mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-20 18:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

glibc: Upgrade 2.20 -> 2.21

Browse Source 
Drop CVE backports and ppc/fpu detection patch which is not needed anymore
Forward port eglibc option groups patch
Default to using glibc 2.21

Additional patches needed to appease -Werror option

Change-Id: I1873097cec8387ea9e8186a255122938fc28c976
(From OE-Core rev: 6617cc92076764d51f0190786f8d62b8c99ae984)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Khem Raj
2015-02-01 23:49:10 -08:00
committed by Richard Purdie
parent dda70ca552
commit a488fd5b61
16 changed files with 1090 additions and 1649 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/conf/distro/include/tcmode-default.inc
View File

@@ -25,7 +25,7 @@ PREFERRED_PROVIDER_virtual/gettext ??= "gettext"
GCCVERSION ?= "4.9%"
SDKGCCVERSION ?= "${GCCVERSION}"
BINUVERSION ?= "2.24"
GLIBCVERSION ?= "2.20"
GLIBCVERSION ?= "2.21"
UCLIBCVERSION ?= "0.9.33+git%"
LINUXLIBCVERSION ?= "3.17.7"

13
meta/recipes-core/glibc/cross-localedef-native_2.20.bb → meta/recipes-core/glibc/cross-localedef-native_2.21.bb
View File

@@ -14,9 +14,10 @@ inherit autotools
FILESEXTRAPATHS =. "${FILE_DIRNAME}/${PN}:${FILE_DIRNAME}/glibc:"
PV = "2.20"
#BRANCH = "release/${PV}/master"
BRANCH = "master"
SRC_URI = "git://sourceware.org/git/glibc.git;branch=release/${PV}/master;name=glibc \
SRC_URI = "git://sourceware.org/git/glibc.git;branch=${BRANCH};name=glibc \
git://github.com/kraj/localedef;branch=master;name=localedef;destsuffix=git/localedef \
file://fix_for_centos_5.8.patch \
${EGLIBCPATCHES} \
@@ -33,17 +34,17 @@ EGLIBCPATCHES = "\
file://eglibc-use-option-groups.patch \
"
SRCREV_glibc = "b8079dd0d360648e4e8de48656c5c38972621072"
SRCREV_glibc = "edac0a60c7514b8c9b59488cffdac6b22267e757"
SRCREV_localedef = "c833367348d39dad7ba018990bfdaffaec8e9ed3"
# Makes for a rather long rev (22 characters), but...
#
SRCREV_FORMAT = "glibc__localedef"
SRCREV_FORMAT = "glibc_localedef"
S = "${WORKDIR}/git"
EXTRA_OECONF = "--with-glibc=${S}"
CFLAGS += "-DNOT_IN_libc=1"
CFLAGS += "-fgnu89-inline -std=gnu99 -DIS_IN\(x\)='0'"
do_configure () {
${S}/localedef/configure ${EXTRA_OECONF}
@@ -51,6 +52,6 @@ do_configure () {
do_install() {
install -d ${D}${bindir}
install -d ${D}${bindir}
install -m 0755 ${B}/localedef ${D}${bindir}/cross-localedef
}

0
meta/recipes-core/glibc/glibc-initial_2.20.bb → meta/recipes-core/glibc/glibc-initial_2.21.bb
View File

0
meta/recipes-core/glibc/glibc-locale_2.20.bb → meta/recipes-core/glibc/glibc-locale_2.21.bb
View File

0
meta/recipes-core/glibc/glibc-mtrace_2.20.bb → meta/recipes-core/glibc/glibc-mtrace_2.21.bb
View File

0
meta/recipes-core/glibc/glibc-scripts_2.20.bb → meta/recipes-core/glibc/glibc-scripts_2.21.bb
View File

4
meta/recipes-core/glibc/glibc.inc
View File

@@ -20,7 +20,7 @@ def get_optimization(d):
SELECTED_OPTIMIZATION := "${@get_optimization(d)}"
# siteconfig.bbclass runs configure which needs a working compiler
# For the compiler to work we need a working libc yet libc isn't
# For the compiler to work we need a working libc yet libc isn't
# in the sysroots directory at this point. This means the libc.so
# linker script won't work as the --sysroot setting isn't correct.
# Here we create a hacked up libc linker script and pass in the right
@@ -71,7 +71,7 @@ EXTRA_OEMAKE += "${EGLIBCPARALLELISM}"
PARALLEL_MAKE = ""
# glibc make-syscalls.sh has a number of issues with /bin/dash and
# it's output which make calls via the SHELL also has issues, so
# it's output which make calls via the SHELL also has issues, so
# ensure make uses /bin/bash
EXTRA_OEMAKE += "SHELL=/bin/bash"

36
meta/recipes-core/glibc/glibc/0001-Add-unused-attribute.patch Normal file
View File

@@ -0,0 +1,36 @@
2015-02-18 Khem Raj <raj.khem@gmail.com>>
* iconv/gconv_charset.h (strip):
Add unused attribute.
From 9c4a91cb331ff1e8cde2314dadee74559d8cb0dd Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Wed, 18 Feb 2015 19:45:31 +0000
Subject: [PATCH] Add unused attribute
Helps in avoiding gcc warning when header is is included in
a source file which does not use both functions
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upstream-Status: Pending
---
iconv/gconv_charset.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/iconv/gconv_charset.h b/iconv/gconv_charset.h
index 80290bc..7890a8e 100644
--- a/iconv/gconv_charset.h
+++ b/iconv/gconv_charset.h
@@ -21,7 +21,7 @@
#include <locale.h>
-static void
+static void __attribute__ ((unused))
strip (char *wp, const char *s)
{
int slash_count = 0;
--
2.1.4

32
meta/recipes-core/glibc/glibc/0001-When-disabling-SSE-also-make-sure-that-fpmath-is-not.patch Normal file
View File

@@ -0,0 +1,32 @@
From 6f5639f6405ff9a42e4f71e7b0f18bddb68d992a Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Thu, 19 Feb 2015 03:23:45 +0000
Subject: [PATCH] When disabling SSE also make sure that fpmath is not set to
use SSE as well
This fixes errors when we inject sse options through CFLAGS and now
that we have -Werror turned on by default this warning turns to become
error on x86
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upstream-Status: Pending
---
sysdeps/x86/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile
index 19f5eca..827ea71 100644
--- a/sysdeps/x86/Makefile
+++ b/sysdeps/x86/Makefile
@@ -1,6 +1,6 @@
ifeq ($(subdir),elf)
CFLAGS-.os += $(if $(filter $(@F),$(patsubst %,%.os,$(all-rtld-routines))),\
- -mno-sse -mno-mmx)
+ -mno-sse -mno-mmx -mfpmath=387)
tests-special += $(objpfx)tst-ld-sse-use.out
$(objpfx)tst-ld-sse-use.out: ../sysdeps/x86/tst-ld-sse-use.sh $(objpfx)ld.so
--
2.1.4

339
meta/recipes-core/glibc/glibc/CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch
View File

@@ -1,339 +0,0 @@
From a5357b7ce2a2982c5778435704bcdb55ce3667a0 Mon Sep 17 00:00:00 2001
From: Jeff Law <law@redhat.com>
Date: Mon, 15 Dec 2014 10:09:32 +0100
Subject: [PATCH] CVE-2012-3406: Stack overflow in vfprintf [BZ #16617]
A larger number of format specifiers coudld cause a stack overflow,
potentially allowing to bypass _FORTIFY_SOURCE format string
protection.
---
ChangeLog | 9 +++++++
NEWS | 13 +++++----
stdio-common/Makefile | 2 +-
stdio-common/bug23-2.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++
stdio-common/bug23-3.c | 50 +++++++++++++++++++++++++++++++++++
stdio-common/bug23-4.c | 31 ++++++++++++++++++++++
stdio-common/vfprintf.c | 40 ++++++++++++++++++++++++++--
7 files changed, 207 insertions(+), 8 deletions(-)
create mode 100644 stdio-common/bug23-2.c
create mode 100644 stdio-common/bug23-3.c
create mode 100644 stdio-common/bug23-4.c
Index: git/ChangeLog
===================================================================
--- git.orig/ChangeLog
+++ git/ChangeLog
@@ -1,3 +1,12 @@
+2014-12-15 Jeff Law <law@redhat.com>
+
+ [BZ #16617]
+ * stdio-common/vfprintf.c (vfprintf): Allocate large specs array
+ on the heap. (CVE-2012-3406)
+ * stdio-common/bug23-2.c, stdio-common/bug23-3.c: New file.
+ * stdio-common/bug23-4.c: New file. Test case by Joseph Myers.
+ * stdio-common/Makefile (tests): Add bug23-2, bug23-3, bug23-4.
+
2014-11-19 Carlos O'Donell <carlos@redhat.com>
Florian Weimer <fweimer@redhat.com>
Joseph Myers <joseph@codesourcery.com>
Index: git/NEWS
===================================================================
--- git.orig/NEWS
+++ git/NEWS
@@ -13,24 +13,28 @@ Version 2.20
15698, 15804, 15894, 15946, 16002, 16064, 16095, 16194, 16198, 16275,
16284, 16287, 16315, 16348, 16349, 16354, 16357, 16362, 16447, 16516,
16532, 16539, 16545, 16561, 16562, 16564, 16574, 16599, 16600, 16609,
- 16610, 16611, 16613, 16619, 16623, 16629, 16632, 16634, 16639, 16642,
- 16648, 16649, 16670, 16674, 16677, 16680, 16681, 16683, 16689, 16695,
- 16701, 16706, 16707, 16712, 16713, 16714, 16724, 16731, 16739, 16740,
- 16743, 16754, 16758, 16759, 16760, 16770, 16786, 16789, 16791, 16796,
- 16799, 16800, 16815, 16823, 16824, 16831, 16838, 16839, 16849, 16854,
- 16876, 16877, 16878, 16882, 16885, 16888, 16890, 16892, 16912, 16915,
- 16916, 16917, 16918, 16922, 16927, 16928, 16932, 16943, 16958, 16965,
- 16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031,
- 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079,
- 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153,
- 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354, 17625.
-
+ 16610, 16611, 16613, 16617, 16619, 16623, 16629, 16632, 16634, 16639,
+ 16642, 16648, 16649, 16670, 16674, 16677, 16680, 16681, 16683, 16689,
+ 16695, 16701, 16706, 16707, 16712, 16713, 16714, 16724, 16731, 16739,
+ 16740, 16743, 16754, 16758, 16759, 16760, 16770, 16786, 16789, 16791,
+ 16796, 16799, 16800, 16815, 16823, 16824, 16831, 16838, 16839, 16849,
+ 16854, 16876, 16877, 16878, 16882, 16885, 16888, 16890, 16892, 16912,
+ 16915, 16916, 16917, 16918, 16922, 16927, 16928, 16932, 16943, 16958,
+ 16965, 16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022,
+ 17031, 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078,
+ 17079, 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150,
+ 17153, 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354,
+ 17625.
+
* CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
under certain input conditions resulting in the execution of a shell for
command substitution when the applicaiton did not request it. The
implementation now checks WRDE_NOCMD immediately before executing the
shell and returns the error WRDE_CMDSUB as expected.
+* CVE-2012-3406 printf-style functions could run into a stack overflow when
+ processing format strings with a large number of format specifiers.
+
* Reverted change of ABI data structures for s390 and s390x:
On s390 and s390x the size of struct ucontext and jmp_buf was increased in
2.19. This change is reverted in 2.20. The introduced 2.19 symbol versions
Index: git/stdio-common/bug23-2.c
===================================================================
--- /dev/null
+++ git/stdio-common/bug23-2.c
@@ -0,0 +1,70 @@
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+static const char expected[] = "\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55\
+\n\
+a\n\
+abbcd55%%%%%%%%%%%%%%%%%%%%%%%%%%\n";
+
+static int
+do_test (void)
+{
+ char *buf = malloc (strlen (expected) + 1);
+ snprintf (buf, strlen (expected) + 1,
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n",
+ "a", "b", "c", "d", 5);
+ return strcmp (buf, expected) != 0;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
Index: git/stdio-common/bug23-3.c
===================================================================
