diff --git a/v8-3.14.5.10-CVE-2016-1669.patch b/v8-3.14.5.10-CVE-2016-1669.patch new file mode 100644 index 0000000..1a37129 --- /dev/null +++ b/v8-3.14.5.10-CVE-2016-1669.patch @@ -0,0 +1,30 @@ +diff -up v8-3.14.5.10/src/zone.cc.3a9bfec v8-3.14.5.10/src/zone.cc +--- v8-3.14.5.10/src/zone.cc.3a9bfec 2016-07-06 11:21:45.362891427 -0400 ++++ v8-3.14.5.10/src/zone.cc 2016-07-06 11:22:08.538764825 -0400 +@@ -168,7 +168,10 @@ Address Zone::NewExpand(int size) { + // Make sure the requested size is already properly aligned and that + // there isn't enough room in the Zone to satisfy the request. + ASSERT(size == RoundDown(size, kAlignment)); +- ASSERT(size > limit_ - position_); ++ ASSERT(limit_ < position_ || ++ reinterpret_cast(limit_) - ++ reinterpret_cast(position_) < ++ size); + + // Compute the new segment size. We use a 'high water mark' + // strategy, where we increase the segment size every time we expand +diff -up v8-3.14.5.10/src/zone-inl.h.3a9bfec v8-3.14.5.10/src/zone-inl.h +--- v8-3.14.5.10/src/zone-inl.h.3a9bfec 2016-07-06 11:21:00.075136898 -0400 ++++ v8-3.14.5.10/src/zone-inl.h 2016-07-06 11:21:31.546966899 -0400 +@@ -55,7 +55,10 @@ inline void* Zone::New(int size) { + // Check if the requested size is available without expanding. + Address result = position_; + +- if (size > limit_ - position_) { ++ const uintptr_t limit = reinterpret_cast(limit_); ++ const uintptr_t position = reinterpret_cast(position_); ++ // position_ > limit_ can be true after the alignment correction above. ++ if (limit < position || (size_t) size > limit - position) { + result = NewExpand(size); + } else { + position_ += size; diff --git a/v8-3.14.5.10-report-builtins-by-name.patch b/v8-3.14.5.10-report-builtins-by-name.patch new file mode 100644 index 0000000..1d2410b --- /dev/null +++ b/v8-3.14.5.10-report-builtins-by-name.patch @@ -0,0 +1,16 @@ +diff -up v8-3.14.5.10/src/log.cc.builtinnames v8-3.14.5.10/src/log.cc +--- v8-3.14.5.10/src/log.cc.builtinnames 2016-07-06 11:25:12.341766992 -0400 ++++ v8-3.14.5.10/src/log.cc 2016-07-06 11:25:41.065609632 -0400 +@@ -1485,7 +1485,11 @@ void Logger::LogCodeObject(Object* objec + tag = Logger::STUB_TAG; + break; + case Code::BUILTIN: +- description = "A builtin from the snapshot"; ++ description = ++ Isolate::Current()->builtins()->Lookup(code_object->entry()); ++ if (description == NULL) { ++ description = "A builtin from the snapshot"; ++ } + tag = Logger::BUILTIN_TAG; + break; + case Code::KEYED_LOAD_IC: diff --git a/v8.spec b/v8.spec index 0f7a593..abb97e3 100644 --- a/v8.spec +++ b/v8.spec @@ -23,7 +23,7 @@ Name: v8 Version: %{somajor}.%{sominor}.%{sobuild}.%{sotiny} -Release: 23%{?dist} +Release: 25%{?dist} Epoch: 1 Summary: JavaScript Engine Group: System Environment/Libraries @@ -34,6 +34,7 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) ExclusiveArch: %{ix86} x86_64 %{arm} BuildRequires: scons, readline-devel, libicu-devel BuildRequires: valgrind-devel +Provides: v8-314 = %{version} #backport fix for CVE-2013-2634 (RHBZ#924495) Patch1: v8-3.14.5.8-CVE-2013-2634.patch @@ -126,6 +127,13 @@ Patch19: v8-3.4.14-CVE-2014-3152.patch # Add REPLACE_INVALID_UTF8 handling that nodejs needs Patch20: v8-3.14.5.10-REPLACE_INVALID_UTF8.patch +# Fix for CVE-2016-1669 (thanks to bhoordhuis) +Patch21: v8-3.14.5.10-CVE-2016-1669.patch + +# Report builtins by name +# https://github.com/nodejs/node/commit/5a60e0d904c38c2bdb04785203b1b784967c870d +Patch22: v8-3.14.5.10-report-builtins-by-name.patch + %description V8 is Google's open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 implements ECMAScript @@ -135,6 +143,7 @@ as specified in ECMA-262, 3rd edition. Group: Development/Libraries Summary: Development headers and libraries for v8 Requires: %{name} = %{epoch}:%{version}-%{release} +Provides: v8-314-devel = %{version} %description devel Development headers and libraries for v8. @@ -142,6 +151,7 @@ Development headers and libraries for v8. %package python Summary: Python libraries from v8 Requires: %{name} = %{epoch}:%{version}-%{release} +Provides: v8-314-python = %{version} %description python Python libraries from v8. @@ -168,6 +178,8 @@ Python libraries from v8. %patch18 -p1 -b .profiler-log %patch19 -p1 -b .cve20143152 %patch20 -p1 -b .riu +%patch21 -p1 -b .CVE-2016-1669 +%patch22 -p1 -b .builtinname # Do not need this lying about. rm -rf src/third_party/valgrind @@ -180,7 +192,7 @@ rm -rf src/third_party/valgrind %endif # -fno-strict-aliasing is needed with gcc 4.4 to get past some ugly code -PARSED_OPT_FLAGS=`echo \'$RPM_OPT_FLAGS %{lrt} -fPIC -fno-strict-aliasing -Wno-unused-parameter -Wno-error=strict-overflow -Wno-unused-but-set-variable\'| sed "s/ /',/g" | sed "s/',/', '/g"` +PARSED_OPT_FLAGS=`echo \'$RPM_OPT_FLAGS %{lrt} -fPIC -fno-strict-aliasing -Wno-unused-parameter -Wno-error=strict-overflow -Wno-unused-but-set-variable -fno-delete-null-pointer-checks\'| sed "s/ /',/g" | sed "s/',/', '/g"` sed -i "s|'-O3',|$PARSED_OPT_FLAGS,|g" SConstruct # clear spurious executable bits @@ -337,6 +349,14 @@ rm -rf %{buildroot} %{python_sitelib}/j*.py* %changelog +* Tue Jul 26 2016 Tom Callaway 1:3.14.5.10-25 +- provide v8-314 provides +- add fix for CVE-2016-1669 + +* Mon Jun 06 2016 Vít Ondruch - 1:3.14.5.10-24 +- Use "-fno-delete-null-pointer-checks" to workaround GCC 6.x compatibility + (rhbz#1331480, rhbz#1331458). + * Fri Feb 05 2016 Fedora Release Engineering - 1:3.14.5.10-23 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild @@ -508,16 +528,16 @@ rm -rf %{buildroot} * Tue Aug 24 2010 Tom "spot" Callaway 2.3.10-1.20100824svn5332 - update to 2.3.10, svn5332 -* Thu Aug 18 2010 Tom "spot" Callaway 2.3.9-1.20100819svn5308 +* Wed Aug 18 2010 Tom "spot" Callaway 2.3.9-1.20100819svn5308 - update to 2.3.9, svn5308 -* Thu Aug 11 2010 Tom "spot" Callaway 2.3.7-1.20100812svn5251 +* Wed Aug 11 2010 Tom "spot" Callaway 2.3.7-1.20100812svn5251 - update to svn5251 * Wed Aug 11 2010 Tom "spot" Callaway 2.3.7-1.20100811svn5248 - update to 2.3.7, svn5248 -* Mon Aug 10 2010 Tom "spot" Callaway 2.3.6-1.20100809svn5217 +* Tue Aug 10 2010 Tom "spot" Callaway 2.3.6-1.20100809svn5217 - update to 2.3.6, svn5217 * Fri Aug 6 2010 Tom "spot" Callaway 2.3.5-1.20100806svn5198