October 2017 - Pacman-dev - lists.archlinux.org

[pacman-dev] [Patch 1/1] Fix CVE-2016-5434 (DoS/loop and out of boundary read)
by Nils Freydank 20 Oct '17

20 Oct '17

This is a rewrite of Tobias Stoeckmann’s patch from June 2016[1] using functions instead of macros. (Thanks to Tobias for explanations of his patch.) A short question on Freenode IRC showed that macros are generally discouraged and functions should be used. The patch introduces size_t length_check() and applies it to libalpm/signing.c and signing.h. Feedback is very appreciated. [1] Original patch: https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html CVE request (and assignment): http://seclists.org/oss-sec/2016/q2/526 diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index 95cb3280..f7a9c9a8 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -986,6 +986,19 @@ int SYMEXPORT alpm_siglist_cleanup(alpm_siglist_t *siglist) return 0; } +/* Check to avoid out of boundary reads */ +size_t length_check(size_t length, size_t position, size_t a, + alpm_handle_t *handle, const char *identifier) +{ + if( a == 0 || length - position <= a) + { + _alpm_log(handle, ALPM_LOG_ERROR, \ + _("%s: signature format error"), identifier); + return -1; + } + else return 0; +} + /** * Extract the Issuer Key ID from a signature * @param sig PGP signature @@ -1021,19 +1034,22 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, } switch(sig[pos] & 0x03) { - case 0: - blen = sig[pos + 1]; - pos = pos + 2; + case 0: if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else blen = sig[pos + 1]; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + 2; break; - case 1: - blen = (sig[pos + 1] << 8) | sig[pos + 2]; - pos = pos + 3; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else blen = (sig[pos + 1] << 8) | sig[pos + 2]; + if( length_check(len, pos, 3, handle, identifier) ){ return -1; } + else pos = pos + 3; break; - case 2: - blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4]; - pos = pos + 5; + case 2: if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4]; + if( length_check(len, pos, 5, handle, identifier) ){ return -1; } + else pos = pos + 5; break; case 3: @@ -1057,25 +1073,38 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, return -1; } - pos = pos + 4; + if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else pos = pos + 4; - hlen = (sig[pos] << 8) | sig[pos + 1]; - pos = pos + hlen + 2; + if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else hlen = (sig[pos] << 8) | sig[pos + 1]; - ulen = (sig[pos] << 8) | sig[pos + 1]; - pos = pos + 2; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + hlen + 2; + + if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else ulen = (sig[pos] << 8) | sig[pos + 1]; + + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + 2; spos = pos; + if( length_check(len, pos, ulen, handle, identifier) ){ return -1; } + else while(spos < pos + ulen) { if(sig[spos] < 192) { slen = sig[spos]; - spos = spos + 1; + if( length_check(len + ulen, spos, 1, handle, identifier) ){ return -1; } + else spos = spos + 1; } else if(sig[spos] < 255) { - slen = (sig[spos] << 8) | sig[spos + 1]; - spos = spos + 2; + if( length_check(pos + ulen, spos, 1, handle, identifier) ){ return -1; } + else slen = (sig[spos] << 8) | sig[spos + 1]; + if( length_check(pos + ulen, spos, 2, handle, identifier) ){ return -1; } + else spos = spos + 2; } else { - slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4]; + if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4]; spos = spos + 5; } @@ -1083,17 +1112,20 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, /* issuer key ID */ char key[17]; size_t i; + if( length_check(pos + ulen, spos, 8, handle, identifier) ){return -1; } + else{ for (i = 0; i < 8; i++) { sprintf(&key[i * 2], "%02X", sig[spos + i + 1]); } + } *keys = alpm_list_add(*keys, strdup(key)); break; } - - spos = spos + slen; + if( length_check(pos + ulen + 1, spos, slen, handle, identifier) ) {return -1; } + else spos = spos + slen; } - - pos = pos + (blen - hlen - 8); + if( length_check( blen, hlen, 8, handle, identifier ) ){return -1;} + else pos = pos + (blen - hlen - 8); } return 0; diff --git a/lib/libalpm/signing.h b/lib/libalpm/signing.h index 3507f584..a67bd900 100644 --- a/lib/libalpm/signing.h +++ b/lib/libalpm/signing.h @@ -36,4 +36,6 @@ int _alpm_key_import(alpm_handle_t *handle, const char *fpr); #endif /* ALPM_SIGNING_H */ +size_t length_check(size_t length, size_t position, size_t a, + alpm_handle_t *handle, const char *identifier); -- GPG fingerprint: '766B 8122 1342 6912 3401 492A 8B54 D7A3 FF3C DB17' Nils Freydank / Holgersson

