packages/ruby
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix CVE-2024-27280 and CVE-2024-27281

Browse Source 
(cherry picked from commit 652039bcc49ab28135864064961d308f9f8a7e63)
This commit is contained in:
shixuantong 2024-03-26 19:57:41 +08:00 committed by openeuler-sync-bot
parent 8f8bef3d11
commit 9a876937dd
5 changed files with 285 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
backport-0001-CVE-2024-27281.patch Normal file
View File

@ -0,0 +1,97 @@
From 32ff6ba0bebd8ea26f569da5fd23be2937f6a644 Mon Sep 17 00:00:00 2001
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
Date: Tue, 20 Feb 2024 17:30:25 +0900
Subject: [PATCH] Filter marshaled objects
Reference:https://github.com/ruby/rdoc/commit/32ff6ba0bebd8ea26f569da5fd23be2937f6a644
Conflict:NA
---
lib/rdoc/store.rb | 45 ++++++++++++++++++++++++++-------------------
1 file changed, 26 insertions(+), 19 deletions(-)
diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb
index 5ba671c..5b663d7 100644
--- a/lib/rdoc/store.rb
+++ b/lib/rdoc/store.rb
@@ -556,9 +556,7 @@ class RDoc::Store
def load_cache
#orig_enc = @encoding
- File.open cache_path, 'rb' do |io|
- @cache = Marshal.load io.read
- end
+ @cache = marshal_load(cache_path)
load_enc = @cache[:encoding]
@@ -615,9 +613,7 @@ class RDoc::Store
def load_class_data klass_name
file = class_file klass_name
- File.open file, 'rb' do |io|
- Marshal.load io.read
- end
+ marshal_load(file)
rescue Errno::ENOENT => e
error = MissingFileError.new(self, file, klass_name)
error.set_backtrace e.backtrace
@@ -630,14 +626,10 @@ class RDoc::Store
def load_method klass_name, method_name
file = method_file klass_name, method_name
- File.open file, 'rb' do |io|
- obj = Marshal.load io.read
- obj.store = self
- obj.parent =
- find_class_or_module(klass_name) || load_class(klass_name) unless
- obj.parent
- obj
- end
+ obj = marshal_load(file)
+ obj.store = self
+ obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name)
+ obj
rescue Errno::ENOENT => e
error = MissingFileError.new(self, file, klass_name + method_name)
error.set_backtrace e.backtrace
@@ -650,11 +642,9 @@ class RDoc::Store
def load_page page_name
file = page_file page_name
- File.open file, 'rb' do |io|
- obj = Marshal.load io.read
- obj.store = self
- obj
- end
+ obj = marshal_load(file)
+ obj.store = self
+ obj
rescue Errno::ENOENT => e
error = MissingFileError.new(self, file, page_name)
error.set_backtrace e.backtrace
@@ -976,4 +966,21 @@ class RDoc::Store
@unique_modules
end
+ private
+ def marshal_load(file)
+ File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)}
+ end
+
+ MarshalFilter = proc do |obj|
+ case obj
+ when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text
+ else
+ unless obj.class.name.start_with("RDoc::")
+ raise TypeError, "not permitted class: #{obj.class.name}"
+ end
+ end
+ obj
+ end
+ private_constant :MarshalFilter
+
end
--
2.33.0

