* [gentoo-commits] repo/gentoo:master commit in: dev-util/samurai/files/, dev-util/samurai/
@ 2021-04-29 19:41 Lars Wendler
0 siblings, 0 replies; 3+ messages in thread
From: Lars Wendler @ 2021-04-29 19:41 UTC (permalink / raw
To: gentoo-commits
commit: 05f98b2284e04f5078b8b38238d6688f9c76414b
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 29 19:40:38 2021 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Thu Apr 29 19:41:01 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=05f98b22
dev-util/samurai: Security revbump to fix mull pointer dereference
Removed old
Bug: https://bugs.gentoo.org/786957
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
.../files/samurai-1.2-null_pointer_fix.patch | 26 ++++++++++++++++++++++
.../{samurai-1.2.ebuild => samurai-1.2-r1.ebuild} | 4 ++++
2 files changed, 30 insertions(+)
diff --git a/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch
new file mode 100644
index 00000000000..fbc97b03d47
--- /dev/null
+++ b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch
@@ -0,0 +1,26 @@
+From d2af3bc375e2a77139c3a28d6128c60cd8d08655 Mon Sep 17 00:00:00 2001
+From: Michael Forney <mforney@mforney.org>
+Date: Sun, 4 Apr 2021 03:50:09 -0700
+Subject: [PATCH] parse: Check for non-empty command/rspfile/rspfile_content
+
+This matches ninja behavior and prevents the possibility of a rule
+with an empty (NULL) command string.
+
+Fixes #68.
+---
+ parse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/parse.c b/parse.c
+index f79a5ee..b4b98a1 100644
+--- a/parse.c
++++ b/parse.c
+@@ -42,6 +42,8 @@ parserule(struct scanner *s, struct environment *env)
+ var = scanname(s);
+ parselet(s, &val);
+ ruleaddvar(r, var, val);
++ if (!val)
++ continue;
+ if (strcmp(var, "command") == 0)
+ hascommand = true;
+ else if (strcmp(var, "rspfile") == 0)
diff --git a/dev-util/samurai/samurai-1.2.ebuild b/dev-util/samurai/samurai-1.2-r1.ebuild
similarity index 90%
rename from dev-util/samurai/samurai-1.2.ebuild
rename to dev-util/samurai/samurai-1.2-r1.ebuild
index 4333d1997bf..ad8d964b12b 100644
--- a/dev-util/samurai/samurai-1.2.ebuild
+++ b/dev-util/samurai/samurai-1.2-r1.ebuild
@@ -16,6 +16,10 @@ fi
LICENSE="ISC Apache-2.0 MIT"
SLOT="0"
+PATCHES=(
+ "${FILESDIR}/${P}-null_pointer_fix.patch" #786957
+)
+
src_install() {
emake DESTDIR="${D}" PREFIX="${EPREFIX}"/usr install
dodoc README.md
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: dev-util/samurai/files/, dev-util/samurai/
@ 2021-04-29 19:50 Lars Wendler
0 siblings, 0 replies; 3+ messages in thread
From: Lars Wendler @ 2021-04-29 19:50 UTC (permalink / raw
To: gentoo-commits
commit: 68b485ff058af6b943ff6633724e3d2ddeb2c7b2
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 29 19:40:38 2021 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Thu Apr 29 19:49:57 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=68b485ff
dev-util/samurai: Security revbump to fix null pointer dereference
Removed old
Bug: https://bugs.gentoo.org/786951
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
.../files/samurai-1.2-null_pointer_fix.patch | 26 ++++++++++++++++++++++
.../{samurai-1.2.ebuild => samurai-1.2-r1.ebuild} | 4 ++++
2 files changed, 30 insertions(+)
diff --git a/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch
new file mode 100644
index 00000000000..fbc97b03d47
--- /dev/null
+++ b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch
@@ -0,0 +1,26 @@
+From d2af3bc375e2a77139c3a28d6128c60cd8d08655 Mon Sep 17 00:00:00 2001
+From: Michael Forney <mforney@mforney.org>
+Date: Sun, 4 Apr 2021 03:50:09 -0700
+Subject: [PATCH] parse: Check for non-empty command/rspfile/rspfile_content
+
+This matches ninja behavior and prevents the possibility of a rule
+with an empty (NULL) command string.
+
+Fixes #68.
+---
+ parse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/parse.c b/parse.c
+index f79a5ee..b4b98a1 100644
+--- a/parse.c
++++ b/parse.c
+@@ -42,6 +42,8 @@ parserule(struct scanner *s, struct environment *env)
+ var = scanname(s);
+ parselet(s, &val);
+ ruleaddvar(r, var, val);
++ if (!val)
++ continue;
+ if (strcmp(var, "command") == 0)
+ hascommand = true;
+ else if (strcmp(var, "rspfile") == 0)
diff --git a/dev-util/samurai/samurai-1.2.ebuild b/dev-util/samurai/samurai-1.2-r1.ebuild
similarity index 90%
rename from dev-util/samurai/samurai-1.2.ebuild
rename to dev-util/samurai/samurai-1.2-r1.ebuild
index 4333d1997bf..ad8d964b12b 100644
--- a/dev-util/samurai/samurai-1.2.ebuild
+++ b/dev-util/samurai/samurai-1.2-r1.ebuild
@@ -16,6 +16,10 @@ fi
LICENSE="ISC Apache-2.0 MIT"
SLOT="0"
+PATCHES=(
+ "${FILESDIR}/${P}-null_pointer_fix.patch" #786957
+)
+
src_install() {
emake DESTDIR="${D}" PREFIX="${EPREFIX}"/usr install
dodoc README.md
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: dev-util/samurai/files/, dev-util/samurai/
@ 2022-07-15 2:14 Sam James
0 siblings, 0 replies; 3+ messages in thread
From: Sam James @ 2022-07-15 2:14 UTC (permalink / raw
To: gentoo-commits
commit: 8cc59eb3b6d73b67c17da03342dac6b241451cce
Author: orbea <orbea <AT> riseup <DOT> net>
AuthorDate: Wed Jul 13 15:10:37 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Jul 15 02:13:56 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8cc59eb3
dev-util/samurai: Add patch for CVE-2021-30218
Also updates to EAPI 8.
Bug: https://bugs.gentoo.org/786951
Upstream-Commit: https://github.com/michaelforney/samurai/commit/e84b6d99c85043fa1ba54851ee500540ec206918
Upstream-Issue: https://github.com/michaelforney/samurai/issues/67
Signed-off-by: orbea <orbea <AT> riseup.net>
Closes: https://github.com/gentoo/gentoo/pull/26386
Signed-off-by: Sam James <sam <AT> gentoo.org>
.../files/samurai-1.2-null_pointer_fix.patch | 36 +++++++++++++++++++++-
...samurai-1.2-r1.ebuild => samurai-1.2-r2.ebuild} | 6 ++--
dev-util/samurai/samurai-9999.ebuild | 4 +--
3 files changed, 40 insertions(+), 6 deletions(-)
diff --git a/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch
index fbc97b03d478..76ffc8cd350f 100644
--- a/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch
+++ b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch
@@ -1,3 +1,37 @@
+CVE-2021-30218 + CVE-2021-30219
+Bug: https://bugs.gentoo.org/786951
+
+Upstream-Commit: https://github.com/michaelforney/samurai/commit/e84b6d99c85043fa1ba54851ee500540ec206918
+From e84b6d99c85043fa1ba54851ee500540ec206918 Mon Sep 17 00:00:00 2001
+From: Michael Forney <mforney@mforney.org>
+Date: Fri, 2 Apr 2021 17:27:48 -0700
+Subject: [PATCH] util: Check for NULL string in writefile
+
+This check was there previously, but was removed in f549b757 with
+the addition of a check during parse that every rule has rspfile
+if and only if it has rspfile_content. However, this fails to
+consider the possibility of those variables coming from the edge
+or global environment. So, re-add the check.
+
+Fixes #67 (https://github.com/michaelforney/samurai/issues/67).
+---
+ util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/util.c b/util.c
+index ea5c3ce..2a59881 100644
+--- a/util.c
++++ b/util.c
+@@ -258,7 +258,7 @@ writefile(const char *name, struct string *s)
+ return -1;
+ }
+ ret = 0;
+- if (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0) {
++ if (s && (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0)) {
+ warn("write %s:", name);
+ ret = -1;
+ }
+Upstream-Commit: https://github.com/michaelforney/samurai/commit/d2af3bc375e2a77139c3a28d6128c60cd8d08655
From d2af3bc375e2a77139c3a28d6128c60cd8d08655 Mon Sep 17 00:00:00 2001
From: Michael Forney <mforney@mforney.org>
Date: Sun, 4 Apr 2021 03:50:09 -0700
@@ -6,7 +40,7 @@ Subject: [PATCH] parse: Check for non-empty command/rspfile/rspfile_content
This matches ninja behavior and prevents the possibility of a rule
with an empty (NULL) command string.
-Fixes #68.
+Fixes #68 (https://github.com/michaelforney/samurai/issues/68).
---
parse.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/dev-util/samurai/samurai-1.2-r1.ebuild b/dev-util/samurai/samurai-1.2-r2.ebuild
similarity index 86%
rename from dev-util/samurai/samurai-1.2-r1.ebuild
rename to dev-util/samurai/samurai-1.2-r2.ebuild
index c2072fc277b1..5a7727cbbf8c 100644
--- a/dev-util/samurai/samurai-1.2-r1.ebuild
+++ b/dev-util/samurai/samurai-1.2-r2.ebuild
@@ -1,7 +1,7 @@
-# Copyright 2021 Gentoo Authors
+# Copyright 2021-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
-EAPI=7
+EAPI=8
inherit toolchain-funcs
@@ -19,7 +19,7 @@ LICENSE="ISC Apache-2.0 MIT"
SLOT="0"
PATCHES=(
- "${FILESDIR}/${P}-null_pointer_fix.patch" #786957
+ "${FILESDIR}/${P}-null_pointer_fix.patch" # 786951
)
src_compile() {
diff --git a/dev-util/samurai/samurai-9999.ebuild b/dev-util/samurai/samurai-9999.ebuild
index 6895ee86fc65..6e723875bada 100644
--- a/dev-util/samurai/samurai-9999.ebuild
+++ b/dev-util/samurai/samurai-9999.ebuild
@@ -1,7 +1,7 @@
-# Copyright 2021 Gentoo Authors
+# Copyright 2021-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
-EAPI=7
+EAPI=8
inherit toolchain-funcs
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-07-15 2:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-04-29 19:41 [gentoo-commits] repo/gentoo:master commit in: dev-util/samurai/files/, dev-util/samurai/ Lars Wendler
-- strict thread matches above, loose matches on Subject: below --
2021-04-29 19:50 Lars Wendler
2022-07-15 2:14 Sam James
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox