diff --git a/0004-fix-55-check-too-big-code-point-value-for-single-byt.patch b/0004-fix-55-check-too-big-code-point-value-for-single-byt.patch new file mode 100644 index 0000000..036c090 --- /dev/null +++ b/0004-fix-55-check-too-big-code-point-value-for-single-byt.patch @@ -0,0 +1,27 @@ +From b4bf968ad52afe14e60a2dc8a95d3555c543353a Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Thu, 18 May 2017 17:05:27 +0900 +Subject: [PATCH 04/25] fix #55 : check too big code point value for single + byte value in next_state_val() + +--- + src/regparse.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/regparse.c b/src/regparse.c +index 11f9e34..665998e 100644 +--- a/src/regparse.c ++++ b/src/regparse.c +@@ -4044,6 +4044,9 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v, + switch (*state) { + case CCS_VALUE: + if (*type == CCV_SB) { ++ if (*vs > 0xff) ++ return ONIGERR_INVALID_CODE_POINT_VALUE; ++ + BITSET_SET_BIT(cc->bs, (int )(*vs)); + } + else if (*type == CCV_CODE_POINT) { +-- +2.13.0 + diff --git a/0005-fix-55-Byte-value-expressed-in-octal-must-be-smaller.patch b/0005-fix-55-Byte-value-expressed-in-octal-must-be-smaller.patch new file mode 100644 index 0000000..e3b0ccb --- /dev/null +++ b/0005-fix-55-Byte-value-expressed-in-octal-must-be-smaller.patch @@ -0,0 +1,35 @@ +From f015fbdd95f76438cd86366467bb2b39870dd7c6 Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Fri, 19 May 2017 15:44:47 +0900 +Subject: [PATCH 05/25] fix #55 : Byte value expressed in octal must be smaller + than 256 + +--- + src/regparse.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/regparse.c b/src/regparse.c +index 665998e..f7acc5f 100644 +--- a/src/regparse.c ++++ b/src/regparse.c +@@ -3020,7 +3020,7 @@ fetch_token_in_cc(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env) + PUNFETCH; + prev = p; + num = scan_unsigned_octal_number(&p, end, 3, enc); +- if (num < 0) return ONIGERR_TOO_BIG_NUMBER; ++ if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER; + if (p == prev) { /* can't read nothing. */ + num = 0; /* but, it's not error */ + } +@@ -3392,7 +3392,7 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env) + if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) { + prev = p; + num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc); +- if (num < 0) return ONIGERR_TOO_BIG_NUMBER; ++ if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER; + if (p == prev) { /* can't read nothing. */ + num = 0; /* but, it's not error */ + } +-- +2.13.0 + diff --git a/0013-fix-56-return-invalid-result-for-codepoint-0xFFFFFFF.patch b/0013-fix-56-return-invalid-result-for-codepoint-0xFFFFFFF.patch new file mode 100644 index 0000000..d9a5b5e --- /dev/null +++ b/0013-fix-56-return-invalid-result-for-codepoint-0xFFFFFFF.patch @@ -0,0 +1,40 @@ +From 166a6c3999bf06b4de0ab4ce6b088a468cc4029f Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Mon, 22 May 2017 18:09:39 +0900 +Subject: [PATCH 13/25] fix #56 : return invalid result for codepoint + 0xFFFFFFFF + +--- + src/gperf_unfold_key_conv.py | 2 +- + src/unicode_unfold_key.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/gperf_unfold_key_conv.py b/src/gperf_unfold_key_conv.py +index dcd8587..34f9c2f 100755 +--- a/src/gperf_unfold_key_conv.py ++++ b/src/gperf_unfold_key_conv.py +@@ -36,7 +36,7 @@ def parse_line(s): + if r != s: return r + r = re.sub(REG_GET_CODE, 'OnigCodePoint gcode = wordlist[key].code;', s) + if r != s: return r +- r = re.sub(REG_CODE_CHECK, 'if (code == gcode)', s) ++ r = re.sub(REG_CODE_CHECK, 'if (code == gcode && wordlist[key].index >= 0)', s) + if r != s: return r + + return s +diff --git a/src/unicode_unfold_key.c b/src/unicode_unfold_key.c +index a5aff90..15302ca 100644 +--- a/src/unicode_unfold_key.c ++++ b/src/unicode_unfold_key.c +@@ -2850,7 +2850,7 @@ unicode_unfold_key(OnigCodePoint code) + { + OnigCodePoint gcode = wordlist[key].code; + +- if (code == gcode) ++ if (code == gcode && wordlist[key].index >= 0) + return &wordlist[key]; + } + } +-- +2.13.0 + diff --git a/0014-fix-57-DATA_ENSURE-check-must-be-before-data-access.patch b/0014-fix-57-DATA_ENSURE-check-must-be-before-data-access.patch new file mode 100644 index 0000000..daf61f0 --- /dev/null +++ b/0014-fix-57-DATA_ENSURE-check-must-be-before-data-access.patch @@ -0,0 +1,32 @@ +From 690313a061f7a4fa614ec5cc8368b4f2284e059b Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Tue, 23 May 2017 10:28:58 +0900 +Subject: [PATCH 14/25] fix #57 : DATA_ENSURE() check must be before data + access + +--- + src/regexec.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/src/regexec.c b/src/regexec.c +index 35fef11..d4e577d 100644 +--- a/src/regexec.c ++++ b/src/regexec.c +@@ -1473,14 +1473,9 @@ match_at(regex_t* reg, const UChar* str, const UChar* end, + break; + + case OP_EXACT1: MOP_IN(OP_EXACT1); +-#if 0 + DATA_ENSURE(1); + if (*p != *s) goto fail; + p++; s++; +-#endif +- if (*p != *s++) goto fail; +- DATA_ENSURE(0); +- p++; + MOP_OUT; + break; + +-- +2.13.0 + diff --git a/0015-fix-58-access-to-invalid-address-by-reg-dmin-value.patch b/0015-fix-58-access-to-invalid-address-by-reg-dmin-value.patch new file mode 100644 index 0000000..2d34818 --- /dev/null +++ b/0015-fix-58-access-to-invalid-address-by-reg-dmin-value.patch @@ -0,0 +1,25 @@ +From 9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814 Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Tue, 23 May 2017 16:15:35 +0900 +Subject: [PATCH 15/25] fix #58 : access to invalid address by reg->dmin value + +--- + src/regexec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/regexec.c b/src/regexec.c +index d4e577d..2fa0f3d 100644 +--- a/src/regexec.c ++++ b/src/regexec.c +@@ -3154,6 +3154,8 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s, + } + else { + UChar *q = p + reg->dmin; ++ ++ if (q >= end) return 0; /* fail */ + while (p < q) p += enclen(reg->enc, p); + } + } +-- +2.13.0 + diff --git a/0019-fix-59-access-to-invalid-address-by-reg-dmax-value.patch b/0019-fix-59-access-to-invalid-address-by-reg-dmax-value.patch new file mode 100644 index 0000000..3b7b3d1 --- /dev/null +++ b/0019-fix-59-access-to-invalid-address-by-reg-dmax-value.patch @@ -0,0 +1,52 @@ +From b690371bbf97794b4a1d3f295d4fb9a8b05d402d Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Wed, 24 May 2017 10:27:04 +0900 +Subject: [PATCH 19/25] fix #59 : access to invalid address by reg->dmax value + +--- + src/regexec.c | 27 +++++++++++++++++---------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/src/regexec.c b/src/regexec.c +index 49bcc50..c0626ef 100644 +--- a/src/regexec.c ++++ b/src/regexec.c +@@ -3235,18 +3235,25 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s, + } + else { + if (reg->dmax != ONIG_INFINITE_DISTANCE) { +- *low = p - reg->dmax; +- if (*low > s) { +- *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s, +- *low, (const UChar** )low_prev); +- if (low_prev && IS_NULL(*low_prev)) +- *low_prev = onigenc_get_prev_char_head(reg->enc, +- (pprev ? pprev : s), *low); ++ if (p - str < reg->dmax) { ++ *low = (UChar* )str; ++ if (low_prev) ++ *low_prev = onigenc_get_prev_char_head(reg->enc, str, *low); + } + else { +- if (low_prev) +- *low_prev = onigenc_get_prev_char_head(reg->enc, +- (pprev ? pprev : str), *low); ++ *low = p - reg->dmax; ++ if (*low > s) { ++ *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s, ++ *low, (const UChar** )low_prev); ++ if (low_prev && IS_NULL(*low_prev)) ++ *low_prev = onigenc_get_prev_char_head(reg->enc, ++ (pprev ? pprev : s), *low); ++ } ++ else { ++ if (low_prev) ++ *low_prev = onigenc_get_prev_char_head(reg->enc, ++ (pprev ? pprev : str), *low); ++ } + } + } + } +-- +2.13.0 + diff --git a/0020-fix-60-invalid-state-CCS_VALUE-in-parse_char_class.patch b/0020-fix-60-invalid-state-CCS_VALUE-in-parse_char_class.patch new file mode 100644 index 0000000..2ed02c4 --- /dev/null +++ b/0020-fix-60-invalid-state-CCS_VALUE-in-parse_char_class.patch @@ -0,0 +1,28 @@ +From 3b63d12038c8d8fc278e81c942fa9bec7c704c8b Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Wed, 24 May 2017 13:43:25 +0900 +Subject: [PATCH 20/25] fix #60 : invalid state(CCS_VALUE) in + parse_char_class() + +--- + src/regparse.