Additional fix for github#60 (CVE-2017-9228)

CVEs 2017-9226 CVE-2017-9225 CVE-2017-9224 CVE-2017-9227 CVE-2017-9229 CVE-2017-9228

0004-fix-55-check-too-big-code-point-value-for-single-byt.patch

@@ -0,0 +1,27 @@
+From b4bf968ad52afe14e60a2dc8a95d3555c543353a Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Thu, 18 May 2017 17:05:27 +0900
+Subject: [PATCH 04/25] fix #55 : check too big code point value for single
+ byte value in next_state_val()
+
+---
+ src/regparse.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/regparse.c b/src/regparse.c
+index 11f9e34..665998e 100644
+--- a/src/regparse.c
++++ b/src/regparse.c
+@@ -4044,6 +4044,9 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v,
+   switch (*state) {
+   case CCS_VALUE:
+     if (*type == CCV_SB) {
++      if (*vs > 0xff)
++          return ONIGERR_INVALID_CODE_POINT_VALUE;
++
+       BITSET_SET_BIT(cc->bs, (int )(*vs));
+     }
+     else if (*type == CCV_CODE_POINT) {
+-- 
+2.13.0
+

0005-fix-55-Byte-value-expressed-in-octal-must-be-smaller.patch

@@ -0,0 +1,35 @@
+From f015fbdd95f76438cd86366467bb2b39870dd7c6 Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Fri, 19 May 2017 15:44:47 +0900
+Subject: [PATCH 05/25] fix #55 : Byte value expressed in octal must be smaller
+ than 256
+
+---
+ src/regparse.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/regparse.c b/src/regparse.c
+index 665998e..f7acc5f 100644
+--- a/src/regparse.c
++++ b/src/regparse.c
+@@ -3020,7 +3020,7 @@ fetch_token_in_cc(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
+         PUNFETCH;
+         prev = p;
+         num = scan_unsigned_octal_number(&p, end, 3, enc);
+-        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
++        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
+         if (p == prev) {  /* can't read nothing. */
+           num = 0; /* but, it's not error */
+         }
+@@ -3392,7 +3392,7 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
+       if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
+         prev = p;
+         num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
+-        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
++        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
+         if (p == prev) {  /* can't read nothing. */
+           num = 0; /* but, it's not error */
+         }
+-- 
+2.13.0
+

0013-fix-56-return-invalid-result-for-codepoint-0xFFFFFFF.patch

@@ -0,0 +1,40 @@
+From 166a6c3999bf06b4de0ab4ce6b088a468cc4029f Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Mon, 22 May 2017 18:09:39 +0900
+Subject: [PATCH 13/25] fix #56 : return invalid result for codepoint
+ 0xFFFFFFFF
+
+---
+ src/gperf_unfold_key_conv.py | 2 +-
+ src/unicode_unfold_key.c     | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/gperf_unfold_key_conv.py b/src/gperf_unfold_key_conv.py
+index dcd8587..34f9c2f 100755
+--- a/src/gperf_unfold_key_conv.py
++++ b/src/gperf_unfold_key_conv.py
+@@ -36,7 +36,7 @@ def parse_line(s):
+     if r != s: return r
+     r = re.sub(REG_GET_CODE, 'OnigCodePoint gcode = wordlist[key].code;', s)
+     if r != s: return r
+-    r = re.sub(REG_CODE_CHECK, 'if (code == gcode)', s)
++    r = re.sub(REG_CODE_CHECK, 'if (code == gcode && wordlist[key].index >= 0)', s)
+     if r != s: return r
+ 
+     return s
+diff --git a/src/unicode_unfold_key.c b/src/unicode_unfold_key.c
+index a5aff90..15302ca 100644
+--- a/src/unicode_unfold_key.c
++++ b/src/unicode_unfold_key.c
+@@ -2850,7 +2850,7 @@ unicode_unfold_key(OnigCodePoint code)
+         {
+           OnigCodePoint gcode = wordlist[key].code;
+ 
+-          if (code == gcode)
++          if (code == gcode && wordlist[key].index >= 0)
+             return &wordlist[key];
+         }
+     }
+-- 
+2.13.0
+

