rpms
/
libcroco
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Import rpm: c8s

This commit is contained in:
Mohan Boddu 2023-04-04 15:39:04 +00:00
commit 4fc8df6af1
5 changed files with 450 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored Normal file
View File

@ -0,0 +1,2 @@
SOURCES/libcroco-0.6.12.tar.xz
/libcroco-0.6.12.tar.xz

184
CVE-2020-12825.patch Normal file
View File

@ -0,0 +1,184 @@
From 6eb257e5c731c691eb137fca94e916ca73941a5a Mon Sep 17 00:00:00 2001
From: Michael Catanzaro <mcatanzaro@gnome.org>
Date: Fri, 31 Jul 2020 15:21:53 -0500
Subject: [PATCH] parser: limit recursion in block and any productions
If we don't have any limits, we can recurse forever and overflow the
stack.
Fixes #8
---
src/cr-parser.c | 44 +++++++++++++++++++++++++++++---------------
1 file changed, 29 insertions(+), 15 deletions(-)
diff --git a/src/cr-parser.c b/src/cr-parser.c
index 18c9a01..f4a62e3 100644
--- a/src/cr-parser.c
+++ b/src/cr-parser.c
@@ -136,6 +136,8 @@ struct _CRParserPriv {
#define CHARS_TAB_SIZE 12
+#define RECURSIVE_CALLERS_LIMIT 100
+
/**
* IS_NUM:
*@a_char: the char to test.
@@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this);
static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this);
-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this);
+static enum CRStatus cr_parser_parse_any_core (CRParser * a_this,
+ guint n_calls);
-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this);
+static enum CRStatus cr_parser_parse_block_core (CRParser * a_this,
+ guint n_calls);
static enum CRStatus cr_parser_parse_value_core (CRParser * a_this);
@@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
cr_parser_try_to_skip_spaces_and_comments (a_this);
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
} while (status == CR_OK);
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr,
@@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
token);
token = NULL;
- status = cr_parser_parse_block_core (a_this);
+ status = cr_parser_parse_block_core (a_this, 0);
CHECK_PARSING_STATUS (status,
FALSE);
goto done;
@@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this)
RECORD_INITIAL_POS (a_this, &init_pos);
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
CHECK_PARSING_STATUS (status, FALSE);
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
} while (status == CR_OK);
@@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this)
*in chapter 4.1 of the css2 spec.
*block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*;
*@param a_this the current instance of #CRParser.
+ *@param n_calls used to limit recursion depth
*FIXME: code this function.
*/
static enum CRStatus
-cr_parser_parse_block_core (CRParser * a_this)
+cr_parser_parse_block_core (CRParser * a_this,
+ guint n_calls)
{
CRToken *token = NULL;
CRInputPos init_pos;
@@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this)
g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR);
+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
+ return CR_ERROR;
+
RECORD_INITIAL_POS (a_this, &init_pos);
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token);
@@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this)
} else if (token->type == CBO_TK) {
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
token = NULL;
- status = cr_parser_parse_block_core (a_this);
+ status = cr_parser_parse_block_core (a_this, n_calls + 1);
CHECK_PARSING_STATUS (status, FALSE);
goto parse_block_content;
} else {
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
token = NULL;
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
CHECK_PARSING_STATUS (status, FALSE);
goto parse_block_content;
}
@@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this)
status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
token);
token = NULL;
- status = cr_parser_parse_block_core (a_this);
+ status = cr_parser_parse_block_core (a_this, 0);
CHECK_PARSING_STATUS (status, FALSE);
ref++;
goto continue_parsing;
@@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this)
status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
token);
token = NULL;
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
if (status == CR_OK) {
ref++;
goto continue_parsing;
@@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this)
* | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*;
*
*@param a_this the current instance of #CRParser.
+ *@param n_calls used to limit recursion depth
*@return CR_OK upon successfull completion, an error code otherwise.
*/
static enum CRStatus
-cr_parser_parse_any_core (CRParser * a_this)
+cr_parser_parse_any_core (CRParser * a_this,
+ guint n_calls)
{
CRToken *token1 = NULL,
*token2 = NULL;
@@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this)
g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR);
+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
+ return CR_ERROR;
+
RECORD_INITIAL_POS (a_this, &init_pos);
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1);
@@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this)
*We consider parameter as being an "any*" production.
*/
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
} while (status == CR_OK);
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
@@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this)
}
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
} while (status == CR_OK);
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
@@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this)
}
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
} while (status == CR_OK);
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
--
GitLab

