rpms
/
p11-kit
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

base: rpms:imports/c8-beta/p11-kit-0.23.14-5.el8_0
Branches Tags
rpms:c8
rpms:c9
rpms:c9-beta
rpms:c8-beta
rpms:c9s
rpms:c8s
rpms:imports/c9/p11-kit-0.25.3-2.el9
rpms:imports/c9/p11-kit-0.24.1-2.el9
rpms:imports/c9-beta/p11-kit-0.24.1-2.el9
rpms:imports/c9-beta/p11-kit-0.24.0-4.el9
rpms:imports/c8-beta/p11-kit-0.23.22-1.el8
rpms:imports/c8-beta/p11-kit-0.23.14-5.el8_0
rpms:imports/c8s/p11-kit-0.23.22-1.el8
rpms:imports/c8s/p11-kit-0.23.21-4.el8
rpms:imports/c8s/p11-kit-0.23.21-3.el8
rpms:imports/c8/p11-kit-0.23.22-1.el8
rpms:imports/c8/p11-kit-0.23.14-5.el8_0
rpms:imports/c8/p11-kit-0.23.14-4.el8
...
compare: rpms:c8
Branches Tags
rpms:c9
rpms:c9-beta
rpms:c8-beta
rpms:c9s
rpms:c8s
rpms:c8
rpms:imports/c9/p11-kit-0.25.3-2.el9
rpms:imports/c9/p11-kit-0.24.1-2.el9
rpms:imports/c9-beta/p11-kit-0.24.1-2.el9
rpms:imports/c9-beta/p11-kit-0.24.0-4.el9
rpms:imports/c8-beta/p11-kit-0.23.22-1.el8
rpms:imports/c8-beta/p11-kit-0.23.14-5.el8_0
rpms:imports/c8s/p11-kit-0.23.22-1.el8
rpms:imports/c8s/p11-kit-0.23.21-4.el8
rpms:imports/c8s/p11-kit-0.23.21-3.el8
rpms:imports/c8/p11-kit-0.23.22-1.el8
rpms:imports/c8/p11-kit-0.23.14-5.el8_0
rpms:imports/c8/p11-kit-0.23.14-4.el8

No commits in common. "imports/c8-beta/p11-kit-0.23.14-5.el8_0" and "c8" have entirely different histories.
imports/c8 ... c8

8 changed files with 101 additions and 774 deletions
Show Stats Expand all files Collapse all files

3
.gitignore vendored
View File

@ -1 +1,2 @@
SOURCES/p11-kit-0.23.14.tar.gz
SOURCES/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
SOURCES/p11-kit-0.23.22.tar.xz

3
.p11-kit.metadata
View File

@ -1 +1,2 @@
30cab1d4b716022e6918f9a49976609c425f9cfc SOURCES/p11-kit-0.23.14.tar.gz
526f07b62624739ba318a171bab3352af91d0134 SOURCES/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
339e5163ed50a9984a74739b9207ea8cd77fa7e2 SOURCES/p11-kit-0.23.22.tar.xz

BIN
SOURCES/p11-kit-0.23.22.tar.xz.sig Normal file
View File

Binary file not shown.

623
SOURCES/p11-kit-coverity.patch
View File

@ -1,623 +0,0 @@
From 8a8db182af533a43b4d478d28af8623035475d68 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:05:10 +0200
Subject: [PATCH 01/10] debug: Work around cppcheck false-positives
https://trac.cppcheck.net/ticket/8794
---
common/debug.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/common/debug.h b/common/debug.h
index 255c62c..7ea36f3 100644
--- a/common/debug.h
+++ b/common/debug.h
@@ -71,13 +71,13 @@ void p11_debug_precond (const char *format,
#endif
#define return_val_if_fail(x, v) \
- do { if (!(x)) { \
+ do { if (x) { } else { \
p11_debug_precond ("p11-kit: '%s' not true at %s\n", #x, __func__); \
return v; \
} } while (false)
#define return_if_fail(x) \
- do { if (!(x)) { \
+ do { if (x) { } else { \
p11_debug_precond ("p11-kit: '%s' not true at %s\n", #x, __func__); \
return; \
} } while (false)
@@ -100,7 +100,7 @@ void p11_debug_precond (const char *format,
} while (false)
#define warn_if_fail(x) \
- do { if (!(x)) { \
+ do { if (x) { } else { \
p11_debug_precond ("p11-kit: '%s' not true at %s\n", #x, __func__); \
} } while (false)
--
2.17.2
From c76197ddbbd0c29adc2bceff2ee9f740f71d134d Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:06:56 +0200
Subject: [PATCH 02/10] build: Call va_end() always when leaving the function
---
common/attrs.c | 4 +++-
common/compat.c | 5 ++++-
common/path.c | 5 ++++-
trust/parser.c | 4 +++-
4 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/common/attrs.c b/common/attrs.c
index aa91891..a387a66 100644
--- a/common/attrs.c
+++ b/common/attrs.c
@@ -538,8 +538,10 @@ buffer_append_printf (p11_buffer *buffer,
va_list va;
va_start (va, format);
- if (vasprintf (&string, format, va) < 0)
+ if (vasprintf (&string, format, va) < 0) {
+ va_end (va);
return_if_reached ();
+ }
va_end (va);
p11_buffer_add (buffer, string, -1);
diff --git a/common/compat.c b/common/compat.c
index 5a9702d..48614fa 100644
--- a/common/compat.c
+++ b/common/compat.c
@@ -525,7 +525,10 @@ strconcat (const char *first,
for (arg = first; arg; arg = va_arg (va, const char*)) {
size_t old_length = length;
length += strlen (arg);
- return_val_if_fail (length >= old_length, NULL);
+ if (length < old_length) {
+ va_end (va);
+ return_val_if_reached (NULL);
+ }
}
va_end (va);
diff --git a/common/path.c b/common/path.c
index 5cf0e1a..17a6230 100644
--- a/common/path.c
+++ b/common/path.c
@@ -218,7 +218,10 @@ p11_path_build (const char *path,
while (path != NULL) {
size_t old_len = len;
len += strlen (path) + 1;
- return_val_if_fail (len >= old_len, NULL);
+ if (len < old_len) {
+ va_end (va);
+ return_val_if_reached (NULL);
+ }
path = va_arg (va, const char *);
}
va_end (va);
diff --git a/trust/parser.c b/trust/parser.c
index f92cdc9..e912c3a 100644
--- a/trust/parser.c
+++ b/trust/parser.c
@@ -697,8 +697,10 @@ p11_parser_formats (p11_parser *parser,
func = va_arg (va, parser_func);
if (func == NULL)
break;
- if (!p11_array_push (formats, func))
+ if (!p11_array_push (formats, func)) {
+ va_end (va);
return_if_reached ();
+ }
}
va_end (va);
--
2.17.2
From b10dadce5a3c921149b2c9fe0dec614f8076ebda Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:10:05 +0200
Subject: [PATCH 03/10] build: Free memory before return{,_val}_if_* macros
---
p11-kit/iter.c | 5 ++++-
p11-kit/proxy.c | 10 ++++++++--
trust/asn1.c | 15 ++++++++++++---
trust/builder.c | 5 ++++-
trust/index.c | 10 ++++++++--
trust/persist.c | 5 ++++-
trust/save.c | 29 +++++++++++++++++++++++++----
trust/session.c | 10 ++++++++--
trust/token.c | 5 ++++-
9 files changed, 77 insertions(+), 17 deletions(-)
diff --git a/p11-kit/iter.c b/p11-kit/iter.c
index 0e4ca6e..d1ffd91 100644
--- a/p11-kit/iter.c
+++ b/p11-kit/iter.c
@@ -157,7 +157,10 @@ p11_kit_iter_new (P11KitUri *uri,
return_val_if_fail (iter != NULL, NULL);
iter->modules = p11_array_new (NULL);
- return_val_if_fail (iter->modules != NULL, NULL);
+ if (iter->modules == NULL) {
+ p11_kit_iter_free (iter);
+ return_val_if_reached (NULL);
+ }
iter->want_writable = !!(behavior & P11_KIT_ITER_WANT_WRITABLE);
iter->preload_results = !(behavior & P11_KIT_ITER_BUSY_SESSIONS);
diff --git a/p11-kit/proxy.c b/p11-kit/proxy.c
index b7fb63d..abe7935 100644
--- a/p11-kit/proxy.c
+++ b/p11-kit/proxy.c
@@ -267,7 +267,10 @@ proxy_create (Proxy **res, CK_FUNCTION_LIST **loaded,
py->forkid = p11_forkid;
py->inited = modules_dup (loaded);
- return_val_if_fail (py->inited != NULL, CKR_HOST_MEMORY);
+ if (py->inited == NULL) {
+ proxy_free (py, 0);
+ return_val_if_reached (CKR_HOST_MEMORY);
+ }
rv = p11_kit_modules_initialize (py->inited, NULL);
@@ -320,7 +323,10 @@ proxy_create (Proxy **res, CK_FUNCTION_LIST **loaded,
}
py->sessions = p11_dict_new (p11_dict_ulongptr_hash, p11_dict_ulongptr_equal, NULL, free);
- return_val_if_fail (py->sessions != NULL, CKR_HOST_MEMORY);
+ if (py->sessions == NULL) {
+ proxy_free (py, 1);
+ return_val_if_reached (CKR_HOST_MEMORY);
+ }
py->refs = 1;
*res = py;
diff --git a/trust/asn1.c b/trust/asn1.c
index dd1812d..5ce682d 100644
--- a/trust/asn1.c
+++ b/trust/asn1.c
@@ -285,11 +285,17 @@ p11_asn1_cache_new (void)
return_val_if_fail (cache != NULL, NULL);
cache->defs = p11_asn1_defs_load ();
- return_val_if_fail (cache->defs != NULL, NULL);
+ if (cache->defs == NULL) {
+ p11_asn1_cache_free (cache);
+ return_val_if_reached (NULL);
+ }
cache->items = p11_dict_new (p11_dict_direct_hash, p11_dict_direct_equal,
NULL, free_asn1_item);
- return_val_if_fail (cache->items != NULL, NULL);
+ if (cache->items == NULL) {
+ p11_asn1_cache_free (cache);
+ return_val_if_reached (NULL);
+ }
return cache;
}
@@ -342,7 +348,10 @@ p11_asn1_cache_take (p11_asn1_cache *cache,
item->length = der_len;
item->node = node;
item->struct_name = strdup (struct_name);
- return_if_fail (item->struct_name != NULL);
+ if (item->struct_name == NULL) {
+ free_asn1_item (item);
+ return_if_reached ();
+ }
if (!p11_dict_set (cache->items, (void *)der, item))
return_if_reached ();
diff --git a/trust/builder.c b/trust/builder.c
index 742c544..d819dc8 100644
--- a/trust/builder.c
+++ b/trust/builder.c
@@ -187,7 +187,10 @@ p11_builder_new (int flags)
return_val_if_fail (builder != NULL, NULL);
builder->asn1_cache = p11_asn1_cache_new ();
- return_val_if_fail (builder->asn1_cache, NULL);
+ if (builder->asn1_cache == NULL) {
+ p11_builder_free (builder);
+ return_val_if_reached (NULL);
+ }
builder->asn1_defs = p11_asn1_cache_defs (builder->asn1_cache);
builder->flags = flags;
diff --git a/trust/index.c b/trust/index.c
index f4b6b4b..6a8e535 100644
--- a/trust/index.c
+++ b/trust/index.c
@@ -170,10 +170,16 @@ p11_index_new (p11_index_build_cb build,
index->objects = p11_dict_new (p11_dict_ulongptr_hash,
p11_dict_ulongptr_equal,
NULL, free_object);
- return_val_if_fail (index->objects != NULL, NULL);
+ if (index->objects == NULL) {
+ p11_index_free (index);
+ return_val_if_reached (NULL);
+ }
index->buckets = calloc (NUM_BUCKETS, sizeof (index_bucket));
- return_val_if_fail (index->buckets != NULL, NULL);
+ if (index->buckets == NULL) {
+ p11_index_free (index);
+ return_val_if_reached (NULL);
+ }
return index;
}
diff --git a/trust/persist.c b/trust/persist.c
index 887b316..569cea1 100644
--- a/trust/persist.c
+++ b/trust/persist.c
@@ -89,7 +89,10 @@ p11_persist_new (void)
return_val_if_fail (persist != NULL, NULL);
persist->constants = p11_constant_reverse (true);
- return_val_if_fail (persist->constants != NULL, NULL);
+ if (persist->constants == NULL) {
+ free (persist);
+ return_val_if_reached (NULL);
+ }
return persist;
}
diff --git a/trust/save.c b/trust/save.c
index abff864..8184e13 100644
--- a/trust/save.c
+++ b/trust/save.c
@@ -68,6 +68,8 @@ static char * make_unique_name (const char *bare,
const char *extension,
int (*check) (void *, char *),
void *data);
+static void filo_free (p11_save_file *file);
+static void dir_free (p11_save_dir *dir);
bool
p11_save_write_and_finish (p11_save_file *file,
@@ -114,9 +116,15 @@ p11_save_open_file (const char *path,
return_val_if_fail (file != NULL, NULL);
file->temp = temp;
file->bare = strdup (path);
- return_val_if_fail (file->bare != NULL, NULL);
+ if (file->bare == NULL) {
+ filo_free (file);
+ return_val_if_reached (NULL);
+ }
file->extension = strdup (extension);
- return_val_if_fail (file->extension != NULL, NULL);
+ if (file->extension == NULL) {
+ filo_free (file);
+ return_val_if_reached (NULL);
+ }
file->flags = flags;
file->fd = fd;
@@ -166,6 +174,13 @@ filo_free (p11_save_file *file)
free (file);
}
+static void
+dir_free (p11_save_dir *dir) {
+ p11_dict_free (dir->cache);
+ free (dir->path);
+ free (dir);
+}
+
#ifdef OS_UNIX
static int
@@ -349,10 +364,16 @@ p11_save_open_directory (const char *path,
return_val_if_fail (dir != NULL, NULL);
dir->path = strdup (path);
- return_val_if_fail (dir->path != NULL, NULL);
+ if (dir->path == NULL) {
+ dir_free (dir);
+ return_val_if_reached (NULL);
+ }
dir->cache = p11_dict_new (p11_dict_str_hash, p11_dict_str_equal, free, NULL);
- return_val_if_fail (dir->cache != NULL, NULL);
+ if (dir->cache == NULL) {
+ dir_free (dir);
+ return_val_if_reached (NULL);
+ }
dir->flags = flags;
return dir;
diff --git a/trust/session.c b/trust/session.c
index b93a5c3..d464394 100644
--- a/trust/session.c
+++ b/trust/session.c
@@ -59,12 +59,18 @@ p11_session_new (p11_token *token)
session->handle = p11_module_next_id ();
session->builder = p11_builder_new (P11_BUILDER_FLAG_NONE);
- return_val_if_fail (session->builder, NULL);
+ if (session->builder == NULL) {
+ p11_session_free (session);
+ return_val_if_reached (NULL);
+ }
session->index = p11_index_new (p11_builder_build, NULL, NULL,
p11_builder_changed,
session->builder);
- return_val_if_fail (session->index != NULL, NULL);
+ if (session->index == NULL) {
+ p11_session_free (session);
+ return_val_if_reached (NULL);
+ }
session->token = token;
diff --git a/trust/token.c b/trust/token.c
index 4cbcc77..fd3b043 100644
--- a/trust/token.c
+++ b/trust/token.c
@@ -829,7 +829,10 @@ p11_token_new (CK_SLOT_ID slot,
return_val_if_fail (token != NULL, NULL);
token->builder = p11_builder_new (P11_BUILDER_FLAG_TOKEN);
- return_val_if_fail (token->builder != NULL, NULL);
+ if (token->builder == NULL) {
+ p11_token_free (token);
+ return_val_if_reached (NULL);
+ }
token->index = p11_index_new (on_index_build,
on_index_store,
--
2.17.2
From 06323aed926ddc67bd18ed98e5af92035a8e3d39 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:14:46 +0200
Subject: [PATCH 04/10] build: Check return value of p11_dict_set
---
p11-kit/proxy.c | 3 ++-
p11-kit/rpc-server.c | 6 +++++-
trust/module.c | 3 ++-
3 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/p11-kit/proxy.c b/p11-kit/proxy.c
index abe7935..11e6165 100644
--- a/p11-kit/proxy.c
+++ b/p11-kit/proxy.c
@@ -612,7 +612,8 @@ proxy_C_OpenSession (CK_X_FUNCTION_LIST *self,
sess->wrap_slot = map.wrap_slot;
sess->real_session = *handle;
sess->wrap_session = ++state->last_handle; /* TODO: Handle wrapping, and then collisions */
- p11_dict_set (state->px->sessions, &sess->wrap_session, sess);
+ if (!p11_dict_set (state->px->sessions, &sess->wrap_session, sess))
+ warn_if_reached ();
*handle = sess->wrap_session;
}
diff --git a/p11-kit/rpc-server.c b/p11-kit/rpc-server.c
index 2db3524..3a8991d 100644
--- a/p11-kit/rpc-server.c
+++ b/p11-kit/rpc-server.c
@@ -2226,7 +2226,11 @@ p11_kit_remote_serve_tokens (const char **tokens,
p11_message_err (error, "couldn't subclass filter");
goto out;
}
- p11_dict_set (filters, module, filter);
+ if (!p11_dict_set (filters, module, filter)) {
+ error = EINVAL;
+ p11_message_err (error, "couldn't register filter");
+ goto out;
+ }
}
for (i = 0; i < n_tokens; i++) {
diff --git a/trust/module.c b/trust/module.c
index e09113b..24cda87 100644
--- a/trust/module.c
+++ b/trust/module.c
@@ -1321,7 +1321,8 @@ find_objects_match (CK_ATTRIBUTE *attrs,
}
value = memdup (oid->pValue, oid->ulValueLen);
return_val_if_fail (value != NULL, false);
- p11_dict_set (find->extensions, value, value);
+ if (!p11_dict_set (find->extensions, value, value))
+ warn_if_reached ();
}
}
--
2.17.2
From 213ea0815ef45411bf6c134918b79d2aad69c1dc Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:16:12 +0200
Subject: [PATCH 05/10] build: Check return value of p11_rpc_buffer_get_uint64
---
p11-kit/rpc-client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/p11-kit/rpc-client.c b/p11-kit/rpc-client.c
index 0dd4525..e202e37 100644
--- a/p11-kit/rpc-client.c
+++ b/p11-kit/rpc-client.c
@@ -371,7 +371,8 @@ proto_read_ulong_array (p11_rpc_message *msg, CK_ULONG_PTR arr,
/* We need to go ahead and read everything in all cases */
for (i = 0; i < num; ++i) {
- p11_rpc_buffer_get_uint64 (msg->input, &msg->parsed, &val);
+ if (!p11_rpc_buffer_get_uint64 (msg->input, &msg->parsed, &val))
+ return PARSE_ERROR;
if (arr)
arr[i] = (CK_ULONG)val;
}
--
2.17.2
From 1f78cb0b4dd193ec1f1b2b424a497a6c2edec043 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:16:51 +0200
Subject: [PATCH 06/10] rpc-server: p11_kit_remote_serve_tokens: Fix memleak
---
p11-kit/rpc-server.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/p11-kit/rpc-server.c b/p11-kit/rpc-server.c
index 3a8991d..5b3dbf0 100644
--- a/p11-kit/rpc-server.c
+++ b/p11-kit/rpc-server.c
@@ -2285,6 +2285,11 @@ p11_kit_remote_serve_tokens (const char **tokens,
p11_kit_modules_release (modules);
if (error != 0)
errno = error;
+ if (uris) {
+ for (i = 0; i < n_tokens; i++)
+ p11_kit_uri_free (uris[i]);
+ free (uris);
+ }
return ret;
}
--
2.17.2
From 033cd90806cb1e2eab7e799703757abc2f07052e Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:18:05 +0200
Subject: [PATCH 07/10] proxy: Fix null dereference when reusing slots
---
p11-kit/proxy.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/p11-kit/proxy.c b/p11-kit/proxy.c
index 11e6165..8eaf205 100644
--- a/p11-kit/proxy.c
+++ b/p11-kit/proxy.c
@@ -307,7 +307,10 @@ proxy_create (Proxy **res, CK_FUNCTION_LIST **loaded,
break;
}
py->mappings[py->n_mappings].funcs = funcs;
- py->mappings[py->n_mappings].wrap_slot = j == n_mappings ? py->n_mappings + MAPPING_OFFSET : mappings[j].wrap_slot;
+ py->mappings[py->n_mappings].wrap_slot =
+ (n_mappings == 0 || j == n_mappings) ?
+ py->n_mappings + MAPPING_OFFSET :
+ mappings[j].wrap_slot;
py->mappings[py->n_mappings].real_slot = slots[i];
++py->n_mappings;
}
--
2.17.2
From da73c2804b3ca962fa51473bb4c303a5ed32d4a1 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 16 Oct 2018 18:20:12 +0200
Subject: [PATCH 08/10] trust: Set umask before calling mkstemp
---
trust/save.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/trust/save.c b/trust/save.c
index 8184e13..bb77348 100644
--- a/trust/save.c
+++ b/trust/save.c
@@ -95,6 +95,7 @@ p11_save_open_file (const char *path,
{
p11_save_file *file;
char *temp;
+ mode_t mode;
int fd;
return_val_if_fail (path != NULL, NULL);
@@ -105,7 +106,9 @@ p11_save_open_file (const char *path,
if (asprintf (&temp, "%s%s.XXXXXX", path, extension) < 0)
return_val_if_reached (NULL);
+ mode = umask (0077);
fd = mkstemp (temp);
+ umask (mode);
if (fd < 0) {
p11_message_err (errno, "couldn't create file: %s%s", path, extension);
free (temp);
--
2.17.2
From 6417780ebbbbb0f01ddb001b239347655fb98578 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 17 Oct 2018 09:53:27 +0200
Subject: [PATCH 09/10] rpc-server: Check calloc failure
---
p11-kit/rpc-server.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/p11-kit/rpc-server.c b/p11-kit/rpc-server.c
index 5b3dbf0..3216742 100644
--- a/p11-kit/rpc-server.c
+++ b/p11-kit/rpc-server.c
@@ -2219,6 +2219,10 @@ p11_kit_remote_serve_tokens (const char **tokens,
filter = p11_dict_get (filters, module);
if (filter == NULL) {
lower = calloc (1, sizeof (p11_virtual));
+ if (lower == NULL) {
+ error = ENOMEM;
+ goto out;
+ }
p11_virtual_init (lower, &p11_virtual_base, module, NULL);
filter = p11_filter_subclass (lower, NULL);
if (filter == NULL) {
--
2.17.2
From 83e92c2f9575707083d8b0c70ef330e285d70836 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 17 Oct 2018 09:53:46 +0200
Subject: [PATCH 10/10] trust: Check index->buckets is allocated on cleanup
---
trust/index.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/trust/index.c b/trust/index.c
index 6a8e535..2d1da29 100644
--- a/trust/index.c
+++ b/trust/index.c
@@ -193,9 +193,11 @@ p11_index_free (p11_index *index)
p11_dict_free (index->objects);
p11_dict_free (index->changes);
- for (i = 0; i < NUM_BUCKETS; i++)
- free (index->buckets[i].elem);
- free (index->buckets);
+ if (index->buckets) {
+ for (i = 0; i < NUM_BUCKETS; i++)
+ free (index->buckets[i].elem);
+ free (index->buckets);
+ }
free (index);
}
--
2.17.2

42
SOURCES/p11-kit-dt-needed.patch Normal file
View File

@ -0,0 +1,42 @@
From a91266ef087532e2332c75c4fd9244df66f30b64 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <ueno@gnu.org>
Date: Fri, 18 Dec 2020 13:37:10 +0100
Subject: [PATCH] meson: Link trust/client modules explicitly to -ldl
This adds the -ldl link flag missing in the meson build, but present
in the autotools build. Although the use-case is unlikely, this
allows those modules to be linked as a normal shared library to a
program.
---
p11-kit/meson.build | 1 +
trust/meson.build | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/p11-kit/meson.build b/p11-kit/meson.build
index 7d57cd7..02147a9 100644
--- a/p11-kit/meson.build
+++ b/p11-kit/meson.build
@@ -92,6 +92,7 @@ if host_system != 'windows'
'client.c', 'client-init.c',
name_prefix: '',
include_directories: [configinc, commoninc],
+ dependencies: dlopen_deps,
link_args: p11_module_ldflags,
link_depends: [p11_module_symbol_map,
p11_module_symbol_def],
diff --git a/trust/meson.build b/trust/meson.build
index 482a3c1..d4a8e15 100644
--- a/trust/meson.build
+++ b/trust/meson.build
@@ -56,7 +56,7 @@ shared_module('p11-kit-trust',
'module-init.c',
name_prefix: '',
c_args: p11_kit_trust_c_args,
- dependencies: [asn_h_dep, libp11_library_dep] + libtasn1_deps,
+ dependencies: [asn_h_dep, libp11_library_dep] + dlopen_deps + libtasn1_deps,
link_args: p11_module_ldflags,
link_depends: [p11_module_symbol_map,
p11_module_symbol_def],
--
2.29.2

