diff --git a/STAGE1-grep b/STAGE1-grep new file mode 100644 index 0000000..f80f9ca --- /dev/null +++ b/STAGE1-grep @@ -0,0 +1,7 @@ +srpm $1 +mcd $BUILDDIR/$1 +$SRC/${1}-*/configure $TCONFIGARGS +notparallel +test -d tools/gnulib/lib && make $J V=1 -C tools/gnulib/lib +make $J V=1 +make $J install DESTDIR=${ROOTFS} diff --git a/grep-2.21-buf-overrun-fix.patch b/grep-2.21-buf-overrun-fix.patch new file mode 100644 index 0000000..661a3ff --- /dev/null +++ b/grep-2.21-buf-overrun-fix.patch @@ -0,0 +1,146 @@ +From 83a95bd8c8561875b948cadd417c653dbe7ef2e2 Mon Sep 17 00:00:00 2001 +From: Yuliy Pisetsky +Date: Thu, 01 Jan 2015 23:36:55 +0000 +Subject: grep -F: fix a heap buffer (read) overrun + +grep's read buffer is often filled to its full size, except when +reading the final buffer of a file. In that case, the number of +bytes read may be far less than the size of the buffer. However, for +certain unusual pattern/text combinations, grep -F would mistakenly +examine bytes in that uninitialized region of memory when searching +for a match. With carefully chosen inputs, one can cause grep -F to +read beyond the end of that buffer altogether. This problem arose via +commit v2.18-90-g73893ff with the introduction of a more efficient +heuristic using what is now the memchr_kwset function. The use of +that function in bmexec_trans could leave TP much larger than EP, +and the subsequent call to bm_delta2_search would mistakenly access +beyond end of the main input read buffer. + +* src/kwset.c (bmexec_trans): When TP reaches or exceeds EP, +do not call bm_delta2_search. +* tests/kwset-abuse: New file. +* tests/Makefile.am (TESTS): Add it. +* THANKS.in: Update. +* NEWS (Bug fixes): Mention it. + +Prior to this patch, this command would trigger a UMR: + + printf %0360db 0 | valgrind src/grep -F $(printf %019dXb 0) + + Use of uninitialised value of size 8 + at 0x4142BE: bmexec_trans (kwset.c:657) + by 0x4143CA: bmexec (kwset.c:678) + by 0x414973: kwsexec (kwset.c:848) + by 0x414DC4: Fexecute (kwsearch.c:128) + by 0x404E2E: grepbuf (grep.c:1238) + by 0x4054BF: grep (grep.c:1417) + by 0x405CEB: grepdesc (grep.c:1645) + by 0x405EC1: grep_command_line_arg (grep.c:1692) + by 0x4077D4: main (grep.c:2570) + +See the accompanying test for how to trigger the heap buffer overrun. + +Thanks to Nima Aghdaii for testing and finding numerous +ways to break early iterations of this patch. +--- +--- a/THANKS.in ++++ b/THANKS.in +@@ -62,6 +62,7 @@ Michael Aichlmayr mikla@nx.com + Miles Bader miles@ccs.mt.nec.co.jp + Mirraz Mirraz mirraz1@rambler.ru + Nelson H. F. Beebe beebe@math.utah.edu ++Nima Aghdaii naghdaii@fb.com + Olaf Kirch okir@ns.lst.de + Paul Kimoto kimoto@spacenet.tn.cornell.edu + Péter Radics mitchnull@gmail.com +diff --git a/src/kwset.c b/src/kwset.c +index 6d21893..998dbfe 100644 +--- a/src/kwset.c ++++ b/src/kwset.c +@@ -643,6 +643,8 @@ bmexec_trans (kwset_t kwset, char const *text, size_t size) + if (! tp) + return -1; + tp++; ++ if (ep <= tp) ++ break; + } + } + } +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 217a731..2f69835 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -72,6 +72,7 @@ TESTS = \ + inconsistent-range \ + invalid-multibyte-infloop \ + khadafy \ ++ kwset-abuse \ + long-line-vs-2GiB-read \ + match-lines \ + max-count-overread \ +diff --git a/tests/Makefile.in b/tests/Makefile.in +index e40a070..9ecafe7 100644 +--- a/tests/Makefile.in ++++ b/tests/Makefile.in +@@ -1376,6 +1376,7 @@ TESTS = \ + inconsistent-range \ + invalid-multibyte-infloop \ + khadafy \ ++ kwset-abuse \ + long-line-vs-2GiB-read \ + match-lines \ + max-count-overread \ +@@ -2030,6 +2031,13 @@ + $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ + --log-file $$b.log --trs-file $$b.trs \ + $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ ++ "$$tst" $(AM_TESTS_FD_REDIRECT) ++kwset-abuse.log: kwset-abuse ++ @p='kwset-abuse'; \ ++ b='kwset-abuse'; \ ++ $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ ++ --log-file $$b.log --trs-file $$b.trs \ ++ $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ + "$$tst" $(AM_TESTS_FD_REDIRECT) + long-line-vs-2GiB-read.log: long-line-vs-2GiB-read + @p='long-line-vs-2GiB-read'; \ +diff --git a/tests/kwset-abuse b/tests/kwset-abuse +new file mode 100755 +index 0000000..6d8ec0c +--- a/dev/null ++++ b/tests/kwset-abuse +@@ -0,0 +1,32 @@ ++#! /bin/sh ++# Evoke a segfault in a hard-to-reach code path of kwset.c. ++# This bug affected grep versions 2.19 through 2.21. ++# ++# Copyright (C) 2015 Free Software Foundation, Inc. ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++ ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++ ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++ ++. "${srcdir=.}/init.sh"; path_prepend_ ../src ++ ++fail=0 ++ ++# This test case chooses a haystack of size 260,000, since prodding ++# with gdb showed a reallocation slightly larger than that in fillbuf. ++# To reach the buggy code, the needle must have length < 1/11 that of ++# the haystack, and 10,000 is a nice round number that fits the bill. ++printf '%0260000dXy\n' 0 | grep -F $(printf %010000dy 0) ++ ++test $? = 1 || fail=1 ++ ++Exit $fail +-- +cgit v0.9.0.2 diff --git a/grep-2.20-help-align.patch b/grep-2.21-help-align.patch similarity index 92% rename from grep-2.20-help-align.patch rename to grep-2.21-help-align.patch index cef6311..56f24d6 100644 --- a/grep-2.20-help-align.patch +++ b/grep-2.21-help-align.patch @@ -1,8 +1,8 @@ diff --git a/src/grep.c b/src/grep.c -index 0fcc272..2208a4e 100644 +index e3461a7..50a9868 100644 --- a/src/grep.c +++ b/src/grep.c -@@ -1579,16 +1579,19 @@ Output control:\n\ +@@ -1757,17 +1757,20 @@ Output control:\n\ -D, --devices=ACTION how to handle devices, FIFOs and sockets;\n\ ACTION is 'read' or 'skip'\n\ -r, --recursive like --directories=recurse\n\ @@ -12,11 +12,12 @@ index 0fcc272..2208a4e 100644 ")); printf (_("\ - --include=FILE_PATTERN search only files that match FILE_PATTERN\n\ -- --exclude=FILE_PATTERN skip files and directories matching FILE_PATTERN\n\ +- --exclude=FILE_PATTERN skip files and directories matching\ + --include=FILE_PATTERN\n\ + search only files that match FILE_PATTERN\n\ + --exclude=FILE_PATTERN\n\ -+ skip files and directories matching FILE_PATTERN\n\ ++ skip files and directories matching\ + FILE_PATTERN\n\ --exclude-from=FILE skip files matching any file pattern from FILE\n\ - --exclude-dir=PATTERN directories that match PATTERN will be skipped.\n\ + --exclude-dir=PATTERN directories that match PATTERN will be skipped.\n\ diff --git a/grep-2.20-man-fix-gs.patch b/grep-2.21-man-fix-gs.patch similarity index 89% rename from grep-2.20-man-fix-gs.patch rename to grep-2.21-man-fix-gs.patch index db3dd24..65f41bf 100644 --- a/grep-2.20-man-fix-gs.patch +++ b/grep-2.21-man-fix-gs.patch @@ -1,8 +1,8 @@ diff --git a/doc/grep.in.1 b/doc/grep.in.1 -index 58a6c0e..3e6a8cf 100644 +index b6362ee..5a1e3ea 100644 --- a/doc/grep.in.1 +++ b/doc/grep.in.1 -@@ -377,7 +377,7 @@ Print +@@ -314,7 +314,7 @@ Print .I NUM lines of trailing context after matching lines. Places a line containing a group separator @@ -11,7 +11,7 @@ index 58a6c0e..3e6a8cf 100644 between contiguous groups of matches. With the .B \-o -@@ -390,7 +390,7 @@ Print +@@ -327,7 +327,7 @@ Print .I NUM lines of leading context before matching lines. Places a line containing a group separator @@ -20,7 +20,7 @@ index 58a6c0e..3e6a8cf 100644 between contiguous groups of matches. With the .B \-o -@@ -403,13 +403,24 @@ Print +@@ -340,13 +340,24 @@ Print .I NUM lines of output context. Places a line containing a group separator @@ -47,10 +47,10 @@ index 58a6c0e..3e6a8cf 100644 .TP .BR \-a ", " \-\^\-text diff --git a/src/grep.c b/src/grep.c -index 7c0f8a8..0fcc272 100644 +index 8dbf86e..e3461a7 100644 --- a/src/grep.c +++ b/src/grep.c -@@ -1602,6 +1602,8 @@ Context control:\n\ +@@ -1781,6 +1781,8 @@ Context control:\n\ ")); printf (_("\ -NUM same as --context=NUM\n\ diff --git a/grep-2.21-recurse-behaviour-change-doc.patch