From c7d07d7ce2cb0c22b0bd0232af76cf40691579c5 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Thu, 6 Sep 2018 14:02:58 +0200 Subject: [PATCH 001/116] Initial import (#1625276). --- .gitignore | 1 + radare2-disable-debugger-s390x.patch | 35 +++ radare2-reproducible-tags.patch | 37 +++ radare2.spec | 333 +++++++++++++++++++++++++++ sources | 1 + 5 files changed, 407 insertions(+) create mode 100644 .gitignore create mode 100644 radare2-disable-debugger-s390x.patch create mode 100644 radare2-reproducible-tags.patch create mode 100644 radare2.spec create mode 100644 sources diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..520a2b0 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/radare2-2.9.0.tar.gz diff --git a/radare2-disable-debugger-s390x.patch b/radare2-disable-debugger-s390x.patch new file mode 100644 index 0000000..3445bbe --- /dev/null +++ b/radare2-disable-debugger-s390x.patch @@ -0,0 +1,35 @@ +From b0448d9d033d0ec125abc7b97cbbd2b08f6579aa Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone +Date: Thu, 6 Sep 2018 13:42:48 +0200 +Subject: [PATCH] meson.build: disable debugger features on Linux/s390x + +Debugging is not supported on Linux/s390x and compilation there doesn't +work. This patch disables the debugging features completely, until +upstream will have proper support for Linux/s390x. +--- + meson.build | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/meson.build b/meson.build +index 355aa5dd3..dfdd77100 100644 +--- a/meson.build ++++ b/meson.build +@@ -237,12 +237,14 @@ else + message('Using bundled openssl code') + endif + ++has_debugger = not (host_machine.system() == 'linux' and host_machine.cpu_family() == 's390x') ++ + userconf = configuration_data() + userconf.set('HAVE_LIB_MAGIC', sys_magic.found().to_int()) + userconf.set('USE_LIB_MAGIC', use_syslib_magic.to_int()) + userconf.set('HAVE_LIB_XXHASH', sys_xxhash.found().to_int()) + userconf.set('USE_LIB_XXHASH', use_sys_xxhash.to_int()) +-userconf.set('DEBUGGER', 1) ++userconf.set('DEBUGGER', has_debugger.to_int()) + userconf.set('PREFIX', r2_prefix) + userconf.set('LIBDIR', r2_libdir) + userconf.set('INCLUDEDIR', r2_incdir) +-- +2.14.4 + diff --git a/radare2-reproducible-tags.patch b/radare2-reproducible-tags.patch new file mode 100644 index 0000000..5192857 --- /dev/null +++ b/radare2-reproducible-tags.patch @@ -0,0 +1,37 @@ +From 78792d4c8eb8fc7891563ffafbff17da484b7360 Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone +Date: Thu, 6 Sep 2018 09:31:48 +0200 +Subject: [PATCH] flag/d: explicitly name files, to ensure reproducibility + +--- + libr/flag/d/meson.build | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/libr/flag/d/meson.build b/libr/flag/d/meson.build +index ac94cc4c2..67df05f64 100644 +--- a/libr/flag/d/meson.build ++++ b/libr/flag/d/meson.build +@@ -1,11 +1,17 @@ +-files = run_command(glob_cmd + ['*']).stdout().strip().split(';') ++files = [ ++ 'alloc', ++ 'env', ++ 'fs', ++ 'network', ++ 'process', ++ 'stdout', ++ 'string' ++] + + script = '''#script + import os + from sys import argv + for fname in argv[1:]: +- if any(ex in fname for ex in ('meson.build', 'Makefile')): +- continue + with open(fname) as f: + text = ' '.join(f.read().splitlines()) + print('ft %s %s' % (os.path.basename(fname), text)) +-- +2.14.4 + diff --git a/radare2.spec b/radare2.spec new file mode 100644 index 0000000..71b1f68 --- /dev/null +++ b/radare2.spec @@ -0,0 +1,333 @@ +# by default it builds from the released version of radare2 +%bcond_without build_release + +Name: radare2 +Summary: The reverse engineering framework +Version: 2.9.0 +URL: https://radare.org/ +VCS: https://github.com/radare/radare2 + +%global gituser radare +%global gitname radare2 + +%global gitdate 20180904 +%global commit 00144a348c47802f203e5de9add609ea1b0808e4 +%global shortcommit %(c=%{commit}; echo ${c:0:7}) + +%global rel 1 + +%if %{with build_release} +Release: %{rel}%{?dist} +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz + +Patch1: radare2-disable-debugger-s390x.patch +Patch2: radare2-reproducible-tags.patch +%else +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz +%endif + +License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib +# Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ +# during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ +# some code has originally different license: +# libr/asm/arch/ - GPLv2+, MIT, GPLv3 +# libr/bin/format/pe/dotnet - Apache License Version 2.0 +# libr/hash/xxhash.c - 2 clause BSD +# libr/util/qrcode.c - MIT +# shlr/grub/grubfs.c - LGPL +# shlr/java - Apache 2.0 +# shlr/sdb/src - MIT +# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) +# shlr/spp - MIT +# shlr/squashfs/src - GPLv2+ +# shlr/tcc - LGPLv2+ +# shlr/udis86 - 2 clause BSD +# shlr/wind - LGPL v3+ +# shlr/spp - MIT +# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) +# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) + +# Removed from the final package because of the presence of minified JS and +# absence of the source JS - this should be packaged with radare2-webui +# shlr/www/m - Apache-2.0 +# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT +# shlr/www/enyo/vendors/jquery.layout-latest.min.js - GPL + MIT +# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT +# shlr/www/enyo/vendors/lodash.min.js - lodash license +# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 +# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 +# shlr/www/p/vendors/jquery* - GPL + MIT +# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD +# shlr/www/p/vendors/jquery.onoff.min.js - MIT + +%if %{!with build_release} +BuildRequires: sed +%endif + +BuildRequires: gcc +BuildRequires: meson +BuildRequires: ninja-build +BuildRequires: pkgconfig +BuildRequires: bzip2-devel +BuildRequires: file-devel +BuildRequires: libzip-devel +BuildRequires: zlib-devel +BuildRequires: lz4-devel +BuildRequires: capstone-devel >= 3.0.4 + +Requires: %{name}-common = %{version}-%{release} + +# Package contains several bundled libraries + +# ./shlr/zip/zlib/README +# compiled with -D use_sys_zip=true and -D use_sys_zlib=true instead + +# ./shlr/lz4/README.md +# compiled with -D use_sys_lz4=true instead + +# ./libr/magic/README +# compiled with -D use_sys_magic=true instead + +# ./shlr/capstone.sh +# compiled with -D use_sys_capstone=true instead + +# ./libr/hash/xxhash.* +# compiled with -D use_sys_xxhash=true instead + +# ./libr/hash/{md4,md5,sha1,sha2}.{c,h} +# compiled with -D use_sys_openssl=true instead + +# ./shlr/spp/README.md +# SPP stands for Simple Pre-Processor, a templating language. +# https://github.com/radare/spp +Provides: bundled(spp) = 1.0 + +# ./shlr/sdb/README.md +# sdb is a simple string key/value database based on djb's cdb +# https://github.com/radare/sdb +Provides: bundled(sdb) = 1.2.0 + +# ./shlr/sdb/src/json/README +# https://github.com/quartzjer/js0n +# JSON support for sdb +Provides: bundled(js0n) + +# libr/util/regex/README +# Modified OpenBSD regex to be portable +# cvs -qd anoncvs@anoncvs.ca.openbsd.org:/cvs get -P src/lib/libc/regex +# version from 2010/11/21 00:02:30, version of files ranges from v1.11 to v1.20 +Provides: bundled(openbsdregex) = 1.11 + +# ./shlr/tcc/README.md +# This is a stripped down version of tcc without the code generators and heavily modified. +Provides: bundled(tcc) = 0.9.26 + +# ./libr/asm/arch/tricore/README.md +# Based on code from https://www.hightec-rt.com/en/downloads/sources/14-sources-for-tricore-v3-3-7-9-binutils-1.html +# part of binutils to read machine code for Tricore architecture +# ./libr/asm/arch/ppc/gnu/ +# part of binutils to read machine code for ppc architecture +# ./libr/asm/arch/arm/gnu/ +Provides: bundled(binutils) = 2.13 + +# ./libr/asm/arch/avr/README +# * This code has been ripped from vavrdisasm 1.6 +Provides: bundled(vavrdisasm) = 1.6 + +# ./shlr/grub/* +# It is not clear which version has been copied +Provides: bundled(grub2) + + +%description +The radare2 is a reverse-engineering framework that is multi-architecture, +multi-platform, and highly scriptable. Radare2 provides a hexadecimal +editor, wrapped I/O, file system support, debugger support, diffing +between two functions or binaries, and code analysis at opcode, +basic block, and function levels. + + +%package devel +Summary: Development files for the radare2 package +Requires: %{name}%{?_isa} = %{version}-%{release} + +%description devel +Development files for the radare2 package. See radare2 package for more +information. + + +%package common +Summary: Arch-independent SDB files for the radare2 package +BuildArch: noarch +Requires: %{name} = %{version}-%{release} + +%description common +Arch-independent SDB files used by radare2 package. See radare2 package for more +information + + +%prep +%if %{with build_release} +# Build from git release version +%autosetup -p1 -n %{gitname}-%{version} +%else +# Build from git commit +%setup -q -n %{gitname}-%{commit} +# Rename internal "version-git" to "version" +sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr +%endif +# Removing some fortunes because inappropriate +rm doc/fortunes.{creepy,nsfw,fun} +# Removing zip/lzip and lz4 files because we use system dependencies +rm -rf shlr/zip shlr/lz4 + +# Webui contains pre-build and/or minimized versions of JS libraries without source code +# Consider installing the web-interface from https://github.com/radare/radare2-webui +rm -rf ./shlr/www/* +echo "The radare2 source usually comes with a pre-built version of the web-interface, but without the source code" > ./shlr/www/README.Fedora +echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora +echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora + + +%build +# Whereever possible use the system-wide libraries instead of bundles +%meson \ + -Duse_sys_capstone=true \ + -Duse_sys_magic=true \ + -Duse_sys_zip=true \ + -Duse_sys_zlib=true \ + -Duse_sys_lz4=true \ + -Duse_sys_xxhash=true \ + -Duse_sys_openssl=true +%meson_build + +%install +%meson_install +# removing r2pm because it is a package manager which could install packages +# system wide or in the user home directory +rm %{buildroot}/%{_bindir}/r2pm +# create r2 symlink because meson build does not create it (yet) +ln -s radare2 %{buildroot}/%{_bindir}/r2 + +%ldconfig_scriptlets + + +%check +# Do not run the testsuite yet - it pulls another package +# https://github.com/radare/radare2-regressions from github make tests + + + +%files +%doc AUTHORS.md CONTRIBUTING.md DEVELOPERS.md README.md +%doc doc/3D/ doc/node.js/ doc/pdb/ doc/sandbox/ +%doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md +%doc doc/esil.md doc/gdb.md doc/gprobe.md doc/intro.md doc/io.md doc/rap.md +%doc doc/siol.md doc/strings.md doc/windbg.md doc/yara.md +# Webui removed cuz of having minified js code and missing source code +%doc %{_datadir}/%{name}/%{version}/www/README.Fedora +%license COPYING COPYING.LESSER +%{_bindir}/r* +%{_libdir}/libr_*.so.2.9.* +%{_mandir}/man1/r*.1.* +%{_mandir}/man7/esil.7.* +%dir %{_datadir}/%{name} +%dir %{_datadir}/%{name}/%{version} +%dir %{_datadir}/%{name}/%{version}/www + + +%files devel +%{_includedir}/libr +%{_libdir}/libr*.so +%{_libdir}/pkgconfig/*.pc + + +%files common +%{_datadir}/%{name}/%{version}/cons +%{_datadir}/%{name}/%{version}/fcnsign +%{_datadir}/%{name}/%{version}/flag +%{_datadir}/%{name}/%{version}/format +%{_datadir}/%{name}/%{version}/hud +%{_datadir}/%{name}/%{version}/magic +%{_datadir}/%{name}/%{version}/opcodes +%{_datadir}/%{name}/%{version}/syscall +%{_datadir}/doc/%{name}/fortunes.* +%dir %{_datadir}/%{name} +%dir %{_datadir}/doc/%{name} + + +%changelog +* Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 +- use system xxhash and openssl +- bump to 2.9.0 release +- use bcond_without to choose between release build or git one +- add gcc as BuildRequires +- do not directly call ldconfig but use RPM macros +- add patch to compile on s390x architecture (disable debugger because there is no support) +- add patch to make tags.r2 file generation reproducible +- make common subpackage do not depend on arch of main package + +* Fri Aug 3 2018 Riccardo Schirone 2.8.0-0.2.20180718git51e2936 +- add grub2 and xxhash Provides +- add some license comments +- move SDB files in -common subpackage + +* Mon Jul 16 2018 Riccardo Schirone 2.8.0-0.1.20180718git51e2936 +- bump to 2.8.0 version and switch to meson + +* Fri Apr 13 2018 Michal Ambroz 2.5.0-1 +- bump to 2.5.0 release + +* Sun Feb 11 2018 Michal Ambroz 2.4.0-1 +- bump to 2.4.0 release + +* Mon Feb 05 2018 Michal Ambroz 2.3.0-1 +- bump to 2.3.0 release +- drop the web-interface for now + +* Tue Nov 14 2017 Michal Ambroz 2.0.1-1 +- bump to 2.0.1 release + +* Fri Aug 04 2017 Michal Ambroz 1.6.0-1 +- bump to 1.6.0 release + +* Thu Jun 08 2017 Michal Ambroz 1.5.0-1 +- bump to 1.5.0 release + +* Sun Apr 23 2017 Michal Ambroz 1.4.0-1 +- bump to 1.4.0 release + +* Sat Mar 18 2017 Michal Ambroz 1.3.0-1 +- bump to 1.3.0 release + +* Sat Feb 18 2017 Michal Ambroz 1.3.0-0.1.gita37af19 +- switch to git version fixing sigseg in radiff2 + +* Wed Feb 08 2017 Michal Ambroz 1.2.1-1 +- bump to 1.2.1 +- removed deprecated post postun calling of /sbin/ldconfig + +* Sat Oct 22 2016 Michal Ambroz 0.10.6-1 +- bump to 0.10.6 + +* Sun Aug 21 2016 Michal Ambroz 0.10.5-1 +- bump to 0.10.5 + +* Mon Aug 01 2016 Michal Ambroz 0.10.4-1 +- bump to 0.10.4 + +* Sun Jun 05 2016 Michal Ambroz 0.10.3-1 +- build for Fedora for release of 0.10.3 + +* Mon Apr 25 2016 Michal Ambroz 0.10.2-1 +- build for Fedora for release of 0.10.2 + +* Thu Jan 21 2016 Michal Ambroz 0.10.0-2 +- build for Fedora for release of 0.10.0 + +* Sat Oct 10 2015 Michal Ambroz 0.10.0-1 +- build for Fedora for alpha of 0.10.0 + +* Sun Nov 09 2014 Pavel Odvody 0.9.8rc3-0 +- initial radare2 package diff --git a/sources b/sources new file mode 100644 index 0000000..89d7146 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (radare2-2.9.0.tar.gz) = 8365edd54d0a8030955b566f750ae4c3b5db26550fa3035f7d543d6f2a9b31760a38df30dfd839f7c9ab938e7f032997d9a3198a16f44c54c71c58c39a2cfc8c From d6386af87aa750688e814279fb6af8c4496f1437 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 10:02:48 +0200 Subject: [PATCH 002/116] add 3.0.0 sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 520a2b0..371838e 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /radare2-2.9.0.tar.gz +/radare2-3.0.0.tar.gz diff --git a/sources b/sources index 89d7146..b291df0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-2.9.0.tar.gz) = 8365edd54d0a8030955b566f750ae4c3b5db26550fa3035f7d543d6f2a9b31760a38df30dfd839f7c9ab938e7f032997d9a3198a16f44c54c71c58c39a2cfc8c +SHA512 (radare2-3.0.0.tar.gz) = 5ca698123ccad80c54c483f7e2cc678dabfc9c1c172670ff9e1d11512174c9ecc15e81dfdb5de846b42c951cafe23d29ceca6f3824504a2f3dac722c659bb2d4 From e0aa58e4a2b8029554e65916dddafaa276ab4097 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 10:03:04 +0200 Subject: [PATCH 003/116] update spec file and patch for 3.0.0 --- radare2-disable-debugger-s390x.patch | 19 +++++++++-------- radare2.spec | 31 +++++++++++++++++++--------- 2 files changed, 31 insertions(+), 19 deletions(-) diff --git a/radare2-disable-debugger-s390x.patch b/radare2-disable-debugger-s390x.patch index 3445bbe..357f036 100644 --- a/radare2-disable-debugger-s390x.patch +++ b/radare2-disable-debugger-s390x.patch @@ -1,26 +1,27 @@ -From b0448d9d033d0ec125abc7b97cbbd2b08f6579aa Mon Sep 17 00:00:00 2001 +From 260433915cbaa515a900d49e5b2498cde7620fb2 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone -Date: Thu, 6 Sep 2018 13:42:48 +0200 +Date: Tue, 16 Oct 2018 09:48:31 +0200 Subject: [PATCH] meson.build: disable debugger features on Linux/s390x -Debugging is not supported on Linux/s390x and compilation there doesn't -work. This patch disables the debugging features completely, until -upstream will have proper support for Linux/s390x. +Debugging is not supported on Linux/s390x and compilation there doesn't work. +This patch disables the debugging features completely, until upstream will have +proper support for Linux/s390x. --- meson.build | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/meson.build b/meson.build -index 355aa5dd3..dfdd77100 100644 +index 5af7d29ec..459e6722f 100644 --- a/meson.build +++ b/meson.build -@@ -237,12 +237,14 @@ else - message('Using bundled openssl code') - endif +@@ -265,13 +265,15 @@ use_ptrace_wrap = ['linux'].contains(host_machine.system()) + message('HAVE_PTRACE: @0@'.format(have_ptrace)) + message('USE_PTRACE_WRAP: @0@'.format(use_ptrace_wrap)) +has_debugger = not (host_machine.system() == 'linux' and host_machine.cpu_family() == 's390x') + userconf = configuration_data() + userconf.set('R_CHECKS_LEVEL', get_option('checks_level')) userconf.set('HAVE_LIB_MAGIC', sys_magic.found().to_int()) userconf.set('USE_LIB_MAGIC', use_syslib_magic.to_int()) userconf.set('HAVE_LIB_XXHASH', sys_xxhash.found().to_int()) diff --git a/radare2.spec b/radare2.spec index 71b1f68..8b1b260 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 2.9.0 +Version: 3.0.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -21,7 +21,6 @@ Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-disable-debugger-s390x.patch -Patch2: radare2-reproducible-tags.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz @@ -47,6 +46,7 @@ License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and z # shlr/spp - MIT # shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) # shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) +# shlr/ptrace-wrap - LGPL v3+ # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -68,13 +68,14 @@ BuildRequires: sed BuildRequires: gcc BuildRequires: meson BuildRequires: ninja-build -BuildRequires: pkgconfig -BuildRequires: bzip2-devel BuildRequires: file-devel -BuildRequires: libzip-devel -BuildRequires: zlib-devel -BuildRequires: lz4-devel -BuildRequires: capstone-devel >= 3.0.4 +BuildRequires: pkgconfig +BuildRequires: pkgconfig(bzip2) +BuildRequires: pkgconfig(libzip) +BuildRequires: pkgconfig(zlib) +BuildRequires: pkgconfig(liblz4) +BuildRequires: pkgconfig(capstone) >= 3.0.4 +BuildRequires: pkgconfig(libuv) Requires: %{name}-common = %{version}-%{release} @@ -139,6 +140,10 @@ Provides: bundled(vavrdisasm) = 1.6 # It is not clear which version has been copied Provides: bundled(grub2) +# ./shlr/ptrace-wrap +# https://github.com/thestr4ng3r/ptrace-wrap +Provides: bundled(ptrace-wrap) + %description The radare2 is a reverse-engineering framework that is multi-architecture, @@ -181,6 +186,9 @@ sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr rm doc/fortunes.{creepy,nsfw,fun} # Removing zip/lzip and lz4 files because we use system dependencies rm -rf shlr/zip shlr/lz4 +# Removing unused man pages +rm man/r2pm.1 +rm man/r2-docker.1 # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui @@ -199,7 +207,8 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA -Duse_sys_zlib=true \ -Duse_sys_lz4=true \ -Duse_sys_xxhash=true \ - -Duse_sys_openssl=true + -Duse_sys_openssl=true \ + -Duse_libuv=true %meson_build %install @@ -229,7 +238,7 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %doc %{_datadir}/%{name}/%{version}/www/README.Fedora %license COPYING COPYING.LESSER %{_bindir}/r* -%{_libdir}/libr_*.so.2.9.* +%{_libdir}/libr_*.so.3.0.* %{_mandir}/man1/r*.1.* %{_mandir}/man7/esil.7.* %dir %{_datadir}/%{name} @@ -258,6 +267,8 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %changelog +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 +- rebase to upstream version 3.0.0 * Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 - use system xxhash and openssl - bump to 2.9.0 release From 31fbeec99fd704fdafd46b868c07ebbd77d47eb5 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 10:52:13 +0200 Subject: [PATCH 004/116] fix compilation on s390x and ppc64, because of void * dereferencing --- radare2-fix-sys-breakpoint.patch | 25 +++++++++++++++++++++ radare2-reproducible-tags.patch | 37 -------------------------------- radare2.spec | 1 + 3 files changed, 26 insertions(+), 37 deletions(-) create mode 100644 radare2-fix-sys-breakpoint.patch delete mode 100644 radare2-reproducible-tags.patch diff --git a/radare2-fix-sys-breakpoint.patch b/radare2-fix-sys-breakpoint.patch new file mode 100644 index 0000000..e942e0c --- /dev/null +++ b/radare2-fix-sys-breakpoint.patch @@ -0,0 +1,25 @@ +From f81e5622d163b173ca2bb3e8998debf9be0fb0c0 Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone +Date: Tue, 16 Oct 2018 10:31:02 +0200 +Subject: [PATCH] r_util: use char * instead of void * + +--- + libr/include/r_util/r_sys.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libr/include/r_util/r_sys.h b/libr/include/r_util/r_sys.h +index 924ce3015..861604e04 100644 +--- a/libr/include/r_util/r_sys.h ++++ b/libr/include/r_util/r_sys.h +@@ -98,7 +98,7 @@ R_API bool r_sys_tts(const char *txt, bool bg); + #define r_sys_breakpoint() __asm__ volatile ("bkpt $0"); + #else + #warning r_sys_breakpoint not implemented for this platform +-#define r_sys_breakpoint() { void *a = NULL; *a = 0; } ++#define r_sys_breakpoint() { char *a = NULL; *a = 0; } + #endif + #endif + +-- +2.14.4 + diff --git a/radare2-reproducible-tags.patch b/radare2-reproducible-tags.patch deleted file mode 100644 index 5192857..0000000 --- a/radare2-reproducible-tags.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 78792d4c8eb8fc7891563ffafbff17da484b7360 Mon Sep 17 00:00:00 2001 -From: Riccardo Schirone -Date: Thu, 6 Sep 2018 09:31:48 +0200 -Subject: [PATCH] flag/d: explicitly name files, to ensure reproducibility - ---- - libr/flag/d/meson.build | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - -diff --git a/libr/flag/d/meson.build b/libr/flag/d/meson.build -index ac94cc4c2..67df05f64 100644 ---- a/libr/flag/d/meson.build -+++ b/libr/flag/d/meson.build -@@ -1,11 +1,17 @@ --files = run_command(glob_cmd + ['*']).stdout().strip().split(';') -+files = [ -+ 'alloc', -+ 'env', -+ 'fs', -+ 'network', -+ 'process', -+ 'stdout', -+ 'string' -+] - - script = '''#script - import os - from sys import argv - for fname in argv[1:]: -- if any(ex in fname for ex in ('meson.build', 'Makefile')): -- continue - with open(fname) as f: - text = ' '.join(f.read().splitlines()) - print('ft %s %s' % (os.path.basename(fname), text)) --- -2.14.4 - diff --git a/radare2.spec b/radare2.spec index 8b1b260..4ad49f7 100644 --- a/radare2.spec +++ b/radare2.spec @@ -21,6 +21,7 @@ Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-disable-debugger-s390x.patch +Patch2: radare2-fix-sys-breakpoint.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz From 2412dcc1c7e7ecb846d4ea98122e27518e1a5cc8 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 11:05:15 +0200 Subject: [PATCH 005/116] update rel to make koji happy --- radare2.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 4ad49f7..99eab4c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 00144a348c47802f203e5de9add609ea1b0808e4 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist} @@ -268,6 +268,8 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %changelog +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 +- fixes for r_sys_breakpoint on ppc64 and s390x architectures * Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 - rebase to upstream version 3.0.0 * Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 From c4ad53e0335c83017766addcca47b05f3908ed0b Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 11:09:17 +0200 Subject: [PATCH 006/116] add package.cfg file to configure koji --- package.cfg | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package.cfg diff --git a/package.cfg b/package.cfg new file mode 100644 index 0000000..6b189b9 --- /dev/null +++ b/package.cfg @@ -0,0 +1,2 @@ +[koji] +targets = master fedora From f1e6a8aae56d6ed46e21468bedd22e8045c55a60 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 11:10:32 +0200 Subject: [PATCH 007/116] radare2.spec: no need for increment in rel --- radare2.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/radare2.spec b/radare2.spec index 99eab4c..feee5ee 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 00144a348c47802f203e5de9add609ea1b0808e4 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist} @@ -268,10 +268,9 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %changelog -* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 -- fixes for r_sys_breakpoint on ppc64 and s390x architectures * Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 - rebase to upstream version 3.0.0 +- fixes for r_sys_breakpoint on ppc64 and s390x architectures * Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 - use system xxhash and openssl - bump to 2.9.0 release From a39c539e5f6c7c3a50bed8ca0068fecfa97714be Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 21:28:38 +0200 Subject: [PATCH 008/116] radare2.spec: delete share/radare2 dir when removing packages --- radare2.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/radare2.spec b/radare2.spec index feee5ee..ee44b63 100644 --- a/radare2.spec +++ b/radare2.spec @@ -235,16 +235,11 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md %doc doc/esil.md doc/gdb.md doc/gprobe.md doc/intro.md doc/io.md doc/rap.md %doc doc/siol.md doc/strings.md doc/windbg.md doc/yara.md -# Webui removed cuz of having minified js code and missing source code -%doc %{_datadir}/%{name}/%{version}/www/README.Fedora %license COPYING COPYING.LESSER %{_bindir}/r* %{_libdir}/libr_*.so.3.0.* %{_mandir}/man1/r*.1.* %{_mandir}/man7/esil.7.* -%dir %{_datadir}/%{name} -%dir %{_datadir}/%{name}/%{version} -%dir %{_datadir}/%{name}/%{version}/www %files devel @@ -265,6 +260,11 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %{_datadir}/doc/%{name}/fortunes.* %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} +%dir %{_datadir}/%{name} +%dir %{_datadir}/%{name}/%{version} +%dir %{_datadir}/%{name}/%{version}/www +# Webui removed cuz of having minified js code and missing source code +%doc %{_datadir}/%{name}/%{version}/www/README.Fedora %changelog From 3931b9dc5421a4d3d572fe5f91104c67dd16d92e Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 16 Oct 2018 21:30:18 +0200 Subject: [PATCH 009/116] increase release number --- radare2.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index ee44b63..6dc257b 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 00144a348c47802f203e5de9add609ea1b0808e4 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist} @@ -268,6 +268,8 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %changelog +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 +- fix datadir dir ownership * Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 - rebase to upstream version 3.0.0 - fixes for r_sys_breakpoint on ppc64 and s390x architectures From 4a0f86304a74452c3da9c55cf3042ca140400405 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Wed, 24 Oct 2018 12:03:32 +0200 Subject: [PATCH 010/116] rebase to 3.0.1 --- radare2-fix-sys-breakpoint.patch | 25 ------------------------- radare2.spec | 6 ++++-- 2 files changed, 4 insertions(+), 27 deletions(-) delete mode 100644 radare2-fix-sys-breakpoint.patch diff --git a/radare2-fix-sys-breakpoint.patch b/radare2-fix-sys-breakpoint.patch deleted file mode 100644 index e942e0c..0000000 --- a/radare2-fix-sys-breakpoint.patch +++ /dev/null @@ -1,25 +0,0 @@ -From f81e5622d163b173ca2bb3e8998debf9be0fb0c0 Mon Sep 17 00:00:00 2001 -From: Riccardo Schirone -Date: Tue, 16 Oct 2018 10:31:02 +0200 -Subject: [PATCH] r_util: use char * instead of void * - ---- - libr/include/r_util/r_sys.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libr/include/r_util/r_sys.h b/libr/include/r_util/r_sys.h -index 924ce3015..861604e04 100644 ---- a/libr/include/r_util/r_sys.h -+++ b/libr/include/r_util/r_sys.h -@@ -98,7 +98,7 @@ R_API bool r_sys_tts(const char *txt, bool bg); - #define r_sys_breakpoint() __asm__ volatile ("bkpt $0"); - #else - #warning r_sys_breakpoint not implemented for this platform --#define r_sys_breakpoint() { void *a = NULL; *a = 0; } -+#define r_sys_breakpoint() { char *a = NULL; *a = 0; } - #endif - #endif - --- -2.14.4 - diff --git a/radare2.spec b/radare2.spec index 6dc257b..ffc08a4 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.0.0 +Version: 3.0.1 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -21,7 +21,6 @@ Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-disable-debugger-s390x.patch -Patch2: radare2-fix-sys-breakpoint.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz @@ -268,6 +267,9 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %changelog +* Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 +- rebase to upstream version 3.0.1 which includes some minor fixes and fixes + for ppc64 and s390x architectures * Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 - fix datadir dir ownership * Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 From e986467cd820cbff3210890f7634512298307a09 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Wed, 24 Oct 2018 12:09:06 +0200 Subject: [PATCH 011/116] add tar.gz for 3.0.1 --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 371838e..00e0c29 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /radare2-2.9.0.tar.gz /radare2-3.0.0.tar.gz +/radare2-3.0.1.tar.gz diff --git a/sources b/sources index b291df0..a34044d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.0.0.tar.gz) = 5ca698123ccad80c54c483f7e2cc678dabfc9c1c172670ff9e1d11512174c9ecc15e81dfdb5de846b42c951cafe23d29ceca6f3824504a2f3dac722c659bb2d4 +SHA512 (radare2-3.0.1.tar.gz) = 755cbbf968179d987b1bd11469ef356e9e5b9968983f45a3276e0001c877d13b3b12b71a29dd954e8111c5196284c0e49f26bd79f5b5e037dd4dd27b1f73e380 From 24e6b1cc2f7823a6058818f7a1393e26d91f5982 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 26 Nov 2018 09:36:44 +0100 Subject: [PATCH 012/116] update do 3.1.0 --- radare2-disable-debugger-s390x.patch | 23 ++++++++++++----------- package.cfg => radare2.cfg | 0 radare2.spec | 14 ++++++++------ 3 files changed, 20 insertions(+), 17 deletions(-) rename package.cfg => radare2.cfg (100%) diff --git a/radare2-disable-debugger-s390x.patch b/radare2-disable-debugger-s390x.patch index 357f036..e2d6416 100644 --- a/radare2-disable-debugger-s390x.patch +++ b/radare2-disable-debugger-s390x.patch @@ -1,28 +1,29 @@ -From 260433915cbaa515a900d49e5b2498cde7620fb2 Mon Sep 17 00:00:00 2001 +From 6aa7254eb6d7ed834210771978385017dbbca61c Mon Sep 17 00:00:00 2001 From: Riccardo Schirone -Date: Tue, 16 Oct 2018 09:48:31 +0200 +Date: Mon, 26 Nov 2018 08:26:20 +0100 Subject: [PATCH] meson.build: disable debugger features on Linux/s390x -Debugging is not supported on Linux/s390x and compilation there doesn't work. -This patch disables the debugging features completely, until upstream will have -proper support for Linux/s390x. +Debugging is not supported on Linux/s390x and compilation there doesn't +work. This patch disables the debugging features completely, until +upstream will have proper support for Linux/s390x. --- meson.build | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/meson.build b/meson.build -index 5af7d29ec..459e6722f 100644 +index b88782fd2..986559f60 100644 --- a/meson.build +++ b/meson.build -@@ -265,13 +265,15 @@ use_ptrace_wrap = ['linux'].contains(host_machine.system()) +@@ -265,6 +265,8 @@ use_ptrace_wrap = ['linux'].contains(host_machine.system()) message('HAVE_PTRACE: @0@'.format(have_ptrace)) message('USE_PTRACE_WRAP: @0@'.format(use_ptrace_wrap)) +has_debugger = not (host_machine.system() == 'linux' and host_machine.cpu_family() == 's390x') + - userconf = configuration_data() - userconf.set('R_CHECKS_LEVEL', get_option('checks_level')) - userconf.set('HAVE_LIB_MAGIC', sys_magic.found().to_int()) + checks_level = get_option('checks_level') + if checks_level == 9999 + if get_option('buildtype') == 'release' +@@ -282,7 +284,7 @@ userconf.set('HAVE_LIB_MAGIC', sys_magic.found().to_int()) userconf.set('USE_LIB_MAGIC', use_syslib_magic.to_int()) userconf.set('HAVE_LIB_XXHASH', sys_xxhash.found().to_int()) userconf.set('USE_LIB_XXHASH', use_sys_xxhash.to_int()) @@ -32,5 +33,5 @@ index 5af7d29ec..459e6722f 100644 userconf.set('LIBDIR', r2_libdir) userconf.set('INCLUDEDIR', r2_incdir) -- -2.14.4 +2.19.1 diff --git a/package.cfg b/radare2.cfg similarity index 100% rename from package.cfg rename to radare2.cfg diff --git a/radare2.spec b/radare2.spec index ffc08a4..11b7938 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.0.1 +Version: 3.1.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 00144a348c47802f203e5de9add609ea1b0808e4 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist} @@ -107,7 +107,7 @@ Provides: bundled(spp) = 1.0 # ./shlr/sdb/README.md # sdb is a simple string key/value database based on djb's cdb # https://github.com/radare/sdb -Provides: bundled(sdb) = 1.2.0 +Provides: bundled(sdb) = 1.3.0 # ./shlr/sdb/src/json/README # https://github.com/quartzjer/js0n @@ -193,7 +193,7 @@ rm man/r2-docker.1 # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui rm -rf ./shlr/www/* -echo "The radare2 source usually comes with a pre-built version of the web-interface, but without the source code" > ./shlr/www/README.Fedora +echo "The radare2 source usually comes with a pre-built version of the web-interface, but without the source code." > ./shlr/www/README.Fedora echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora @@ -236,7 +236,7 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %doc doc/siol.md doc/strings.md doc/windbg.md doc/yara.md %license COPYING COPYING.LESSER %{_bindir}/r* -%{_libdir}/libr_*.so.3.0.* +%{_libdir}/libr_*.so.3.1.* %{_mandir}/man1/r*.1.* %{_mandir}/man7/esil.7.* @@ -259,7 +259,6 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %{_datadir}/doc/%{name}/fortunes.* %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} -%dir %{_datadir}/%{name} %dir %{_datadir}/%{name}/%{version} %dir %{_datadir}/%{name}/%{version}/www # Webui removed cuz of having minified js code and missing source code @@ -267,6 +266,9 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %changelog +* Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 +- rebase to upstream version 3.1.0 +- remove duplicated /usr/share/radare2 dir in %files * Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 - rebase to upstream version 3.0.1 which includes some minor fixes and fixes for ppc64 and s390x architectures From 692d38120e2adeb26a0cac2df3f0d3b29287ea34 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 26 Nov 2018 09:51:01 +0100 Subject: [PATCH 013/116] update sources file --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 00e0c29..17940cc 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /radare2-2.9.0.tar.gz /radare2-3.0.0.tar.gz /radare2-3.0.1.tar.gz +/radare2-3.1.0.tar.gz diff --git a/sources b/sources index a34044d..1caf7b4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.0.1.tar.gz) = 755cbbf968179d987b1bd11469ef356e9e5b9968983f45a3276e0001c877d13b3b12b71a29dd954e8111c5196284c0e49f26bd79f5b5e037dd4dd27b1f73e380 +SHA512 (radare2-3.1.0.tar.gz) = ee31de49ff83ca1ed093eaf113201cb3709adcb3315671d88413aa4d5c80c37cf9e981c33b4f472b9aa5f67309cdaf9577c2085a8c58e4faf86b37d1ee19866d From 77008db3f439a52a4bf6eda95c96bb2959baede8 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 26 Nov 2018 11:38:04 +0100 Subject: [PATCH 014/116] Fix radare2-disable-debugger-s390x patch Do not enable ptrace nor ptrace-wrapper if the debugger is not enabled. --- radare2-disable-debugger-s390x.patch | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/radare2-disable-debugger-s390x.patch b/radare2-disable-debugger-s390x.patch index e2d6416..efd31dd 100644 --- a/radare2-disable-debugger-s390x.patch +++ b/radare2-disable-debugger-s390x.patch @@ -1,29 +1,31 @@ -From 6aa7254eb6d7ed834210771978385017dbbca61c Mon Sep 17 00:00:00 2001 +From 4fffaf0c423bf5f1d80389eab6975c6a602e0107 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone -Date: Mon, 26 Nov 2018 08:26:20 +0100 +Date: Mon, 26 Nov 2018 11:36:11 +0100 Subject: [PATCH] meson.build: disable debugger features on Linux/s390x Debugging is not supported on Linux/s390x and compilation there doesn't work. This patch disables the debugging features completely, until upstream will have proper support for Linux/s390x. --- - meson.build | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) + meson.build | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/meson.build b/meson.build -index b88782fd2..986559f60 100644 +index b88782fd2..0be8f18f1 100644 --- a/meson.build +++ b/meson.build -@@ -265,6 +265,8 @@ use_ptrace_wrap = ['linux'].contains(host_machine.system()) +@@ -262,6 +262,10 @@ endif + have_ptrace = not ['windows', 'cygwin', 'sunos'].contains(host_machine.system()) + use_ptrace_wrap = ['linux'].contains(host_machine.system()) + ++has_debugger = not (host_machine.system() == 'linux' and host_machine.cpu_family() == 's390x') ++have_ptrace = have_ptrace and has_debugger ++use_ptrace_wrap = use_ptrace_wrap and has_debugger ++ message('HAVE_PTRACE: @0@'.format(have_ptrace)) message('USE_PTRACE_WRAP: @0@'.format(use_ptrace_wrap)) -+has_debugger = not (host_machine.system() == 'linux' and host_machine.cpu_family() == 's390x') -+ - checks_level = get_option('checks_level') - if checks_level == 9999 - if get_option('buildtype') == 'release' -@@ -282,7 +284,7 @@ userconf.set('HAVE_LIB_MAGIC', sys_magic.found().to_int()) +@@ -282,7 +286,7 @@ userconf.set('HAVE_LIB_MAGIC', sys_magic.found().to_int()) userconf.set('USE_LIB_MAGIC', use_syslib_magic.to_int()) userconf.set('HAVE_LIB_XXHASH', sys_xxhash.found().to_int()) userconf.set('USE_LIB_XXHASH', use_sys_xxhash.to_int()) From a9296120f6f484d67a47783cbb81846b17455d69 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 26 Nov 2018 14:48:25 +0100 Subject: [PATCH 015/116] Guard io_ptrace with DEBUGGER macro too --- radare2-io_ptrace-no-debugger.patch | 26 ++++++++++++++++++++++++++ radare2.spec | 1 + 2 files changed, 27 insertions(+) create mode 100644 radare2-io_ptrace-no-debugger.patch diff --git a/radare2-io_ptrace-no-debugger.patch b/radare2-io_ptrace-no-debugger.patch new file mode 100644 index 0000000..6a59a51 --- /dev/null +++ b/radare2-io_ptrace-no-debugger.patch @@ -0,0 +1,26 @@ +From a9e98df117fe9f8901783eaa5b408ab1edb4c5b1 Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone +Date: Mon, 26 Nov 2018 13:57:33 +0100 +Subject: [PATCH] io_ptrace: do not include io_ptrace if DEBUGGER is not + defined + +--- + libr/io/p/io_ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libr/io/p/io_ptrace.c b/libr/io/p/io_ptrace.c +index 245687cf9..435d5d5df 100644 +--- a/libr/io/p/io_ptrace.c ++++ b/libr/io/p/io_ptrace.c +@@ -7,7 +7,7 @@ + #include + #include + +-#if __linux__ || __BSD__ ++#if DEBUGGER && (__linux__ || __BSD__) + + #include + #include +-- +2.19.1 + diff --git a/radare2.spec b/radare2.spec index 11b7938..a755047 100644 --- a/radare2.spec +++ b/radare2.spec @@ -21,6 +21,7 @@ Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-disable-debugger-s390x.patch +Patch2: radare2-io_ptrace-no-debugger.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz From aea164d836b1b94e03a36dd161b9b0d23b44560b Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 8 Jan 2019 16:57:05 +0100 Subject: [PATCH 016/116] update to 3.2.0 Fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 Resolve bz#1663999 --- radare2-disable-debugger-s390x.patch | 39 ---------------------------- radare2-io_ptrace-no-debugger.patch | 26 ------------------- radare2.spec | 37 +++++++++++++++----------- 3 files changed, 22 insertions(+), 80 deletions(-) delete mode 100644 radare2-disable-debugger-s390x.patch delete mode 100644 radare2-io_ptrace-no-debugger.patch diff --git a/radare2-disable-debugger-s390x.patch b/radare2-disable-debugger-s390x.patch deleted file mode 100644 index efd31dd..0000000 --- a/radare2-disable-debugger-s390x.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 4fffaf0c423bf5f1d80389eab6975c6a602e0107 Mon Sep 17 00:00:00 2001 -From: Riccardo Schirone -Date: Mon, 26 Nov 2018 11:36:11 +0100 -Subject: [PATCH] meson.build: disable debugger features on Linux/s390x - -Debugging is not supported on Linux/s390x and compilation there doesn't -work. This patch disables the debugging features completely, until -upstream will have proper support for Linux/s390x. ---- - meson.build | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/meson.build b/meson.build -index b88782fd2..0be8f18f1 100644 ---- a/meson.build -+++ b/meson.build -@@ -262,6 +262,10 @@ endif - have_ptrace = not ['windows', 'cygwin', 'sunos'].contains(host_machine.system()) - use_ptrace_wrap = ['linux'].contains(host_machine.system()) - -+has_debugger = not (host_machine.system() == 'linux' and host_machine.cpu_family() == 's390x') -+have_ptrace = have_ptrace and has_debugger -+use_ptrace_wrap = use_ptrace_wrap and has_debugger -+ - message('HAVE_PTRACE: @0@'.format(have_ptrace)) - message('USE_PTRACE_WRAP: @0@'.format(use_ptrace_wrap)) - -@@ -282,7 +286,7 @@ userconf.set('HAVE_LIB_MAGIC', sys_magic.found().to_int()) - userconf.set('USE_LIB_MAGIC', use_syslib_magic.to_int()) - userconf.set('HAVE_LIB_XXHASH', sys_xxhash.found().to_int()) - userconf.set('USE_LIB_XXHASH', use_sys_xxhash.to_int()) --userconf.set('DEBUGGER', 1) -+userconf.set('DEBUGGER', has_debugger.to_int()) - userconf.set('PREFIX', r2_prefix) - userconf.set('LIBDIR', r2_libdir) - userconf.set('INCLUDEDIR', r2_incdir) --- -2.19.1 - diff --git a/radare2-io_ptrace-no-debugger.patch b/radare2-io_ptrace-no-debugger.patch deleted file mode 100644 index 6a59a51..0000000 --- a/radare2-io_ptrace-no-debugger.patch +++ /dev/null @@ -1,26 +0,0 @@ -From a9e98df117fe9f8901783eaa5b408ab1edb4c5b1 Mon Sep 17 00:00:00 2001 -From: Riccardo Schirone -Date: Mon, 26 Nov 2018 13:57:33 +0100 -Subject: [PATCH] io_ptrace: do not include io_ptrace if DEBUGGER is not - defined - ---- - libr/io/p/io_ptrace.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libr/io/p/io_ptrace.c b/libr/io/p/io_ptrace.c -index 245687cf9..435d5d5df 100644 ---- a/libr/io/p/io_ptrace.c -+++ b/libr/io/p/io_ptrace.c -@@ -7,7 +7,7 @@ - #include - #include - --#if __linux__ || __BSD__ -+#if DEBUGGER && (__linux__ || __BSD__) - - #include - #include --- -2.19.1 - diff --git a/radare2.spec b/radare2.spec index a755047..c948df6 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.1.0 +Version: 3.2.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -20,8 +20,6 @@ VCS: https://github.com/radare/radare2 Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz -Patch1: radare2-disable-debugger-s390x.patch -Patch2: radare2-io_ptrace-no-debugger.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz @@ -183,13 +181,8 @@ information # Rename internal "version-git" to "version" sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif -# Removing some fortunes because inappropriate -rm doc/fortunes.{creepy,nsfw,fun} # Removing zip/lzip and lz4 files because we use system dependencies rm -rf shlr/zip shlr/lz4 -# Removing unused man pages -rm man/r2pm.1 -rm man/r2-docker.1 # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui @@ -202,14 +195,17 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA %build # Whereever possible use the system-wide libraries instead of bundles %meson \ - -Duse_sys_capstone=true \ -Duse_sys_magic=true \ -Duse_sys_zip=true \ -Duse_sys_zlib=true \ -Duse_sys_lz4=true \ -Duse_sys_xxhash=true \ -Duse_sys_openssl=true \ - -Duse_libuv=true + -Duse_libuv=true \ +%ifarch s390x + -Ddebugger=false \ +%endif + -Duse_sys_capstone=true %meson_build %install @@ -219,6 +215,11 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA rm %{buildroot}/%{_bindir}/r2pm # create r2 symlink because meson build does not create it (yet) ln -s radare2 %{buildroot}/%{_bindir}/r2 +# install README.Fedora for the www part +mkdir -p %{buildroot}/%{_datadir}/%{name}/%{version}/www +cp ./shlr/www/README.Fedora %{buildroot}/%{_datadir}/%{name}/%{version}/www/README.Fedora +# remove unneeded fortunes +rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %ldconfig_scriptlets @@ -235,11 +236,16 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md %doc doc/esil.md doc/gdb.md doc/gprobe.md doc/intro.md doc/io.md doc/rap.md %doc doc/siol.md doc/strings.md doc/windbg.md doc/yara.md +%doc doc/fortunes.tips +%dir %{_datadir}/%{name}/%{version}/www +# Webui removed cuz of having minified js code and missing source code +%doc %{_datadir}/%{name}/%{version}/www/README.Fedora %license COPYING COPYING.LESSER %{_bindir}/r* -%{_libdir}/libr_*.so.3.1.* +%{_libdir}/libr_*.so.3.2.* %{_mandir}/man1/r*.1.* %{_mandir}/man7/esil.7.* +%{_datadir}/zsh/vendor-completions/_r* %files devel @@ -257,16 +263,17 @@ ln -s radare2 %{buildroot}/%{_bindir}/r2 %{_datadir}/%{name}/%{version}/magic %{_datadir}/%{name}/%{version}/opcodes %{_datadir}/%{name}/%{version}/syscall -%{_datadir}/doc/%{name}/fortunes.* %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} -%dir %{_datadir}/%{name}/%{version}/www -# Webui removed cuz of having minified js code and missing source code -%doc %{_datadir}/%{name}/%{version}/www/README.Fedora %changelog +* Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 +- rebase to upstream version 3.2.0 +- remove patch to disable debugger on s390x and use build option +- move doc files to common package +- fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 * Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 - rebase to upstream version 3.1.0 - remove duplicated /usr/share/radare2 dir in %files From 110029ecac0e2bd752e7f59b21572b99cfa93aca Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 8 Jan 2019 17:00:23 +0100 Subject: [PATCH 017/116] add 3.2.0 tarball to lookaside cache --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 17940cc..529e0cb 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /radare2-3.0.0.tar.gz /radare2-3.0.1.tar.gz /radare2-3.1.0.tar.gz +/radare2-3.2.0.tar.gz diff --git a/sources b/sources index 1caf7b4..cb4400e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.1.0.tar.gz) = ee31de49ff83ca1ed093eaf113201cb3709adcb3315671d88413aa4d5c80c37cf9e981c33b4f472b9aa5f67309cdaf9577c2085a8c58e4faf86b37d1ee19866d +SHA512 (radare2-3.2.0.tar.gz) = 9773068568cf71797b0c86837188604130ef9d63e7b7fd115820d8979dde37d259aaea45002c9984e8c3599e9bade53720d3bb1b3635bdad5a2dc73aff54f048 From 6ce70a4dbb88486005eaeac15dc3a7805b3014b2 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Wed, 9 Jan 2019 15:37:39 +0100 Subject: [PATCH 018/116] patch meson.build to use python36 on epel --- radare2-epel-use-python36.patch | 12 ++++++++++++ radare2-for-loops.patch | 14 ++++++++++++++ radare2.spec | 17 ++++++++++++++--- 3 files changed, 40 insertions(+), 3 deletions(-) create mode 100644 radare2-epel-use-python36.patch create mode 100644 radare2-for-loops.patch diff --git a/radare2-epel-use-python36.patch b/radare2-epel-use-python36.patch new file mode 100644 index 0000000..657660f --- /dev/null +++ b/radare2-epel-use-python36.patch @@ -0,0 +1,12 @@ +diff -up radare2-3.2.0/libr/asm/p/asm_arm_gnu.c.orig radare2-3.2.0/libr/asm/p/asm_arm_gnu.c +diff -up radare2-3.2.0/meson.build.orig radare2-3.2.0/meson.build +--- radare2-3.2.0/meson.build.orig 2019-01-09 16:46:04.897149233 +0100 ++++ radare2-3.2.0/meson.build 2019-01-09 16:46:32.199021773 +0100 +@@ -1,6 +1,6 @@ + project('radare2', 'c', license: 'LGPL3', meson_version: '>=0.47.0') + +-py3_exe = import('python').find_installation('python3') ++py3_exe = import('python').find_installation('python36') + git_exe = find_program('git', required: false) + pkgconfig_mod = import('pkgconfig') + diff --git a/radare2-for-loops.patch b/radare2-for-loops.patch new file mode 100644 index 0000000..f1f9092 --- /dev/null +++ b/radare2-for-loops.patch @@ -0,0 +1,14 @@ +diff -up radare2-3.2.0/libr/asm/p/asm_arm_gnu.c.orig radare2-3.2.0/libr/asm/p/asm_arm_gnu.c +--- radare2-3.2.0/libr/asm/p/asm_arm_gnu.c.orig 2019-01-09 16:46:21.673070915 +0100 ++++ radare2-3.2.0/libr/asm/p/asm_arm_gnu.c 2019-01-09 16:47:07.929854934 +0100 +@@ -154,7 +154,8 @@ cpucode = 66471; + int cpucode = 0; + if (a->cpu) { + cpucode = atoi (a->cpu); +- for (int i = 0; i < (sizeof(arm_cpucodes) / sizeof(arm_cpucodes[0])); i++) { ++ int i; ++ for (i = 0; i < (sizeof(arm_cpucodes) / sizeof(arm_cpucodes[0])); i++) { + if (!strcmp (arm_cpucodes[i].name, a->cpu)) { + cpucode = arm_cpucodes[i].cpucode; + break; + diff --git a/radare2.spec b/radare2.spec index c948df6..f6773d0 100644 --- a/radare2.spec +++ b/radare2.spec @@ -20,6 +20,8 @@ VCS: https://github.com/radare/radare2 Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Patch1: radare2-epel-use-python36.patch +Patch2: radare2-for-loops.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz @@ -69,7 +71,13 @@ BuildRequires: meson BuildRequires: ninja-build BuildRequires: file-devel BuildRequires: pkgconfig + +%if 0%{?epel} +BuildRequires: bzip2-devel +BuildRequires: python36 +%else BuildRequires: pkgconfig(bzip2) +%endif BuildRequires: pkgconfig(libzip) BuildRequires: pkgconfig(zlib) BuildRequires: pkgconfig(liblz4) @@ -174,7 +182,11 @@ information %prep %if %{with build_release} # Build from git release version -%autosetup -p1 -n %{gitname}-%{version} +%setup -n %{gitname}-%{version} +%if 0%{?epel} +%patch1 -p1 +%endif +%patch2 -p1 %else # Build from git commit %setup -q -n %{gitname}-%{commit} @@ -191,7 +203,6 @@ echo "The radare2 source usually comes with a pre-built version of the web-inter echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora - %build # Whereever possible use the system-wide libraries instead of bundles %meson \ @@ -236,7 +247,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md %doc doc/esil.md doc/gdb.md doc/gprobe.md doc/intro.md doc/io.md doc/rap.md %doc doc/siol.md doc/strings.md doc/windbg.md doc/yara.md -%doc doc/fortunes.tips +%doc %{_datadir}/doc/%{name}/fortunes.tips %dir %{_datadir}/%{name}/%{version}/www # Webui removed cuz of having minified js code and missing source code %doc %{_datadir}/%{name}/%{version}/www/README.Fedora From 7c4ba9668912548e0ecbe28dbe7f0345d6d055af Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Thu, 10 Jan 2019 09:55:01 +0100 Subject: [PATCH 019/116] Update to 3.2.0-2 and fix library versions --- radare2-gittap-release.patch | 15 +++++++++++++++ radare2.spec | 6 +++++- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 radare2-gittap-release.patch diff --git a/radare2-gittap-release.patch b/radare2-gittap-release.patch new file mode 100644 index 0000000..31ecd74 --- /dev/null +++ b/radare2-gittap-release.patch @@ -0,0 +1,15 @@ +diff -up radare2-3.2.0/meson.build.orig radare2-3.2.0/meson.build +--- radare2-3.2.0/meson.build.orig 2019-01-10 09:38:46.353532035 +0100 ++++ radare2-3.2.0/meson.build 2019-01-10 09:39:18.732366400 +0100 +@@ -59,6 +59,11 @@ endif + if get_option('r2_gittap') != '' + gittap = get_option('r2_gittap') + endif ++# gittap is used for the version of each r_ library ++# in case it has not been set (e.g. a release tarball) set it ++if gittap == '' ++ gittap = r2_version ++endif + + if get_option('r2_gittip') != '' + gittip = get_option('r2_gittip') diff --git a/radare2.spec b/radare2.spec index f6773d0..82717be 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 00144a348c47802f203e5de9add609ea1b0808e4 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist} @@ -22,6 +22,7 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar. Patch1: radare2-epel-use-python36.patch Patch2: radare2-for-loops.patch +Patch3: radare2-gittap-release.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz @@ -187,6 +188,7 @@ information %patch1 -p1 %endif %patch2 -p1 +%patch3 -p1 %else # Build from git commit %setup -q -n %{gitname}-%{commit} @@ -280,6 +282,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 +- fix version reported by radare2 -V * Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 - rebase to upstream version 3.2.0 - remove patch to disable debugger on s390x and use build option From c469b8319a449e4c8b8299003c1f58e418c5c3f9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 2 Feb 2019 10:59:07 +0000 Subject: [PATCH 020/116] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 82717be..b82dfd5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -17,14 +17,14 @@ VCS: https://github.com/radare/radare2 %global rel 2 %if %{with build_release} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-epel-use-python36.patch Patch2: radare2-for-loops.patch Patch3: radare2-gittap-release.patch %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz %endif @@ -282,6 +282,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 - fix version reported by radare2 -V * Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 From 66ccabc76a343b778c71a135baa148f946d4661b Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 19 Feb 2019 13:49:04 +0100 Subject: [PATCH 021/116] Rebase to 3.3.0 --- radare2-for-loops.patch | 14 -------------- radare2-gittap-release.patch | 15 --------------- radare2.spec | 16 ++++++---------- 3 files changed, 6 insertions(+), 39 deletions(-) delete mode 100644 radare2-for-loops.patch delete mode 100644 radare2-gittap-release.patch diff --git a/radare2-for-loops.patch b/radare2-for-loops.patch deleted file mode 100644 index f1f9092..0000000 --- a/radare2-for-loops.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff -up radare2-3.2.0/libr/asm/p/asm_arm_gnu.c.orig radare2-3.2.0/libr/asm/p/asm_arm_gnu.c ---- radare2-3.2.0/libr/asm/p/asm_arm_gnu.c.orig 2019-01-09 16:46:21.673070915 +0100 -+++ radare2-3.2.0/libr/asm/p/asm_arm_gnu.c 2019-01-09 16:47:07.929854934 +0100 -@@ -154,7 +154,8 @@ cpucode = 66471; - int cpucode = 0; - if (a->cpu) { - cpucode = atoi (a->cpu); -- for (int i = 0; i < (sizeof(arm_cpucodes) / sizeof(arm_cpucodes[0])); i++) { -+ int i; -+ for (i = 0; i < (sizeof(arm_cpucodes) / sizeof(arm_cpucodes[0])); i++) { - if (!strcmp (arm_cpucodes[i].name, a->cpu)) { - cpucode = arm_cpucodes[i].cpucode; - break; - diff --git a/radare2-gittap-release.patch b/radare2-gittap-release.patch deleted file mode 100644 index 31ecd74..0000000 --- a/radare2-gittap-release.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -up radare2-3.2.0/meson.build.orig radare2-3.2.0/meson.build ---- radare2-3.2.0/meson.build.orig 2019-01-10 09:38:46.353532035 +0100 -+++ radare2-3.2.0/meson.build 2019-01-10 09:39:18.732366400 +0100 -@@ -59,6 +59,11 @@ endif - if get_option('r2_gittap') != '' - gittap = get_option('r2_gittap') - endif -+# gittap is used for the version of each r_ library -+# in case it has not been set (e.g. a release tarball) set it -+if gittap == '' -+ gittap = r2_version -+endif - - if get_option('r2_gittip') != '' - gittip = get_option('r2_gittip') diff --git a/radare2.spec b/radare2.spec index b82dfd5..a4f1120 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,29 +3,27 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.2.0 +Version: 3.3.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 %global gituser radare %global gitname radare2 -%global gitdate 20180904 -%global commit 00144a348c47802f203e5de9add609ea1b0808e4 +%global gitdate 20190219 +%global commit 365d3e9f37696aba9a8f6e1109e91854eff6db42 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-epel-use-python36.patch -Patch2: radare2-for-loops.patch -Patch3: radare2-gittap-release.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-%{shortcommit}.tar.gz +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib @@ -187,8 +185,6 @@ information %if 0%{?epel} %patch1 -p1 %endif -%patch2 -p1 -%patch3 -p1 %else # Build from git commit %setup -q -n %{gitname}-%{commit} @@ -255,7 +251,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %doc %{_datadir}/%{name}/%{version}/www/README.Fedora %license COPYING COPYING.LESSER %{_bindir}/r* -%{_libdir}/libr_*.so.3.2.* +%{_libdir}/libr_*.so.%{version}* %{_mandir}/man1/r*.1.* %{_mandir}/man7/esil.7.* %{_datadir}/zsh/vendor-completions/_r* From b1c45309c0296cd78c8166bd0ba3f9a19dfde6cc Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 19 Feb 2019 13:51:40 +0100 Subject: [PATCH 022/116] Update sources for 3.3.0 --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 529e0cb..59e5e60 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /radare2-3.0.1.tar.gz /radare2-3.1.0.tar.gz /radare2-3.2.0.tar.gz +/radare2-3.3.0.tar.gz diff --git a/sources b/sources index cb4400e..504dd14 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.2.0.tar.gz) = 9773068568cf71797b0c86837188604130ef9d63e7b7fd115820d8979dde37d259aaea45002c9984e8c3599e9bade53720d3bb1b3635bdad5a2dc73aff54f048 +SHA512 (radare2-3.3.0.tar.gz) = 4db9d547b72b952babfd67c8cef2b94fdac9d6fd1194fb50b2ebab538d5bbda0bab4b704d5af64ef684ce9311634c8e04465906a1e7e706b211427054fe0721a From bc40f1412d30dbb44a62e0dc6518648c1ae74ad0 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 19 Feb 2019 14:34:13 +0100 Subject: [PATCH 023/116] Add changelog entry --- radare2.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/radare2.spec b/radare2.spec index a4f1120..590f07c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -278,6 +278,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-1 +- rebase to upstream version 3.3.0 * Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 3f1c8a3afdc2108e26e7f4ff214da5b3de79e744 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 19 Feb 2019 14:34:57 +0100 Subject: [PATCH 024/116] Increase release to 3.3.0-2 --- radare2.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 590f07c..fe10d42 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 365d3e9f37696aba9a8f6e1109e91854eff6db42 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist}.1 @@ -278,7 +278,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog -* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-1 +* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 - rebase to upstream version 3.3.0 * Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 881f9588298f07cc182129f11dcc2302d6e731de Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 8 Apr 2019 09:06:18 +0200 Subject: [PATCH 025/116] Rebase to upstream version 3.4.1 --- radare2.spec | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/radare2.spec b/radare2.spec index fe10d42..219d5cd 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,18 +3,18 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.3.0 +Version: 3.4.1 URL: https://radare.org/ VCS: https://github.com/radare/radare2 %global gituser radare %global gitname radare2 -%global gitdate 20190219 -%global commit 365d3e9f37696aba9a8f6e1109e91854eff6db42 +%global gitdate 20190401 +%global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist}.1 @@ -278,6 +278,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 +- rebase to upstream version 3.4.1 * Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 - rebase to upstream version 3.3.0 * Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 From 4d9e190ea498ebed7caed05f342000b5e17d2056 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 8 Apr 2019 09:07:31 +0200 Subject: [PATCH 026/116] Add 3.4.1 source tarball --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 59e5e60..303c35d 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /radare2-3.1.0.tar.gz /radare2-3.2.0.tar.gz /radare2-3.3.0.tar.gz +/radare2-3.4.1.tar.gz diff --git a/sources b/sources index 504dd14..66e1b20 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.3.0.tar.gz) = 4db9d547b72b952babfd67c8cef2b94fdac9d6fd1194fb50b2ebab538d5bbda0bab4b704d5af64ef684ce9311634c8e04465906a1e7e706b211427054fe0721a +SHA512 (radare2-3.4.1.tar.gz) = 8803d54a8158aedd5900792bd013dad440a14abbb6fcbdf963e5d9031f30e66865479f29877e6f656ab01b59b3138458daf52f1eaeb462ec767c128d0b12640a From 6acbec6a0135e80790244f83284ab56ed4bc3fe2 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Tue, 16 Apr 2019 12:19:17 -0700 Subject: [PATCH 027/116] Rebuild with Meson fix for #1699099 --- radare2.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/radare2.spec b/radare2.spec index 219d5cd..ebf7d6e 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,15 +14,15 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-epel-use-python36.patch %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -278,6 +278,10 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Tue Apr 16 2019 Adam Williamson - 3.4.1-2 +- Rebuild with Meson fix for #1699099 +- Fix versioning + * Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 - rebase to upstream version 3.4.1 * Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 From 9a8f2a5bd9001843e1faf539ba3f0fb373dd6708 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Wed, 26 Jun 2019 15:39:21 +0200 Subject: [PATCH 028/116] Rebase to upstream version 3.6.0 --- .gitignore | 1 + radare2.spec | 10 ++++++---- sources | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 303c35d..8524ccb 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /radare2-3.2.0.tar.gz /radare2-3.3.0.tar.gz /radare2-3.4.1.tar.gz +/radare2-3.6.0.tar.gz diff --git a/radare2.spec b/radare2.spec index ebf7d6e..8cf9935 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.4.1 +Version: 3.6.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist} @@ -113,7 +113,7 @@ Provides: bundled(spp) = 1.0 # ./shlr/sdb/README.md # sdb is a simple string key/value database based on djb's cdb # https://github.com/radare/sdb -Provides: bundled(sdb) = 1.3.0 +Provides: bundled(sdb) = 1.4.0 # ./shlr/sdb/src/json/README # https://github.com/quartzjer/js0n @@ -254,7 +254,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %{_libdir}/libr_*.so.%{version}* %{_mandir}/man1/r*.1.* %{_mandir}/man7/esil.7.* -%{_datadir}/zsh/vendor-completions/_r* +%{_datadir}/zsh/site-functions/_r* %files devel @@ -278,6 +278,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Wed Jun 26 2019 Riccardo Schirone - 3.6.0 +- rebase to upstream version 3.6.0 * Tue Apr 16 2019 Adam Williamson - 3.4.1-2 - Rebuild with Meson fix for #1699099 - Fix versioning diff --git a/sources b/sources index 66e1b20..81c1fce 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.4.1.tar.gz) = 8803d54a8158aedd5900792bd013dad440a14abbb6fcbdf963e5d9031f30e66865479f29877e6f656ab01b59b3138458daf52f1eaeb462ec767c128d0b12640a +SHA512 (radare2-3.6.0.tar.gz) = 15c02b744892934bd0b4beeb146d8a0289244405214b62892d7e307cd42f6706aca16c1e02b6b2beb5b6869c5c5920cc291ffec8a690b5338c6973a5e1d7900e From 5cf42383c44d8f2a44fc1ff6ef677be0745339dd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jul 2019 18:08:18 +0000 Subject: [PATCH 029/116] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 8cf9935..8475bc0 100644 --- a/radare2.spec +++ b/radare2.spec @@ -17,12 +17,12 @@ VCS: https://github.com/radare/radare2 %global rel 1 %if %{with build_release} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: radare2-epel-use-python36.patch %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -278,6 +278,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Wed Jun 26 2019 Riccardo Schirone - 3.6.0 - rebase to upstream version 3.6.0 * Tue Apr 16 2019 Adam Williamson - 3.4.1-2 From 2adfdd47f534fa80fdd29135ba53cf27eec482f8 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Tue, 1 Oct 2019 00:19:10 +0200 Subject: [PATCH 030/116] Update to radare2-3.9.0 --- .gitignore | 1 + radare2.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 8524ccb..d8ba5d1 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /radare2-3.3.0.tar.gz /radare2-3.4.1.tar.gz /radare2-3.6.0.tar.gz +/radare2-3.9.0.tar.gz diff --git a/radare2.spec b/radare2.spec index 8475bc0..a425022 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.6.0 +Version: 3.9.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -113,7 +113,7 @@ Provides: bundled(spp) = 1.0 # ./shlr/sdb/README.md # sdb is a simple string key/value database based on djb's cdb # https://github.com/radare/sdb -Provides: bundled(sdb) = 1.4.0 +Provides: bundled(sdb) = 1.4.1 # ./shlr/sdb/src/json/README # https://github.com/quartzjer/js0n @@ -278,6 +278,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 +- rebase to upstream version 3.9.0 + * Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 81c1fce..b82ca30 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.6.0.tar.gz) = 15c02b744892934bd0b4beeb146d8a0289244405214b62892d7e307cd42f6706aca16c1e02b6b2beb5b6869c5c5920cc291ffec8a690b5338c6973a5e1d7900e +SHA512 (radare2-3.9.0.tar.gz) = 7198c6fb35778d93fdbba5dd3dceddb7af21d555fb42f22752c8898ccba44fdcba92a6c502ddc8bdda71b883df392168ece807325b53cf75537b4ec59d86e42a From 0b4a75d49d4e8a306e4ddcbe0e7d9882b8c87d43 Mon Sep 17 00:00:00 2001 From: Ivan Mironov Date: Fri, 4 Oct 2019 22:27:27 +0500 Subject: [PATCH 031/116] Add missing BuildRequires and Requires Before adding BuildRequires: $ grep "#define HAVE_LIB" /usr/include/libr/r_userconf.h #define HAVE_LIB_MAGIC 1 #define HAVE_LIB_XXHASH 0 #define HAVE_LIB_SSL 0 #define HAVE_LIBUV 1 After adding BuildRequires: $ grep "#define HAVE_LIB" /usr/include/libr/r_userconf.h #define HAVE_LIB_MAGIC 1 #define HAVE_LIB_XXHASH 1 #define HAVE_LIB_SSL 1 #define HAVE_LIBUV 1 Also adding file-devel and openssl-devel as Requires for -devel package because headers from these dependencies are directly included in headers inside -devel package. --- radare2.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index a425022..7781f34 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist}.1 @@ -69,6 +69,7 @@ BuildRequires: gcc BuildRequires: meson BuildRequires: ninja-build BuildRequires: file-devel +BuildRequires: xxhash-devel BuildRequires: pkgconfig %if 0%{?epel} @@ -82,6 +83,7 @@ BuildRequires: pkgconfig(zlib) BuildRequires: pkgconfig(liblz4) BuildRequires: pkgconfig(capstone) >= 3.0.4 BuildRequires: pkgconfig(libuv) +BuildRequires: pkgconfig(openssl) Requires: %{name}-common = %{version}-%{release} @@ -162,6 +164,8 @@ basic block, and function levels. %package devel Summary: Development files for the radare2 package Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: file-devel +Requires: openssl-devel %description devel Development files for the radare2 package. See radare2 package for more @@ -278,6 +282,10 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 +- Add missing BuildRequires: xxhash-devel, openssl-devel +- Add missing Requires for -devel package: file-devel, openssl-devel + * Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 - rebase to upstream version 3.9.0 From 12772e3c2e67fc5a5fc3a4f5f7c16313f3af7194 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Wed, 9 Oct 2019 10:13:22 +0200 Subject: [PATCH 032/116] Just use python3 instead of python36 in epel --- radare2-epel-use-python36.patch | 12 ------------ radare2.spec | 12 +++++------- 2 files changed, 5 insertions(+), 19 deletions(-) delete mode 100644 radare2-epel-use-python36.patch diff --git a/radare2-epel-use-python36.patch b/radare2-epel-use-python36.patch deleted file mode 100644 index 657660f..0000000 --- a/radare2-epel-use-python36.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up radare2-3.2.0/libr/asm/p/asm_arm_gnu.c.orig radare2-3.2.0/libr/asm/p/asm_arm_gnu.c -diff -up radare2-3.2.0/meson.build.orig radare2-3.2.0/meson.build ---- radare2-3.2.0/meson.build.orig 2019-01-09 16:46:04.897149233 +0100 -+++ radare2-3.2.0/meson.build 2019-01-09 16:46:32.199021773 +0100 -@@ -1,6 +1,6 @@ - project('radare2', 'c', license: 'LGPL3', meson_version: '>=0.47.0') - --py3_exe = import('python').find_installation('python3') -+py3_exe = import('python').find_installation('python36') - git_exe = find_program('git', required: false) - pkgconfig_mod = import('pkgconfig') - diff --git a/radare2.spec b/radare2.spec index 7781f34..ac0759a 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,13 +14,11 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 3 %if %{with build_release} Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz - -Patch1: radare2-epel-use-python36.patch %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip @@ -74,7 +72,7 @@ BuildRequires: pkgconfig %if 0%{?epel} BuildRequires: bzip2-devel -BuildRequires: python36 +BuildRequires: python3 %else BuildRequires: pkgconfig(bzip2) %endif @@ -186,9 +184,6 @@ information %if %{with build_release} # Build from git release version %setup -n %{gitname}-%{version} -%if 0%{?epel} -%patch1 -p1 -%endif %else # Build from git commit %setup -q -n %{gitname}-%{commit} @@ -282,6 +277,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 +- Fix epel7 build + * Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 - Add missing BuildRequires: xxhash-devel, openssl-devel - Add missing Requires for -devel package: file-devel, openssl-devel From 727719267a24e681078587e1f855929dd4c2611a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 30 Jan 2020 17:13:19 +0000 Subject: [PATCH 033/116] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index ac0759a..5681f0d 100644 --- a/radare2.spec +++ b/radare2.spec @@ -17,10 +17,10 @@ VCS: https://github.com/radare/radare2 %global rel 3 %if %{with build_release} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist}.2 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.2 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -277,6 +277,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 - Fix epel7 build From 05906c756ec7c870e18ddd01b2eb8a1abe9eada4 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 3 Feb 2020 17:24:49 +0100 Subject: [PATCH 034/116] Rebase to 4.2.1 --- .gitignore | 1 + radare2.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d8ba5d1..bcd005e 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /radare2-3.4.1.tar.gz /radare2-3.6.0.tar.gz /radare2-3.9.0.tar.gz +/radare2-4.2.1.tar.gz diff --git a/radare2.spec b/radare2.spec index 5681f0d..e5c2bfe 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 3.9.0 +Version: 4.2.1 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 3 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist}.2 @@ -277,6 +277,11 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1.1 +- Rebase to upstream version 4.2.1 +- Fix CVE-2019-19647 +- Fix CVE-2019-19590 + * Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index b82ca30..1575c24 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-3.9.0.tar.gz) = 7198c6fb35778d93fdbba5dd3dceddb7af21d555fb42f22752c8898ccba44fdcba92a6c502ddc8bdda71b883df392168ece807325b53cf75537b4ec59d86e42a +SHA512 (radare2-4.2.1.tar.gz) = aed37f6ff7ae3a25e809e8fbab3ef1c370dba80b7b8ef440a025edfbda23314ce20990b3e89589fe6bee427b2beebabd67a9e1def603e53ca5078bf32bdc4e6c From 7f2be390b94c961af06ce8f7cecc0401aa82dc14 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 3 Feb 2020 21:26:16 +0100 Subject: [PATCH 035/116] Remove number from version --- radare2.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/radare2.spec b/radare2.spec index e5c2bfe..b39f567 100644 --- a/radare2.spec +++ b/radare2.spec @@ -17,10 +17,10 @@ VCS: https://github.com/radare/radare2 %global rel 1 %if %{with build_release} -Release: %{rel}%{?dist}.2 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.2 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -277,7 +277,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog -* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1.1 +* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 - Rebase to upstream version 4.2.1 - Fix CVE-2019-19647 - Fix CVE-2019-19590 From fb29646ad3474f3385d68effeeee0d894ff30b6c Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 4 May 2020 16:48:28 +0200 Subject: [PATCH 036/116] Rebase to 4.4.0 upstream version --- .gitignore | 1 + radare2.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index bcd005e..ec0544e 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /radare2-3.6.0.tar.gz /radare2-3.9.0.tar.gz /radare2-4.2.1.tar.gz +/radare2-4.4.0.tar.gz diff --git a/radare2.spec b/radare2.spec index b39f567..dda722f 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 4.2.1 +Version: 4.4.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -213,7 +213,8 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA %ifarch s390x -Ddebugger=false \ %endif - -Duse_sys_capstone=true + -Duse_sys_capstone=true \ + -Denable_r2r=false %meson_build %install @@ -277,6 +278,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Mon May 4 2020 Riccardo Schirone - 4.4.0-1 +- Rebase to upstream version 4.4.0 * Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 - Rebase to upstream version 4.2.1 - Fix CVE-2019-19647 diff --git a/sources b/sources index 1575c24..283b42c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-4.2.1.tar.gz) = aed37f6ff7ae3a25e809e8fbab3ef1c370dba80b7b8ef440a025edfbda23314ce20990b3e89589fe6bee427b2beebabd67a9e1def603e53ca5078bf32bdc4e6c +SHA512 (radare2-4.4.0.tar.gz) = 6208d97f8333e72dfd04cccdb0234b60fb8979ca559b92532bf7e47d402f91e0c54678a83e6bafee65666fb7d6008b44b961600f24f9b3275cb2eec32490eaa5 From 20bcfd9575e6ca01fed3b957d943df7752d5701d Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Fri, 8 May 2020 13:47:03 +0200 Subject: [PATCH 037/116] Re-build 4.4.0-2 --- radare2.