3 8

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.0.1-192-ge4f13e62
by allan＠archlinux.org 17 Oct '17

17 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via e4f13e62cf74393e811dd247a28b887935ce6a56 (commit) via 62bfba53dbb33d12f3a4beaf9044a04b40c6b537 (commit) via 2ddbc6964b31f65678ed8e7c2cf1e80f0a7d4a0f (commit) via 4dae3fde17d663bf39a17978c2ee365696a54fb0 (commit) via 39319c1860d200a9b4a3cc2c6975e3cece502f2d (commit) via 64b7edd2fed122e63abd42dbe392a6f2896a0c16 (commit) via 064e7280cb2608747b2ce628f7e8faf7745f0707 (commit) via b4a197a6155d6cb4d02e712bf324beb0502b4d51 (commit) via 2b1b7b70753eb56bee08cd270efc7cfa342bc0ec (commit) via fa8419a0b569378674fb87e69f249d9cfe724596 (commit) from bcc9c417ae989ffda193083807142171c7a0190f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e4f13e62cf74393e811dd247a28b887935ce6a56 Author: Allan McRae <allan(a)archlinux.org> Date: Sun Oct 8 23:34:48 2017 +1000 libmakepkg: only output package file names when checking for build references The leading directory is distraction from identifying the files containing build references. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 62bfba53dbb33d12f3a4beaf9044a04b40c6b537 Author: Alastair Hughes <hobbitalastair(a)gmail.com> Date: Sat Aug 12 09:15:33 2017 +1200 Make the flags used for sed -i configurable Not all sed implementations on linux accept the --follow-symlinks argument, so let the user configure the arguments passed to sed if required. Signed-off-by: Alastair Hughes <hobbitalastair(a)gmail.com> [Allan: fixed configure summary output] Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 2ddbc6964b31f65678ed8e7c2cf1e80f0a7d4a0f Author: Allan McRae <allan(a)archlinux.org> Date: Thu Sep 14 09:45:53 2017 +1000 libmakepkg: grammar fix Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 4dae3fde17d663bf39a17978c2ee365696a54fb0 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Tue Sep 12 23:59:24 2017 -0400 makepkg: respect $SOURCE_DATE_EPOCH to activate reproducible builds If SOURCE_DATE_EPOCH is set, `touch` all source files between the (optional) prepare() and build() functions to unify the modification times. This works around build systems and compilers that embed the file modification times into the file contents of release artifacts. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 39319c1860d200a9b4a3cc2c6975e3cece502f2d Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Tue Sep 12 23:57:32 2017 -0400 libmakepkg: check for invalid tags in git As per https://lists.archlinux.org/pipermail/arch-general/2017-July/043876.html git doesn't check that the tag name matches what an annotated tag object *thinks* it should be called. This is a bit of a theoretical attack and some would argue that we should always use commits since upstream can legitimately change a tag, but nevertheless this can result in a downgrade attack if the git download transport was manipulated or the upstream repository hacked. So, check the tag blob to make sure the tag actually matches the name we used for `git checkout`. This really should be fixed in git itself, rather than forcing all downstream users of git verify-tag to implement their own checks, but the git developers disagree, see the discussion surrounding https://public-inbox.org/git/xmqqk2hzldx8.fsf@gitster.mtv.corp.google.com/ Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 64b7edd2fed122e63abd42dbe392a6f2896a0c16 Author: Michael Straube <straubem(a)gmx.de> Date: Sat Jul 15 14:56:30 2017 +0200 Fix brace coding style issues - Add missing braces to one-line if blocks - Move opening brace to line end Signed-off-by: Michael Straube <straubem(a)gmx.de> commit 064e7280cb2608747b2ce628f7e8faf7745f0707 Author: Michael Straube <straubem(a)gmx.de> Date: Thu Jul 13 21:30:59 2017 +0200 Fix coding style issue in pacman/util.c Add missing braces to some one-line if blocks. Signed-off-by: Michael Straube <straubem(a)gmx.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit b4a197a6155d6cb4d02e712bf324beb0502b4d51 Author: Michael Straube <straubem(a)gmx.de> Date: Sun Jul 9 16:45:38 2017 +0200 test/pacman: fix spelling of distribution name and another typo Signed-off-by: Michael Straube <straubem(a)gmx.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 2b1b7b70753eb56bee08cd270efc7cfa342bc0ec Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sat Jul 8 20:33:18 2017 -0400 clarify broken dependency error messages Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit fa8419a0b569378674fb87e69f249d9cfe724596 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sat Jul 8 20:33:17 2017 -0400 provide command for downloading missing databases This is primarily to help users who are not aware that -F operations use a separate set of databases that need to be separately downloaded. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: configure.ac | 16 +++++++++++----- doc/makepkg.8.txt | 16 ++++++++++++++++ lib/libalpm/delta.c | 3 +-- lib/libalpm/sync.c | 6 ++++-- scripts/Makefile.am | 3 ++- scripts/libmakepkg/lint_package.sh.in | 2 +- scripts/libmakepkg/lint_package/build_references.sh.in | 2 +- scripts/libmakepkg/source/git.sh.in | 11 ++++++++++- scripts/makepkg.sh.in | 17 ++++++++++++++--- src/pacman/callback.c | 5 +++-- src/pacman/sync.c | 11 ++++++----- src/pacman/util.c | 12 ++++++++---- test/pacman/ChangeLog | 2 +- test/pacman/README | 6 +++--- 14 files changed, 81 insertions(+), 31 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] libmakepkg: only output package file names when checking for build references
by Allan McRae 08 Oct '17

08 Oct '17

The leading directory is distraction from identifying the files containing build references. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/libmakepkg/lint_package/build_references.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/libmakepkg/lint_package/build_references.sh.in b/scripts/libmakepkg/lint_package/build_references.sh.in index 9183fce9..6b777bf1 100644 --- a/scripts/libmakepkg/lint_package/build_references.sh.in +++ b/scripts/libmakepkg/lint_package/build_references.sh.in @@ -34,7 +34,7 @@ warn_build_references() { mapfile -t refs < <(find "$pkgdir" -type f -exec grep -l "${!var}" {} +) if (( ${#refs} > 0 )); then warning "$(gettext 'Package contains reference to %s')" "\$$var" - printf '%s\n' "${refs[@]}" >&2 + printf '%s\n' "${refs[@]#"$pkgdir/"}" >&2 fi done return 0 -- 2.14.2

1 0

[pacman-dev] repo-add and extended attributes
by Magnus Therning 07 Oct '17

07 Oct '17

Hi, I ran into problems with using repo-add inside a Docker instance as part of my CI build (gitlab CI). The error messages were: ==> Extracting database to a temporary location... cabal-install-1.24.0.2-0.1/: Cannot restore extended attributes on this file system. cabal-install-1.24.0.2-0.1/desc: Cannot restore extended attributes on this file system. bsdtar: Error exit delayed from previous errors. ==> Extracting database to a temporary location... cabal-install-1.24.0.2-0.1/: Cannot restore extended attributes on this file system. cabal-install-1.24.0.2-0.1/desc: Cannot restore extended attributes on this file system. cabal-install-1.24.0.2-0.1/files: Cannot restore extended attributes on this file system. bsdtar: Error exit delayed from previous errors. After a bit of searching and reading man pages I sprinkled a few "--no-xattr" on the calls to bsdtar in repo-add. That solved the problem for me. I had a quick search through this mailing list and I don't think this has been brought up before, so now I'm curious as to whether extended attributes actually are used for anything in the repo databases, or are they only there due to bsdtar defaults? /M -- Magnus Therning OpenPGP: 0x927912051716CE39 email: magnus(a)therning.org jabber: magnus(a)therning.org twitter: magthe http://therning.org/magnus For every problem there is a solution which is clear, simple, and wrong. — HL Mencken

2 1