diff --git a/.gitignore b/.gitignore index 2365f0e..9779d1d 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/libyang-1.0.184.tar.gz +v2.1.148.tar.gz diff --git a/.libyang.metadata b/.libyang.metadata deleted file mode 100644 index 510d087..0000000 --- a/.libyang.metadata +++ /dev/null @@ -1 +0,0 @@ -89842305651e76696a0b79370659763f55be4398 SOURCES/libyang-1.0.184.tar.gz diff --git a/SOURCES/libyang-fix-CVE-2026-44673.patch b/SOURCES/libyang-fix-CVE-2026-44673.patch deleted file mode 100644 index 826485b..0000000 --- a/SOURCES/libyang-fix-CVE-2026-44673.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff --git a/src/parser_lyb.c b/src/parser_lyb.c -index 252bf77..e5bc860 100644 ---- a/src/parser_lyb.c -+++ b/src/parser_lyb.c -@@ -160,6 +160,9 @@ lyb_read_string(const char *data, char **str, int with_length, struct lyb_state - } - } - -+ LY_CHECK_ERR_RETURN(len + 1 == 0, -+ LOGERR(lybs->ctx, LY_EINVAL, "LYB value size overflow."), LY_EINVAL); -+ - *str = malloc((len + 1) * sizeof **str); - LY_CHECK_ERR_RETURN(!*str, LOGMEM(lybs->ctx), -1); - diff --git a/SPECS/libyang.spec b/SPECS/libyang.spec deleted file mode 100644 index 6706d8c..0000000 --- a/SPECS/libyang.spec +++ /dev/null @@ -1,169 +0,0 @@ -# valgrind finds invalid writes in libcmocka on arm -# see bug #1699304 for more information -%ifarch %arm ppc64le -%global run_valgrind_tests OFF -%else -%global run_valgrind_tests ON -%endif - -Name: libyang -Version: 1.0.184 -Release: 2%{?dist} -Summary: YANG data modeling language library -Url: https://github.com/CESNET/libyang -Source: %{url}/archive/libyang-%{version}.tar.gz -License: BSD - -Requires: pcre -BuildRequires: cmake -BuildRequires: doxygen -BuildRequires: pcre-devel -BuildRequires: gcc -BuildRequires: valgrind -BuildRequires: gcc-c++ -BuildRequires: swig >= 3.0.12 -BuildRequires: libcmocka-devel -BuildRequires: python3-devel -BuildRequires: flex -BuildRequires: bison -BuildRequires: graphviz - -Patch1: libyang-fix-CVE-2026-44673.patch - -%package devel -Summary: Development files for libyang -Requires: %{name}%{?_isa} = %{version}-%{release} -Requires: pcre-devel - -%package devel-doc -Summary: Documentation of libyang API -Requires: %{name} = %{version}-%{release} -BuildArch: noarch - -%package -n libyang-cpp -Summary: C++ bindings for libyang -Requires: %{name}%{?_isa} = %{version}-%{release} - -%package -n libyang-cpp-devel -Summary: Development files for libyang-cpp -Requires: libyang-cpp%{?_isa} = %{version}-%{release} -Requires: pcre-devel - -%package -n python3-libyang -Summary: Python3 bindings for libyang -Requires: libyang-cpp%{?_isa} = %{version}-%{release} -%{?python_provide:%python_provide python3-libyang} - -%description -n libyang-cpp -Bindings of libyang library to C++ language. - -%description -n libyang-cpp-devel -Headers of bindings to c++ language. - -%description -n python3-libyang -Bindings of libyang library to python language. - -%description devel -Headers of libyang library. - -%description devel-doc -Documentation of libyang API. - -%description -Libyang is YANG data modeling language parser and toolkit -written (and providing API) in C. - -%prep -%autosetup -S git -mkdir build - -%build -cd build -%cmake \ - -DCMAKE_INSTALL_PREFIX:PATH=/usr \ - -DCMAKE_BUILD_TYPE:String="Package" \ - -DENABLE_LYD_PRIV=ON \ - -DGEN_JAVA_BINDINGS=OFF \ - -DGEN_JAVASCRIPT_BINDINGS=OFF \ - -DGEN_LANGUAGE_BINDINGS=ON \ - -DENABLE_VALGRIND_TESTS=%{run_valgrind_tests} .. -%make_build -make doc - -%check -cd build -ctest --output-on-failure -V %{?