From f34068734feb1a58550ea0a0ccc54c3465e369e1 Mon Sep 17 00:00:00 2001 From: Leigh Scott Date: Thu, 24 Oct 2019 08:32:36 +0100 Subject: [PATCH] Apply upstream commits to fix FTBFS (ps: version 4 is availabe) --- ...nerate_pw_hash-don-t-use-strlen-for-.patch | 102 +++++++++++++++ ...void-taking-pointer-to-packed-struct.patch | 117 ++++++++++++++++++ mokutil.spec | 7 +- 3 files changed, 225 insertions(+), 1 deletion(-) create mode 100644 0008-generate_hash-generate_pw_hash-don-t-use-strlen-for-.patch create mode 100644 0009-Avoid-taking-pointer-to-packed-struct.patch diff --git a/0008-generate_hash-generate_pw_hash-don-t-use-strlen-for-.patch b/0008-generate_hash-generate_pw_hash-don-t-use-strlen-for-.patch new file mode 100644 index 0000000..aa6e78e --- /dev/null +++ b/0008-generate_hash-generate_pw_hash-don-t-use-strlen-for-.patch @@ -0,0 +1,102 @@ +From 385a7dd63fad61a28e38444da797d947f1c79623 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 15 May 2018 11:20:15 -0400 +Subject: [PATCH 01/12] generate_hash() / generate_pw_hash(): don't use + strlen() for strncpy bounds + +New gcc rightly comlplains when we do the following: + +strncpy (dest, src, strlen(src)); + +For two reasons: +a) it doesn't copy the NUL byte +b) it's otherwise the same thing strcpy() would have done + +This patch replaces that with stpncpy (just because it's slightly easier +to use) and the real bounds for the destination. + +Signed-off-by: Peter Jones +--- + src/mokutil.c | 34 +++++++++++++++++++++++----------- + 1 file changed, 23 insertions(+), 11 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index 6e9a342..6e31e2d 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -766,9 +766,10 @@ generate_hash (pw_crypt_t *pw_crypt, char *password, unsigned int pw_len) + { + pw_crypt_t new_crypt; + char settings[SETTINGS_LEN]; ++ char *next; + char *crypt_string; + const char *prefix; +- int hash_len, prefix_len; ++ int hash_len, settings_len = sizeof (settings) - 2; + + if (!password || !pw_crypt || password[pw_len] != '\0') + return -1; +@@ -776,15 +777,19 @@ generate_hash (pw_crypt_t *pw_crypt, char *password, unsigned int pw_len) + prefix = get_crypt_prefix (pw_crypt->method); + if (!prefix) + return -1; +- prefix_len = strlen(prefix); + + pw_crypt->salt_size = get_salt_size (pw_crypt->method); + generate_salt ((char *)pw_crypt->salt, pw_crypt->salt_size); + +- strncpy (settings, prefix, prefix_len); +- strncpy (settings + prefix_len, (const char *)pw_crypt->salt, +- pw_crypt->salt_size); +- settings[pw_crypt->salt_size + prefix_len] = '\0'; ++ memset (settings, 0, sizeof (settings)); ++ next = stpncpy (settings, prefix, settings_len); ++ if (pw_crypt->salt_size > settings_len - (next - settings)) { ++ errno = EOVERFLOW; ++ return -1; ++ } ++ next = stpncpy (next, (const char *)pw_crypt->salt, ++ pw_crypt->salt_size); ++ *next = '\0'; + + crypt_string = crypt (password, settings); + if (!crypt_string) +@@ -1931,10 +1936,11 @@ static int + generate_pw_hash (const char *input_pw) + { + char settings[SETTINGS_LEN]; ++ char *next; + char *password = NULL; + char *crypt_string; + const char *prefix; +- int prefix_len; ++ int settings_len = sizeof (settings) - 2; + unsigned int pw_len, salt_size; + + if (input_pw) { +@@ -1960,12 +1966,18 @@ generate_pw_hash (const char *input_pw) + prefix = get_crypt_prefix (DEFAULT_CRYPT_METHOD); + if (!prefix) + return -1; +- prefix_len = strlen(prefix); + +- strncpy (settings, prefix, prefix_len); ++ memset (settings, 0, sizeof (settings)); ++ next = stpncpy (settings, prefix, settings_len); + salt_size = get_salt_size (DEFAULT_CRYPT_METHOD); +- generate_salt ((settings + prefix_len), salt_size); +- settings[DEFAULT_SALT_SIZE + prefix_len] = '\0'; ++ if (salt_size > settings_len - (next - settings)) { ++ free(password); ++ errno = EOVERFLOW; ++ return -1; ++ } ++ generate_salt (next, salt_size); ++ next += salt_size; ++ *next = '\0'; + + crypt_string = crypt (password, settings); + free (password); +-- +2.21.0 + diff --git a/0009-Avoid-taking-pointer-to-packed-struct.patch b/0009-Avoid-taking-pointer-to-packed-struct.patch new file mode 100644 index 0000000..4e863ec --- /dev/null +++ b/0009-Avoid-taking-pointer-to-packed-struct.patch @@ -0,0 +1,117 @@ +From 19e8c9071b3d9306ca7b7329b313b31f86c2936d Mon Sep 17 00:00:00 2001 +From: Harry Youd +Date: Wed, 31 Jul 2019 19:44:53 +0100 +Subject: [PATCH 12/12] Avoid taking pointer to packed struct +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Fixes: +error: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Werror=address-of-packed-member] +--- + src/mokutil.c | 38 ++++++++++++++++++++++---------------- + 1 file changed, 22 insertions(+), 16 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index e2d567d..8892613 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -270,20 +270,22 @@ build_mok_list (void *data, unsigned long data_size, uint32_t *mok_num) + return NULL; + } + +- if ((efi_guid_cmp (&CertList->SignatureType, &efi_guid_x509_cert) != 0) && +- (efi_guid_cmp (&CertList->SignatureType, &efi_guid_sha1) != 0) && +- (efi_guid_cmp (&CertList->SignatureType, &efi_guid_sha224) != 0) && +- (efi_guid_cmp (&CertList->SignatureType, &efi_guid_sha256) != 0) && +- (efi_guid_cmp (&CertList->SignatureType, &efi_guid_sha384) != 0) && +- (efi_guid_cmp (&CertList->SignatureType, &efi_guid_sha512) != 0)) { ++ efi_guid_t sigtype = CertList->SignatureType; ++ ++ if ((efi_guid_cmp (&sigtype, &efi_guid_x509_cert) != 0) && ++ (efi_guid_cmp (&sigtype, &efi_guid_sha1) != 0) && ++ (efi_guid_cmp (&sigtype, &efi_guid_sha224) != 0) && ++ (efi_guid_cmp (&sigtype, &efi_guid_sha256) != 0) && ++ (efi_guid_cmp (&sigtype, &efi_guid_sha384) != 0) && ++ (efi_guid_cmp (&sigtype, &efi_guid_sha512) != 0)) { + dbsize -= CertList->SignatureListSize; + CertList = (EFI_SIGNATURE_LIST *)((uint8_t *) CertList + + CertList->SignatureListSize); + continue; + } + +- if ((efi_guid_cmp (&CertList->SignatureType, &efi_guid_x509_cert) != 0) && +- (CertList->SignatureSize != signature_size (&CertList->SignatureType))) { ++ if ((efi_guid_cmp (&sigtype, &efi_guid_x509_cert) != 0) && ++ (CertList->SignatureSize != signature_size (&sigtype))) { + dbsize -= CertList->SignatureListSize; + CertList = (EFI_SIGNATURE_LIST *)((uint8_t *) CertList + + CertList->SignatureListSize); +@@ -312,7 +314,7 @@ build_mok_list (void *data, unsigned long data_size, uint32_t *mok_num) + } + + list[count].header = CertList; +- if (efi_guid_cmp (&CertList->SignatureType, &efi_guid_x509_cert) == 0) { ++ if (efi_guid_cmp (&sigtype, &efi_guid_x509_cert) == 0) { + /* X509 certificate */ + list[count].mok_size = CertList->SignatureSize - + sizeof(efi_guid_t); +@@ -442,10 +444,11 @@ list_keys (uint8_t *data, size_t data_size) + + for (unsigned int i = 0; i < mok_num; i++) { + printf ("[key %d]\n", i+1); +- if (efi_guid_cmp (&list[i].header->SignatureType, &efi_guid_x509_cert) == 0) { ++ efi_guid_t sigtype = list[i].header->SignatureType; ++ if (efi_guid_cmp (&sigtype, &efi_guid_x509_cert) == 0) { + print_x509 ((char *)list[i].mok, list[i].mok_size); + } else { +- print_hash_array (&list[i].header->SignatureType, ++ print_hash_array (&sigtype, + list[i].mok, list[i].mok_size); + } + if (i < mok_num - 1) +@@ -523,7 +526,8 @@ delete_data_from_list (const efi_guid_t *var_guid, const char *var_name, + remain = total; + for (unsigned int i = 0; i < mok_num; i++) { + remain -= list[i].header->SignatureListSize; +- if (efi_guid_cmp (&list[i].header->SignatureType, type) != 0) ++ efi_guid_t sigtype = list[i].header->SignatureType; ++ if (efi_guid_cmp (&sigtype, type) != 0) + continue; + + sig_list_size = list[i].header->SignatureListSize; +@@ -1057,7 +1061,8 @@ is_duplicate (const efi_guid_t *type, const void *data, const uint32_t data_size + } + + for (unsigned int i = 0; i < node_num; i++) { +- if (efi_guid_cmp (&list[i].header->SignatureType, type) != 0) ++ efi_guid_t sigtype = list[i].header->SignatureType; ++ if (efi_guid_cmp (&sigtype, type) != 0) + continue; + + if (efi_guid_cmp (type, &efi_guid_x509_cert) == 0) { +@@ -1510,8 +1515,8 @@ issue_hash_request (const char *hash_str, MokRequest req, + goto error; + /* Check if there is a signature list with the same type */ + for (unsigned int i = 0; i < mok_num; i++) { +- if (efi_guid_cmp (&mok_list[i].header->SignatureType, +- &hash_type) == 0) { ++ efi_guid_t sigtype = mok_list[i].header->SignatureType; ++ if (efi_guid_cmp (&sigtype, &hash_type) == 0) { + merge_ind = i; + list_size -= sizeof(EFI_SIGNATURE_LIST); + break; +@@ -1678,8 +1683,9 @@ export_db_keys (const DBName db_name) + for (unsigned i = 0; i < mok_num; i++) { + off_t offset = 0; + ssize_t write_size; ++ efi_guid_t sigtype = list[i].header->SignatureType; + +- if (efi_guid_cmp (&list[i].header->SignatureType, &efi_guid_x509_cert) != 0) ++ if (efi_guid_cmp (&sigtype, &efi_guid_x509_cert) != 0) + continue; + + /* Dump X509 certificate to files */ +-- +2.21.0 + diff --git a/mokutil.spec b/mokutil.spec index 7b2c384..0857422 100644 --- a/mokutil.spec +++ b/mokutil.spec @@ -1,6 +1,6 @@ Name: mokutil Version: 0.3.0 -Release: 13%{?dist} +Release: 14%{?dist} Epoch: 1 Summary: Tool to manage UEFI Secure Boot MoK Keys License: GPLv3+ @@ -20,6 +20,8 @@ Patch0004: 0004-Don-t-allow-sha1-on-the-mokutil-command-line.patch Patch0005: 0005-Make-all-efi_guid_t-const.patch Patch0006: 0006-mokutil-be-explicit-about-file-modes-in-all-cases.patch Patch0007: 0007-Add-bash-completion-file.patch +Patch0008: 0008-generate_hash-generate_pw_hash-don-t-use-strlen-for-.patch +Patch0009: 0009-Avoid-taking-pointer-to-packed-struct.patch %description mokutil provides a tool to manage keys for Secure Boot through the MoK @@ -54,6 +56,9 @@ make PREFIX=%{_prefix} LIBDIR=%{_libdir} DESTDIR=%{buildroot} install %{_datadir}/bash-completion/completions/mokutil %changelog +* Thu Oct 24 2019 Leigh Scott - 1:0.3.0-14 +- Apply upstream commits to fix FTBFS + * Thu Jul 25 2019 Fedora Release Engineering - 1:0.3.0-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild