|
[meta-java][PATCH] openjdk-8: refresh patches
Signed-off-by: Ulrich Ölmann <u.oelmann@...>
---
.../0013-autoconf-remove-Werror.patch | 22 +++++++++----------
...pot-Turn-on-the-Wreturn-type-warning.patch | 20 ++++++++---------
.../1010-hotspot-fix-shark-build-common.patch | 12 +++++-----
.../1012-hotspot-enable-Wno-error.patch | 4 ++--
4 files changed, 29 insertions(+), 29 deletions(-)
diff --git a/recipes-core/openjdk/patches-openjdk-8/0013-autoconf-remove-Werror.patch b/recipes-core/openjdk/patches-openjdk-8/0013-autoconf-remove-Werror.patch
index d3bd8e7d1808..91fedb5310ec 100644
--- a/recipes-core/openjdk/patches-openjdk-8/0013-autoconf-remove-Werror.patch
+++ b/recipes-core/openjdk/patches-openjdk-8/0013-autoconf-remove-Werror.patch
@@ -63,10 +63,10 @@ index 077efa2..b98575a 100644
CFLAGS_JDK="${CFLAGS_JDK} ${NO_DELETE_NULL_POINTER_CHECKS_CFLAG} ${NO_LIFETIME_DSE_CFLAG}"
AC_SUBST([NO_LIFETIME_DSE_CFLAG])
diff --git a/common/autoconf/generated-configure.sh b/common/autoconf/generated-configure.sh
-index d57035b..1953dc4 100644
+index f285a74..31d41b1 100644
--- a/common/autoconf/generated-configure.sh
+++ b/common/autoconf/generated-configure.sh
-@@ -41498,12 +41498,12 @@ $as_echo "$ac_cv_c_bigendian" >&6; }
+@@ -41503,12 +41503,12 @@ $as_echo "$ac_cv_c_bigendian" >&6; }
fi
CXXSTD_CXXFLAG="-std=gnu++98"
@@ -82,7 +82,7 @@ index d57035b..1953dc4 100644
ac_ext=cpp
ac_cpp='$CXXCPP $CPPFLAGS'
ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-@@ -41654,12 +41654,12 @@ fi
+@@ -41659,12 +41659,12 @@ fi
NO_DELETE_NULL_POINTER_CHECKS_CFLAG="-fno-delete-null-pointer-checks"
@@ -98,7 +98,7 @@ index d57035b..1953dc4 100644
ac_ext=c
ac_cpp='$CPP $CPPFLAGS'
ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-@@ -41694,12 +41694,12 @@ $as_echo "$supports" >&6; }
+@@ -41699,12 +41699,12 @@ $as_echo "$supports" >&6; }
fi
@@ -114,7 +114,7 @@ index d57035b..1953dc4 100644
ac_ext=cpp
ac_cpp='$CXXCPP $CPPFLAGS'
ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-@@ -41733,8 +41733,8 @@ $as_echo "$supports" >&6; }
+@@ -41738,8 +41738,8 @@ $as_echo "$supports" >&6; }
fi
@@ -125,7 +125,7 @@ index d57035b..1953dc4 100644
supports=no
if test "x$C_COMP_SUPPORTS" = "xyes" -a "x$CXX_COMP_SUPPORTS" = "xyes"; then supports=yes; fi
-@@ -41750,12 +41750,12 @@ $as_echo "$supports" >&6; }
+@@ -41755,12 +41755,12 @@ $as_echo "$supports" >&6; }
NO_LIFETIME_DSE_CFLAG="-fno-lifetime-dse"
@@ -141,7 +141,7 @@ index d57035b..1953dc4 100644
ac_ext=c
ac_cpp='$CPP $CPPFLAGS'
ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-@@ -41789,12 +41789,12 @@ $as_echo "$supports" >&6; }
+@@ -41794,12 +41794,12 @@ $as_echo "$supports" >&6; }
fi
@@ -157,7 +157,7 @@ index d57035b..1953dc4 100644
ac_ext=cpp
ac_cpp='$CXXCPP $CPPFLAGS'
ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-@@ -41828,8 +41828,8 @@ $as_echo "$supports" >&6; }
+@@ -41833,8 +41833,8 @@ $as_echo "$supports" >&6; }
fi
@@ -168,7 +168,7 @@ index d57035b..1953dc4 100644
supports=no
if test "x$C_COMP_SUPPORTS" = "xyes" -a "x$CXX_COMP_SUPPORTS" = "xyes"; then supports=yes; fi
-@@ -41862,12 +41862,12 @@ $as_echo "$supports" >&6; }
+@@ -41867,12 +41867,12 @@ $as_echo "$supports" >&6; }
# -mno-fused-madd -fno-strict-aliasing for GCC < 4.6
COMPILER_FP_CONTRACT_OFF_FLAG="-ffp-contract=off"
@@ -184,7 +184,7 @@ index d57035b..1953dc4 100644
ac_ext=cpp
ac_cpp='$CXXCPP $CPPFLAGS'
ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-@@ -41906,12 +41906,12 @@ $as_echo "$supports" >&6; }
+@@ -41911,12 +41911,12 @@ $as_echo "$supports" >&6; }
test "$OPENJDK_TARGET_CPU_ARCH" = "ppc"; then
M_NO_FUSED_ADD_FLAG="-mno-fused-madd"
@@ -200,7 +200,7 @@ index d57035b..1953dc4 100644
ac_ext=cpp
ac_cpp='$CXXCPP $CPPFLAGS'
ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-@@ -41946,12 +41946,12 @@ $as_echo "$supports" >&6; }
+@@ -41951,12 +41951,12 @@ $as_echo "$supports" >&6; }
NO_STRICT_ALIASING_FLAG="-fno-strict-aliasing"
diff --git a/recipes-core/openjdk/patches-openjdk-8/1007-hotspot-Turn-on-the-Wreturn-type-warning.patch b/recipes-core/openjdk/patches-openjdk-8/1007-hotspot-Turn-on-the-Wreturn-type-warning.patch
index b5173a939733..0dc09b68c38a 100644
--- a/recipes-core/openjdk/patches-openjdk-8/1007-hotspot-Turn-on-the-Wreturn-type-warning.patch
+++ b/recipes-core/openjdk/patches-openjdk-8/1007-hotspot-Turn-on-the-Wreturn-type-warning.patch
@@ -36,10 +36,10 @@ Signed-off-by: Richard Leitner <richard.leitner@...>
13 files changed, 17 insertions(+), 15 deletions(-)
diff --git a/hotspot/make/linux/makefiles/gcc.make b/hotspot/make/linux/makefiles/gcc.make
-index 36b3c8ba9..cd9511e50 100644
+index ac44b6837..7a5162a06 100644
--- a/hotspot/make/linux/makefiles/gcc.make
+++ b/hotspot/make/linux/makefiles/gcc.make
-@@ -211,7 +211,7 @@ ifeq ($(USE_CLANG), true)
+@@ -212,7 +212,7 @@ ifeq ($(USE_CLANG), true)
WARNINGS_ARE_ERRORS += -Wno-return-type -Wno-empty-body
endif
@@ -95,7 +95,7 @@ index 4b4b4e250..196622aed 100644
diff --git a/hotspot/src/share/vm/classfile/symbolTable.cpp b/hotspot/src/share/vm/classfile/symbolTable.cpp
-index 83369cbcf..8dd4e6b21 100644
+index ec97077b7..2621a7d62 100644
--- a/hotspot/src/share/vm/classfile/symbolTable.cpp
+++ b/hotspot/src/share/vm/classfile/symbolTable.cpp
@@ -249,7 +249,7 @@ Symbol* SymbolTable::lookup(const char* name, int len, TRAPS) {
@@ -117,7 +117,7 @@ index 83369cbcf..8dd4e6b21 100644
Symbol* SymbolTable::lookup_only(const char* name, int len,
diff --git a/hotspot/src/share/vm/classfile/systemDictionary.cpp b/hotspot/src/share/vm/classfile/systemDictionary.cpp
-index 4541e815a..98412e1e1 100644
+index 5911d94f5..df4d56f6f 100644
--- a/hotspot/src/share/vm/classfile/systemDictionary.cpp
+++ b/hotspot/src/share/vm/classfile/systemDictionary.cpp
@@ -236,15 +236,15 @@ Klass* SystemDictionary::resolve_or_null(Symbol* class_name, Handle class_loader
@@ -166,10 +166,10 @@ index 2f3abae6a..d58ebecb2 100644
static ReservedSpace* shared_rs() {
CDS_ONLY(return _shared_rs);
diff --git a/hotspot/src/share/vm/oops/constantPool.hpp b/hotspot/src/share/vm/oops/constantPool.hpp
-index 68435471d..fad4a92cb 100644
+index 124c970e2..dae574c09 100644
--- a/hotspot/src/share/vm/oops/constantPool.hpp
+++ b/hotspot/src/share/vm/oops/constantPool.hpp
-@@ -350,7 +350,7 @@ class ConstantPool : public Metadata {
+@@ -353,7 +353,7 @@ class ConstantPool : public Metadata {
Klass* klass_at(int which, TRAPS) {
constantPoolHandle h_this(THREAD, this);
@@ -177,7 +177,7 @@ index 68435471d..fad4a92cb 100644
+ return klass_at_impl(h_this, which, THREAD);
}
- Symbol* klass_name_at(int which) const; // Returns the name, w/o resolving.
+ Symbol* klass_name_at(int which); // Returns the name, w/o resolving.
diff --git a/hotspot/src/share/vm/prims/jvm.cpp b/hotspot/src/share/vm/prims/jvm.cpp
index 6f2221c41..daa69f89a 100644
--- a/hotspot/src/share/vm/prims/jvm.cpp
@@ -192,7 +192,7 @@ index 6f2221c41..daa69f89a 100644
JVM_ENTRY(jboolean,JVM_DTraceIsProbeEnabled(JNIEnv* env, jmethodID method))
diff --git a/hotspot/src/share/vm/runtime/reflection.cpp b/hotspot/src/share/vm/runtime/reflection.cpp
-index 4b39d8ccb..9cd7b0dcb 100644
+index d9fddbe47..a5f737935 100644
--- a/hotspot/src/share/vm/runtime/reflection.cpp
+++ b/hotspot/src/share/vm/runtime/reflection.cpp
@@ -1093,7 +1093,7 @@ oop Reflection::invoke(instanceKlassHandle klass, methodHandle reflected_method,
@@ -205,10 +205,10 @@ index 4b39d8ccb..9cd7b0dcb 100644
}
diff --git a/hotspot/src/share/vm/runtime/sharedRuntime.cpp b/hotspot/src/share/vm/runtime/sharedRuntime.cpp
-index d5bea29c3..50578ad63 100644
+index 013aa7a23..df4cde963 100644
--- a/hotspot/src/share/vm/runtime/sharedRuntime.cpp
+++ b/hotspot/src/share/vm/runtime/sharedRuntime.cpp
-@@ -1041,7 +1041,7 @@ Handle SharedRuntime::find_callee_info(JavaThread* thread, Bytecodes::Code& bc,
+@@ -1045,7 +1045,7 @@ Handle SharedRuntime::find_callee_info(JavaThread* thread, Bytecodes::Code& bc,
// last java frame on stack (which includes native call frames)
vframeStream vfst(thread, true); // Do not skip and javaCalls
diff --git a/recipes-core/openjdk/patches-openjdk-8/1010-hotspot-fix-shark-build-common.patch b/recipes-core/openjdk/patches-openjdk-8/1010-hotspot-fix-shark-build-common.patch
index 8e70cab814c7..711d17bfd43c 100644
--- a/recipes-core/openjdk/patches-openjdk-8/1010-hotspot-fix-shark-build-common.patch
+++ b/recipes-core/openjdk/patches-openjdk-8/1010-hotspot-fix-shark-build-common.patch
@@ -22,10 +22,10 @@ Signed-off-by: Richard Leitner <richard.leitner@...>
14 files changed, 123 insertions(+), 12 deletions(-)
diff --git a/hotspot/make/Makefile b/hotspot/make/Makefile
-index ad195763b..53b5ea046 100644
+index de2607c71..3054c3fe8 100644
--- a/hotspot/make/Makefile
+++ b/hotspot/make/Makefile
-@@ -525,7 +525,7 @@ $(EXPORT_INCLUDE_DIR)/%: $(SHARK_BUILD_DIR)/../generated/jvmtifiles/%
+@@ -536,7 +536,7 @@ $(EXPORT_INCLUDE_DIR)/%: $(SHARK_BUILD_DIR)/../generated/jvmtifiles/%
# Unix
$(EXPORT_JRE_LIB_ARCH_DIR)/%.$(LIBRARY_SUFFIX): $(SHARK_BUILD_DIR)/%.$(LIBRARY_SUFFIX)
$(install-file)
@@ -79,10 +79,10 @@ index 4707cc96e..a2b297ca0 100644
flow_block(blk, temp_vector, temp_set);
if (failing()) return; // Watch for bailouts.
diff --git a/hotspot/src/share/vm/classfile/systemDictionary.cpp b/hotspot/src/share/vm/classfile/systemDictionary.cpp
-index 98412e1e1..f62731c43 100644
+index df4d56f6f..b1dd335cb 100644
--- a/hotspot/src/share/vm/classfile/systemDictionary.cpp
+++ b/hotspot/src/share/vm/classfile/systemDictionary.cpp
-@@ -2392,6 +2392,7 @@ methodHandle SystemDictionary::find_method_handle_intrinsic(vmIntrinsics::ID iid
+@@ -2371,6 +2371,7 @@ methodHandle SystemDictionary::find_method_handle_intrinsic(vmIntrinsics::ID iid
spe = NULL;
// Must create lots of stuff here, but outside of the SystemDictionary lock.
m = Method::make_method_handle_intrinsic(iid, signature, CHECK_(empty));
@@ -90,7 +90,7 @@ index 98412e1e1..f62731c43 100644
if (!Arguments::is_interpreter_only()) {
// Generate a compiled form of the MH intrinsic.
AdapterHandlerLibrary::create_native_wrapper(m);
-@@ -2401,6 +2402,7 @@ methodHandle SystemDictionary::find_method_handle_intrinsic(vmIntrinsics::ID iid
+@@ -2380,6 +2381,7 @@ methodHandle SystemDictionary::find_method_handle_intrinsic(vmIntrinsics::ID iid
"out of space in CodeCache for method handle intrinsic", empty);
}
}
@@ -98,7 +98,7 @@ index 98412e1e1..f62731c43 100644
// Now grab the lock. We might have to throw away the new method,
// if a racing thread has managed to install one at the same time.
{
-@@ -2414,9 +2416,11 @@ methodHandle SystemDictionary::find_method_handle_intrinsic(vmIntrinsics::ID iid
+@@ -2393,9 +2395,11 @@ methodHandle SystemDictionary::find_method_handle_intrinsic(vmIntrinsics::ID iid
}
assert(spe != NULL && spe->method() != NULL, "");
diff --git a/recipes-core/openjdk/patches-openjdk-8/1012-hotspot-enable-Wno-error.patch b/recipes-core/openjdk/patches-openjdk-8/1012-hotspot-enable-Wno-error.patch
index 2239d481ae82..aeeba6b87602 100644
--- a/recipes-core/openjdk/patches-openjdk-8/1012-hotspot-enable-Wno-error.patch
+++ b/recipes-core/openjdk/patches-openjdk-8/1012-hotspot-enable-Wno-error.patch
@@ -14,10 +14,10 @@ Signed-off-by: Richard Leitner <richard.leitner@...>
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hotspot/make/linux/makefiles/gcc.make b/hotspot/make/linux/makefiles/gcc.make
-index cd9511e50..94412c8fe 100644
+index 7a5162a06..67607fb26 100644
--- a/hotspot/make/linux/makefiles/gcc.make
+++ b/hotspot/make/linux/makefiles/gcc.make
-@@ -200,8 +200,8 @@ else
+@@ -201,8 +201,8 @@ else
CFLAGS += -pipe
endif
--
2.30.2
|
|
|
[meta-networking][PATCHv2] blueman: upgrade 2.34 -> 2.35
This fixes a nasty bug where the shown device list doesnt match the under= lying MAC list, resulting in connecting to a different device than selected. Signed-off-by: Markus Volk <f_l_k@...> --- .../blueman/{blueman_2.3.4.bb =3D> blueman_2.3.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-networking/recipes-connectivity/blueman/{blueman_2.3.4.bb =3D= blueman_2.3.5.bb} (97%) diff --git a/meta-networking/recipes-connectivity/blueman/blueman_2.3.4.b= b b/meta-networking/recipes-connectivity/blueman/blueman_2.3.5.bb similarity index 97% rename from meta-networking/recipes-connectivity/blueman/blueman_2.3.4.bb rename to meta-networking/recipes-connectivity/blueman/blueman_2.3.5.bb index 2822e8713..2343cec71 100644 --- a/meta-networking/recipes-connectivity/blueman/blueman_2.3.4.bb +++ b/meta-networking/recipes-connectivity/blueman/blueman_2.3.5.bb @@ -13,7 +13,7 @@ SRC_URI =3D " \ file://0001-meson-add-pythoninstalldir-option.patch \ " S =3D "${WORKDIR}/git" -SRCREV =3D "89bb5313a7cc24ca6fdbeaf2b02f6142dc1a8e60" +SRCREV =3D "c85e7afb8d6547d4c35b7b639124de8e999c3650" =20 EXTRA_OEMESON =3D "-Druntime_deps_check=3Dfalse -Dpythoninstalldir=3D${@= noprefix('PYTHON_SITEPACKAGES_DIR', d)}" =20 --=20 2.34.1
|
|
|
[meta-networking][PATCH] blueman: upgrade 2.34 -> 2.35
This fixes a nasty bug where the shown device list doesnt match the under= lying MAC list, resulting in connecting to a different device than selected. This fixes keyboard not being able to reconnect after disconnect. Signed-off-by: Markus Volk <f_l_k@...> --- .../blueman/{blueman_2.3.4.bb =3D> blueman_2.3.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-networking/recipes-connectivity/blueman/{blueman_2.3.4.bb =3D= blueman_2.3.5.bb} (97%) diff --git a/meta-networking/recipes-connectivity/blueman/blueman_2.3.4.b= b b/meta-networking/recipes-connectivity/blueman/blueman_2.3.5.bb similarity index 97% rename from meta-networking/recipes-connectivity/blueman/blueman_2.3.4.bb rename to meta-networking/recipes-connectivity/blueman/blueman_2.3.5.bb index 2822e8713..2343cec71 100644 --- a/meta-networking/recipes-connectivity/blueman/blueman_2.3.4.bb +++ b/meta-networking/recipes-connectivity/blueman/blueman_2.3.5.bb @@ -13,7 +13,7 @@ SRC_URI =3D " \ file://0001-meson-add-pythoninstalldir-option.patch \ " S =3D "${WORKDIR}/git" -SRCREV =3D "89bb5313a7cc24ca6fdbeaf2b02f6142dc1a8e60" +SRCREV =3D "c85e7afb8d6547d4c35b7b639124de8e999c3650" =20 EXTRA_OEMESON =3D "-Druntime_deps_check=3Dfalse -Dpythoninstalldir=3D${@= noprefix('PYTHON_SITEPACKAGES_DIR', d)}" =20 --=20 2.34.1
|
|
|
[meta-python][PATCH] python3-kmod: new package
From: Bartosz Golaszewski <bartosz.golaszewski@...> Add a recipe for python3-kmod - a python wrapper around libkmod. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@...> --- .../recipes-devtools/python/python3-kmod_0.9.1.bb | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-kmod_0.9.1.bb diff --git a/meta-python/recipes-devtools/python/python3-kmod_0.9.1.bb b/meta-python/recipes-devtools/python/python3-kmod_0.9.1.bb new file mode 100644 index 000000000..2ec4d474b --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-kmod_0.9.1.bb @@ -0,0 +1,14 @@ +SUMMARY = "Python bindings for kmod/libkmod." +HOMEPAGE = " https://github.com/agrover/python-kmod"+SECTION = "devel/python" +LICENSE = "LGPL-2.1-only" +LIC_FILES_CHKSUM = "file://COPYING;md5=6d62c2454850386a2ffe44f72db83d74" + +inherit pypi setuptools3 + +SRC_URI[sha256sum] = "f3bf829059bf88eca22f4f549e17aa316cdaa14302bf2ba49ddeee60cea109ff" + +DEPENDS += " \ + kmod \ + python3-cython-native \ +" -- 2.37.2
|
|
|
[meta-oe][PATCH] nss: fix cross-compilation error
Change OS_TEST to be soft assignment so that the cross-compilation
doens't fail with the errors like (note the difference in CPU tags):
| make[4]: *** No rule to make target
'../certhigh/Linux3.4_x86_64_glibc_PTH_64_OPT.OBJ/certhtml.o', needed by
'Linux3.4_aarch64_glibc_PTH_64_OPT.OBJ/libnss3.so'. Stop.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@...>
---
.../nss/nss/0001-nss-fix-support-cross-compiling.patch | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch b/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch
index eb6174a7b016..950fae667a8c 100644
--- a/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch
+++ b/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch
@@ -18,7 +18,12 @@ diff --git a/nss/coreconf/arch.mk b/nss/coreconf/arch.mk
index 2012d18..78fca62 100644
--- a/nss/coreconf/arch.mk
+++ b/nss/coreconf/arch.mk
-@@ -30,7 +30,7 @@ OS_TEST := $(shell uname -m)
+@@ -26,11 +26,11 @@ OS_ARCH := $(subst /,_,$(shell uname -s)
+ # Attempt to differentiate between sparc and x86 Solaris
+ #
+
+-OS_TEST := $(shell uname -m)
++OS_TEST ?= $(shell uname -m)
ifeq ($(OS_TEST),i86pc)
OS_RELEASE := $(shell uname -r)_$(OS_TEST)
else
--
2.30.2
|
|
|
[meta-secure-core][kirkstone][PATCH 1/1] Signed-off-by: Manoj Saun <manojsingh.saun@windriver.com>
Manoj Saun <manojsingh.saun@...>
-> nginx: fix CVE-2022-41741 -> nginx: disabled duplicate atoms. -> Reference: -> https://nvd.nist.gov/vuln/detail/CVE-2022-41742-> Upstream fixes: -> https://github.com/nginx/nginx/commit/0d23105373e6d8a720b9826079c077b9b4be919d--- .../0001-Mp4-disabled-duplicate-atoms.patch | 313 ++++++++++++++++++ meta-webserver/recipes-httpd/nginx/nginx.inc | 1 + 2 files changed, 314 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch new file mode 100644 index 000000000..0b0753c4c --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch @@ -0,0 +1,313 @@ +From 0d23105373e6d8a720b9826079c077b9b4be919d Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan <arut@...> +Date: Wed, 19 Oct 2022 10:53:17 +0300 +Subject: [PATCH] Mp4: disabled duplicate atoms. + +Most atoms should not appear more than once in a container. Previously, +this was not enforced by the module, which could result in worker process +crash, memory corruption and disclosure. +--- + src/http/modules/ngx_http_mp4_module.c | 147 +++++++++++++++++++++++++ + 1 file changed, 147 insertions(+) + +diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c +index 5721efbe..75a7315f 100644 +--- a/src/http/modules/ngx_http_mp4_module.c ++++ b/src/http/modules/ngx_http_mp4_module.c +@@ -1121,6 +1121,12 @@ ngx_http_mp4_read_ftyp_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + return NGX_ERROR; + } + ++ if (mp4->ftyp_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 ftyp atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + ftyp_atom = ngx_palloc(mp4->request->pool, atom_size); +@@ -1179,6 +1185,12 @@ ngx_http_mp4_read_moov_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + return NGX_DECLINED; + } + ++ if (mp4->moov_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 moov atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + conf = ngx_http_get_module_loc_conf(mp4->request, ngx_http_mp4_module); + + if (atom_data_size > mp4->buffer_size) { +@@ -1246,6 +1258,12 @@ ngx_http_mp4_read_mdat_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mdat atom"); + ++ if (mp4->mdat_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdat atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + data = &mp4->mdat_data_buf; + data->file = &mp4->file; + data->in_file = 1; +@@ -1372,6 +1390,12 @@ ngx_http_mp4_read_mvhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mvhd atom"); + ++ if (mp4->mvhd_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mvhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom_header = ngx_mp4_atom_header(mp4); + mvhd_atom = (ngx_mp4_mvhd_atom_t *) atom_header; + mvhd64_atom = (ngx_mp4_mvhd64_atom_t *) atom_header; +@@ -1637,6 +1661,13 @@ ngx_http_mp4_read_tkhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_TKHD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 tkhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->tkhd_size = atom_size; + trak->movie_duration = duration; + +@@ -1676,6 +1707,12 @@ ngx_http_mp4_read_mdia_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_MDIA_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdia atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->mdia_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1799,6 +1836,13 @@ ngx_http_mp4_read_mdhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_MDHD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->mdhd_size = atom_size; + trak->timescale = timescale; + trak->duration = duration; +@@ -1862,6 +1906,12 @@ ngx_http_mp4_read_hdlr_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_HDLR_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 hdlr atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->hdlr_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1890,6 +1940,12 @@ ngx_http_mp4_read_minf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_MINF_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 minf atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->minf_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1933,6 +1989,15 @@ ngx_http_mp4_read_vmhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 vmhd/smhd atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->vmhd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1964,6 +2029,15 @@ ngx_http_mp4_read_smhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 vmhd/smhd atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->smhd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1995,6 +2069,12 @@ ngx_http_mp4_read_dinf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_DINF_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 dinf atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->dinf_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2023,6 +2103,12 @@ ngx_http_mp4_read_stbl_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_STBL_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stbl atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->stbl_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2144,6 +2230,12 @@ ngx_http_mp4_read_stsd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_STSD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->stsd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2212,6 +2304,13 @@ ngx_http_mp4_read_stts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STTS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stts atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->time_to_sample_entries = entries; + + atom = &trak->stts_atom_buf; +@@ -2480,6 +2579,13 @@ ngx_http_mp4_read_stss_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "sync sample entries:%uD", entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stss atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sync_samples_entries = entries; + + atom_table = atom_header + sizeof(ngx_http_mp4_stss_atom_t); +@@ -2678,6 +2784,13 @@ ngx_http_mp4_read_ctts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "composition offset entries:%uD", entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_CTTS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 ctts atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->composition_offset_entries = entries; + + atom_table = atom_header + sizeof(ngx_mp4_ctts_atom_t); +@@ -2881,6 +2994,13 @@ ngx_http_mp4_read_stsc_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSC_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsc atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sample_to_chunk_entries = entries; + + atom = &trak->stsc_atom_buf; +@@ -3213,6 +3333,13 @@ ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "sample uniform size:%uD, entries:%uD", size, entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSZ_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsz atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sample_sizes_entries = entries; + + atom_table = atom_header + sizeof(ngx_mp4_stsz_atom_t); +@@ -3396,6 +3523,16 @@ ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(uint32_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stco/co64 atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->chunks = entries; + + atom = &trak->stco_atom_buf; +@@ -3602,6 +3739,16 @@ ngx_http_mp4_read_co64_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(uint64_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stco/co64 atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->chunks = entries; + + atom = &trak->co64_atom_buf; +-- +2.34.1 + diff --git a/meta-webserver/recipes-httpd/nginx/nginx.inc b/meta-webserver/recipes-httpd/nginx/nginx.inc index dfced3330..754290d3a 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx.inc +++ b/meta-webserver/recipes-httpd/nginx/nginx.inc @@ -22,6 +22,7 @@ SRC_URI = " \ file://nginx-volatile.conf \ file://nginx.service \ file://nginx-fix-pidfile.patch \ + file://0001-Mp4-disabled-duplicate-atoms.patch \ " inherit siteinfo update-rc.d useradd systemd -- 2.34.1
|
|
|
[meta-openembedded][PATCH 1/1] Signed-off-by: Manoj Saun <manojsingh.saun@windriver.com>
Manoj Saun <manojsingh.saun@...>
-> nginx: fix CVE-2022-41741 -> nginx: disabled duplicate atoms. -> Reference: -> https://nvd.nist.gov/vuln/detail/CVE-2022-41742-> Upstream fixes: -> https://github.com/nginx/nginx/commit/0d23105373e6d8a720b9826079c077b9b4be919d--- .../0001-Mp4-disabled-duplicate-atoms.patch | 313 ++++++++++++++++++ meta-webserver/recipes-httpd/nginx/nginx.inc | 1 + 2 files changed, 314 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch new file mode 100644 index 000000000..0b0753c4c --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch @@ -0,0 +1,313 @@ +From 0d23105373e6d8a720b9826079c077b9b4be919d Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan <arut@...> +Date: Wed, 19 Oct 2022 10:53:17 +0300 +Subject: [PATCH] Mp4: disabled duplicate atoms. + +Most atoms should not appear more than once in a container. Previously, +this was not enforced by the module, which could result in worker process +crash, memory corruption and disclosure. +--- + src/http/modules/ngx_http_mp4_module.c | 147 +++++++++++++++++++++++++ + 1 file changed, 147 insertions(+) + +diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c +index 5721efbe..75a7315f 100644 +--- a/src/http/modules/ngx_http_mp4_module.c ++++ b/src/http/modules/ngx_http_mp4_module.c +@@ -1121,6 +1121,12 @@ ngx_http_mp4_read_ftyp_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + return NGX_ERROR; + } + ++ if (mp4->ftyp_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 ftyp atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + ftyp_atom = ngx_palloc(mp4->request->pool, atom_size); +@@ -1179,6 +1185,12 @@ ngx_http_mp4_read_moov_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + return NGX_DECLINED; + } + ++ if (mp4->moov_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 moov atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + conf = ngx_http_get_module_loc_conf(mp4->request, ngx_http_mp4_module); + + if (atom_data_size > mp4->buffer_size) { +@@ -1246,6 +1258,12 @@ ngx_http_mp4_read_mdat_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mdat atom"); + ++ if (mp4->mdat_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdat atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + data = &mp4->mdat_data_buf; + data->file = &mp4->file; + data->in_file = 1; +@@ -1372,6 +1390,12 @@ ngx_http_mp4_read_mvhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mvhd atom"); + ++ if (mp4->mvhd_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mvhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom_header = ngx_mp4_atom_header(mp4); + mvhd_atom = (ngx_mp4_mvhd_atom_t *) atom_header; + mvhd64_atom = (ngx_mp4_mvhd64_atom_t *) atom_header; +@@ -1637,6 +1661,13 @@ ngx_http_mp4_read_tkhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_TKHD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 tkhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->tkhd_size = atom_size; + trak->movie_duration = duration; + +@@ -1676,6 +1707,12 @@ ngx_http_mp4_read_mdia_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_MDIA_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdia atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->mdia_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1799,6 +1836,13 @@ ngx_http_mp4_read_mdhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_MDHD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->mdhd_size = atom_size; + trak->timescale = timescale; + trak->duration = duration; +@@ -1862,6 +1906,12 @@ ngx_http_mp4_read_hdlr_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_HDLR_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 hdlr atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->hdlr_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1890,6 +1940,12 @@ ngx_http_mp4_read_minf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_MINF_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 minf atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->minf_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1933,6 +1989,15 @@ ngx_http_mp4_read_vmhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 vmhd/smhd atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->vmhd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1964,6 +2029,15 @@ ngx_http_mp4_read_smhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 vmhd/smhd atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->smhd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1995,6 +2069,12 @@ ngx_http_mp4_read_dinf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_DINF_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 dinf atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->dinf_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2023,6 +2103,12 @@ ngx_http_mp4_read_stbl_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_STBL_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stbl atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->stbl_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2144,6 +2230,12 @@ ngx_http_mp4_read_stsd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_STSD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->stsd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2212,6 +2304,13 @@ ngx_http_mp4_read_stts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STTS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stts atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->time_to_sample_entries = entries; + + atom = &trak->stts_atom_buf; +@@ -2480,6 +2579,13 @@ ngx_http_mp4_read_stss_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "sync sample entries:%uD", entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stss atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sync_samples_entries = entries; + + atom_table = atom_header + sizeof(ngx_http_mp4_stss_atom_t); +@@ -2678,6 +2784,13 @@ ngx_http_mp4_read_ctts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "composition offset entries:%uD", entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_CTTS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 ctts atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->composition_offset_entries = entries; + + atom_table = atom_header + sizeof(ngx_mp4_ctts_atom_t); +@@ -2881,6 +2994,13 @@ ngx_http_mp4_read_stsc_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSC_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsc atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sample_to_chunk_entries = entries; + + atom = &trak->stsc_atom_buf; +@@ -3213,6 +3333,13 @@ ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "sample uniform size:%uD, entries:%uD", size, entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSZ_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsz atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sample_sizes_entries = entries; + + atom_table = atom_header + sizeof(ngx_mp4_stsz_atom_t); +@@ -3396,6 +3523,16 @@ ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(uint32_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stco/co64 atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->chunks = entries; + + atom = &trak->stco_atom_buf; +@@ -3602,6 +3739,16 @@ ngx_http_mp4_read_co64_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(uint64_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stco/co64 atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->chunks = entries; + + atom = &trak->co64_atom_buf; +-- +2.34.1 + diff --git a/meta-webserver/recipes-httpd/nginx/nginx.inc b/meta-webserver/recipes-httpd/nginx/nginx.inc index 260f5f320..c6116d0db 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx.inc +++ b/meta-webserver/recipes-httpd/nginx/nginx.inc @@ -22,6 +22,7 @@ SRC_URI = " \ file://nginx-volatile.conf \ file://nginx.service \ file://nginx-fix-pidfile.patch \ + file://0001-Mp4-disabled-duplicate-atoms.patch\ " inherit siteinfo update-rc.d useradd systemd -- 2.34.1
|
|
|
Re: [meta-openembedded][PATCH 1/1] Signed-off-by: Manoj Saun <manojsingh.saun@windriver.com>
Manoj Saun <manojsingh.saun@...>
Hi All,
Please ignore the below email.
Thanks
Manoj Saun
toggle quoted message
Show quoted text
From: Manoj Saun <manojsingh.saun@...>
Sent: Thursday, November 24, 2022 12:27 PM
To: openembedded-devel@... <openembedded-devel@...>
Cc: Mali, Narpat <Narpat.Mali@...>; Saun, Manoj Singh <ManojSingh.Saun@...>
Subject: [meta-openembedded][PATCH 1/1] Signed-off-by: Manoj Saun <manojsingh.saun@...>
-> nginx: fix CVE-2022-41741
-> nginx: disabled duplicate atoms.
-> Reference:
-> https://nvd.nist.gov/vuln/detail/CVE-2022-41742
-> Upstream fixes:
->
https://github.com/nginx/nginx/commit/0d23105373e6d8a720b9826079c077b9b4be919d
-> (LOCAL REV: NOT UPSTREAM) -- Not applicable, upstream out of maintenance
---
.../0001-Mp4-disabled-duplicate-atoms.patch | 313 ++++++++++++++++++
meta-webserver/recipes-httpd/nginx/nginx.inc | 1 +
2 files changed, 314 insertions(+)
create mode 100644 meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch
diff --git a/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch
new file mode 100644
index 000000000..0b0753c4c
--- /dev/null
+++ b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch
@@ -0,0 +1,313 @@
+From 0d23105373e6d8a720b9826079c077b9b4be919d Mon Sep 17 00:00:00 2001
+From: Roman Arutyunyan <arut@...>
+Date: Wed, 19 Oct 2022 10:53:17 +0300
+Subject: [PATCH] Mp4: disabled duplicate atoms.
+
+Most atoms should not appear more than once in a container. Previously,
+this was not enforced by the module, which could result in worker process
+crash, memory corruption and disclosure.
+---
+ src/http/modules/ngx_http_mp4_module.c | 147 +++++++++++++++++++++++++
+ 1 file changed, 147 insertions(+)
+
+diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
+index 5721efbe..75a7315f 100644
+--- a/src/http/modules/ngx_http_mp4_module.c
++++ b/src/http/modules/ngx_http_mp4_module.c
+@@ -1121,6 +1121,12 @@ ngx_http_mp4_read_ftyp_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ return NGX_ERROR;
+ }
+
++ if (mp4->ftyp_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 ftyp atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size;
+
+ ftyp_atom = ngx_palloc(mp4->request->pool, atom_size);
+@@ -1179,6 +1185,12 @@ ngx_http_mp4_read_moov_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ return NGX_DECLINED;
+ }
+
++ if (mp4->moov_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 moov atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ conf = ngx_http_get_module_loc_conf(mp4->request, ngx_http_mp4_module);
+
+ if (atom_data_size > mp4->buffer_size) {
+@@ -1246,6 +1258,12 @@ ngx_http_mp4_read_mdat_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mdat atom");
+
++ if (mp4->mdat_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mdat atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ data = &mp4->mdat_data_buf;
+ data->file = &mp4->file;
+ data->in_file = 1;
+@@ -1372,6 +1390,12 @@ ngx_http_mp4_read_mvhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mvhd atom");
+
++ if (mp4->mvhd_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mvhd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom_header = ngx_mp4_atom_header(mp4);
+ mvhd_atom = (ngx_mp4_mvhd_atom_t *) atom_header;
+ mvhd64_atom = (ngx_mp4_mvhd64_atom_t *) atom_header;
+@@ -1637,6 +1661,13 @@ ngx_http_mp4_read_tkhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size;
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_TKHD_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 tkhd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->tkhd_size = atom_size;
+ trak->movie_duration = duration;
+
+@@ -1676,6 +1707,12 @@ ngx_http_mp4_read_mdia_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_MDIA_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mdia atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->mdia_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1799,6 +1836,13 @@ ngx_http_mp4_read_mdhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size;
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_MDHD_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mdhd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->mdhd_size = atom_size;
+ trak->timescale = timescale;
+ trak->duration = duration;
+@@ -1862,6 +1906,12 @@ ngx_http_mp4_read_hdlr_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_HDLR_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 hdlr atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->hdlr_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1890,6 +1940,12 @@ ngx_http_mp4_read_minf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_MINF_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 minf atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->minf_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1933,6 +1989,15 @@ ngx_http_mp4_read_vmhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 vmhd/smhd atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->vmhd_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1964,6 +2029,15 @@ ngx_http_mp4_read_smhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 vmhd/smhd atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->smhd_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1995,6 +2069,12 @@ ngx_http_mp4_read_dinf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_DINF_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 dinf atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->dinf_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -2023,6 +2103,12 @@ ngx_http_mp4_read_stbl_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_STBL_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stbl atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->stbl_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -2144,6 +2230,12 @@ ngx_http_mp4_read_stsd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_STSD_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stsd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->stsd_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -2212,6 +2304,13 @@ ngx_http_mp4_read_stts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STTS_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stts atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->time_to_sample_entries = entries;
+
+ atom = &trak->stts_atom_buf;
+@@ -2480,6 +2579,13 @@ ngx_http_mp4_read_stss_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ "sync sample entries:%uD", entries);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STSS_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stss atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->sync_samples_entries = entries;
+
+ atom_table = atom_header + sizeof(ngx_http_mp4_stss_atom_t);
+@@ -2678,6 +2784,13 @@ ngx_http_mp4_read_ctts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ "composition offset entries:%uD", entries);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_CTTS_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 ctts atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->composition_offset_entries = entries;
+
+ atom_table = atom_header + sizeof(ngx_mp4_ctts_atom_t);
+@@ -2881,6 +2994,13 @@ ngx_http_mp4_read_stsc_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STSC_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stsc atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->sample_to_chunk_entries = entries;
+
+ atom = &trak->stsc_atom_buf;
+@@ -3213,6 +3333,13 @@ ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ "sample uniform size:%uD, entries:%uD", size, entries);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STSZ_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stsz atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->sample_sizes_entries = entries;
+
+ atom_table = atom_header + sizeof(ngx_mp4_stsz_atom_t);
+@@ -3396,6 +3523,16 @@ ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(uint32_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stco/co64 atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->chunks = entries;
+
+ atom = &trak->stco_atom_buf;
+@@ -3602,6 +3739,16 @@ ngx_http_mp4_read_co64_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(uint64_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stco/co64 atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->chunks = entries;
+
+ atom = &trak->co64_atom_buf;
+--
+2.34.1
+
diff --git a/meta-webserver/recipes-httpd/nginx/nginx.inc b/meta-webserver/recipes-httpd/nginx/nginx.inc
index 260f5f320..c6116d0db 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx.inc
+++ b/meta-webserver/recipes-httpd/nginx/nginx.inc
@@ -22,6 +22,7 @@ SRC_URI = " \
file://nginx-volatile.conf \
file://nginx.service \
file://nginx-fix-pidfile.patch \
+ file://0001-Mp4-disabled-duplicate-atoms.patch\
"
inherit siteinfo update-rc.d useradd systemd
--
2.34.1
|
|
|
[meta-openembedded][PATCH 1/1] Signed-off-by: Manoj Saun <manojsingh.saun@windriver.com>
Manoj Saun <manojsingh.saun@...>
-> nginx: fix CVE-2022-41741 -> nginx: disabled duplicate atoms. -> Reference: -> https://nvd.nist.gov/vuln/detail/CVE-2022-41742-> Upstream fixes: -> https://github.com/nginx/nginx/commit/0d23105373e6d8a720b9826079c077b9b4be919d-> (LOCAL REV: NOT UPSTREAM) -- Not applicable, upstream out of maintenance --- .../0001-Mp4-disabled-duplicate-atoms.patch | 313 ++++++++++++++++++ meta-webserver/recipes-httpd/nginx/nginx.inc | 1 + 2 files changed, 314 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch new file mode 100644 index 000000000..0b0753c4c --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/0001-Mp4-disabled-duplicate-atoms.patch @@ -0,0 +1,313 @@ +From 0d23105373e6d8a720b9826079c077b9b4be919d Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan <arut@...> +Date: Wed, 19 Oct 2022 10:53:17 +0300 +Subject: [PATCH] Mp4: disabled duplicate atoms. + +Most atoms should not appear more than once in a container. Previously, +this was not enforced by the module, which could result in worker process +crash, memory corruption and disclosure. +--- + src/http/modules/ngx_http_mp4_module.c | 147 +++++++++++++++++++++++++ + 1 file changed, 147 insertions(+) + +diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c +index 5721efbe..75a7315f 100644 +--- a/src/http/modules/ngx_http_mp4_module.c ++++ b/src/http/modules/ngx_http_mp4_module.c +@@ -1121,6 +1121,12 @@ ngx_http_mp4_read_ftyp_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + return NGX_ERROR; + } + ++ if (mp4->ftyp_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 ftyp atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + ftyp_atom = ngx_palloc(mp4->request->pool, atom_size); +@@ -1179,6 +1185,12 @@ ngx_http_mp4_read_moov_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + return NGX_DECLINED; + } + ++ if (mp4->moov_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 moov atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + conf = ngx_http_get_module_loc_conf(mp4->request, ngx_http_mp4_module); + + if (atom_data_size > mp4->buffer_size) { +@@ -1246,6 +1258,12 @@ ngx_http_mp4_read_mdat_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mdat atom"); + ++ if (mp4->mdat_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdat atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + data = &mp4->mdat_data_buf; + data->file = &mp4->file; + data->in_file = 1; +@@ -1372,6 +1390,12 @@ ngx_http_mp4_read_mvhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mvhd atom"); + ++ if (mp4->mvhd_atom.buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mvhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom_header = ngx_mp4_atom_header(mp4); + mvhd_atom = (ngx_mp4_mvhd_atom_t *) atom_header; + mvhd64_atom = (ngx_mp4_mvhd64_atom_t *) atom_header; +@@ -1637,6 +1661,13 @@ ngx_http_mp4_read_tkhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_TKHD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 tkhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->tkhd_size = atom_size; + trak->movie_duration = duration; + +@@ -1676,6 +1707,12 @@ ngx_http_mp4_read_mdia_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_MDIA_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdia atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->mdia_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1799,6 +1836,13 @@ ngx_http_mp4_read_mdhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size; + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_MDHD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 mdhd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->mdhd_size = atom_size; + trak->timescale = timescale; + trak->duration = duration; +@@ -1862,6 +1906,12 @@ ngx_http_mp4_read_hdlr_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_HDLR_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 hdlr atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->hdlr_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1890,6 +1940,12 @@ ngx_http_mp4_read_minf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_MINF_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 minf atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->minf_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1933,6 +1989,15 @@ ngx_http_mp4_read_vmhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 vmhd/smhd atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->vmhd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1964,6 +2029,15 @@ ngx_http_mp4_read_smhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 vmhd/smhd atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->smhd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -1995,6 +2069,12 @@ ngx_http_mp4_read_dinf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_DINF_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 dinf atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->dinf_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2023,6 +2103,12 @@ ngx_http_mp4_read_stbl_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_STBL_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stbl atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->stbl_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2144,6 +2230,12 @@ ngx_http_mp4_read_stsd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + + trak = ngx_mp4_last_trak(mp4); + ++ if (trak->out[NGX_HTTP_MP4_STSD_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsd atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + atom = &trak->stsd_atom_buf; + atom->temporary = 1; + atom->pos = atom_header; +@@ -2212,6 +2304,13 @@ ngx_http_mp4_read_stts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STTS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stts atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->time_to_sample_entries = entries; + + atom = &trak->stts_atom_buf; +@@ -2480,6 +2579,13 @@ ngx_http_mp4_read_stss_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "sync sample entries:%uD", entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stss atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sync_samples_entries = entries; + + atom_table = atom_header + sizeof(ngx_http_mp4_stss_atom_t); +@@ -2678,6 +2784,13 @@ ngx_http_mp4_read_ctts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "composition offset entries:%uD", entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_CTTS_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 ctts atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->composition_offset_entries = entries; + + atom_table = atom_header + sizeof(ngx_mp4_ctts_atom_t); +@@ -2881,6 +2994,13 @@ ngx_http_mp4_read_stsc_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSC_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsc atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sample_to_chunk_entries = entries; + + atom = &trak->stsc_atom_buf; +@@ -3213,6 +3333,13 @@ ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + "sample uniform size:%uD, entries:%uD", size, entries); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STSZ_ATOM].buf) { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stsz atom in \"%s\"", mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->sample_sizes_entries = entries; + + atom_table = atom_header + sizeof(ngx_mp4_stsz_atom_t); +@@ -3396,6 +3523,16 @@ ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(uint32_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stco/co64 atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->chunks = entries; + + atom = &trak->stco_atom_buf; +@@ -3602,6 +3739,16 @@ ngx_http_mp4_read_co64_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size) + atom_end = atom_table + entries * sizeof(uint64_t); + + trak = ngx_mp4_last_trak(mp4); ++ ++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf ++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf) ++ { ++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, ++ "duplicate mp4 stco/co64 atom in \"%s\"", ++ mp4->file.name.data); ++ return NGX_ERROR; ++ } ++ + trak->chunks = entries; + + atom = &trak->co64_atom_buf; +-- +2.34.1 + diff --git a/meta-webserver/recipes-httpd/nginx/nginx.inc b/meta-webserver/recipes-httpd/nginx/nginx.inc index 260f5f320..c6116d0db 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx.inc +++ b/meta-webserver/recipes-httpd/nginx/nginx.inc @@ -22,6 +22,7 @@ SRC_URI = " \ file://nginx-volatile.conf \ file://nginx.service \ file://nginx-fix-pidfile.patch \ + file://0001-Mp4-disabled-duplicate-atoms.patch\ " inherit siteinfo update-rc.d useradd systemd -- 2.34.1
|
|
|
langdale merge request Nov 24th
Armin Kuster
The following changes since commit c5668905a6d8a78fb72c2cbf8b20e91e686ceb86: meta-openemnedded: Add myself as langdale maintainer (2022-10-22 15:59:34 -0700) are available in the Git repository at: https://git.openembedded.org/meta-openembedded langdale-next for you to fetch changes up to c354f92778c1d4bcd3680af7e0fb0d1414de2344: chrony: Remove the libcap and nss PACKAGECONFIGs (2022-11-18 10:11:45 -0500) ---------------------------------------------------------------- Alex Kiernan (1): lldpd: Upgrade 1.0.14 -> 1.0.15 Armin Kuster (1): meta-oe][PATCH] gst-editing-services: fix typo in LICENSE field. Leon Anavi (1): python3-pythonping: Upgrade 1.1.3 -> 1.1.4 Markus Volk (1): libcamera: upgrade -> 0.0.1 Martin Jansa (1): monkey: use git fetcher Peter Kjellerstedt (2): chrony: Make it possible to enable editline support again chrony: Remove the libcap and nss PACKAGECONFIGs Peter Marko (1): cpputest: remove dev package dependency Robert Joslyn (1): fwupd: Fix plugin_gpio PACKAGECONFIG Wang Mingyu (23): bats: upgrade 1.8.0 -> 1.8.2 ctags: upgrade 5.9.20221009.0 -> 5.9.20221016.0 fvwm: upgrade 2.6.9 -> 2.7.0 makedumpfile: upgrade 1.7.1 -> 1.7.2 sanlock: upgrade 3.8.4 -> 3.8.5 python3-astroid: upgrade 2.12.11 -> 2.12.12 python3-charset-normalizer: upgrade 2.1.1 -> 3.0.0 python3-google-api-python-client: upgrade 2.64.0 -> 2.65.0 python3-google-auth: upgrade 2.12.0 -> 2.13.0 python3-huey: upgrade 2.4.3 -> 2.4.4 python3-oauthlib: upgrade 3.2.1 -> 3.2.2 python3-pandas: upgrade 1.5.0 -> 1.5.1 python3-pika: upgrade 1.3.0 -> 1.3.1 python3-protobuf: upgrade 4.21.7 -> 4.21.8 python3-pywbemtools: upgrade 1.0.0 -> 1.0.1 python3-socketio: upgrade 5.7.1 -> 5.7.2 python3-sqlalchemy: upgrade 1.4.41 -> 1.4.42 tracker: upgrade 3.4.0 -> 3.4.1 wolfssl: upgrade 5.5.1 -> 5.5.2 cglm: upgrade 0.8.5 -> 0.8.7 ctags: upgrade 5.9.20221016.0 -> 5.9.20221023.0 function2: upgrade 4.2.1 -> 4.2.2 poco: upgrade 1.12.2 -> 1.12.3 Xiangyu Chen (1): ipmitool: fix typo in .bb file's comments, using = instead of =? zhengruoqin (2): tcpslice: upgrade 1.5 -> 1.6 tio: upgrade 2.1 -> 2.2 meta-gnome/recipes-gnome/tracker/{tracker_3.4.0.bb => tracker_3.4.1.bb} | 2 +- .../recipes-multimedia/libcamera/{libcamera.bb => libcamera_0.0.1.bb} | 18 +++++------------- .../recipes-connectivity/wolfssl/{wolfssl_5.5.1.bb => wolfssl_5.5.2.bb} | 2 +- .../recipes-daemons/lldpd/{lldpd_1.0.14.bb => lldpd_1.0.15.bb} | 4 ++-- meta-networking/recipes-support/chrony/chrony_4.3.bb | 19 +++++++------------ .../recipes-support/tcpdump/{tcpslice_1.5.bb => tcpslice_1.6.bb} | 3 +-- meta-oe/recipes-bsp/fwupd/fwupd_1.8.4.bb | 2 +- .../ctags/{ctags_5.9.20221009.0.bb => ctags_5.9.20221023.0.bb} | 2 +- .../recipes-devtools/gst-editing-services/gst-editing-services_1.20.4.bb | 2 +- meta-oe/recipes-extended/sanlock/sanlock/setuptools.patch | 18 ------------------ meta-oe/recipes-extended/sanlock/{sanlock_3.8.4.bb => sanlock_3.8.5.bb} | 3 +-- meta-oe/recipes-graphics/cglm/{cglm_0.8.5.bb => cglm_0.8.7.bb} | 2 +- meta-oe/recipes-graphics/fvwm/{fvwm_2.6.9.bb => fvwm_2.7.0.bb} | 2 +- meta-oe/recipes-kernel/ipmitool/ipmitool_1.8.19.bb | 2 +- .../makedumpfile/{makedumpfile_1.7.1.bb => makedumpfile_1.7.2.bb} | 2 +- .../recipes-support/function2/{function2_4.2.1.bb => function2_4.2.2.bb} | 2 +- meta-oe/recipes-support/poco/{poco_1.12.2.bb => poco_1.12.3.bb} | 2 +- meta-oe/recipes-support/tio/{tio_2.1.bb => tio_2.2.bb} | 2 +- meta-oe/recipes-test/bats/{bats_1.8.0.bb => bats_1.8.2.bb} | 2 +- meta-oe/recipes-test/cpputest/cpputest_4.0.bb | 2 ++ .../python/{python3-astroid_2.12.11.bb => python3-astroid_2.12.12.bb} | 2 +- ...n3-charset-normalizer_2.1.1.bb => python3-charset-normalizer_3.0.0.bb} | 2 +- ...python-client_2.64.0.bb => python3-google-api-python-client_2.65.0.bb} | 2 +- .../{python3-google-auth_2.12.0.bb => python3-google-auth_2.13.0.bb} | 2 +- .../python/{python3-huey_2.4.3.bb => python3-huey_2.4.4.bb} | 2 +- .../python/{python3-oauthlib_3.2.1.bb => python3-oauthlib_3.2.2.bb} | 2 +- .../python/{python3-pandas_1.5.0.bb => python3-pandas_1.5.1.bb} | 2 +- .../python/{python3-pika_1.3.0.bb => python3-pika_1.3.1.bb} | 2 +- .../python/{python3-protobuf_4.21.7.bb => python3-protobuf_4.21.8.bb} | 2 +- .../python/{python3-pythonping_1.1.3.bb => python3-pythonping_1.1.4.bb} | 2 +- .../python/{python3-socketio_5.7.1.bb => python3-socketio_5.7.2.bb} | 2 +- .../python/{python3-sqlalchemy_1.4.41.bb => python3-sqlalchemy_1.4.42.bb} | 2 +- .../{python3-pywbemtools_1.0.0.bb => python3-pywbemtools_1.0.1.bb} | 2 +- meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb | 5 +++-- 34 files changed, 47 insertions(+), 77 deletions(-) rename meta-gnome/recipes-gnome/tracker/{tracker_3.4.0.bb => tracker_3.4.1.bb} (93%) rename meta-multimedia/recipes-multimedia/libcamera/{libcamera.bb => libcamera_0.0.1.bb} (74%) rename meta-networking/recipes-connectivity/wolfssl/{wolfssl_5.5.1.bb => wolfssl_5.5.2.bb} (93%) rename meta-networking/recipes-daemons/lldpd/{lldpd_1.0.14.bb => lldpd_1.0.15.bb} (95%) rename meta-networking/recipes-support/tcpdump/{tcpslice_1.5.bb => tcpslice_1.6.bb} (80%) rename meta-oe/recipes-devtools/ctags/{ctags_5.9.20221009.0.bb => ctags_5.9.20221023.0.bb} (95%) delete mode 100644 meta-oe/recipes-extended/sanlock/sanlock/setuptools.patch rename meta-oe/recipes-extended/sanlock/{sanlock_3.8.4.bb => sanlock_3.8.5.bb} (95%) rename meta-oe/recipes-graphics/cglm/{cglm_0.8.5.bb => cglm_0.8.7.bb} (93%) rename meta-oe/recipes-graphics/fvwm/{fvwm_2.6.9.bb => fvwm_2.7.0.bb} (98%) rename meta-oe/recipes-kernel/makedumpfile/{makedumpfile_1.7.1.bb => makedumpfile_1.7.2.bb} (96%) rename meta-oe/recipes-support/function2/{function2_4.2.1.bb => function2_4.2.2.bb} (92%) rename meta-oe/recipes-support/poco/{poco_1.12.2.bb => poco_1.12.3.bb} (98%) rename meta-oe/recipes-support/tio/{tio_2.1.bb => tio_2.2.bb} (91%) rename meta-oe/recipes-test/bats/{bats_1.8.0.bb => bats_1.8.2.bb} (95%) rename meta-python/recipes-devtools/python/{python3-astroid_2.12.11.bb => python3-astroid_2.12.12.bb} (89%) rename meta-python/recipes-devtools/python/{python3-charset-normalizer_2.1.1.bb => python3-charset-normalizer_3.0.0.bb} (82%) rename meta-python/recipes-devtools/python/{python3-google-api-python-client_2.64.0.bb => python3-google-api-python-client_2.65.0.bb} (86%) rename meta-python/recipes-devtools/python/{python3-google-auth_2.12.0.bb => python3-google-auth_2.13.0.bb} (87%) rename meta-python/recipes-devtools/python/{python3-huey_2.4.3.bb => python3-huey_2.4.4.bb} (78%) rename meta-python/recipes-devtools/python/{python3-oauthlib_3.2.1.bb => python3-oauthlib_3.2.2.bb} (92%) rename meta-python/recipes-devtools/python/{python3-pandas_1.5.0.bb => python3-pandas_1.5.1.bb} (89%) rename meta-python/recipes-devtools/python/{python3-pika_1.3.0.bb => python3-pika_1.3.1.bb} (87%) rename meta-python/recipes-devtools/python/{python3-protobuf_4.21.7.bb => python3-protobuf_4.21.8.bb} (92%) rename meta-python/recipes-devtools/python/{python3-pythonping_1.1.3.bb => python3-pythonping_1.1.4.bb} (77%) rename meta-python/recipes-devtools/python/{python3-socketio_5.7.1.bb => python3-socketio_5.7.2.bb} (89%) rename meta-python/recipes-devtools/python/{python3-sqlalchemy_1.4.41.bb => python3-sqlalchemy_1.4.42.bb} (87%) rename meta-python/recipes-extended/pywbemtools/{python3-pywbemtools_1.0.0.bb => python3-pywbemtools_1.0.1.bb} (92%)
|
|
|
[meta-openembedded][kirkstone][PATCH 1/1] syslog-ng: fix CVE-2022-38725
Fix buffer handling of syslog and timestamp parsers.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-38725
https://github.com/syslog-ng/syslog-ng/releases
https://github.com/syslog-ng/syslog-ng/pull/4110
Upstream patches:
https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
Signed-off-by: Yogita Urade <yogita.urade@...>
---
.../syslog-ng/files/CVE-2022-38725-0001.patch | 67 ++++++
.../syslog-ng/files/CVE-2022-38725-0002.patch | 152 +++++++++++++
.../syslog-ng/files/CVE-2022-38725-0003.patch | 79 +++++++
.../syslog-ng/files/CVE-2022-38725-0004.patch | 40 ++++
.../syslog-ng/files/CVE-2022-38725-0005.patch | 213 ++++++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0006.patch | 182 +++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0007.patch | 84 +++++++
.../syslog-ng/files/CVE-2022-38725-0008.patch | 47 ++++
.../syslog-ng/syslog-ng_3.36.1.bb | 8 +
9 files changed, 872 insertions(+)
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
new file mode 100644
index 000000000..cd6a93d8e
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
@@ -0,0 +1,67 @@
+From c6e7195075fd4fbd3db04e187f6d75030d17cb6b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:26:05 +0200
+Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ modules/syslogformat/syslog-format.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 38bb6f6..9042396 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data,
+ const guchar *src = *data;
+ gint left = *length;
+
++ if (!left)
++ return;
++
+ /* Cisco timestamp extensions, the first '*' indicates that the clock is
+ * unsynced, '.' if it is known to be synced */
+ if (G_UNLIKELY(src[0] == '*'))
+@@ -556,7 +559,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ open_sd++;
+ do
+ {
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+ /* read sd_id */
+ pos = 0;
+@@ -589,7 +592,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ sd_id_len = pos;
+ strcpy(sd_value_name, logmsg_sd_prefix);
+ strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len);
+- if (*src == ']')
++
++ if (left && *src == ']')
+ {
+ log_msg_set_value_by_name(self, sd_value_name, "", 0);
+ }
+@@ -606,7 +610,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ else
+ goto error;
+
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+
+ /* read sd-param */
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
new file mode 100644
index 000000000..ac5bc78a5
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
@@ -0,0 +1,152 @@
+From f8f985cd0902e0fa8306f988fb183f1987ab7d3b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:22:44 +0200
+Subject: [PATCH 2/8] syslogformat: add bug reproducer test for non-zero
+ terminated input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ modules/syslogformat/CMakeLists.txt | 1 +
+ modules/syslogformat/Makefile.am | 2 +
+ modules/syslogformat/tests/CMakeLists.txt | 1 +
+ modules/syslogformat/tests/Makefile.am | 9 +++
+ .../syslogformat/tests/test_syslog_format.c | 72 +++++++++++++++++++
+ 5 files changed, 85 insertions(+)
+ create mode 100644 modules/syslogformat/tests/CMakeLists.txt
+ create mode 100644 modules/syslogformat/tests/Makefile.am
+ create mode 100644 modules/syslogformat/tests/test_syslog_format.c
+
+diff --git a/modules/syslogformat/CMakeLists.txt b/modules/syslogformat/CMakeLists.txt
+index 94ee01a..64848ef 100644
+--- a/modules/syslogformat/CMakeLists.txt
++++ b/modules/syslogformat/CMakeLists.txt
+@@ -14,3 +14,4 @@ add_module(
+ SOURCES ${SYSLOGFORMAT_SOURCES}
+ )
+
++add_test_subdirectory(tests)
+diff --git a/modules/syslogformat/Makefile.am b/modules/syslogformat/Makefile.am
+index f13f88c..14cdf58 100644
+--- a/modules/syslogformat/Makefile.am
++++ b/modules/syslogformat/Makefile.am
+@@ -31,3 +31,5 @@ modules_syslogformat_libsyslogformat_la_DEPENDENCIES = \
+ modules/syslogformat modules/syslogformat/ mod-syslogformat: \
+ modules/syslogformat/libsyslogformat.la
+ .PHONY: modules/syslogformat/ mod-syslogformat
++
++include modules/syslogformat/tests/Makefile.am
+diff --git a/modules/syslogformat/tests/CMakeLists.txt b/modules/syslogformat/tests/CMakeLists.txt
+new file mode 100644
+index 0000000..2e45b71
+--- /dev/null
++++ b/modules/syslogformat/tests/CMakeLists.txt
+@@ -0,0 +1 @@
++add_unit_test(CRITERION TARGET test_syslog_format DEPENDS syslogformat)
+diff --git a/modules/syslogformat/tests/Makefile.am b/modules/syslogformat/tests/Makefile.am
+new file mode 100644
+index 0000000..7ee66a5
+--- /dev/null
++++ b/modules/syslogformat/tests/Makefile.am
+@@ -0,0 +1,9 @@
++modules_syslogformat_tests_TESTS = \
++ modules/syslogformat/tests/test_syslog_format
++
++check_PROGRAMS += ${modules_syslogformat_tests_TESTS}
++
++EXTRA_DIST += modules/syslogformat/tests/CMakeLists.txt
++
++modules_syslogformat_tests_test_syslog_format_CFLAGS = $(TEST_CFLAGS) -I$(top_srcdir)/modules/syslogformat
++modules_syslogformat_tests_test_syslog_format_LDADD = $(TEST_LDADD) $(PREOPEN_SYSLOGFORMAT)
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+new file mode 100644
+index 0000000..b247fe3
+--- /dev/null
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -0,0 +1,72 @@
++/*
++ * Copyright (c) 2022 One Identity
++ * Copyright (c) 2022 László Várady
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published
++ * by the Free Software Foundation, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
++ *
++ * As an additional exemption you are allowed to compile & link against the
++ * OpenSSL libraries as published by the OpenSSL project. See the file
++ * COPYING for details.
++ *
++ */
++
++#include <criterion/criterion.h>
++
++#include "apphook.h"
++#include "cfg.h"
++#include "syslog-format.h"
++#include "logmsg/logmsg.h"
++#include "msg-format.h"
++#include "scratch-buffers.h"
++
++#include <string.h>
++
++GlobalConfig *cfg;
++MsgFormatOptions parse_options;
++
++static void
++setup(void)
++{
++ app_startup();
++ syslog_format_init();
++
++ cfg = cfg_new_snippet();
++ msg_format_options_defaults(&parse_options);
++}
++
++static void
++teardown(void)
++{
++ scratch_buffers_explicit_gc();
++ app_shutdown();
++ cfg_free(cfg);
++}
++
++TestSuite(syslog_format, .init = setup, .fini = teardown);
++
++Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeout = 10)
++{
++ const gchar *data = "<182>2022-08-17T05:02:28.217 mymachine su: 'su root' failed for lonvick on /dev/pts/8";
++ /* chosen carefully to reproduce a bug */
++ gsize data_length = 27;
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
new file mode 100644
index 000000000..34e6b65d2
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
@@ -0,0 +1,79 @@
+From 041ccdf8a4c73cd3138dac0611272361f384fb81 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sun, 21 Aug 2022 18:44:28 +0200
+Subject: [PATCH 3/8] syslogformat: fix reading cisco sequence id out of bounds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ modules/syslogformat/syslog-format.c | 2 +-
+ .../syslogformat/tests/test_syslog_format.c | 32 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 9042396..fe829fb 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -207,7 +207,7 @@ log_msg_parse_cisco_sequence_id(LogMessage *self, const guchar **data, gint *len
+
+ /* if the next char is not space, then we may try to read a date */
+
+- if (*src != ' ')
++ if (!left || *src != ' ')
+ return;
+
+ log_msg_set_value(self, handles.cisco_seqid, (gchar *) *data, *length - left - 1);
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+index b247fe3..d0f5b40 100644
+--- a/modules/syslogformat/tests/test_syslog_format.c
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -70,3 +70,35 @@ Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeou
+ msg_format_options_destroy(&parse_options);
+ log_msg_unref(msg);
+ }
++
++Test(syslog_format, cisco_sequence_id_non_zero_termination)
++{
++ const gchar *data = "<189>65536: ";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, ".SDATA.meta.sequenceId", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
++
++Test(syslog_format, minimal_non_zero_terminated_numeric_message_is_parsed_as_program_name)
++{
++ const gchar *data = "<189>65536";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, "PROGRAM", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
new file mode 100644
index 000000000..cfad5a378
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
@@ -0,0 +1,40 @@
+From bea4678261328c841b6062014394e6d3230a2fdb Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:42:38 +0200
+Subject: [PATCH 4/8] timeutils: fix iterating out of the range of timestamp
+ buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+Signed-off-by: Balazs Scheidler <bazsi77@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 2f6a6b7..cb6802d 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -328,7 +328,7 @@ __parse_usec(const guchar **data, gint *length)
+ src++;
+ (*length)--;
+ }
+- while (isdigit(*src))
++ while (*length > 0 && isdigit(*src))
+ {
+ src++;
+ (*length)--;
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
new file mode 100644
index 000000000..487118957
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
@@ -0,0 +1,213 @@
+From 1f62031101608bee8ad772967eb8151aa33d6e1a Mon Sep 17 00:00:00 2001
+From: Balazs Scheidler <bazsi77@...>
+Date: Sat, 20 Aug 2022 12:43:42 +0200
+Subject: [PATCH 5/8] timeutils: add tests for non-zero terminated inputs
+
+Signed-off-by: Balazs Scheidler <bazsi77@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/tests/test_scan-timestamp.c | 126 +++++++++++++++++++---
+ 1 file changed, 113 insertions(+), 13 deletions(-)
+
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index 2756bf3..da375c8 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -49,17 +49,21 @@ fake_time_add(time_t diff)
+ }
+
+ static gboolean
+-_parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc3164(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
+-
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc3164_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -70,16 +74,21 @@ _parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc5424(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc5424_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -90,31 +99,60 @@ _parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_rfc3164_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc3164_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc3164(ts, converted));
++ cr_assert(_parse_rfc3164(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ static gboolean
+-_rfc5424_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc5424_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc5424(ts, converted));
++ cr_assert(_parse_rfc5424(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ #define _expect_rfc3164_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc3164_timestamp_eq(ts, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc3164_timestamp_eq(ts, -1, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc3164_timestamp_eq(ts, len, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc3164_timestamp(&data, &length, &wct)); \
+ })
+
+ #define _expect_rfc5424_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc5424_timestamp_eq(ts, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc5424_timestamp_eq(ts, -1, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc5424_timestamp_eq(ts, len, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc5424_timestamp(&data, &length, &wct)); \
+ })
+
++
+ Test(parse_timestamp, standard_bsd_format)
+ {
+ _expect_rfc3164_timestamp_eq("Oct 1 17:46:12", "2017-10-01T17:46:12.000+02:00");
+@@ -148,6 +186,68 @@ Test(parse_timestamp, standard_bsd_format_year_in_the_past)
+ _expect_rfc3164_timestamp_eq("Dec 31 17:46:12", "2017-12-31T17:46:12.000+01:00");
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc3164_iso_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc3164_bsd_pix_or_asa_input_is_handled_properly)
++{
++ gchar *ts = "Aug 17 2022 05:02:28: whatever";
++ gint ts_len = 21;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.000+02:00");
++
++ /* no ":" at the end, that's a problem, unrecognized */
++ _expect_rfc3164_fails(ts, ts_len - 1);
++
++ for (gint i = 1; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc5424_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc5424_fails(ts, ts_len - i);
++
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
new file mode 100644
index 000000000..e32076ab5
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
@@ -0,0 +1,182 @@
+From 14bcd1596f0f194b28e3f7babc75ad90d39ae7af Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:29:43 +0200
+Subject: [PATCH 6/8] timeutils: name repeating constant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 54 ++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index cb6802d..197e3ad 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -34,41 +34,43 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ {
+ *wday = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'S':
+- if (strncasecmp(*buf, "Sun", 3) == 0)
++ if (strncasecmp(*buf, "Sun", abbrev_length) == 0)
+ *wday = 0;
+- else if (strncasecmp(*buf, "Sat", 3) == 0)
++ else if (strncasecmp(*buf, "Sat", abbrev_length) == 0)
+ *wday = 6;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mon", 3) == 0)
++ if (strncasecmp(*buf, "Mon", abbrev_length) == 0)
+ *wday = 1;
+ else
+ return FALSE;
+ break;
+ case 'T':
+- if (strncasecmp(*buf, "Tue", 3) == 0)
++ if (strncasecmp(*buf, "Tue", abbrev_length) == 0)
+ *wday = 2;
+- else if (strncasecmp(*buf, "Thu", 3) == 0)
++ else if (strncasecmp(*buf, "Thu", abbrev_length) == 0)
+ *wday = 4;
+ else
+ return FALSE;
+ break;
+ case 'W':
+- if (strncasecmp(*buf, "Wed", 3) == 0)
++ if (strncasecmp(*buf, "Wed", abbrev_length) == 0)
+ *wday = 3;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Fri", 3) == 0)
++ if (strncasecmp(*buf, "Fri", abbrev_length) == 0)
+ *wday = 5;
+ else
+ return FALSE;
+@@ -77,8 +79,8 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+@@ -87,63 +89,65 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ {
+ *mon = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'J':
+- if (strncasecmp(*buf, "Jan", 3) == 0)
++ if (strncasecmp(*buf, "Jan", abbrev_length) == 0)
+ *mon = 0;
+- else if (strncasecmp(*buf, "Jun", 3) == 0)
++ else if (strncasecmp(*buf, "Jun", abbrev_length) == 0)
+ *mon = 5;
+- else if (strncasecmp(*buf, "Jul", 3) == 0)
++ else if (strncasecmp(*buf, "Jul", abbrev_length) == 0)
+ *mon = 6;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Feb", 3) == 0)
++ if (strncasecmp(*buf, "Feb", abbrev_length) == 0)
+ *mon = 1;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mar", 3) == 0)
++ if (strncasecmp(*buf, "Mar", abbrev_length) == 0)
+ *mon = 2;
+- else if (strncasecmp(*buf, "May", 3) == 0)
++ else if (strncasecmp(*buf, "May", abbrev_length) == 0)
+ *mon = 4;
+ else
+ return FALSE;
+ break;
+ case 'A':
+- if (strncasecmp(*buf, "Apr", 3) == 0)
++ if (strncasecmp(*buf, "Apr", abbrev_length) == 0)
+ *mon = 3;
+- else if (strncasecmp(*buf, "Aug", 3) == 0)
++ else if (strncasecmp(*buf, "Aug", abbrev_length) == 0)
+ *mon = 7;
+ else
+ return FALSE;
+ break;
+ case 'S':
+- if (strncasecmp(*buf, "Sep", 3) == 0)
++ if (strncasecmp(*buf, "Sep", abbrev_length) == 0)
+ *mon = 8;
+ else
+ return FALSE;
+ break;
+ case 'O':
+- if (strncasecmp(*buf, "Oct", 3) == 0)
++ if (strncasecmp(*buf, "Oct", abbrev_length) == 0)
+ *mon = 9;
+ else
+ return FALSE;
+ break;
+ case 'N':
+- if (strncasecmp(*buf, "Nov", 3) == 0)
++ if (strncasecmp(*buf, "Nov", abbrev_length) == 0)
+ *mon = 10;
+ else
+ return FALSE;
+ break;
+ case 'D':
+- if (strncasecmp(*buf, "Dec", 3) == 0)
++ if (strncasecmp(*buf, "Dec", abbrev_length) == 0)
+ *mon = 11;
+ else
+ return FALSE;
+@@ -152,8 +156,8 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
new file mode 100644
index 000000000..b3135df4e
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
@@ -0,0 +1,84 @@
+From d4c8ba0c513052b5f19c6e989ba31f847f4900d1 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:30:22 +0200
+Subject: [PATCH 7/8] timeutils: fix invalid calculation of ISO timestamp
+ length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 8 ++++++--
+ lib/timeutils/tests/test_scan-timestamp.c | 7 +++++++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 197e3ad..4e618e4 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -346,19 +346,21 @@ __parse_usec(const guchar **data, gint *length)
+ static gboolean
+ __has_iso_timezone(const guchar *src, gint length)
+ {
+- return (length >= 5) &&
++ return (length >= 6) &&
+ (*src == '+' || *src == '-') &&
+ isdigit(*(src+1)) &&
+ isdigit(*(src+2)) &&
+ *(src+3) == ':' &&
+ isdigit(*(src+4)) &&
+ isdigit(*(src+5)) &&
+- !isdigit(*(src+6));
++ (length < 7 || !isdigit(*(src+6)));
+ }
+
+ static guint32
+ __parse_iso_timezone(const guchar **data, gint *length)
+ {
++ g_assert(*length >= 6);
++
+ gint hours, mins;
+ const guchar *src = *data;
+ guint32 tz = 0;
+@@ -368,8 +370,10 @@ __parse_iso_timezone(const guchar **data, gint *length)
+ hours = (*(src + 1) - '0') * 10 + *(src + 2) - '0';
+ mins = (*(src + 4) - '0') * 10 + *(src + 5) - '0';
+ tz = sign * (hours * 3600 + mins * 60);
++
+ src += 6;
+ (*length) -= 6;
++
+ *data = src;
+ return tz;
+ }
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index da375c8..9b38738 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -248,6 +248,13 @@ Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
+
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc5424_timestamp_only)
++{
++ const gchar *ts = "2022-08-17T05:02:28.417+03:00";
++ gint ts_len = strlen(ts);
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, ts);
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
new file mode 100644
index 000000000..cec573fa2
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
@@ -0,0 +1,47 @@
+From f60dcfa9e094dc9c2a752115ca426159c4ae4192 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:30:51 +0200
+Subject: [PATCH 8/8] timeutils: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 4e618e4..0f7f52e 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -427,7 +427,7 @@ __parse_bsd_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ if (!scan_pix_timestamp((const gchar **) &src, &left, wct))
+ return FALSE;
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ src++;
+ left--;
+@@ -478,7 +478,7 @@ scan_rfc3164_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ * looking at you, skip that as well, so we can reliably detect IPv6
+ * addresses as hostnames, which would be using ":" as well. */
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ ++src;
+ --left;
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb b/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
index 40bbfe495..5fc386e56 100644
--- a/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
+++ b/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
@@ -22,6 +22,14 @@ SRC_URI = "https://github.com/balabit/syslog-ng/releases/download/${BP}/${BP}.ta
file://volatiles.03_syslog-ng \
file://syslog-ng-tmp.conf \
file://syslog-ng.service-the-syslog-ng-service.patch \
+ file://CVE-2022-38725-0001.patch \
+ file://CVE-2022-38725-0002.patch \
+ file://CVE-2022-38725-0003.patch \
+ file://CVE-2022-38725-0004.patch \
+ file://CVE-2022-38725-0005.patch \
+ file://CVE-2022-38725-0006.patch \
+ file://CVE-2022-38725-0007.patch \
+ file://CVE-2022-38725-0008.patch \
"
SRC_URI[sha256sum] = "90a25c9767fe749db50f118ddfc92ec71399763d2ecd5ad4f11ff5eea049e60b"
--
2.34.1
Sent from
Mail for Windows
toggle quoted message
Show quoted text
From: MacLeod, Randy
Sent: 24 November 2022 03:16
To: Urade, Yogita;
openembedded-devel@...
Cc: G Pillai, Hari;
Mali, Narpat
Subject: Re: [oe] [meta-openembedded][kirkstone][PATCH 1/1] syslog-ng: fix CVE-2022-38725
On 2022-11-21 05:29, Urade, Yogita via lists.openembedded.org wrote:
Issue: LIN1022-1598
The line above is only for internal WR reviews, please drop.
Fix buffer handling of syslog and timestamp parsers.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-38725
https://github.com/syslog-ng/syslog-ng/releases
https://github.com/syslog-ng/syslog-ng/pull/4110
Upstream patches:
https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
(LOCAL REV: NOT UPSTREAM) -- Not applicable, upstream out of maintenance
The line above is only for internal WR reviews, please drop.
Also, this is the upstream for WR Linux, so it's not out of maintenance! ;-)
Other than that, this looks good.
Please send a v2.
Thanks,
../Randy
Signed-off-by: Yogita Urade <yogita.urade@...>
---
.../syslog-ng/files/CVE-2022-38725-0001.patch | 67 ++++++
.../syslog-ng/files/CVE-2022-38725-0002.patch | 152 +++++++++++++
.../syslog-ng/files/CVE-2022-38725-0003.patch | 79 +++++++
.../syslog-ng/files/CVE-2022-38725-0004.patch | 40 ++++
.../syslog-ng/files/CVE-2022-38725-0005.patch | 213 ++++++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0006.patch | 182 +++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0007.patch | 84 +++++++
.../syslog-ng/files/CVE-2022-38725-0008.patch | 47 ++++
.../syslog-ng/syslog-ng_3.36.1.bb | 8 +
9 files changed, 872 insertions(+)
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
new file mode 100644
index 000000000..cd6a93d8e
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
@@ -0,0 +1,67 @@
+From c6e7195075fd4fbd3db04e187f6d75030d17cb6b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:26:05 +0200
+Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ modules/syslogformat/syslog-format.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 38bb6f6..9042396 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data,
+ const guchar *src = *data;
+ gint left = *length;
+
++ if (!left)
++ return;
++
+ /* Cisco timestamp extensions, the first '*' indicates that the clock is
+ * unsynced, '.' if it is known to be synced */
+ if (G_UNLIKELY(src[0] == '*'))
+@@ -556,7 +559,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ open_sd++;
+ do
+ {
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+ /* read sd_id */
+ pos = 0;
+@@ -589,7 +592,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ sd_id_len = pos;
+ strcpy(sd_value_name, logmsg_sd_prefix);
+ strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len);
+- if (*src == ']')
++
++ if (left && *src == ']')
+ {
+ log_msg_set_value_by_name(self, sd_value_name, "", 0);
+ }
+@@ -606,7 +610,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ else
+ goto error;
+
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+
+ /* read sd-param */
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
new file mode 100644
index 000000000..ac5bc78a5
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
@@ -0,0 +1,152 @@
+From f8f985cd0902e0fa8306f988fb183f1987ab7d3b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:22:44 +0200
+Subject: [PATCH 2/8] syslogformat: add bug reproducer test for non-zero
+ terminated input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ modules/syslogformat/CMakeLists.txt | 1 +
+ modules/syslogformat/Makefile.am | 2 +
+ modules/syslogformat/tests/CMakeLists.txt | 1 +
+ modules/syslogformat/tests/Makefile.am | 9 +++
+ .../syslogformat/tests/test_syslog_format.c | 72 +++++++++++++++++++
+ 5 files changed, 85 insertions(+)
+ create mode 100644 modules/syslogformat/tests/CMakeLists.txt
+ create mode 100644 modules/syslogformat/tests/Makefile.am
+ create mode 100644 modules/syslogformat/tests/test_syslog_format.c
+
+diff --git a/modules/syslogformat/CMakeLists.txt b/modules/syslogformat/CMakeLists.txt
+index 94ee01a..64848ef 100644
+--- a/modules/syslogformat/CMakeLists.txt
++++ b/modules/syslogformat/CMakeLists.txt
+@@ -14,3 +14,4 @@ add_module(
+ SOURCES ${SYSLOGFORMAT_SOURCES}
+ )
+
++add_test_subdirectory(tests)
+diff --git a/modules/syslogformat/Makefile.am b/modules/syslogformat/Makefile.am
+index f13f88c..14cdf58 100644
+--- a/modules/syslogformat/Makefile.am
++++ b/modules/syslogformat/Makefile.am
+@@ -31,3 +31,5 @@ modules_syslogformat_libsyslogformat_la_DEPENDENCIES = \
+ modules/syslogformat modules/syslogformat/ mod-syslogformat: \
+ modules/syslogformat/libsyslogformat.la
+ .PHONY: modules/syslogformat/ mod-syslogformat
++
++include modules/syslogformat/tests/Makefile.am
+diff --git a/modules/syslogformat/tests/CMakeLists.txt b/modules/syslogformat/tests/CMakeLists.txt
+new file mode 100644
+index 0000000..2e45b71
+--- /dev/null
++++ b/modules/syslogformat/tests/CMakeLists.txt
+@@ -0,0 +1 @@
++add_unit_test(CRITERION TARGET test_syslog_format DEPENDS syslogformat)
+diff --git a/modules/syslogformat/tests/Makefile.am b/modules/syslogformat/tests/Makefile.am
+new file mode 100644
+index 0000000..7ee66a5
+--- /dev/null
++++ b/modules/syslogformat/tests/Makefile.am
+@@ -0,0 +1,9 @@
++modules_syslogformat_tests_TESTS = \
++ modules/syslogformat/tests/test_syslog_format
++
++check_PROGRAMS += ${modules_syslogformat_tests_TESTS}
++
++EXTRA_DIST += modules/syslogformat/tests/CMakeLists.txt
++
++modules_syslogformat_tests_test_syslog_format_CFLAGS = $(TEST_CFLAGS) -I$(top_srcdir)/modules/syslogformat
++modules_syslogformat_tests_test_syslog_format_LDADD = $(TEST_LDADD) $(PREOPEN_SYSLOGFORMAT)
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+new file mode 100644
+index 0000000..b247fe3
+--- /dev/null
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -0,0 +1,72 @@
++/*
++ * Copyright (c) 2022 One Identity
++ * Copyright (c) 2022 László Várady
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published
++ * by the Free Software Foundation, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
++ *
++ * As an additional exemption you are allowed to compile & link against the
++ * OpenSSL libraries as published by the OpenSSL project. See the file
++ * COPYING for details.
++ *
++ */
++
++#include <criterion/criterion.h>
++
++#include "apphook.h"
++#include "cfg.h"
++#include "syslog-format.h"
++#include "logmsg/logmsg.h"
++#include "msg-format.h"
++#include "scratch-buffers.h"
++
++#include <string.h>
++
++GlobalConfig *cfg;
++MsgFormatOptions parse_options;
++
++static void
++setup(void)
++{
++ app_startup();
++ syslog_format_init();
++
++ cfg = cfg_new_snippet();
++ msg_format_options_defaults(&parse_options);
++}
++
++static void
++teardown(void)
++{
++ scratch_buffers_explicit_gc();
++ app_shutdown();
++ cfg_free(cfg);
++}
++
++TestSuite(syslog_format, .init = setup, .fini = teardown);
++
++Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeout = 10)
++{
++ const gchar *data = "<182>2022-08-17T05:02:28.217 mymachine su: 'su root' failed for lonvick on /dev/pts/8";
++ /* chosen carefully to reproduce a bug */
++ gsize data_length = 27;
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
new file mode 100644
index 000000000..34e6b65d2
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
@@ -0,0 +1,79 @@
+From 041ccdf8a4c73cd3138dac0611272361f384fb81 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sun, 21 Aug 2022 18:44:28 +0200
+Subject: [PATCH 3/8] syslogformat: fix reading cisco sequence id out of bounds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ modules/syslogformat/syslog-format.c | 2 +-
+ .../syslogformat/tests/test_syslog_format.c | 32 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 9042396..fe829fb 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -207,7 +207,7 @@ log_msg_parse_cisco_sequence_id(LogMessage *self, const guchar **data, gint *len
+
+ /* if the next char is not space, then we may try to read a date */
+
+- if (*src != ' ')
++ if (!left || *src != ' ')
+ return;
+
+ log_msg_set_value(self, handles.cisco_seqid, (gchar *) *data, *length - left - 1);
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+index b247fe3..d0f5b40 100644
+--- a/modules/syslogformat/tests/test_syslog_format.c
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -70,3 +70,35 @@ Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeou
+ msg_format_options_destroy(&parse_options);
+ log_msg_unref(msg);
+ }
++
++Test(syslog_format, cisco_sequence_id_non_zero_termination)
++{
++ const gchar *data = "<189>65536: ";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, ".SDATA.meta.sequenceId", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
++
++Test(syslog_format, minimal_non_zero_terminated_numeric_message_is_parsed_as_program_name)
++{
++ const gchar *data = "<189>65536";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, "PROGRAM", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
new file mode 100644
index 000000000..cfad5a378
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
@@ -0,0 +1,40 @@
+From bea4678261328c841b6062014394e6d3230a2fdb Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:42:38 +0200
+Subject: [PATCH 4/8] timeutils: fix iterating out of the range of timestamp
+ buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+Signed-off-by: Balazs Scheidler <bazsi77@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 2f6a6b7..cb6802d 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -328,7 +328,7 @@ __parse_usec(const guchar **data, gint *length)
+ src++;
+ (*length)--;
+ }
+- while (isdigit(*src))
++ while (*length > 0 && isdigit(*src))
+ {
+ src++;
+ (*length)--;
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
new file mode 100644
index 000000000..487118957
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
@@ -0,0 +1,213 @@
+From 1f62031101608bee8ad772967eb8151aa33d6e1a Mon Sep 17 00:00:00 2001
+From: Balazs Scheidler <bazsi77@...>
+Date: Sat, 20 Aug 2022 12:43:42 +0200
+Subject: [PATCH 5/8] timeutils: add tests for non-zero terminated inputs
+
+Signed-off-by: Balazs Scheidler <bazsi77@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/tests/test_scan-timestamp.c | 126 +++++++++++++++++++---
+ 1 file changed, 113 insertions(+), 13 deletions(-)
+
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index 2756bf3..da375c8 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -49,17 +49,21 @@ fake_time_add(time_t diff)
+ }
+
+ static gboolean
+-_parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc3164(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
+-
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc3164_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -70,16 +74,21 @@ _parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc5424(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc5424_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -90,31 +99,60 @@ _parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_rfc3164_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc3164_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc3164(ts, converted));
++ cr_assert(_parse_rfc3164(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ static gboolean
+-_rfc5424_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc5424_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc5424(ts, converted));
++ cr_assert(_parse_rfc5424(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ #define _expect_rfc3164_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc3164_timestamp_eq(ts, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc3164_timestamp_eq(ts, -1, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc3164_timestamp_eq(ts, len, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc3164_timestamp(&data, &length, &wct)); \
+ })
+
+ #define _expect_rfc5424_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc5424_timestamp_eq(ts, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc5424_timestamp_eq(ts, -1, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc5424_timestamp_eq(ts, len, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc5424_timestamp(&data, &length, &wct)); \
+ })
+
++
+ Test(parse_timestamp, standard_bsd_format)
+ {
+ _expect_rfc3164_timestamp_eq("Oct 1 17:46:12", "2017-10-01T17:46:12.000+02:00");
+@@ -148,6 +186,68 @@ Test(parse_timestamp, standard_bsd_format_year_in_the_past)
+ _expect_rfc3164_timestamp_eq("Dec 31 17:46:12", "2017-12-31T17:46:12.000+01:00");
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc3164_iso_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc3164_bsd_pix_or_asa_input_is_handled_properly)
++{
++ gchar *ts = "Aug 17 2022 05:02:28: whatever";
++ gint ts_len = 21;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.000+02:00");
++
++ /* no ":" at the end, that's a problem, unrecognized */
++ _expect_rfc3164_fails(ts, ts_len - 1);
++
++ for (gint i = 1; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc5424_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc5424_fails(ts, ts_len - i);
++
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
new file mode 100644
index 000000000..e32076ab5
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
@@ -0,0 +1,182 @@
+From 14bcd1596f0f194b28e3f7babc75ad90d39ae7af Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:29:43 +0200
+Subject: [PATCH 6/8] timeutils: name repeating constant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 54 ++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index cb6802d..197e3ad 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -34,41 +34,43 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ {
+ *wday = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'S':
+- if (strncasecmp(*buf, "Sun", 3) == 0)
++ if (strncasecmp(*buf, "Sun", abbrev_length) == 0)
+ *wday = 0;
+- else if (strncasecmp(*buf, "Sat", 3) == 0)
++ else if (strncasecmp(*buf, "Sat", abbrev_length) == 0)
+ *wday = 6;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mon", 3) == 0)
++ if (strncasecmp(*buf, "Mon", abbrev_length) == 0)
+ *wday = 1;
+ else
+ return FALSE;
+ break;
+ case 'T':
+- if (strncasecmp(*buf, "Tue", 3) == 0)
++ if (strncasecmp(*buf, "Tue", abbrev_length) == 0)
+ *wday = 2;
+- else if (strncasecmp(*buf, "Thu", 3) == 0)
++ else if (strncasecmp(*buf, "Thu", abbrev_length) == 0)
+ *wday = 4;
+ else
+ return FALSE;
+ break;
+ case 'W':
+- if (strncasecmp(*buf, "Wed", 3) == 0)
++ if (strncasecmp(*buf, "Wed", abbrev_length) == 0)
+ *wday = 3;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Fri", 3) == 0)
++ if (strncasecmp(*buf, "Fri", abbrev_length) == 0)
+ *wday = 5;
+ else
+ return FALSE;
+@@ -77,8 +79,8 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+@@ -87,63 +89,65 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ {
+ *mon = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'J':
+- if (strncasecmp(*buf, "Jan", 3) == 0)
++ if (strncasecmp(*buf, "Jan", abbrev_length) == 0)
+ *mon = 0;
+- else if (strncasecmp(*buf, "Jun", 3) == 0)
++ else if (strncasecmp(*buf, "Jun", abbrev_length) == 0)
+ *mon = 5;
+- else if (strncasecmp(*buf, "Jul", 3) == 0)
++ else if (strncasecmp(*buf, "Jul", abbrev_length) == 0)
+ *mon = 6;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Feb", 3) == 0)
++ if (strncasecmp(*buf, "Feb", abbrev_length) == 0)
+ *mon = 1;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mar", 3) == 0)
++ if (strncasecmp(*buf, "Mar", abbrev_length) == 0)
+ *mon = 2;
+- else if (strncasecmp(*buf, "May", 3) == 0)
++ else if (strncasecmp(*buf, "May", abbrev_length) == 0)
+ *mon = 4;
+ else
+ return FALSE;
+ break;
+ case 'A':
+- if (strncasecmp(*buf, "Apr", 3) == 0)
++ if (strncasecmp(*buf, "Apr", abbrev_length) == 0)
+ *mon = 3;
+- else if (strncasecmp(*buf, "Aug", 3) == 0)
++ else if (strncasecmp(*buf, "Aug", abbrev_length) == 0)
+ *mon = 7;
+ else
+ return FALSE;
+ break;
+ case 'S':
+- if (strncasecmp(*buf, "Sep", 3) == 0)
++ if (strncasecmp(*buf, "Sep", abbrev_length) == 0)
+ *mon = 8;
+ else
+ return FALSE;
+ break;
+ case 'O':
+- if (strncasecmp(*buf, "Oct", 3) == 0)
++ if (strncasecmp(*buf, "Oct", abbrev_length) == 0)
+ *mon = 9;
+ else
+ return FALSE;
+ break;
+ case 'N':
+- if (strncasecmp(*buf, "Nov", 3) == 0)
++ if (strncasecmp(*buf, "Nov", abbrev_length) == 0)
+ *mon = 10;
+ else
+ return FALSE;
+ break;
+ case 'D':
+- if (strncasecmp(*buf, "Dec", 3) == 0)
++ if (strncasecmp(*buf, "Dec", abbrev_length) == 0)
+ *mon = 11;
+ else
+ return FALSE;
+@@ -152,8 +156,8 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
new file mode 100644
index 000000000..b3135df4e
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
@@ -0,0 +1,84 @@
+From d4c8ba0c513052b5f19c6e989ba31f847f4900d1 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:30:22 +0200
+Subject: [PATCH 7/8] timeutils: fix invalid calculation of ISO timestamp
+ length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 8 ++++++--
+ lib/timeutils/tests/test_scan-timestamp.c | 7 +++++++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 197e3ad..4e618e4 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -346,19 +346,21 @@ __parse_usec(const guchar **data, gint *length)
+ static gboolean
+ __has_iso_timezone(const guchar *src, gint length)
+ {
+- return (length >= 5) &&
++ return (length >= 6) &&
+ (*src == '+' || *src == '-') &&
+ isdigit(*(src+1)) &&
+ isdigit(*(src+2)) &&
+ *(src+3) == ':' &&
+ isdigit(*(src+4)) &&
+ isdigit(*(src+5)) &&
+- !isdigit(*(src+6));
++ (length < 7 || !isdigit(*(src+6)));
+ }
+
+ static guint32
+ __parse_iso_timezone(const guchar **data, gint *length)
+ {
++ g_assert(*length >= 6);
++
+ gint hours, mins;
+ const guchar *src = *data;
+ guint32 tz = 0;
+@@ -368,8 +370,10 @@ __parse_iso_timezone(const guchar **data, gint *length)
+ hours = (*(src + 1) - '0') * 10 + *(src + 2) - '0';
+ mins = (*(src + 4) - '0') * 10 + *(src + 5) - '0';
+ tz = sign * (hours * 3600 + mins * 60);
++
+ src += 6;
+ (*length) -= 6;
++
+ *data = src;
+ return tz;
+ }
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index da375c8..9b38738 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -248,6 +248,13 @@ Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
+
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc5424_timestamp_only)
++{
++ const gchar *ts = "2022-08-17T05:02:28.417+03:00";
++ gint ts_len = strlen(ts);
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, ts);
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
new file mode 100644
index 000000000..cec573fa2
--- /dev/null
+++ b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
@@ -0,0 +1,47 @@
+From f60dcfa9e094dc9c2a752115ca426159c4ae4192 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:30:51 +0200
+Subject: [PATCH 8/8] timeutils: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 4e618e4..0f7f52e 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -427,7 +427,7 @@ __parse_bsd_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ if (!scan_pix_timestamp((const gchar **) &src, &left, wct))
+ return FALSE;
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ src++;
+ left--;
+@@ -478,7 +478,7 @@ scan_rfc3164_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ * looking at you, skip that as well, so we can reliably detect IPv6
+ * addresses as hostnames, which would be using ":" as well. */
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ ++src;
+ --left;
+--
+2.37.3
+
+
diff --git a/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb b/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
index 40bbfe495..5fc386e56 100644
--- a/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
+++ b/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
@@ -22,6 +22,14 @@ SRC_URI = "https://github.com/balabit/syslog-ng/releases/download/${BP}/${BP}.ta
file://volatiles.03_syslog-ng \
file://syslog-ng-tmp.conf \
file://syslog-ng.service-the-syslog-ng-service.patch \
+ file://CVE-2022-38725-0001.patch \
+ file://CVE-2022-38725-0002.patch \
+ file://CVE-2022-38725-0003.patch \
+ file://CVE-2022-38725-0004.patch \
+ file://CVE-2022-38725-0005.patch \
+ file://CVE-2022-38725-0006.patch \
+ file://CVE-2022-38725-0007.patch \
+ file://CVE-2022-38725-0008.patch \
"
SRC_URI[sha256sum] = "90a25c9767fe749db50f118ddfc92ec71399763d2ecd5ad4f11ff5eea049e60b"
--
2.34.1
Sent from
Mail for Windows
--
# Randy MacLeod
# Wind River Linux
|
|
|
Re: [PATCH] kbd: DEPEND on bison-native and don't build tests
On Tue, 2022-11-22 at 17:00 +0100, Ola x Nilsson wrote: bison-native is required if any .y-file is changed.
Add --disable-tests to EXTRA_OECONF as the tests are not usable in
ptest - they can only run in-situ - and fails when building with
-D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64.
Signed-off-by: Ola x Nilsson <olani@...>
---
meta/recipes-core/kbd/kbd_2.5.1.bb | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/kbd/kbd_2.5.1.bb b/meta/recipes-core/kbd/kbd_2.5.1.bb
index aa3ab6e121..75b3c2765a 100644
--- a/meta/recipes-core/kbd/kbd_2.5.1.bb
+++ b/meta/recipes-core/kbd/kbd_2.5.1.bb
@@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
inherit autotools gettext pkgconfig
-DEPENDS += "flex-native"
+DEPENDS += "bison-native flex-native"
RREPLACES:${PN} = "console-tools"
RPROVIDES:${PN} = "console-tools"
@@ -18,6 +18,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/${BP}.tar.xz \
SRC_URI[sha256sum] = "ccdf452387a6380973d2927363e9cbb939fa2068915a6f937ff9d24522024683"
+EXTRA_OECONF = "--disable-tests"
PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)} \
" This needs to go to the other list. I'd also want to understand why we don't normally run into any problems despite the missing dependency? That needs to be explained in the commit message. Cheers, Richard
|
|
|
Re: [meta-openembedded][kirkstone][PATCH 1/1] syslog-ng: fix CVE-2022-38725
Randy MacLeod
Hi Yogita,
On 2022-11-21 05:29, Urade, Yogita via
lists.openembedded.org wrote:
The line above is only for internal WR reviews, please drop.
The line above is only for internal WR reviews, please drop.
Also, this is the upstream for WR Linux, so it's not out of
maintenance! ;-)
Other than that, this looks good.
Please send a v2.
Thanks,
../Randy
Signed-off-by: Yogita Urade <yogita.urade@...>
---
.../syslog-ng/files/CVE-2022-38725-0001.patch | 67 ++++++
.../syslog-ng/files/CVE-2022-38725-0002.patch | 152
+++++++++++++
.../syslog-ng/files/CVE-2022-38725-0003.patch | 79 +++++++
.../syslog-ng/files/CVE-2022-38725-0004.patch | 40 ++++
.../syslog-ng/files/CVE-2022-38725-0005.patch | 213
++++++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0006.patch | 182
+++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0007.patch | 84 +++++++
.../syslog-ng/files/CVE-2022-38725-0008.patch | 47 ++++
.../syslog-ng/syslog-ng_3.36.1.bb | 8 +
9 files changed, 872 insertions(+)
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
create mode 100644
meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
new file mode 100644
index 000000000..cd6a93d8e
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
@@ -0,0 +1,67 @@
+From c6e7195075fd4fbd3db04e187f6d75030d17cb6b Mon Sep 17
00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:26:05 +0200
+Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading
of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady
<laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ modules/syslogformat/syslog-format.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/modules/syslogformat/syslog-format.c
b/modules/syslogformat/syslog-format.c
+index 38bb6f6..9042396 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -223,6 +223,9 @@
log_msg_parse_cisco_timestamp_attributes(LogMessage *self,
const guchar **data,
+ const guchar *src = *data;
+ gint left = *length;
+
++ if (!left)
++ return;
++
+ /* Cisco timestamp extensions, the first '*' indicates
that the clock is
+ * unsynced, '.' if it is known to be synced */
+ if (G_UNLIKELY(src[0] == '*'))
+@@ -556,7 +559,7 @@ log_msg_parse_sd(LogMessage *self, const
guchar **data, gint *length, const MsgF
+ open_sd++;
+ do
+ {
+- if (!isascii(*src) || *src == '=' || *src == ' '
|| *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src
== ' ' || *src == ']' || *src == '"')
+ goto error;
+ /* read sd_id */
+ pos = 0;
+@@ -589,7 +592,8 @@ log_msg_parse_sd(LogMessage *self, const
guchar **data, gint *length, const MsgF
+ sd_id_len = pos;
+ strcpy(sd_value_name, logmsg_sd_prefix);
+ strncpy(sd_value_name + logmsg_sd_prefix_len,
sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len);
+- if (*src == ']')
++
++ if (left && *src == ']')
+ {
+ log_msg_set_value_by_name(self, sd_value_name,
"", 0);
+ }
+@@ -606,7 +610,7 @@ log_msg_parse_sd(LogMessage *self, const
guchar **data, gint *length, const MsgF
+ else
+ goto error;
+
+- if (!isascii(*src) || *src == '=' || *src == '
' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' ||
*src == ' ' || *src == ']' || *src == '"')
+ goto error;
+
+ /* read sd-param */
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
new file mode 100644
index 000000000..ac5bc78a5
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
@@ -0,0 +1,152 @@
+From f8f985cd0902e0fa8306f988fb183f1987ab7d3b Mon Sep 17
00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:22:44 +0200
+Subject: [PATCH 2/8] syslogformat: add bug reproducer test
for non-zero
+ terminated input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady
<laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ modules/syslogformat/CMakeLists.txt | 1 +
+ modules/syslogformat/Makefile.am | 2 +
+ modules/syslogformat/tests/CMakeLists.txt | 1 +
+ modules/syslogformat/tests/Makefile.am | 9 +++
+ .../syslogformat/tests/test_syslog_format.c | 72
+++++++++++++++++++
+ 5 files changed, 85 insertions(+)
+ create mode 100644 modules/syslogformat/tests/CMakeLists.txt
+ create mode 100644 modules/syslogformat/tests/Makefile.am
+ create mode 100644
modules/syslogformat/tests/test_syslog_format.c
+
+diff --git a/modules/syslogformat/CMakeLists.txt
b/modules/syslogformat/CMakeLists.txt
+index 94ee01a..64848ef 100644
+--- a/modules/syslogformat/CMakeLists.txt
++++ b/modules/syslogformat/CMakeLists.txt
+@@ -14,3 +14,4 @@ add_module(
+ SOURCES ${SYSLOGFORMAT_SOURCES}
+ )
+
++add_test_subdirectory(tests)
+diff --git a/modules/syslogformat/Makefile.am
b/modules/syslogformat/Makefile.am
+index f13f88c..14cdf58 100644
+--- a/modules/syslogformat/Makefile.am
++++ b/modules/syslogformat/Makefile.am
+@@ -31,3 +31,5 @@
modules_syslogformat_libsyslogformat_la_DEPENDENCIES = \
+ modules/syslogformat modules/syslogformat/ mod-syslogformat:
\
+ modules/syslogformat/libsyslogformat.la
+ .PHONY: modules/syslogformat/ mod-syslogformat
++
++include modules/syslogformat/tests/Makefile.am
+diff --git a/modules/syslogformat/tests/CMakeLists.txt
b/modules/syslogformat/tests/CMakeLists.txt
+new file mode 100644
+index 0000000..2e45b71
+--- /dev/null
++++ b/modules/syslogformat/tests/CMakeLists.txt
+@@ -0,0 +1 @@
++add_unit_test(CRITERION TARGET test_syslog_format DEPENDS
syslogformat)
+diff --git a/modules/syslogformat/tests/Makefile.am
b/modules/syslogformat/tests/Makefile.am
+new file mode 100644
+index 0000000..7ee66a5
+--- /dev/null
++++ b/modules/syslogformat/tests/Makefile.am
+@@ -0,0 +1,9 @@
++modules_syslogformat_tests_TESTS = \
++ modules/syslogformat/tests/test_syslog_format
++
++check_PROGRAMS += ${modules_syslogformat_tests_TESTS}
++
++EXTRA_DIST += modules/syslogformat/tests/CMakeLists.txt
++
++modules_syslogformat_tests_test_syslog_format_CFLAGS =
$(TEST_CFLAGS) -I$(top_srcdir)/modules/syslogformat
++modules_syslogformat_tests_test_syslog_format_LDADD =
$(TEST_LDADD) $(PREOPEN_SYSLOGFORMAT)
+diff --git a/modules/syslogformat/tests/test_syslog_format.c
b/modules/syslogformat/tests/test_syslog_format.c
+new file mode 100644
+index 0000000..b247fe3
+--- /dev/null
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -0,0 +1,72 @@
++/*
++ * Copyright (c) 2022 One Identity
++ * Copyright (c) 2022 László Várady
++ *
++ * This program is free software; you can redistribute it
and/or modify it
++ * under the terms of the GNU General Public License version
2 as published
++ * by the Free Software Foundation, or (at your option) any
later version.
++ *
++ * This program is distributed in the hope that it will be
useful,
++ * but WITHOUT ANY WARRANTY; without even the implied
warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public
License
++ * along with this program; if not, write to the Free
Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
MA 02110-1301 USA
++ *
++ * As an additional exemption you are allowed to compile
& link against the
++ * OpenSSL libraries as published by the OpenSSL project.
See the file
++ * COPYING for details.
++ *
++ */
++
++#include <criterion/criterion.h>
++
++#include "apphook.h"
++#include "cfg.h"
++#include "syslog-format.h"
++#include "logmsg/logmsg.h"
++#include "msg-format.h"
++#include "scratch-buffers.h"
++
++#include <string.h>
++
++GlobalConfig *cfg;
++MsgFormatOptions parse_options;
++
++static void
++setup(void)
++{
++ app_startup();
++ syslog_format_init();
++
++ cfg = cfg_new_snippet();
++ msg_format_options_defaults(&parse_options);
++}
++
++static void
++teardown(void)
++{
++ scratch_buffers_explicit_gc();
++ app_shutdown();
++ cfg_free(cfg);
++}
++
++TestSuite(syslog_format, .init = setup, .fini = teardown);
++
++Test(syslog_format,
parser_should_not_spin_on_non_zero_terminated_input, .timeout
= 10)
++{
++ const gchar *data = "<182>2022-08-17T05:02:28.217
mymachine su: 'su root' failed for lonvick on /dev/pts/8";
++ /* chosen carefully to reproduce a bug */
++ gsize data_length = 27;
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg =
msg_format_construct_message(&parse_options, (const guchar
*) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg,
(const guchar *) data, data_length, &problem_position));
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
new file mode 100644
index 000000000..34e6b65d2
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
@@ -0,0 +1,79 @@
+From 041ccdf8a4c73cd3138dac0611272361f384fb81 Mon Sep 17
00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sun, 21 Aug 2022 18:44:28 +0200
+Subject: [PATCH 3/8] syslogformat: fix reading cisco sequence
id out of bounds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady
<laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ modules/syslogformat/syslog-format.c | 2 +-
+ .../syslogformat/tests/test_syslog_format.c | 32
+++++++++++++++++++
+ 2 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/modules/syslogformat/syslog-format.c
b/modules/syslogformat/syslog-format.c
+index 9042396..fe829fb 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -207,7 +207,7 @@
log_msg_parse_cisco_sequence_id(LogMessage *self, const guchar
**data, gint *len
+
+ /* if the next char is not space, then we may try to read
a date */
+
+- if (*src != ' ')
++ if (!left || *src != ' ')
+ return;
+
+ log_msg_set_value(self, handles.cisco_seqid, (gchar *)
*data, *length - left - 1);
+diff --git a/modules/syslogformat/tests/test_syslog_format.c
b/modules/syslogformat/tests/test_syslog_format.c
+index b247fe3..d0f5b40 100644
+--- a/modules/syslogformat/tests/test_syslog_format.c
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -70,3 +70,35 @@ Test(syslog_format,
parser_should_not_spin_on_non_zero_terminated_input, .timeou
+ msg_format_options_destroy(&parse_options);
+ log_msg_unref(msg);
+ }
++
++Test(syslog_format, cisco_sequence_id_non_zero_termination)
++{
++ const gchar *data = "<189>65536: ";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg =
msg_format_construct_message(&parse_options, (const guchar
*) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg,
(const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg,
".SDATA.meta.sequenceId", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
++
++Test(syslog_format,
minimal_non_zero_terminated_numeric_message_is_parsed_as_program_name)
++{
++ const gchar *data = "<189>65536";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg =
msg_format_construct_message(&parse_options, (const guchar
*) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg,
(const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, "PROGRAM",
NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
new file mode 100644
index 000000000..cfad5a378
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
@@ -0,0 +1,40 @@
+From bea4678261328c841b6062014394e6d3230a2fdb Mon Sep 17
00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 12:42:38 +0200
+Subject: [PATCH 4/8] timeutils: fix iterating out of the
range of timestamp
+ buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady
<laszlo.varady@...>
+Signed-off-by: Balazs Scheidler <bazsi77@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c
b/lib/timeutils/scan-timestamp.c
+index 2f6a6b7..cb6802d 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -328,7 +328,7 @@ __parse_usec(const guchar **data, gint
*length)
+ src++;
+ (*length)--;
+ }
+- while (isdigit(*src))
++ while (*length > 0 && isdigit(*src))
+ {
+ src++;
+ (*length)--;
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
new file mode 100644
index 000000000..487118957
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
@@ -0,0 +1,213 @@
+From 1f62031101608bee8ad772967eb8151aa33d6e1a Mon Sep 17
00:00:00 2001
+From: Balazs Scheidler <bazsi77@...>
+Date: Sat, 20 Aug 2022 12:43:42 +0200
+Subject: [PATCH 5/8] timeutils: add tests for non-zero
terminated inputs
+
+Signed-off-by: Balazs Scheidler <bazsi77@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ lib/timeutils/tests/test_scan-timestamp.c | 126
+++++++++++++++++++---
+ 1 file changed, 113 insertions(+), 13 deletions(-)
+
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c
b/lib/timeutils/tests/test_scan-timestamp.c
+index 2756bf3..da375c8 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -49,17 +49,21 @@ fake_time_add(time_t diff)
+ }
+
+ static gboolean
+-_parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc3164(const gchar *ts, gint len, gchar
isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
+-
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc3164_timestamp(&data,
&length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct,
&stamp);
+
+@@ -70,16 +74,21 @@ _parse_rfc3164(const gchar *ts, gchar
isotimestamp[32])
+ }
+
+ static gboolean
+-_parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc5424(const gchar *ts, gint len, gchar
isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc5424_timestamp(&data,
&length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct,
&stamp);
+
+@@ -90,31 +99,60 @@ _parse_rfc5424(const gchar *ts, gchar
isotimestamp[32])
+ }
+
+ static gboolean
+-_rfc3164_timestamp_eq(const gchar *ts, const gchar
*expected, gchar converted[32])
++_rfc3164_timestamp_eq(const gchar *ts, gint len, const gchar
*expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc3164(ts, converted));
++ cr_assert(_parse_rfc3164(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ static gboolean
+-_rfc5424_timestamp_eq(const gchar *ts, const gchar
*expected, gchar converted[32])
++_rfc5424_timestamp_eq(const gchar *ts, gint len, const gchar
*expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc5424(ts, converted));
++ cr_assert(_parse_rfc5424(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ #define _expect_rfc3164_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc3164_timestamp_eq(ts, expected,
converted), "Parsed RFC3164 timestamp does not equal expected,
ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc3164_timestamp_eq(ts, -1, expected,
converted), "Parsed RFC3164 timestamp does not equal expected,
ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_timestamp_len_eq(ts, len, expected)
\
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc3164_timestamp_eq(ts, len, expected,
converted), "Parsed RFC3164 timestamp does not equal expected,
ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc3164_timestamp(&data,
&length, &wct)); \
+ })
+
+ #define _expect_rfc5424_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc5424_timestamp_eq(ts, expected,
converted), "Parsed RFC5424 timestamp does not equal expected,
ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc5424_timestamp_eq(ts, -1, expected,
converted), "Parsed RFC5424 timestamp does not equal expected,
ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_timestamp_len_eq(ts, len, expected)
\
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc5424_timestamp_eq(ts, len, expected,
converted), "Parsed RFC5424 timestamp does not equal expected,
ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc5424_timestamp(&data,
&length, &wct)); \
+ })
+
++
+ Test(parse_timestamp, standard_bsd_format)
+ {
+ _expect_rfc3164_timestamp_eq("Oct 1 17:46:12",
"2017-10-01T17:46:12.000+02:00");
+@@ -148,6 +186,68 @@ Test(parse_timestamp,
standard_bsd_format_year_in_the_past)
+ _expect_rfc3164_timestamp_eq("Dec 31 17:46:12",
"2017-12-31T17:46:12.000+01:00");
+ }
+
++Test(parse_timestamp,
non_zero_terminated_rfc3164_iso_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts),
"2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5,
"2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len,
"2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET
*/
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 1,
"2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the
right */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 2,
"2022-08-17T05:02:28.410+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 3,
"2022-08-17T05:02:28.400+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 4,
"2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 5,
"2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++
++}
++
++Test(parse_timestamp,
non_zero_terminated_rfc3164_bsd_pix_or_asa_input_is_handled_properly)
++{
++ gchar *ts = "Aug 17 2022 05:02:28: whatever";
++ gint ts_len = 21;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts),
"2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5,
"2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len,
"2022-08-17T05:02:28.000+02:00");
++
++ /* no ":" at the end, that's a problem, unrecognized */
++ _expect_rfc3164_fails(ts, ts_len - 1);
++
++ for (gint i = 1; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++}
++
++Test(parse_timestamp,
non_zero_terminated_rfc5424_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc5424_timestamp_len_eq(ts, strlen(ts),
"2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len + 5,
"2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len,
"2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET
*/
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 1,
"2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the
right */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 2,
"2022-08-17T05:02:28.410+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 3,
"2022-08-17T05:02:28.400+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 4,
"2022-08-17T05:02:28.000+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 5,
"2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc5424_fails(ts, ts_len - i);
++
++}
++
+
+ Test(parse_timestamp,
daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
new file mode 100644
index 000000000..e32076ab5
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
@@ -0,0 +1,182 @@
+From 14bcd1596f0f194b28e3f7babc75ad90d39ae7af Mon Sep 17
00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:29:43 +0200
+Subject: [PATCH 6/8] timeutils: name repeating constant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady
<laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 54
++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c
b/lib/timeutils/scan-timestamp.c
+index cb6802d..197e3ad 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -34,41 +34,43 @@ scan_day_abbrev(const gchar **buf, gint
*left, gint *wday)
+ {
+ *wday = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'S':
+- if (strncasecmp(*buf, "Sun", 3) == 0)
++ if (strncasecmp(*buf, "Sun", abbrev_length) == 0)
+ *wday = 0;
+- else if (strncasecmp(*buf, "Sat", 3) == 0)
++ else if (strncasecmp(*buf, "Sat", abbrev_length) == 0)
+ *wday = 6;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mon", 3) == 0)
++ if (strncasecmp(*buf, "Mon", abbrev_length) == 0)
+ *wday = 1;
+ else
+ return FALSE;
+ break;
+ case 'T':
+- if (strncasecmp(*buf, "Tue", 3) == 0)
++ if (strncasecmp(*buf, "Tue", abbrev_length) == 0)
+ *wday = 2;
+- else if (strncasecmp(*buf, "Thu", 3) == 0)
++ else if (strncasecmp(*buf, "Thu", abbrev_length) == 0)
+ *wday = 4;
+ else
+ return FALSE;
+ break;
+ case 'W':
+- if (strncasecmp(*buf, "Wed", 3) == 0)
++ if (strncasecmp(*buf, "Wed", abbrev_length) == 0)
+ *wday = 3;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Fri", 3) == 0)
++ if (strncasecmp(*buf, "Fri", abbrev_length) == 0)
+ *wday = 5;
+ else
+ return FALSE;
+@@ -77,8 +79,8 @@ scan_day_abbrev(const gchar **buf, gint
*left, gint *wday)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+@@ -87,63 +89,65 @@ scan_month_abbrev(const gchar **buf, gint
*left, gint *mon)
+ {
+ *mon = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'J':
+- if (strncasecmp(*buf, "Jan", 3) == 0)
++ if (strncasecmp(*buf, "Jan", abbrev_length) == 0)
+ *mon = 0;
+- else if (strncasecmp(*buf, "Jun", 3) == 0)
++ else if (strncasecmp(*buf, "Jun", abbrev_length) == 0)
+ *mon = 5;
+- else if (strncasecmp(*buf, "Jul", 3) == 0)
++ else if (strncasecmp(*buf, "Jul", abbrev_length) == 0)
+ *mon = 6;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Feb", 3) == 0)
++ if (strncasecmp(*buf, "Feb", abbrev_length) == 0)
+ *mon = 1;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mar", 3) == 0)
++ if (strncasecmp(*buf, "Mar", abbrev_length) == 0)
+ *mon = 2;
+- else if (strncasecmp(*buf, "May", 3) == 0)
++ else if (strncasecmp(*buf, "May", abbrev_length) == 0)
+ *mon = 4;
+ else
+ return FALSE;
+ break;
+ case 'A':
+- if (strncasecmp(*buf, "Apr", 3) == 0)
++ if (strncasecmp(*buf, "Apr", abbrev_length) == 0)
+ *mon = 3;
+- else if (strncasecmp(*buf, "Aug", 3) == 0)
++ else if (strncasecmp(*buf, "Aug", abbrev_length) == 0)
+ *mon = 7;
+ else
+ return FALSE;
+ break;
+ case 'S':
+- if (strncasecmp(*buf, "Sep", 3) == 0)
++ if (strncasecmp(*buf, "Sep", abbrev_length) == 0)
+ *mon = 8;
+ else
+ return FALSE;
+ break;
+ case 'O':
+- if (strncasecmp(*buf, "Oct", 3) == 0)
++ if (strncasecmp(*buf, "Oct", abbrev_length) == 0)
+ *mon = 9;
+ else
+ return FALSE;
+ break;
+ case 'N':
+- if (strncasecmp(*buf, "Nov", 3) == 0)
++ if (strncasecmp(*buf, "Nov", abbrev_length) == 0)
+ *mon = 10;
+ else
+ return FALSE;
+ break;
+ case 'D':
+- if (strncasecmp(*buf, "Dec", 3) == 0)
++ if (strncasecmp(*buf, "Dec", abbrev_length) == 0)
+ *mon = 11;
+ else
+ return FALSE;
+@@ -152,8 +156,8 @@ scan_month_abbrev(const gchar **buf, gint
*left, gint *mon)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
new file mode 100644
index 000000000..b3135df4e
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
@@ -0,0 +1,84 @@
+From d4c8ba0c513052b5f19c6e989ba31f847f4900d1 Mon Sep 17
00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:30:22 +0200
+Subject: [PATCH 7/8] timeutils: fix invalid calculation of
ISO timestamp
+ length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady
<laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 8 ++++++--
+ lib/timeutils/tests/test_scan-timestamp.c | 7 +++++++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c
b/lib/timeutils/scan-timestamp.c
+index 197e3ad..4e618e4 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -346,19 +346,21 @@ __parse_usec(const guchar **data, gint
*length)
+ static gboolean
+ __has_iso_timezone(const guchar *src, gint length)
+ {
+- return (length >= 5) &&
++ return (length >= 6) &&
+ (*src == '+' || *src == '-') &&
+ isdigit(*(src+1)) &&
+ isdigit(*(src+2)) &&
+ *(src+3) == ':' &&
+ isdigit(*(src+4)) &&
+ isdigit(*(src+5)) &&
+- !isdigit(*(src+6));
++ (length < 7 || !isdigit(*(src+6)));
+ }
+
+ static guint32
+ __parse_iso_timezone(const guchar **data, gint *length)
+ {
++ g_assert(*length >= 6);
++
+ gint hours, mins;
+ const guchar *src = *data;
+ guint32 tz = 0;
+@@ -368,8 +370,10 @@ __parse_iso_timezone(const guchar
**data, gint *length)
+ hours = (*(src + 1) - '0') * 10 + *(src + 2) - '0';
+ mins = (*(src + 4) - '0') * 10 + *(src + 5) - '0';
+ tz = sign * (hours * 3600 + mins * 60);
++
+ src += 6;
+ (*length) -= 6;
++
+ *data = src;
+ return tz;
+ }
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c
b/lib/timeutils/tests/test_scan-timestamp.c
+index da375c8..9b38738 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -248,6 +248,13 @@ Test(parse_timestamp,
non_zero_terminated_rfc5424_input_is_handled_properly)
+
+ }
+
++Test(parse_timestamp,
non_zero_terminated_rfc5424_timestamp_only)
++{
++ const gchar *ts = "2022-08-17T05:02:28.417+03:00";
++ gint ts_len = strlen(ts);
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, ts);
++}
++
+
+ Test(parse_timestamp,
daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
new file mode 100644
index 000000000..cec573fa2
--- /dev/null
+++
b/meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
@@ -0,0 +1,47 @@
+From f60dcfa9e094dc9c2a752115ca426159c4ae4192 Mon Sep 17
00:00:00 2001
+From: Laszlo Varady <laszlo.varady@...>
+Date: Sat, 20 Aug 2022 14:30:51 +0200
+Subject: [PATCH 8/8] timeutils: fix out-of-bounds reading of
data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady
<laszlo.varady@...>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
+
+Signed-off-by: Ovidiu Panait
<ovidiu.panait@...>
+---
+ lib/timeutils/scan-timestamp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c
b/lib/timeutils/scan-timestamp.c
+index 4e618e4..0f7f52e 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -427,7 +427,7 @@ __parse_bsd_timestamp(const guchar
**data, gint *length, WallClockTime *wct)
+ if (!scan_pix_timestamp((const gchar **) &src,
&left, wct))
+ return FALSE;
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ src++;
+ left--;
+@@ -478,7 +478,7 @@ scan_rfc3164_timestamp(const guchar
**data, gint *length, WallClockTime *wct)
+ * looking at you, skip that as well, so we can reliably
detect IPv6
+ * addresses as hostnames, which would be using ":" as
well. */
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ ++src;
+ --left;
+--
+2.37.3
+
+
diff --git
a/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
b/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
index 40bbfe495..5fc386e56 100644
--- a/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
+++ b/meta-oe/recipes-support/syslog-ng/syslog-ng_3.36.1.bb
@@ -22,6 +22,14 @@ SRC_URI =
"https://github.com/balabit/syslog-ng/releases/download/${BP}/${BP}.ta
file://volatiles.03_syslog-ng \
file://syslog-ng-tmp.conf \
file://syslog-ng.service-the-syslog-ng-service.patch
\
+ file://CVE-2022-38725-0001.patch
\
+ file://CVE-2022-38725-0002.patch
\
+ file://CVE-2022-38725-0003.patch
\
+ file://CVE-2022-38725-0004.patch
\
+ file://CVE-2022-38725-0005.patch
\
+ file://CVE-2022-38725-0006.patch
\
+ file://CVE-2022-38725-0007.patch
\
+ file://CVE-2022-38725-0008.patch
\
"
SRC_URI[sha256sum] =
"90a25c9767fe749db50f118ddfc92ec71399763d2ecd5ad4f11ff5eea049e60b"
--
2.34.1
Sent from
Mail for Windows
--
# Randy MacLeod
# Wind River Linux
|
|
|
Re: [PATCH] kbd: DEPEND on bison-native and don't build tests
Khem Raj
please send this patch to oe-core mailing list as thats where the
patch belongs to
toggle quoted message
Show quoted text
On Tue, Nov 22, 2022 at 8:00 AM Ola x Nilsson <olani@...> wrote:
bison-native is required if any .y-file is changed.
Add --disable-tests to EXTRA_OECONF as the tests are not usable in
ptest - they can only run in-situ - and fails when building with
-D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64.
Signed-off-by: Ola x Nilsson <olani@...>
---
meta/recipes-core/kbd/kbd_2.5.1.bb | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/kbd/kbd_2.5.1.bb b/meta/recipes-core/kbd/kbd_2.5.1.bb
index aa3ab6e121..75b3c2765a 100644
--- a/meta/recipes-core/kbd/kbd_2.5.1.bb
+++ b/meta/recipes-core/kbd/kbd_2.5.1.bb
@@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
inherit autotools gettext pkgconfig
-DEPENDS += "flex-native"
+DEPENDS += "bison-native flex-native"
RREPLACES:${PN} = "console-tools"
RPROVIDES:${PN} = "console-tools"
@@ -18,6 +18,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/${BP}.tar.xz \
SRC_URI[sha256sum] = "ccdf452387a6380973d2927363e9cbb939fa2068915a6f937ff9d24522024683"
+EXTRA_OECONF = "--disable-tests"
PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)} \
"
--
2.30.2
|
|
|
[meta-networking][PATCH] lldpd: Use github release assets for SRC_URI
Khem Raj
media.luffy.cx seems unreliable as AB is not able to fetch it Signed-off-by: Khem Raj <raj.khem@...> --- meta-networking/recipes-daemons/lldpd/lldpd_1.0.16.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-networking/recipes-daemons/lldpd/lldpd_1.0.16.bb b/meta-networking/recipes-daemons/lldpd/lldpd_1.0.16.bb index c7237d74bb..6638de1ba1 100644 --- a/meta-networking/recipes-daemons/lldpd/lldpd_1.0.16.bb +++ b/meta-networking/recipes-daemons/lldpd/lldpd_1.0.16.bb @@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/ISC;md5=f3b90e DEPENDS = "libbsd libevent" SRC_URI = "\ - http://media.luffy.cx/files/${BPN}/${BPN}-${PV}.tar.gz \ + https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz \ file://lldpd.init.d \ file://lldpd.default \ file://run-ptest \ -- 2.38.1
|
|
|
[meta-oe][PATCH] boinc-client: Update boinc from 7.18.1 to 7.20.4
Drop patches now upstream, or deprecated due to gtk3 switch Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@...> Signed-off-by: Gianfranco Costamagna <locutusofborg@...> --- .../boinc/boinc-client/4563.patch | 36 ------------------- .../boinc/boinc-client/gtk-configure.patch | 28 --------------- ...lient_7.18.1.bb => boinc-client_7.20.4.bb} | 16 ++------- 3 files changed, 3 insertions(+), 77 deletions(-) delete mode 100644 meta-oe/recipes-extended/boinc/boinc-client/4563.patch delete mode 100644 meta-oe/recipes-extended/boinc/boinc-client/gtk-configure.patch rename meta-oe/recipes-extended/boinc/{boinc-client_7.18.1.bb => boinc-client_7.20.4.bb} (87%) diff --git a/meta-oe/recipes-extended/boinc/boinc-client/4563.patch b/meta-oe/recipes-extended/boinc/boinc-client/4563.patch deleted file mode 100644 index a18da4539..000000000 --- a/meta-oe/recipes-extended/boinc/boinc-client/4563.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 689dc20ede9768377d4032ff8c70b58269c8dc9c Mon Sep 17 00:00:00 2001 -From: Charlie Fenton <charlief@...> -Date: Mon, 18 Oct 2021 01:43:08 -0700 -Subject: [PATCH 01/10] Mac: update dependent libraries to latest: - c-ares-1.17.2, curl-7.79.1, freetype-2.11.0, openssl-3.0.0 Previously updated - to wxWidgets-3.1.5. FTGL version ftgl-2.1.3~rc5 is still the current - version. - ---- - lib/crypt.cpp | 7 +- - 8 files changed, 199 insertions(+), 150 deletions(-) - -diff --git a/lib/crypt.cpp b/lib/crypt.cpp -index 01249cfc340..9b1f69160b8 100644 ---- a/lib/crypt.cpp -+++ b/lib/crypt.cpp -@@ -1,6 +1,6 @@ - // This file is part of BOINC. - // http://boinc.berkeley.edu--// Copyright (C) 2008 University of California -+// Copyright (C) 2021 University of California - // - // BOINC is free software; you can redistribute it and/or modify it - // under the terms of the GNU Lesser General Public License -@@ -672,7 +672,10 @@ int check_validity_of_cert( - } - #ifdef HAVE_OPAQUE_RSA_DSA_DH - RSA *rsa; -- rsa = EVP_PKEY_get0_RSA(pubKey); -+ // CAUTION: In OpenSSL 3.0.0, EVP_PKEY_get0_RSA() now returns a -+ // pointer of type "const struct rsa_st*" to an immutable value. -+ // Do not try to modify the contents of the returned struct. -+ rsa = (rsa_st*)EVP_PKEY_get0_RSA(pubKey); - if (!RSA_blinding_on(rsa, c)) { - #else - if (!RSA_blinding_on(pubKey->pkey.rsa, c)) { diff --git a/meta-oe/recipes-extended/boinc/boinc-client/gtk-configure.patch b/meta-oe/recipes-extended/boinc/boinc-client/gtk-configure.patch deleted file mode 100644 index 3b814e903..000000000 --- a/meta-oe/recipes-extended/boinc/boinc-client/gtk-configure.patch +++ /dev/null @@ -1,28 +0,0 @@ -From d53e9617fb6446780478bb13907efd111f241cd1 Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@...> -Date: Thu, 3 Nov 2016 01:20:33 -0700 -Subject: [PATCH] Check for gtk2+ only when manager is enabled - -Signed-off-by: Khem Raj <raj.khem@...> -Upstream-Status: Pending - ---- - configure.ac | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index 7beeb34ae2..35234c2762 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1044,6 +1044,11 @@ else - AM_CONDITIONAL([GUI_GTK], false) - fi - -+dnl ---------- GTK+2.0----------------------------------------------------- -+if test "X${no_x}" != "Xyes"; then -+ PKG_CHECK_MODULES([GTK2], [gtk+-2.0]) -+fi -+ - dnl ---------- libNotify -------------------------------------------------- - if test "${enable_manager}" = yes ; then - PKG_CHECK_MODULES(LIBNOTIFY, [libnotify]) diff --git a/meta-oe/recipes-extended/boinc/boinc-client_7.18.1.bb b/meta-oe/recipes-extended/boinc/boinc-client_7.20.4.bb similarity index 87% rename from meta-oe/recipes-extended/boinc/boinc-client_7.18.1.bb rename to meta-oe/recipes-extended/boinc/boinc-client_7.20.4.bb index 8f85a508e..4cbbca23f 100644 --- a/meta-oe/recipes-extended/boinc/boinc-client_7.18.1.bb +++ b/meta-oe/recipes-extended/boinc/boinc-client_7.20.4.bb @@ -26,15 +26,13 @@ DEPENDS = "curl \ sqlite3 \ virtual/egl \ ${@bb.utils.contains('DISTRO_FEATURES', 'wayland', 'libnotify', '', d)} \ - ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'gtk+ libnotify xcb-util libxscrnsaver', '', d)} \ + ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'gtk+3 wxwidgets libnotify xcb-util libxscrnsaver', '', d)} \ nettle \ " -SRCREV = "b49adfb118211e11c719766c0d71e7bdfe7f3363" -BRANCH = "client_release/7/7.18" +SRCREV = "1eca0c7931d0409d65a1254dc5d5c46abe058daa" +BRANCH = "client_release/7/7.20" SRC_URI = "git://github.com/BOINC/boinc;protocol=https;branch=${BRANCH} \ file://boinc-AM_CONDITIONAL.patch \ - file://gtk-configure.patch \ - file://4563.patch \ file://0001-scripts-Do-not-check-for-files-on-build-host.patch \ " @@ -61,14 +59,6 @@ EXTRA_OECONF += "\ " export PKG_CONFIG = "${STAGING_BINDIR_NATIVE}/pkg-config" -do_configure:prepend () { - if [ "${@bb.utils.contains('DEPENDS', 'gtk+', '1', '0', d)}" = "0" ] - then - export GTK2_CFLAGS="" - export GTK2_LIBS="" - fi -} - do_compile:prepend () { # Disable rpaths sed -i -e 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' ${B}/libtool -- 2.34.1
|
|
|
[meta-oe][PATCH] protobuf: stage protoc binary to sysroot
If protoc is enabled for the build, recipes using protobuf will
fail when protoc is not available in the recipe sysroot:
| The imported target "protobuf::protoc" references the file
|
| ".../recipe-sysroot/usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/usr/bin/protoc-3.21.5.0"
|
| but this file does not exist. Possible reasons include:
|
| * The file was deleted, renamed, or moved to another location.
|
| * An install or uninstall procedure did not complete successfully.
|
| * The installation package was faulty and contained
|
| ".../recipe-sysroot/usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/usr/lib/cmake/protobuf/protobuf-targets.cmake"
|
| but not all the files it references.
Use SYSROOT_DIRS to stage the binary to sysroot so it's always
available for other recipes.
Signed-off-by: Samuli Piippo <samuli.piippo@...>
---
meta-oe/recipes-devtools/protobuf/protobuf_3.21.5.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-devtools/protobuf/protobuf_3.21.5.bb b/meta-oe/recipes-devtools/protobuf/protobuf_3.21.5.bb
index c8b9158e6..201908f3c 100644
--- a/meta-oe/recipes-devtools/protobuf/protobuf_3.21.5.bb
+++ b/meta-oe/recipes-devtools/protobuf/protobuf_3.21.5.bb
@@ -92,6 +92,8 @@ PACKAGE_BEFORE_PN = "${PN}-compiler ${PN}-lite"
FILES:${PN}-compiler = "${bindir} ${libdir}/libprotoc${SOLIBS}"
FILES:${PN}-lite = "${libdir}/libprotobuf-lite${SOLIBS}"
+SYSROOT_DIRS += "${bindir}"
+
RDEPENDS:${PN}-compiler = "${PN}"
RDEPENDS:${PN}-dev += "${PN}-compiler"
RDEPENDS:${PN}-ptest = "bash ${@bb.utils.contains('PACKAGECONFIG', 'python', 'python3-protobuf', '', d)}"
--
2.25.1
|
|
|
[meta-oe][PATCH] vbxguestdrivers: upgrade 7.0.2 -> 7.0.4
Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@...> Signed-off-by: Gianfranco Costamagna <locutusofborg@...> --- .../{vboxguestdrivers_7.0.2.bb => vboxguestdrivers_7.0.4.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-support/vboxguestdrivers/{vboxguestdrivers_7.0.2.bb => vboxguestdrivers_7.0.4.bb} (97%) diff --git a/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_7.0.2.bb b/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_7.0.4.bb similarity index 97% rename from meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_7.0.2.bb rename to meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_7.0.4.bb index 49c2a3f2a..91f5ae0e0 100644 --- a/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_7.0.2.bb +++ b/meta-oe/recipes-support/vboxguestdrivers/vboxguestdrivers_7.0.4.bb @@ -15,7 +15,7 @@ SRC_URI = " http://download.virtualbox.org/virtualbox/${PV}/${VBOX_NAME}.tar.bz2 file://Makefile.utils \ " -SRC_URI[sha256sum] = "612fd6fc417e0067653091a613e1d4fa084d3f42407dff5f991a0eb1e2ab26c8" +SRC_URI[sha256sum] = "58951f7d1bcda836c5e50ca0a6b13f0e61a07a904f476526a831df3d9bfe5b17" S ?= "${WORKDIR}/vbox_module" S:task-patch = "${WORKDIR}/${VBOX_NAME}" -- 2.34.1
|
|
|
[meta-xfce][PATCH] xfce4-settings: 4.16.3 -> 4.16.5
From: Kai Kang <kai.kang@...>
It fixes CVE-2022-45062 in xfce4-settings 4.16.5.
CVE: CVE-2022-45062
Signed-off-by: Kai Kang <kai.kang@...>
---
.../{xfce4-settings_4.16.3.bb => xfce4-settings_4.16.5.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-xfce/recipes-xfce/xfce4-settings/{xfce4-settings_4.16.3.bb => xfce4-settings_4.16.5.bb} (93%)
diff --git a/meta-xfce/recipes-xfce/xfce4-settings/xfce4-settings_4.16.3.bb b/meta-xfce/recipes-xfce/xfce4-settings/xfce4-settings_4.16.5.bb
similarity index 93%
rename from meta-xfce/recipes-xfce/xfce4-settings/xfce4-settings_4.16.3.bb
rename to meta-xfce/recipes-xfce/xfce4-settings/xfce4-settings_4.16.5.bb
index f283edac6..4a4e9f188 100644
--- a/meta-xfce/recipes-xfce/xfce4-settings/xfce4-settings_4.16.3.bb
+++ b/meta-xfce/recipes-xfce/xfce4-settings/xfce4-settings_4.16.5.bb
@@ -9,7 +9,7 @@ inherit xfce features_check mime-xdg
REQUIRED_DISTRO_FEATURES = "x11"
SRC_URI += "file://0001-xsettings.xml-Set-default-themes.patch"
-SRC_URI[sha256sum] = "f299e6d26d8e142c0b7edeb9b8917d6bd50bc8647254ea585069c68f2bab8e64"
+SRC_URI[sha256sum] = "7a4f74802486d7e77a1c9fa4fda19b13fc8a8dec3e5074f367e34fa82b40d28e"
EXTRA_OECONF += "--enable-maintainer-mode --disable-debug"
--
2.17.1
|
|
|
[meta-python] [PATCH] python3-simplejson: upgrade 3.17.6 -> 3.18.0
Changelog: ========== * Allow serialization of classes that implement for_json or _asdict by ignoring TypeError when those methods are called https://github.com/simplejson/simplejson/pull/302* Raise JSONDecodeError instead of ValueError in invalid unicode escape sequence edge case https://github.com/simplejson/simplejson/pull/298Signed-off-by: Zheng Ruoqin <zhengrq.fnst@...> --- ...ython3-simplejson_3.17.6.bb => python3-simplejson_3.18.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-simplejson_3.17.6.bb => python3-simplejson_3.18.0.bb} (87%) diff --git a/meta-python/recipes-devtools/python/python3-simplejson_3.17.6.bb b/meta-python/recipes-devtools/python/python3-simplejson_3.18.0.bb similarity index 87% rename from meta-python/recipes-devtools/python/python3-simplejson_3.17.6.bb rename to meta-python/recipes-devtools/python/python3-simplejson_3.18.0.bb index b836f97fe..ccdd4ddba 100644 --- a/meta-python/recipes-devtools/python/python3-simplejson_3.17.6.bb +++ b/meta-python/recipes-devtools/python/python3-simplejson_3.18.0.bb @@ -4,7 +4,7 @@ HOMEPAGE = " http://cheeseshop.python.org/pypi/simplejson" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c6338d7abd321c0b50a2a547e441c52e" -SRC_URI[sha256sum] = "cf98038d2abf63a1ada5730e91e84c642ba6c225b0198c3684151b1f80c5f8a6" +SRC_URI[sha256sum] = "58a429d2c2fa80834115b923ff689622de8f214cf0dc4afa9f59e824b444ab31" inherit pypi setuptools3 -- 2.25.1
|
|
|
