From 365ebd8f002ef00745304408a217bb412e301193 Mon Sep 17 00:00:00 2001 From: "coadde [Márcio Alexandre Silva Delgado]" Date: Sun, 17 Apr 2016 20:55:23 -0300 Subject: perl-static: add new package to [libre] --- libre/perl-static/CVE-2016-2381_duplicate_env.diff | 104 +++++++++++++++++++++ libre/perl-static/PKGBUILD | 59 ++++++++++++ 2 files changed, 163 insertions(+) create mode 100644 libre/perl-static/CVE-2016-2381_duplicate_env.diff create mode 100644 libre/perl-static/PKGBUILD diff --git a/libre/perl-static/CVE-2016-2381_duplicate_env.diff b/libre/perl-static/CVE-2016-2381_duplicate_env.diff new file mode 100644 index 000000000..80adf62d2 --- /dev/null +++ b/libre/perl-static/CVE-2016-2381_duplicate_env.diff @@ -0,0 +1,104 @@ +From 83e7ebed7afa79a2f50eca6b6330eae7c3a02d36 Mon Sep 17 00:00:00 2001 +From: Tony Cook +Date: Wed, 27 Jan 2016 11:52:15 +1100 +Subject: remove duplicate environment variables from environ + +If we see duplicate environment variables while iterating over +environ[]: + +a) make sure we use the same value in %ENV that getenv() returns. + +Previously on a duplicate, %ENV would have the last entry for the name +from environ[], but a typical getenv() would return the first entry. + +Rather than assuming all getenv() implementations return the first entry +explicitly call getenv() to ensure they agree. + +b) remove duplicate entries from environ + +Previously if there was a duplicate definition for a name in environ[] +setting that name in %ENV could result in an unsafe value being passed +to a child process, so ensure environ[] has no duplicates. + +Patch-Name: fixes/CVE-2016-2381_duplicate_env.diff +--- + perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 49 insertions(+), 2 deletions(-) + +diff --git a/perl.c b/perl.c +index 80a76c2..ed25429 100644 +--- a/perl.c ++++ b/perl.c +@@ -4303,23 +4303,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env) + } + if (env) { + char *s, *old_var; ++ STRLEN nlen; + SV *sv; ++ HV *dups = newHV(); ++ + for (; *env; env++) { + old_var = *env; + + if (!(s = strchr(old_var,'=')) || s == old_var) + continue; ++ nlen = s - old_var; + + #if defined(MSDOS) && !defined(DJGPP) + *s = '\0'; + (void)strupr(old_var); + *s = '='; + #endif +- sv = newSVpv(s+1, 0); +- (void)hv_store(hv, old_var, s - old_var, sv, 0); ++ if (hv_exists(hv, old_var, nlen)) { ++ const char *name = savepvn(old_var, nlen); ++ ++ /* make sure we use the same value as getenv(), otherwise code that ++ uses getenv() (like setlocale()) might see a different value to %ENV ++ */ ++ sv = newSVpv(PerlEnv_getenv(name), 0); ++ ++ /* keep a count of the dups of this name so we can de-dup environ later */ ++ if (hv_exists(dups, name, nlen)) ++ ++SvIVX(*hv_fetch(dups, name, nlen, 0)); ++ else ++ (void)hv_store(dups, name, nlen, newSViv(1), 0); ++ ++ Safefree(name); ++ } ++ else { ++ sv = newSVpv(s+1, 0); ++ } ++ (void)hv_store(hv, old_var, nlen, sv, 0); + if (env_is_not_environ) + mg_set(sv); + } ++ if (HvKEYS(dups)) { ++ /* environ has some duplicate definitions, remove them */ ++ HE *entry; ++ hv_iterinit(dups); ++ while ((entry = hv_iternext_flags(dups, 0))) { ++ STRLEN nlen; ++ const char *name = HePV(entry, nlen); ++ IV count = SvIV(HeVAL(entry)); ++ IV i; ++ SV **valp = hv_fetch(hv, name, nlen, 0); ++ ++ assert(valp); ++ ++ /* try to remove any duplicate names, depending on the ++ * implementation used in my_setenv() the iteration might ++ * not be necessary, but let's be safe. ++ */ ++ for (i = 0; i < count; ++i) ++ my_setenv(name, 0); ++ ++ /* and set it back to the value we set $ENV{name} to */ ++ my_setenv(name, SvPV_nolen(*valp)); ++ } ++ } ++ SvREFCNT_dec_NN(dups); + } + #endif /* USE_ENVIRON_ARRAY */ + #endif /* !PERL_MICRO */ diff --git a/libre/perl-static/PKGBUILD b/libre/perl-static/PKGBUILD new file mode 100644 index 000000000..a412e9d98 --- /dev/null +++ b/libre/perl-static/PKGBUILD @@ -0,0 +1,59 @@ +# Maintainer: Márcio Silva +# based of perl + +_pkgname=perl +pkgname=perl-static +pkgver=5.22.1 +pkgrel=2 +pkgdesc="A highly capable, feature-rich programming language (static libraries only)" +arch=(i686 x86_64 armv7h) +license=('GPL' 'PerlArtistic') +url="http://www.perl.org" +groups=('base') +depends=('gdbm-static' 'db-static' 'perl') +source=(http://www.cpan.org/src/5.0/perl-${pkgver}.tar.bz2 + CVE-2016-2381_duplicate_env.diff) +options=('makeflags' '!purge' 'emptydirs' 'staticlibs') +md5sums=('67242b9bd642b458bec884ed2a040910' + 'a108f258b9ba1504b6051d123ccaa623') + +prepare() { + cd ${srcdir}/${_pkgname}-${pkgver} + + patch -p1 -i "$srcdir/CVE-2016-2381_duplicate_env.diff" +} + +build() { + cd ${srcdir}/${_pkgname}-${pkgver} + + if [ "${CARCH}" = "x86_64" ]; then + # for x86_64 + arch_opts="-Dcccdlflags='-fPIC'" + else + # for i686 + arch_opts="" + fi + + ./Configure -des -Dusethreads -Duseshrplib=false -Doptimize="${CFLAGS}" \ + -Dprefix=/usr \ + -Darchlib=/usr/lib/perl5/core_perl \ + -Dinc_version_list=none \ + ${arch_opts} \ + -Dlddlflags="-static ${LDFLAGS}" -Dldflags="${LDFLAGS}" -Dso=none + make +} + +check() { + cd ${srcdir}/${_pkgname}-${pkgver} + TEST_JOBS=$(echo $MAKEFLAGS | sed 's/.*-j\([0-9][0-9]*\).*/\1/') make test_harness +# make test +} + +package() { + cd ${srcdir}/${_pkgname}-${pkgver} + make DESTDIR="$pkgdir" install + + # remove conflicting files +# rm -vr ${pkgdir}/usr/{include,share} +# rm -v ${pkgdir}/usr/lib/lib*.so* +} -- cgit v1.2.3-54-g00ecf