_smp_mflags} - -%install -pushd build -%make_install DESTDIR=%{buildroot} -popd -mkdir -m0755 -p %{buildroot}/%{_docdir}/libyang -cp -r doc/html %{buildroot}/%{_docdir}/libyang/html - -%files -%license LICENSE -%{_bindir}/yanglint -%{_bindir}/yangre -%{_datadir}/man/man1/yanglint.1.gz -%{_datadir}/man/man1/yangre.1.gz -%{_libdir}/libyang.so.* -%{_libdir}/libyang1 - -%files devel -%{_libdir}/libyang.so -%{_libdir}/pkgconfig/libyang.pc -%{_includedir}/libyang/*.h -%dir %{_includedir}/libyang/ - -%files devel-doc -%{_docdir}/libyang - -%files -n libyang-cpp -%{_libdir}/libyang-cpp.so.* - -%files -n libyang-cpp-devel -%{_libdir}/libyang-cpp.so -%{_includedir}/libyang/*.hpp -%{_libdir}/pkgconfig/libyang-cpp.pc -%dir %{_includedir}/libyang/ - -%files -n python3-libyang -%{python3_sitearch}/yang.py -%{python3_sitearch}/_yang.so -%{python3_sitearch}/__pycache__/yang* - -%changelog -* Tue Jun 02 2026 Michal Ruprich - 1.0.184-2 -- DoS or arbitrary code execution via maliciously crafted LYB binary blob -- Resolves: RHEL-177017 - CVE-2026-44673 - -* Thu Jan 07 2021 Michal Ruprich - 1.0.184-1 -- Resolves: #1910046 - [RFE] Rebase libyang to 1.0.184 - -* Mon Dec 16 2019 Michal Ruprich - 0.16.105-5 -- Related: #1780311 - Fixing a few covscan issues - -* Tue Dec 10 2019 Michal Ruprich - 0.16.105-4 -- Resolves: #1780311 - CVE-2019-19333 libyang: stack-based buffer overflow in make_canonical when bits leaf type is used -- Resolves: #1780313 - CVE-2019-19334 libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used - -* Mon May 27 2019 Michal Ruprich - 0.16.105-3 -- Related: #1698076 - Adding gating file - -* Tue May 14 2019 Michal Ruprich - 0.16.105-2 -- Related: #1698076 - turning off valgrind on tests on ppc64le - -* Mon May 13 2019 Michal Ruprich - 0.16.105-1 -- Resolves: #1698076 - [RFE] Add libyang package as a build-time dependency for FRR - -* Fri Apr 26 2019 Tomas Korbar - 0.16.105-1 -- Change specfile accordingly to mosvald's review -- Remove obsolete ldconfig scriptlets -- libyang-devel-doc changed to noarch package -- Add python_provide macro to python3-libyang subpackage -- Remove obsolete Requires from libyang-cpp-devel -- Start using cmake with smp_mflags macro - -* Wed Apr 03 2019 Tomas Korbar - 0.16.105-1 -- Initial commit of package after editation of specfile diff --git a/disable-test_structure.patch b/disable-test_structure.patch new file mode 100644 index 0000000..0088472 --- /dev/null +++ b/disable-test_structure.patch @@ -0,0 +1,10 @@ +diff --git a/tests/utests/CMakeLists.txt b/tests/utests/CMakeLists.txt +index ac47611b..50f12e55 100644 +--- a/tests/utests/CMakeLists.txt ++++ b/tests/utests/CMakeLists.txt +@@ -74,4 +74,4 @@ ly_add_utest(NAME metadata SOURCES extensions/test_metadata.c) + ly_add_utest(NAME nacm SOURCES extensions/test_nacm.c) + ly_add_utest(NAME yangdata SOURCES extensions/test_yangdata.c) + ly_add_utest(NAME schema_mount SOURCES extensions/test_schema_mount.c) +-ly_add_utest(NAME