1 |
commit: 2c5ef4bf3c0497dd26da1f97b48e3a4b2e11241e |
2 |
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
3 |
AuthorDate: Tue May 25 21:42:08 2021 +0000 |
4 |
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue May 25 21:42:19 2021 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2c5ef4bf |
7 |
|
8 |
dev-libs/libcroco: fix CVE-2020-12825 |
9 |
|
10 |
Bug: https://bugs.gentoo.org/722752 |
11 |
Package-Manager: Portage-3.0.18, Repoman-3.0.3 |
12 |
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> |
13 |
|
14 |
.../files/libcroco-0.6.13-CVE-2020-12825.patch | 187 +++++++++++++++++++++ |
15 |
dev-libs/libcroco/libcroco-0.6.13-r1.ebuild | 57 +++++++ |
16 |
2 files changed, 244 insertions(+) |
17 |
|
18 |
diff --git a/dev-libs/libcroco/files/libcroco-0.6.13-CVE-2020-12825.patch b/dev-libs/libcroco/files/libcroco-0.6.13-CVE-2020-12825.patch |
19 |
new file mode 100644 |
20 |
index 00000000000..26fc677eb16 |
21 |
--- /dev/null |
22 |
+++ b/dev-libs/libcroco/files/libcroco-0.6.13-CVE-2020-12825.patch |
23 |
@@ -0,0 +1,187 @@ |
24 |
+From 44cbd1e718d6a08e59b9300280c340218a84e089 Mon Sep 17 00:00:00 2001 |
25 |
+From: Michael Catanzaro <mcatanzaro@×××××.org> |
26 |
+Date: Wed, 12 Aug 2020 13:54:15 -0500 |
27 |
+Subject: [PATCH] libcroco: Limit recursion in block and any productions |
28 |
+ (CVE-2020-12825) |
29 |
+ |
30 |
+If we don't have any limits, we can recurse forever and overflow the |
31 |
+stack. |
32 |
+ |
33 |
+This is per https://gitlab.gnome.org/Archive/libcroco/-/issues/8 |
34 |
+ |
35 |
+https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404 |
36 |
+--- |
37 |
+ src/cr-parser.c | 44 ++++++++++++++++++++++++++-------------- |
38 |
+ 1 file changed, 29 insertions(+), 15 deletions(-) |
39 |
+ |
40 |
+diff --git a/src/cr-parser.c b/src/cr-parser.c |
41 |
+index 07f4ed9e8b..8304b75614 100644 |
42 |
+--- a/src/cr-parser.c |
43 |
++++ b/src/cr-parser.c |
44 |
+@@ -136,6 +136,8 @@ struct _CRParserPriv { |
45 |
+ |
46 |
+ #define CHARS_TAB_SIZE 12 |
47 |
+ |
48 |
++#define RECURSIVE_CALLERS_LIMIT 100 |
49 |
++ |
50 |
+ /** |
51 |
+ * IS_NUM: |
52 |
+ *@a_char: the char to test. |
53 |
+@@ -343,9 +345,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); |
54 |
+ |
55 |
+ static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); |
56 |
+ |
57 |
+-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); |
58 |
++static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, |
59 |
++ guint n_calls); |
60 |
+ |
61 |
+-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); |
62 |
++static enum CRStatus cr_parser_parse_block_core (CRParser * a_this, |
63 |
++ guint n_calls); |
64 |
+ |
65 |
+ static enum CRStatus cr_parser_parse_value_core (CRParser * a_this); |
66 |
+ |
67 |
+@@ -783,7 +787,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) |
68 |
+ cr_parser_try_to_skip_spaces_and_comments (a_this); |
69 |
+ |
70 |
+ do { |
71 |
+- status = cr_parser_parse_any_core (a_this); |
72 |
++ status = cr_parser_parse_any_core (a_this, 0); |
73 |
+ } while (status == CR_OK); |
74 |
+ |
75 |
+ status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, |
76 |
+@@ -794,7 +798,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) |
77 |
+ cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, |
78 |
+ token); |
79 |
+ token = NULL; |
80 |
+- status = cr_parser_parse_block_core (a_this); |
81 |
++ status = cr_parser_parse_block_core (a_this, 0); |
82 |
+ CHECK_PARSING_STATUS (status, |
83 |
+ FALSE); |
84 |
+ goto done; |
85 |
+@@ -929,11 +933,11 @@ cr_parser_parse_selector_core (CRParser * a_this) |