71
SOURCES/p11-kit-lower-libffi-priority.patch
View File

@ -1,71 +0,0 @@
From 6e1046de2233fba7875d3d6a1b260192678dd0ad Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Fri, 19 Oct 2018 10:21:36 +0200
Subject: [PATCH] virtual: Prefer fixed closures to libffi closures
On some circumstances (such as when loading p11-kit-proxy from httpd),
it is known that creation of libffi closure always fails, due to
SELinux policy. Although this is harmless, it pollutes the journal
and gives wrong hints when troubleshooting. This patch changes the
order of preference of libffi vs pre-compiled closures to avoid that.
---
p11-kit/virtual.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/p11-kit/virtual.c b/p11-kit/virtual.c
index 6abfe7a..338239f 100644
--- a/p11-kit/virtual.c
+++ b/p11-kit/virtual.c
@@ -2832,9 +2832,14 @@ p11_virtual_wrap (p11_virtual *virt,
p11_destroyer destroyer)
{
Wrapper *wrapper;
+ CK_FUNCTION_LIST *result;
return_val_if_fail (virt != NULL, NULL);
+ result = p11_virtual_wrap_fixed (virt, destroyer);
+ if (result)
+ return result;
+
wrapper = calloc (1, sizeof (Wrapper));
return_val_if_fail (wrapper != NULL, NULL);
@@ -2844,8 +2849,10 @@ p11_virtual_wrap (p11_virtual *virt,
wrapper->bound.version.minor = CRYPTOKI_VERSION_MINOR;
wrapper->fixed_index = -1;
- if (!init_wrapper_funcs (wrapper))
- return p11_virtual_wrap_fixed (virt, destroyer);
+ if (!init_wrapper_funcs (wrapper)) {
+ free (wrapper);
+ return_val_if_reached (NULL);
+ }
assert ((void *)wrapper == (void *)&wrapper->bound);
assert (p11_virtual_is_wrapper (&wrapper->bound));
@@ -2859,7 +2866,11 @@ CK_FUNCTION_LIST *
p11_virtual_wrap (p11_virtual *virt,
p11_destroyer destroyer)
{
- return p11_virtual_wrap_fixed (virt, destroyer);
+ CK_FUNCTION_LIST *result;
+
+ result = p11_virtual_wrap_fixed (virt, destroyer);
+ return_val_if_fail (result != NULL, NULL);
+ return result;
}
#endif /* !FFI_CLOSURES */
@@ -3068,8 +3079,6 @@ p11_virtual_wrap_fixed (p11_virtual *virt,
}
p11_mutex_unlock (&p11_virtual_mutex);
- return_val_if_fail (result != NULL, NULL);
-
return result;
}
--
2.17.2

49
SOURCES/p11-kit-unloading-fix.patch
View File

@ -1,49 +0,0 @@
From 4a925177a81c2566d2a81a0a450607a5ff4d9048 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Wed, 27 Feb 2019 12:25:20 +0100
Subject: [PATCH] modules: check gl.modules before iterates on it when freeing
In some circumstances, as described in the BZ, can happen that
free_modules_when_no_refs_unlocked() is called multiple times
when the module destructor is invoked.
We should check gl.modules before iterates on it in the
free_modules_when_no_refs_unlocked() functions, to avoid
a SIGSEGV.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1680963
---
p11-kit/modules.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/p11-kit/modules.c b/p11-kit/modules.c
index 0299eda..891ce4c 100644
--- a/p11-kit/modules.c
+++ b/p11-kit/modules.c
@@ -797,14 +797,16 @@ init_globals_unlocked (void)
static void
free_modules_when_no_refs_unlocked (void)
{
- Module *mod;
- p11_dictiter iter;
-
- /* Check if any modules have a ref count */
- p11_dict_iterate (gl.modules, &iter);
- while (p11_dict_next (&iter, (void **)&mod, NULL)) {
- if (mod->ref_count)
- return;
+ if (gl.modules) {
+ Module *mod;
+ p11_dictiter iter;
+
+ /* Check if any modules have a ref count */
+ p11_dict_iterate (gl.modules, &iter);
+ while (p11_dict_next (&iter, (void **)&mod, NULL)) {
+ if (mod->ref_count)
+ return;
+ }
}
p11_dict_free (gl.unmanaged_by_funcs);
--
2.20.1

84
SPECS/p11-kit.spec
View File

@ -1,26 +1,33 @@
# This spec file has been automatically updated
Version: 0.23.14
Release: 5%{?dist}
Version: 0.23.22
Release: 1%{?dist}
Name: p11-kit
Summary: Library for loading and sharing PKCS#11 modules
License: BSD
URL: http://p11-glue.freedesktop.org/p11-kit.html
Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz
Source1: trust-extract-compat
Source2: p11-kit-client.service
Patch1: p11-kit-coverity.patch
Patch2: p11-kit-lower-libffi-priority.patch
Patch3: p11-kit-unloading-fix.patch
Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.xz
Source1: https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.xz.sig
Source2: gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
Source3: trust-extract-compat
Source4: p11-kit-client.service
Patch1: p11-kit-dt-needed.patch
BuildRequires: gcc
BuildRequires: libtasn1-devel >= 2.3
BuildRequires: libtasn1-tools
BuildRequires: libffi-devel
BuildRequires: gettext
BuildRequires: gtk-doc
BuildRequires: systemd-devel
BuildRequires: meson
BuildRequires: systemd-devel
BuildRequires: bash-completion
# Work around for https://bugzilla.redhat.com/show_bug.cgi?id=1497147
# Remove this once it is fixed
BuildRequires: pkgconfig(glib-2.0)
BuildRequires: gnupg2
BuildRequires: /usr/bin/xsltproc
%description
p11-kit provides a way to load and enumerate PKCS#11 modules, as well
@ -38,11 +45,11 @@ developing applications that use %{name}.
%package trust
Summary: System trust module from %{name}
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires(post): %{_sbindir}/update-alternatives
Requires(postun): %{_sbindir}/update-alternatives
Conflicts: nss < 3.14.3-9
Summary: System trust module from %{name}
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires(post): %{_sbindir}/update-alternatives
Requires(postun): %{_sbindir}/update-alternatives
Conflicts: nss < 3.14.3-9
%description trust
The %{name}-trust package contains a system trust PKCS#11 module which
@ -69,37 +76,35 @@ feature is still experimental.
%prep
gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
%autosetup -p1
%build
# These paths are the source paths that come from the plan here:
# https://fedoraproject.org/wiki/Features/SharedSystemCertificates:SubTasks
%configure --disable-static --enable-doc --with-trust-paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source --disable-silent-rules
make %{?_smp_mflags} V=1
%meson -Dgtk_doc=true -Dman=true -Dtrust_paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source
%meson_build
%install
make install DESTDIR=$RPM_BUILD_ROOT
%meson_install
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/modules
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
rm -f $RPM_BUILD_ROOT%{_libdir}/pkcs11/*.la
install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/
install -p -m 755 %{SOURCE3} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/
# Install the example conf with %%doc instead
rm $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/pkcs11.conf.example
mkdir -p $RPM_BUILD_ROOT%{_docdir}/%{name}
mv $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/pkcs11.conf.example $RPM_BUILD_ROOT%{_docdir}/%{name}/pkcs11.conf.example
mkdir -p $RPM_BUILD_ROOT%{_userunitdir}
install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_userunitdir}
install -p -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_userunitdir}
%find_lang %{name}
%check
make check
%meson_test
%post -p /sbin/ldconfig
%post trust
%{_sbindir}/update-alternatives --install %{_libdir}/libnssckbi.so \
%{alt_ckbi} %{_libdir}/pkcs11/p11-kit-trust.so 30
%postun -p /sbin/ldconfig
%postun trust
if [ $1 -eq 0 ] ; then
# package removal
@ -107,11 +112,11 @@ if [ $1 -eq 0 ] ; then
fi
%files
%files -f %{name}.lang
%{!?_licensedir:%global license %%doc}
%license COPYING
%doc AUTHORS NEWS README
%doc p11-kit/pkcs11.conf.example
%{_docdir}/%{name}/pkcs11.conf.example
%dir %{_sysconfdir}/pkcs11
%dir %{_sysconfdir}/pkcs11/modules
%dir %{_datadir}/p11-kit
@ -124,6 +129,7 @@ fi
%{_mandir}/man1/trust.1.gz
%{_mandir}/man8/p11-kit.8.gz
%{_mandir}/man5/pkcs11.conf.5.gz
%{_datadir}/bash-completion/completions/p11-kit
%files devel
%{_includedir}/p11-kit-1/
@ -138,6 +144,7 @@ fi
%{_libdir}/pkcs11/p11-kit-trust.so
%{_datadir}/p11-kit/modules/p11-kit-trust.module
%{_libexecdir}/p11-kit/trust-extract-compat
%{_datadir}/bash-completion/completions/trust
%files server
%{_libdir}/pkcs11/p11-kit-client.so
@ -148,6 +155,25 @@ fi
%changelog
* Mon Jan 11 2021 Daiki Ueno <dueno@redhat.com> - 0.23.22-1
- Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
- Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
- Add xsltproc to BR
* Tue Nov 10 2020 Daiki Ueno <dueno@redhat.com> - 0.23.21-4
- Fix realloc usage on proxy cleanup (#1894979)
- Make 'trust anchor --store' preserve all attributes from .p11-kit files
* Tue Nov 3 2020 Daiki Ueno <dueno@redhat.com> - 0.23.21-3
- Restore clobbered changelog entry
* Mon Nov 2 2020 Daiki Ueno <dueno@redhat.com> - 0.23.21-2
- Update p11-kit-invalid-config.patch to be more thorough (thanks to
Alexander Sosedkin)
* Tue Oct 20 2020 Daiki Ueno <dueno@redhat.com> - 0.23.21-1
- Update to upstream 0.23.21 release
* Fri Mar 29 2019 Daiki Ueno <dueno@redhat.com> - 0.23.14-5
- Fix crash on unloading the library, when it is both linked and dlopen'ed