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index dda722f..7c74ca2 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist} @@ -278,6 +278,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Fri May 8 2020 Riccardo Schirone - 4.4.0-2 +- Just re-build * Mon May 4 2020 Riccardo Schirone - 4.4.0-1 - Rebase to upstream version 4.4.0 * Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 From cc012afa1363e31c4a866c8aafd8e6673f58f5e2 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 20 Jul 2020 14:30:12 +0200 Subject: [PATCH 038/116] Rebase to 4.5.0 --- .gitignore | 1 + radare2.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index ec0544e..06ff8f8 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /radare2-3.9.0.tar.gz /radare2-4.2.1.tar.gz /radare2-4.4.0.tar.gz +/radare2-4.5.0.tar.gz diff --git a/radare2.spec b/radare2.spec index 7c74ca2..2131b1a 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 4.4.0 +Version: 4.5.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist} @@ -108,12 +108,12 @@ Requires: %{name}-common = %{version}-%{release} # ./shlr/spp/README.md # SPP stands for Simple Pre-Processor, a templating language. # https://github.com/radare/spp -Provides: bundled(spp) = 1.0 +Provides: bundled(spp) = 1.2.0 # ./shlr/sdb/README.md # sdb is a simple string key/value database based on djb's cdb # https://github.com/radare/sdb -Provides: bundled(sdb) = 1.4.1 +Provides: bundled(sdb) = 1.5.0 # ./shlr/sdb/src/json/README # https://github.com/quartzjer/js0n @@ -214,6 +214,7 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA -Ddebugger=false \ %endif -Duse_sys_capstone=true \ + -Denable_tests=false \ -Denable_r2r=false %meson_build @@ -278,6 +279,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 +- Rebase to upstream version 4.5.0 * Fri May 8 2020 Riccardo Schirone - 4.4.0-2 - Just re-build * Mon May 4 2020 Riccardo Schirone - 4.4.0-1 diff --git a/sources b/sources index 283b42c..809a51f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-4.4.0.tar.gz) = 6208d97f8333e72dfd04cccdb0234b60fb8979ca559b92532bf7e47d402f91e0c54678a83e6bafee65666fb7d6008b44b961600f24f9b3275cb2eec32490eaa5 +SHA512 (radare2-4.5.0.tar.gz) = 84d4ffc28f499f4360f57f31ad1b1f4b2a14e7fcbde7198bfb9ec4a85ac6606ceb5b28602624d6419b14b1586afd50330ace6232a183d7bfb876fefe07ea7bf4 From 9a36fbfb356a13f128f58bd94933b04d5a7b3972 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 05:25:25 +0000 Subject: [PATCH 039/116] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 2131b1a..b782ce2 100644 --- a/radare2.spec +++ b/radare2.spec @@ -17,10 +17,10 @@ VCS: https://github.com/radare/radare2 %global rel 1 %if %{with build_release} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -279,6 +279,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 - Rebase to upstream version 4.5.0 * Fri May 8 2020 Riccardo Schirone - 4.4.0-2 From e7491108e9ff6d4c076a62b56b8888e0aa7532e8 Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Fri, 2 Oct 2020 17:19:51 +0200 Subject: [PATCH 040/116] Update radare2.spec rel number --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index b782ce2..ed6f997 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist}.1 @@ -279,6 +279,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 +- Rebuilt to make sure version is no lower than F32 + * Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 354a0af0fee77aacc03a7af9439434c473fece61 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 14:58:43 +0000 Subject: [PATCH 041/116] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index ed6f997..90e6303 100644 --- a/radare2.spec +++ b/radare2.spec @@ -17,10 +17,10 @@ VCS: https://github.com/radare/radare2 %global rel 2 %if %{with build_release} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist}.2 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.2 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -279,6 +279,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 - Rebuilt to make sure version is no lower than F32 From 5933132d7687d2616bd0eea2af58a6fa8aa42985 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Mon, 15 Feb 2021 22:05:22 +0100 Subject: [PATCH 042/116] Update to 5.1.0 --- radare2.spec | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/radare2.spec b/radare2.spec index 90e6303..0800bc5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 4.5.0 +Version: 5.1.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -45,6 +45,7 @@ License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and z # shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) # shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) # shlr/ptrace-wrap - LGPL v3+ +# shlr/tree-sitter - MIT # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -113,11 +114,12 @@ Provides: bundled(spp) = 1.2.0 # ./shlr/sdb/README.md # sdb is a simple string key/value database based on djb's cdb # https://github.com/radare/sdb -Provides: bundled(sdb) = 1.5.0 +Provides: bundled(sdb) = 1.7.0 # ./shlr/sdb/src/json/README +# Based on js0n with a lot of modifications # https://github.com/quartzjer/js0n -# JSON support for sdb +# JSON support for sdb. Provides: bundled(js0n) # libr/util/regex/README @@ -150,6 +152,9 @@ Provides: bundled(grub2) # https://github.com/thestr4ng3r/ptrace-wrap Provides: bundled(ptrace-wrap) +# ./shlr/tree-sitter +# https://github.com/tree-sitter/tree-sitter +Provides: bundled(tree-sitter) = 0.17.2 %description The radare2 is a reverse-engineering framework that is multi-architecture, @@ -223,13 +228,11 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA # removing r2pm because it is a package manager which could install packages # system wide or in the user home directory rm %{buildroot}/%{_bindir}/r2pm -# create r2 symlink because meson build does not create it (yet) -ln -s radare2 %{buildroot}/%{_bindir}/r2 # install README.Fedora for the www part mkdir -p %{buildroot}/%{_datadir}/%{name}/%{version}/www cp ./shlr/www/README.Fedora %{buildroot}/%{_datadir}/%{name}/%{version}/www/README.Fedora # remove unneeded fortunes -rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} +rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %ldconfig_scriptlets @@ -241,7 +244,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %files -%doc AUTHORS.md CONTRIBUTING.md DEVELOPERS.md README.md +%doc CONTRIBUTING.md DEVELOPERS.md README.md %doc doc/3D/ doc/node.js/ doc/pdb/ doc/sandbox/ %doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md %doc doc/esil.md doc/gdb.md doc/gprobe.md doc/intro.md doc/io.md doc/rap.md @@ -273,12 +276,16 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.{creepy,nsfw,fun} %{_datadir}/%{name}/%{version}/magic %{_datadir}/%{name}/%{version}/opcodes %{_datadir}/%{name}/%{version}/syscall +%{_datadir}/%{name}/%{version}/charsets %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +* Mon Feb 15 2021 Henrik Nordstrom - 5.1.0-2.2 +- Rebase to upstream version 5.1.0 + * Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 43ef346a3c285a7f8016acf5e3d72f010ffac6d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Mon, 15 Feb 2021 22:06:20 +0100 Subject: [PATCH 043/116] Update to 5.1.0 --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 06ff8f8..89a7795 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /radare2-4.2.1.tar.gz /radare2-4.4.0.tar.gz /radare2-4.5.0.tar.gz +/radare2-5.1.0.tar.gz diff --git a/sources b/sources index 809a51f..0c133b6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-4.5.0.tar.gz) = 84d4ffc28f499f4360f57f31ad1b1f4b2a14e7fcbde7198bfb9ec4a85ac6606ceb5b28602624d6419b14b1586afd50330ace6232a183d7bfb876fefe07ea7bf4 +SHA512 (radare2-5.1.0.tar.gz) = f973aeeb4d3a1e9eaf889a14bba4d54568dc2527d1160c7d999a7b2c870270cec7dc11a0eed12ae8f1d0aeacf63f14a92c7ca99f44e38573a6ce2276a08180f1 From f9c55ae02360ca5547794dcbf27975c0df6c4f07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Mon, 15 Feb 2021 22:12:56 +0100 Subject: [PATCH 044/116] Update to 5.1.1 --- .gitignore | 1 + radare2.spec | 12 ++++++------ sources | 2 +- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 89a7795..3edee39 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /radare2-4.4.0.tar.gz /radare2-4.5.0.tar.gz /radare2-5.1.0.tar.gz +/radare2-5.1.1.tar.gz diff --git a/radare2.spec b/radare2.spec index 0800bc5..8d18a83 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.1.0 +Version: 5.1.1 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -14,13 +14,13 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} -Release: %{rel}%{?dist}.2 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.2 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -283,8 +283,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog -* Mon Feb 15 2021 Henrik Nordstrom - 5.1.0-2.2 -- Rebase to upstream version 5.1.0 +* Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 +- Rebase to upstream version 5.1.1 * Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 0c133b6..0a7d1cf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.1.0.tar.gz) = f973aeeb4d3a1e9eaf889a14bba4d54568dc2527d1160c7d999a7b2c870270cec7dc11a0eed12ae8f1d0aeacf63f14a92c7ca99f44e38573a6ce2276a08180f1 +SHA512 (radare2-5.1.1.tar.gz) = b6728bb59788804f5442d5eec8141f62c3b51f589955589b310733b3aeb28beedb969af540649f454dad96710231df384e389d8b4a1d55627d8370e4d3da454f From d13832d9fdc024b28d3647e907f3d3c49a3f930f Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 28 Feb 2021 03:40:41 +0000 Subject: [PATCH 045/116] Do not remove r2pm from the radare2 package r2pm is to radare2 same as cpan to perl or pip to python. --- radare2.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/radare2.spec b/radare2.spec index 8d18a83..a48ef39 100644 --- a/radare2.spec +++ b/radare2.spec @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 +%global rel 2 %if %{with build_release} Release: %{rel}%{?dist} @@ -225,9 +225,6 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA %install %meson_install -# removing r2pm because it is a package manager which could install packages -# system wide or in the user home directory -rm %{buildroot}/%{_bindir}/r2pm # install README.Fedora for the www part mkdir -p %{buildroot}/%{_datadir}/%{name}/%{version}/www cp ./shlr/www/README.Fedora %{buildroot}/%{_datadir}/%{name}/%{version}/www/README.Fedora @@ -283,6 +280,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog +* Sun Feb 28 2021 Michal Ambroz 5.1.1-2 +- stop removing the r2pm binary from the package + * Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 - Rebase to upstream version 5.1.1 From f1576c66ab8d341ba6e606ddd23dfdfc03f952bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Wed, 14 Apr 2021 07:45:16 +0200 Subject: [PATCH 046/116] 5.2.0 --- .gitignore | 1 + radare2.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3edee39..433a1a5 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /radare2-4.5.0.tar.gz /radare2-5.1.0.tar.gz /radare2-5.1.1.tar.gz +/radare2-5.2.0.tar.gz diff --git a/radare2.spec b/radare2.spec index a48ef39..cebddd5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -3,7 +3,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.1.1 +Version: 5.2.0 URL: https://radare.org/ VCS: https://github.com/radare/radare2 @@ -14,7 +14,7 @@ VCS: https://github.com/radare/radare2 %global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 2 +%global rel 1 %if %{with build_release} Release: %{rel}%{?dist} @@ -280,6 +280,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog +* Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 +- Update to version 5.2.0 + * Sun Feb 28 2021 Michal Ambroz 5.1.1-2 - stop removing the r2pm binary from the package diff --git a/sources b/sources index 0a7d1cf..29e1adb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.1.1.tar.gz) = b6728bb59788804f5442d5eec8141f62c3b51f589955589b310733b3aeb28beedb969af540649f454dad96710231df384e389d8b4a1d55627d8370e4d3da454f +SHA512 (radare2-5.2.0.tar.gz) = 664ea6df65c1ea8d13a80d281c3dbbcae16fb308826b9276e68d63f26f239f4a5c0d59abcf9325c299894ad4ebf1098b964aa3cad0bbe58b6c96cbd6e7b25952 From 54361208343feeed9546613b1ade56d9f8a7691b Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 17 Apr 2021 08:02:59 +0200 Subject: [PATCH 047/116] fix build for epel, hope that libuv-devel is already available --- radare2.spec | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/radare2.spec b/radare2.spec index cebddd5..e6d0078 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,20 +1,21 @@ -# by default it builds from the released version of radare2 -%bcond_without build_release - Name: radare2 Summary: The reverse engineering framework Version: 5.2.0 +%global rel 2 URL: https://radare.org/ -VCS: https://github.com/radare/radare2 +VCS: https://github.com/radareorg/radare2 -%global gituser radare +# by default it builds from the released version of radare2 +# to build fro git use rpmbuild --without=build_release +%bcond_without build_release + +%global gituser radareorg %global gitname radare2 -%global gitdate 20190401 -%global commit 3c41cb7d7ed018509a24c2e370d79a91c642ed07 +%global gitdate 20210411 +%global commit cf3db945083fb4dab951874e5ec1283128deab11 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%global rel 1 %if %{with build_release} Release: %{rel}%{?dist} @@ -60,10 +61,7 @@ License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and z # shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD # shlr/www/p/vendors/jquery.onoff.min.js - MIT -%if %{!with build_release} BuildRequires: sed -%endif - BuildRequires: gcc BuildRequires: meson BuildRequires: ninja-build @@ -188,10 +186,10 @@ information %prep %if %{with build_release} # Build from git release version -%setup -n %{gitname}-%{version} +%autosetup -n %{gitname}-%{version} %else # Build from git commit -%setup -q -n %{gitname}-%{commit} +%autosetup -q -n %{gitname}-%{commit} # Rename internal "version-git" to "version" sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif @@ -205,6 +203,15 @@ echo "The radare2 source usually comes with a pre-built version of the web-inter echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora +%if 0%{?rhel} && 0%{?rhel} == 8 +# Meson on EPEL8 is older than meson on EPEL7 and older than recommended one +# on EPEL8 downgrade the recommendation in meson.build and pray +# meson_version : '>=0.50.1' => meson_version : '>=0.49.1' +sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build +%endif + + + %build # Whereever possible use the system-wide libraries instead of bundles %meson \ @@ -280,6 +287,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog +* Sat Apr 17 2021 Michal Ambroz 5.2.0-2 +- fix epel build + * Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 - Update to version 5.2.0 From b4b467d05f6e74c047d0696a71558c75187d86a8 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 21 Apr 2021 03:21:47 +0200 Subject: [PATCH 048/116] avoid std=c99 feature for( int i .. --- radare2.spec | 39 ++++++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/radare2.spec b/radare2.spec index e6d0078..0700195 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,13 +1,13 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.2.0 -%global rel 2 +%global rel 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # by default it builds from the released version of radare2 -# to build fro git use rpmbuild --without=build_release -%bcond_without build_release +# to build from git use rpmbuild --without=releasetag +%bcond_without releasetag %global gituser radareorg %global gitname radare2 @@ -17,7 +17,7 @@ VCS: https://github.com/radareorg/radare2 %global shortcommit %(c=%{commit}; echo ${c:0:7}) -%if %{with build_release} +%if %{with releasetag} Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else @@ -25,6 +25,12 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif +# avoid requiring the stdc99 feature +# declare the variable prior its usage in for cycle +# https://github.com/radareorg/radare2/pull/18602 +Patch0: https://github.com/radareorg/radare2/pull/18602.patch#/radare2-5.2.0-for_std99.patch + + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -69,9 +75,13 @@ BuildRequires: file-devel BuildRequires: xxhash-devel BuildRequires: pkgconfig -%if 0%{?epel} +%if 0%{?rhel} BuildRequires: bzip2-devel BuildRequires: python3 +# %%meson macro using the %%set_build_flags from Fedora/EPEL, but not bringing the dependency +# https://src.fedoraproject.org/rpms/meson/pull-request/9 +BuildRequires: epel-rpm-macros + %else BuildRequires: pkgconfig(bzip2) %endif @@ -118,7 +128,7 @@ Provides: bundled(sdb) = 1.7.0 # Based on js0n with a lot of modifications # https://github.com/quartzjer/js0n # JSON support for sdb. -Provides: bundled(js0n) +Provides: bundled(js0n) = 2018 # libr/util/regex/README # Modified OpenBSD regex to be portable @@ -144,15 +154,15 @@ Provides: bundled(vavrdisasm) = 1.6 # ./shlr/grub/* # It is not clear which version has been copied -Provides: bundled(grub2) +Provides: bundled(grub2) = 1.99~beta0 # ./shlr/ptrace-wrap # https://github.com/thestr4ng3r/ptrace-wrap -Provides: bundled(ptrace-wrap) +Provides: bundled(ptrace-wrap) = 20181018 # ./shlr/tree-sitter # https://github.com/tree-sitter/tree-sitter -Provides: bundled(tree-sitter) = 0.17.2 +Provides: bundled(tree-sitter) = 0.17.2 %description The radare2 is a reverse-engineering framework that is multi-architecture, @@ -184,12 +194,12 @@ information %prep -%if %{with build_release} +%if %{with releasetag} # Build from git release version -%autosetup -n %{gitname}-%{version} +%autosetup -p 1 -n %{gitname}-%{version} %else # Build from git commit -%autosetup -q -n %{gitname}-%{commit} +%autosetup -p 1 -n %{gitname}-%{commit} # Rename internal "version-git" to "version" sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif @@ -287,6 +297,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog +* Wed Apr 21 2021 Michal Ambroz 5.2.0-3 +- avoid c99 for(int i... + * Sat Apr 17 2021 Michal Ambroz 5.2.0-2 - fix epel build @@ -357,7 +370,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun - fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 * Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 - rebase to upstream version 3.1.0 -- remove duplicated /usr/share/radare2 dir in %files +- remove duplicated /usr/share/radare2 dir in %%files * Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 - rebase to upstream version 3.0.1 which includes some minor fixes and fixes for ppc64 and s390x architectures From e05a8ed5288182a0a8690b1fe7213cf2216ba382 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 21 Apr 2021 04:27:48 +0200 Subject: [PATCH 049/116] adding patch for for (int .. --- radare2-5.2.0-for_std99.patch | 36 +++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 radare2-5.2.0-for_std99.patch diff --git a/radare2-5.2.0-for_std99.patch b/radare2-5.2.0-for_std99.patch new file mode 100644 index 0000000..044ee93 --- /dev/null +++ b/radare2-5.2.0-for_std99.patch @@ -0,0 +1,36 @@ +From ac6f9be8037cfc05c0ab7a4eb9e70c4204ae3fbd Mon Sep 17 00:00:00 2001 +From: Michal Ambroz <723625+xambroz@users.noreply.github.com> +Date: Tue, 20 Apr 2021 23:32:41 +0200 +Subject: [PATCH] Avoid c99 feature + +Hello, +this patch avoids c99 feature of declaring variable withing the for stanza. + + +Sample build log output +FAILED: libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o +cc -Ilibr/crypto/libr_crypto.so.5.2.0.p -I. -I.. -I../libr/include -I../shlr/spp -I../shlr/sdb/src -pipe -D_FILE_OFFSET_BITS=64 -fvisibility=hidden -O2 -g -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC -pthread -DR2_PLUGIN_INCORE=1 -MD -MQ libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o -MF libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o.d -o libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o -c ../libr/crypto/p/crypto_cps2.c +../libr/crypto/p/crypto_cps2.c: In function 'set_key': +../libr/crypto/p/crypto_cps2.c:729:3: error: 'for' loop initial declarations are only allowed in C99 mode + for (int b = 0; b < 10 * 16; b++) { + ^ +../libr/crypto/p/crypto_cps2.c:729:3: note: use option -std=c99 or -std=gnu99 to compile your code +ninja: build stopped: subcommand failed. +--- + libr/crypto/p/crypto_cps2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libr/crypto/p/crypto_cps2.c b/libr/crypto/p/crypto_cps2.c +index fbc069beb4d..bc03cedcd1e 100644 +--- a/libr/crypto/p/crypto_cps2.c ++++ b/libr/crypto/p/crypto_cps2.c +@@ -726,7 +726,8 @@ static bool set_key(RCrypto *cry, const ut8 *key, int keylen, int mode, int dire + } else if (keylen == 20) { + const ut8* key8 = (const ut8*)key; + unsigned short decoded[10] = {0}; +- for (int b = 0; b < 10 * 16; b++) { ++ int b; ++ for (b = 0; b < 10 * 16; b++) { + int bit = (317 - b) % 160; + if ((key8[bit / 8] >> ((bit ^ 7) % 8)) & 1) { + decoded[b / 16] |= (0x8000 >> (b % 16)); From 219117d327861bb212e681b7c69aaf93bfd7f48b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 22 Apr 2021 19:09:26 +0200 Subject: [PATCH 050/116] 5.2.1 --- .gitignore | 1 + radare2-5.2.0-for_std99.patch | 36 ----------------------------------- radare2.spec | 13 +++++-------- sources | 2 +- 4 files changed, 7 insertions(+), 45 deletions(-) delete mode 100644 radare2-5.2.0-for_std99.patch diff --git a/.gitignore b/.gitignore index 433a1a5..3668516 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /radare2-5.1.0.tar.gz /radare2-5.1.1.tar.gz /radare2-5.2.0.tar.gz +/radare2-5.2.1.tar.gz diff --git a/radare2-5.2.0-for_std99.patch b/radare2-5.2.0-for_std99.patch deleted file mode 100644 index 044ee93..0000000 --- a/radare2-5.2.0-for_std99.patch +++ /dev/null @@ -1,36 +0,0 @@ -From ac6f9be8037cfc05c0ab7a4eb9e70c4204ae3fbd Mon Sep 17 00:00:00 2001 -From: Michal Ambroz <723625+xambroz@users.noreply.github.com> -Date: Tue, 20 Apr 2021 23:32:41 +0200 -Subject: [PATCH] Avoid c99 feature - -Hello, -this patch avoids c99 feature of declaring variable withing the for stanza. - - -Sample build log output -FAILED: libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o -cc -Ilibr/crypto/libr_crypto.so.5.2.0.p -I. -I.. -I../libr/include -I../shlr/spp -I../shlr/sdb/src -pipe -D_FILE_OFFSET_BITS=64 -fvisibility=hidden -O2 -g -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC -pthread -DR2_PLUGIN_INCORE=1 -MD -MQ libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o -MF libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o.d -o libr/crypto/libr_crypto.so.5.2.0.p/p_crypto_cps2.c.o -c ../libr/crypto/p/crypto_cps2.c -../libr/crypto/p/crypto_cps2.c: In function 'set_key': -../libr/crypto/p/crypto_cps2.c:729:3: error: 'for' loop initial declarations are only allowed in C99 mode - for (int b = 0; b < 10 * 16; b++) { - ^ -../libr/crypto/p/crypto_cps2.c:729:3: note: use option -std=c99 or -std=gnu99 to compile your code -ninja: build stopped: subcommand failed. ---- - libr/crypto/p/crypto_cps2.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/libr/crypto/p/crypto_cps2.c b/libr/crypto/p/crypto_cps2.c -index fbc069beb4d..bc03cedcd1e 100644 ---- a/libr/crypto/p/crypto_cps2.c -+++ b/libr/crypto/p/crypto_cps2.c -@@ -726,7 +726,8 @@ static bool set_key(RCrypto *cry, const ut8 *key, int keylen, int mode, int dire - } else if (keylen == 20) { - const ut8* key8 = (const ut8*)key; - unsigned short decoded[10] = {0}; -- for (int b = 0; b < 10 * 16; b++) { -+ int b; -+ for (b = 0; b < 10 * 16; b++) { - int bit = (317 - b) % 160; - if ((key8[bit / 8] >> ((bit ^ 7) % 8)) & 1) { - decoded[b / 16] |= (0x8000 >> (b % 16)); diff --git a/radare2.spec b/radare2.spec index 0700195..8be01bf 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.2.0 -%global rel 3 +Version: 5.2.1 +%global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -25,12 +25,6 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif -# avoid requiring the stdc99 feature -# declare the variable prior its usage in for cycle -# https://github.com/radareorg/radare2/pull/18602 -Patch0: https://github.com/radareorg/radare2/pull/18602.patch#/radare2-5.2.0-for_std99.patch - - License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -297,6 +291,9 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog +* Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 +- Update to version 5.2.1 + * Wed Apr 21 2021 Michal Ambroz 5.2.0-3 - avoid c99 for(int i... diff --git a/sources b/sources index 29e1adb..dc25127 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.2.0.tar.gz) = 664ea6df65c1ea8d13a80d281c3dbbcae16fb308826b9276e68d63f26f239f4a5c0d59abcf9325c299894ad4ebf1098b964aa3cad0bbe58b6c96cbd6e7b25952 +SHA512 (radare2-5.2.1.tar.gz) = c744f5c8fff163022a7a9a913fe34dfa0dee0d9ab3b18bd4cc038c2d487dbfeba2f1523aa12a3166a2c22c45bcc71e802fae101b72fc2e6adab96b522c0de17b From 224fff17dcec05f722c0af866a7edf4b233c33e1 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 12 May 2021 00:52:15 +0200 Subject: [PATCH 051/116] allow build with older meson version 0.49 as used in EPEL8/RHEL8 --- radare2-5.2.1-meson_rhel8.patch | 49 ++++++++++++++++++++++++++++++ radare2-5.2.1-xxhash.patch | 28 +++++++++++++++++ radare2.spec | 54 +++++++++++++++++++++++---------- 3 files changed, 115 insertions(+), 16 deletions(-) create mode 100644 radare2-5.2.1-meson_rhel8.patch create mode 100644 radare2-5.2.1-xxhash.patch diff --git a/radare2-5.2.1-meson_rhel8.patch b/radare2-5.2.1-meson_rhel8.patch new file mode 100644 index 0000000..967d8d3 --- /dev/null +++ b/radare2-5.2.1-meson_rhel8.patch @@ -0,0 +1,49 @@ +From abb813ebe328c7eb2480d63cbf100d66493cf09a Mon Sep 17 00:00:00 2001 +From: Michal Ambroz <723625+xambroz@users.noreply.github.com> +Date: Tue, 11 May 2021 22:55:37 +0200 +Subject: [PATCH] Make meson compatible with older versions (RHEL8 meson 0.49) + +This patch makes it possible to build with older version of meson. +It is needed to build radare2 on RedHat Enterprise Linux 8 where the meson version 0.49 is older than on RHEL7+EPEL7 or Fedora. + +Issues fixed: +- set minimum meson version down to 0.49 (version available in RHEL8) +- meson 0.49 has bug which prevents processing of '\' split-lines => build r2_version_number on single line +- on meson 0.49 the ternary operator is not possible to use with some constructs (subdir in add_install_scripts) => replace one ternary operator with if-else construct +--- + meson.build | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/meson.build b/meson.build +index 271ebd71af1..0c47a07bcbc 100644 +--- a/meson.build ++++ b/meson.build +@@ -1,4 +1,4 @@ +-project('radare2', 'c', license : 'LGPL3', meson_version : '>=0.50.1', version : '5.2.1') ++project('radare2', 'c', license : 'LGPL3', meson_version : '>=0.49', version : '5.2.1') + + py3_exe = import('python').find_installation('python3') + git_exe = find_program('git', required: false) +@@ -10,10 +10,7 @@ vers = r2_version.split('.') + r2_version_major = vers[0].to_int() + r2_version_minor = vers[1].to_int() + r2_version_patch = vers[2].split('-')[0].to_int() +-r2_version_number \ +- = (r2_version_major * 10000) \ +- + (r2_version_minor * 100) \ +- + (r2_version_patch) ++r2_version_number = (r2_version_major * 10000) + (r2_version_minor * 100) + (r2_version_patch) + + repo = '.' + if meson.is_subproject() +@@ -709,5 +706,9 @@ if cli_enabled + install_dir: r2_zsh_compdir + ) + +- meson.add_install_script(host_machine.system() == 'windows' ? 'sys/create_r2.bat' : 'sys/create_r2.sh') ++ if host_machine.system() == 'windows' ++ meson.add_install_script('sys/create_r2.bat') ++ else ++ meson.add_install_script('sys/create_r2.sh') ++ endif + endif diff --git a/radare2-5.2.1-xxhash.patch b/radare2-5.2.1-xxhash.patch new file mode 100644 index 0000000..5be65a4 --- /dev/null +++ b/radare2-5.2.1-xxhash.patch @@ -0,0 +1,28 @@ +From f5712f01740e2d729547786b2a869fdd23b430bd Mon Sep 17 00:00:00 2001 +From: Michal Ambroz <723625+xambroz@users.noreply.github.com> +Date: Tue, 11 May 2021 22:35:27 +0200 +Subject: [PATCH] Improve the xxhash system library detection + +The pkgconfig module is named libxxhash on Debian/Fedora/RedHat/SuSE/Arch so I added libxxhash on first place. +Keeping the xxhash checked second. +--- + meson.build | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/meson.build b/meson.build +index 271ebd71af1..1093598229e 100644 +--- a/meson.build ++++ b/meson.build +@@ -237,8 +237,11 @@ if sys_magic.found() and get_option('use_sys_magic') + endif + + # handle xxhash library +-sys_xxhash = dependency('xxhash', required: false) ++sys_xxhash = dependency('libxxhash', required: false) + use_sys_xxhash = false ++if not sys_xxhash.found() ++ sys_xxhash = dependency('xxhash', required: false) ++endif + if not sys_xxhash.found() + sys_xxhash = cc.find_library('xxhash', required: false) + endif diff --git a/radare2.spec b/radare2.spec index 8be01bf..a7b1445 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.2.1 -%global rel 1 +%global rel 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -25,6 +25,13 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif +# make it possible to use older version of messon - needed for EPEL8 which has older version than EPEL7 +Patch0: https://github.com/radareorg/radare2/pull/18684.patch#/radare2-5.2.1-meson_rhel8.patch + +# improve the detection of the system xxhash. pkgconfig module name is libxxhash not xhash +Patch1: https://github.com/radareorg/radare2/pull/18683.patch#/radare2-5.2.1-xxhash.patch + + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -65,20 +72,9 @@ BuildRequires: sed BuildRequires: gcc BuildRequires: meson BuildRequires: ninja-build -BuildRequires: file-devel -BuildRequires: xxhash-devel BuildRequires: pkgconfig - -%if 0%{?rhel} -BuildRequires: bzip2-devel -BuildRequires: python3 -# %%meson macro using the %%set_build_flags from Fedora/EPEL, but not bringing the dependency -# https://src.fedoraproject.org/rpms/meson/pull-request/9 -BuildRequires: epel-rpm-macros - -%else -BuildRequires: pkgconfig(bzip2) -%endif +# xxhash-devel +BuildRequires: pkgconfig(libxxhash) BuildRequires: pkgconfig(libzip) BuildRequires: pkgconfig(zlib) BuildRequires: pkgconfig(liblz4) @@ -86,6 +82,22 @@ BuildRequires: pkgconfig(capstone) >= 3.0.4 BuildRequires: pkgconfig(libuv) BuildRequires: pkgconfig(openssl) +%if 0%{?rhel} +BuildRequires: file-devel +BuildRequires: bzip2-devel +BuildRequires: python3 +# %%meson macro using the %%set_build_flags from Fedora/EPEL, but not bringing the dependency +# https://src.fedoraproject.org/rpms/meson/pull-request/9 +BuildRequires: epel-rpm-macros +# On RHEL xxhash-devel is not bringing the xxhash as dependency +BuildRequires: xxhash + +%else +# file-devel +BuildRequires: pkgconfig(libmagic) +BuildRequires: pkgconfig(bzip2) +%endif + Requires: %{name}-common = %{version}-%{release} # Package contains several bundled libraries @@ -199,6 +211,10 @@ sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif # Removing zip/lzip and lz4 files because we use system dependencies rm -rf shlr/zip shlr/lz4 +# Remove xxhash files because we use system dependencies +rm -f libr/hash/xxhash.c libr/hash/xxhash.h + + # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui @@ -242,8 +258,9 @@ cp ./shlr/www/README.Fedora %{buildroot}/%{_datadir}/%{name}/%{version}/www/READ # remove unneeded fortunes rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun +%if 0%{?rhel} && 0%{?rhel} <= 8 %ldconfig_scriptlets - +%endif %check # Do not run the testsuite yet - it pulls another package @@ -252,6 +269,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %files +%license COPYING COPYING.LESSER %doc CONTRIBUTING.md DEVELOPERS.md README.md %doc doc/3D/ doc/node.js/ doc/pdb/ doc/sandbox/ %doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md @@ -261,7 +279,6 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %dir %{_datadir}/%{name}/%{version}/www # Webui removed cuz of having minified js code and missing source code %doc %{_datadir}/%{name}/%{version}/www/README.Fedora -%license COPYING COPYING.LESSER %{_bindir}/r* %{_libdir}/libr_*.so.%{version}* %{_mandir}/man1/r*.1.* @@ -291,6 +308,11 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog +* Tue May 11 2021 Michal Ambroz 5.2.1-2 +- patch for older version of meson used on EPEL8 +- use pkgconfig where possible for BR +- use ldconfig_scriptlets only on older platforms + * Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 - Update to version 5.2.1 From efc9e633aef26832e5cfd047b55fb964455ad678 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 12 May 2021 23:39:34 +0200 Subject: [PATCH 052/116] ExcludeArch for EPEL8 + s390x --- radare2.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/radare2.spec b/radare2.spec index a7b1445..f434be5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -5,6 +5,14 @@ Version: 5.2.1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 +%if 0%{?rhel} && 0%{?rhel} == 8 +# Radare2 fails to build on EPEL8+s390x +# https://bugzilla.redhat.com/show_bug.cgi?id=1960046 +# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_architecture_build_failures +ExcludeArch: s390x +%endif + + # by default it builds from the released version of radare2 # to build from git use rpmbuild --without=releasetag %bcond_without releasetag @@ -312,6 +320,7 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun - patch for older version of meson used on EPEL8 - use pkgconfig where possible for BR - use ldconfig_scriptlets only on older platforms +- add ExcludeArch for s390x on EPEL8 * Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 - Update to version 5.2.1 From 2c71e4e2e4579208800dc16a8a2110cb049bc0d0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 9 Jun 2021 22:00:52 +0200 Subject: [PATCH 053/116] bump to 5.3.0 --- .gitignore | 1 + radare2-5.2.1-meson_rhel8.patch | 49 --------------------------------- radare2-5.2.1-xxhash.patch | 28 ------------------- radare2.rpmlintrc | 8 ++++++ radare2.spec | 43 +++++++++++++++++------------ sources | 2 +- 6 files changed, 36 insertions(+), 95 deletions(-) delete mode 100644 radare2-5.2.1-meson_rhel8.patch delete mode 100644 radare2-5.2.1-xxhash.patch create mode 100644 radare2.rpmlintrc diff --git a/.gitignore b/.gitignore index 3668516..add1c15 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ /radare2-5.1.1.tar.gz /radare2-5.2.0.tar.gz /radare2-5.2.1.tar.gz +/radare2-5.3.0.tar.gz diff --git a/radare2-5.2.1-meson_rhel8.patch b/radare2-5.2.1-meson_rhel8.patch deleted file mode 100644 index 967d8d3..0000000 --- a/radare2-5.2.1-meson_rhel8.patch +++ /dev/null @@ -1,49 +0,0 @@ -From abb813ebe328c7eb2480d63cbf100d66493cf09a Mon Sep 17 00:00:00 2001 -From: Michal Ambroz <723625+xambroz@users.noreply.github.com> -Date: Tue, 11 May 2021 22:55:37 +0200 -Subject: [PATCH] Make meson compatible with older versions (RHEL8 meson 0.49) - -This patch makes it possible to build with older version of meson. -It is needed to build radare2 on RedHat Enterprise Linux 8 where the meson version 0.49 is older than on RHEL7+EPEL7 or Fedora. - -Issues fixed: -- set minimum meson version down to 0.49 (version available in RHEL8) -- meson 0.49 has bug which prevents processing of '\' split-lines => build r2_version_number on single line -- on meson 0.49 the ternary operator is not possible to use with some constructs (subdir in add_install_scripts) => replace one ternary operator with if-else construct ---- - meson.build | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - -diff --git a/meson.build b/meson.build -index 271ebd71af1..0c47a07bcbc 100644 ---- a/meson.build -+++ b/meson.build -@@ -1,4 +1,4 @@ --project('radare2', 'c', license : 'LGPL3', meson_version : '>=0.50.1', version : '5.2.1') -+project('radare2', 'c', license : 'LGPL3', meson_version : '>=0.49', version : '5.2.1') - - py3_exe = import('python').find_installation('python3') - git_exe = find_program('git', required: false) -@@ -10,10 +10,7 @@ vers = r2_version.split('.') - r2_version_major = vers[0].to_int() - r2_version_minor = vers[1].to_int() - r2_version_patch = vers[2].split('-')[0].to_int() --r2_version_number \ -- = (r2_version_major * 10000) \ -- + (r2_version_minor * 100) \ -- + (r2_version_patch) -+r2_version_number = (r2_version_major * 10000) + (r2_version_minor * 100) + (r2_version_patch) - - repo = '.' - if meson.is_subproject() -@@ -709,5 +706,9 @@ if cli_enabled - install_dir: r2_zsh_compdir - ) - -- meson.add_install_script(host_machine.system() == 'windows' ? 