Files
poky/meta/recipes-devtools/python/python_2.7.3.bb
Daniel BORNAZ da75a9aaf0 python: fix _json module arbitrary process memory read vulnerability
http://bugs.python.org/issue21529

Python 2 and 3 are susceptible to arbitrary process memory reading by
a user or adversary due to a bug in the _json module caused by
insufficient bounds checking.

The sole prerequisites of this attack are that the attacker is able to
control or influence the two parameters of the default scanstring
function: the string to be decoded and the index.

The bug is caused by allowing the user to supply a negative index
value. The index value is then used directly as an index to an array
in the C code; internally the address of the array and its index are
added to each other in order to yield the address of the value that is
desired. However, by supplying a negative index value and adding this
to the address of the array, the processor's register value wraps
around and the calculated value will point to a position in memory
which isn't within the bounds of the supplied string, causing the
function to access other parts of the process memory.

(From OE-Core rev: 9ec213bf67afbdfdbe25802ec86487bb22aeb2e4)

Signed-off-by: Benjamin Peterson <benjamin@python.org>

Applied to python-native recipe in order to fix the above mentioned
vulnerability.

Upstream-Status: Submitted

Signed-off-by: Daniel BORNAZ <daniel.bornaz@enea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-25 15:34:01 +01:00

188 lines
7.0 KiB
BlitzBasic

require python.inc
DEPENDS = "python-native bzip2 db gdbm openssl readline sqlite3 zlib"
PR = "${INC_PR}.3"
DISTRO_SRC_URI ?= "file://sitecustomize.py"
DISTRO_SRC_URI_linuxstdbase = ""
SRC_URI += "\
file://01-use-proper-tools-for-cross-build.patch \
file://03-fix-tkinter-detection.patch \
file://05-enable-ctypes-cross-build.patch \
file://06-ctypes-libffi-fix-configure.patch \
file://06-avoid_usr_lib_termcap_path_in_linking.patch \
${DISTRO_SRC_URI} \
file://multilib.patch \
file://cgi_py.patch \
file://remove_sqlite_rpath.patch \
file://setup_py_skip_cross_import_check.patch \
file://add-md5module-support.patch \
file://host_include_contamination.patch \
file://fix_for_using_different_libdir.patch \
file://setuptweaks.patch \
file://check-if-target-is-64b-not-host.patch \
file://search_db_h_in_inc_dirs_and_avoid_warning.patch \
file://avoid_warning_about_tkinter.patch \
file://avoid_warning_for_sunos_specific_module.patch \
file://python-2.7.3-berkeley-db-5.3.patch \
file://python-2.7.3-remove-bsdb-rpath.patch \
file://builddir.patch \
file://python-2.7.3-CVE-2012-2135.patch \
file://gcc-4.8-fix-configure-Wformat.patch \
file://fix-makefile-for-ptest.patch \
file://run-ptest \
file://CVE-2013-4073_py27.patch \
file://pypirc-secure.patch \
file://parallel-makeinst-create-bindir.patch \
file://python-2.7.3-CVE-2013-1752-smtplib-fix.patch \
file://python-fix-build-error-with-Readline-6.3.patch \
file://python-2.7.3-CVE-2014-1912.patch \
file://json-flaw-fix.patch \
"
S = "${WORKDIR}/Python-${PV}"
inherit autotools multilib_header python-dir pythonnative
# The 3 lines below are copied from the libffi recipe, ctypes ships its own copy of the libffi sources
#Somehow gcc doesn't set __SOFTFP__ when passing -mfloatabi=softp :(
TARGET_CC_ARCH_append_armv6 = " -D__SOFTFP__"
TARGET_CC_ARCH_append_armv7a = " -D__SOFTFP__"
do_configure_prepend() {
rm -f ${S}/Makefile.orig
autoreconf -Wcross --verbose --install --force --exclude=autopoint Modules/_ctypes/libffi || bbnote "_ctypes failed to autoreconf"
}
do_compile() {
# regenerate platform specific files, because they depend on system headers
cd Lib/plat-linux2
include=${STAGING_INCDIR} ${STAGING_BINDIR_NATIVE}/python-native/python \
${S}/Tools/scripts/h2py.py -i '(u_long)' \
${STAGING_INCDIR}/dlfcn.h \
${STAGING_INCDIR}/linux/cdrom.h \
${STAGING_INCDIR}/netinet/in.h \
${STAGING_INCDIR}/sys/types.h
sed -e 's,${STAGING_DIR_HOST},,g' -i *.py
cd -
# remove hardcoded ccache, see http://bugs.openembedded.net/show_bug.cgi?id=4144
sed -i -e s,ccache\ ,'$(CCACHE) ', Makefile
# remove any bogus LD_LIBRARY_PATH
sed -i -e s,RUNSHARED=.*,RUNSHARED=, Makefile
if [ ! -f Makefile.orig ]; then
install -m 0644 Makefile Makefile.orig
fi
sed -i -e 's,^LDFLAGS=.*,LDFLAGS=-L. -L${STAGING_LIBDIR},g' \
-e 's,libdir=${libdir},libdir=${STAGING_LIBDIR},g' \
-e 's,libexecdir=${libexecdir},libexecdir=${STAGING_DIR_HOST}${libexecdir},g' \
-e 's,^LIBDIR=.*,LIBDIR=${STAGING_LIBDIR},g' \
-e 's,includedir=${includedir},includedir=${STAGING_INCDIR},g' \
-e 's,^INCLUDEDIR=.*,INCLUDE=${STAGING_INCDIR},g' \
-e 's,^CONFINCLUDEDIR=.*,CONFINCLUDE=${STAGING_INCDIR},g' \
Makefile
# save copy of it now, because if we do it in do_install and
# then call do_install twice we get Makefile.orig == Makefile.sysroot
install -m 0644 Makefile Makefile.sysroot
export CROSS_COMPILE="${TARGET_PREFIX}"
export PYTHONBUILDDIR="${S}"
oe_runmake HOSTPGEN=${STAGING_BINDIR_NATIVE}/python-native/pgen \
HOSTPYTHON=${STAGING_BINDIR_NATIVE}/python-native/python \
STAGING_LIBDIR=${STAGING_LIBDIR} \
STAGING_INCDIR=${STAGING_INCDIR} \
STAGING_BASELIBDIR=${STAGING_BASELIBDIR} \
BUILD_SYS=${BUILD_SYS} HOST_SYS=${HOST_SYS} \
OPT="${CFLAGS}"
}
do_install() {
# make install needs the original Makefile, or otherwise the inclues would
# go to ${D}${STAGING...}/...
install -m 0644 Makefile.orig Makefile
export CROSS_COMPILE="${TARGET_PREFIX}"
export PYTHONBUILDDIR="${S}"
# After swizzling the makefile, we need to run the build again.
# install can race with the build so we have to run this first, then install
oe_runmake HOSTPGEN=${STAGING_BINDIR_NATIVE}/python-native/pgen \
HOSTPYTHON=${STAGING_BINDIR_NATIVE}/python-native/python \
CROSSPYTHONPATH=${STAGING_LIBDIR_NATIVE}/python${PYTHON_MAJMIN}/lib-dynload/ \
STAGING_LIBDIR=${STAGING_LIBDIR} \
STAGING_INCDIR=${STAGING_INCDIR} \
STAGING_BASELIBDIR=${STAGING_BASELIBDIR} \
BUILD_SYS=${BUILD_SYS} HOST_SYS=${HOST_SYS} \
DESTDIR=${D} LIBDIR=${libdir}
oe_runmake HOSTPGEN=${STAGING_BINDIR_NATIVE}/python-native/pgen \
HOSTPYTHON=${STAGING_BINDIR_NATIVE}/python-native/python \
CROSSPYTHONPATH=${STAGING_LIBDIR_NATIVE}/python${PYTHON_MAJMIN}/lib-dynload/ \
STAGING_LIBDIR=${STAGING_LIBDIR} \
STAGING_INCDIR=${STAGING_INCDIR} \
STAGING_BASELIBDIR=${STAGING_BASELIBDIR} \
BUILD_SYS=${BUILD_SYS} HOST_SYS=${HOST_SYS} \
DESTDIR=${D} LIBDIR=${libdir} install
install -m 0644 Makefile.sysroot ${D}/${libdir}/python${PYTHON_MAJMIN}/config/Makefile
if [ -e ${WORKDIR}/sitecustomize.py ]; then
install -m 0644 ${WORKDIR}/sitecustomize.py ${D}/${libdir}/python${PYTHON_MAJMIN}
fi
oe_multilib_header python${PYTHON_MAJMIN}/pyconfig.h
}
do_install_append_class-nativesdk () {
create_wrapper ${D}${bindir}/python2.7 TERMINFO_DIRS='${sysconfdir}/terminfo:/etc/terminfo:/usr/share/terminfo:/usr/share/misc/terminfo:/lib/terminfo'
}
SSTATE_SCAN_FILES += "Makefile"
PACKAGE_PREPROCESS_FUNCS += "py_package_preprocess"
py_package_preprocess () {
# copy back the old Makefile to fix target package
install -m 0644 Makefile.orig ${PKGD}/${libdir}/python${PYTHON_MAJMIN}/config/Makefile
# Remove references to buildmachine paths in target Makefile
sed -i -e 's:--sysroot=${STAGING_DIR_TARGET}::g' -e s:'--with-libtool-sysroot=${STAGING_DIR_TARGET}'::g ${PKGD}/${libdir}/python${PYTHON_MAJMIN}/config/Makefile
}
require python-${PYTHON_MAJMIN}-manifest.inc
# manual dependency additions
RPROVIDES_${PN}-core = "${PN}"
RRECOMMENDS_${PN}-core = "${PN}-readline"
RRECOMMENDS_${PN}-crypt = "openssl"
RRECOMMENDS_${PN}-crypt_class-nativesdk = "nativesdk-openssl"
# package libpython2
PACKAGES =+ "lib${BPN}2"
FILES_lib${BPN}2 = "${libdir}/libpython*.so.*"
# catch debug extensions (isn't that already in python-core-dbg?)
FILES_${PN}-dbg += "${libdir}/python${PYTHON_MAJMIN}/lib-dynload/.debug"
# catch all the rest (unsorted)
PACKAGES += "${PN}-misc"
FILES_${PN}-misc = "${libdir}/python${PYTHON_MAJMIN}"
RDEPENDS_${PN}-ptest = "${PN}-modules ${PN}-misc"
#inherit ptest after "require python-${PYTHON_MAJMIN}-manifest.inc" so PACKAGES doesn't get overwritten
inherit ptest
# This must come after inherit ptest for the override to take effect
do_install_ptest() {
cp ${B}/Makefile ${D}${PTEST_PATH}
sed -e s:LIBDIR/python/ptest:${PTEST_PATH}:g \
-e s:LIBDIR:${libdir}:g \
-i ${D}${PTEST_PATH}/run-ptest
}
# catch manpage
PACKAGES += "${PN}-man"
FILES_${PN}-man = "${datadir}/man"
BBCLASSEXTEND = "nativesdk"