From cd0065483bfe1283c1be6cd61d5b6037ec8128ca Mon Sep 17 00:00:00 2001 From: Tom Callaway Date: Thu, 23 Apr 2015 15:12:15 -0400 Subject: [PATCH 1/2] fix for CVE-2014-3152 --- v8-3.4.14-CVE-2014-3152.patch | 13 +++++++++++++ v8.spec | 11 ++++++++++- 2 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 v8-3.4.14-CVE-2014-3152.patch diff --git a/v8-3.4.14-CVE-2014-3152.patch b/v8-3.4.14-CVE-2014-3152.patch new file mode 100644 index 0000000..a399c79 --- /dev/null +++ b/v8-3.4.14-CVE-2014-3152.patch @@ -0,0 +1,13 @@ +diff -up v8-3.14.5.10/src/arm/lithium-codegen-arm.cc.cve20143152 v8-3.14.5.10/src/arm/lithium-codegen-arm.cc +--- v8-3.14.5.10/src/arm/lithium-codegen-arm.cc.cve20143152 2015-04-23 14:51:20.095648219 -0400 ++++ v8-3.14.5.10/src/arm/lithium-codegen-arm.cc 2015-04-23 14:53:28.834149299 -0400 +@@ -3034,7 +3034,8 @@ MemOperand LCodeGen::PrepareKeyedOperand + return MemOperand(base, scratch0(), LSL, shift_size); + } else { + ASSERT_EQ(-1, shift_size); +- return MemOperand(base, scratch0(), LSR, 1); ++ // key can be negative, so using ASR here. ++ return MemOperand(base, scratch0(), ASR, 1); + } + } + diff --git a/v8.spec b/v8.spec index 45b05ec..eb77fb1 100644 --- a/v8.spec +++ b/v8.spec @@ -23,7 +23,7 @@ Name: v8 Version: %{somajor}.%{sominor}.%{sobuild}.%{sotiny} -Release: 17%{?dist} +Release: 18%{?dist} Epoch: 1 Summary: JavaScript Engine Group: System Environment/Libraries @@ -118,6 +118,11 @@ Patch17: v8-3.14.5.10-busy-loop.patch # https://codereview.chromium.org/806143002 Patch18: v8-3.14.5.10-profiler-log.patch +# Fix CVE in ARM code +# https://bugzilla.redhat.com/show_bug.cgi?id=1101057 +# https://codereview.chromium.org/219473002 +Patch19: v8-3.4.14-CVE-2014-3152.patch + %description V8 is Google's open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 implements ECMAScript @@ -151,6 +156,7 @@ Development headers and libraries for v8. %patch16 -p1 -b .unhandled-ReferenceError %patch17 -p1 -b .busy-loop %patch18 -p1 -b .profiler-log +%patch19 -p1 -b .cve20143152 # Do not need this lying about. rm -rf src/third_party/valgrind @@ -318,6 +324,9 @@ rm -rf %{buildroot} %{python_sitelib}/j*.py* %changelog +* Thu Apr 23 2015 Tom Callaway - 1:3.14.5.10-18 +- backport security fix for ARM - CVE-2014-3152 + * Thu Feb 19 2015 T.C. Hollingsworth - 1:3.14.5.10-17 - backports for nodejs 0.10.36 From 5b4b4cfdc09eb853ef74f8ac8636c11e3dd180a4 Mon Sep 17 00:00:00 2001 From: Tom Callaway Date: Mon, 21 Sep 2015 13:46:17 -0400 Subject: [PATCH 2/2] wrong repo --- MuseScore-2.0.0-remove-mp3-support.patch | 71 ------------------------ 1 file changed, 71 deletions(-) delete mode 100644 MuseScore-2.0.0-remove-mp3-support.patch diff --git a/MuseScore-2.0.0-remove-mp3-support.patch b/MuseScore-2.0.0-remove-mp3-support.patch deleted file mode 100644 index 6517102..0000000 --- a/MuseScore-2.0.0-remove-mp3-support.patch +++ /dev/null @@ -1,71 +0,0 @@ -diff -uNr MuseScore-2.0.0/CMakeLists.txt MuseScore-2.0.0.lame/CMakeLists.txt ---- MuseScore-2.0.0/CMakeLists.txt 2015-04-25 17:25:27.105930823 +0300 -+++ MuseScore-2.0.0.lame/CMakeLists.txt 2015-04-25 17:07:45.879356577 +0300 -@@ -44,7 +44,6 @@ - include (UsePkgConfig1) - include (TargetDoc) - include (FindPulseAudio) --include (FindLame) - include (GetCompilerVersion) - include (CreatePrecompiledHeader) - -@@ -436,7 +435,6 @@ - ${OGG_INCDIR} - ${VORBIS_INCDIR} - ${SNDFILE_INCDIR} -- ${LAME_INCLUDE_DIR} - ) - - ## -diff -uNr MuseScore-2.0.0/mscore/CMakeLists.txt MuseScore-2.0.0.lame/mscore/CMakeLists.txt ---- MuseScore-2.0.0/mscore/CMakeLists.txt 2015-04-25 17:25:27.093930461 +0300 -+++ MuseScore-2.0.0.lame/mscore/CMakeLists.txt 2015-04-25 17:07:32.514973070 +0300 -@@ -226,7 +226,7 @@ - importgtp.cpp importgtp-gp4.cpp importgtp-gp5.cpp importgtp-gp6.cpp fotomode.cpp drumtools.cpp - selinstrument.cpp texteditor.cpp editstafftype.cpp texttools.cpp - editpitch.cpp editstringdata.cpp editraster.cpp pianotools.cpp mediadialog.cpp -- workspace.cpp exportmp3.cpp chordview.cpp -+ workspace.cpp chordview.cpp - album.cpp albummanager.cpp - textstyle.cpp - lineproperties.cpp stafftextproperties.cpp splitstaff.cpp -diff -uNr MuseScore-2.0.0/mscore/file.cpp MuseScore-2.0.0.lame/mscore/file.cpp ---- MuseScore-2.0.0/mscore/file.cpp 2015-03-21 10:32:54.000000000 +0300 -+++ MuseScore-2.0.0.lame/mscore/file.cpp 2015-04-25 17:24:16.761808110 +0300 -@@ -1537,7 +1537,6 @@ - fl.append(tr("FLAC Audio (*.flac)")); - fl.append(tr("Ogg Vorbis Audio (*.ogg)")); - #endif -- fl.append(tr("MP3 Audio (*.mp3)")); - fl.append(tr("Standard MIDI File (*.mid)")); - fl.append(tr("MusicXML File (*.xml)")); - fl.append(tr("Compressed MusicXML File (*.mxl)")); -@@ -1601,7 +1600,6 @@ - fl.append(tr("FLAC Audio (*.flac)")); - fl.append(tr("Ogg Vorbis Audio (*.ogg)")); - #endif -- fl.append(tr("MP3 Audio (*.mp3)")); - fl.append(tr("Standard MIDI File (*.mid)")); - fl.append(tr("MusicXML File (*.xml)")); - fl.append(tr("Compressed MusicXML File (*.mxl)")); -@@ -1797,8 +1795,6 @@ - else if (ext == "wav" || ext == "flac" || ext == "ogg") - rv = saveAudio(cs, fn); - #endif -- else if (ext == "mp3") -- rv = saveMp3(cs, fn); - else if (ext == "spos") { - // save positions of segments - rv = savePositions(cs, fn, true); -diff -uNr MuseScore-2.0.0/mscore/musescore.cpp MuseScore-2.0.0.lame/mscore/musescore.cpp ---- MuseScore-2.0.0/mscore/musescore.cpp 2015-03-21 10:32:54.000000000 +0300 -+++ MuseScore-2.0.0.lame/mscore/musescore.cpp 2015-04-25 17:22:52.616268923 +0300 -@@ -2140,8 +2140,6 @@ - if (fn.endsWith(".wav") || fn.endsWith(".ogg") || fn.endsWith(".flac")) - return mscore->saveAudio(cs, fn); - #endif -- if (fn.endsWith(".mp3")) -- return mscore->saveMp3(cs, fn); - if (fn.endsWith(".spos")) - return savePositions(cs, fn, true); - if (fn.endsWith(".mpos"))