From 5308e52a60159d8720c30d5e1df6b2ff12866a31 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 14:49:44 +0100 Subject: [PATCH 01/25] rebuild with 5.0.1 --- radare2.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/radare2.spec b/radare2.spec index 77b08c2..126343f 100644 --- a/radare2.spec +++ b/radare2.spec @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 +- rebuild F40+ with capstone 5.0.1+ + * Thu Oct 26 2023 Michal Ambroz 5.8.8-2 - cherrypick from upstream master patches for known vulnerabilities: - CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler From cf7acffaa8a1866b66a7a02e13888e76a68c46af Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 14:54:15 +0100 Subject: [PATCH 02/25] rebuild with capstone 5.0.1 --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 126343f..72eed03 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 2 +%global baserelease 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases From e05a26dc172905679101f7d5330b61fee4d40d9a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 15:53:17 +0100 Subject: [PATCH 03/25] update the license to SPDX --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 72eed03..1a2f341 100644 --- a/radare2.spec +++ b/radare2.spec @@ -53,7 +53,7 @@ Patch6: radare2-5.8.8-CVE-2023-5686.patch -License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib +License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ # some code has originally different license: From d9b75dda69eb48b093b9d0dbbd1e919acbd9860a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 22 Jan 2024 10:35:24 +0000 Subject: [PATCH 04/25] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 1a2f341..15b7c38 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 3 +%global baserelease 4 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Oct 26 2023 Michal Ambroz 5.8.8-3 - rebuild F40+ with capstone 5.0.1+ From f62823625617f127b145ed2e738e5de06eef9567 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 14:36:39 +0000 Subject: [PATCH 05/25] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 15b7c38..9158d06 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 4 +%global baserelease 5 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 75eb7b377b1493d6c28ff9868ca5ccc26bdc2500 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 5 May 2024 18:15:22 +0200 Subject: [PATCH 06/25] radare2 --- README.md | 23 ++++++++++++++++++- radare2-5.9.0-use_magic.patch | 42 +++++++++++++++++++++++++++++++++++ radare2.spec | 22 +++++++++++------- sources | 2 +- 4 files changed, 79 insertions(+), 10 deletions(-) create mode 100644 radare2-5.9.0-use_magic.patch diff --git a/README.md b/README.md index 6e0362e..bce9e92 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,24 @@ # radare2 -radare2: the reverse engineering framework \ No newline at end of file +radare2: the reverse engineering framework + + +## How to update + +### Rawhide +* do changes primarily in the rawhide branch +* request side tag with `fedpkg request-side-tag` +* build updated package with `fedpkg build --target=fZZ-build-side-XXXXX` from the `main` branch +* build cutter-re and other dependent packages with the same command from the `main` branch +* when all builds are done, create a bodhi update with `bodhi updates new --from-tag --notes "mynotes" --user YYYYY fZZ-build-side-XXXXX` + +### Stable +* wherever possible us fast-forward merge from rawhide to stable branches +``` +cd fXX +fedpkg pull && git merge origin/rawhide && fedpkg push && fedpkg build +``` +* create buildroot override with `fedpkg override create` +* possibly update and re-build iaito and other dependent packages with `fedpkg build` from the `fXX` branch +* when all builds are done, create a bodhi update with `bodhi updates new --type enhancement --bugs xxxxxxxx --close-bugs --notes "mynotes" radare2-nvr,iaito-nvr,...` + diff --git a/radare2-5.9.0-use_magic.patch b/radare2-5.9.0-use_magic.patch new file mode 100644 index 0000000..c8b031e --- /dev/null +++ b/radare2-5.9.0-use_magic.patch @@ -0,0 +1,42 @@ +diff -ru radare2-5.9.0.old/libr/magic/meson.build radare2-5.9.0.new/libr/magic/meson.build +--- radare2-5.9.0.old/libr/magic/meson.build 2024-03-31 17:01:15.000000000 +0200 ++++ radare2-5.9.0.new/libr/magic/meson.build 2024-04-21 00:48:57.545114120 +0200 +@@ -1,15 +1,3 @@ +-r_magic_sources = [ +- 'apprentice.c', +- 'ascmagic.c', +- 'fsmagic.c', +- 'funcs.c', +- 'mdump.c', +- 'is_tar.c', +- 'magic.c', +- # XXX not used? 'print.c', +- 'softmagic.c' +-] +- + r_magic_deps = [r_util_dep] + if get_option('blob') + r_magic_static_deps = [r_util_static_dep] +@@ -21,8 +9,22 @@ + if get_option('blob') + r_magic_static_deps += [sys_magic] + endif ++ r_magic_sources = [ ++ 'magic-libmagic.c', ++ 'ascmagic-libmagic.c', ++ ] + else + message('Use bundled magic library') ++ r_magic_sources = [ ++ 'apprentice.c', ++ 'ascmagic.c', ++ 'fsmagic.c', ++ 'funcs.c', ++ 'is_tar.c', ++ 'magic.c', ++ # XXX not used? 'print.c', ++ 'softmagic.c' ++ ] + endif + + r_magic = library('r_magic', r_magic_sources, diff --git a/radare2.spec b/radare2.spec index 9158d06..c071c80 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.8 -%global baserelease 5 +Version: 5.9.0 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20230608 -%global commit ea7f0356519884715cf1d5fba16042bac72b2df5 +%global gitdate 20240331 +%global commit 4a07098809c71c21515d0f862ac4ca044ae95e95 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -36,18 +36,20 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{nam # Specific to Fedora - build with system libraries Patch1: radare2-5.6.6-use_openssl.patch -Patch3: radare2-5.7.6-use_magic.patch -Patch4: radare2-5.6.6-use_lz4.patch +Patch3: radare2-5.9.0-use_magic.patch + +# using system-wide LZ4 should be done using conditionals +# Patch4: radare2-5.6.6-use_lz4.patch # CVE-2023-4322 - radare2: Heap-based Buffer Overflow in the bf dissassembler # fix should be part of 5.9.0 # https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd -Patch5: radare2-5.8.8-CVE-2023-4322.patch +# Patch5: radare2-5.8.8-CVE-2023-4322.patch # CVE-2023-5686 - radare2: heap-buffer-overflow in /radare2/shlr/java/code.c:211:21 in java_print_opcode # fix should be part of 5.9.0 # https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de -Patch6: radare2-5.8.8-CVE-2023-5686.patch +# Patch6: radare2-5.8.8-CVE-2023-5686.patch @@ -368,12 +370,16 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %{_datadir}/%{name}/%{version}/opcodes %{_datadir}/%{name}/%{version}/syscall %{_datadir}/%{name}/%{version}/charsets +%{_datadir}/%{name}/%{version}/platform %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 +- bump to 5.9.0 + * Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 65379f9..e6c62b8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b +SHA512 (radare2-5.9.0.tar.gz) = f184ad6e066a5113091912c11cca87cb9450eff20e920a00dc9da0efa9de97d6bfdaf44ae4d9e08a4760f4ebca82732832a309fad8452930adb4ee2438d9668e From 6041caa627e33ac1dbe40a621d51df37fd2e2216 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 18 May 2024 23:43:07 +0200 Subject: [PATCH 07/25] cosmetics --- radare2.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index c071c80..cb2bc68 100644 --- a/radare2.spec +++ b/radare2.spec @@ -28,10 +28,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} Release: %{baserelease}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries From d4b00ad1b3e0720f3190c6767c9d0500b03daaa3 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:44:42 +0200 Subject: [PATCH 08/25] bump to 5.9.2 --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index cb2bc68..3af3a05 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.0 +Version: 5.9.2 %global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -377,6 +377,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 From 803fff39945f7f86ffb2d3f0a5945b2fec32f20a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:49:50 +0200 Subject: [PATCH 09/25] radare2 - bump to 5.9.2 --- radare2.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/radare2.spec b/radare2.spec index 3af3a05..a77917f 100644 --- a/radare2.spec +++ b/radare2.spec @@ -22,15 +22,15 @@ VCS: https://github.com/radareorg/radare2 %global gitname radare2 %global gitdate 20240331 -%global commit 4a07098809c71c21515d0f862ac4ca044ae95e95 +%global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{baserelease}%{?dist} +Release: 1%{?dist} Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Release: 1%{?dist} Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -380,6 +380,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 From a74b7d314abaf7aad39b2660c30f8b175c33f4e0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:54:48 +0200 Subject: [PATCH 10/25] 5.9.2 - fix back the release numbers --- radare2.spec | 7 ++----- sources | 2 +- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/radare2.spec b/radare2.spec index a77917f..0513f39 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: 1%{?dist} +Release: %{baserelease}%{?dist} Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 1%{?dist} +Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -380,9 +380,6 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 -* Wed May 22 2024 Michal Ambroz - 5.9.2-1 -- bump to 5.9.2 - * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 diff --git a/sources b/sources index e6c62b8..33cd418 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.0.tar.gz) = f184ad6e066a5113091912c11cca87cb9450eff20e920a00dc9da0efa9de97d6bfdaf44ae4d9e08a4760f4ebca82732832a309fad8452930adb4ee2438d9668e +SHA512 (radare2-5.9.2.tar.gz) = e190ec124c6d48e512939782148b23fb0ef50aeb66763c198fdf7a6329d6882bb49a10641902313045b6802fca233c56fbc0142155b52f915dab4099481923c9 From 22caa02c41a9ebeab9f01b5eecc93ef09b71928d Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 30 May 2024 00:42:18 +0200 Subject: [PATCH 11/25] cosmetics --- radare2.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 0513f39..2be95c6 100644 --- a/radare2.spec +++ b/radare2.spec @@ -20,8 +20,7 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 - -%global gitdate 20240331 +%global gitdate 20240520 %global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d %global shortcommit %(c=%{commit}; echo ${c:0:7}) From c8e2d753e3c801dc1b02495a006bea8af0b3147c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 18:10:04 +0000 Subject: [PATCH 12/25] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 2be95c6..252753c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.9.2 -%global baserelease 1 +%global baserelease 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -376,6 +376,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 From 1c0b5ff277a44c88ad625869c35dd243dce9c8f0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 13:09:59 +0200 Subject: [PATCH 13/25] bump to 5.9.4 --- radare2.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/radare2.spec b/radare2.spec index 252753c..3958f2c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.2 -%global baserelease 2 +Version: 5.9.4 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -20,8 +20,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20240520 -%global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d +%global gitdate 20240808 +%global commit b77e3f8ed651b6866175062213158e2b33d2c1e7 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -376,6 +376,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 +- bump to 5.9.4 + * Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 44514a55eecb0dd23752484ddfd1c64621016641 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 13:17:58 +0200 Subject: [PATCH 14/25] bump to 5.9.4 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 33cd418..65379f9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.2.tar.gz) = e190ec124c6d48e512939782148b23fb0ef50aeb66763c198fdf7a6329d6882bb49a10641902313045b6802fca233c56fbc0142155b52f915dab4099481923c9 +SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b From 44a7813ff1dee2038d24634f4e7365859f13254c Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 22:50:23 +0200 Subject: [PATCH 15/25] bump to 5.9.4 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 65379f9..1af8588 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b +SHA512 (radare2-5.9.4.tar.gz) = 51d42b6d98027d3f3d85570e79ea18a8f220c145e3451fd10d82eea1a0542648f83447bb6cb6f5bbf76241677a2412bf064ffbade75e69b486c6148543aa4b0f From fea7fd87c73602fd3555122c02f9f88032639c05 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 16 Oct 2024 13:48:45 +0200 Subject: [PATCH 16/25] adding changelog --- changelog | 293 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 293 insertions(+) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..e5553cc --- /dev/null +++ b/changelog @@ -0,0 +1,293 @@ +* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 +- bump to 5.9.4 + +* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + +* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 +- bump to 5.9.0 + +* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 +- rebuild F40+ with capstone 5.0.1+ + +* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 +- cherrypick from upstream master patches for known vulnerabilities: +- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler +- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c + +* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 +- bump to 5.8.8 + +* Tue May 23 2023 Michal Ambroz 5.8.6-1 +- bump to 5.8.6 + +* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 +- 5.8.5 rebuild from git, patched for segfault + +* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 +- patch for segfault in sdb_hash + +* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 +- bump to 5.8.4 +- fix CVE-2023-27114 + +* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 +- cherrypick upstream patch for fixing the sdb generation from meson + +* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 +- bump to 5.8.2 +- fix CVE-2023-0302 , CVE-2023-0302 + +* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 +- bump to 5.7.8 + +* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 +- bump to 5.7.6 +- cherrypicked patch for new libmagic from upstream +- fix CVE-2022-34502 + +* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 +- bump to 5.6.8 + +* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 +- refresh list of bundled libraries and associated cleanup + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 +- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 + CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 + CVE-2022-1297 + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 +- bump to 5.6.6 + +* Mon Feb 28 2022 Michal Ambroz 5.6.4-1 +- bump to 5.6.4 + +* Wed Feb 09 2022 Michal Ambroz 5.6.2-1 +- bump to 5.6.2 +- disable multithreading for now to be able to compile with iaito + +* Wed Feb 09 2022 Michal Ambroz 5.6.0-2 +- patch declaration of int i in for cycle to avoid C99 mode on EPEL7 + +* Wed Feb 09 2022 Michal Ambroz 5.6.0-1 +- bump to 5.6.0 +- fix CVE-2022-0419 +- fix CVE-2021-4021 + +* Wed Jan 26 2022 Henrik Nordstrom - 5.5.4-1 +- Update to version 5.5.4 +- should be fixing CVE-2021-4021 + +* Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 +- Update to version 5.4.2 + +* Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 +- Update to version 5.4.0 +- Fix CVE-2021-3673 + +* Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jun 11 2021 Michal Ambroz 5.3.1-1 +- bump to 5.3.1 + +* Wed Jun 09 2021 Michal Ambroz 5.3.0-1 +- re-enable build for s390x on EPEL8 (libuv should be available for 8.4) +- bump to 5.3.0 +- remove radare2-5.2.1-meson_rhel8.patch - accepted upstream +- remove radare2-5.2.1-xxhash.patch - accepted upstream +- fix CVE-2021-32494 #2221281, #2221280, #2221282 +- fix CVE-2021-32495 #2221285, #2221286 + +* Sat May 15 2021 Michal Ambroz 5.2.1-3 +- adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 + +* Tue May 11 2021 Michal Ambroz 5.2.1-2 +- patch for older version of meson used on EPEL8 +- use pkgconfig where possible for BR +- use ldconfig_scriptlets only on older platforms +- add ExcludeArch for s390x on EPEL8 + +* Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 +- Update to version 5.2.1 + +* Wed Apr 21 2021 Michal Ambroz 5.2.0-3 +- avoid c99 for(int i... + +* Sat Apr 17 2021 Michal Ambroz 5.2.0-2 +- fix epel build + +* Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 +- Update to version 5.2.0 + +* Sun Feb 28 2021 Michal Ambroz 5.1.1-2 +- stop removing the r2pm binary from the package + +* Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 +- Rebase to upstream version 5.1.1 + +* Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 +- Rebuilt to make sure version is no lower than F32 + +* Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 +- Rebase to upstream version 4.5.0 + +* Fri May 8 2020 Riccardo Schirone - 4.4.0-2 +- Just re-build + +* Mon May 4 2020 Riccardo Schirone - 4.4.0-1 +- Rebase to upstream version 4.4.0 + +* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 +- Rebase to upstream version 4.2.1 +- Fix CVE-2019-19647 +- Fix CVE-2019-19590 + +* Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 +- Fix epel7 build + +* Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 +- Add missing BuildRequires: xxhash-devel, openssl-devel +- Add missing Requires for -devel package: file-devel, openssl-devel + +* Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 +- rebase to upstream version 3.9.0 + +* Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Wed Jun 26 2019 Riccardo Schirone - 3.6.0 +- rebase to upstream version 3.6.0 +* Tue Apr 16 2019 Adam Williamson - 3.4.1-2 +- Rebuild with Meson fix for #1699099 +- Fix versioning + +* Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 +- rebase to upstream version 3.4.1 +* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 +- rebase to upstream version 3.3.0 +* Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 +- fix version reported by radare2 -V +* Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 +- rebase to upstream version 3.2.0 +- remove patch to disable debugger on s390x and use build option +- move doc files to common package +- fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 +* Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 +- rebase to upstream version 3.1.0 +- remove duplicated /usr/share/radare2 dir in %%files +* Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 +- rebase to upstream version 3.0.1 which includes some minor fixes and fixes + for ppc64 and s390x architectures +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 +- fix datadir dir ownership +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 +- rebase to upstream version 3.0.0 +- fixes for r_sys_breakpoint on ppc64 and s390x architectures +* Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 +- use system xxhash and openssl +- bump to 2.9.0 release +- use bcond_without to choose between release build or git one +- add gcc as BuildRequires +- do not directly call ldconfig but use RPM macros +- add patch to compile on s390x architecture (disable debugger because there is no support) +- add patch to make tags.r2 file generation reproducible +- make common subpackage do not depend on arch of main package + +* Fri Aug 3 2018 Riccardo Schirone 2.8.0-0.2.20180718git51e2936 +- add grub2 and xxhash Provides +- add some license comments +- move SDB files in -common subpackage + +* Mon Jul 16 2018 Riccardo Schirone 2.8.0-0.1.20180718git51e2936 +- bump to 2.8.0 version and switch to meson + +* Fri Apr 13 2018 Michal Ambroz 2.5.0-1 +- bump to 2.5.0 release + +* Sun Feb 11 2018 Michal Ambroz 2.4.0-1 +- bump to 2.4.0 release + +* Mon Feb 05 2018 Michal Ambroz 2.3.0-1 +- bump to 2.3.0 release +- drop the web-interface for now + +* Tue Nov 14 2017 Michal Ambroz 2.0.1-1 +- bump to 2.0.1 release + +* Fri Aug 04 2017 Michal Ambroz 1.6.0-1 +- bump to 1.6.0 release + +* Thu Jun 08 2017 Michal Ambroz 1.5.0-1 +- bump to 1.5.0 release + +* Sun Apr 23 2017 Michal Ambroz 1.4.0-1 +- bump to 1.4.0 release + +* Sat Mar 18 2017 Michal Ambroz 1.3.0-1 +- bump to 1.3.0 release + +* Sat Feb 18 2017 Michal Ambroz 1.3.0-0.1.gita37af19 +- switch to git version fixing sigseg in radiff2 + +* Wed Feb 08 2017 Michal Ambroz 1.2.1-1 +- bump to 1.2.1 +- removed deprecated post postun calling of /sbin/ldconfig + +* Sat Oct 22 2016 Michal Ambroz 0.10.6-1 +- bump to 0.10.6 + +* Sun Aug 21 2016 Michal Ambroz 0.10.5-1 +- bump to 0.10.5 + +* Mon Aug 01 2016 Michal Ambroz 0.10.4-1 +- bump to 0.10.4 + +* Sun Jun 05 2016 Michal Ambroz 0.10.3-1 +- build for Fedora for release of 0.10.3 + +* Mon Apr 25 2016 Michal Ambroz 0.10.2-1 +- build for Fedora for release of 0.10.2 + +* Thu Jan 21 2016 Michal Ambroz 0.10.0-2 +- build for Fedora for release of 0.10.0 + +* Sat Oct 10 2015 Michal Ambroz 0.10.0-1 +- build for Fedora for alpha of 0.10.0 + +* Sun Nov 09 2014 Pavel Odvody 0.9.8rc3-0 +- initial radare2 package From f27b2bc9a9ba4d37e6cfa542f791f361037a4f48 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 16 Oct 2024 13:58:43 +0200 Subject: [PATCH 17/25] bump to 5.9.6 --- radare2.spec | 313 ++------------------------------------------------- sources | 2 +- 2 files changed, 12 insertions(+), 303 deletions(-) diff --git a/radare2.spec b/radare2.spec index 3958f2c..b7dfb4a 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,11 +1,12 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.4 -%global baserelease 1 +Version: 5.9.6 URL: https://radare.org/ -VCS: https://github.com/radareorg/radare2 +%global vcsurl https://github.com/radareorg/radare2 +VCS: git:%{vcsurl} # https://github.com/radareorg/radare2/releases + # %%if 0%%{?rhel} && 0%%{?rhel} == 8 # Radare2 fails to build on EPEL8+s390x # https://bugzilla.redhat.com/show_bug.cgi?id=1960046 @@ -20,17 +21,17 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20240808 -%global commit b77e3f8ed651b6866175062213158e2b33d2c1e7 +%global gitdate 20241013 +%global commit 2d36454e9914a5e0c03906b3e8d1e9fe4a2df6b7 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{baserelease}%{?dist} -Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Release: %autorelease +Source0: %{vcsurl}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} -Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +Release: %autorelease -s %{gitdate}git%{shortcommit} +Source0: %{vcsurl}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries @@ -376,296 +377,4 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 -- bump to 5.9.4 - -* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed May 22 2024 Michal Ambroz - 5.9.2-1 -- bump to 5.9.2 - -* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 -- bump to 5.9.0 - -* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 -- rebuild F40+ with capstone 5.0.1+ - -* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 -- cherrypick from upstream master patches for known vulnerabilities: -- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler -- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c - -* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 -- bump to 5.8.8 - -* Tue May 23 2023 Michal Ambroz 5.8.6-1 -- bump to 5.8.6 - -* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 -- 5.8.5 rebuild from git, patched for segfault - -* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 -- patch for segfault in sdb_hash - -* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 -- bump to 5.8.4 -- fix CVE-2023-27114 - -* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 -- cherrypick upstream patch for fixing the sdb generation from meson - -* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 -- bump to 5.8.2 -- fix CVE-2023-0302 , CVE-2023-0302 - -* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 -- bump to 5.7.8 - -* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 -- bump to 5.7.6 -- cherrypicked patch for new libmagic from upstream -- fix CVE-2022-34502 - -* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 -- bump to 5.6.8 - -* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 -- refresh list of bundled libraries and associated cleanup - -* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 -- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 - CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 - CVE-2022-1297 - -* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 -- bump to 5.6.6 - -* Mon Feb 28 2022 Michal Ambroz 5.6.4-1 -- bump to 5.6.4 - -* Wed Feb 09 2022 Michal Ambroz 5.6.2-1 -- bump to 5.6.2 -- disable multithreading for now to be able to compile with iaito - -* Wed Feb 09 2022 Michal Ambroz 5.6.0-2 -- patch declaration of int i in for cycle to avoid C99 mode on EPEL7 - -* Wed Feb 09 2022 Michal Ambroz 5.6.0-1 -- bump to 5.6.0 -- fix CVE-2022-0419 -- fix CVE-2021-4021 - -* Wed Jan 26 2022 Henrik Nordstrom - 5.5.4-1 -- Update to version 5.5.4 -- should be fixing CVE-2021-4021 - -* Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 -- Update to version 5.4.2 - -* Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 -- Update to version 5.4.0 -- Fix CVE-2021-3673 - -* Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Fri Jun 11 2021 Michal Ambroz 5.3.1-1 -- bump to 5.3.1 - -* Wed Jun 09 2021 Michal Ambroz 5.3.0-1 -- re-enable build for s390x on EPEL8 (libuv should be available for 8.4) -- bump to 5.3.0 -- remove radare2-5.2.1-meson_rhel8.patch - accepted upstream -- remove radare2-5.2.1-xxhash.patch - accepted upstream -- fix CVE-2021-32494 #2221281, #2221280, #2221282 -- fix CVE-2021-32495 #2221285, #2221286 - -* Sat May 15 2021 Michal Ambroz 5.2.1-3 -- adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 - -* Tue May 11 2021 Michal Ambroz 5.2.1-2 -- patch for older version of meson used on EPEL8 -- use pkgconfig where possible for BR -- use ldconfig_scriptlets only on older platforms -- add ExcludeArch for s390x on EPEL8 - -* Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 -- Update to version 5.2.1 - -* Wed Apr 21 2021 Michal Ambroz 5.2.0-3 -- avoid c99 for(int i... - -* Sat Apr 17 2021 Michal Ambroz 5.2.0-2 -- fix epel build - -* Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 -- Update to version 5.2.0 - -* Sun Feb 28 2021 Michal Ambroz 5.1.1-2 -- stop removing the r2pm binary from the package - -* Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 -- Rebase to upstream version 5.1.1 - -* Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 -- Rebuilt to make sure version is no lower than F32 - -* Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 -- Rebase to upstream version 4.5.0 - -* Fri May 8 2020 Riccardo Schirone - 4.4.0-2 -- Just re-build - -* Mon May 4 2020 Riccardo Schirone - 4.4.0-1 -- Rebase to upstream version 4.4.0 - -* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 -- Rebase to upstream version 4.2.1 -- Fix CVE-2019-19647 -- Fix CVE-2019-19590 - -* Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 -- Fix epel7 build - -* Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 -- Add missing BuildRequires: xxhash-devel, openssl-devel -- Add missing Requires for -devel package: file-devel, openssl-devel - -* Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 -- rebase to upstream version 3.9.0 - -* Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Wed Jun 26 2019 Riccardo Schirone - 3.6.0 -- rebase to upstream version 3.6.0 -* Tue Apr 16 2019 Adam Williamson - 3.4.1-2 -- Rebuild with Meson fix for #1699099 -- Fix versioning - -* Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 -- rebase to upstream version 3.4.1 -* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 -- rebase to upstream version 3.3.0 -* Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 -- fix version reported by radare2 -V -* Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 -- rebase to upstream version 3.2.0 -- remove patch to disable debugger on s390x and use build option -- move doc files to common package -- fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 -* Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 -- rebase to upstream version 3.1.0 -- remove duplicated /usr/share/radare2 dir in %%files -* Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 -- rebase to upstream version 3.0.1 which includes some minor fixes and fixes - for ppc64 and s390x architectures -* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 -- fix datadir dir ownership -* Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 -- rebase to upstream version 3.0.0 -- fixes for r_sys_breakpoint on ppc64 and s390x architectures -* Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 -- use system xxhash and openssl -- bump to 2.9.0 release -- use bcond_without to choose between release build or git one -- add gcc as BuildRequires -- do not directly call ldconfig but use RPM macros -- add patch to compile on s390x architecture (disable debugger because there is no support) -- add patch to make tags.r2 file generation reproducible -- make common subpackage do not depend on arch of main package - -* Fri Aug 3 2018 Riccardo Schirone 2.8.0-0.2.20180718git51e2936 -- add grub2 and xxhash Provides -- add some license comments -- move SDB files in -common subpackage - -* Mon Jul 16 2018 Riccardo Schirone 2.8.0-0.1.20180718git51e2936 -- bump to 2.8.0 version and switch to meson - -* Fri Apr 13 2018 Michal Ambroz 2.5.0-1 -- bump to 2.5.0 release - -* Sun Feb 11 2018 Michal Ambroz 2.4.0-1 -- bump to 2.4.0 release - -* Mon Feb 05 2018 Michal Ambroz 2.3.0-1 -- bump to 2.3.0 release -- drop the web-interface for now - -* Tue Nov 14 2017 Michal Ambroz 2.0.1-1 -- bump to 2.0.1 release - -* Fri Aug 04 2017 Michal Ambroz 1.6.0-1 -- bump to 1.6.0 release - -* Thu Jun 08 2017 Michal Ambroz 1.5.0-1 -- bump to 1.5.0 release - -* Sun Apr 23 2017 Michal Ambroz 1.4.0-1 -- bump to 1.4.0 release - -* Sat Mar 18 2017 Michal Ambroz 1.3.0-1 -- bump to 1.3.0 release - -* Sat Feb 18 2017 Michal Ambroz 1.3.0-0.1.gita37af19 -- switch to git version fixing sigseg in radiff2 - -* Wed Feb 08 2017 Michal Ambroz 1.2.1-1 -- bump to 1.2.1 -- removed deprecated post postun calling of /sbin/ldconfig - -* Sat Oct 22 2016 Michal Ambroz 0.10.6-1 -- bump to 0.10.6 - -* Sun Aug 21 2016 Michal Ambroz 0.10.5-1 -- bump to 0.10.5 - -* Mon Aug 01 2016 Michal Ambroz 0.10.4-1 -- bump to 0.10.4 - -* Sun Jun 05 2016 Michal Ambroz 0.10.3-1 -- build for Fedora for release of 0.10.3 - -* Mon Apr 25 2016 Michal Ambroz 0.10.2-1 -- build for Fedora for release of 0.10.2 - -* Thu Jan 21 2016 Michal Ambroz 0.10.0-2 -- build for Fedora for release of 0.10.0 - -* Sat Oct 10 2015 Michal Ambroz 0.10.0-1 -- build for Fedora for alpha of 0.10.0 - -* Sun Nov 09 2014 Pavel Odvody 0.9.8rc3-0 -- initial radare2 package +%autochangelog diff --git a/sources b/sources index 1af8588..66c7fbf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.4.tar.gz) = 51d42b6d98027d3f3d85570e79ea18a8f220c145e3451fd10d82eea1a0542648f83447bb6cb6f5bbf76241677a2412bf064ffbade75e69b486c6148543aa4b0f +SHA512 (radare2-5.9.6.tar.gz) = ae7211b560b0949f55d385846df3f477c46596e42d2076ab6cc6314adf77ec595f6f98800fb5d8999b82ec1150b9924e301976a18218858dd5f9399278ac9a59 From dbf4c8dabd9c03a524bb318ea93a4e3e2a129c75 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 22 Nov 2024 16:15:59 +0100 Subject: [PATCH 18/25] bump to 5.9.8 --- radare2-5.9.8-dec99.patch | 21 +++++++++++++++++++++ radare2.spec | 21 ++++++++++++++++----- sources | 2 +- 3 files changed, 38 insertions(+), 6 deletions(-) create mode 100644 radare2-5.9.8-dec99.patch diff --git a/radare2-5.9.8-dec99.patch b/radare2-5.9.8-dec99.patch new file mode 100644 index 0000000..53a9fa1 --- /dev/null +++ b/radare2-5.9.8-dec99.patch @@ -0,0 +1,21 @@ +diff -ru radare2-5.9.8.orig/shlr/qjs/src/quickjs.c radare2-5.9.8.new/shlr/qjs/src/quickjs.c +--- radare2-5.9.8.orig/shlr/qjs/src/quickjs.c 2024-11-19 12:38:30.000000000 +0100 ++++ radare2-5.9.8.new/shlr/qjs/src/quickjs.c 2024-11-22 14:34:10.546707808 +0100 +@@ -11311,6 +11311,8 @@ + char dest[minimum_length(JS_ECVT_BUF_SIZE)], + size_t size, int *decpt) + { ++ int i; ++ + if (n_digits == 0) { + /* find the minimum number of digits (XXX: inefficient but simple) */ + // TODO(chqrlie) use direct method from quickjs-printf +@@ -11360,7 +11362,7 @@ + return n_digits; /* truncate the 2 extra digits */ + } + /* round up in the string */ +- for(int i = n_digits;; i--) { ++ for(i = n_digits;; i--) { + /* ignore the locale specific decimal point */ + if (is_digit(dest[i])) { + if (dest[i]++ < '9') diff --git a/radare2.spec b/radare2.spec index b7dfb4a..fb30942 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.6 +Version: 5.9.8 URL: https://radare.org/ %global vcsurl https://github.com/radareorg/radare2 VCS: git:%{vcsurl} @@ -21,10 +21,15 @@ VCS: git:%{vcsurl} %global gituser radareorg %global gitname radare2 -%global gitdate 20241013 -%global commit 2d36454e9914a5e0c03906b3e8d1e9fe4a2df6b7 +%global gitdate 20241119 +%global commit 4eb49d5ad8c99eaecc8850a2f10bad407067c898 %global shortcommit %(c=%{commit}; echo ${c:0:7}) +# autorelease not available on epel7 +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1 +%endif + %if %{with releasetag} Release: %autorelease @@ -51,8 +56,10 @@ Patch3: radare2-5.9.0-use_magic.patch # https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de # Patch6: radare2-5.8.8-CVE-2023-5686.patch - - +# Build reports need for C99 compatibility mode for the index type declaration in the for cycle. +# As rest of the radare2 is strictly defining all index variables prior to for cycle, it is recommended +# to change this one as well +Patch7: radare2-5.9.8-dec99.patch License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib @@ -371,10 +378,14 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %{_datadir}/%{name}/%{version}/syscall %{_datadir}/%{name}/%{version}/charsets %{_datadir}/%{name}/%{version}/platform +%{_datadir}/%{name}/%{version}/scripts + %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog +%endif diff --git a/sources b/sources index 66c7fbf..1fba33c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.6.tar.gz) = ae7211b560b0949f55d385846df3f477c46596e42d2076ab6cc6314adf77ec595f6f98800fb5d8999b82ec1150b9924e301976a18218858dd5f9399278ac9a59 +SHA512 (radare2-5.9.8.tar.gz) = d1338bcbd437c7f376a07a9d6870fa56bdab883cc5371ce506bc7f667780e19ce777c2839926d4bedf0578ec9338567b402a678643f36ac84404be55eeadb2da From 3c6f7341d4f49ef6c1f8c5ff88ac7aad04586506 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 25 Nov 2024 10:11:23 +0100 Subject: [PATCH 19/25] documentation of embedded quickjs-ng library --- radare2.spec | 47 +++++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/radare2.spec b/radare2.spec index fb30942..44d2370 100644 --- a/radare2.spec +++ b/radare2.spec @@ -66,25 +66,26 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ # some code has originally different license: -# libr/asm/arch/ - GPLv2+, MIT, GPLv3 +# libr/asm/arch/ - GPLv2+, MIT, GPLv3 # libr/bin/format/pe/dotnet - Apache License Version 2.0 -# libr/hash/xxhash.c - 2 clause BSD -# libr/util/qrcode.c - MIT -# shlr/grub/grubfs.c - LGPL -# shlr/java - Apache 2.0 -# shlr/sdb/src - MIT -# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) -# shlr/squashfs/src - GPLv2+ -# libr/parse/c - LGPLv2+ -# shlr/udis86 - 2 clause BSD -# shlr/winkd - LGPL v3+ -# shlr/spp - MIT -# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) -# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) -# shlr/ptrace-wrap - LGPL v3+ -# shlr/tree-sitter - MIT -# shlr/mpc - 2 clause BSD -# shlr/yxml - MIT +# libr/hash/xxhash.c - 2 clause BSD +# libr/util/qrcode.c - MIT +# shlr/grub/grubfs.c - LGPL +# shlr/java - Apache 2.0 +# shlr/sdb/src - MIT +# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) +# shlr/squashfs/src - GPLv2+ +# libr/parse/c - LGPLv2+ +# shlr/udis86 - 2 clause BSD +# shlr/winkd - LGPL v3+ +# shlr/spp - MIT +# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) +# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) +# shlr/ptrace-wrap - LGPL v3+ +# shlr/tree-sitter - MIT +# shlr/mpc - 2 clause BSD +# shlr/yxml - MIT +# shlr/qjs - MIT # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -217,6 +218,16 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 + +# ./shlr/qjs +# https://github.com/quickjs-ng/quickjs +# License: MIT +Provides: bundled(quickjs-ng) = 0.7.0 + + + + + # and likely some more in libr/... borrowed from other projects %description From 7420e619a1c04af35eadab597c3ed1018eaedaff Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 00:48:59 +0100 Subject: [PATCH 20/25] [skip changelog] fix the build for rhel8 on rhel8 the env mangling works wrong for "env -S" --- radare2.spec | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/radare2.spec b/radare2.spec index 44d2370..990e5c3 100644 --- a/radare2.spec +++ b/radare2.spec @@ -89,16 +89,16 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui -# shlr/www/m - Apache-2.0 -# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT +# shlr/www/m - Apache-2.0 +# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT # shlr/www/enyo/vendors/jquery.layout-latest.min.js - GPL + MIT -# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT -# shlr/www/enyo/vendors/lodash.min.js - lodash license -# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 -# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 -# shlr/www/p/vendors/jquery* - GPL + MIT -# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD -# shlr/www/p/vendors/jquery.onoff.min.js - MIT +# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT +# shlr/www/enyo/vendors/lodash.min.js - lodash license +# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 +# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 +# shlr/www/p/vendors/jquery* - GPL + MIT +# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD +# shlr/www/p/vendors/jquery.onoff.min.js - MIT BuildRequires: sed BuildRequires: gcc @@ -218,16 +218,11 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 - # ./shlr/qjs # https://github.com/quickjs-ng/quickjs # License: MIT Provides: bundled(quickjs-ng) = 0.7.0 - - - - # and likely some more in libr/... borrowed from other projects %description @@ -302,6 +297,8 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build %endif +# On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" +sed -i -e "s|/usr/bin/env -S r2|/usr/bin/r2|" ./scripts/licenses.r2.js %build # Whereever possible use the system-wide libraries instead of bundles From e31daf3a1bbc0dde9a332da177fa4575d5dc75d6 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 02:44:42 +0100 Subject: [PATCH 21/25] fix epel build --- radare2.spec | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/radare2.spec b/radare2.spec index 990e5c3..1b09d52 100644 --- a/radare2.spec +++ b/radare2.spec @@ -26,8 +26,8 @@ VCS: git:%{vcsurl} %global shortcommit %(c=%{commit}; echo ${c:0:7}) # autorelease not available on epel7 -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) -%global autorelease 1 +%if ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1%{?dist} %endif @@ -290,11 +290,9 @@ echo "The radare2 source usually comes with a pre-built version of the web-inter echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora -%if 0%{?rhel} && 0%{?rhel} == 8 -# Meson on EPEL8 is older than meson on EPEL7 and older than recommended one -# on EPEL8 downgrade the recommendation in meson.build and pray -# meson_version : '>=0.50.1' => meson_version : '>=0.49.1' -sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build +%if 0%{?rhel} && 0%{?rhel} <= 8 +# Meson on EPEL8 / EPEL7 is older than recommended one +sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.47.2'|;" meson.build %endif # On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" From 36838d331cd5ca08dcce21069de90221e04a9057 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 21:58:29 +0000 Subject: [PATCH 22/25] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c79e6c5c16938c539212c6b8b431fc3bba94af16 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 8 Mar 2025 00:38:41 +0100 Subject: [PATCH 23/25] fix CVE-2025-1744 and CVE-2025-1864 --- radare2-5.9.8-magic-cve.patch | 47 +++++++++++++++++++++++++++++++++++ radare2-5.9.8-zlib-cve.patch | 30 ++++++++++++++++++++++ radare2.spec | 11 ++++++-- 3 files changed, 86 insertions(+), 2 deletions(-) create mode 100644 radare2-5.9.8-magic-cve.patch create mode 100644 radare2-5.9.8-zlib-cve.patch diff --git a/radare2-5.9.8-magic-cve.patch b/radare2-5.9.8-magic-cve.patch new file mode 100644 index 0000000..9e76c3b --- /dev/null +++ b/radare2-5.9.8-magic-cve.patch @@ -0,0 +1,47 @@ +From 9c92960f8606be2decf88cdcec7a7ab53ff13b4b Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Wed, 19 Feb 2025 23:42:14 +0800 +Subject: [PATCH 1/2] PR/454: Fix memory corruption when the continuation level + jumps by more than 20 in a single step. + +--- + libr/magic/funcs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 7356dc0c93f77..14687bf7be8f0 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,7 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len += 20) * sizeof (*ms->c.li); ++ size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { + +From 030e74cd136044e28828ab52615ce929693bae7a Mon Sep 17 00:00:00 2001 +From: pancake +Date: Wed, 19 Feb 2025 17:32:21 +0100 +Subject: [PATCH 2/2] Update libr/magic/funcs.c + +--- + libr/magic/funcs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 14687bf7be8f0..52e3819f0e04e 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,8 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); ++ ms->c.len = level + 20; ++ size_t len = ms->c.len * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { diff --git a/radare2-5.9.8-zlib-cve.patch b/radare2-5.9.8-zlib-cve.patch new file mode 100644 index 0000000..02ada03 --- /dev/null +++ b/radare2-5.9.8-zlib-cve.patch @@ -0,0 +1,30 @@ +From b49d2f0b84d424ec7fbf47138bf6acc6b18e1b0d Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Tue, 18 Feb 2025 11:28:15 +0800 +Subject: [PATCH] Fix a bug when getting a gzip header extra field with + inflate(). If the extra field was larger than the space the user provided + with inflateGetHeader(), and if multiple calls of inflate() delivered the + extra header data, then there could be a buffer overflow of the provided + space. This commit assures that provided space is not exceeded. + +--- + shlr/zip/zlib/inflate.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/shlr/zip/zlib/inflate.c b/shlr/zip/zlib/inflate.c +index e9ed74cff3279..2ecfb4876d155 100644 +--- a/shlr/zip/zlib/inflate.c ++++ b/shlr/zip/zlib/inflate.c +@@ -755,9 +755,10 @@ int ZEXPORT inflate(z_streamp strm, int flush) + copy = state->length; + if (copy > have) copy = have; + if (copy) { ++ len = state->head->extra_len - state->length; + if (state->head != Z_NULL && +- state->head->extra != Z_NULL) { +- len = state->head->extra_len - state->length; ++ state->head->extra != Z_NULL && ++ len < state->head->extra_max) { + zmemcpy(state->head->extra + len, next, + len + copy > state->head->extra_max ? + state->head->extra_max - len : copy); diff --git a/radare2.spec b/radare2.spec index 1b09d52..3ed3487 100644 --- a/radare2.spec +++ b/radare2.spec @@ -61,6 +61,15 @@ Patch3: radare2-5.9.0-use_magic.patch # to change this one as well Patch7: radare2-5.9.8-dec99.patch +# CVE-2025-1744 - Potential Vulnerability in zlib Library +# https://github.com/radareorg/radare2/pull/23969 +Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2-5.9.8-zlib-cve.patch + +# CVE-2025-1864 - Potential Vulnerability in magic Library +# https://github.com/radareorg/radare2/pull/23981 +Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch + + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -392,6 +401,4 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog -%endif From 756d6a5693c005c23746ebe9e82082c96e9521e0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 11 Mar 2025 18:24:30 +0100 Subject: [PATCH 24/25] fix CVE-2024-56737 --- radare2-5.9.8-hfs-cve.patch | 36 ++++++++++++++++++++++++++++++++++++ radare2.spec | 5 +++++ 2 files changed, 41 insertions(+) create mode 100644 radare2-5.9.8-hfs-cve.patch diff --git a/radare2-5.9.8-hfs-cve.patch b/radare2-5.9.8-hfs-cve.patch new file mode 100644 index 0000000..c4e58bf --- /dev/null +++ b/radare2-5.9.8-hfs-cve.patch @@ -0,0 +1,36 @@ +From 984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4 Mon Sep 17 00:00:00 2001 +From: pancake +Date: Thu, 2 Jan 2025 13:03:34 +0100 +Subject: [PATCH] CVE-2024-56737 - Fix buffer overflow in the HFS parser from + grub2 ##crash + +--- + shlr/grub/fs/hfs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/shlr/grub/fs/hfs.c b/shlr/grub/fs/hfs.c +index 33060d5d5fe25..98f717c4c47b4 100644 +--- a/shlr/grub/fs/hfs.c ++++ b/shlr/grub/fs/hfs.c +@@ -375,7 +375,9 @@ grub_hfs_mount (grub_disk_t disk) + volume name. */ + key.parent_dir = grub_cpu_to_be32 (1); + key.strlen = data->sblock.volname[0]; +- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ ///grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ strncpy (key.str, (char *) (data->sblock.volname + 1), sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + int depth = 0; + if (grub_hfs_find_node (data, (char *) &key, data->cat_root, +@@ -965,7 +967,9 @@ grub_hfs_find_dir (struct grub_hfs_data *data, const char *path, + + key.parent_dir = grub_cpu_to_be32 (inode); + key.strlen = grub_strlen (path); +- grub_strcpy ((char *) (key.str), path); ++ // grub_strcpy ((char *) (key.str), path); ++ strncpy (key.str, (char *) path, sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + /* Lookup this node. */ + if (! grub_hfs_find_node (data, (char *) &key, data->cat_root, diff --git a/radare2.spec b/radare2.spec index 3ed3487..d0d3c71 100644 --- a/radare2.spec +++ b/radare2.spec @@ -69,6 +69,11 @@ Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2 # https://github.com/radareorg/radare2/pull/23981 Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch +# CVE-2024-56737 - Fix buffer overflow in the HFS parser from grub2 +# https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch +# https://github.com/advisories/GHSA-9vr3-263w-c6mj +Patch10: https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib From c8ae303a57fda3f806a9f476641b1ca8ef257339 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 11:43:35 +0000 Subject: [PATCH 25/25] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild