- rel 4; fix for CVE-2014-5119

diff --git a/glibc-git.patch b/glibc-git.patch
new file mode 100644 (file)
index 0000000..bf4c813
--- /dev/null
+++ b/glibc-git.patch
@@ -0,0 +1,199 @@
+commit a1a6a401ab0a3c9f15fb7eaebbdcee24192254e8
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Tue Aug 26 19:38:59 2014 +0200
+
+    __gconv_translit_find: Disable function [BZ #17187]
+    
+    This functionality has never worked correctly, and the implementation
+    contained a security vulnerability (CVE-2014-5119).
+
+diff --git a/iconv/gconv_trans.c b/iconv/gconv_trans.c
+index 1e25854..e0835fc 100644
+--- a/iconv/gconv_trans.c
++++ b/iconv/gconv_trans.c
+@@ -238,181 +238,12 @@ __gconv_transliterate (struct __gconv_step *step,
+   return __GCONV_ILLEGAL_INPUT;
+ }
+ 
+-
+-/* Structure to represent results of found (or not) transliteration
+-   modules.  */
+-struct known_trans
+-{
+-  /* This structure must remain the first member.  */
+-  struct trans_struct info;
+-
+-  char *fname;
+-  void *handle;
+-  int open_count;
+-};
+-
+-
+-/* Tree with results of previous calls to __gconv_translit_find.  */
+-static void *search_tree;
+-
+-/* We modify global data.   */
+-__libc_lock_define_initialized (static, lock);
+-
+-
+-/* Compare two transliteration entries.  */
+-static int
+-trans_compare (const void *p1, const void *p2)
+-{
+-  const struct known_trans *s1 = (const struct known_trans *) p1;
+-  const struct known_trans *s2 = (const struct known_trans *) p2;
+-
+-  return strcmp (s1->info.name, s2->info.name);
+-}
+-
+-
+-/* Open (maybe reopen) the module named in the struct.  Get the function
+-   and data structure pointers we need.  */
+-static int
+-open_translit (struct known_trans *trans)
+-{
+-  __gconv_trans_query_fct queryfct;
+-
+-  trans->handle = __libc_dlopen (trans->fname);
+-  if (trans->handle == NULL)
+-    /* Not available.  */
+-    return 1;
+-
+-  /* Find the required symbol.  */
+-  queryfct = __libc_dlsym (trans->handle, "gconv_trans_context");
+-  if (queryfct == NULL)
+-    {
+-      /* We cannot live with that.  */
+-    close_and_out:
+-      __libc_dlclose (trans->handle);
+-      trans->handle = NULL;
+-      return 1;
+-    }
+-
+-  /* Get the context.  */
+-  if (queryfct (trans->info.name, &trans->info.csnames, &trans->info.ncsnames)
+-      != 0)
+-    goto close_and_out;
+-
+-  /* Of course we also have to have the actual function.  */
+-  trans->info.trans_fct = __libc_dlsym (trans->handle, "gconv_trans");
+-  if (trans->info.trans_fct == NULL)
+-    goto close_and_out;
+-
+-  /* Now the optional functions.  */
+-  trans->info.trans_init_fct =
+-    __libc_dlsym (trans->handle, "gconv_trans_init");
+-  trans->info.trans_context_fct =
+-    __libc_dlsym (trans->handle, "gconv_trans_context");
+-  trans->info.trans_end_fct =
+-    __libc_dlsym (trans->handle, "gconv_trans_end");
+-
+-  trans->open_count = 1;
+-
+-  return 0;
+-}
+-
+-
+ int
+ internal_function
+ __gconv_translit_find (struct trans_struct *trans)
+ {
+-  struct known_trans **found;
+-  const struct path_elem *runp;
+-  int res = 1;
+-
+-  /* We have to have a name.  */
+-  assert (trans->name != NULL);
+-
+-  /* Acquire the lock.  */
+-  __libc_lock_lock (lock);
+-
+-  /* See whether we know this module already.  */
+-  found = __tfind (trans, &search_tree, trans_compare);
+-  if (found != NULL)
+-    {
+-      /* Is this module available?  */
+-      if ((*found)->handle != NULL)
+-      {
+-        /* Maybe we have to reopen the file.  */
