diff options
Diffstat (limited to 'sys-libs/musl')
-rw-r--r-- | sys-libs/musl/Manifest | 2 | ||||
-rw-r--r-- | sys-libs/musl/files/musl-1.2.1-CVE-2020-28928.patch | 114 | ||||
-rw-r--r-- | sys-libs/musl/musl-1.2.1-r1.ebuild | 133 |
3 files changed, 249 insertions, 0 deletions
diff --git a/sys-libs/musl/Manifest b/sys-libs/musl/Manifest index 9f5b26569797..5e9c55eb1922 100644 --- a/sys-libs/musl/Manifest +++ b/sys-libs/musl/Manifest @@ -1,4 +1,5 @@ AUX ldconfig.in 2552 BLAKE2B c94f9900e8582d707519171c4b61079c801b60c555677b1740b04adbdec9645578b9a8fc91f11413072568f316c795e46a332970f3d2dde5272b0c49a5d60a78 SHA512 59f1b57361196363d3f127366764f05d26c23dbe3d3dbcdba9bd3c8ca26a671fd713b96d31c509d22805c57ada2b596d979a3f5795bcf0a4d3ac7d168f3bf377 +AUX musl-1.2.1-CVE-2020-28928.patch 3787 BLAKE2B 25919e7bc18eef643a53bb1be1ed11b8385462c25a991ad306bc2275d523cb64e41a45f5e379de47ecfc59beac773cf8515b3130b68472905007dc49a9342da6 SHA512 07bd31861fa123e55800c9e685ee662b6d80892fdfed943893c22c5e4bd2c283d475a5714823db15c95f343af9ef2290543780fdeadcc2df79c7954a5b68de3d DIST getconf.c 11614 BLAKE2B ba49a573fc16d51780a0b0b81fbf7b64a1142f1dbad203c9609a59b6b07e7404f676c415383ae88c0aede95694821f6ee381bffd93cc3330501e17dc07d122bd SHA512 0d80f37b34a35e3d14b012257c50862dfeb9d2c81139ea2dfa101d981d093b009b9fa450ba27a708ac59377a48626971dfc58e20a3799084a65777a0c32cbc7d DIST getent.c 9438 BLAKE2B dc20353583c10a001bd8fe8474f32b70254dc56da186d1cdbaf4081570c3d7a10497024da5815a485fc4728adc9eebd270aec99ba93b7546b38c728978e3e00b SHA512 b35de9847353b273516162ed4828a810c6130fc5b7de44ee4433003b3f99647b25792d9b1c40dfc67069add11f3fb850e5c35d4f1912dccac108059bbbdfd5a2 DIST iconv.c 2577 BLAKE2B 070ca87b30c90ab98c27d5faf7a2fcb64ff7c67ca212ee6072165b2146979c551f714954dbd465462a171837c59b6ea027e0206458a2df0f977e45f01be3ce48 SHA512 9d42d66fb1facce2b85dad919be5be819ee290bd26ca2db00982b2f8e055a0196290a008711cbe2b18ec9eee8d2270e3b3a4692c5a1b807013baa5c2b70a2bbf @@ -7,6 +8,7 @@ DIST musl-1.2.0.tar.gz 1035265 BLAKE2B 0a47e0f438cca0f3ce31ae024c193581602148421 DIST musl-1.2.1.tar.gz 1047481 BLAKE2B 5ccdee248d4caa1b433ab9c56cce3842fb46a269fd6a53d0880ba5eaad208997306e6b56fd345917e5076714fbfac0804ea226e6dc3f0f2e75f8c824a7155535 SHA512 455464ef47108a78457291bda2b1ea574987a1787f6001e9376956f20521593a4816bc215dab41c1a80292ae7ebd315accb4d4fa6a1210ff77d9a4d68239e960 EBUILD musl-1.1.24.ebuild 3299 BLAKE2B 17a4f78ae35c583480621880845dca6cbe55638519f25470a2bdf0922705caaeeb65a760763244b8890381714fc162487d22f07d15e20f163cb5f6cb7543b870 SHA512 984c0a1542ab23354d6e5dccad8c4ff6bab68ca9b52bba5ec36364ee997798ad0ee6f85b7ca7e66a78eead3e199c8dbe51d3e9df84d5c4df0f887428844f1ac9 EBUILD musl-1.2.0-r1.ebuild 3258 BLAKE2B 7a8edb02b626e2cdc1ae65bfc56973c98fb874990a1ca81d3fcb1b539512efad6e5874a41bd31769965874058f27d657776137a90bdbe5d2c6eefc033c18c447 SHA512 1e7f3ff9da0870b0f42c6ae364df2155d55208ed05e445ed63862600143f01fbad428f9cb6578052f7cd7536f6cec975fc618b2b92839f04e9ba186e988e0806 +EBUILD