--- /dev/null
+++ git/stdio-common/bug23-3.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+int
+do_test (void)
+{
+ size_t instances = 16384;
+#define X0 "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ const char *item = "\na\nabbcd55";
+#define X3 X0 X0 X0 X0 X0 X0 X0 X0
+#define X6 X3 X3 X3 X3 X3 X3 X3 X3
+#define X9 X6 X6 X6 X6 X6 X6 X6 X6
+#define X12 X9 X9 X9 X9 X9 X9 X9 X9
+#define X14 X12 X12 X12 X12
+#define TRAILER "%%%%%%%%%%%%%%%%%%%%%%%%%%"
+#define TRAILER2 TRAILER TRAILER
+ size_t length = instances * strlen (item) + strlen (TRAILER) + 1;
+
+ char *buf = malloc (length + 1);
+ snprintf (buf, length + 1,
+ X14 TRAILER2 "\n",
+ "a", "b", "c", "d", 5);
+
+ const char *p = buf;
+ size_t i;
+ for (i = 0; i < instances; ++i)
+ {
+ const char *expected;
+ for (expected = item; *expected; ++expected)
+ {
+ if (*p != *expected)
+ {
+ printf ("mismatch at offset %zu (%zu): expected %d, got %d\n",
+ (size_t) (p - buf), i, *expected & 0xFF, *p & 0xFF);
+ return 1;
+ }
+ ++p;
+ }
+ }
+ if (strcmp (p, TRAILER "\n") != 0)
+ {
+ printf ("mismatch at trailer: [%s]\n", p);
+ return 1;
+ }
+ free (buf);
+ return 0;
+}
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
Index: git/stdio-common/bug23-4.c
===================================================================
--- /dev/null
+++ git/stdio-common/bug23-4.c
@@ -0,0 +1,31 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/resource.h>
+
+#define LIMIT 1000000
+
+int
+main (void)
+{
+ struct rlimit lim;
+ getrlimit (RLIMIT_STACK, &lim);
+ lim.rlim_cur = 1048576;
+ setrlimit (RLIMIT_STACK, &lim);
+ char *fmtstr = malloc (4 * LIMIT + 1);
+ if (fmtstr == NULL)
+ abort ();
+ char *output = malloc (LIMIT + 1);
+ if (output == NULL)
+ abort ();
+ for (size_t i = 0; i < LIMIT; i++)
+ memcpy (fmtstr + 4 * i, "%1$d", 4);
+ fmtstr[4 * LIMIT] = '\0';
+ int ret = snprintf (output, LIMIT + 1, fmtstr, 0);
+ if (ret != LIMIT)
+ abort ();
+ for (size_t i = 0; i < LIMIT; i++)
+ if (output[i] != '0')
+ abort ();
+ return 0;
+}
Index: git/stdio-common/vfprintf.c
===================================================================
--- git.orig/stdio-common/vfprintf.c
+++ git/stdio-common/vfprintf.c
@@ -276,6 +276,12 @@ vfprintf (FILE *s, const CHAR_T *format,
/* For the argument descriptions, which may be allocated on the heap. */
void *args_malloced = NULL;
+ /* For positional argument handling. */
+ struct printf_spec *specs;
+
+ /* Track if we malloced the SPECS array and thus must free it. */
+ bool specs_malloced = false;
+
/* This table maps a character into a number representing a
class. In each step there is a destination label for each
class. */
@@ -1699,8 +1705,8 @@ do_positional:
size_t nspecs = 0;
/* A more or less arbitrary start value. */
size_t nspecs_size = 32 * sizeof (struct printf_spec);
- struct printf_spec *specs = alloca (nspecs_size);
+ specs = alloca (nspecs_size);
/* The number of arguments the format string requests. This will
determine the size of the array needed to store the argument
attributes. */
@@ -1743,11 +1749,39 @@ do_positional:
if (nspecs * sizeof (*specs) >= nspecs_size)
{
/* Extend the array of format specifiers. */
+ if (nspecs_size * 2 < nspecs_size)
+ {
+ __set_errno (ENOMEM);
+ done = -1;
+ goto all_done;
+ }
struct printf_spec *old = specs;
- specs = extend_alloca (specs, nspecs_size, 2 * nspecs_size);
+ if (__libc_use_alloca (2 * nspecs_size))
+ specs = extend_alloca (specs, nspecs_size, 2 * nspecs_size);
+ else
+ {
+ nspecs_size *= 2;
+ specs = malloc (nspecs_size);
+ if (specs == NULL)
+ {
+ __set_errno (ENOMEM);
+ specs = old;
+ done = -1;
+ goto all_done;
+ }
+ }
/* Copy the old array's elements to the new space. */
memmove (specs, old, nspecs * sizeof (*specs));
+
+ /* If we had previously malloc'd space for SPECS, then
+ release it after the copy is complete. */
+ if (specs_malloced)
+ free (old);
+
+ /* Now set SPECS_MALLOCED if needed. */
+ if (!__libc_use_alloca (nspecs_size))
+ specs_malloced = true;
}
/* Parse the format specifier. */
@@ -2068,6 +2102,8 @@ do_positional:
}
all_done:
+ if (specs_malloced)
+ free (specs);
if (__glibc_unlikely (args_malloced != NULL))
free (args_malloced);
if (__glibc_unlikely (workstart != NULL))
Index: git/stdio-common/Makefile
===================================================================
--- git.orig/stdio-common/Makefile
+++ git/stdio-common/Makefile
@@ -66,7 +66,7 @@ tests := tstscanf test_rdwr test-popen t
tst-fwrite bug16 bug17 tst-sprintf2 bug18 \
bug19 tst-popen2 scanf14 scanf15 bug21 bug22 scanf16 scanf17 \
tst-setvbuf1 bug23 bug24 bug-vfprintf-nargs tst-sprintf3 bug25 \
- tst-printf-round bug26
+ tst-printf-round bug23-2 bug23-3 bug23-4
tests-$(OPTION_EGLIBC_LOCALE_CODE) \
+= tst-sscanf tst-swprintf test-vfprintf bug14 scanf13 tst-grouping