+-        if ((*found)->handle != (void *) -1)
+-          /* The object is not unloaded.  */
+-          res = 0;
+-        else if (open_translit (*found) == 0)
+-          {
+-            /* Copy the data.  */
+-            *trans = (*found)->info;
+-            (*found)->open_count++;
+-            res = 0;
+-          }
+-      }
+-    }
+-  else
+-    {
+-      size_t name_len = strlen (trans->name) + 1;
+-      int need_so = 0;
+-      struct known_trans *newp;
+-
+-      /* We have to continue looking for the module.  */
+-      if (__gconv_path_elem == NULL)
+-      __gconv_get_path ();
+-
+-      /* See whether we have to append .so.  */
+-      if (name_len <= 4 || memcmp (&trans->name[name_len - 4], ".so", 3) != 0)
+-      need_so = 1;
+-
+-      /* Create a new entry.  */
+-      newp = (struct known_trans *) malloc (sizeof (struct known_trans)
+-                                          + (__gconv_max_path_elem_len
+-                                             + name_len + 3)
+-                                          + name_len);
+-      if (newp != NULL)
+-      {
+-        char *cp;
+-
+-        /* Clear the struct.  */
+-        memset (newp, '\0', sizeof (struct known_trans));
+-
+-        /* Store a copy of the module name.  */
+-        newp->info.name = cp = (char *) (newp + 1);
+-        cp = __mempcpy (cp, trans->name, name_len);
+-
+-        newp->fname = cp;
+-
+-        /* Search in all the directories.  */
+-        for (runp = __gconv_path_elem; runp->name != NULL; ++runp)
+-          {
+-            cp = __mempcpy (__stpcpy ((char *) newp->fname, runp->name),
+-                            trans->name, name_len);
+-            if (need_so)
+-              memcpy (cp, ".so", sizeof (".so"));
+-
+-            if (open_translit (newp) == 0)
+-              {
+-                /* We found a module.  */
+-                res = 0;
+-                break;
+-              }
+-          }
+-
+-        if (res)
+-          newp->fname = NULL;
+-
+-        /* In any case we'll add the entry to our search tree.  */
+-        if (__tsearch (newp, &search_tree, trans_compare) == NULL)
+-          {
+-            /* Yickes, this should not happen.  Unload the object.  */
+-            res = 1;
+-            /* XXX unload here.  */
+-          }
+-      }
+-    }
+-
+-  __libc_lock_unlock (lock);
+-
+-  return res;
++  /* Transliteration module loading has been removed because it never
++     worked as intended and suffered from a security vulnerability.
++     Consequently, this function always fails.  */
++  return 1;
+ }

diff --git a/glibc.spec b/glibc.spec
index 4323fcb0a9d4cd4c5e1dac7afce9ba80a4a4c806..a38acc7beef605910562efb6e109c0c85f02db89 100644 (file)
--- a/glibc.spec
+++ b/glibc.spec
@@ -35,7 +35,7 @@ Summary(tr.UTF-8):    GNU libc
 Summary(uk.UTF-8):     GNU libc версії
 Name:          glibc
 Version:       %{core_version}
-Release:       3
+Release:       4
 Epoch:         6
 License:       LGPL v2.1+
 Group:         Libraries
@@ -51,6 +51,7 @@ Source6:      %{name}-localedb-gen
 Source7:       %{name}-LD-path.c
 Source8:       nscd.upstart
 Source9:       nscd.tmpfiles
+Patch100:      %{name}-git.patch
 # against GNU TP (libc domain)
 #Patch1:               %{name}-pl.po-update.patch
 Patch2:                %{name}-pld.patch
@@ -940,6 +941,8 @@ echo "Minimal supported kernel is 2.6.16" >&2
 exit 1
 %endif
 
+%patch100 -p1
+
 %patch2 -p1
 %patch3 -p0
 %patch4 -p1