NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/screen: security bump to version 4.9.1

Browse Source 
See release announce:
https://lists.gnu.org/archive/html/screen-users/2023-08/msg00000.html

Fixes:
CVE-2023-24626: https://www.cve.org/CVERecord?id=CVE-2023-24626

Note: Buildroot installs screen as setuid, so the described scenario
in CVE applies.

This commit also rebases all patches on this release. Patch were
regenerated with 'git format-patch -N', so patch file name changed in
this process. The file .checkpackageignore is also updated accordingly.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Julien Olivain 2023-08-22 21:49:21 +02:00 committed by Thomas Petazzoni
parent bdaade3e34
commit 96a54b0907
11 changed files with 112 additions and 195 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
.checkpackageignore
View File

@ -1314,12 +1314,12 @@ package/samba4/0002-build-find-pre-built-heimdal-build-tools-in-case-of-.patch U
package/samba4/0003-ldap_message_test.c-include-stdint.h-before-cmoka.h.patch Upstream
package/samba4/S91smb Indent Shellcheck Variables
package/sane-backends/0001-sane_backend-add-missing-config.h.patch Upstream
package/screen/0001-no-memcpy-fallback.patch Upstream
package/screen/0002-install-no-backup-binary.patch Upstream
package/screen/0003-install-always-chmod.patch Upstream
package/screen/0004-install-nonversioned-binary.patch Upstream
package/screen/0005-rename-sched_h.patch Upstream
package/screen/0006-comm-h-now-depends-on-term-h.patch Upstream
package/screen/0001-Do-not-use-memcpy-as-an-alternative-for-bcopy-memmov.patch Upstream
package/screen/0002-Do-not-create-backup-of-old-installed-binary.patch Upstream
package/screen/0003-Change-binary-permission-flags-even-if-chown-fails.patch Upstream
package/screen/0004-Support-overriding-SCREEN-to-get-a-non-versioned-bin.patch Upstream
package/screen/0005-Renamed-sched.h-to-eventqueue.h.patch Upstream
package/screen/0006-comm.h-now-depends-on-term.h.patch Upstream
package/screen/0007-comm.h-needed-for-list_-display-generic-.o.patch Upstream
package/scrub/0001-configure-ac-make-sure-m4-macros-are-included-in-the-build.patch Upstream
package/sdl/0001-use-correct-directfb-config.patch Upstream

47
package/screen/0001-no-memcpy-fallback.patch → package/screen/0001-Do-not-use-memcpy-as-an-alternative-for-bcopy-memmov.patch
View File

@ -1,6 +1,7 @@
From 545875ad0b6c9697fae41ae8770e95d117fe3cca Mon Sep 17 00:00:00 2001
From: Maarten ter Huurne <maarten@treewalker.org>
Date: Sat, 13 Sep 2014 11:37:59 +0200
Subject: Do not use memcpy as an alternative for bcopy/memmove
Subject: [PATCH] Do not use memcpy as an alternative for bcopy/memmove
The configure script runs a small test program to check whether
memcpy can handle overlapping memory areas. However, it is not valid
@ -16,15 +17,17 @@ Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
[Bernd: rebase on top of 4.7.0]
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Julien: rebase on top of 4.9.1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
acconfig.h | 3 +--
configure.ac | 18 +-----------------
configure.ac | 22 +---------------------
os.h | 8 ++------
osdef.h.in | 10 +---------
4 files changed, 5 insertions(+), 34 deletions(-)
4 files changed, 5 insertions(+), 38 deletions(-)
diff --git a/acconfig.h b/acconfig.h
index 2e46985..9b0b9d4 100644
index 46d62b0..f83572c 100644
--- a/acconfig.h
+++ b/acconfig.h
@@ -476,7 +476,7 @@
@ -45,43 +48,47 @@ index 2e46985..9b0b9d4 100644
/*
diff --git a/configure.ac b/configure.ac
index 27690a6..b8e3bec 100644
index 1a12c04..6f6c2da 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1145,7 +1145,7 @@ AC_TRY_LINK(,[getttyent();], AC_DEFINE(GETTTYENT))
AC_CHECKING(fdwalk)
AC_TRY_LINK([#include <stdlib.h>], [fdwalk(NULL, NULL);],AC_DEFINE(HAVE_FDWALK))
@@ -1278,7 +1278,7 @@ AC_TRY_LINK([
fdwalk(NULL, NULL);
],AC_DEFINE(HAVE_FDWALK))
-AC_CHECKING(whether memcpy/memmove/bcopy handles overlapping arguments)
+AC_CHECKING(whether memmove/bcopy handles overlapping arguments)
AC_TRY_RUN([
main() {
char buf[10];
@@ -1175,22 +1175,6 @@ main() {
exit(0); /* libc version works properly. */
}], AC_DEFINE(USEMEMMOVE))
#include <string.h>
#include <stdlib.h>
@@ -1319,26 +1319,6 @@ main() {
}], AC_DEFINE(USEMEMMOVE),,
AC_NOTE(- skipping check because we are cross compiling; use memmove) AC_DEFINE(USEMEMMOVE))
-
-AC_TRY_RUN([
-#include <string.h>
-#include <stdlib.h>
-
-#define bcopy(s,d,l) memcpy(d,s,l)
-
-int
-main() {
- char buf[10];
- strcpy(buf, "abcdefghi");
- bcopy(buf, buf + 2, 3);
- if (strncmp(buf, "ababcf", 6))
- exit(1);
- return 1;
- strcpy(buf, "abcdefghi");
- bcopy(buf + 2, buf, 3);
- if (strncmp(buf, "cdedef", 6))
- exit(1);
- exit(0); /* libc version works properly. */
- return 1;
- return 0; /* libc version works properly. */
-}], AC_DEFINE(USEMEMCPY),,:)
-
AC_SYS_LONG_FILE_NAMES
AC_MSG_CHECKING(for vsprintf)
diff --git a/os.h b/os.h
index e827ac9..0b41fb9 100644
index 2a1c2ca..d1ac87e 100644
--- a/os.h
+++ b/os.h
@@ -142,12 +142,8 @@ extern int errno;
@ -100,7 +107,7 @@ index e827ac9..0b41fb9 100644
#endif
diff --git a/osdef.h.in b/osdef.h.in
index 8687b60..e4057a0 100644
index 6ddbd66..abdacf7 100644
--- a/osdef.h.in
+++ b/osdef.h.in
@@ -58,16 +58,8 @@ extern int bcmp __P((char *, char *, int));
@ -122,5 +129,5 @@ index 8687b60..e4057a0 100644
extern void bcopy __P((char *, char *, int));
#endif
--
1.8.4.5
2.41.0

9
package/screen/0002-install-no-backup-binary.patch → package/screen/0002-Do-not-create-backup-of-old-installed-binary.patch
View File

@ -1,18 +1,21 @@
From 86b5c7677c5bef780bd4c28cbbdaa97eda938230 Mon Sep 17 00:00:00 2001
From: Maarten ter Huurne <maarten@treewalker.org>
Date: Sun, 14 Sep 2014 23:58:34 +0200
Subject: Do not create backup of old installed binary
Subject: [PATCH] Do not create backup of old installed binary
This is a rather unusual feature that packagers will not expect.
Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
[baruch: update for 4.6.2]
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
[Julien: rebase on top of 4.9.1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
Makefile.in | 4 ----
1 file changed, 4 deletions(-)
diff --git a/Makefile.in b/Makefile.in
index 187a69b..65549e9 100644
index 26ec404..3efbbfd 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -83,12 +83,9 @@ screen: $(OFILES)
@ -37,5 +40,5 @@ index 187a69b..65549e9 100644
cd doc; $(MAKE) uninstall
--
1.8.4.5
2.41.0

11
package/screen/0003-install-always-chmod.patch → package/screen/0003-Change-binary-permission-flags-even-if-chown-fails.patch
View File

@ -1,22 +1,25 @@
From 4231969c47a8379f9113e0c9c9586bcfdd545c37 Mon Sep 17 00:00:00 2001
From: Maarten ter Huurne <maarten@treewalker.org>
Date: Mon, 15 Sep 2014 00:03:05 +0200
Subject: Change binary permission flags even if chown fails
Subject: [PATCH] Change binary permission flags even if chown fails
Typically when creating a package, the build is not run as root, so
the chown will fail. But the chmod can still be done.
Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
[Julien: rebase on top of 4.9.1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
Makefile.in | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/Makefile.in b/Makefile.in
index 65549e9..3c12fdb 100644
index 3efbbfd..0315fde 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -84,7 +84,8 @@ screen: $(OFILES)
install_bin: .version screen
install_bin: .version screen installdirs
$(INSTALL_PROGRAM) screen $(DESTDIR)$(bindir)/$(SCREEN)
- -chown root $(DESTDIR)$(bindir)/$(SCREEN) && chmod 4755 $(DESTDIR)$(bindir)/$(SCREEN)
+ -chown root $(DESTDIR)$(bindir)/$(SCREEN)
@ -25,5 +28,5 @@ index 65549e9..3c12fdb 100644
rm -f $(DESTDIR)$(bindir)/screen
(cd $(DESTDIR)$(bindir) && ln -f -s $(SCREEN) screen)
--
1.8.4.5
2.41.0

11
package/screen/0004-install-nonversioned-binary.patch → package/screen/0004-Support-overriding-SCREEN-to-get-a-non-versioned-bin.patch
View File

@ -1,20 +1,23 @@
From 07d6e4d9da8bc7c6ed31aa9b643410ea093d164f Mon Sep 17 00:00:00 2001
From: Maarten ter Huurne <maarten@treewalker.org>
Date: Mon, 15 Sep 2014 00:06:20 +0200
Subject: Support overriding SCREEN to get a non-versioned binary
Subject: [PATCH] Support overriding SCREEN to get a non-versioned binary
If a packager runs "make install SCREEN=screen", do not create
"screen" as a symlink to itself.
Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
[Julien: rebase on top of 4.9.1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
Makefile.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/Makefile.in b/Makefile.in
index 3c12fdb..860f351 100644
index 0315fde..4718f08 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -86,9 +86,11 @@ install_bin: .version screen
@@ -86,9 +86,11 @@ install_bin: .version screen installdirs
$(INSTALL_PROGRAM) screen $(DESTDIR)$(bindir)/$(SCREEN)
-chown root $(DESTDIR)$(bindir)/$(SCREEN)
-chmod 4755 $(DESTDIR)$(bindir)/$(SCREEN)
@ -27,5 +30,5 @@ index 3c12fdb..860f351 100644
###############################################################################
--
1.8.4.5
2.41.0

39
package/screen/0005-Renamed-sched.h-to-eventqueue.h.patch Normal file
View File

@ -0,0 +1,39 @@
From 8b066a777b61600ff2c60cad0725f2089299ff56 Mon Sep 17 00:00:00 2001
From: Maarten ter Huurne <maarten@treewalker.org>
Date: Mon, 15 Sep 2014 00:24:41 +0200
Subject: [PATCH] Renamed sched.h to eventqueue.h
There is a <sched.h> system header that got shadowed by "sched.h".
While Screen itself doesn't include <sched.h>, other system headers
might include it indirectly. This broke the build when using uClibc
with pthread support.
Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
[Julien: rebase on top of 4.9.1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
sched.h => eventqueue.h | 0
screen.h | 2 +-
2 files changed, 1 insertion(+), 1 deletion(-)
rename sched.h => eventqueue.h (100%)
diff --git a/sched.h b/eventqueue.h
similarity index 100%
rename from sched.h
rename to eventqueue.h
diff --git a/screen.h b/screen.h
index 4823efb..2d51788 100644
--- a/screen.h
+++ b/screen.h
@@ -43,7 +43,7 @@
#include "osdef.h"
#include "ansi.h"
-#include "sched.h"
+#include "eventqueue.h"
#include "acls.h"
#include "comm.h"
#include "layer.h"
--
2.41.0

