From 1f57a367534c2888aca623183c868533572e3cd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Tue, 12 Apr 2022 22:42:26 +0200 Subject: [PATCH 01/51] Bump to 5.6.6 --- .gitignore | 1 + radare2.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 48bd1ae..60952c3 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ /radare2-5.6.0.tar.gz /radare2-5.6.2.tar.gz /radare2-5.6.4.tar.gz +/radare2-5.6.6.tar.gz diff --git a/radare2.spec b/radare2.spec index 72c3aef..69fcab1 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.6.4 +Version: 5.6.6 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -323,6 +323,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue Apr 12 2922 Henrikj Nordstrom 5.6.6-1 +- bump to 5.6.6 + * Mon Feb 28 2022 Michal Ambroz 5.6.4-1 - bump to 5.6.4 diff --git a/sources b/sources index 3e0e0e9..5dd77c4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.6.4.tar.gz) = 5e7ff9c5d73685a4a0167750f74bb7ddcb19d3e3d2a306d8eea00b4f961efdbed4843f6e3ff66ef7108a91d372fc403eaf7343a3f4d1bada4e5ac243529e2593 +SHA512 (radare2-5.6.6.tar.gz) = 0969d923b0c65c937dadb3cef655a3931b3daf1fc48bf1f6e3dd1afd1df54f65da3baf4bd401eb1677f88566774ed115c271cdc923dc4ef800ef867f4849efb0 From cb6504ca9db9ec1122c78d77bfb7db8dad94aad7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Wed, 13 Apr 2022 01:10:13 +0200 Subject: [PATCH 02/51] A number of CVE fixes --- CVE-2022-1061.patch | 29 ++++++ CVE-2022-1207.patch | 98 ++++++++++++++++++++ CVE-2022-1237.patch | 98 ++++++++++++++++++++ CVE-2022-1238-2.patch | 205 ++++++++++++++++++++++++++++++++++++++++++ CVE-2022-1238.patch | 35 ++++++++ CVE-2022-1240.patch | 23 +++++ CVE-2022-1244.patch | 34 +++++++ CVE-2022-1283.patch | 33 +++++++ CVE-2022-1284.patch | 36 ++++++++ CVE-2022-1296.patch | 83 +++++++++++++++++ CVE-2022-1297.patch | 39 ++++++++ radare2.spec | 42 ++++++++- 12 files changed, 753 insertions(+), 2 deletions(-) create mode 100644 CVE-2022-1061.patch create mode 100644 CVE-2022-1207.patch create mode 100644 CVE-2022-1237.patch create mode 100644 CVE-2022-1238-2.patch create mode 100644 CVE-2022-1238.patch create mode 100644 CVE-2022-1240.patch create mode 100644 CVE-2022-1244.patch create mode 100644 CVE-2022-1283.patch create mode 100644 CVE-2022-1284.patch create mode 100644 CVE-2022-1296.patch create mode 100644 CVE-2022-1297.patch diff --git a/CVE-2022-1061.patch b/CVE-2022-1061.patch new file mode 100644 index 0000000..affd9b7 --- /dev/null +++ b/CVE-2022-1061.patch @@ -0,0 +1,29 @@ +commit d4ce40b516ffd70cf2e9e36832d8de139117d522 +Author: Sergi Àlvarez i Capilla +Date: Thu Mar 24 10:11:29 2022 +0100 + + Fix oobread in symbols header parsing ##bin + +diff --git a/libr/bin/p/bin_symbols.c b/libr/bin/p/bin_symbols.c +index 2036dc092..779e36940 100644 +--- a/libr/bin/p/bin_symbols.c ++++ b/libr/bin/p/bin_symbols.c +@@ -181,7 +181,7 @@ static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy + + static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) { + D eprintf ("Dragons at 0x%x\n", off); +- ut64 size = r_buf_size (buf); ++ st64 size = r_buf_size (buf); + if (off >= size) { + return NULL; + } +@@ -189,6 +189,9 @@ static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, i + if (!size) { + return NULL; + } ++ if (size < 32) { ++ return NULL; ++ } + ut8 *b = malloc (size); + if (!b) { + return NULL; diff --git a/CVE-2022-1207.patch b/CVE-2022-1207.patch new file mode 100644 index 0000000..91f0f3e --- /dev/null +++ b/CVE-2022-1207.patch @@ -0,0 +1,98 @@ +commit 605785b65dd356d46d4487faa41dbf90943b8bc1 +Author: pancake +Date: Fri Apr 1 21:03:24 2022 +0200 + + Fix 1 byte oobread in the cris analysis plugin ##crash + +diff --git a/libr/anal/p/anal_cris.c b/libr/anal/p/anal_cris.c +index 2b95c37e0..db30421ed 100644 +--- a/libr/anal/p/anal_cris.c ++++ b/libr/anal/p/anal_cris.c +@@ -1,4 +1,4 @@ +-/* radare2 - LGPL - Copyright 2014-2015 - pancake */ ++/* radare2 - LGPL - Copyright 2014-2022 - pancake */ + + #include + #include +@@ -7,6 +7,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + int opsize = -1; + op->type = -1; + opsize = 2; ++ if (len < 1) { ++ return -1; ++ } + switch (buf[0]) { + case 0x3f: + case 0x4f: +@@ -21,9 +24,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + op->type = R_ANAL_OP_TYPE_LEA; + if (len > 5) { + op->ptr = buf[2]; +- op->ptr |= buf[3]<<8; +- op->ptr |= buf[4]<<16; +- op->ptr |= ((ut32)(0xff&buf[5]))<<24; ++ op->ptr |= buf[3] << 8; ++ op->ptr |= buf[4] << 16; ++ op->ptr |= ((ut32)(0xff & buf[5])) << 24; + op->ptr += addr; + opsize = 6; + } else { +@@ -35,9 +38,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + op->type = R_ANAL_OP_TYPE_CALL; + if (len > 5) { + st32 delta = buf[2]; +- delta |= buf[3]<<8; +- delta |= buf[4]<<16; +- delta |= buf[5]<<24; ++ delta |= buf[3] << 8; ++ delta |= buf[4] << 16; ++ delta |= buf[5] << 24; + op->jump = addr + delta; + } else { + op->jump = UT64_MAX; +@@ -46,6 +49,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + opsize = 6; + break; + case 0x00: ++ if (len < 2) { ++ break; ++ } + if (buf[1] == 0x00) { + op->type = R_ANAL_OP_TYPE_TRAP; + } else { +@@ -57,11 +63,17 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + } + break; + case 0xf0: +- if (buf[1]==0xb9) { ++ if (len < 2) { ++ break; ++ } ++ if (buf[1] == 0xb9) { + op->type = R_ANAL_OP_TYPE_RET; + } + break; + default: ++ if (len < 2) { ++ break; ++ } + switch (buf[1]) { + case 0x00: + op->type = R_ANAL_OP_TYPE_CJMP; // BCC +@@ -70,7 +82,7 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn + op->type = R_ANAL_OP_TYPE_SHR; + break; + case 0x96: // move.d r, r +- if (buf[0] >=0xc0) { ++ if (buf[0] >= 0xc0) { + op->type = R_ANAL_OP_TYPE_CMP; + } else { + op->type = R_ANAL_OP_TYPE_MOV; +@@ -242,6 +254,7 @@ static bool set_reg_profile(RAnal *anal) { + "=PC pc\n" + "=SP r14\n" // XXX + "=BP srp\n" // XXX ++ "=SN r0\n" + "=A0 r0\n" + "=A1 r1\n" + "=A2 r2\n" diff --git a/CVE-2022-1237.patch b/CVE-2022-1237.patch new file mode 100644 index 0000000..56f2441 --- /dev/null +++ b/CVE-2022-1237.patch @@ -0,0 +1,98 @@ +commit 2d782cdaa2112c10b8dd5e7a93c134b2ada9c1a6 +Author: pancake +Date: Tue Apr 5 11:31:24 2022 +0200 + + Fix oobread segfaults in the NE bin parser ##crash + + * Reported by @han0nly via huntr.dev + * Reproducers: seed1 seed2 + * BountyID: ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40 + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index d26860b26..210fe0369 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -1,4 +1,4 @@ +-/* radare - LGPL - Copyright 2019 - GustavoLCR */ ++/* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ + + #include "ne.h" + +@@ -83,10 +83,10 @@ RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) { + RList *segments = r_list_newf (free); + for (i = 0; i < bin->ne_header->SegCount; i++) { + RBinSection *bs = R_NEW0 (RBinSection); +- NE_image_segment_entry *se = &bin->segment_entries[i]; + if (!bs) { + return segments; + } ++ NE_image_segment_entry *se = &bin->segment_entries[i]; + bs->size = se->length; + bs->vsize = se->minAllocSz ? se->minAllocSz : 64000; + bs->bits = R_SYS_BITS_16; +@@ -425,7 +425,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + return NULL; + } + +- ut16 *modref = malloc (bin->ne_header->ModRefs * sizeof (ut16)); ++ ut16 *modref = calloc (bin->ne_header->ModRefs, sizeof (ut16)); + if (!modref) { + return NULL; + } +@@ -451,7 +451,8 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + continue; + } + off += 2; +- while (off < start + length * sizeof (NE_image_reloc_item)) { ++ size_t buf_size = r_buf_size (bin->buf); ++ while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { + RBinReloc *reloc = R_NEW0 (RBinReloc); + if (!reloc) { + return NULL; +@@ -484,10 +485,11 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + break; + } + char *name; +- if (rel.index > bin->ne_header->ModRefs) { ++ if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { + name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? + } else { +- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; ++ int index = rel.index; ++ offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; + name = __read_nonnull_str_at (bin->buf, offset); + } + if (rel.flags & IMPORTED_ORD) { +@@ -563,7 +565,14 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + return; + } + bin->buf = buf; ++ // XXX this is endian unsafe + r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); ++ if (bin->ne_header->FileAlnSzShftCnt > 8) { ++ bin->ne_header->FileAlnSzShftCnt = 8; ++ } ++ if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { ++ bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); ++ } + bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; + if (!bin->alignment) { + bin->alignment = 1 << 9; +@@ -571,8 +580,16 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + bin->os = __get_target_os (bin); + + ut16 offset = bin->ne_header->SegTableOffset + bin->header_offset; +- ut16 size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); ++ size_t size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); ++ if (offset >= r_buf_size (bin->buf)) { ++ return; ++ } ++ size_t remaining = r_buf_size (bin->buf) - offset; ++ size = R_MIN (remaining, size); + bin->segment_entries = calloc (1, size); ++ if (size >= remaining) { ++ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); ++ } + if (!bin->segment_entries) { + return; + } diff --git a/CVE-2022-1238-2.patch b/CVE-2022-1238-2.patch new file mode 100644 index 0000000..cddec23 --- /dev/null +++ b/CVE-2022-1238-2.patch @@ -0,0 +1,205 @@ +commit c35d1629422a12fafb0b3d379c8739c7894521e9 +Author: pancake +Date: Tue Apr 5 12:06:37 2022 +0200 + + Fix another oobread in the NE parser ##crash + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index ad7c86be1..f080e937f 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -1,6 +1,7 @@ + /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ + + #include "ne.h" ++#define NE_BUG 0 + + static char *__get_target_os(r_bin_ne_obj_t *bin) { + switch (bin->ne_header->targOS) { +@@ -355,26 +356,28 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + if (!entries) { + return NULL; + } +- RBinAddr *entry; + RList *segments = r_bin_ne_get_segments (bin); + if (!segments) { + r_list_free (entries); + return NULL; + } + if (bin->ne_header->csEntryPoint) { +- entry = R_NEW0 (RBinAddr); ++ RBinAddr *entry = R_NEW0 (RBinAddr); + if (!entry) { + r_list_free (entries); + return NULL; + } + entry->bits = 16; +- RBinSection *s = r_list_get_n (segments, bin->ne_header->csEntryPoint - 1); ++ ut32 entry_cs = bin->ne_header->csEntryPoint; ++ RBinSection *s = r_list_get_n (segments, entry_cs - 1); + entry->paddr = bin->ne_header->ipEntryPoint + (s? s->paddr: 0); ++ + r_list_append (entries, entry); + } + int off = 0; ++ size_t tableat = bin->header_offset + bin->ne_header->EntryTableOffset; + while (off < bin->ne_header->EntryTableLength) { +- if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { ++ if (tableat + off >= r_buf_size (bin->buf)) { + break; + } + ut8 bundle_length = *(ut8 *)(bin->entry_table + off); +@@ -386,7 +389,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + off++; + int i; + for (i = 0; i < bundle_length; i++) { +- entry = R_NEW0 (RBinAddr); ++ if (tableat + off + 4 >= r_buf_size (bin->buf)) { ++ break; ++ } ++ RBinAddr *entry = R_NEW0 (RBinAddr); + if (!entry) { + r_list_free (entries); + return NULL; +@@ -396,7 +402,7 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + off--; + free (entry); + break; +- } else if (bundle_type == 0xFF) { // Moveable ++ } else if (bundle_type == 0xff) { // moveable + off += 2; + ut8 segnum = *(bin->entry_table + off); + off++; +@@ -405,7 +411,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; + } + } else { // Fixed +- entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); ++ if (bundle_type < bin->ne_header->SegCount) { ++ entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset ++ * bin->alignment + *(ut16 *)(bin->entry_table + off); ++ } + } + off += 2; + r_list_append (entries, entry); +@@ -450,20 +459,24 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + if (!(bin->segment_entries[index].flags & RELOCINFO)) { + continue; + } +- ut32 off, start = off = seg->paddr + seg->size; ++ ut32 off = seg->paddr + seg->size; ++ ut32 start = off; + ut16 length = r_buf_read_le16_at (bin->buf, off); + if (!length) { + continue; + } + off += 2; +- size_t buf_size = r_buf_size (bin->buf); +- while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { ++ // size_t buf_size = r_buf_size (bin->buf); ++ while (off < start + length * sizeof (NE_image_reloc_item)) { ++ // && off + sizeof (NE_image_reloc_item) < buf_size) ++ NE_image_reloc_item rel = {0}; ++ if (r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)) < 1) { ++ return NULL; ++ } + RBinReloc *reloc = R_NEW0 (RBinReloc); + if (!reloc) { + return NULL; + } +- NE_image_reloc_item rel; +- r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)); + reloc->paddr = seg->paddr + rel.offset; + switch (rel.type) { + case LOBYTE: +@@ -490,13 +503,21 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + break; + } + char *name; +- if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { ++#if NE_BUG ++ if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { ++ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; ++ name = __read_nonnull_str_at (bin->buf, offset); ++ } else { ++ name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? ++ } ++#else ++ if (rel.index > bin->ne_header->ModRefs) { + name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? + } else { +- int index = rel.index; +- offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; ++ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; + name = __read_nonnull_str_at (bin->buf, offset); + } ++#endif + if (rel.flags & IMPORTED_ORD) { + imp->ordinal = rel.func_ord; + imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); +@@ -542,8 +563,12 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + r_list_append (relocs, reloc); + } else { + do { ++#if NE_BUG ++ if (reloc->paddr + 4 < r_buf_size (bin->buf)) { ++ break; ++ } ++#endif + r_list_append (relocs, reloc); +- + offset = r_buf_read_le16_at (bin->buf, reloc->paddr); + RBinReloc *tmp = reloc; + reloc = R_NEW0 (RBinReloc); +@@ -571,12 +596,17 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + } + bin->buf = buf; + // XXX this is endian unsafe +- r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); +- if (bin->ne_header->FileAlnSzShftCnt > 8) { +- bin->ne_header->FileAlnSzShftCnt = 8; ++ if (r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)) < 1) { ++ R_FREE (bin->ne_header); ++ return; ++ } ++ if (bin->ne_header->FileAlnSzShftCnt > 15) { ++ bin->ne_header->FileAlnSzShftCnt = 15; + } +- if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { +- bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); ++ ut64 from = bin->ne_header->ModRefTable + bin->header_offset; ++ ut64 left = r_buf_size (bin->buf) - from; ++ if (from + bin->ne_header->ModRefs * sizeof (ut16) >= left) { ++ bin->ne_header->ModRefs = left / sizeof (ut16); + } + bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; + if (!bin->alignment) { +@@ -591,6 +621,7 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + } + size_t remaining = r_buf_size (bin->buf) - offset; + size = R_MIN (remaining, size); ++ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); // * sizeof (NE_image_segment_entry); + bin->segment_entries = calloc (1, size); + if (size >= remaining) { + bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); +@@ -599,7 +630,11 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { + return; + } + r_buf_read_at (buf, offset, (ut8 *)bin->segment_entries, size); +- bin->entry_table = calloc (1, bin->ne_header->EntryTableLength); ++ bin->entry_table = calloc (4, bin->ne_header->EntryTableLength); ++ if (!bin->entry_table) { ++ R_FREE (bin->segment_entries); ++ return; ++ } + r_buf_read_at (buf, (ut64)bin->header_offset + bin->ne_header->EntryTableOffset, bin->entry_table, bin->ne_header->EntryTableLength); + bin->imports = r_bin_ne_get_imports (bin); + __ne_get_resources (bin); +@@ -612,6 +647,7 @@ void r_bin_ne_free(r_bin_ne_obj_t *bin) { + free (bin->ne_header); + free (bin->resident_name_table); + free (bin->segment_entries); ++ free (bin); + } + + r_bin_ne_obj_t *r_bin_ne_new_buf(RBuffer *buf, bool verbose) { diff --git a/CVE-2022-1238.patch b/CVE-2022-1238.patch new file mode 100644 index 0000000..3f68500 --- /dev/null +++ b/CVE-2022-1238.patch @@ -0,0 +1,35 @@ +commit c40a4f9862104ede15d0ba05ccbf805923070778 +Author: pancake +Date: Tue Apr 5 11:44:46 2022 +0200 + + Fix another oobread segfault in the NE bin parser ##crash + + * Reported by @han0nly via huntr.dev + * Reproducers: sample1 sample2 sample3 + * BountyID: 47422cdf-aad2-4405-a6a1-6f63a3a93200 + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index 210fe0369..ad7c86be1 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -374,6 +374,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + } + int off = 0; + while (off < bin->ne_header->EntryTableLength) { ++ if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { ++ break; ++ } + ut8 bundle_length = *(ut8 *)(bin->entry_table + off); + if (!bundle_length) { + break; +@@ -398,7 +401,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + ut8 segnum = *(bin->entry_table + off); + off++; + ut16 segoff = *(ut16 *)(bin->entry_table + off); +- entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; ++ if (segnum > 0) { ++ entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; ++ } + } else { // Fixed + entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); + } diff --git a/CVE-2022-1240.patch b/CVE-2022-1240.patch new file mode 100644 index 0000000..2fadbdf --- /dev/null +++ b/CVE-2022-1240.patch @@ -0,0 +1,23 @@ +commit ca8d8b39f3e34a4fd943270330b80f1148129de4 +Author: pancake +Date: Tue Apr 5 11:52:32 2022 +0200 + + Fix oobread in the macho parser ##crash + + * Reported by @Han0nly via huntr.dev + * Reproducers: heapoverflow1 + * BountyID: e589bd97-4c74-4e79-93b5-0951a281facc + +diff --git a/libr/bin/format/mach0/mach0.c b/libr/bin/format/mach0/mach0.c +index 1bf09233a..8aaf3f49a 100644 +--- a/libr/bin/format/mach0/mach0.c ++++ b/libr/bin/format/mach0/mach0.c +@@ -3178,7 +3178,7 @@ static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs, + for (i = 0; i < num; i++) { + struct relocation_info a_info = info[i]; + ut32 sym_num = a_info.r_symbolnum; +- if (sym_num > bin->nsymtab) { ++ if (sym_num >= bin->nsymtab) { + continue; + } + diff --git a/CVE-2022-1244.patch b/CVE-2022-1244.patch new file mode 100644 index 0000000..9892952 --- /dev/null +++ b/CVE-2022-1244.patch @@ -0,0 +1,34 @@ +commit 2b77b277d67ce061ee6ef839e7139ebc2103c1e3 +Author: pancake +Date: Tue Apr 5 19:39:26 2022 +0200 + + Fix oobread in dyldcache ##crash + + * Reported by @hdthky via huntr.dev + * Reproducers: poc1 + * BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82 + +diff --git a/libr/bin/format/mach0/dyldcache.h b/libr/bin/format/mach0/dyldcache.h +index 9f00182cd..21e598abb 100644 +--- a/libr/bin/format/mach0/dyldcache.h ++++ b/libr/bin/format/mach0/dyldcache.h +@@ -1,4 +1,4 @@ +-/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */ ++/* radare - LGPL - Copyright 2009-2022 nibble, pancake */ + + #include + #include "mach0_specs.h" +diff --git a/libr/bin/p/bin_dyldcache.c b/libr/bin/p/bin_dyldcache.c +index 0dc9d16a6..0d9af87a9 100644 +--- a/libr/bin/p/bin_dyldcache.c ++++ b/libr/bin/p/bin_dyldcache.c +@@ -1247,7 +1247,8 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) { + if (deps && !deps[j]) { + continue; + } +- ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); ++ // ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); ++ ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); + if (pa == UT64_MAX) { + continue; + } diff --git a/CVE-2022-1283.patch b/CVE-2022-1283.patch new file mode 100644 index 0000000..41066f2 --- /dev/null +++ b/CVE-2022-1283.patch @@ -0,0 +1,33 @@ +commit 18d1d064bf599a255d55f09fca3104776fc34a67 +Author: Sergi Àlvarez i Capilla +Date: Fri Apr 8 19:49:21 2022 +0200 + + Fix null deref in the ne parser ##crash + + * Reported by @hmsec via huntr.dev + * Reproducer: nepoc00 + * BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013 + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index f080e937f..ee2df871a 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -115,7 +115,7 @@ RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) { + } + RList *entries = r_bin_ne_get_entrypoints (bin); + bool resident = true, first = true; +- while (true) { ++ while (entries) { + ut8 sz = r_buf_read8_at (bin->buf, off); + if (!sz) { + first = true; +@@ -352,6 +352,9 @@ RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) { + } + + RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { ++ if (!bin->entry_table) { ++ return NULL; ++ } + RList *entries = r_list_newf (free); + if (!entries) { + return NULL; diff --git a/CVE-2022-1284.patch b/CVE-2022-1284.patch new file mode 100644 index 0000000..4278af5 --- /dev/null +++ b/CVE-2022-1284.patch @@ -0,0 +1,36 @@ +commit 64a82e284dddabaeb549228380103b57dead32a6 +Author: Sergi Àlvarez i Capilla +Date: Fri Apr 8 20:39:43 2022 +0200 + + Fix UAF in `aaef` ##crash + + * Reported by @hdthky + * Reproducer: uaf-aef + * BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7 + +diff --git a/libr/core/canal.c b/libr/core/canal.c +index fb53e75fc..610cd22f2 100644 +--- a/libr/core/canal.c ++++ b/libr/core/canal.c +@@ -5295,10 +5295,6 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { + arch = R2_ARCH_MIPS; + } + +- const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); +- if (!sn) { +- eprintf ("Warning: No SN reg alias for current architecture.\n"); +- } + r_reg_arena_push (core->anal->reg); + + IterCtx ictx = { start, end, fcn, NULL }; +@@ -5409,6 +5405,10 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { + goto repeat; + } + } ++ const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); ++ if (!sn) { ++ eprintf ("Warning: No SN reg alias for current architecture.\n"); ++ } + if (sn && op.type == R_ANAL_OP_TYPE_SWI) { + r_strf_buffer (64); + r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS); diff --git a/CVE-2022-1296.patch b/CVE-2022-1296.patch new file mode 100644 index 0000000..2ac950b --- /dev/null +++ b/CVE-2022-1296.patch @@ -0,0 +1,83 @@ +commit 153bcdc29f11cd8c90e7d639a7405450f644ddb6 +Author: Sergi Àlvarez i Capilla +Date: Fri Apr 8 20:14:32 2022 +0200 + + Fix oobread in NE parser ##crash + + * Reported by @hmsec via huntr.dev + * Reproducer: necrash + * BountyID: 52b57274-0e1a-4d61-ab29-1373b555fea0/ + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index ee2df871a..b907d56e9 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -1,7 +1,6 @@ + /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ + + #include "ne.h" +-#define NE_BUG 0 + + static char *__get_target_os(r_bin_ne_obj_t *bin) { + switch (bin->ne_header->targOS) { +@@ -505,25 +504,18 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + free (reloc); + break; + } +- char *name; +-#if NE_BUG +- if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { +- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; +- name = __read_nonnull_str_at (bin->buf, offset); +- } else { +- name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? +- } +-#else ++ char *name = NULL; + if (rel.index > bin->ne_header->ModRefs) { + name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? +- } else { ++ } else if (rel.index > 0) { + offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; + name = __read_nonnull_str_at (bin->buf, offset); + } +-#endif + if (rel.flags & IMPORTED_ORD) { + imp->ordinal = rel.func_ord; +- imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); ++ char *fname = __func_name_from_ord (name, rel.func_ord); ++ imp->name = r_str_newf ("%s.%s", name, fname); ++ free (fname); + } else { + offset = bin->header_offset + bin->ne_header->ImportNameTable + rel.name_off; + char *func = __read_nonnull_str_at (bin->buf, offset); +@@ -566,6 +558,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { + r_list_append (relocs, reloc); + } else { + do { ++#define NE_BUG 0 + #if NE_BUG + if (reloc->paddr + 4 < r_buf_size (bin->buf)) { + break; +diff --git a/test/db/formats/ne b/test/db/formats/ne +index 7b6834441..b71f29469 100644 +--- a/test/db/formats/ne ++++ b/test/db/formats/ne +@@ -1,3 +1,17 @@ ++NAME=NE crash ++FILE=bins/ne/necrash ++CMDS=< +Date: Mon Apr 11 13:35:52 2022 +0200 + + Fix oobread and unaligned casts in the NE entrypoint logic ##crash + + * Reported by @hmsec via huntr.dev + * Reproducer: nepocaligns + * BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac + +diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c +index b907d56e9..32aa589e8 100644 +--- a/libr/bin/format/ne/ne.c ++++ b/libr/bin/format/ne/ne.c +@@ -408,14 +408,21 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { + off += 2; + ut8 segnum = *(bin->entry_table + off); + off++; +- ut16 segoff = *(ut16 *)(bin->entry_table + off); +- if (segnum > 0) { ++ if (off > bin->ne_header->EntryTableLength) { ++ break; ++ } ++ ut16 segoff = r_read_le16 (bin->entry_table + off); ++ if (segnum > 0 && segnum < bin->ne_header->SegCount) { + entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; + } + } else { // Fixed ++ if (off + 2 >= bin->ne_header->EntryTableLength) { ++ break; ++ } ++ ut16 delta = r_read_le16 (bin->entry_table + off); + if (bundle_type < bin->ne_header->SegCount) { + entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset +- * bin->alignment + *(ut16 *)(bin->entry_table + off); ++ * bin->alignment + delta; + } + } + off += 2; diff --git a/radare2.spec b/radare2.spec index 69fcab1..24ebd58 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.6.6 -%global rel 1 +%global rel 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -38,6 +38,39 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{nam # This is specific to 5.6.0 and is already fixed in the git Patch0: radare2-5.6.0-dec99.patch +# Upstream security patches + +# Bug #2068585 #2068586 +Patch100: CVE-2022-1061.patch + +# Bug #2074067 #2074066 +Patch110: CVE-2022-1207.patch + +# Bug #2073961 #2073962 +Patch120: CVE-2022-1237.patch + +# Bug #2073970 #2073971 +Patch130: CVE-2022-1238.patch +Patch131: CVE-2022-1238-2.patch + +# Bug #2073955 #2073956 +Patch140: CVE-2022-1240.patch + +# Bug #2073974 #2073975 +Patch150: CVE-2022-1244.patch + +# Bug #2073914 #2073910 +Patch160: CVE-2022-1283.patch + +# Bug #2073908 #2073907 +Patch170: CVE-2022-1284.patch + +# Bug #2074200 #2074199 +Patch180: CVE-2022-1296.patch + +# Bug #2074203 #2074204 +Patch190: CVE-2022-1297.patch + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -323,7 +356,12 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -* Tue Apr 12 2922 Henrikj Nordstrom 5.6.6-1 +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 +- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 + CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 + CVE-2022-1297 + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 - bump to 5.6.6 * Mon Feb 28 2022 Michal Ambroz 5.6.4-1 From 4ebfe2878d95b16bafe6f2327b30ad40399b4988 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Wed, 13 Apr 2022 04:02:16 +0200 Subject: [PATCH 03/51] refresh list of bundled libraries --- radare2.spec | 43 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 9 deletions(-) diff --git a/radare2.spec b/radare2.spec index 24ebd58..45951b5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.6.6 -%global rel 2 +%global rel 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -37,6 +37,9 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{nam # Declaration of variable in the for loop requires at least c99 compatibility mode # This is specific to 5.6.0 and is already fixed in the git Patch0: radare2-5.6.0-dec99.patch +Patch1: radare2-5.6.6-use_openssl.patch +Patch3: radare2-5.6.6-use_magic.patch +Patch4: radare2-5.6.6-use_lz4.patch # Upstream security patches @@ -84,16 +87,17 @@ License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and z # shlr/java - Apache 2.0 # shlr/sdb/src - MIT # shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) -# shlr/spp - MIT # shlr/squashfs/src - GPLv2+ -# shlr/tcc - LGPLv2+ +# libr/parse/c - LGPLv2+ # shlr/udis86 - 2 clause BSD -# shlr/wind - LGPL v3+ +# shlr/winkd - LGPL v3+ # shlr/spp - MIT # shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) # shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) # shlr/ptrace-wrap - LGPL v3+ # shlr/tree-sitter - MIT +# shlr/mpc - 2 clause BSD +# shlr/yxml - MIT # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -158,6 +162,7 @@ Requires: %{name}-common = %{version}-%{release} # compiled with -D use_sys_xxhash=true instead # ./libr/hash/{md4,md5,sha1,sha2}.{c,h} +# ./libr/util/big.c # compiled with -D use_sys_openssl=true instead # ./shlr/spp/README.md @@ -168,7 +173,7 @@ Provides: bundled(spp) = 1.2.0 # ./shlr/sdb/README.md # sdb is a simple string key/value database based on djb's cdb # https://github.com/radare/sdb -Provides: bundled(sdb) = 1.7.0 +Provides: bundled(sdb) = 1.8.6 # ./shlr/sdb/src/json/README # Based on js0n with a lot of modifications @@ -182,7 +187,7 @@ Provides: bundled(js0n) = 2018 # version from 2010/11/21 00:02:30, version of files ranges from v1.11 to v1.20 Provides: bundled(openbsdregex) = 1.11 -# ./shlr/tcc/README.md +# ./libr/parse/c/README.md # This is a stripped down version of tcc without the code generators and heavily modified. Provides: bundled(tcc) = 0.9.26 @@ -202,7 +207,7 @@ Provides: bundled(vavrdisasm) = 1.6 # It is not clear which version has been copied Provides: bundled(grub2) = 1.99~beta0 -# ./shlr/ptrace-wrap +# ./libr/io/ptrace_wrap.c # https://github.com/thestr4ng3r/ptrace-wrap Provides: bundled(ptrace-wrap) = 20181018 @@ -210,6 +215,16 @@ Provides: bundled(ptrace-wrap) = 20181018 # https://github.com/tree-sitter/tree-sitter Provides: bundled(tree-sitter) = 0.17.2 +# ./shlr/mpc +# https://github.com/orangeduck/mpc +Provides: bundled(mpc) = 0.8.7 + +# ./shlr/yxml +# https://dev.yorhel.nl/yxml +Provides: bundled(yxml) = 20201108 + +# and likely some more in libr/... borrowed from other projects + %description The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal @@ -251,10 +266,16 @@ sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif # Removing zip/lzip files because we use system dependencies rm -rf shlr/zip/{zip,zlib,include} -# Not removing the LZ4 source code - hardcoded -# rm -rf shlr/lz4 +# Remove lx4 files because we use system dependencies +rm -rf shlr/lz4/{deps.mk,LICENSE,lz4.*,Makefile,README.md} # Remove xxhash files because we use system dependencies rm -f libr/hash/xxhash.c libr/hash/xxhash.h +# Remove magic files because we use system dependencies +awk 'BEGIN {p=1} /#if USE_LIB_MAGIC/ {p=2; next} p==2 && /#else/ {p=0} p>0 {print}' libr/magic/magic.c > libr/magic/magic.c.stripped +rm -rf libr/magic/*.c +mv libr/magic/magic.c.stripped libr/magic/magic-libmagic.c +# Remove openssl files because we use system dependencies +rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui @@ -279,6 +300,7 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil -Duse_sys_zlib=true \ -Duse_sys_lz4=true \ -Duse_sys_xxhash=true \ + -Duse_ssl=true \ -Duse_sys_openssl=true \ -Duse_libuv=true \ %ifarch s390x @@ -356,6 +378,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue Apr 13 2022 Henrik Nordstrom 5.6.6-2 +- refresh list of bundled libraries and associated cleanup + * Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 - Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 From 2bb7e5547cb1617a28318448f5f070b3218f5f28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 21:45:33 +0200 Subject: [PATCH 04/51] 5.6.8 --- CVE-2022-1061.patch | 29 ------ CVE-2022-1207.patch | 98 -------------------- CVE-2022-1237.patch | 98 -------------------- CVE-2022-1238-2.patch | 205 ------------------------------------------ CVE-2022-1238.patch | 35 -------- CVE-2022-1240.patch | 23 ----- CVE-2022-1244.patch | 34 ------- CVE-2022-1283.patch | 33 ------- CVE-2022-1284.patch | 36 -------- CVE-2022-1296.patch | 83 ----------------- CVE-2022-1297.patch | 39 -------- radare2.spec | 41 ++------- 12 files changed, 5 insertions(+), 749 deletions(-) delete mode 100644 CVE-2022-1061.patch delete mode 100644 CVE-2022-1207.patch delete mode 100644 CVE-2022-1237.patch delete mode 100644 CVE-2022-1238-2.patch delete mode 100644 CVE-2022-1238.patch delete mode 100644 CVE-2022-1240.patch delete mode 100644 CVE-2022-1244.patch delete mode 100644 CVE-2022-1283.patch delete mode 100644 CVE-2022-1284.patch delete mode 100644 CVE-2022-1296.patch delete mode 100644 CVE-2022-1297.patch diff --git a/CVE-2022-1061.patch b/CVE-2022-1061.patch deleted file mode 100644 index affd9b7..0000000 --- a/CVE-2022-1061.patch +++ /dev/null @@ -1,29 +0,0 @@ -commit d4ce40b516ffd70cf2e9e36832d8de139117d522 -Author: Sergi Àlvarez i Capilla -Date: Thu Mar 24 10:11:29 2022 +0100 - - Fix oobread in symbols header parsing ##bin - -diff --git a/libr/bin/p/bin_symbols.c b/libr/bin/p/bin_symbols.c -index 2036dc092..779e36940 100644 ---- a/libr/bin/p/bin_symbols.c -+++ b/libr/bin/p/bin_symbols.c -@@ -181,7 +181,7 @@ static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy - - static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) { - D eprintf ("Dragons at 0x%x\n", off); -- ut64 size = r_buf_size (buf); -+ st64 size = r_buf_size (buf); - if (off >= size) { - return NULL; - } -@@ -189,6 +189,9 @@ static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, i - if (!size) { - return NULL; - } -+ if (size < 32) { -+ return NULL; -+ } - ut8 *b = malloc (size); - if (!b) { - return NULL; diff --git a/CVE-2022-1207.patch b/CVE-2022-1207.patch deleted file mode 100644 index 91f0f3e..0000000 --- a/CVE-2022-1207.patch +++ /dev/null @@ -1,98 +0,0 @@ -commit 605785b65dd356d46d4487faa41dbf90943b8bc1 -Author: pancake -Date: Fri Apr 1 21:03:24 2022 +0200 - - Fix 1 byte oobread in the cris analysis plugin ##crash - -diff --git a/libr/anal/p/anal_cris.c b/libr/anal/p/anal_cris.c -index 2b95c37e0..db30421ed 100644 ---- a/libr/anal/p/anal_cris.c -+++ b/libr/anal/p/anal_cris.c -@@ -1,4 +1,4 @@ --/* radare2 - LGPL - Copyright 2014-2015 - pancake */ -+/* radare2 - LGPL - Copyright 2014-2022 - pancake */ - - #include - #include -@@ -7,6 +7,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - int opsize = -1; - op->type = -1; - opsize = 2; -+ if (len < 1) { -+ return -1; -+ } - switch (buf[0]) { - case 0x3f: - case 0x4f: -@@ -21,9 +24,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - op->type = R_ANAL_OP_TYPE_LEA; - if (len > 5) { - op->ptr = buf[2]; -- op->ptr |= buf[3]<<8; -- op->ptr |= buf[4]<<16; -- op->ptr |= ((ut32)(0xff&buf[5]))<<24; -+ op->ptr |= buf[3] << 8; -+ op->ptr |= buf[4] << 16; -+ op->ptr |= ((ut32)(0xff & buf[5])) << 24; - op->ptr += addr; - opsize = 6; - } else { -@@ -35,9 +38,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - op->type = R_ANAL_OP_TYPE_CALL; - if (len > 5) { - st32 delta = buf[2]; -- delta |= buf[3]<<8; -- delta |= buf[4]<<16; -- delta |= buf[5]<<24; -+ delta |= buf[3] << 8; -+ delta |= buf[4] << 16; -+ delta |= buf[5] << 24; - op->jump = addr + delta; - } else { - op->jump = UT64_MAX; -@@ -46,6 +49,9 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - opsize = 6; - break; - case 0x00: -+ if (len < 2) { -+ break; -+ } - if (buf[1] == 0x00) { - op->type = R_ANAL_OP_TYPE_TRAP; - } else { -@@ -57,11 +63,17 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - } - break; - case 0xf0: -- if (buf[1]==0xb9) { -+ if (len < 2) { -+ break; -+ } -+ if (buf[1] == 0xb9) { - op->type = R_ANAL_OP_TYPE_RET; - } - break; - default: -+ if (len < 2) { -+ break; -+ } - switch (buf[1]) { - case 0x00: - op->type = R_ANAL_OP_TYPE_CJMP; // BCC -@@ -70,7 +82,7 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn - op->type = R_ANAL_OP_TYPE_SHR; - break; - case 0x96: // move.d r, r -- if (buf[0] >=0xc0) { -+ if (buf[0] >= 0xc0) { - op->type = R_ANAL_OP_TYPE_CMP; - } else { - op->type = R_ANAL_OP_TYPE_MOV; -@@ -242,6 +254,7 @@ static bool set_reg_profile(RAnal *anal) { - "=PC pc\n" - "=SP r14\n" // XXX - "=BP srp\n" // XXX -+ "=SN r0\n" - "=A0 r0\n" - "=A1 r1\n" - "=A2 r2\n" diff --git a/CVE-2022-1237.patch b/CVE-2022-1237.patch deleted file mode 100644 index 56f2441..0000000 --- a/CVE-2022-1237.patch +++ /dev/null @@ -1,98 +0,0 @@ -commit 2d782cdaa2112c10b8dd5e7a93c134b2ada9c1a6 -Author: pancake -Date: Tue Apr 5 11:31:24 2022 +0200 - - Fix oobread segfaults in the NE bin parser ##crash - - * Reported by @han0nly via huntr.dev - * Reproducers: seed1 seed2 - * BountyID: ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40 - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index d26860b26..210fe0369 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -1,4 +1,4 @@ --/* radare - LGPL - Copyright 2019 - GustavoLCR */ -+/* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ - - #include "ne.h" - -@@ -83,10 +83,10 @@ RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) { - RList *segments = r_list_newf (free); - for (i = 0; i < bin->ne_header->SegCount; i++) { - RBinSection *bs = R_NEW0 (RBinSection); -- NE_image_segment_entry *se = &bin->segment_entries[i]; - if (!bs) { - return segments; - } -+ NE_image_segment_entry *se = &bin->segment_entries[i]; - bs->size = se->length; - bs->vsize = se->minAllocSz ? se->minAllocSz : 64000; - bs->bits = R_SYS_BITS_16; -@@ -425,7 +425,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - return NULL; - } - -- ut16 *modref = malloc (bin->ne_header->ModRefs * sizeof (ut16)); -+ ut16 *modref = calloc (bin->ne_header->ModRefs, sizeof (ut16)); - if (!modref) { - return NULL; - } -@@ -451,7 +451,8 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - continue; - } - off += 2; -- while (off < start + length * sizeof (NE_image_reloc_item)) { -+ size_t buf_size = r_buf_size (bin->buf); -+ while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { - RBinReloc *reloc = R_NEW0 (RBinReloc); - if (!reloc) { - return NULL; -@@ -484,10 +485,11 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - break; - } - char *name; -- if (rel.index > bin->ne_header->ModRefs) { -+ if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { - name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? - } else { -- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -+ int index = rel.index; -+ offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; - name = __read_nonnull_str_at (bin->buf, offset); - } - if (rel.flags & IMPORTED_ORD) { -@@ -563,7 +565,14 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - return; - } - bin->buf = buf; -+ // XXX this is endian unsafe - r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); -+ if (bin->ne_header->FileAlnSzShftCnt > 8) { -+ bin->ne_header->FileAlnSzShftCnt = 8; -+ } -+ if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { -+ bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); -+ } - bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; - if (!bin->alignment) { - bin->alignment = 1 << 9; -@@ -571,8 +580,16 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - bin->os = __get_target_os (bin); - - ut16 offset = bin->ne_header->SegTableOffset + bin->header_offset; -- ut16 size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); -+ size_t size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry); -+ if (offset >= r_buf_size (bin->buf)) { -+ return; -+ } -+ size_t remaining = r_buf_size (bin->buf) - offset; -+ size = R_MIN (remaining, size); - bin->segment_entries = calloc (1, size); -+ if (size >= remaining) { -+ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); -+ } - if (!bin->segment_entries) { - return; - } diff --git a/CVE-2022-1238-2.patch b/CVE-2022-1238-2.patch deleted file mode 100644 index cddec23..0000000 --- a/CVE-2022-1238-2.patch +++ /dev/null @@ -1,205 +0,0 @@ -commit c35d1629422a12fafb0b3d379c8739c7894521e9 -Author: pancake -Date: Tue Apr 5 12:06:37 2022 +0200 - - Fix another oobread in the NE parser ##crash - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index ad7c86be1..f080e937f 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -1,6 +1,7 @@ - /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ - - #include "ne.h" -+#define NE_BUG 0 - - static char *__get_target_os(r_bin_ne_obj_t *bin) { - switch (bin->ne_header->targOS) { -@@ -355,26 +356,28 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - if (!entries) { - return NULL; - } -- RBinAddr *entry; - RList *segments = r_bin_ne_get_segments (bin); - if (!segments) { - r_list_free (entries); - return NULL; - } - if (bin->ne_header->csEntryPoint) { -- entry = R_NEW0 (RBinAddr); -+ RBinAddr *entry = R_NEW0 (RBinAddr); - if (!entry) { - r_list_free (entries); - return NULL; - } - entry->bits = 16; -- RBinSection *s = r_list_get_n (segments, bin->ne_header->csEntryPoint - 1); -+ ut32 entry_cs = bin->ne_header->csEntryPoint; -+ RBinSection *s = r_list_get_n (segments, entry_cs - 1); - entry->paddr = bin->ne_header->ipEntryPoint + (s? s->paddr: 0); -+ - r_list_append (entries, entry); - } - int off = 0; -+ size_t tableat = bin->header_offset + bin->ne_header->EntryTableOffset; - while (off < bin->ne_header->EntryTableLength) { -- if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { -+ if (tableat + off >= r_buf_size (bin->buf)) { - break; - } - ut8 bundle_length = *(ut8 *)(bin->entry_table + off); -@@ -386,7 +389,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - off++; - int i; - for (i = 0; i < bundle_length; i++) { -- entry = R_NEW0 (RBinAddr); -+ if (tableat + off + 4 >= r_buf_size (bin->buf)) { -+ break; -+ } -+ RBinAddr *entry = R_NEW0 (RBinAddr); - if (!entry) { - r_list_free (entries); - return NULL; -@@ -396,7 +402,7 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - off--; - free (entry); - break; -- } else if (bundle_type == 0xFF) { // Moveable -+ } else if (bundle_type == 0xff) { // moveable - off += 2; - ut8 segnum = *(bin->entry_table + off); - off++; -@@ -405,7 +411,10 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; - } - } else { // Fixed -- entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); -+ if (bundle_type < bin->ne_header->SegCount) { -+ entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset -+ * bin->alignment + *(ut16 *)(bin->entry_table + off); -+ } - } - off += 2; - r_list_append (entries, entry); -@@ -450,20 +459,24 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - if (!(bin->segment_entries[index].flags & RELOCINFO)) { - continue; - } -- ut32 off, start = off = seg->paddr + seg->size; -+ ut32 off = seg->paddr + seg->size; -+ ut32 start = off; - ut16 length = r_buf_read_le16_at (bin->buf, off); - if (!length) { - continue; - } - off += 2; -- size_t buf_size = r_buf_size (bin->buf); -- while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) { -+ // size_t buf_size = r_buf_size (bin->buf); -+ while (off < start + length * sizeof (NE_image_reloc_item)) { -+ // && off + sizeof (NE_image_reloc_item) < buf_size) -+ NE_image_reloc_item rel = {0}; -+ if (r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)) < 1) { -+ return NULL; -+ } - RBinReloc *reloc = R_NEW0 (RBinReloc); - if (!reloc) { - return NULL; - } -- NE_image_reloc_item rel; -- r_buf_read_at (bin->buf, off, (ut8 *)&rel, sizeof (rel)); - reloc->paddr = seg->paddr + rel.offset; - switch (rel.type) { - case LOBYTE: -@@ -490,13 +503,21 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - break; - } - char *name; -- if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) { -+#if NE_BUG -+ if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { -+ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -+ name = __read_nonnull_str_at (bin->buf, offset); -+ } else { -+ name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? -+ } -+#else -+ if (rel.index > bin->ne_header->ModRefs) { - name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? - } else { -- int index = rel.index; -- offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -+ offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; - name = __read_nonnull_str_at (bin->buf, offset); - } -+#endif - if (rel.flags & IMPORTED_ORD) { - imp->ordinal = rel.func_ord; - imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); -@@ -542,8 +563,12 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - r_list_append (relocs, reloc); - } else { - do { -+#if NE_BUG -+ if (reloc->paddr + 4 < r_buf_size (bin->buf)) { -+ break; -+ } -+#endif - r_list_append (relocs, reloc); -- - offset = r_buf_read_le16_at (bin->buf, reloc->paddr); - RBinReloc *tmp = reloc; - reloc = R_NEW0 (RBinReloc); -@@ -571,12 +596,17 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - } - bin->buf = buf; - // XXX this is endian unsafe -- r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)); -- if (bin->ne_header->FileAlnSzShftCnt > 8) { -- bin->ne_header->FileAlnSzShftCnt = 8; -+ if (r_buf_read_at (buf, bin->header_offset, (ut8 *)bin->ne_header, sizeof (NE_image_header)) < 1) { -+ R_FREE (bin->ne_header); -+ return; -+ } -+ if (bin->ne_header->FileAlnSzShftCnt > 15) { -+ bin->ne_header->FileAlnSzShftCnt = 15; - } -- if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) { -- bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16); -+ ut64 from = bin->ne_header->ModRefTable + bin->header_offset; -+ ut64 left = r_buf_size (bin->buf) - from; -+ if (from + bin->ne_header->ModRefs * sizeof (ut16) >= left) { -+ bin->ne_header->ModRefs = left / sizeof (ut16); - } - bin->alignment = 1 << bin->ne_header->FileAlnSzShftCnt; - if (!bin->alignment) { -@@ -591,6 +621,7 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - } - size_t remaining = r_buf_size (bin->buf) - offset; - size = R_MIN (remaining, size); -+ bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); // * sizeof (NE_image_segment_entry); - bin->segment_entries = calloc (1, size); - if (size >= remaining) { - bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry); -@@ -599,7 +630,11 @@ void __init(RBuffer *buf, r_bin_ne_obj_t *bin) { - return; - } - r_buf_read_at (buf, offset, (ut8 *)bin->segment_entries, size); -- bin->entry_table = calloc (1, bin->ne_header->EntryTableLength); -+ bin->entry_table = calloc (4, bin->ne_header->EntryTableLength); -+ if (!bin->entry_table) { -+ R_FREE (bin->segment_entries); -+ return; -+ } - r_buf_read_at (buf, (ut64)bin->header_offset + bin->ne_header->EntryTableOffset, bin->entry_table, bin->ne_header->EntryTableLength); - bin->imports = r_bin_ne_get_imports (bin); - __ne_get_resources (bin); -@@ -612,6 +647,7 @@ void r_bin_ne_free(r_bin_ne_obj_t *bin) { - free (bin->ne_header); - free (bin->resident_name_table); - free (bin->segment_entries); -+ free (bin); - } - - r_bin_ne_obj_t *r_bin_ne_new_buf(RBuffer *buf, bool verbose) { diff --git a/CVE-2022-1238.patch b/CVE-2022-1238.patch deleted file mode 100644 index 3f68500..0000000 --- a/CVE-2022-1238.patch +++ /dev/null @@ -1,35 +0,0 @@ -commit c40a4f9862104ede15d0ba05ccbf805923070778 -Author: pancake -Date: Tue Apr 5 11:44:46 2022 +0200 - - Fix another oobread segfault in the NE bin parser ##crash - - * Reported by @han0nly via huntr.dev - * Reproducers: sample1 sample2 sample3 - * BountyID: 47422cdf-aad2-4405-a6a1-6f63a3a93200 - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index 210fe0369..ad7c86be1 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -374,6 +374,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - } - int off = 0; - while (off < bin->ne_header->EntryTableLength) { -+ if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) { -+ break; -+ } - ut8 bundle_length = *(ut8 *)(bin->entry_table + off); - if (!bundle_length) { - break; -@@ -398,7 +401,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - ut8 segnum = *(bin->entry_table + off); - off++; - ut16 segoff = *(ut16 *)(bin->entry_table + off); -- entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; -+ if (segnum > 0) { -+ entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; -+ } - } else { // Fixed - entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off); - } diff --git a/CVE-2022-1240.patch b/CVE-2022-1240.patch deleted file mode 100644 index 2fadbdf..0000000 --- a/CVE-2022-1240.patch +++ /dev/null @@ -1,23 +0,0 @@ -commit ca8d8b39f3e34a4fd943270330b80f1148129de4 -Author: pancake -Date: Tue Apr 5 11:52:32 2022 +0200 - - Fix oobread in the macho parser ##crash - - * Reported by @Han0nly via huntr.dev - * Reproducers: heapoverflow1 - * BountyID: e589bd97-4c74-4e79-93b5-0951a281facc - -diff --git a/libr/bin/format/mach0/mach0.c b/libr/bin/format/mach0/mach0.c -index 1bf09233a..8aaf3f49a 100644 ---- a/libr/bin/format/mach0/mach0.c -+++ b/libr/bin/format/mach0/mach0.c -@@ -3178,7 +3178,7 @@ static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs, - for (i = 0; i < num; i++) { - struct relocation_info a_info = info[i]; - ut32 sym_num = a_info.r_symbolnum; -- if (sym_num > bin->nsymtab) { -+ if (sym_num >= bin->nsymtab) { - continue; - } - diff --git a/CVE-2022-1244.patch b/CVE-2022-1244.patch deleted file mode 100644 index 9892952..0000000 --- a/CVE-2022-1244.patch +++ /dev/null @@ -1,34 +0,0 @@ -commit 2b77b277d67ce061ee6ef839e7139ebc2103c1e3 -Author: pancake -Date: Tue Apr 5 19:39:26 2022 +0200 - - Fix oobread in dyldcache ##crash - - * Reported by @hdthky via huntr.dev - * Reproducers: poc1 - * BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82 - -diff --git a/libr/bin/format/mach0/dyldcache.h b/libr/bin/format/mach0/dyldcache.h -index 9f00182cd..21e598abb 100644 ---- a/libr/bin/format/mach0/dyldcache.h -+++ b/libr/bin/format/mach0/dyldcache.h -@@ -1,4 +1,4 @@ --/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */ -+/* radare - LGPL - Copyright 2009-2022 nibble, pancake */ - - #include - #include "mach0_specs.h" -diff --git a/libr/bin/p/bin_dyldcache.c b/libr/bin/p/bin_dyldcache.c -index 0dc9d16a6..0d9af87a9 100644 ---- a/libr/bin/p/bin_dyldcache.c -+++ b/libr/bin/p/bin_dyldcache.c -@@ -1247,7 +1247,8 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) { - if (deps && !deps[j]) { - continue; - } -- ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); -+ // ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); -+ ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL); - if (pa == UT64_MAX) { - continue; - } diff --git a/CVE-2022-1283.patch b/CVE-2022-1283.patch deleted file mode 100644 index 41066f2..0000000 --- a/CVE-2022-1283.patch +++ /dev/null @@ -1,33 +0,0 @@ -commit 18d1d064bf599a255d55f09fca3104776fc34a67 -Author: Sergi Àlvarez i Capilla -Date: Fri Apr 8 19:49:21 2022 +0200 - - Fix null deref in the ne parser ##crash - - * Reported by @hmsec via huntr.dev - * Reproducer: nepoc00 - * BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013 - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index f080e937f..ee2df871a 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -115,7 +115,7 @@ RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) { - } - RList *entries = r_bin_ne_get_entrypoints (bin); - bool resident = true, first = true; -- while (true) { -+ while (entries) { - ut8 sz = r_buf_read8_at (bin->buf, off); - if (!sz) { - first = true; -@@ -352,6 +352,9 @@ RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) { - } - - RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { -+ if (!bin->entry_table) { -+ return NULL; -+ } - RList *entries = r_list_newf (free); - if (!entries) { - return NULL; diff --git a/CVE-2022-1284.patch b/CVE-2022-1284.patch deleted file mode 100644 index 4278af5..0000000 --- a/CVE-2022-1284.patch +++ /dev/null @@ -1,36 +0,0 @@ -commit 64a82e284dddabaeb549228380103b57dead32a6 -Author: Sergi Àlvarez i Capilla -Date: Fri Apr 8 20:39:43 2022 +0200 - - Fix UAF in `aaef` ##crash - - * Reported by @hdthky - * Reproducer: uaf-aef - * BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7 - -diff --git a/libr/core/canal.c b/libr/core/canal.c -index fb53e75fc..610cd22f2 100644 ---- a/libr/core/canal.c -+++ b/libr/core/canal.c -@@ -5295,10 +5295,6 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { - arch = R2_ARCH_MIPS; - } - -- const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); -- if (!sn) { -- eprintf ("Warning: No SN reg alias for current architecture.\n"); -- } - r_reg_arena_push (core->anal->reg); - - IterCtx ictx = { start, end, fcn, NULL }; -@@ -5409,6 +5405,10 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { - goto repeat; - } - } -+ const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); -+ if (!sn) { -+ eprintf ("Warning: No SN reg alias for current architecture.\n"); -+ } - if (sn && op.type == R_ANAL_OP_TYPE_SWI) { - r_strf_buffer (64); - r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS); diff --git a/CVE-2022-1296.patch b/CVE-2022-1296.patch deleted file mode 100644 index 2ac950b..0000000 --- a/CVE-2022-1296.patch +++ /dev/null @@ -1,83 +0,0 @@ -commit 153bcdc29f11cd8c90e7d639a7405450f644ddb6 -Author: Sergi Àlvarez i Capilla -Date: Fri Apr 8 20:14:32 2022 +0200 - - Fix oobread in NE parser ##crash - - * Reported by @hmsec via huntr.dev - * Reproducer: necrash - * BountyID: 52b57274-0e1a-4d61-ab29-1373b555fea0/ - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index ee2df871a..b907d56e9 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -1,7 +1,6 @@ - /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */ - - #include "ne.h" --#define NE_BUG 0 - - static char *__get_target_os(r_bin_ne_obj_t *bin) { - switch (bin->ne_header->targOS) { -@@ -505,25 +504,18 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - free (reloc); - break; - } -- char *name; --#if NE_BUG -- if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) { -- offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; -- name = __read_nonnull_str_at (bin->buf, offset); -- } else { -- name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? -- } --#else -+ char *name = NULL; - if (rel.index > bin->ne_header->ModRefs) { - name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ???? -- } else { -+ } else if (rel.index > 0) { - offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable; - name = __read_nonnull_str_at (bin->buf, offset); - } --#endif - if (rel.flags & IMPORTED_ORD) { - imp->ordinal = rel.func_ord; -- imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord)); -+ char *fname = __func_name_from_ord (name, rel.func_ord); -+ imp->name = r_str_newf ("%s.%s", name, fname); -+ free (fname); - } else { - offset = bin->header_offset + bin->ne_header->ImportNameTable + rel.name_off; - char *func = __read_nonnull_str_at (bin->buf, offset); -@@ -566,6 +558,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) { - r_list_append (relocs, reloc); - } else { - do { -+#define NE_BUG 0 - #if NE_BUG - if (reloc->paddr + 4 < r_buf_size (bin->buf)) { - break; -diff --git a/test/db/formats/ne b/test/db/formats/ne -index 7b6834441..b71f29469 100644 ---- a/test/db/formats/ne -+++ b/test/db/formats/ne -@@ -1,3 +1,17 @@ -+NAME=NE crash -+FILE=bins/ne/necrash -+CMDS=< -Date: Mon Apr 11 13:35:52 2022 +0200 - - Fix oobread and unaligned casts in the NE entrypoint logic ##crash - - * Reported by @hmsec via huntr.dev - * Reproducer: nepocaligns - * BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac - -diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c -index b907d56e9..32aa589e8 100644 ---- a/libr/bin/format/ne/ne.c -+++ b/libr/bin/format/ne/ne.c -@@ -408,14 +408,21 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { - off += 2; - ut8 segnum = *(bin->entry_table + off); - off++; -- ut16 segoff = *(ut16 *)(bin->entry_table + off); -- if (segnum > 0) { -+ if (off > bin->ne_header->EntryTableLength) { -+ break; -+ } -+ ut16 segoff = r_read_le16 (bin->entry_table + off); -+ if (segnum > 0 && segnum < bin->ne_header->SegCount) { - entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; - } - } else { // Fixed -+ if (off + 2 >= bin->ne_header->EntryTableLength) { -+ break; -+ } -+ ut16 delta = r_read_le16 (bin->entry_table + off); - if (bundle_type < bin->ne_header->SegCount) { - entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset -- * bin->alignment + *(ut16 *)(bin->entry_table + off); -+ * bin->alignment + delta; - } - } - off += 2; diff --git a/radare2.spec b/radare2.spec index 45951b5..5b985c5 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.6.6 -%global rel 3 +Version: 5.6.8 +%global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -41,40 +41,6 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.6.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch -# Upstream security patches - -# Bug #2068585 #2068586 -Patch100: CVE-2022-1061.patch - -# Bug #2074067 #2074066 -Patch110: CVE-2022-1207.patch - -# Bug #2073961 #2073962 -Patch120: CVE-2022-1237.patch - -# Bug #2073970 #2073971 -Patch130: CVE-2022-1238.patch -Patch131: CVE-2022-1238-2.patch - -# Bug #2073955 #2073956 -Patch140: CVE-2022-1240.patch - -# Bug #2073974 #2073975 -Patch150: CVE-2022-1244.patch - -# Bug #2073914 #2073910 -Patch160: CVE-2022-1283.patch - -# Bug #2073908 #2073907 -Patch170: CVE-2022-1284.patch - -# Bug #2074200 #2074199 -Patch180: CVE-2022-1296.patch - -# Bug #2074203 #2074204 -Patch190: CVE-2022-1297.patch - - License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -378,6 +344,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 +- bump to 5.6.8 + * Tue Apr 13 2022 Henrik Nordstrom 5.6.6-2 - refresh list of bundled libraries and associated cleanup From 1bd0eebf7d4e83940d38f76c96c4a5a67a1e6fc6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 21:56:03 +0200 Subject: [PATCH 05/51] Import scripts used for sidetag build with iaito --- build.sh | 22 ++++++++++++++++++++++ update.sh | 13 +++++++++++++ 2 files changed, 35 insertions(+) create mode 100755 build.sh create mode 100755 update.sh diff --git a/build.sh b/build.sh new file mode 100755 index 0000000..0dc63a5 --- /dev/null +++ b/build.sh @@ -0,0 +1,22 @@ +#!/bin/sh -xe +branch=${1:-$(git branch --show-current)} +dist=$(echo $branch | cut -d- -f1) +case $dist in +devel) + dist=rawhide + ;; +esac + +fedpkg switch-branch $branch +if [ -f .side-tag-$branch ]; then + echo "Side tag for $branch exists" + read ok +else + fedpkg --release $dist request-side-tag > .side-tag-$branch.txt + head -1 .side-tag-$branch.txt | cut "-d'" -f2 > .side-tag-$branch +fi + +git merge rawhide +git push +fedpkg --release $dist verrel > .ver-$branch +fedpkg --release $dist build --target=$(cat .side-tag-$branch) diff --git a/update.sh b/update.sh new file mode 100755 index 0000000..7f0ebd0 --- /dev/null +++ b/update.sh @@ -0,0 +1,13 @@ +#!/bin/sh -e +if [ $# -lt 2 ]; then + echo "Usage: $0 dist " + exit 1 +fi +dist=${1} +shift +if [ ! -f .side-tag-$dist ]; then + echo "No existing side tag for $dist" + exit 1 +fi + +bodhi updates new --from-tag $(cat .side-tag-$dist) "$@" From 32ccde0f4c6483d07c6a4e7676633c38c8e9ef1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 22:08:46 +0200 Subject: [PATCH 06/51] spelling --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 5b985c5..4ded7b7 100644 --- a/radare2.spec +++ b/radare2.spec @@ -347,7 +347,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 - bump to 5.6.8 -* Tue Apr 13 2022 Henrik Nordstrom 5.6.6-2 +* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 - refresh list of bundled libraries and associated cleanup * Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 From 669cbda8b29b77154a6fcef68cdc106eb4c00c8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 22:11:03 +0200 Subject: [PATCH 07/51] Update to 5.6.8 --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 60952c3..2ebc659 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ /radare2-5.6.2.tar.gz /radare2-5.6.4.tar.gz /radare2-5.6.6.tar.gz +/radare2-5.6.8.tar.gz diff --git a/sources b/sources index 5dd77c4..a92107a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.6.6.tar.gz) = 0969d923b0c65c937dadb3cef655a3931b3daf1fc48bf1f6e3dd1afd1df54f65da3baf4bd401eb1677f88566774ed115c271cdc923dc4ef800ef867f4849efb0 +SHA512 (radare2-5.6.8.tar.gz) = e29a3ff235f37bcde4ec6c1c97d1b9c521b57e93512ca40d71be9e88ac1c002f41af905865fdf4685ee94287425cff32500b5a111eec5594bdd7f32f05631910 From 0493df34da7d03c4917816ae795e5f93fabbdca3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= Date: Thu, 21 Apr 2022 22:18:55 +0200 Subject: [PATCH 08/51] Actually add patches --- radare2-5.6.6-use_lz4.patch | 12 +++++++++++ radare2-5.6.6-use_magic.patch | 37 +++++++++++++++++++++++++++++++++ radare2-5.6.6-use_openssl.patch | 11 ++++++++++ 3 files changed, 60 insertions(+) create mode 100644 radare2-5.6.6-use_lz4.patch create mode 100644 radare2-5.6.6-use_magic.patch create mode 100644 radare2-5.6.6-use_openssl.patch diff --git a/radare2-5.6.6-use_lz4.patch b/radare2-5.6.6-use_lz4.patch new file mode 100644 index 0000000..282cda8 --- /dev/null +++ b/radare2-5.6.6-use_lz4.patch @@ -0,0 +1,12 @@ +diff -ru radare2-5.6.6-orig/libr/util/zip.c radare2-5.6.6/libr/util/zip.c +--- radare2-5.6.6-orig/libr/util/zip.c 2022-03-22 20:06:43.000000000 +0100 ++++ radare2-5.6.6/libr/util/zip.c 2022-04-13 02:48:30.050632855 +0200 +@@ -2,7 +2,7 @@ + + #include + #include +-#include "../../../shlr/lz4/lz4.h" ++#include + + // set a maximum output buffer of 50MB + #define MAXOUT 50000000 diff --git a/radare2-5.6.6-use_magic.patch b/radare2-5.6.6-use_magic.patch new file mode 100644 index 0000000..11ae8e6 --- /dev/null +++ b/radare2-5.6.6-use_magic.patch @@ -0,0 +1,37 @@ +--- radare2-5.6.6-orig/libr/magic/meson.build 2022-03-22 20:06:43.000000000 +0100 ++++ radare2-5.6.6/libr/magic/meson.build 2022-04-13 02:36:10.031944601 +0200 +@@ -1,14 +1,3 @@ +-r_magic_sources = [ +- 'apprentice.c', +- 'ascmagic.c', +- 'fsmagic.c', +- 'funcs.c', +- 'is_tar.c', +- 'magic.c', +- # XXX not used? 'print.c', +- 'softmagic.c' +-] +- + r_magic_deps = [r_util_dep] + if get_option('blob') + r_magic_static_deps = [r_util_static_dep] +@@ -20,8 +9,19 @@ + if get_option('blob') + r_magic_static_deps += [sys_magic] + endif ++ r_magic_sources = [ 'magic-libmagic.c' ] + else + message('Use bundled magic library') ++ r_magic_sources = [ ++ 'apprentice.c', ++ 'ascmagic.c', ++ 'fsmagic.c', ++ 'funcs.c', ++ 'is_tar.c', ++ 'magic.c', ++ # XXX not used? 'print.c', ++ 'softmagic.c' ++ ] + endif + + r_magic = library('r_magic', r_magic_sources, diff --git a/radare2-5.6.6-use_openssl.patch b/radare2-5.6.6-use_openssl.patch new file mode 100644 index 0000000..cacc731 --- /dev/null +++ b/radare2-5.6.6-use_openssl.patch @@ -0,0 +1,11 @@ +--- radare2-5.6.6/libr/socket/meson.build.orig 2022-04-13 02:03:18.003440078 +0200 ++++ radare2-5.6.6/libr/socket/meson.build 2022-04-13 02:03:22.879431434 +0200 +@@ -11,6 +11,8 @@ + ] + + r_util_deps = [utl, r_util_dep, platform_deps] ++r_util_static_deps = [] ++ + if get_option('blob') + r_util_static_deps = [utl, r_util_static_dep, platform_deps] + if use_sys_openssl From 30933f693ef686c501676f80db0b40299ba253d3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 00:24:48 +0000 Subject: [PATCH 09/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 4ded7b7..26176ce 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -344,6 +344,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 - bump to 5.6.8 From c63e06d42f9a944d4479a867207a4003e2529ebe Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 2 Aug 2022 08:48:20 +0200 Subject: [PATCH 10/51] bump to 5.7.6 --- .gitignore | 1 + radare2.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 2ebc659..862adb2 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ /radare2-5.6.4.tar.gz /radare2-5.6.6.tar.gz /radare2-5.6.8.tar.gz +/radare2-5.7.6.tar.gz diff --git a/radare2.spec b/radare2.spec index 26176ce..9cffbd6 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.6.8 +Version: 5.7.6 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -344,6 +344,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Apr 21 2022 Henrik Nordstrom - 5.7.6-1 +- bump to 5.7.6 + * Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index a92107a..0079aae 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.6.8.tar.gz) = e29a3ff235f37bcde4ec6c1c97d1b9c521b57e93512ca40d71be9e88ac1c002f41af905865fdf4685ee94287425cff32500b5a111eec5594bdd7f32f05631910 +SHA512 (radare2-5.7.6.tar.gz) = 04717ddb4bef9ed415c22aa25a0bf626f05c5d32133ac46d5e8a30ebe83e7b782a2b1835233f17f16315a99a39b33dd4e67c34798eb8ae9fbc6db51ca1051e94 From 771bca8a79fc449f6ae710a57b31326d727f5fc6 Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 2 Aug 2022 09:44:14 +0200 Subject: [PATCH 11/51] radare2-5.6.0-dec99.patch already in upstream --- radare2-5.6.0-dec99.patch | 28 ---------------------------- radare2.spec | 3 --- 2 files changed, 31 deletions(-) delete mode 100644 radare2-5.6.0-dec99.patch diff --git a/radare2-5.6.0-dec99.patch b/radare2-5.6.0-dec99.patch deleted file mode 100644 index 511b873..0000000 --- a/radare2-5.6.0-dec99.patch +++ /dev/null @@ -1,28 +0,0 @@ -Declaration of variable in the for loop requires at least c99 compatibility mode -This is specific to 5.6.0 and is already fixed in the git -diff -ru radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c ---- radare2-5.6.0/libr/anal/p/anal_loongarch_gnu.c 2022-02-02 13:29:26.000000000 +0100 -+++ radare2-5.6.0.new/libr/anal/p/anal_loongarch_gnu.c 2022-02-12 00:24:15.787894773 +0100 -@@ -1228,7 +1228,8 @@ - ase->la_opcode_ht[LA_INSN_HASH(it->match)] = it; - } - } -- for (int i=0; ila_opcode_ht[i]){ - ase->la_opcode_ht[i]=it; - } -diff -ru radare2-5.6.0/libr/core/disasm.c radare2-5.6.0.new/libr/core/disasm.c ---- radare2-5.6.0/libr/core/disasm.c 2022-02-02 13:29:26.000000000 +0100 -+++ radare2-5.6.0.new/libr/core/disasm.c 2022-02-12 00:28:26.325298373 +0100 -@@ -5483,7 +5483,8 @@ - if (p) { - core->asmqjmps_size = R_CORE_ASMQJMPS_NUM; - core->asmqjmps = p; -- for (int i = 0; i < R_CORE_ASMQJMPS_NUM; i++) { -+ int i; -+ for (i = 0; i < R_CORE_ASMQJMPS_NUM; i++) { - core->asmqjmps[i] = UT64_MAX; - } - } diff --git a/radare2.spec b/radare2.spec index 9cffbd6..7797d1e 100644 --- a/radare2.spec +++ b/radare2.spec @@ -34,9 +34,6 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif -# Declaration of variable in the for loop requires at least c99 compatibility mode -# This is specific to 5.6.0 and is already fixed in the git -Patch0: radare2-5.6.0-dec99.patch Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.6.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch From 51f6fc2c8af28ce6f217be39c2ae65ffd1435f5f Mon Sep 17 00:00:00 2001 From: nobody Date: Mon, 8 Aug 2022 18:21:55 +0200 Subject: [PATCH 12/51] patch for new libmagic --- radare2-5.7.6-ebcdic.patch | 538 ++++++++++++++++++ ...gic.patch => radare2-5.7.6-use_magic.patch | 7 +- radare2.spec | 14 +- 3 files changed, 554 insertions(+), 5 deletions(-) create mode 100644 radare2-5.7.6-ebcdic.patch rename radare2-5.6.6-use_magic.patch => radare2-5.7.6-use_magic.patch (89%) diff --git a/radare2-5.7.6-ebcdic.patch b/radare2-5.7.6-ebcdic.patch new file mode 100644 index 0000000..d4ff96d --- /dev/null +++ b/radare2-5.7.6-ebcdic.patch @@ -0,0 +1,538 @@ +From ddf483893e92f9edcd3d65f1098231b000bfe28a Mon Sep 17 00:00:00 2001 +From: pancake +Date: Sun, 7 Aug 2022 13:17:58 +0200 +Subject: [PATCH] Test and benchmark --with-sysmagic in the CI ##search + +* Improve output of search.verbose +* Remove conflictive magic signature +--- + .github/workflows/ci.yml | 28 ++++++++ + dist/plugins-cfg/plugins.nocs.cfg | 1 + + libr/core/cmd_magic.c | 42 ++++++----- + libr/include/r_magic.h | 8 +-- + libr/magic/apprentice.c | 3 +- + libr/magic/ascmagic.c | 112 +++++++++++++++--------------- + libr/magic/d/default/archive | 110 +++++++++++++++-------------- + libr/magic/magic.c | 4 +- + 8 files changed, 171 insertions(+), 137 deletions(-) + +diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml +index a640d44a02f7..0767be9d6a52 100644 +--- a/.github/workflows/ci.yml ++++ b/.github/workflows/ci.yml +@@ -47,10 +47,38 @@ jobs: + - name: Linting + run: sys/lint.sh + - name: Building without capstone ++ env: ++ CFLAGS: -O0 + run: | + cp -f dist/plugins-cfg/plugins.nocs.cfg plugins.cfg + ./configure --without-capstone --with-rpath && make -j + sudo make install ++ - name: Running c/m with self-hosted libmagic ++ run: ++ time r2 -a gb -e search.verbose=false -qc/m test/bins/mach0/ls-m1 > /tmp/m.1 2>&1 || true ++ cat /tmp/m.1 ++ - name: Uninstall test ++ run: | ++ sudo make uninstall ++ - name: Building with libmagic ++ env: ++ CFLAGS: -O0 ++ run: | ++ sudo apt install -y libmagic-dev ++ git clean -xdf ; rm -rf shlr/capstone ++ cp -f dist/plugins-cfg/plugins.nocs.cfg plugins.cfg ++ ./configure --with-sysmagic --without-capstone --with-rpath && make -j ++ sudo make install ++ - name: Running c/m with system libmagic ++ run: ++ time r2 -a gb -e search.verbose=false -qc/m test/bins/mach0/ls-m1 > /tmp/m.2 2>&1 || true ++ cat /tmp/m.2 ++ - name: Compare magic times and results ++ run: | ++ echo ===== m.1 ++ cat /tmp/m.1 ++ echo ===== m.2 ++ cat /tmp/m.2 + #- name: Building muon/samu + # run: | + # r2pm -gci muon # installs samurai as dependency +diff --git a/dist/plugins-cfg/plugins.nocs.cfg b/dist/plugins-cfg/plugins.nocs.cfg +index 9a9dee5fc5a9..504cce94782e 100644 +--- a/dist/plugins-cfg/plugins.nocs.cfg ++++ b/dist/plugins-cfg/plugins.nocs.cfg +@@ -62,6 +62,7 @@ asm.x86_as + asm.x86_nz + asm.x86_nasm + bin.any ++bin.s390 + bin.wasm + bin.nro + bin.nso +diff --git a/libr/core/cmd_magic.c b/libr/core/cmd_magic.c +index d1862b64462b..083e90d30329 100644 +--- a/libr/core/cmd_magic.c ++++ b/libr/core/cmd_magic.c +@@ -18,8 +18,8 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + const char *str; + int delta = 0, adelta = 0, ret; + ut64 curoffset = core->offset; +- int maxHits = r_config_get_i (core->config, "search.maxhits"); +- if (maxHits > 0 && *hits >= maxHits) { ++ int max_hits = r_config_get_i (core->config, "search.maxhits"); ++ if (max_hits > 0 && *hits >= max_hits) { + return 0; + } + +@@ -27,8 +27,15 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + ret = 0; + goto seek_exit; + } ++ bool must_report_progress = !pj; ++ if (must_report_progress) { ++ must_report_progress = r_config_get_b (core->config, "search.verbose"); ++ if (must_report_progress) { ++ must_report_progress = r_config_get_b (core->config, "scr.interactive"); ++ } ++ } + if (addr != core->offset) { +- if (addr >= core->offset && (addr+NAH) < (core->offset + core->blocksize)) { ++ if (addr >= core->offset && (addr + NAH) < (core->offset + core->blocksize)) { + delta = addr - core->offset; + } else { + r_core_seek (core, addr, true); +@@ -37,18 +44,21 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + if (core->search->align) { + int mod = addr % core->search->align; + if (mod) { +- eprintf ("Unaligned search at %d\n", mod); ++ R_LOG_WARN ("Unaligned search result at %d", mod); + ret = mod; + goto seek_exit; + } + } +- if (((addr&7)==0) && ((addr&(7<<8))==0)) +- if (!pj) { // update search display ++ if (((addr & 7) == 0) && ((addr & (7 << 8)) == 0)) { ++ if (must_report_progress) { + eprintf ("0x%08" PFMT64x " [%d matches found]\r", addr, *hits); + } ++ } + if (file) { +- if (*file == ' ') file++; +- if (!*file) file = NULL; ++ file = r_str_trim_head_ro (file); ++ if (R_STR_ISEMPTY (file)) { ++ file = NULL; ++ } + } + if (file && ofile && file != ofile) { + if (strcmp (file, ofile)) { +@@ -65,7 +75,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + free (ofile); + ofile = strdup (file); + if (!r_magic_load (ck, file)) { +- eprintf ("failed r_magic_load (\"%s\") %s\n", file, r_magic_error (ck)); ++ R_LOG_ERROR ("failed r_magic_load (\"%s\") %s", file, r_magic_error (ck)); + ck = NULL; + ret = -1; + goto seek_exit; +@@ -74,7 +84,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + const char *magicpath = r_config_get (core->config, "dir.magic"); + if (!r_magic_load (ck, magicpath)) { + ck = NULL; +- eprintf ("failed r_magic_load (dir.magic) %s\n", r_magic_error (ck)); ++ R_LOG_ERROR ("failed r_magic_load (dir.magic) %s", r_magic_error (ck)); + ret = -1; + goto seek_exit; + } +@@ -82,7 +92,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + } + //if (v) r_cons_printf (" %d # pm %s @ 0x%"PFMT64x"\n", depth, r_str_get (file), addr); + if (delta + 2 > core->blocksize) { +- eprintf ("EOB\n"); ++ R_LOG_WARN ("magic result happens between block reads"); + ret = -1; + goto seek_exit; + } +@@ -90,7 +100,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + if (str) { + const char *cmdhit; + #if USE_LIB_MAGIC +- if (!v && (!strcmp (str, "data") || strstr(str, "ASCII") || strstr(str, "ISO") || strstr(str, "no line terminator"))) { ++ if (!v && (!strcmp (str, "data") || strstr(str, "ASCII") || strstr (str, "ISO") || strstr (str, "no line terminator"))) { + #else + if (!v && (!strcmp (str, "data"))) { + #endif +@@ -126,7 +136,7 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + } + // TODO: This must be a callback .. move this into RSearch? + if (!pj) { +- r_cons_printf ("0x%08"PFMT64x" %d %s\n", addr + adelta, magicdepth-depth, p); ++ r_cons_printf ("0x%08"PFMT64x" %d %s\n", addr + adelta, magicdepth - depth, p); + } else { + pj_o (pj); + pj_kN (pj, "offset", addr + adelta); +@@ -134,7 +144,9 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + pj_ks (pj, "info", p); + pj_end (pj); + } +- r_cons_clear_line (1); ++ if (must_report_progress) { ++ r_cons_clear_line (1); ++ } + //eprintf ("0x%08"PFMT64x" 0x%08"PFMT64x" %d %s\n", addr+adelta, addr+adelta, magicdepth-depth, p); + // walking children + for (q = p; *q; q++) { +@@ -171,13 +183,11 @@ static int r_core_magic_at(RCore *core, const char *file, ut64 addr, int depth, + r_magic_free (ck); + ck = NULL; + #endif +-{ + int mod = core->search->align; + if (mod) { + ret = mod; //adelta%addr + deR_ABS(mod-adelta)+1; + goto seek_exit; + } +-} + ret = adelta; //found; + + seek_exit: +diff --git a/libr/include/r_magic.h b/libr/include/r_magic.h +index 488dbf9686ff..bb36c04e153b 100644 +--- a/libr/include/r_magic.h ++++ b/libr/include/r_magic.h +@@ -1,4 +1,4 @@ +-/* radare - LGPL - Copyright 2011-2014 - pancake */ ++/* radare - LGPL - Copyright 2011-2022 - pancake */ + + #ifndef R2_MAGIC_H + #define R2_MAGIC_H +@@ -13,12 +13,6 @@ R_LIB_VERSION_HEADER (r_magic); + + #ifdef R_API + +-#ifdef __EMX__ +-#define PATHSEP ';' +-#else +-#define PATHSEP ':' +-#endif +- + /* limits */ + #ifndef HOWMANY + # define HOWMANY (256 * 1024) /* how much of the file to look at */ +diff --git a/libr/magic/apprentice.c b/libr/magic/apprentice.c +index 6a4428e3f1bd..89eae490ddab 100644 +--- a/libr/magic/apprentice.c ++++ b/libr/magic/apprentice.c +@@ -296,7 +296,7 @@ struct mlist * file_apprentice(RMagic *ms, const char *fn, size_t fn_size, int a + mlist->next = mlist->prev = mlist; + + while (fn) { +- p = strchr (fn, PATHSEP); ++ p = strstr (fn, R_SYS_ENVSEP); + if (p) { + *p++ = '\0'; + } +@@ -2045,6 +2045,7 @@ static ut32 swap4(ut32 sv) { + * swap a quad + */ + static ut64 swap8(ut64 sv) { ++ // we have r_read apis for that, dont dupe! + ut64 rv; + ut8 *s = (ut8 *)(void *)&sv; + ut8 *d = (ut8 *)(void *)&rv; +diff --git a/libr/magic/ascmagic.c b/libr/magic/ascmagic.c +index f7de1f472e3b..59b5ab22bd72 100644 +--- a/libr/magic/ascmagic.c ++++ b/libr/magic/ascmagic.c +@@ -39,6 +39,57 @@ + #include + #include + ++/* ++ * This table maps each EBCDIC character to an (8-bit extended) ASCII ++ * character, as specified in the rationale for the dd(1) command in ++ * draft 11.2 (September, 1991) of the POSIX P1003.2 standard. ++ * ++ * Unfortunately it does not seem to correspond exactly to any of the ++ * five variants of EBCDIC documented in IBM's _Enterprise Systems ++ * Architecture/390: Principles of Operation_, SA22-7201-06, Seventh ++ * Edition, July, 1999, pp. I-1 - I-4. ++ * ++ * Fortunately, though, all versions of EBCDIC, including this one, agree ++ * on most of the printing characters that also appear in (7-bit) ASCII. ++ * Of these, only '|', '!', '~', '^', '[', and ']' are in question at all. ++ * ++ * Fortunately too, there is general agreement that codes 0x00 through ++ * 0x3F represent control characters, 0x41 a nonbreaking space, and the ++ * remainder printing characters. ++ * ++ * This is sufficient to allow us to identify EBCDIC text and to distinguish ++ * between old-style and internationalized examples of text. ++ */ ++ ++static ut8 ebcdic_to_ascii[] = { ++ 0, 1, 2, 3, 156, 9, 134, 127, 151, 141, 142, 11, 12, 13, 14, 15, ++ 16, 17, 18, 19, 157, 133, 8, 135, 24, 25, 146, 143, 28, 29, 30, 31, ++128, 129, 130, 131, 132, 10, 23, 27, 136, 137, 138, 139, 140, 5, 6, 7, ++144, 145, 22, 147, 148, 149, 150, 4, 152, 153, 154, 155, 20, 21, 158, 26, ++' ', 160, 161, 162, 163, 164, 165, 166, 167, 168, 213, '.', '<', '(', '+', '|', ++'&', 169, 170, 171, 172, 173, 174, 175, 176, 177, '!', '$', '*', ')', ';', '~', ++'-', '/', 178, 179, 180, 181, 182, 183, 184, 185, 203, ',', '%', '_', '>', '?', ++186, 187, 188, 189, 190, 191, 192, 193, 194, '`', ':', '#', '@', '\'','=', '"', ++195, 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 196, 197, 198, 199, 200, 201, ++202, 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', '^', 204, 205, 206, 207, 208, ++209, 229, 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 210, 211, 212, '[', 214, 215, ++216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, ']', 230, 231, ++'{', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 232, 233, 234, 235, 236, 237, ++'}', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 238, 239, 240, 241, 242, 243, ++'\\',159, 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 244, 245, 246, 247, 248, 249, ++'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 250, 251, 252, 253, 254, 255 ++}; ++ ++/* ++ * Copy buf[0 ... nbytes-1] into out[], translating EBCDIC to ASCII. ++ */ ++R_API void r_magic_from_ebcdic(const ut8 *buf, size_t nbytes, ut8 *out) { ++ size_t i; ++ for (i = 0; i < nbytes; i++) { ++ out[i] = ebcdic_to_ascii[buf[i]]; ++ } ++} ++ + #if !USE_LIB_MAGIC + + #include "file.h" +@@ -147,9 +198,9 @@ return 0; + type = "text"; + code_mime = "unknown"; + } else { +- r_magic_from_ebcdic(buf, nbytes, nbuf); ++ r_magic_from_ebcdic (buf, nbytes, nbuf); + +- if (looks_ascii(nbuf, nbytes, ubuf, &ulen)) { ++ if (looks_ascii (nbuf, nbytes, ubuf, &ulen)) { + code = "EBCDIC"; + type = "character data"; + code_mime = "ebcdic"; +@@ -534,9 +585,7 @@ static int looks_extended(const ut8 *buf, size_t nbytes, unichar *ubuf, size_t * + * Encode Unicode string as UTF-8, returning pointer to character + * after end of string, or NULL if an invalid character is found. + */ +-static ut8 * +-encode_utf8(ut8 *buf, size_t len, unichar *ubuf, size_t ulen) +-{ ++static ut8 * encode_utf8(ut8 *buf, size_t len, unichar *ubuf, size_t ulen) { + size_t i; + ut8 *end = buf + len; + +@@ -732,48 +781,7 @@ static int looks_ucs16(const ut8 *buf, size_t nbytes, unichar *ubuf, size_t *ule + + #endif + +-/* +- * This table maps each EBCDIC character to an (8-bit extended) ASCII +- * character, as specified in the rationale for the dd(1) command in +- * draft 11.2 (September, 1991) of the POSIX P1003.2 standard. +- * +- * Unfortunately it does not seem to correspond exactly to any of the +- * five variants of EBCDIC documented in IBM's _Enterprise Systems +- * Architecture/390: Principles of Operation_, SA22-7201-06, Seventh +- * Edition, July, 1999, pp. I-1 - I-4. +- * +- * Fortunately, though, all versions of EBCDIC, including this one, agree +- * on most of the printing characters that also appear in (7-bit) ASCII. +- * Of these, only '|', '!', '~', '^', '[', and ']' are in question at all. +- * +- * Fortunately too, there is general agreement that codes 0x00 through +- * 0x3F represent control characters, 0x41 a nonbreaking space, and the +- * remainder printing characters. +- * +- * This is sufficient to allow us to identify EBCDIC text and to distinguish +- * between old-style and internationalized examples of text. +- */ +- +-static ut8 ebcdic_to_ascii[] = { +- 0, 1, 2, 3, 156, 9, 134, 127, 151, 141, 142, 11, 12, 13, 14, 15, +- 16, 17, 18, 19, 157, 133, 8, 135, 24, 25, 146, 143, 28, 29, 30, 31, +-128, 129, 130, 131, 132, 10, 23, 27, 136, 137, 138, 139, 140, 5, 6, 7, +-144, 145, 22, 147, 148, 149, 150, 4, 152, 153, 154, 155, 20, 21, 158, 26, +-' ', 160, 161, 162, 163, 164, 165, 166, 167, 168, 213, '.', '<', '(', '+', '|', +-'&', 169, 170, 171, 172, 173, 174, 175, 176, 177, '!', '$', '*', ')', ';', '~', +-'-', '/', 178, 179, 180, 181, 182, 183, 184, 185, 203, ',', '%', '_', '>', '?', +-186, 187, 188, 189, 190, 191, 192, 193, 194, '`', ':', '#', '@', '\'','=', '"', +-195, 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 196, 197, 198, 199, 200, 201, +-202, 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', '^', 204, 205, 206, 207, 208, +-209, 229, 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 210, 211, 212, '[', 214, 215, +-216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, ']', 230, 231, +-'{', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 232, 233, 234, 235, 236, 237, +-'}', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 238, 239, 240, 241, 242, 243, +-'\\',159, 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 244, 245, 246, 247, 248, 249, +-'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 250, 251, 252, 253, 254, 255 +-}; +- +-#ifdef notdef ++#if 0 + /* + * The following EBCDIC-to-ASCII table may relate more closely to reality, + * or at least to modern reality. It comes from +@@ -807,13 +815,3 @@ static ut8 ebcdic_1047_to_8859[] = { + 0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0xB3,0xDB,0xDC,0xD9,0xDA,0x9F + }; + #endif +- +-/* +- * Copy buf[0 ... nbytes-1] into out[], translating EBCDIC to ASCII. +- */ +-R_API void r_magic_from_ebcdic(const ut8 *buf, size_t nbytes, ut8 *out) { +- size_t i; +- for (i = 0; i < nbytes; i++) { +- out[i] = ebcdic_to_ascii[buf[i]]; +- } +-} +diff --git a/libr/magic/d/default/archive b/libr/magic/d/default/archive +index 0f7cb77866a2..17dbed94e1cd 100755 +--- a/libr/magic/d/default/archive ++++ b/libr/magic/d/default/archive +@@ -133,60 +133,62 @@ + # ZIP footer + 0 string PK\005\006 End of Zip archive + +-# OpenOffice.org / KOffice / StarOffice documents +-# From: Abel Cheung +-# Listed here because they are basically zip files +->>30 string mimetype +- +-# KOffice (1.2 or above) formats +->>>50 string vnd.kde. KOffice (>=1.2) +->>>>58 string karbon Karbon document +->>>>58 string kchart KChart document +->>>>58 string kformula KFormula document +->>>>58 string kivio Kivio document +->>>>58 string kontour Kontour document +->>>>58 string kpresenter KPresenter document +->>>>58 string kspread KSpread document +->>>>58 string kword KWord document +- +-# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) +->>>50 string vnd.sun.xml. OpenOffice.org 1.x +->>>>62 string writer Writer +->>>>>68 byte !0x2e document +->>>>>68 string .template template +->>>>>68 string .global global document +->>>>62 string calc Calc +->>>>>66 byte !0x2e spreadsheet +->>>>>66 string .template template +->>>>62 string draw Draw +->>>>>66 byte !0x2e document +->>>>>66 string .template template +->>>>62 string impress Impress +->>>>>69 byte !0x2e presentation +->>>>>69 string .template template +->>>>62 string math Math document +- +-# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +-# http://lists.oasis-open.org/archives/office/200505/msg00006.html +->>>50 string vnd.oasis.opendocument. OpenDocument +->>>>73 string text +->>>>>77 byte !0x2d Text +-!:mime application/vnd.oasis.opendocument.text +->>>>>77 string -template Text Template +->>>>>77 string -web HTML Document Template +->>>>>77 string -master Master Document +->>>>73 string graphics Drawing +->>>>>81 string -template Template +->>>>73 string presentation Presentation +->>>>>85 string -template Template +->>>>73 string spreadsheet Spreadsheet +->>>>>84 string -template Template +->>>>73 string chart Chart +->>>>>78 string -template Template +->>>>73 string formula Formula +->>>>>80 string -template Template +->>>>73 string database Database +->>>>73 string image Image ++# commented because barely used and barely used ++# ++# # OpenOffice.org / KOffice / StarOffice documents ++# # From: Abel Cheung ++# # Listed here because they are basically zip files ++# >>30 string mimetype ++# ++# # KOffice (1.2 or above) formats ++# >>>50 string vnd.kde. KOffice (>=1.2) ++# >>>>58 string karbon Karbon document ++# >>>>58 string kchart KChart document ++# >>>>58 string kformula KFormula document ++# >>>>58 string kivio Kivio document ++# >>>>58 string kontour Kontour document ++# >>>>58 string kpresenter KPresenter document ++# >>>>58 string kspread KSpread document ++# >>>>58 string kword KWord document ++# ++# # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) ++# >>>50 string vnd.sun.xml. OpenOffice.org 1.x ++# >>>>62 string writer Writer ++# >>>>>68 byte !0x2e document ++# >>>>>68 string .template template ++# >>>>>68 string .global global document ++# >>>>62 string calc Calc ++# >>>>>66 byte !0x2e spreadsheet ++# >>>>>66 string .template template ++# >>>>62 string draw Draw ++# >>>>>66 byte !0x2e document ++# >>>>>66 string .template template ++# >>>>62 string impress Impress ++# >>>>>69 byte !0x2e presentation ++# >>>>>69 string .template template ++# >>>>62 string math Math document ++# ++# # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) ++# # http://lists.oasis-open.org/archives/office/200505/msg00006.html ++# >>>50 string vnd.oasis.opendocument. OpenDocument ++# >>>>73 string text ++# >>>>>77 byte !0x2d Text ++# !:mime application/vnd.oasis.opendocument.text ++# >>>>>77 string -template Text Template ++# >>>>>77 string -web HTML Document Template ++# >>>>>77 string -master Master Document ++# >>>>73 string graphics Drawing ++# >>>>>81 string -template Template ++# >>>>73 string presentation Presentation ++# >>>>>85 string -template Template ++# >>>>73 string spreadsheet Spreadsheet ++# >>>>>84 string -template Template ++# >>>>73 string chart Chart ++# >>>>>78 string -template Template ++# >>>>73 string formula Formula ++# >>>>>80 string -template Template ++# >>>>73 string database Database ++# >>>>73 string image Image + + # Zoo archiver + 20 lelong 0xfdc4a7dc Zoo archive data +diff --git a/libr/magic/magic.c b/libr/magic/magic.c +index 70d2b54dbb74..7f7bf77999dc 100644 +--- a/libr/magic/magic.c ++++ b/libr/magic/magic.c +@@ -106,7 +106,7 @@ static const char *file_or_fd(RMagic *ms, const char *inname, int fd) { + * one extra for terminating '\0', and + * some overlapping space for matches near EOF + */ +-#define SLOP (1 + sizeof(union VALUETYPE)) ++#define SLOP (1 + sizeof (union VALUETYPE)) + if (!(buf = malloc (HOWMANY + SLOP))) { + return NULL; + } +@@ -126,7 +126,7 @@ static const char *file_or_fd(RMagic *ms, const char *inname, int fd) { + ispipe = true; + } + } else { +- int flags = O_RDONLY|O_BINARY; ++ int flags = O_RDONLY | O_BINARY; + + if (stat (inname, &sb) == 0 && S_ISFIFO (sb.st_mode)) { + #if O_NONBLOCK diff --git a/radare2-5.6.6-use_magic.patch b/radare2-5.7.6-use_magic.patch similarity index 89% rename from radare2-5.6.6-use_magic.patch rename to radare2-5.7.6-use_magic.patch index 11ae8e6..a6d58aa 100644 --- a/radare2-5.6.6-use_magic.patch +++ b/radare2-5.7.6-use_magic.patch @@ -15,11 +15,14 @@ r_magic_deps = [r_util_dep] if get_option('blob') r_magic_static_deps = [r_util_static_dep] -@@ -20,8 +9,19 @@ +@@ -20,8 +9,22 @@ if get_option('blob') r_magic_static_deps += [sys_magic] endif -+ r_magic_sources = [ 'magic-libmagic.c' ] ++ r_magic_sources = [ ++ 'magic-libmagic.c', ++ 'ascmagic-libmagic.c', ++ ] else message('Use bundled magic library') + r_magic_sources = [ diff --git a/radare2.spec b/radare2.spec index 7797d1e..1c061f7 100644 --- a/radare2.spec +++ b/radare2.spec @@ -34,10 +34,15 @@ Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif +# Specific to Fedora - build with system libraries Patch1: radare2-5.6.6-use_openssl.patch -Patch3: radare2-5.6.6-use_magic.patch +Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch +# Build with new libmagic which is missing EBCDIC transform functions +Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch + + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -180,7 +185,7 @@ Provides: bundled(tree-sitter) = 0.17.2 # ./shlr/mpc # https://github.com/orangeduck/mpc -Provides: bundled(mpc) = 0.8.7 +Provides: bundled(mpc) = 0.8.7 # ./shlr/yxml # https://dev.yorhel.nl/yxml @@ -235,8 +240,10 @@ rm -rf shlr/lz4/{deps.mk,LICENSE,lz4.*,Makefile,README.md} rm -f libr/hash/xxhash.c libr/hash/xxhash.h # Remove magic files because we use system dependencies awk 'BEGIN {p=1} /#if USE_LIB_MAGIC/ {p=2; next} p==2 && /#else/ {p=0} p>0 {print}' libr/magic/magic.c > libr/magic/magic.c.stripped +awk 'BEGIN {p=1} /#if !USE_LIB_MAGIC/ {p=0; next} p==2 && /#else/ {p=0} p>0 {print}' libr/magic/ascmagic.c > libr/magic/ascmagic.c.stripped rm -rf libr/magic/*.c mv libr/magic/magic.c.stripped libr/magic/magic-libmagic.c +mv libr/magic/ascmagic.c.stripped libr/magic/ascmagic-libmagic.c # Remove openssl files because we use system dependencies rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] @@ -341,8 +348,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -* Thu Apr 21 2022 Henrik Nordstrom - 5.7.6-1 +* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 - bump to 5.7.6 +- cherrypicked patch for new libmagic from upstream * Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From c16f9f0c02ce11982645dbfaf0a68776cf339da2 Mon Sep 17 00:00:00 2001 From: nobody Date: Wed, 5 Oct 2022 15:44:08 +0200 Subject: [PATCH 13/51] bump to 5.7.8 --- .gitignore | 1 + radare2.spec | 12 ++++++++---- sources | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 862adb2..e96e92c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /radare2-5.6.6.tar.gz /radare2-5.6.8.tar.gz /radare2-5.7.6.tar.gz +/radare2-5.7.8.tar.gz diff --git a/radare2.spec b/radare2.spec index 1c061f7..62bdda0 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.7.6 +Version: 5.7.8 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20220228 -%global commit b636941cefcbc12b2031054e736b1f8e5458be32 +%global gitdate 20220913 +%global commit 8e965bef30457a12e07a32a9047a9620a944bc39 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -40,7 +40,8 @@ Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch # Build with new libmagic which is missing EBCDIC transform functions -Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch +# imported upstream +# Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib @@ -348,6 +349,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 +- bump to 5.7.8 + * Tue Aug 02 2022 Michal Ambroz 5.7.6-1 - bump to 5.7.6 - cherrypicked patch for new libmagic from upstream diff --git a/sources b/sources index 0079aae..b2886c2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.7.6.tar.gz) = 04717ddb4bef9ed415c22aa25a0bf626f05c5d32133ac46d5e8a30ebe83e7b782a2b1835233f17f16315a99a39b33dd4e67c34798eb8ae9fbc6db51ca1051e94 +SHA512 (radare2-5.7.8.tar.gz) = 7c819a052f5e4b3da72b945915fca92a747c52dc2e2fa8483a8c2d8e71479ce374efbbe2bc02b1b4af26db6a891b6e44cdbb9e062de2f13b22a258cceab561f6 From 6a300669401042474d3939f9a4cd01ee557b74c5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 19:23:15 +0000 Subject: [PATCH 14/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 62bdda0..8b4bf68 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{rel}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -349,6 +349,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Aug 02 2022 Michal Ambroz 5.7.8-1 - bump to 5.7.8 From 7d3e10f8fc6333458b9f9282bff7d0a065b2f860 Mon Sep 17 00:00:00 2001 From: nobody Date: Thu, 26 Jan 2023 04:34:56 +0100 Subject: [PATCH 15/51] fix rhel7 build, keep embedded libzip as rhel7 libzip is too old --- radare2.spec | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/radare2.spec b/radare2.spec index 8b4bf68..601a9a0 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,12 +1,12 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.7.8 +Version: 5.8.2 %global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases -# %%if 0%%{?rhel} && 0i%%{?rhel} == 8 +# %%if 0%%{?rhel} && 0%%{?rhel} == 8 # Radare2 fails to build on EPEL8+s390x # https://bugzilla.redhat.com/show_bug.cgi?id=1960046 # https://docs.fedoraproject.org/en-US/packaging-guidelines/#_architecture_build_failures @@ -21,16 +21,16 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20220913 -%global commit 8e965bef30457a12e07a32a9047a9620a944bc39 +%global gitdate 20230123 +%global commit 0b6793f37d9dae5b43fa96beae93008e197dc87a %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{rel}%{?dist}.1 +Release: %{rel}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist}.1 +Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip %endif @@ -88,7 +88,12 @@ BuildRequires: ninja-build BuildRequires: pkgconfig # xxhash-devel BuildRequires: pkgconfig(libxxhash) + +# version of libzip on rhel7 is too old +%if 0%{?fedora} || 0%{?rhel} >= 8 BuildRequires: pkgconfig(libzip) +%endif + BuildRequires: pkgconfig(zlib) BuildRequires: pkgconfig(liblz4) BuildRequires: pkgconfig(capstone) >= 3.0.4 @@ -132,7 +137,9 @@ Requires: %{name}-common = %{version}-%{release} # ./libr/hash/{md4,md5,sha1,sha2}.{c,h} # ./libr/util/big.c -# compiled with -D use_sys_openssl=true instead +# could be compiled with -D use_sys_openssl=true instead, +# but is currently not maintained so using embedded R2 implementations +# for hashing # ./shlr/spp/README.md # SPP stands for Simple Pre-Processor, a templating language. @@ -234,7 +241,11 @@ information sed -i -e "s|%{version}-git|%{version}|g;" configure configure.acr %endif # Removing zip/lzip files because we use system dependencies +# version of libzip on rhel7 is too old, use the embedded one instead +%if 0%{?fedora} || 0%{?rhel} >= 8 rm -rf shlr/zip/{zip,zlib,include} +%endif + # Remove lx4 files because we use system dependencies rm -rf shlr/lz4/{deps.mk,LICENSE,lz4.*,Makefile,README.md} # Remove xxhash files because we use system dependencies @@ -246,7 +257,7 @@ rm -rf libr/magic/*.c mv libr/magic/magic.c.stripped libr/magic/magic-libmagic.c mv libr/magic/ascmagic.c.stripped libr/magic/ascmagic-libmagic.c # Remove openssl files because we use system dependencies -rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] +# rm -f libr/hash/{md4,md5,sha1,sha2}.[ch] # Webui contains pre-build and/or minimized versions of JS libraries without source code # Consider installing the web-interface from https://github.com/radare/radare2-webui @@ -267,12 +278,15 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil # Whereever possible use the system-wide libraries instead of bundles %meson \ -Duse_sys_magic=true \ +%if 0%{?fedora} || 0%{?rhel} >= 8 -Duse_sys_zip=true \ +%else + -Duse_sys_zip=false \ +%endif -Duse_sys_zlib=true \ -Duse_sys_lz4=true \ -Duse_sys_xxhash=true \ -Duse_ssl=true \ - -Duse_sys_openssl=true \ -Duse_libuv=true \ %ifarch s390x -Ddebugger=false \ @@ -310,7 +324,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %files %license COPYING COPYING.LESSER %doc CONTRIBUTING.md DEVELOPERS.md README.md -%doc doc/3D/ doc/node.js/ doc/pdb/ doc/sandbox/ +%doc doc/3D/ doc/pdb/ doc/sandbox/ %doc doc/avr.md doc/brainfuck.md doc/calling-conventions.md doc/debug.md %doc doc/esil.md doc/gdb.md doc/gprobe.md doc/intro.md doc/io.md doc/rap.md %doc doc/siol.md doc/strings.md doc/windbg.md doc/yara.md @@ -349,6 +363,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 +- bump to 5.8.2 + * Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From c3cf87391df7b4ba95a465e061ef212295a57703 Mon Sep 17 00:00:00 2001 From: nobody Date: Thu, 26 Jan 2023 05:23:17 +0100 Subject: [PATCH 16/51] upload tarball to sidecache --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index e96e92c..c7c09f4 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ /radare2-5.6.8.tar.gz /radare2-5.7.6.tar.gz /radare2-5.7.8.tar.gz +/radare2-5.8.2.tar.gz diff --git a/sources b/sources index b2886c2..beb6d4c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.7.8.tar.gz) = 7c819a052f5e4b3da72b945915fca92a747c52dc2e2fa8483a8c2d8e71479ce374efbbe2bc02b1b4af26db6a891b6e44cdbb9e062de2f13b22a258cceab561f6 +SHA512 (radare2-5.8.2.tar.gz) = a3b768cade2f0bba7b252331010cddda952882db32ade7e3e16fb6c766265b574672a0f093b070bca5ac48b67c263b87a66c08064601d6e1961c0ff4dd0abc22 From 9faa73b81f0d0f685f180feb1460fe1b0eca69f9 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 10 Feb 2023 02:21:34 +0100 Subject: [PATCH 17/51] tag CVEs in the changelog --- radare2.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/radare2.spec b/radare2.spec index 601a9a0..ff2052b 100644 --- a/radare2.spec +++ b/radare2.spec @@ -365,6 +365,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog * Wed Jan 25 2023 Michal Ambroz 5.8.2-1 - bump to 5.8.2 +- fix CVE-2023-0302 , CVE-2023-0302 * Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild @@ -375,6 +376,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Tue Aug 02 2022 Michal Ambroz 5.7.6-1 - bump to 5.7.6 - cherrypicked patch for new libmagic from upstream +- fix CVE-2022-34502 * Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 5e8a89cd03c44654ba368902d76d90a460c9514f Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 26 Feb 2023 16:30:11 +0100 Subject: [PATCH 18/51] fix sdb generation with meson build --- radare2-5.8.2-meson-sdb.patch | 72 +++++++++++++++++++++++++++++++++++ radare2.spec | 14 +++++-- 2 files changed, 82 insertions(+), 4 deletions(-) create mode 100644 radare2-5.8.2-meson-sdb.patch diff --git a/radare2-5.8.2-meson-sdb.patch b/radare2-5.8.2-meson-sdb.patch new file mode 100644 index 0000000..e4bf64d --- /dev/null +++ b/radare2-5.8.2-meson-sdb.patch @@ -0,0 +1,72 @@ +diff -ru -N radare2-5.8.2/libr/syscall/d/gen.py radare2-5.8.2.new/libr/syscall/d/gen.py +--- radare2-5.8.2/libr/syscall/d/gen.py 1970-01-01 01:00:00.000000000 +0100 ++++ radare2-5.8.2.new/libr/syscall/d/gen.py 2023-02-26 00:13:15.616002799 +0100 +@@ -0,0 +1,29 @@ ++#!/usr/bin/env python ++# args [sdbpath] [input] [output] ++import os ++import sys ++import subprocess ++ ++ ++try: ++ sdb_exe = sys.argv[1] ++ _input = sys.argv[2] ++ _output = sys.argv[3] ++ _tmpfile = _input + ".tmp" ++ with open(_input) as lines: ++ res = "" ++ for line in lines: ++ kv = line.rstrip().split("=", 1) ++ if kv[0] == "_": ++ res += line ++ else: ++ vv = kv[1].split(",") ++ res += vv[0] + "." + vv[1] + "=" + kv[0] + "\n" ++ res += line ++ with open(_tmpfile, "w") as file: ++ file.write(res) ++ subprocess.call([sdb_exe, _output, "==", _tmpfile]) ++except Exception as e: ++ print(e) ++ print("Usage: gen.py [sdb_exe] [input] [output]") ++ +diff -ru -N radare2-5.8.2/libr/syscall/d/meson.build radare2-5.8.2.new/libr/syscall/d/meson.build +--- radare2-5.8.2/libr/syscall/d/meson.build 2023-01-23 11:53:42.000000000 +0100 ++++ radare2-5.8.2.new/libr/syscall/d/meson.build 2023-02-26 00:13:15.617002836 +0100 +@@ -35,7 +35,7 @@ + gen_cmd = sdb_gen_cmd_cgen + else + outfile = '@0@.sdb'.format(file) +- gen_cmd = sdb_gen_cmd ++ gen_cmd = syscall_sdb_gen_cmd + endif + + r_syscall_d_sources += custom_target(outfile, +diff -ru -N radare2-5.8.2/meson.build radare2-5.8.2.new/meson.build +--- radare2-5.8.2/meson.build 2023-01-23 11:53:42.000000000 +0100 ++++ radare2-5.8.2.new/meson.build 2023-02-26 00:13:15.619002909 +0100 +@@ -1,6 +1,7 @@ + project('radare2', 'c', license : 'LGPL3', meson_version : '>=0.49', version : '5.8.2') + + py3_exe = import('python').find_installation('python3') ++gen_py = '@0@/libr/syscall/d/gen.py'.format(meson.current_source_dir()) + git_exe = find_program('git', required: false) + pkgconfig_mod = import('pkgconfig') + +@@ -553,6 +554,15 @@ + '@INPUT@' + ] + ++py_cmd = '__import__("os").readlink(r"@0@"))'.format(repo) ++syscall_sdb_gen_cmd = [ ++ py3_exe, ++ gen_py, ++ sdb_exe, ++ '@INPUT@', ++ '@OUTPUT@', ++] ++ + # handle spp dependency + spp_files = [ + 'shlr/spp/spp.c' diff --git a/radare2.spec b/radare2.spec index ff2052b..878a92b 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.2 -%global rel 1 +%global rel 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -39,9 +39,12 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch -# Build with new libmagic which is missing EBCDIC transform functions -# imported upstream -# Patch5: https://github.com/radareorg/radare2/commit/ddf483893e92f9edcd3d65f1098231b000bfe28a.patch#/radare2-5.7.6-ebcdic.patch +# Fix issues wit the generation of SDB from the meson build +# https://github.com/radareorg/radare2/issues/21375 +# https://bugzilla.redhat.com/show_bug.cgi?id=2170036 +# Patch5: https://github.com/radareorg/radare2/commit/81d7a23df788ecd68aeae2921297cc0ca31902ed.patch#/%%{name}-%%{version}-meson-sdb.patch +Patch5: %{name}-%{version}-meson-sdb.patch + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib @@ -363,6 +366,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 +- cherrypick upstream patch for fixing the sdb generation from mesosn + * Wed Jan 25 2023 Michal Ambroz 5.8.2-1 - bump to 5.8.2 - fix CVE-2023-0302 , CVE-2023-0302 From 35bf7c6f1b40540951c220a843299f4e74383717 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 16 Mar 2023 11:53:22 +0100 Subject: [PATCH 19/51] bump to 5.8.4 --- .gitignore | 29 +---------------------------- radare2.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 33 deletions(-) diff --git a/.gitignore b/.gitignore index c7c09f4..98e0f4f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,28 +1 @@ -/radare2-2.9.0.tar.gz -/radare2-3.0.0.tar.gz -/radare2-3.0.1.tar.gz -/radare2-3.1.0.tar.gz -/radare2-3.2.0.tar.gz -/radare2-3.3.0.tar.gz -/radare2-3.4.1.tar.gz -/radare2-3.6.0.tar.gz -/radare2-3.9.0.tar.gz -/radare2-4.2.1.tar.gz -/radare2-4.4.0.tar.gz -/radare2-4.5.0.tar.gz -/radare2-5.1.0.tar.gz -/radare2-5.1.1.tar.gz -/radare2-5.2.0.tar.gz -/radare2-5.2.1.tar.gz -/radare2-5.3.0.tar.gz -/radare2-5.3.1.tar.gz -/radare2-5.4.0.tar.gz -/radare2-5.4.2.tar.gz -/radare2-5.6.0.tar.gz -/radare2-5.6.2.tar.gz -/radare2-5.6.4.tar.gz -/radare2-5.6.6.tar.gz -/radare2-5.6.8.tar.gz -/radare2-5.7.6.tar.gz -/radare2-5.7.8.tar.gz -/radare2-5.8.2.tar.gz +/radare2-*.tar.gz diff --git a/radare2.spec b/radare2.spec index 878a92b..33f0eac 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.2 -%global rel 2 +Version: 5.8.4 +%global rel 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20230123 -%global commit 0b6793f37d9dae5b43fa96beae93008e197dc87a +%global gitdate 20230314 +%global commit ab809417aa6b676922f95cf77861924eb90e7ef2 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -366,6 +366,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 +- bump to 5.8.4 + * Sun Feb 26 2023 Michal Ambroz 5.8.2-2 - cherrypick upstream patch for fixing the sdb generation from mesosn diff --git a/sources b/sources index beb6d4c..a3a3a01 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.2.tar.gz) = a3b768cade2f0bba7b252331010cddda952882db32ade7e3e16fb6c766265b574672a0f093b070bca5ac48b67c263b87a66c08064601d6e1961c0ff4dd0abc22 +SHA512 (radare2-5.8.4.tar.gz) = 3b7ef3756fa45dd1dc1e7293b278650734c4d8c160940215de7f1c46b8eb187829f92d6411ce5f60e5f0ea8c74ae8cc0abe4df44df0336f7f5cc7ff9ca177aca From f552af6b593f044a501341b9002e0ef07d2e21f7 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 29 Mar 2023 02:15:30 +0200 Subject: [PATCH 20/51] as 5.8.4 contains segfault, bump to 5.8.5 --- radare2.spec | 34 +++++++++++++++++----------------- sources | 2 +- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/radare2.spec b/radare2.spec index 33f0eac..d922936 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.4 -%global rel 1 +Version: 5.8.5 +%global baserelease 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -16,22 +16,22 @@ VCS: https://github.com/radareorg/radare2 # by default it builds from the released version of radare2 # to build from git use rpmbuild --without=releasetag -%bcond_without releasetag +%bcond_with releasetag %global gituser radareorg %global gitname radare2 -%global gitdate 20230314 -%global commit ab809417aa6b676922f95cf77861924eb90e7ef2 +%global gitdate 20230328 +%global commit 70a78f0943e33b8885ee63cb8cca889b732404da %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{rel}%{?dist} +Release: %{baserelease}%{?dist} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{rel}.%{gitdate}git%{shortcommit}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.zip#/%{name}-%{version}-%{shortcommit}.zip +Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries @@ -39,14 +39,6 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch -# Fix issues wit the generation of SDB from the meson build -# https://github.com/radareorg/radare2/issues/21375 -# https://bugzilla.redhat.com/show_bug.cgi?id=2170036 -# Patch5: https://github.com/radareorg/radare2/commit/81d7a23df788ecd68aeae2921297cc0ca31902ed.patch#/%%{name}-%%{version}-meson-sdb.patch -Patch5: %{name}-%{version}-meson-sdb.patch - - - License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -279,6 +271,8 @@ sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.buil %build # Whereever possible use the system-wide libraries instead of bundles +# --sanitize=address,undefined,signed-integer-overflow \ + %meson \ -Duse_sys_magic=true \ %if 0%{?fedora} || 0%{?rhel} >= 8 @@ -366,11 +360,17 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 +- 5.8.5 rebuild from git, patched for segfault + +* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 +- patch for segfault in sdb_hash + * Thu Mar 16 2023 Michal Ambroz 5.8.4-1 - bump to 5.8.4 * Sun Feb 26 2023 Michal Ambroz 5.8.2-2 -- cherrypick upstream patch for fixing the sdb generation from mesosn +- cherrypick upstream patch for fixing the sdb generation from meson * Wed Jan 25 2023 Michal Ambroz 5.8.2-1 - bump to 5.8.2 diff --git a/sources b/sources index a3a3a01..3927678 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.4.tar.gz) = 3b7ef3756fa45dd1dc1e7293b278650734c4d8c160940215de7f1c46b8eb187829f92d6411ce5f60e5f0ea8c74ae8cc0abe4df44df0336f7f5cc7ff9ca177aca +SHA512 (radare2-5.8.5-git20230328-70a78f0.tar.gz) = 758f35bc666fe54fd4f0da97b0b1c14239e1edc5c7e8587ec89ed78bcd372f9c1f76586afc30f3576319067534d3e3f13f86529aeacc85141cd41947f2f64628 From 3563cf9435ca82741b92406ceb2b9301df038822 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 23 May 2023 18:58:43 +0200 Subject: [PATCH 21/51] bump to 5.8.6 --- radare2.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/radare2.spec b/radare2.spec index d922936..988fff9 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.5 -%global baserelease 3 +Version: 5.8.6 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -16,13 +16,13 @@ VCS: https://github.com/radareorg/radare2 # by default it builds from the released version of radare2 # to build from git use rpmbuild --without=releasetag -%bcond_with releasetag +%bcond_without releasetag %global gituser radareorg %global gitname radare2 -%global gitdate 20230328 -%global commit 70a78f0943e33b8885ee63cb8cca889b732404da +%global gitdate 20230505 +%global commit 3c9ad151adf52658d814f56b9bb80bc9231da36b %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -360,6 +360,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Tue May 23 2023 Michal Ambroz 5.8.6-1 +- bump to 5.8.5 + * Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 - 5.8.5 rebuild from git, patched for segfault From c5ff3b2c71c66337db39a2cfff26bb956885616d Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 23 May 2023 19:00:26 +0200 Subject: [PATCH 22/51] adding 5.8.6 source --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 3927678..d1b87fe 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.5-git20230328-70a78f0.tar.gz) = 758f35bc666fe54fd4f0da97b0b1c14239e1edc5c7e8587ec89ed78bcd372f9c1f76586afc30f3576319067534d3e3f13f86529aeacc85141cd41947f2f64628 +SHA512 (radare2-5.8.6.tar.gz) = cd53ed7519d485253182d8d7d414b8d0927e65dd4d0c9716d0d8819e739c8e5e39deb702d93cb5a2a9425804d9798e6eb0acb58a4b904e25a9ba4fcad2315f47 From 7cefe109c8b30e37a03c0eea7c96a6d2e2ef86aa Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 23 May 2023 19:02:57 +0200 Subject: [PATCH 23/51] bump to 5.8.5 comment --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 988fff9..9012108 100644 --- a/radare2.spec +++ b/radare2.spec @@ -361,7 +361,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog * Tue May 23 2023 Michal Ambroz 5.8.6-1 -- bump to 5.8.5 +- bump to 5.8.6 * Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 - 5.8.5 rebuild from git, patched for segfault From dde323006c617458228b6d270ed7c0c973b37f03 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 5 Jul 2023 00:21:53 +0200 Subject: [PATCH 24/51] bump to 5.8.8 --- radare2.spec | 9 ++++++--- sources | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/radare2.spec b/radare2.spec index 9012108..3f697c2 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.6 +Version: 5.8.8 %global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20230505 -%global commit 3c9ad151adf52658d814f56b9bb80bc9231da36b +%global gitdate 20230608 +%global commit ea7f0356519884715cf1d5fba16042bac72b2df5 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -360,6 +360,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 +- bump to 5.8.8 + * Tue May 23 2023 Michal Ambroz 5.8.6-1 - bump to 5.8.6 diff --git a/sources b/sources index d1b87fe..65379f9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.6.tar.gz) = cd53ed7519d485253182d8d7d414b8d0927e65dd4d0c9716d0d8819e739c8e5e39deb702d93cb5a2a9425804d9798e6eb0acb58a4b904e25a9ba4fcad2315f47 +SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b From fe73bbcbea22ab4fabf7eb756ac5774fb223985a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 16:26:50 +0000 Subject: [PATCH 25/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 3f697c2..657e522 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 1 +%global baserelease 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -360,6 +360,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jul 05 2023 Michal Ambroz 5.8.8-1 - bump to 5.8.8 From 6e264534597c5d1c8dfe25a5c500cd634b11e797 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 26 Oct 2023 15:37:38 +0200 Subject: [PATCH 26/51] cherrypick CVE-2023-4322 & CVE-2023-5686 fix from upstream --- radare2-5.8.8-CVE-2023-4322.patch | 120 ++++++++++++++++++++++++++++++ radare2-5.8.8-CVE-2023-5686.patch | 20 +++++ radare2.spec | 24 +++++- 3 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 radare2-5.8.8-CVE-2023-4322.patch create mode 100644 radare2-5.8.8-CVE-2023-5686.patch diff --git a/radare2-5.8.8-CVE-2023-4322.patch b/radare2-5.8.8-CVE-2023-4322.patch new file mode 100644 index 0000000..2e80af3 --- /dev/null +++ b/radare2-5.8.8-CVE-2023-4322.patch @@ -0,0 +1,120 @@ +diff -ru radare2-5.8.8/libr/arch/p/bf/plugin.c radare2-5.8.8.new/libr/arch/p/bf/plugin.c +--- radare2-5.8.8/libr/arch/p/bf/plugin.c 2023-06-08 15:54:42.000000000 +0200 ++++ radare2-5.8.8.new/libr/arch/p/bf/plugin.c 2023-10-26 14:52:41.893960711 +0200 +@@ -13,8 +13,8 @@ + } + + static int getid(char ch) { +- const char *keys = "[]<>+-,."; +- const char *cidx = strchr (keys, ch); ++ const char *const keys = "[]<>+-,."; ++ const char *const cidx = strchr (keys, ch); + return cidx? cidx - keys + 1: 0; + } + +@@ -136,13 +136,11 @@ + #define BUFSIZE_INC 32 + static bool decode(RArchSession *as, RAnalOp *op, RArchDecodeMask mask) { + int len = op->size; +- const ut8 *_buf = op->bytes; +- const ut64 addr = op->addr; + if (len < 1) { + return false; + } +- +- ut8 *buf = (ut8*)_buf; // XXX ++ ut8 *buf = op->bytes; ++ const ut64 addr = op->addr; + ut64 dst = 0LL; + if (!op) { + return 1; +@@ -169,29 +167,32 @@ + } + r_strbuf_set (&op->esil, "1,pc,-,brk,=[4],4,brk,+="); + #if 1 +- { ++ if (len > 1) { + const ut8 *p = buf + 1; + int lev = 0, i = 1; + len--; + while (i < len && *p) { +- if (*p == '[') { ++ switch (*p) { ++ case '[': + lev++; +- } +- if (*p == ']') { ++ break; ++ case ']': + lev--; +- if (lev == -1) { +- dst = addr + (size_t)(p - buf) + 1; ++ if (lev < 1) { ++ size_t delta = p - buf; ++ dst = addr + (size_t)delta + 1; + op->jump = dst; + r_strbuf_set (&op->esil, "1,pc,-,brk,=[4],4,brk,+=,"); + goto beach; + } +- } +- if (*p == 0x00 || *p == 0xff) { ++ break; ++ case 0: ++ case 0xff: + op->type = R_ANAL_OP_TYPE_ILL; + goto beach; + } + if (read_at && i == len - 1) { +- break; ++#if 0 + // XXX unnecessary just break + int new_buf_len = len + 1 + BUFSIZE_INC; + ut8 *new_buf = calloc (new_buf_len, 1); +@@ -203,6 +204,9 @@ + p = buf + i; + len += BUFSIZE_INC; + } ++#else ++ break; ++#endif + } + p++; + i++; +Only in radare2-5.8.8.new/libr/arch/p/bf: plugin.c.orig +diff -ru radare2-5.8.8/libr/core/cmd_anal.c radare2-5.8.8.new/libr/core/cmd_anal.c +--- radare2-5.8.8/libr/core/cmd_anal.c 2023-06-08 15:54:42.000000000 +0200 ++++ radare2-5.8.8.new/libr/core/cmd_anal.c 2023-10-26 14:56:01.978360519 +0200 +@@ -8700,9 +8700,9 @@ + isValidCall = false; + } + if (isValidCall) { +- ut8 buf[4] = {0}; +- r_io_read_at (core->io, op.jump, buf, 4); +- isValidCall = memcmp (buf, "\x00\x00\x00\x00", 4); ++ ut8 zbuf[4] = {0}; ++ r_io_read_at (core->io, op.jump, zbuf, 4); ++ isValidCall = memcmp (zbuf, "\x00\x00\x00\x00", 4); + } + if (isValidCall) { + #if JAYRO_03 +@@ -8798,9 +8798,8 @@ + } + + static void cmd_sdbk(Sdb *db, const char *input) { +- char *out = (input[0] == ' ') +- ? sdb_querys (db, NULL, 0, input + 1) +- : sdb_querys (db, NULL, 0, "*"); ++ const char *arg = (input[0] == ' ')? input + 1: "*"; ++ char *out = sdb_querys (db, NULL, 0, arg); + if (out) { + r_cons_println (out); + free (out); +@@ -9098,7 +9097,7 @@ + } + + static void cmd_anal_ucall_ref(RCore *core, ut64 addr) { +- RAnalFunction * fcn = r_anal_get_function_at (core->anal, addr); ++ RAnalFunction *fcn = r_anal_get_function_at (core->anal, addr); + if (fcn) { + r_cons_printf (" ; %s", fcn->name); + } else { diff --git a/radare2-5.8.8-CVE-2023-5686.patch b/radare2-5.8.8-CVE-2023-5686.patch new file mode 100644 index 0000000..be97561 --- /dev/null +++ b/radare2-5.8.8-CVE-2023-5686.patch @@ -0,0 +1,20 @@ +diff -ru radare2-5.8.8/shlr/java/code.c radare2-5.8.8.new/shlr/java/code.c +--- radare2-5.8.8/shlr/java/code.c 2023-06-08 15:54:42.000000000 +0200 ++++ radare2-5.8.8.new/shlr/java/code.c 2023-10-26 14:42:41.822081941 +0200 +@@ -191,10 +191,12 @@ + case 0xa6: // if_acmpne + case 0xa7: // goto + case 0xa8: // jsr +- snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, +- (addr+(short)USHORT (bytes, 1))); +- output[outlen-1] = 0; +- return update_bytes_consumed (JAVA_OPS[idx].size); ++ if (len > 3) { ++ const short delta = USHORT (bytes, 1); ++ snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, addr + delta); ++ output[outlen-1] = 0; ++ return update_bytes_consumed (JAVA_OPS[idx].size); ++ } + // XXX - Figure out what constitutes the [] value + case 0xab: // tableswitch + case 0xaa: // tableswitch diff --git a/radare2.spec b/radare2.spec index 3f697c2..2441d1d 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 1 +%global baserelease 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -39,6 +39,20 @@ Patch1: radare2-5.6.6-use_openssl.patch Patch3: radare2-5.7.6-use_magic.patch Patch4: radare2-5.6.6-use_lz4.patch +# CVE-2023-4322 - radare2: Heap-based Buffer Overflow in the bf dissassembler +# fix should be part of 5.9.0 +# https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd +Patch5: radare2-5.8.8-CVE-2023-4322.patch + +# CVE-2023-5686 - radare2: heap-buffer-overflow in /radare2/shlr/java/code.c:211:21 in java_print_opcode +# fix should be part of 5.9.0 +# https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de +Patch6: radare2-5.8.8-CVE-2023-5686.patch + + + + + License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ @@ -360,6 +374,11 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 +- cherrypick from upstream master patches for known vulnerabilities: +- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler +- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c + * Wed Jul 05 2023 Michal Ambroz 5.8.8-1 - bump to 5.8.8 @@ -374,6 +393,7 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Thu Mar 16 2023 Michal Ambroz 5.8.4-1 - bump to 5.8.4 +- fix CVE-2023-27114 * Sun Feb 26 2023 Michal Ambroz 5.8.2-2 - cherrypick upstream patch for fixing the sdb generation from meson @@ -450,6 +470,8 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} - bump to 5.3.0 - remove radare2-5.2.1-meson_rhel8.patch - accepted upstream - remove radare2-5.2.1-xxhash.patch - accepted upstream +- fix CVE-2021-32494 #2221281, #2221280, #2221282 +- fix CVE-2021-32495 #2221285, #2221286 * Sat May 15 2021 Michal Ambroz 5.2.1-3 - adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 From 5308e52a60159d8720c30d5e1df6b2ff12866a31 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 14:49:44 +0100 Subject: [PATCH 27/51] rebuild with 5.0.1 --- radare2.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/radare2.spec b/radare2.spec index 77b08c2..126343f 100644 --- a/radare2.spec +++ b/radare2.spec @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 +- rebuild F40+ with capstone 5.0.1+ + * Thu Oct 26 2023 Michal Ambroz 5.8.8-2 - cherrypick from upstream master patches for known vulnerabilities: - CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler From cf7acffaa8a1866b66a7a02e13888e76a68c46af Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 14:54:15 +0100 Subject: [PATCH 28/51] rebuild with capstone 5.0.1 --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 126343f..72eed03 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 2 +%global baserelease 3 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases From e05a26dc172905679101f7d5330b61fee4d40d9a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 13 Nov 2023 15:53:17 +0100 Subject: [PATCH 29/51] update the license to SPDX --- radare2.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 72eed03..1a2f341 100644 --- a/radare2.spec +++ b/radare2.spec @@ -53,7 +53,7 @@ Patch6: radare2-5.8.8-CVE-2023-5686.patch -License: LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib +License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ # some code has originally different license: From d9b75dda69eb48b093b9d0dbbd1e919acbd9860a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 22 Jan 2024 10:35:24 +0000 Subject: [PATCH 30/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 1a2f341..15b7c38 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 3 +%global baserelease 4 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Oct 26 2023 Michal Ambroz 5.8.8-3 - rebuild F40+ with capstone 5.0.1+ From f62823625617f127b145ed2e738e5de06eef9567 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 14:36:39 +0000 Subject: [PATCH 31/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 15b7c38..9158d06 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.8.8 -%global baserelease 4 +%global baserelease 5 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -374,6 +374,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 75eb7b377b1493d6c28ff9868ca5ccc26bdc2500 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 5 May 2024 18:15:22 +0200 Subject: [PATCH 32/51] radare2 --- README.md | 23 ++++++++++++++++++- radare2-5.9.0-use_magic.patch | 42 +++++++++++++++++++++++++++++++++++ radare2.spec | 22 +++++++++++------- sources | 2 +- 4 files changed, 79 insertions(+), 10 deletions(-) create mode 100644 radare2-5.9.0-use_magic.patch diff --git a/README.md b/README.md index 6e0362e..bce9e92 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,24 @@ # radare2 -radare2: the reverse engineering framework \ No newline at end of file +radare2: the reverse engineering framework + + +## How to update + +### Rawhide +* do changes primarily in the rawhide branch +* request side tag with `fedpkg request-side-tag` +* build updated package with `fedpkg build --target=fZZ-build-side-XXXXX` from the `main` branch +* build cutter-re and other dependent packages with the same command from the `main` branch +* when all builds are done, create a bodhi update with `bodhi updates new --from-tag --notes "mynotes" --user YYYYY fZZ-build-side-XXXXX` + +### Stable +* wherever possible us fast-forward merge from rawhide to stable branches +``` +cd fXX +fedpkg pull && git merge origin/rawhide && fedpkg push && fedpkg build +``` +* create buildroot override with `fedpkg override create` +* possibly update and re-build iaito and other dependent packages with `fedpkg build` from the `fXX` branch +* when all builds are done, create a bodhi update with `bodhi updates new --type enhancement --bugs xxxxxxxx --close-bugs --notes "mynotes" radare2-nvr,iaito-nvr,...` + diff --git a/radare2-5.9.0-use_magic.patch b/radare2-5.9.0-use_magic.patch new file mode 100644 index 0000000..c8b031e --- /dev/null +++ b/radare2-5.9.0-use_magic.patch @@ -0,0 +1,42 @@ +diff -ru radare2-5.9.0.old/libr/magic/meson.build radare2-5.9.0.new/libr/magic/meson.build +--- radare2-5.9.0.old/libr/magic/meson.build 2024-03-31 17:01:15.000000000 +0200 ++++ radare2-5.9.0.new/libr/magic/meson.build 2024-04-21 00:48:57.545114120 +0200 +@@ -1,15 +1,3 @@ +-r_magic_sources = [ +- 'apprentice.c', +- 'ascmagic.c', +- 'fsmagic.c', +- 'funcs.c', +- 'mdump.c', +- 'is_tar.c', +- 'magic.c', +- # XXX not used? 'print.c', +- 'softmagic.c' +-] +- + r_magic_deps = [r_util_dep] + if get_option('blob') + r_magic_static_deps = [r_util_static_dep] +@@ -21,8 +9,22 @@ + if get_option('blob') + r_magic_static_deps += [sys_magic] + endif ++ r_magic_sources = [ ++ 'magic-libmagic.c', ++ 'ascmagic-libmagic.c', ++ ] + else + message('Use bundled magic library') ++ r_magic_sources = [ ++ 'apprentice.c', ++ 'ascmagic.c', ++ 'fsmagic.c', ++ 'funcs.c', ++ 'is_tar.c', ++ 'magic.c', ++ # XXX not used? 'print.c', ++ 'softmagic.c' ++ ] + endif + + r_magic = library('r_magic', r_magic_sources, diff --git a/radare2.spec b/radare2.spec index 9158d06..c071c80 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.8.8 -%global baserelease 5 +Version: 5.9.0 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -21,8 +21,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20230608 -%global commit ea7f0356519884715cf1d5fba16042bac72b2df5 +%global gitdate 20240331 +%global commit 4a07098809c71c21515d0f862ac4ca044ae95e95 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -36,18 +36,20 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{nam # Specific to Fedora - build with system libraries Patch1: radare2-5.6.6-use_openssl.patch -Patch3: radare2-5.7.6-use_magic.patch -Patch4: radare2-5.6.6-use_lz4.patch +Patch3: radare2-5.9.0-use_magic.patch + +# using system-wide LZ4 should be done using conditionals +# Patch4: radare2-5.6.6-use_lz4.patch # CVE-2023-4322 - radare2: Heap-based Buffer Overflow in the bf dissassembler # fix should be part of 5.9.0 # https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd -Patch5: radare2-5.8.8-CVE-2023-4322.patch +# Patch5: radare2-5.8.8-CVE-2023-4322.patch # CVE-2023-5686 - radare2: heap-buffer-overflow in /radare2/shlr/java/code.c:211:21 in java_print_opcode # fix should be part of 5.9.0 # https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de -Patch6: radare2-5.8.8-CVE-2023-5686.patch +# Patch6: radare2-5.8.8-CVE-2023-5686.patch @@ -368,12 +370,16 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %{_datadir}/%{name}/%{version}/opcodes %{_datadir}/%{name}/%{version}/syscall %{_datadir}/%{name}/%{version}/charsets +%{_datadir}/%{name}/%{version}/platform %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 +- bump to 5.9.0 + * Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 65379f9..e6c62b8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b +SHA512 (radare2-5.9.0.tar.gz) = f184ad6e066a5113091912c11cca87cb9450eff20e920a00dc9da0efa9de97d6bfdaf44ae4d9e08a4760f4ebca82732832a309fad8452930adb4ee2438d9668e From 6041caa627e33ac1dbe40a621d51df37fd2e2216 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 18 May 2024 23:43:07 +0200 Subject: [PATCH 33/51] cosmetics --- radare2.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index c071c80..cb2bc68 100644 --- a/radare2.spec +++ b/radare2.spec @@ -28,10 +28,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} Release: %{baserelease}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} -Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries From d4b00ad1b3e0720f3190c6767c9d0500b03daaa3 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:44:42 +0200 Subject: [PATCH 34/51] bump to 5.9.2 --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index cb2bc68..3af3a05 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.0 +Version: 5.9.2 %global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 @@ -377,6 +377,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 From 803fff39945f7f86ffb2d3f0a5945b2fec32f20a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:49:50 +0200 Subject: [PATCH 35/51] radare2 - bump to 5.9.2 --- radare2.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/radare2.spec b/radare2.spec index 3af3a05..a77917f 100644 --- a/radare2.spec +++ b/radare2.spec @@ -22,15 +22,15 @@ VCS: https://github.com/radareorg/radare2 %global gitname radare2 %global gitdate 20240331 -%global commit 4a07098809c71c21515d0f862ac4ca044ae95e95 +%global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{baserelease}%{?dist} +Release: 1%{?dist} Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Release: 1%{?dist} Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -380,6 +380,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 From a74b7d314abaf7aad39b2660c30f8b175c33f4e0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 22 May 2024 15:54:48 +0200 Subject: [PATCH 36/51] 5.9.2 - fix back the release numbers --- radare2.spec | 7 ++----- sources | 2 +- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/radare2.spec b/radare2.spec index a77917f..0513f39 100644 --- a/radare2.spec +++ b/radare2.spec @@ -27,10 +27,10 @@ VCS: https://github.com/radareorg/radare2 %if %{with releasetag} -Release: 1%{?dist} +Release: %{baserelease}%{?dist} Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 1%{?dist} +Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -380,9 +380,6 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 -* Wed May 22 2024 Michal Ambroz - 5.9.2-1 -- bump to 5.9.2 - * Sat Apr 20 2024 Michal Ambroz 5.9.0-1 - bump to 5.9.0 diff --git a/sources b/sources index e6c62b8..33cd418 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.0.tar.gz) = f184ad6e066a5113091912c11cca87cb9450eff20e920a00dc9da0efa9de97d6bfdaf44ae4d9e08a4760f4ebca82732832a309fad8452930adb4ee2438d9668e +SHA512 (radare2-5.9.2.tar.gz) = e190ec124c6d48e512939782148b23fb0ef50aeb66763c198fdf7a6329d6882bb49a10641902313045b6802fca233c56fbc0142155b52f915dab4099481923c9 From 22caa02c41a9ebeab9f01b5eecc93ef09b71928d Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 30 May 2024 00:42:18 +0200 Subject: [PATCH 37/51] cosmetics --- radare2.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/radare2.spec b/radare2.spec index 0513f39..2be95c6 100644 --- a/radare2.spec +++ b/radare2.spec @@ -20,8 +20,7 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 - -%global gitdate 20240331 +%global gitdate 20240520 %global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d %global shortcommit %(c=%{commit}; echo ${c:0:7}) From c8e2d753e3c801dc1b02495a006bea8af0b3147c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 18:10:04 +0000 Subject: [PATCH 38/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- radare2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/radare2.spec b/radare2.spec index 2be95c6..252753c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework Version: 5.9.2 -%global baserelease 1 +%global baserelease 2 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -376,6 +376,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Wed May 22 2024 Michal Ambroz - 5.9.2-1 - bump to 5.9.2 From 1c0b5ff277a44c88ad625869c35dd243dce9c8f0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 13:09:59 +0200 Subject: [PATCH 39/51] bump to 5.9.4 --- radare2.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/radare2.spec b/radare2.spec index 252753c..3958f2c 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,7 +1,7 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.2 -%global baserelease 2 +Version: 5.9.4 +%global baserelease 1 URL: https://radare.org/ VCS: https://github.com/radareorg/radare2 # https://github.com/radareorg/radare2/releases @@ -20,8 +20,8 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20240520 -%global commit aea5c93a8f5a6ed360ea21d6a4e36f00accb8b7d +%global gitdate 20240808 +%global commit b77e3f8ed651b6866175062213158e2b33d2c1e7 %global shortcommit %(c=%{commit}; echo ${c:0:7}) @@ -376,6 +376,9 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog +* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 +- bump to 5.9.4 + * Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 44514a55eecb0dd23752484ddfd1c64621016641 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 13:17:58 +0200 Subject: [PATCH 40/51] bump to 5.9.4 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 33cd418..65379f9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.2.tar.gz) = e190ec124c6d48e512939782148b23fb0ef50aeb66763c198fdf7a6329d6882bb49a10641902313045b6802fca233c56fbc0142155b52f915dab4099481923c9 +SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b From 44a7813ff1dee2038d24634f4e7365859f13254c Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 12 Aug 2024 22:50:23 +0200 Subject: [PATCH 41/51] bump to 5.9.4 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 65379f9..1af8588 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.8.8.tar.gz) = 38f3373cc3029a7d92e1ae44ab515f0bea4c897cb981a904b40a7e05c04c29786dc8ac2f46fc97b495c4a2ec4905e0e196633dd3144c557c550239c462c9360b +SHA512 (radare2-5.9.4.tar.gz) = 51d42b6d98027d3f3d85570e79ea18a8f220c145e3451fd10d82eea1a0542648f83447bb6cb6f5bbf76241677a2412bf064ffbade75e69b486c6148543aa4b0f From fea7fd87c73602fd3555122c02f9f88032639c05 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 16 Oct 2024 13:48:45 +0200 Subject: [PATCH 42/51] adding changelog --- changelog | 293 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 293 insertions(+) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..e5553cc --- /dev/null +++ b/changelog @@ -0,0 +1,293 @@ +* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 +- bump to 5.9.4 + +* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed May 22 2024 Michal Ambroz - 5.9.2-1 +- bump to 5.9.2 + +* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 +- bump to 5.9.0 + +* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 +- rebuild F40+ with capstone 5.0.1+ + +* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 +- cherrypick from upstream master patches for known vulnerabilities: +- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler +- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c + +* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 +- bump to 5.8.8 + +* Tue May 23 2023 Michal Ambroz 5.8.6-1 +- bump to 5.8.6 + +* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 +- 5.8.5 rebuild from git, patched for segfault + +* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 +- patch for segfault in sdb_hash + +* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 +- bump to 5.8.4 +- fix CVE-2023-27114 + +* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 +- cherrypick upstream patch for fixing the sdb generation from meson + +* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 +- bump to 5.8.2 +- fix CVE-2023-0302 , CVE-2023-0302 + +* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 +- bump to 5.7.8 + +* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 +- bump to 5.7.6 +- cherrypicked patch for new libmagic from upstream +- fix CVE-2022-34502 + +* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 +- bump to 5.6.8 + +* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 +- refresh list of bundled libraries and associated cleanup + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 +- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 + CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 + CVE-2022-1297 + +* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 +- bump to 5.6.6 + +* Mon Feb 28 2022 Michal Ambroz 5.6.4-1 +- bump to 5.6.4 + +* Wed Feb 09 2022 Michal Ambroz 5.6.2-1 +- bump to 5.6.2 +- disable multithreading for now to be able to compile with iaito + +* Wed Feb 09 2022 Michal Ambroz 5.6.0-2 +- patch declaration of int i in for cycle to avoid C99 mode on EPEL7 + +* Wed Feb 09 2022 Michal Ambroz 5.6.0-1 +- bump to 5.6.0 +- fix CVE-2022-0419 +- fix CVE-2021-4021 + +* Wed Jan 26 2022 Henrik Nordstrom - 5.5.4-1 +- Update to version 5.5.4 +- should be fixing CVE-2021-4021 + +* Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 +- Update to version 5.4.2 + +* Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 +- Update to version 5.4.0 +- Fix CVE-2021-3673 + +* Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jun 11 2021 Michal Ambroz 5.3.1-1 +- bump to 5.3.1 + +* Wed Jun 09 2021 Michal Ambroz 5.3.0-1 +- re-enable build for s390x on EPEL8 (libuv should be available for 8.4) +- bump to 5.3.0 +- remove radare2-5.2.1-meson_rhel8.patch - accepted upstream +- remove radare2-5.2.1-xxhash.patch - accepted upstream +- fix CVE-2021-32494 #2221281, #2221280, #2221282 +- fix CVE-2021-32495 #2221285, #2221286 + +* Sat May 15 2021 Michal Ambroz 5.2.1-3 +- adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 + +* Tue May 11 2021 Michal Ambroz 5.2.1-2 +- patch for older version of meson used on EPEL8 +- use pkgconfig where possible for BR +- use ldconfig_scriptlets only on older platforms +- add ExcludeArch for s390x on EPEL8 + +* Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 +- Update to version 5.2.1 + +* Wed Apr 21 2021 Michal Ambroz 5.2.0-3 +- avoid c99 for(int i... + +* Sat Apr 17 2021 Michal Ambroz 5.2.0-2 +- fix epel build + +* Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 +- Update to version 5.2.0 + +* Sun Feb 28 2021 Michal Ambroz 5.1.1-2 +- stop removing the r2pm binary from the package + +* Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 +- Rebase to upstream version 5.1.1 + +* Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 +- Rebuilt to make sure version is no lower than F32 + +* Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 +- Rebase to upstream version 4.5.0 + +* Fri May 8 2020 Riccardo Schirone - 4.4.0-2 +- Just re-build + +* Mon May 4 2020 Riccardo Schirone - 4.4.0-1 +- Rebase to upstream version 4.4.0 + +* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 +- Rebase to upstream version 4.2.1 +- Fix CVE-2019-19647 +- Fix CVE-2019-19590 + +* Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 +- Fix epel7 build + +* Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 +- Add missing BuildRequires: xxhash-devel, openssl-devel +- Add missing Requires for -devel package: file-devel, openssl-devel + +* Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 +- rebase to upstream version 3.9.0 + +* Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Wed Jun 26 2019 Riccardo Schirone - 3.6.0 +- rebase to upstream version 3.6.0 +* Tue Apr 16 2019 Adam Williamson - 3.4.1-2 +- Rebuild with Meson fix for #1699099 +- Fix versioning + +* Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 +- rebase to upstream version 3.4.1 +* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 +- rebase to upstream version 3.3.0 +* Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 +- fix version reported by radare2 -V +* Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 +- rebase to upstream version 3.2.0 +- remove patch to disable debugger on s390x and use build option +- move doc files to common package +- fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 +* Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 +- rebase to upstream version 3.1.0 +- remove duplicated /usr/share/radare2 dir in %%files +* Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 +- rebase to upstream version 3.0.1 which includes some minor fixes and fixes + for ppc64 and s390x architectures +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 +- fix datadir dir ownership +* Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 +- rebase to upstream version 3.0.0 +- fixes for r_sys_breakpoint on ppc64 and s390x architectures +* Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 +- use system xxhash and openssl +- bump to 2.9.0 release +- use bcond_without to choose between release build or git one +- add gcc as BuildRequires +- do not directly call ldconfig but use RPM macros +- add patch to compile on s390x architecture (disable debugger because there is no support) +- add patch to make tags.r2 file generation reproducible +- make common subpackage do not depend on arch of main package + +* Fri Aug 3 2018 Riccardo Schirone 2.8.0-0.2.20180718git51e2936 +- add grub2 and xxhash Provides +- add some license comments +- move SDB files in -common subpackage + +* Mon Jul 16 2018 Riccardo Schirone 2.8.0-0.1.20180718git51e2936 +- bump to 2.8.0 version and switch to meson + +* Fri Apr 13 2018 Michal Ambroz 2.5.0-1 +- bump to 2.5.0 release + +* Sun Feb 11 2018 Michal Ambroz 2.4.0-1 +- bump to 2.4.0 release + +* Mon Feb 05 2018 Michal Ambroz 2.3.0-1 +- bump to 2.3.0 release +- drop the web-interface for now + +* Tue Nov 14 2017 Michal Ambroz 2.0.1-1 +- bump to 2.0.1 release + +* Fri Aug 04 2017 Michal Ambroz 1.6.0-1 +- bump to 1.6.0 release + +* Thu Jun 08 2017 Michal Ambroz 1.5.0-1 +- bump to 1.5.0 release + +* Sun Apr 23 2017 Michal Ambroz 1.4.0-1 +- bump to 1.4.0 release + +* Sat Mar 18 2017 Michal Ambroz 1.3.0-1 +- bump to 1.3.0 release + +* Sat Feb 18 2017 Michal Ambroz 1.3.0-0.1.gita37af19 +- switch to git version fixing sigseg in radiff2 + +* Wed Feb 08 2017 Michal Ambroz 1.2.1-1 +- bump to 1.2.1 +- removed deprecated post postun calling of /sbin/ldconfig + +* Sat Oct 22 2016 Michal Ambroz 0.10.6-1 +- bump to 0.10.6 + +* Sun Aug 21 2016 Michal Ambroz 0.10.5-1 +- bump to 0.10.5 + +* Mon Aug 01 2016 Michal Ambroz 0.10.4-1 +- bump to 0.10.4 + +* Sun Jun 05 2016 Michal Ambroz 0.10.3-1 +- build for Fedora for release of 0.10.3 + +* Mon Apr 25 2016 Michal Ambroz 0.10.2-1 +- build for Fedora for release of 0.10.2 + +* Thu Jan 21 2016 Michal Ambroz 0.10.0-2 +- build for Fedora for release of 0.10.0 + +* Sat Oct 10 2015 Michal Ambroz 0.10.0-1 +- build for Fedora for alpha of 0.10.0 + +* Sun Nov 09 2014 Pavel Odvody 0.9.8rc3-0 +- initial radare2 package From f27b2bc9a9ba4d37e6cfa542f791f361037a4f48 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 16 Oct 2024 13:58:43 +0200 Subject: [PATCH 43/51] bump to 5.9.6 --- radare2.spec | 313 ++------------------------------------------------- sources | 2 +- 2 files changed, 12 insertions(+), 303 deletions(-) diff --git a/radare2.spec b/radare2.spec index 3958f2c..b7dfb4a 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,11 +1,12 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.4 -%global baserelease 1 +Version: 5.9.6 URL: https://radare.org/ -VCS: https://github.com/radareorg/radare2 +%global vcsurl https://github.com/radareorg/radare2 +VCS: git:%{vcsurl} # https://github.com/radareorg/radare2/releases + # %%if 0%%{?rhel} && 0%%{?rhel} == 8 # Radare2 fails to build on EPEL8+s390x # https://bugzilla.redhat.com/show_bug.cgi?id=1960046 @@ -20,17 +21,17 @@ VCS: https://github.com/radareorg/radare2 %global gituser radareorg %global gitname radare2 -%global gitdate 20240808 -%global commit b77e3f8ed651b6866175062213158e2b33d2c1e7 +%global gitdate 20241013 +%global commit 2d36454e9914a5e0c03906b3e8d1e9fe4a2df6b7 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %if %{with releasetag} -Release: %{baserelease}%{?dist} -Source0: %{vcs}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Release: %autorelease +Source0: %{vcsurl}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz %else -Release: 0.%{baserelease}.%{gitdate}git%{shortcommit}%{?dist} -Source0: %{vcs}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +Release: %autorelease -s %{gitdate}git%{shortcommit} +Source0: %{vcsurl}/archive/%{commit}/%{name}-%{commit}.tar.gz#/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif # Specific to Fedora - build with system libraries @@ -376,296 +377,4 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -* Mon Aug 12 2024 Michal Ambroz - 5.9.4-1 -- bump to 5.9.4 - -* Fri Jul 19 2024 Fedora Release Engineering - 5.9.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed May 22 2024 Michal Ambroz - 5.9.2-1 -- bump to 5.9.2 - -* Sat Apr 20 2024 Michal Ambroz 5.9.0-1 -- bump to 5.9.0 - -* Fri Jan 26 2024 Fedora Release Engineering - 5.8.8-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering - 5.8.8-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Oct 26 2023 Michal Ambroz 5.8.8-3 -- rebuild F40+ with capstone 5.0.1+ - -* Thu Oct 26 2023 Michal Ambroz 5.8.8-2 -- cherrypick from upstream master patches for known vulnerabilities: -- CVE-2023-4322 - heap-buffer-overflow in the brainfuck dissassembler -- CVE-2023-5686 - heap-buffer-overflow in /radare2/shlr/java/code.c - -* Fri Jul 21 2023 Fedora Release Engineering - 5.8.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jul 05 2023 Michal Ambroz 5.8.8-1 -- bump to 5.8.8 - -* Tue May 23 2023 Michal Ambroz 5.8.6-1 -- bump to 5.8.6 - -* Sat Mar 25 2023 Michal Ambroz 5.8.5-0.3 -- 5.8.5 rebuild from git, patched for segfault - -* Wed Mar 22 2023 Michal Ambroz 5.8.4-2 -- patch for segfault in sdb_hash - -* Thu Mar 16 2023 Michal Ambroz 5.8.4-1 -- bump to 5.8.4 -- fix CVE-2023-27114 - -* Sun Feb 26 2023 Michal Ambroz 5.8.2-2 -- cherrypick upstream patch for fixing the sdb generation from meson - -* Wed Jan 25 2023 Michal Ambroz 5.8.2-1 -- bump to 5.8.2 -- fix CVE-2023-0302 , CVE-2023-0302 - -* Fri Jan 20 2023 Fedora Release Engineering - 5.7.8-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Tue Aug 02 2022 Michal Ambroz 5.7.8-1 -- bump to 5.7.8 - -* Tue Aug 02 2022 Michal Ambroz 5.7.6-1 -- bump to 5.7.6 -- cherrypicked patch for new libmagic from upstream -- fix CVE-2022-34502 - -* Sat Jul 23 2022 Fedora Release Engineering - 5.6.8-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Apr 21 2022 Henrik Nordstrom - 5.6.8-1 -- bump to 5.6.8 - -* Wed Apr 13 2022 Henrik Nordstrom 5.6.6-2 -- refresh list of bundled libraries and associated cleanup - -* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-2 -- Fixes for CVE-2022-1061 CVE-2022-1207 CVE-2022-1237 CVE-2022-1238 - CVE-2022-1240 CVE-2022-1244 CVE-2022-1283 CVE-2022-1284 CVE-2022-1296 - CVE-2022-1297 - -* Tue Apr 12 2022 Henrik Nordstrom 5.6.6-1 -- bump to 5.6.6 - -* Mon Feb 28 2022 Michal Ambroz 5.6.4-1 -- bump to 5.6.4 - -* Wed Feb 09 2022 Michal Ambroz 5.6.2-1 -- bump to 5.6.2 -- disable multithreading for now to be able to compile with iaito - -* Wed Feb 09 2022 Michal Ambroz 5.6.0-2 -- patch declaration of int i in for cycle to avoid C99 mode on EPEL7 - -* Wed Feb 09 2022 Michal Ambroz 5.6.0-1 -- bump to 5.6.0 -- fix CVE-2022-0419 -- fix CVE-2021-4021 - -* Wed Jan 26 2022 Henrik Nordstrom - 5.5.4-1 -- Update to version 5.5.4 -- should be fixing CVE-2021-4021 - -* Fri Jan 21 2022 Fedora Release Engineering - 5.4.2-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Thu Sep 23 2021 Henrik Nordstrom - 5.4.2-1 -- Update to version 5.4.2 - -* Sat Sep 18 2021 Henrik Nordstrom - 5.4.0-1 -- Update to version 5.4.0 -- Fix CVE-2021-3673 - -* Fri Jul 23 2021 Fedora Release Engineering - 5.3.1-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Fri Jun 11 2021 Michal Ambroz 5.3.1-1 -- bump to 5.3.1 - -* Wed Jun 09 2021 Michal Ambroz 5.3.0-1 -- re-enable build for s390x on EPEL8 (libuv should be available for 8.4) -- bump to 5.3.0 -- remove radare2-5.2.1-meson_rhel8.patch - accepted upstream -- remove radare2-5.2.1-xxhash.patch - accepted upstream -- fix CVE-2021-32494 #2221281, #2221280, #2221282 -- fix CVE-2021-32495 #2221285, #2221286 - -* Sat May 15 2021 Michal Ambroz 5.2.1-3 -- adding the global plugins directory - for example /usr/lib64/radare2/5.2.1 - -* Tue May 11 2021 Michal Ambroz 5.2.1-2 -- patch for older version of meson used on EPEL8 -- use pkgconfig where possible for BR -- use ldconfig_scriptlets only on older platforms -- add ExcludeArch for s390x on EPEL8 - -* Thu Apr 22 2021 Henrik Nordstrom - 5.2.1-1 -- Update to version 5.2.1 - -* Wed Apr 21 2021 Michal Ambroz 5.2.0-3 -- avoid c99 for(int i... - -* Sat Apr 17 2021 Michal Ambroz 5.2.0-2 -- fix epel build - -* Wed Apr 14 2021 Henrik Nordstrom - 5.2.0-1 -- Update to version 5.2.0 - -* Sun Feb 28 2021 Michal Ambroz 5.1.1-2 -- stop removing the r2pm binary from the package - -* Mon Feb 15 2021 Henrik Nordstrom - 5.1.1-1 -- Rebase to upstream version 5.1.1 - -* Wed Jan 27 2021 Fedora Release Engineering - 4.5.0-2.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Fri Oct 2 2020 Riccardo Schirone - 4.5.0-2.1 -- Rebuilt to make sure version is no lower than F32 - -* Wed Jul 29 2020 Fedora Release Engineering - 4.5.0-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon Jul 20 2020 Riccardo Schirone - 4.5.0-1 -- Rebase to upstream version 4.5.0 - -* Fri May 8 2020 Riccardo Schirone - 4.4.0-2 -- Just re-build - -* Mon May 4 2020 Riccardo Schirone - 4.4.0-1 -- Rebase to upstream version 4.4.0 - -* Mon Feb 3 2020 Riccardo Schirone - 4.2.1-1 -- Rebase to upstream version 4.2.1 -- Fix CVE-2019-19647 -- Fix CVE-2019-19590 - -* Thu Jan 30 2020 Fedora Release Engineering - 3.9.0-3.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Mon Oct 07 2019 Riccardo Schirone - 3.9.0-3.1 -- Fix epel7 build - -* Fri Oct 04 2019 Ivan Mironov - 3.9.0-2.1 -- Add missing BuildRequires: xxhash-devel, openssl-devel -- Add missing Requires for -devel package: file-devel, openssl-devel - -* Mon Sep 30 2019 Riccardo Schirone - 3.9.0-1.1 -- rebase to upstream version 3.9.0 - -* Fri Jul 26 2019 Fedora Release Engineering - 3.6.0-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Wed Jun 26 2019 Riccardo Schirone - 3.6.0 -- rebase to upstream version 3.6.0 -* Tue Apr 16 2019 Adam Williamson - 3.4.1-2 -- Rebuild with Meson fix for #1699099 -- Fix versioning - -* Mon Apr 8 2019 Riccardo Schirone - 3.4.1-1 -- rebase to upstream version 3.4.1 -* Tue Feb 19 2019 Riccardo Schirone - 3.3.0-2 -- rebase to upstream version 3.3.0 -* Sat Feb 02 2019 Fedora Release Engineering - 3.2.0-2.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Jan 10 2019 Riccardo Schirone 3.2.0-2 -- fix version reported by radare2 -V -* Tue Jan 8 2019 Riccardo Schirone 3.2.0-1 -- rebase to upstream version 3.2.0 -- remove patch to disable debugger on s390x and use build option -- move doc files to common package -- fix CVE-2018-20455 CVE-2018-20456 CVE-2018-20457 CVE-2018-20458 CVE-2018-20459 CVE-2018-20460 CVE-2018-20461 -* Fri Nov 23 2018 Riccardo Schirone 3.1.0-1 -- rebase to upstream version 3.1.0 -- remove duplicated /usr/share/radare2 dir in %%files -* Tue Oct 23 2018 Riccardo Schirone 3.0.1-1 -- rebase to upstream version 3.0.1 which includes some minor fixes and fixes - for ppc64 and s390x architectures -* Tue Oct 16 2018 Riccardo Schirone 3.0.0-2 -- fix datadir dir ownership -* Tue Oct 16 2018 Riccardo Schirone 3.0.0-1 -- rebase to upstream version 3.0.0 -- fixes for r_sys_breakpoint on ppc64 and s390x architectures -* Tue Sep 4 2018 Riccardo Schirone 2.9.0-1 -- use system xxhash and openssl -- bump to 2.9.0 release -- use bcond_without to choose between release build or git one -- add gcc as BuildRequires -- do not directly call ldconfig but use RPM macros -- add patch to compile on s390x architecture (disable debugger because there is no support) -- add patch to make tags.r2 file generation reproducible -- make common subpackage do not depend on arch of main package - -* Fri Aug 3 2018 Riccardo Schirone 2.8.0-0.2.20180718git51e2936 -- add grub2 and xxhash Provides -- add some license comments -- move SDB files in -common subpackage - -* Mon Jul 16 2018 Riccardo Schirone 2.8.0-0.1.20180718git51e2936 -- bump to 2.8.0 version and switch to meson - -* Fri Apr 13 2018 Michal Ambroz 2.5.0-1 -- bump to 2.5.0 release - -* Sun Feb 11 2018 Michal Ambroz 2.4.0-1 -- bump to 2.4.0 release - -* Mon Feb 05 2018 Michal Ambroz 2.3.0-1 -- bump to 2.3.0 release -- drop the web-interface for now - -* Tue Nov 14 2017 Michal Ambroz 2.0.1-1 -- bump to 2.0.1 release - -* Fri Aug 04 2017 Michal Ambroz 1.6.0-1 -- bump to 1.6.0 release - -* Thu Jun 08 2017 Michal Ambroz 1.5.0-1 -- bump to 1.5.0 release - -* Sun Apr 23 2017 Michal Ambroz 1.4.0-1 -- bump to 1.4.0 release - -* Sat Mar 18 2017 Michal Ambroz 1.3.0-1 -- bump to 1.3.0 release - -* Sat Feb 18 2017 Michal Ambroz 1.3.0-0.1.gita37af19 -- switch to git version fixing sigseg in radiff2 - -* Wed Feb 08 2017 Michal Ambroz 1.2.1-1 -- bump to 1.2.1 -- removed deprecated post postun calling of /sbin/ldconfig - -* Sat Oct 22 2016 Michal Ambroz 0.10.6-1 -- bump to 0.10.6 - -* Sun Aug 21 2016 Michal Ambroz 0.10.5-1 -- bump to 0.10.5 - -* Mon Aug 01 2016 Michal Ambroz 0.10.4-1 -- bump to 0.10.4 - -* Sun Jun 05 2016 Michal Ambroz 0.10.3-1 -- build for Fedora for release of 0.10.3 - -* Mon Apr 25 2016 Michal Ambroz 0.10.2-1 -- build for Fedora for release of 0.10.2 - -* Thu Jan 21 2016 Michal Ambroz 0.10.0-2 -- build for Fedora for release of 0.10.0 - -* Sat Oct 10 2015 Michal Ambroz 0.10.0-1 -- build for Fedora for alpha of 0.10.0 - -* Sun Nov 09 2014 Pavel Odvody 0.9.8rc3-0 -- initial radare2 package +%autochangelog diff --git a/sources b/sources index 1af8588..66c7fbf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.4.tar.gz) = 51d42b6d98027d3f3d85570e79ea18a8f220c145e3451fd10d82eea1a0542648f83447bb6cb6f5bbf76241677a2412bf064ffbade75e69b486c6148543aa4b0f +SHA512 (radare2-5.9.6.tar.gz) = ae7211b560b0949f55d385846df3f477c46596e42d2076ab6cc6314adf77ec595f6f98800fb5d8999b82ec1150b9924e301976a18218858dd5f9399278ac9a59 From dbf4c8dabd9c03a524bb318ea93a4e3e2a129c75 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 22 Nov 2024 16:15:59 +0100 Subject: [PATCH 44/51] bump to 5.9.8 --- radare2-5.9.8-dec99.patch | 21 +++++++++++++++++++++ radare2.spec | 21 ++++++++++++++++----- sources | 2 +- 3 files changed, 38 insertions(+), 6 deletions(-) create mode 100644 radare2-5.9.8-dec99.patch diff --git a/radare2-5.9.8-dec99.patch b/radare2-5.9.8-dec99.patch new file mode 100644 index 0000000..53a9fa1 --- /dev/null +++ b/radare2-5.9.8-dec99.patch @@ -0,0 +1,21 @@ +diff -ru radare2-5.9.8.orig/shlr/qjs/src/quickjs.c radare2-5.9.8.new/shlr/qjs/src/quickjs.c +--- radare2-5.9.8.orig/shlr/qjs/src/quickjs.c 2024-11-19 12:38:30.000000000 +0100 ++++ radare2-5.9.8.new/shlr/qjs/src/quickjs.c 2024-11-22 14:34:10.546707808 +0100 +@@ -11311,6 +11311,8 @@ + char dest[minimum_length(JS_ECVT_BUF_SIZE)], + size_t size, int *decpt) + { ++ int i; ++ + if (n_digits == 0) { + /* find the minimum number of digits (XXX: inefficient but simple) */ + // TODO(chqrlie) use direct method from quickjs-printf +@@ -11360,7 +11362,7 @@ + return n_digits; /* truncate the 2 extra digits */ + } + /* round up in the string */ +- for(int i = n_digits;; i--) { ++ for(i = n_digits;; i--) { + /* ignore the locale specific decimal point */ + if (is_digit(dest[i])) { + if (dest[i]++ < '9') diff --git a/radare2.spec b/radare2.spec index b7dfb4a..fb30942 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.6 +Version: 5.9.8 URL: https://radare.org/ %global vcsurl https://github.com/radareorg/radare2 VCS: git:%{vcsurl} @@ -21,10 +21,15 @@ VCS: git:%{vcsurl} %global gituser radareorg %global gitname radare2 -%global gitdate 20241013 -%global commit 2d36454e9914a5e0c03906b3e8d1e9fe4a2df6b7 +%global gitdate 20241119 +%global commit 4eb49d5ad8c99eaecc8850a2f10bad407067c898 %global shortcommit %(c=%{commit}; echo ${c:0:7}) +# autorelease not available on epel7 +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1 +%endif + %if %{with releasetag} Release: %autorelease @@ -51,8 +56,10 @@ Patch3: radare2-5.9.0-use_magic.patch # https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de # Patch6: radare2-5.8.8-CVE-2023-5686.patch - - +# Build reports need for C99 compatibility mode for the index type declaration in the for cycle. +# As rest of the radare2 is strictly defining all index variables prior to for cycle, it is recommended +# to change this one as well +Patch7: radare2-5.9.8-dec99.patch License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib @@ -371,10 +378,14 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %{_datadir}/%{name}/%{version}/syscall %{_datadir}/%{name}/%{version}/charsets %{_datadir}/%{name}/%{version}/platform +%{_datadir}/%{name}/%{version}/scripts + %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog +%endif diff --git a/sources b/sources index 66c7fbf..1fba33c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.6.tar.gz) = ae7211b560b0949f55d385846df3f477c46596e42d2076ab6cc6314adf77ec595f6f98800fb5d8999b82ec1150b9924e301976a18218858dd5f9399278ac9a59 +SHA512 (radare2-5.9.8.tar.gz) = d1338bcbd437c7f376a07a9d6870fa56bdab883cc5371ce506bc7f667780e19ce777c2839926d4bedf0578ec9338567b402a678643f36ac84404be55eeadb2da From 3c6f7341d4f49ef6c1f8c5ff88ac7aad04586506 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 25 Nov 2024 10:11:23 +0100 Subject: [PATCH 45/51] documentation of embedded quickjs-ng library --- radare2.spec | 47 +++++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/radare2.spec b/radare2.spec index fb30942..44d2370 100644 --- a/radare2.spec +++ b/radare2.spec @@ -66,25 +66,26 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ # some code has originally different license: -# libr/asm/arch/ - GPLv2+, MIT, GPLv3 +# libr/asm/arch/ - GPLv2+, MIT, GPLv3 # libr/bin/format/pe/dotnet - Apache License Version 2.0 -# libr/hash/xxhash.c - 2 clause BSD -# libr/util/qrcode.c - MIT -# shlr/grub/grubfs.c - LGPL -# shlr/java - Apache 2.0 -# shlr/sdb/src - MIT -# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) -# shlr/squashfs/src - GPLv2+ -# libr/parse/c - LGPLv2+ -# shlr/udis86 - 2 clause BSD -# shlr/winkd - LGPL v3+ -# shlr/spp - MIT -# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) -# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) -# shlr/ptrace-wrap - LGPL v3+ -# shlr/tree-sitter - MIT -# shlr/mpc - 2 clause BSD -# shlr/yxml - MIT +# libr/hash/xxhash.c - 2 clause BSD +# libr/util/qrcode.c - MIT +# shlr/grub/grubfs.c - LGPL +# shlr/java - Apache 2.0 +# shlr/sdb/src - MIT +# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) +# shlr/squashfs/src - GPLv2+ +# libr/parse/c - LGPLv2+ +# shlr/udis86 - 2 clause BSD +# shlr/winkd - LGPL v3+ +# shlr/spp - MIT +# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) +# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) +# shlr/ptrace-wrap - LGPL v3+ +# shlr/tree-sitter - MIT +# shlr/mpc - 2 clause BSD +# shlr/yxml - MIT +# shlr/qjs - MIT # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -217,6 +218,16 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 + +# ./shlr/qjs +# https://github.com/quickjs-ng/quickjs +# License: MIT +Provides: bundled(quickjs-ng) = 0.7.0 + + + + + # and likely some more in libr/... borrowed from other projects %description From 7420e619a1c04af35eadab597c3ed1018eaedaff Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 00:48:59 +0100 Subject: [PATCH 46/51] [skip changelog] fix the build for rhel8 on rhel8 the env mangling works wrong for "env -S" --- radare2.spec | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/radare2.spec b/radare2.spec index 44d2370..990e5c3 100644 --- a/radare2.spec +++ b/radare2.spec @@ -89,16 +89,16 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui -# shlr/www/m - Apache-2.0 -# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT +# shlr/www/m - Apache-2.0 +# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT # shlr/www/enyo/vendors/jquery.layout-latest.min.js - GPL + MIT -# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT -# shlr/www/enyo/vendors/lodash.min.js - lodash license -# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 -# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 -# shlr/www/p/vendors/jquery* - GPL + MIT -# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD -# shlr/www/p/vendors/jquery.onoff.min.js - MIT +# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT +# shlr/www/enyo/vendors/lodash.min.js - lodash license +# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 +# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 +# shlr/www/p/vendors/jquery* - GPL + MIT +# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD +# shlr/www/p/vendors/jquery.onoff.min.js - MIT BuildRequires: sed BuildRequires: gcc @@ -218,16 +218,11 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 - # ./shlr/qjs # https://github.com/quickjs-ng/quickjs # License: MIT Provides: bundled(quickjs-ng) = 0.7.0 - - - - # and likely some more in libr/... borrowed from other projects %description @@ -302,6 +297,8 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build %endif +# On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" +sed -i -e "s|/usr/bin/env -S r2|/usr/bin/r2|" ./scripts/licenses.r2.js %build # Whereever possible use the system-wide libraries instead of bundles From e31daf3a1bbc0dde9a332da177fa4575d5dc75d6 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 02:44:42 +0100 Subject: [PATCH 47/51] fix epel build --- radare2.spec | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/radare2.spec b/radare2.spec index 990e5c3..1b09d52 100644 --- a/radare2.spec +++ b/radare2.spec @@ -26,8 +26,8 @@ VCS: git:%{vcsurl} %global shortcommit %(c=%{commit}; echo ${c:0:7}) # autorelease not available on epel7 -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) -%global autorelease 1 +%if ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1%{?dist} %endif @@ -290,11 +290,9 @@ echo "The radare2 source usually comes with a pre-built version of the web-inter echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora -%if 0%{?rhel} && 0%{?rhel} == 8 -# Meson on EPEL8 is older than meson on EPEL7 and older than recommended one -# on EPEL8 downgrade the recommendation in meson.build and pray -# meson_version : '>=0.50.1' => meson_version : '>=0.49.1' -sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build +%if 0%{?rhel} && 0%{?rhel} <= 8 +# Meson on EPEL8 / EPEL7 is older than recommended one +sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.47.2'|;" meson.build %endif # On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" From 36838d331cd5ca08dcce21069de90221e04a9057 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 21:58:29 +0000 Subject: [PATCH 48/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c79e6c5c16938c539212c6b8b431fc3bba94af16 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 8 Mar 2025 00:38:41 +0100 Subject: [PATCH 49/51] fix CVE-2025-1744 and CVE-2025-1864 --- radare2-5.9.8-magic-cve.patch | 47 +++++++++++++++++++++++++++++++++++ radare2-5.9.8-zlib-cve.patch | 30 ++++++++++++++++++++++ radare2.spec | 11 ++++++-- 3 files changed, 86 insertions(+), 2 deletions(-) create mode 100644 radare2-5.9.8-magic-cve.patch create mode 100644 radare2-5.9.8-zlib-cve.patch diff --git a/radare2-5.9.8-magic-cve.patch b/radare2-5.9.8-magic-cve.patch new file mode 100644 index 0000000..9e76c3b --- /dev/null +++ b/radare2-5.9.8-magic-cve.patch @@ -0,0 +1,47 @@ +From 9c92960f8606be2decf88cdcec7a7ab53ff13b4b Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Wed, 19 Feb 2025 23:42:14 +0800 +Subject: [PATCH 1/2] PR/454: Fix memory corruption when the continuation level + jumps by more than 20 in a single step. + +--- + libr/magic/funcs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 7356dc0c93f77..14687bf7be8f0 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,7 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len += 20) * sizeof (*ms->c.li); ++ size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { + +From 030e74cd136044e28828ab52615ce929693bae7a Mon Sep 17 00:00:00 2001 +From: pancake +Date: Wed, 19 Feb 2025 17:32:21 +0100 +Subject: [PATCH 2/2] Update libr/magic/funcs.c + +--- + libr/magic/funcs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 14687bf7be8f0..52e3819f0e04e 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,8 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); ++ ms->c.len = level + 20; ++ size_t len = ms->c.len * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { diff --git a/radare2-5.9.8-zlib-cve.patch b/radare2-5.9.8-zlib-cve.patch new file mode 100644 index 0000000..02ada03 --- /dev/null +++ b/radare2-5.9.8-zlib-cve.patch @@ -0,0 +1,30 @@ +From b49d2f0b84d424ec7fbf47138bf6acc6b18e1b0d Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Tue, 18 Feb 2025 11:28:15 +0800 +Subject: [PATCH] Fix a bug when getting a gzip header extra field with + inflate(). If the extra field was larger than the space the user provided + with inflateGetHeader(), and if multiple calls of inflate() delivered the + extra header data, then there could be a buffer overflow of the provided + space. This commit assures that provided space is not exceeded. + +--- + shlr/zip/zlib/inflate.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/shlr/zip/zlib/inflate.c b/shlr/zip/zlib/inflate.c +index e9ed74cff3279..2ecfb4876d155 100644 +--- a/shlr/zip/zlib/inflate.c ++++ b/shlr/zip/zlib/inflate.c +@@ -755,9 +755,10 @@ int ZEXPORT inflate(z_streamp strm, int flush) + copy = state->length; + if (copy > have) copy = have; + if (copy) { ++ len = state->head->extra_len - state->length; + if (state->head != Z_NULL && +- state->head->extra != Z_NULL) { +- len = state->head->extra_len - state->length; ++ state->head->extra != Z_NULL && ++ len < state->head->extra_max) { + zmemcpy(state->head->extra + len, next, + len + copy > state->head->extra_max ? + state->head->extra_max - len : copy); diff --git a/radare2.spec b/radare2.spec index 1b09d52..3ed3487 100644 --- a/radare2.spec +++ b/radare2.spec @@ -61,6 +61,15 @@ Patch3: radare2-5.9.0-use_magic.patch # to change this one as well Patch7: radare2-5.9.8-dec99.patch +# CVE-2025-1744 - Potential Vulnerability in zlib Library +# https://github.com/radareorg/radare2/pull/23969 +Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2-5.9.8-zlib-cve.patch + +# CVE-2025-1864 - Potential Vulnerability in magic Library +# https://github.com/radareorg/radare2/pull/23981 +Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch + + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -392,6 +401,4 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog -%endif From 756d6a5693c005c23746ebe9e82082c96e9521e0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 11 Mar 2025 18:24:30 +0100 Subject: [PATCH 50/51] fix CVE-2024-56737 --- radare2-5.9.8-hfs-cve.patch | 36 ++++++++++++++++++++++++++++++++++++ radare2.spec | 5 +++++ 2 files changed, 41 insertions(+) create mode 100644 radare2-5.9.8-hfs-cve.patch diff --git a/radare2-5.9.8-hfs-cve.patch b/radare2-5.9.8-hfs-cve.patch new file mode 100644 index 0000000..c4e58bf --- /dev/null +++ b/radare2-5.9.8-hfs-cve.patch @@ -0,0 +1,36 @@ +From 984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4 Mon Sep 17 00:00:00 2001 +From: pancake +Date: Thu, 2 Jan 2025 13:03:34 +0100 +Subject: [PATCH] CVE-2024-56737 - Fix buffer overflow in the HFS parser from + grub2 ##crash + +--- + shlr/grub/fs/hfs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/shlr/grub/fs/hfs.c b/shlr/grub/fs/hfs.c +index 33060d5d5fe25..98f717c4c47b4 100644 +--- a/shlr/grub/fs/hfs.c ++++ b/shlr/grub/fs/hfs.c +@@ -375,7 +375,9 @@ grub_hfs_mount (grub_disk_t disk) + volume name. */ + key.parent_dir = grub_cpu_to_be32 (1); + key.strlen = data->sblock.volname[0]; +- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ ///grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ strncpy (key.str, (char *) (data->sblock.volname + 1), sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + int depth = 0; + if (grub_hfs_find_node (data, (char *) &key, data->cat_root, +@@ -965,7 +967,9 @@ grub_hfs_find_dir (struct grub_hfs_data *data, const char *path, + + key.parent_dir = grub_cpu_to_be32 (inode); + key.strlen = grub_strlen (path); +- grub_strcpy ((char *) (key.str), path); ++ // grub_strcpy ((char *) (key.str), path); ++ strncpy (key.str, (char *) path, sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + /* Lookup this node. */ + if (! grub_hfs_find_node (data, (char *) &key, data->cat_root, diff --git a/radare2.spec b/radare2.spec index 3ed3487..d0d3c71 100644 --- a/radare2.spec +++ b/radare2.spec @@ -69,6 +69,11 @@ Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2 # https://github.com/radareorg/radare2/pull/23981 Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch +# CVE-2024-56737 - Fix buffer overflow in the HFS parser from grub2 +# https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch +# https://github.com/advisories/GHSA-9vr3-263w-c6mj +Patch10: https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib From c8ae303a57fda3f806a9f476641b1ca8ef257339 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 11:43:35 +0000 Subject: [PATCH 51/51] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild