Compare commits

...

11 Commits

Author SHA1 Message Date
openeuler-ci-bot
e7eb7307f1
!24 [sync] PR-22: fix CVE-2022-1271
From: @openeuler-sync-bot 
Reviewed-by: @xiezhipeng1 
Signed-off-by: @xiezhipeng1
2022-04-24 01:27:10 +00:00
shixuantong
e30d940847 fix CVE-2022-1271
(cherry picked from commit 69cd3c7b0aca787d509e0be63695ac318fd56271)
2022-04-22 09:11:06 +08:00
openeuler-ci-bot
a2f1faa632
!18 update license from GPLv3+,GFDL to GPLv3+
From: @renxichen 
Reviewed-by: @overweight 
Signed-off-by: @overweight
2022-04-14 06:33:43 +00:00
rwx403335
63d1b918b4 update license from GPLv3+,GFDL to GPLv3+ 2022-04-14 12:01:12 +08:00
openeuler-ci-bot
d6965ccd4e !5 add gzexe.patch
Merge pull request !5 from chengquan/master
2020-05-12 18:36:42 +08:00
chengquan
9e35ca583e add gzexe.patch. 2020-05-12 17:28:16 +08:00
chengquan
f38c236fc4 删除文件 gnulib.patch 2020-05-12 17:27:50 +08:00
openeuler-ci-bot
8859f72ca7 !3 Update software to v1.10
Merge pull request !3 from chengquan/master
2020-05-11 16:30:02 +08:00
chengquan
4da855bf53 upgrade software to v1.10 2020-05-11 14:53:43 +08:00
openeuler-ci-bot
d68b535dd0 !2 remove useless scripts for grep
Merge pull request !2 from chengquan/dev
2020-01-17 16:00:24 +08:00
梳碧湖的砍柴人
bcd7641fe3 delete useless scripts for grep 2020-01-17 14:57:42 +08:00
11 changed files with 229 additions and 292 deletions

View File

@ -0,0 +1,43 @@
From dc9740df61e575e8c3148b7bd3c147a81ea00c7c Mon Sep 17 00:00:00 2001
From: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon, 4 Apr 2022 23:52:49 -0700
Subject: zgrep: avoid exploit via multi-newline file names
* zgrep.in: The issue with the old code is that with multiple
newlines, the N-command will read the second line of input,
then the s-commands will be skipped because it's not the end
of the file yet, then a new sed cycle starts and the pattern
space is printed and emptied. So only the last line or two get
escaped. This patch makes sed read all lines into the pattern
space and then do the escaping.
This vulnerability was discovered by:
cleemy desu wayo working with Trend Micro Zero Day Initiative
---
zgrep.in | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/zgrep.in b/zgrep.in
index 345dae3..bdf7da2 100644
--- a/zgrep.in
+++ b/zgrep.in
@@ -222,9 +222,13 @@ do
'* | *'&'* | *'\'* | *'|'*)
i=$(printf '%s\n' "$i" |
sed '
- $!N
- $s/[&\|]/\\&/g
- $s/\n/\\n/g
+ :start
+ $!{
+ N
+ b start
+ }
+ s/[&\|]/\\&/g
+ s/\n/\\n/g
');;
esac
sed_script="s|^|$i:|"
--
1.8.3.1

