From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs. Date: Sun, 15 Jan 2017 15:49:22 -0500 Message-ID: <20170115204922.GB4522@jasmine> References: <20170112180655.1588-1-mbakke@fastmail.com> <20170112183017.GB23706@jasmine> <87wpe05adv.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <20170112200346.GA11411@jasmine> <87shonai6b.fsf@netris.org> <20170115184717.GA29718@jasmine> <87lgucxhwz.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="9zSXsLTf0vkW971A" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:59775) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cSrjz-0006jq-Vb for guix-devel@gnu.org; Sun, 15 Jan 2017 15:49:30 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cSrjw-0006Ab-Qm for guix-devel@gnu.org; Sun, 15 Jan 2017 15:49:28 -0500 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:53187) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cSrjw-0006AV-Fr for guix-devel@gnu.org; Sun, 15 Jan 2017 15:49:24 -0500 Content-Disposition: inline In-Reply-To: <87lgucxhwz.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Marius Bakke Cc: guix-devel@gnu.org --9zSXsLTf0vkW971A Content-Type: multipart/mixed; boundary="oyUTqETQ0mS9luUI" Content-Disposition: inline --oyUTqETQ0mS9luUI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Jan 15, 2017 at 08:05:48PM +0100, Marius Bakke wrote: > Is it possible to use the 'package-input-rewriting' procedure here? See > example at the end of section 5.1.0: >=20 > https://www.gnu.org/software/guix/manual/guix.html#Defining-Packages >=20 > Otherwise this LGTM, thanks a lot! Okay, please test this updated patch series :) --oyUTqETQ0mS9luUI Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: attachment; filename="0001-gnu-mupdf-Fix-CVE-2016-10132-10133-in-bundled-mujs.patch" Content-Transfer-Encoding: quoted-printable =46rom 34cc0dc9d9451d540f8733ebca2a3db54a073aa0 Mon Sep 17 00:00:00 2001 =46rom: Marius Bakke Date: Thu, 12 Jan 2017 19:06:55 +0100 Subject: [PATCH 1/2] gnu: mupdf: Fix CVE-2016-{10132,10133} in bundled mujs. * gnu/packages/patches/mupdf-mujs-CVE-2016-10132.patch, gnu/packages/patches/mupdf-mujs-CVE-2016-10133.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/pdf.scm (mupdf)[replacement]: New field. (mupdf/fixed): New variable. --- gnu/local.mk | 2 + .../patches/mupdf-mujs-CVE-2016-10132.patch | 188 +++++++++++++++++= ++++ .../patches/mupdf-mujs-CVE-2016-10133.patch | 36 ++++ gnu/packages/pdf.scm | 15 +- 4 files changed, 240 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/mupdf-mujs-CVE-2016-10132.patch create mode 100644 gnu/packages/patches/mupdf-mujs-CVE-2016-10133.patch diff --git a/gnu/local.mk b/gnu/local.mk index 81d774eb6..58554160d 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -755,6 +755,8 @@ dist_patch_DATA =3D \ %D%/packages/patches/multiqc-fix-git-subprocess-error.patch \ %D%/packages/patches/mumps-build-parallelism.patch \ %D%/packages/patches/mupdf-build-with-openjpeg-2.1.patch \ + %D%/packages/patches/mupdf-mujs-CVE-2016-10132.patch \ + %D%/packages/patches/mupdf-mujs-CVE-2016-10133.patch \ %D%/packages/patches/mupen64plus-ui-console-notice.patch \ %D%/packages/patches/musl-CVE-2016-8859.patch \ %D%/packages/patches/mutt-store-references.patch \ diff --git a/gnu/packages/patches/mupdf-mujs-CVE-2016-10132.patch b/gnu/pac= kages/patches/mupdf-mujs-CVE-2016-10132.patch new file mode 100644 index 000000000..e752e57ec --- /dev/null +++ b/gnu/packages/patches/mupdf-mujs-CVE-2016-10132.patch @@ -0,0 +1,188 @@ +Fix CVE-2016-10132: + +https://bugs.ghostscript.com/show_bug.cgi?id=3D697381 +http://seclists.org/oss-sec/2017/q1/74 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2016-10132 + +Patch lifted from upstream source repository: + +http://git.ghostscript.com/?p=3Dmujs.git;h=3Dfd003eceda531e13fbdd1aeb6e9c7= 3156496e569 + +From fd003eceda531e13fbdd1aeb6e9c73156496e569 Mon Sep 17 00:00:00 2001 +From: Tor Andersson +Date: Fri, 2 Dec 2016 14:56:20 -0500 +Subject: [PATCH] Fix 697381: check allocation when compiling regular + expressions. + +Also use allocator callback function. +--- + thirdparty/mujs/jsgc.c | 2 +- + thirdparty/mujs/jsregexp.c | 2 +- + thirdparty/mujs/jsstate.c | 6 ------ + thirdparty/mujs/regexp.c | 45 +++++++++++++++++++++++++++++++++++------= ---- + thirdparty/mujs/regexp.h | 7 +++++++ + 5 files changed, 44 insertions(+), 18 deletions(-) + +diff --git a/thirdparty/mujs/jsgc.c b/thirdparty/mujs/jsgc.c +index 4f7e7dc..f80111e 100644 +--- a/thirdparty/mujs/jsgc.c ++++ b/thirdparty/mujs/jsgc.c +@@ -46,7 +46,7 @@ static void jsG_freeobject(js_State *J, js_Object *obj) + jsG_freeproperty(J, obj->head); + if (obj->type =3D=3D JS_CREGEXP) { + js_free(J, obj->u.r.source); +- js_regfree(obj->u.r.prog); ++ js_regfreex(J->alloc, J->actx, obj->u.r.prog); + } + if (obj->type =3D=3D JS_CITERATOR) + jsG_freeiterator(J, obj->u.iter.head); +diff --git a/thirdparty/mujs/jsregexp.c b/thirdparty/mujs/jsregexp.c +index a2d5156..7b09c06 100644 +--- a/thirdparty/mujs/jsregexp.c ++++ b/thirdparty/mujs/jsregexp.c +@@ -16,7 +16,7 @@ void js_newregexp(js_State *J, const char *pattern, int = flags) + if (flags & JS_REGEXP_I) opts |=3D REG_ICASE; + if (flags & JS_REGEXP_M) opts |=3D REG_NEWLINE; +=20 +- prog =3D js_regcomp(pattern, opts, &error); ++ prog =3D js_regcompx(J->alloc, J->actx, pattern, opts, &error); + if (!prog) + js_syntaxerror(J, "regular expression: %s", error); +=20 +diff --git a/thirdparty/mujs/jsstate.c b/thirdparty/mujs/jsstate.c +index 638cab3..fd5bcf6 100644 +--- a/thirdparty/mujs/jsstate.c ++++ b/thirdparty/mujs/jsstate.c +@@ -9,12 +9,6 @@ +=20 + static void *js_defaultalloc(void *actx, void *ptr, int size) + { +- if (size =3D=3D 0) { +- free(ptr); +- return NULL; +- } +- if (!ptr) +- return malloc((size_t)size); + return realloc(ptr, (size_t)size); + } +=20 +diff --git a/thirdparty/mujs/regexp.c b/thirdparty/mujs/regexp.c +index 9852be2..01c18a3 100644 +--- a/thirdparty/mujs/regexp.c ++++ b/thirdparty/mujs/regexp.c +@@ -807,23 +807,31 @@ static void dumpprog(Reprog *prog) + } + #endif +=20 +-Reprog *regcomp(const char *pattern, int cflags, const char **errorp) ++Reprog *regcompx(void *(*alloc)(void *ctx, void *p, int n), void *ctx, ++ const char *pattern, int cflags, const char **errorp) + { + struct cstate g; + Renode *node; + Reinst *split, *jump; + int i; +=20 +- g.prog =3D malloc(sizeof (Reprog)); +- g.pstart =3D g.pend =3D malloc(sizeof (Renode) * strlen(pattern) * 2); ++ g.pstart =3D NULL; ++ g.prog =3D NULL; +=20 + if (setjmp(g.kaboom)) { + if (errorp) *errorp =3D g.error; +- free(g.pstart); +- free(g.prog); ++ alloc(ctx, g.pstart, 0); ++ alloc(ctx, g.prog, 0); + return NULL; + } +=20 ++ g.prog =3D alloc(ctx, NULL, sizeof (Reprog)); ++ if (!g.prog) ++ die(&g, "cannot allocate regular expression"); ++ g.pstart =3D g.pend =3D alloc(ctx, NULL, sizeof (Renode) * strlen(patter= n) * 2); ++ if (!g.pstart) ++ die(&g, "cannot allocate regular expression parse list"); ++ + g.source =3D pattern; + g.ncclass =3D 0; + g.nsub =3D 1; +@@ -840,7 +848,9 @@ Reprog *regcomp(const char *pattern, int cflags, const= char **errorp) + die(&g, "syntax error"); +=20 + g.prog->nsub =3D g.nsub; +- g.prog->start =3D g.prog->end =3D malloc((count(node) + 6) * sizeof (Rei= nst)); ++ g.prog->start =3D g.prog->end =3D alloc(ctx, NULL, (count(node) + 6) * s= izeof (Reinst)); ++ if (!g.prog->start) ++ die(&g, "cannot allocate regular expression instruction list"); +=20 + split =3D emit(g.prog, I_SPLIT); + split->x =3D split + 3; +@@ -859,20 +869,35 @@ Reprog *regcomp(const char *pattern, int cflags, con= st char **errorp) + dumpprog(g.prog); + #endif +=20 +- free(g.pstart); ++ alloc(ctx, g.pstart, 0); +=20 + if (errorp) *errorp =3D NULL; + return g.prog; + } +=20 +-void regfree(Reprog *prog) ++void regfreex(void *(*alloc)(void *ctx, void *p, int n), void *ctx, Repro= g *prog) + { + if (prog) { +- free(prog->start); +- free(prog); ++ alloc(ctx, prog->start, 0); ++ alloc(ctx, prog, 0); + } + } +=20 ++static void *default_alloc(void *ctx, void *p, int n) ++{ ++ return realloc(p, (size_t)n); ++} ++ ++Reprog *regcomp(const char *pattern, int cflags, const char **errorp) ++{ ++ return regcompx(default_alloc, NULL, pattern, cflags, errorp); ++} ++ ++void regfree(Reprog *prog) ++{ ++ regfreex(default_alloc, NULL, prog); ++} ++ + /* Match */ +=20 + static int isnewline(int c) +diff --git a/thirdparty/mujs/regexp.h b/thirdparty/mujs/regexp.h +index 4bb4615..6bb73e8 100644 +--- a/thirdparty/mujs/regexp.h ++++ b/thirdparty/mujs/regexp.h +@@ -1,6 +1,8 @@ + #ifndef regexp_h + #define regexp_h +=20 ++#define regcompx js_regcompx ++#define regfreex js_regfreex + #define regcomp js_regcomp + #define regexec js_regexec + #define regfree js_regfree +@@ -8,6 +10,11 @@ + typedef struct Reprog Reprog; + typedef struct Resub Resub; +=20 ++Reprog *regcompx(void *(*alloc)(void *ctx, void *p, int n), void *ctx, ++ const char *pattern, int cflags, const char **errorp); ++void regfreex(void *(*alloc)(void *ctx, void *p, int n), void *ctx, ++ Reprog *prog); ++ + Reprog *regcomp(const char *pattern, int cflags, const char **errorp); + int regexec(Reprog *prog, const char *string, Resub *sub, int eflags); + void regfree(Reprog *prog); +--=20 +2.9.1 + diff --git a/gnu/packages/patches/mupdf-mujs-CVE-2016-10133.patch b/gnu/pac= kages/patches/mupdf-mujs-CVE-2016-10133.patch new file mode 100644 index 000000000..d73849262 --- /dev/null +++ b/gnu/packages/patches/mupdf-mujs-CVE-2016-10133.patch @@ -0,0 +1,36 @@ +Fix CVE-2016-10133: + +https://bugs.ghostscript.com/show_bug.cgi?id=3D697401 +http://seclists.org/oss-sec/2017/q1/74 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2016-10133 + +Patch lifted from upstream source repository: + +https://git.ghostscript.com/?p=3Dmujs.git;h=3D77ab465f1c394bb77f00966cd950= 650f3f53cb24 + +From 77ab465f1c394bb77f00966cd950650f3f53cb24 Mon Sep 17 00:00:00 2001 +From: Tor Andersson +Date: Thu, 12 Jan 2017 14:47:01 +0100 +Subject: [PATCH] Fix 697401: Error when dropping extra arguments to + lightweight functions. + +--- + thirdparty/mujs/jsrun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/thirdparty/mujs/jsrun.c b/thirdparty/mujs/jsrun.c +index ee80845..782a6f9 100644 +--- a/thirdparty/mujs/jsrun.c ++++ b/thirdparty/mujs/jsrun.c +@@ -937,7 +937,7 @@ static void jsR_calllwfunction(js_State *J, int n, js_= Function *F, js_Environmen + jsR_savescope(J, scope); +=20 + if (n > F->numparams) { +- js_pop(J, F->numparams - n); ++ js_pop(J, n - F->numparams); + n =3D F->numparams; + } + for (i =3D n; i < F->varlen; ++i) +--=20 +2.9.1 + diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm index 9b3571e67..5efc5e6d1 100644 --- a/gnu/packages/pdf.scm +++ b/gnu/packages/pdf.scm @@ -6,10 +6,11 @@ ;;; Copyright =A9 2016 Roel Janssen ;;; Coypright =A9 2016 ng0 ;;; Coypright =A9 2016 Efraim Flashner -;;; Coypright =A9 2016 Marius Bakke +;;; Coypright =A9 2016, 2017 Marius Bakke ;;; Coypright =A9 2016 Ludovic Court=E8s ;;; Coypright =A9 2016 Julien Lepiller ;;; Copyright =A9 2016 Arun Isaac +;;; Copyright =A9 2017 Leo Famulari ;;; ;;; This file is part of GNU Guix. ;;; @@ -538,6 +539,18 @@ line tools for batch rendering (pdfdraw), rewriting fi= les (pdfclean), and examining the file structure (pdfshow).") (license license:agpl3+))) =20 +(define mupdf/fixed + (package + (inherit mupdf) + (source + (origin + (inherit (package-source mupdf)) + (patches + (append + (origin-patches (package-source mupdf)) + (search-patches "mupdf-mujs-CVE-2016-10132.patch" + "mupdf-mujs-CVE-2016-10133.patch"))))))) + (define-public qpdf (package (name "qpdf") --=20 2.11.0 --oyUTqETQ0mS9luUI Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: attachment; filename="0002-gnu-cups-filters-Fix-CVE-2016-10132-10133-in-statica.patch" Content-Transfer-Encoding: quoted-printable =46rom 58de4daf7fea3a2196fe055404d685930b2b57b4 Mon Sep 17 00:00:00 2001 =46rom: Leo Famulari Date: Sun, 15 Jan 2017 13:38:48 -0500 Subject: [PATCH 2/2] gnu: cups-filters: Fix CVE-2016-{10132,10133} in statically linked mupdf. The vulnerabilities are the MuJS that is bundled with MuPDF. * gnu/packages/cups.scm (cups-filters)[replacement]: New field. (mupdf/fixed-instead-of-mupdf), (cups-filters/fixed): New variables. --- gnu/packages/cups.scm | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm index ca1695835..fa96b2327 100644 --- a/gnu/packages/cups.scm +++ b/gnu/packages/cups.scm @@ -3,6 +3,7 @@ ;;; Copyright =A9 2015, 2016 Ludovic Court=E8s ;;; Copyright =A9 2015, 2016 Efraim Flashner ;;; Copyright =A9 2016 Danny Milosavljevic +;;; Copyright =A9 2017 Leo Famulari ;;; ;;; This file is part of GNU Guix. ;;; @@ -51,6 +52,7 @@ (define-public cups-filters (package (name "cups-filters") + (replacement cups-filters/fixed) (version "1.13.1") (source(origin (method url-fetch) @@ -133,6 +135,12 @@ filters for the PDF-centric printing workflow introduc= ed by OpenPrinting.") license:lgpl2.0+ license:expat)))) =20 +(define mupdf/fixed-instead-of-mupdf + (package-input-rewriting `((,mupdf . ,(@@ (gnu packages pdf) mupdf/fixed= ))))) + +(define cups-filters/fixed + (mupdf/fixed-instead-of-mupdf cups-filters)) + ;; CUPS on non-MacOS systems requires cups-filters. Since cups-filters al= so ;; depends on CUPS libraries and binaries, cups-minimal has been added to ;; satisfy this dependency. --=20 2.11.0 --oyUTqETQ0mS9luUI-- --9zSXsLTf0vkW971A Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlh74E0ACgkQJkb6MLrK fwg6DhAAx+hcrWXl/sOLOZ27P6QE6xXH6HTgKk67DpJSOy+2R67rYAIFGmPxkRJb 9dYv4fDDLjU5rDHVJaEgtBMh3K6x9FSlzZUp5vDXYDu/k/z0eyhYJNLdNIM4nb4q v/e95Xr/38TW4bhYaBsIAOg6S/TEg5JP4gfAuIc49h3SJ0HpArBLOATeyGosC1qL t5lhB8cY0Dt7bBh4GKGhBnXAo9wHkUBLxDIBXqjk/I9VevAvURsKWesxoBxmG+eS /fKMOkYre1GWvP7fUx3MPoHKsG8+U+q/7qDEICa1tbYCxcrPWYo3M5oNUegUeMoD oZG3I4dL5u1e0Aeqo5YxW2UddZOtzhqhBTuidB5RZBgLkKYY4AxgsXI+FWhgVNXk 0upzks+vDcpZVSDZ59XG5p3H6RGBrf/P3pscK/1CG1Q5cnsGGwk2Q1hThWjm0ivI CdAFZGaAgi9sAjWxaWsIMgRc5D2bkM5V4yu5/TGxwFjI+ZEzCLlKNzB/Hgc6OR56 zz52rpEVctmeI+Y6zclVQiDMR+Skia3LU2jjg1RsK7gvzDrpUrCb4ThgbyKaG1v8 pL2yuKc1eTd51Xc16q0rN6+M5ynaj2iTuzlXrxVchcCXSJibxCA7iGPAGWziGuJ9 fdyfPod1NwkzA52MjivkKyG7V7NzcckXKVB8yZxcersiN5W4/R8= =J19o -----END PGP SIGNATURE----- --9zSXsLTf0vkW971A--