From 3cba7281d690d6d290aa70fc28c851530fd6a3c5 Mon Sep 17 00:00:00 2001 From: Alexandre Rostovtsev Date: Thu, 5 Mar 2015 18:20:58 +0000 Subject: [PATCH] Fix potentially exploitable memory corruption (bug #542264, thanks to Agostino Sarubbo). Punt old. Package-Manager: portage-2.2.18/cvs/Linux x86_64 Manifest-Sign-Key: 0x18E5B6F2D8D5EC8D --- net-libs/rest/ChangeLog | 11 +++- net-libs/rest/Manifest | 28 ++++++-- .../rest-0.7.92-oauth-missing-include.patch | 25 +++++++ .../rest-0.7.92-tests-GError-pointers.patch | 40 ++++++++++++ ...rest-0.7.92-xml-parser-missing-break.patch | 26 ++++++++ net-libs/rest/rest-0.7.91.ebuild | 46 ------------- net-libs/rest/rest-0.7.92-r2.ebuild | 65 +++++++++++++++++++ 7 files changed, 187 insertions(+), 54 deletions(-) create mode 100644 net-libs/rest/files/rest-0.7.92-oauth-missing-include.patch create mode 100644 net-libs/rest/files/rest-0.7.92-tests-GError-pointers.patch create mode 100644 net-libs/rest/files/rest-0.7.92-xml-parser-missing-break.patch delete mode 100644 net-libs/rest/rest-0.7.91.ebuild create mode 100644 net-libs/rest/rest-0.7.92-r2.ebuild diff --git a/net-libs/rest/ChangeLog b/net-libs/rest/ChangeLog index e27b832b9a54..2851740e49d4 100644 --- a/net-libs/rest/ChangeLog +++ b/net-libs/rest/ChangeLog @@ -1,6 +1,15 @@ # ChangeLog for net-libs/rest # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/ChangeLog,v 1.32 2015/01/19 10:41:51 jer Exp $ +# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/ChangeLog,v 1.33 2015/03/05 18:20:52 tetromino Exp $ + +*rest-0.7.92-r2 (05 Mar 2015) + + 05 Mar 2015; Alexandre Rostovtsev -rest-0.7.91.ebuild, + +rest-0.7.92-r2.ebuild, +files/rest-0.7.92-oauth-missing-include.patch, + +files/rest-0.7.92-tests-GError-pointers.patch, + +files/rest-0.7.92-xml-parser-missing-break.patch: + Fix potentially exploitable memory corruption (bug #542264, thanks to + Agostino Sarubbo). Punt old. 19 Jan 2015; Jeroen Roovers rest-0.7.92-r1.ebuild: Stable for HPPA (bug #536694). diff --git a/net-libs/rest/Manifest b/net-libs/rest/Manifest index 34275ae0a7d2..140a5824681a 100644 --- a/net-libs/rest/Manifest +++ b/net-libs/rest/Manifest @@ -1,17 +1,31 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 -DIST rest-0.7.91.tar.xz 321120 SHA256 838814d935143f2dc99eb79f1ac69c615e7b547339f6cd226dd0ed4d7c16b67a SHA512 3fa63ca2c2b0d2a0bcccdc5cdd2a7b0d55a7e2600c564fe84e638bac4ac3b24d50199c7e65cb0e15946d9f80965165e5f01bc3521e7d797a66ca90e04a31d659 WHIRLPOOL cbc01285445a9785d36a0231230abde336927e4104cffcd994ac6ba01b4b38f560253c244c6eef4af3de4ac3188f49dc46f893bd451d9319c0e178ae3a615911 +AUX rest-0.7.92-oauth-missing-include.patch 745 SHA256 46da0228295c0c7095d45350411183833d2beb3660f6afbb56a8f9dafa83f3a0 SHA512 7b850de4c568638dd0d7cdf796b43a8cf94dd70854c1ba3fb40d6e8105371254132af362b0849e3a7bf974c2732b76869c1067c47a7666eaec03e83d849e383a WHIRLPOOL 860e3ddac6f11bd9c6da6349678b160543eb8fccc3f2f3bebe6657ca3a765134862ca8b3f01ee47312c2371157e776755fd9a67592570ff1ee6d010ab6014d99 +AUX rest-0.7.92-tests-GError-pointers.patch 1082 SHA256 435e8ec3a9e18889a5a20c63ab1926dae730e59241d1ec5aff193dc4687b96c5 SHA512 844aaa3d00a12689ed642330a9454fe744082c477778c5ffa4a9a7bff0f7f68713439f332f0e9558eebbb30bb96948dcbb923d82c25efe82ca5f2a53fd5bb017 WHIRLPOOL 865b9fbe5aea61e3583a43673aefbe20636602ee6a7ccd39d79d172fb4faa5e563c3da026a63f43d14f0bf3ccda037ea062fb6ac43fcf32e931deea41813afab +AUX rest-0.7.92-xml-parser-missing-break.patch 939 SHA256 b1842826d440faca991d5263c347117a629e29f8d9a8e90661a0a029853e3e3c SHA512 3e4838c0f86250fd5d25723379c93e5b05b013884daef989a4626e4bc6153c149aa8c5f7d71f274115c23a32423865ed9108fcd6b192f5db45324235d3c135fb WHIRLPOOL a8aa1db085cec4b9d0e7c7384ec58405cd705c897073056b41c29d03e700cf9612bff72c1f1ed2afaa8e8be6d468110d5d8d9072ab2f3472f675cf7729c275f6 DIST rest-0.7.92.tar.xz 321580 SHA256 07548c8785a3e743daf54a82b952ff5f32af94fee68997df4c83b00d52f9c0ec SHA512 9e30e185b0c2bdbbc507cef35f7c2e286917d2a9a0c97b075b8dea3eb9312e1a0a757185679109ca569de5dda7fee7fd2e6e19a24d7ca66aa9fcf5166dd5de86 WHIRLPOOL 1ade25a20d81e08a937c37f36c051c07eaef1792be1be118e4baf26d283e4ee1ce351b34d698b69bda591641af5644c406e8be8c11a0f8b94c8aedf252ea0d68 -EBUILD rest-0.7.91.ebuild 1141 SHA256 69e67212897ec23e376cabb604c738773394231a7fe9fa401644532031512b90 SHA512 324177558be94f938ad7af5e2ab26a6e6e9a39ac1ab12acd6723331a4ce38317e1bd81984bc8a96ecc5d224c0a2935654fdaaf551e1f8aa1b823d407f6492d92 WHIRLPOOL 09cc69d574583e801a147acfbc259ad6da1c9282d97dca3f767b8a185900d547b12cdf0e819dd7d605f36910a5a9191f6bda494a8f639d660819576b0dd9ad1d EBUILD rest-0.7.92-r1.ebuild 1548 SHA256 6ec1a1bfb50e29487dbefb2e474fc3984e4367f7f3e986dce65d4819a7c4bb79 SHA512 e9e7fe321f1c085aaddbfe4a59506a54f1ee93713a4ef0a016b526c44aa8ea321fa44bdd84a2a20ef08ec06bab9e705f35f89837057085478b8da776200c05dc WHIRLPOOL 129cfa1949d8cb84dc7737b41c783090518e5de7980bb11abc6d446980ce12b531b7316ac8130e929c23779bbedeaea87e1efad774794fdfb3edf5ea157285ab +EBUILD rest-0.7.92-r2.ebuild 1843 SHA256 a815007568c159b2bf145b4f88084bd0831b79e35f327837ce9840e4436125bb SHA512 db1fac7c5674e0e75ee4944984de40b1696329921081b62f21b40e8f4a474799907285213d3f56cea82598cfa6916a912e22797deff914c5147c550af6ec3f94 WHIRLPOOL f38af82daf9194ff7f3e8815ea31f8db3662a4adb1c974b4ead55aa50bb7a676c2bd9194935353cdffaa2ddcbcf8254f882dd99d629dca11087c91fac8769780 EBUILD rest-0.7.92.ebuild 1148 SHA256 7f7d0faee8bf7115430b620754518a4fb075faaac286505508116598b261c8be SHA512 291175028944bbdb94c73c7f23ef9855cb374f6eb9ac564d59dd4632f7c1b2172c5a8cd1fc1c8034366f023afad6731d7f9cf9f6e46835041920259d9b042cb0 WHIRLPOOL 031d745a617b6736321d91a999cd2084bd23298e8548a97836b6810197658701d72e2595ba7986e194c9895f41bd820f89b3051f5f79e51a2e3379c5aacb8608 -MISC ChangeLog 4117 SHA256 f508333c4b5b651dd769c5647aabb6d803d68ac2a8d269fdcb2371ed28c9ca4e SHA512 98e310e1957556ea63ad846fcdda89ac8115bbf5bfff4967ae2038012ffd3935c5aa0f387fabc5f2876abc86a0c6665c3e2764ad5ef1e8201a4069e2ef1f34d9 WHIRLPOOL 331eacea1e259f59bc27130e379c7681bd071542c61b92d085a35890f7750a708d9eab55ee3eb29c6faf7ad1bafbcef43ba1e172bf4bc27e224c1e74d9f7d827 +MISC ChangeLog 4515 SHA256 56626c0ca723fbe93b030b1d399de0027563ffd856e6ff4a5c485a66244771a5 SHA512 038ed078d5e4422560555557ce284687837e92eeefe703b28bfa4b7f56006cb980d98c8bef0b1266be739f33c226f9e0499a53c1309c4f2123f2d02fb2e879ff WHIRLPOOL f10aa00a25b6e7a1fade2033828b9dfe97aee15113847784487d182d90d3f768bad60842977ff6b6de7c295aee35e065ee83704dd71aae82b8bebd4fe6753c2b MISC metadata.xml 279 SHA256 688824d65296493f7c53e26eef986d647df2c137a419bc2e55b31eb77c7bd5a0 SHA512 449d5f4daa7de31f2aae7228e492f826fea80c3243255f5be61ef401bf8fc45880528e4e922e9ecd1060f0039c7f0ef37ec0f825f295f9594ae4ed8d9af8fa1c WHIRLPOOL 1aca9c991f4f47907eb08bf9dc75e5d7c7197822948519cb4bc44c6dca3514bd94068b774555ed6d1a527be1c72671c517efe0c40532db12ecf95a99a8e09447 -----BEGIN PGP SIGNATURE----- -Version: GnuPG v2 +Version: GnuPG v2.0 -iEYEAREIAAYFAlS833EACgkQVWmRsqeSphO8vgCdFxDFAfzRqF8KqJpP7mViOYLi -GqcAn1elulDkrE2sh3DLJVx3drevvQHd -=3cZ3 +iQJ8BAEBCABmBQJU+J6FXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w +ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ1RTNCRkUzRDRBNkI2MEEwQkYwQzMyOEEx +OEU1QjZGMkQ4RDVFQzhEAAoJEBjltvLY1eyNJs0QANpzpFZHLovtEfkx1z/+RT2t +ywJKyvLsl9L46UiYdK95wHS0rI7s4taD4SrVf9qOH+4auD8xBPrjr5fbnLP58XNc +opaKR2/CFnXRAG3PyPZDf7yMI/ZaAEsyIdgQUr6GoAcph2TjApHFDznzxbbl0Yg8 +E2pKBOzAcr10WVHvS1CbriRtPBi6JtJ0kjv9syyqxWiHmgDIHcJrPa8O0g51Hmzx +yXpVCPoZbPHAkUA3EvYGu6KSgN9ef1HIhDYc67IiRI8tPfVOqw9CZ9rbslWPla77 +VF14HS54D90a39IZ0rBEks/lUtqLzhLXqBo1KN9zFT20U0NvSUGXdP4BMRXYFEY6 +gl8P+a2CMbbFuhtGul4JUIieo4wv4HXp6eHGu8nj+s/iR2YDYce+GfK3y5Ez/OYv +LKDyjd6hWnfprvYSUR4/9qEiZ3BcoIR5mFrh1myora1yVI2Ngxj732HDw5LQtSkk +5Gz5Mz2ofAKYQh8tLooKi/4nko9avm4kFA7W78AwDFpnjPwOoIGweBA63D16MRsr +q6E1N8+e4HJMrK1ZaMwsfrTcDhparZEDcdCPs5gajN30Yy7gRhKkoK4kfx1t5JYO +2bgz5wTa5hZWuXLkrjN67j37GJKKZVWq01XCIo8jnxn4wsdplt+SQ05ZecfDiXJk +zZ2QHhy5ELwvcq1VmkDe +=uO0F -----END PGP SIGNATURE----- diff --git a/net-libs/rest/files/rest-0.7.92-oauth-missing-include.patch b/net-libs/rest/files/rest-0.7.92-oauth-missing-include.patch new file mode 100644 index 000000000000..2fafa2c52758 --- /dev/null +++ b/net-libs/rest/files/rest-0.7.92-oauth-missing-include.patch @@ -0,0 +1,25 @@ +From b50ace7738ea03817acdad87fb2b338a86018329 Mon Sep 17 00:00:00 2001 +From: Christophe Fergeau +Date: Wed, 3 Sep 2014 11:31:49 +0200 +Subject: [PATCH 2/3] oauth: Add missing include + +This fixes a compilation warning about a missing prototype. +--- + rest/oauth-proxy-call.