215
meta/recipes-core/glibc/glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch
View File

@@ -1,215 +0,0 @@
From a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c Mon Sep 17 00:00:00 2001
From: Carlos O'Donell <carlos@redhat.com>
Date: Wed, 19 Nov 2014 11:44:12 -0500
Subject: [PATCH] CVE-2014-7817: wordexp fails to honour WRDE_NOCMD.
The function wordexp() fails to properly handle the WRDE_NOCMD
flag when processing arithmetic inputs in the form of "$((... ``))"
where "..." can be anything valid. The backticks in the arithmetic
epxression are evaluated by in a shell even if WRDE_NOCMD forbade
command substitution. This allows an attacker to attempt to pass
dangerous commands via constructs of the above form, and bypass
the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
in exec_comm(), the only place that can execute a shell. All other
checks for WRDE_NOCMD are superfluous and removed.
We expand the testsuite and add 3 new regression tests of roughly
the same form but with a couple of nested levels.
On top of the 3 new tests we add fork validation to the WRDE_NOCMD
testing. If any forks are detected during the execution of a wordexp()
call with WRDE_NOCMD, the test is marked as failed. This is slightly
heuristic since vfork might be used in the future, but it provides a
higher level of assurance that no shells were executed as part of
command substitution with WRDE_NOCMD in effect. In addition it doesn't
require libpthread or libdl, instead we use the public implementation
namespace function __register_atfork (already part of the public ABI
for libpthread).
Tested on x86_64 with no regressions.
---
ChangeLog | 22 ++++++++++++++++++++++
NEWS | 8 +++++++-
posix/wordexp-test.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
posix/wordexp.c | 16 ++++------------
4 files changed, 77 insertions(+), 13 deletions(-)
Index: git/ChangeLog
===================================================================
--- git.orig/ChangeLog
+++ git/ChangeLog
@@ -1,3 +1,24 @@
+2014-11-19 Carlos O'Donell <carlos@redhat.com>
+ Florian Weimer <fweimer@redhat.com>
+ Joseph Myers <joseph@codesourcery.com>
+ Adam Conrad <adconrad@0c3.net>
+ Andreas Schwab <schwab@suse.de>
+ Brooks <bmoses@google.com>
+
+ [BZ #17625]
+ * wordexp-test.c (__dso_handle): Add prototype.
+ (__register_atfork): Likewise.
+ (__app_register_atfork): New function.
+ (registered_forks): New global.
+ (register_fork): New function.
+ (test_case): Add 3 new tests for WRDE_CMDSUB.
+ (main): Call __app_register_atfork.
+ (testit): If WRDE_NOCMD set registered_forks to zero, run test, and if
+ fork count is non-zero fail the test.
+ * posix/wordexp.c (exec_comm): Return WRDE_CMDSUB if WRDE_NOCMD flag
+ is set.
+ (parse_dollars): Remove check for WRDE_NOCMD.
+
2014-09-07 Allan McRae <allan@archlinux.org
* version.h (RELEASE): Set to "stable".
Index: git/NEWS
===================================================================
--- git.orig/NEWS
+++ git/NEWS
@@ -23,7 +23,13 @@ Version 2.20
16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031,
17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079,
17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153,
- 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354.
+ 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354, 17625.
+
+* CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
+ under certain input conditions resulting in the execution of a shell for
+ command substitution when the applicaiton did not request it. The
+ implementation now checks WRDE_NOCMD immediately before executing the
+ shell and returns the error WRDE_CMDSUB as expected.
* Reverted change of ABI data structures for s390 and s390x:
On s390 and s390x the size of struct ucontext and jmp_buf was increased in
Index: git/posix/wordexp-test.c
===================================================================
--- git.orig/posix/wordexp-test.c
+++ git/posix/wordexp-test.c
@@ -27,6 +27,25 @@
#define IFS " \n\t"
+extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
+extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
+
+static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
+{
+ return __register_atfork (prepare, parent, child,
+ &__dso_handle == NULL ? NULL : __dso_handle);
+}
+
+/* Number of forks seen. */
+static int registered_forks;
+
+/* For each fork increment the fork count. */
+static void
+register_fork (void)
+{
+ registered_forks++;
+}
+
struct test_case_struct
{
int retval;
@@ -206,6 +225,12 @@ struct test_case_struct
{ WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS },
{ WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS },
{ WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS },
+ /* Test for CVE-2014-7817. We test 3 combinations of command
+ substitution inside an arithmetic expression to make sure that
+ no commands are executed and error is returned. */
+ { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
+ { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
+ { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
{ -1, NULL, NULL, 0, 0, { NULL, }, IFS },
};
@@ -258,6 +283,15 @@ main (int argc, char *argv[])
return -1;
}
+ /* If we are not allowed to do command substitution, we install
+ fork handlers to verify that no forks happened. No forks should
+ happen at all if command substitution is disabled. */
+ if (__app_register_atfork (register_fork, NULL, NULL) != 0)
+ {
+ printf ("Failed to register fork handler.\n");
+ return -1;
+ }
+
for (test = 0; test_case[test].retval != -1; test++)
if (testit (&test_case[test]))
++fail;
@@ -367,6 +401,9 @@ testit (struct test_case_struct *tc)
printf ("Test %d (%s): ", ++tests, tc->words);
+ if (tc->flags & WRDE_NOCMD)
+ registered_forks = 0;
+
if (tc->flags & WRDE_APPEND)
{
/* initial wordexp() call, to be appended to */
@@ -378,6 +415,13 @@ testit (struct test_case_struct *tc)
}
retval = wordexp (tc->words, &we, tc->flags);
+ if ((tc->flags & WRDE_NOCMD)
+ && (registered_forks > 0))
+ {
+ printf ("FAILED fork called for WRDE_NOCMD\n");
+ return 1;
+ }
+
if (tc->flags & WRDE_DOOFFS)
start_offs = sav_we.we_offs;
Index: git/posix/wordexp.c
===================================================================
--- git.orig/posix/wordexp.c
+++ git/posix/wordexp.c
@@ -893,6 +893,10 @@ exec_comm (char *comm, char **word, size
pid_t pid;
int noexec = 0;
+ /* Do nothing if command substitution should not succeed. */
+ if (flags & WRDE_NOCMD)
+ return WRDE_CMDSUB;
+
/* Don't fork() unless necessary */
if (!comm || !*comm)
return 0;
@@ -2082,9 +2086,6 @@ parse_dollars (char **word, size_t *word
}
}
- if (flags & WRDE_NOCMD)
- return WRDE_CMDSUB;
-
(*offset) += 2;
return parse_comm (word, word_length, max_length, words, offset, flags,
quoted? NULL : pwordexp, ifs, ifs_white);
@@ -2196,9 +2197,6 @@ parse_dquote (char **word, size_t *word_
break;
case '`':
- if (flags & WRDE_NOCMD)
- return WRDE_CMDSUB;
-
++(*offset);
error = parse_backtick (word, word_length, max_length, words,
offset, flags, NULL, NULL, NULL);
@@ -2357,12 +2355,6 @@ wordexp (const char *words, wordexp_t *p
break;
case '`':
- if (flags & WRDE_NOCMD)
- {
- error = WRDE_CMDSUB;
- goto do_error;
- }
-
++words_offset;
error = parse_backtick (&word, &word_length, &max_length, words,
&words_offset, flags, pwordexp, ifs,

65
meta/recipes-core/glibc/glibc/CVE-2014-9402_endless-loop-in-getaddr_r.patch
View File

@@ -1,65 +0,0 @@
CVE-2014-9402 endless loop in getaddr_r
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=11e3417af6e354f1942c68a271ae51e892b2814d
Upstream-Status: Backport
Signed-off-by: Armin Kuster <akuster@mvista.com>
From 11e3417af6e354f1942c68a271ae51e892b2814d Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 15 Dec 2014 17:41:13 +0100
Subject: [PATCH] Avoid infinite loop in nss_dns getnetbyname [BZ #17630]
---
ChangeLog | 6 ++++++
NEWS | 7 +++++--
resolv/nss_dns/dns-network.c | 4 ++--
3 files changed, 13 insertions(+), 4 deletions(-)
Index: git/NEWS
===================================================================
--- git.orig/NEWS
+++ git/NEWS
@@ -24,7 +24,10 @@ Version 2.20
17031, 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078,
17079, 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150,
17153, 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354,
- 17625.
+ 17625, 17630.
+
+* The nss_dns implementation of getnetbyname could run into an infinite loop
+ if the DNS response contained a PTR record of an unexpected format.
* CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
under certain input conditions resulting in the execution of a shell for
Index: git/resolv/nss_dns/dns-network.c
===================================================================
--- git.orig/resolv/nss_dns/dns-network.c
+++ git/resolv/nss_dns/dns-network.c
@@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int
case BYNAME:
{
- char **ap = result->n_aliases++;
- while (*ap != NULL)
+ char **ap;
+ for (ap = result->n_aliases; *ap != NULL; ++ap)
{
/* Check each alias name for being of the forms:
4.3.2.1.in-addr.arpa = net 1.2.3.4
Index: git/ChangeLog
===================================================================
--- git.orig/ChangeLog
+++ git/ChangeLog
@@ -1,3 +1,9 @@
+2014-12-16 Florian Weimer <fweimer@redhat.com>
+
+ [BZ #17630]
+ * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias
+ names.
+
2014-12-15 Jeff Law <law@redhat.com>
[BZ #16617]

1895
meta/recipes-core/glibc/glibc/eglibc-use-option-groups.patch
View File

File diff suppressed because it is too large Load Diff

100
meta/recipes-core/glibc/glibc/fsl-ppc-no-fsqrt.patch
View File

@@ -1,100 +0,0 @@
Create e5500 specific math_private.h and let it include when compiling for e5500/64bit core
We prefefine __CPU_HAS_FSQRT to 0 and then in general ppc64 math_private.h we check if its
already defined before redefining it. This way we can ensure that on e5500 builds it wont
emit fsqrt intructions
-Khem
Upstream-Status: Pending
Index: git/sysdeps/powerpc/fpu/math_private.h
===================================================================
--- git.orig/sysdeps/powerpc/fpu/math_private.h 2014-08-29 10:31:30.224070587 -0700
+++ git/sysdeps/powerpc/fpu/math_private.h 2014-08-29 10:31:30.212070587 -0700
@@ -25,10 +25,12 @@
#include <fenv_private.h>
#include_next <math_private.h>
-# if __WORDSIZE == 64 || defined _ARCH_PWR4
-# define __CPU_HAS_FSQRT 1
-# else
-# define __CPU_HAS_FSQRT ((GLRO(dl_hwcap) & PPC_FEATURE_64) != 0)
+# ifndef __CPU_HAS_FSQRT
+# if __WORDSIZE == 64 || defined _ARCH_PWR4
+# define __CPU_HAS_FSQRT 1
+# else
+# define __CPU_HAS_FSQRT ((GLRO(dl_hwcap) & PPC_FEATURE_64) != 0)
+# endif
# endif
extern double __slow_ieee754_sqrt (double);
Index: git/sysdeps/powerpc/powerpc64/e5500/fpu/math_private.h
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ git/sysdeps/powerpc/powerpc64/e5500/fpu/math_private.h 2014-08-29 10:31:30.212070587 -0700
@@ -0,0 +1,9 @@
+#ifndef _E5500_MATH_PRIVATE_H_
+#define _E5500_MATH_PRIVATE_H_ 1
+/* E5500 core FPU does not implement
+ fsqrt */
+
+#define __CPU_HAS_FSQRT 0
+#include_next <math_private.h>
+
+#endif /* _E5500_MATH_PRIVATE_H_ */
Index: git/sysdeps/powerpc/powerpc64/e6500/fpu/math_private.h
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ git/sysdeps/powerpc/powerpc64/e6500/fpu/math_private.h 2014-08-29 10:31:30.212070587 -0700
@@ -0,0 +1,9 @@
+#ifndef _E6500_MATH_PRIVATE_H_
+#define _E6500_MATH_PRIVATE_H_ 1
+/* E6500 core FPU does not implement
+ fsqrt */
+
+#define __CPU_HAS_FSQRT 0
+#include_next <math_private.h>
+
+#endif /* _E6500_MATH_PRIVATE_H_ */
Index: git/sysdeps/powerpc/powerpc32/e500mc/fpu/math_private.h
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ git/sysdeps/powerpc/powerpc32/e500mc/fpu/math_private.h 2014-08-29 10:31:30.212070587 -0700
@@ -0,0 +1,9 @@
+#ifndef _E500MC_MATH_PRIVATE_H_
+#define _E500MC_MATH_PRIVATE_H_ 1
+/* E500MC core FPU does not implement
+ fsqrt */
+
+#define __CPU_HAS_FSQRT 0
+#include_next <math_private.h>
+
+#endif /* _E500MC_MATH_PRIVATE_H_ */
Index: git/sysdeps/powerpc/powerpc32/e5500/fpu/math_private.h
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ git/sysdeps/powerpc/powerpc32/e5500/fpu/math_private.h 2014-08-29 10:31:30.216070587 -0700
@@ -0,0 +1,9 @@
+#ifndef _E5500_MATH_PRIVATE_H_
+#define _E5500_MATH_PRIVATE_H_ 1
+/* E5500 core FPU does not implement
+ fsqrt */
+
+#define __CPU_HAS_FSQRT 0
+#include_next <math_private.h>
+
+#endif /* _E5500_MATH_PRIVATE_H_ */
Index: git/sysdeps/powerpc/powerpc32/e6500/fpu/math_private.h
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ git/sysdeps/powerpc/powerpc32/e6500/fpu/math_private.h 2014-08-29 10:31:30.216070587 -0700
@@ -0,0 +1,9 @@
+#ifndef _E6500_MATH_PRIVATE_H_
+#define _E6500_MATH_PRIVATE_H_ 1
+/* E6500 core FPU does not implement
+ fsqrt */
+
+#define __CPU_HAS_FSQRT 0
+#include_next <math_private.h>
+
+#endif /* _E6500_MATH_PRIVATE_H_ */

22
meta/recipes-core/glibc/glibc/grok_gold.patch
View File

@@ -8,9 +8,9 @@ Upstream-Status: Backport
Index: git/configure
===================================================================
--- git.orig/configure 2014-08-29 10:32:34.464070587 -0700
+++ git/configure 2014-08-29 10:32:34.456070587 -0700
@@ -4592,7 +4592,7 @@
--- git.orig/configure
+++ git/configure
@@ -4593,7 +4593,7 @@ else
# Found it, now check the version.
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking version of $LD" >&5
$as_echo_n "checking version of $LD... " >&6; }
@@ -18,17 +18,17 @@ Index: git/configure
+ ac_prog_version=`$LD --version 2>&1 | sed -n 's/^.*GNU [Bbinutilsd][^.]* \([0-9][0-9]*\.[0-9.]*\).*$/\1/p'`
case $ac_prog_version in
'') ac_prog_version="v. ?.??, bad"; ac_verc_fail=yes;;
2.1[0-9][0-9]*|2.[2-9][0-9]*|[3-9].*|[1-9][0-9]*)
2.1[0-9][0-9]*|2.2[2-9]*|2.[3-9][0-9]*|[3-9].*|[1-9][0-9]*)
Index: git/configure.ac
===================================================================
--- git.orig/configure.ac 2014-08-29 10:32:34.464070587 -0700
+++ git/configure.ac 2014-08-29 10:32:34.460070587 -0700
@@ -930,7 +930,7 @@
[GNU assembler.* \([0-9]*\.[0-9.]*\)],
[2.1[0-9][0-9]*|2.[2-9][0-9]*|[3-9].*|[1-9][0-9]*], AS=: critic_missing="$critic_missing as")
--- git.orig/configure.ac
+++ git/configure.ac
@@ -913,7 +913,7 @@ AC_CHECK_PROG_VER(AS, $AS, --version,
[2.1[0-9][0-9]*|2.2[2-9]*|2.[3-9][0-9]*|[3-9].*|[1-9][0-9]*],
AS=: critic_missing="$critic_missing as")
AC_CHECK_PROG_VER(LD, $LD, --version,
- [GNU ld.* \([0-9][0-9]*\.[0-9.]*\)],
+ [GNU [Bbinutilsd][^.]* \([0-9][0-9]*\.[0-9.]*\)],
[2.1[0-9][0-9]*|2.[2-9][0-9]*|[3-9].*|[1-9][0-9]*], LD=: critic_missing="$critic_missing ld")
[2.1[0-9][0-9]*|2.2[2-9]*|2.[3-9][0-9]*|[3-9].*|[1-9][0-9]*],
LD=: critic_missing="$critic_missing ld")
# These programs are version sensitive.

16
meta/recipes-core/glibc/glibc_2.20.bb → meta/recipes-core/glibc/glibc_2.21.bb
View File

@@ -2,11 +2,12 @@ require glibc.inc
DEPENDS += "gperf-native kconfig-frontends-native"
PV = "2.20"
SRCREV = "edac0a60c7514b8c9b59488cffdac6b22267e757"
SRCREV = "b8079dd0d360648e4e8de48656c5c38972621072"
#BRANCH = "release/${PV}/master"
BRANCH = "master"
SRC_URI = "git://sourceware.org/git/glibc.git;branch=release/${PV}/master \
SRC_URI = "git://sourceware.org/git/glibc.git;branch=${BRANCH} \
file://IO-acquire-lock-fix.patch \
file://mips-rld-map-check.patch \
file://etc/ld.so.conf \
@@ -16,15 +17,15 @@ SRC_URI = "git://sourceware.org/git/glibc.git;branch=release/${PV}/master \
file://ppc-sqrt_finite.patch \
file://ppc_slow_ieee754_sqrt.patch \
file://add_resource_h_to_wait_h.patch \
file://fsl-ppc-no-fsqrt.patch \
file://0001-R_ARM_TLS_DTPOFF32.patch \
file://0001-eglibc-run-libm-err-tab.pl-with-specific-dirs-in-S.patch \
file://fix-tibetian-locales.patch \
file://ppce6500-32b_slow_ieee754_sqrt.patch \
file://grok_gold.patch \
file://fix_am_rootsbindir.patch \
file://0001-Add-unused-attribute.patch \
file://0001-When-disabling-SSE-also-make-sure-that-fpmath-is-not.patch \
${EGLIBCPATCHES} \
${CVEPATCHES} \
"
EGLIBCPATCHES = "\
file://timezone-re-written-tzselect-as-posix-sh.patch \
@@ -41,11 +42,6 @@ EGLIBCPATCHES = "\
# file://initgroups_keys.patch \
#
CVEPATCHES = "\
file://CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch \
file://CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch \
file://CVE-2014-9402_endless-loop-in-getaddr_r.patch \
"
LIC_FILES_CHKSUM = "file://LICENSES;md5=e9a558e243b36d3209f380deb394b213 \
file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
file://posix/rxspencer/COPYRIGHT;md5=dc5485bb394a13b2332ec1c785f5d83a \