structure SOURCES extensions/test_structure.c) ++#ly_add_utest(NAME structure SOURCES extensions/test_structure.c) diff --git a/libyang-fix-CVE-2026-44673.patch b/libyang-fix-CVE-2026-44673.patch new file mode 100644 index 0000000..e91e90c --- /dev/null +++ b/libyang-fix-CVE-2026-44673.patch @@ -0,0 +1,29 @@ +diff --git a/src/parser_lyb.c b/src/parser_lyb.c +index 788be94..5a26e43 100644 +--- a/src/parser_lyb.c ++++ b/src/parser_lyb.c +@@ -217,6 +217,11 @@ lyb_read_string(char **str, uint8_t len_size, struct lylyb_ctx *lybctx) + + lyb_read_number(&len, sizeof len, len_size, lybctx); + ++ /* len could be potentially at UINT64_MAX meaning that len + 1 would ++ * cause malloc(0) followed by an out-of-bounds write */ ++ LY_CHECK_ERR_RET(len == UINT64_MAX, ++ LOGERR(lybctx->ctx, LY_EINVAL, "LYB value size overflow."), LY_EINVAL); ++ + *str = malloc((len + 1) * sizeof **str); + LY_CHECK_ERR_RET(!*str, LOGMEM(lybctx->ctx), LY_EMEM); + +@@ -281,6 +281,12 @@ lyb_read_term_value(const struct lysc_node_leaf *term, uint8_t **term_value, uin + *term_value_len = lyb_data_len; + } + ++ /* *term_value_len + 1 can overflow uint32_t allocated_size when ++ * *term_value_len >= UINT32_MAX, causing malloc(0) followed by ++ * an out-of-bounds write (OOM / DoS) */ ++ LY_CHECK_ERR_RET(*term_value_len >= UINT32_MAX, ++ LOGERR(lybctx->ctx, LY_EINVAL, "LYB value size overflow."), LY_EINVAL); ++ + /* Allocate memory. */ + allocated_size = *term_value_len + 1; + *term_value = malloc(allocated_size * sizeof **term_value); diff --git a/libyang.spec b/libyang.spec new file mode 100644 index 0000000..2e42e4f --- /dev/null +++ b/libyang.spec @@ -0,0 +1,283 @@ +%global run_valgrind_tests ON +# valgrind finds invalid writes in libcmocka on arm and power +# see bug #1699304 for more information +%ifarch %{arm} ppc64le +%global run_valgrind_tests OFF +%endif +# Turn off valgrind unilaterally on all arches which don't have +# valgrind at all, like riscv64. +%ifnarch %{valgrind_arches} +%global run_valgrind_tests OFF +%endif + +Name: libyang +Version: 2.1.148 +Release: 4%{?dist} +Summary: YANG data modeling language library +Url: https://github.com/CESNET/libyang +Source: %{url}/archive/v%{version}.tar.gz +License: BSD-3-Clause + +# disable tests failing on s390x +Patch1: disable-test_structure.patch +# Original commit: https://github.com/CESNET/libyang/commit/48672b2 +# We have a different version, below is a minimal patch +Patch2: libyang-fix-CVE-2026-44673.patch + +BuildRequires: cmake +BuildRequires: doxygen +BuildRequires: gcc +BuildRequires: cmake(cmocka) >= 1.0.0 +BuildRequires: make +BuildRequires: pkgconfig(libpcre2-8) >= 10.21 +%ifarch %{valgrind_arches} +BuildRequires: valgrind +%endif + +Conflicts: %{name} < 1.0.225-3 + +%package devel +Summary: Development files for libyang +Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: pcre2-devel + +%package devel-doc +Summary: Documentation of libyang API +Requires: %{name}%{?_isa} = %{version}-%{release} + +%package tools +Summary: YANG validator tools +Requires: %{name}%{?_isa} = %{version}-%{release} +# This was not properly split out before +Conflicts: %{name} < 1.0.225-3 + +%description devel +Headers of libyang library. + +%description devel-doc +Documentation of libyang API. + +%description tools +YANG validator tools. + +%description +Libyang is YANG data modeling language parser and toolkit +written (and providing API) in C. + +%prep +%autosetup -p1 + +%build +%cmake \ + -DCMAKE_INSTALL_PREFIX:PATH=%{_prefix} \ + -DCMAKE_BUILD_TYPE=RELWITHDEBINFO \ + -DENABLE_LYD_PRIV=ON \ + -DENABLE_VALGRIND_TESTS=%{run_valgrind_tests} +%cmake_build + +pushd redhat-linux-build +make doc +popd + +%check +pushd redhat-linux-build +ctest --output-on-failure -V %{?_smp_mflags} +popd + +%install +%cmake_install + +mkdir -m0755 -p %{buildroot}/%{_docdir}/libyang +cp -a doc/html %{buildroot}/%{_docdir}/libyang/html + +%files +%license LICENSE +%{_libdir}/libyang.so.2 +%{_libdir}/libyang.so.2.* +%{_datadir}/yang/modules/libyang/*.yang +%dir %{_datadir}/yang/ +%dir %{_datadir}/yang/modules/ +%dir %{_datadir}/yang/modules/libyang/ + +%files tools +%{_bindir}/yanglint +%{_bindir}/yangre +%{_datadir}/man/man1/yanglint.1.gz +%{_datadir}/man/man1/yangre.1.gz + +%files devel +%{_libdir}/libyang.so +%{_libdir}/pkgconfig/libyang.pc +%{_includedir}/libyang/*.h +%dir %{_includedir}/libyang/ + +%files devel-doc +%{_docdir}/libyang + +%changelog +* Mon May 25 2026 Michal Ruprich - 2.1.148-4 +- DoS or arbitrary code execution via maliciously crafted LYB binary blob +- Resolves: RHEL-177026 - CVE-2026-44673 + +* Wed Nov 05 2025 Michal Ruprich - 2.1.148-3 +- Resolves: RHEL-119430 - Move libyang-devel to CRB + +* Tue Oct 29 2024 Troy Dawson - 2.1.148-2 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 + +* Thu Aug 22 2024 Michal Ruprich - 2.1.148-1 +- New version 2.1.148 + +* Mon Jun 24 2024 Troy Dawson - 2.1.80-6 +- Bump release for June 2024 mass rebuild + +* Sat Mar 02 2024 David Abdurachmanov - 2.1.80-5 +- Properly check valgrind arches + +* Thu Jan 25 2024 Fedora Release Engineering - 2.1.80-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 2.1.80-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jul 20 2023 Fedora Release Engineering - 2.1.80-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue May 23 2023 Tomas Korbar - 2.1.80-1 +- Rebase to version 2.1.80 +- Resolves: rhbz#2209212 + +* Sun Mar 19 2023 Tomas Korbar - 2.1.55-1 +- Rebase to version 2.1.55 +- Resolves: rhbz#2179481 + +* Fri Mar 10 2023 Tomas Korbar - 2.1.30-2 +- Change the License tag to the SPDX format + +* Thu Jan 19 2023 Tomas Korbar - 2.1.30-1 +- Rebase to version 2.1.30 +- Resolves: rhbz#2162362 + +* Wed Nov 09 2022 Jakub Ružička - 2.1.4-1 +- Rebase to version 2.1.4 (Resolves: rhbz#2141228) +- Add patch to disable tests failing on s390x + +* Mon Aug 01 2022 Tomas Korbar - 2.0.231-2 +- Clean specfile and remove obsolete tag that is not relevant + +* Wed Jul 27 2022 Jakub Ružička - 2.0.231-1 +- Rebase to version 2.0.231 (Resolves: rhbz#2111304) +- Own yang modules (Resolves: rhbz#2094371) +- Use proper CMAKE_BUILD_TYPE + +* Thu Jul 21 2022 Fedora Release Engineering - 2.0.194-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon May 09 2022 Tomas Korbar - 2.0.194-1 +- Rebase to version 2.0.194 +- Resolves: rhbz#2082735 + +* Tue Mar 15 2022 Jakub Ružička - 2.0.164-1 +- Rebase to version 2.0.164 + +* Thu Jan 20 2022 Fedora Release Engineering - 2.0.112-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Jan 19 2022 Tomas Korbar - 2.0.112-2 +- Fix building of libyang 2 on fedora 34 + +* Tue Nov 30 2021 Tomas Korbar - 2.0.112-1 +- Rebase to version 2.0.112 +- Resolves: rhbz#2022586 + +* Mon Oct 11 2021 Tomas Korbar - 2.0.97-1 +- Rebase to version 2.0.97 +- Resolves: rhbz#2012348 + +* Thu Sep 30 2021 Tomas Korbar - 2.0.88-1 +- Rebase to version 2.0.88 +- Resolves: rhbz#2007673 + +* Fri Aug 06 2021 Tomas Korbar - 2.0.7-1 +- Rebase to version 2.0.7 +- Resolves: rhbz#1959645 + +* Thu Jul 22 2021 Fedora Release Engineering - 1.0.225-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Sat Jul 10 2021 Neal Gompa - 1.0.225-3 +- Clean up the spec file for legibility and modern spec standards +- Split out tools into their own subpackage +- Remove archfulness from the build path to fix documentation build + +* Fri Jun 04 2021 Python Maint - 1.0.225-2 +- Rebuilt for Python 3.10 + +* Tue Mar 09 2021 Tomas Korbar - 1.0.225-1 +- Rebase to version 1.0.225 +- Resolves: rhbz#1936718 + +* Wed Feb 03 2021 Tomas Korbar - 1.0.215-1 +- Rebase to version 1.0.215 +- Resolves: rhbz#1921779 + +* Tue Jan 26 2021 Fedora Release Engineering - 1.0.184-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Sep 02 2020 Merlin Mathesius - 1.0.184-3 +- Fix FTBFS by disabling valgrind on power since it finds bogus invalid + writes in libcmocka + +* Tue Jul 28 2020 Fedora Release Engineering - 1.0.184-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 22 2020 Tomas Korbar - 1.0.184-1 +- Update to 1.0.184 +- Fix build + +* Fri Jun 19 2020 Tomas Korbar - 1.0.176-1 +- Update to 1.0.176 + +* Tue May 26 2020 Miro Hrončok - 1.0.167-2 +- Rebuilt for Python 3.9 + +* Mon May 18 2020 Tomas Korbar - 1.0.167-1 +- Update to 1.0.167 + +* Fri Feb 07 2020 Tomas Korbar - 1.0.130-1 +- Rebase to version 1.0.130 (#1797495) + +* Wed Jan 29 2020 Fedora Release Engineering - 1.0.101-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Dec 09 2019 Tomas Korbar - 1.0.101-1 +- Rebase to version 1.0.101 +- Fix CVE-2019-19333 (#1780495) +- Fix CVE-2019-19334 (#1780494) + +* Fri Oct 25 2019 Tomas Korbar - 1.0.73-1 +- Rebase to version 1.0.73 (#1758512) + +* Thu Oct 03 2019 Miro Hrončok - 0.16.105-4 +- Rebuilt for Python 3.8.0rc1 (#1748018) + +* Mon Aug 19 2019 Miro Hrončok - 0.16.105-3 +- Rebuilt for Python 3.8 + +* Thu Jul 25 2019 Fedora Release Engineering - 0.16.105-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue May 07 2019 Tomas Korbar - 0.16.105-1 +- Initial import (#1699846). + +* Fri Apr 26 2019 Tomas Korbar - 0.16.105-1 +- Change specfile accordingly to mosvald's review +- Remove obsolete ldconfig scriptlets +- libyang-devel-doc changed to noarch package +- Add python_provide macro to python3-libyang subpackage +- Remove obsolete Requires from libyang-cpp-devel +- Start using cmake with smp_mflags macro + +* Wed Apr 03 2019 Tomas Korbar - 0.16.105-1 +- Initial commit of package after editation of specfile diff --git a/sources b/sources new file mode 100644 index 0000000..e82a194 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (v2.1.148.tar.gz) = 548628e6879f37cd27b0b39197a389c140b4372d11309f588ab93a4d74889b59f891f5b6bc447b491e24544559a42e93a1dbfa49827506aed30b226cf61ca400