From e6a9d7a853f7afcf876c0c0f47c598639ffc4166 Mon Sep 17 00:00:00 2001 From: Michael Cobb michael.cobb@iceotope.com Date: Tue, 20 Aug 2024 15:10:18 +0100 Subject: [PATCH 1/4] libpcre2: C64 initial commit
Inital commit of libpcre2 10.40 recipe
Signed-off-by: Michael Cobb michael.cobb@iceotope.com --- .../libpcre/libpcre2-morello_10.40.bb | 69 +++++++++++++++++ .../libpcre/libpcre2/CVE-2022-41409.patch | 75 +++++++++++++++++++ 2 files changed, 144 insertions(+) create mode 100644 recipes-support/libpcre/libpcre2-morello_10.40.bb create mode 100644 recipes-support/libpcre/libpcre2/CVE-2022-41409.patch
diff --git a/recipes-support/libpcre/libpcre2-morello_10.40.bb b/recipes-support/libpcre/libpcre2-morello_10.40.bb new file mode 100644 index 0000000..1b7d15a --- /dev/null +++ b/recipes-support/libpcre/libpcre2-morello_10.40.bb @@ -0,0 +1,69 @@ +inherit autotools binconfig-disabled purecap-sysroot + +MORELLO_SRC = "poky/meta/recipes-support/libpcre/libpcre2_10.40.bb" + +DESCRIPTION = "There are two major versions of the PCRE library. The \ +newest version is PCRE2, which is a re-working of the original PCRE \ +library to provide an entirely new API. The original, very widely \ +deployed PCRE library's API and feature are stable, future releases \ + will be for bugfixes only. All new future features will be to PCRE2, \ +not the original PCRE 8.x series." +SUMMARY = "Perl Compatible Regular Expressions version 2" +HOMEPAGE = "http://www.pcre.org" +SECTION = "devel" +LICENSE = "BSD-3-Clause" +LIC_FILES_CHKSUM = "file://LICENCE;md5=41bfb977e4933c506588724ce69bf5d2" + +SRC_URI = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-%24%7BPV%7D/pcr... \ + file://CVE-2022-41409.patch \ +" + +UPSTREAM_CHECK_URI = "https://github.com/PhilipHazel/pcre2/releases" + +SRC_URI[sha256sum] = "14e4b83c4783933dc17e964318e6324f7cae1bc75d8f3c79bc6969f00c159d68" + +CVE_PRODUCT = "pcre2" + +TOOLCHAIN = "${MORELLO_TOOLCHAIN}" + +FILESEXTRAPATHS:prepend := "${THISDIR}/libpcre2:" + +S = "${WORKDIR}/pcre2-${PV}" + +PROVIDES += "pcre2-morello" +DEPENDS += "bzip2-morello zlib-morello" + +BINCONFIG = "${bindir}/pcre2-config" + +EXTRA_OECONF = "\ + --enable-newline-is-lf \ + --with-link-size=2 \ + --with-match-limit=10000000 \ + --enable-pcre2-16 \ + --enable-pcre2-32 \ +" + +CFLAGS += "-D_REENTRANT" +CXXFLAGS:append:powerpc = " -lstdc++" + +do_install:append() { + libtool --finish "${D}${libdir}" +} + +PACKAGES =+ "libpcre2-16-morello libpcre2-32-morello pcre2grep-morello pcre2grep-doc-morello pcre2test-morello pcre2test-doc-morello" + +SUMMARY:pcre2grep-morello = "grep utility that uses perl 5 compatible regexes" +SUMMARY:pcre2grep-doc-morello = "grep utility that uses perl 5 compatible regexes - docs" +SUMMARY:pcre2test-morello = "program for testing Perl-comatible regular expressions" +SUMMARY:pcre2test-doc-morello = "program for testing Perl-comatible regular expressions - docs" + +# prevent a clash with the non-morello version of libpcre2 during do_package_ipk: +PKG:libpcre2-16-morello = "libpcre2-16-0-morello" +PKG:libpcre2-32-morello = "libpcre2-32-0-morello" + +FILES:libpcre2-16-morello = "${libdir}/libpcre2-16.so.*" +FILES:libpcre2-32-morello = "${libdir}/libpcre2-32.so.*" +FILES:pcre2grep-morello = "${bindir}/pcre2grep" +FILES:pcre2grep-morello-doc = "${mandir}/man1/pcre2grep.1" +FILES:pcre2test-morello = "${bindir}/pcre2test" +FILES:pcre2test-morello-doc = "${mandir}/man1/pcre2test.1" diff --git a/recipes-support/libpcre/libpcre2/CVE-2022-41409.patch b/recipes-support/libpcre/libpcre2/CVE-2022-41409.patch new file mode 100644 index 0000000..833348c --- /dev/null +++ b/recipes-support/libpcre/libpcre2/CVE-2022-41409.patch @@ -0,0 +1,75 @@ +From 94e1c001761373b7d9450768aa15d04c25547a35 Mon Sep 17 00:00:00 2001 +From: Philip Hazel Philip.Hazel@gmail.com +Date: Tue, 16 Aug 2022 17:00:45 +0100 +Subject: [PATCH] Diagnose negative repeat value in pcre2test subject line + +CVE: CVE-2022-41409 +Upstream-Status: Backport [https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04...] + +Signed-off-by: Peter Marko peter.marko@siemens.com + +--- + ChangeLog | 3 +++ + src/pcre2test.c | 4 ++-- + testdata/testinput2 | 3 +++ + testdata/testoutput2 | 4 ++++ + 4 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index eab50eb7..276eb57a 100644 +--- a/ChangeLog ++++ b/ChangeLog +index eab50eb7..276eb57a 100644 +@@ -1,6 +1,9 @@ + Change Log for PCRE2 + -------------------- + ++20. A negative repeat value in a pcre2test subject line was not being ++diagnosed, leading to infinite looping. ++ + + Version 10.40 15-April-2022 + --------------------------- +diff --git a/src/pcre2test.c b/src/pcre2test.c +index 08f86096..f6f5d66c 100644 +--- a/src/pcre2test.c ++++ b/src/pcre2test.c +@@ -6781,9 +6781,9 @@ while ((c = *p++) != 0) + } + + i = (int32_t)li; +- if (i-- == 0) ++ if (i-- <= 0) + { +- fprintf(outfile, "** Zero repeat not allowed\n"); ++ fprintf(outfile, "** Zero or negative repeat not allowed\n"); + return PR_OK; + } + +diff --git a/testdata/testinput2 b/testdata/testinput2 +index d37d8f30..717ba2ae 100644 +--- a/testdata/testinput2 ++++ b/testdata/testinput2 +@@ -5932,4 +5932,7 @@ a)"xI + /[Aa]{2,3}/BI + aabcd + ++-- ++ [X]{-10} ++ + # End of testinput2 +diff --git a/testdata/testoutput2 b/testdata/testoutput2 +index ce090f8c..d2188d3c 100644 +--- a/testdata/testoutput2 ++++ b/testdata/testoutput2 +@@ -17746,6 +17746,10 @@ Subject length lower bound = 2 + aabcd + 0: aa + ++-- ++ [X]{-10} ++** Zero or negative repeat not allowed ++ + # End of testinput2 + Error -70: PCRE2_ERROR_BADDATA (unknown error number) + Error -62: bad serialized data