86 |
+ |
87 |
+ RECORD_INITIAL_POS (a_this, &init_pos); |
88 |
+ |
89 |
+- status = cr_parser_parse_any_core (a_this); |
90 |
++ status = cr_parser_parse_any_core (a_this, 0); |
91 |
+ CHECK_PARSING_STATUS (status, FALSE); |
92 |
+ |
93 |
+ do { |
94 |
+- status = cr_parser_parse_any_core (a_this); |
95 |
++ status = cr_parser_parse_any_core (a_this, 0); |
96 |
+ |
97 |
+ } while (status == CR_OK); |
98 |
+ |
99 |
+@@ -955,10 +959,12 @@ cr_parser_parse_selector_core (CRParser * a_this) |
100 |
+ *in chapter 4.1 of the css2 spec. |
101 |
+ *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*; |
102 |
+ *@param a_this the current instance of #CRParser. |
103 |
++ *@param n_calls used to limit recursion depth |
104 |
+ *FIXME: code this function. |
105 |
+ */ |
106 |
+ static enum CRStatus |
107 |
+-cr_parser_parse_block_core (CRParser * a_this) |
108 |
++cr_parser_parse_block_core (CRParser * a_this, |
109 |
++ guint n_calls) |
110 |
+ { |
111 |
+ CRToken *token = NULL; |
112 |
+ CRInputPos init_pos; |
113 |
+@@ -966,6 +972,9 @@ cr_parser_parse_block_core (CRParser * a_this) |
114 |
+ |
115 |
+ g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR); |
116 |
+ |
117 |
++ if (n_calls > RECURSIVE_CALLERS_LIMIT) |
118 |
++ return CR_ERROR; |
119 |
++ |
120 |
+ RECORD_INITIAL_POS (a_this, &init_pos); |
121 |
+ |
122 |
+ status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token); |
123 |
+@@ -995,13 +1004,13 @@ cr_parser_parse_block_core (CRParser * a_this) |
124 |
+ } else if (token->type == CBO_TK) { |
125 |
+ cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); |
126 |
+ token = NULL; |
127 |
+- status = cr_parser_parse_block_core (a_this); |
128 |
++ status = cr_parser_parse_block_core (a_this, n_calls + 1); |
129 |
+ CHECK_PARSING_STATUS (status, FALSE); |
130 |
+ goto parse_block_content; |
131 |
+ } else { |
132 |
+ cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); |
133 |
+ token = NULL; |
134 |
+- status = cr_parser_parse_any_core (a_this); |
135 |
++ status = cr_parser_parse_any_core (a_this, n_calls + 1); |
136 |
+ CHECK_PARSING_STATUS (status, FALSE); |
137 |
+ goto parse_block_content; |
138 |
+ } |
139 |
+@@ -1108,7 +1117,7 @@ cr_parser_parse_value_core (CRParser * a_this) |
140 |
+ status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, |
141 |
+ token); |
142 |
+ token = NULL; |
143 |
+- status = cr_parser_parse_block_core (a_this); |
144 |
++ status = cr_parser_parse_block_core (a_this, 0); |
145 |
+ CHECK_PARSING_STATUS (status, FALSE); |
146 |
+ ref++; |
147 |
+ goto continue_parsing; |
148 |
+@@ -1122,7 +1131,7 @@ cr_parser_parse_value_core (CRParser * a_this) |
149 |
+ status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, |
150 |
+ token); |
151 |
+ token = NULL; |
152 |
+- status = cr_parser_parse_any_core (a_this); |
153 |
++ status = cr_parser_parse_any_core (a_this, 0); |
154 |
+ if (status == CR_OK) { |
155 |
+ ref++; |
156 |
+ goto continue_parsing; |
157 |
+@@ -1161,10 +1170,12 @@ cr_parser_parse_value_core (CRParser * a_this) |
158 |
+ * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*; |
159 |
+ * |
160 |
+ *@param a_this the current instance of #CRParser. |
161 |
++ *@param n_calls used to limit recursion depth |
162 |
+ *@return CR_OK upon successfull completion, an error code otherwise. |
163 |
+ */ |
164 |
+ static enum CRStatus |
165 |
+-cr_parser_parse_any_core (CRParser * a_this) |
166 |
++cr_parser_parse_any_core (CRParser * a_this, |
167 |
++ guint n_calls) |
168 |
+ { |
169 |
+ CRToken *token1 = NULL, |
170 |
+ *token2 = NULL; |