b/grep-2.21-recurse-behaviour-change-doc.patch new file mode 100644 index 0000000..52a3550 --- /dev/null +++ b/grep-2.21-recurse-behaviour-change-doc.patch @@ -0,0 +1,24 @@ +diff --git a/doc/grep.in.1 b/doc/grep.in.1 +index 5a1e3ea..3f633ea 100644 +--- a/doc/grep.in.1 ++++ b/doc/grep.in.1 +@@ -478,6 +478,7 @@ Search only files whose base name matches + .BR \-r ", " \-\^\-recursive + Read all files under each directory, recursively, + following symbolic links only if they are on the command line. ++Note that if no file operand is given, grep searches the working directory. + This is equivalent to the + .B "\-d recurse" + option. +diff --git a/doc/grep.texi b/doc/grep.texi +index da9a1be..63016bd 100644 +--- a/doc/grep.texi ++++ b/doc/grep.texi +@@ -698,6 +698,7 @@ For each directory operand, + read and process all files in that directory, recursively. + Follow symbolic links on the command line, but skip symlinks + that are encountered recursively. ++Note that if no file operand is given, grep searches the working directory. + This is the same as the @samp{--directories=recurse} option. + + @item -R diff --git a/grep.spec b/grep.spec index 5f38f17..af8c0b8 100644 --- a/grep.spec +++ b/grep.spec @@ -2,8 +2,8 @@ Summary: Pattern matching utilities Name: grep -Version: 2.20 -Release: 2%{?dist} +Version: 2.21 +Release: 3%{?dist} License: GPLv3+ Group: Applications/Text Source: ftp://ftp.gnu.org/pub/gnu/grep/grep-%{version}.tar.xz @@ -11,9 +11,14 @@ Source1: colorgrep.sh Source2: colorgrep.csh Source3: GREP_COLORS # upstream ticket 39444 -Patch0: grep-2.20-man-fix-gs.patch +Patch0: grep-2.21-man-fix-gs.patch # upstream ticket 39445 -Patch1: grep-2.20-help-align.patch +Patch1: grep-2.21-help-align.patch +# fix buffer overrun for grep -F, rhbz#1183653 +Patch2: grep-2.21-buf-overrun-fix.patch +# backported from upstream +# http://git.savannah.gnu.org/cgit/grep.git/commit/?id=c8b9364d5900a40809827aee6cc53705073278f6 +Patch3: grep-2.21-recurse-behaviour-change-doc.patch URL: http://www.gnu.org/software/grep/ Requires(post): /sbin/install-info Requires(preun): /sbin/install-info @@ -34,6 +39,10 @@ GNU grep is needed by many scripts, so it shall be installed on every system. %setup -q %patch0 -p1 -b .man-fix-gs %patch1 -p1 -b .help-align +%patch2 -p1 -b .buf-overrun-fix +%patch3 -p1 -b .recurse-behaviour-change-doc + +chmod 755 tests/kwset-abuse %build %global BUILD_FLAGS $RPM_OPT_FLAGS @@ -76,7 +85,9 @@ fi %files -f %{name}.lang %defattr(-,root,root,-) -%doc ABOUT-NLS AUTHORS THANKS TODO NEWS README ChangeLog COPYING +%doc ABOUT-NLS AUTHORS THANKS TODO NEWS README ChangeLog +%{!?_licensedir:%global license %%doc} +%license COPYING %{_bindir}/* %config(noreplace) %{_sysconfdir}/profile.d/colorgrep.*sh @@ -85,6 +96,35 @@ fi %{_mandir}/*/* %changelog +* Tue Apr 7 2015 Jaroslav Škarvada - 2.21-3 +- Documented change in behaviour of recurse option + Resolves: rhbz#1178305 + +* Tue Jan 20 2015 Jaroslav Škarvada - 2.21-2 +- Fixed buffer overrun for grep -F + Resolves: rhbz#1183653 + +* Tue Nov 25 2014 Jaroslav Škarvada - 2.21-1 +- New version + Resolves: rhbz#1167657 +- De-fuzzified patches +- Dropped pcre-backported-fixes patch (not needed) + +* Fri Nov 14 2014 Jaroslav Škarvada - 2.20-6 +- Backported more PCRE fixes (by pcre-backported-fixes patch) +- Dropped pcre-invalid-utf8-fix patch, handled by pcre-backported-fixes patch + +* Tue Nov 11 2014 Jaroslav Škarvada - 2.20-5 +- Fixed invalid UTF-8 byte sequence error in PCRE mode + (by pcre-invalid-utf8-fix patch) + Resolves: rhbz#1161832 + +* Sat Aug 16 2014 Fedora Release Engineering - 2.20-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sat Jul 12 2014 Tom Callaway - 2.20-3 +- fix license handling . + * Sat Jun 07 2014 Fedora Release Engineering - 2.20-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild diff --git a/sources b/sources index fe1f529..d9d5863 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -2cbea44a4f1548aee20b9ff2d3076908 grep-2.20.tar.xz +43c48064d6409862b8a850db83c8038a grep-2.21.tar.xz