import libuv-1.38.0-2.el8

SOURCES/libuv-unix-don-t-use-_POSIX_PATH_MAX.patch

@@ -0,0 +1,48 @@
+Upstream patch from https://github.com/libuv/libuv/pull/2966
+to address https://bugzilla.redhat.com/show_bug.cgi?id=1879330
+Resolves: #CVE-2020-8252
+
+From 0e6e8620496dff0eb285589ef1e37a7f407f3ddd Mon Sep 17 00:00:00 2001
+From: Ben Noordhuis <info@bnoordhuis.nl>
+Date: Mon, 24 Aug 2020 11:42:27 +0200
+Subject: unix: don't use _POSIX_PATH_MAX
+
+Libuv was using _POSIX_PATH_MAX wrong. Bug introduced in commit b56d279b
+("unix: do not require PATH_MAX to be defined") from September 2018.
+
+_POSIX_PATH_MAX is the minimum max path size guaranteed by POSIX, not
+the actual max path size of the system libuv runs on. _POSIX_PATH_MAX
+is always 256, the real max is often much bigger.
+
+This commit fixes buffer overruns when processing very long paths in
+uv_fs_readlink() and uv_fs_realpath() because libuv was not allocating
+enough memory to store the result.
+
+Fixes: https://github.com/libuv/libuv/issues/2965
+PR-URL: https://github.com/libuv/libuv/pull/2966
+Reviewed-By: Richard Lau <riclau@uk.ibm.com>
+Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
+Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
+Reviewed-By: Jameson Nash <vtjnash@gmail.com>
+---
+ src/unix/internal.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/src/unix/internal.h b/src/unix/internal.h
+index 30711673..9d3c2297 100644
+--- a/src/unix/internal.h
++++ b/src/unix/internal.h
+@@ -62,9 +62,7 @@
+ # include <AvailabilityMacros.h>
+ #endif
+ 
+-#if defined(_POSIX_PATH_MAX)
+-# define UV__PATH_MAX _POSIX_PATH_MAX
+-#elif defined(PATH_MAX)
++#if defined(PATH_MAX)
+ # define UV__PATH_MAX PATH_MAX
+ #else
+ # define UV__PATH_MAX 8192
+-- 
+2.26.2
+

SPECS/libuv.spec

@@ -6,7 +6,7 @@
 Name:           libuv
 Epoch:          1
 Version:        1.38.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Platform layer for node.js
 
 # the licensing breakdown is described in detail in the LICENSE file
@@ -25,6 +25,7 @@ BuildRequires:  gcc
 # -- Patches -- #
 Patch1:         0001-Disable-failing-network-tests.patch
 %endif
+Patch2:         libuv-unix-don-t-use-_POSIX_PATH_MAX.patch
 
 %description
 libuv is a new platform layer for Node. Its purpose is to abstract IOCP on
@@ -88,6 +89,11 @@ make check
 %{_libdir}/%{name}.a
 
 %changelog
+* Wed Sep 23 2020 Honza Horak <hhorak@redhat.com> - 1:1.38.0-2
+- Fix max path size by not using _POSIX_PATH_MAX
+  Resolves: #1879330
+  Fixes: CVE-2020-8252
+
 * Tue Jun 09 2020 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:1.38.0-1
 - Update, disable failing tests