From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 13C841396D0 for ; Sun, 3 Sep 2017 22:19:26 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 27C02E0CCD; Sun, 3 Sep 2017 22:19:25 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id E946AE0CCD for ; Sun, 3 Sep 2017 22:19:24 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 0D5F733BEAE for ; Sun, 3 Sep 2017 22:19:24 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id C7D758CF5 for ; Sun, 3 Sep 2017 22:19:22 +0000 (UTC) From: "Alon Bar-Lev" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Alon Bar-Lev" Message-ID: <1504477077.4017809b1df76179561d99b69349935dbdd1dae7.alonbl@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: dev-libs/libtasn1/files/, dev-libs/libtasn1/ X-VCS-Repository: repo/gentoo X-VCS-Files: dev-libs/libtasn1/files/libtasn1-4.12-CVE-2017-10790.patch dev-libs/libtasn1/libtasn1-4.12-r1.ebuild X-VCS-Directories: dev-libs/libtasn1/ dev-libs/libtasn1/files/ X-VCS-Committer: alonbl X-VCS-Committer-Name: Alon Bar-Lev X-VCS-Revision: 4017809b1df76179561d99b69349935dbdd1dae7 X-VCS-Branch: master Date: Sun, 3 Sep 2017 22:19:22 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: dcd67757-c77a-472a-be0b-94de5fba273c X-Archives-Hash: 5fc9c2ea3c1179d2b594264314b5bdd0 commit: 4017809b1df76179561d99b69349935dbdd1dae7 Author: Alon Bar-Lev gentoo org> AuthorDate: Sun Sep 3 22:12:32 2017 +0000 Commit: Alon Bar-Lev gentoo org> CommitDate: Sun Sep 3 22:17:57 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4017809b dev-libs/libtasn1: CVE-2017-10790 Package-Manager: Portage-2.3.6, Repoman-2.3.1 .../files/libtasn1-4.12-CVE-2017-10790.patch | 55 ++++++++++++++++++++++ dev-libs/libtasn1/libtasn1-4.12-r1.ebuild | 54 +++++++++++++++++++++ 2 files changed, 109 insertions(+) diff --git a/dev-libs/libtasn1/files/libtasn1-4.12-CVE-2017-10790.patch b/dev-libs/libtasn1/files/libtasn1-4.12-CVE-2017-10790.patch new file mode 100644 index 00000000000..eb752c20a9b --- /dev/null +++ b/dev-libs/libtasn1/files/libtasn1-4.12-CVE-2017-10790.patch @@ -0,0 +1,55 @@ +From d8d805e1f2e6799bb2dff4871a8598dc83088a39 Mon Sep 17 00:00:00 2001 +From: Nikos Mavrogiannopoulos +Date: Thu, 22 Jun 2017 16:31:37 +0200 +Subject: [PATCH] _asn1_check_identifier: safer access to values read + +Signed-off-by: Nikos Mavrogiannopoulos +--- + lib/parser_aux.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/lib/parser_aux.c b/lib/parser_aux.c +index 976ab38..786ea64 100644 +--- a/lib/parser_aux.c ++++ b/lib/parser_aux.c +@@ -955,7 +955,7 @@ _asn1_check_identifier (asn1_node node) + if (p2 == NULL) + { + if (p->value) +- _asn1_strcpy (_asn1_identifierMissing, p->value); ++ _asn1_str_cpy (_asn1_identifierMissing, sizeof(_asn1_identifierMissing), (char*)p->value); + else + _asn1_strcpy (_asn1_identifierMissing, "(null)"); + return ASN1_IDENTIFIER_NOT_FOUND; +@@ -968,9 +968,15 @@ _asn1_check_identifier (asn1_node node) + if (p2 && (type_field (p2->type) == ASN1_ETYPE_DEFAULT)) + { + _asn1_str_cpy (name2, sizeof (name2), node->name); +- _asn1_str_cat (name2, sizeof (name2), "."); +- _asn1_str_cat (name2, sizeof (name2), (char *) p2->value); +- _asn1_strcpy (_asn1_identifierMissing, p2->value); ++ if (p2->value) ++ { ++ _asn1_str_cat (name2, sizeof (name2), "."); ++ _asn1_str_cat (name2, sizeof (name2), (char *) p2->value); ++ _asn1_str_cpy (_asn1_identifierMissing, sizeof(_asn1_identifierMissing), (char*)p2->value); ++ } ++ else ++ _asn1_strcpy (_asn1_identifierMissing, "(null)"); ++ + p2 = asn1_find_node (node, name2); + if (!p2 || (type_field (p2->type) != ASN1_ETYPE_OBJECT_ID) || + !(p2->type & CONST_ASSIGN)) +@@ -990,7 +996,8 @@ _asn1_check_identifier (asn1_node node) + _asn1_str_cpy (name2, sizeof (name2), node->name); + _asn1_str_cat (name2, sizeof (name2), "."); + _asn1_str_cat (name2, sizeof (name2), (char *) p2->value); +- _asn1_strcpy (_asn1_identifierMissing, p2->value); ++ _asn1_str_cpy (_asn1_identifierMissing, sizeof(_asn1_identifierMissing), (char*)p2->value); ++ + p2 = asn1_find_node (node, name2); + if (!p2 || (type_field (p2->type) != ASN1_ETYPE_OBJECT_ID) + || !(p2->type & CONST_ASSIGN)) +-- +1.9.1 + diff --git a/dev-libs/libtasn1/libtasn1-4.12-r1.ebuild b/dev-libs/libtasn1/libtasn1-4.12-r1.ebuild new file mode 100644 index 00000000000..4dbcc7cf692 --- /dev/null +++ b/dev-libs/libtasn1/libtasn1-4.12-r1.ebuild @@ -0,0 +1,54 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=6 + +inherit multilib-minimal libtool ltprune + +DESCRIPTION="ASN.1 library" +HOMEPAGE="https://www.gnu.org/software/libtasn1/" +SRC_URI="mirror://gnu/${PN}/${P}.tar.gz" + +LICENSE="GPL-3 LGPL-2.1" +SLOT="0/6" # subslot = libtasn1 soname version +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" +IUSE="doc static-libs valgrind" + +DEPEND=">=dev-lang/perl-5.6 + sys-apps/help2man + virtual/yacc" +RDEPEND=" + valgrind? ( dev-util/valgrind ) + abi_x86_32? ( + !<=app-emulation/emul-linux-x86-baselibs-20131008-r16 + !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] + )" + +DOCS=( AUTHORS ChangeLog NEWS README THANKS ) + +PATCHES=( + "${FILESDIR}/${P}-CVE-2017-10790.patch" +) + +pkg_setup() { + if use doc; then + DOCS+=( doc/libtasn1.pdf ) + HTML_DOCS=( doc/reference/html/. ) + fi +} + +src_prepare() { + default + elibtoolize # for Solaris shared library +} + +multilib_src_configure() { + ECONF_SOURCE="${S}" econf \ + $(use_enable static-libs static) \ + $(multilib_native_use_enable valgrind valgrind-tests) +} + +multilib_src_install_all() { + einstalldocs + prune_libtool_files +}