142
package/screen/0005-rename-sched_h.patch
View File

@ -1,142 +0,0 @@
From: Maarten ter Huurne <maarten@treewalker.org>
Date: Mon, 15 Sep 2014 00:24:41 +0200
Subject: Renamed sched.h to eventqueue.h
There is a <sched.h> system header that got shadowed by "sched.h".
While Screen itself doesn't include <sched.h>, other system headers
might include it indirectly. This broke the build when using uClibc
with pthread support.
Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
---
eventqueue.h | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
sched.h | 48 ------------------------------------------------
screen.h | 2 +-
3 files changed, 49 insertions(+), 49 deletions(-)
create mode 100644 eventqueue.h
delete mode 100644 sched.h
diff --git a/eventqueue.h b/eventqueue.h
new file mode 100644
index 0000000..fdc3fc4
--- /dev/null
+++ b/eventqueue.h
@@ -0,0 +1,48 @@
+/* Copyright (c) 2008, 2009
+ * Juergen Weigert (jnweiger@immd4.informatik.uni-erlangen.de)
+ * Michael Schroeder (mlschroe@immd4.informatik.uni-erlangen.de)
+ * Micah Cowan (micah@cowan.name)
+ * Sadrul Habib Chowdhury (sadrul@users.sourceforge.net)
+ * Copyright (c) 1993-2002, 2003, 2005, 2006, 2007
+ * Juergen Weigert (jnweiger@immd4.informatik.uni-erlangen.de)
+ * Michael Schroeder (mlschroe@immd4.informatik.uni-erlangen.de)
+ * Copyright (c) 1987 Oliver Laumann
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program (see the file COPYING); if not, see
+ * https://www.gnu.org/licenses/, or contact Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02111-1301 USA
+ *
+ ****************************************************************
+ * $Id$ GNU
+ */
+
+struct event
+{
+ struct event *next;
+ void (*handler) __P((struct event *, char *));
+ char *data;
+ int fd;
+ int type;
+ int pri;
+ struct timeval timeout;
+ int queued; /* in evs queue */
+ int active; /* in fdset */
+ int *condpos; /* only active if condpos - condneg > 0 */
+ int *condneg;
+};
+
+#define EV_TIMEOUT 0
+#define EV_READ 1
+#define EV_WRITE 2
+#define EV_ALWAYS 3
diff --git a/sched.h b/sched.h
deleted file mode 100644
index fdc3fc4..0000000
--- a/sched.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/* Copyright (c) 2008, 2009
- * Juergen Weigert (jnweiger@immd4.informatik.uni-erlangen.de)
- * Michael Schroeder (mlschroe@immd4.informatik.uni-erlangen.de)
- * Micah Cowan (micah@cowan.name)
- * Sadrul Habib Chowdhury (sadrul@users.sourceforge.net)
- * Copyright (c) 1993-2002, 2003, 2005, 2006, 2007
- * Juergen Weigert (jnweiger@immd4.informatik.uni-erlangen.de)
- * Michael Schroeder (mlschroe@immd4.informatik.uni-erlangen.de)
- * Copyright (c) 1987 Oliver Laumann
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3, or (at your option)
- * any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program (see the file COPYING); if not, see
- * https://www.gnu.org/licenses/, or contact Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02111-1301 USA
- *
- ****************************************************************
- * $Id$ GNU
- */
-
-struct event
-{
- struct event *next;
- void (*handler) __P((struct event *, char *));
- char *data;
- int fd;
- int type;
- int pri;
- struct timeval timeout;
- int queued; /* in evs queue */
- int active; /* in fdset */
- int *condpos; /* only active if condpos - condneg > 0 */
- int *condneg;
-};
-
-#define EV_TIMEOUT 0
-#define EV_READ 1
-#define EV_WRITE 2
-#define EV_ALWAYS 3
diff --git a/screen.h b/screen.h
index 603ca3f..34238c8 100644
--- a/screen.h
+++ b/screen.h
@@ -43,7 +43,7 @@
#include "osdef.h"
#include "ansi.h"
-#include "sched.h"
+#include "eventqueue.h"
#include "acls.h"
#include "comm.h"
#include "layer.h"
--
1.8.4.5

