Thu Apr 11 00:04:39 PDT 2013

3 files changed, 199 insertions, 5 deletions

diff --git a/core/glibc/PKGBUILD b/core/glibc/PKGBUILD
index 144f42c64..e89e1aedc 100644
--- a/core/glibc/PKGBUILD
+++ b/core/glibc/PKGBUILD
@@ -1,4 +1,4 @@
-# $Id: PKGBUILD 181168 2013-04-02 06:48:58Z allan $
+# $Id: PKGBUILD 182400 2013-04-10 06:04:12Z allan $
 # Maintainer: Allan McRae <allan@archlinux.org>
 
 # toolchain build order: linux-api-headers->glibc->binutils->gcc->binutils->glibc
@@ -6,7 +6,7 @@
 
 pkgname=glibc
 pkgver=2.17
-pkgrel=4
+pkgrel=5
 pkgdesc="GNU C Library"
 arch=('i686' 'x86_64')
 url="http://www.gnu.org/software/libc"
@@ -21,13 +21,17 @@ options=('!strip')
 install=glibc.install
 source=(http://ftp.gnu.org/gnu/libc/${pkgname}-${pkgver}.tar.xz{,.sig}
         glibc-2.17-sync-with-linux37.patch
+        glibc-2.17-getaddrinfo-stack-overflow.patch
+        glibc-2.17-regexp-matcher-overrun.patch
         nscd.service
         nscd.tmpfiles
         locale.gen.txt
         locale-gen)
 md5sums=('87bf675c8ee523ebda4803e8e1cec638'
-         '6db4d1661cf34282755dc90330465f6d'
+         'SKIP'
          'fb99380d94598cc76d793deebf630022'
+         '56d5f2c09503a348281a20ae404b7de3'
+         '200acc05961b084ee00dde919e64f82d'
          'c1e07c0bec0fe89791bfd9d13fc85edf'
          'bccbe5619e75cf1d97312ec3681c605c'
          '07ac979b6ab5eeb778d55f041529d623'
@@ -40,6 +44,12 @@ build() {
   # combination of upstream commits 318cd0b, b540704 and fc1abbe
   patch -p1 -i ${srcdir}/glibc-2.17-sync-with-linux37.patch
 
+  # CVE-2013-1914 - upstream commit 1cef1b19
+  patch -p1 -i ${srcdir}/glibc-2.17-getaddrinfo-stack-overflow.patch
+
+  # CVE-2013-0242 - upstream commit a445af0b
+  patch -p1 -i ${srcdir}/glibc-2.17-regexp-matcher-overrun.patch
+
   cd ${srcdir}
   mkdir glibc-build
   cd glibc-build
@@ -52,9 +62,9 @@ build() {
 
   echo "slibdir=/usr/lib" >> configparms
 
-  # remove hardening options from CFLAGS for building libraries
+  # remove hardening options for building libraries
   CFLAGS=${CFLAGS/-fstack-protector/}
-  CFLAGS=${CFLAGS/-D_FORTIFY_SOURCE=2/}
+  CPPFLAGS=${CPPFLAGS/-D_FORTIFY_SOURCE=2/}
 
   ${srcdir}/${pkgname}-${pkgver}/configure --prefix=/usr \
       --libdir=/usr/lib --libexecdir=/usr/lib \
diff --git a/core/glibc/glibc-2.17-getaddrinfo-stack-overflow.patch b/core/glibc/glibc-2.17-getaddrinfo-stack-overflow.patch
new file mode 100644
index 000000000..aa916ac2c
--- /dev/null
+++ b/core/glibc/glibc-2.17-getaddrinfo-stack-overflow.patch
@@ -0,0 +1,47 @@
+diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
+index d95c2d1..2309281 100644
+--- a/sysdeps/posix/getaddrinfo.c
++++ b/sysdeps/posix/getaddrinfo.c
+@@ -2489,11 +2489,27 @@ getaddrinfo (const char *name, const char *service,
+       __typeof (once) old_once = once;
+       __libc_once (once, gaiconf_init);
+       /* Sort results according to RFC 3484.  */
+-      struct sort_result results[nresults];
+-      size_t order[nresults];
++      struct sort_result *results;
++      size_t *order;
+       struct addrinfo *q;
+       struct addrinfo *last = NULL;
+       char *canonname = NULL;
++      bool malloc_results;
++
++      malloc_results
++	= !__libc_use_alloca (nresults * (sizeof (*results) + sizeof (size_t)));
++      if (malloc_results)
++	{
++	  results = malloc (nresults * (sizeof (*results) + sizeof (size_t)));
++	  if (results == NULL)
++	    {
++	      __free_in6ai (in6ai);
++	      return EAI_MEMORY;
++	    }
++	}
++      else
++	results = alloca (nresults * (sizeof (*results) + sizeof (size_t)));
++      order = (size_t *) (results + nresults);
+ 
+       /* Now we definitely need the interface information.  */
+       if (! check_pf_called)
+@@ -2664,6 +2680,9 @@ getaddrinfo (const char *name, const char *service,
+ 
+       /* Fill in the canonical name into the new first entry.  */
+       p->ai_canonname = canonname;
++
++      if (malloc_results)
++	free (results);
+     }
+ 
+   __free_in6ai (in6ai);
+-- 
+1.7.1
+
diff --git a/core/glibc/glibc-2.17-regexp-matcher-overrun.patch b/core/glibc/glibc-2.17-regexp-matcher-overrun.patch
new file mode 100644
index 000000000..b108f9d42
--- /dev/null
+++ b/core/glibc/glibc-2.17-regexp-matcher-overrun.patch
@@ -0,0 +1,137 @@
+diff --git a/posix/Makefile b/posix/Makefile
+index 88d409f..2cacd21 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -86,7 +86,7 @@ tests		:= tstgetopt testfnm runtests runptests	     \
+ 		   tst-rfc3484-3 \
+ 		   tst-getaddrinfo3 tst-fnmatch2 tst-cpucount tst-cpuset \
+ 		   bug-getopt1 bug-getopt2 bug-getopt3 bug-getopt4 \
+-		   bug-getopt5 tst-getopt_long1
++		   bug-getopt5 tst-getopt_long1 bug-regex34
+ xtests		:= bug-ga2
+ ifeq (yes,$(build-shared))
+ test-srcs	:= globtest
+@@ -199,5 +199,6 @@ bug-regex26-ENV = LOCPATH=$(common-objpfx)localedata
+ bug-regex30-ENV = LOCPATH=$(common-objpfx)localedata
+ bug-regex32-ENV = LOCPATH=$(common-objpfx)localedata
+ bug-regex33-ENV = LOCPATH=$(common-objpfx)localedata
++bug-regex34-ENV = LOCPATH=$(common-objpfx)localedata
+ tst-rxspencer-ARGS = --utf8 rxspencer/tests
+ tst-rxspencer-ENV = LOCPATH=$(common-objpfx)localedata
+diff --git a/posix/bug-regex34.c b/posix/bug-regex34.c
+new file mode 100644
+index 0000000..bb3b613
+--- /dev/null
++++ b/posix/bug-regex34.c
+@@ -0,0 +1,46 @@
++/* Test re_search with multi-byte characters in UTF-8.
++   Copyright (C) 2013 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#define _GNU_SOURCE 1
++#include <stdio.h>
++#include <string.h>
++#include <locale.h>
++#include <regex.h>
++
++static int
++do_test (void)
++{
++  struct re_pattern_buffer r;
++  /* ကျွန်ုပ်x */
++  const char *s = "\xe1\x80\x80\xe1\x80\xbb\xe1\x80\xbd\xe1\x80\x94\xe1\x80\xba\xe1\x80\xaf\xe1\x80\x95\xe1\x80\xbax";
++
++  if (setlocale (LC_ALL, "en_US.UTF-8") == NULL)
++    {
++      puts ("setlocale failed");
++      return 1;
++    }
++  memset (&r, 0, sizeof (r));
++
++  re_compile_pattern ("[^x]x", 5, &r);
++  /* This was triggering a buffer overflow.  */
++  re_search (&r, s, strlen (s), 0, strlen (s), 0);
++  return 0;
++}
++
++#define TEST_FUNCTION do_test ()
++#include "../test-skeleton.c"
+diff --git a/posix/regexec.c b/posix/regexec.c
+index 7f2de85..5ca2bf6 100644
+--- a/posix/regexec.c
++++ b/posix/regexec.c
+@@ -197,7 +197,7 @@ static int group_nodes_into_DFAstates (const re_dfa_t *dfa,
+ static int check_node_accept (const re_match_context_t *mctx,
+ 			      const re_token_t *node, int idx)
+      internal_function;
+-static reg_errcode_t extend_buffers (re_match_context_t *mctx)
++static reg_errcode_t extend_buffers (re_match_context_t *mctx, int min_len)
+      internal_function;
+ 
+ /* Entry point for POSIX code.  */
+@@ -1160,7 +1160,7 @@ check_matching (re_match_context_t *mctx, int fl_longest_match,
+ 	  || (BE (next_char_idx >= mctx->input.valid_len, 0)
+ 	      && mctx->input.valid_len < mctx->input.len))
+ 	{
+-	  err = extend_buffers (mctx);
++	  err = extend_buffers (mctx, next_char_idx + 1);
+ 	  if (BE (err != REG_NOERROR, 0))
+ 	    {
+ 	      assert (err == REG_ESPACE);
+@@ -1738,7 +1738,7 @@ clean_state_log_if_needed (re_match_context_t *mctx, int next_state_log_idx)
+ 	  && mctx->input.valid_len < mctx->input.len))
+     {
+       reg_errcode_t err;
+-      err = extend_buffers (mctx);
++      err = extend_buffers (mctx, next_state_log_idx + 1);
+       if (BE (err != REG_NOERROR, 0))
+ 	return err;
+     }
+@@ -2792,7 +2792,7 @@ get_subexp (re_match_context_t *mctx, int bkref_node, int bkref_str_idx)
+ 		  if (bkref_str_off >= mctx->input.len)
+ 		    break;
+ 
+-		  err = extend_buffers (mctx);
++		  err = extend_buffers (mctx, bkref_str_off + 1);
+ 		  if (BE (err != REG_NOERROR, 0))
+ 		    return err;
+ 
+@@ -4102,7 +4102,7 @@ check_node_accept (const re_match_context_t *mctx, const re_token_t *node,
+ 
+ static reg_errcode_t
+ internal_function __attribute_warn_unused_result__
+-extend_buffers (re_match_context_t *mctx)
++extend_buffers (re_match_context_t *mctx, int min_len)
+ {
+   reg_errcode_t ret;
+   re_string_t *pstr = &mctx->input;
+@@ -4111,8 +4111,10 @@ extend_buffers (re_match_context_t *mctx)
+   if (BE (INT_MAX / 2 / sizeof (re_dfastate_t *) <= pstr->bufs_len, 0))
+     return REG_ESPACE;
+ 
+-  /* Double the lengthes of the buffers.  */
+-  ret = re_string_realloc_buffers (pstr, MIN (pstr->len, pstr->bufs_len * 2));
++  /* Double the lengthes of the buffers, but allocate at least MIN_LEN.  */
++  ret = re_string_realloc_buffers (pstr,
++				   MAX (min_len,
++					MIN (pstr->len, pstr->bufs_len * 2)));
+   if (BE (ret != REG_NOERROR, 0))
+     return ret;
+ 
+-- 
+1.7.1
+