[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
01/01: gnu: pcre2: Fix CVE-2016-3191.
|
From: |
Leo Famulari |
|
Subject: |
01/01: gnu: pcre2: Fix CVE-2016-3191. |
|
Date: |
Mon, 30 May 2016 03:57:50 +0000 (UTC) |
lfam pushed a commit to branch master
in repository guix.
commit ccda7c8317fcbcdf929d6f8a183d4dbd2f5c1391
Author: Leo Famulari <address@hidden>
Date: Sun May 29 14:38:54 2016 -0400
gnu: pcre2: Fix CVE-2016-3191.
* gnu/packages/patches/pcre2-CVE-2016-3191.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/pcre.scm (pcre2): Use it.
---
gnu/local.mk | 1 +
gnu/packages/patches/pcre2-CVE-2016-3191.patch | 179 ++++++++++++++++++++++++
gnu/packages/pcre.scm | 2 +
3 files changed, 182 insertions(+)
diff --git a/gnu/local.mk b/gnu/local.mk
index eab390d..66d7c62 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -665,6 +665,7 @@ dist_patch_DATA =
\
%D%/packages/patches/patchutils-xfail-gendiff-tests.patch \
%D%/packages/patches/patch-hurd-path-max.patch \
%D%/packages/patches/pcre-CVE-2016-3191.patch \
+ %D%/packages/patches/pcre2-CVE-2016-3191.patch \
%D%/packages/patches/perl-CVE-2015-8607.patch \
%D%/packages/patches/perl-CVE-2016-2381.patch \
%D%/packages/patches/perl-autosplit-default-time.patch \
diff --git a/gnu/packages/patches/pcre2-CVE-2016-3191.patch
b/gnu/packages/patches/pcre2-CVE-2016-3191.patch
new file mode 100644
index 0000000..80f9d3d
--- /dev/null
+++ b/gnu/packages/patches/pcre2-CVE-2016-3191.patch
@@ -0,0 +1,179 @@
+Fixes CVE-2016-3191 (remote execution of arbitrary code or denial of
+service (stack-based buffer overflow) via a crafted regular expression).
+
+See <https://bugzilla.redhat.com/show_bug.cgi?id=1311503>.
+
+This is svn r489 at <svn://vcs.exim.org/pcre2/code>, omitting the
+changes to 'testdata/testoutput8-16-4', which does not exist in the
+source tarball.
+
+git-svn-id: svn://vcs.exim.org/pcre2/code/address@hidden
6239d852-aaf2-0410-a92c-79f79f948069
+---
+ ChangeLog | 4 ++++
+ src/pcre2_compile.c | 16 ++++++++++++++--
+ testdata/testinput8 | 2 ++
+ testdata/testoutput8-16-2 | 3 +++
+ testdata/testoutput8-16-3 | 3 +++
+ testdata/testoutput8-16-4 | 3 +++
+ testdata/testoutput8-32-2 | 3 +++
+ testdata/testoutput8-32-3 | 3 +++
+ testdata/testoutput8-32-4 | 3 +++
+ testdata/testoutput8-8-2 | 3 +++
+ testdata/testoutput8-8-3 | 3 +++
+ testdata/testoutput8-8-4 | 3 +++
+ 12 files changed, 47 insertions(+), 2 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 3ce0207..65e333e 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -58,6 +58,10 @@ some head-scratching the next time this happens.
+ assertion, caused pcre2test to output a very large number of spaces when the
+ callout was taken, making the program appearing to loop.
+
++12. A pattern that included (*ACCEPT) in the middle of a sufficiently deeply
++nested set of parentheses of sufficient size caused an overflow of the
++compiling workspace (which was diagnosed, but of course is not desirable).
++
+
+ Version 10.21 12-January-2016
+ -----------------------------
+diff --git a/src/pcre2_compile.c b/src/pcre2_compile.c
+index e33d620..887fbfd 100644
+--- a/src/pcre2_compile.c
++++ b/src/pcre2_compile.c
+@@ -5901,10 +5901,22 @@ for (;; ptr++)
+ goto FAILED;
+ }
+ cb->had_accept = TRUE;
++
++ /* In the first pass, just accumulate the length required;
++ otherwise hitting (*ACCEPT) inside many nested parentheses can
++ cause workspace overflow. */
++
+ for (oc = cb->open_caps; oc != NULL; oc = oc->next)
+ {
+- *code++ = OP_CLOSE;
+- PUT2INC(code, 0, oc->number);
++ if (lengthptr != NULL)
++ {
++ *lengthptr += CU2BYTES(1) + IMM2_SIZE;
++ }
++ else
++ {
++ *code++ = OP_CLOSE;
++ PUT2INC(code, 0, oc->number);
++ }
+ }
+ setverb = *code++ =
+ (cb->assert_depth > 0)? OP_ASSERT_ACCEPT : OP_ACCEPT;
+diff --git a/testdata/testinput8 b/testdata/testinput8
+index ca3b1b9..7e2a1f0 100644
+--- a/testdata/testinput8
++++ b/testdata/testinput8
+@@ -182,4 +182,6 @@
+
+
/((?1)(?2)(?3)(?4)(?5)(?6)(?7)(?8)(?9)(?9)(?8)(?7)(?6)(?5)(?4)(?3)(?2)(?1)(?0)){2,}()()()()()()()()()/debug
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-16-2 b/testdata/testoutput8-16-2
+index 05669bb..a5e8dec 100644
+--- a/testdata/testoutput8-16-2
++++ b/testdata/testoutput8-16-2
+@@ -1027,4 +1027,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 186 at offset 490: regular expression is too complicated
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-16-3 b/testdata/testoutput8-16-3
+index 31884e1..36133b3 100644
+--- a/testdata/testoutput8-16-3
++++ b/testdata/testoutput8-16-3
+@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 114 at offset 509: missing closing parenthesis
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-32-2 b/testdata/testoutput8-32-2
+index babd0c7..99c4fad 100644
+--- a/testdata/testoutput8-32-2
++++ b/testdata/testoutput8-32-2
+@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 114 at offset 509: missing closing parenthesis
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-32-3 b/testdata/testoutput8-32-3
+index babd0c7..99c4fad 100644
+--- a/testdata/testoutput8-32-3
++++ b/testdata/testoutput8-32-3
+@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 114 at offset 509: missing closing parenthesis
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-32-4 b/testdata/testoutput8-32-4
+index babd0c7..99c4fad 100644
+--- a/testdata/testoutput8-32-4
++++ b/testdata/testoutput8-32-4
+@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 114 at offset 509: missing closing parenthesis
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-8-2 b/testdata/testoutput8-8-2
+index 6a9aa0a..6dc1f42 100644
+--- a/testdata/testoutput8-8-2
++++ b/testdata/testoutput8-8-2
+@@ -1026,4 +1026,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 114 at offset 509: missing closing parenthesis
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-8-3 b/testdata/testoutput8-8-3
+index 2fe1168..ae14946 100644
+--- a/testdata/testoutput8-8-3
++++ b/testdata/testoutput8-8-3
+@@ -1024,4 +1024,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 114 at offset 509: missing closing parenthesis
++
+ # End of testinput8
+diff --git a/testdata/testoutput8-8-4 b/testdata/testoutput8-8-4
+index 91993b2..6c79956 100644
+--- a/testdata/testoutput8-8-4
++++ b/testdata/testoutput8-8-4
+@@ -1022,4 +1022,7 @@ Capturing subpattern count = 10
+ May match empty string
+ Subject length lower bound = 0
+
++/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]
[...]
++Failed: error 114 at offset 509: missing closing parenthesis
++
+ # End of testinput8
+--
+2.8.3
+
diff --git a/gnu/packages/pcre.scm b/gnu/packages/pcre.scm
index 24ecf90..e954492 100644
--- a/gnu/packages/pcre.scm
+++ b/gnu/packages/pcre.scm
@@ -2,6 +2,7 @@
;;; Copyright © 2013 Andreas Enge <address@hidden>
;;; Copyright © 2014, 2015 Mark H Weaver <address@hidden>
;;; Copyright © 2015 Ricardo Wurmus <address@hidden>
+;;; Copyright © 2016 Leo Famulari <address@hidden>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -83,6 +84,7 @@ POSIX regular expression API.")
(uri (string-append "mirror://sourceforge/pcre/pcre2/"
version "/pcre2-" version ".tar.bz2"))
+ (patches (search-patches "pcre2-CVE-2016-3191.patch"))
(sha256
(base32
"1q6lrj9b08l1q39vxipb0fi88x6ybvkr6439h8bjb9r8jd81fsn6"))))