20
package/screen/0006-comm-h-now-depends-on-term-h.patch → package/screen/0006-comm.h-now-depends-on-term.h.patch
View File

@ -1,28 +1,30 @@
From 39c5f1c76f1fcef4b5958bf828a63f53426b6984 Mon Sep 17 00:00:00 2001
From 23a8ca6be87ad374d66854cee66ab758880cc651 Mon Sep 17 00:00:00 2001
From: Mike Gerwitz <mike@mikegerwitz.com>
Date: Tue, 24 Dec 2013 22:16:31 -0500
Subject: comm.h now depends on term.h
Subject: [PATCH] comm.h now depends on term.h
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Patch retrieved and updated from:
http://git.savannah.gnu.org/cgit/screen.git/commit/?id=39c5f1c]
[Julien: rebase on top of 4.9.1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
src/Makefile.in | 2 +-
Makefile.in | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Makefile.in b/Makefile.in
index e791e79..d4f7c0b 100644
index 4718f08..7082a3e 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -113,7 +113,7 @@ term.h: term.c term.sh
kmapdef.c: term.h
@@ -132,7 +132,7 @@ kmapdef.c: term.h
tty.c: tty.sh
sh $(srcdir)/tty.sh tty.c
-comm.h: comm.c comm.sh config.h
+comm.h: comm.c comm.sh config.h term.h
AWK=$(AWK) CC="$(CC) $(CFLAGS)" srcdir=${srcdir} sh $(srcdir)/comm.sh
docs:
osdef.h: osdef.sh config.h osdef.h.in
--
cgit v1.0-41-gc330
2.41.0

10
package/screen/0007-comm.h-needed-for-list_-display-generic-.o.patch
View File

@ -1,4 +1,4 @@
From b719314d201a3e9e1e57c65746a468c47bfc847f Mon Sep 17 00:00:00 2001
From 8d8899b3ffd26d5049f8a9ccf12ff9ac65c352b4 Mon Sep 17 00:00:00 2001
From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Date: Wed, 3 Oct 2018 22:29:32 +0200
Subject: [PATCH] comm.h needed for list_{display,generic}.o
@ -12,15 +12,17 @@ Fixes:
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Upstream status: https://savannah.gnu.org/bugs/index.php?54776]
[Julien: rebase on top of 4.9.1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
Makefile.in | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Makefile.in b/Makefile.in
index af5938b..e6d5247 100644
index 7082a3e..cd363b7 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -265,7 +265,7 @@ braille.h
@@ -349,7 +349,7 @@ layout.o: layout.h viewport.h canvas.h layout.c config.h screen.h os.h osdef.h a
viewport.o: layout.h viewport.h canvas.h viewport.c config.h screen.h os.h osdef.h ansi.h acls.h \
comm.h layer.h term.h image.h display.h window.h extern.h \
braille.h
@ -31,5 +33,5 @@ index af5938b..e6d5247 100644
list_window.o: list_generic.h list_window.c window.h layer.h screen.h osdef.h comm.h
--
2.17.1
2.41.0

4
package/screen/screen.hash
View File

@ -1,5 +1,5 @@
# Locally calculated after checking pgp signature
# https://ftp.gnu.org/gnu/screen/screen-4.9.0.tar.gz.sig
sha256 f9335281bb4d1538ed078df78a20c2f39d3af9a4e91c57d084271e0289c730f4 screen-4.9.0.tar.gz
# https://ftp.gnu.org/gnu/screen/screen-4.9.1.tar.gz.sig
sha256 26cef3e3c42571c0d484ad6faf110c5c15091fbf872b06fa7aa4766c7405ac69 screen-4.9.1.tar.gz
# Locally calculated
sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 COPYING

2
package/screen/screen.mk
View File

@ -4,7 +4,7 @@
#
################################################################################
SCREEN_VERSION = 4.9.0
SCREEN_VERSION = 4.9.1
SCREEN_SITE = $(BR2_GNU_MIRROR)/screen
SCREEN_LICENSE = GPL-3.0+
SCREEN_LICENSE_FILES = COPYING