diff options
Diffstat (limited to 'system/musl')
| -rw-r--r-- | system/musl/0001-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch | 38 | ||||
| -rw-r--r-- | system/musl/0002-iconv-harden-UTF-8-output-code-path-against-input-de.patch | 37 | ||||
| -rw-r--r-- | system/musl/APKBUILD | 11 | ||||
| -rw-r--r-- | system/musl/ppc-hwcap.patch | 36 |
4 files changed, 121 insertions, 1 deletions
diff --git a/system/musl/0001-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch b/system/musl/0001-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch new file mode 100644 index 000000000..ff92d8ef9 --- /dev/null +++ b/system/musl/0001-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch @@ -0,0 +1,38 @@ +From e5adcd97b5196e29991b524237381a0202a60659 Mon Sep 17 00:00:00 2001 +From: Rich Felker <dalias@aerifal.cx> +Date: Sun, 9 Feb 2025 10:07:19 -0500 +Subject: [PATCH] iconv: fix erroneous input validation in EUC-KR decoder + +as a result of incorrect bounds checking on the lead byte being +decoded, certain invalid inputs which should produce an encoding +error, such as "\xc8\x41", instead produced out-of-bounds loads from +the ksc table. + +in a worst case, the loaded value may not be a valid unicode scalar +value, in which case, if the output encoding was UTF-8, wctomb would +return (size_t)-1, causing an overflow in the output pointer and +remaining buffer size which could clobber memory outside of the output +buffer. + +bug report was submitted in private by Nick Wellnhofer on account of +potential security implications. +--- + src/locale/iconv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/locale/iconv.c b/src/locale/iconv.c +index 9605c8e9..008c93f0 100644 +--- a/src/locale/iconv.c ++++ b/src/locale/iconv.c +@@ -502,7 +502,7 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri + if (c >= 93 || d >= 94) { + c += (0xa1-0x81); + d += 0xa1; +- if (c >= 93 || c>=0xc6-0x81 && d>0x52) ++ if (c > 0xc6-0x81 || c==0xc6-0x81 && d>0x52) + goto ilseq; + if (d-'A'<26) d = d-'A'; + else if (d-'a'<26) d = d-'a'+26; +-- +2.21.0 + diff --git a/system/musl/0002-iconv-harden-UTF-8-output-code-path-against-input-de.patch b/system/musl/0002-iconv-harden-UTF-8-output-code-path-against-input-de.patch new file mode 100644 index 000000000..d66e66e3f --- /dev/null +++ b/system/musl/0002-iconv-harden-UTF-8-output-code-path-against-input-de.patch @@ -0,0 +1,37 @@ +From c47ad25ea3b484e10326f933e927c0bc8cded3da Mon Sep 17 00:00:00 2001 +From: Rich Felker <dalias@aerifal.cx> +Date: Wed, 12 Feb 2025 17:06:30 -0500 +Subject: [PATCH] iconv: harden UTF-8 output code path against input decoder + bugs + +the UTF-8 output code was written assuming an invariant that iconv's +decoders only emit valid Unicode Scalar Values which wctomb can encode +successfully, thereby always returning a value between 1 and 4. + +if this invariant is not satisfied, wctomb returns (size_t)-1, and the +subsequent adjustments to the output buffer pointer and remaining +output byte count overflow, moving the output position backwards, +potentially past the beginning of the buffer, without storing any +bytes. +--- + src/locale/iconv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/locale/iconv.c b/src/locale/iconv.c +index 008c93f0..52178950 100644 +--- a/src/locale/iconv.c ++++ b/src/locale/iconv.c +@@ -545,6 +545,10 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri + if (*outb < k) goto toobig; + memcpy(*out, tmp, k); + } else k = wctomb_utf8(*out, c); ++ /* This failure condition should be unreachable, but ++ * is included to prevent decoder bugs from translating ++ * into advancement outside the output buffer range. */ ++ if (k>4) goto ilseq; + *out += k; + *outb -= k; + break; +-- +2.21.0 + diff --git a/system/musl/APKBUILD b/system/musl/APKBUILD index 9816d009e..5951328a1 100644 --- a/system/musl/APKBUILD +++ b/system/musl/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=musl pkgver=1.2.3 -pkgrel=1 +pkgrel=3 pkgdesc="System library (libc) implementation" url="https://www.musl-libc.org/" arch="all" @@ -26,9 +26,13 @@ source="https://musl.libc.org/releases/musl-${pkgver}.tar.gz 3001-make-real-lastlog-h.patch handle-aux-at_base.patch fgetspent_r.patch + ppc-hwcap.patch realpath.patch signed-wchar_t-fixes.patch + 0001-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch + 0002-iconv-harden-UTF-8-output-code-path-against-input-de.patch + ldconfig getent.c iconv.c @@ -41,6 +45,8 @@ source="https://musl.libc.org/releases/musl-${pkgver}.tar.gz # - CVE-2019-14697 # 1.2.0-r2: # - CVE-2020-28928 +# 1.2.3-r3: +# - CVE-2025-26519 build() { [ "$BOOTSTRAP" = "nocc" ] && return 0 @@ -125,8 +131,11 @@ f7b05d8c5f804ba3ad6998b3de5fa4d9dfceac4aca63dd67298c2d5f27cdd28a91eba74f6e428c25 88ae443dbb8e0a4368235bdc3a1c5c7b718495afa75e06deb8e01becc76cb1f0d6964589e2204fc749c9c1b3190b8b9ac1ae2c0099cab8e2ce3ec877103d4332 3001-make-real-lastlog-h.patch 1f4e9aea5a546015c75f77aa0dec10d56fc14831ccc15cf71ff27fc15ac5230ffeadb382ebe1c87c1ea07a462620e16ed01cd36252d997d1a9c2af11cb5c9ff3 handle-aux-at_base.patch ded41235148930f8cf781538f7d63ecb0c65ea4e8ce792565f3649ee2523592a76b2a166785f0b145fc79f5852fd1fb1729a7a09110b3b8f85cba3912e790807 fgetspent_r.patch +96d88bb9c03f6eddcfc22cbd04efa73535f4ab78409954a042a2e08294cc8df1fb2cb0475eadb92a7fa281229abaa600f034d3ef08e918c6016dbf9be1db28d9 ppc-hwcap.patch d5ec3f1a86f2194e0af83c2391508811b939d0f8f2fd2ac5ac7f03774f8a250ce42399110d2ae04d32b864ee292863fed683a029b64598dbbcb21d9811a825d0 realpath.patch 3770af3bc961e5d5b8c152c428cd20dc54e026b23b31d764fbc2e71ee38140d160db2267755f23800bc8586fd4b51554b1caebb2415bef82fd0f4a6dd8bf640d signed-wchar_t-fixes.patch +a69f77c4b4c7fefb543f5a1678f981b001c35cdb4c0bb2dfb56548eebc88e725330b9961a5435d11e6e1e3185b508f1fd5bf72e6aa67b708a8e8186c4b33392a 0001-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch +c4777d653007ea3e2af5e3edf7804e5b5562823e41543991b7c04843203a6e93c1e1e2c63b178c8ed2f89411040230268d8a83ebc3018ad199aad958587c0faf 0002-iconv-harden-UTF-8-output-code-path-against-input-de.patch cb71d29a87f334c75ecbc911becde7be825ab30d8f39fa6d64cb53812a7c9abaf91d9804c72540e5be3ddd3c84cfe7fd9632274309005cb8bcdf9a9b09b4b923 ldconfig 378d70e65bcc65bb4e1415354cecfa54b0c1146dfb24474b69e418cdbf7ad730472cd09f6f103e1c99ba6c324c9560bccdf287f5889bbc3ef0bdf0e08da47413 getent.c 9d42d66fb1facce2b85dad919be5be819ee290bd26ca2db00982b2f8e055a0196290a008711cbe2b18ec9eee8d2270e3b3a4692c5a1b807013baa5c2b70a2bbf iconv.c" diff --git a/system/musl/ppc-hwcap.patch b/system/musl/ppc-hwcap.patch new file mode 100644 index 000000000..3ebd5c42b --- /dev/null +++ b/system/musl/ppc-hwcap.patch @@ -0,0 +1,36 @@ +From 2c788798c1f625c42e844311f5a5d2e19707d581 Mon Sep 17 00:00:00 2001 +From: "A. Wilcox" <AWilcox@Wilcox-Tech.com> +Date: Fri, 3 Jan 2025 13:36:33 -0600 +Subject: [PATCH] powerpc: Update HWCAP bits for Power10 + +Linux kernel commit ee988c11acf6f9464b7b44e9a091bf6afb3b3a49 added two +new HWCAP bits: one for ARCH_3_1, which is the Power10 ISA revision, and +one for MMA, which is the optional Matrix Multiply Assist extension. +--- + arch/powerpc/bits/hwcap.h | 2 ++ + arch/powerpc64/bits/hwcap.h | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/arch/powerpc/bits/hwcap.h b/arch/powerpc/bits/hwcap.h +index 803de9b5..12981623 100644 +--- a/arch/powerpc/bits/hwcap.h ++++ b/arch/powerpc/bits/hwcap.h +@@ -41,3 +41,5 @@ + #define PPC_FEATURE2_DARN 0x00200000 + #define PPC_FEATURE2_SCV 0x00100000 + #define PPC_FEATURE2_HTM_NO_SUSPEND 0x00080000 ++#define PPC_FEATURE2_ARCH_3_1 0x00040000 ++#define PPC_FEATURE2_MMA 0x00020000 +diff --git a/arch/powerpc64/bits/hwcap.h b/arch/powerpc64/bits/hwcap.h +index 803de9b5..12981623 100644 +--- a/arch/powerpc64/bits/hwcap.h ++++ b/arch/powerpc64/bits/hwcap.h +@@ -41,3 +41,5 @@ + #define PPC_FEATURE2_DARN 0x00200000 + #define PPC_FEATURE2_SCV 0x00100000 + #define PPC_FEATURE2_HTM_NO_SUSPEND 0x00080000 ++#define PPC_FEATURE2_ARCH_3_1 0x00040000 ++#define PPC_FEATURE2_MMA 0x00020000 +-- +2.40.0 + |