0014-fix-57-DATA_ENSURE-check-must-be-before-data-access.patch

@@ -0,0 +1,32 @@
+From 690313a061f7a4fa614ec5cc8368b4f2284e059b Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Tue, 23 May 2017 10:28:58 +0900
+Subject: [PATCH 14/25] fix #57 : DATA_ENSURE() check must be before data
+ access
+
+---
+ src/regexec.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/src/regexec.c b/src/regexec.c
+index 35fef11..d4e577d 100644
+--- a/src/regexec.c
++++ b/src/regexec.c
+@@ -1473,14 +1473,9 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
+       break;
+ 
+     case OP_EXACT1:  MOP_IN(OP_EXACT1);
+-#if 0
+       DATA_ENSURE(1);
+       if (*p != *s) goto fail;
+       p++; s++;
+-#endif
+-      if (*p != *s++) goto fail;
+-      DATA_ENSURE(0);
+-      p++;
+       MOP_OUT;
+       break;
+ 
+-- 
+2.13.0
+

0015-fix-58-access-to-invalid-address-by-reg-dmin-value.patch

@@ -0,0 +1,25 @@
+From 9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814 Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Tue, 23 May 2017 16:15:35 +0900
+Subject: [PATCH 15/25] fix #58 : access to invalid address by reg->dmin value
+
+---
+ src/regexec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/regexec.c b/src/regexec.c
+index d4e577d..2fa0f3d 100644
+--- a/src/regexec.c
++++ b/src/regexec.c
+@@ -3154,6 +3154,8 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
+     }
+     else {
+       UChar *q = p + reg->dmin;
++
++      if (q >= end) return 0; /* fail */
+       while (p < q) p += enclen(reg->enc, p);
+     }
+   }
+-- 
+2.13.0
+

0019-fix-59-access-to-invalid-address-by-reg-dmax-value.patch

@@ -0,0 +1,52 @@
+From b690371bbf97794b4a1d3f295d4fb9a8b05d402d Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Wed, 24 May 2017 10:27:04 +0900
+Subject: [PATCH 19/25] fix #59 : access to invalid address by reg->dmax value
+
+---
+ src/regexec.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/src/regexec.c b/src/regexec.c
+index 49bcc50..c0626ef 100644
+--- a/src/regexec.c
++++ b/src/regexec.c
+@@ -3235,18 +3235,25 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
+     }
+     else {
+       if (reg->dmax != ONIG_INFINITE_DISTANCE) {
+-        *low = p - reg->dmax;
+-        if (*low > s) {
+-          *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s,
+-                                          *low, (const UChar** )low_prev);
+-          if (low_prev && IS_NULL(*low_prev))
+-            *low_prev = onigenc_get_prev_char_head(reg->enc,
+-                                                   (pprev ? pprev : s), *low);
++        if (p - str < reg->dmax) {
++          *low = (UChar* )str;
++          if (low_prev)
++            *low_prev = onigenc_get_prev_char_head(reg->enc, str, *low);
+         }
+         else {
+-          if (low_prev)
+-            *low_prev = onigenc_get_prev_char_head(reg->enc,
+-                                                   (pprev ? pprev : str), *low);
++          *low = p - reg->dmax;
++          if (*low > s) {
++            *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s,
++                                                 *low, (const UChar** )low_prev);
++            if (low_prev && IS_NULL(*low_prev))
++              *low_prev = onigenc_get_prev_char_head(reg->enc,
++                                                     (pprev ? pprev : s), *low);
++          }
++          else {
++            if (low_prev)
++              *low_prev = onigenc_get_prev_char_head(reg->enc,
++                                                     (pprev ? pprev : str), *low);
++          }
+         }
+       }
+     }
+-- 
+2.13.0
+

0020-fix-60-invalid-state-CCS_VALUE-in-parse_char_class.patch

@@ -0,0 +1,28 @@
+From 3b63d12038c8d8fc278e81c942fa9bec7c704c8b Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Wed, 24 May 2017 13:43:25 +0900
+Subject: [PATCH 20/25] fix #60 : invalid state(CCS_VALUE) in
+ parse_char_class()
+
+---
+ src/regparse.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/regparse.c b/src/regparse.c
+index 69875fa..1988747 100644
+--- a/src/regparse.c
++++ b/src/regparse.c
+@@ -4081,7 +4081,9 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
+     }
+   }
+ 
+-  *state = CCS_VALUE;
++  if (*state != CCS_START)
++    *state = CCS_VALUE;
++
+   *type  = CCV_CLASS;
+   return 0;
+ }
+-- 
+2.13.0
+

0104-re-fix-60-by-check-val_type.patch

@@ -0,0 +1,40 @@
+From ddbf55698b5f7ffdfa737b0b8e0079af1fdd7cb1 Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Thu, 15 Jun 2017 15:48:46 +0900
+Subject: [PATCH 104/515] re-fix #60 by check val_type
+
+---
+ src/regparse.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/src/regparse.c b/src/regparse.c
+index a4e3d4a..4f4802d 100644
+--- a/src/regparse.c
++++ b/src/regparse.c
+@@ -4061,9 +4061,7 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
+     }
+   }
+ 
+-  if (*state != CCS_START)
+-    *state = CCS_VALUE;
+-
++  *state = CCS_VALUE;
+   *type  = CCV_CLASS;
+   return 0;
+ }
+@@ -4348,6 +4346,12 @@ parse_char_class(Node** np, OnigToken* tok, UChar** src, UChar* end,
+           CC_ESC_WARN(env, (UChar* )"-");
+           goto range_end_val;
+         }
++
++        if (val_type == CCV_CLASS) {
++          r = ONIGERR_UNMATCHED_RANGE_SPECIFIER_IN_CHAR_CLASS;
++          goto err;
++        }
++
+         state = CCS_RANGE;
+       }
+       else if (state == CCS_START) {
+-- 
+2.14.1
+

oniguruma.spec

@@ -1,6 +1,6 @@
 Name:		oniguruma
 Version:	6.1.3
-Release:	1%{?dist}
+Release:	3%{?dist}
 Summary:	Regular expressions library
 
 Group:		System Environment/Libraries
@@ -11,6 +11,22 @@ Source0:	https://github.com/kkos/oniguruma/releases/download/v%{version}/onig-%{
 # Don't know exactly why, however without Patch0 onig_new returns
 # NULL reg variable
 Patch0:		oniguruma-5.9.2-onig_new-returns-NULL-reg.patch
+# Patch from the upstream git
+# https://github.com/kkos/oniguruma/issues/55 (CVE-2017-9226)
+Patch104:		0004-fix-55-check-too-big-code-point-value-for-single-byt.patch
+Patch105:		0005-fix-55-Byte-value-expressed-in-octal-must-be-smaller.patch
+# https://github.com/kkos/oniguruma/issues/56 (CVE-2017-9225)
+Patch113:		0013-fix-56-return-invalid-result-for-codepoint-0xFFFFFFF.patch
+# https://github.com/kkos/oniguruma/issues/57 (CVE-2017-9224)
+Patch114:		0014-fix-57-DATA_ENSURE-check-must-be-before-data-access.patch
+# https://github.com/kkos/oniguruma/issues/58 (CVE-2017-9227)
+Patch115:		0015-fix-58-access-to-invalid-address-by-reg-dmin-value.patch
+# https://github.com/kkos/oniguruma/issues/59 (CVE-2017-9229)
+Patch119:		0019-fix-59-access-to-invalid-address-by-reg-dmax-value.patch
+# https://github.com/kkos/oniguruma/issues/60 (CVE-2017-9228)
+Patch120:		0020-fix-60-invalid-state-CCS_VALUE-in-parse_char_class.patch
+# https://github.com/kkos/oniguruma/commit/ddbf55698b5f7ffdfa737b0b8e0079af1fdd7cb1
+Patch121:		0104-re-fix-60-by-check-val_type.patch
 
 BuildRequires:	ruby >= 1.8
 #Requires:	
@@ -37,6 +53,15 @@ developing applications that use %{name}.
 ( cd src
 %patch0 -p1 -b .nullreg
 )
+%patch104 -p1
+%patch105 -p1
+%patch113 -p1
+%patch114 -p1
+%patch115 -p1
+%patch119 -p1
+%patch120 -p1
+%patch121 -p1
+
 %{__sed} -i.multilib -e 's|-L@libdir@||' onig-config.in
 
 for f in \
@@ -101,6 +126,13 @@ find $RPM_BUILD_ROOT -name '*.la' \
 %{_libdir}/pkgconfig/%{name}.pc	
 
 %changelog
+* Fri Sep 15 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.1.3-3
+- Additional fix for github#60 (CVE-2017-9228)
+
+* Tue May 30 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.1.3-2
+- Backport patches from git trunk
+  - CVEs 2017-9226 CVE-2017-9225 CVE-2017-9224 CVE-2017-9227 CVE-2017-9229 CVE-2017-9228
+
 * Wed Dec 28 2016 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.1.3-1
 - 6.1.3