View File

@ -0,0 +1,77 @@
From d74a30d45c6834c8e9f87115197370fe86656d81 Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering@fb.com>
Date: Mon, 4 Apr 2022 23:52:49 -0700
Subject: zgrep: add NEWS and tests for this exploitable bug
* tests/zgrep-abuse: New file, based on PoC by cleemy desu wayo.
* tests/Makefile.am (TESTS): Add it.
* NEWS: Mention the exploit.
The bug appears to have been present since the beginning.
---
tests/Makefile.am | 1 +
tests/zgrep-abuse | 41 +++++++++++++++++++++++++++++++++++++++++
2 files changed, 42 insertions(+)
create mode 100755 tests/zgrep-abuse
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 691bbf8..d565211 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -34,6 +34,7 @@ TESTS = \
z-suffix \
zdiff \
zgrep-f \
+ zgrep-abuse \
zgrep-context \
zgrep-signal \
znew-k
diff --git a/tests/zgrep-abuse b/tests/zgrep-abuse
new file mode 100755
index 0000000..3e8a8f9
--- /dev/null
+++ b/tests/zgrep-abuse
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Show how zgrep applied to a crafted file name may overwrite
+# a selected file with chosen content. Fixed in gzip-1.12.
+
+# Copyright (C) 2022 Free Software Foundation, Inc.
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+# limit so don't run it by default.
+
+. "${srcdir=.}/init.sh"; path_prepend_ ..
+
+: > z || framework_failure_
+echo test |gzip > 'z|
+p
+1s|.*|chosen-content|
+1w hacked
+etouch .\x2fhacked2
+d
+#
+#' || framework_failure_
+
+fail=0
+
+zgrep test z* > /dev/null
+
+# Before the fix, each of these would be created.
+test -f hacked && fail=1
+test -f hacked2 && fail=1
+
+Exit $fail
--
1.8.3.1

View File

@ -0,0 +1,46 @@
From c99f320d5c0fd98fe88d9cea5407eb7ad9d50e8a Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Mon, 4 Apr 2022 23:52:49 -0700
Subject: zgrep: port to POSIX sed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* zgrep.in (res): When escaping the file name do not rely on GNU
seds extension to POSIX with respect to s/.../\n/. Instead, use
features that should also work with AIX and/or Solaris sed. This is
simpler anyway, and would have prevented the recently-fixed bug.
---
zgrep.in | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)
diff --git a/zgrep.in b/zgrep.in
index bdf7da2..6a16dd1 100644
--- a/zgrep.in
+++ b/zgrep.in
@@ -220,18 +220,11 @@ do
case $i in
(*'
'* | *'&'* | *'\'* | *'|'*)
- i=$(printf '%s\n' "$i" |
- sed '
- :start
- $!{
- N
- b start
- }
- s/[&\|]/\\&/g
- s/\n/\\n/g
- ');;
+ icolon=$(printf '%s\n' "$i:" |
+ sed -e 's/[&\|]/\\&/g' -e '$!s/$/\\/');;
+ (*) icolon="$i:";;
esac
- sed_script="s|^|$i:|"
+ sed_script="s|^|$icolon|"
# Fail if grep or sed fails.
r=$(
--
1.8.3.1

View File

@ -1,9 +0,0 @@
test -f /usr/libexec/grepconf.sh
if ( $status == 1 ) exit
/usr/libexec/grepconf.sh -c
if ( $status == 1 ) exit
alias zgrep 'zgrep --color=auto'
alias zfgrep 'zfgrep --color=auto'
alias zegrep 'zegrep --color=auto'

View File

@ -1,6 +0,0 @@
[ -f /usr/libexec/grepconf.sh ] || return
/usr/libexec/grepconf.sh -c || return
alias zgrep='zgrep --color=auto' 2>/dev/null
alias zfgrep='zfgrep --color=auto' 2>/dev/null
alias zegrep='zegrep --color=auto' 2>/dev/null

View File

@ -1,189 +0,0 @@
From 1831628c0630ae96a43586b2a25ca51cbdba3e53 Mon Sep 17 00:00:00 2001
From: Paul Eggert <address@hidden>
Date: Mon, 5 Mar 2018 10:56:29 -0800
Subject: [PATCH] fflush: adjust to glibc 2.28 libio.h removal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Problem reported by Daniel P. Berrangé in:
https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
* lib/fbufmode.c (fbufmode):
* lib/fflush.c (clear_ungetc_buffer_preserving_position)
(disable_seek_optimization, rpl_fflush):
* lib/fpending.c (__fpending):
* lib/fpurge.c (fpurge):
* lib/freadable.c (freadable):
* lib/freadahead.c (freadahead):
* lib/freading.c (freading):
* lib/freadptr.c (freadptr):
* lib/freadseek.c (freadptrinc):
* lib/fseeko.c (fseeko):
* lib/fseterr.c (fseterr):
* lib/fwritable.c (fwritable):
* lib/fwriting.c (fwriting):
Check _IO_EOF_SEEN instead of _IO_ftrylockfile.
* lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]:
Define if not already defined.
---
ChangeLog | 23 +++++++++++++++++++++++
lib/fbufmode.c | 2 +-
lib/fflush.c | 6 +++---
lib/fpending.c | 2 +-
lib/fpurge.c | 2 +-
lib/freadable.c | 2 +-
lib/freadahead.c | 2 +-
lib/freading.c | 2 +-
lib/freadptr.c | 2 +-
lib/freadseek.c | 2 +-
lib/fseeko.c | 4 ++--
lib/fseterr.c | 2 +-
lib/fwritable.c | 2 +-
lib/fwriting.c | 2 +-
lib/stdio-impl.h | 6 ++++++
15 files changed, 45 insertions(+), 16 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 667f91663..beb835670 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,26 @@
+2018-03-05 Paul Eggert <address@hidden>
+
+ fflush: adjust to glibc 2.28 libio.h removal
+ Problem reported by Daniel P. Berrangé in:
+ https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
+ * lib/fbufmode.c (fbufmode):
+ * lib/fflush.c (clear_ungetc_buffer_preserving_position)
+ (disable_seek_optimization, rpl_fflush):
+ * lib/fpending.c (__fpending):
+ * lib/fpurge.c (fpurge):
+ * lib/freadable.c (freadable):
+ * lib/freadahead.c (freadahead):
+ * lib/freading.c (freading):
+ * lib/freadptr.c (freadptr):
+ * lib/freadseek.c (freadptrinc):
+ * lib/fseeko.c (fseeko):
+ * lib/fseterr.c (fseterr):
+ * lib/fwritable.c (fwritable):
+ * lib/fwriting.c (fwriting):
+ Check _IO_EOF_SEEN instead of _IO_ftrylockfile.
+ * lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]:
+ Define if not already defined.
+
2018-01-07 Jim Meyering <meyering@fb.com>
version 1.9
* NEWS: Record release date.
diff --git a/lib/fflush.c b/lib/fflush.c
index 983ade0ff..a6edfa105 100644
--- a/lib/fflush.c
+++ b/lib/fflush.c
@@ -33,7 +33,7 @@
#undef fflush
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
/* Clear the stream's ungetc buffer, preserving the value of ftello (fp). */
static void
@@ -72,7 +72,7 @@ clear_ungetc_buffer (FILE *fp)
#endif
-#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
+#if ! (defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
# if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT
/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
@@ -148,7 +148,7 @@ rpl_fflush (FILE *stream)
if (stream == NULL || ! freading (stream))
return fflush (stream);
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
clear_ungetc_buffer_preserving_position (stream);
diff --git a/lib/fpurge.c b/lib/fpurge.c
index b1d417c7a..3aedcc373 100644
--- a/lib/fpurge.c
+++ b/lib/fpurge.c
@@ -62,7 +62,7 @@ fpurge (FILE *fp)
/* Most systems provide FILE as a struct and the necessary bitmask in
<stdio.h>, because they need it for implementing getc() and putc() as
fast macros. */
-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
fp->_IO_read_end = fp->_IO_read_ptr;
fp->_IO_write_ptr = fp->_IO_write_base;
/* Avoid memory leak when there is an active ungetc buffer. */
diff --git a/lib/freading.c b/lib/freading.c
index 73c28acdd..c24d0c88a 100644
--- a/lib/freading.c
+++ b/lib/freading.c
@@ -31,7 +31,7 @@ freading (FILE *fp)
/* Most systems provide FILE as a struct and the necessary bitmask in
<stdio.h>, because they need it for implementing getc() and putc() as
fast macros. */
-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
return ((fp->_flags & _IO_NO_WRITES) != 0
|| ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0
&& fp->_IO_read_base != NULL));
diff --git a/lib/fseeko.c b/lib/fseeko.c
index 0101ab55f..193f4e8ce 100644
--- a/lib/fseeko.c
+++ b/lib/fseeko.c
@@ -47,7 +47,7 @@ fseeko (FILE *fp, off_t offset, int whence)
#endif
/* These tests are based on fpurge.c. */
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
if (fp->_IO_read_end == fp->_IO_read_ptr
&& fp->_IO_write_ptr == fp->_IO_write_base
&& fp->_IO_save_base == NULL)
@@ -123,7 +123,7 @@ fseeko (FILE *fp, off_t offset, int whence)
return -1;
}
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
fp->_flags &= ~_IO_EOF_SEEN;
fp->_offset = pos;
#elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
diff --git a/lib/fseterr.c b/lib/fseterr.c
index 82649c3ac..adb637256 100644
--- a/lib/fseterr.c
+++ b/lib/fseterr.c
@@ -29,7 +29,7 @@ fseterr (FILE *fp)
/* Most systems provide FILE as a struct and the necessary bitmask in
<stdio.h>, because they need it for implementing getc() and putc() as
fast macros. */
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
fp->_flags |= _IO_ERR_SEEN;
#elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
diff --git a/lib/stdio-impl.h b/lib/stdio-impl.h
index 78d896e9f..05c5752a2 100644
--- a/lib/stdio-impl.h
+++ b/lib/stdio-impl.h
@@ -18,6 +18,12 @@
the same implementation of stdio extension API, except that some fields
have different naming conventions, or their access requires some casts. */
+/* Glibc 2.28 made _IO_IN_BACKUP private. For now, work around this
+ problem by defining it ourselves. FIXME: Do not rely on glibc
+ internals. */
+#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN
+# define _IO_IN_BACKUP 0x100
+#endif
/* BSD stdio derived implementations. */
--
2.14.3

View File

@ -1,38 +1,38 @@
From 21cd963565a43dabd59516bd4cca5c76a614f255 Mon Sep 17 00:00:00 2001
From: Jakub Martisko <jamartis@redhat.com>
Date: Tue, 26 Mar 2019 12:29:30 +0100
Subject: [PATCH] Fix: the value of the skip variable in the gzexe
---
gzexe.in | 4 ++--
tests/Makefile.am | 1 +
tests/gzexe | 20 ++++++++++++++++++++
3 files changed, 23 insertions(+), 2 deletions(-)
create mode 100755 tests/gzexe
diff --git a/gzexe.in b/gzexe.in
index 6c61183..cffa84e 100644
--- a/gzexe.in
+++ b/gzexe.in
@@ -145,7 +145,7 @@ for i do
if test $decomp -eq 0; then
(cat <<'EOF' &&
#!/bin/sh
-skip=44
+skip=49
tab=' '
nl='
@@ -201,7 +201,7 @@ EOF
else
# decompression
- skip=44
+ skip=49
skip_line=`sed -e 1d -e 2q "$file"`
case $skip_line in
skip=[0-9] | skip=[0-9][0-9] | skip=[0-9][0-9][0-9])
--
2.21.0
From 21cd963565a43dabd59516bd4cca5c76a614f255 Mon Sep 17 00:00:00 2001
From: Jakub Martisko <jamartis@redhat.com>
Date: Tue, 26 Mar 2019 12:29:30 +0100
Subject: [PATCH] Fix: the value of the skip variable in the gzexe
---
gzexe.in | 4 ++--
tests/Makefile.am | 1 +
tests/gzexe | 20 ++++++++++++++++++++
3 files changed, 23 insertions(+), 2 deletions(-)
create mode 100755 tests/gzexe
diff --git a/gzexe.in b/gzexe.in
index 6c61183..cffa84e 100644
--- a/gzexe.in
+++ b/gzexe.in
@@ -145,7 +145,7 @@ for i do
if test $decomp -eq 0; then
(cat <<'EOF' &&
#!/bin/sh
-skip=44
+skip=49
tab=' '
nl='
@@ -201,7 +201,7 @@ EOF
else
# decompression
- skip=44
+ skip=49
skip_line=`sed -e 1d -e 2q "$file"`
case $skip_line in
skip=[0-9] | skip=[0-9][0-9] | skip=[0-9][0-9][0-9])
--
2.21.0

BIN
gzip-1.10.tar.xz Normal file

Binary file not shown.

Binary file not shown.

View File

@ -1,37 +0,0 @@
From 26c140cf5377585d38d2a13a949e109724d4d406 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Fri, 30 Nov 2018 13:00:42 -0800
Subject: [PATCH 11/23] gzip: fix use of uninitialized memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Problem reported by Hanno Böck (Bug#33501).
* NEWS: Mention this.
* inflate.c (inflate_dynamic): Return if code is invalid.
Fix by Mark Adler.
* tests/hufts: Add test case for the bug.
---
inflate.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletion(-)
diff --git a/inflate.c b/inflate.c
index d372685..bcafcf1 100644
--- a/inflate.c
+++ b/inflate.c
@@ -799,6 +799,12 @@ inflate_dynamic(void)
NEEDBITS((unsigned)bl)
j = (td = tl + ((unsigned)b & m))->b;
DUMPBITS(j)
+ if (td->e == 99)
+ {
+ /* Invalid code. */
+ huft_free (tl);
+ return 2;
+ }
j = td->v.n;
if (j < 16) /* length of code in bits (0..15) */
ll[i++] = l = j; /* save last length in l */
--
1.8.3.1

View File

@ -1,21 +1,21 @@
Name: gzip
Version: 1.9
Release: 17
Version: 1.10
Release: 3
Summary: A data compression utility
License: GPLv3+ and GFDL
License: GPLv3+
URL: https://www.gnu.org/software/gzip
Source0: https://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
Source1: colorzgrep.csh
Source2: colorzgrep.sh
Patch0: gnulib.patch
Patch1: gzip-fix-use-of-uninitialized-memory.patch
Patch2: gzexe.patch
Patch0: gzexe.patch
Patch9000: fix-verbose-disable.patch
Patch9100: performance-neoncrc32-and-prfm.patch
BuildRequires: gcc texinfo
Patch6000: backport-0001-CVE-2022-1271.patch
Patch6001: backport-0002-CVE-2022-1271.patch
Patch6002: backport-0003-CVE-2022-1271.patch
BuildRequires: gcc texinfo automake autoconf
Requires: coreutils
Conflicts: filesystem < 3
Provides: /bin/gunzip
@ -37,15 +37,13 @@ has the suffix .gz.
%ifarch aarch64
export CFLAGS="${CFLAGS:-%optflags} -march=armv8-a+crc"
%endif
autoreconf
%configure
%make_build
%install
rm -rf %RPM_BUILD_ROOT
%make_install
mkdir -p %{buildroot}%{_sysconfdir}/profile.d
install -m 0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/profile.d
install -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/profile.d
# ncompress provides uncompress, may cause conflict.
rm -f %{buildroot}%{_bindir}/uncompress
@ -57,7 +55,6 @@ make check
%doc AUTHORS ChangeLog README
%license COPYING
%{_bindir}/*
%{_sysconfdir}/profile.d/*
%exclude %{_infodir}/dir
%files help
@ -66,6 +63,21 @@ make check
%{_mandir}/man1/*
%changelog
* Wed Apr 20 2022 shixuantong <shixuantong@h-partners.com> - 1.10-3
- fix CVE-2022-1271
* Thu Apr 14 2022 renhongxun <renhongxun@h-partners.com> - 1.10-2
- update license from GPLv3+,GFDL to GPLv3+
* Fri Apr 24 2020 BruceGW <gyl93216@163.com> - 1.10-1
- update upstream to 1.10
* Fri Jan 17 2020 openEuler Buildteam <buildteam@openeuler.org> - 1.9-18
- Type:performance improve
- ID:NA
- SUG:NA
- DESC:delete useless scripts for grep
* Mon Nov 11 2019 liqiang<liqiang64@huawei.com> - 1.9-17
- Type:performance improve
- ID:NA