'sys/create_r2.bat' : 'sys/create_r2.sh') -+ if host_machine.system() == 'windows' -+ meson.add_install_script('sys/create_r2.bat') -+ else -+ meson.add_install_script('sys/create_r2.sh') -+ endif - endif diff --git a/radare2-5.2.1-xxhash.patch b/radare2-5.2.1-xxhash.patch deleted file mode 100644 index 5be65a4..0000000 --- a/radare2-5.2.1-xxhash.patch +++ /dev/null @@ -1,28 +0,0 @@ -From f5712f01740e2d729547786b2a869fdd23b430bd Mon Sep 17 00:00:00 2001 -From: Michal Ambroz <723625+xambroz@users.noreply.github.com> -Date: Tue, 11 May 2021 22:35:27 +0200 -Subject: [PATCH] Improve the xxhash system library detection - -The pkgconfig module is named libxxhash on Debian/Fedora/RedHat/SuSE/Arch so I added libxxhash on first place. -Keeping the xxhash checked second. ---- - meson.build | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/meson.build b/meson.build -index 271ebd71af1..1093598229e 100644 ---- a/meson.build -+++ b/meson.build -@@ -237,8 +237,11 @@ if sys_magic.found() and get_option('use_sys_magic') - endif - - # handle xxhash library --sys_xxhash = dependency('xxhash', required: false) -+sys_xxhash = dependency('libxxhash', required: false) - use_sys_xxhash = false -+if not sys_xxhash.found() -+ sys_xxhash = dependency('xxhash', required: false) -+endif - if not sys_xxhash.found() - sys_xxhash = cc.find_library('xxhash', required: false) - endif diff --git a/radare2.rpmlintrc b/radare2.rpmlintrc new file mode 100644 index 0000000..bcf112a --- /dev/null +++ b/radare2.rpmlintrc @@ -0,0 +1,8 @@ +from Config import addFilter + + +# radare2.src: W: spelling-error %description -l en_US scriptable -> scrip table, scrip-table, script able +addFilter('radare2.*: spelling-error.*scriptable') + +# radare2.src: W: spelling-error %description -l en_US opcode -> op code, op-code, code +addFilter('radare2.*: spelling-error.*opcode') diff --git a/radare2.spec b/radare2.spec index f434be5..06da506 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,16 +1,17 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.2.1 -%global rel 2 +Version: 5.3.0 +%global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 +# https://github.com/radareorg/radare2/releases -%if 0%{?rhel} && 0%{?rhel} == 8 +# %%if 0%%{?rhel} && 0i%%{?rhel} == 8 # Radare2 fails to build on EPEL8+s390x # https://bugzilla.redhat.com/show_bug.cgi?id=1960046 # https://docs.fedoraproject.org/en-US/packaging-guidelines/#_architecture_build_failures -ExcludeArch: s390x -%endif +# ExcludeArch: s390x +# %%endif # by default it builds from the released version of radare2 @@ -20,8 +21,8 @@ ExcludeArch: s390x %global gituser radareorg %global gitname radare2 -%global gitdate 20210411 -%global commit cf3db945083fb4dab951874e5ec1283128deab11 +%global gitdate 20210601 +%global commit ee753c25094c6e1c62dfb9596423824251dbc943 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -33,12 +34,6 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif -# make it possible to use older version of messon - needed for EPEL8 which has older version than EPEL7 -Patch0: https://github.com/radareorg/radare2/pull/18684.patch#/radare2-5.2.1-meson_rhel8.patch - -# improve the detection of the system xxhash. pkgconfig module name is libxxhash not xhash -Patch1: https://github.com/radareorg/radare2/pull/18683.patch#/radare2-5.2.1-xxhash.patch - License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -222,8 +217,6 @@ rm -rf shlr/zip shlr/lz4 # Remove xxhash files because we use system dependencies rm -f libr/hash/xxhash.c libr/hash/xxhash.h - - # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui rm -rf ./shlr/www/* @@ -239,7 +232,6 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil %endif - %build # Whereever possible use the system-wide libraries instead of bundles %meson \ @@ -258,6 +250,7 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil -Denable_r2r=false %meson_build + %install %meson_install # install README.Fedora for the www part @@ -266,16 +259,21 @@ cp ./shlr/www/README.Fedora %{buildroot}/%{_datadir}/%{name}/%{version}/www/READ # remove unneeded fortunes rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun +# Make directory for the plugins +# Users can learn the dirname by "r2 -H" +mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} + + %if 0%{?rhel} && 0%{?rhel} <= 8 %ldconfig_scriptlets %endif + %check # Do not run the testsuite yet - it pulls another package # https://github.com/radare/radare2-regressions from github make tests - %files %license COPYING COPYING.LESSER %doc CONTRIBUTING.md DEVELOPERS.md README.md @@ -289,6 +287,8 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %doc %{_datadir}/%{name}/%{version}/www/README.Fedora %{_bindir}/r* %{_libdir}/libr_*.so.%{version}* +# Empty directory for plugins +%{_libdir}/%{name} %{_mandir}/man1/r*.1.* %{_mandir}/man7/esil.7.* %{_datadir}/zsh/site-functions/_r* @@ -316,6 +316,15 @@ rm %{buildroot}/%{_datadir}/doc/%{name}/fortunes.fun %changelog +* Wed Jun 09 2021 Michal Ambroz 5.3.0-1 +- re-enable build for s390x on EPEL8 (libuv should be available for 8.4) +- bump to 5.3.0 +- remove radare2-5.2.1-meson_rhel8.patch - accepted upstream +- remove radare2-5.2.1-xxhash.patch - accepted upstream + +* Sat May 15 2021 Michal Ambroz 5.2.1-3 +- adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 + * Tue May 11 2021 Michal Ambroz 5.2.1-2 - patch for older version of meson used on EPEL8 - use pkgconfig where possible for BR diff --git a/sources b/sources index dc25127..c7bee1d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.2.1.tar.gz) = c744f5c8fff163022a7a9a913fe34dfa0dee0d9ab3b18bd4cc038c2d487dbfeba2f1523aa12a3166a2c22c45bcc71e802fae101b72fc2e6adab96b522c0de17b +SHA512 (radare2-5.3.0.tar.gz) = f9d5ffd6f39efdcd447c2bc65ad3129576292a11942c99da8d0c10217621a6d1db72baaf7badadcbbaf75c54be0439a9257de4f56d47cefdce457ffb08167ff8 From 71efb6a3a3ae0ebcd718b40641e9fc6ffcaf8da6 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 12 Jun 2021 01:50:16 +0200 Subject: [PATCH 054/116] bump to 5.3.1 --- .gitignore | 1 + radare2.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index add1c15..4d5c224 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,4 @@ /radare2-5.2.0.tar.gz /radare2-5.2.1.tar.gz /radare2-5.3.0.tar.gz +/radare2-5.3.1.tar.gz diff --git a/radare2.spec b/radare2.spec index 06da506..3a417bc 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.3.0 +Version: 5.3.1 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -316,6 +316,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jun 11 2021 Michal Ambroz 5.3.1-1 +- bump to 5.3.1 + * Wed Jun 09 2021 Michal Ambroz 5.3.0-1 - re-enable build for s390x on EPEL8 (libuv should be available for 8.4) - bump to 5.3.0 diff --git a/sources b/sources index c7bee1d..e1e0f3b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.3.0.tar.gz) = f9d5ffd6f39efdcd447c2bc65ad3129576292a11942c99da8d0c10217621a6d1db72baaf7badadcbbaf75c54be0439a9257de4f56d47cefdce457ffb08167ff8 +SHA512 (radare2-5.3.1.tar.gz) = 34c96c7c863fb8a59f1d03539375d5b8f31f6021dc84ce943daa163d8a0227bf3156963cc187c366790abec4381da6aa987248e76570a498cfcdeb982cb2ffc0 From d44b0d9878a47fcee264285f0fe8a4de54ed6eb6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 11:05:44 +0000 Subject: [PATCH 055/116] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 3a417bc..8d6f840 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -316,6 +316,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Fri Jun 11 2021 Michal Ambroz 5.3.1-1 - bump to 5.3.1 From c7f4186056b4c6d84c597a709c090d59ecdddf45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Sat, 18 Sep 2021 16:33:31 +0200 Subject: [PATCH 056/116] 5.4.0 --- .gitignore | 1 + radare2.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4d5c224..397c2a8 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,4 @@ /radare2-5.2.1.tar.gz /radare2-5.3.0.tar.gz /radare2-5.3.1.tar.gz +/radare2-5.4.0.tar.gz diff --git a/radare2.spec b/radare2.spec index 8d6f840..af1ff22 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.3.1 +Version: 5.4.0 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -27,7 +27,7 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 @@ -316,6 +316,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 +- Update to version 5.4.0 + * Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/sources b/sources index e1e0f3b..06b81a7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.3.1.tar.gz) = 34c96c7c863fb8a59f1d03539375d5b8f31f6021dc84ce943daa163d8a0227bf3156963cc187c366790abec4381da6aa987248e76570a498cfcdeb982cb2ffc0 +SHA512 (radare2-5.4.0.tar.gz) = b77fef7eda7951b2a880e3131768280dc662338f25a44d4aad5990d01fa852250ed0395fa0639bf1cdb0a6d876ad74da3da2f59362231c41f56a552709ce7e09 From 128499f9143482a633360618abee91fc31937ca8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 23 Sep 2021 07:57:53 +0200 Subject: [PATCH 057/116] 5.4.2 --- .gitignore | 1 + radare2.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 397c2a8..49d0e0b 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,4 @@ /radare2-5.3.0.tar.gz /radare2-5.3.1.tar.gz /radare2-5.4.0.tar.gz +/radare2-5.4.2.tar.gz diff --git a/radare2.spec b/radare2.spec index af1ff22..4004fda 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.4.0 +Version: 5.4.2 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -316,6 +316,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 +- Update to version 5.4.2 + * Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 - Update to version 5.4.0 diff --git a/sources b/sources index 06b81a7..0483dbf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.4.0.tar.gz) = b77fef7eda7951b2a880e3131768280dc662338f25a44d4aad5990d01fa852250ed0395fa0639bf1cdb0a6d876ad74da3da2f59362231c41f56a552709ce7e09 +SHA512 (radare2-5.4.2.tar.gz) = 238d36489be6cdd9a59fe2af61f78fb2b9cd48f0529d5023b64b040f3a79ef3712119a9a120603c766a2eef027562032fb500173f8b4be21242559662fda2a9f From 0078dbd7ce95b7b3dd8fe3a3aff394f00af88b63 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jan 2022 17:25:44 +0000 Subject: [PATCH 058/116] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 4004fda..8aeff18 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.2 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -316,6 +316,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 - Update to version 5.4.2 From 222ff2c28692a192bd1879b0b56fd7552ae667b8 Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Mon, 31 Jan 2022 16:49:38 -0800 Subject: [PATCH 059/116] epel8-playground decommissioned : https://pagure.io/epel/issue/136 --- README.md | 3 --- dead.package | 1 + 2 files changed, 1 insertion(+), 3 deletions(-) delete mode 100644 README.md create mode 100644 dead.package diff --git a/README.md b/README.md deleted file mode 100644 index 6e0362e..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# radare2 - -radare2: the reverse engineering framework \ No newline at end of file diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..a72aec0 --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +epel8-playground decommissioned : https://pagure.io/epel/issue/136 From 326a1665b8230e3aa35dc298b6fe656932b2f636 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 11 Feb 2022 23:06:26 +0100 Subject: [PATCH 060/116] bump to 5.6.0 --- .gitignore | 1 + radare2.spec | 25 +++++++++++++++++++------ sources | 2 +- 3 files changed, 21 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 49d0e0b..6eef4bc 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ /radare2-5.3.1.tar.gz /radare2-5.4.0.tar.gz /radare2-5.4.2.tar.gz +/radare2-5.6.0.tar.gz diff --git a/radare2.spec b/radare2.spec index 8aeff18..1c8471a 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.4.2 +Version: 5.6.0 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -21,16 +21,16 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20210601 -%global commit ee753c25094c6e1c62dfb9596423824251dbc943 +%global gitdate 20220202 +%global commit e9e600a9a4c22a1e4aa901ab50e1d744648bd722 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.2 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif @@ -213,7 +213,7 @@ information sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif # Removing zip/lzip and lz4 files because we use system dependencies -rm -rf shlr/zip shlr/lz4 +rm -rf shlr/zip/{zip,zlib,include} shlr/lz4 # Remove xxhash files because we use system dependencies rm -f libr/hash/xxhash.c libr/hash/xxhash.h @@ -316,6 +316,15 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed Feb 09 2022 Michal Ambroz 5.6.0-1 +- bump to 5.6.0 +- fix CVE-2022-0419 +- fix CVE-2021-4021 + +* Wed Jan 26 2022 Henrik Nordstrom - 5.5.4-1 +- Update to version 5.5.4 +- should be fixing CVE-2021-4021 + * Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild @@ -324,6 +333,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 - Update to version 5.4.0 +- Fix CVE-2021-3673 * Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild @@ -375,10 +385,13 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 - Rebase to upstream version 4.5.0 + * Fri May 8 2020 Riccardo Schirone - 4.4.0-2 - Just re-build + * Mon May 4 2020 Riccardo Schirone - 4.4.0-1 - Rebase to upstream version 4.4.0 + * Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 - Rebase to upstream version 4.2.1 - Fix CVE-2019-19647 diff --git a/sources b/sources index 0483dbf..509a9bd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.4.2.tar.gz) = 238d36489be6cdd9a59fe2af61f78fb2b9cd48f0529d5023b64b040f3a79ef3712119a9a120603c766a2eef027562032fb500173f8b4be21242559662fda2a9f +SHA512 (radare2-5.6.0.tar.gz) = 6eaac2c399ad3c50f8acecf6e90b0b16ae69e19401ca9cdea0345ac9c6e617e8c9719a642caf55e929c350d3cba6d549849c6e196a2893a4ab8d996f8fbfe672 From fdac0ac3cd04edbdd549da2f22b5f5a978e43a56 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 12 Feb 2022 00:37:51 +0100 Subject: [PATCH 061/116] avoid using C99 on EPEL7 --- radare2-5.6.0-dec99.patch | 26 ++++++++++++++++++++++++++ radare2.spec | 9 ++++++++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 radare2-5.6.0-dec99.patch diff --git a/radare2-5.6.0-dec99.patch b/radare2-5.6.0-dec99.patch new file mode 100644 index 0000000..6adfa58 --- /dev/null +++ b/radare2-5.6.0-dec99.patch @@ -0,0 +1,26 @@ +diff -ru radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c +--- radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c 2022-02-02 13:29:26.000000000 +0100 ++++ radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c 2022-02-12 00:24:15.787894773 +0100 +@@ -1228,7 +1228,8 @@ + ase->la_opcode_ht[LA_INSN_HASH(it->match)] = it; + } + } +- for (int i=0; ila_opcode_ht[i]){ + ase->la_opcode_ht[i]=it; + } +diff -ru radare2-5.6.0/libr/core/disasm.c radare2-5.6.0.new/libr/core/disasm.c +--- radare2-5.6.0/libr/core/disasm.c 2022-02-02 13:29:26.000000000 +0100 ++++ radare2-5.6.0.new/libr/core/disasm.c 2022-02-12 00:28:26.325298373 +0100 +@@ -5483,7 +5483,8 @@ + if (p) { + core->asmqjmps_size = R_CORE_ASMQJMPS_NUM; + core->asmqjmps = p; +- for (int i = 0; i < R_CORE_ASMQJMPS_NUM; i++) { ++ int i; ++ for (i = 0; i < R_CORE_ASMQJMPS_NUM; i++) { + core->asmqjmps[i] = UT64_MAX; + } + } diff --git a/radare2.spec b/radare2.spec index 1c8471a..ab03f23 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.6.0 -%global rel 1 +%global rel 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -34,6 +34,10 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip %endif +# Declaration of variable in the for loop requires at least c99 compatibility mode +# This is specific to 5.6.0 and is already fixed in the git +Patch0: radare2-5.6.0-dec99.patch + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -316,6 +320,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed Feb 09 2022 Michal Ambroz 5.6.0-2 +- patch declaration of int i in for cycle to avoid C99 mode on EPEL7 + * Wed Feb 09 2022 Michal Ambroz 5.6.0-1 - bump to 5.6.0 - fix CVE-2022-0419 From 3adc78df62c28a55153bea8a1d9a39e84743fe61 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 12 Feb 2022 00:49:46 +0100 Subject: [PATCH 062/116] add comment to the patch --- radare2-5.6.0-dec99.patch | 2 ++ 1 file changed, 2 insertions(+) diff --git a/radare2-5.6.0-dec99.patch b/radare2-5.6.0-dec99.patch index 6adfa58..511b873 100644 --- a/radare2-5.6.0-dec99.patch +++ b/radare2-5.6.0-dec99.patch @@ -1,3 +1,5 @@ +Declaration of variable in the for loop requires at least c99 compatibility mode +This is specific to 5.6.0 and is already fixed in the git diff -ru radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c --- radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c 2022-02-02 13:29:26.000000000 +0100 +++ radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c 2022-02-12 00:24:15.787894773 +0100 From be3c696235580bb67f11bd22e8d40578fb7819e4 Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 22 Feb 2022 02:59:41 +0100 Subject: [PATCH 063/116] fix build error when building with system lz4 --- radare2-5.6.2-lz4.patch | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 radare2-5.6.2-lz4.patch diff --git a/radare2-5.6.2-lz4.patch b/radare2-5.6.2-lz4.patch new file mode 100644 index 0000000..025608f --- /dev/null +++ b/radare2-5.6.2-lz4.patch @@ -0,0 +1,31 @@ +From cfc1c5d2023a90817b008564f8bda6bcf1140e04 Mon Sep 17 00:00:00 2001 +From: pancake +Date: Mon, 21 Feb 2022 19:32:51 +0100 +Subject: [PATCH] Fix #19726 - fix meson definition order issue when using + syslz4 ##build + +--- + libr/util/meson.build | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/libr/util/meson.build b/libr/util/meson.build +index f2613e5c03b..745fe2fc897 100644 +--- a/libr/util/meson.build ++++ b/libr/util/meson.build +@@ -96,6 +96,7 @@ if get_option('sdb_cgen') + r_util_sources += r_util_d_sources + endif + ++r_util_deps = [ldl, mth, spp_dep, pth, utl, sdb_dep, zlib_dep, platform_deps] + if lz4_dep.found() and get_option('use_sys_lz4') + # r_util_deps += lz4_dep + r_util_deps += declare_dependency( +@@ -105,8 +106,6 @@ if lz4_dep.found() and get_option('use_sys_lz4') + else + r_util_sources += '../../shlr/lz4/lz4.c' + endif +- +-r_util_deps = [ldl, mth, spp_dep, pth, utl, sdb_dep, zlib_dep, platform_deps] + if host_machine.system().startswith('freebsd') or host_machine.system().startswith('netbsd') or host_machine.system().startswith('haiku') + # backtrace_symbols_fd requires -lexecinfo + r_util_deps += [cc.find_library('execinfo')] From f21104d0a731cb1f3741a50fc87ed8a1eb493ce4 Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 1 Mar 2022 01:14:32 +0100 Subject: [PATCH 064/116] bump to 5.6.4, disable multithreading for iaito --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 6eef4bc..eacf5e3 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ /radare2-5.4.0.tar.gz /radare2-5.4.2.tar.gz /radare2-5.6.0.tar.gz +/radare2-5.6.4.tar.gz diff --git a/sources b/sources index 509a9bd..3e0e0e9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.6.0.tar.gz) = 6eaac2c399ad3c50f8acecf6e90b0b16ae69e19401ca9cdea0345ac9c6e617e8c9719a642caf55e929c350d3cba6d549849c6e196a2893a4ab8d996f8fbfe672 +SHA512 (radare2-5.6.4.tar.gz) = 5e7ff9c5d73685a4a0167750f74bb7ddcb19d3e3d2a306d8eea00b4f961efdbed4843f6e3ff66ef7108a91d372fc403eaf7343a3f4d1bada4e5ac243529e2593 From ee0e3a860937d581b363ac76badebe7d43bae16e Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 1 Mar 2022 01:15:21 +0100 Subject: [PATCH 065/116] bump to 5.6.4, disable multithreading for iaito --- .gitignore | 1 + radare2.spec | 26 ++++++++++++++++++-------- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index eacf5e3..48bd1ae 100644 --- a/.gitignore +++ b/.gitignore @@ -19,4 +19,5 @@ /radare2-5.4.0.tar.gz /radare2-5.4.2.tar.gz /radare2-5.6.0.tar.gz +/radare2-5.6.2.tar.gz /radare2-5.6.4.tar.gz diff --git a/radare2.spec b/radare2.spec index ab03f23..72c3aef 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.6.0 -%global rel 2 +Version: 5.6.4 +%global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20220202 -%global commit e9e600a9a4c22a1e4aa901ab50e1d744648bd722 +%global gitdate 20220228 +%global commit b636941cefcbc12b2031054e736b1f8e5458be32 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -31,7 +31,7 @@ Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif # Declaration of variable in the for loop requires at least c99 compatibility mode @@ -216,8 +216,10 @@ information # Rename internal "version-git" to "version" sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif -# Removing zip/lzip and lz4 files because we use system dependencies -rm -rf shlr/zip/{zip,zlib,include} shlr/lz4 +# Removing zip/lzip files because we use system dependencies +rm -rf shlr/zip/{zip,zlib,include} +# Not removing the LZ4 source code - hardcoded +# rm -rf shlr/lz4 # Remove xxhash files because we use system dependencies rm -f libr/hash/xxhash.c libr/hash/xxhash.h @@ -251,7 +253,8 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil %endif -Duse_sys_capstone=true \ -Denable_tests=false \ - -Denable_r2r=false + -Denable_r2r=false \ + -Dwant_threads=false # multithreading doesn't work well with Iaito package %meson_build @@ -320,6 +323,13 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Mon Feb 28 2022 Michal Ambroz 5.6.4-1 +- bump to 5.6.4 + +* Wed Feb 09 2022 Michal Ambroz 5.6.2-1 +- bump to 5.6.2 +- disable multithreading for now to be able to compile with iaito + * Wed Feb 09 2022 Michal Ambroz 5.6.0-2 - patch declaration of int i in for cycle to avoid C99 mode on EPEL7 From 1f57a367534c2888aca623183c868533572e3cd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Tue, 12 Apr 2022 22:42:26 +0200 Subject: [PATCH 066/116] Bump to 5.6.6 --- .gitignore | 1 + radare2.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 48bd1ae..60952c3 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ /radare2-5.6.0.tar.gz /radare2-5.6.2.tar.gz /radare2-5.6.4.tar.gz +/radare2-5.6.6.tar.gz diff --git a/radare2.spec b/radare2.spec index 72c3aef..69fcab1 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.6.4 +Version: 5.6.6 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -323,6 +323,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue Apr 12 2922 Henrikj Nordstrom 5.6.6-1 +- bump to 5.6.6 + * Mon Feb 28 2022 Michal Ambroz 5.6.4-1 - bump to 5.6.4 diff --git a/sources b/sources index 3e0e0e9..5dd77c4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.6.4.tar.gz) = 5e7ff9c5d73685a4a0167750f74bb7ddcb19d3e3d2a306d8eea00b4f961efdbed4843f6e3ff66ef7108a91d372fc403eaf7343a3f4d1bada4e5ac243529e2593 +SHA512 (radare2-5.6.6.tar.gz) = 0969d923b0c65c937dadb3cef655a3931b3daf1fc48bf1f6e3dd1afd1df54f65da3baf4bd401eb1677f88566774ed115c271cdc923dc4ef800ef867f4849efb0 From cb6504ca9db9ec1122c78d77bfb7db8dad94aad7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Wed, 13 Apr 2022 01:10:13 +0200 Subject: [PATCH 067/116] A number of CVE fixes --- CVE-2022-1061.patch | 29 ++++++ CVE-2022-1207.patch | 98 ++++++++++++++++++++ CVE-2022-1237.patch | 98 ++++++++++++++++++++ CVE-2022-1238-2.patch | 205 ++++++++++++++++++++++++++++++++++++++++++ CVE-2022-1238.patch | 35 ++++++++ CVE-2022-1240.patch | 23 +++++ CVE-2022-1244.patch | 34 +++++++ CVE-2022-1283.patch | 33 +++++++ CVE-2022-1284.patch | 36 ++++++++ CVE-2022-1296.patch | 83 +++++++++++++++++ CVE-2022-1297.patch | 39 ++++++++ radare2.spec | 42 ++++++++- 12 files changed, 753 insertions(+), 2 deletions(-) create mode 100644 CVE-2022-1061.patch create mode 100644 CVE-2022-1207.patch create mode 100644 CVE-2022-1237.patch create mode 100644 CVE-2022-1238-2.patch create mode 100644 CVE-2022-1238.patch create mode 100644 CVE-2022-1240.patch create mode 100644 CVE-2022-1244.patch create mode 100644 CVE-2022-1283.patch create mode 100644 CVE-2022-1284.patch create mode 100644 CVE-2022-1296.patch create mode 100644 CVE-2022-1297.patch diff --git a/CVE-2022-1061.patch b/CVE-2022-1061.patch new file mode 100644 index 0000000..affd9b7 --- /dev/null +++ b/CVE-2022-1061.patch @@ -0,0 +1,29 @@ +commit d4ce40b516ffd70cf2e9e36832d8de139117d522 +Author: Sergi Àlvarez i Capilla +Date: Thu Mar 24 10:11:29 2022 +0100 + + Fix oobread in symbols header parsing ##bin + +diff --git a/libr/bin/p/bin_symbols.c b/libr/bin/p/bin_symbols.c +index 2036dc092..779e36940 100644 +--- a/libr/bin/p/bin_symbols.c ++++ b/libr/bin/p/bin_symbols.c +@@ -181,7 +181,7 @@ static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy + + static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) { + D eprintf ("Dragons at 0x%x\n", off); +- ut64 size = r_buf_size (buf); ++ st64 size = r_buf_size (buf); + if (off >= size) { + return NULL; + } +@@ -189,6 +189,9 @@ static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, i + if (!size) { + return NULL; + } ++ if (size < 32) { ++ return NULL; ++ } + ut8 *b = malloc (size); + if (!b) { + return NULL; diff --git a/CVE-2022-1207.patch b/CVE-2022-1207.patch new file mode 100644 index 0000000..91f0f3e --- /dev/null +++ b/CVE-2022-1207.patch @@ -0,0 +1,98 @@ +commit 605785b65dd356d46d4487faa41dbf90943b8bc1 +Author: pancake +Date: Fri Apr 1 21:03:24 2022 +0200 + + Fix 1 byte oobread in the cris analysis plugin ##crash + +diff --git a/libr/anal/p/anal_cris.c b/libr/anal/p/anal_cris.c +index 2b95c37e0..db30421ed 100644 +--- a/libr/anal/p/anal_cris.c ++++ b/libr/anal/p/anal_cris.c +@@ -1,4 +1,4 @@ +-/* radare2 - LGPL - Copyright 2014-2015 - pancake */ ++/* radare2 - LGPL - Copyright 2014-2022 - pancake */ + + #include + #include +@@ -7,6 +7,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + int opsize = -1; + op->type = -1; + opsize = 2; ++ if (len < 1) { ++ return -1; ++ } + switch (buf[0]) { + case 0x3f: + case 0x4f: +@@ -21,9 +24,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + op->type = R_ANAL_OP_TYPE_LEA; + if (len > 5) { + op->ptr = buf[2]; +- op->ptr |= buf[3]<<8; +- op->ptr |= buf[4]<<16; +- op->ptr |= ((ut32)(0xff&buf[5]))<<24; ++ op->ptr |= buf[3] << 8; ++ op->ptr |= buf[4] << 16; ++ op->ptr |= ((ut32)(0xff & buf[5])) << 24; + op->ptr += addr; + opsize = 6; + } else { +@@ -35,9 +38,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + op->type = R_ANAL_OP_TYPE_CALL; + if (len > 5) { + st32 delta = buf[2]; +- delta |= buf[3]<<8; +- delta |= buf[4]<<16; +- delta |= buf[5]<<24; ++ delta |= buf[3] << 8; ++ delta |= buf[4] << 16; ++ delta |= buf[5] << 24; + op->jump = addr + delta; + } else { + op->jump = UT64_MAX; +@@ -46,6 +49,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + opsize = 6; + break; + case 0x00: ++ if (len < 2) { ++ break; ++ } + if (buf[1] == 0x00) { + op->type = R_ANAL_OP_TYPE_TRAP; + } else { +@@ -57,11 +63,17 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + } + break; + case 0xf0: +- if (buf[1]==0xb9) { ++ if (len < 2) { ++ break; ++ } ++ if (buf[1] == 0xb9) { + op->type = R_ANAL_OP_TYPE_RET; + } + break; + default: ++ if (len < 2) { ++ break; ++ } + switch (buf[1]) { + case 0x00: + op->type = R_ANAL_OP_TYPE_CJMP; // BCC +@@ -70,7 +82,7 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + op->type = R_ANAL_OP_TYPE_SHR; + break; + case 0x96: // move.d r, r +- if (buf[0] >=0xc0) { ++ if (buf[0] >= 0xc0) { + op->type = R_ANAL_OP_TYPE_CMP; + } else { + op->type = R_ANAL_OP_TYPE_MOV; +@@ -242,6 +254,7 @@ static bool set_reg_profile(RAnal *anal) { + "=PC pc\n" + "=SP r14\n" // XXX + "=BP srp\n" // XXX ++ "=SN r0\n" + "=A0 r0\n" + "=A1 r1\n" + "=A2 r2\n" diff --git a/CVE-2022-1237.patch b/CVE-2022-1237.patch new file mode 100644 index 0000000..56f2441 --- /dev/null +++ b/CVE-2022-1237.patch @@ -0,0 +1,98 @@ +commit 2d782cdaa2112c10b8dd5e7a93c134b2ada9c1a6 +Author: pancake +Date: Tue Apr 5 11:31:24 2022 +0200 + + Fix oobread segfaults in the NE bin parser ##crash + + * Reported by @han0nly via huntr.dev + * Reproducers: seed1 seed2 + * BountyID: ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40 + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index d26860b26..210fe0369 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -1,4 +1,4 @@ +-/* radare - LGPL - Copyright 2019 - GustavoLCR */ ++/* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ + + #include "ne.h" + +@@ -83,10 +83,10 @@ RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) { + RList *segments = r_list_newf (free); + for (i = 0; i < bin->ne_header->SegCount; i++) { + RBinSection *bs = R_NEW0 (RBinSection); +- NE_image_segment_entry *se = &bin->segment_entries[i]; + if (!bs) { + return segments; + } ++ NE_image_segment_entry *se = &bin->segment_entries[i]; + bs->size = se->length; + bs->vsize = se->minAllocSz ? se->minAllocSz : 64000; + bs->bits = R_SYS_BITS_16; +@@ -425,7 +425,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + return NULL; + } + +- ut16 *modref = malloc (bin->ne_header->ModRefs * sizeof (ut16)); ++ ut16 *modref = calloc (bin->ne_header->ModRefs, sizeof (ut16)); + if (!modref) { + return NULL; + } +@@ -451,7 +451,8 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + continue; + } + off += 2; +- while (off < start + length * sizeof (NE_image_reloc_item)) { ++ size_t buf_size = r_buf_size (bin->buf); ++ while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { + RBinReloc *reloc = R_NEW0 (RBinReloc); + if (!reloc) { + return NULL; +@@ -484,10 +485,11 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + break; + } + char *name; +- if (rel.index > bin->ne_header->ModRefs) { ++ if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { + name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? + } else { +- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; ++ int index = rel.index; ++ offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; + name = __read_nonnull_str_at (bin->buf, offset); + } + if (rel.flags & IMPORTED_ORD) { +@@ -563,7 +565,14 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + return; + } + bin->buf = buf; ++ // XXX this is endian unsafe + r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); ++ if (bin->ne_header->FileAlnSzShftCnt > 8) { ++ bin->ne_header->FileAlnSzShftCnt = 8; ++ } ++ if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { ++ bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); ++ } + bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; + if (!bin->alignment) { + bin->alignment = 1 << 9; +@@ -571,8 +580,16 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + bin->os = __get_target_os (bin); + + ut16 offset = bin->ne_header->SegTableOffset + bin->header_offset; +- ut16 size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); ++ size_t size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); ++ if (offset >= r_buf_size (bin->buf)) { ++ return; ++ } ++ size_t remaining = r_buf_size (bin->buf) - offset; ++ size = R_MIN (remaining, size); + bin->segment_entries = calloc (1, size); ++ if (size >= remaining) { ++ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); ++ } + if (!bin->segment_entries) { + return; + } diff --git a/CVE-2022-1238-2.patch b/CVE-2022-1238-2.patch new file mode 100644 index 0000000..cddec23 --- /dev/null +++ b/CVE-2022-1238-2.patch @@ -0,0 +1,205 @@ +commit c35d1629422a12fafb0b3d379c8739c7894521e9 +Author: pancake +Date: Tue Apr 5 12:06:37 2022 +0200 + + Fix another oobread in the NE parser ##crash + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index ad7c86be1..f080e937f 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -1,6 +1,7 @@ + /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ + + #include "ne.h" ++#define NE_BUG 0 + + static char *__get_target_os(r_bin_ne_obj_t *bin) { + switch (bin->ne_header->targOS) { +@@ -355,26 +356,28 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + if (!entries) { + return NULL; + } +- RBinAddr *entry; + RList *segments = r_bin_ne_get_segments (bin); + if (!segments) { + r_list_free (entries); + return NULL; + } + if (bin->ne_header->csEntryPoint) { +- entry = R_NEW0 (RBinAddr); ++ RBinAddr *entry = R_NEW0 (RBinAddr); + if (!entry) { + r_list_free (entries); + return NULL; + } + entry->bits = 16; +- RBinSection *s = r_list_get_n (segments, bin->ne_header->csEntryPoint - 1); ++ ut32 entry_cs = bin->ne_header->csEntryPoint; ++ RBinSection *s = r_list_get_n (segments, entry_cs - 1); + entry->paddr = bin->ne_header->ipEntryPoint + (s? s->paddr: 0); ++ + r_list_append (entries, entry); + } + int off = 0; ++ size_t tableat = bin->header_offset + bin->ne_header->EntryTableOffset; + while (off < bin->ne_header->EntryTableLength) { +- if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { ++ if (tableat + off >= r_buf_size (bin->buf)) { + break; + } + ut8 bundle_length = *(ut8 *)(bin->entry_table + off); +@@ -386,7 +389,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + off++; + int i; + for (i = 0; i < bundle_length; i++) { +- entry = R_NEW0 (RBinAddr); ++ if (tableat + off + 4 >= r_buf_size (bin->buf)) { ++ break; ++ } ++ RBinAddr *entry = R_NEW0 (RBinAddr); + if (!entry) { + r_list_free (entries); + return NULL; +@@ -396,7 +402,7 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + off--; + free (entry); + break; +- } else if (bundle_type == 0xFF) { // Moveable ++ } else if (bundle_type == 0xff) { // moveable + off += 2; + ut8 segnum = *(bin->entry_table + off); + off++; +@@ -405,7 +411,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; + } + } else { // Fixed +- entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); ++ if (bundle_type < bin->ne_header->SegCount) { ++ entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset ++ * bin->alignment + *(ut16 *)(bin->entry_table + off); ++ } + } + off += 2; + r_list_append (entries, entry); +@@ -450,20 +459,24 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + if (!