musl-1.2.1-r1.ebuild 3312 BLAKE2B 25174ab232870a4c06470a3eed0242f92710780160166c7da01b7e1af80fc312f75ab552849aa41ee6eaf5e5e5f5ba408082c2eba39f86d5bf8f470e118e7f5c SHA512 b3565c4357898a8c1300245f78725cf711a4e398c884c217ffb97bb4d5c5cbdf57136768b523dc1e903f51aa8cf367d57b612f5f443be35685b1ea2d59e383b2 EBUILD musl-1.2.1.ebuild 3256 BLAKE2B 29ea386004127256cf45713b1f82e788c557ae9e602bf5623e1523e3ddfe4caeb87ca86d8f7edb770d8805ab046473e70df606e43c89ef45c8a7034d581da20b SHA512 f4bba2bf005d85f4edc133088405ba41ed9c5a38127f7c67796ea31767f65f475c008e06f4a95914bc5e2b8443eb30700c7a630b61778cf3f21864b233303d08 EBUILD musl-9999.ebuild 3258 BLAKE2B 7a8edb02b626e2cdc1ae65bfc56973c98fb874990a1ca81d3fcb1b539512efad6e5874a41bd31769965874058f27d657776137a90bdbe5d2c6eefc033c18c447 SHA512 1e7f3ff9da0870b0f42c6ae364df2155d55208ed05e445ed63862600143f01fbad428f9cb6578052f7cd7536f6cec975fc618b2b92839f04e9ba186e988e0806 MISC metadata.xml 453 BLAKE2B d7b2840a6b0bb2ede2124f22bde34a9f77ac258792a9fbf9d9e3f552a85d6ee539a98c8704729efb75dec627db62b33759fc0cfdfd01614abbc4960a163c5019 SHA512 5d8bebce119ed34a6a6b8cb07b3ce056db5efc91db80709fc8031c955b16e29965f3741f75e9afbe9f428bbac1e39e7c30278cd63f04479e3a1493b006195e0a diff --git a/sys-libs/musl/files/musl-1.2.1-CVE-2020-28928.patch b/sys-libs/musl/files/musl-1.2.1-CVE-2020-28928.patch new file mode 100644 index 000000000000..9797e92ec423 --- /dev/null +++ b/sys-libs/musl/files/musl-1.2.1-CVE-2020-28928.patch @@ -0,0 +1,114 @@ +https://bugs.gentoo.org/755695 +https://git.musl-libc.org/cgit/musl/patch/?id=3ab2a4e02682df1382955071919d8aa3c3ec40d4 +From 3ab2a4e02682df1382955071919d8aa3c3ec40d4 Mon Sep 17 00:00:00 2001 +From: Rich Felker <dalias@aerifal.cx> +Date: Thu, 19 Nov 2020 17:12:43 -0500 +Subject: rewrite wcsnrtombs to fix buffer overflow and other bugs + +the original wcsnrtombs implementation, which has been largely +untouched since 0.5.0, attempted to build input-length-limiting +conversion on top of wcsrtombs, which only limits output length. as +best I recall, this choice was made out of a mix of disdain over +having yet another variant function to implement (added in POSIX 2008; +not standard C) and preference not to switch things around and +implement the wcsrtombs in terms of the more general new function, +probably over namespace issues. the strategy employed was to impose +output limits that would ensure the input limit wasn't exceeded, then +finish up the tail character-at-a-time. unfortunately, none of that +worked correctly. + +first, the logic in the wcsrtombs loop was wrong in that it could +easily get stuck making no forward progress, by imposing an output +limit too small to convert even one character. + +the character-at-a-time loop that followed was even worse. it made no +effort to ensure that the converted multibyte character would fit in +the remaining output space, only that there was a nonzero amount of +output space remaining. it also employed an incorrect