1 |
commit: 56b1a55f56872459376e4f24cdf272477844123c |
2 |
Author: Mart Raudsepp <leio <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sun Feb 16 13:03:12 2020 +0000 |
4 |
Commit: Mart Raudsepp <leio <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Feb 16 17:27:50 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=56b1a55f |
7 |
|
8 |
net-misc/vino: apply 3 security fixes and misc upstream fixes |
9 |
|
10 |
Adds patchset for a plethora of translation updates and a couple |
11 |
bug fixes pending in master without any releases for years. |
12 |
The security fixes are not found in upstream and are ported |
13 |
separately from libvncserver commits. |
14 |
|
15 |
Bug: https://bugs.gentoo.org/701836 |
16 |
Package-Manager: Portage-2.3.84, Repoman-2.3.20 |
17 |
Signed-off-by: Mart Raudsepp <leio <AT> gentoo.org> |
18 |
|
19 |
net-misc/vino/Manifest | 1 + |
20 |
net-misc/vino/files/CVE-2014-6053.patch | 31 +++++++++++++ |
21 |
net-misc/vino/files/CVE-2018-7225.patch | 64 +++++++++++++++++++++++++++ |
22 |
net-misc/vino/files/CVE-2019-15681.patch | 26 +++++++++++ |
23 |
net-misc/vino/vino-3.22.0-r2.ebuild | 76 ++++++++++++++++++++++++++++++++ |
24 |
5 files changed, 198 insertions(+) |
25 |
|
26 |
diff --git a/net-misc/vino/Manifest b/net-misc/vino/Manifest |
27 |
index 8ec11375c7e..56fb2cd63fb 100644 |
28 |
--- a/net-misc/vino/Manifest |
29 |
+++ b/net-misc/vino/Manifest |
30 |
@@ -1 +1,2 @@ |
31 |
+DIST vino-3.22.0-patchset.tar.xz 158480 BLAKE2B fb8b50abde8cb4728410302c1d3a57bc4d344a33ac0bd9f1265fd24eb142dcd52e870845b902c9b63e98134f87873ebf6abfcfcd1efadb72b0cc72b04f9bf4be SHA512 cf96f5dce96d5c060462698c9d8df6f6d94eb9d624cb689c1262830840ed8f3617485f2274832076c273625e92a89732f9c2ae99dbcbf495e5293cf88408064f |
32 |
DIST vino-3.22.0.tar.xz 768716 BLAKE2B 5c3f6df059f129009bbc97527d1767bc8a29d8cbff5e6f9e89dabc4583ffdae2cf235eec66cbcb5f9e73c9a0a7c05a504e4e90221bf5adfc2ecbbbd518fdc84a SHA512 29b88e151b0b8c69bce1565ae3ec2e788f48c7645429984329fb2d3daaf03cc5ac100abbf70247bf0516c6d03a3b9aeb78d018c8f1bf35fd241919117fd1105f |
33 |
|
34 |
diff --git a/net-misc/vino/files/CVE-2014-6053.patch b/net-misc/vino/files/CVE-2014-6053.patch |
35 |
new file mode 100644 |
36 |
index 00000000000..8830c30f870 |
37 |
--- /dev/null |
38 |
+++ b/net-misc/vino/files/CVE-2014-6053.patch |
39 |
@@ -0,0 +1,31 @@ |
40 |
+From b1bfadcbfd88970c6d48672e2dbcca8713c91411 Mon Sep 17 00:00:00 2001 |
41 |
+From: Nicolas Ruff <nruff@××××××.com> |
42 |
+Date: Mon, 18 Aug 2014 15:16:16 +0200 |
43 |
+Subject: [PATCH 1/3] Check malloc() return value on client->server |
44 |
+ ClientCutText message. Client can send up to 2**32-1 bytes of text, and such |
45 |
+ a large allocation is likely to fail in case of high memory pressure. This |
46 |
+ would in a server crash (write at address 0). |
