| 1 |
commit: edc966cf52bcb20f6141cc4ca3a20e98d4440069 |
| 2 |
Author: Alon Bar-Lev <alonbl <AT> gentoo <DOT> org> |
| 3 |
AuthorDate: Mon Jun 5 17:14:51 2017 +0000 |
| 4 |
Commit: Alon Bar-Lev <alonbl <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Mon Jun 5 17:29:16 2017 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=edc966cf |
| 7 |
|
| 8 |
dev-libs/crypto++: fix CVE-2017-9434 |
| 9 |
|
| 10 |
Bug: 620926 |
| 11 |
|
| 12 |
Package-Manager: Portage-2.3.5, Repoman-2.3.1 |
| 13 |
|
| 14 |
dev-libs/crypto++/crypto++-5.6.5-r1.ebuild | 60 ++++++++++++++++++++++ |
| 15 |
.../files/crypto++-5.6.5-CVE-2017-9434.patch | 45 ++++++++++++++++ |
| 16 |
2 files changed, 105 insertions(+) |
| 17 |
|
| 18 |
diff --git a/dev-libs/crypto++/crypto++-5.6.5-r1.ebuild b/dev-libs/crypto++/crypto++-5.6.5-r1.ebuild |
| 19 |
new file mode 100644 |
| 20 |
index 00000000000..47aa6d36e78 |
| 21 |
--- /dev/null |
| 22 |
+++ b/dev-libs/crypto++/crypto++-5.6.5-r1.ebuild |
| 23 |
@@ -0,0 +1,60 @@ |
| 24 |
+# Copyright 1999-2017 Gentoo Foundation |
| 25 |
+# Distributed under the terms of the GNU General Public License v2 |
| 26 |
+ |
| 27 |
+EAPI=6 |
| 28 |
+ |
| 29 |
+inherit flag-o-matic toolchain-funcs |
| 30 |
+ |
| 31 |
+DESCRIPTION="C++ class library of cryptographic schemes" |
| 32 |
+HOMEPAGE="http://cryptopp.com" |
| 33 |
+SRC_URI="https://www.cryptopp.com/cryptopp${PV//.}.zip" |
| 34 |
+ |
| 35 |
+LICENSE="Boost-1.0" |
| 36 |
+SLOT="0/5.6" # subslot is so version |
| 37 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86 ~x64-macos" |
| 38 |
+IUSE="static-libs" |
| 39 |
+ |
| 40 |
+DEPEND="app-arch/unzip" |
| 41 |
+ |
| 42 |
+S="${WORKDIR}" |
| 43 |
+ |
| 44 |
+PATCHES=( |
| 45 |
+ "${FILESDIR}/${PN}-5.6.4-nonative.patch" |
| 46 |
+ "${FILESDIR}/${P}-CVE-2017-9434.patch" |
| 47 |
+) |
| 48 |
+ |
| 49 |
+pkg_setup() { |
| 50 |
+ export CXX="$(tc-getCXX)" |
| 51 |
+ export LIBDIR="${EPREFIX}/usr/$(get_libdir)" |
| 52 |
+ export PREFIX="${EPREFIX}/usr" |
| 53 |
+} |
| 54 |
+ |
| 55 |
+src_compile() { |
| 56 |
+ # higher optimizations cause problems |
| 57 |
+ replace-flags -O3 -O2 |
| 58 |
+ # ASM isn't Darwin/Mach-O ready, #479554, buildsys doesn't grok CPPFLAGS |
| 59 |
+ [[ ${CHOST} == *-darwin* ]] && append-cxxflags -DCRYPTOPP_DISABLE_ASM |
| 60 |
+ |
| 61 |
+ emake -f GNUmakefile all shared |
| 62 |
+} |
| 63 |
+ |
| 64 |
+src_install() { |
| 65 |
+ default |
| 66 |
+ |
| 67 |
+ # remove leftovers as build system sucks |
| 68 |
+ rm -fr "${ED}"/usr/bin "${ED}"/usr/share/cryptopp |
| 69 |
+ use static-libs || rm -f "${ED}${EPREFIX}"/usr/$(get_libdir)/*.a |
| 70 |
+ |
| 71 |
+ # compatibility |
| 72 |
+ dosym cryptopp "${EPREFIX}"/usr/include/crypto++ |
| 73 |
+ for f in "${ED}${EPREFIX}"/usr/$(get_libdir)/*; do |
| 74 |
