X-Original-To: alpine-aports@lists.alpinelinux.org Received: from mail-lf0-f68.google.com (mail-lf0-f68.google.com [209.85.215.68]) by lists.alpinelinux.org (Postfix) with ESMTP id 7E4A75C46C1 for ; Wed, 5 Apr 2017 05:35:31 +0000 (GMT) Received: by mail-lf0-f68.google.com with SMTP id x137so238867lff.1 for ; Tue, 04 Apr 2017 22:35:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=HvJnwjkFOx0wmf/ewpIAn6wvOQdRjgn/uLrk0V+hy48=; b=D3u8CO57OCaXJZa80lVM2KvhRC+5D2iLC0lixTsIsOnfOTx0472AHNTf6BxdI1PpD8 xtHkCl6SG1ft0B7ktWuDmLEGBNgbJuxejcgWd6eznRP2K1q1n8qUKg9m6KDjmG59vWTe 5jB8Sqp5VpTFJPA6P2LbIbfCQJW81nTL1zwvXeFmW31hnF4OyO748abZbyWhRMXxFTT0 64N51QGRjR2ynSsYP/rEl+5yajkifXVcN3VXw+cHMMhblFYltImmkSeZ3wogUqQWL5Rv pO1mR4SiHpY2ZVsnxlpt8X47zOesIfgaQbouYTp5V59493OnTB8SOCQ1ogPNuDkq8wf5 30kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=HvJnwjkFOx0wmf/ewpIAn6wvOQdRjgn/uLrk0V+hy48=; b=eiplpLYOzUboouMtWtk74KwKDBleD9GI0WDavd3xnjW62p1T5UeeBAMG1dD5K6PO03 14So+ciBtI6YFqZYa0KKadIsYrKGmsLxVfBFdg3a/o9FVcEfbDZuqDTuPyUPZ5Nm6zOH MNf7jXm+/2TNRZ4jKm3IXMDLjC90SvrsO0dCCre+4vLCB5YlHQNBSD7UNtINEpWyDgHX L3otoISIwBpWB8LBmaujjaURY0nywk1YHed+PRAHvoEYFBPSedxjMPu74bnEH8XVDA4R EDeM+2yiQAB/BdBlsJUU4JAPX0PktDiD+IYScLrqKiivZfDXE4z0fCv6VtQXoMu8UbMj qtEw== X-Gm-Message-State: AFeK/H3PDN2xFT7HTIqkOLypH3lJRdLgrjdyvRfs0pVZGRBJav7W/jTpkVWfYutA/rc2RQ== X-Received: by 10.25.192.5 with SMTP id q5mr8932125lff.38.1491370530510; Tue, 04 Apr 2017 22:35:30 -0700 (PDT) Received: from edge.util.wtbts.net ([83.145.235.199]) by smtp.gmail.com with ESMTPSA id f19sm3594360lji.69.2017.04.04.22.35.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 04 Apr 2017 22:35:29 -0700 (PDT) From: Sergei Lukin To: alpine-aports@lists.alpinelinux.org Cc: Sergei Lukin Subject: [alpine-aports] [PATCH edge] main/pcre: security upgrade (CVE-2017-7186) ref #7068 Date: Wed, 5 Apr 2017 05:35:21 +0000 Message-Id: <20170405053521.17012-1-sergej.lukin@gmail.com> X-Mailer: git-send-email 2.12.2 X-Mailinglist: alpine-aports Precedence: list List-Id: Alpine Development List-Unsubscribe: List-Post: List-Help: List-Subscribe: --- main/pcre/APKBUILD | 15 +++++++++--- main/pcre/CVE-2017-7186.patch | 57 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 3 deletions(-) create mode 100644 main/pcre/CVE-2017-7186.patch diff --git a/main/pcre/APKBUILD b/main/pcre/APKBUILD index f4cf6bf4aa..123eda15bb 100644 --- a/main/pcre/APKBUILD +++ b/main/pcre/APKBUILD @@ -1,7 +1,8 @@ +# Contributor: Sergei Lukin # Maintainer: Natanael Copa pkgname=pcre pkgver=8.40 -pkgrel=1 +pkgrel=2 pkgdesc="Perl-compatible regular expression library" url="http://pcre.sourceforge.net" arch="all" @@ -10,7 +11,14 @@ depends= makedepends="" subpackages="$pkgname-dev $pkgname-doc $pkgname-tools libpcrecpp libpcre16 libpcre32" -source="ftp://ftp.csx.cam.ac.uk/pub/software/programming/$pkgname/$pkgname-$pkgver.tar.bz2" +source="ftp://ftp.csx.cam.ac.uk/pub/software/programming/$pkgname/$pkgname-$pkgver.tar.bz2 + CVE-2017-7186.patch + " + +# secfixes: +# 8.40-r2: +# - CVE-2017-7186.patch + builddir="$srcdir/$pkgname-$pkgver" build() { @@ -63,4 +71,5 @@ tools() { mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ } -sha512sums="b4c27eafbdf33bd7a1384655b1936f4be3bc6745c072347eb26e988896c52664bd85ac42444da1be78b6e20f45b6c7e5921f5f20f5b0741b5bd3d9844e5bd4e2 pcre-8.40.tar.bz2" +sha512sums="b4c27eafbdf33bd7a1384655b1936f4be3bc6745c072347eb26e988896c52664bd85ac42444da1be78b6e20f45b6c7e5921f5f20f5b0741b5bd3d9844e5bd4e2 pcre-8.40.tar.bz2 +3644a2d9895a974192dfe778e5dcdbf0eacc592ccedeb37caf3d9426668ee8fda5fc16f87e38c112943e619d1b35a498ccbf4b4a1c2da58821198bbcc180be31 CVE-2017-7186.patch" diff --git a/main/pcre/CVE-2017-7186.patch b/main/pcre/CVE-2017-7186.patch new file mode 100644 index 0000000000..256325b563 --- /dev/null +++ b/main/pcre/CVE-2017-7186.patch @@ -0,0 +1,57 @@ +Patch source: +https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date +https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date + +--- a/pcre_internal.h 2016/05/21 13:34:44 1649 ++++ b/pcre_internal.h 2017/02/24 17:30:30 1688 +@@ -2772,6 +2772,9 @@ + extern const pcre_uint16 PRIV(ucd_stage2)[]; + extern const pcre_uint32 PRIV(ucp_gentype)[]; + extern const pcre_uint32 PRIV(ucp_gbtable)[]; ++#ifdef COMPILE_PCRE32 ++extern const ucd_record PRIV(dummy_ucd_record)[]; ++#endif + #ifdef SUPPORT_JIT + extern const int PRIV(ucp_typerange)[]; + #endif +@@ -2780,9 +2783,15 @@ + /* UCD access macros */ + + #define UCD_BLOCK_SIZE 128 +-#define GET_UCD(ch) (PRIV(ucd_records) + \ ++#define REAL_GET_UCD(ch) (PRIV(ucd_records) + \ + PRIV(ucd_stage2)[PRIV(ucd_stage1)[(int)(ch) / UCD_BLOCK_SIZE] * \ + UCD_BLOCK_SIZE + (int)(ch) % UCD_BLOCK_SIZE]) ++ ++#ifdef COMPILE_PCRE32 ++#define GET_UCD(ch) ((ch > 0x10ffff)? PRIV(dummy_ucd_record) : REAL_GET_UCD(ch)) ++#else ++#define GET_UCD(ch) REAL_GET_UCD(ch) ++#endif + + #define UCD_CHARTYPE(ch) GET_UCD(ch)->chartype + #define UCD_SCRIPT(ch) GET_UCD(ch)->script + +--- a/pcre_ucd.c 2014/06/19 07:51:39 1490 ++++ a/pcre_ucd.c 2017/02/24 17:30:30 1688 +@@ -38,6 +38,20 @@ + const pcre_uint32 PRIV(ucd_caseless_sets)[] = {0}; + #else + ++/* If the 32-bit library is run in non-32-bit mode, character values ++greater than 0x10ffff may be encountered. For these we set up a ++special record. */ ++ ++#ifdef COMPILE_PCRE32 ++const ucd_record PRIV(dummy_ucd_record)[] = {{ ++ ucp_Common, /* script */ ++ ucp_Cn, /* type unassigned */ ++ ucp_gbOther, /* grapheme break property */ ++ 0, /* case set */ ++ 0, /* other case */ ++ }}; ++#endif ++ + /* When recompiling tables with a new Unicode version, please check the + types in this structure definition from pcre_internal.h (the actual + field names will be different): -- 2.12.2 --- Unsubscribe: alpine-aports+unsubscribe@lists.alpinelinux.org Help: alpine-aports+help@lists.alpinelinux.org ---