(bin->segment_entries[index].flags & RELOCINFO)) { + continue; + } +- ut32 off, start = off = seg->paddr + seg->size; ++ ut32 off = seg->paddr + seg->size; ++ ut32 start = off; + ut16 length = r_buf_read_le16_at (bin->buf, off); + if (!length) { + continue; + } + off += 2; +- size_t buf_size = r_buf_size (bin->buf); +- while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { ++ // size_t buf_size = r_buf_size (bin->buf); ++ while (off < start + length * sizeof (NE_image_reloc_item)) { ++ // && off + sizeof (NE_image_reloc_item) < buf_size) ++ NE_image_reloc_item rel = {0}; ++ if (r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)) < 1) { ++ return NULL; ++ } + RBinReloc *reloc = R_NEW0 (RBinReloc); + if (!reloc) { + return NULL; + } +- NE_image_reloc_item rel; +- r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)); + reloc->paddr = seg->paddr + rel.offset; + switch (rel.type) { + case LOBYTE: +@@ -490,13 +503,21 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + break; + } + char *name; +- if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { ++#if NE_BUG ++ if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { ++ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; ++ name = __read_nonnull_str_at (bin->buf, offset); ++ } else { ++ name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? ++ } ++#else ++ if (rel.index > bin->ne_header->ModRefs) { + name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? + } else { +- int index = rel.index; +- offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; ++ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; + name = __read_nonnull_str_at (bin->buf, offset); + } ++#endif + if (rel.flags & IMPORTED_ORD) { + imp->ordinal = rel.func_ord; + imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); +@@ -542,8 +563,12 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + r_list_append (relocs, reloc); + } else { + do { ++#if NE_BUG ++ if (reloc->paddr + 4 < r_buf_size (bin->buf)) { ++ break; ++ } ++#endif + r_list_append (relocs, reloc); +- + offset = r_buf_read_le16_at (bin->buf, reloc->paddr); + RBinReloc *tmp = reloc; + reloc = R_NEW0 (RBinReloc); +@@ -571,12 +596,17 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + } + bin->buf = buf; + // XXX this is endian unsafe +- r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); +- if (bin->ne_header->FileAlnSzShftCnt > 8) { +- bin->ne_header->FileAlnSzShftCnt = 8; ++ if (r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)) < 1) { ++ R_FREE (bin->ne_header); ++ return; ++ } ++ if (bin->ne_header->FileAlnSzShftCnt > 15) { ++ bin->ne_header->FileAlnSzShftCnt = 15; + } +- if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { +- bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); ++ ut64 from = bin->ne_header->ModRefTable + bin->header_offset; ++ ut64 left = r_buf_size (bin->buf) - from; ++ if (from + bin->ne_header->ModRefs * sizeof (ut16) >= left) { ++ bin->ne_header->ModRefs = left / sizeof (ut16); + } + bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; + if (!bin->alignment) { +@@ -591,6 +621,7 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + } + size_t remaining = r_buf_size (bin->buf) - offset; + size = R_MIN (remaining, size); ++ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); // * sizeof (NE_image_segment_entry); + bin->segment_entries = calloc (1, size); + if (size >= remaining) { + bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); +@@ -599,7 +630,11 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + return; + } + r_buf_read_at (buf, offset, (ut8 *)bin->segment_entries, size); +- bin->entry_table = calloc (1, bin->ne_header->EntryTableLength); ++ bin->entry_table = calloc (4, bin->ne_header->EntryTableLength); ++ if (!bin->entry_table) { ++ R_FREE (bin->segment_entries); ++ return; ++ } + r_buf_read_at (buf, (ut64)bin->header_offset + bin->ne_header->EntryTableOffset, bin->entry_table, bin->ne_header->EntryTableLength); + bin->imports = r_bin_ne_get_imports (bin); + __ne_get_resources (bin); +@@ -612,6 +647,7 @@ void r_bin_ne_free(r_bin_ne_obj_t *bin) { + free (bin->ne_header); + free (bin->resident_name_table); + free (bin->segment_entries); ++ free (bin); + } + + r_bin_ne_obj_t *r_bin_ne_new_buf(RBuffer *buf, bool verbose) { diff --git a/CVE-2022-1238.patch b/CVE-2022-1238.patch new file mode 100644 index 0000000..3f68500 --- /dev/null +++ b/CVE-2022-1238.patch @@ -0,0 +1,35 @@ +commit c40a4f9862104ede15d0ba05ccbf805923070778 +Author: pancake +Date: Tue Apr 5 11:44:46 2022 +0200 + + Fix another oobread segfault in the NE bin parser ##crash + + * Reported by @han0nly via huntr.dev + * Reproducers: sample1 sample2 sample3 + * BountyID: 47422cdf-aad2-4405-a6a1-6f63a3a93200 + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index 210fe0369..ad7c86be1 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -374,6 +374,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + } + int off = 0; + while (off < bin->ne_header->EntryTableLength) { ++ if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { ++ break; ++ } + ut8 bundle_length = *(ut8 *)(bin->entry_table + off); + if (!bundle_length) { + break; +@@ -398,7 +401,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + ut8 segnum = *(bin->entry_table + off); + off++; + ut16 segoff = *(ut16 *)(bin->entry_table + off); +- entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; ++ if (segnum > 0) { ++ entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; ++ } + } else { // Fixed + entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); + } diff --git a/CVE-2022-1240.patch b/CVE-2022-1240.patch new file mode 100644 index 0000000..2fadbdf --- /dev/null +++ b/CVE-2022-1240.patch @@ -0,0 +1,23 @@ +commit ca8d8b39f3e34a4fd943270330b80f1148129de4 +Author: pancake +Date: Tue Apr 5 11:52:32 2022 +0200 + + Fix oobread in the macho parser ##crash + + * Reported by @Han0nly via huntr.dev + * Reproducers: heapoverflow1 + * BountyID: e589bd97-4c74-4e79-93b5-0951a281facc + +diff --git a/libr/bin/format/mach0/mach0.c b/libr/bin/format/mach0/mach0.c +index 1bf09233a..8aaf3f49a 100644 +--- a/libr/bin/format/mach0/mach0.c ++++ b/libr/bin/format/mach0/mach0.c +@@ -3178,7 +3178,7 @@ static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs, + for (i = 0; i < num; i++) { + struct relocation_info a_info = info[i]; + ut32 sym_num = a_info.r_symbolnum; +- if (sym_num > bin->nsymtab) { ++ if (sym_num >= bin->nsymtab) { + continue; + } + diff --git a/CVE-2022-1244.patch b/CVE-2022-1244.patch new file mode 100644 index 0000000..9892952 --- /dev/null +++ b/CVE-2022-1244.patch @@ -0,0 +1,34 @@ +commit 2b77b277d67ce061ee6ef839e7139ebc2103c1e3 +Author: pancake +Date: Tue Apr 5 19:39:26 2022 +0200 + + Fix oobread in dyldcache ##crash + + * Reported by @hdthky via huntr.dev + * Reproducers: poc1 + * BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82 + +diff --git a/libr/bin/format/mach0/dyldcache.h b/libr/bin/format/mach0/dyldcache.h +index 9f00182cd..21e598abb 100644 +--- a/libr/bin/format/mach0/dyldcache.h ++++ b/libr/bin/format/mach0/dyldcache.h +@@ -1,4 +1,4 @@ +-/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */ ++/* radare - LGPL - Copyright 2009-2022 nibble, pancake */ + + #include + #include "mach0_specs.h" +diff --git a/libr/bin/p/bin_dyldcache.c b/libr/bin/p/bin_dyldcache.c +index 0dc9d16a6..0d9af87a9 100644 +--- a/libr/bin/p/bin_dyldcache.c ++++ b/libr/bin/p/bin_dyldcache.c +@@ -1247,7 +1247,8 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) { + if (deps && !deps[j]) { + continue; + } +- ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); ++ // ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); ++ ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); + if (pa == UT64_MAX) { + continue; + } diff --git a/CVE-2022-1283.patch b/CVE-2022-1283.patch new file mode 100644 index 0000000..41066f2 --- /dev/null +++ b/CVE-2022-1283.patch @@ -0,0 +1,33 @@ +commit 18d1d064bf599a255d55f09fca3104776fc34a67 +Author: Sergi Àlvarez i Capilla +Date: Fri Apr 8 19:49:21 2022 +0200 + + Fix null deref in the ne parser ##crash + + * Reported by @hmsec via huntr.dev + * Reproducer: nepoc00 + * BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013 + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index f080e937f..ee2df871a 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -115,7 +115,7 @@ RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) { + } + RList *entries = r_bin_ne_get_entrypoints (bin); + bool resident = true, first = true; +- while (true) { ++ while (entries) { + ut8 sz = r_buf_read8_at (bin->buf, off); + if (!sz) { + first = true; +@@ -352,6 +352,9 @@ RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) { + } + + RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { ++ if (!bin->entry_table) { ++ return NULL; ++ } + RList *entries = r_list_newf (free); + if (!entries) { + return NULL; diff --git a/CVE-2022-1284.patch b/CVE-2022-1284.patch new file mode 100644 index 0000000..4278af5 --- /dev/null +++ b/CVE-2022-1284.patch @@ -0,0 +1,36 @@ +commit 64a82e284dddabaeb549228380103b57dead32a6 +Author: Sergi Àlvarez i Capilla +Date: Fri Apr 8 20:39:43 2022 +0200 + + Fix UAF in `aaef` ##crash + + * Reported by @hdthky + * Reproducer: uaf-aef + * BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7 + +diff --git a/libr/core/canal.c b/libr/core/canal.c +index fb53e75fc..610cd22f2 100644 +--- a/libr/core/canal.c ++++ b/libr/core/canal.c +@@ -5295,10 +5295,6 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { + arch = R2_ARCH_MIPS; + } + +- const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); +- if (!sn) { +- eprintf ("Warning: No SN reg alias for current architecture.\n"); +- } + r_reg_arena_push (core->anal->reg); + + IterCtx ictx = { start, end, fcn, NULL }; +@@ -5409,6 +5405,10 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { + goto repeat; + } + } ++ const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); ++ if (!sn) { ++ eprintf ("Warning: No SN reg alias for current architecture.\n"); ++ } + if (sn && op.type == R_ANAL_OP_TYPE_SWI) { + r_strf_buffer (64); + r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS); diff --git a/CVE-2022-1296.patch b/CVE-2022-1296.patch new file mode 100644 index 0000000..2ac950b --- /dev/null +++ b/CVE-2022-1296.patch @@ -0,0 +1,83 @@ +commit 153bcdc29f11cd8c90e7d639a7405450f644ddb6 +Author: Sergi Àlvarez i Capilla +Date: Fri Apr 8 20:14:32 2022 +0200 + + Fix oobread in NE parser ##crash + + * Reported by @hmsec via huntr.dev + * Reproducer: necrash + * BountyID: 52b57274-0e1a-4d61-ab29-1373b555fea0/ + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index ee2df871a..b907d56e9 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -1,7 +1,6 @@ + /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ + + #include "ne.h" +-#define NE_BUG 0 + + static char *__get_target_os(r_bin_ne_obj_t *bin) { + switch (bin->ne_header->targOS) { +@@ -505,25 +504,18 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + free (reloc); + break; + } +- char *name; +-#if NE_BUG +- if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { +- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; +- name = __read_nonnull_str_at (bin->buf, offset); +- } else { +- name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? +- } +-#else ++ char *name = NULL; + if (rel.index > bin->ne_header->ModRefs) { + name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? +- } else { ++ } else if (rel.index > 0) { + offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; + name = __read_nonnull_str_at (bin->buf, offset); + } +-#endif + if (rel.flags & IMPORTED_ORD) { + imp->ordinal = rel.func_ord; +- imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); ++ char *fname = __func_name_from_ord (name, rel.func_ord); ++ imp->name = r_str_newf ("%s.%s", name, fname); ++ free (fname); + } else { + offset = bin->header_offset + bin->ne_header->ImportNameTable + rel.name_off; + char *func = __read_nonnull_str_at (bin->buf, offset); +@@ -566,6 +558,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + r_list_append (relocs, reloc); + } else { + do { ++#define NE_BUG 0 + #if NE_BUG + if (reloc->paddr + 4 < r_buf_size (bin->buf)) { + break; +diff --git a/test/db/formats/ne b/test/db/formats/ne +index 7b6834441..b71f29469 100644 +--- a/test/db/formats/ne ++++ b/test/db/formats/ne +@@ -1,3 +1,17 @@ ++NAME=NE crash ++FILE=bins/ne/necrash ++CMDS=< +Date: Mon Apr 11 13:35:52 2022 +0200 + + Fix oobread and unaligned casts in the NE entrypoint logic ##crash + + * Reported by @hmsec via huntr.dev + * Reproducer: nepocaligns + * BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index b907d56e9..32aa589e8 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -408,14 +408,21 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + off += 2; + ut8 segnum = *(bin->entry_table + off); + off++; +- ut16 segoff = *(ut16 *)(bin->entry_table + off); +- if (segnum > 0) { ++ if (off > bin->ne_header->EntryTableLength) { ++ break; ++ } ++ ut16 segoff = r_read_le16 (bin->entry_table + off); ++ if (segnum > 0 && segnum < bin->ne_header->SegCount) { + entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; + } + } else { // Fixed ++ if (off + 2 >= bin->ne_header->EntryTableLength) { ++ break; ++ } ++ ut16 delta = r_read_le16 (bin->entry_table + off); + if (bundle_type < bin->ne_header->SegCount) { + entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset +- * bin->alignment + *(ut16 *)(bin->entry_table + off); ++ * bin->alignment + delta; + } + } + off += 2; diff --git a/radare2.spec b/radare2.spec index 69fcab1..24ebd58 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.6.6 -%global rel 1 +%global rel 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -38,6 +38,39 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{nam # This is specific to 5.6.0 and is already fixed in the git Patch0: radare2-5.6.0-dec99.patch +# Upstream security patches + +# Bug #2068585 #2068586 +Patch100: CVE-2022-1061.patch + +# Bug #2074067 #2074066 +Patch110: CVE-2022-1207.patch + +# Bug #2073961 #2073962 +Patch120: CVE-2022-1237.patch + +# Bug #2073970 #2073971 +Patch130: CVE-2022-1238.patch +Patch131: CVE-2022-1238-2.patch + +# Bug #2073955 #2073956 +Patch140: CVE-2022-1240.patch + +# Bug #2073974 #2073975 +Patch150: CVE-2022-1244.patch + +# Bug #2073914 #2073910 +Patch160: CVE-2022-1283.patch + +# Bug #2073908 #2073907 +Patch170: CVE-2022-1284.patch + +# Bug #2074200 #2074199 +Patch180: CVE-2022-1296.patch + +# Bug #2074203 #2074204 +Patch190: CVE-2022-1297.patch + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -323,7 +356,12 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -* Tue Apr 12 2922 Henrikj Nordstrom 5.6.6-1 +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 +- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 + CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 + CVE-2022-1297 + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 - bump to 5.6.6 * Mon Feb 28 2022 Michal Ambroz 5.6.4-1 From 4ebfe2878d95b16bafe6f2327b30ad40399b4988 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Wed, 13 Apr 2022 04:02:16 +0200 Subject: [PATCH 068/116] refresh list of bundled libraries --- radare2.spec | 43 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 9 deletions(-) diff --git a/radare2.spec b/radare2.spec index 24ebd58..45951b5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.6.6 -%global rel 2 +%global rel 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -37,6 +37,9 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{nam # Declaration of variable in the for loop requires at least c99 compatibility mode # This is specific to 5.6.0 and is already fixed in the git Patch0: radare2-5.6.0-dec99.patch +Patch1: radare2-5.6.6-use_openssl.patch +Patch3: radare2-5.6.6-use_magic.patch +Patch4: radare2-5.6.6-use_lz4.patch # Upstream security patches @@ -84,16 +87,17 @@ License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and z # shlr/java - Apache 2.0 # shlr/sdb/src - MIT # shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) -# shlr/spp - MIT # shlr/squashfs/src - GPLv2+ -# shlr/tcc - LGPLv2+ +# libr/parse/c - LGPLv2+ # shlr/udis86 - 2 clause BSD -# shlr/wind - LGPL v3+ +# shlr/winkd - LGPL v3+ # shlr/spp - MIT # shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) # shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) # shlr/ptrace-wrap - LGPL v3+ # shlr/tree-sitter - MIT +# shlr/mpc - 2 clause BSD +# shlr/yxml - MIT # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -158,6 +162,7 @@ Requires: %{name}-common = %{version}-%{release} # compiled with -D use_sys_xxhash=true instead # ./libr/hash/{md4,md5,sha1,sha2}.{c,h} +# ./libr/util/big.c # compiled with -D use_sys_openssl=true instead # ./shlr/spp/README.md @@ -168,7 +173,7 @@ Provides: bundled(spp) = 1.2.0 # ./shlr/sdb/README.md # sdb is a simple string key/value database based on djb's cdb # https://github.com/radare/sdb -Provides: bundled(sdb) = 1.7.0 +Provides: bundled(sdb) = 1.8.6 # ./shlr/sdb/src/json/README # Based on js0n with a lot of modifications @@ -182,7 +187,7 @@ Provides: bundled(js0n) = 2018 # version from 2010/11/21 00:02:30, version of files ranges from v1.11 to v1.20 Provides: bundled(openbsdregex) = 1.11 -# ./shlr/tcc/README.md +# ./libr/parse/c/README.md # This is a stripped down version of tcc without the code generators and heavily modified. Provides: bundled(tcc) = 0.9.26 @@ -202,7 +207,7 @@ Provides: bundled(vavrdisasm) = 1.6 # It is not clear which version has been copied Provides: bundled(grub2) = 1.99~beta0 -# ./shlr/ptrace-wrap +# ./libr/io/ptrace_wrap.c # https://github.com/thestr4ng3r/ptrace-wrap Provides: bundled(ptrace-wrap) = 20181018 @@ -210,6 +215,16 @@ Provides: bundled(ptrace-wrap) = 20181018 # https://github.com/tree-sitter/tree-sitter Provides: bundled(tree-sitter) = 0.17.2 +# ./shlr/mpc +# https://github.com/orangeduck/mpc +Provides: bundled(mpc) = 0.8.7 + +# ./shlr/yxml +# https://dev.yorhel.nl/yxml +Provides: bundled(yxml) = 20201108 + +# and likely some more in libr/... borrowed from other projects + %description The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal @@ -251,10 +266,16 @@ sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif # Removing zip/lzip files because we use system dependencies rm -rf shlr/zip/{zip,zlib,include} -# Not removing the LZ4 source code - hardcoded -# rm -rf shlr/lz4 +# Remove lx4 files because we use system dependencies +rm -rf shlr/lz4/{deps.mk,LICENSE,lz4.*,Makefile,README.md} # Remove xxhash files because we use system dependencies rm -f libr/hash/xxhash.c libr/hash/xxhash.h +# Remove magic files because we use system dependencies +awk 'BEGIN {p=1} /#if USE_LIB_MAGIC/ {p=2; next} p==2 && /#else/ {p=0} p>0 {print}' libr/magic/magic.c > libr/magic/magic.c.stripped +rm -rf libr/magic/*.c +mv libr/magic/magic.c.stripped libr/magic/magic-libmagic.c +# Remove openssl files because we use system dependencies +rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui @@ -279,6 +300,7 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil -Duse_sys_zlib=true \ -Duse_sys_lz4=true \ -Duse_sys_xxhash=true \ + -Duse_ssl=true \ -Duse_sys_openssl=true \ -Duse_libuv=true \ %ifarch s390x @@ -356,6 +378,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue Apr 13 2022 Henrik Nordstrom 5.6.6-2 +- refresh list of bundled libraries and associated cleanup + * Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 - Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 From 2bb7e5547cb1617a28318448f5f070b3218f5f28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 21:45:33 +0200 Subject: [PATCH 069/116] 5.6.8 --- CVE-2022-1061.patch | 29 ------ CVE-2022-1207.patch | 98 -------------------- CVE-2022-1237.patch | 98 -------------------- CVE-2022-1238-2.patch | 205 ------------------------------------------ CVE-2022-1238.patch | 35 -------- CVE-2022-1240.patch | 23 ----- CVE-2022-1244.patch | 34 ------- CVE-2022-1283.patch | 33 ------- CVE-2022-1284.patch | 36 -------- CVE-2022-1296.patch | 83 ----------------- CVE-2022-1297.patch | 39 -------- radare2.spec | 41 ++------- 12 files changed, 5 insertions(+), 749 deletions(-) delete mode 100644 CVE-2022-1061.patch delete mode 100644 CVE-2022-1207.patch delete mode 100644 CVE-2022-1237.patch delete mode 100644 CVE-2022-1238-2.patch delete mode 100644 CVE-2022-1238.patch delete mode 100644 CVE-2022-1240.patch delete mode 100644 CVE-2022-1244.patch delete mode 100644 CVE-2022-1283.patch delete mode 100644 CVE-2022-1284.patch delete mode 100644 CVE-2022-1296.patch delete mode 100644 CVE-2022-1297.patch diff --git a/CVE-2022-1061.patch b/CVE-2022-1061.patch deleted file mode 100644 index affd9b7..0000000 --- a/CVE-2022-1061.patch +++ /dev/null @@ -1,29 +0,0 @@ -commit d4ce40b516ffd70cf2e9e36832d8de139117d522 -Author: Sergi Àlvarez i Capilla -Date: Thu Mar 24 10:11:29 2022 +0100 - - Fix oobread in symbols header parsing ##bin - -diff --git a/libr/bin/p/bin_symbols.c b/libr/bin/p/bin_symbols.c -index 2036dc092..779e36940 100644 ---- a/libr/bin/p/bin_symbols.c -+++ b/libr/bin/p/bin_symbols.c -@@ -181,7 +181,7 @@ static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy - - static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) { - D eprintf ("Dragons at 0x%x\n", off); -- ut64 size = r_buf_size (buf); -+ st64 size = r_buf_size (buf); - if (off >= size) { - return NULL; - } -@@ -189,6 +189,9 @@ static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, i - if (!size) { - return NULL; - } -+ if (size < 32) { -+ return NULL; -+ } - ut8 *b = malloc (size); - if (!b) { - return NULL; diff --git a/CVE-2022-1207.patch b/CVE-2022-1207.patch deleted file mode 100644 index 91f0f3e..0000000 --- a/CVE-2022-1207.patch +++ /dev/null @@ -1,98 +0,0 @@ -commit 605785b65dd356d46d4487faa41dbf90943b8bc1 -Author: pancake -Date: Fri Apr 1 21:03:24 2022 +0200 - - Fix 1 byte oobread in the cris analysis plugin ##crash - -diff --git a/libr/anal/p/anal_cris.c b/libr/anal/p/anal_cris.c -index 2b95c37e0..db30421ed 100644 ---- a/libr/anal/p/anal_cris.c -+++ b/libr/anal/p/anal_cris.c -@@ -1,4 +1,4 @@ --/* radare2 - LGPL - Copyright 2014-2015 - pancake */ -+/* radare2 - LGPL - Copyright 2014-2022 - pancake */ - - #include - #include -@@ -7,6 +7,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - int opsize = -1; - op->type = -1; - opsize = 2; -+ if (len < 1) { -+ return -1; -+ } - switch (buf[0]) { - case 0x3f: - case 0x4f: -@@ -21,9 +24,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - op->type = R_ANAL_OP_TYPE_LEA; - if (len > 5) { - op->ptr = buf[2]; -- op->ptr |= buf[3]<<8; -- op->ptr |= buf[4]<<16; -- op->ptr |= ((ut32)(0xff&buf[5]))<<24; -+ op->ptr |= buf[3] << 8; -+ op->ptr |= buf[4] << 16; -+ op->ptr |= ((ut32)(0xff & buf[5])) << 24; - op->ptr += addr; - opsize = 6; - } else { -@@ -35,9 +38,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - op->type = R_ANAL_OP_TYPE_CALL; - if (len > 5) { - st32 delta = buf[2]; -- delta |= buf[3]<<8; -- delta |= buf[4]<<16; -- delta |= buf[5]<<24; -+ delta |= buf[3] << 8; -+ delta |= buf[4] << 16; -+ delta |= buf[5] << 24; - op->jump = addr + delta; - } else { - op->jump = UT64_MAX; -@@ -46,6 +49,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - opsize = 6; - break; - case 0x00: -+ if (len < 2) { -+ break; -+ } - if (buf[1] == 0x00) { - op->type = R_ANAL_OP_TYPE_TRAP; - } else { -@@ -57,11 +63,17 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - } - break; - case 0xf0: -- if (buf[1]==0xb9) { -+ if (len < 2) { -+ break; -+ } -+ if (buf[1] == 0xb9) { - op->type = R_ANAL_OP_TYPE_RET; - } - break; - default: -+ if (len < 2) { -+ break; -+ } - switch (buf[1]) { - case 0x00: - op->type = R_ANAL_OP_TYPE_CJMP; // BCC -@@ -70,7 +82,7 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - op->type = R_ANAL_OP_TYPE_SHR; - break; - case 0x96: // move.d r, r -- if (buf[0] >=0xc0) { -+ if (buf[0] >= 0xc0) { - op->type = R_ANAL_OP_TYPE_CMP; - } else { - op->type = R_ANAL_OP_TYPE_MOV; -@@ -242,6 +254,7 @@ static bool set_reg_profile(RAnal *anal) { - "=PC pc\n" - "=SP r14\n" // XXX - "=BP srp\n" // XXX -+ "=SN r0\n" - "=A0 r0\n" - "=A1 r1\n" - "=A2 r2\n" diff --git a/CVE-2022-1237.patch b/CVE-2022-1237.patch deleted file mode 100644 index 56f2441..0000000 --- a/CVE-2022-1237.patch +++ /dev/null @@ -1,98 +0,0 @@ -commit 2d782cdaa2112c10b8dd5e7a93c134b2ada9c1a6 -Author: pancake -Date: Tue Apr 5 11:31:24 2022 +0200 - - Fix oobread segfaults in the NE bin parser ##crash - - * Reported by @han0nly via huntr.dev - * Reproducers: seed1 seed2 - * BountyID: ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40 - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index d26860b26..210fe0369 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -1,4 +1,4 @@ --/* radare - LGPL - Copyright 2019 - GustavoLCR */ -+/* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ - - #include "ne.h" - -@@ -83,10 +83,10 @@ RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) { - RList *segments = r_list_newf (free); - for (i = 0; i < bin->ne_header->SegCount; i++) { - RBinSection *bs = R_NEW0 (RBinSection); -- NE_image_segment_entry *se = &bin->segment_entries[i]; - if (!bs) { - return segments; - } -+ NE_image_segment_entry *se = &bin->segment_entries[i]; - bs->size = se->length; - bs->vsize = se->minAllocSz ? se->minAllocSz : 64000; - bs->bits = R_SYS_BITS_16; -@@ -425,7 +425,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - return NULL; - } - -- ut16 *modref = malloc (bin->ne_header->ModRefs * sizeof (ut16)); -+ ut16 *modref = calloc (bin->ne_header->ModRefs, sizeof (ut16)); - if (!modref) { - return NULL; - } -@@ -451,7 +451,8 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - continue; - } - off += 2; -- while (off < start + length * sizeof (NE_image_reloc_item)) { -+ size_t buf_size = r_buf_size (bin->buf); -+ while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { - RBinReloc *reloc = R_NEW0 (RBinReloc); - if (!reloc) { - return NULL; -@@ -484,10 +485,11 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - break; - } - char *name; -- if (rel.index > bin->ne_header->ModRefs) { -+ if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { - name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? - } else { -- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -+ int index = rel.index; -+ offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; - name = __read_nonnull_str_at (bin->buf, offset); - } - if (rel.flags & IMPORTED_ORD) { -@@ -563,7 +565,14 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - return; - } - bin->buf = buf; -+ // XXX this is endian unsafe - r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); -+ if (bin->ne_header->FileAlnSzShftCnt > 8) { -+ bin->ne_header->FileAlnSzShftCnt = 8; -+ } -+ if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { -+ bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); -+ } - bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; - if (!bin->alignment) { - bin->alignment = 1 << 9; -@@ -571,8 +580,16 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - bin->os = __get_target_os (bin); - - ut16 offset = bin->ne_header->SegTableOffset + bin->header_offset; -- ut16 size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); -+ size_t size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); -+ if (offset >= r_buf_size (bin->buf)) { -+ return; -+ } -+ size_t remaining = r_buf_size (bin->buf) - offset; -+ size = R_MIN (remaining, size); - bin->segment_entries = calloc (1, size); -+ if (size >= remaining) { -+ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); -+ } - if (!bin->segment_entries) { - return; - } diff --git a/CVE-2022-1238-2.patch b/CVE-2022-1238-2.patch deleted file mode 100644 index cddec23..0000000 --- a/CVE-2022-1238-2.patch +++ /dev/null @@ -1,205 +0,0 @@ -commit c35d1629422a12fafb0b3d379c8739c7894521e9 -Author: pancake -Date: Tue Apr 5 12:06:37 2022 +0200 - - Fix another oobread in the NE parser ##crash - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index ad7c86be1..f080e937f 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -1,6 +1,7 @@ - /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ - - #include "ne.h" -+#define NE_BUG 0 - - static char *__get_target_os(r_bin_ne_obj_t *bin) { - switch (bin->ne_header->targOS) { -@@ -355,26 +356,28 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - if (!entries) { - return NULL; - } -- RBinAddr *entry; - RList *segments = r_bin_ne_get_segments (bin); - if (!segments) { - r_list_free (entries); - return NULL; - } - if (bin->ne_header->csEntryPoint) { -- entry = R_NEW0 (RBinAddr); -+ RBinAddr *entry = R_NEW0 (RBinAddr); - if (!entry) { - r_list_free (entries); - return NULL; - } - entry->bits = 16; -- RBinSection *s = r_list_get_n (segments, bin->ne_header->csEntryPoint - 1); -+ ut32 entry_cs = bin->ne_header->csEntryPoint; -+ RBinSection *s = r_list_get_n (segments, entry_cs - 1); - entry->paddr = bin->ne_header->ipEntryPoint + (s? s->paddr: 0); -+ - r_list_append (entries, entry); - } - int off = 0; -+ size_t tableat = bin->header_offset + bin->ne_header->EntryTableOffset; - while (off < bin->ne_header->EntryTableLength) { -- if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { -+ if (tableat + off >= r_buf_size (bin->buf)) { - break; - } - ut8 bundle_length = *(ut8 *)(bin->entry_table + off); -@@ -386,7 +389,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - off++; - int i; - for (i = 0; i < bundle_length; i++) { -- entry = R_NEW0 (RBinAddr); -+ if (tableat + off + 4 >= r_buf_size (bin->buf)) { -+ break; -+ } -+ RBinAddr *entry = R_NEW0 (RBinAddr); - if (!entry) { - r_list_free (entries); - return NULL; -@@ -396,7 +402,7 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - off--; - free (entry); - break; -- } else if (bundle_type == 0xFF) { // Moveable -+ } else if (bundle_type == 0xff) { // moveable - off += 2; - ut8 segnum = *(bin->entry_table + off); - off++; -@@ -405,7 +411,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; - } - } else { // Fixed -- entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); -+ if (bundle_type < bin->ne_header->SegCount) { -+ entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset -+ * bin->alignment + *(ut16 *)(bin->entry_table + off); -+ } - } - off += 2; - r_list_append (entries, entry); -@@ -450,20 +459,24 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - if (!(bin->segment_entries[index].flags & RELOCINFO)) { - continue; - } -- ut32 off, start = off = seg->paddr + seg->size; -+ ut32 off = seg->paddr + seg->size; -+ ut32 start = off; - ut16 length = r_buf_read_le16_at (bin->buf, off); - if (!length) { - continue; - } - off += 2; -- size_t buf_size = r_buf_size (bin->buf); -- while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { -+ // size_t buf_size = r_buf_size (bin->buf); -+ while (off < start + length * sizeof (NE_image_reloc_item)) { -+ // && off + sizeof (NE_image_reloc_item) < buf_size) -+ NE_image_reloc_item rel = {0}; -+ if (r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)) < 1) { -+ return NULL; -+ } - RBinReloc *reloc = R_NEW0 (RBinReloc); - if (!reloc) { - return NULL; - } -- NE_image_reloc_item rel; -- r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)); - reloc->paddr = seg->paddr + rel.offset; - switch (rel.type) { - case LOBYTE: -@@ -490,13 +503,21 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - break; - } - char *name; -- if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { -+#if NE_BUG -+ if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { -+ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -+ name = __read_nonnull_str_at (bin->buf, offset); -+ } else { -+ name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? -+ } -+#else -+ if (rel.index > bin->ne_header->ModRefs) { - name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? - } else { -- int index = rel.index; -- offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -+ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; - name = __read_nonnull_str_at (bin->buf, offset); - } -+#endif - if (rel.flags & IMPORTED_ORD) { - imp->ordinal = rel.func_ord; - imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); -@@ -542,8 +563,12 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - r_list_append (relocs, reloc); - } else { - do { -+#if NE_BUG -+ if (reloc->paddr + 4 < r_buf_size (bin->buf)) { -+ break; -+ } -+#endif - r_list_append (relocs, reloc); -- - offset = r_buf_read_le16_at (bin->buf, reloc->paddr); - RBinReloc *tmp = reloc; - reloc = R_NEW0 (RBinReloc); -@@ -571,12 +596,17 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - } - bin->buf = buf; - // XXX this is endian unsafe -- r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); -- if (bin->ne_header->FileAlnSzShftCnt > 8) { -- bin->ne_header->FileAlnSzShftCnt = 8; -+ if (r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)) < 1) { -+ R_FREE (bin->ne_header); -+ return; -+ } -+ if (bin->ne_header->FileAlnSzShftCnt > 15) { -+ bin->ne_header->FileAlnSzShftCnt = 15; - } -- if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { -- bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); -+ ut64 from = bin->ne_header->ModRefTable + bin->header_offset; -+ ut64 left = r_buf_size (bin->buf) - from; -+ if (from + bin->ne_header->ModRefs * sizeof (ut16) >= left) { -+ bin->ne_header->ModRefs = left / sizeof (ut16); - } - bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; - if (!bin->alignment) { -@@ -591,6 +621,7 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - } - size_t remaining = r_buf_size (bin->buf) - offset; - size = R_MIN (remaining, size); -+ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); // * sizeof (NE_image_segment_entry); - bin->segment_entries = calloc (1, size); - if (size >= remaining) { - bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); -@@ -599,7 +630,11 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - return; - } - r_buf_read_at (buf, offset, (ut8 *)bin->segment_entries, size); -- bin->entry_table = calloc (1, bin->ne_header->EntryTableLength); -+ bin->entry_table = calloc (4, bin->ne_header->EntryTableLength); -+ if (!bin->entry_table) { -+ R_FREE (bin->segment_entries); -+ return; -+ } - r_buf_read_at (buf, (ut64)bin->header_offset + bin->ne_header->EntryTableOffset, bin->entry_table, bin->ne_header->EntryTableLength); - bin->imports = r_bin_ne_get_imports (bin); - __ne_get_resources (bin); -@@ -612,6 +647,7 @@ void r_bin_ne_free(r_bin_ne_obj_t *bin) { - free (bin->ne_header); - free (bin->resident_name_table); - free (bin->segment_entries); -+ free (bin); - } - - r_bin_ne_obj_t *r_bin_ne_new_buf(RBuffer *buf, bool verbose) { diff --git a/CVE-2022-1238.patch b/CVE-2022-1238.patch deleted file mode 100644 index 3f68500..0000000 --- a/CVE-2022-1238.patch +++ /dev/null @@ -1,35 +0,0 @@ -commit c40a4f9862104ede15d0ba05ccbf805923070778 -Author: pancake -Date: Tue Apr 5 11:44:46 2022 +0200 - - Fix another oobread segfault in the NE bin parser ##crash - - * Reported by @han0nly via huntr.dev - * Reproducers: sample1 sample2 sample3 - * BountyID: 47422cdf-aad2-4405-a6a1-6f63a3a93200 - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index 210fe0369..ad7c86be1 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -374,6 +374,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - } - int off = 0; - while (off < bin->ne_header->EntryTableLength) { -+ if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { -+ break; -+ } - ut8 bundle_length = *(ut8 *)(bin->entry_table + off); - if (!bundle_length) { - break; -@@ -398,7 +401,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - ut8 segnum = *(bin->entry_table + off); - off++; - ut16 segoff = *(ut16 *)(bin->entry_table + off); -- entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; -+ if (segnum > 0) { -+ entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; -+ } - } else { // Fixed - entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); - } diff --git a/CVE-2022-1240.patch b/CVE-2022-1240.patch deleted file mode 100644 index 2fadbdf..0000000 --- a/CVE-2022-1240.patch +++ /dev/null @@ -1,23 +0,0 @@ -commit ca8d8b39f3e34a4fd943270330b80f1148129de4 -Author: pancake -Date: Tue Apr 5 11:52:32 2022 +0200 - - Fix oobread in the macho parser ##crash - - * Reported by @Han0nly via huntr.dev - * Reproducers: heapoverflow1 - * BountyID: e589bd97-4c74-4e79-93b5-0951a281facc - -diff --git a/libr/bin/format/mach0/mach0.c b/libr/bin/format/mach0/mach0.c -index 1bf09233a..8aaf3f49a 100644 ---- a/libr/bin/format/mach0/mach0.c -+++ b/libr/bin/format/mach0/mach0.c -@@ -3178,7 +3178,7 @@ static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs, - for (i = 0; i < num; i++) { - struct relocation_info a_info = info[i]; - ut32 sym_num = a_info.r_symbolnum; -- if (sym_num > bin->nsymtab) { -+ if (sym_num >= bin->nsymtab) { - continue; - } - diff --git a/CVE-2022-1244.patch b/CVE-2022-1244.patch deleted file mode 100644 index 9892952..0000000 --- a/CVE-2022-1244.patch +++ /dev/null @@ -1,34 +0,0 @@ -commit 2b77b277d67ce061ee6ef839e7139ebc2103c1e3 -Author: pancake -Date: Tue Apr 5 19:39:26 2022 +0200 - - Fix oobread in dyldcache ##crash - - * Reported by @hdthky via huntr.dev - * Reproducers: poc1 - * BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82 - -diff --git a/libr/bin/format/mach0/dyldcache.h b/libr/bin/format/mach0/dyldcache.h -index 9f00182cd..21e598abb 100644 ---- a/libr/bin/format/mach0/dyldcache.h -+++ b/libr/bin/format/mach0/dyldcache.h -@@ -1,4 +1,4 @@ --/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */ -+/* radare - LGPL - Copyright 2009-2022 nibble, pancake */ - - #include - #include "mach0_specs.h" -diff --git a/libr/bin/p/bin_dyldcache.c b/libr/bin/p/bin_dyldcache.c -index 0dc9d16a6..0d9af87a9 100644 ---- a/libr/bin/p/bin_dyldcache.c -+++ b/libr/bin/p/bin_dyldcache.c -@@ -1247,7 +1247,8 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) { - if (deps && !deps[j]) { - continue; - } -- ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); -+ // ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); -+ ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); - if (pa == UT64_MAX) { - continue; - } diff --git a/CVE-2022-1283.patch b/CVE-2022-1283.patch deleted file mode 100644 index 41066f2..0000000 --- a/CVE-2022-1283.patch +++ /dev/null @@ -1,33 +0,0 @@ -commit 18d1d064bf599a255d55f09fca3104776fc34a67 -Author: Sergi Àlvarez i Capilla -Date: Fri Apr 8 19:49:21 2022 +0200 - - Fix null deref in the ne parser ##crash - - * Reported by @hmsec via huntr.dev - * Reproducer: nepoc00 - * BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013 - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index f080e937f..ee2df871a 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -115,7 +115,7 @@ RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) { - } - RList *entries = r_bin_ne_get_entrypoints (bin); - bool resident = true, first = true; -- while (true) { -+ while (entries) { - ut8 sz = r_buf_read8_at (bin->buf, off); - if (!sz) { - first = true; -@@ -352,6 +352,9 @@ RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) { - } - - RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { -+ if (!bin->entry_table) { -+ return NULL; -+ } - RList *entries = r_list_newf (free); - if (!entries) { - return NULL; diff --git a/CVE-2022-1284.patch b/CVE-2022-1284.patch deleted file mode 100644 index 4278af5..0000000 --- a/CVE-2022-1284.patch +++ /dev/null @@ -1,36 +0,0 @@ -commit 64a82e284dddabaeb549228380103b57dead32a6 -Author: Sergi Àlvarez i Capilla -Date: Fri Apr 8 20:39:43 2022 +0200 - - Fix UAF in `aaef` ##crash - - * Reported by @hdthky - * Reproducer: uaf-aef - * BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7 - -diff --git a/libr/core/canal.c b/libr/core/canal.c -index fb53e75fc..610cd22f2 100644 ---- a/libr/core/canal.c -+++ b/libr/core/canal.c -@@ -5295,10 +5295,6 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { - arch = R2_ARCH_MIPS; - } - -- const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); -- if (!sn) { -- eprintf ("Warning: No SN reg alias for current architecture.\n"); -- } - r_reg_arena_push (core->anal->reg); - - IterCtx ictx = { start, end, fcn, NULL }; -@@ -5409,6 +5405,10 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { - goto repeat; - } - } -+ const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); -+ if (!sn) { -+ eprintf ("Warning: No SN reg alias for current architecture.