41
libcroco-0.6.1-multilib.patch Normal file
View File

@ -0,0 +1,41 @@
--- libcroco-0.6.1/croco-config.in.multilib 2006-03-05 16:57:01.000000000 -0500
+++ libcroco-0.6.1/croco-config.in 2006-05-23 13:54:34.000000000 -0400
@@ -1,10 +1,11 @@
#! /bin/sh
-prefix=@prefix@
-exec_prefix=@exec_prefix@
+name=libcroco-0.6
+prefix=`pkg-config --variable prefix $name`
+exec_prefix=`pkg-config --variable exec_prefix $name`
exec_prefix_set=no
-includedir=@includedir@
-libdir=@libdir@
+includedir=`pkg-config --variable includedir $name`
+libdir=`pkg-config --variable libdir $name`
usage()
{
@@ -59,7 +60,7 @@
;;
--version)
- echo @VERSION@
+ pkg-config --modversion $name
exit 0
;;
@@ -68,11 +69,11 @@
;;
--cflags)
- echo @CROCO_CFLAGS@ @GLIB2_CFLAGS@ @LIBXML2_CFLAGS@
+ pkg-config --cflags $name
;;
--libs)
- echo @CROCO_LIBS@ @GLIB2_LIBS@ @LIBXML2_LIBS@
+ pkg-config --libs $name
;;
*)

222
libcroco.spec Normal file
View File

@ -0,0 +1,222 @@
Name: libcroco
Summary: A CSS2 parsing library
Version: 0.6.12
Release: 4%{?dist}.1
License: LGPLv2
Group: System Environment/Libraries
Source: http://download.gnome.org/sources/libcroco/0.6/%{name}-%{version}.tar.xz
#Fedora-specific patch
Patch0: libcroco-0.6.1-multilib.patch
# https://gitlab.gnome.org/GNOME/libcroco/-/merge_requests/5
Patch1: CVE-2020-12825.patch
BuildRequires: pkgconfig
BuildRequires: glib2-devel
BuildRequires: libxml2-devel
%description
CSS2 parsing and manipulation library for GNOME
%package devel
Summary: Libraries and include files for developing with libcroco
Group: Development/Libraries
Requires: %{name}%{_isa} = %{version}-%{release}
%description devel
This package provides the necessary development libraries and include
files to allow you to develop with libcroco.
%prep
%setup -q
%patch0 -p1 -b .multilib
%patch1 -p1 -b .CVE-2020-12825
%build
%configure --disable-static
make %{?_smp_mflags} CFLAGS="$CFLAGS -fno-strict-aliasing"
%install
%make_install
find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
%check
make check
%post -p /sbin/ldconfig
%postun -p /sbin/ldconfig
%files
%license COPYING COPYING.LIB
%doc AUTHORS NEWS README
%{_bindir}/csslint-0.6
%{_libdir}/*.so.*
%files devel
%{_libdir}/*.so
%{_includedir}/libcroco-0.6
%{_bindir}/croco-0.6-config
%{_libdir}/pkgconfig/libcroco-0.6.pc
%{_datadir}/gtk-doc/html/libcroco
%changelog
* Thu Aug 06 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 0.6.12-4.1
- Fix CVE-2020-12825
Resolves: #1866484
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.12-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.12-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.12-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Thu Apr 06 2017 Kalev Lember <klember@redhat.com> - 0.6.12-1
- Update to 0.6.12
* Thu Feb 09 2017 Kalev Lember <klember@redhat.com> - 0.6.11-3
- Disable strict aliasing, since the code is not strict-aliasing-clean
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.11-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Thu Dec 17 2015 Kalev Lember <klember@redhat.com> - 0.6.11-1
- Update to 0.6.11
* Mon Dec 14 2015 Kalev Lember <klember@redhat.com> - 0.6.10-1
- Update to 0.6.10
* Sat Oct 31 2015 Kalev Lember <klember@redhat.com> - 0.6.9-1
- Update to 0.6.9
- Use make_install macro
- Mark COPYING and COPYING.LIB as %%license
- Tighten -devel subpackage deps
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.8-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 0.6.8-6
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.8-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.8-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Fri Nov 09 2012 Kalev Lember <kalevlember@gmail.com> - 0.6.8-1
- Update to 0.6.8
* Tue Oct 16 2012 Kalev Lember <kalevlember@gmail.com> - 0.6.7-1
- Update to 0.6.7
* Wed Sep 19 2012 Richard Hughes <hughsient@gmail.com> - 0.6.6-1
- Update to 0.6.6
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Tue Mar 27 2012 Kalev Lember <kalevlember@gmail.com> - 0.6.5-1
- Update to 0.6.5
- Dropped unused configure options
* Mon Feb 6 2012 Matthias Clasen <mclasen@redhat.com> - 0.6.4-1
- Update to 0.6.4
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Tue Nov 22 2011 Matthias Clasen <mclasen@redhat.com> - 0.6.3-1
- Update to 0.6.3
* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.2-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Fri Sep 10 2010 Parag Nemade <paragn AT fedoraproject.org> 0.6.2-5
- Merge-review cleanup (#225994)
* Tue Dec 8 2009 Matthias Clasen <mclasen@redhat.com> - 0.6.2-4
- Add source url
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
* Wed Feb 4 2009 Matthias Clasen <mclasen@redhat.com> - 0.6.2-1
- Update to 0.6.2
* Tue Apr 1 2008 Matthias Clasen <mclasen@redhat.com> - 0.6.1-5
- Clean up dependencies
* Fri Feb 8 2008 Matthias Clasen <mclasen@redhat.com> - 0.6.1-4
- Rebuild for gcc 4.3
* Wed Oct 10 2007 Matthias Clasen <mclasen@redhat.com> - 0.6.1-3
- Rebuild
- Update license tag
* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.6.1-2.1
- rebuild
* Tue May 23 2006 Matthias Clasen <mclasen@redhat.com> - 0.6.1-2
- Make config script a pkg-config wrapper to fix multilib conflict
* Mon Mar 13 2006 Matthias Clasen <mclasen@redhat.com> - 0.6.1-1
- Update to 0.6.1
- Drop upstreamed patches
* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.6.0-6.2.1
- bump again for double-long bug on ppc(64)
* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.6.0-6.2
- rebuilt for new gcc4.1 snapshot and glibc changes
* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
- rebuilt
* Sat Oct 15 2005 Florian La Roche <laroche@redhat.com>
- link shared lib against -lglib-2.0 and -lxml2
* Wed Mar 2 2005 Matthias Clasen <mclasen@redhat.com> - 0.6.0-5
- Rebuild with gcc4
* Wed Sep 22 2004 Matthias Clasen <mclasen@redhat.com> - 0.6.0-4
- Move croco-config to the devel package
* Mon Sep 20 2004 Matthias Clasen <mclasen@redhat.com> - 0.6-3
- Don't memset() stack variables
* Tue Aug 31 2004 Matthias Clasen <mclasen@redhat.com> - 0.6-2
- Add missing ldconfig calls (#131279)
* Fri Jul 30 2004 Matthias Clasen <mclasen@redhat.com> - 0.6-1
- Update to 0.6
* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
- rebuilt
* Sat Apr 10 2004 Warren Togami <wtogami@redhat.com>
- BR and -devel req libgnomeui-devel
* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
- rebuilt
* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
- rebuilt
* Tue Jan 27 2004 Jonathan Blandford <jrb@redhat.com> 0.4.0-1
- new version
* Wed Aug 13 2003 Jonathan Blandford <jrb@redhat.com> 0.3.0-1
- initial import into the tree. Based on the spec file in the package

1
sources Normal file
View File

@ -0,0 +1 @@
SHA512 (libcroco-0.6.12.tar.xz) = af9a171d5ccded255b57f170576e67155f12fa0f61ab3e379e907975f77afc37e82e22772c6019b2897cffc15b2425faf3ccfda92b1a45b23eda2519debabeb6