47 |
+ |
48 |
+--- |
49 |
+ server/libvncserver/rfbserver.c | 5 +++++ |
50 |
+ 1 file changed, 5 insertions(+) |
51 |
+ |
52 |
+diff --git a/server/libvncserver/rfbserver.c b/server/libvncserver/rfbserver.c |
53 |
+index a880b53..2615dc3 100644 |
54 |
+--- a/server/libvncserver/rfbserver.c |
55 |
++++ b/server/libvncserver/rfbserver.c |
56 |
+@@ -853,6 +853,11 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) |
57 |
+ msg.cct.length = Swap32IfLE(msg.cct.length); |
58 |
+ |
59 |
+ str = (char *)malloc(msg.cct.length); |
60 |
++ if (str == NULL) { |
61 |
++ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); |
62 |
++ rfbCloseClient(cl); |
63 |
++ return; |
64 |
++ } |
65 |
+ |
66 |
+ if ((n = ReadExact(cl, str, msg.cct.length)) <= 0) { |
67 |
+ if (n != 0) |
68 |
+-- |
69 |
+2.20.1 |
70 |
+ |
71 |
|
72 |
diff --git a/net-misc/vino/files/CVE-2018-7225.patch b/net-misc/vino/files/CVE-2018-7225.patch |
73 |
new file mode 100644 |
74 |
index 00000000000..1b1186b4fe7 |
75 |
--- /dev/null |
76 |
+++ b/net-misc/vino/files/CVE-2018-7225.patch |
77 |
@@ -0,0 +1,64 @@ |
78 |
+From d8a663541ef358a13fed2fbb39e7d323454369dc Mon Sep 17 00:00:00 2001 |
79 |
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@××××××.com> |
80 |
+Date: Mon, 26 Feb 2018 13:48:00 +0100 |
81 |
+Subject: [PATCH 2/3] Limit client cut text length to 1 MB |
82 |
+ |
83 |
+This patch constrains a client cut text length to 1 MB. Otherwise |
84 |
+a client could make server allocate 2 GB of memory and that seems to |
85 |
+be to much to classify it as a denial of service. |
86 |
+ |
87 |
+The limit also prevents from an integer overflow followed by copying |
88 |
+an uninitilized memory when processing msg.cct.length value larger |
89 |
+than SIZE_MAX or INT_MAX - sz_rfbClientCutTextMsg. |
90 |
+ |
91 |
+This patch also corrects accepting length value of zero (malloc(0) is |
92 |
+interpreted on differnet systems differently). |
93 |
+ |
94 |
+CVE-2018-7225 |
95 |
+<https://github.com/LibVNC/libvncserver/issues/218> |
96 |
+--- |
97 |
+ server/libvncserver/rfbserver.c | 21 ++++++++++++++++++++- |
98 |
+ 1 file changed, 20 insertions(+), 1 deletion(-) |
99 |
+ |
100 |
+diff --git a/server/libvncserver/rfbserver.c b/server/libvncserver/rfbserver.c |
101 |
+index 2615dc3..2224edb 100644 |
102 |
+--- a/server/libvncserver/rfbserver.c |
103 |
++++ b/server/libvncserver/rfbserver.c |
104 |
+@@ -59,6 +59,9 @@ |
105 |
+ #define DEBUGPROTO(x) |
106 |
+ #endif |
107 |
+ |
108 |
++/* PRIu32 */ |
109 |
++#include <inttypes.h> |
110 |
++ |
111 |
+ rfbClientPtr pointerClient = NULL; /* Mutex for pointer events */ |
112 |
+ |
113 |
+ static void rfbProcessClientProtocolVersion(rfbClientPtr cl); |
114 |
+@@ -852,7 +855,23 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) |
115 |
+ |
116 |
+ msg.cct.length = Swap32IfLE(msg.cct.length); |
117 |
+ |
118 |
+- str = (char *)malloc(msg.cct.length); |
119 |
++ /* uint32_t input is passed to malloc()'s size_t argument, |
120 |
++ * to rfbReadExact()'s int argument, to rfbStatRecordMessageRcvd()'s int |
121 |
++ * argument increased of sz_rfbClientCutTextMsg, and to setXCutText()'s int |
122 |
++ * argument. Here we impose a limit of 1 MB so that the value fits |
123 |
++ * into all of the types to prevent from misinterpretation and thus |
124 |
++ * from accessing uninitialized memory (CVE-2018-7225) and also to |
125 |
++ * prevent from a denial-of-service by allocating to much memory in |
126 |
++ * the server. */ |
127 |
++ if (msg.cct.length > 1<<20) { |
128 |
++ rfbLog("rfbClientCutText: too big cut text length requested: %" PRIu32 "\n", |
129 |
++ msg.cct.length); |
130 |
++ rfbCloseClient(cl); |
131 |
++ return; |
132 |
++ } |
133 |
++ |
134 |
++ /* Allow zero-length client cut text. */ |
135 |
++ str = (char *)calloc(msg.cct.length ? msg.cct.length : 1, 1); |
136 |
+ if (str == NULL) { |
137 |
+ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); |
138 |
+ rfbCloseClient(cl); |
139 |
+-- |
140 |
+2.20.1 |
141 |
+ |
142 |
|
143 |
diff --git a/net-misc/vino/files/CVE-2019-15681.patch b/net-misc/vino/files/CVE-2019-15681.patch |
144 |
new file mode 100644 |
145 |
index 00000000000..31bb47ee9b2 |
146 |
--- /dev/null |
147 |
+++ b/net-misc/vino/files/CVE-2019-15681.patch |
148 |
@@ -0,0 +1,26 @@ |
149 |
+From d9f3fa0ede556c6a751a8ca6c8bc37e769715233 Mon Sep 17 00:00:00 2001 |
150 |
+From: Christian Beier <dontmind@×××××××××.org> |
151 |
+Date: Mon, 19 Aug 2019 22:32:25 +0200 |
152 |
+Subject: [PATCH 3/3] rfbserver: don't leak stack memory to the remote |
153 |
+ |
154 |
+Thanks go to Pavel Cheremushkin of Kaspersky for reporting. |
155 |
+--- |
156 |
+ server/libvncserver/rfbserver.c | 2 ++ |
157 |
+ 1 file changed, 2 insertions(+) |
158 |
+ |
159 |
+diff --git a/server/libvncserver/rfbserver.c b/server/libvncserver/rfbserver.c |
160 |
+index 2224edb..ca4f59b 100644 |
161 |
+--- a/server/libvncserver/rfbserver.c |
162 |
++++ b/server/libvncserver/rfbserver.c |
163 |
+@@ -1565,6 +1565,8 @@ rfbSendServerCutText(rfbScreenInfoPtr rfbScreen,char *str, int len) |
164 |
+ rfbServerCutTextMsg sct; |
165 |
+ rfbClientIteratorPtr iterator; |
166 |
+ |
167 |
++ memset((char *)&sct, 0, sizeof(sct)); |
168 |
++ |
169 |
+ iterator = rfbGetClientIterator(rfbScreen); |
170 |
+ while ((cl = rfbClientIteratorNext(iterator)) != NULL) { |
171 |
+ /* Client is not authenticated, ignore. See GNOME bug 678434. */ |
172 |
+-- |
173 |
+2.20.1 |
174 |
+ |
175 |
|
176 |
diff --git a/net-misc/vino/vino-3.22.0-r2.ebuild b/net-misc/vino/vino-3.22.0-r2.ebuild |
177 |
new file mode 100644 |
178 |