+ ln -s "$(basename "${f}")" "$(echo "${f}" | sed 's/cryptopp/crypto++/')" || die |
| 75 |
+ done |
| 76 |
+} |
| 77 |
+ |
| 78 |
+pkg_preinst() { |
| 79 |
+ # we switched directory to symlink |
| 80 |
+ # make sure portage digests that |
| 81 |
+ rm -fr "${EROOT}/usr/include/crypto++" |
| 82 |
+ rm -fr "${EROOT}/usr/include/cryptopp" |
| 83 |
+} |
| 84 |
|
| 85 |
diff --git a/dev-libs/crypto++/files/crypto++-5.6.5-CVE-2017-9434.patch b/dev-libs/crypto++/files/crypto++-5.6.5-CVE-2017-9434.patch |
| 86 |
new file mode 100644 |
| 87 |
index 00000000000..428f48901a3 |
| 88 |
--- /dev/null |
| 89 |
+++ b/dev-libs/crypto++/files/crypto++-5.6.5-CVE-2017-9434.patch |
| 90 |
@@ -0,0 +1,45 @@ |
| 91 |
+From 07dbcc3d9644b18e05c1776db2a57fe04d780965 Mon Sep 17 00:00:00 2001 |
| 92 |
+From: Jeffrey Walton <noloader@×××××.com> |
| 93 |
+Date: Wed, 10 May 2017 18:17:12 -0400 |
| 94 |
+Subject: [PATCH] Add Inflator::BadDistanceErr exception (Issue 414) The |
| 95 |
+ improved validation and excpetion clears the Address Sanitizer and Undefined |
| 96 |
+ Behavior Sanitizer findings |
| 97 |
+ |
| 98 |
+--- |
| 99 |
+ zinflate.cpp | 8 +++++++- |
| 100 |
+ zinflate.h | 4 ++++ |
| 101 |
+ 3 files changed, 14 insertions(+), 4 deletions(-) |
| 102 |
+ |
| 103 |
+diff --git a/zinflate.cpp b/zinflate.cpp |
| 104 |
+index 664efe6..fbd7505 100644 |
| 105 |
+--- a/zinflate.cpp |
| 106 |
++++ b/zinflate.cpp |
| 107 |
+@@ -550,12 +550,16 @@ bool Inflator::DecodeBody() |
| 108 |
+ break; |
| 109 |
+ } |
| 110 |
+ case DISTANCE_BITS: |
| 111 |
++ if (m_distance >= COUNTOF(distanceExtraBits)) |
| 112 |
++ throw BadDistanceErr(); |
| 113 |
+ bits = distanceExtraBits[m_distance]; |
| 114 |
+ if (!m_reader.FillBuffer(bits)) |
| 115 |
+ { |
| 116 |
+ m_nextDecode = DISTANCE_BITS; |
| 117 |
+ break; |
| 118 |
+ } |
| 119 |
++ if (m_distance >= COUNTOF(distanceStarts)) |
| 120 |
++ throw BadDistanceErr(); |
| 121 |
+ m_distance = m_reader.GetBits(bits) + distanceStarts[m_distance]; |
| 122 |
+ OutputPast(m_literal, m_distance); |
| 123 |
+ } |
| 124 |
+diff --git a/zinflate.h b/zinflate.h |
| 125 |
+index e2fd237..c47d2f6 100644 |
| 126 |
+--- a/zinflate.h |
| 127 |
++++ b/zinflate.h |
| 128 |
+@@ -96,6 +96,7 @@ public: |
| 129 |
+ }; |
| 130 |
+ class UnexpectedEndErr : public Err {public: UnexpectedEndErr() : Err(INVALID_DATA_FORMAT, "Inflator: unexpected end of compressed block") {}}; |
| 131 |
+ class BadBlockErr : public Err {public: BadBlockErr() : Err(INVALID_DATA_FORMAT, "Inflator: error in compressed block") {}}; |
| 132 |
++ class BadDistanceErr : public Err {public: BadDistanceErr() : Err(INVALID_DATA_FORMAT, "Inflator: error in bit distance") {}}; |
| 133 |
+ |
| 134 |
+ //! \brief RFC 1951 Decompressor |
| 135 |
+ //! \param attachment the filter's attached transformation |
Archives