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/regparse.c b/src/regparse.c +index 69875fa..1988747 100644 +--- a/src/regparse.c ++++ b/src/regparse.c +@@ -4081,7 +4081,9 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type, + } + } + +- *state = CCS_VALUE; ++ if (*state != CCS_START) ++ *state = CCS_VALUE; ++ + *type = CCV_CLASS; + return 0; + } +-- +2.13.0 + diff --git a/0104-re-fix-60-by-check-val_type.patch b/0104-re-fix-60-by-check-val_type.patch new file mode 100644 index 0000000..8a18783 --- /dev/null +++ b/0104-re-fix-60-by-check-val_type.patch @@ -0,0 +1,40 @@ +From ddbf55698b5f7ffdfa737b0b8e0079af1fdd7cb1 Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Thu, 15 Jun 2017 15:48:46 +0900 +Subject: [PATCH 104/515] re-fix #60 by check val_type + +--- + src/regparse.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/src/regparse.c b/src/regparse.c +index a4e3d4a..4f4802d 100644 +--- a/src/regparse.c ++++ b/src/regparse.c +@@ -4061,9 +4061,7 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type, + } + } + +- if (*state != CCS_START) +- *state = CCS_VALUE; +- ++ *state = CCS_VALUE; + *type = CCV_CLASS; + return 0; + } +@@ -4348,6 +4346,12 @@ parse_char_class(Node** np, OnigToken* tok, UChar** src, UChar* end, + CC_ESC_WARN(env, (UChar* )"-"); + goto range_end_val; + } ++ ++ if (val_type == CCV_CLASS) { ++ r = ONIGERR_UNMATCHED_RANGE_SPECIFIER_IN_CHAR_CLASS; ++ goto err; ++ } ++ + state = CCS_RANGE; + } + else if (state == CCS_START) { +-- +2.14.1 + diff --git a/oniguruma.spec b/oniguruma.spec index 1a8754f..f9ba221 100644 --- a/oniguruma.spec +++ b/oniguruma.spec @@ -1,6 +1,6 @@ Name: oniguruma Version: 6.1.3 -Release: 1%{?dist} +Release: 3%{?dist} Summary: Regular expressions library Group: System Environment/Libraries @@ -11,6 +11,22 @@ Source0: https://github.com/kkos/oniguruma/releases/download/v%{version}/onig-%{ # Don't know exactly why, however without Patch0 onig_new returns # NULL reg variable Patch0: oniguruma-5.9.2-onig_new-returns-NULL-reg.patch +# Patch from the upstream git +# https://github.com/kkos/oniguruma/issues/55 (CVE-2017-9226) +Patch104: 0004-fix-55-check-too-big-code-point-value-for-single-byt.patch +Patch105: 0005-fix-55-Byte-value-expressed-in-octal-must-be-smaller.patch +# https://github.com/kkos/oniguruma/issues/56 (CVE-2017-9225) +Patch113: 0013-fix-56-return-invalid-result-for-codepoint-0xFFFFFFF.patch +# https://github.com/kkos/oniguruma/issues/57 (CVE-2017-9224) +Patch114: 0014-fix-57-DATA_ENSURE-check-must-be-before-data-access.patch +# https://github.com/kkos/oniguruma/issues/58 (CVE-2017-9227) +Patch115: 0015-fix-58-access-to-invalid-address-by-reg-dmin-value.patch +# https://github.com/kkos/oniguruma/issues/59 (CVE-2017-9229) +Patch119: 0019-fix-59-access-to-invalid-address-by-reg-dmax-value.patch +# https://github.com/kkos/oniguruma/issues/60 (CVE-2017-9228) +Patch120: 0020-fix-60-invalid-state-CCS_VALUE-in-parse_char_class.patch +# https://github.com/kkos/oniguruma/commit/ddbf55698b5f7ffdfa737b0b8e0079af1fdd7cb1 +Patch121: 0104-re-fix-60-by-check-val_type.patch BuildRequires: ruby >= 1.8 #Requires: @@ -37,6 +53,15 @@ developing applications that use %{name}. ( cd src %patch0 -p1 -b .nullreg ) +%patch104 -p1 +%patch105 -p1 +%patch113 -p1 +%patch114 -p1 +%patch115 -p1 +%patch119 -p1 +%patch120 -p1 +%patch121 -p1 + %{__sed} -i.multilib -e 's|-L@libdir@||' onig-config.in for f in \ @@ -101,6 +126,13 @@ find $RPM_BUILD_ROOT -name '*.la' \ %{_libdir}/pkgconfig/%{name}.pc %changelog +* Fri Sep 15 2017 Mamoru TASAKA - 6.1.3-3 +- Additional fix for github#60 (CVE-2017-9228) + +* Tue May 30 2017 Mamoru TASAKA - 6.1.3-2 +- Backport patches from git trunk + - CVEs 2017-9226 CVE-2017-9225 CVE-2017-9224 CVE-2017-9227 CVE-2017-9229 CVE-2017-9228 + * Wed Dec 28 2016 Mamoru TASAKA - 6.1.3-1 - 6.1.3