171 |
+@@ -1173,6 +1184,9 @@ cr_parser_parse_any_core (CRParser * a_this) |
172 |
+ |
173 |
+ g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); |
174 |
+ |
175 |
++ if (n_calls > RECURSIVE_CALLERS_LIMIT) |
176 |
++ return CR_ERROR; |
177 |
++ |
178 |
+ RECORD_INITIAL_POS (a_this, &init_pos); |
179 |
+ |
180 |
+ status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1); |
181 |
+@@ -1211,7 +1225,7 @@ cr_parser_parse_any_core (CRParser * a_this) |
182 |
+ *We consider parameter as being an "any*" production. |
183 |
+ */ |
184 |
+ do { |
185 |
+- status = cr_parser_parse_any_core (a_this); |
186 |
++ status = cr_parser_parse_any_core (a_this, n_calls + 1); |
187 |
+ } while (status == CR_OK); |
188 |
+ |
189 |
+ ENSURE_PARSING_COND (status == CR_PARSING_ERROR); |
190 |
+@@ -1236,7 +1250,7 @@ cr_parser_parse_any_core (CRParser * a_this) |
191 |
+ } |
192 |
+ |
193 |
+ do { |
194 |
+- status = cr_parser_parse_any_core (a_this); |
195 |
++ status = cr_parser_parse_any_core (a_this, n_calls + 1); |
196 |
+ } while (status == CR_OK); |
197 |
+ |
198 |
+ ENSURE_PARSING_COND (status == CR_PARSING_ERROR); |
199 |
+@@ -1264,7 +1278,7 @@ cr_parser_parse_any_core (CRParser * a_this) |
200 |
+ } |
201 |
+ |
202 |
+ do { |
203 |
+- status = cr_parser_parse_any_core (a_this); |
204 |
++ status = cr_parser_parse_any_core (a_this, n_calls + 1); |
205 |
+ } while (status == CR_OK); |
206 |
+ |
207 |
+ ENSURE_PARSING_COND (status == CR_PARSING_ERROR); |
208 |
+-- |
209 |
+GitLab |
210 |
+ |
211 |
|
212 |
diff --git a/dev-libs/libcroco/libcroco-0.6.13-r1.ebuild b/dev-libs/libcroco/libcroco-0.6.13-r1.ebuild |
213 |
new file mode 100644 |
214 |
index 00000000000..8e6f4779040 |
215 |
--- /dev/null |
216 |
+++ b/dev-libs/libcroco/libcroco-0.6.13-r1.ebuild |
217 |
@@ -0,0 +1,57 @@ |
218 |
+# Copyright 1999-2021 Gentoo Authors |
219 |
+# Distributed under the terms of the GNU General Public License v2 |
220 |
+ |
221 |
+EAPI=7 |
222 |
+ |
223 |
+inherit gnome2 multilib-minimal |
224 |
+ |
225 |
+DESCRIPTION="Generic Cascading Style Sheet (CSS) parsing and manipulation toolkit" |
226 |
+HOMEPAGE="https://gitlab.gnome.org/Archive/libcroco" |
227 |
+ |
228 |
+LICENSE="LGPL-2" |
229 |
+SLOT="0.6" |
230 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~x64-solaris ~x86-solaris" |
231 |
+IUSE="test" |
232 |
+RESTRICT="!test? ( test )" |
233 |
+ |
234 |
+RDEPEND=" |
235 |
+ >=dev-libs/glib-2.34.3:2[${MULTILIB_USEDEP}] |
236 |
+ >=dev-libs/libxml2-2.9.1-r4[${MULTILIB_USEDEP}] |
237 |
+" |
238 |
+DEPEND="${RDEPEND}" |
239 |
+BDEPEND=" |
240 |
+ dev-util/gtk-doc-am |
241 |
+ virtual/pkgconfig |
242 |
+" |
243 |
+ |
244 |
+PATCHES=( "${FILESDIR}"/${PN}-0.6.13-CVE-2020-12825.patch ) |
245 |
+ |
246 |
+src_prepare() { |
247 |
+ if ! use test; then |
248 |
+ # don't waste time building tests |
249 |
+ sed 's/^\(SUBDIRS .*\=.*\)tests\(.*\)$/\1\2/' -i Makefile.am Makefile.in \ |
250 |
+ || die "sed failed" |
251 |
+ fi |
252 |
+ |
253 |
+ gnome2_src_prepare |
254 |
+} |
255 |
+ |
256 |
+multilib_src_configure() { |
257 |
+ ECONF_SOURCE=${S} \ |
258 |
+ gnome2_src_configure \ |
259 |
+ --disable-static \ |
260 |
+ $([[ ${CHOST} == *-darwin* ]] && echo --disable-Bsymbolic) |
261 |
+ |
262 |
+ if multilib_is_native_abi; then |
263 |
+ ln -s "${S}"/docs/reference/html docs/reference/html || die |
264 |
+ fi |
265 |
+} |
266 |
+ |
267 |
+multilib_src_install() { |
268 |
+ gnome2_src_install |
269 |
+} |
270 |
+ |
271 |
+multilib_src_install_all() { |
272 |
+ DOCS=( AUTHORS ChangeLog HACKING NEWS README TODO ) |
273 |
+ einstalldocs |
274 |
+} |