From ca899a3e2a1d93f6e119a98599779c349aca8cb62991f7e21e25097fa435797d Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Sat, 20 Feb 2021 17:33:07 +0000 Subject: [PATCH] Fix patches OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python39?expand=0&rev=54 --- CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch | 176 ---------------------- bsc1167501-invalid-alignment.patch | 76 ---------- python39.spec | 8 - subprocess-raise-timeout.patch | 4 +- 4 files changed, 2 insertions(+), 262 deletions(-) delete mode 100644 CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch delete mode 100644 bsc1167501-invalid-alignment.patch diff --git a/CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch b/CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch deleted file mode 100644 index 1cc1957..0000000 --- a/CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch +++ /dev/null @@ -1,176 +0,0 @@ -From 34df10a9a16b38d54421eeeaf73ec89828563be7 Mon Sep 17 00:00:00 2001 -From: Benjamin Peterson -Date: Mon, 18 Jan 2021 15:11:46 -0600 -Subject: [PATCH] [3.6] closes bpo-42938: Replace snprintf with Python unicode - formatting in ctypes param reprs. (GH-24250) - -(cherry picked from commit 916610ef90a0d0761f08747f7b0905541f0977c7) - -Co-authored-by: Benjamin Peterson ---- - Lib/ctypes/test/test_parameters.py | 43 +++++++++++++++ - .../2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst | 2 + - Modules/_ctypes/callproc.c | 55 +++++++------------ - 3 files changed, 66 insertions(+), 34 deletions(-) - create mode 100644 Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst - ---- a/Lib/ctypes/test/test_parameters.py -+++ b/Lib/ctypes/test/test_parameters.py -@@ -201,6 +201,49 @@ class SimpleTypesTestCase(unittest.TestC - with self.assertRaises(ZeroDivisionError): - WorseStruct().__setstate__({}, b'foo') - -+ def test_parameter_repr(self): -+ from ctypes import ( -+ c_bool, -+ c_char, -+ c_wchar, -+ c_byte, -+ c_ubyte, -+ c_short, -+ c_ushort, -+ c_int, -+ c_uint, -+ c_long, -+ c_ulong, -+ c_longlong, -+ c_ulonglong, -+ c_float, -+ c_double, -+ c_longdouble, -+ c_char_p, -+ c_wchar_p, -+ c_void_p, -+ ) -+ self.assertRegex(repr(c_bool.from_param(True)), r"^$") -+ self.assertEqual(repr(c_char.from_param(97)), "") -+ self.assertRegex(repr(c_wchar.from_param('a')), r"^$") -+ self.assertEqual(repr(c_byte.from_param(98)), "") -+ self.assertEqual(repr(c_ubyte.from_param(98)), "") -+ self.assertEqual(repr(c_short.from_param(511)), "") -+ self.assertEqual(repr(c_ushort.from_param(511)), "") -+ self.assertRegex(repr(c_int.from_param(20000)), r"^$") -+ self.assertRegex(repr(c_uint.from_param(20000)), r"^$") -+ self.assertRegex(repr(c_long.from_param(20000)), r"^$") -+ self.assertRegex(repr(c_ulong.from_param(20000)), r"^$") -+ self.assertRegex(repr(c_longlong.from_param(20000)), r"^$") -+ self.assertRegex(repr(c_ulonglong.from_param(20000)), r"^$") -+ self.assertEqual(repr(c_float.from_param(1.5)), "") -+ self.assertEqual(repr(c_double.from_param(1.5)), "") -+ self.assertEqual(repr(c_double.from_param(1e300)), "") -+ self.assertRegex(repr(c_longdouble.from_param(1.5)), r"^$") -+ self.assertRegex(repr(c_char_p.from_param(b'hihi')), "^$") -+ self.assertRegex(repr(c_wchar_p.from_param('hihi')), "^$") -+ self.assertRegex(repr(c_void_p.from_param(0x12)), r"^$") -+ - ################################################################ - - if __name__ == '__main__': ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst -@@ -0,0 +1,2 @@ -+Avoid static buffers when computing the repr of :class:`ctypes.c_double` and -+:class:`ctypes.c_longdouble` values. ---- a/Modules/_ctypes/callproc.c -+++ b/Modules/_ctypes/callproc.c -@@ -489,58 +489,47 @@ is_literal_char(unsigned char c) - static PyObject * - PyCArg_repr(PyCArgObject *self) - { -- char buffer[256]; - switch(self->tag) { - case 'b': - case 'B': -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - self->tag, self->value.b); -- break; - case 'h': - case 'H': -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - self->tag, self->value.h); -- break; - case 'i': - case 'I': -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - self->tag, self->value.i); -- break; - case 'l': - case 'L': -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - self->tag, self->value.l); -- break; - - case 'q': - case 'Q': -- sprintf(buffer, --#ifdef MS_WIN32 -- "", --#else -- "", --#endif -+ return PyUnicode_FromFormat("", - self->tag, self->value.q); -- break; - case 'd': -- sprintf(buffer, "", -- self->tag, self->value.d); -- break; -- case 'f': -- sprintf(buffer, "", -- self->tag, self->value.f); -- break; -- -+ case 'f': { -+ PyObject *f = PyFloat_FromDouble((self->tag == 'f') ? self->value.f : self->value.d); -+ if (f == NULL) { -+ return NULL; -+ } -+ PyObject *result = PyUnicode_FromFormat("", self->tag, f); -+ Py_DECREF(f); -+ return result; -+ } - case 'c': - if (is_literal_char((unsigned char)self->value.c)) { -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - self->tag, self->value.c); - } - else { -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - self->tag, (unsigned char)self->value.c); - } -- break; - - /* Hm, are these 'z' and 'Z' codes useful at all? - Shouldn't they be replaced by the functionality of c_string -@@ -549,22 +538,19 @@ PyCArg_repr(PyCArgObject *self) - case 'z': - case 'Z': - case 'P': -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - self->tag, self->value.p); -- break; - - default: - if (is_literal_char((unsigned char)self->tag)) { -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - (unsigned char)self->tag, (void *)self); - } - else { -- sprintf(buffer, "", -+ return PyUnicode_FromFormat("", - (unsigned char)self->tag, (void *)self); - } -- break; - } -- return PyUnicode_FromString(buffer); - } - - static PyMemberDef PyCArgType_members[] = { diff --git a/bsc1167501-invalid-alignment.patch b/bsc1167501-invalid-alignment.patch deleted file mode 100644 index 8752a6e..0000000 --- a/bsc1167501-invalid-alignment.patch +++ /dev/null @@ -1,76 +0,0 @@ -From e6f4de57ffd175870e513ffa387fa6e7eaaeaed2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 24 Mar 2020 07:55:00 +0100 -Subject: [PATCH] bpo-40052: Fix alignment issue in PyVectorcall_Function() - -In file included from /usr/include/python3.8/Python.h:147: -In file included from /usr/include/python3.8/abstract.h:837: -/usr/include/python3.8/cpython/abstract.h:91:11: error: cast from 'char *' to 'vectorcallfunc *' -(aka 'struct _object *(**)(struct _object *, struct _object *const *, unsigned long, struct _object *)') -increases required alignment from 1 to 8 [-Werror,-Wcast-align] - - ptr = (vectorcallfunc*)(((char *)callable) + offset); - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -1 error generated. - -Signed-off-by: Andreas Schneider ---- - Include/cpython/abstract.h | 9 ++++++--- - .../next/C API/2020-03-24-09-27-10.bpo-40052.27P2KG.rst | 1 + - Objects/call.c | 7 ++++++- - 3 files changed, 13 insertions(+), 4 deletions(-) - create mode 100644 Misc/NEWS.d/next/C API/2020-03-24-09-27-10.bpo-40052.27P2KG.rst - ---- a/Include/cpython/abstract.h -+++ b/Include/cpython/abstract.h -@@ -67,7 +67,10 @@ PyVectorcall_Function(PyObject *callable - { - PyTypeObject *tp; - Py_ssize_t offset; -- vectorcallfunc *ptr; -+ union { -+ char *data; -+ vectorcallfunc *ptr; -+ } vc; - - assert(callable != NULL); - tp = Py_TYPE(callable); -@@ -77,8 +80,8 @@ PyVectorcall_Function(PyObject *callable - assert(PyCallable_Check(callable)); - offset = tp->tp_vectorcall_offset; - assert(offset > 0); -- ptr = (vectorcallfunc *)(((char *)callable) + offset); -- return *ptr; -+ vc.data = (char *)callable + offset; -+ return *vc.ptr; - } - - /* Call the callable object 'callable' with the "vectorcall" calling ---- a/Objects/call.c -+++ b/Objects/call.c -@@ -205,6 +205,10 @@ PyObject * - PyVectorcall_Call(PyObject *callable, PyObject *tuple, PyObject *kwargs) - { - PyThreadState *tstate = _PyThreadState_GET(); -+ union { -+ char *data; -+ vectorcallfunc *ptr; -+ } vc; - - /* get vectorcallfunc as in PyVectorcall_Function, but without - * the Py_TPFLAGS_HAVE_VECTORCALL check */ -@@ -215,7 +219,8 @@ PyVectorcall_Call(PyObject *callable, Py - Py_TYPE(callable)->tp_name); - return NULL; - } -- vectorcallfunc func = *(vectorcallfunc *)(((char *)callable) + offset); -+ vc.data = (char *)callable + offset; -+ vectorcallfunc func = *vc.ptr; - if (func == NULL) { - _PyErr_Format(tstate, PyExc_TypeError, - "'%.200s' object does not support vectorcall", ---- /dev/null -+++ b/Misc/NEWS.d/next/C -@@ -0,0 +1 @@ -+Fix an alignment build warning/error in function ``PyVectorcall_Function()`` publicly exposed by ``abstract.h``. -\ No newline at end of file diff --git a/python39.spec b/python39.spec index 3df4e6a..ba4ece0 100644 --- a/python39.spec +++ b/python39.spec @@ -137,17 +137,11 @@ Patch27: CVE-2019-5010-null-defer-x509-cert-DOS.patch # PATCH-FEATURE-UPSTREAM bpo-31046_ensurepip_honours_prefix.patch bpo#31046 mcepl@suse.com # ensurepip should honour the value of $(prefix) Patch29: bpo-31046_ensurepip_honours_prefix.patch -# PATCH-FIX-UPSTREAM bsc1167501-invalid-alignment.patch gh#python/cpython#19133 mcepl@suse.com -# Fix wrong misalignment of pointer to vectorcallfunc -Patch31: bsc1167501-invalid-alignment.patch # PATCH-FIX-UPSTREAM stop calling removed Sphinx function gh#python/cpython#13236 Patch32: sphinx-update-removed-function.patch # PATCH-FIX-SLE no-skipif-doctests.patch jsc#SLE-13738 mcepl@suse.com # SLE-15 version of Sphinx doesn't know about skipif directive in doctests. Patch33: no-skipif-doctests.patch -# PATCH-FIX-UPSTREAM CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch bsc#1181126 mcepl@suse.com -# buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution -Patch34: CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch BuildRequires: automake BuildRequires: fdupes BuildRequires: gmp-devel @@ -393,12 +387,10 @@ other applications. %patch25 -p1 %patch27 -p1 %patch29 -p1 -%patch31 -p1 %patch32 -p1 %if 0%{?suse_version} <= 1500 %patch33 -p1 %endif -%patch34 -p1 # drop Autoconf version requirement sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac diff --git a/subprocess-raise-timeout.patch b/subprocess-raise-timeout.patch index a0de87d..70094ef 100644 --- a/subprocess-raise-timeout.patch +++ b/subprocess-raise-timeout.patch @@ -1,6 +1,6 @@ --- a/Lib/test/test_subprocess.py +++ b/Lib/test/test_subprocess.py -@@ -230,7 +230,8 @@ +@@ -252,7 +252,8 @@ class ProcessTestCase(BaseTestCase): "time.sleep(3600)"], # Some heavily loaded buildbots (sparc Debian 3.x) require # this much time to start and print. @@ -9,4 +9,4 @@ + timeout=10) self.fail("Expected TimeoutExpired.") self.assertEqual(c.exception.output, b'BDFL') - +