From 1c7d6584a7811b7785ae5c1e378f14b5ba0971cf Mon Sep 17 00:00:00 2001 From: takeshi_hoshina Date: Mon, 2 Nov 2020 11:07:33 +0900 Subject: basesystem-jj recipes --- .../perl/perl/CVE-2018-18314.patch | 271 --------------------- 1 file changed, 271 deletions(-) delete mode 100644 external/poky/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch (limited to 'external/poky/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch') diff --git a/external/poky/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch b/external/poky/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch deleted file mode 100644 index e84e7bc4..00000000 --- a/external/poky/meta/recipes-devtools/perl/perl/CVE-2018-18314.patch +++ /dev/null @@ -1,271 +0,0 @@ -From 6a2d07f43ae7cfcb2eb30cf39751f2f7fed7ecc1 Mon Sep 17 00:00:00 2001 -From: Yves Orton -Date: Mon, 26 Jun 2017 13:19:55 +0200 -Subject: [PATCH 3/3] fix #131649 - extended charclass can trigger assert - -The extended charclass parser makes some assumptions during the -first pass which are only true on well structured input, and it -does not properly catch various errors. later on the code assumes -that things the first pass will let through are valid, when in -fact they should trigger errors. - -(cherry picked from commit 19a498a461d7c81ae3507c450953d1148efecf4f) - -CVE: CVE-2018-18314 -Upstream-Status: Backport -[https://perl5.git.perl.org/perl.git/commit/dabe076af345ab4512ea80245b4e4cd7ec0996cd] - -Signed-off-by: Dan Tran ---- - pod/perldiag.pod | 27 ++++++++++++++++++++++++++- - pod/perlrecharclass.pod | 4 ++-- - regcomp.c | 23 +++++++++++++---------- - t/lib/warnings/regcomp | 6 +++--- - t/re/reg_mesg.t | 29 ++++++++++++++++------------- - t/re/regex_sets.t | 6 +++--- - 6 files changed, 63 insertions(+), 32 deletions(-) - -diff --git a/pod/perldiag.pod b/pod/perldiag.pod -index 737d3633f6..644b814008 100644 ---- a/pod/perldiag.pod -+++ b/pod/perldiag.pod -@@ -5777,7 +5777,7 @@ yourself. - a perl4 interpreter, especially if the next 2 tokens are "use strict" - or "my $var" or "our $var". - --=item Syntax error in (?[...]) in regex m/%s/ -+=item Syntax error in (?[...]) in regex; marked by <-- HERE in m/%s/ - - (F) Perl could not figure out what you meant inside this construct; this - notifies you that it is giving up trying. -@@ -6153,6 +6153,31 @@ for example, - (F) The unexec() routine failed for some reason. See your local FSF - representative, who probably put it there in the first place. - -+=item Unexpected ']' with no following ')' in (?[... in regex; marked by <-- HERE in m/%s/ -+ -+(F) While parsing an extended character class a ']' character was encountered -+at a point in the definition where the only legal use of ']' is to close the -+character class definition as part of a '])', you may have forgotten the close -+paren, or otherwise confused the parser. -+ -+=item Expecting close paren for nested extended charclass in regex; marked by <-- HERE in m/%s/ -+ -+(F) While parsing a nested extended character class like: -+ -+ (?[ ... (?flags:(?[ ... ])) ... ]) -+ ^ -+ -+we expected to see a close paren ')' (marked by ^) but did not. -+ -+=item Expecting close paren for wrapper for nested extended charclass in regex; marked by <-- HERE in m/%s/ -+ -+(F) While parsing a nested extended character class like: -+ -+ (?