From dbf4c8dabd9c03a524bb318ea93a4e3e2a129c75 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 22 Nov 2024 16:15:59 +0100 Subject: [PATCH 1/8] bump to 5.9.8 --- radare2-5.9.8-dec99.patch | 21 +++++++++++++++++++++ radare2.spec | 21 ++++++++++++++++----- sources | 2 +- 3 files changed, 38 insertions(+), 6 deletions(-) create mode 100644 radare2-5.9.8-dec99.patch diff --git a/radare2-5.9.8-dec99.patch b/radare2-5.9.8-dec99.patch new file mode 100644 index 0000000..53a9fa1 --- /dev/null +++ b/radare2-5.9.8-dec99.patch @@ -0,0 +1,21 @@ +diff -ru radare2-5.9.8.orig/shlr/qjs/src/quickjs.c radare2-5.9.8.new/shlr/qjs/src/quickjs.c +--- radare2-5.9.8.orig/shlr/qjs/src/quickjs.c 2024-11-19 12:38:30.000000000 +0100 ++++ radare2-5.9.8.new/shlr/qjs/src/quickjs.c 2024-11-22 14:34:10.546707808 +0100 +@@ -11311,6 +11311,8 @@ + char dest[minimum_length(JS_ECVT_BUF_SIZE)], + size_t size, int *decpt) + { ++ int i; ++ + if (n_digits == 0) { + /* find the minimum number of digits (XXX: inefficient but simple) */ + // TODO(chqrlie) use direct method from quickjs-printf +@@ -11360,7 +11362,7 @@ + return n_digits; /* truncate the 2 extra digits */ + } + /* round up in the string */ +- for(int i = n_digits;; i--) { ++ for(i = n_digits;; i--) { + /* ignore the locale specific decimal point */ + if (is_digit(dest[i])) { + if (dest[i]++ < '9') diff --git a/radare2.spec b/radare2.spec index b7dfb4a..fb30942 100644 --- a/radare2.spec +++ b/radare2.spec @@ -1,6 +1,6 @@ Name: radare2 Summary: The reverse engineering framework -Version: 5.9.6 +Version: 5.9.8 URL: https://radare.org/ %global vcsurl https://github.com/radareorg/radare2 VCS: git:%{vcsurl} @@ -21,10 +21,15 @@ VCS: git:%{vcsurl} %global gituser radareorg %global gitname radare2 -%global gitdate 20241013 -%global commit 2d36454e9914a5e0c03906b3e8d1e9fe4a2df6b7 +%global gitdate 20241119 +%global commit 4eb49d5ad8c99eaecc8850a2f10bad407067c898 %global shortcommit %(c=%{commit}; echo ${c:0:7}) +# autorelease not available on epel7 +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1 +%endif + %if %{with releasetag} Release: %autorelease @@ -51,8 +56,10 @@ Patch3: radare2-5.9.0-use_magic.patch # https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de # Patch6: radare2-5.8.8-CVE-2023-5686.patch - - +# Build reports need for C99 compatibility mode for the index type declaration in the for cycle. +# As rest of the radare2 is strictly defining all index variables prior to for cycle, it is recommended +# to change this one as well +Patch7: radare2-5.9.8-dec99.patch License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib @@ -371,10 +378,14 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %{_datadir}/%{name}/%{version}/syscall %{_datadir}/%{name}/%{version}/charsets %{_datadir}/%{name}/%{version}/platform +%{_datadir}/%{name}/%{version}/scripts + %dir %{_datadir}/%{name} %dir %{_datadir}/doc/%{name} %dir %{_datadir}/%{name}/%{version} %changelog +%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog +%endif diff --git a/sources b/sources index 66c7fbf..1fba33c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (radare2-5.9.6.tar.gz) = ae7211b560b0949f55d385846df3f477c46596e42d2076ab6cc6314adf77ec595f6f98800fb5d8999b82ec1150b9924e301976a18218858dd5f9399278ac9a59 +SHA512 (radare2-5.9.8.tar.gz) = d1338bcbd437c7f376a07a9d6870fa56bdab883cc5371ce506bc7f667780e19ce777c2839926d4bedf0578ec9338567b402a678643f36ac84404be55eeadb2da From 3c6f7341d4f49ef6c1f8c5ff88ac7aad04586506 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 25 Nov 2024 10:11:23 +0100 Subject: [PATCH 2/8] documentation of embedded quickjs-ng library --- radare2.spec | 47 +++++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/radare2.spec b/radare2.spec index fb30942..44d2370 100644 --- a/radare2.spec +++ b/radare2.spec @@ -66,25 +66,26 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ # during build for Fedora the GPL code is not omitted so effectively it is GPLv2+ # some code has originally different license: -# libr/asm/arch/ - GPLv2+, MIT, GPLv3 +# libr/asm/arch/ - GPLv2+, MIT, GPLv3 # libr/bin/format/pe/dotnet - Apache License Version 2.0 -# libr/hash/xxhash.c - 2 clause BSD -# libr/util/qrcode.c - MIT -# shlr/grub/grubfs.c - LGPL -# shlr/java - Apache 2.0 -# shlr/sdb/src - MIT -# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) -# shlr/squashfs/src - GPLv2+ -# libr/parse/c - LGPLv2+ -# shlr/udis86 - 2 clause BSD -# shlr/winkd - LGPL v3+ -# shlr/spp - MIT -# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) -# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) -# shlr/ptrace-wrap - LGPL v3+ -# shlr/tree-sitter - MIT -# shlr/mpc - 2 clause BSD -# shlr/yxml - MIT +# libr/hash/xxhash.c - 2 clause BSD +# libr/util/qrcode.c - MIT +# shlr/grub/grubfs.c - LGPL +# shlr/java - Apache 2.0 +# shlr/sdb/src - MIT +# shlr/lz4 - 3 clause BSD (system installed shared lz4 is used instead) +# shlr/squashfs/src - GPLv2+ +# libr/parse/c - LGPLv2+ +# shlr/udis86 - 2 clause BSD +# shlr/winkd - LGPL v3+ +# shlr/spp - MIT +# shlr/zip/zlib - zlib/libpng License (system installed shared libzip is used instead) +# shlr/zip/zip - 3 clause BSD (system installed shared zlib is used instead) +# shlr/ptrace-wrap - LGPL v3+ +# shlr/tree-sitter - MIT +# shlr/mpc - 2 clause BSD +# shlr/yxml - MIT +# shlr/qjs - MIT # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui @@ -217,6 +218,16 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 + +# ./shlr/qjs +# https://github.com/quickjs-ng/quickjs +# License: MIT +Provides: bundled(quickjs-ng) = 0.7.0 + + + + + # and likely some more in libr/... borrowed from other projects %description From 7420e619a1c04af35eadab597c3ed1018eaedaff Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 00:48:59 +0100 Subject: [PATCH 3/8] [skip changelog] fix the build for rhel8 on rhel8 the env mangling works wrong for "env -S" --- radare2.spec | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/radare2.spec b/radare2.spec index 44d2370..990e5c3 100644 --- a/radare2.spec +++ b/radare2.spec @@ -89,16 +89,16 @@ License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD- # Removed from the final package because of the presence of minified JS and # absence of the source JS - this should be packaged with radare2-webui -# shlr/www/m - Apache-2.0 -# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT +# shlr/www/m - Apache-2.0 +# shlr/www/enyo/vendors/jquery-ui.min.js - GPL + MIT # shlr/www/enyo/vendors/jquery.layout-latest.min.js - GPL + MIT -# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT -# shlr/www/enyo/vendors/lodash.min.js - lodash license -# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 -# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 -# shlr/www/p/vendors/jquery* - GPL + MIT -# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD -# shlr/www/p/vendors/jquery.onoff.min.js - MIT +# shlr/www/enyo/vendors/jquery.scrollTo.min.js - MIT +# shlr/www/enyo/vendors/lodash.min.js - lodash license +# shlr/www/enyo/vendors/joint.* - Mozilla MPL 2.0 +# shlr/www/enyo/vendors/jquery.min.js - Apache License version 2.0 +# shlr/www/p/vendors/jquery* - GPL + MIT +# shlr/www/p/vendors/dagre*|graphlib* - 3 clause BSD +# shlr/www/p/vendors/jquery.onoff.min.js - MIT BuildRequires: sed BuildRequires: gcc @@ -218,16 +218,11 @@ Provides: bundled(mpc) = 0.8.7 # https://dev.yorhel.nl/yxml Provides: bundled(yxml) = 20201108 - # ./shlr/qjs # https://github.com/quickjs-ng/quickjs # License: MIT Provides: bundled(quickjs-ng) = 0.7.0 - - - - # and likely some more in libr/... borrowed from other projects %description @@ -302,6 +297,8 @@ echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/REA sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build %endif +# On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" +sed -i -e "s|/usr/bin/env -S r2|/usr/bin/r2|" ./scripts/licenses.r2.js %build # Whereever possible use the system-wide libraries instead of bundles From e31daf3a1bbc0dde9a332da177fa4575d5dc75d6 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 30 Nov 2024 02:44:42 +0100 Subject: [PATCH 4/8] fix epel build --- radare2.spec | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/radare2.spec b/radare2.spec index 990e5c3..1b09d52 100644 --- a/radare2.spec +++ b/radare2.spec @@ -26,8 +26,8 @@ VCS: git:%{vcsurl} %global shortcommit %(c=%{commit}; echo ${c:0:7}) # autorelease not available on epel7 -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) -%global autorelease 1 +%if ( 0%{?rhel} && 0%{?rhel} <= 7 ) +%global autorelease 1%{?dist} %endif @@ -290,11 +290,9 @@ echo "The radare2 source usually comes with a pre-built version of the web-inter echo "This has been removed in the Fedora package to follow the Fedora Packaging Guidelines." >> ./shlr/www/README.Fedora echo "Available under https://github.com/radare/radare2-webui" >> ./shlr/www/README.Fedora -%if 0%{?rhel} && 0%{?rhel} == 8 -# Meson on EPEL8 is older than meson on EPEL7 and older than recommended one -# on EPEL8 downgrade the recommendation in meson.build and pray -# meson_version : '>=0.50.1' => meson_version : '>=0.49.1' -sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.49.1'|;" meson.build +%if 0%{?rhel} && 0%{?rhel} <= 8 +# Meson on EPEL8 / EPEL7 is older than recommended one +sed -i -e "s|meson_version : '>=......'|meson_version : '>=0.47.2'|;" meson.build %endif # On RHEL8 the shabeng for "/usr/bin/env -S" is mangled wrongly as "/usr/bin/-S" From 36838d331cd5ca08dcce21069de90221e04a9057 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 21:58:29 +0000 Subject: [PATCH 5/8] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c79e6c5c16938c539212c6b8b431fc3bba94af16 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 8 Mar 2025 00:38:41 +0100 Subject: [PATCH 6/8] fix CVE-2025-1744 and CVE-2025-1864 --- radare2-5.9.8-magic-cve.patch | 47 +++++++++++++++++++++++++++++++++++ radare2-5.9.8-zlib-cve.patch | 30 ++++++++++++++++++++++ radare2.spec | 11 ++++++-- 3 files changed, 86 insertions(+), 2 deletions(-) create mode 100644 radare2-5.9.8-magic-cve.patch create mode 100644 radare2-5.9.8-zlib-cve.patch diff --git a/radare2-5.9.8-magic-cve.patch b/radare2-5.9.8-magic-cve.patch new file mode 100644 index 0000000..9e76c3b --- /dev/null +++ b/radare2-5.9.8-magic-cve.patch @@ -0,0 +1,47 @@ +From 9c92960f8606be2decf88cdcec7a7ab53ff13b4b Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Wed, 19 Feb 2025 23:42:14 +0800 +Subject: [PATCH 1/2] PR/454: Fix memory corruption when the continuation level + jumps by more than 20 in a single step. + +--- + libr/magic/funcs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 7356dc0c93f77..14687bf7be8f0 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,7 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len += 20) * sizeof (*ms->c.li); ++ size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { + +From 030e74cd136044e28828ab52615ce929693bae7a Mon Sep 17 00:00:00 2001 +From: pancake +Date: Wed, 19 Feb 2025 17:32:21 +0100 +Subject: [PATCH 2/2] Update libr/magic/funcs.c + +--- + libr/magic/funcs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c +index 14687bf7be8f0..52e3819f0e04e 100644 +--- a/libr/magic/funcs.c ++++ b/libr/magic/funcs.c +@@ -322,7 +322,8 @@ const char *__magic_file_getbuffer(RMagic *ms) { + + int __magic_file_check_mem(RMagic *ms, unsigned int level) { + if (level >= ms->c.len) { +- size_t len = (ms->c.len = 20 + level) * sizeof (*ms->c.li); ++ ms->c.len = level + 20; ++ size_t len = ms->c.len * sizeof (*ms->c.li); + ms->c.li = (!ms->c.li) ? malloc (len) : + realloc (ms->c.li, len); + if (!ms->c.li) { diff --git a/radare2-5.9.8-zlib-cve.patch b/radare2-5.9.8-zlib-cve.patch new file mode 100644 index 0000000..02ada03 --- /dev/null +++ b/radare2-5.9.8-zlib-cve.patch @@ -0,0 +1,30 @@ +From b49d2f0b84d424ec7fbf47138bf6acc6b18e1b0d Mon Sep 17 00:00:00 2001 +From: tabudz +Date: Tue, 18 Feb 2025 11:28:15 +0800 +Subject: [PATCH] Fix a bug when getting a gzip header extra field with + inflate(). If the extra field was larger than the space the user provided + with inflateGetHeader(), and if multiple calls of inflate() delivered the + extra header data, then there could be a buffer overflow of the provided + space. This commit assures that provided space is not exceeded. + +--- + shlr/zip/zlib/inflate.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/shlr/zip/zlib/inflate.c b/shlr/zip/zlib/inflate.c +index e9ed74cff3279..2ecfb4876d155 100644 +--- a/shlr/zip/zlib/inflate.c ++++ b/shlr/zip/zlib/inflate.c +@@ -755,9 +755,10 @@ int ZEXPORT inflate(z_streamp strm, int flush) + copy = state->length; + if (copy > have) copy = have; + if (copy) { ++ len = state->head->extra_len - state->length; + if (state->head != Z_NULL && +- state->head->extra != Z_NULL) { +- len = state->head->extra_len - state->length; ++ state->head->extra != Z_NULL && ++ len < state->head->extra_max) { + zmemcpy(state->head->extra + len, next, + len + copy > state->head->extra_max ? + state->head->extra_max - len : copy); diff --git a/radare2.spec b/radare2.spec index 1b09d52..3ed3487 100644 --- a/radare2.spec +++ b/radare2.spec @@ -61,6 +61,15 @@ Patch3: radare2-5.9.0-use_magic.patch # to change this one as well Patch7: radare2-5.9.8-dec99.patch +# CVE-2025-1744 - Potential Vulnerability in zlib Library +# https://github.com/radareorg/radare2/pull/23969 +Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2-5.9.8-zlib-cve.patch + +# CVE-2025-1864 - Potential Vulnerability in magic Library +# https://github.com/radareorg/radare2/pull/23981 +Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch + + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib # Radare2 as a package is targeting to be licensed/compiled as LGPLv3+ @@ -392,6 +401,4 @@ mkdir -p %{buildroot}%{_libdir}/%{name}/%{version} %changelog -%if ! ( 0%{?rhel} && 0%{?rhel} <= 7 ) %autochangelog -%endif From 756d6a5693c005c23746ebe9e82082c96e9521e0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 11 Mar 2025 18:24:30 +0100 Subject: [PATCH 7/8] fix CVE-2024-56737 --- radare2-5.9.8-hfs-cve.patch | 36 ++++++++++++++++++++++++++++++++++++ radare2.spec | 5 +++++ 2 files changed, 41 insertions(+) create mode 100644 radare2-5.9.8-hfs-cve.patch diff --git a/radare2-5.9.8-hfs-cve.patch b/radare2-5.9.8-hfs-cve.patch new file mode 100644 index 0000000..c4e58bf --- /dev/null +++ b/radare2-5.9.8-hfs-cve.patch @@ -0,0 +1,36 @@ +From 984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4 Mon Sep 17 00:00:00 2001 +From: pancake +Date: Thu, 2 Jan 2025 13:03:34 +0100 +Subject: [PATCH] CVE-2024-56737 - Fix buffer overflow in the HFS parser from + grub2 ##crash + +--- + shlr/grub/fs/hfs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/shlr/grub/fs/hfs.c b/shlr/grub/fs/hfs.c +index 33060d5d5fe25..98f717c4c47b4 100644 +--- a/shlr/grub/fs/hfs.c ++++ b/shlr/grub/fs/hfs.c +@@ -375,7 +375,9 @@ grub_hfs_mount (grub_disk_t disk) + volume name. */ + key.parent_dir = grub_cpu_to_be32 (1); + key.strlen = data->sblock.volname[0]; +- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ ///grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ strncpy (key.str, (char *) (data->sblock.volname + 1), sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + int depth = 0; + if (grub_hfs_find_node (data, (char *) &key, data->cat_root, +@@ -965,7 +967,9 @@ grub_hfs_find_dir (struct grub_hfs_data *data, const char *path, + + key.parent_dir = grub_cpu_to_be32 (inode); + key.strlen = grub_strlen (path); +- grub_strcpy ((char *) (key.str), path); ++ // grub_strcpy ((char *) (key.str), path); ++ strncpy (key.str, (char *) path, sizeof (key.str) - 1); ++ key.str[sizeof (key.str) - 1] = 0; + + /* Lookup this node. */ + if (! grub_hfs_find_node (data, (char *) &key, data->cat_root, diff --git a/radare2.spec b/radare2.spec index 3ed3487..d0d3c71 100644 --- a/radare2.spec +++ b/radare2.spec @@ -69,6 +69,11 @@ Patch8: https://github.com/radareorg/radare2/pull/23969.patch#/radare2 # https://github.com/radareorg/radare2/pull/23981 Patch9: https://github.com/radareorg/radare2/pull/23981.patch#/radare2-5.9.8-magic-cve.patch +# CVE-2024-56737 - Fix buffer overflow in the HFS parser from grub2 +# https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch +# https://github.com/advisories/GHSA-9vr3-263w-c6mj +Patch10: https://github.com/radareorg/radare2/commit/984ad6ae4ebbc3a01cf1209e05377b5d1d6221f4.patch#/radare2-5.9.8-hfs-cve.patch + License: LGPL-3.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Apache-2.0 AND MPL-2.0 AND Zlib From c8ae303a57fda3f806a9f476641b1ca8ef257339 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 11:43:35 +0000 Subject: [PATCH 8/8] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild