From 8af4d8d60c026041747107072167582f841e00be Mon Sep 17 00:00:00 2001 From: idriskalp Date: Wed, 11 Dec 2019 19:37:08 +0300 Subject: [PATCH] perl 5.30.1 --- system/base/perl/actions.py | 4 +- .../files/CVE-2016-2381_duplicate_env.diff | 104 ++++++++++++++++++ system/base/perl/pspec.xml | 14 ++- 3 files changed, 116 insertions(+), 6 deletions(-) create mode 100644 system/base/perl/files/CVE-2016-2381_duplicate_env.diff diff --git a/system/base/perl/actions.py b/system/base/perl/actions.py index ddac2009..04b7010f 100644 --- a/system/base/perl/actions.py +++ b/system/base/perl/actions.py @@ -88,8 +88,8 @@ def install(): # NEEDS MODIFICATION FOR NEW VERSION pisitools.dosym("/usr/lib/perl5/%s/%s-linux-thread-multi/CORE/libperl.so.%s" % (get.srcVERSION(), get.ARCH(), get.srcVERSION()), "/usr/lib/libperl.so") pisitools.dosym("/usr/lib/perl5/%s/%s-linux-thread-multi/CORE/libperl.so.%s" % (get.srcVERSION(), get.ARCH(), get.srcVERSION()), "/usr/lib/libperl.so.5") - pisitools.dosym("/usr/lib/perl5/%s/%s-linux-thread-multi/CORE/libperl.so.%s" % (get.srcVERSION(), get.ARCH(), get.srcVERSION()), "/usr/lib/libperl.so.5.26") - pisitools.dosym("/usr/lib/perl5/%s/%s-linux-thread-multi/CORE/libperl.so.%s" % (get.srcVERSION(), get.ARCH(), get.srcVERSION()), "/usr/lib/libperl.so.5.26.1") + pisitools.dosym("/usr/lib/perl5/%s/%s-linux-thread-multi/CORE/libperl.so.%s" % (get.srcVERSION(), get.ARCH(), get.srcVERSION()), "/usr/lib/libperl.so.5.30") + pisitools.dosym("/usr/lib/perl5/%s/%s-linux-thread-multi/CORE/libperl.so.%s" % (get.srcVERSION(), get.ARCH(), get.srcVERSION()), "/usr/lib/libperl.so.5.30.0") # Docs pisitools.dodir("/usr/share/doc/%s/html" % get.srcNAME()) diff --git a/system/base/perl/files/CVE-2016-2381_duplicate_env.diff b/system/base/perl/files/CVE-2016-2381_duplicate_env.diff new file mode 100644 index 00000000..80adf62d --- /dev/null +++ b/system/base/perl/files/CVE-2016-2381_duplicate_env.diff @@ -0,0 +1,104 @@ +From 83e7ebed7afa79a2f50eca6b6330eae7c3a02d36 Mon Sep 17 00:00:00 2001 +From: Tony Cook +Date: Wed, 27 Jan 2016 11:52:15 +1100 +Subject: remove duplicate environment variables from environ + +If we see duplicate environment variables while iterating over +environ[]: + +a) make sure we use the same value in %ENV that getenv() returns. + +Previously on a duplicate, %ENV would have the last entry for the name +from environ[], but a typical getenv() would return the first entry. + +Rather than assuming all getenv() implementations return the first entry +explicitly call getenv() to ensure they agree. + +b) remove duplicate entries from environ + +Previously if there was a duplicate definition for a name in environ[] +setting that name in %ENV could result in an unsafe value being passed +to a child process, so ensure environ[] has no duplicates. + +Patch-Name: fixes/CVE-2016-2381_duplicate_env.diff +--- + perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 49 insertions(+), 2 deletions(-) + +diff --git a/perl.c b/perl.c +index 80a76c2..ed25429 100644 +--- a/perl.c ++++ b/perl.c +@@ -4303,23 +4303,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env) + } + if (env) { + char *s, *old_var; ++ STRLEN nlen; + SV *sv; ++ HV *dups = newHV(); ++ + for (; *env; env++) { + old_var = *env; + + if (!(s = strchr(old_var,'=')) || s == old_var) + continue; ++ nlen = s - old_var; + + #if defined(MSDOS) && !defined(DJGPP) + *s = '\0'; + (void)strupr(old_var); + *s = '='; + #endif +- sv = newSVpv(s+1, 0); +- (void)hv_store(hv, old_var, s - old_var, sv, 0); ++ if (hv_exists(hv, old_var, nlen)) { ++ const char *name = savepvn(old_var, nlen); ++ ++ /* make sure we use the same value as getenv(), otherwise code that ++ uses getenv() (like setlocale()) might see a different value to %ENV ++ */ ++ sv = newSVpv(PerlEnv_getenv(name), 0); ++ ++ /* keep a count of the dups of this name so we can de-dup environ later */ ++ if (hv_exists(dups, name, nlen)) ++ ++SvIVX(*hv_fetch(dups, name, nlen, 0)); ++ else ++ (void)hv_store(dups, name, nlen, newSViv(1), 0); ++ ++ Safefree(name); ++ } ++ else { ++ sv = newSVpv(s+1, 0); ++ } ++ (void)hv_store(hv, old_var, nlen, sv, 0); + if (env_is_not_environ) + mg_set(sv); + } ++ if (HvKEYS(dups)) { ++ /* environ has some duplicate definitions, remove them */ ++ HE *entry; ++ hv_iterinit(dups); ++ while ((entry = hv_iternext_flags(dups, 0))) { ++ STRLEN nlen; ++ const char *name = HePV(entry, nlen); ++ IV count = SvIV(HeVAL(entry)); ++ IV i; ++ SV **valp = hv_fetch(hv, name, nlen, 0); ++ ++ assert(valp); ++ ++ /* try to remove any duplicate names, depending on the ++ * implementation used in my_setenv() the iteration might ++ * not be necessary, but let's be safe. ++ */ ++ for (i = 0; i < count; ++i) ++ my_setenv(name, 0); ++ ++ /* and set it back to the value we set $ENV{name} to */ ++ my_setenv(name, SvPV_nolen(*valp)); ++ } ++ } ++ SvREFCNT_dec_NN(dups); + } + #endif /* USE_ENVIRON_ARRAY */ + #endif /* !PERL_MICRO */ diff --git a/system/base/perl/pspec.xml b/system/base/perl/pspec.xml index ab4c93b7..f025e23e 100644 --- a/system/base/perl/pspec.xml +++ b/system/base/perl/pspec.xml @@ -13,15 +13,14 @@ app:console Larry Wall's Practical Extraction and Reporting Language Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. - http://www.cpan.org/src/5.0/perl-5.26.1.tar.bz2 + https://www.cpan.org/src/5.0/perl-5.30.1.tar.gz db-devel gdbm-devel zlib-devel - + @@ -50,11 +49,18 @@ - Turkish.pm + Turkish.pm + + 2019-12-11 + 5.30.1 + Version bump + Idris Kalp + idriskalp@gmail.com + 2018-07-15 5.26.1