\n"); -+ } - if (sn && op.type == R_ANAL_OP_TYPE_SWI) { - r_strf_buffer (64); - r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS); diff --git a/CVE-2022-1296.patch b/CVE-2022-1296.patch deleted file mode 100644 index 2ac950b..0000000 --- a/CVE-2022-1296.patch +++ /dev/null @@ -1,83 +0,0 @@ -commit 153bcdc29f11cd8c90e7d639a7405450f644ddb6 -Author: Sergi Àlvarez i Capilla -Date: Fri Apr 8 20:14:32 2022 +0200 - - Fix oobread in NE parser ##crash - - * Reported by @hmsec via huntr.dev - * Reproducer: necrash - * BountyID: 52b57274-0e1a-4d61-ab29-1373b555fea0/ - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index ee2df871a..b907d56e9 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -1,7 +1,6 @@ - /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ - - #include "ne.h" --#define NE_BUG 0 - - static char *__get_target_os(r_bin_ne_obj_t *bin) { - switch (bin->ne_header->targOS) { -@@ -505,25 +504,18 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - free (reloc); - break; - } -- char *name; --#if NE_BUG -- if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { -- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -- name = __read_nonnull_str_at (bin->buf, offset); -- } else { -- name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? -- } --#else -+ char *name = NULL; - if (rel.index > bin->ne_header->ModRefs) { - name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? -- } else { -+ } else if (rel.index > 0) { - offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; - name = __read_nonnull_str_at (bin->buf, offset); - } --#endif - if (rel.flags & IMPORTED_ORD) { - imp->ordinal = rel.func_ord; -- imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); -+ char *fname = __func_name_from_ord (name, rel.func_ord); -+ imp->name = r_str_newf ("%s.%s", name, fname); -+ free (fname); - } else { - offset = bin->header_offset + bin->ne_header->ImportNameTable + rel.name_off; - char *func = __read_nonnull_str_at (bin->buf, offset); -@@ -566,6 +558,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - r_list_append (relocs, reloc); - } else { - do { -+#define NE_BUG 0 - #if NE_BUG - if (reloc->paddr + 4 < r_buf_size (bin->buf)) { - break; -diff --git a/test/db/formats/ne b/test/db/formats/ne -index 7b6834441..b71f29469 100644 ---- a/test/db/formats/ne -+++ b/test/db/formats/ne -@@ -1,3 +1,17 @@ -+NAME=NE crash -+FILE=bins/ne/necrash -+CMDS=< -Date: Mon Apr 11 13:35:52 2022 +0200 - - Fix oobread and unaligned casts in the NE entrypoint logic ##crash - - * Reported by @hmsec via huntr.dev - * Reproducer: nepocaligns - * BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index b907d56e9..32aa589e8 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -408,14 +408,21 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - off += 2; - ut8 segnum = *(bin->entry_table + off); - off++; -- ut16 segoff = *(ut16 *)(bin->entry_table + off); -- if (segnum > 0) { -+ if (off > bin->ne_header->EntryTableLength) { -+ break; -+ } -+ ut16 segoff = r_read_le16 (bin->entry_table + off); -+ if (segnum > 0 && segnum < bin->ne_header->SegCount) { - entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; - } - } else { // Fixed -+ if (off + 2 >= bin->ne_header->EntryTableLength) { -+ break; -+ } -+ ut16 delta = r_read_le16 (bin->entry_table + off); - if (bundle_type < bin->ne_header->SegCount) { - entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset -- * bin->alignment + *(ut16 *)(bin->entry_table + off); -+ * bin->alignment + delta; - } - } - off += 2; diff --git a/radare2.spec b/radare2.spec index 45951b5..5b985c5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.6.6 -%global rel 3 +Version: 5.6.8 +%global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -41,40 +41,6 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.6.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch -# Upstream security patches - -# Bug #2068585 #2068586 -Patch100: CVE-2022-1061.patch - -# Bug #2074067 #2074066 -Patch110: CVE-2022-1207.patch - -# Bug #2073961 #2073962 -Patch120: CVE-2022-1237.patch - -# Bug #2073970 #2073971 -Patch130: CVE-2022-1238.patch -Patch131: CVE-2022-1238-2.patch - -# Bug #2073955 #2073956 -Patch140: CVE-2022-1240.patch - -# Bug #2073974 #2073975 -Patch150: CVE-2022-1244.patch - -# Bug #2073914 #2073910 -Patch160: CVE-2022-1283.patch - -# Bug #2073908 #2073907 -Patch170: CVE-2022-1284.patch - -# Bug #2074200 #2074199 -Patch180: CVE-2022-1296.patch - -# Bug #2074203 #2074204 -Patch190: CVE-2022-1297.patch - - License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -378,6 +344,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 +- bump to 5.6.8 + * Tue Apr 13 2022 Henrik Nordstrom 5.6.6-2 - refresh list of bundled libraries and associated cleanup From 1bd0eebf7d4e83940d38f76c96c4a5a67a1e6fc6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 21:56:03 +0200 Subject: [PATCH 070/116] Import scripts used for sidetag build with iaito --- build.sh | 22 ++++++++++++++++++++++ update.sh | 13 +++++++++++++ 2 files changed, 35 insertions(+) create mode 100755 build.sh create mode 100755 update.sh diff --git a/build.sh b/build.sh new file mode 100755 index 0000000..0dc63a5 --- /dev/null +++ b/build.sh @@ -0,0 +1,22 @@ +#!/bin/sh -xe +branch=${1:-$(git branch --show-current)} +dist=$(echo $branch | cut -d- -f1) +case $dist in +devel) + dist=rawhide + ;; +esac + +fedpkg switch-branch $branch +if [ -f .side-tag-$branch ]; then + echo "Side tag for $branch exists" + read ok +else + fedpkg --release $dist request-side-tag > .side-tag-$branch.txt + head -1 .side-tag-$branch.txt | cut "-d'" -f2 > .side-tag-$branch +fi + +git merge rawhide +git push +fedpkg --release $dist verrel > .ver-$branch +fedpkg --release $dist build --target=$(cat .side-tag-$branch) diff --git a/update.sh b/update.sh new file mode 100755 index 0000000..7f0ebd0 --- /dev/null +++ b/update.sh @@ -0,0 +1,13 @@ +#!/bin/sh -e +if [ $# -lt 2 ]; then + echo "Usage: $0 dist " + exit 1 +fi +dist=${1} +shift +if [ ! -f .side-tag-$dist ]; then + echo "No existing side tag for $dist" + exit 1 +fi + +bodhi updates new --from-tag $(cat .side-tag-$dist) "$@" From 32ccde0f4c6483d07c6a4e7676633c38c8e9ef1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 22:08:46 +0200 Subject: [PATCH 071/116] spelling --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 5b985c5..4ded7b7 100644 --- a/radare2.spec +++ b/radare2.spec @@ -347,7 +347,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 - bump to 5.6.8 -* Tue Apr 13 2022 Henrik Nordstrom 5.6.6-2 +* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 - refresh list of bundled libraries and associated cleanup * Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 From 669cbda8b29b77154a6fcef68cdc106eb4c00c8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 22:11:03 +0200 Subject: [PATCH 072/116] Update to 5.6.8 --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 60952c3..2ebc659 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ /radare2-5.6.2.tar.gz /radare2-5.6.4.tar.gz /radare2-5.6.6.tar.gz +/radare2-5.6.8.tar.gz diff --git a/sources b/sources index 5dd77c4..a92107a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.6.6.tar.gz) = 0969d923b0c65c937dadb3cef655a3931b3daf1fc48bf1f6e3dd1afd1df54f65da3baf4bd401eb1677f88566774ed115c271cdc923dc4ef800ef867f4849efb0 +SHA512 (radare2-5.6.8.tar.gz) = e29a3ff235f37bcde4ec6c1c97d1b9c521b57e93512ca40d71be9e88ac1c002f41af905865fdf4685ee94287425cff32500b5a111eec5594bdd7f32f05631910 From 0493df34da7d03c4917816ae795e5f93fabbdca3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 22:18:55 +0200 Subject: [PATCH 073/116] Actually add patches --- radare2-5.6.6-use_lz4.patch | 12 +++++++++++ radare2-5.6.6-use_magic.patch | 37 +++++++++++++++++++++++++++++++++ radare2-5.6.6-use_openssl.patch | 11 ++++++++++ 3 files changed, 60 insertions(+) create mode 100644 radare2-5.6.6-use_lz4.patch create mode 100644 radare2-5.6.6-use_magic.patch create mode 100644 radare2-5.6.6-use_openssl.patch diff --git a/radare2-5.6.6-use_lz4.patch b/radare2-5.6.6-use_lz4.patch new file mode 100644 index 0000000..282cda8 --- /dev/null +++ b/radare2-5.6.6-use_lz4.patch @@ -0,0 +1,12 @@ +diff -ru radare2-5.6.6-orig/libr/util/zip.c radare2-5.6.6/libr/util/zip.c +--- radare2-5.6.6-orig/libr/util/zip.c 2022-03-22 20:06:43.000000000 +0100 ++++ radare2-5.6.6/libr/util/zip.c 2022-04-13 02:48:30.050632855 +0200 +@@ -2,7 +2,7 @@ + + #include + #include +-#include "../../../shlr/lz4/lz4.h" ++#include + + // set a maximum output buffer of 50MB + #define MAXOUT 50000000 diff --git a/radare2-5.6.6-use_magic.patch b/radare2-5.6.6-use_magic.patch new file mode 100644 index 0000000..11ae8e6 --- /dev/null +++ b/radare2-5.6.6-use_magic.patch @@ -0,0 +1,37 @@ +--- radare2-5.6.6-orig/libr/magic/meson.build 2022-03-22 20:06:43.000000000 +0100 ++++ radare2-5.6.6/libr/magic/meson.build 2022-04-13 02:36:10.031944601 +0200 +@@ -1,14 +1,3 @@ +-r_magic_sources = [ +- 'apprentice.c', +- 'ascmagic.c', +- 'fsmagic.c', +- 'funcs.c', +- 'is_tar.c', +- 'magic.c', +- # XXX not used? 'print.c', +- 'softmagic.c' +-] +- + r_magic_deps = [r_util_dep] + if get_option('blob') + r_magic_static_deps = [r_util_static_dep] +@@ -20,8 +9,19 @@ + if get_option('blob') + r_magic_static_deps += [sys_magic] + endif ++ r_magic_sources = [ 'magic-libmagic.c' ] + else + message('Use bundled magic library') ++ r_magic_sources = [ ++ 'apprentice.c', ++ 'ascmagic.c', ++ 'fsmagic.c', ++ 'funcs.c', ++ 'is_tar.c', ++ 'magic.c', ++ # XXX not used? 'print.c', ++ 'softmagic.c' ++ ] + endif + + r_magic = library('r_magic', r_magic_sources, diff --git a/radare2-5.6.6-use_openssl.patch b/radare2-5.6.6-use_openssl.patch new file mode 100644 index 0000000..cacc731 --- /dev/null +++ b/radare2-5.6.6-use_openssl.patch @@ -0,0 +1,11 @@ +--- radare2-5.6.6/libr/socket/meson.build.orig 2022-04-13 02:03:18.003440078 +0200 ++++ radare2-5.6.6/libr/socket/meson.build 2022-04-13 02:03:22.879431434 +0200 +@@ -11,6 +11,8 @@ + ] + + r_util_deps = [utl, r_util_dep, platform_deps] ++r_util_static_deps = [] ++ + if get_option('blob') + r_util_static_deps = [utl, r_util_static_dep, platform_deps] + if use_sys_openssl From 30933f693ef686c501676f80db0b40299ba253d3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 00:24:48 +0000 Subject: [PATCH 074/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 4ded7b7..26176ce 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -344,6 +344,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 - bump to 5.6.8 From c63e06d42f9a944d4479a867207a4003e2529ebe Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 2 Aug 2022 08:48:20 +0200 Subject: [PATCH 075/116] bump to 5.7.6 --- .gitignore | 1 + radare2.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 2ebc659..862adb2 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ /radare2-5.6.4.tar.gz /radare2-5.6.6.tar.gz /radare2-5.6.8.tar.gz +/radare2-5.7.6.tar.gz diff --git a/radare2.spec b/radare2.spec index 26176ce..9cffbd6 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.6.8 +Version: 5.7.6 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -344,6 +344,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Apr 21 2022 Henrik Nordstrom - 5.7.6-1 +- bump to 5.7.6 + * Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index a92107a..0079aae 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.6.8.tar.gz) = e29a3ff235f37bcde4ec6c1c97d1b9c521b57e93512ca40d71be9e88ac1c002f41af905865fdf4685ee94287425cff32500b5a111eec5594bdd7f32f05631910 +SHA512 (radare2-5.7.6.tar.gz) = 04717ddb4bef9ed415c22aa25a0bf626f05c5d32133ac46d5e8a30ebe83e7b782a2b1835233f17f16315a99a39b33dd4e67c34798eb8ae9fbc6db51ca1051e94 From 771bca8a79fc449f6ae710a57b31326d727f5fc6 Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 2 Aug 2022 09:44:14 +0200 Subject: [PATCH 076/116] radare2-5.6.0-dec99.patch already in upstream --- radare2-5.6.0-dec99.patch | 28 ---------------------------- radare2.spec | 3 --- 2 files changed, 31 deletions(-) delete mode 100644 radare2-5.6.0-dec99.patch diff --git a/radare2-5.6.0-dec99.patch b/radare2-5.6.0-dec99.patch deleted file mode 100644 index 511b873..0000000 --- a/radare2-5.6.0-dec99.patch +++ /dev/null @@ -1,28 +0,0 @@ -Declaration of variable in the for loop requires at least c99 compatibility mode -This is specific to 5.6.0 and is already fixed in the git -diff -ru radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c ---- radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c 2022-02-02 13:29:26.000000000 +0100 -+++ radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c 2022-02-12 00:24:15.787894773 +0100 -@@ -1228,7 +1228,8 @@ - ase->la_opcode_ht[LA_INSN_HASH(it->match)] = it; - } - } -- for (int i=0; ila_opcode_ht[i]){ - ase->la_opcode_ht[i]=it; - } -diff -ru radare2-5.6.0/libr/core/disasm.c radare2-5.6.0.new/libr/core/disasm.c ---- radare2-5.6.0/libr/core/disasm.c 2022-02-02 13:29:26.000000000 +0100 -+++ radare2-5.6.0.new/libr/core/disasm.c 2022-02-12 00:28:26.325298373 +0100 -@@ -5483,7 +5483,8 @@ - if (p) { - core->asmqjmps_size = R_CORE_ASMQJMPS_NUM; - core->asmqjmps = p; -- for (int i = 0; i < R_CORE_ASMQJMPS_NUM; i++) { -+ int i; -+ for (i = 0; i < R_CORE_ASMQJMPS_NUM; i++) { - core->asmqjmps[i] = UT64_MAX; - } - } diff --git a/radare2.spec b/radare2.spec index 9cffbd6..7797d1e 100644 --- a/radare2.spec +++ b/radare2.spec @@ -34,9 +34,6 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif -# Declaration of variable in the for loop requires at least c99 compatibility mode -# This is specific to 5.6.0 and is already fixed in the git -Patch0: radare2-5.6.0-dec99.patch Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.6.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch From 51f6fc2c8af28ce6f217be39c2ae65ffd1435f5f Mon Sep 17 00:00:00 2001 From: nobody Date: Mon, 8 Aug 2022 18:21:55 +0200 Subject: [PATCH 077/116] patch for new libmagic --- radare2-5.7.6-ebcdic.patch | 538 ++++++++++++++++++ ...gic.patch => radare2-5.7.6-use_magic.patch | 7 +- radare2.spec | 14 +- 3 files changed, 554 insertions(+), 5 deletions(-) create mode 100644 radare2-5.7.6-ebcdic.patch rename radare2-5.6.6-use_magic.patch => radare2-5.7.6-use_magic.patch (89%) diff --git a/radare2-5.7.6-ebcdic.patch b/radare2-5.7.6-ebcdic.patch new file mode 100644 index 0000000..d4ff96d --- /dev/null +++ b/radare2-5.7.6-ebcdic.patch @@ -0,0 +1,538 @@ +From ddf483893e92f9edcd3d65f1098231b000bfe28a Mon Sep 17 00:00:00 2001 +From: pancake +Date: Sun, 7 Aug 2022 13:17:58 +0200 +Subject: [PATCH] Test and benchmark --with-sysmagic in the CI ##search + +* Improve output of search.verbose +* Remove conflictive magic signature +--- + .github/workflows/ci.yml | 28 ++++++++ + dist/plugins-cfg/plugins.nocs.cfg | 1 + + libr/core/cmd_magic.c | 42 ++++++----- + libr/include/r_magic.h | 8 +-- + libr/magic/apprentice.c | 3 +- + libr/magic/ascmagic.c | 112 +++++++++++++++--------------- + libr/magic/d/default/archive | 110 +++++++++++++++-------------- + libr/magic/magic.c | 4 +- + 8 files changed, 171 insertions(+), 137 deletions(-) + +diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml +index a640d44a02f7..0767be9d6a52 100644 +--- a/.github/workflows/ci.yml ++++ b/.github/workflows/ci.yml +@@ -47,10 +47,38 @@ jobs: + - name: Linting + run: sys/lint.sh + - name: Building without capstone ++ env: ++ CFLAGS: -O0 + run: | + cp -f dist/plugins-cfg/plugins.nocs.cfg plugins.cfg + ./configure --without-capstone --with-rpath && make -j + sudo make install ++ - name: Running c/m with self-hosted libmagic ++ run: ++ time r2 -a gb -e search.verbose=false -qc/m test/bins/mach0/ls-m1 > /tmp/m.1 2>&1 || true ++ cat /tmp/m.1 ++ - name: Uninstall test ++ run: | ++ sudo make uninstall ++ - name: Building with libmagic ++ env: ++ CFLAGS: -O0 ++ run: | ++ sudo apt install -y libmagic-dev ++ git clean -xdf ; rm -rf shlr/capstone ++ cp -f dist/plugins-cfg/plugins.nocs.cfg plugins.cfg ++ ./configure --with-sysmagic --without-capstone --with-rpath && make -j ++ sudo make install ++ - name: Running c/m with system libmagic ++ run: ++ time r2 -a gb -e search.verbose=false -qc/m test/bins/mach0/ls-m1 > /tmp/m.2 2>&1 || true ++ cat /tmp/m.2 ++ - name: Compare magic times and results ++ run: | ++ echo ===== m.1 ++ cat /tmp/m.1 ++ echo ===== m.2 ++ cat /tmp/m.2 + #- name: Building muon/samu + # run: | + # r2pm -gci muon # installs samurai as dependency +diff --git a/dist/plugins-cfg/plugins.nocs.cfg b/dist/plugins-cfg/plugins.nocs.cfg +index 9a9dee5fc5a9..504cce94782e 100644 +--- a/dist/plugins-cfg/plugins.nocs.cfg ++++ b/dist/plugins-cfg/plugins.nocs.cfg +@@ -62,6 +62,7 @@ asm.x86_as + asm.x86_nz + asm.x86_nasm + bin.any ++bin.s390 + bin.wasm + bin.nro + bin.nso +diff --git a/libr/core/cmd_magic.c b/libr/core/cmd_magic.c +index d1862b64462b..083e90d30329 100644 +--- a/libr/core/cmd_magic.c ++++ b/libr/core/cmd_magic.c +@@ -18,8 +18,8 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + const char *str; + int delta = 0, adelta = 0, ret; + ut64 curoffset = core->offset; +- int maxHits = r_config_get_i (core->config, "search.maxhits"); +- if (maxHits > 0 && *hits >= maxHits) { ++ int max_hits = r_config_get_i (core->config, "search.maxhits"); ++ if (max_hits > 0 && *hits >= max_hits) { + return 0; + } + +@@ -27,8 +27,15 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + ret = 0; + goto seek_exit; + } ++ bool must_report_progress = !pj; ++ if (must_report_progress) { ++ must_report_progress = r_config_get_b (core->config, "search.verbose"); ++ if (must_report_progress) { ++ must_report_progress = r_config_get_b (core->config, "scr.interactive"); ++ } ++ } + if (addr != core->offset) { +- if (addr >= core->offset && (addr+NAH) < (core->offset + core->blocksize)) { ++ if (addr >= core->offset && (addr + NAH) < (core->offset + core->blocksize)) { + delta = addr - core->offset; + } else { + r_core_seek (core, addr, true); +@@ -37,18 +44,21 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + if (core->search->align) { + int mod = addr % core->search->align; + if (mod) { +- eprintf ("Unaligned search at %d\n", mod); ++ R_LOG_WARN ("Unaligned search result at %d", mod); + ret = mod; + goto seek_exit; + } + } +- if (((addr&7)==0) && ((addr&(7<<8))==0)) +- if (!pj) { // update search display ++ if (((addr & 7) == 0) && ((addr & (7 << 8)) == 0)) { ++ if (must_report_progress) { + eprintf ("0x%08" PFMT64x " [%d matches found]\r", addr, *hits); + } ++ } + if (file) { +- if (*file == ' ') file++; +- if (!*file) file = NULL; ++ file = r_str_trim_head_ro (file); ++ if (R_STR_ISEMPTY (file)) { ++ file = NULL; ++ } + } + if (file && ofile && file != ofile) { + if (strcmp (file, ofile)) { +@@ -65,7 +75,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + free (ofile); + ofile = strdup (file); + if (!r_magic_load (ck, file)) { +- eprintf ("failed r_magic_load (\"%s\") %s\n", file, r_magic_error (ck)); ++ R_LOG_ERROR ("failed r_magic_load (\"%s\") %s", file, r_magic_error (ck)); + ck = NULL; + ret = -1; + goto seek_exit; +@@ -74,7 +84,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + const char *magicpath = r_config_get (core->config, "dir.magic"); + if (!r_magic_load (ck, magicpath)) { + ck = NULL; +- eprintf ("failed r_magic_load (dir.magic) %s\n", r_magic_error (ck)); ++ R_LOG_ERROR ("failed r_magic_load (dir.magic) %s", r_magic_error (ck)); + ret = -1; + goto seek_exit; + } +@@ -82,7 +92,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + } + //if (v) r_cons_printf (" %d # pm %s @ 0x%"PFMT64x"\n", depth, r_str_get (file), addr); + if (delta + 2 > core->blocksize) { +- eprintf ("EOB\n"); ++ R_LOG_WARN ("magic result happens between block reads"); + ret = -1; + goto seek_exit; + } +@@ -90,7 +100,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + if (str) { + const char *cmdhit; + #if USE_LIB_MAGIC +- if (!v && (!strcmp (str, "data") || strstr(str, "ASCII") || strstr(str, "ISO") || strstr(str, "no line terminator"))) { ++ if (!v && (!strcmp (str, "data") || strstr(str, "ASCII") || strstr (str, "ISO") || strstr (str, "no line terminator"))) { + #else + if (!v && (!strcmp (str, "data"))) { + #endif +@@ -126,7 +136,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + } + // TODO: This must be a callback .. move this into RSearch? + if (!pj) { +- r_cons_printf ("0x%08"PFMT64x" %d %s\n", addr + adelta, magicdepth-depth, p); ++ r_cons_printf ("0x%08"PFMT64x" %d %s\n", addr + adelta, magicdepth - depth, p); + } else { + pj_o (pj); + pj_kN (pj, "offset", addr + adelta); +@@ -134,7 +144,9 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + pj_ks (pj, "info", p); + pj_end (pj); + } +- r_cons_clear_line (1); ++ if (must_report_progress) { ++ r_cons_clear_line (1); ++ } + //eprintf ("0x%08"PFMT64x" 0x%08"PFMT64x" %d %s\n", addr+adelta, addr+adelta, magicdepth-depth, p); + // walking children + for (q = p; *q; q++) { +@@ -171,13 +183,11 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + r_magic_free (ck); + ck = NULL; + #endif +-{ + int mod = core->search->align; + if (mod) { + ret = mod; //adelta%addr + deR_ABS(mod-adelta)+1; + goto seek_exit; + } +-} + ret = adelta; //found; + + seek_exit: +diff --git a/libr/include/r_magic.h b/libr/include/r_magic.h +index 488dbf9686ff..bb36c04e153b 100644 +--- a/libr/include/r_magic.h ++++ b/libr/include/r_magic.h +@@ -1,4 +1,4 @@ +-/* radare - LGPL - Copyright 2011-2014 - pancake */ ++/* radare - LGPL - Copyright 2011-2022 - pancake */ + + #ifndef R2_MAGIC_H + #define R2_MAGIC_H +@@ -13,12 +13,6 @@ R_LIB_VERSION_HEADER (r_magic); + + #ifdef R_API + +-#ifdef __EMX__ +-#define PATHSEP ';' +-#else +-#define PATHSEP ':' +-#endif +- + /* limits */ + #ifndef HOWMANY + # define HOWMANY (256 * 1024) /* how much of the file to look at */ +diff --git a/libr/magic/apprentice.c b/libr/magic/apprentice.c +index 6a4428e3f1bd..89eae490ddab 100644 +--- a/libr/magic/apprentice.c ++++ b/libr/magic/apprentice.c +@@ -296,7 +296,7 @@ struct mlist * file_apprentice(RMagic *ms, const char *fn, size_t fn_size, int a + mlist->next = mlist->prev = mlist; + + while (fn) { +- p = strchr (fn, PATHSEP); ++ p = strstr (fn, R_SYS_ENVSEP); + if (p) { + *p++ = '\0'; + } +@@ -2045,6 +2045,7 @@ static ut32 swap4(ut32 sv) { + * swap a quad + */ + static ut64 swap8(ut64 sv) { ++ // we have r_read apis for that, dont dupe! + ut64 rv; + ut8 *s = (ut8 *)(void *)&sv; + ut8 *d = (ut8 *)(void *)&rv; +diff --git a/libr/magic/ascmagic.c b/libr/magic/ascmagic.c +index f7de1f472e3b..59b5ab22bd72 100644 +--- a/libr/magic/ascmagic.c ++++ b/libr/magic/ascmagic.c +@@ -39,6 +39,57 @@ + #include + #include + ++/* ++ * This table maps each EBCDIC character to an (8-bit extended) ASCII ++ * character, as specified in the rationale for the dd(1) command in ++ * draft 11.2 (September, 1991) of the POSIX P1003.2 standard. ++ * ++ * Unfortunately it does not seem to correspond exactly to any of the ++ * five variants of EBCDIC documented in IBM's _Enterprise Systems ++ * Architecture/390: Principles of Operation_, SA22-7201-06, Seventh ++ * Edition, July, 1999, pp. I-1 - I-4. ++ * ++ * Fortunately, though, all versions of EBCDIC, including this one, agree ++ * on most of the printing characters that also appear in (7-bit) ASCII. ++ * Of these, only '|', '!', '~', '^', '[', and ']' are in question at all. ++ * ++ * Fortunately too, there is general agreement that codes 0x00 through ++ * 0x3F represent control characters, 0x41 a nonbreaking space, and the ++ * remainder printing characters. ++ * ++ * This is sufficient to allow us to identify EBCDIC text and to distinguish ++ * between old-style and internationalized examples of text. ++ */ ++ ++static ut8 ebcdic_to_ascii[] = { ++ 0, 1, 2, 3, 156, 9, 134, 127, 151, 141, 142, 11, 12, 13, 14, 15, ++ 16, 17, 18, 19, 157, 133, 8, 135, 24, 25, 146, 143, 28, 29, 30, 31, ++128, 129, 130, 131, 132, 10, 23, 27, 136, 137, 138, 139, 140, 5, 6, 7, ++144, 145, 22, 147, 148, 149, 150, 4, 152, 153, 154, 155, 20, 21, 158, 26, ++' ', 160, 161, 162, 163, 164, 165, 166, 167, 168, 213, '.', '<', '(', '+', '|', ++'&', 169, 170, 171, 172, 173, 174, 175, 176, 177, '!', '$', '*', ')', ';', '~', ++'-', '/', 178, 179, 180, 181, 182, 183, 184, 185, 203, ',', '%', '_', '>', '?', ++186, 187, 188, 189, 190, 191, 192, 193, 194, '`', ':', '#', '@', '\'','=', '"', ++195, 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 196, 197, 198, 199, 200, 201, ++202, 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', '^', 204, 205, 206, 207, 208, ++209, 229, 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 210, 211, 212, '[', 214, 215, ++216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, ']', 230, 231, ++'{', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 232, 233, 234, 235, 236, 237, ++'}', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 238, 239, 240, 241, 242, 243, ++'\\',159, 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 244, 245, 246, 247, 248, 249, ++'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 250, 251, 252, 253, 254, 255 ++}; ++ ++/* ++ * Copy buf[0 ... nbytes-1] into out[], translating EBCDIC to ASCII. ++ */ ++R_API void r_magic_from_ebcdic(const ut8 *buf, size_t nbytes, ut8 *out) { ++ size_t i; ++ for (i = 0; i < nbytes; i++) { ++ out[i] = ebcdic_to_ascii[buf[i]]; ++ } ++} ++ + #if !USE_LIB_MAGIC + + #include "file.h" +@@ -147,9 +198,9 @@ return 0; + type = "text"; + code_mime = "unknown"; + } else { +- r_magic_from_ebcdic(buf, nbytes, nbuf); ++ r_magic_from_ebcdic (buf, nbytes, nbuf); + +- if (looks_ascii(nbuf, nbytes, ubuf, &ulen)) { ++ if (looks_ascii (nbuf, nbytes, ubuf, &ulen)) { + code = "EBCDIC"; + type = "character data"; + code_mime = "ebcdic"; +@@ -534,9 +585,7 @@ static int looks_extended(const ut8 *buf, size_t nbytes, unichar *ubuf, size_t * + * Encode Unicode string as UTF-8, returning pointer to character + * after end of string, or NULL if an invalid character is found. + */ +-static ut8 * +-encode_utf8(ut8 *buf, size_t len, unichar *ubuf, size_t ulen) +-{ ++static ut8 * encode_utf8(ut8 *buf, size_t len, unichar *ubuf, size_t ulen) { + size_t i; + ut8 *end = buf + len; + +@@ -732,48 +781,7 @@ static int looks_ucs16(const ut8 *buf, size_t nbytes, unichar *ubuf, size_t *ule + + #endif + +-/* +- * This table maps each EBCDIC character to an (8-bit extended) ASCII +- * character, as specified in the rationale for the dd(1) command in +- * draft 11.2 (September, 1991) of the POSIX P1003.2 standard. +- * +- * Unfortunately it does not seem to correspond exactly to any of the +- * five variants of EBCDIC documented in IBM's _Enterprise Systems +- * Architecture/390: Principles of Operation_, SA22-7201-06, Seventh +- * Edition, July, 1999, pp. I-1 - I-4. +- * +- * Fortunately, though, all versions of EBCDIC, including this one, agree +- * on most of the printing characters that also appear in (7-bit) ASCII. +- * Of these, only '|', '!', '~', '^', '[', and ']' are in question at all. +- * +- * Fortunately too, there is general agreement that codes 0x00 through +- * 0x3F represent control characters, 0x41 a nonbreaking space, and the +- * remainder printing characters. +- * +- * This is sufficient to allow us to identify EBCDIC text and to distinguish +- * between old-style and internationalized examples of text. +- */ +- +-static ut8 ebcdic_to_ascii[] = { +- 0, 1, 2, 3, 156, 9, 134, 127, 151, 141, 142, 11, 12, 13, 14, 15, +- 16, 17, 18, 19, 157, 133, 8, 135, 24, 25, 146, 143, 28, 29, 30, 31, +-128, 129, 130, 131, 132, 10, 23, 27, 136, 137, 138, 139, 140, 5, 6, 7, +-144, 145, 22, 147, 148, 149, 150, 4, 152, 153, 154, 155, 20, 21, 158, 26, +-' ', 160, 161, 162, 163, 164, 165, 166, 167, 168, 213, '.', '<', '(', '+', '|', +-'&', 169, 170, 171, 172, 173, 174, 175, 176, 177, '!', '$', '*', ')', ';', '~', +-'-', '/', 178, 179, 180, 181, 182, 183, 184, 185, 203, ',', '%', '_', '>', '?', +-186, 187, 188, 189, 190, 191, 192, 193, 194, '`', ':', '#', '@', '\'','=', '"', +-195, 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 196, 197, 198, 199, 200, 201, +-202, 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', '^', 204, 205, 206, 207, 208, +-209, 229, 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 210, 211, 212, '[', 214, 215, +-216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, ']', 230, 231, +-'{', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 232, 233, 234, 235, 236, 237, +-'}', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 238, 239, 240, 241, 242, 243, +-'\\',159, 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 244, 245, 246, 247, 248, 249, +-'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 250, 251, 252, 253, 254, 255 +-}; +- +-#ifdef notdef ++#if 0 + /* + * The following EBCDIC-to-ASCII table may relate more closely to reality, + * or at least to modern reality. It comes from +@@ -807,13 +815,3 @@ static ut8 ebcdic_1047_to_8859[] = { + 0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0xB3,0xDB,0xDC,0xD9,0xDA,0x9F + }; + #endif +- +-/* +- * Copy buf[0 ... nbytes-1] into out[], translating EBCDIC to ASCII. +- */ +-R_API void r_magic_from_ebcdic(const ut8 *buf, size_t nbytes, ut8 *out) { +- size_t i; +- for (i = 0; i < nbytes; i++) { +- out[i] = ebcdic_to_ascii[buf[i]]; +- } +-} +diff --git a/libr/magic/d/default/archive b/libr/magic/d/default/archive +index 0f7cb77866a2..17dbed94e1cd 100755 +--- a/libr/magic/d/default/archive ++++ b/libr/magic/d/default/archive +@@ -133,60 +133,62 @@ + # ZIP footer + 0 string PK\005\006 End of Zip archive + +-# OpenOffice.org / KOffice / StarOffice documents +-# From: Abel Cheung +-# Listed here because they are basically zip files +->>30 string mimetype +- +-# KOffice (1.2 or above) formats +->>>50 string vnd.kde. KOffice (>=1.2) +->>>>58 string karbon Karbon document +->>>>58 string kchart KChart document +->>>>58 string kformula KFormula document +->>>>58 string kivio Kivio document +->>>>58 string kontour Kontour document +->>>>58 string kpresenter KPresenter document +->>>>58 string kspread KSpread document +->>>>58 string kword KWord document +- +-# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) +->>>50 string vnd.sun.xml. OpenOffice.org 1.x +->>>>62 string writer Writer +->>>>>68 byte !0x2e document +->>>>>68 string .template template +->>>>>68 string .global global document +->>>>62 string calc Calc +->>>>>66 byte !0x2e spreadsheet +->>>>>66 string .template template +->>>>62 string draw Draw +->>>>>66 byte !0x2e document +->>>>>66 string .template template +->>>>62 string impress Impress +->>>>>69 byte !0x2e presentation +->>>>>69 string .template template +->>>>62 string math Math document +- +-# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +-# http://lists.oasis-open.org/archives/office/200505/msg00006.html +->>>50 string vnd.oasis.opendocument. OpenDocument +->>>>73 string text +->>>>>77 byte !0x2d Text +-!:mime application/vnd.oasis.opendocument.text +->>>>>77 string -template Text Template +->>>>>77 string -web HTML Document Template +->>>>>77 string -master Master Document +->>>>73 string graphics Drawing +->>>>>81 string -template Template +->>>>73 string presentation Presentation +->>>>>85 string -template Template +->>>>73 string spreadsheet Spreadsheet +->>>>>84 string -template Template +->>>>73 string chart Chart +->>>>>78 string -template Template +->>>>73 string formula Formula +->>>>>80 string -template Template +->>>>73 string database Database +->>>>73 string image Image ++# commented because barely used and barely used ++# ++# # OpenOffice.org / KOffice / StarOffice documents ++# # From: Abel Cheung ++# # Listed here because they are basically zip files ++# >>30 string mimetype ++# ++# # KOffice (1.2 or above) formats ++# >>>50 string vnd.kde. KOffice (>=1.2) ++# >>>>58 string karbon Karbon document ++# >>>>58 string kchart KChart document ++# >>>>58 string kformula KFormula document ++# >>>>58 string kivio Kivio document ++# >>>>58 string kontour Kontour document ++# >>>>58 string kpresenter KPresenter document ++# >>>>58 string kspread KSpread document ++# >>>>58 string kword KWord document ++# ++# # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) ++# >>>50 string vnd.sun.xml. OpenOffice.org 1.x ++# >>>>62 string writer Writer ++# >>>>>68 byte !0x2e document ++# >>>>>68 string .template template ++# >>>>>68 string .global global document ++# >>>>62 string calc Calc ++# >>>>>66 byte !0x2e spreadsheet ++# >>>>>66 string .template template ++# >>>>62 string draw Draw ++# >>>>>66 byte !0x2e document ++# >>>>>66 string .template template ++# >>>>62 string impress Impress ++# >>>>>69 byte !0x2e presentation ++# >>>>>69 string .template template ++# >>>>62 string math Math document ++# ++# # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) ++# # http://lists.oasis-open.org/archives/office/200505/msg00006.html ++# >>>50 string vnd.oasis.opendocument. OpenDocument ++# >>>>73 string text ++# >>>>>77 byte !0x2d Text ++# !:mime application/vnd.oasis.opendocument.text ++# >>>>>77 string -template Text Template ++# >>>>>77 string -web HTML Document Template ++# >>>>>77 string -master Master Document ++# >>>>73 string graphics Drawing ++# >>>>>81 string -template Template ++# >>>>73 string presentation Presentation ++# >>>>>85 string -template Template ++# >>>>73 string spreadsheet Spreadsheet ++# >>>>>84 string -template Template ++# >>>>73 string chart Chart ++# >>>>>78 string -template Template ++# >>>>73 string formula Formula ++# >>>>>80 string -template Template ++# >>>>73 string database Database ++# >>>>73 string image Image + + # Zoo archiver + 20 lelong 0xfdc4a7dc Zoo archive data +diff --git a/libr/magic/magic.c b/libr/magic/magic.c +index 70d2b54dbb74..7f7bf77999dc 100644 +--- a/libr/magic/magic.c ++++ b/libr/magic/magic.c +@@ -106,7 +106,7 @@ static const char *file_or_fd(RMagic *ms, const char *inname, int fd) { + * one extra for terminating '\0', and + * some overlapping space for matches near EOF + */ +-#define SLOP (1 + sizeof(union VALUETYPE)) ++#define SLOP (1 + sizeof (union VALUETYPE)) + if (!(buf = malloc (HOWMANY + SLOP))) { + return NULL; + } +@@ -126,7 +126,7 @@ static const char *file_or_fd(RMagic *ms, const char *inname, int fd) { + ispipe = true; + } + } else { +- int flags = O_RDONLY|O_BINARY; ++ int flags = O_RDONLY | O_BINARY; + + if (stat (inname, &sb) == 0 && S_ISFIFO (sb.st_mode)) { + #if O_NONBLOCK diff --git a/radare2-5.6.6-use_magic.patch b/radare2-5.7.6-use_magic.patch similarity index 89% rename from radare2-5.6.6-use_magic.patch rename to radare2-5.7.6-use_magic.patch index 11ae8e6..a6d58aa 100644 --- a/radare2-5.6.6-use_magic.patch +++ b/radare2-5.7.6-use_magic.patch @@ -15,11 +15,14 @@ r_magic_deps = [r_util_dep] if get_option('blob') r_magic_static_deps = [r_util_static_dep] -@@ -20,8 +9,19 @@ +@@ -20,8 +9,22 @@ if get_option('blob') r_magic_static_deps += [sys_magic] endif -+ r_magic_sources = [ 'magic-libmagic.c' ] ++ r_magic_sources = [ ++ 'magic-libmagic.c', ++ 'ascmagic-libmagic.c', ++ ] else message('Use bundled magic library') + r_magic_sources = [ diff --git a/radare2.spec b/radare2.spec index 7797d1e..1c061f7 100644 --- a/radare2.spec +++ b/radare2.spec @@ -34,10 +34,15 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif +# Specific to Fedora - build with system libraries Patch1: radare2-5.6.6-use_openssl.patch -Patch3: radare2-5.6.6-use_magic.patch +Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch +# Build with new libmagic which is missing EBCDIC transform functions +Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch + + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -180,7 +185,7 @@ Provides: bundled(tree-sitter) = 0.17.2 # ./shlr/mpc # https://github.com/orangeduck/mpc -Provides: bundled(mpc) = 0.8.7 +Provides: bundled(mpc) = 0.8.7 # ./shlr/yxml # https://dev.yorhel.nl/yxml @@ -235,8 +240,10 @@ rm -rf shlr/lz4/{deps.mk,LICENSE,lz4.