From 365bab8d400e160f0e53fef73dc31d8cd451b9a6 Mon Sep 17 00:00:00 2001 From: Lars Wendler Date: Fri, 23 Jan 2015 19:36:03 +0000 Subject: [PATCH] Removed unused patches Package-Manager: portage-2.2.15/cvs/Linux x86_64 Manifest-Sign-Key: 0x981CA6FC --- sys-devel/patch/ChangeLog | 7 +- sys-devel/patch/Manifest | 30 ++- ...atch-2.7.2-fix_for_CVE-2015-1196_fix.patch | 220 ------------------ ...alid_filenames_on_renames_and_copies.patch | 66 ------ 4 files changed, 20 insertions(+), 303 deletions(-) delete mode 100644 sys-devel/patch/files/patch-2.7.2-fix_for_CVE-2015-1196_fix.patch delete mode 100644 sys-devel/patch/files/patch-2.7.2-valid_filenames_on_renames_and_copies.patch diff --git a/sys-devel/patch/ChangeLog b/sys-devel/patch/ChangeLog index 3269c476bd4e..9ab761f9100d 100644 --- a/sys-devel/patch/ChangeLog +++ b/sys-devel/patch/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for sys-devel/patch # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-devel/patch/ChangeLog,v 1.69 2015/01/23 19:33:40 polynomial-c Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-devel/patch/ChangeLog,v 1.70 2015/01/23 19:36:02 polynomial-c Exp $ + + 23 Jan 2015; Lars Wendler + -files/patch-2.7.2-fix_for_CVE-2015-1196_fix.patch, + -files/patch-2.7.2-valid_filenames_on_renames_and_copies.patch: + Removed unused patches. *patch-2.7.3 (23 Jan 2015) diff --git a/sys-devel/patch/Manifest b/sys-devel/patch/Manifest index 7181d59181e9..f013860c96ae 100644 --- a/sys-devel/patch/Manifest +++ b/sys-devel/patch/Manifest @@ -6,8 +6,6 @@ AUX patch-2.7.1-Fix-removing-empty-directories.patch 2094 SHA256 9e1a576fedac307 AUX patch-2.7.1-dry-run-mode-create-temp-files-in-temp-dir.patch 815 SHA256 1b9c214bb21ce98e0205161110b27ce7c3fade80f1c5af799ee064b33f3cd1e8 SHA512 fbb7adfafedda770c4662c31004b87c1184bc52025d71f0500af8494fccdceb9a21ebdf9d4bfb7429318a3b3d4766c74f26bca250cba88242e5624618a83e058 WHIRLPOOL 67d7adfb7a1ebcb889801942c504c1f1d17e1729d5e791a70010b5969712e313671c6c9617b576294d699572baed487a435d70419100fdd6c3d94cb469e8a012 AUX patch-2.7.1-initialize_data_structures_early_enough.patch 2148 SHA256 62aacb522251df87f4882533f68d09a42022461c76491e0560aa4e25ddcdbab0 SHA512 57ffb7a22056b1e37d442b63aff2df7df041c6950b7d437b726c3021224bf81035fbbee88a815ba98d9449229a5426f1aa7cbf9265f8fb8ef6e9b608b0f9841a WHIRLPOOL 083ac9efb2445afbfb645da86873a13a06b869c77499d6870e332175c33d7d89de03e85bcae749c5755b9b888592604e4f894eeb1b998ddd856f4ad32f346858 AUX patch-2.7.1-prevent_depend_on_autotools.patch 1602 SHA256 0988b3e0bb9d192fe3e6923c4d8e3550e6f290dac8d44bddcc0505b6bd2d67d0 SHA512 