interpretation +of wcrtomb's interface contract for converting the null character, +thereby failing to act on end of input, and remaining space accounting +was subject to unsigned wrap-around. together these errors allow +unbounded overflow of the destination buffer, controlled by input +length limit and input wchar_t string contents. + +given the extent to which this function was broken, it's plausible +that most applications that would have been rendered exploitable were +sufficiently broken not to be usable in the first place. however, it's +also plausible that common (especially ASCII-only) inputs succeeded in +the wcsrtombs loop, which mostly worked, while leaving the wildly +erroneous code in the second loop exposed to particular non-ASCII +inputs. + +CVE-2020-28928 has been assigned for this issue. +--- + src/multibyte/wcsnrtombs.c | 46 +++++++++++++++++++--------------------------- + 1 file changed, 19 insertions(+), 27 deletions(-) + +diff --git a/src/multibyte/wcsnrtombs.c b/src/multibyte/wcsnrtombs.c +index 676932b5..95e25e70 100644 +--- a/src/multibyte/wcsnrtombs.c ++++ b/src/multibyte/wcsnrtombs.c +@@ -1,41 +1,33 @@ + #include <wchar.h> ++#include <limits.h> ++#include <string.h> + + size_t wcsnrtombs(char *restrict dst, const wchar_t **restrict wcs, size_t wn, size_t n, mbstate_t *restrict st) + { +- size_t l, cnt=0, n2; +- char *s, buf[256]; + const wchar_t *ws = *wcs; +- const wchar_t *tmp_ws; +- +- if (!dst) s = buf, n = sizeof buf; +- else s = dst; +- +- while ( ws && n && ( (n2=wn)>=n || n2>32 ) ) { +- if (n2>=n) n2=n; +- tmp_ws = ws; +- l = wcsrtombs(s, &ws, n2, 0); +- if (!(l+1)) { +- cnt = l; +- n = 0; ++ size_t cnt = 0; ++ if (!dst) n=0; ++ while (ws && wn) { ++ char tmp[MB_LEN_MAX]; ++ size_t l = wcrtomb(n<MB_LEN_MAX ? tmp : dst, *ws, 0); ++ if (l==-1) { ++ cnt = -1; + break; + } +- if (s != buf) { +- s += l; ++ if (dst) { ++ if (n<MB_LEN_MAX) { ++ if (l>n) break; ++ memcpy(dst, tmp, l); ++ } ++ dst += l; + n -= l; + } +- wn = ws ? wn - (ws - tmp_ws) : 0; +- cnt += l; +- } +- if (ws) while (n && wn) { +- l = wcrtomb(s, *ws, 0); +- if ((l+1)<=1) { +- if (!l) ws = 0; +- else cnt = l; ++ if (!*ws) { ++ ws = 0; + break; + } +- ws++; wn--; +- /* safe - this loop runs fewer than sizeof(buf) times */ +- s+=l; n-=l; ++ ws++; ++ wn--; + cnt += l; + } + if (dst) *wcs = ws; +-- +cgit v1.2.1 + diff --git a/sys-libs/musl/musl-1.2.1-r1.ebuild b/sys-libs/musl/musl-1.2.1-r1.ebuild new file mode 100644 index 000000000000..05a55e96e2d1 --- /dev/null +++ b/sys-libs/musl/musl-1.2.1-r1.ebuild @@ -0,0 +1,133 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit eutils flag-o-matic multilib toolchain-funcs +if [[ ${PV} == "9999" ]] ; then + EGIT_REPO_URI="git://git.musl-libc.org/musl" + inherit git-r3 + SRC_URI=" + https://dev.gentoo.org/~blueness/musl-misc/getconf.c + https://dev.gentoo.org/~blueness/musl-misc/getent.c + https://dev.gentoo.org/~blueness/musl-misc/iconv.c" + KEYWORDS="" +else + SRC_URI="http://www.musl-libc.org/releases/${P}.tar.gz + https://dev.gentoo.org/~blueness/musl-misc/getconf.c + https://dev.gentoo.org/~blueness/musl-misc/getent.c + https://dev.gentoo.org/~blueness/musl-misc/iconv.c" + KEYWORDS="-* ~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~x86" +fi + +export CBUILD=${CBUILD:-${CHOST}} +export CTARGET=${CTARGET:-${CHOST}} +if [[ ${CTARGET} == ${CHOST} ]] ; then + if [[ ${CATEGORY} == cross-* ]] ; then + export CTARGET=${CATEGORY#cross-} + fi +fi + +DESCRIPTION="Light, fast and simple C library focused on standards-conformance and safety" +HOMEPAGE="http://www.musl-libc.org/" +LICENSE="MIT LGPL-2 GPL-2" +SLOT="0" +IUSE="headers-only" + +QA_SONAME="/usr/lib/libc.so" +QA_DT_NEEDED="/usr/lib/libc.so" + +PATCHES=( + "${FILESDIR}/${P}-CVE-2020-28928.patch" +) + +is_crosscompile() { + [[ ${CHOST} != ${CTARGET} ]] +} + +just_headers() { + use headers-only && is_crosscompile +} + +pkg_setup() { + if [ ${CTARGET} == ${CHOST} ] ; then + case ${CHOST} in + *-musl*) ;; + *) die "Use sys-devel/crossdev to build a musl toolchain" ;; + esac + fi + + # fix for #667126, copied from glibc ebuild + # make sure host make.conf doesn't pollute us + if is_crosscompile || tc-is-cross-compiler ; then + CHOST=${CTARGET} strip-unsupported-flags + fi +} + +src_configure() { + tc-getCC ${CTARGET} + just_headers && export CC=true + + local sysroot + is_crosscompile && sysroot=/usr/${CTARGET} + ./configure \ + --target=${CTARGET} \ + --prefix=${sysroot}/usr \ + --syslibdir=${sysroot}/lib \ + --disable-gcc-wrapper || die +} + +src_compile() { + emake obj/include/bits/alltypes.h + just_headers && return 0 + + emake + if [[ ${CATEGORY} != cross-* ]] ; then + emake -C "${T}" getconf getent iconv \ + CC="$(tc-getCC)" \ + CFLAGS="${CFLAGS}" \ + CPPFLAGS="${CPPFLAGS}" \ + LDFLAGS="${LDFLAGS}" \ + VPATH="${DISTDIR}" + fi +} + +src_install() { + local target="install" + just_headers && target="install-headers" + emake DESTDIR="${D}" ${target} + just_headers && return 0 + + # musl provides ldd via a sym link to its ld.so + local sysroot + is_crosscompile && sysroot=/usr/${CTARGET} + local ldso=$(basename "${D}"${sysroot}/lib/ld-musl-*) + dosym ${sysroot}/lib/${ldso} ${sysroot}/usr/bin/ldd + + if [[ ${CATEGORY} != cross-* ]] ; then + # Fish out of config: + # ARCH = ... + # SUBARCH = ... + # and print $(ARCH)$(SUBARCH). + local arch=$(awk '{ k[$1] = $3 } END { printf("%s%s", k["ARCH"], k["SUBARCH"]); }' config.mak) + [[ -e "${D}"/lib/ld-musl-${arch}.so.1 ]] || die + cp "${FILESDIR}"/ldconfig.in "${T}" || die + sed -e "s|@@ARCH@@|${arch}|" "${T}"/ldconfig.in > "${T}"/ldconfig || die + into / + dosbin "${T}"/ldconfig + into /usr + dobin "${T}"/getconf + dobin "${T}"/getent + dobin "${T}"/iconv + echo 'LDPATH="include ld.so.conf.d/*.conf"' > "${T}"/00musl || die + doenvd "${T}"/00musl + fi +} + +pkg_postinst() { + is_crosscompile && return 0 + + [ "${ROOT}" != "/" ] && return 0 + + ldconfig || die +} |