diff --git a/SOURCES/perl-5.26.3-CVE-2020-12723.patch b/SOURCES/perl-5.26.3-CVE-2020-12723.patch new file mode 100644 index 0000000..a98c81f --- /dev/null +++ b/SOURCES/perl-5.26.3-CVE-2020-12723.patch @@ -0,0 +1,279 @@ +From c031e3ec7c713077659f5f7dc6638d926c69d7b2 Mon Sep 17 00:00:00 2001 +From: Hugo van der Sanden +Date: Sat, 11 Apr 2020 14:10:24 +0100 +Subject: [PATCH v528 3/3] study_chunk: avoid mutating regexp program within + GOSUB + +gh16947 and gh17743: studying GOSUB may restudy in an inner call +(via a mix of recursion and enframing) something that an outer call +is in the middle of looking at. Let the outer frame deal with it. + +(CVE-2020-12723) +--- + embed.fnc | 2 +- + embed.h | 2 +- + proto.h | 2 +- + regcomp.c | 48 ++++++++++++++++++++++++++++++++---------------- + t/re/pat.t | 26 +++++++++++++++++++++++++- + 5 files changed, 60 insertions(+), 20 deletions(-) + +diff --git a/embed.fnc b/embed.fnc +index cf89277163..4b1ba28277 100644 +--- a/embed.fnc ++++ b/embed.fnc +@@ -2397,7 +2397,7 @@ Es |SSize_t|study_chunk |NN RExC_state_t *pRExC_state \ + |NULLOK struct scan_data_t *data \ + |I32 stopparen|U32 recursed_depth \ + |NULLOK regnode_ssc *and_withp \ +- |U32 flags|U32 depth ++ |U32 flags|U32 depth|bool was_mutate_ok + EsRn |U32 |add_data |NN RExC_state_t* const pRExC_state \ + |NN const char* const s|const U32 n + rs |void |re_croak2 |bool utf8|NN const char* pat1|NN const char* pat2|... +diff --git a/embed.h b/embed.h +index 886551ce5c..50fcabc140 100644 +--- a/embed.h ++++ b/embed.h +@@ -1075,7 +1075,7 @@ + #define ssc_is_cp_posixl_init S_ssc_is_cp_posixl_init + #define ssc_or(a,b,c) S_ssc_or(aTHX_ a,b,c) + #define ssc_union(a,b,c) S_ssc_union(aTHX_ a,b,c) +-#define study_chunk(a,b,c,d,e,f,g,h,i,j,k) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k) ++#define study_chunk(a,b,c,d,e,f,g,h,i,j,k,l) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k,l) + # endif + # if defined(PERL_IN_REGCOMP_C) || defined (PERL_IN_DUMP_C) + #define _invlist_dump(a,b,c,d) Perl__invlist_dump(aTHX_ a,b,c,d) +diff --git a/proto.h b/proto.h +index d3f8802c1d..e276f69bd1 100644 +--- a/proto.h ++++ b/proto.h +@@ -5258,7 +5258,7 @@ PERL_STATIC_INLINE void S_ssc_union(pTHX_ regnode_ssc *ssc, SV* const invlist, c + #define PERL_ARGS_ASSERT_SSC_UNION \ + assert(ssc); assert(invlist) + #endif +-STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth); ++STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth, bool was_mutate_ok); + #define PERL_ARGS_ASSERT_STUDY_CHUNK \ + assert(pRExC_state); assert(scanp); assert(minlenp); assert(deltap); assert(last) + #endif +diff --git a/regcomp.c b/regcomp.c +index 0a9c6a8085..e66032a16a 100644 +--- a/regcomp.c ++++ b/regcomp.c +@@ -110,6 +110,7 @@ typedef struct scan_frame { + regnode *next_regnode; /* next node to process when last is reached */ + U32 prev_recursed_depth; + I32 stopparen; /* what stopparen do we use */ ++ bool in_gosub; /* this or an outer frame is for GOSUB */ + U32 is_top_frame; /* what flags do we use? */ + + struct scan_frame *this_prev_frame; /* this previous frame */ +@@ -4102,7 +4103,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + I32 stopparen, + U32 recursed_depth, + regnode_ssc *and_withp, +- U32 flags, U32 depth) ++ U32 flags, U32 depth, bool was_mutate_ok) + /* scanp: Start here (read-write). */ + /* deltap: Write maxlen-minlen here. */ + /* last: Stop before this one. */ +@@ -4179,6 +4180,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + node length to get a real minimum (because + the folded version may be shorter) */ + bool unfolded_multi_char = FALSE; ++ /* avoid mutating ops if we are anywhere within the recursed or ++ * enframed handling for a GOSUB: the outermost level will handle it. ++ */ ++ bool mutate_ok = was_mutate_ok && !(frame && frame->in_gosub); + /* Peephole optimizer: */ + DEBUG_STUDYDATA("Peep:", data, depth); + DEBUG_PEEP("Peep", scan, depth); +@@ -4189,7 +4194,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + * parsing code, as each (?:..) is handled by a different invocation of + * reg() -- Yves + */ +- JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); ++ if (mutate_ok) ++ JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); + + /* Follow the next-chain of the current node and optimize + away all the NOTHINGs from it. */ +@@ -4238,7 +4244,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + * NOTE we dont use the return here! */ + (void)study_chunk(pRExC_state, &scan, &minlen, + &deltanext, next, &data_fake, stopparen, +- recursed_depth, NULL, f, depth+1); ++ recursed_depth, NULL, f, depth+1, mutate_ok); + + scan = next; + } else +@@ -4305,7 +4311,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + /* we suppose the run is continuous, last=next...*/ + minnext = study_chunk(pRExC_state, &scan, minlenp, + &deltanext, next, &data_fake, stopparen, +- recursed_depth, NULL, f,depth+1); ++ recursed_depth, NULL, f, depth+1, ++ mutate_ok); + + if (min1 > minnext) + min1 = minnext; +@@ -4372,9 +4379,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + } + } + +- if (PERL_ENABLE_TRIE_OPTIMISATION && +- OP( startbranch ) == BRANCH ) +- { ++ if (PERL_ENABLE_TRIE_OPTIMISATION ++ && OP(startbranch) == BRANCH ++ && mutate_ok ++ ) { + /* demq. + + Assuming this was/is a branch we are dealing with: 'scan' +@@ -4825,6 +4833,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + newframe->stopparen = stopparen; + newframe->prev_recursed_depth = recursed_depth; + newframe->this_prev_frame= frame; ++ newframe->in_gosub = ( ++ (frame && frame->in_gosub) || OP(scan) == GOSUB ++ ); + + DEBUG_STUDYDATA("frame-new:",data,depth); + DEBUG_PEEP("fnew", scan, depth); +@@ -5043,7 +5054,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + (mincount == 0 + ? (f & ~SCF_DO_SUBSTR) + : f) +- ,depth+1); ++ , depth+1, mutate_ok); + + if (flags & SCF_DO_STCLASS) + data->start_class = oclass; +@@ -5105,7 +5116,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + if ( OP(oscan) == CURLYX && data + && data->flags & SF_IN_PAR + && !(data->flags & SF_HAS_EVAL) +- && !deltanext && minnext == 1 ) { ++ && !deltanext && minnext == 1 ++ && mutate_ok ++ ) { + /* Try to optimize to CURLYN. */ + regnode *nxt = NEXTOPER(oscan) + EXTRA_STEP_2ARGS; + regnode * const nxt1 = nxt; +@@ -5151,10 +5164,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + && !(data->flags & SF_HAS_EVAL) + && !deltanext /* atom is fixed width */ + && minnext != 0 /* CURLYM can't handle zero width */ +- + /* Nor characters whose fold at run-time may be + * multi-character */ + && ! (RExC_seen & REG_UNFOLDED_MULTI_SEEN) ++ && mutate_ok + ) { + /* XXXX How to optimize if data == 0? */ + /* Optimize to a simpler form. */ +@@ -5201,7 +5214,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + #endif + /* Optimize again: */ + study_chunk(pRExC_state, &nxt1, minlenp, &deltanext, nxt, +- NULL, stopparen, recursed_depth, NULL, 0,depth+1); ++ NULL, stopparen, recursed_depth, NULL, 0, ++ depth+1, mutate_ok); + } + else + oscan->flags = 0; +@@ -5592,7 +5606,8 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n", + nscan = NEXTOPER(NEXTOPER(scan)); + minnext = study_chunk(pRExC_state, &nscan, minlenp, &deltanext, + last, &data_fake, stopparen, +- recursed_depth, NULL, f, depth+1); ++ recursed_depth, NULL, f, depth+1, ++ mutate_ok); + if (scan->flags) { + if (deltanext) { + FAIL("Variable length lookbehind not implemented"); +@@ -5681,7 +5696,7 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n", + *minnextp = study_chunk(pRExC_state, &nscan, minnextp, + &deltanext, last, &data_fake, + stopparen, recursed_depth, NULL, +- f,depth+1); ++ f, depth+1, mutate_ok); + if (scan->flags) { + if (deltanext) { + FAIL("Variable length lookbehind not implemented"); +@@ -5841,7 +5856,8 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n", + branches even though they arent otherwise used. */ + minnext = study_chunk(pRExC_state, &scan, minlenp, + &deltanext, (regnode *)nextbranch, &data_fake, +- stopparen, recursed_depth, NULL, f,depth+1); ++ stopparen, recursed_depth, NULL, f, depth+1, ++ mutate_ok); + } + if (nextbranch && PL_regkind[OP(nextbranch)]==BRANCH) + nextbranch= regnext((regnode*)nextbranch); +@@ -7524,7 +7540,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count, + &data, -1, 0, NULL, + SCF_DO_SUBSTR | SCF_WHILEM_VISITED_POS | stclass_flag + | (restudied ? SCF_TRIE_DOING_RESTUDY : 0), +- 0); ++ 0, TRUE); + + + CHECK_RESTUDY_GOTO_butfirst(LEAVE_with_name("study_chunk")); +@@ -7670,7 +7686,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count, + SCF_DO_STCLASS_AND|SCF_WHILEM_VISITED_POS|(restudied + ? SCF_TRIE_DOING_RESTUDY + : 0), +- 0); ++ 0, TRUE); + + CHECK_RESTUDY_GOTO_butfirst(NOOP); + +diff --git a/t/re/pat.t b/t/re/pat.t +index 1d98fe77d7..1488259b02 100644 +--- a/t/re/pat.t ++++ b/t/re/pat.t +@@ -23,7 +23,7 @@ BEGIN { + skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader; + skip_all_without_unicode_tables(); + +-plan tests => 840; # Update this when adding/deleting tests. ++plan tests => 844; # Update this when adding/deleting tests. + + run_tests() unless caller; + +@@ -1929,6 +1929,30 @@ EOP + fresh_perl_is('"AA" =~ m/AA{1,0}/','',{},"handle OPFAIL insert properly"); + } + ++ # gh16947: test regexp corruption (GOSUB) ++ { ++ fresh_perl_is(q{ ++ 'xy' =~ /x(?0)|x(?|y|y)/ && print 'ok' ++ }, 'ok', {}, 'gh16947: test regexp corruption (GOSUB)'); ++ } ++ # gh16947: test fix doesn't break SUSPEND ++ { ++ fresh_perl_is(q{ 'sx' =~ m{ss++}i; print 'ok' }, ++ 'ok', {}, "gh16947: test fix doesn't break SUSPEND"); ++ } ++ ++ # gh17743: more regexp corruption via GOSUB ++ { ++ fresh_perl_is(q{ ++ "0" =~ /((0(?0)|000(?|0000|0000)(?0))|)/; print "ok" ++ }, 'ok', {}, 'gh17743: test regexp corruption (1)'); ++ ++ fresh_perl_is(q{ ++ "000000000000" =~ /(0(())(0((?0)())|000(?|\x{ef}\x{bf}\x{bd}|\x{ef}\x{bf}\x{bd}))|)/; ++ print "ok" ++ }, 'ok', {}, 'gh17743: test regexp corruption (2)'); ++ } ++ + } # End of sub run_tests + + 1; +-- +2.20.1 + diff --git a/SOURCES/perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch b/SOURCES/perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch new file mode 100644 index 0000000..4fb8553 --- /dev/null +++ b/SOURCES/perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch @@ -0,0 +1,113 @@ +From 381d51822fccaa333cbd0ab9fca8b69f650c05f9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= +Date: Fri, 14 Feb 2020 14:10:10 +0100 +Subject: [PATCH] Only pass 2-digit years to tests when testing 2-digit year + handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This will start breaking in 2020 if done without working around the whole +breakpoint thing. See https://rt.cpan.org/Ticket/Display.html?id=124787. + +Ported from Time-Local 63265fd81c7f6177bf28dfe0d1ada9cb897de566 commit +by Dave Rolsky to perl 5.28.2. + +Signed-off-by: Petr Písař +--- + cpan/Time-Local/t/Local.t | 40 +++++++++++++++++++++++++++++---------- + 1 file changed, 30 insertions(+), 10 deletions(-) + +diff --git a/cpan/Time-Local/t/Local.t b/cpan/Time-Local/t/Local.t +index 6341396..701d22d 100644 +--- a/cpan/Time-Local/t/Local.t ++++ b/cpan/Time-Local/t/Local.t +@@ -85,19 +85,17 @@ my $epoch_is_64 + + for ( @time, @neg_time ) { + my ( $year, $mon, $mday, $hour, $min, $sec ) = @$_; +- $year -= 1900; + $mon--; + + SKIP: { + skip '1970 test on VOS fails.', 12 +- if $^O eq 'vos' && $year == 70; ++ if $^O eq 'vos' && $year == 1970; + skip 'this platform does not support negative epochs.', 12 +- if $year < 70 && !$neg_epoch_ok; ++ if $year < 1970 && !$neg_epoch_ok; + + # Test timelocal() + { +- my $year_in = $year < 70 ? $year + 1900 : $year; +- my $time = timelocal( $sec, $min, $hour, $mday, $mon, $year_in ); ++ my $time = timelocal( $sec, $min, $hour, $mday, $mon, $year ); + + my ( $s, $m, $h, $D, $M, $Y ) = localtime($time); + +@@ -106,13 +104,12 @@ SKIP: { + is( $h, $hour, "timelocal hour for @$_" ); + is( $D, $mday, "timelocal day for @$_" ); + is( $M, $mon, "timelocal month for @$_" ); +- is( $Y, $year, "timelocal year for @$_" ); ++ is( $Y, $year - 1900, "timelocal year for @$_" ); + } + + # Test timegm() + { +- my $year_in = $year < 70 ? $year + 1900 : $year; +- my $time = timegm( $sec, $min, $hour, $mday, $mon, $year_in ); ++ my $time = timegm( $sec, $min, $hour, $mday, $mon, $year ); + + my ( $s, $m, $h, $D, $M, $Y ) = gmtime($time); + +@@ -121,14 +118,13 @@ SKIP: { + is( $h, $hour, "timegm hour for @$_" ); + is( $D, $mday, "timegm day for @$_" ); + is( $M, $mon, "timegm month for @$_" ); +- is( $Y, $year, "timegm year for @$_" ); ++ is( $Y, $year - 1900, "timegm year for @$_" ); + } + } + } + + for (@bad_time) { + my ( $year, $mon, $mday, $hour, $min, $sec ) = @$_; +- $year -= 1900; + $mon--; + + eval { timegm( $sec, $min, $hour, $mday, $mon, $year ) }; +@@ -229,6 +225,30 @@ SKIP: + ); + } + ++# 2-digit years ++{ ++ my $current_year = ( localtime() )[5]; ++ my $pre_break = ( $current_year + 49 ) - 100; ++ my $break = ( $current_year + 50 ) - 100; ++ my $post_break = ( $current_year + 51 ) - 100; ++ ++ is( ++ ( ( localtime( timelocal( 0, 0, 0, 1, 1, $pre_break ) ) )[5] ), ++ $pre_break + 100, ++ "year $pre_break is treated as next century", ++ ); ++ is( ++ ( ( localtime( timelocal( 0, 0, 0, 1, 1, $break ) ) )[5] ), ++ $break + 100, ++ "year $break is treated as next century", ++ ); ++ is( ++ ( ( localtime( timelocal( 0, 0, 0, 1, 1, $post_break ) ) )[5] ), ++ $post_break, ++ "year $post_break is treated as current century", ++ ); ++} ++ + SKIP: + { + skip 'These tests only run for the package maintainer.', 8 +-- +2.21.1 + diff --git a/SPECS/perl.spec b/SPECS/perl.spec index 16e6095..5804c5b 100644 --- a/SPECS/perl.spec +++ b/SPECS/perl.spec @@ -81,7 +81,7 @@ License: GPL+ or Artistic Epoch: %{perl_epoch} Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 416%{?dist} +Release: 417%{?dist} Summary: Practical Extraction and Report Language Url: http://www.perl.org/ Source0: http://www.cpan.org/src/5.0/perl-%{perl_version}.tar.bz2 @@ -289,6 +289,14 @@ Patch89: perl-5.26.2-perl.h-Add-parens-around-macro-arguments.patch # Pass the correct CFLAGS to dtrace Patch90: perl-5.26.2-Pass-CFLAGS-to-dtrace.patch +# Fix Time-Local tests to pass after year 2019, bug #1807120, CPAN RT#124787, +# GH#17410, in Time-Local-1.26 +Patch91: perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch + +# Fix CVE-2020-12723, bug #1909860, GH#16947, fixed in upstream 5.28.3, ported from +# upstream 3f4ba871d2d397dcd4386ed75e05353c36135c29. +Patch92: perl-5.26.3-CVE-2020-12723.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -2895,6 +2903,8 @@ Perl extension for Version Objects %patch88 -p1 %patch89 -p1 %patch90 -p1 +%patch91 -p1 +%patch92 -p1 %patch200 -p1 %patch201 -p1 @@ -2952,6 +2962,8 @@ perl -x patchlevel.h \ 'Fedora Patch88: Fix printing a warning about a wide character when matching a regular expression while ISO-8859-1 locale is in effect' \ 'Fedora Patch89: Fix invoking a check for wide characters while ISO-8859-1 locale is in effect' \ 'Fedora Patch90: Pass the correct CFLAGS to dtrace' \ + 'RHEL Patch91: Fix Time-Local tests to pass after year 2019 (bug #1807120)' \ + 'RHEL Patch92: Fix CVE-2020-12723 (GH#16947)' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ %{nil} @@ -5239,6 +5251,10 @@ popd # Old changelog entries are preserved in CVS. %changelog +* Fri Dec 18 2020 Petr Pisar - 4:5.26.3-417 +- Fix CVE-2020-12723 (bug #1909860) +- Fix Time-Local tests to pass after year 2019 (bug #1807120) + * Thu Dec 06 2018 Jitka Plesnikova - 4:5.26.3-416 - 5.26.3 bump (bug #1655526) - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)