From 67f4d2409e5267365163192ec90e860fadc7fd3f Mon Sep 17 00:00:00 2001 From: Rmys Date: Thu, 25 Feb 2021 23:48:13 +0300 Subject: [PATCH] libproxy rebuild --- .../libproxy-0.4.15-fix-CVE-2020-25219.patch | 57 ++++++ ...proxy-0.4.15-fix-pac-buffer-overflow.patch | 93 +++++++++ ...libproxy-0.4.15-mozjs-use-after-free.patch | 38 ++++ .../files/libproxy-0.4.15-mozjs60.patch | 23 +++ .../files/libproxy-0.4.17-mozjs68.patch | 180 ++++++++++++++++++ network/misc/libproxy/pspec.xml | 12 ++ 6 files changed, 403 insertions(+) create mode 100644 network/misc/libproxy/files/libproxy-0.4.15-fix-CVE-2020-25219.patch create mode 100644 network/misc/libproxy/files/libproxy-0.4.15-fix-pac-buffer-overflow.patch create mode 100644 network/misc/libproxy/files/libproxy-0.4.15-mozjs-use-after-free.patch create mode 100644 network/misc/libproxy/files/libproxy-0.4.15-mozjs60.patch create mode 100644 network/misc/libproxy/files/libproxy-0.4.17-mozjs68.patch diff --git a/network/misc/libproxy/files/libproxy-0.4.15-fix-CVE-2020-25219.patch b/network/misc/libproxy/files/libproxy-0.4.15-fix-CVE-2020-25219.patch new file mode 100644 index 0000000000..03cfbc00e0 --- /dev/null +++ b/network/misc/libproxy/files/libproxy-0.4.15-fix-CVE-2020-25219.patch @@ -0,0 +1,57 @@ +From a83dae404feac517695c23ff43ce1e116e2bfbe0 Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro +Date: Wed, 9 Sep 2020 11:12:02 -0500 +Subject: [PATCH] Rewrite url::recvline to be nonrecursive + +This function processes network input. It's semi-trusted, because the +PAC ought to be trusted. But we still shouldn't allow it to control how +far we recurse. A malicious PAC can cause us to overflow the stack by +sending a sufficiently-long line without any '\n' character. + +Also, this function failed to properly handle EINTR, so let's fix that +too, for good measure. + +Fixes #134 +--- + libproxy/url.cpp | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/libproxy/url.cpp b/libproxy/url.cpp +index ee776b2..68d69cd 100644 +--- a/libproxy/url.cpp ++++ b/libproxy/url.cpp +@@ -388,16 +388,24 @@ string url::to_string() const { + return m_orig; + } + +-static inline string recvline(int fd) { +- // Read a character. +- // If we don't get a character, return empty string. +- // If we are at the end of the line, return empty string. +- char c = '\0'; +- +- if (recv(fd, &c, 1, 0) != 1 || c == '\n') +- return ""; +- +- return string(1, c) + recvline(fd); ++static string recvline(int fd) { ++ string line; ++ int ret; ++ ++ // Reserve arbitrary amount of space to avoid small memory reallocations. ++ line.reserve(128); ++ ++ do { ++ char c; ++ ret = recv(fd, &c, 1, 0); ++ if (ret == 1) { ++ if (c == '\n') ++ return line; ++ line += c; ++ } ++ } while (ret == 1 || (ret == -1 && errno == EINTR)); ++ ++ return line; + } + + char* url::get_pac() { diff --git a/network/misc/libproxy/files/libproxy-0.4.15-fix-pac-buffer-overflow.patch b/network/misc/libproxy/files/libproxy-0.4.15-fix-pac-buffer-overflow.patch new file mode 100644 index 0000000000..929083327f --- /dev/null +++ b/network/misc/libproxy/files/libproxy-0.4.15-fix-pac-buffer-overflow.patch @@ -0,0 +1,93 @@ +From 4411b523545b22022b4be7d0cac25aa170ae1d3e Mon Sep 17 00:00:00 2001 +From: Fei Li +Date: Fri, 17 Jul 2020 02:18:37 +0800 +Subject: [PATCH] Fix buffer overflow when PAC is enabled + +The bug was found on Windows 10 (MINGW64) when PAC is enabled. It turned +out to be the large PAC file (more than 102400 bytes) returned by a +local proxy program with no content-length present. +--- + libproxy/url.cpp | 44 +++++++++++++++++++++++++++++++------------- + 1 file changed, 31 insertions(+), 13 deletions(-) + +diff --git a/libproxy/url.cpp b/libproxy/url.cpp +index ee776b2..8684086 100644 +--- a/libproxy/url.cpp ++++ b/libproxy/url.cpp +@@ -54,7 +54,7 @@ using namespace std; + #define PAC_MIME_TYPE_FB "text/plain" + + // This is the maximum pac size (to avoid memory attacks) +-#define PAC_MAX_SIZE 102400 ++#define PAC_MAX_SIZE 0x800000 + // This is the default block size to use when receiving via HTTP + #define PAC_HTTP_BLOCK_SIZE 512 + +@@ -478,15 +478,13 @@ char* url::get_pac() { + } + + // Get content +- unsigned int recvd = 0; +- buffer = new char[PAC_MAX_SIZE]; +- memset(buffer, 0, PAC_MAX_SIZE); ++ std::vector dynamic_buffer; + do { + unsigned int chunk_length; + + if (chunked) { + // Discard the empty line if we received a previous chunk +- if (recvd > 0) recvline(sock); ++ if (!dynamic_buffer.empty()) recvline(sock); + + // Get the chunk-length line as an integer + if (sscanf(recvline(sock).c_str(), "%x", &chunk_length) != 1 || chunk_length == 0) break; +@@ -498,21 +496,41 @@ char* url::get_pac() { + + if (content_length >= PAC_MAX_SIZE) break; + +- while (content_length == 0 || recvd != content_length) { +- int r = recv(sock, buffer + recvd, +- content_length == 0 ? PAC_HTTP_BLOCK_SIZE +- : content_length - recvd, 0); ++ while (content_length == 0 || dynamic_buffer.size() != content_length) { ++ // Calculate length to recv ++ unsigned int length_to_read = PAC_HTTP_BLOCK_SIZE; ++ if (content_length > 0) ++ length_to_read = content_length - dynamic_buffer.size(); ++ ++ // Prepare buffer ++ dynamic_buffer.resize(dynamic_buffer.size() + length_to_read); ++ ++ int r = recv(sock, dynamic_buffer.data() + dynamic_buffer.size() - length_to_read, length_to_read, 0); ++ ++ // Shrink buffer to fit ++ if (r >= 0) ++ dynamic_buffer.resize(dynamic_buffer.size() - length_to_read + r); ++ ++ // PAC size too large, discard ++ if (dynamic_buffer.size() >= PAC_MAX_SIZE) { ++ chunked = false; ++ dynamic_buffer.clear(); ++ break; ++ } ++ + if (r <= 0) { + chunked = false; + break; + } +- recvd += r; + } + } while (chunked); + +- if (content_length != 0 && string(buffer).size() != content_length) { +- delete[] buffer; +- buffer = NULL; ++ if (content_length == 0 || content_length == dynamic_buffer.size()) { ++ buffer = new char[dynamic_buffer.size() + 1]; ++ if (!dynamic_buffer.empty()) { ++ memcpy(buffer, dynamic_buffer.data(), dynamic_buffer.size()); ++ } ++ buffer[dynamic_buffer.size()] = '\0'; + } + } + diff --git a/network/misc/libproxy/files/libproxy-0.4.15-mozjs-use-after-free.patch b/network/misc/libproxy/files/libproxy-0.4.15-mozjs-use-after-free.patch new file mode 100644 index 0000000000..f63a394e95 --- /dev/null +++ b/network/misc/libproxy/files/libproxy-0.4.15-mozjs-use-after-free.patch @@ -0,0 +1,38 @@ +From 738785214546ec5bb772886019529b2a6519deaf Mon Sep 17 00:00:00 2001 +From: Simon McVittie +Date: Fri, 1 May 2020 19:04:22 +0100 +Subject: [PATCH] mozjs: Avoid use-after-free + +If we don't assign the temporary std::string returned by +url_.to_string() to a variable, then it immediately goes out of scope +and is freed, resulting in the result of c_str() pointing into freed +memory. This works about as well as you would expect. + +Signed-off-by: Simon McVittie +--- + libproxy/modules/pacrunner_mozjs.cpp | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libproxy/modules/pacrunner_mozjs.cpp b/libproxy/modules/pacrunner_mozjs.cpp +index ade6d0a..aac6531 100644 +--- a/libproxy/modules/pacrunner_mozjs.cpp ++++ b/libproxy/modules/pacrunner_mozjs.cpp +@@ -175,14 +175,11 @@ class mozjs_pacrunner : public pacrunner { + + string run(const url& url_) throw (bad_alloc) { + // Build arguments to the FindProxyForURL() function +- const char *tmpurl = url_.to_string().c_str(); +- const char *tmphost = url_.get_host().c_str(); +- if (!tmpurl || !tmphost) { +- throw bad_alloc(); +- } ++ string tmpurl(url_.to_string()); ++ string tmphost(url_.get_host()); + JS::AutoValueArray<2> args(this->jsctx); +- args[0].setString(JS_NewStringCopyZ(this->jsctx, tmpurl)); +- args[1].setString(JS_NewStringCopyZ(this->jsctx, tmphost)); ++ args[0].setString(JS_NewStringCopyZ(this->jsctx, tmpurl.c_str())); ++ args[1].setString(JS_NewStringCopyZ(this->jsctx, tmphost.c_str())); + + // Find the proxy (call FindProxyForURL()) + JS::RootedValue rval(this->jsctx); diff --git a/network/misc/libproxy/files/libproxy-0.4.15-mozjs60.patch b/network/misc/libproxy/files/libproxy-0.4.15-mozjs60.patch new file mode 100644 index 0000000000..5e81a70a5a --- /dev/null +++ b/network/misc/libproxy/files/libproxy-0.4.15-mozjs60.patch @@ -0,0 +1,23 @@ +From 1600c6af7ed775d4ccbb239937acd92ef7162409 Mon Sep 17 00:00:00 2001 +From: Laurent Bigonville +Date: Sun, 9 Dec 2018 16:07:55 +0100 +Subject: [PATCH] Build with mozjs 60 instead + +This seems enough to make it work with mozjs 60 +--- + libproxy/cmake/modules/pacrunner_mozjs.cmk | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libproxy/cmake/modules/pacrunner_mozjs.cmk b/libproxy/cmake/modules/pacrunner_mozjs.cmk +index 20857fb..871cc85 100644 +--- a/libproxy/cmake/modules/pacrunner_mozjs.cmk ++++ b/libproxy/cmake/modules/pacrunner_mozjs.cmk +@@ -9,7 +9,7 @@ if(WIN32) + elseif(NOT APPLE) + option(WITH_MOZJS "Search for MOZJS package" ON) + if (WITH_MOZJS) +- pkg_search_module(MOZJS mozjs-52) ++ pkg_search_module(MOZJS mozjs-60) + if(MOZJS_FOUND) + include_directories(${MOZJS_INCLUDE_DIRS}) + link_directories(${MOZJS_LIBRARY_DIRS}) diff --git a/network/misc/libproxy/files/libproxy-0.4.17-mozjs68.patch b/network/misc/libproxy/files/libproxy-0.4.17-mozjs68.patch new file mode 100644 index 0000000000..7784dc8167 --- /dev/null +++ b/network/misc/libproxy/files/libproxy-0.4.17-mozjs68.patch @@ -0,0 +1,180 @@ +From 6c9e48accddb90eef8412bef3ccc29594935d3b3 Mon Sep 17 00:00:00 2001 +From: Iain Lane +Date: Wed, 11 Mar 2020 11:54:52 +0000 +Subject: [PATCH] mozjs: Port to mozjs 68 + +There are a number of API changes that need to be adapted to, notably + + - JS_EncodeString is gone; need to use