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/rest/oauth-proxy-call.c b/rest/oauth-proxy-call.c +index dce2c66..ab77b1a 100644 +--- a/rest/oauth-proxy-call.c ++++ b/rest/oauth-proxy-call.c +@@ -25,6 +25,7 @@ + #include + #include "oauth-proxy-call.h" + #include "oauth-proxy-private.h" ++#include "rest-proxy-call-private.h" + #include "sha1.h" + + G_DEFINE_TYPE (OAuthProxyCall, oauth_proxy_call, REST_TYPE_PROXY_CALL) +-- +2.3.1 + diff --git a/net-libs/rest/files/rest-0.7.92-tests-GError-pointers.patch b/net-libs/rest/files/rest-0.7.92-tests-GError-pointers.patch new file mode 100644 index 000000000000..edc8b7075905 --- /dev/null +++ b/net-libs/rest/files/rest-0.7.92-tests-GError-pointers.patch @@ -0,0 +1,40 @@ +From 1bd0dc67914b7398acf60aaa42aa03bb4d36b839 Mon Sep 17 00:00:00 2001 +From: Alexandre Rostovtsev +Date: Thu, 5 Mar 2015 13:05:21 -0500 +Subject: [PATCH] tests: GError pointers must be initialized + +https://bugzilla.gnome.org/show_bug.cgi?id=745694 +--- + tests/custom-serialize.c | 2 +- + tests/proxy-continuous.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tests/custom-serialize.c b/tests/custom-serialize.c +index b50405d..f683941 100644 +--- a/tests/custom-serialize.c ++++ b/tests/custom-serialize.c +@@ -115,7 +115,7 @@ main (int argc, char **argv) + RestProxy *proxy; + RestProxyCall *call; + char *url; +- GError *error; ++ GError *error = NULL; + + #if !GLIB_CHECK_VERSION (2, 36, 0) + g_type_init (); +diff --git a/tests/proxy-continuous.c b/tests/proxy-continuous.c +index 9395cd2..22ad0f7 100644 +--- a/tests/proxy-continuous.c ++++ b/tests/proxy-continuous.c +@@ -139,7 +139,7 @@ static void + stream_test (RestProxy *proxy) + { + RestProxyCall *call; +- GError *error; ++ GError *error = NULL; + + client_count = 1; + +-- +2.3.1 + diff --git a/net-libs/rest/files/rest-0.7.92-xml-parser-missing-break.patch b/net-libs/rest/files/rest-0.7.92-xml-parser-missing-break.patch new file mode 100644 index 000000000000..7f2b5c40be77 --- /dev/null +++ b/net-libs/rest/files/rest-0.7.92-xml-parser-missing-break.patch @@ -0,0 +1,26 @@ +From 272db68e131a20652c98453b75b9c743cda2b327 Mon Sep 17 00:00:00 2001 +From: Rob Bradford +Date: Fri, 19 Sep 2014 17:06:00 +0100 +Subject: [PATCH 3/3] xml-parser: Add missing break in switch statement + +This would result in an inappropriate debug message appearing on valid +text data. +--- + rest/rest-xml-parser.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/rest/rest-xml-parser.c b/rest/rest-xml-parser.c +index 49b49b4..4447a1a 100644 +--- a/rest/rest-xml-parser.c ++++ b/rest/rest-xml-parser.c +@@ -197,6 +197,7 @@ rest_xml_parser_parse_from_data (RestXmlParser *parser, + cur_node->content = g_strdup (G(xmlTextReaderConstValue (reader))); + REST_DEBUG (XML_PARSER, "Text content found: %s", + cur_node->content); ++ break; + default: + REST_DEBUG (XML_PARSER, "Found unknown content with type: 0x%x", + xmlTextReaderNodeType (reader)); +-- +2.3.1 + diff --git a/net-libs/rest/rest-0.7.91.ebuild b/net-libs/rest/rest-0.7.91.ebuild deleted file mode 100644 index 3f8ebc90cd7d..000000000000 --- a/net-libs/rest/rest-0.7.91.ebuild +++ /dev/null @@ -1,46 +0,0 @@ -# Copyright 1999-2014 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/rest-0.7.91.ebuild,v 1.5 2014/08/07 18:25:58 jer Exp $ - -EAPI="5" -GCONF_DEBUG="no" -GNOME2_LA_PUNT="yes" - -inherit gnome2 virtualx - -DESCRIPTION="Helper library for RESTful services" -HOMEPAGE="http://live.gnome.org/Librest" - -LICENSE="LGPL-2.1" -SLOT="0.7" -IUSE="+gnome +introspection test" -KEYWORDS="~alpha amd64 ~arm hppa ~ia64 ~ppc ~ppc64 ~sparc x86" - -# Coverage testing should not be enabled -RDEPEND="app-misc/ca-certificates - >=dev-libs/glib-2.24:2 - dev-libs/libxml2:2 - net-libs/libsoup:2.4 - gnome? ( >=net-libs/libsoup-gnome-2.25.1:2.4 ) - introspection? ( >=dev-libs/gobject-introspection-0.6.7 ) -" -DEPEND="${RDEPEND} - >=dev-util/gtk-doc-am-1.13 - >=dev-util/intltool-0.40 - virtual/pkgconfig - test? ( sys-apps/dbus ) -" - -src_configure() { - gnome2_src_configure \ - --disable-static \ - --disable-gcov \ - --with-ca-certificates="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt \ - $(use_with gnome) \ - $(use_enable introspection) -} - -src_test() { - # Tests need dbus - Xemake check || die -} diff --git a/net-libs/rest/rest-0.7.92-r2.ebuild b/net-libs/rest/rest-0.7.92-r2.ebuild new file mode 100644 index 000000000000..8e726f23af7f --- /dev/null +++ b/net-libs/rest/rest-0.7.92-r2.ebuild @@ -0,0 +1,65 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/rest-0.7.92-r2.ebuild,v 1.1 2015/03/05 18:20:52 tetromino Exp $ + +EAPI="5" +GCONF_DEBUG="no" +GNOME2_LA_PUNT="yes" + +inherit gnome2 multilib-minimal virtualx + +DESCRIPTION="Helper library for RESTful services" +HOMEPAGE="https://wiki.gnome.org/Projects/Librest" + +LICENSE="LGPL-2.1" +SLOT="0.7" +IUSE="+gnome +introspection test" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86" + +# Coverage testing should not be enabled +RDEPEND=" + app-misc/ca-certificates + >=dev-libs/glib-2.24:2[${MULTILIB_USEDEP}] + dev-libs/libxml2:2[${MULTILIB_USEDEP}] + net-libs/libsoup:2.4[${MULTILIB_USEDEP}] + gnome? ( >=net-libs/libsoup-gnome-2.25.1:2.4[${MULTILIB_USEDEP}] ) + introspection? ( >=dev-libs/gobject-introspection-0.6.7 ) +" +DEPEND="${RDEPEND} + >=dev-util/gtk-doc-am-1.13 + >=dev-util/intltool-0.40 + virtual/pkgconfig[${MULTILIB_USEDEP}] + test? ( sys-apps/dbus[${MULTILIB_USEDEP}] ) +" + +src_prepare() { + # fixed in 0.7.93 + epatch "${FILESDIR}/${P}-oauth-missing-include.patch" #542264 + epatch "${FILESDIR}/${P}-xml-parser-missing-break.patch" + # https://bugzilla.gnome.org/show_bug.cgi?id=745694 + epatch "${FILESDIR}/${P}-tests-GError-pointers.patch" + + gnome2_src_prepare +} + +multilib_src_configure() { + ECONF_SOURCE=${S} \ + gnome2_src_configure \ + --disable-static \ + --disable-gcov \ + --with-ca-certificates="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt \ + $(use_with gnome) \ + $(multilib_native_use_enable introspection) + + if multilib_is_native_abi; then + ln -s "${S}"/docs/reference/rest/html docs/reference/rest/html || die + fi +} + +multilib_src_test() { + # Tests need dbus + Xemake check +} + +multilib_src_compile() { gnome2_src_compile; } +multilib_src_install() { gnome2_src_install; } -- 2.26.2