279,6 +283,12 @@ struct nghttp2_session { + size_t max_send_header_block_length; + /* The maximum number of settings accepted per SETTINGS frame. */ + size_t max_settings; ++ /* The maximum number of CONTINUATION frames following an incoming ++ HEADER frame. */ ++ size_t max_continuations; ++ /* The number of CONTINUATION frames following an incoming HEADER ++ frame. This variable is reset when END_HEADERS flag is seen. */ ++ size_t num_continuations; + /* Next Stream ID. Made unsigned int to detect >= (1 << 31). */ + uint32_t next_stream_id; + /* The last stream ID this session initiated. For client session, +-- +2.40.0 diff --git a/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0002.patch b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0002.patch new file mode 100644 index 0000000000..fee19465d5 --- /dev/null +++ b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0002.patch @@ -0,0 +1,105 @@ +From d71a4668c6bead55805d18810d633fbb98315af9 Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> +Date: Sat, 9 Mar 2024 16:48:10 +0900 +Subject: [PATCH] Add nghttp2_option_set_max_continuations + +CVE: CVE-2024-28182 + +Upstream-Status: Backport [https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9] + +Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> +--- + doc/Makefile.am | 1 + + lib/includes/nghttp2/nghttp2.h | 11 +++++++++++ + lib/nghttp2_option.c | 5 +++++ + lib/nghttp2_option.h | 5 +++++ + lib/nghttp2_session.c | 4 ++++ + 5 files changed, 26 insertions(+) + +diff --git a/doc/Makefile.am b/doc/Makefile.am +index b9d5a2d..83cfdfd 100644 +--- a/doc/Makefile.am ++++ b/doc/Makefile.am +@@ -70,6 +70,7 @@ APIDOCS= \ + nghttp2_option_set_no_recv_client_magic.rst \ + nghttp2_option_set_peer_max_concurrent_streams.rst \ + nghttp2_option_set_user_recv_extension_type.rst \ ++ nghttp2_option_set_max_continuations.rst \ + nghttp2_option_set_max_outbound_ack.rst \ + nghttp2_option_set_max_settings.rst \ + nghttp2_option_set_stream_reset_rate_limit.rst \ +diff --git a/lib/includes/nghttp2/nghttp2.h b/lib/includes/nghttp2/nghttp2.h +index 6cc8c0c..c77cca9 100644 +--- a/lib/includes/nghttp2/nghttp2.h ++++ b/lib/includes/nghttp2/nghttp2.h +@@ -2724,6 +2724,17 @@ NGHTTP2_EXTERN void nghttp2_option_set_max_outbound_ack(nghttp2_option *option, + NGHTTP2_EXTERN void nghttp2_option_set_max_settings(nghttp2_option *option, + size_t val); + ++/** ++ * @function ++ * ++ * This function sets the maximum number of CONTINUATION frames ++ * following an incoming HEADER frame. If more than those frames are ++ * received, the remote endpoint is considered to be misbehaving and ++ * session will be closed. The default value is 8. ++ */ ++NGHTTP2_EXTERN void nghttp2_option_set_max_continuations(nghttp2_option *option, ++ size_t val); ++ + /** + * @function + * +diff --git a/lib/nghttp2_option.c b/lib/nghttp2_option.c +index 0d9a404..f3659c1 100644 +--- a/lib/nghttp2_option.c ++++ b/lib/nghttp2_option.c +@@ -133,3 +133,8 @@ void nghttp2_option_set_stream_reset_rate_limit(nghttp2_option *option, + option->stream_reset_burst = burst; + option->stream_reset_rate = rate; + } ++ ++void nghttp2_option_set_max_continuations(nghttp2_option *option, size_t val) { ++ option->opt_set_mask |= NGHTTP2_OPT_MAX_CONTINUATIONS; ++ option->max_continuations = val; ++} +diff --git a/lib/nghttp2_option.h b/lib/nghttp2_option.h +index e6ba910..c1b48c7 100644 +--- a/lib/nghttp2_option.h ++++ b/lib/nghttp2_option.h +@@ -69,6 +69,7 @@ typedef enum { + NGHTTP2_OPT_MAX_OUTBOUND_ACK = 1 << 11, + NGHTTP2_OPT_MAX_SETTINGS = 1 << 12, + NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT = 1 << 15, ++ NGHTTP2_OPT_MAX_CONTINUATIONS = 1 << 16, + } nghttp2_option_flag; + + /** +@@ -96,6 +97,10 @@ struct nghttp2_option { + * NGHTTP2_OPT_MAX_SETTINGS + */ + size_t max_settings; ++ /** ++ * NGHTTP2_OPT_MAX_CONTINUATIONS ++ */ ++ size_t max_continuations; + /** + * Bitwise OR of nghttp2_option_flag to determine that which fields + * are specified. +diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c +index 537127c..b390cd5 100644 +--- a/lib/nghttp2_session.c ++++ b/lib/nghttp2_session.c +@@ -539,6 +539,10 @@ static int session_new(nghttp2_session **session_ptr, + option->stream_reset_burst, + option->stream_reset_rate); + } ++ ++ if (option->opt_set_mask & NGHTTP2_OPT_MAX_CONTINUATIONS) { ++ (*session_ptr)->max_continuations = option->max_continuations; ++ } + } + + rv = nghttp2_hd_deflate_init2(&(*session_ptr)->hd_deflater, +-- +2.40.0 diff --git a/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb b/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb index 58ce08084d..79b1cf95c5 100644 --- a/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb +++ b/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb @@ -9,6 +9,10 @@ UPSTREAM_CHECK_URI = "https://github.com/nghttp2/nghttp2/releases" SRC_URI = "\ https://github.com/nghttp2/nghttp2/releases/download/v${PV}/nghttp2-${PV}.tar.xz \ file://0001-fetch-ocsp-response-use-python3.patch \ + file://CVE-2023-35945.patch \ + file://CVE-2023-44487.patch \ + file://CVE-2024-28182-0001.patch \ + file://CVE-2024-28182-0002.patch \ " SRC_URI[sha256sum] = "68271951324554c34501b85190f22f2221056db69f493afc3bbac8e7be21e7cc" @@ -19,17 +23,19 @@ PACKAGECONFIG[manpages] = "" # first place EXTRA_OECMAKE = "-DENABLE_EXAMPLES=OFF -DENABLE_APP=OFF -DENABLE_HPACK_TOOLS=OFF" -PACKAGES =+ "lib${BPN} ${PN}-client ${PN}-proxy ${PN}-server" +# Do not let configure try to decide this. +# +EXTRA_OECMAKE += "-DENABLE_PYTHON_BINDINGS=OFF" -RDEPENDS:${PN} = "${PN}-client (>= ${PV}) ${PN}-proxy (>= ${PV}) ${PN}-server (>= ${PV})" +PACKAGES =+ "lib${BPN} ${PN}-proxy " + +RDEPENDS:${PN} = "${PN}-proxy (>= ${PV})" RDEPENDS:${PN}:class-native = "" RDEPENDS:${PN}-proxy = "openssl python3-core python3-io python3-shell" ALLOW_EMPTY:${PN} = "1" FILES:${PN} = "" FILES:lib${BPN} = "${libdir}/*${SOLIBS}" -FILES:${PN}-client = "${bindir}/h2load ${bindir}/nghttp" FILES:${PN}-proxy = "${bindir}/nghttpx ${datadir}/${BPN}/fetch-ocsp-response" -FILES:${PN}-server = "${bindir}/nghttpd" BBCLASSEXTEND = "native nativesdk" diff --git a/meta/recipes-support/p11-kit/p11-kit_0.24.1.bb b/meta/recipes-support/p11-kit/p11-kit_0.24.1.bb index 59cbb67961..72b446204a 100644 --- a/meta/recipes-support/p11-kit/p11-kit_0.24.1.bb +++ b/meta/recipes-support/p11-kit/p11-kit_0.24.1.bb @@ -29,4 +29,4 @@ FILES:${PN} += " \ # PN contains p11-kit-proxy.so, a symlink to a loadable module INSANE_SKIP:${PN} = "dev-so" -BBCLASSEXTEND = "nativesdk" +BBCLASSEXTEND = "native nativesdk" diff --git a/meta/recipes-support/serf/serf/0001-Fix-syntax-of-a-print-in-the-scons-file-to-unbreak-b.patch b/meta/recipes-support/serf/serf/0001-Fix-syntax-of-a-print-in-the-scons-file-to-unbreak-b.patch deleted file mode 100644 index 4a5832ac1a..0000000000 --- a/meta/recipes-support/serf/serf/0001-Fix-syntax-of-a-print-in-the-scons-file-to-unbreak-b.