From 74d540b0cf28755b117e35c6e5e7f10ba463e5b0 Mon Sep 17 00:00:00 2001 From: Georgy Yakovlev Date: Fri, 16 Sep 2022 13:50:48 -0700 Subject: app-shells/ksh: drop 2020.0.0-r1 Signed-off-by: Georgy Yakovlev --- app-shells/ksh/Manifest | 1 - app-shells/ksh/files/CVE-2019-14868.patch | 89 ---------------------- .../ksh/files/ksh-2020.0.0-ensure-user-set.patch | 30 -------- .../ksh/files/ksh-2020.0.0-skip-api-test.patch | 36 --------- app-shells/ksh/ksh-2020.0.0-r1.ebuild | 50 ------------ 5 files changed, 206 deletions(-) delete mode 100644 app-shells/ksh/files/CVE-2019-14868.patch delete mode 100644 app-shells/ksh/files/ksh-2020.0.0-ensure-user-set.patch delete mode 100644 app-shells/ksh/files/ksh-2020.0.0-skip-api-test.patch delete mode 100644 app-shells/ksh/ksh-2020.0.0-r1.ebuild diff --git a/app-shells/ksh/Manifest b/app-shells/ksh/Manifest index 2e62c5d467c2..6b1143d68816 100644 --- a/app-shells/ksh/Manifest +++ b/app-shells/ksh/Manifest @@ -1,3 +1,2 @@ -DIST ksh-2020.0.0.tar.gz 2022880 BLAKE2B cb952c4febe88a3ccf8fd48f511a30a73bfc812ebf0b7a5fe799470b29ee13ca61004fd34e367d836940a88214da2aa05b7cb96f173a1b8d57c8e644c8c3a2a6 SHA512 7d6da3af341a62718d691ddc52e10bdf3b7290d74f1cd01610093c587af47b6d6d04b74b210eb31f93a3559855a5bc5155f9b188d2f8bb4444042c26bfaf1792 DIST ksh-v1.0.0-beta.2.tar.gz 2238224 BLAKE2B b4eb8e116d0dd8fda498fb8d2805613a73291be628ce87ebc1c47c9bc8c49b236b285accaf35b4c9e411df23b99c6a949b672edeea1f1f317fc85a2b4db48779 SHA512 c2cd5a4b442bcff1dd2c1c054ee79c4cb131dce28d811dcd3476164d6cb7e88e6b317a094b16f227564a1266708ef0cfeca2af0929c00a19497cf1b67c647cf2 DIST ksh-v1.0.3.tar.gz 2110771 BLAKE2B 4316c78f7889fb2e4630a83dd0f1c5c4c4b418a822e8f7d3d9415a83bbef6e993cbd21b4842c7f56cd8647305c4bdddc04562b8788f2ee6e14698a9cb090f386 SHA512 9d6e664bc6c8d102ba09e692d057b9546b07ba3ecb060449df6648e7c99f8dfd670401e6fcf34f6f3de13338a3c31c09596344931ccfdf4cd4e49eabdf005c23 diff --git a/app-shells/ksh/files/CVE-2019-14868.patch b/app-shells/ksh/files/CVE-2019-14868.patch deleted file mode 100644 index d5c80566bafc..000000000000 --- a/app-shells/ksh/files/CVE-2019-14868.patch +++ /dev/null @@ -1,89 +0,0 @@ -From c7de8b641266bac7c77942239ac659edfee9ecd2 Mon Sep 17 00:00:00 2001 -From: Kurtis Rader -Date: Thu, 12 Dec 2019 18:46:50 -0800 -Subject: [PATCH] Harden env var imports - ---- - src/cmd/ksh93/sh/arith.c | 37 ++++++++++++++++++++++----------- - src/cmd/ksh93/tests/subshell.sh | 23 ++++++++++++++++++++ - -diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c -index 30b3067590a2..8e68cbdc868a 100644 ---- a/src/cmd/ksh93/sh/arith.c -+++ b/src/cmd/ksh93/sh/arith.c -@@ -567,19 +567,32 @@ Sfdouble_t sh_strnum(Shell_t *shp, const char *str, char **ptr, int mode) { - char *last; - - if (*str == 0) { -- if (ptr) *ptr = (char *)str; -- return 0; -- } -- errno = 0; -- d = number(str, &last, shp->inarith ? 0 : 10, NULL); -- if (*last) { -- if (*last != '.' || last[1] != '.') { -- d = strval(shp, str, &last, arith, mode); -- Varsubscript = true; -+ d = 0.0; -+ last = (char *)str; -+ } else { -+ d = number(str, &last, shp->inarith ? 0 : 10, NULL); -+ if (*last && !shp->inarith && sh_isstate(shp, SH_INIT)) { -+ // This call is to handle "base#value" literals if we're importing untrusted env vars. -+ d = number(str, &last, 0, NULL); -+ } -+ if (*last) { -+ if (sh_isstate(shp, SH_INIT)) { -+ // Initializing means importing untrusted env vars. Since the string does not appear -+ // to be a recognized numeric literal give up. We can't safely call strval() since -+ // that allows arbitrary expressions which would create a security vulnerability. -+ d = 0.0; -+ } else { -+ if (*last != '.' || last[1] != '.') { -+ d = strval(shp, str, &last, arith, mode); -+ Varsubscript = true; -+ } -+ if (!ptr && *last && mode > 0) { -+ errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str); -+ } -+ } -+ } else if (d == 0.0 && *str == '-') { -+ d = -0.0; - } -- if (!ptr && *last && mode > 0) errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str); -- } else if (!d && *str == '-') { -- d = -0.0; - } - if (ptr) *ptr = last; - return d; -diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh -index b63a8051ed5c..3faba475d6de 100644 ---- a/src/cmd/ksh93/tests/subshell.sh -+++ b/src/cmd/ksh93/tests/subshell.sh -@@ -856,3 +856,26 @@ for exp in 65535 65536 - do got=$($SHELL -c 'x=$(printf "%.*c" '$exp' x); print ${#x}' 2>&1) - [[ $got == $exp ]] || log_error "large command substitution failed" "$exp" "$got" - done -+ -+# ========== -+# Verify that importing untrusted env vars does not allow evaluating arbitrary expressions but does -+# recognize all integer literals recognized by ksh. -+expect=8 -+actual=$(env SHLVL='7' $SHELL -c 'echo $SHLVL') -+[[ $actual == $expect ]] || log_error "decimal int literal not recognized" "$expect" "$actual" -+ -+expect=14 -+actual=$(env SHLVL='013' $SHELL -c 'echo $SHLVL') -+[[ $actual == $expect ]] || log_error "leading zeros int literal not recognized" "$expect" "$actual" -+ -+expect=4 -+actual=$(env SHLVL='2#11' $SHELL -c 'echo $SHLVL') -+[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual" -+ -+expect=12 -+actual=$(env SHLVL='16#B' $SHELL -c 'echo $SHLVL') -+[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual" -+ -+expect=1 -+actual=$(env SHLVL="2#11+x[\$($bin_echo DANGER WILL ROBINSON >&2)0]" $SHELL -c 'echo $SHLVL') -+[[ $actual == $expect ]] || log_error "expression allowed on env var import" "$expect" "$actual" diff --git a/app-shells/ksh/files/ksh-2020.0.0-ensure-user-set.patch b/app-shells/ksh/files/ksh-2020.0.0-ensure-user-set.patch deleted file mode 100644 index 9f5d70f4d33c..000000000000 --- a/app-shells/ksh/files/ksh-2020.0.0-ensure-user-set.patch +++ /dev/null @@ -1,30 +0,0 @@ -From cb9f6d3498622b46de021a7f4798512d203747e9 Mon Sep 17 00:00:00 2001 -From: Kurtis Rader -Date: Sun, 1 Sep 2019 15:44:40 -0700 -Subject: [PATCH] Ensure USER is set when unit tests run - -Related #1391 ---- - src/cmd/ksh93/tests/util/run_test.sh | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/src/cmd/ksh93/tests/util/run_test.sh b/src/cmd/ksh93/tests/util/run_test.sh -index 20d24ed1fda..ebc74770cae 100644 ---- a/src/cmd/ksh93/tests/util/run_test.sh -+++ b/src/cmd/ksh93/tests/util/run_test.sh -@@ -62,6 +62,15 @@ fi - # - export OS_NAME=$(uname -s | tr '[A-Z]' '[a-z]') - -+# -+# Make sure $USER is set. A CI/CB environment might not set it. -+# See https://github.com/att/ast/issues/1391 -+# -+if [[ -z $USER ]] -+then -+ export USER=$(id -un) -+fi -+ - # TODO: Enable the `io` test on Travis macOS once we understand why it dies from an abort(). - # I'm not seeing that failure happen on either of my macOS 10.12 or 10.13 systems. - if [[ $test_name == io && $OS_NAME == darwin && $CI == true ]] diff --git a/app-shells/ksh/files/ksh-2020.0.0-skip-api-test.patch b/app-shells/ksh/files/ksh-2020.0.0-skip-api-test.patch deleted file mode 100644 index f832d175454e..000000000000 --- a/app-shells/ksh/files/ksh-2020.0.0-skip-api-test.patch +++ /dev/null @@ -1,36 +0,0 @@ -From d89753b5d38482f4a3f17ba3b7d09ab07cfe7419 Mon Sep 17 00:00:00 2001 -From: Kurtis Rader -Date: Sun, 1 Sep 2019 13:47:40 -0700 -Subject: [PATCH] Skip API test if build type != debug - -Fixes #1390 ---- - src/lib/libast/tests/misc/meson.build | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/src/lib/libast/tests/misc/meson.build b/src/lib/libast/tests/misc/meson.build -index 67a178762fa..a4c864428d8 100644 ---- a/src/lib/libast/tests/misc/meson.build -+++ b/src/lib/libast/tests/misc/meson.build -@@ -10,6 +10,12 @@ tests_to_skip = [ - ['freebsd', 'debug'], - ] - -+# Non-debug build types affect the behavior of `backtrace()`. Which means it will almost certainly -+# break the "debug" test. See https://github.com/att/ast/issues/1390. -+if get_option('buildtype') != 'debug' -+ tests_to_skip += [['*', 'debug']] -+endif -+ - foreach test_name: tests - # If the platform doesn't have an execinfo.h header there is no point in trying to run the - # debug.c unit test. -@@ -18,7 +24,7 @@ foreach test_name: tests - endif - skip_test = false - foreach skip : tests_to_skip -- if system == skip[0] and test_name == skip[1] -+ if ('*' == skip[0] or system == skip[0]) and test_name == skip[1] - warning('skipping ' + test_name + ' on ' + system) - skip_test = true - # break # Not until meson 0.49 diff --git a/app-shells/ksh/ksh-2020.0.0-r1.ebuild b/app-shells/ksh/ksh-2020.0.0-r1.ebuild deleted file mode 100644 index 5eb45fad5785..000000000000 --- a/app-shells/ksh/ksh-2020.0.0-r1.ebuild +++ /dev/null @@ -1,50 +0,0 @@ -# Copyright 1999-2021 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit meson ninja-utils - -if [[ ${PV} == 9999 ]]; then - inherit git-r3 - EGIT_REPO_URI="https://github.com/att/ast" -else - KEYWORDS="~alpha ~amd64 ~arm ~ia64 ~ppc ~ppc64 ~s390 ~sparc ~x86" - MY_PV="${PV/_/-}" - MY_P="${PN}-${MY_PV}" - SRC_URI="https://github.com/att/ast/releases/download/${MY_PV}/${MY_P}.tar.gz" - S="${WORKDIR}/${MY_P}" -fi - -DESCRIPTION="The Original Korn Shell, 1993 revision (ksh93)" -HOMEPAGE="https://github.com/att/ast" - -LICENSE="CPL-1.0 EPL-1.0" -SLOT="0" - -RDEPEND="!app-shells/pdksh" - -PATCHES=( - "${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch - "${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch - "${FILESDIR}"/CVE-2019-14868.patch -) - -src_test() { - # https://bugs.gentoo.org/702570 - addwrite /proc/self - local cmd=( - meson test - -C "${BUILD_DIR}" - --num-processes "$(makeopts_jobs ${NINJAOPTS:-${MAKEOPTS}})" - ) - echo "${cmd[@]}" >&2 - # https://github.com/att/ast/issues/1392 - env -u T "${cmd[@]}" || die -} - -src_install() { - meson_src_install - dodir /bin - mv "${ED}/usr/bin/ksh" "${ED}/bin/ksh" || die -} -- cgit v1.2.3-65-gdbad