[ ... (?flags:(?[ ... ])) ... ]) -+ ^ -+ -+we expected to see a close paren ')' (marked by ^) but did not. -+ - =item Unexpected binary operator '%c' with no preceding operand in regex; - marked by S<<-- HERE> in m/%s/ - -diff --git a/pod/perlrecharclass.pod b/pod/perlrecharclass.pod -index 89f4a7ef3f..a557cc0384 100644 ---- a/pod/perlrecharclass.pod -+++ b/pod/perlrecharclass.pod -@@ -1101,8 +1101,8 @@ hence both of the following work: - Any contained POSIX character classes, including things like C<\w> and C<\D> - respect the Ca> (and Caa>) modifiers. - --C<< (?[ ]) >> is a regex-compile-time construct. Any attempt to use --something which isn't knowable at the time the containing regular -+Note that C<< (?[ ]) >> is a regex-compile-time construct. Any attempt -+to use something which isn't knowable at the time the containing regular - expression is compiled is a fatal error. In practice, this means - just three limitations: - -diff --git a/regcomp.c b/regcomp.c -index 2688979882..cb8409ed27 100644 ---- a/regcomp.c -+++ b/regcomp.c -@@ -14609,8 +14609,9 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, - TRUE /* Force /x */ ); - - switch (*RExC_parse) { -- case '?': -- if (RExC_parse[1] == '[') depth++, RExC_parse++; -+ case '(': -+ if (RExC_parse[1] == '?' && RExC_parse[2] == '[') -+ depth++, RExC_parse+=2; - /* FALLTHROUGH */ - default: - break; -@@ -14667,9 +14668,9 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, - } - - case ']': -- if (depth--) break; -- RExC_parse++; -- if (*RExC_parse == ')') { -+ if (RExC_parse[1] == ')') { -+ RExC_parse++; -+ if (depth--) break; - node = reganode(pRExC_state, ANYOF, 0); - RExC_size += ANYOF_SKIP; - nextchar(pRExC_state); -@@ -14681,20 +14682,20 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, - - return node; - } -- goto no_close; -+ RExC_parse++; -+ vFAIL("Unexpected ']' with no following ')' in (?[..."); - } - - RExC_parse += UTF ? UTF8SKIP(RExC_parse) : 1; - } - -- no_close: - /* We output the messages even if warnings are off, because we'll fail - * the very next thing, and these give a likely diagnosis for that */ - if (posix_warnings && av_tindex_nomg(posix_warnings) >= 0) { - output_or_return_posix_warnings(pRExC_state, posix_warnings, NULL); - } - -- FAIL("Syntax error in (?[...])"); -+ vFAIL("Syntax error in (?[...])"); - } - - /* Pass 2 only after this. */ -@@ -14868,12 +14869,14 @@ redo_curchar: - * inversion list, and RExC_parse points to the trailing - * ']'; the next character should be the ')' */ - RExC_parse++; -- assert(UCHARAT(RExC_parse) == ')'); -+ if (UCHARAT(RExC_parse) != ')') -+ vFAIL("Expecting close paren for nested extended charclass"); - - /* Then the ')' matching the original '(' handled by this - * case: statement */ - RExC_parse++; -- assert(UCHARAT(RExC_parse) == ')'); -+ if (UCHARAT(RExC_parse) != ')') -+ vFAIL("Expecting close paren for wrapper for nested extended charclass"); - - RExC_flags = save_flags; - goto handle_operand; -diff --git a/t/lib/warnings/regcomp b/t/lib/warnings/regcomp -index 08cb27b00f..367276d0fc 100644 ---- a/t/lib/warnings/regcomp -+++ b/t/lib/warnings/regcomp -@@ -59,21 +59,21 @@ Unmatched [ in regex; marked by <-- HERE in m/abc[ <-- HERE fi[.00./ at - line - qr/(?