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 99f6e1b0d68281b63218d6adfe68cd9e331ac5be Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@gmail.com> -Date: Mon, 3 Sep 2018 10:50:08 -0700 -Subject: [PATCH] Fix syntax of a print() in the scons file to unbreak building - with most recent scons version. - -* SConstruct Use Python 3.0 valid syntax to make Scons 3.0.0 happy on both python - 3.0 and 2.7. - -Upstream-Status: Backport -[https://svn.apache.org/viewvc/serf/trunk/SConstruct?r1=1809132&r2=1811083&diff_format=h] -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - SConstruct | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/SConstruct b/SConstruct -index 1670459..18a45fa 100644 ---- a/SConstruct -+++ b/SConstruct -@@ -184,7 +184,7 @@ CALLOUT_OKAY = not (env.GetOption('clean') or env.GetOption('help')) - - unknown = opts.UnknownVariables() - if unknown: -- print 'Warning: Used unknown variables:', ', '.join(unknown.keys()) -+ print('Warning: Used unknown variables:', ', '.join(unknown.keys())) - - apr = str(env['APR']) - apu = str(env['APU']) diff --git a/meta/recipes-support/serf/serf/0001-buckets-ssl_buckets.c-do-not-use-ERR_GET_FUNC.patch b/meta/recipes-support/serf/serf/0001-buckets-ssl_buckets.c-do-not-use-ERR_GET_FUNC.patch deleted file mode 100644 index 91ccc8a474..0000000000 --- a/meta/recipes-support/serf/serf/0001-buckets-ssl_buckets.c-do-not-use-ERR_GET_FUNC.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 2f45711a66ff99886b6e4a5708e2db01a63e5af4 Mon Sep 17 00:00:00 2001 -From: Alexander Kanavin <alex@linutronix.de> -Date: Fri, 10 Sep 2021 11:05:10 +0200 -Subject: [PATCH] buckets/ssl_buckets.c: do not use ERR_GET_FUNC - -Upstream removed it in -https://github.com/openssl/openssl/pull/16004 - -Upstream-Status: Inactive-Upstream [lastrelease: 2015, lastcommit: 2019] -Signed-off-by: Alexander Kanavin <alex@linutronix.de> ---- - buckets/ssl_buckets.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/buckets/ssl_buckets.c b/buckets/ssl_buckets.c -index b01e535..9801f87 100644 ---- a/buckets/ssl_buckets.c -+++ b/buckets/ssl_buckets.c -@@ -1325,8 +1325,7 @@ static int ssl_need_client_cert(SSL *ssl, X509 **cert, EVP_PKEY **pkey) - return 0; - } - else { -- printf("OpenSSL cert error: %d %d %d\n", ERR_GET_LIB(err), -- ERR_GET_FUNC(err), -+ printf("OpenSSL cert error: %d %d\n", ERR_GET_LIB(err), - ERR_GET_REASON(err)); - PKCS12_free(p12); - bio_meth_free(biom); diff --git a/meta/recipes-support/serf/serf/0004-Follow-up-to-r1811083-fix-building-with-scons-3.0.0-.patch b/meta/recipes-support/serf/serf/0004-Follow-up-to-r1811083-fix-building-with-scons-3.0.0-.patch deleted file mode 100644 index 02fa9e3a06..0000000000 --- a/meta/recipes-support/serf/serf/0004-Follow-up-to-r1811083-fix-building-with-scons-3.0.0-.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 565211fd082ef653ca9c44a345350fc1451f5a0f Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@gmail.com> -Date: Mon, 3 Sep 2018 11:12:38 -0700 -Subject: [PATCH] Follow-up to r1811083 fix building with scons 3.0.0 and - Python3 - -* SConstruct: Append decode('utf-8) to FILE.get_contents() to avoid - TypeError: cannot use a string pattern on a bytes-like object - -Upstream-Status: Backport -[https://svn.apache.org/viewvc/serf/trunk/SConstruct?r1=1811088&r2=1814604] -Signed-off-by: Khem Raj <raj.khem@gmail.com> ---- - SConstruct | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/SConstruct b/SConstruct -index 877731e..7678bb1 100644 ---- a/SConstruct -+++ b/SConstruct -@@ -169,7 +169,7 @@ env.Append(BUILDERS = { - match = re.search('SERF_MAJOR_VERSION ([0-9]+).*' - 'SERF_MINOR_VERSION ([0-9]+).*' - 'SERF_PATCH_VERSION ([0-9]+)', -- env.File('serf.h').get_contents(), -+ env.File('serf.h').get_contents().decode('utf-8'), - re.DOTALL) - MAJOR, MINOR, PATCH = [int(x) for x in match.groups()] - env.Append(MAJOR=str(MAJOR)) diff --git a/meta/recipes-support/serf/serf/SConstruct.stop.creating.directories.without.sandbox-install.prefix.patch b/meta/recipes-support/serf/serf/SConstruct.stop.creating.directories.without.sandbox-install.prefix.patch index 4105868a7e..91640d6044 100644 --- a/meta/recipes-support/serf/serf/SConstruct.stop.creating.directories.without.sandbox-install.prefix.patch +++ b/meta/recipes-support/serf/serf/SConstruct.stop.creating.directories.without.sandbox-install.prefix.patch @@ -31,7 +31,7 @@ ERROR: scons install execution failed. and the installed paths (including the paths inside libserf*.pc) look correct -Upstream-Status: Inactive-Upstream [lastrelease: 2015, lastcommit: 2019] +Upstream-Status: Pending Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> diff --git a/meta/recipes-support/serf/serf_1.3.9.bb b/meta/recipes-support/serf/serf_1.3.10.bb index 669f42b8e7..c6b51452aa 100644 --- a/meta/recipes-support/serf/serf_1.3.9.bb +++ b/meta/recipes-support/serf/serf_1.3.10.bb @@ -7,16 +7,12 @@ HOMEPAGE = "http://serf.apache.org/" SRC_URI = "${APACHE_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ file://norpath.patch \ file://env.patch \ - file://0001-Fix-syntax-of-a-print-in-the-scons-file-to-unbreak-b.patch \ file://0002-SConstruct-Fix-path-quoting-for-.def-generator.patch \ file://0003-gen_def.patch \ - file://0004-Follow-up-to-r1811083-fix-building-with-scons-3.0.0-.patch \ file://SConstruct.stop.creating.directories.without.sandbox-install.prefix.patch \ - file://0001-buckets-ssl_buckets.c-do-not-use-ERR_GET_FUNC.patch \ " -SRC_URI[md5sum] = "370a6340ff20366ab088012cd13f2b57" -SRC_URI[sha256sum] = "549c2d21c577a8a9c0450facb5cca809f26591f048e466552240947bdf7a87cc" +SRC_URI[sha256sum] = "be81ef08baa2516ecda76a77adf7def7bc3227eeb578b9a33b45f7b41dc064e6" LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327" diff --git a/meta/recipes-support/sqlite/files/CVE-2023-36191.patch b/meta/recipes-support/sqlite/files/CVE-2023-36191.patch new file mode 100644 index 0000000000..aca79c334a --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2023-36191.patch @@ -0,0 +1,37 @@ +From 4e8a0eb4e773b808d9e9697af94319599777169a Mon Sep 17 00:00:00 2001 +From: larrybr <larrybr@noemail.net> +Date: Fri, 2 Jun 2023 12:56:32 +0000 +Subject: [PATCH] Fix CLI fault on missing -nonce reported by [forum:/info/f8c14a1134|forum post f8c14a1134]. + +FossilOrigin-Name: cd24178bbaad4a1dafc3848e7d74240f90030160b5c43c93e1e0e11b073c2df5 + +Upstream-Status: Backport [https://sqlite.org/src/info/cd24178bbaad4a1d +Upstream commit https://github.com/sqlite/sqlite/commit/4e8a0eb4e773b808d9e9697af94319599777169a] +CVE: CVE-2023-36191 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + shell.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/shell.c b/shell.c +index 0200c0a..fa45d40 100644 +--- a/shell.c ++++ b/shell.c +@@ -23163,8 +23163,12 @@ int SQLITE_CDECL wmain(int argc, wchar_t **wargv){ + }else if( strcmp(z,"-bail")==0 ){ + bail_on_error = 1; + }else if( strcmp(z,"-nonce")==0 ){ +- free(data.zNonce); +- data.zNonce = strdup(argv[++i]); ++ if( data.zNonce ) free(data.zNonce); ++ if( i+1 < argc ) data.zNonce = strdup(argv[++i]); ++ else{ ++ data.zNonce = 0; ++ break; ++ } + }else if( strcmp(z,"-safe")==0 ){ + /* no-op - catch this on the second pass */ + } +-- +2.25.1 + diff --git a/meta/recipes-support/sqlite/files/CVE-2023-7104.patch b/meta/recipes-support/sqlite/files/CVE-2023-7104.patch new file mode 100644 index 0000000000..25c6ba017c --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2023-7104.patch @@ -0,0 +1,44 @@ +From 09f1652f36c5c4e8a6a640ce887f9ea0f48a7958 Mon Sep 17 00:00:00 2001 +From: dan <Dan Kennedy> +Date: Thu, 7 Sep 2023 13:53:09 +0000 +Subject: [PATCH] Fix a buffer overread in the sessions extension that could + occur when processing a corrupt changeset. + +Upstream-Status: Backport [https://sqlite.org/src/info/0e4e7a05c4204b47] +CVE: CVE-2022-46908 +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + sqlite3.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c +index 9f862f2465..0491549231 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -213482,15 +213482,19 @@ static int sessionReadRecord( + } + } + if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){ +- sqlite3_int64 v = sessionGetI64(aVal); +- if( eType==SQLITE_INTEGER ){ +- sqlite3VdbeMemSetInt64(apOut[i], v); ++ if( (pIn->nData-pIn->iNext)<8 ){ ++ rc = SQLITE_CORRUPT_BKPT; + }else{ +- double d; +- memcpy(&d, &v, 8); +- sqlite3VdbeMemSetDouble(apOut[i], d); ++ sqlite3_int64 v = sessionGetI64(aVal); ++ if( eType==SQLITE_INTEGER ){ ++ sqlite3VdbeMemSetInt64(apOut[i], v); ++ }else{ ++ double d; ++ memcpy(&d, &v, 8); ++ sqlite3VdbeMemSetDouble(apOut[i], d); ++ } ++ pIn->iNext += 8; + } +- pIn->iNext += 8; + } + } + } diff --git a/meta/recipes-support/sqlite/sqlite3_3.38.5.bb b/meta/recipes-support/sqlite/sqlite3_3.38.5.bb index 313c15dff4..cece207eae 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.38.5.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.38.5.bb @@ -6,6 +6,8 @@ LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed0 SRC_URI = "http://www.sqlite.org/2022/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://0001-sqlite-Increased-the-size-of-loop-variables-in-the-printf-implementation.patch \ file://CVE-2022-46908.patch \ + file://CVE-2023-36191.patch \ + file://CVE-2023-7104.patch \ " SRC_URI[sha256sum] = "5af07de982ba658fd91a03170c945f99c971f6955bc79df3266544373e39869c" diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 9bc6881fce..906aa53a16 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -10,8 +10,7 @@ DEPENDS = "ncurses gettext-native" RSUGGESTS:${PN} = "diffutils" LICENSE = "Vim" -LIC_FILES_CHKSUM = "file://LICENSE;md5=6b30ea4fa660c483b619924bc709ef99 \ - file://runtime/doc/uganda.txt;md5=001ef779f422a0e9106d428c84495b4d" +LIC_FILES_CHKSUM = "file://LICENSE;md5=d1a651ab770b45d41c0f8cb5a8ca930e" SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://disable_acl_header_check.patch \ @@ -20,20 +19,19 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://no-path-adjust.patch \ " -PV .= ".1211" -SRCREV = "f7d1c6e1884c76680980571f1cf15e0928d247b5" - -# Remove when 8.3 is out -UPSTREAM_VERSION_UNKNOWN = "1" +PV .= ".2190" +SRCREV = "6a950da86d7a6eb09d5ebeab17657986420d07ac" # Do not consider .z in x.y.z, as that is updated with every commit UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+)\.0" +# Ignore that the upstream version .z in x.y.z is always newer +UPSTREAM_VERSION_UNKNOWN = "1" S = "${WORKDIR}/git" VIMDIR = "vim${@d.getVar('PV').split('.')[0]}${@d.getVar('PV').split('.')[1]}" -inherit autotools-brokensep update-alternatives mime-xdg +inherit autotools-brokensep update-alternatives mime-xdg pkgconfig CLEANBROKEN = "1" @@ -42,22 +40,18 @@ do_configure () { cd src rm -f auto/* touch auto/config.mk + # git timestamps aren't reliable, so touch the shipped .po files so they aren't regenerated + touch -c po/cs.cp1250.po po/ja.euc-jp.po po/ja.sjis.po po/ko.po po/pl.UTF-8.po po/pl.cp1250.po po/ru.cp1251.po po/sk.cp1250.po po/uk.cp1251.po po/zh_CN.po po/zh_CN.cp936.po po/zh_TW.po + # ru.cp1251.po uses CP1251 rather than cp1251, fix that + sed -i -e s/CP1251/cp1251/ po/ru.cp1251.po aclocal autoconf cd .. oe_runconf touch src/auto/configure touch src/auto/config.mk src/auto/config.h -} - -do_compile() { - # We do not support fully / correctly the following locales. Attempting - # to use these with msgfmt in order to update the ".desktop" files exposes - # this problem and leads to the compile failing. - for LOCALE in cs fr ko pl sk zh_CN zh_TW;do - echo -n > src/po/${LOCALE}.po - done - autotools_do_compile + # need a native tool, not a target one + ${BUILD_CC} src/po/sjiscorr.c -o src/po/sjiscorr } PACKAGECONFIG ??= "\ @@ -82,6 +76,7 @@ EXTRA_OECONF = " \ --disable-netbeans \ --disable-desktop-database-update \ --with-tlib=ncurses \ + --with-modified-by='${MAINTAINER}' \ ac_cv_small_wchar_t=no \ ac_cv_path_GLIB_COMPILE_RESOURCES=no \ vim_cv_getcwd_broken=no \ diff --git a/scripts/combo-layer b/scripts/combo-layer index 7f2020fca7..19ad32660d 100755 --- a/scripts/combo-layer +++ b/scripts/combo-layer @@ -483,7 +483,7 @@ def check_repo_clean(repodir): exit if repo is dirty """ output=runcmd("git status --porcelain", repodir) - r = re.compile('\?\? patch-.*/') + r = re.compile(r'\?\? patch-.*/') dirtyout = [item for item in output.splitlines() if not r.match(item)] if dirtyout: logger.error("git repo %s is dirty, please fix it first", repodir) diff --git a/scripts/contrib/bbvars.py b/scripts/contrib/bbvars.py index 090133600b..a9cdf082ab 100755 --- a/scripts/contrib/bbvars.py +++ b/scripts/contrib/bbvars.py @@ -36,8 +36,8 @@ def bbvar_is_documented(var, documented_vars): def collect_documented_vars(docfiles): ''' Walk the docfiles and collect the documented variables ''' documented_vars = [] - prog = re.compile(".*($|[^A-Z_])<glossentry id=\'var-") - var_prog = re.compile('<glossentry id=\'var-(.*)\'>') + prog = re.compile(r".*($|[^A-Z_])<glossentry id=\'var-") + var_prog = re.compile(r'<glossentry id=\'var-(.*)\'>') for d in docfiles: with open(d) as f: documented_vars += var_prog.findall(f.read()) @@ -45,7 +45,7 @@ def collect_documented_vars(docfiles): return documented_vars def bbvar_doctag(var, docconf): - prog = re.compile('^%s\[doc\] *= *"(.*)"' % (var)) + prog = re.compile(r'^%s\[doc\] *= *"(.*)"' % (var)) if docconf == "": return "?" diff --git a/scripts/contrib/convert-overrides.py b/scripts/contrib/convert-overrides.py index 1939757f1b..c69acb4095 100755 --- a/scripts/contrib/convert-overrides.py +++ b/scripts/contrib/convert-overrides.py @@ -81,19 +81,19 @@ skip_ext = [".html", ".patch", ".m4", ".diff"] + args.skip_ext vars_re = {} for exp in vars: - vars_re[exp] = (re.compile('((^|[#\'"\s\-\+])[A-Za-z0-9_\-:${}\.]+)_' + exp), r"\1:" + exp) + vars_re[exp] = (re.compile(r'((^|[#\'"\s\-\+])[A-Za-z0-9_\-:${}\.]+)_' + exp), r"\1:" + exp) shortvars_re = {} for exp in shortvars: - shortvars_re[exp] = (re.compile('((^|[#\'"\s\-\+])[A-Za-z0-9_\-:${}\.]+)_' + exp + '([\(\'"\s:])'), r"\1:" + exp + r"\3") + shortvars_re[exp] = (re.compile(r'((^|[#\'"\s\-\+])[A-Za-z0-9_\-:${}\.]+)_' + exp + r'([\(\'"\s:])'), r"\1:" + exp + r"\3") package_re = {} for exp in packagevars: - package_re[exp] = (re.compile('(^|[#\'"\s\-\+]+)' + exp + '_' + '([$a-z"\'\s%\[<{\\\*].)'), r"\1" + exp + r":\2") + package_re[exp] = (re.compile(r'(^|[#\'"\s\-\+]+)' + exp + r'_' + r'([$a-z"\'\s%\[<{\\\*].)'), r"\1" + exp + r":\2") # Other substitutions to make subs = { - 'r = re.compile("([^:]+):\s*(.*)")' : 'r = re.compile("(^.+?):\s+(.*)")', + 'r = re.compile(r"([^:]+):\s*(.*)")' : 'r = re.compile(r"(^.+?):\s+(.*)")', "val = d.getVar('%s_%s' % (var, pkg))" : "val = d.getVar('%s:%s' % (var, pkg))", "f.write('%s_%s: %s\\n' % (var, pkg, encode(val)))" : "f.write('%s:%s: %s\\n' % (var, pkg, encode(val)))", "d.getVar('%s_%s' % (scriptlet_name, pkg))" : "d.getVar('%s:%s' % (scriptlet_name, pkg))", diff --git a/scripts/contrib/image-manifest b/scripts/contrib/image-manifest index 3c07a73a4e..4d65a99258 100755 --- a/scripts/contrib/image-manifest +++ b/scripts/contrib/image-manifest @@ -392,7 +392,7 @@ def export_manifest_info(args): for key in rd.getVarFlags('PACKAGECONFIG').keys(): if key == 'doc': continue - rvalues[pn]['packageconfig_opts'][key] = rd.getVarFlag('PACKAGECONFIG', key, True) + rvalues[pn]['packageconfig_opts'][key] = rd.getVarFlag('PACKAGECONFIG', key) if config['patches'] == 'yes': patches = oe.recipeutils.get_recipe_patches(rd) diff --git a/scripts/create-pull-request b/scripts/create-pull-request index 2f91a355b0..885105fab3 100755 --- a/scripts/create-pull-request +++ b/scripts/create-pull-request @@ -149,13 +149,10 @@ fi WEB_URL="" case "$REMOTE_URL" in *git.yoctoproject.org*) - WEB_URL="http://git.yoctoproject.org/cgit.cgi/$REMOTE_REPO/log/?h=$BRANCH" - ;; - *git.pokylinux.org*) - WEB_URL="http://git.pokylinux.org/cgit.cgi/$REMOTE_REPO/log/?h=$BRANCH" + WEB_URL="https://git.yoctoproject.org/$REMOTE_REPO/log/?h=$BRANCH" ;; *git.openembedded.org*) - WEB_URL="http://cgit.openembedded.org/$REMOTE_REPO/log/?h=$BRANCH" + WEB_URL="https://git.openembedded.org/$REMOTE_REPO/log/?h=$BRANCH" ;; *github.com*) WEB_URL="https://github.com/$REMOTE_REPO/tree/$BRANCH" diff --git a/scripts/lib/buildstats.py b/scripts/lib/buildstats.py index 3b76286ba5..6db60d5bcf 100644 --- a/scripts/lib/buildstats.py +++ b/scripts/lib/buildstats.py @@ -79,8 +79,8 @@ class BSTask(dict): return self['rusage']['ru_oublock'] @classmethod - def from_file(cls, buildstat_file): - """Read buildstat text file""" + def from_file(cls, buildstat_file, fallback_end=0): + """Read buildstat text file. fallback_end is an optional end time for tasks that are not recorded as finishing.""" bs_task = cls() log.debug("Reading task buildstats from %s", buildstat_file) end_time = None @@ -108,7 +108,10 @@ class BSTask(dict): bs_task[ru_type][ru_key] = val elif key == 'Status': bs_task['status'] = val - if end_time is not None and start_time is not None: + # If the task didn't finish, fill in the fallback end time if specified + if start_time and not end_time and fallback_end: + end_time = fallback_end + if start_time and end_time: bs_task['elapsed_time'] = end_time - start_time else: raise BSError("{} looks like a invalid buildstats file".format(buildstat_file)) @@ -226,15 +229,34 @@ class BuildStats(dict): epoch = match.group('epoch') return name, epoch, version, revision + @staticmethod + def parse_top_build_stats(path): + """ + Parse the top-level build_stats file for build-wide start and duration. + """ + start = elapsed = 0 + with open(path) as fobj: + for line in fobj.readlines(): + key, val = line.split(':', 1) + val = val.strip() + if key == 'Build Started': + start = float(val) + elif key == "Elapsed time": + elapsed = float(val.split()[0]) + return start, elapsed + @classmethod def from_dir(cls, path): """Load buildstats from a buildstats directory""" - if not os.path.isfile(os.path.join(path, 'build_stats')): + top_stats = os.path.join(path, 'build_stats') + if not os.path.isfile(top_stats): raise BSError("{} does not look like a buildstats directory".format(path)) log.debug("Reading buildstats directory %s", path) - buildstats = cls() + build_started, build_elapsed = buildstats.parse_top_build_stats(top_stats) + build_end = build_started + build_elapsed + subdirs = os.listdir(path) for dirname in subdirs: recipe_dir = os.path.join(path, dirname) @@ -244,7 +266,7 @@ class BuildStats(dict): bsrecipe = BSRecipe(name, epoch, version, revision) for task in os.listdir(recipe_dir): bsrecipe.tasks[task] = BSTask.from_file( - os.path.join(recipe_dir, task)) + os.path.join(recipe_dir, task), build_end) if name in buildstats: raise BSError("Cannot handle multiple versions of the same " "package ({})".format(name)) diff --git a/scripts/lib/checklayer/__init__.py b/scripts/lib/checklayer/__init__.py index 938805289e..53f99dce1e 100644 --- a/scripts/lib/checklayer/__init__.py +++ b/scripts/lib/checklayer/__init__.py @@ -324,8 +324,8 @@ def get_signatures(builddir, failsafe=False, machine=None, extravars=None): else: raise - sig_regex = re.compile("^(?P<task>.*:.*):(?P<hash>.*) .$") - tune_regex = re.compile("(^|\s)SIGGEN_LOCKEDSIGS_t-(?P<tune>\S*)\s*=\s*") + sig_regex = re.compile(r"^(?P<task>.*:.*):(?P<hash>.*) .$") + tune_regex = re.compile(r"(^|\s)SIGGEN_LOCKEDSIGS_t-(?P<tune>\S*)\s*=\s*") current_tune = None with open(sigs_file, 'r') as f: for line in f.readlines(): diff --git a/scripts/lib/devtool/menuconfig.py b/scripts/lib/devtool/menuconfig.py index 95384c5333..ff9227035d 100644 --- a/scripts/lib/devtool/menuconfig.py +++ b/scripts/lib/devtool/menuconfig.py @@ -43,7 +43,7 @@ def menuconfig(args, config, basepath, workspace): return 1 check_workspace_recipe(workspace, args.component) - pn = rd.getVar('PN', True) + pn = rd.getVar('PN') if not rd.getVarFlag('do_menuconfig','task'): raise DevtoolError("This recipe does not support menuconfig option") diff --git a/scripts/lib/devtool/standard.py b/scripts/lib/devtool/standard.py index e2a8335a62..7a005c9010 100644 --- a/scripts/lib/devtool/standard.py +++ b/scripts/lib/devtool/standard.py @@ -1628,7 +1628,7 @@ def _update_recipe_patch(recipename, workspace, srctree, rd, appendlayerdir, wil else: patchdir_params = {'patchdir': relpatchdir} - def srcuri_entry(fname): + def srcuri_entry(basepath): if patchdir_params: paramstr = ';' + ';'.join('%s=%s' % (k,v) for k,v in patchdir_params.items()) else: diff --git a/scripts/lib/devtool/upgrade.py b/scripts/lib/devtool/upgrade.py index 967d157077..6c4a62b558 100644 --- a/scripts/lib/devtool/upgrade.py +++ b/scripts/lib/devtool/upgrade.py @@ -125,11 +125,8 @@ def _write_append(rc, srctreebase, srctree, same_dir, no_same_dir, rev, copied, return af def _cleanup_on_error(rd, srctree): - rdp = os.path.split(rd)[0] # recipes folder if os.path.exists(rd): shutil.rmtree(rd) - if not len(os.listdir(rdp)): - os.rmdir(rdp) srctree = os.path.abspath(srctree) if os.path.exists(srctree): shutil.rmtree(srctree) diff --git a/scripts/lib/recipetool/create.py b/scripts/lib/recipetool/create.py index 220465ed2f..7b4c501456 100644 --- a/scripts/lib/recipetool/create.py +++ b/scripts/lib/recipetool/create.py @@ -745,6 +745,10 @@ def create_recipe(args): for handler in handlers: handler.process(srctree_use, classes, lines_before, lines_after, handled, extravalues) + # native and nativesdk classes are special and must be inherited last + # If present, put them at the end of the classes list + classes.sort(key=lambda c: c in ("native", "nativesdk")) + extrafiles = extravalues.pop('extrafiles', {}) extra_pn = extravalues.pop('PN', None) extra_pv = extravalues.pop('PV', None) @@ -1069,12 +1073,12 @@ def crunch_license(licfile): # Note: these are carefully constructed! license_title_re = re.compile(r'^#*\(? *(This is )?([Tt]he )?.{0,15} ?[Ll]icen[sc]e( \(.{1,10}\))?\)?[:\.]? ?#*$') license_statement_re = re.compile(r'^((This (project|software)|.{1,10}) is( free software)? (released|licen[sc]ed)|(Released|Licen[cs]ed)) under the .{1,10} [Ll]icen[sc]e:?$') - copyright_re = re.compile('^ *[#\*]* *(Modified work |MIT LICENSED )?Copyright ?(\([cC]\))? .*$') - disclaimer_re = re.compile('^ *\*? ?All [Rr]ights [Rr]eserved\.$') - email_re = re.compile('^.*<[\w\.-]*@[\w\.\-]*>$') - header_re = re.compile('^(\/\**!?)? ?[\-=\*]* ?(\*\/)?$') - tag_re = re.compile('^ *@?\(?([Ll]icense|MIT)\)?$') - url_re = re.compile('^ *[#\*]* *https?:\/\/[\w\.\/\-]+$') + copyright_re = re.compile(r'^ *[#\*]* *(Modified work |MIT LICENSED )?Copyright ?(\([cC]\))? .*$') + disclaimer_re = re.compile(r'^ *\*? ?All [Rr]ights [Rr]eserved\.$') + email_re = re.compile(r'^.*<[\w\.-]*@[\w\.\-]*>$') + header_re = re.compile(r'^(\/\**!?)? ?[\-=\*]* ?(\*\/)?$') + tag_re = re.compile(r'^ *@?\(?([Ll]icense|MIT)\)?$') + url_re = re.compile(r'^ *[#\*]* *https?:\/\/[\w\.\/\-]+$') crunched_md5sums = {} diff --git a/scripts/lib/recipetool/create_buildsys.py b/scripts/lib/recipetool/create_buildsys.py index 5015634476..bc4fb14a20 100644 --- a/scripts/lib/recipetool/create_buildsys.py +++ b/scripts/lib/recipetool/create_buildsys.py @@ -137,15 +137,15 @@ class CmakeRecipeHandler(RecipeHandler): deps = [] unmappedpkgs = [] - proj_re = re.compile('project\s*\(([^)]*)\)', re.IGNORECASE) - pkgcm_re = re.compile('pkg_check_modules\s*\(\s*[a-zA-Z0-9-_]+\s*(REQUIRED)?\s+([^)\s]+)\s*\)', re.IGNORECASE) - pkgsm_re = re.compile('pkg_search_module\s*\(\s*[a-zA-Z0-9-_]+\s*(REQUIRED)?((\s+[^)\s]+)+)\s*\)', re.IGNORECASE) - findpackage_re = re.compile('find_package\s*\(\s*([a-zA-Z0-9-_]+)\s*.*', re.IGNORECASE) - findlibrary_re = re.compile('find_library\s*\(\s*[a-zA-Z0-9-_]+\s*(NAMES\s+)?([a-zA-Z0-9-_ ]+)\s*.*') - checklib_re = re.compile('check_library_exists\s*\(\s*([^\s)]+)\s*.*', re.IGNORECASE) - include_re = re.compile('include\s*\(\s*([^)\s]*)\s*\)', re.IGNORECASE) - subdir_re = re.compile('add_subdirectory\s*\(\s*([^)\s]*)\s*([^)\s]*)\s*\)', re.IGNORECASE) - dep_re = re.compile('([^ ><=]+)( *[<>=]+ *[^ ><=]+)?') + proj_re = re.compile(r'project\s*\(([^)]*)\)', re.IGNORECASE) + pkgcm_re = re.compile(r'pkg_check_modules\s*\(\s*[a-zA-Z0-9-_]+\s*(REQUIRED)?\s+([^)\s]+)\s*\)', re.IGNORECASE) + pkgsm_re = re.compile(r'pkg_search_module\s*\(\s*[a-zA-Z0-9-_]+\s*(REQUIRED)?((\s+[^)\s]+)+)\s*\)', re.IGNORECASE) + findpackage_re = re.compile(r'find_package\s*\(\s*([a-zA-Z0-9-_]+)\s*.*', re.IGNORECASE) + findlibrary_re = re.compile(r'find_library\s*\(\s*[a-zA-Z0-9-_]+\s*(NAMES\s+)?([a-zA-Z0-9-_ ]+)\s*.*') + checklib_re = re.compile(r'check_library_exists\s*\(\s*([^\s)]+)\s*.*', re.IGNORECASE) + include_re = re.compile(r'include\s*\(\s*([^)\s]*)\s*\)', re.IGNORECASE) + subdir_re = re.compile(r'add_subdirectory\s*\(\s*([^)\s]*)\s*([^)\s]*)\s*\)', re.IGNORECASE) + dep_re = re.compile(r'([^ ><=]+)( *[<>=]+ *[^ ><=]+)?') def find_cmake_package(pkg): RecipeHandler.load_devel_filemap(tinfoil.config_data) @@ -423,16 +423,16 @@ class AutotoolsRecipeHandler(RecipeHandler): 'makeinfo': 'texinfo', } - pkg_re = re.compile('PKG_CHECK_MODULES\(\s*\[?[a-zA-Z0-9_]*\]?,\s*\[?([^,\]]*)\]?[),].*') - pkgce_re = re.compile('PKG_CHECK_EXISTS\(\s*\[?([^,\]]*)\]?[),].*') - lib_re = re.compile('AC_CHECK_LIB\(\s*\[?([^,\]]*)\]?,.*') - libx_re = re.compile('AX_CHECK_LIBRARY\(\s*\[?[^,\]]*\]?,\s*\[?([^,\]]*)\]?,\s*\[?([a-zA-Z0-9-]*)\]?,.*') - progs_re = re.compile('_PROGS?\(\s*\[?[a-zA-Z0-9_]*\]?,\s*\[?([^,\]]*)\]?[),].*') - dep_re = re.compile('([^ ><=]+)( [<>=]+ [^ ><=]+)?') - ac_init_re = re.compile('AC_INIT\(\s*([^,]+),\s*([^,]+)[,)].*') - am_init_re = re.compile('AM_INIT_AUTOMAKE\(\s*([^,]+),\s*([^,]+)[,)].*') - define_re = re.compile('\s*(m4_)?define\(\s*([^,]+),\s*([^,]+)\)') - version_re = re.compile('([0-9.]+)') + pkg_re = re.compile(r'PKG_CHECK_MODULES\(\s*\[?[a-zA-Z0-9_]*\]?,\s*\[?([^,\]]*)\]?[),].*') + pkgce_re = re.compile(r'PKG_CHECK_EXISTS\(\s*\[?([^,\]]*)\]?[),].*') + lib_re = re.compile(r'AC_CHECK_LIB\(\s*\[?([^,\]]*)\]?,.*') + libx_re = re.compile(r'AX_CHECK_LIBRARY\(\s*\[?[^,\]]*\]?,\s*\[?([^,\]]*)\]?,\s*\[?([a-zA-Z0-9-]*)\]?,.*') + progs_re = re.compile(r'_PROGS?\(\s*\[?[a-zA-Z0-9_]*\]?,\s*\[?([^,\]]*)\]?[),].*') + dep_re = re.compile(r'([^ ><=]+)( [<>=]+ [^ ><=]+)?') + ac_init_re = re.compile(r'AC_INIT\(\s*([^,]+),\s*([^,]+)[,)].*') + am_init_re = re.compile(r'AM_INIT_AUTOMAKE\(\s*([^,]+),\s*([^,]+)[,)].*') + define_re = re.compile(r'\s*(m4_)?define\(\s*([^,]+),\s*([^,]+)\)') + version_re = re.compile(r'([0-9.]+)') defines = {} def subst_defines(value): diff --git a/scripts/lib/recipetool/create_buildsys_python.py b/scripts/lib/recipetool/create_buildsys_python.py index 5686a62d3f..a7eed3256f 100644 --- a/scripts/lib/recipetool/create_buildsys_python.py +++ b/scripts/lib/recipetool/create_buildsys_python.py @@ -10,7 +10,7 @@ import codecs import collections import setuptools.command.build_py import email -import imp +import importlib import glob import itertools import logging @@ -561,7 +561,6 @@ class PythonRecipeHandler(RecipeHandler): return deps def parse_pkgdata_for_python_packages(self): - suffixes = [t[0] for t in imp.get_suffixes()] pkgdata_dir = tinfoil.config_data.getVar('PKGDATA_DIR') ldata = tinfoil.config_data.createCopy() @@ -585,7 +584,7 @@ class PythonRecipeHandler(RecipeHandler): continue for fn in files_info: - for suffix in suffixes: + for suffix in importlib.machinery.all_suffixes(): if fn.endswith(suffix): break else: diff --git a/scripts/lib/resulttool/report.py b/scripts/lib/resulttool/report.py index f0ca50ebe2..a349510ab8 100644 --- a/scripts/lib/resulttool/report.py +++ b/scripts/lib/resulttool/report.py @@ -176,7 +176,10 @@ class ResultsTextReport(object): vals['sort'] = line['testseries'] + "_" + line['result_id'] vals['failed_testcases'] = line['failed_testcases'] for k in cols: - vals[k] = "%d (%s%%)" % (line[k], format(line[k] / total_tested * 100, '.0f')) + if total_tested: + vals[k] = "%d (%s%%)" % (line[k], format(line[k] / total_tested * 100, '.0f')) + else: + vals[k] = "0 (0%)" for k in maxlen: if k in vals and len(vals[k]) > maxlen[k]: maxlen[k] = len(vals[k]) diff --git a/scripts/lib/resulttool/resultutils.py b/scripts/lib/resulttool/resultutils.py index 8917022d36..c5521d81bd 100644 --- a/scripts/lib/resulttool/resultutils.py +++ b/scripts/lib/resulttool/resultutils.py @@ -58,7 +58,11 @@ def append_resultsdata(results, f, configmap=store_map, configvars=extra_configv testseries = posixpath.basename(posixpath.dirname(url.path)) else: with open(f, "r") as filedata: - data = json.load(filedata) + try: + data = json.load(filedata) + except json.decoder.JSONDecodeError: + print("Cannot decode {}. Possible corruption. Skipping.".format(f)) + data = "" testseries = os.path.basename(os.path.dirname(f)) else: data = f @@ -142,7 +146,7 @@ def generic_get_log(sectionname, results, section): return decode_log(ptest['log']) def ptestresult_get_log(results, section): - return generic_get_log('ptestresuls.sections', results, section) + return generic_get_log('ptestresult.sections', results, section) def generic_get_rawlogs(sectname, results): if sectname not in results: diff --git a/scripts/lib/wic/misc.py b/scripts/lib/wic/misc.py index a8aab6c524..2b90821b30 100644 --- a/scripts/lib/wic/misc.py +++ b/scripts/lib/wic/misc.py @@ -36,6 +36,7 @@ NATIVE_RECIPES = {"bmaptool": "bmap-tools", "mkdosfs": "dosfstools", "mkisofs": "cdrtools", "mkfs.btrfs": "btrfs-tools", + "mkfs.erofs": "erofs-utils", "mkfs.ext2": "e2fsprogs", "mkfs.ext3": "e2fsprogs", "mkfs.ext4": "e2fsprogs", diff --git a/scripts/lib/wic/partition.py b/scripts/lib/wic/partition.py index 5563f4448a..5275da6ed3 100644 --- a/scripts/lib/wic/partition.py +++ b/scripts/lib/wic/partition.py @@ -132,6 +132,8 @@ class Partition(): self.update_fstab_in_rootfs = True if not self.source: + if self.fstype == "none" or self.no_table: + return if not self.size and not self.fixed_size: raise WicError("The %s partition has a size of zero. Please " "specify a non-zero --size/--fixed-size for that " @@ -404,6 +406,9 @@ class Partition(): (extraopts, self.fsuuid, rootfs, rootfs_dir) exec_native_cmd(erofs_cmd, native_sysroot, pseudo=pseudo) + def prepare_empty_partition_none(self, rootfs, oe_builddir, native_sysroot): + pass + def prepare_empty_partition_ext(self, rootfs, oe_builddir, native_sysroot): """ diff --git a/scripts/lib/wic/plugins/source/bootimg-efi.py b/scripts/lib/wic/plugins/source/bootimg-efi.py index a65a5b9780..a2b9f4c893 100644 --- a/scripts/lib/wic/plugins/source/bootimg-efi.py +++ b/scripts/lib/wic/plugins/source/bootimg-efi.py @@ -330,6 +330,8 @@ class BootimgEFIPlugin(SourcePlugin): # https://www.freedesktop.org/software/systemd/man/systemd-stub.html objcopy_cmd = "%s-objcopy" % target_sys + objcopy_cmd += " --enable-deterministic-archives" + objcopy_cmd += " --preserve-dates" objcopy_cmd += " --add-section .osrel=%s/usr/lib/os-release" % staging_dir_host objcopy_cmd += " --change-section-vma .osrel=0x20000" objcopy_cmd += " --add-section .cmdline=%s" % cmdline.name @@ -390,6 +392,13 @@ class BootimgEFIPlugin(SourcePlugin): logger.debug("Added %d extra blocks to %s to get to %d total blocks", extra_blocks, part.mountpoint, blocks) + # required for compatibility with certain devices expecting file system + # block count to be equal to partition block count + if blocks < part.fixed_size: + blocks = part.fixed_size + logger.debug("Overriding %s to %d total blocks for compatibility", + part.mountpoint, blocks) + # dosfs image, created by mkdosfs bootimg = "%s/boot.img" % cr_workdir diff --git a/scripts/oe-check-sstate b/scripts/oe-check-sstate index 4187e77458..0d171c4463 100755 --- a/scripts/oe-check-sstate +++ b/scripts/oe-check-sstate @@ -53,7 +53,7 @@ def check(args): cmd = ['bitbake', '--dry-run', '--runall=build'] + args.target output = subprocess.check_output(cmd, stderr=subprocess.STDOUT, env=env) - task_re = re.compile('NOTE: Running setscene task [0-9]+ of [0-9]+ \(([^)]+)\)') + task_re = re.compile(r'NOTE: Running setscene task [0-9]+ of [0-9]+ \(([^)]+)\)') tasks = [] for line in output.decode('utf-8').splitlines(): res = task_re.match(line) diff --git a/scripts/oe-depends-dot b/scripts/oe-depends-dot index 5eb3e12769..1c2d51c6ec 100755 --- a/scripts/oe-depends-dot +++ b/scripts/oe-depends-dot @@ -15,7 +15,7 @@ class Dot(object): def __init__(self): parser = argparse.ArgumentParser( description="Analyse recipe-depends.dot generated by bitbake -g", - epilog="Use %(prog)s --help to get help") + formatter_class=argparse.RawDescriptionHelpFormatter) parser.add_argument("dotfile", help = "Specify the dotfile", nargs = 1, action='store', default='') parser.add_argument("-k", "--key", @@ -32,6 +32,21 @@ class Dot(object): " For example, A->B, B->C, A->C, then A->C can be removed.", action="store_true", default=False) + parser.epilog = """ +Examples: +First generate the .dot file: + bitbake -g core-image-minimal + +To find out why a package is being built: + %(prog)s -k <package> -w ./task-depends.dot + +To find out what a package depends on: + %(prog)s -k <package> -d ./task-depends.dot + +Reduce the .dot file packages only, no tasks: + %(prog)s -r ./task-depends.dot +""" + self.args = parser.parse_args() if len(sys.argv) != 3 and len(sys.argv) < 5: @@ -99,6 +114,10 @@ class Dot(object): if key == "meta-world-pkgdata": continue dep = m.group(2) + key = key.split('.')[0] + dep = dep.split('.')[0] + if key == dep: + continue if key in depends: if not key in depends[key]: depends[key].add(dep) diff --git a/scripts/oe-pkgdata-util b/scripts/oe-pkgdata-util index 7412cc1f47..44ae40549a 100755 --- a/scripts/oe-pkgdata-util +++ b/scripts/oe-pkgdata-util @@ -296,7 +296,7 @@ def package_info(args): extra = '' for line in f: for var in vars: - m = re.match(var + '(?::\S+)?:\s*(.+?)\s*$', line) + m = re.match(var + r'(?::\S+)?:\s*(.+?)\s*$', line) if m: vals[var] = m.group(1) pkg_version = vals['PKGV'] or '' diff --git a/scripts/opkg-query-helper.py b/scripts/opkg-query-helper.py index bc3ab43823..084d9ef684 100755 --- a/scripts/opkg-query-helper.py +++ b/scripts/opkg-query-helper.py @@ -29,7 +29,7 @@ for arg in sys.argv[1:]: args.append(arg) # Regex for removing version specs after dependency items -verregex = re.compile(' \([=<>]* [^ )]*\)') +verregex = re.compile(r' \([=<>]* [^ )]*\)') pkg = "" ver = "" diff --git a/scripts/pybootchartgui/pybootchartgui/draw.py b/scripts/pybootchartgui/pybootchartgui/draw.py index fc708b55c3..ce3af74e2b 100644 --- a/scripts/pybootchartgui/pybootchartgui/draw.py +++ b/scripts/pybootchartgui/pybootchartgui/draw.py @@ -558,6 +558,11 @@ def render_processes_chart(ctx, options, trace, curr_y, w, h, sec_w): draw_rect(ctx, PROC_BORDER_COLOR, (x, y, w, proc_h)) draw_label_in_box(ctx, PROC_TEXT_COLOR, process, x, y + proc_h - 4, w, proc_h) + + # Show elapsed time for each task + elapsed_time = f"{trace.processes[process][1] - start}s" + draw_text(ctx, elapsed_time, PROC_TEXT_COLOR, x + w + 4, y + proc_h - 4) + y = y + proc_h return curr_y @@ -698,7 +703,7 @@ def draw_processes_recursively(ctx, proc, proc_tree, y, proc_h, rect, clip) : cmdString = proc.cmd else: cmdString = '' - if (OPTIONS.show_pid or OPTIONS.show_all) and ipid is not 0: + if (OPTIONS.show_pid or OPTIONS.show_all) and ipid != 0: cmdString = cmdString + " [" + str(ipid // 1000) + "]" if OPTIONS.show_all: if proc.args: @@ -796,7 +801,7 @@ class CumlSample: if self.color is None: i = self.next() % HSV_MAX_MOD h = 0.0 - if i is not 0: + if i != 0: h = (1.0 * i) / HSV_MAX_MOD s = 0.5 v = 1.0 diff --git a/scripts/pybootchartgui/pybootchartgui/parsing.py b/scripts/pybootchartgui/pybootchartgui/parsing.py index b42dac6b88..9d6787ec5a 100644 --- a/scripts/pybootchartgui/pybootchartgui/parsing.py +++ b/scripts/pybootchartgui/pybootchartgui/parsing.py @@ -128,7 +128,7 @@ class Trace: def compile(self, writer): def find_parent_id_for(pid): - if pid is 0: + if pid == 0: return 0 ppid = self.parent_map.get(pid) if ppid: diff --git a/scripts/rpm2cpio.sh b/scripts/rpm2cpio.sh index 7cd771bbe7..8199b43784 100755 --- a/scripts/rpm2cpio.sh +++ b/scripts/rpm2cpio.sh @@ -7,7 +7,7 @@ fatal() { } pkg="$1" -[ -n "$pkg" -a -e "$pkg" ] || +[ -n "$pkg" ] && [ -e "$pkg" ] || fatal "No package supplied" _dd() { @@ -16,14 +16,23 @@ _dd() { } calcsize() { + + case "$(_dd $1 bs=4 count=1 | tr -d '\0')" in + "$(printf '\216\255\350')"*) ;; # '\x8e\xad\xe8' + *) fatal "File doesn't look like rpm: $pkg" ;; + esac + offset=$(($1 + 8)) local i b b0 b1 b2 b3 b4 b5 b6 b7 i=0 while [ $i -lt 8 ]; do - b=$(_dd $(($offset + $i)) bs=1 count=1; echo X) - b=${b%X} + # add . to not loose \n + # strip \0 as it gets dropped with warning otherwise + b="$(_dd $(($offset + $i)) bs=1 count=1 | tr -d '\0' ; echo .)" + b=${b%.} # strip . again + [ -z "$b" ] && b="0" || b="$(exec printf '%u\n' "'$b")" @@ -35,7 +44,7 @@ calcsize() { offset=$(($offset + $rsize)) } -case "$(_dd 0 bs=8 count=1)" in +case "$(_dd 0 bs=4 count=1 | tr -d '\0')" in "$(printf '\355\253\356\333')"*) ;; # '\xed\xab\xee\xdb' *) fatal "File doesn't look like rpm: $pkg" ;; esac @@ -46,10 +55,11 @@ sigsize=$rsize calcsize $(($offset + (8 - ($sigsize % 8)) % 8)) hdrsize=$rsize -case "$(_dd $offset bs=3 count=1)" in - "$(printf '\102\132')"*) _dd $offset | bunzip2 ;; # '\x42\x5a' - "$(printf '\037\213')"*) _dd $offset | gunzip ;; # '\x1f\x8b' - "$(printf '\375\067')"*) _dd $offset | xzcat ;; # '\xfd\x37' - "$(printf '\135\000')"*) _dd $offset | unlzma ;; # '\x5d\x00' - *) fatal "Unrecognized rpm file: $pkg" ;; +case "$(_dd $offset bs=2 count=1 | tr -d '\0')" in + "$(printf '\102\132')") _dd $offset | bunzip2 ;; # '\x42\x5a' + "$(printf '\037\213')") _dd $offset | gunzip ;; # '\x1f\x8b' + "$(printf '\375\067')") _dd $offset | xzcat ;; # '\xfd\x37' + "$(printf '\135')") _dd $offset | unlzma ;; # '\x5d\x00' + "$(printf '\050\265')") _dd $offset | unzstd ;; # '\x28\xb5' + *) fatal "Unrecognized payload compression format in rpm file: $pkg" ;; esac diff --git a/scripts/runqemu b/scripts/runqemu index 0cce8bb96a..ba7c1b2461 100755 --- a/scripts/runqemu +++ b/scripts/runqemu @@ -82,6 +82,7 @@ of the following environment variables (in any order): kvm-vhost - enable KVM with vhost when running x86/x86_64 (VT-capable CPU required) publicvnc - enable a VNC server open to all hosts audio - enable audio + qmp=<path> - create a QMP socket (defaults to unix:qmp.sock if unspecified) [*/]ovmf* - OVMF firmware file or base name for booting with UEFI tcpserial=<port> - specify tcp serial port number qemuparams=<xyz> - specify custom parameters to QEMU @@ -211,11 +212,12 @@ class BaseConfig(object): self.mac_slirp = "52:54:00:12:35:" # pid of the actual qemu process self.qemu_environ = os.environ.copy() - self.qemupid = None + self.qemuprocess = None # avoid cleanup twice self.cleaned = False # Files to cleanup after run self.cleanup_files = [] + self.qmp = None def acquire_taplock(self, error=True): logger.debug("Acquiring lockfile %s..." % self.taplock) @@ -362,7 +364,7 @@ class BaseConfig(object): if p.endswith('.qemuboot.conf'): self.qemuboot = p self.qbconfload = True - elif re.search('\.bin$', p) or re.search('bzImage', p) or \ + elif re.search('\\.bin$', p) or re.search('bzImage', p) or \ re.search('zImage', p) or re.search('vmlinux', p) or \ re.search('fitImage', p) or re.search('uImage', p): self.kernel = p @@ -376,13 +378,13 @@ class BaseConfig(object): fst = t break if not fst: - m = re.search('.*\.(.*)$', self.rootfs) + m = re.search('.*\\.(.*)$', self.rootfs) if m: fst = m.group(1) if fst: self.check_arg_fstype(fst) - qb = re.sub('\.' + fst + "$", '', self.rootfs) - qb = '%s%s' % (re.sub('\.rootfs$', '', qb), '.qemuboot.conf') + qb = re.sub('\\.' + fst + "$", '', self.rootfs) + qb = '%s%s' % (re.sub('\\.rootfs$', '', qb), '.qemuboot.conf') if os.path.exists(qb): self.qemuboot = qb self.qbconfload = True @@ -447,30 +449,16 @@ class BaseConfig(object): self.set("MACHINE", arg) def set_dri_path(self): - # As runqemu can be run within bitbake (when using testimage, for example), - # we need to ensure that we run host pkg-config, and that it does not - # get mis-directed to native build paths set by bitbake. - env = os.environ.copy() - try: - del env['PKG_CONFIG_PATH'] - del env['PKG_CONFIG_DIR'] - del env['PKG_CONFIG_LIBDIR'] - del env['PKG_CONFIG_SYSROOT_DIR'] - except KeyError: - pass - try: - dripath = subprocess.check_output("PATH=/bin:/usr/bin:$PATH pkg-config --variable=dridriverdir dri", shell=True, env=env) - except subprocess.CalledProcessError as e: - raise RunQemuError("Could not determine the path to dri drivers on the host via pkg-config.\nPlease install Mesa development files (particularly, dri.pc) on the host machine.") - self.qemu_environ['LIBGL_DRIVERS_PATH'] = dripath.decode('utf-8').strip() - - # This preloads uninative libc pieces and therefore ensures that RPATH/RUNPATH - # in host mesa drivers doesn't trick uninative into loading host libc. - preload_items = ['libdl.so.2', 'librt.so.1', 'libpthread.so.0'] - uninative_path = os.path.dirname(self.get("UNINATIVE_LOADER")) - if os.path.exists(uninative_path): - preload_paths = [os.path.join(uninative_path, i) for i in preload_items] - self.qemu_environ['LD_PRELOAD'] = " ".join(preload_paths) + drivers_path = os.path.join(self.bindir_native, '../lib/dri') + if not os.path.exists(drivers_path) or not os.listdir(drivers_path): + raise RunQemuError(""" +qemu has been built without opengl support and accelerated graphics support is not available. +To enable it, add: +DISTRO_FEATURES_NATIVE:append = " opengl" +DISTRO_FEATURES_NATIVESDK:append = " opengl" +to your build configuration. +""") + self.qemu_environ['LIBGL_DRIVERS_PATH'] = drivers_path def check_args(self): for debug in ("-d", "--debug"): @@ -526,6 +514,10 @@ class BaseConfig(object): elif arg == 'publicvnc': self.publicvnc = True self.qemu_opt_script += ' -vnc :0' + elif arg == "qmp": + self.qmp = "unix:qmp.sock" + elif arg.startswith("qmp="): + self.qmp = arg[len('qmp='):] elif arg.startswith('tcpserial='): self.tcpserial_portnum = '%s' % arg[len('tcpserial='):] elif arg.startswith('qemuparams='): @@ -1001,17 +993,14 @@ class BaseConfig(object): else: self.nfs_server = '192.168.7.1' - # Figure out a new nfs_instance to allow multiple qemus running. - ps = subprocess.check_output(("ps", "auxww")).decode('utf-8') - pattern = '/bin/unfsd .* -i .*\.pid -e .*/exports([0-9]+) ' - all_instances = re.findall(pattern, ps, re.M) - if all_instances: - all_instances.sort(key=int) - self.nfs_instance = int(all_instances.pop()) + 1 - - nfsd_port = 3049 + 2 * self.nfs_instance - mountd_port = 3048 + 2 * self.nfs_instance + nfsd_port = 3048 + self.nfs_instance + lockdir = "/tmp/qemu-port-locks" + self.make_lock_dir(lockdir) + while not self.check_free_port('localhost', nfsd_port, lockdir): + self.nfs_instance += 1 + nfsd_port += 1 + mountd_port = nfsd_port # Export vars for runqemu-export-rootfs export_dict = { 'NFS_INSTANCE': self.nfs_instance, @@ -1062,6 +1051,17 @@ class BaseConfig(object): self.set('NETWORK_CMD', '-netdev bridge,br=%s,id=net0,helper=%s -device virtio-net-pci,netdev=net0 ' % ( self.net_bridge, os.path.join(self.bindir_native, 'qemu-oe-bridge-helper'))) + def make_lock_dir(self, lockdir): + if not os.path.exists(lockdir): + # There might be a race issue when multi runqemu processess are + # running at the same time. + try: + os.mkdir(lockdir) + os.chmod(lockdir, 0o777) + except FileExistsError: + pass + return + def setup_slirp(self): """Setup user networking""" @@ -1080,14 +1080,7 @@ class BaseConfig(object): mac = 2 lockdir = "/tmp/qemu-port-locks" - if not os.path.exists(lockdir): - # There might be a race issue when multi runqemu processess are - # running at the same time. - try: - os.mkdir(lockdir) - os.chmod(lockdir, 0o777) - except FileExistsError: - pass + self.make_lock_dir(lockdir) # Find a free port to avoid conflicts for p in ports[:]: @@ -1127,14 +1120,7 @@ class BaseConfig(object): logger.error("ip: %s" % ip) raise OEPathError("runqemu-ifup, runqemu-ifdown or ip not found") - if not os.path.exists(lockdir): - # There might be a race issue when multi runqemu processess are - # running at the same time. - try: - os.mkdir(lockdir) - os.chmod(lockdir, 0o777) - except FileExistsError: - pass + self.make_lock_dir(lockdir) cmd = (ip, 'link') logger.debug('Running %s...' % str(cmd)) @@ -1352,6 +1338,10 @@ class BaseConfig(object): raise RunQemuError("Failed to boot, QB_SYSTEM_NAME is NULL!") self.qemu_system = qemu_system + def setup_qmp(self): + if self.qmp: + self.qemu_opt += " -qmp %s,server,nowait" % self.qmp + def setup_vga(self): if self.nographic == True: if self.sdl == True: @@ -1482,6 +1472,7 @@ class BaseConfig(object): if self.snapshot: self.qemu_opt += " -snapshot" + self.setup_qmp() self.setup_serial() self.setup_vga() @@ -1512,7 +1503,7 @@ class BaseConfig(object): for descriptor in self.portlocks.values(): pass_fds.append(descriptor.fileno()) process = subprocess.Popen(cmds, stderr=subprocess.PIPE, pass_fds=pass_fds, env=self.qemu_environ) - self.qemupid = process.pid + self.qemuprocess = process retcode = process.wait() if retcode: if retcode == -signal.SIGTERM: @@ -1528,6 +1519,15 @@ class BaseConfig(object): signal.signal(signal.SIGTERM, signal.SIG_IGN) logger.info("Cleaning up") + + if self.qemuprocess: + try: + # give it some time to shut down, ignore return values and output + self.qemuprocess.send_signal(signal.SIGTERM) + self.qemuprocess.communicate(timeout=5) + except subprocess.TimeoutExpired: + self.qemuprocess.kill() + with open('/proc/uptime', 'r') as f: uptime_seconds = f.readline().split()[0] logger.info('Host uptime: %s\n' % uptime_seconds) @@ -1536,13 +1536,13 @@ class BaseConfig(object): logger.debug('Running %s' % str(cmd)) subprocess.check_call(cmd) self.release_taplock() - self.release_portlock() if self.nfs_running: logger.info("Shutting down the userspace NFS server...") cmd = ("runqemu-export-rootfs", "stop", self.rootfs) logger.debug('Running %s' % str(cmd)) subprocess.check_call(cmd) + self.release_portlock() if self.saved_stty: subprocess.check_call(("stty", self.saved_stty)) @@ -1555,6 +1555,9 @@ class BaseConfig(object): else: shutil.rmtree(ent) + # Deliberately ignore the return code of 'tput smam'. + subprocess.call(["tput", "smam"]) + self.cleaned = True def run_bitbake_env(self, mach=None): @@ -1631,12 +1634,8 @@ def main(): subprocess.check_call([renice, str(os.getpid())]) def sigterm_handler(signum, frame): - logger.info("SIGTERM received") - if config.qemupid: - os.kill(config.qemupid, signal.SIGTERM) + logger.info("Received signal: %s" % (signum)) config.cleanup() - # Deliberately ignore the return code of 'tput smam'. - subprocess.call(["tput", "smam"]) signal.signal(signal.SIGTERM, sigterm_handler) config.check_args() @@ -1658,8 +1657,6 @@ def main(): return 1 finally: config.cleanup() - # Deliberately ignore the return code of 'tput smam'. - subprocess.call(["tput", "smam"]) if __name__ == "__main__": sys.exit(main()) |