From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 370BC158011 for ; Fri, 15 Jul 2022 02:14:20 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 7C025E10CD; Fri, 15 Jul 2022 02:14:19 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 57F30E10CD for ; Fri, 15 Jul 2022 02:14:19 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 646A3340EE4 for ; Fri, 15 Jul 2022 02:14:18 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id BD8597F for ; Fri, 15 Jul 2022 02:14:16 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1657851236.8cc59eb3b6d73b67c17da03342dac6b241451cce.sam@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: dev-util/samurai/files/, dev-util/samurai/ X-VCS-Repository: repo/gentoo X-VCS-Files: dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch dev-util/samurai/samurai-1.2-r1.ebuild dev-util/samurai/samurai-1.2-r2.ebuild dev-util/samurai/samurai-9999.ebuild X-VCS-Directories: dev-util/samurai/ dev-util/samurai/files/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: 8cc59eb3b6d73b67c17da03342dac6b241451cce X-VCS-Branch: master Date: Fri, 15 Jul 2022 02:14:16 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: ac3ba780-65c8-4a9c-915c-bbfc810f1773 X-Archives-Hash: 87618041e2a6151fc8c0d9ac47278163 commit: 8cc59eb3b6d73b67c17da03342dac6b241451cce Author: orbea riseup net> AuthorDate: Wed Jul 13 15:10:37 2022 +0000 Commit: Sam James gentoo org> CommitDate: Fri Jul 15 02:13:56 2022 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8cc59eb3 dev-util/samurai: Add patch for CVE-2021-30218 Also updates to EAPI 8. Bug: https://bugs.gentoo.org/786951 Upstream-Commit: https://github.com/michaelforney/samurai/commit/e84b6d99c85043fa1ba54851ee500540ec206918 Upstream-Issue: https://github.com/michaelforney/samurai/issues/67 Signed-off-by: orbea riseup.net> Closes: https://github.com/gentoo/gentoo/pull/26386 Signed-off-by: Sam James gentoo.org> .../files/samurai-1.2-null_pointer_fix.patch | 36 +++++++++++++++++++++- ...samurai-1.2-r1.ebuild => samurai-1.2-r2.ebuild} | 6 ++-- dev-util/samurai/samurai-9999.ebuild | 4 +-- 3 files changed, 40 insertions(+), 6 deletions(-) diff --git a/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch index fbc97b03d478..76ffc8cd350f 100644 --- a/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch +++ b/dev-util/samurai/files/samurai-1.2-null_pointer_fix.patch @@ -1,3 +1,37 @@ +CVE-2021-30218 + CVE-2021-30219 +Bug: https://bugs.gentoo.org/786951 + +Upstream-Commit: https://github.com/michaelforney/samurai/commit/e84b6d99c85043fa1ba54851ee500540ec206918 +From e84b6d99c85043fa1ba54851ee500540ec206918 Mon Sep 17 00:00:00 2001 +From: Michael Forney +Date: Fri, 2 Apr 2021 17:27:48 -0700 +Subject: [PATCH] util: Check for NULL string in writefile + +This check was there previously, but was removed in f549b757 with +the addition of a check during parse that every rule has rspfile +if and only if it has rspfile_content. However, this fails to +consider the possibility of those variables coming from the edge +or global environment. So, re-add the check. + +Fixes #67 (https://github.com/michaelforney/samurai/issues/67). +--- + util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util.c b/util.c +index ea5c3ce..2a59881 100644 +--- a/util.c ++++ b/util.c +@@ -258,7 +258,7 @@ writefile(const char *name, struct string *s) + return -1; + } + ret = 0; +- if (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0) { ++ if (s && (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0)) { + warn("write %s:", name); + ret = -1; + } +Upstream-Commit: https://github.com/michaelforney/samurai/commit/d2af3bc375e2a77139c3a28d6128c60cd8d08655 From d2af3bc375e2a77139c3a28d6128c60cd8d08655 Mon Sep 17 00:00:00 2001 From: Michael Forney Date: Sun, 4 Apr 2021 03:50:09 -0700 @@ -6,7 +40,7 @@ Subject: [PATCH] parse: Check for non-empty command/rspfile/rspfile_content This matches ninja behavior and prevents the possibility of a rule with an empty (NULL) command string. -Fixes #68. +Fixes #68 (https://github.com/michaelforney/samurai/issues/68). --- parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dev-util/samurai/samurai-1.2-r1.ebuild b/dev-util/samurai/samurai-1.2-r2.ebuild similarity index 86% rename from dev-util/samurai/samurai-1.2-r1.ebuild rename to dev-util/samurai/samurai-1.2-r2.ebuild index c2072fc277b1..5a7727cbbf8c 100644 --- a/dev-util/samurai/samurai-1.2-r1.ebuild +++ b/dev-util/samurai/samurai-1.2-r2.ebuild @@ -1,7 +1,7 @@ -# Copyright 2021 Gentoo Authors +# Copyright 2021-2022 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI=7 +EAPI=8 inherit toolchain-funcs @@ -19,7 +19,7 @@ LICENSE="ISC Apache-2.0 MIT" SLOT="0" PATCHES=( - "${FILESDIR}/${P}-null_pointer_fix.patch" #786957 + "${FILESDIR}/${P}-null_pointer_fix.patch" # 786951 ) src_compile() { diff --git a/dev-util/samurai/samurai-9999.ebuild b/dev-util/samurai/samurai-9999.ebuild index 6895ee86fc65..6e723875bada 100644 --- a/dev-util/samurai/samurai-9999.ebuild +++ b/dev-util/samurai/samurai-9999.ebuild @@ -1,7 +1,7 @@ -# Copyright 2021 Gentoo Authors +# Copyright 2021-2022 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI=7 +EAPI=8 inherit toolchain-funcs