[[[:word]]])/; - EXPECT - Assuming NOT a POSIX class since there is no terminating ':' in regex; marked by <-- HERE in m/(?[[[:word <-- HERE ]]])/ at - line 2. --syntax error in (?[...]) in regex m/(?[[[:word]]])/ at - line 2. -+Unexpected ']' with no following ')' in (?[... in regex; marked by <-- HERE in m/(?[[[:word]] <-- HERE ])/ at - line 2. - ######## - # NAME qr/(?[ [[:digit: ])/ - # OPTION fatal - qr/(?[[[:digit: ])/; - EXPECT - Assuming NOT a POSIX class since no blanks are allowed in one in regex; marked by <-- HERE in m/(?[[[:digit: ] <-- HERE )/ at - line 2. --syntax error in (?[...]) in regex m/(?[[[:digit: ])/ at - line 2. -+syntax error in (?[...]) in regex; marked by <-- HERE in m/(?[[[:digit: ]) <-- HERE / at - line 2. - ######## - # NAME qr/(?[ [:digit: ])/ - # OPTION fatal - qr/(?[[:digit: ])/ - EXPECT - Assuming NOT a POSIX class since no blanks are allowed in one in regex; marked by <-- HERE in m/(?[[:digit: ] <-- HERE )/ at - line 2. --syntax error in (?[...]) in regex m/(?[[:digit: ])/ at - line 2. -+syntax error in (?[...]) in regex; marked by <-- HERE in m/(?[[:digit: ]) <-- HERE / at - line 2. - ######## - # NAME [perl #126141] - # OPTION fatal -diff --git a/t/re/reg_mesg.t b/t/re/reg_mesg.t -index 658397ac27..08a3688e1d 100644 ---- a/t/re/reg_mesg.t -+++ b/t/re/reg_mesg.t -@@ -202,8 +202,9 @@ my @death = - '/\b{gc}/' => "'gc' is an unknown bound type {#} m/\\b{gc{#}}/", - '/\B{gc}/' => "'gc' is an unknown bound type {#} m/\\B{gc{#}}/", - -- '/(?[[[::]]])/' => "Syntax error in (?[...]) in regex m/(?[[[::]]])/", -- '/(?[[[:w:]]])/' => "Syntax error in (?[...]) in regex m/(?[[[:w:]]])/", -+ -+ '/(?[[[::]]])/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[[[::]]{#}])/", -+ '/(?[[[:w:]]])/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[[[:w:]]{#}])/", - '/(?[[:w:]])/' => "", - '/[][[:alpha:]]' => "", # [perl #127581] - '/([.].*)[.]/' => "", # [perl #127582] -@@ -227,11 +228,12 @@ my @death = - '/(?[ \p{foo} ])/' => 'Can\'t find Unicode property definition "foo" {#} m/(?[ \p{foo}{#} ])/', - '/(?[ \p{ foo = bar } ])/' => 'Can\'t find Unicode property definition "foo = bar" {#} m/(?[ \p{ foo = bar }{#} ])/', - '/(?[ \8 ])/' => 'Unrecognized escape \8 in character class {#} m/(?[ \8{#} ])/', -- '/(?[ \t ]/' => 'Syntax error in (?[...]) in regex m/(?[ \t ]/', -- '/(?[ [ \t ]/' => 'Syntax error in (?[...]) in regex m/(?[ [ \t ]/', -- '/(?[ \t ] ]/' => 'Syntax error in (?[...]) in regex m/(?[ \t ] ]/', -- '/(?[ [ ] ]/' => 'Syntax error in (?[...]) in regex m/(?[ [ ] ]/', -- '/(?[ \t + \e # This was supposed to be a comment ])/' => 'Syntax error in (?[...]) in regex m/(?[ \t + \e # This was supposed to be a comment ])/', -+ '/(?[ \t ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[ \\t ]{#}/", -+ '/(?[ [ \t ]/' => "Syntax error in (?[...]) {#} m/(?[ [ \\t ]{#}/", -+ '/(?[ \t ] ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[ \\t ]{#} ]/", -+ '/(?[ [ ] ]/' => "Syntax error in (?[...]) {#} m/(?[ [ ] ]{#}/", -+ '/(?[ \t + \e # This was supposed to be a comment ])/' => -+ "Syntax error in (?[...]) {#} m/(?[ \\t + \\e # This was supposed to be a comment ]){#}/", - '/(?[ ])/' => 'Incomplete expression within \'(?[ ])\' {#} m/(?[ {#}])/', - 'm/(?[[a-\d]])/' => 'False [] range "a-\d" {#} m/(?[[a-\d{#}]])/', - 'm/(?[[\w-x]])/' => 'False [] range "\w-" {#} m/(?[[\w-{#}x]])/', -@@ -410,10 +412,10 @@ my @death_utf8 = mark_as_utf8( - - '/ネ\p{}ネ/' => 'Empty \p{} {#} m/ネ\p{{#}}ネ/', - -- '/ネ(?[[[:ネ]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ]]])ネ/", -- '/ネ(?[[[:ネ: ])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ: ])ネ/", -- '/ネ(?[[[::]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[::]]])ネ/", -- '/ネ(?[[[:ネ:]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ:]]])ネ/", -+ '/ネ(?[[[:ネ]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[:ネ]]{#}])ネ/", -+ '/ネ(?[[[:ネ: ])ネ/' => "Syntax error in (?[...]) {#} m/ネ(?[[[:ネ: ])ネ{#}/", -+ '/ネ(?[[[::]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[::]]{#}])ネ/", -+ '/ネ(?[[[:ネ:]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[:ネ:]]{#}])ネ/", - '/ネ(?[[:ネ:]])ネ/' => "", - '/ネ(?[ネ])ネ/' => 'Unexpected character {#} m/ネ(?[ネ{#}])ネ/', - '/ネ(?[ + [ネ] ])/' => 'Unexpected binary operator \'+\' with no preceding operand {#} m/ネ(?[ +{#} [ネ] ])/', -@@ -426,8 +428,9 @@ my @death_utf8 = mark_as_utf8( - '/(?[ \x{ネ} ])ネ/' => 'Non-hex character {#} m/(?[ \x{ネ{#}} ])ネ/', - '/(?[ \p{ネ} ])/' => 'Can\'t find Unicode property definition "ネ" {#} m/(?[ \p{ネ}{#} ])/', - '/(?[ \p{ ネ = bar } ])/' => 'Can\'t find Unicode property definition "ネ = bar" {#} m/(?[ \p{ ネ = bar }{#} ])/', -- '/ネ(?[ \t ]/' => 'Syntax error in (?[...]) in regex m/ネ(?[ \t ]/', -- '/(?[ \t + \e # ネ This was supposed to be a comment ])/' => 'Syntax error in (?[...]) in regex m/(?[ \t + \e # ネ This was supposed to be a comment ])/', -+ '/ネ(?[ \t ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[ \\t ]{#}/", -+ '/(?[ \t + \e # ネ This was supposed to be a comment ])/' => -+ "Syntax error in (?[...]) {#} m/(?[ \\t + \\e # ネ This was supposed to be a comment ]){#}/", - 'm/(*ネ)ネ/' => q, - '/\cネ/' => "Character following \"\\c\" must be printable ASCII", - '/\b{ネ}/' => "'ネ' is an unknown bound type {#} m/\\b{ネ{#}}/", -diff --git a/t/re/regex_sets.t b/t/re/regex_sets.t -index 92875677be..60a126ba3c 100644 ---- a/t/re/regex_sets.t -+++ b/t/re/regex_sets.t -@@ -157,13 +157,13 @@ for my $char ("٠", "٥", "٩") { - eval { $_ = '/(?[(\c]) /'; qr/$_/ }; - like($@, qr/^Syntax error/, '/(?[(\c]) / should not panic'); - eval { $_ = '(?[\c#]' . "\n])"; qr/$_/ }; -- like($@, qr/^Syntax error/, '/(?[(\c]) / should not panic'); -+ like($@, qr/^Unexpected/, '/(?[(\c]) / should not panic'); - eval { $_ = '(?[(\c])'; qr/$_/ }; - like($@, qr/^Syntax error/, '/(?[(\c])/ should be a syntax error'); - eval { $_ = '(?[(\c]) ]\b'; qr/$_/ }; -- like($@, qr/^Syntax error/, '/(?[(\c]) ]\b/ should be a syntax error'); -+ like($@, qr/^Unexpected/, '/(?[(\c]) ]\b/ should be a syntax error'); - eval { $_ = '(?[\c[]](])'; qr/$_/ }; -- like($@, qr/^Syntax error/, '/(?[\c[]](])/ should be a syntax error'); -+ like($@, qr/^Unexpected/, '/(?[\c[]](])/ should be a syntax error'); - like("\c#", qr/(?[\c#])/, '\c# should match itself'); - like("\c[", qr/(?[\c[])/, '\c[ should match itself'); - like("\c\ ", qr/(?[\c\])/, '\c\ should match itself'); --- -2.22.0.vfs.1.1.57.gbaf16c8 - -- cgit 1.2.3-korg