66
backport-0002-CVE-2024-27281.patch Normal file
View File

@ -0,0 +1,66 @@
From 60a6d74ebdbb7d585e379526e5639932fdca2904 Mon Sep 17 00:00:00 2001
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
Date: Tue, 20 Feb 2024 17:59:57 +0900
Subject: [PATCH] Use safe_load and safe_load_file for .rdoc_options
Reference:https://github.com/ruby/rdoc/commit/60a6d74ebdbb7d585e379526e5639932fdca2904
Conflict:NA
---
lib/rdoc/rdoc.rb | 5 +++--
test/rdoc/test_rdoc_options.rb | 6 +++---
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb
index 826451e..4da281b 100644
--- a/lib/rdoc/rdoc.rb
+++ b/lib/rdoc/rdoc.rb
@@ -162,11 +162,12 @@ class RDoc::RDoc
RDoc.load_yaml
begin
- options = YAML.load_file '.rdoc_options'
+ options = YAML.safe_load_file '.rdoc_options', permitted_classes: [RDoc::Options, Symbol]
rescue Psych::SyntaxError
+ raise RDoc::Error, "#{options_file} is not a valid rdoc options file"
end
- return RDoc::Options.new if options == false # Allow empty file.
+ return RDoc::Options.new unless options # Allow empty file.
raise RDoc::Error, "#{options_file} is not a valid rdoc options file" unless
RDoc::Options === options or Hash === options
diff --git a/test/rdoc/test_rdoc_options.rb b/test/rdoc/test_rdoc_options.rb
index 8adeced..c28f64c 100644
--- a/test/rdoc/test_rdoc_options.rb
+++ b/test/rdoc/test_rdoc_options.rb
@@ -145,7 +145,7 @@ class TestRDocOptions < RDoc::TestCase
@options.encoding = Encoding::IBM437
- options = YAML.load YAML.dump @options
+ options = YAML.safe_load(YAML.dump(@options), permitted_classes: [RDoc::Options, Symbol])
assert_equal Encoding::IBM437, options.encoding
end
@@ -161,7 +161,7 @@ rdoc_include:
- /etc
YAML
- options = YAML.load yaml
+ options = YAML.safe_load(yaml, permitted_classes: [RDoc::Options, Symbol])
assert_empty options.rdoc_include
assert_empty options.static_path
@@ -764,7 +764,7 @@ rdoc_include:
assert File.exist? '.rdoc_options'
- assert_equal @options, YAML.load(File.read('.rdoc_options'))
+ assert_equal @options, YAML.safe_load(File.read('.rdoc_options'), permitted_classes: [RDoc::Options, Symbol])
end
end
--
2.33.0

28
backport-0003-CVE-2024-27281.patch Normal file
View File

@ -0,0 +1,28 @@
From a5de13bf0f0c26f8e764e82b5bf4bf8bffc7198e Mon Sep 17 00:00:00 2001
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
Date: Thu, 21 Mar 2024 13:18:13 +0900
Subject: [PATCH] Fix NoMethodError for start_with
Reference:https://github.com/ruby/rdoc/commit/a5de13bf0f0c26f8e764e82b5bf4bf8bffc7198e
Conflict:NA
---
lib/rdoc/store.rb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb
index 5b663d7..c793e49 100644
--- a/lib/rdoc/store.rb
+++ b/lib/rdoc/store.rb
@@ -975,7 +975,7 @@ class RDoc::Store
case obj
when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text
else
- unless obj.class.name.start_with("RDoc::")
+ unless obj.class.name.start_with?("RDoc::")
raise TypeError, "not permitted class: #{obj.class.name}"
end
end
--
2.33.0

86
backport-CVE-2024-27280.patch Normal file
View File

@ -0,0 +1,86 @@
From a35268a3ac1b5f0058e5b7c1a041a7e86d9da067 Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@ruby-lang.org>
Date: Tue, 16 Nov 2021 17:39:32 +0900
Subject: [PATCH] Fix expanding size at ungetc/ungetbyte
Reference:https://github.com/ruby/stringio/commit/a35268a3ac1b5f0058e5b7c1a041a7e86d9da067
Conflict:NA
---
ext/stringio/stringio.c | 2 +-
test/stringio/test_stringio.rb | 25 +++++++++++++++++++++----
2 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/ext/stringio/stringio.c b/ext/stringio/stringio.c
index 8df07e8..d1e0473 100644
--- a/ext/stringio/stringio.c
+++ b/ext/stringio/stringio.c
@@ -984,7 +984,7 @@ strio_unget_bytes(struct StringIO *ptr, const char *cp, long cl)
len = RSTRING_LEN(str);
rest = pos - len;
if (cl > pos) {
- long ex = (rest < 0 ? cl-pos : cl+rest);
+ long ex = cl - (rest < 0 ? pos : len);
rb_str_modify_expand(str, ex);
rb_str_set_len(str, len + ex);
s = RSTRING_PTR(str);
diff --git a/test/stringio/test_stringio.rb b/test/stringio/test_stringio.rb
index e0b4504..144a9f4 100644
--- a/test/stringio/test_stringio.rb
+++ b/test/stringio/test_stringio.rb
@@ -757,6 +757,15 @@ class TestStringIO < Test::Unit::TestCase
assert_equal("b""\0""a", s.string)
end
+ def test_ungetc_fill
+ count = 100
+ s = StringIO.new
+ s.print 'a' * count
+ s.ungetc('b' * (count * 5))
+ assert_equal((count * 5), s.string.size)
+ assert_match(/\Ab+\z/, s.string)
+ end
+
def test_ungetbyte_pos
b = '\\b00010001 \\B00010001 \\b1 \\B1 \\b000100011'
s = StringIO.new( b )
@@ -782,6 +791,15 @@ class TestStringIO < Test::Unit::TestCase
assert_equal("b""\0""a", s.string)
end
+ def test_ungetbyte_fill
+ count = 100
+ s = StringIO.new
+ s.print 'a' * count
+ s.ungetbyte('b' * (count * 5))
+ assert_equal((count * 5), s.string.size)
+ assert_match(/\Ab+\z/, s.string)
+ end
+
def test_frozen
s = StringIO.new
s.freeze
@@ -825,18 +843,17 @@ class TestStringIO < Test::Unit::TestCase
end
def test_overflow
- omit if RbConfig::SIZEOF["void*"] > RbConfig::SIZEOF["long"]
+ return if RbConfig::SIZEOF["void*"] > RbConfig::SIZEOF["long"]
limit = RbConfig::LIMITS["INTPTR_MAX"] - 0x10
assert_separately(%w[-rstringio], "#{<<-"begin;"}\n#{<<-"end;"}")
begin;
limit = #{limit}
ary = []
- while true
+ begin
x = "a"*0x100000
break if [x].pack("p").unpack("i!")[0] < 0
ary << x
- omit if ary.size > 100
- end
+ end while ary.size <= 100
s = StringIO.new(x)
s.gets("xxx", limit)
assert_equal(0x100000, s.pos)
--
2.27.0

9
ruby.spec
View File

@ -33,7 +33,7 @@
Name: ruby Name: ruby
Version: %{ruby_version} Version: %{ruby_version}
Release: 131 Release: 132
Summary: Object-oriented scripting language interpreter Summary: Object-oriented scripting language interpreter
License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD
URL: https://www.ruby-lang.org/en/ URL: https://www.ruby-lang.org/en/
@ -188,6 +188,10 @@ Patch6016: backport-0001-CVE-2023-28756.patch
Patch6017: backport-0002-CVE-2023-28756.patch Patch6017: backport-0002-CVE-2023-28756.patch
Patch6018: backport-0003-CVE-2023-28756.patch Patch6018: backport-0003-CVE-2023-28756.patch
Patch6019: backport-CVE-2023-36617.patch Patch6019: backport-CVE-2023-36617.patch
Patch6020: backport-CVE-2024-27280.patch
Patch6021: backport-0001-CVE-2024-27281.patch
Patch6022: backport-0002-CVE-2024-27281.patch
Patch6023: backport-0003-CVE-2024-27281.patch
Provides: %{name}-libs = %{version}-%{release} Provides: %{name}-libs = %{version}-%{release}
Obsoletes: %{name}-libs < %{version}-%{release} Obsoletes: %{name}-libs < %{version}-%{release}
@ -1186,6 +1190,9 @@ make runruby TESTRUN_SCRIPT=%{SOURCE13}
%doc %{gem_dir}/gems/typeprof-%{typeprof_version}/testbed %doc %{gem_dir}/gems/typeprof-%{typeprof_version}/testbed
%changelog %changelog
* Tue Mar 26 2024 shixuantong <shixuantong1@huawei.com> - 3.0.3-132
- fix CVE-2024-27280 and CVE-2024-27281
* Sat Jul 08 2023 shixuantong <shixuantong1@huawei.com> - 3.0.3-131 * Sat Jul 08 2023 shixuantong <shixuantong1@huawei.com> - 3.0.3-131
- fix CVE-2023-36617 - fix CVE-2023-36617