From d73955489307338185501cc0bb227ef4d5bffedc Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 1 Oct 2020 16:27:28 +0900 Subject: [PATCH 1/2] Apply upstream fix for CVE-2020-26159 --- oniguruma-XXX-CVE-2020-26159.patch | 22 ++++++++++++++++++++++ oniguruma.spec | 9 ++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 oniguruma-XXX-CVE-2020-26159.patch diff --git a/oniguruma-XXX-CVE-2020-26159.patch b/oniguruma-XXX-CVE-2020-26159.patch new file mode 100644 index 0000000..71a8ada --- /dev/null +++ b/oniguruma-XXX-CVE-2020-26159.patch @@ -0,0 +1,22 @@ +From cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0 Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Mon, 21 Sep 2020 12:58:29 +0900 +Subject: [PATCH] #207: Out-of-bounds write + +--- + src/regcomp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/regcomp.c b/src/regcomp.c +index f6494b6d..a0a68561 100644 +--- a/src/regcomp.c ++++ b/src/regcomp.c +@@ -6257,7 +6257,7 @@ concat_opt_exact_str(OptStr* to, UChar* s, UChar* end, OnigEncoding enc) + + for (i = to->len, p = s; p < end && i < OPT_EXACT_MAXLEN; ) { + len = enclen(enc, p); +- if (i + len > OPT_EXACT_MAXLEN) break; ++ if (i + len >= OPT_EXACT_MAXLEN) break; + for (j = 0; j < len && p < end; j++) + to->s[i++] = *p++; + } diff --git a/oniguruma.spec b/oniguruma.spec index 5b90947..ca52355 100644 --- a/oniguruma.spec +++ b/oniguruma.spec @@ -3,7 +3,7 @@ %global mainver 6.9.4 #%%global betaver rc3 -%global fedorarel 1 +%global fedorarel 2 Name: oniguruma Version: %{mainver} @@ -13,6 +13,9 @@ Summary: Regular expressions library License: BSD URL: https://github.com/kkos/oniguruma/ Source0: https://github.com/kkos/oniguruma/releases/download/v%{mainver}%{?betaver:_%betaver}/onig-%{mainver}%{?betaver:-%betaver}.tar.gz +# https://github.com/kkos/oniguruma/commit/cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0 +# https://github.com/kkos/oniguruma/issues/207 +Patch1: oniguruma-XXX-CVE-2020-26159.patch BuildRequires: gcc @@ -35,6 +38,7 @@ developing applications that use %{name}. %prep %setup -q -n onig-%{mainver} %{__sed} -i.multilib -e 's|-L@libdir@||' onig-config.in +%patch1 -p1 -b .CVE-2020-26159 %if 0 for f in \ @@ -104,6 +108,9 @@ find $RPM_BUILD_ROOT -name '*.la' \ %{_libdir}/pkgconfig/%{name}.pc %changelog +* Thu Oct 1 2020 Mamoru TASAKA - 6.9.4-2 +- Apply upstream fix for CVE-2020-26159 + * Fri Nov 29 2019 Mamoru TASAKA - 6.9.4-1 - 6.9.4 final From 062c295e5dccde99b71f317d4a926bbfc6fded3b Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Tue, 20 Oct 2020 22:18:19 +0900 Subject: [PATCH 2/2] Revert the previous change, CVE-2020-26159 is marked as false https://github.com/kkos/oniguruma/issues/221 --- oniguruma-XXX-CVE-2020-26159.patch | 22 ---------------------- oniguruma.spec | 10 +++++----- 2 files changed, 5 insertions(+), 27 deletions(-) delete mode 100644 oniguruma-XXX-CVE-2020-26159.patch diff --git a/oniguruma-XXX-CVE-2020-26159.patch b/oniguruma-XXX-CVE-2020-26159.patch deleted file mode 100644 index 71a8ada..0000000 --- a/oniguruma-XXX-CVE-2020-26159.patch +++ /dev/null @@ -1,22 +0,0 @@ -From cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0 Mon Sep 17 00:00:00 2001 -From: "K.Kosako" -Date: Mon, 21 Sep 2020 12:58:29 +0900 -Subject: [PATCH] #207: Out-of-bounds write - ---- - src/regcomp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/regcomp.c b/src/regcomp.c -index f6494b6d..a0a68561 100644 ---- a/src/regcomp.c -+++ b/src/regcomp.c -@@ -6257,7 +6257,7 @@ concat_opt_exact_str(OptStr* to, UChar* s, UChar* end, OnigEncoding enc) - - for (i = to->len, p = s; p < end && i < OPT_EXACT_MAXLEN; ) { - len = enclen(enc, p); -- if (i + len > OPT_EXACT_MAXLEN) break; -+ if (i + len >= OPT_EXACT_MAXLEN) break; - for (j = 0; j < len && p < end; j++) - to->s[i++] = *p++; - } diff --git a/oniguruma.spec b/oniguruma.spec index ca52355..6506e81 100644 --- a/oniguruma.spec +++ b/oniguruma.spec @@ -3,7 +3,7 @@ %global mainver 6.9.4 #%%global betaver rc3 -%global fedorarel 2 +%global fedorarel 3 Name: oniguruma Version: %{mainver} @@ -13,9 +13,6 @@ Summary: Regular expressions library License: BSD URL: https://github.com/kkos/oniguruma/ Source0: https://github.com/kkos/oniguruma/releases/download/v%{mainver}%{?betaver:_%betaver}/onig-%{mainver}%{?betaver:-%betaver}.tar.gz -# https://github.com/kkos/oniguruma/commit/cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0 -# https://github.com/kkos/oniguruma/issues/207 -Patch1: oniguruma-XXX-CVE-2020-26159.patch BuildRequires: gcc @@ -38,7 +35,6 @@ developing applications that use %{name}. %prep %setup -q -n onig-%{mainver} %{__sed} -i.multilib -e 's|-L@libdir@||' onig-config.in -%patch1 -p1 -b .CVE-2020-26159 %if 0 for f in \ @@ -108,6 +104,10 @@ find $RPM_BUILD_ROOT -name '*.la' \ %{_libdir}/pkgconfig/%{name}.pc %changelog +* Tue Oct 20 2020 Mamoru TASAKA - 6.9.4-3 +- Revert the previous change, CVE-2020-26159 is marked as false + https://github.com/kkos/oniguruma/issues/221 + * Thu Oct 1 2020 Mamoru TASAKA - 6.9.4-2 - Apply upstream fix for CVE-2020-26159