diff options
Diffstat (limited to 'app-crypt/heimdal/files')
4 files changed, 90 insertions, 74 deletions
diff --git a/app-crypt/heimdal/files/heimdal-7.8.0-CVE-2022-45142.patch b/app-crypt/heimdal/files/heimdal-7.8.0-CVE-2022-45142.patch new file mode 100644 index 000000000000..dad75df4b3b8 --- /dev/null +++ b/app-crypt/heimdal/files/heimdal-7.8.0-CVE-2022-45142.patch @@ -0,0 +1,36 @@ +https://bugs.gentoo.org/893722 +https://www.openwall.com/lists/oss-security/2023/02/08/1 + +From: Helmut Grohne <helmut@...divi.de> +Subject: [PATCH v3] CVE-2022-45142: gsskrb5: fix accidental logic inversions + +The referenced commit attempted to fix miscompilations with gcc-9 and +gcc-10 by changing `memcmp(...)` to `memcmp(...) != 0`. Unfortunately, +it also inverted the result of the comparison in two occasions. This +inversion happened during backporting the patch to 7.7.1 and 7.8.0. + +Fixes: f6edaafcfefd ("gsskrb5: CVE-2022-3437 Use constant-time memcmp() + for arcfour unwrap") +Signed-off-by: Helmut Grohne <helmut@...divi.de> +--- a/lib/gssapi/krb5/arcfour.c ++++ b/lib/gssapi/krb5/arcfour.c +@@ -365,7 +365,7 @@ _gssapi_verify_mic_arcfour(OM_uint32 * minor_status, + return GSS_S_FAILURE; + } + +- cmp = (ct_memcmp(cksum_data, p + 8, 8) == 0); ++ cmp = (ct_memcmp(cksum_data, p + 8, 8) != 0); + if (cmp) { + *minor_status = 0; + return GSS_S_BAD_MIC; +@@ -730,7 +730,7 @@ OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status, + return GSS_S_FAILURE; + } + +- cmp = (ct_memcmp(cksum_data, p0 + 16, 8) == 0); /* SGN_CKSUM */ ++ cmp = (ct_memcmp(cksum_data, p0 + 16, 8) != 0); /* SGN_CKSUM */ + if (cmp) { + _gsskrb5_release_buffer(minor_status, output_message_buffer); + *minor_status = 0; +-- +2.38.1 diff --git a/app-crypt/heimdal/files/heimdal-7.8.0-configure-clang16.patch b/app-crypt/heimdal/files/heimdal-7.8.0-configure-clang16.patch new file mode 100644 index 000000000000..6e948bc51c3b --- /dev/null +++ b/app-crypt/heimdal/files/heimdal-7.8.0-configure-clang16.patch @@ -0,0 +1,54 @@ +https://bugs.gentoo.org/899072 +https://github.com/heimdal/heimdal/issues/790 +https://github.com/heimdal/heimdal/pull/1085 + +From 5b872a635c9c8f04f58e03c43e7953c35e1f66b7 Mon Sep 17 00:00:00 2001 +From: Florian Weimer <fweimer@redhat.com> +Date: Thu, 13 Apr 2023 13:13:59 +0200 +Subject: [PATCH 1/2] cf: Include <string.h> for memset in AC_HAVE_STRUCT_FIELD + +Otherwise, the check relies on an implicit function declaration, +and will fail unconditionally with compilers that do not support +them. +--- a/cf/have-struct-field.m4 ++++ b/cf/have-struct-field.m4 +@@ -7,7 +7,8 @@ dnl AC_HAVE_STRUCT_FIELD(struct, field, headers) + AC_DEFUN([AC_HAVE_STRUCT_FIELD], [ + define(cache_val, translit(ac_cv_type_$1_$2, [A-Z ], [a-z_])) + AC_CACHE_CHECK([for $2 in $1], cache_val,[ +-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[$3]], ++AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <string.h> ++$3]], + [[$1 x; memset(&x, 0, sizeof(x)); x.$2]])], + [cache_val=yes], + [cache_val=no]) + +From fc6d5b5c7677bb7271361c4bd60ea1bd36d944b9 Mon Sep 17 00:00:00 2001 +From: Florian Weimer <fweimer@redhat.com> +Date: Thu, 13 Apr 2023 13:26:29 +0200 +Subject: [PATCH 2/2] cf: Do not use headers and argument lists in + AC_FIND_FUNC_NO_LIBS2 + +The callers of this macro generally do not supply this information. +Without it, the checks rely on compiler support for implicit function +declarations. It would be possible to supply this information in +the callers. But even then, with the existing macro interface, it +would be necessary to pass eg. null pointers where they trigger +undefined behavior. Therefore, use the same kludge that autoconf +uses to make up prototypes, avoiding those implicit function +declarations. + +The includes/arguments macro parameters are now ignored, but preserved +for interface compatibility. +--- a/cf/find-func-no-libs2.m4 ++++ b/cf/find-func-no-libs2.m4 +@@ -21,7 +21,7 @@ if eval "test \"\$ac_cv_func_$1\" != yes" ; then + *) ac_lib="-l$ac_lib" ;; + esac + LIBS="$6 $ac_lib $5 $ac_save_LIBS" +- AC_LINK_IFELSE([AC_LANG_PROGRAM([[$3]],[[$1($4)]])],[eval "if test -n \"$ac_lib\";then ac_cv_funclib_$1=$ac_lib; else ac_cv_funclib_$1=yes; fi";break]) ++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[char $1 (void);]],[[$1()]])],[eval "if test -n \"$ac_lib\";then ac_cv_funclib_$1=$ac_lib; else ac_cv_funclib_$1=yes; fi";break]) + done + eval "ac_cv_funclib_$1=\${ac_cv_funclib_$1-no}" + LIBS="$ac_save_LIBS" + diff --git a/app-crypt/heimdal/files/heimdal_fix-autoconf-2.70.patch b/app-crypt/heimdal/files/heimdal_fix-autoconf-2.70.patch deleted file mode 100644 index 0dcc31026203..000000000000 --- a/app-crypt/heimdal/files/heimdal_fix-autoconf-2.70.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 22352b90e78e2d162b98b5ef6c84672c397be40a Mon Sep 17 00:00:00 2001 -From: Lars Wendler <polynomial-c@gentoo.org> -Date: Wed, 17 Mar 2021 17:49:18 +0100 -Subject: [PATCH] autoconf-2.70 fix - -autoconf-2.70 and newer are more strict with quoting etc. and thus generate -a broken configure file: - - configure: 20855: Syntax error: ")" unexpected (expecting "fi") - -Gentoo-bug: https://bugs.gentoo.org/776241 -Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> ---- - cf/check-var.m4 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cf/check-var.m4 b/cf/check-var.m4 -index 2fd7bca6f0..71d6f70ca8 100644 ---- a/cf/check-var.m4 -+++ b/cf/check-var.m4 -@@ -20,7 +20,7 @@ AC_MSG_RESULT($ac_foo) - if test "$ac_foo" = yes; then - AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_[]$1), 1, - [Define if you have the `]$1[' variable.]) -- m4_ifval([$2], AC_CHECK_DECLS([$1],[],[],[$2])) -+ m4_ifval([$2], [AC_CHECK_DECLS([$1],[],[],[$2])]) - fi - ]) - diff --git a/app-crypt/heimdal/files/heimdal_hcrypto.patch b/app-crypt/heimdal/files/heimdal_hcrypto.patch deleted file mode 100644 index ff3228d4973a..000000000000 --- a/app-crypt/heimdal/files/heimdal_hcrypto.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 329918bd671c89de6e1c2874baba48d658a89a10 Mon Sep 17 00:00:00 2001 -From: Damir Franusic <df@release14.org> -Date: Sun, 9 Dec 2018 19:53:58 +0100 -Subject: [PATCH] hcrypto: fix include path - ---- - lib/hcrypto/Makefile.am | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/lib/hcrypto/Makefile.am b/lib/hcrypto/Makefile.am -index 469176b6c6..195117d174 100644 ---- a/lib/hcrypto/Makefile.am -+++ b/lib/hcrypto/Makefile.am -@@ -9,7 +9,8 @@ AM_CPPFLAGS += $(INCLUDE_openssl_crypto) - endif - - AM_CPPFLAGS += -I$(top_srcdir)/lib/hx509 \ -- -I$(srcdir)/libtommath -DUSE_HCRYPTO_LTM=1 -+ -I$(srcdir)/libtommath -DUSE_HCRYPTO_LTM=1 \ -+ -I$(srcdir)/.. - - lib_LTLIBRARIES = libhcrypto.la - check_LTLIBRARIES = libhctest.la -From 572a6fd7ac41e9210ef3eb765fe7da4ec8a94bb2 Mon Sep 17 00:00:00 2001 -From: Luke Howard <lukeh@padl.com> -Date: Mon, 24 Dec 2018 02:21:32 +0000 -Subject: [PATCH] hx509: fix dependency, hxtool requires ASN.1 headers - ---- - lib/hx509/Makefile.am | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/hx509/Makefile.am b/lib/hx509/Makefile.am -index b58deb3e37..09643c43a0 100644 ---- a/lib/hx509/Makefile.am -+++ b/lib/hx509/Makefile.am -@@ -164,7 +164,7 @@ hxtool-commands.c hxtool-commands.h: hxtool-commands.in $(SLC) - dist_hxtool_SOURCES = hxtool.c - nodist_hxtool_SOURCES = hxtool-commands.c hxtool-commands.h - --$(hxtool_OBJECTS): hxtool-commands.h hx509_err.h -+$(hxtool_OBJECTS): hxtool-commands.h $(nodist_include_HEADERS) - - hxtool_LDADD = \ - libhx509.la \ |