1 |
commit: c3cbbadd99e9e4cc8014b99d74fe76ab943bf0bb |
2 |
Author: Nils Freydank <holgersson <AT> posteo <DOT> de> |
3 |
AuthorDate: Fri Oct 27 15:56:06 2017 +0000 |
4 |
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Oct 27 15:57:38 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c3cbbadd |
7 |
|
8 |
sys-apps/pacman: Rev bump to fix CVE-2016-5434 (bug #585940) |
9 |
|
10 |
Closes: https://bugs.gentoo.org/633742 |
11 |
Closes: https://bugs.gentoo.org/631754 |
12 |
|
13 |
Package-Manager: Portage-2.3.11, Repoman-2.3.3 |
14 |
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> |
15 |
|
16 |
.../pacman/files/pacman-5.0.2-CVE-2016-5434.patch | 136 +++++++++++++++++++++ |
17 |
sys-apps/pacman/metadata.xml | 3 + |
18 |
sys-apps/pacman/pacman-5.0.2-r1.ebuild | 112 +++++++++++++++++ |
19 |
3 files changed, 251 insertions(+) |
20 |
|
21 |
diff --git a/sys-apps/pacman/files/pacman-5.0.2-CVE-2016-5434.patch b/sys-apps/pacman/files/pacman-5.0.2-CVE-2016-5434.patch |
22 |
new file mode 100644 |
23 |
index 00000000000..c245cb78dcb |
24 |
--- /dev/null |
25 |
+++ b/sys-apps/pacman/files/pacman-5.0.2-CVE-2016-5434.patch |
26 |
@@ -0,0 +1,136 @@ |
27 |
+From bf84fd00d3ac1ae2a43dac57f7ef689ef2e8b8aa Mon Sep 17 00:00:00 2001 |
28 |
+From: Nils Freydank <holgersson@××××××.de> |
29 |
+Date: Fri, 20 Oct 2017 22:30:33 +0200 |
30 |
+Subject: [PATCH] Fix CVE-2016-5434 (DoS/loop and out of boundary read) |
31 |
+ |
32 |
+This is a rewrite of Tobias Stoeckmann’s patch from June 2016[1] using |
33 |
+functions instead of macros. (Thanks to Tobias for explanations of his patch.) |
34 |
+A short question on Freenode IRC showed that macros are generally discouraged |
35 |
+and functions should be used. |
36 |
+ |
37 |
+The patch introduces a static size_t length_check() in libalpm/signing.c. |
38 |
+ |
39 |
+[1] Original patch: |
40 |
+https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html |
41 |
+CVE request (and assignment): |
42 |
+http://seclists.org/oss-sec/2016/q2/526 |
43 |
+--- |
44 |
+ This patch is provided to upstream, but not merged (2017-10-25). |
45 |
+ |
46 |
+ lib/libalpm/signing.c | 48 ++++++++++++++++++++++++++++++++++++++++++++---- |
47 |
+ 1 file changed, 44 insertions(+), 4 deletions(-) |
48 |
+ |
49 |
+diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c |
50 |
+index 95cb3280..51b11df6 100644 |
51 |
+--- a/lib/libalpm/signing.c |
52 |
++++ b/lib/libalpm/signing.c |
53 |
+@@ -986,6 +986,19 @@ int SYMEXPORT alpm_siglist_cleanup(alpm_siglist_t *siglist) |
54 |
+ return 0; |
55 |
+ } |
56 |
+ |
57 |
++/* Check to avoid out of boundary reads */ |
58 |
++static size_t length_check(size_t length, size_t position, size_t a, |
59 |
++ alpm_handle_t *handle, const char *identifier) |
60 |
++{ |
61 |
++ if( a == 0 || length - position <= a) { |
62 |
++ _alpm_log(handle, ALPM_LOG_ERROR, |
63 |
++ _("%s: signature format error"), identifier); |
64 |
++ return -1; |
65 |
++ } else { |
66 |
++ return 0; |
67 |
++ } |
68 |
++} |
69 |
++ |
70 |
+ /** |
71 |
+ * Extract the Issuer Key ID from a signature |
72 |
+ * @param sig PGP signature |
73 |
+@@ -1022,16 +1035,25 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, |
74 |
+ |
75 |
+ switch(sig[pos] & 0x03) { |
76 |
+ case 0: |
77 |
++ if(length_check(len, pos, 2, handle, identifier) != 0) { |
78 |
++ return -1; |
79 |
++ } |
80 |
+ blen = sig[pos + 1]; |
81 |
+ pos = pos + 2; |
82 |
+ break; |
83 |
+ |
84 |
+ case 1: |
85 |
++ if(length_check(len, pos, 3, handle, identifier)) { |
86 |
++ return -1; |
87 |
++ } |
88 |
+ blen = (sig[pos + 1] << 8) | sig[pos + 2]; |
89 |
+ pos = pos + 3; |
90 |
+ break; |
91 |
+ |
92 |
+ case 2: |
93 |
++ if(length_check(len, pos, 5, handle, identifier)) { |
94 |
++ return -1; |
95 |
++ } |
96 |
+ blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4]; |
97 |
+ pos = pos + 5; |
98 |
+ break; |
99 |
+@@ -1059,7 +1081,16 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, |
100 |
+ |
101 |
+ pos = pos + 4; |
102 |
+ |
103 |
++ /* pos got changed above, so an explicit check is necessary |
104 |
++ * check for 2 as that catches another some lines down */ |
105 |
++ if(length_check(len, pos, 2, handle, identifier)) { |
106 |
++ return -1; |
107 |
++ } |
108 |
+ hlen = (sig[pos] << 8) | sig[pos + 1]; |
109 |
++ |
110 |
++ if(length_check(len, pos, hlen + 2, handle, identifier)) { |
111 |
++ return -1; |
112 |
++ } |
113 |
+ pos = pos + hlen + 2; |
114 |
+ |
115 |
+ ulen = (sig[pos] << 8) | sig[pos + 1]; |
116 |
+@@ -1072,30 +1103,39 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, |
117 |
+ slen = sig[spos]; |
118 |
+ spos = spos + 1; |
119 |
+ } else if(sig[spos] < 255) { |
120 |
++ if(length_check(pos + ulen, spos, 2, handle, identifier)){ |
121 |
++ return -1; |
122 |
++ } |
123 |
+ slen = (sig[spos] << 8) | sig[spos + 1]; |
124 |
+ spos = spos + 2; |
125 |
+ } else { |
126 |
++ /* check for pos and spos, as spos is still pos */ |
127 |
++ if(length_check(len, pos, 5, handle, identifier)) { |
128 |
++ return -1; |
129 |
++ } |
130 |
+ slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4]; |
131 |
+ spos = spos + 5; |
132 |
+ } |
133 |
+- |
134 |
+ if(sig[spos] == 16) { |
135 |
+ /* issuer key ID */ |
136 |
+ char key[17]; |
137 |
+ size_t i; |
138 |
++ if(length_check(pos + ulen, spos, 8, handle, identifier)) { |
139 |
++ return -1; |
140 |
++ } |
141 |
+ for (i = 0; i < 8; i++) { |
142 |
+ sprintf(&key[i * 2], "%02X", sig[spos + i + 1]); |
143 |
+ } |
144 |
+ *keys = alpm_list_add(*keys, strdup(key)); |
145 |
+ break; |
146 |
+ } |
147 |
+- |
148 |
++ if(length_check(pos + ulen + 1, spos, slen, handle, identifier)) { |
149 |
++ return -1; |
150 |
++ } |
151 |
+ spos = spos + slen; |
152 |
+ } |
153 |
+- |
154 |
+ pos = pos + (blen - hlen - 8); |
155 |
+ } |
156 |
+- |
157 |
+ return 0; |
158 |
+ } |
159 |
+ |
160 |
+-- |
161 |
+2.14.2 |
162 |
+ |
163 |
|
164 |
diff --git a/sys-apps/pacman/metadata.xml b/sys-apps/pacman/metadata.xml |
165 |
index 24ba8965c72..2eb4eff00bb 100644 |
166 |
--- a/sys-apps/pacman/metadata.xml |
167 |
+++ b/sys-apps/pacman/metadata.xml |
168 |
@@ -14,6 +14,9 @@ |
169 |
<email>proxy-maint@g.o</email> |
170 |
<name>Proxy Maintainers</name> |
171 |
</maintainer> |
172 |
+ <slots> |
173 |
+ <subslots>Reflect major ABI of libalpm.so.</subslots> |
174 |
+ </slots> |
175 |
<use> |
176 |
<flag name="doc">Install extended documentation using <pkg>app-doc/doxygen</pkg>. (Man pages are included by default.)</flag> |
177 |
<flag name="gpg">Enable GPG signature verification using <pkg>app-crypt/gpgme</pkg></flag> |
178 |
|
179 |
diff --git a/sys-apps/pacman/pacman-5.0.2-r1.ebuild b/sys-apps/pacman/pacman-5.0.2-r1.ebuild |
180 |
new file mode 100644 |
181 |
index 00000000000..f60a609779c |
182 |
--- /dev/null |
183 |
+++ b/sys-apps/pacman/pacman-5.0.2-r1.ebuild |
184 |
@@ -0,0 +1,112 @@ |
185 |
+# Copyright 1999-2017 Gentoo Foundation |
186 |
+# Distributed under the terms of the GNU General Public License v2 |
187 |
+ |
188 |
+EAPI="6" |
189 |
+ |
190 |
+PYTHON_COMPAT=( python2_7 ) |
191 |
+ |
192 |
+inherit autotools |
193 |
+ |
194 |
+DESCRIPTION="Archlinux's binary package manager" |
195 |
+HOMEPAGE="https://archlinux.org/pacman/" |
196 |
+ |
197 |
+PATCHES=() |
198 |
+ |
199 |
+if [[ ${PV} == "9999" ]]; then |
200 |
+ inherit git-r3 |
201 |
+ EGIT_REPO_URI="https://git.archlinux.org/pacman.git" |
202 |
+else |
203 |
+ SRC_URI="https://sources.archlinux.org/other/pacman/${P}.tar.gz" |
204 |
+ # Do *not* re-add ~x86! |
205 |
+ # https://www.archlinux.org/news/phasing-out-i686-support/ |
206 |
+ KEYWORDS="~amd64" |
207 |
+ |
208 |
+ PATCHES+=( "${FILESDIR}"/${PN}-5.0.2-CVE-2016-5434.patch ) |
209 |
+fi |
210 |
+ |
211 |
+LICENSE="GPL-2" |
212 |
+SLOT="0/10" |
213 |
+ |
214 |
+IUSE="curl debug doc +gpg test" |
215 |
+COMMON_DEPEND="app-arch/libarchive:=[lzma] |
216 |
+ gpg? ( >=app-crypt/gpgme-1.4.0:= ) |
217 |
+ dev-libs/openssl:0= |
218 |
+ curl? ( net-misc/curl ) |
219 |
+ virtual/libiconv |
220 |
+ virtual/libintl" |
221 |
+RDEPEND="${COMMON_DEPEND}" |
222 |
+ |
223 |
+DEPEND="${COMMON_DEPEND} |
224 |
+ app-text/asciidoc |
225 |
+ doc? ( app-doc/doxygen ) |
226 |
+ test? ( sys-apps/fakeroot |
227 |
+ sys-apps/fakechroot )" |
228 |
+ |
229 |
+# workaround until tests are fixed/sorted out |
230 |
+RESTRICT="test" |
231 |
+ |
232 |
+src_prepare() { |
233 |
+ # Remove a line that adds "-Werror" in ./configure when |
234 |
+ # "--enable-debug" is passed: |
235 |
+ sed -i -e '/-Werror/d' configure.ac || die |
236 |
+ |
237 |
+ default |
238 |
+ eautoreconf |
239 |
+} |
240 |
+ |
241 |
+src_configure() { |
242 |
+ local myeconfargs=( |
243 |
+ --localstatedir=/var |
244 |
+ --disable-git-version |
245 |
+ --with-openssl |
246 |
+ # Help protect user from shooting his/her Gentoo installation |
247 |
+ # in its foot. |
248 |
+ --with-root-dir="${EPREFIX}/var/chroot/archlinux" |
249 |
+ $(use_enable debug) |
250 |
+ # full doc with doxygen |
251 |
+ $(use_enable doc doxygen) |
252 |
+ $(use_with curl libcurl) |
253 |
+ $(use_with gpg gpgme) |
254 |
+ ) |
255 |
+ econf "${myeconfargs[@]}" |
256 |
+} |
257 |
+ |
258 |
+src_compile() { |
259 |
+ default |
260 |
+ |
261 |
+ emake -C contrib |
262 |
+} |
263 |
+ |
264 |
+src_install() { |
265 |
+ dodir /etc/pacman.d/ |
266 |
+ # contributed parts, i.e. not pacman itself, but useful helpers and some templates and basic docs |
267 |
+ dobin "${S}"/contrib/{bacman,checkupdates,pac{cache,diff,list,log-pkglist,scripts,search},rankmirrors,updpkgsums} |
268 |
+ newdoc "${S}"/contrib/README contrib-README |
269 |
+ dodoc "${S}"/contrib/PKGBUILD.vim |
270 |
+ # create /var/chroot/archlinux |
271 |
+ # see bug #631754 |
272 |
+ dodir /var/chroot/archlinux |
273 |
+ |
274 |
+ default |
275 |
+ # avoid creating stuff inside /var/cache/ |
276 |
+ # see bug #633742 for more information |
277 |
+ rm -r "${D}"/var/cache/pacman |
278 |
+} |
279 |
+ |
280 |
+pkg_postinst() { |
281 |
+ einfo "" |
282 |
+ einfo "The default root dir was set to ${EPREFIX}/var/chroot/archlinux" |
283 |
+ einfo "to avoid breaking Gentoo systems due to oscitancy." |
284 |
+ einfo "If you prefer another directory, take a look at" |
285 |
+ einfo "pacman’s parameter -r|--root)." |
286 |
+ einfo "" |
287 |
+ einfo "You will need to setup at least one mirror in /etc/pacman.d/mirrorlist." |
288 |
+ einfo "Please generate it manually according to the Archlinux documentation:" |
289 |
+ einfo "https://wiki.archlinux.org/index.php/Mirror" |
290 |
+ einfo "" |
291 |
+ ewarn "Archlinux is dropping support for x86 (i686 called there) entirely" |
292 |
+ ewarn "in Nov 2017. Please keep this in mind when setting up new systems." |
293 |
+ ewarn "For more details see" |
294 |
+ ewarn "https://www.archlinux.org/news/phasing-out-i686-support" |
295 |
+ einfo "" |
296 |
+} |