index 00000000000..bb0874d055d |
179 |
--- /dev/null |
180 |
+++ b/net-misc/vino/vino-3.22.0-r2.ebuild |
181 |
@@ -0,0 +1,76 @@ |
182 |
+# Copyright 1999-2020 Gentoo Authors |
183 |
+# Distributed under the terms of the GNU General Public License v2 |
184 |
+ |
185 |
+EAPI=6 |
186 |
+GNOME2_EAUTORECONF="yes" |
187 |
+inherit gnome2 systemd |
188 |
+ |
189 |
+DESCRIPTION="An integrated VNC server for GNOME" |
190 |
+HOMEPAGE="https://wiki.gnome.org/Projects/Vino" |
191 |
+SRC_URI+=" https://dev.gentoo.org/~leio/distfiles/${P}-patchset.tar.xz" |
192 |
+ |
193 |
+LICENSE="GPL-2+" |
194 |
+SLOT="0" |
195 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86" |
196 |
+IUSE="crypt debug gnome-keyring ipv6 jpeg ssl systemd +telepathy zeroconf +zlib" |
197 |
+# bug #394611; tight encoding requires zlib encoding |
198 |
+REQUIRED_USE="jpeg? ( zlib )" |
199 |
+ |
200 |
+# cairo used in vino-fb |
201 |
+# libSM and libICE used in eggsmclient-xsmp |
202 |
+RDEPEND=" |
203 |
+ >=dev-libs/glib-2.26:2 |
204 |
+ >=dev-libs/libgcrypt-1.1.90:0= |
205 |
+ >=x11-libs/gtk+-3:3 |
206 |
+ |
207 |
+ x11-libs/cairo:= |
208 |
+ x11-libs/libICE |
209 |
+ x11-libs/libSM |
210 |
+ x11-libs/libX11 |
211 |
+ x11-libs/libXdamage |
212 |
+ x11-libs/libXext |
213 |
+ x11-libs/libXfixes |
214 |
+ x11-libs/libXtst |
215 |
+ x11-libs/pango[X] |
216 |
+ |
217 |
+ >=x11-libs/libnotify-0.7.0:= |
218 |
+ |
219 |
+ crypt? ( >=dev-libs/libgcrypt-1.1.90:0= ) |
220 |
+ gnome-keyring? ( app-crypt/libsecret ) |
221 |
+ jpeg? ( virtual/jpeg:0= ) |
222 |
+ ssl? ( >=net-libs/gnutls-2.2.0:= ) |
223 |
+ systemd? ( sys-apps/dbus[user-session] ) |
224 |
+ telepathy? ( |
225 |
+ dev-libs/dbus-glib |
226 |
+ >=net-libs/telepathy-glib-0.18 ) |
227 |
+ zeroconf? ( >=net-dns/avahi-0.6:=[dbus] ) |
228 |
+ zlib? ( sys-libs/zlib:= ) |
229 |
+" |
230 |
+DEPEND="${RDEPEND} |
231 |
+ app-crypt/libsecret |
232 |
+ dev-util/glib-utils |
233 |
+ >=dev-util/intltool-0.50 |
234 |
+ virtual/pkgconfig |
235 |
+" |
236 |
+# libsecret is always required at build time per bug 322763 |
237 |
+ |
238 |
+PATCHES=( |
239 |
+ "${WORKDIR}"/patches/ # Patches from master branch at 2020-02-15 state; needs autoreconf |
240 |
+ "${FILESDIR}"/CVE-2014-6053.patch |
241 |
+ "${FILESDIR}"/CVE-2018-7225.patch |
242 |
+ "${FILESDIR}"/CVE-2019-15681.patch |
243 |
+) |
244 |
+ |
245 |
+src_configure() { |
246 |
+ gnome2_src_configure \ |
247 |
+ $(use_enable ipv6) \ |
248 |
+ $(use_with crypt gcrypt) \ |
249 |
+ $(usex debug --enable-debug=yes ' ') \ |
250 |
+ $(use_with gnome-keyring secret) \ |
251 |
+ $(use_with jpeg) \ |
252 |
+ $(use_with ssl gnutls) \ |
253 |
+ $(use_with telepathy) \ |
254 |
+ $(use_with zeroconf avahi) \ |
255 |
+ $(use_with zlib) \ |
256 |
+ --with-systemduserunitdir="$(systemd_get_userunitdir)" |
257 |
+} |