sys-apps/pacman: Rev bump to fix CVE-2016-5434 (bug #585940)

Closes: https://bugs.gentoo.org/633742
Closes: https://bugs.gentoo.org/631754

Package-Manager: Portage-2.3.11, Repoman-2.3.3
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

3 files changed, 251 insertions, 0 deletions

diff --git a/sys-apps/pacman/files/pacman-5.0.2-CVE-2016-5434.patch b/sys-apps/pacman/files/pacman-5.0.2-CVE-2016-5434.patch
new file mode 100644
index 000000000000..c245cb78dcbc
--- /dev/null
+++ b/sys-apps/pacman/files/pacman-5.0.2-CVE-2016-5434.patch
@@ -0,0 +1,136 @@
+From bf84fd00d3ac1ae2a43dac57f7ef689ef2e8b8aa Mon Sep 17 00:00:00 2001
+From: Nils Freydank <holgersson@posteo.de>
+Date: Fri, 20 Oct 2017 22:30:33 +0200
+Subject: [PATCH] Fix CVE-2016-5434 (DoS/loop and out of boundary read)
+
+This is a rewrite of Tobias Stoeckmann’s patch from June 2016[1] using
+functions instead of macros. (Thanks to Tobias for explanations of his patch.)
+A short question on Freenode IRC showed that macros are generally discouraged
+and functions should be used.
+
+The patch introduces a static size_t length_check() in libalpm/signing.c.
+
+[1] Original patch:
+https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html
+CVE request (and assignment):
+http://seclists.org/oss-sec/2016/q2/526
+---
+ This patch is provided to upstream, but not merged (2017-10-25).
+
+ lib/libalpm/signing.c | 48 ++++++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 44 insertions(+), 4 deletions(-)
+
+diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c
+index 95cb3280..51b11df6 100644
+--- a/lib/libalpm/signing.c
++++ b/lib/libalpm/signing.c
+@@ -986,6 +986,19 @@ int SYMEXPORT alpm_siglist_cleanup(alpm_siglist_t *siglist)
+ 	return 0;
+ }
+ 
++/* Check to avoid out of boundary reads */
++static size_t length_check(size_t length, size_t position, size_t a,
++		alpm_handle_t *handle, const char *identifier)
++{
++	if( a == 0 || length - position <= a) {
++		_alpm_log(handle, ALPM_LOG_ERROR,
++		_("%s: signature format error"), identifier);
++		return -1;
++	} else {
++		return 0;
++	}
++}
++
+ /**
+  * Extract the Issuer Key ID from a signature
+  * @param sig PGP signature
+@@ -1022,16 +1035,25 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier,
+ 
+ 		switch(sig[pos] & 0x03) {
+ 			case 0:
++				if(length_check(len, pos, 2, handle, identifier) != 0) {
++					return -1;
++				}
+ 				blen = sig[pos + 1];
+ 				pos = pos + 2;
+ 				break;
+ 
+ 			case 1:
++				if(length_check(len, pos, 3, handle, identifier)) {
++					return -1;
++				}
+ 				blen = (sig[pos + 1] << 8) | sig[pos + 2];
+ 				pos = pos + 3;
+ 				break;
+ 
+ 			case 2:
++				if(length_check(len, pos, 5, handle, identifier)) {
++					return -1;
++				}
+ 				blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4];
+ 				pos = pos + 5;
+ 				break;
+@@ -1059,7 +1081,16 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier,
+ 
+ 		pos = pos + 4;
+ 
++		/* pos got changed above, so an explicit check is necessary
++		 * check for 2 as that catches another some lines down */
++		if(length_check(len, pos, 2, handle, identifier)) {
++			return -1;
++		}
+ 		hlen = (sig[pos] << 8) | sig[pos + 1];
++
++		if(length_check(len, pos, hlen + 2, handle, identifier)) {
++			return -1;
++		}
+ 		pos = pos + hlen + 2;
+ 
+ 		ulen = (sig[pos] << 8) | sig[pos + 1];
+@@ -1072,30 +1103,39 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier,
+ 				slen = sig[spos];
+ 				spos = spos + 1;
+ 			} else if(sig[spos] < 255) {
++				if(length_check(pos + ulen, spos, 2, handle, identifier)){
++					return -1;
++				}
+ 				slen = (sig[spos] << 8) | sig[spos + 1];
+ 				spos = spos + 2;
+ 			} else {
++				/* check for pos and spos, as spos is still pos */
++				if(length_check(len, pos, 5, handle, identifier)) {
++					return -1;
++				}
+ 				slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4];
+ 				spos = spos + 5;
+ 			}
+-
+ 			if(sig[spos] == 16) {
+ 				/* issuer key ID */
+ 				char key[17];
+ 				size_t i;
++				if(length_check(pos + ulen, spos, 8, handle, identifier)) {
++					return -1;
++				}
+ 				for (i = 0; i < 8; i++) {
+ 					sprintf(&key[i * 2], "%02X", sig[spos + i + 1]);
+ 				}
+ 				*keys = alpm_list_add(*keys, strdup(key));
+ 				break;
+ 			}
+-
++			if(length_check(pos + ulen + 1, spos, slen, handle, identifier)) {
++				return -1;
++			}
+ 			spos = spos + slen;
+ 		}
+-
+ 		pos = pos + (blen - hlen - 8);
+ 	}
+-
+ 	return 0;
+ }
+ 
+-- 
+2.14.2
+
diff --git a/sys-apps/pacman/metadata.xml b/sys-apps/pacman/metadata.xml
index 24ba8965c722..2eb4eff00bb6 100644
--- a/sys-apps/pacman/metadata.xml
+++ b/sys-apps/pacman/metadata.xml
@@ -14,6 +14,9 @@
 		<email>proxy-maint@gentoo.org</email>
 		<name>Proxy Maintainers</name>
 	</maintainer>
+	<slots>
+		<subslots>Reflect major ABI of libalpm.so.</subslots>
+	</slots>
 	<use>
 		<flag name="doc">Install extended documentation using <pkg>app-doc/doxygen</pkg>. (Man pages are included by default.)</flag>
 		<flag name="gpg">Enable GPG signature verification using <pkg>app-crypt/gpgme</pkg></flag>
diff --git a/sys-apps/pacman/pacman-5.0.2-r1.ebuild b/sys-apps/pacman/pacman-5.0.2-r1.ebuild
new file mode 100644
index 000000000000..f60a609779c2
--- /dev/null
+++ b/sys-apps/pacman/pacman-5.0.2-r1.ebuild
@@ -0,0 +1,112 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+PYTHON_COMPAT=( python2_7 )
+
+inherit autotools
+
+DESCRIPTION="Archlinux's binary package manager"
+HOMEPAGE="https://archlinux.org/pacman/"
+
+PATCHES=()
+
+if [[ ${PV} == "9999" ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://git.archlinux.org/pacman.git"
+else
+	SRC_URI="https://sources.archlinux.org/other/pacman/${P}.tar.gz"
+	# Do *not* re-add ~x86!
+	# https://www.archlinux.org/news/phasing-out-i686-support/
+	KEYWORDS="~amd64"
+
+	PATCHES+=( "${FILESDIR}"/${PN}-5.0.2-CVE-2016-5434.patch )
+fi
+
+LICENSE="GPL-2"
+SLOT="0/10"
+
+IUSE="curl debug doc +gpg test"
+COMMON_DEPEND="app-arch/libarchive:=[lzma]
+	gpg? ( >=app-crypt/gpgme-1.4.0:= )
+	dev-libs/openssl:0=
+	curl? ( net-misc/curl )
+	virtual/libiconv
+	virtual/libintl"
+RDEPEND="${COMMON_DEPEND}"
+
+DEPEND="${COMMON_DEPEND}
+	app-text/asciidoc
+	doc? ( app-doc/doxygen )
+	test? ( sys-apps/fakeroot
+	sys-apps/fakechroot )"
+
+# workaround until tests are fixed/sorted out
+RESTRICT="test"
+
+src_prepare() {
+	# Remove a line that adds "-Werror" in ./configure when
+	# "--enable-debug" is passed:
+	sed -i -e '/-Werror/d' configure.ac || die
+
+	default
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--localstatedir=/var
+		--disable-git-version
+		--with-openssl
+		# Help protect user from shooting his/her Gentoo installation
+		# in its foot.
+		--with-root-dir="${EPREFIX}/var/chroot/archlinux"
+		$(use_enable debug)
+		# full doc with doxygen
+		$(use_enable doc doxygen)
+		$(use_with curl libcurl)
+		$(use_with gpg gpgme)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	default
+
+	emake -C contrib
+}
+
+src_install() {
+	dodir /etc/pacman.d/
+	# contributed parts, i.e. not pacman itself, but useful helpers and some templates and basic docs
+	dobin "${S}"/contrib/{bacman,checkupdates,pac{cache,diff,list,log-pkglist,scripts,search},rankmirrors,updpkgsums}
+	newdoc "${S}"/contrib/README contrib-README
+	dodoc "${S}"/contrib/PKGBUILD.vim
+	# create /var/chroot/archlinux
+	# see bug #631754
+	dodir /var/chroot/archlinux
+
+	default
+	# avoid creating stuff inside /var/cache/
+	# see bug #633742 for more information
+	rm -r "${D}"/var/cache/pacman
+}
+
+pkg_postinst() {
+	einfo ""
+	einfo "The default root dir was set to ${EPREFIX}/var/chroot/archlinux"
+	einfo "to avoid breaking Gentoo systems due to oscitancy."
+	einfo "If you prefer another directory, take a look at"
+	einfo "pacman’s parameter -r|--root)."
+	einfo ""
+	einfo "You will need to setup at least one mirror in /etc/pacman.d/mirrorlist."
+	einfo "Please generate it manually according to the Archlinux documentation:"
+	einfo "https://wiki.archlinux.org/index.php/Mirror"
+	einfo ""
+	ewarn "Archlinux is dropping support for x86 (i686 called there) entirely"
+	ewarn "in Nov 2017. Please keep this in mind when setting up new systems."
+	ewarn "For more details see"
+	ewarn "https://www.archlinux.org/news/phasing-out-i686-support"
+	einfo ""
+}