From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 104286 invoked by alias); 24 Jun 2019 13:55:46 -0000 Mailing-List: contact bzip2-devel-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Id: Sender: bzip2-devel-owner@sourceware.org Received: (qmail 104134 invoked by uid 89); 24 Jun 2019 13:55:46 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.100.3 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-6.7 required=5.0 tests=AWL,BAYES_00,SPF_PASS autolearn=ham version=3.3.1 spammy=cid, 1069, efforts X-Spam-Status: No, score=-6.7 required=5.0 tests=AWL,BAYES_00,SPF_PASS autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on sourceware.org X-Spam-Level: X-HELO: gnu.wildebeest.org Message-ID: <909f618c164a1aee716dac9f6620aa90c5260ece.camel@klomp.org> Subject: Some cherry-picks (Was: [PATCH] bzip2: Fix return value when combining --test,-t and -q.) From: Mark Wielaard To: Santiago Ruano =?ISO-8859-1?Q?Rinc=F3n?= Cc: bzip2-devel@sourceware.org, Anibal Monsalve Salazar , Anthony Fok , Federico Mena Quintero Date: Tue, 01 Jan 2019 00:00:00 -0000 In-Reply-To: References: <1561362056-4393-1-git-send-email-mark@klomp.org> <20190624083116.GN6125@bartik> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Evolution 3.28.5 (3.28.5-2.el7) Mime-Version: 1.0 X-Spam-Flag: NO X-SW-Source: 2019-q2/txt/msg00007.txt.bz2 On Mon, 2019-06-24 at 11:34 +0200, Mark Wielaard wrote: > On Mon, 2019-06-24 at 10:31 +0200, Santiago Ruano Rinc=C3=B3n wrote: > > For information, Federico Mena (in CC) is taking over the development > > of > > bzip2: https://people.gnome.org/~federico/blog/maintaining-bzip2.html > >=20 > > You should consider coordinating your efforts! >=20 > Thanks. I assumed Federico was already on the bzip2-devel mailinglist. > We did email earlier to discuss bzip2 maintenance and that all the > infrastructure was already setup on the new sourceware.org bzip2 > project. But it seems we did some duplicate work. Sorry for the > miscommunication. >=20 > It looks like we picked at least similar patches for the C sources, so > those look mostly identical. I'll go over the remaining differences and > try to cherry-pick or merge them into the bzip2 git repo. I cherry-picked the following: commit ff986850159a1ea0c75617ffa792d1bb2069856e Author: Federico Mena Quintero Date: Wed May 29 17:14:27 2019 -0500 Change a magic number (6) for a constant (BZ_N_GROUPS). =20=20=20=20 decompress.c (BZ2_decompress): Check nGroups against BZ_N_GROUPS. commit 7ed62bfb46e87a9e878712603469440e6882b184 Author: Albert Astals Cid Date: Tue May 28 19:35:18 2019 +0200 Make sure nSelectors is not out of range =20=20=20=20 nSelectors is used in a loop from 0 to nSelectors to access selectorMtf which is UChar selectorMtf[BZ_MAX_SELECTORS]; so if nSelectors is bigger than BZ_MAX_SELECTORS it'll do an invalid me= mory access =20=20=20=20 Fixes out of bounds access discovered while fuzzying karchive =20=20=20=20 This was reported as CVE-2019-12900 BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. commit 16f2c753f9959e8d7c7e1fa771b8ccc5821427aa Author: Paul Kehrer Date: Sat Jun 8 10:06:40 2019 -0400 Fix undefined behavior in the macros SET_BH, CLEAR_BH, & ISSET_BH =20=20=20=20 These macros contain this pattern: 1 << ((Int32_value) & 31 =20=20=20=20 This causes the undefined behavior sanitizers in clang and gcc to complain because the shift, while ultimately stored to an unsigned variable, is done as a signed value. Adding a cast to unsigned for the int32 value resolves this issue. That makes the sources almost identical, modulo some whitespace issues (inconsistent use of tab/space as indent). And some Windows specific tweaks that I am not able to test (but they are probably correct though ). The only remaining difference between the trees (for the C sources) is the fix for O_CLOEXEC. I would like to better understand the (different) Debian solution for that: https://sources.debian.org/patches/bzip2/1.0.6-9/bzip2recover-race-open-out= put.diff/ Cheers, Mark