*,Makefile,README.md} rm -f libr/hash/xxhash.c libr/hash/xxhash.h # Remove magic files because we use system dependencies awk 'BEGIN {p=1} /#if USE_LIB_MAGIC/ {p=2; next} p==2 && /#else/ {p=0} p>0 {print}' libr/magic/magic.c > libr/magic/magic.c.stripped +awk 'BEGIN {p=1} /#if !USE_LIB_MAGIC/ {p=0; next} p==2 && /#else/ {p=0} p>0 {print}' libr/magic/ascmagic.c > libr/magic/ascmagic.c.stripped rm -rf libr/magic/*.c mv libr/magic/magic.c.stripped libr/magic/magic-libmagic.c +mv libr/magic/ascmagic.c.stripped libr/magic/ascmagic-libmagic.c # Remove openssl files because we use system dependencies rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] @@ -341,8 +348,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -* Thu Apr 21 2022 Henrik Nordstrom - 5.7.6-1 +* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 - bump to 5.7.6 +- cherrypicked patch for new libmagic from upstream * Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From c16f9f0c02ce11982645dbfaf0a68776cf339da2 Mon Sep 17 00:00:00 2001 From: nobody Date: Wed, 5 Oct 2022 15:44:08 +0200 Subject: [PATCH 078/116] bump to 5.7.8 --- .gitignore | 1 + radare2.spec | 12 ++++++++---- sources | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 862adb2..e96e92c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /radare2-5.6.6.tar.gz /radare2-5.6.8.tar.gz /radare2-5.7.6.tar.gz +/radare2-5.7.8.tar.gz diff --git a/radare2.spec b/radare2.spec index 1c061f7..62bdda0 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.7.6 +Version: 5.7.8 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20220228 -%global commit b636941cefcbc12b2031054e736b1f8e5458be32 +%global gitdate 20220913 +%global commit 8e965bef30457a12e07a32a9047a9620a944bc39 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -40,7 +40,8 @@ Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch # Build with new libmagic which is missing EBCDIC transform functions -Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch +# imported upstream +# Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib @@ -348,6 +349,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 +- bump to 5.7.8 + * Tue Aug 02 2022 Michal Ambroz 5.7.6-1 - bump to 5.7.6 - cherrypicked patch for new libmagic from upstream diff --git a/sources b/sources index 0079aae..b2886c2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.7.6.tar.gz) = 04717ddb4bef9ed415c22aa25a0bf626f05c5d32133ac46d5e8a30ebe83e7b782a2b1835233f17f16315a99a39b33dd4e67c34798eb8ae9fbc6db51ca1051e94 +SHA512 (radare2-5.7.8.tar.gz) = 7c819a052f5e4b3da72b945915fca92a747c52dc2e2fa8483a8c2d8e71479ce374efbbe2bc02b1b4af26db6a891b6e44cdbb9e062de2f13b22a258cceab561f6 From 6a300669401042474d3939f9a4cd01ee557b74c5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 19:23:15 +0000 Subject: [PATCH 079/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 62bdda0..8b4bf68 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -349,6 +349,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Aug 02 2022 Michal Ambroz 5.7.8-1 - bump to 5.7.8 From 7d3e10f8fc6333458b9f9282bff7d0a065b2f860 Mon Sep 17 00:00:00 2001 From: nobody Date: Thu, 26 Jan 2023 04:34:56 +0100 Subject: [PATCH 080/116] fix rhel7 build, keep embedded libzip as rhel7 libzip is too old --- radare2.spec | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/radare2.spec b/radare2.spec index 8b4bf68..601a9a0 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,12 +1,12 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.7.8 +Version: 5.8.2 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases -# %%if 0%%{?rhel} && 0i%%{?rhel} == 8 +# %%if 0%%{?rhel} && 0%%{?rhel} == 8 # Radare2 fails to build on EPEL8+s390x # https://bugzilla.redhat.com/show_bug.cgi?id=1960046 # https://docs.fedoraproject.org/en-US/packaging-guidelines/#_architecture_build_failures @@ -21,16 +21,16 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20220913 -%global commit 8e965bef30457a12e07a32a9047a9620a944bc39 +%global gitdate 20230123 +%global commit 0b6793f37d9dae5b43fa96beae93008e197dc87a %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -88,7 +88,12 @@ BuildRequires: ninja-build BuildRequires: pkgconfig # xxhash-devel BuildRequires: pkgconfig(libxxhash) + +# version of libzip on rhel7 is too old +%if 0%{?fedora} || 0%{?rhel} >= 8 BuildRequires: pkgconfig(libzip) +%endif + BuildRequires: pkgconfig(zlib) BuildRequires: pkgconfig(liblz4) BuildRequires: pkgconfig(capstone) >= 3.0.4 @@ -132,7 +137,9 @@ Requires: %{name}-common = %{version}-%{release} # ./libr/hash/{md4,md5,sha1,sha2}.{c,h} # ./libr/util/big.c -# compiled with -D use_sys_openssl=true instead +# could be compiled with -D use_sys_openssl=true instead, +# but is currently not maintained so using embedded R2 implementations +# for hashing # ./shlr/spp/README.md # SPP stands for Simple Pre-Processor, a templating language. @@ -234,7 +241,11 @@ information sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif # Removing zip/lzip files because we use system dependencies +# version of libzip on rhel7 is too old, use the embedded one instead +%if 0%{?fedora} || 0%{?rhel} >= 8 rm -rf shlr/zip/{zip,zlib,include} +%endif + # Remove lx4 files because we use system dependencies rm -rf shlr/lz4/{deps.mk,LICENSE,lz4.*,Makefile,README.md} # Remove xxhash files because we use system dependencies @@ -246,7 +257,7 @@ rm -rf libr/magic/*.c mv libr/magic/magic.c.stripped libr/magic/magic-libmagic.c mv libr/magic/ascmagic.c.stripped libr/magic/ascmagic-libmagic.c # Remove openssl files because we use system dependencies -rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] +# rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui @@ -267,12 +278,15 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil # Whereever possible use the system-wide libraries instead of bundles %meson \ -Duse_sys_magic=true \ +%if 0%{?fedora} || 0%{?rhel} >= 8 -Duse_sys_zip=true \ +%else + -Duse_sys_zip=false \ +%endif -Duse_sys_zlib=true \ -Duse_sys_lz4=true \ -Duse_sys_xxhash=true \ -Duse_ssl=true \ - -Duse_sys_openssl=true \ -Duse_libuv=true \ %ifarch s390x -Ddebugger=false \ @@ -310,7 +324,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %files %license COPYING COPYING.LESSER %doc CONTRIBUTING.md DEVELOPERS.md README.md -%doc doc/3D/ doc/node.js/ doc/pdb/ doc/sandbox/ +%doc doc/3D/ doc/pdb/ doc/sandbox/ %doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md %doc doc/esil.md doc/gdb.md doc/gprobe.md doc/intro.md doc/io.md doc/rap.md %doc doc/siol.md doc/strings.md doc/windbg.md doc/yara.md @@ -349,6 +363,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 +- bump to 5.8.2 + * Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From c3cf87391df7b4ba95a465e061ef212295a57703 Mon Sep 17 00:00:00 2001 From: nobody Date: Thu, 26 Jan 2023 05:23:17 +0100 Subject: [PATCH 081/116] upload tarball to sidecache --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index e96e92c..c7c09f4 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ /radare2-5.6.8.tar.gz /radare2-5.7.6.tar.gz /radare2-5.7.8.tar.gz +/radare2-5.8.2.tar.gz diff --git a/sources b/sources index b2886c2..beb6d4c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.7.8.tar.gz) = 7c819a052f5e4b3da72b945915fca92a747c52dc2e2fa8483a8c2d8e71479ce374efbbe2bc02b1b4af26db6a891b6e44cdbb9e062de2f13b22a258cceab561f6 +SHA512 (radare2-5.8.2.tar.gz) = a3b768cade2f0bba7b252331010cddda952882db32ade7e3e16fb6c766265b574672a0f093b070bca5ac48b67c263b87a66c08064601d6e1961c0ff4dd0abc22 From 9faa73b81f0d0f685f180feb1460fe1b0eca69f9 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 10 Feb 2023 02:21:34 +0100 Subject: [PATCH 082/116] tag CVEs in the changelog --- radare2.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/radare2.spec b/radare2.spec index 601a9a0..ff2052b 100644 --- a/radare2.spec +++ b/radare2.spec @@ -365,6 +365,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog * Wed Jan 25 2023 Michal Ambroz 5.8.2-1 - bump to 5.8.2 +- fix CVE-2023-0302 , CVE-2023-0302 * Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild @@ -375,6 +376,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Tue Aug 02 2022 Michal Ambroz 5.7.6-1 - bump to 5.7.6 - cherrypicked patch for new libmagic from upstream +- fix CVE-2022-34502 * Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 5e8a89cd03c44654ba368902d76d90a460c9514f Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 26 Feb 2023 16:30:11 +0100 Subject: [PATCH 083/116] fix sdb generation with meson build --- radare2-5.8.2-meson-sdb.patch | 72 +++++++++++++++++++++++++++++++++++ radare2.spec | 14 +++++-- 2 files changed, 82 insertions(+), 4 deletions(-) create mode 100644 radare2-5.8.2-meson-sdb.patch diff --git a/radare2-5.8.2-meson-sdb.patch b/radare2-5.8.2-meson-sdb.patch new file mode 100644 index 0000000..e4bf64d --- /dev/null +++ b/radare2-5.8.2-meson-sdb.patch @@ -0,0 +1,72 @@ +diff -ru -N radare2-5.8.2/libr/syscall/d/gen.py radare2-5.8.2.new/libr/syscall/d/gen.py +--- radare2-5.8.2/libr/syscall/d/gen.py 1970-01-01 01:00:00.000000000 +0100 ++++ radare2-5.8.2.new/libr/syscall/d/gen.py 2023-02-26 00:13:15.616002799 +0100 +@@ -0,0 +1,29 @@ ++#!/usr/bin/env python ++# args [sdbpath] [input] [output] ++import os ++import sys ++import subprocess ++ ++ ++try: ++ sdb_exe = sys.argv[1] ++ _input = sys.argv[2] ++ _output = sys.argv[3] ++ _tmpfile = _input + ".tmp" ++ with open(_input) as lines: ++ res = "" ++ for line in lines: ++ kv = line.rstrip().split("=", 1) ++ if kv[0] == "_": ++ res += line ++ else: ++ vv = kv[1].split(",") ++ res += vv[0] + "." + vv[1] + "=" + kv[0] + "\n" ++ res += line ++ with open(_tmpfile, "w") as file: ++ file.write(res) ++ subprocess.call([sdb_exe, _output, "==", _tmpfile]) ++except Exception as e: ++ print(e) ++ print("Usage: gen.py [sdb_exe] [input] [output]") ++ +diff -ru -N radare2-5.8.2/libr/syscall/d/meson.build radare2-5.8.2.new/libr/syscall/d/meson.build +--- radare2-5.8.2/libr/syscall/d/meson.build 2023-01-23 11:53:42.000000000 +0100 ++++ radare2-5.8.2.new/libr/syscall/d/meson.build 2023-02-26 00:13:15.617002836 +0100 +@@ -35,7 +35,7 @@ + gen_cmd = sdb_gen_cmd_cgen + else + outfile = '@0@.sdb'.format(file) +- gen_cmd = sdb_gen_cmd ++ gen_cmd = syscall_sdb_gen_cmd + endif + + r_syscall_d_sources += custom_target(outfile, +diff -ru -N radare2-5.8.2/meson.build radare2-5.8.2.new/meson.build +--- radare2-5.8.2/meson.build 2023-01-23 11:53:42.000000000 +0100 ++++ radare2-5.8.2.new/meson.build 2023-02-26 00:13:15.619002909 +0100 +@@ -1,6 +1,7 @@ + project('radare2', 'c', license : 'LGPL3', meson_version : '>=0.49', version : '5.8.2') + + py3_exe = import('python').find_installation('python3') ++gen_py = '@0@/libr/syscall/d/gen.py'.format(meson.current_source_dir()) + git_exe = find_program('git', required: false) + pkgconfig_mod = import('pkgconfig') + +@@ -553,6 +554,15 @@ + '@INPUT@' + ] + ++py_cmd = '__import__("os").readlink(r"@0@"))'.format(repo) ++syscall_sdb_gen_cmd = [ ++ py3_exe, ++ gen_py, ++ sdb_exe, ++ '@INPUT@', ++ '@OUTPUT@', ++] ++ + # handle spp dependency + spp_files = [ + 'shlr/spp/spp.c' diff --git a/radare2.spec b/radare2.spec index ff2052b..878a92b 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.2 -%global rel 1 +%global rel 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -39,9 +39,12 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch -# Build with new libmagic which is missing EBCDIC transform functions -# imported upstream -# Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch +# Fix issues wit the generation of SDB from the meson build +# https://github.com/radareorg/radare2/issues/21375 +# https://bugzilla.redhat.com/show_bug.cgi?id=2170036 +# Patch5: https://github.com/radareorg/radare2/commit/81d7a23df788ecd68aeae2921297cc0ca31902ed.patch#/%%{name}-%%{version}-meson-sdb.patch +Patch5: %{name}-%{version}-meson-sdb.patch + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib @@ -363,6 +366,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 +- cherrypick upstream patch for fixing the sdb generation from mesosn + * Wed Jan 25 2023 Michal Ambroz 5.8.2-1 - bump to 5.8.2 - fix CVE-2023-0302 , CVE-2023-0302 From 35bf7c6f1b40540951c220a843299f4e74383717 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 16 Mar 2023 11:53:22 +0100 Subject: [PATCH 084/116] bump to 5.8.4 --- .gitignore | 29 +---------------------------- radare2.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 33 deletions(-) diff --git a/.gitignore b/.gitignore index c7c09f4..98e0f4f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,28 +1 @@ -/radare2-2.9.0.tar.gz -/radare2-3.0.0.tar.gz -/radare2-3.0.1.tar.gz -/radare2-3.1.0.tar.gz -/radare2-3.2.0.tar.gz -/radare2-3.3.0.tar.gz -/radare2-3.4.1.tar.gz -/radare2-3.6.0.tar.gz -/radare2-3.9.0.tar.gz -/radare2-4.2.1.tar.gz -/radare2-4.4.0.tar.gz -/radare2-4.5.0.tar.gz -/radare2-5.1.0.tar.gz -/radare2-5.1.1.tar.gz -/radare2-5.2.0.tar.gz -/radare2-5.2.1.tar.gz -/radare2-5.3.0.tar.gz -/radare2-5.3.1.tar.gz -/radare2-5.4.0.tar.gz -/radare2-5.4.2.tar.gz -/radare2-5.6.0.tar.gz -/radare2-5.6.2.tar.gz -/radare2-5.6.4.tar.gz -/radare2-5.6.6.tar.gz -/radare2-5.6.8.tar.gz -/radare2-5.7.6.tar.gz -/radare2-5.7.8.tar.gz -/radare2-5.8.2.tar.gz +/radare2-*.tar.gz diff --git a/radare2.spec b/radare2.spec index 878a92b..33f0eac 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.2 -%global rel 2 +Version: 5.8.4 +%global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20230123 -%global commit 0b6793f37d9dae5b43fa96beae93008e197dc87a +%global gitdate 20230314 +%global commit ab809417aa6b676922f95cf77861924eb90e7ef2 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -366,6 +366,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 +- bump to 5.8.4 + * Sun Feb 26 2023 Michal Ambroz 5.8.2-2 - cherrypick upstream patch for fixing the sdb generation from mesosn diff --git a/sources b/sources index beb6d4c..a3a3a01 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.2.tar.gz) = a3b768cade2f0bba7b252331010cddda952882db32ade7e3e16fb6c766265b574672a0f093b070bca5ac48b67c263b87a66c08064601d6e1961c0ff4dd0abc22 +SHA512 (radare2-5.8.4.tar.gz) = 3b7ef3756fa45dd1dc1e7293b278650734c4d8c160940215de7f1c46b8eb187829f92d6411ce5f60e5f0ea8c74ae8cc0abe4df44df0336f7f5cc7ff9ca177aca From f552af6b593f044a501341b9002e0ef07d2e21f7 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 29 Mar 2023 02:15:30 +0200 Subject: [PATCH 085/116] as 5.8.4 contains segfault, bump to 5.8.5 --- radare2.spec | 34 +++++++++++++++++----------------- sources | 2 +- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/radare2.spec b/radare2.spec index 33f0eac..d922936 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.4 -%global rel 1 +Version: 5.8.5 +%global baserelease 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -16,22 +16,22 @@ VCS: https://github.com/radareorg/radare2 # by default it builds from the released version of radare2 # to build from git use rpmbuild --without=releasetag -%bcond_without releasetag +%bcond_with releasetag %global gituser radareorg %global gitname radare2 -%global gitdate 20230314 -%global commit ab809417aa6b676922f95cf77861924eb90e7ef2 +%global gitdate 20230328 +%global commit 70a78f0943e33b8885ee63cb8cca889b732404da %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{baserelease}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip +Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries @@ -39,14 +39,6 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch -# Fix issues wit the generation of SDB from the meson build -# https://github.com/radareorg/radare2/issues/21375 -# https://bugzilla.redhat.com/show_bug.cgi?id=2170036 -# Patch5: https://github.com/radareorg/radare2/commit/81d7a23df788ecd68aeae2921297cc0ca31902ed.patch#/%%{name}-%%{version}-meson-sdb.patch -Patch5: %{name}-%{version}-meson-sdb.patch - - - License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -279,6 +271,8 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil %build # Whereever possible use the system-wide libraries instead of bundles +# --sanitize=address,undefined,signed-integer-overflow \ + %meson \ -Duse_sys_magic=true \ %if 0%{?fedora} || 0%{?rhel} >= 8 @@ -366,11 +360,17 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 +- 5.8.5 rebuild from git, patched for segfault + +* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 +- patch for segfault in sdb_hash + * Thu Mar 16 2023 Michal Ambroz 5.8.4-1 - bump to 5.8.4 * Sun Feb 26 2023 Michal Ambroz 5.8.2-2 -- cherrypick upstream patch for fixing the sdb generation from mesosn +- cherrypick upstream patch for fixing the sdb generation from meson * Wed Jan 25 2023 Michal Ambroz 5.8.2-1 - bump to 5.8.2 diff --git a/sources b/sources index a3a3a01..3927678 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.4.tar.gz) = 3b7ef3756fa45dd1dc1e7293b278650734c4d8c160940215de7f1c46b8eb187829f92d6411ce5f60e5f0ea8c74ae8cc0abe4df44df0336f7f5cc7ff9ca177aca +SHA512 (radare2-5.8.5-git20230328-70a78f0.tar.gz) = 758f35bc666fe54fd4f0da97b0b1c14239e1edc5c7e8587ec89ed78bcd372f9c1f76586afc30f3576319067534d3e3f13f86529aeacc85141cd41947f2f64628 From 3563cf9435ca82741b92406ceb2b9301df038822 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 23 May 2023 18:58:43 +0200 Subject: [PATCH 086/116] bump to 5.8.6 --- radare2.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/radare2.spec b/radare2.spec index d922936..988fff9 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.5 -%global baserelease 3 +Version: 5.8.6 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -16,13 +16,13 @@ VCS: https://github.com/radareorg/radare2 # by default it builds from the released version of radare2 # to build from git use rpmbuild --without=releasetag -%bcond_with releasetag +%bcond_without releasetag %global gituser radareorg %global gitname radare2 -%global gitdate 20230328 -%global commit 70a78f0943e33b8885ee63cb8cca889b732404da +%global gitdate 20230505 +%global commit 3c9ad151adf52658d814f56b9bb80bc9231da36b %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -360,6 +360,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue May 23 2023 Michal Ambroz 5.8.6-1 +- bump to 5.8.5 + * Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 - 5.8.5 rebuild from git, patched for segfault From c5ff3b2c71c66337db39a2cfff26bb956885616d Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 23 May 2023 19:00:26 +0200 Subject: [PATCH 087/116] adding 5.8.6 source --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 3927678..d1b87fe 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.5-git20230328-70a78f0.tar.gz) = 758f35bc666fe54fd4f0da97b0b1c14239e1edc5c7e8587ec89ed78bcd372f9c1f76586afc30f3576319067534d3e3f13f86529aeacc85141cd41947f2f64628 +SHA512 (radare2-5.8.6.tar.gz) = cd53ed7519d485253182d8d7d414b8d0927e65dd4d0c9716d0d8819e739c8e5e39deb702d93cb5a2a9425804d9798e6eb0acb58a4b904e25a9ba4fcad2315f47 From 7cefe109c8b30e37a03c0eea7c96a6d2e2ef86aa Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 23 May 2023 19:02:57 +0200 Subject: [PATCH 088/116] bump to 5.8.5 comment --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 988fff9..9012108 100644 --- a/radare2.spec +++ b/radare2.spec @@ -361,7 +361,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog * Tue May 23 2023 Michal Ambroz 5.8.6-1 -- bump to 5.8.5 +- bump to 5.8.6 * Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 - 5.8.5 rebuild from git, patched for segfault From dde323006c617458228b6d270ed7c0c973b37f03 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 5 Jul 2023 00:21:53 +0200 Subject: [PATCH 089/116] bump to 5.8.8 --- radare2.spec | 9 ++++++--- sources | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/radare2.spec b/radare2.spec index 9012108..3f697c2 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.6 +Version: 5.8.8 %global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20230505 -%global commit 3c9ad151adf52658d814f56b9bb80bc9231da36b +%global gitdate 20230608 +%global commit ea7f0356519884715cf1d5fba16042bac72b2df5 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -360,6 +360,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 +- bump to 5.8.8 + * Tue May 23 2023 Michal Ambroz 5.8.6-1 - bump to 5.8.6 diff --git a/sources b/sources index d1b87fe..65379f9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.6.tar.gz) = cd53ed7519d485253182d8d7d414b8d0927e65dd4d0c9716d0d8819e739c8e5e39deb702d93cb5a2a9425804d9798e6eb0acb58a4b904e25a9ba4fcad2315f47 +SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b From fe73bbcbea22ab4fabf7eb756ac5774fb223985a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 16:26:50 +0000 Subject: [PATCH 090/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 3f697c2..657e522 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 1 +%global baserelease 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -360,6 +360,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jul 05 2023 Michal Ambroz 5.8.8-1 - bump to 5.8.8 From 6e264534597c5d1c8dfe25a5c500cd634b11e797 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 26 Oct 2023 15:37:38 +0200 Subject: [PATCH 091/116] cherrypick CVE-2023-4322 & CVE-2023-5686 fix from upstream --- radare2-5.8.8-CVE-2023-4322.patch | 120 ++++++++++++++++++++++++++++++ radare2-5.8.8-CVE-2023-5686.patch | 20 +++++ radare2.spec | 24 +++++- 3 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 radare2-5.8.8-CVE-2023-4322.patch create mode 100644 radare2-5.8.8-CVE-2023-5686.patch diff --git a/radare2-5.8.8-CVE-2023-4322.patch b/radare2-5.8.8-CVE-2023-4322.patch new file mode 100644 index 0000000..2e80af3 --- /dev/null +++ b/radare2-5.8.8-CVE-2023-4322.patch @@ -0,0 +1,120 @@ +diff -ru radare2-5.8.8/libr/arch/p/bf/plugin.c radare2-5.8.8.new/libr/arch/p/bf/plugin.c +--- radare2-5.8.8/libr/arch/p/bf/plugin.c 2023-06-08 15:54:42.000000000 +0200 ++++ radare2-5.8.8.new/libr/arch/p/bf/plugin.c 2023-10-26 14:52:41.893960711 +0200 +@@ -13,8 +13,8 @@ + } + + static int getid(char ch) { +- const char *keys = "[]<>+-,."; +- const char *cidx = strchr (keys, ch); ++ const char *const keys = "[]<>+-,."; ++ const char *const cidx = strchr (keys, ch); + return cidx? cidx - keys + 1: 0; + } + +@@ -136,13 +136,11 @@ + #define BUFSIZE_INC 32 + static bool decode(RArchSession *as, RAnalOp *op, RArchDecodeMask mask) { + int len = op->size; +- const ut8 *_buf = op->bytes; +- const ut64 addr = op->addr; + if (len < 1) { + return false; + } +- +- ut8 *buf = (ut8*)_buf; // XXX ++ ut8 *buf = op->bytes; ++ const ut64 addr = op->addr; + ut64 dst = 0LL; + if (!op) { + return 1; +@@ -169,29 +167,32 @@ + } + r_strbuf_set (&op->esil, "1,pc,-,brk,=[4],4,brk,+="); + #if 1 +- { ++ if (len > 1) { + const ut8 *p = buf + 1; + int lev = 0, i = 1; + len--; + while (i < len && *p) { +- if (*p == '[') { ++ switch (*p) { ++ case '[': + lev++; +- } +- if (*p == ']') { ++ break; ++ case ']': + lev--; +- if (lev == -1) { +- dst = addr + (size_t)(p - buf) + 1; ++ if (lev < 1) { ++ size_t delta = p - buf; ++ dst = addr + (size_t)delta + 1; + op->jump = dst; + r_strbuf_set (&op->esil, "1,pc,-,brk,=[4],4,brk,+=,"); + goto beach; + } +- } +- if (*p == 0x00 || *p == 0xff) { ++ break; ++ case 0: ++ case 0xff: + op->type = R_ANAL_OP_TYPE_ILL; + goto beach; + } + if (read_at && i == len - 1) { +- break; ++#if 0 + // XXX unnecessary just break + int new_buf_len = len + 1 + BUFSIZE_INC; + ut8 *new_buf = calloc (new_buf_len, 1); +@@ -203,6 +204,9 @@ + p = buf + i; + len += BUFSIZE_INC; + } ++#else ++ break; ++#endif + } + p++; + i++; +Only in radare2-5.8.8.new/libr/arch/p/bf: plugin.c.orig +diff -ru radare2-5.8.8/libr/core/cmd_anal.c radare2-5.8.8.new/libr/core/cmd_anal.c +--- radare2-5.8.8/libr/core/cmd_anal.c 2023-06-08 15:54:42.000000000 +0200 ++++ radare2-5.8.8.new/libr/core/cmd_anal.c 2023-10-26 14:56:01.978360519 +0200 +@@ -8700,9 +8700,9 @@ + isValidCall = false; + } + if (isValidCall) { +- ut8 buf[4] = {0}; +- r_io_read_at (core->io, op.jump, buf, 4); +- isValidCall = memcmp (buf, "\x00\x00\x00\x00", 4); ++ ut8 zbuf[4] = {0}; ++ r_io_read_at (core->io, op.jump, zbuf, 4); ++ isValidCall = memcmp (zbuf, "\x00\x00\x00\x00", 4); + } + if (isValidCall) { + #if JAYRO_03 +@@ -8798,9 +8798,8 @@ + } + + static void cmd_sdbk(Sdb *db, const char *input) { +- char *out = (input[0] == ' ') +- ? sdb_querys (db, NULL, 0, input + 1) +- : sdb_querys (db, NULL, 0, "*"); ++ const char *arg = (input[0] == ' ')? input + 1: "*"; ++ char *out = sdb_querys (db, NULL, 0, arg); + if (out) { + r_cons_println (out); + free (out); +@@ -9098,7 +9097,7 @@ + } + + static void cmd_anal_ucall_ref(RCore *core, ut64 addr) { +- RAnalFunction * fcn = r_anal_get_function_at (core->anal, addr); ++ RAnalFunction *fcn = r_anal_get_function_at (core->anal, addr); + if (fcn) { + r_cons_printf (" ; %s", fcn->name); + } else { diff --git a/radare2-5.8.8-CVE-2023-5686.patch b/radare2-5.8.8-CVE-2023-5686.patch new file mode 100644 index 0000000..be97561 --- /dev/null +++ b/radare2-5.8.8-CVE-2023-5686.patch @@ -0,0 +1,20 @@ +diff -ru radare2-5.8.8/shlr/java/code.c radare2-5.8.8.new/shlr/java/code.c +--- radare2-5.8.8/shlr/java/code.c 2023-06-08 15:54:42.000000000 +0200 ++++ radare2-5.8.8.new/shlr/java/code.c 2023-10-26 14:42:41.822081941 +0200 +@@ -191,10 +191,12 @@ + case 0xa6: // if_acmpne + case 0xa7: // goto + case 0xa8: // jsr +- snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, +- (addr+(short)USHORT (bytes, 1))); +- output[outlen-1] = 0; +- return update_bytes_consumed (JAVA_OPS[idx].size); ++ if (len > 3) { ++ const short delta = USHORT (bytes, 1); ++ snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, addr + delta); ++ output[outlen-1] = 0; ++ return update_bytes_consumed (JAVA_OPS[idx].size); ++ } + // XXX - Figure out what constitutes the [] value + case 0xab: // tableswitch + case 0xaa: // tableswitch diff --git a/radare2.spec b/radare2.spec index 3f697c2..2441d1d 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 1 +%global baserelease 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -39,6 +39,20 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch +# CVE-2023-4322 - radare2: Heap-based Buffer Overflow in the bf dissassembler +# fix should be part of 5.9.0 +# https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd +Patch5: radare2-5.8.8-CVE-2023-4322.patch + +# CVE-2023-5686 - radare2: heap-buffer-overflow in /radare2/shlr/java/code.c:211:21 in java_print_opcode +# fix should be part of 5.9.0 +# https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de +Patch6: radare2-5.8.8-CVE-2023-5686.patch + + + + + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -360,6 +374,11 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 +- cherrypick from upstream master patches for known vulnerabilities: +- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler +- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c + * Wed Jul 05 2023 Michal Ambroz 5.8.8-1 - bump to 5.8.8 @@ -374,6 +393,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Thu Mar 16 2023 Michal Ambroz 5.8.4-1 - bump to 5.8.4 +- fix CVE-2023-27114 * Sun Feb 26 2023 Michal Ambroz 5.8.2-2 - cherrypick upstream patch for fixing the sdb generation from meson @@ -450,6 +470,8 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} - bump to 5.3.0 - remove radare2-5.2.1-meson_rhel8.patch - accepted upstream - remove radare2-5.2.1-xxhash.patch - accepted upstream +- fix CVE-2021-32494 #2221281, #2221280, #2221282 +- fix CVE-2021-32495 #2221285, #2221286 * Sat May 15 2021 Michal Ambroz 5.2.1-3 - adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 From 5308e52a60159d8720c30d5e1df6b2ff12866a31 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 14:49:44 +0100 Subject: [PATCH 092/116] rebuild with 5.0.1 --- radare2.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/radare2.spec b/radare2.spec index 77b08c2..126343f 100644 --- a/radare2.spec +++ b/radare2.spec @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 +- rebuild F40+ with capstone 5.0.1+ + * Thu Oct 26 2023 Michal Ambroz 5.8.8-2 - cherrypick from upstream master patches for known vulnerabilities: - CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler From cf7acffaa8a1866b66a7a02e13888e76a68c46af Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 14:54:15 +0100 Subject: [PATCH 093/116] rebuild with capstone 5.0.1 --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 126343f..72eed03 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 2 +%global baserelease 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases From e05a26dc172905679101f7d5330b61fee4d40d9a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 15:53:17 +0100 Subject: [PATCH 094/116] update the license to SPDX --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 72eed03..1a2f341 100644 --- a/radare2.spec +++ b/radare2.spec @@ -53,7 +53,7 @@ Patch6: radare2-5.8.8-CVE-2023-5686.patch -License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib +License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ # some code has originally different license: From d9b75dda69eb48b093b9d0dbbd1e919acbd9860a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 22 Jan 2024 10:35:24 +0000 Subject: [PATCH 095/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 1a2f341..15b7c38 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 3 +%global baserelease 4 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Oct 26 2023 Michal Ambroz 5.8.8-3 - rebuild F40+ with capstone 5.0.1+ From f62823625617f127b145ed2e738e5de06eef9567 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 14:36:39 +0000 Subject: [PATCH 096/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 15b7c38..9158d06 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 4 +%global baserelease 5 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 75eb7b377b1493d6c28ff9868ca5ccc26bdc2500 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 5 May 2024 18:15:22 +0200 Subject: [PATCH 097/116] radare2 --- README.md | 23 ++++++++++++++++++- radare2-5.9.0-use_magic.patch | 42 +++++++++++++++++++++++++++++++++++ radare2.spec | 22 +++++++++++------- sources | 2 +- 4 files changed, 79 insertions(+), 10 deletions(-) create mode 100644 radare2-5.9.0-use_magic.patch diff --git a/README.md b/README.md index 6e0362e..bce9e92 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,24 @@ # radare2 -radare2: the reverse engineering framework \ No newline at end of file +radare2: the reverse engineering framework + + +## How to update + +### Rawhide +* do changes primarily in the rawhide branch +* request side tag with `fedpkg request-side-tag` +* build updated package with `fedpkg build --target=fZZ-build-side-XXXXX` from the `main` branch +* build cutter-re and other dependent packages with the same command from the `main` branch +* when all builds are done, create a bodhi update with `bodhi updates new --from-tag --notes "mynotes" --user YYYYY fZZ-build-side-XXXXX` + +### Stable +* wherever possible us fast-forward merge from rawhide to stable branches +``` +cd fXX +fedpkg pull && git merge origin/rawhide && fedpkg push && fedpkg build +``` +* create buildroot override with `fedpkg override create` +* possibly update and re-build iaito and other dependent packages with `fedpkg build` from the `fXX` branch +* when all builds are done, create a bodhi update with `bodhi updates new --type enhancement --bugs xxxxxxxx --close-bugs --notes "mynotes" radare2-nvr,iaito-nvr,...` + diff --git a/radare2-5.9.0-use_magic.patch b/radare2-5.9.0-use_magic.patch new file mode 100644 index 0000000..c8b031e --- /dev/null +++ b/radare2-5.9.0-use_magic.patch @@ -0,0 +1,42 @@ +diff -ru radare2-5.9.0.old/libr/magic/meson.build radare2-5.9.0.new/libr/magic/meson.build +--- radare2-5.9.0.old/libr/magic/meson.build 2024-03-31 17:01:15.000000000 +0200 ++++ radare2-5.9.0.new/libr/magic/meson.build 2024-04-21 00:48:57.545114120 +0200 +@@ -1,15 +1,3 @@ +-r_magic_sources = [ +- 'apprentice.c', +- 'ascmagic.c', +- 'fsmagic.c', +- 'funcs.c', +- 'mdump.c', +- 'is_tar.c', +- 'magic.c', +- # XXX not used? 'print.c', +- 'softmagic.c' +-] +- + r_magic_deps = [r_util_dep] + if get_option('blob') + r_magic_static_deps = [r_util_static_dep] +@@ -21,8 +9,22 @@ + if get_option('blob') + r_magic_static_deps += [sys_magic] + endif ++ r_magic_sources = [ ++ 'magic-libmagic.c', ++ 'ascmagic-libmagic.c', ++ ] + else + message('Use bundled magic library') ++ r_magic_sources = [ ++ 'apprentice.c', ++ 'ascmagic.c', ++ 'fsmagic.c', ++ 'funcs.c', ++ 'is_tar.c', ++ 'magic.c', ++ # XXX not used? 'print.c', ++ 'softmagic.c' ++ ] + endif + + r_magic = library('r_magic', r_magic_sources, diff --git a/radare2.spec b/radare2.spec index 9158d06..c071c80 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.8 -%global baserelease 5 +Version: 5.9.0 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20230608 -%global commit ea7f0356519884715cf1d5fba16042bac72b2df5 +%global gitdate 20240331 +%global commit 4a07098809c71c21515d0f862ac4ca044ae95e95 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -36,18 +36,20 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{nam # Specific to Fedora - build with system libraries Patch1: radare2-5.6.6-use_openssl.patch -Patch3: radare2-5.7.6-use_magic.patch -Patch4: radare2-5.6.6-use_lz4.patch +Patch3: radare2-5.9.0-use_magic.patch + +# using system-wide LZ4 should be done using conditionals +# Patch4: radare2-5.6.6-use_lz4.patch # CVE-2023-4322 - radare2: Heap-based Buffer Overflow in the bf dissassembler # fix should be part of 5.9.0 # https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd -Patch5: radare2-5.8.8-CVE-2023-4322.patch +# Patch5: radare2-5.8.8-CVE-2023-4322.patch # CVE-2023-5686 - radare2: heap-buffer-overflow in /radare2/shlr/java/code.c:211:21 in java_print_opcode # fix should be part of 5.9.0 # https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de -Patch6: radare2-5.8.8-CVE-2023-5686.patch +# Patch6: radare2-5.8.8-CVE-2023-5686.patch @@ -368,12 +370,16 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %{_datadir}/%{name}/%{version}/opcodes %{_datadir}/%{name}/%{version}/syscall %{_datadir}/%{name}/%{version}/charsets +%{_datadir}/%{name}/%{version}/platform %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 +- bump to 5.9.0 + * Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 65379f9..e6c62b8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b +SHA512 (radare2-5.9.0.tar.gz) = f184ad6e066a5113091912c11cca87cb9450eff20e920a00dc9da0efa9de97d6bfdaf44ae4d9e08a4760f4ebca82732832a309fad8452930adb4ee2438d9668e From 6041caa627e33ac1dbe40a621d51df37fd2e2216 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 18 May 2024 23:43:07 +0200 Subject: [PATCH 098/116] cosmetics --- radare2.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index c071c80..cb2bc68 100644 --- a/radare2.spec +++ b/radare2.spec @@ -28,10 +28,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} Release: %{baserelease}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries From d4b00ad1b3e0720f3190c6767c9d0500b03daaa3 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:44:42 +0200 Subject: [PATCH 099/116] bump to 5.9.2 --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index cb2bc68..3af3a05 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.0 +Version: 5.9.2 %global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -377,6 +377,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 From 803fff39945f7f86ffb2d3f0a5945b2fec32f20a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:49:50 +0200 Subject: [PATCH 100/116] radare2 - bump to 5.9.2 --- radare2.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/radare2.spec b/radare2.spec index 3af3a05..a77917f 100644 --- a/radare2.spec +++ b/radare2.spec @@ -22,15 +22,15 @@ VCS: https://github.com/radareorg/radare2 %global gitname radare2 %global gitdate 20240331 -%global commit 4a07098809c71c21515d0f862ac4ca044ae95e95 +%global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{baserelease}%{?dist} +Release: 1%{?dist} Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Release: 1%{?dist} Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -380,6 +380,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 From a74b7d314abaf7aad39b2660c30f8b175c33f4e0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:54:48 +0200 Subject: [PATCH 101/116] 5.9.2 - fix back the release numbers --- radare2.spec | 7 ++----- sources | 2 +- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/radare2.spec b/radare2.spec index a77917f..0513f39 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: 1%{?dist} +Release: %{baserelease}%{?dist} Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 1%{?dist} +Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -380,9 +380,6 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 -* Wed May 22 2024 Michal Ambroz - 5.9.2-1 -- bump to 5.9.2 - * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 diff --git a/sources b/sources index e6c62b8..33cd418 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.0.tar.gz) = f184ad6e066a5113091912c11cca87cb9450eff20e920a00dc9da0efa9de97d6bfdaf44ae4d9e08a4760f4ebca82732832a309fad8452930adb4ee2438d9668e +SHA512 (radare2-5.9.2.tar.gz) = e190ec124c6d48e512939782148b23fb0ef50aeb66763c198fdf7a6329d6882bb49a10641902313045b6802fca233c56fbc0142155b52f915dab4099481923c9 From 22caa02c41a9ebeab9f01b5eecc93ef09b71928d Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 30 May 2024 00:42:18 +0200 Subject: [PATCH 102/116] cosmetics --- radare2.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 0513f39..2be95c6 100644 --- a/radare2.spec +++ b/radare2.spec @@ -20,8 +20,7 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 - -%global gitdate 20240331 +%global gitdate 20240520 %global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d %global shortcommit %(c=%{commit}; echo ${c:0:7}) From c8e2d753e3c801dc1b02495a006bea8af0b3147c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 18:10:04 +0000 Subject: [PATCH 103/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 2be95c6..252753c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.9.2 -%global baserelease 1 +%global baserelease 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -376,6 +376,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 From 1c0b5ff277a44c88ad625869c35dd243dce9c8f0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 13:09:59 +0200 Subject: [PATCH 104/116] bump to 5.9.4 --- radare2.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/radare2.spec b/radare2.spec index 252753c..3958f2c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.2 -%global baserelease 2 +Version: 5.9.4 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -20,8 +20,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20240520 -%global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d +%global gitdate 20240808 +%global commit b77e3f8ed651b6866175062213158e2b33d2c1e7 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -376,6 +376,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 +- bump to 5.9.4 + * Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 44514a55eecb0dd23752484ddfd1c64621016641 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 13:17:58 +0200 Subject: [PATCH 105/116] bump to 5.9.4 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 33cd418..65379f9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.2.tar.gz) = e190ec124c6d48e512939782148b23fb0ef50aeb66763c198fdf7a6329d6882bb49a10641902313045b6802fca233c56fbc0142155b52f915dab4099481923c9 +SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b From 44a7813ff1dee2038d24634f4e7365859f13254c Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 22:50:23 +0200 Subject: [PATCH 106/116] bump to 5.9.4 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 65379f9..1af8588 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b +SHA512 (radare2-5.9.4.tar.gz) = 51d42b6d98027d3f3d85570e79ea18a8f220c145e3451fd10d82eea1a0542648f83447bb6cb6f5bbf76241677a2412bf064ffbade75e69b486c6148543aa4b0f From fea7fd87c73602fd3555122c02f9f88032639c05 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 16 Oct 2024 13:48:45 +0200 Subject: [PATCH 107/116] adding changelog --- changelog | 293 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 293 insertions(+) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..e5553cc --- /dev/null +++ b/changelog @@ -0,0 +1,293 @@ +* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 +- bump to 5.9.4 + +* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + +* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 +- bump to 5.9.0 + +* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 +- rebuild F40+ with capstone 5.0.1+ + +* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 +- cherrypick from upstream master patches for known vulnerabilities: +- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler +- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c + +* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 +- bump to 5.8.8 + +* Tue May 23 2023 Michal Ambroz 5.8.6-1 +- bump to 5.8.6 + +* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 +- 5.8.5 rebuild from git, patched for segfault + +* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 +- patch for segfault in sdb_hash + +* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 +- bump to 5.8.4 +- fix CVE-2023-27114 + +* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 +- cherrypick upstream patch for fixing the sdb generation from meson + +* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 +- bump to 5.8.2 +- fix CVE-2023-0302 , CVE-2023-0302 + +* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 +- bump to 5.7.8 + +* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 +- bump to 5.7.6 +- cherrypicked patch for new libmagic from upstream +- fix CVE-2022-34502 + +* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 +- bump to 5.6.8 + +* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 +- refresh list of bundled libraries and associated cleanup + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 +- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 + CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 + CVE-2022-1297 + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 +- bump to 5.6.6 + +* Mon Feb 28 2022 Michal Ambroz 5.6.4-1 +- bump to 5.6.4 + +* Wed Feb 09 2022 Michal Ambroz 5.6.2-1 +- bump to 5.6.2 +- disable multithreading for now to be able to compile with iaito + +* Wed Feb 09 2022 Michal Ambroz 5.6.0-2 +- patch declaration of int i in for cycle to avoid C99 mode on EPEL7 + +* Wed Feb 09 2022 Michal Ambroz 5.6.0-1 +- bump to 5.6.0 +- fix CVE-2022-0419 +- fix CVE-2021-4021 + +* Wed Jan 26 2022 Henrik Nordstrom - 5.5.4-1 +- Update to version 5.5.4 +- should be fixing CVE-2021-4021 + +* Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 +- Update to version 5.4.2 + +* Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 +- Update to version 5.4.0 +- Fix CVE-2021-3673 + +* Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jun 11 2021 Michal Ambroz 5.3.1-1 +- bump to 5.3.1 + +* Wed Jun 09 2021 Michal Ambroz 5.3.0-1 +- re-enable build for s390x on EPEL8 (libuv should be available for 8.4) +- bump to 5.3.0 +- remove radare2-5.2.1-meson_rhel8.patch - accepted upstream +- remove radare2-5.2.1-xxhash.patch - accepted upstream +- fix CVE-2021-32494 #2221281, #2221280, #2221282 +- fix CVE-2021-32495 #2221285, #2221286 + +* Sat May 15 2021 Michal Ambroz 5.2.1-3 +- adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 + +* Tue May 11 2021 Michal Ambroz 5.2.1-2 +- patch for older version of meson used on EPEL8 +- use pkgconfig where possible for BR +- use ldconfig_scriptlets only on older platforms +- add ExcludeArch for s390x on EPEL8 + +* Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 +- Update to version 5.2.1 + +* Wed Apr 21 2021 Michal Ambroz 5.2.0-3 +- avoid c99 for(int i... + +* Sat Apr 17 2021 Michal Ambroz 5.2.0-2 +- fix epel build + +* Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 +- Update to version 5.2.0 + +* Sun Feb 28 2021 Michal Ambroz 5.1.1-2 +- stop removing the r2pm binary from the package + +* Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 +- Rebase to upstream version 5.1.1 + +* Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 +- Rebuilt to make sure version is no lower than F32 + +* Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 +- Rebase to upstream version 4.5.0 + +* Fri May 8 2020 Riccardo Schirone - 4.4.0-2 +- Just re-build + +* Mon May 4 2020 Riccardo Schirone - 4.4.0-1 +- Rebase to upstream version 4.4.0 + +* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 +- Rebase to upstream version 4.2.1 +- Fix CVE-2019-19647 +- Fix CVE-2019-19590 + +* Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 +- Fix epel7 build + +* Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 +- Add missing BuildRequires: xxhash-devel, openssl-devel +- Add missing Requires for -devel package: file-devel, openssl-devel + +* Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 +- rebase to upstream version 3.9.0 + +* Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Wed Jun 26 2019 Riccardo Schirone - 3.6.0 +- rebase to upstream version 3.6.0 +* Tue Apr 16 2019 Adam Williamson - 3.4.1-2 +- Rebuild with Meson fix for #1699099 +- Fix versioning + +* Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 +- rebase to upstream version 3.4.1 +* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 +- rebase to upstream version 3.3.0 +* Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 +- fix version reported by radare2 -V +* Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 +- rebase to upstream version 3.2.0 +- remove patch to disable debugger on s390x and use build option +- move doc files to common package +- fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 +* Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 +- rebase to upstream version 3.1.0 +- remove duplicated /usr/share/radare2 dir in %%files +* Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 +- rebase to upstream version 3.0.1 which includes some minor fixes and fixes + for ppc64 and s390x architectures +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 +- fix datadir dir ownership +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 +- rebase to upstream version 3.0.0 +- fixes for r_sys_breakpoint on ppc64 and s390x architectures +* Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 +- use system xxhash and openssl +- bump to 2.9.0 release +- use bcond_without to choose between release build or git one +- add gcc as BuildRequires +- do not directly call ldconfig but use RPM macros +- add patch to compile on s390x architecture (disable debugger because there is no support) +- add patch to make tags.r2 file generation reproducible +- make common subpackage do not depend on arch of main package + +* Fri Aug 3 2018 Riccardo Schirone 2.8.0-0.2.20180718git51e2936 +- add grub2 and xxhash Provides +- add some license comments +- move SDB files in -common subpackage + +* Mon Jul 16 2018 Riccardo Schirone 2.8.0-0.1.20180718git51e2936 +- bump to 2.8.0 version and switch to meson + +* Fri Apr 13 2018 Michal Ambroz 2.5.0-1 +- bump to 2.5.0 release + +* Sun Feb 11 2018 Michal Ambroz 2.4.0-1 +- bump to 2.4.0 release + +* Mon Feb 05 2018 Michal Ambroz 2.3.0-1 +- bump to 2.3.0 release +- drop the web-interface for now + +* Tue Nov 14 2017 Michal Ambroz 2.0.1-1 +- bump to 2.0.1 release + +* Fri Aug 04 2017 Michal Ambroz 1.6.0-1 +- bump to 1.6.0 release + +* Thu Jun 08 2017 Michal Ambroz 1.5.0-1 +- bump to 1.5.0 release + +* Sun Apr 23 2017 Michal Ambroz 1.4.0-1 +- bump to 1.4.0 release + +* Sat Mar 18 2017 Michal Ambroz 1.3.0-1 +- bump to 1.3.0 release + +* Sat Feb 18 2017 Michal Ambroz 1.3.0-0.1.gita37af19 +- switch to git version fixing sigseg in radiff2 + +* Wed Feb 08 2017 Michal Ambroz 1.2.1-1 +- bump to 1.2.1 +- removed deprecated post postun calling of /sbin/ldconfig + +* Sat Oct 22 2016 Michal Ambroz 0.10.6-1 +- bump to 0.10.6 + +* Sun Aug 21 2016 Michal Ambroz 0.10.5-1 +- bump to 0.10.5 + +* Mon Aug 01 2016 Michal Ambroz 0.10.4-1 +- bump to 0.10.4 + +* Sun Jun 05 2016 Michal Ambroz 0.10.3-1 +- build for Fedora for release of 0.10.3 + +* Mon Apr 25 2016 Michal Ambroz 0.10.2-1 +- build for Fedora for release of 0.10.2 + +* Thu Jan 21 2016 Michal Ambroz 0.10.0-2 +- build for Fedora for release of 0.10.0 + +* Sat Oct 10 2015 Michal Ambroz 0.10.0-1 +- build for Fedora for alpha of 0.10.0 + +* Sun Nov 09 2014 Pavel Odvody 0.9.8rc3-0 +- initial radare2 package From f27b2bc9a9ba4d37e6cfa542f791f361037a4f48 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 16 Oct 2024 13:58:43 +0200 Subject: [PATCH 108/116] bump to 5.9.6 --- radare2.spec | 313 ++------------------------------------------------- sources | 2 +- 2 files changed, 12 insertions(+), 303 deletions(-) diff --git a/radare2.spec b/radare2.spec index 3958f2c..b7dfb4a 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,11 +1,12 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.4 -%global baserelease 1 +Version: 5.9.6 URL: https://radare.org/ -VCS: https://github.com/radareorg/radare2 +%global vcsurl https://github.com/radareorg/radare2 +VCS: git:%{vcsurl} # https://github.com/radareorg/radare2/releases + # %%if 0%%{?rhel} && 0%%{?rhel} == 8 # Radare2 fails to build on EPEL8+s390x # https://bugzilla.redhat.com/show_bug.cgi?id=1960046 @@ -20,17 +21,17 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20240808 -%global commit b77e3f8ed651b6866175062213158e2b33d2c1e7 +%global gitdate 20241013 +%global commit 2d36454e9914a5e0c03906b3e8d1e9fe4a2df6b7 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{baserelease}%{?dist} -Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Release: %autorelease +Source0: %{vcsurl}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} -Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +Release: %autorelease -s %{gitdate}git%{shortcommit} +Source0: %{vcsurl}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries @@ -376,296 +377,4 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 -- bump to 5.9.4 - -* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed May 22 2024 Michal Ambroz - 5.9.2-1 -- bump to 5.9.2 - -* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 -- bump to 5.9.0 - -* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 -- rebuild F40+ with capstone 5.0.1+ - -* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 -- cherrypick from upstream master patches for known vulnerabilities: -- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler -- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c - -* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 -- bump to 5.8.8 - -* Tue May 23 2023 Michal Ambroz 5.8.6-1 -- bump to 5.8.6 - -* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 -- 5.8.5 rebuild from git, patched for segfault - -* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 -- patch for segfault in sdb_hash - -* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 -- bump to 5.8.4 -- fix CVE-2023-27114 - -* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 -- cherrypick upstream patch for fixing the sdb generation from meson - -* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 -- bump to 5.8.2 -- fix CVE-2023-0302 , CVE-2023-0302 - -* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 -- bump to 5.7.8 - -* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 -- bump to 5.7.6 -- cherrypicked patch for new libmagic from upstream -- fix CVE-2022-34502 - -* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 -- bump to 5.6.8 - -* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 -- refresh list of bundled libraries and associated cleanup - -* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 -- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 - CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 - CVE-2022-1297 - -* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 -- bump to 5.6.6 - -* Mon Feb 28 2022 Michal Ambroz 5.6.4-1 -- bump to 5.6.4 - -* Wed Feb 09 2022 Michal Ambroz 5.6.2-1 -- bump to 5.6.2 -- disable multithreading for now to be able to compile with iaito - -* Wed Feb 09 2022 Michal Ambroz 5.6.0-2 -- patch declaration of int i in for cycle to avoid C99 mode on EPEL7 - -* Wed Feb 09 2022 Michal Ambroz 5.6.0-1 -- bump to 5.6.0 -- fix CVE-2022-0419 -- fix CVE-2021-4021 - -* Wed Jan 26 2022 Henrik Nordstrom - 5.5.4-1 -- Update to version 5.5.4 -- should be fixing CVE-2021-4021 - -* Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 -- Update to version 5.4.2 - -* Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 -- Update to version 5.4.0 -- Fix CVE-2021-3673 - -* Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Fri Jun 11 2021 Michal Ambroz 5.3.1-1 -- bump to 5.3.1 - -* Wed Jun 09 2021 Michal Ambroz 5.3.0-1 -- re-enable build for s390x on EPEL8 (libuv should be available for 8.4) -- bump to 5.3.0 -- remove radare2-5.2.1-meson_rhel8.patch - accepted upstream -- remove radare2-5.2.1-xxhash.patch - accepted upstream -- fix CVE-2021-32494 #2221281, #2221280, #2221282 -- fix CVE-2021-32495 #2221285, #2221286 - -* Sat May 15 2021 Michal Ambroz 5.2.1-3 -- adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 - -* Tue May 11 2021 Michal Ambroz 5.2.1-2 -- patch for older version of meson used on EPEL8 -- use pkgconfig where possible for BR -- use ldconfig_scriptlets only on older platforms -- add ExcludeArch for s390x on EPEL8 - -* Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 -- Update to version 5.2.1 - -* Wed Apr 21 2021 Michal Ambroz 5.2.0-3 -- avoid c99 for(int i... - -* Sat Apr 17 2021 Michal Ambroz 5.2.0-2 -- fix epel build - -* Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 -- Update to version 5.2.0 - -* Sun Feb 28 2021 Michal Ambroz 5.1.1-2 -- stop removing the r2pm binary from the package - -* Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 -- Rebase to upstream version 5.1.1 - -* Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 -- Rebuilt to make sure version is no lower than F32 - -* Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 -- Rebase to upstream version 4.5.0 - -* Fri May 8 2020 Riccardo Schirone - 4.4.0-2 -- Just re-build - -* Mon May 4 2020 Riccardo Schirone - 4.4.0-1 -- Rebase to upstream version 4.4.0 - -* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 -- Rebase to upstream version 4.2.1 -- Fix CVE-2019-19647 -- Fix CVE-2019-19590 - -* Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 -- Fix epel7 build - -* Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 -- Add missing BuildRequires: xxhash-devel, openssl-devel -- Add missing Requires for -devel package: file-devel, openssl-devel - -* Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 -- rebase to upstream version 3.9.0 - -* Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Wed Jun 26 2019 Riccardo Schirone - 3.6.0 -- rebase to upstream version 3.6.0 -* Tue Apr 16 2019 Adam Williamson - 3.4.1-2 -- Rebuild with Meson fix for #1699099 -- Fix versioning - -* Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 -- rebase to upstream version 3.4.1 -* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 -- rebase to upstream version 3.3.0 -* Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 -- fix version reported by radare2 -V -* Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 -- rebase to upstream version 3.2.0 -- remove patch to disable debugger on s390x and use build option -- move doc files to common package -- fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 -* Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 -- rebase to upstream version 3.1.0 -- remove duplicated /usr/share/radare2 dir in %%files -* Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 -- rebase to upstream version 3.0.1 which includes some minor fixes and fixes - for ppc64 and s390x architectures -* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 -- fix datadir dir ownership -* Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 -- rebase to upstream version 3.0.0 -- fixes for r_sys_breakpoint on ppc64 and s390x architectures -* Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 -- use system xxhash and openssl -- bump to 2.9.0 release -- use bcond_without to choose between release build or git one -- add gcc as BuildRequires -- do not directly call ldconfig but use RPM macros -- add patch to compile on s390x architecture (disable debugger because there is no support) -- add patch to make tags.r2 file generation reproducible -- make common subpackage do not depend on arch of main package - -* Fri Aug 3 2018 Riccardo Schirone 2.8.0-0.2.20180718git51e2936 -- add grub2 and xxhash Provides -- add some license comments -- move SDB files in -common subpackage - -* Mon Jul 16 2018 Riccardo Schirone 2.8.0-0.1.20180718git51e2936 -- bump to 2.8.0 version and switch to meson - -* Fri Apr 13 2018 Michal Ambroz 2.5.0-1 -- bump to 2.5.0 release - -* Sun Feb 11 2018 Michal Ambroz 2.4.0-1 -- bump to 2.4.0 release - -* Mon Feb 05 2018 Michal Ambroz 2.3.0-1 -- bump to 2.3.0 release -- drop the web-interface for now - -* Tue Nov 14 2017 Michal Ambroz 2.0.1-1 -- bump to 2.0.1 release - -* Fri Aug 04 2017 Michal Ambroz 1.6.0-1 -- bump to 1.6.0 release - -* Thu Jun 08 2017 Michal Ambroz 1.5.0-1 -- bump to 1.5.0 release - -* Sun Apr 23 2017 Michal Ambroz 1.4.0-1 -- bump to 1.4.0 release - -* Sat Mar 18 2017 Michal Ambroz 1.3.0-1 -- bump to 1.3.0 release - -* Sat Feb 18 2017 Michal Ambroz 1.3.0-0.1.gita37af19 -- switch to git version fixing sigseg in radiff2 - -* Wed Feb 08 2017 Michal Ambroz 1.2.1-1 -- bump to 1.2.1 -- removed deprecated post postun calling of /sbin/ldconfig - -* Sat Oct 22 2016 Michal Ambroz 0.10.6-1 -- bump to 0.10.6 - -* Sun Aug 21 2016 Michal Ambroz 0.10.5-1 -- bump to 0.10.5 - -* Mon Aug 01 2016 Michal Ambroz 0.10.4-1 -- bump to 0.10.4 - -* Sun Jun 05 2016 Michal Ambroz 0.10.3-1 -- build for Fedora for release of 0.10.3 - -* Mon Apr 25 2016 Michal Ambroz 0.10.2-1 -- build for Fedora for release of 0.10.2 - -* Thu Jan 21 2016 Michal Ambroz 0.10.0-2 -- build for Fedora for release of 0.10.0 - -* Sat Oct 10 2015 Michal Ambroz 0.10.0-1 -- build for Fedora for alpha of 0.10.0 - -* Sun Nov 09 2014 Pavel Odvody 0.9.8rc3-0 -- initial radare2 package +%autochangelog diff --git a/sources b/sources index 1af8588..66c7fbf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.4.tar.gz) = 51d42b6d98027d3f3d85570e79ea18a8f220c145e3451fd10d82eea1a0542648f83447bb6cb6f5bbf76241677a2412bf064ffbade75e69b486c6148543aa4b0f +SHA512 (radare2-5.9.6.tar.gz) = ae7211b560b0949f55d385846df3f477c46596e42d2076ab6cc6314adf77ec595f6f98800fb5d8999b82ec1150b9924e301976a18218858dd5f9399278ac9a59 From dbf4c8dabd9c03a524bb318ea93a4e3e2a129c75 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 22 Nov 2024 16:15:59 +0100 Subject: [PATCH 109/116] bump to 5.9.8 --- radare2-5.9.8-dec99.patch | 21 +++++++++++++++++++++ radare2.spec | 21 ++++++++++++++++----- sources | 2 +- 3 files changed, 38 insertions(+), 6 deletions(-) create mode 100644 radare2-5.9.8-dec99.patch diff --git a/radare2-5.9.8-dec99.patch b/radare2-5.9.8-dec99.patch new file mode 100644 index 0000000..53a9fa1 --- /dev/null +++ b/radare2-5.9.8-dec99.patch @@ -0,0 +1,21 @@ +diff -ru radare2-5.9.8.orig/shlr/qjs/src/quickjs.c radare2-5.9.8.new/shlr/qjs/src/quickjs.c +--- radare2-5.9.8.orig/shlr/qjs/src/quickjs.c 2024-11-19 12:38:30.000000000 +0100 ++++ radare2-5.9.8.new/shlr/qjs/src/quickjs.c 2024-11-22 14:34:10.546707808 +0100 +@@ -11311,6 +11311,8 @@ + char dest[minimum_length(JS_ECVT_BUF_SIZE)], + size_t size, int *decpt) + { ++ int i; ++ + if (n_digits == 0) { + /* find the minimum number of digits (XXX: inefficient but simple) */ + // TODO(chqrlie) use direct method from quickjs-printf +@@ -11360,7 +11362,7 @@ + return n_digits; /* truncate the 2 extra digits */ + } + /* round up in the string */ +- for(int i = n_digits;; i--) { ++ for(i = n_digits;; i--) { + /* ignore the locale specific decimal point */ + if (is_digit(dest[i])) { + if (dest[i]++ < '9') diff --git a/radare2.spec b/radare2.spec index b7dfb4a..fb30942 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.6 +Version: 5.9.8 URL: https://radare.org/ %global vcsurl https://github.com/radareorg/radare2 VCS: git:%{vcsurl} @@ -21,10 +21,15 @@ VCS: git:%{vcsurl} %global gituser radareorg %global gitname radare2 -%global gitdate 20241013 -%global commit 2d36454e9914a5e0c03906b3e8d1e9fe4a2df6b7 +%global gitdate 20241119 +%global commit 4eb49d5ad8c99eaecc8850a2f10bad407067c898 %global shortcommit %(c=%{commit}; echo ${c:0:7}) +# autorelease not available on epel7 +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1 +%endif + %if %{with releasetag} Release: %autorelease @@ -51,8 +56,10 @@ Patch3: radare2-5.9.0-use_magic.patch # https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de # Patch6: radare2-5.8.8-CVE-2023-5686.patch - - +# Build reports need for C99 compatibility mode for the index type declaration in the for cycle. +# As rest of the radare2 is strictly defining all index variables prior to for cycle, it is recommended +# to change this one as well +Patch7: radare2-5.9.8-dec99.patch License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib @@ -371,10 +378,14 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %{_datadir}/%{name}/%{version}/syscall %{_datadir}/%{name}/%{version}/charsets %{_datadir}/%{name}/%{version}/platform +%{_datadir}/%{name}/%{version}/scripts + %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog +%endif diff --git a/sources b/sources index 66c7fbf..1fba33c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.6.tar.gz) = ae7211b560b0949f55d385846df3f477c46596e42d2076ab6cc6314adf77ec595f6f98800fb5d8999b82ec1150b9924e301976a18218858dd5f9399278ac9a59 +SHA512 (radare2-5.9.8.tar.gz) = d1338bcbd437c7f376a07a9d6870fa56bdab883cc5371ce506bc7f667780e19ce777c2839926d4bedf0578ec9338567b402a678643f36ac84404be55eeadb2da From 3c6f7341d4f49ef6c1f8c5ff88ac7aad04586506 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 25 Nov 2024 10:11:23 +0100 Subject: [PATCH 110/116] documentation of embedded quickjs-ng library --- radare2.spec | 47 +++++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/radare2.spec b/radare2.spec index fb30942..44d2370 100644 --- a/radare2.spec +++ b/radare2.spec @@ -66,25 +66,26 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ # some code has originally different license: -# libr/asm/arch/ - GPLv2+, MIT, GPLv3 +# libr/asm/arch/ - GPLv2+, MIT, GPLv3 # libr/bin/format/pe/dotnet - Apache License Version 2.0 -# libr/hash/xxhash.c - 2 clause BSD -# libr/util/qrcode.c - MIT -# shlr/grub/grubfs.c - LGPL -# shlr/java - Apache 2.0 -# shlr/sdb/src - MIT -# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) -# shlr/squashfs/src - GPLv2+ -# libr/parse/c - LGPLv2+ -# shlr/udis86 - 2 clause BSD -# shlr/winkd - LGPL v3+ -# shlr/spp - MIT -# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) -# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) -# shlr/ptrace-wrap - LGPL v3+ -# shlr/tree-sitter - MIT -# shlr/mpc - 2 clause BSD -# shlr/yxml - MIT +# libr/hash/xxhash.c - 2 clause BSD +# libr/util/qrcode.c - MIT +# shlr/grub/grubfs.c - LGPL +# shlr/java - Apache 2.0 +# shlr/sdb/src - MIT +# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) +# shlr/squashfs/src - GPLv2+ +# libr/parse/c - LGPLv2+ +# shlr/udis86 - 2 clause BSD +# shlr/winkd - LGPL v3+ +# shlr/spp - MIT +# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) +# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) +# shlr/ptrace-wrap - LGPL v3+ +# shlr/tree-sitter - MIT +# shlr/mpc - 2 clause BSD +# shlr/yxml - MIT +# shlr/qjs - MIT # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -217,6 +218,16 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 + +# ./shlr/qjs +# https://github.com/quickjs-ng/quickjs +# License: MIT +Provides: bundled(quickjs-ng) = 0.7.0 + + + + + # and likely some more in libr/... borrowed from other projects %description From 7420e619a1c04af35eadab597c3ed1018eaedaff Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 00:48:59 +0100 Subject: [PATCH 111/116] [skip changelog] fix the build for rhel8 on rhel8 the env mangling works wrong for "env -S" --- radare2.spec | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/radare2.spec b/radare2.spec index 44d2370..990e5c3 100644 --- a/radare2.spec +++ b/radare2.spec @@ -89,16 +89,16 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui -# shlr/www/m - Apache-2.0 -# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT +# shlr/www/m - Apache-2.0 +# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT # shlr/www/enyo/vendors/jquery.layout-latest.min.js - GPL + MIT -# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT -# shlr/www/enyo/vendors/lodash.min.js - lodash license -# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 -# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 -# shlr/www/p/vendors/jquery* - GPL + MIT -# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD -# shlr/www/p/vendors/jquery.onoff.min.js - MIT +# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT +# shlr/www/enyo/vendors/lodash.min.js - lodash license +# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 +# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 +# shlr/www/p/vendors/jquery* - GPL + MIT +# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD +# shlr/www/p/vendors/jquery.onoff.min.js - MIT BuildRequires: sed BuildRequires: gcc @@ -218,16 +218,11 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 - # ./shlr/qjs # https://github.com/quickjs-ng/quickjs # License: MIT Provides: bundled(quickjs-ng) = 0.7.0 - - - - # and likely some more in libr/... borrowed from other projects %description @@ -302,6 +297,8 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build %endif +# On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" +sed -i -e "s|/usr/bin/env -S r2|/usr/bin/r2|" ./scripts/licenses.r2.js %build # Whereever possible use the system-wide libraries instead of bundles From e31daf3a1bbc0dde9a332da177fa4575d5dc75d6 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 02:44:42 +0100 Subject: [PATCH 112/116] fix epel build --- radare2.spec | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/radare2.spec b/radare2.spec index 990e5c3..1b09d52 100644 --- a/radare2.spec +++ b/radare2.spec @@ -26,8 +26,8 @@ VCS: git:%{vcsurl} %global shortcommit %(c=%{commit}; echo ${c:0:7}) # autorelease not available on epel7 -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) -%global autorelease 1 +%if ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1%{?dist} %endif @@ -290,11 +290,9 @@ echo "The radare2 source usually comes with a pre-built version of the web-inter echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora -%if 0%{?rhel} && 0%{?rhel} == 8 -# Meson on EPEL8 is older than meson on EPEL7 and older than recommended one -# on EPEL8 downgrade the recommendation in meson.build and pray -# meson_version : '>=0.50.1' => meson_version : '>=0.49.1' -sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build +%if 0%{?rhel} && 0%{?rhel} <= 8 +# Meson on EPEL8 / EPEL7 is older than recommended one +sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.47.2'|;" meson.build %endif # On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" From 36838d331cd5ca08dcce21069de90221e04a9057 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 21:58:29 +0000 Subject: [PATCH 113/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c79e6c5c16938c539212c6b8b431fc3bba94af16 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 8 Mar 2025 00:38:41 +0100 Subject: [PATCH 114/116] fix CVE-2025-1744 and CVE-2025-1864 --- radare2-5.9.8-magic-cve.patch | 47 +++++++++++++++++++++++++++++++++++ radare2-5.9.8-zlib-cve.patch | 30 ++++++++++++++++++++++ radare2.spec | 11 ++++++-- 3 files changed, 86 insertions(+), 2 deletions(-) create mode 100644 radare2-5.9.8-magic-cve.patch create mode 100644 radare2-5.9.8-zlib-cve.patch diff --git a/radare2-5.9.8-magic-cve.patch b/radare2-5.9.8-magic-cve.patch new file mode 100644 index 0000000..9e76c3b --- /dev/null +++ b/radare2-5.9.8-magic-cve.patch @@ -0,0 +1,47 @@ +From 9c92960f8606be2decf88cdcec7a7ab53ff13b4b Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Wed, 19 Feb 2025 23:42:14 +0800 +Subject: [PATCH 1/2] PR/454: Fix memory corruption when the continuation level + jumps by more than 20 in a single step. + +--- + libr/magic/funcs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 7356dc0c93f77..14687bf7be8f0 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,7 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len += 20) * sizeof (*ms->c.li); ++ size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { + +From 030e74cd136044e28828ab52615ce929693bae7a Mon Sep 17 00:00:00 2001 +From: pancake +Date: Wed, 19 Feb 2025 17:32:21 +0100 +Subject: [PATCH 2/2] Update libr/magic/funcs.c + +--- + libr/magic/funcs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 14687bf7be8f0..52e3819f0e04e 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,8 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); ++ ms->c.len = level + 20; ++ size_t len = ms->c.len * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { diff --git a/radare2-5.9.8-zlib-cve.patch b/radare2-5.9.8-zlib-cve.patch new file mode 100644 index 0000000..02ada03 --- /dev/null +++ b/radare2-5.9.8-zlib-cve.patch @@ -0,0 +1,30 @@ +From b49d2f0b84d424ec7fbf47138bf6acc6b18e1b0d Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Tue, 18 Feb 2025 11:28:15 +0800 +Subject: [PATCH] Fix a bug when getting a gzip header extra field with + inflate(). If the extra field was larger than the space the user provided + with inflateGetHeader(), and if multiple calls of inflate() delivered the + extra header data, then there could be a buffer overflow of the provided + space. This commit assures that provided space is not exceeded. + +--- + shlr/zip/zlib/inflate.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/shlr/zip/zlib/inflate.c b/shlr/zip/zlib/inflate.c +index e9ed74cff3279..2ecfb4876d155 100644 +--- a/shlr/zip/zlib/inflate.c ++++ b/shlr/zip/zlib/inflate.c +@@ -755,9 +755,10 @@ int ZEXPORT inflate(z_streamp strm, int flush) + copy = state->length; + if (copy > have) copy = have; + if (copy) { ++ len = state->head->extra_len - state->length; + if (state->head != Z_NULL && +- state->head->extra != Z_NULL) { +- len = state->head->extra_len - state->length; ++ state->head->extra != Z_NULL && ++ len < state->head->extra_max) { + zmemcpy(state->head->extra + len, next, + len + copy > state->head->extra_max ? + state->head->extra_max - len : copy); diff --git a/radare2.spec b/radare2.spec index 1b09d52..3ed3487 100644 --- a/radare2.spec +++ b/radare2.spec @@ -61,6 +61,15 @@ Patch3: radare2-5.9.0-use_magic.patch # to change this one as well Patch7: radare2-5.9.8-dec99.patch +# CVE-2025-1744 - Potential Vulnerability in zlib Library +# https://github.com/radareorg/radare2/pull/23969 +Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2-5.9.8-zlib-cve.patch + +# CVE-2025-1864 - Potential Vulnerability in magic Library +# https://github.com/radareorg/radare2/pull/23981 +Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch + + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -392,6 +401,4 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog -%endif From 756d6a5693c005c23746ebe9e82082c96e9521e0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 11 Mar 2025 18:24:30 +0100 Subject: [PATCH 115/116] fix CVE-2024-56737 --- radare2-5.9.8-hfs-cve.patch | 36 ++++++++++++++++++++++++++++++++++++ radare2.spec | 5 +++++ 2 files changed, 41 insertions(+) create mode 100644 radare2-5.9.8-hfs-cve.patch diff --git a/radare2-5.9.8-hfs-cve.patch b/radare2-5.9.8-hfs-cve.patch new file mode 100644 index 0000000..c4e58bf --- /dev/null +++ b/radare2-5.9.8-hfs-cve.patch @@ -0,0 +1,36 @@ +From 984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4 Mon Sep 17 00:00:00 2001 +From: pancake +Date: Thu, 2 Jan 2025 13:03:34 +0100 +Subject: [PATCH] CVE-2024-56737 - Fix buffer overflow in the HFS parser from + grub2 ##crash + +--- + shlr/grub/fs/hfs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/shlr/grub/fs/hfs.c b/shlr/grub/fs/hfs.c +index 33060d5d5fe25..98f717c4c47b4 100644 +--- a/shlr/grub/fs/hfs.c ++++ b/shlr/grub/fs/hfs.c +@@ -375,7 +375,9 @@ grub_hfs_mount (grub_disk_t disk) + volume name. */ + key.parent_dir = grub_cpu_to_be32 (1); + key.strlen = data->sblock.volname[0]; +- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ ///grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ strncpy (key.str, (char *) (data->sblock.volname + 1), sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + int depth = 0; + if (grub_hfs_find_node (data, (char *) &key, data->cat_root, +@@ -965,7 +967,9 @@ grub_hfs_find_dir (struct grub_hfs_data *data, const char *path, + + key.parent_dir = grub_cpu_to_be32 (inode); + key.strlen = grub_strlen (path); +- grub_strcpy ((char *) (key.str), path); ++ // grub_strcpy ((char *) (key.str), path); ++ strncpy (key.str, (char *) path, sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + /* Lookup this node. */ + if (! grub_hfs_find_node (data, (char *) &key, data->cat_root, diff --git a/radare2.spec b/radare2.spec index 3ed3487..d0d3c71 100644 --- a/radare2.spec +++ b/radare2.spec @@ -69,6 +69,11 @@ Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2 # https://github.com/radareorg/radare2/pull/23981 Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch +# CVE-2024-56737 - Fix buffer overflow in the HFS parser from grub2 +# https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch +# https://github.com/advisories/GHSA-9vr3-263w-c6mj +Patch10: https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib From c8ae303a57fda3f806a9f476641b1ca8ef257339 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 11:43:35 +0000 Subject: [PATCH 116/116] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild