aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJakub Jirutka <jakub@jirutka.cz>2020-09-21 12:53:33 +0200
committerJakub Jirutka <jakub@jirutka.cz>2020-09-21 12:54:31 +0200
commit05547ef0a96a7d2210ca7ad03ac5b63a9d889a50 (patch)
treede467ca101ae3d59f1b3946697ba6d5e44b10ca0
parentb8bc93193c18cd8b6e25f65ff5593be36dc2448f (diff)
main/libuv: fix CVE-2020-8252
-rw-r--r--main/libuv/APKBUILD8
-rw-r--r--main/libuv/CVE-2020-8252.patch38
2 files changed, 45 insertions, 1 deletions
diff --git a/main/libuv/APKBUILD b/main/libuv/APKBUILD
index 3d8fa0cd98f..f2fa98b19b4 100644
--- a/main/libuv/APKBUILD
+++ b/main/libuv/APKBUILD
@@ -13,9 +13,14 @@ makedepends_host="linux-headers"
subpackages="$pkgname-static $pkgname-dev $pkgname-dbg"
source="https://dist.libuv.org/dist/v$pkgver/libuv-v$pkgver.tar.gz
disable-test-failing-on-builders.patch
+ CVE-2020-8252.patch
"
builddir="$srcdir/$pkgname-v$pkgver"
+# secfixes:
+# 1.38.1-r0:
+# - CVE-2020-8252
+
prepare() {
default_prepare
sh autogen.sh
@@ -52,4 +57,5 @@ package() {
}
sha512sums="694156590bea55d47146fbee0864850773ef5fdee00532ca87c5c791855cc94c88a82dbe3b8c59fd1a4f463ea2a2508e7978cb4165209d636fe19fb74383b305 libuv-v1.38.1.tar.gz
-0d155259cfaa78fd229a015fd7181b9a76bf4618e36e6e9d4697323cddcde42f29598f161f6831489ec31adc5cf2614cb670021bf6f5ede7202bcbad7f675fbb disable-test-failing-on-builders.patch"
+0d155259cfaa78fd229a015fd7181b9a76bf4618e36e6e9d4697323cddcde42f29598f161f6831489ec31adc5cf2614cb670021bf6f5ede7202bcbad7f675fbb disable-test-failing-on-builders.patch
+2b967bc726e13a3e705a692708e0a9a0609a6b68beeeff195653b4b5fa1f9d5b1e2734e3910328b06662013e3cb778aa65344b97d6577c65b124047aef52dab9 CVE-2020-8252.patch"
diff --git a/main/libuv/CVE-2020-8252.patch b/main/libuv/CVE-2020-8252.patch
new file mode 100644
index 00000000000..aa47d2a62db
--- /dev/null
+++ b/main/libuv/CVE-2020-8252.patch
@@ -0,0 +1,38 @@
+From 0423aa68ad55f6cb2faa9dd6361a3493705bc614 Mon Sep 17 00:00:00 2001
+From: Ben Noordhuis <info@bnoordhuis.nl>
+Date: Mon, 24 Aug 2020 11:42:27 +0200
+Subject: [PATCH] unix: don't use _POSIX_PATH_MAX
+
+Libuv was using _POSIX_PATH_MAX wrong. Bug introduced in commit b56d279b
+("unix: do not require PATH_MAX to be defined") from September 2018.
+
+_POSIX_PATH_MAX is the minimum max path size guaranteed by POSIX, not
+the actual max path size of the system libuv runs on. _POSIX_PATH_MAX
+is always 256, the real max is often much bigger.
+
+This commit fixes buffer overruns when processing very long paths in
+uv_fs_readlink() and uv_fs_realpath() because libuv was not allocating
+enough memory to store the result.
+
+Fixes: https://github.com/libuv/libuv/issues/2965
+
+Patch-Source: https://github.com/libuv/libuv/pull/2966
+---
+ src/unix/internal.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/src/unix/internal.h b/src/unix/internal.h
+index 30711673e0..9d3c2297f8 100644
+--- a/src/unix/internal.h
++++ b/src/unix/internal.h
+@@ -62,9 +62,7 @@
+ # include <AvailabilityMacros.h>
+ #endif
+
+-#if defined(_POSIX_PATH_MAX)
+-# define UV__PATH_MAX _POSIX_PATH_MAX
+-#elif defined(PATH_MAX)
++#if defined(PATH_MAX)
+ # define UV__PATH_MAX PATH_MAX
+ #else
+ # define UV__PATH_MAX 8192