mirror of
https://git.yoctoproject.org/poky
synced 2026-02-05 16:28:43 +01:00
http://bugs.python.org/issue21529 Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstring function: the string to be decoded and the index. The bug is caused by allowing the user to supply a negative index value. The index value is then used directly as an index to an array in the C code; internally the address of the array and its index are added to each other in order to yield the address of the value that is desired. However, by supplying a negative index value and adding this to the address of the array, the processor's register value wraps around and the calculated value will point to a position in memory which isn't within the bounds of the supplied string, causing the function to access other parts of the process memory. (From OE-Core rev: 9ec213bf67afbdfdbe25802ec86487bb22aeb2e4) Signed-off-by: Benjamin Peterson <benjamin@python.org> Applied to python-native recipe in order to fix the above mentioned vulnerability. Upstream-Status: Submitted Signed-off-by: Daniel BORNAZ <daniel.bornaz@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
188 lines
7.0 KiB
BlitzBasic
188 lines
7.0 KiB
BlitzBasic
require python.inc
|
|
DEPENDS = "python-native bzip2 db gdbm openssl readline sqlite3 zlib"
|
|
PR = "${INC_PR}.3"
|
|
|
|
DISTRO_SRC_URI ?= "file://sitecustomize.py"
|
|
DISTRO_SRC_URI_linuxstdbase = ""
|
|
SRC_URI += "\
|
|
file://01-use-proper-tools-for-cross-build.patch \
|
|
file://03-fix-tkinter-detection.patch \
|
|
file://05-enable-ctypes-cross-build.patch \
|
|
file://06-ctypes-libffi-fix-configure.patch \
|
|
file://06-avoid_usr_lib_termcap_path_in_linking.patch \
|
|
${DISTRO_SRC_URI} \
|
|
file://multilib.patch \
|
|
file://cgi_py.patch \
|
|
file://remove_sqlite_rpath.patch \
|
|
file://setup_py_skip_cross_import_check.patch \
|
|
file://add-md5module-support.patch \
|
|
file://host_include_contamination.patch \
|
|
file://fix_for_using_different_libdir.patch \
|
|
file://setuptweaks.patch \
|
|
file://check-if-target-is-64b-not-host.patch \
|
|
file://search_db_h_in_inc_dirs_and_avoid_warning.patch \
|
|
file://avoid_warning_about_tkinter.patch \
|
|
file://avoid_warning_for_sunos_specific_module.patch \
|
|
file://python-2.7.3-berkeley-db-5.3.patch \
|
|
file://python-2.7.3-remove-bsdb-rpath.patch \
|
|
file://builddir.patch \
|
|
file://python-2.7.3-CVE-2012-2135.patch \
|
|
file://gcc-4.8-fix-configure-Wformat.patch \
|
|
file://fix-makefile-for-ptest.patch \
|
|
file://run-ptest \
|
|
file://CVE-2013-4073_py27.patch \
|
|
file://pypirc-secure.patch \
|
|
file://parallel-makeinst-create-bindir.patch \
|
|
file://python-2.7.3-CVE-2013-1752-smtplib-fix.patch \
|
|
file://python-fix-build-error-with-Readline-6.3.patch \
|
|
file://python-2.7.3-CVE-2014-1912.patch \
|
|
file://json-flaw-fix.patch \
|
|
"
|
|
|
|
S = "${WORKDIR}/Python-${PV}"
|
|
|
|
inherit autotools multilib_header python-dir pythonnative
|
|
|
|
# The 3 lines below are copied from the libffi recipe, ctypes ships its own copy of the libffi sources
|
|
#Somehow gcc doesn't set __SOFTFP__ when passing -mfloatabi=softp :(
|
|
TARGET_CC_ARCH_append_armv6 = " -D__SOFTFP__"
|
|
TARGET_CC_ARCH_append_armv7a = " -D__SOFTFP__"
|
|
|
|
do_configure_prepend() {
|
|
rm -f ${S}/Makefile.orig
|
|
autoreconf -Wcross --verbose --install --force --exclude=autopoint Modules/_ctypes/libffi || bbnote "_ctypes failed to autoreconf"
|
|
}
|
|
|
|
do_compile() {
|
|
# regenerate platform specific files, because they depend on system headers
|
|
cd Lib/plat-linux2
|
|
include=${STAGING_INCDIR} ${STAGING_BINDIR_NATIVE}/python-native/python \
|
|
${S}/Tools/scripts/h2py.py -i '(u_long)' \
|
|
${STAGING_INCDIR}/dlfcn.h \
|
|
${STAGING_INCDIR}/linux/cdrom.h \
|
|
${STAGING_INCDIR}/netinet/in.h \
|
|
${STAGING_INCDIR}/sys/types.h
|
|
sed -e 's,${STAGING_DIR_HOST},,g' -i *.py
|
|
cd -
|
|
|
|
# remove hardcoded ccache, see http://bugs.openembedded.net/show_bug.cgi?id=4144
|
|
sed -i -e s,ccache\ ,'$(CCACHE) ', Makefile
|
|
|
|
# remove any bogus LD_LIBRARY_PATH
|
|
sed -i -e s,RUNSHARED=.*,RUNSHARED=, Makefile
|
|
|
|
if [ ! -f Makefile.orig ]; then
|
|
install -m 0644 Makefile Makefile.orig
|
|
fi
|
|
sed -i -e 's,^LDFLAGS=.*,LDFLAGS=-L. -L${STAGING_LIBDIR},g' \
|
|
-e 's,libdir=${libdir},libdir=${STAGING_LIBDIR},g' \
|
|
-e 's,libexecdir=${libexecdir},libexecdir=${STAGING_DIR_HOST}${libexecdir},g' \
|
|
-e 's,^LIBDIR=.*,LIBDIR=${STAGING_LIBDIR},g' \
|
|
-e 's,includedir=${includedir},includedir=${STAGING_INCDIR},g' \
|
|
-e 's,^INCLUDEDIR=.*,INCLUDE=${STAGING_INCDIR},g' \
|
|
-e 's,^CONFINCLUDEDIR=.*,CONFINCLUDE=${STAGING_INCDIR},g' \
|
|
Makefile
|
|
# save copy of it now, because if we do it in do_install and
|
|
# then call do_install twice we get Makefile.orig == Makefile.sysroot
|
|
install -m 0644 Makefile Makefile.sysroot
|
|
|
|
export CROSS_COMPILE="${TARGET_PREFIX}"
|
|
export PYTHONBUILDDIR="${S}"
|
|
|
|
oe_runmake HOSTPGEN=${STAGING_BINDIR_NATIVE}/python-native/pgen \
|
|
HOSTPYTHON=${STAGING_BINDIR_NATIVE}/python-native/python \
|
|
STAGING_LIBDIR=${STAGING_LIBDIR} \
|
|
STAGING_INCDIR=${STAGING_INCDIR} \
|
|
STAGING_BASELIBDIR=${STAGING_BASELIBDIR} \
|
|
BUILD_SYS=${BUILD_SYS} HOST_SYS=${HOST_SYS} \
|
|
OPT="${CFLAGS}"
|
|
}
|
|
|
|
do_install() {
|
|
# make install needs the original Makefile, or otherwise the inclues would
|
|
# go to ${D}${STAGING...}/...
|
|
install -m 0644 Makefile.orig Makefile
|
|
|
|
export CROSS_COMPILE="${TARGET_PREFIX}"
|
|
export PYTHONBUILDDIR="${S}"
|
|
|
|
# After swizzling the makefile, we need to run the build again.
|
|
# install can race with the build so we have to run this first, then install
|
|
oe_runmake HOSTPGEN=${STAGING_BINDIR_NATIVE}/python-native/pgen \
|
|
HOSTPYTHON=${STAGING_BINDIR_NATIVE}/python-native/python \
|
|
CROSSPYTHONPATH=${STAGING_LIBDIR_NATIVE}/python${PYTHON_MAJMIN}/lib-dynload/ \
|
|
STAGING_LIBDIR=${STAGING_LIBDIR} \
|
|
STAGING_INCDIR=${STAGING_INCDIR} \
|
|
STAGING_BASELIBDIR=${STAGING_BASELIBDIR} \
|
|
BUILD_SYS=${BUILD_SYS} HOST_SYS=${HOST_SYS} \
|
|
DESTDIR=${D} LIBDIR=${libdir}
|
|
|
|
oe_runmake HOSTPGEN=${STAGING_BINDIR_NATIVE}/python-native/pgen \
|
|
HOSTPYTHON=${STAGING_BINDIR_NATIVE}/python-native/python \
|
|
CROSSPYTHONPATH=${STAGING_LIBDIR_NATIVE}/python${PYTHON_MAJMIN}/lib-dynload/ \
|
|
STAGING_LIBDIR=${STAGING_LIBDIR} \
|
|
STAGING_INCDIR=${STAGING_INCDIR} \
|
|
STAGING_BASELIBDIR=${STAGING_BASELIBDIR} \
|
|
BUILD_SYS=${BUILD_SYS} HOST_SYS=${HOST_SYS} \
|
|
DESTDIR=${D} LIBDIR=${libdir} install
|
|
|
|
install -m 0644 Makefile.sysroot ${D}/${libdir}/python${PYTHON_MAJMIN}/config/Makefile
|
|
|
|
if [ -e ${WORKDIR}/sitecustomize.py ]; then
|
|
install -m 0644 ${WORKDIR}/sitecustomize.py ${D}/${libdir}/python${PYTHON_MAJMIN}
|
|
fi
|
|
|
|
oe_multilib_header python${PYTHON_MAJMIN}/pyconfig.h
|
|
}
|
|
|
|
do_install_append_class-nativesdk () {
|
|
create_wrapper ${D}${bindir}/python2.7 TERMINFO_DIRS='${sysconfdir}/terminfo:/etc/terminfo:/usr/share/terminfo:/usr/share/misc/terminfo:/lib/terminfo'
|
|
}
|
|
|
|
SSTATE_SCAN_FILES += "Makefile"
|
|
PACKAGE_PREPROCESS_FUNCS += "py_package_preprocess"
|
|
|
|
py_package_preprocess () {
|
|
# copy back the old Makefile to fix target package
|
|
install -m 0644 Makefile.orig ${PKGD}/${libdir}/python${PYTHON_MAJMIN}/config/Makefile
|
|
|
|
# Remove references to buildmachine paths in target Makefile
|
|
sed -i -e 's:--sysroot=${STAGING_DIR_TARGET}::g' -e s:'--with-libtool-sysroot=${STAGING_DIR_TARGET}'::g ${PKGD}/${libdir}/python${PYTHON_MAJMIN}/config/Makefile
|
|
}
|
|
|
|
require python-${PYTHON_MAJMIN}-manifest.inc
|
|
|
|
# manual dependency additions
|
|
RPROVIDES_${PN}-core = "${PN}"
|
|
RRECOMMENDS_${PN}-core = "${PN}-readline"
|
|
RRECOMMENDS_${PN}-crypt = "openssl"
|
|
RRECOMMENDS_${PN}-crypt_class-nativesdk = "nativesdk-openssl"
|
|
|
|
# package libpython2
|
|
PACKAGES =+ "lib${BPN}2"
|
|
FILES_lib${BPN}2 = "${libdir}/libpython*.so.*"
|
|
|
|
# catch debug extensions (isn't that already in python-core-dbg?)
|
|
FILES_${PN}-dbg += "${libdir}/python${PYTHON_MAJMIN}/lib-dynload/.debug"
|
|
|
|
# catch all the rest (unsorted)
|
|
PACKAGES += "${PN}-misc"
|
|
FILES_${PN}-misc = "${libdir}/python${PYTHON_MAJMIN}"
|
|
RDEPENDS_${PN}-ptest = "${PN}-modules ${PN}-misc"
|
|
#inherit ptest after "require python-${PYTHON_MAJMIN}-manifest.inc" so PACKAGES doesn't get overwritten
|
|
inherit ptest
|
|
|
|
# This must come after inherit ptest for the override to take effect
|
|
do_install_ptest() {
|
|
cp ${B}/Makefile ${D}${PTEST_PATH}
|
|
sed -e s:LIBDIR/python/ptest:${PTEST_PATH}:g \
|
|
-e s:LIBDIR:${libdir}:g \
|
|
-i ${D}${PTEST_PATH}/run-ptest
|
|
}
|
|
|
|
# catch manpage
|
|
PACKAGES += "${PN}-man"
|
|
FILES_${PN}-man = "${datadir}/man"
|
|
|
|
BBCLASSEXTEND = "nativesdk"
|