JS_EncodeStringToUTF8 now which + requires a rooted object to be passed in. + - JS_free is gone + +The pkg-config file ships some flags which need to be supplied to the +build. +--- + libproxy/cmake/modules/pacrunner_mozjs.cmk | 6 ++- + libproxy/modules/pacrunner_mozjs.cpp | 56 ++++++++++++++-------- + 2 files changed, 41 insertions(+), 21 deletions(-) + +diff --git a/libproxy/cmake/modules/pacrunner_mozjs.cmk b/libproxy/cmake/modules/pacrunner_mozjs.cmk +index 871cc85..2cc3c51 100644 +--- a/libproxy/cmake/modules/pacrunner_mozjs.cmk ++++ b/libproxy/cmake/modules/pacrunner_mozjs.cmk +@@ -9,8 +9,12 @@ if(WIN32) + elseif(NOT APPLE) + option(WITH_MOZJS "Search for MOZJS package" ON) + if (WITH_MOZJS) +- pkg_search_module(MOZJS mozjs-60) ++ pkg_search_module(MOZJS mozjs-68) + if(MOZJS_FOUND) ++ foreach(OPT ${MOZJS_CFLAGS}) ++ set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${OPT}") ++ endforeach() ++ message("mozjs is " ${CMAKE_CXX_FLAGS}) + include_directories(${MOZJS_INCLUDE_DIRS}) + link_directories(${MOZJS_LIBRARY_DIRS}) + else() +diff --git a/libproxy/modules/pacrunner_mozjs.cpp b/libproxy/modules/pacrunner_mozjs.cpp +index 38e7d46..37e1b42 100644 +--- a/libproxy/modules/pacrunner_mozjs.cpp ++++ b/libproxy/modules/pacrunner_mozjs.cpp +@@ -37,6 +37,9 @@ using namespace libproxy; + #pragma GCC diagnostic error "-Winvalid-offsetof" + #include + #include ++#include ++#include ++#include + + #include "pacutils.h" + +@@ -49,19 +52,21 @@ using namespace libproxy; + #endif + + static void dnsResolve_(JSContext *cx, JSString *hostname, JS::CallArgs *argv) { ++ char *tmp; + // Get hostname argument +- char *tmp = JS_EncodeString(cx, hostname); ++ JS::RootedString str(cx, hostname); ++ JS::UniqueChars chars = JS_EncodeStringToUTF8(cx, str); ++ const char *val = chars.get(); + + // Set the default return value + argv->rval().setNull(); + + // Look it up + struct addrinfo *info = nullptr; +- if (getaddrinfo(tmp, NULL, NULL, &info)) ++ if (getaddrinfo(val, NULL, NULL, &info)) + goto out; + + // Allocate the IP address +- JS_free(cx, tmp); + tmp = (char *) JS_malloc(cx, INET6_ADDRSTRLEN+1); + memset(tmp, 0, INET6_ADDRSTRLEN+1); + +@@ -77,7 +82,6 @@ static void dnsResolve_(JSContext *cx, JSString *hostname, JS::CallArgs *argv) { + + out: + if (info) freeaddrinfo(info); +- JS_free(cx, tmp); + } + + static bool dnsResolve(JSContext *cx, unsigned argc, JS::Value *vp) { +@@ -121,29 +125,40 @@ class mozjs_pacrunner : public pacrunner { + if (!JS::InitSelfHostedCode(this->jsctx)) goto error; + + JS::RootedValue rval(this->jsctx); +- JS::CompartmentOptions compart_opts; ++ JS::RealmOptions realm_opts; + + this->jsglb = new JS::Heap(JS_NewGlobalObject( + this->jsctx, &cls, + nullptr, JS::DontFireOnNewGlobalHook, +- compart_opts)); ++ realm_opts)); + + if (!(this->jsglb)) goto error; + JS::RootedObject global(this->jsctx,this->jsglb->get()); +- if (!(this->jsac = new JSAutoCompartment(this->jsctx, global))) goto error; +- if (!JS_InitStandardClasses(this->jsctx, global)) goto error; ++ if (!(this->jsar = new JSAutoRealm(this->jsctx, global))) goto error; + + // Define Javascript functions + JS_DefineFunction(this->jsctx, global, "dnsResolve", dnsResolve, 1, 0); + JS_DefineFunction(this->jsctx, global, "myIpAddress", myIpAddress, 0, 0); + JS::CompileOptions options(this->jsctx); +- options.setUTF8(true); + +- JS::Evaluate(this->jsctx, options, JAVASCRIPT_ROUTINES, +- strlen(JAVASCRIPT_ROUTINES), JS::MutableHandleValue(&rval)); ++ JS::SourceText routines, pac_source; ++ if (!routines.init(this->jsctx, ++ JAVASCRIPT_ROUTINES, ++ strlen(JAVASCRIPT_ROUTINES), ++ JS::SourceOwnership::Borrowed)) ++ goto error; ++ ++ if (!pac_source.init(this->jsctx, ++ pac.c_str(), ++ pac.length(), ++ JS::SourceOwnership::Borrowed)) ++ goto error; ++ ++ ++ JS::Evaluate(this->jsctx, options, routines, JS::MutableHandleValue(&rval)); + + // Add PAC to the environment +- JS::Evaluate(this->jsctx, options, pac.c_str(), pac.length(), JS::MutableHandleValue(&rval)); ++ JS::Evaluate(this->jsctx, options, pac_source, JS::MutableHandleValue(&rval)); + return; + } + error: +@@ -152,7 +167,7 @@ class mozjs_pacrunner : public pacrunner { + } + + ~mozjs_pacrunner() { +- if (this->jsac) delete this->jsac; ++ if (this->jsar) delete this->jsar; + if (this->jsglb) delete this->jsglb; + if (this->jsctx) JS_DestroyContext(this->jsctx); + JS_ShutDown(); +@@ -160,11 +175,9 @@ class mozjs_pacrunner : public pacrunner { + + string run(const url& url_) throw (bad_alloc) { + // Build arguments to the FindProxyForURL() function +- char *tmpurl = JS_strdup(this->jsctx, url_.to_string().c_str()); +- char *tmphost = JS_strdup(this->jsctx, url_.get_host().c_str()); ++ const char *tmpurl = url_.to_string().c_str(); ++ const char *tmphost = url_.get_host().c_str(); + if (!tmpurl || !tmphost) { +- if (tmpurl) JS_free(this->jsctx, tmpurl); +- if (tmphost) JS_free(this->jsctx, tmphost); + throw bad_alloc(); + } + JS::AutoValueArray<2> args(this->jsctx); +@@ -176,10 +189,13 @@ class mozjs_pacrunner : public pacrunner { + JS::RootedObject global(this->jsctx,this->jsglb->get()); + bool result = JS_CallFunctionName(this->jsctx, global, "FindProxyForURL", args, &rval); + if (!result) return ""; ++ if (!rval.isString()) ++ return ""; + +- char * tmpanswer = JS_EncodeString(this->jsctx, rval.toString()); ++ JS::RootedString s(this->jsctx, rval.toString()); ++ JS::UniqueChars chars = JS_EncodeStringToUTF8(this->jsctx, s); ++ const char *tmpanswer = chars.get(); + string answer = string(tmpanswer); +- JS_free(this->jsctx, tmpanswer); + + if (answer == "undefined") return ""; + return answer; +@@ -188,7 +204,7 @@ class mozjs_pacrunner : public pacrunner { + private: + JSContext *jsctx; + JS::Heap *jsglb; +- JSAutoCompartment *jsac; ++ JSAutoRealm *jsar; + }; + + PX_PACRUNNER_MODULE_EZ(mozjs, "JS_DefineFunction", "mozjs"); diff --git a/network/misc/libproxy/pspec.xml b/network/misc/libproxy/pspec.xml index ee06e96922..ee4d87dd76 100644 --- a/network/misc/libproxy/pspec.xml +++ b/network/misc/libproxy/pspec.xml @@ -24,7 +24,12 @@ libproxy-pac-modules.patch + libproxy-0.4.15-fix-CVE-2020-25219.patch + libproxy-0.4.15-fix-pac-buffer-overflow.patch libproxy-0.4.15-mozjs52.patch + libproxy-0.4.15-mozjs60.patch + libproxy-0.4.17-mozjs68.patch + libproxy-0.4.15-mozjs-use-after-free.patch @@ -104,6 +109,13 @@ + + 2021-02-25 + 0.4.15 + Rebuild. + Mustafa Cinasal + muscnsl@gmail.com + 2020-01-16 0.4.15