ec639c2a21216501822b49395596e2139ad2f7570bb75a393f4591501d56ae05c3376a712c0ad4984d715a3410da4113298bca5a571a005762d73069cc45bfca WHIRLPOOL 9a197ba472f08e5978b81c1ee04318ef367bb5bc9f439c97d511aa7653429a1da8e0967e55ab243a1003f786cd79f7939f1cc6aba7e5540b2fd09b0353e37bec -AUX patch-2.7.2-fix_for_CVE-2015-1196_fix.patch 6088 SHA256 5a66e13659f9126854350bf8f0e15bb11d48159fae2fc8187d2a20f4e38136c0 SHA512 9b7f2b45f11f884faa82be00ca98913f17bec820f7b5bf947881446509121826b56502f4753452d9a98130533ff07f224c375cce3a57a12c9acbd81d52c13c32 WHIRLPOOL 2e2c6dafe1b313f2772b975b392b29f162a71831a8daa641d596ea8f66f7b7fc9ff0375ac6edc30fae25fb118467fea693797bb78c836021b544c7bdb19b22ff -AUX patch-2.7.2-valid_filenames_on_renames_and_copies.patch 1843 SHA256 1905cc3418558b313634ec9ceaea06f223eef3de078ed0ccde2561f1eebb9129 SHA512 8e52cc952d8f1608e932b713501d9282a7cf568e0d8bd5b255263b2085d1bd90505103adc4a2964ec6924634baff0a47768c3f03518b585db549088defc1598c WHIRLPOOL 0f2baa2a8ec893cbbbc8a1d2374f0ee06d6d93cb98d5f7d8655d95a3cb75d2d367167a2a42dbd925d027800b2ae787c6464f0a6c97f0a4f9bb0c2f8b294b2592 DIST patch-2.6.1.tar.bz2 253719 SHA256 1d1441380c92ed8572049411406964a0a987aefd228be3abb8623eca1f3ced8a SHA512 a751bd9d14c82e047c9e914bf03f3296f76e2ebc3f9fb4c3f480590c303d492235a6b340056c612afef6c6b2c8d8de794189b5ba933f53687effb6acb2c5b187 WHIRLPOOL c93833d02d981fa417f5389638ec4731b5addfc0314f92709deb992ad6bab86e67b68b5ee704ed46627944469f1c4e58df51b316c1f4539e196077639013c600 DIST patch-2.7.1.tar.xz 675896 SHA256 9124ba46db0abd873d0995c2ca880e81252676bb6c03e0a37dfc5f608a9b0ceb SHA512 e10274bd59875d4ec5b02960d23f54e5b2a94ac19554c4a013fdb1df48f01012ce418627c74f7a6bd0a416527dd2ead347642878a057048ede9ee2d9c76a51b0 WHIRLPOOL 5e9d4f2f3ea0fe6d4c9ca577a1ca9103b78d7429e7f67cce4eb2cdea00c71cb9bfe9882101c04be3a5fa6a9ad5e05ff3f1d851a5ef2ae4b80f03696d1c13c6f9 DIST patch-2.7.2.tar.xz 684108 SHA256 9a55c7e7415fa789acc45dbe78fe4675b1fa12c1ccb19f1513f69fca3f798a9a SHA512 dcfcc06e0503236b05a9202906116a5ec039b30d8d4ad0eddd63601a2ba37b81cd4ebf71749ff69c0e05d49ae4fe8a01332d5c6c6499ab5eb1eea9176b374ede WHIRLPOOL 66e019eef0b33709357a5ffcdf43f43ad41673c64368644676ab82407611e905f201446042c824c30e690424f5db218ad4903785431bbd479c1be249c5e72732 @@ -16,22 +14,22 @@ EBUILD patch-2.6.1.ebuild 1013 SHA256 56f327dfdcf34f638721dc42e60f682121799b1e5d EBUILD patch-2.7.1-r3.ebuild 1388 SHA256 b59edda27f1c76d18fa3130cca5d5c3af0a6556ead06698ce0e6f510cf38ef63 SHA512 7192e4fd2f7856f2a9d599af1d9dfe13629c731d1b5d9da72cfa1f4c619b47131620656c859aece426ef64160741cbe8b3c3433a2164d49e49a5a5894a3cde72 WHIRLPOOL 7fe063706978f7831d30a691d0e082c16727a91a50ba5700b5ae2f583cf82b9460ebdeb8609f2a5f8545e7eb858699888b4d3f983202cf2412b487a90b7de306 EBUILD patch-2.7.2.ebuild 1110 SHA256 52fde29093c1bc3627472f332ad14304c5a40bc09260aa06cae9d6054f0c8cf9 SHA512 52c50725ef3376ae9ed81c8056ef20fb1b58f21228e7a3118483aa7546406f3b30343ee5d7b0b91720992c5b46086e9388a6db434f53e3a258ac606576e9571e WHIRLPOOL 9e9d55448c84410f756553da9c576caa3df591837c262ab0086b07e0d27ca4d44ae4a19a24492b6c234c5842a8e12bf78c6d7ba659739dcf2ace1cad8850d86d EBUILD patch-2.7.3.ebuild 1110 SHA256 faecabd660838124dc81b00f55da98772788c93d30d0fdb37f9ee52db2babee5 SHA512 1c4e88ca1404b3ce2cc0f2fa6f15647f13a3401a5429648904267a5c230abcc8a95e3d67cf51c13510b56d3854ee90f33ade2c64048e7e81dc88b5105cc2711b WHIRLPOOL 3baf67e12e7b67ca1e82820021c970dbd5f7035d6303b5be1d9dc502938826ef82dabc0a889063bb2d1612373ac23301c15e6727883b49877e82af8ec59f03b8 -MISC ChangeLog 8644 SHA256 8055a1cd685e450e485863df5e16f34c9cc22dd16583b6c8cdfa9913e3b1d66b SHA512 8d76df773c2d5909e30f5eace919608780519cc87ef4029649ad3529dd10b35b6b7d3b6a624ac09e75cfeba3308e531a7aa89209b1aca155765d01e2f1202a7f WHIRLPOOL 73253d02c3f18be6fd85a46b1825e13a754d1f80ba017bffa63cfa2a486ac02db3125fe5e0cdc0d97295a4874d95577dac05152bb3f243b006026f58ffe2ecd2 +MISC ChangeLog 8845 SHA256 ca80267fcb831e38e3acb52457ad651514bc89b1d4447ebb0d2245a078aa150c SHA512 9536000324312a7a0bde6ffd0d27ef1e18feb20ff87609acb5bb89cd0a974b128a65077f663e1e29c1e5d3abef33c342126cd241d4ecae688d4f2bbfba718c49 WHIRLPOOL c2a6e017a429ef3a59247e81da9e911abdc45dde79bf93c5440522aecb3b788f0994e3bb2b60eca8251e7a89f492d84af4a65faa7d82f119517a074674e10fbe MISC metadata.xml 164 SHA256 f5f2891f2a4791cd31350bb2bb572131ad7235cd0eeb124c9912c187ac10ce92 SHA512 8eb0d5153d388f6ea069c64b93882244816a0a09aecc0d73cb872121ce0eb24c5ccafa96aad0b620b2300f319e1af101fa7fa6c5d0d561719d49bb07da0a2eca WHIRLPOOL 11a1441bddb7a6c69653c663902b7da5767ae6ad515ac2aabfc42fe37927a1ccc21472deeee454009ff720201a41c3e4a912df42661a0a87150fb46126da2d52 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 -iQIcBAEBCAAGBQJUwqIVAAoJEPiazRVxLXTFq1cP/0x3NT+5RCAi9+qyBUToNjJp -SdavJs7OXqkZFhykSuk2Ru+iuZpwVAoyNP54WkrPW81hvqfiQSi5m6mEVJ2abxWb -fffDxsNprVTBvu2QVCvUjdn0anEtTAlCjSJ5ApFxb9ffH2M/0yOhpsK2/5RgQqL0 -epMG3pg6NtuF/Hi430ruhHKw0d27qUaVzyKxHPe0p61SwoExs6cq/MaGz4XBd2Tx -08Q98+kogdKN7HtoWUMNGQM8yQ2vC5HM49/9BCmoVwlunSOP3ciy3cLS0tTqxEE7 -jQmbb/xUuK6pbBOsBJIAJXWq1vXJ0XVO4qC49FopRuYfSUQ55Fsta8a5whSwoLQm -gZgbCALFerD+2LWuen3s91CkIBjOLaMelaSvmmdQVVdpwG9tNETojARS6MCUKJuq -rzjJtCeASlpOVE45ObFblYK45xVAziifiCVuUr+xnXS59pL5tuCL7bHpcwhbB1xb -l4R6P0qHxFcyMvwhB59fEca+PI8FO2twg124rEwH9wpgqrexz+nwze7MDKPbVXC+ -xPbyhQgiHg+7gCJD0fngUciuUib8Jt7EgLKStgasOCIiYqpAwc/SaJzaOgaUXtsp -eeeo2yAa65uQ9Av5XbDIEstUsHDnbb7hC19136JabliPHY23uer71j3p51ghmN03 -96j8FfM3lFsr/2k6S51K -=zQKn +iQIcBAEBCAAGBQJUwqKjAAoJEPiazRVxLXTFrewP/2+vkHi9xHvTiplNnwH8aTJh +rc/NVtB/Z4YrsEe0qzz9SvLhk6PUnKQ9uNjuZU4DHDyd2H7gx16JaSkLShV3vJyM +U2/cXhKVFRhzMq9+v3tIUbpZyAUV+jvyDxHNWMYW2KNmjVfg7ZizL3qZ1EoUT/Xr +dNjJuyJJ+nyMn8tltvxBFzQQ2F3w6VAeisfYgD9Liz7VObOu1CYi8dN1Jq/O6CNq +muG7qPzyoWNkhQrEAqHHwb0F/Vp4ymdPpru9Lo9d5Kan6oJqGILPfq/SlsHMV2lL +/seqtDLBht5gH/ulCcaCTFYIHCQyIMat/w83AdMxvErYhT/gh8U6kwl4SbKXaNHS +cVCqZsbuw6gDGzgXBNKFFpLpl0x56opz/5gZ0wTmjtWkoiVzDhZtlmPshPfxQ6tA +0WM1ki7NsCSQ/DzSm8/kH0P8wFxqoO0yZRMJnxyZudN5ldKIi1WBUXyaXuqkGr3c +fvf9kBqQvfdBzzFNRaQ1IMlY3vll34jspYM4ot3cRKe8+cYLWE0FmBGgsOSmbDNy +hUpatBovoFPsMDiv4Tgx6Wx2jssTL+Dt5nz6cT5i3Mm99GYJaPgQujYgYkjc2i8S +rhMwXgdA6GXrPaVzuIkpLrFE3SG5wMHp1mR71LjueJXL1ZNPf+eMCIt7fzjg7nDb +J63M8Fzdaq+ls6l5e3vB +=WyJw -----END PGP SIGNATURE----- diff --git a/sys-devel/patch/files/patch-2.7.2-fix_for_CVE-2015-1196_fix.patch b/sys-devel/patch/files/patch-2.7.2-fix_for_CVE-2015-1196_fix.patch deleted file mode 100644 index 7f5130c56c3c..000000000000 --- a/sys-devel/patch/files/patch-2.7.2-fix_for_CVE-2015-1196_fix.patch +++ /dev/null @@ -1,220 +0,0 @@ -From 41688ad8ef88bc296f3bed30b171ec73e5876b88 Mon Sep 17 00:00:00 2001 -From: Andreas Gruenbacher -Date: Wed, 21 Jan 2015 09:01:15 +0000 -Subject: Fix the fix for CVE-2015-1196 - -* src/util.c (filename_is_safe): New function split off from name_is_valid(). -(symlink_target_is_valid): Explain why we cannot have absolute symlinks or -symlinks with ".." components for now. -(move_file): Move absolute filename check here and explain. -* tests/symlinks: Put test case with ".." symlink in comments for now. -* NEWS: Add CVE number. ---- -diff --git a/NEWS b/NEWS -index d3f1c2d..d79cead 100644 ---- a/NEWS -+++ b/NEWS -@@ -4,7 +4,7 @@ - deleting". - * Function names in hunks (from diff -p) are now preserved in reject files. - * With git-style patches, symlinks that point outside the working directory -- will no longer be created. -+ will no longer be created (CVE-2015-1196). - - Changes in version 2.7.1: - -diff --git a/src/pch.c b/src/pch.c -index bb39576..028d51f 100644 ---- a/src/pch.c -+++ b/src/pch.c -@@ -401,21 +401,7 @@ name_is_valid (char const *name) - return false; - } - -- if (IS_ABSOLUTE_FILE_NAME (name)) -- is_valid = false; -- else -- for (n = name; *n; ) -- { -- if (*n == '.' && *++n == '.' && ( ! *++n || ISSLASH (*n))) -- { -- is_valid = false; -- break; -- } -- while (*n && ! ISSLASH (*n)) -- n++; -- while (ISSLASH (*n)) -- n++; -- } -+ is_valid = filename_is_safe (name); - - /* Allow any filename if we are in the filesystem root. */ - if (! is_valid && cwd_is_root (name)) -diff --git a/src/util.c b/src/util.c -index 94c7582..ae05caa 100644 ---- a/src/util.c -+++ b/src/util.c -@@ -423,55 +423,18 @@ create_backup (char const *to, const struct stat *to_st, bool leave_original) - } - } - -+/* Only allow symlink targets which are relative and free of ".." components: -+ * otherwise, the operating system may follow one of those symlinks in a -+ * pathname component, leading to a path traversal vulnerability. -+ * -+ * An alternative to disallowing many kinds of symlinks would be to implement -+ * path traversal in user space using openat() without following symlinks -+ * altogether. -+ */ - static bool - symlink_target_is_valid (char const *target, char const *to) - { -- bool is_valid; -- -- if (IS_ABSOLUTE_FILE_NAME (to)) -- is_valid = true; -- else if (IS_ABSOLUTE_FILE_NAME (target)) -- is_valid = false; -- else -- { -- unsigned int depth = 0; -- char const *t; -- -- is_valid = true; -- t = to; -- while (*t) -- { -- while (*t && ! ISSLASH (*t)) -- t++; -- if (ISSLASH (*t)) -- { -- while (ISSLASH (*t)) -- t++; -- depth++; -- } -- } -- -- t = target; -- while (*t) -- { -- if (*t == '.' && *++t == '.' && (! *++t || ISSLASH (*t))) -- { -- if (! depth--) -- { -- is_valid = false; -- break; -- } -- } -- else -- { -- while (*t && ! ISSLASH (*t)) -- t++; -- depth++; -- } -- while (ISSLASH (*t)) -- t++; -- } -- } -+ bool is_valid = filename_is_safe (target); - - /* Allow any symlink target if we are in the filesystem root. */ - return is_valid || cwd_is_root (to); -@@ -520,7 +483,11 @@ move_file (char const *from, bool *from_needs_removal, - read_fatal (); - buffer[size] = 0; - -- if (! symlink_target_is_valid (buffer, to)) -+ /* If we are allowed to create a file with an absolute path name, -+ anywhere, we also don't need to worry about symlinks that can -+ leave the working directory. */ -+ if (! (IS_ABSOLUTE_FILE_NAME (to) -+ || symlink_target_is_valid (buffer, to))) - { - fprintf (stderr, "symbolic link target '%s' is invalid\n", - buffer); -@@ -1720,6 +1687,28 @@ int stat_file (char const *filename, struct stat *st) - return xstat (filename, st) == 0 ? 0 : errno; - } - -+/* Check if a filename is relative and free of ".." components. -+ Such a path cannot lead to files outside the working tree -+ as long as the working tree only contains symlinks that are -+ "filename_is_safe" when followed. */ -+bool -+filename_is_safe (char const *name) -+{ -+ if (IS_ABSOLUTE_FILE_NAME (name)) -+ return false; -+ while (*name) -+ { -+ if (*name == '.' && *++name == '.' -+ && ( ! *++name || ISSLASH (*name))) -+ return false; -+ while (*name && ! ISSLASH (*name)) -+ name++; -+ while (ISSLASH (*name)) -+ name++; -+ } -+ return true; -+} -+ - /* Check if we are in the root of a particular filesystem namespace ("/" on - UNIX or a particular drive's root on DOS-like systems). */ - bool -diff --git a/src/util.h b/src/util.h -index 579c5de..6b3308a 100644 ---- a/src/util.h -+++ b/src/util.h -@@ -69,6 +69,7 @@ enum file_id_type lookup_file_id (struct stat const *); - void set_queued_output (struct stat const *, bool); - bool has_queued_output (struct stat const *); - int stat_file (char const *, struct stat *); -+bool filename_is_safe (char const *); - bool cwd_is_root (char const *); - - enum file_attributes { -diff --git a/tests/symlinks b/tests/symlinks -index 6211026..04a9b73 100644 ---- a/tests/symlinks -+++ b/tests/symlinks -@@ -148,20 +148,24 @@ ncheck 'test ! -L symlink' - - # Patch should not create symlinks which point outside the working directory. - --cat > symlink-target.diff < symlink-target.diff < bad-symlink-target1.diff < -Date: Wed, 21 Jan 2015 12:01:08 +0000 -Subject: For renames and copies, make sure that both file names are valid - -* src/patch.c (main): Allow there_is_another_patch() to set the -skip_rest_of_patch flag. -* src/pch.c (intuit_diff_type): For renames and copies, also check the "other" -file name. -(pch_copy, pch_rename): Now that both names are checked in intuit_diff_type(), -we know they are defined here. ---- -diff --git a/src/patch.c b/src/patch.c -index 441732e..cb4dbb2 100644 ---- a/src/patch.c -+++ b/src/patch.c -@@ -196,6 +196,9 @@ main (int argc, char **argv) - bool mismatch = false; - char const *outname = NULL; - -+ if (skip_rest_of_patch) -+ somefailed = true; -+ - if (have_git_diff != pch_git_diff ()) - { - if (have_git_diff) -diff --git a/src/pch.c b/src/pch.c -index 33facd9..bb39576 100644 ---- a/src/pch.c -+++ b/src/pch.c -@@ -978,6 +978,16 @@ intuit_diff_type (bool need_header, mode_t *p_file_type) - } - } - -+ if ((pch_rename () || pch_copy ()) -+ && ! inname -+ && ! ((i == OLD || i == NEW) && -+ p_name[! reverse] && -+ name_is_valid (p_name[! reverse]))) -+ { -+ say ("Cannot %s file without two valid file names\n", pch_rename () ? "rename" : "copy"); -+ skip_rest_of_patch = true; -+ } -+ - if (i == NONE) - { - if (inname) -@@ -2178,14 +2188,12 @@ pch_name (enum nametype type) - - bool pch_copy (void) - { -- return p_copy[OLD] && p_copy[NEW] -- && p_name[OLD] && p_name[NEW]; -+ return p_copy[OLD] && p_copy[NEW]; - } - - bool pch_rename (void) - { -- return p_rename[OLD] && p_rename[NEW] -- && p_name[OLD] && p_name[NEW]; -+ return p_rename[OLD] && p_rename[NEW]; - } - - /* Return the specified line position in the old file of the old context. */ --- -cgit v0.9.0.2 -- 2.26.2