main/musl: security fix for CVE-2020-28928

2 files changed, 73 insertions, 2 deletions

diff --git a/main/musl/APKBUILD b/main/musl/APKBUILD
index 4c7621ae73c..e29e5240635 100644
--- a/main/musl/APKBUILD
+++ b/main/musl/APKBUILD
@@ -1,8 +1,8 @@
-# Contributor:
+# Contributor: Ariadne Conill <ariadne@dereferenced.org>
 # Maintainer: Timo Teräs <timo.teras@iki.fi>
 pkgname=musl
 pkgver=1.1.24
-pkgrel=2
+pkgrel=3
 pkgdesc="the musl c library (libc) implementation"
 url="https://musl.libc.org/"
 arch="all"
@@ -12,6 +12,7 @@ subpackages="$pkgname-libintl:libintl:noarch
 	$pkgname-dbg
 	libc6-compat:compat:noarch
 	"
+options="lib64"
 case "$BOOTSTRAP" in
 nocc)	pkgname="musl-dev"; subpackages="";;
 nolibc) ;;
@@ -27,6 +28,8 @@ source="https://musl.libc.org/releases/musl-$pkgver.tar.gz
 	fix-return-value-of-ungetc-when-argument-is-outside-.patch
 	fix-errno-for-posix_openpt-with-no-free-ptys-availab.patch
 
+	wcsnrtombs-cve-2020-28928.diff
+
 	ldconfig
 	__stack_chk_fail_local.c
 	getconf.c
@@ -35,6 +38,8 @@ source="https://musl.libc.org/releases/musl-$pkgver.tar.gz
 	"
 
 # secfixes:
+#   1.1.24-r3:
+#     - CVE-2020-28928
 #   1.1.23-r2:
 #     - CVE-2019-14697
 #   1.1.15-r4:
@@ -175,6 +180,7 @@ sha512sums="8987f1e194ea616f34f4f21fe9def28fb7f81d7060e38619206c6349f79db3bbb76b
 41934951bbc16f155d40824abf30d818b4c124f668f74f5a13674b5251650bb9d9bf9fde0b75462bb2a4b80dc00871ba122960fa027998e71970d533df1cb987  fix-incorrect-results-for-catanf-and-catanl-with-som.patch
 81bddb171fc2171a7aa86e74bf674e3a99508d27416dfc1cfcf2824f17b33ee7dda7c5968a8a69a542fdd6eecded5b8e3973e81079d9a061aa80142d08fc1a90  fix-return-value-of-ungetc-when-argument-is-outside-.patch
 144b4525483cbc97f0414955b7e5ce42c9ff69580e5be714b56330da30b0687911bd6019aef3c8611bd0a5bd7671d690b66b4920ae47cf3442a1c982ed000e22  fix-errno-for-posix_openpt-with-no-free-ptys-availab.patch
+35dc5df28d90d1c84f9100116b63ba9e7fd44a20f512d12760da5e01f1aec4e799f726cbafb586bae568ff4f6d5a70948f1bf9fb901f1ca7dfcdf35c5d7510a6  wcsnrtombs-cve-2020-28928.diff
 8d3a2d5315fc56fee7da9abb8b89bb38c6046c33d154c10d168fb35bfde6b0cf9f13042a3bceee34daf091bc409d699223735dcf19f382eeee1f6be34154f26f  ldconfig
 062bb49fa54839010acd4af113e20f7263dde1c8a2ca359b5fb2661ef9ed9d84a0f7c3bc10c25dcfa10bb3c5a4874588dff636ac43d5dbb3d748d75400756d0b  __stack_chk_fail_local.c
 0d80f37b34a35e3d14b012257c50862dfeb9d2c81139ea2dfa101d981d093b009b9fa450ba27a708ac59377a48626971dfc58e20a3799084a65777a0c32cbc7d  getconf.c
diff --git a/main/musl/wcsnrtombs-cve-2020-28928.diff b/main/musl/wcsnrtombs-cve-2020-28928.diff
new file mode 100644
index 00000000000..8465f9422a8
--- /dev/null
+++ b/main/musl/wcsnrtombs-cve-2020-28928.diff
@@ -0,0 +1,65 @@
+diff --git a/src/multibyte/wcsnrtombs.c b/src/multibyte/wcsnrtombs.c
+index 676932b5..95e25e70 100644
+--- a/src/multibyte/wcsnrtombs.c
++++ b/src/multibyte/wcsnrtombs.c
+@@ -1,41 +1,33 @@
+ #include <wchar.h>
++#include <limits.h>
++#include <string.h>
+ 
+ size_t wcsnrtombs(char *restrict dst, const wchar_t **restrict wcs, size_t wn, size_t n, mbstate_t *restrict st)
+ {
+-	size_t l, cnt=0, n2;
+-	char *s, buf[256];
+ 	const wchar_t *ws = *wcs;
+-	const wchar_t *tmp_ws;
+-
+-	if (!dst) s = buf, n = sizeof buf;
+-	else s = dst;
+-
+-	while ( ws && n && ( (n2=wn)>=n || n2>32 ) ) {
+-		if (n2>=n) n2=n;
+-		tmp_ws = ws;
+-		l = wcsrtombs(s, &ws, n2, 0);
+-		if (!(l+1)) {
+-			cnt = l;
+-			n = 0;
++	size_t cnt = 0;
++	if (!dst) n=0;
++	while (ws && wn) {
++		char tmp[MB_LEN_MAX];
++		size_t l = wcrtomb(n<MB_LEN_MAX ? tmp : dst, *ws, 0);
++		if (l==-1) {
++			cnt = -1;
+ 			break;
+ 		}
+-		if (s != buf) {
+-			s += l;
++		if (dst) {
++			if (n<MB_LEN_MAX) {
++				if (l>n) break;
++				memcpy(dst, tmp, l);
++			}
++			dst += l;
+ 			n -= l;
+ 		}
+-		wn = ws ? wn - (ws - tmp_ws) : 0;
+-		cnt += l;
+-	}
+-	if (ws) while (n && wn) {
+-		l = wcrtomb(s, *ws, 0);
+-		if ((l+1)<=1) {
+-			if (!l) ws = 0;
+-			else cnt = l;
++		if (!*ws) {
++			ws = 0;
+ 			break;
+ 		}
+-		ws++; wn--;
+-		/* safe - this loop runs fewer than sizeof(buf) times */
+-		s+=l; n-=l;
++		ws++;
++		wn--;
+ 		cnt += l;
+ 	}
+ 	if (dst) *wcs = ws;