diff --git a/internal/rosa/package/hakurei/package.az b/internal/rosa/package/hakurei.az similarity index 90% rename from internal/rosa/package/hakurei/package.az rename to internal/rosa/package/hakurei.az index a918a872..229af5fc 100644 --- a/internal/rosa/package/hakurei/package.az +++ b/internal/rosa/package/hakurei.az @@ -27,16 +27,9 @@ package hakurei { "CC=clang -O3 -Werror", ]; - files = { - "hostname/main.go": "hostname"; - }; - exec = generic { chdir = false; build = ` -echo 'Building test helper (hostname).' -go build -o /bin/hostname /usr/src/hostname/main.go - mkdir -p /work/system/libexec/hakurei/ echo "Building hakurei for $(go env GOOS)/$(go env GOARCH)." @@ -72,6 +65,7 @@ mkdir -p /work/system/bin/ inputs = [ go, pkgconf, + net-tools, libseccomp, acl, @@ -98,16 +92,9 @@ package hakurei-dist { "CC=clang -O3 -Werror", ]; - files = { - "hostname/main.go": "hostname"; - }; - exec = generic { chdir = false; build = ` -echo 'Building test helper (hostname).' -go build -o /bin/hostname /usr/src/hostname/main.go - NAME=make`; check = ` NAME=all`; @@ -119,6 +106,7 @@ DESTDIR=/work "./${NAME}.sh" inputs = [ go, pkgconf, + net-tools, libseccomp, acl, diff --git a/internal/rosa/package/hakurei/hostname b/internal/rosa/package/hakurei/hostname deleted file mode 100644 index de72c9d1..00000000 --- a/internal/rosa/package/hakurei/hostname +++ /dev/null @@ -1,11 +0,0 @@ -package main - -import "os" - -func main() { - if name, err := os.Hostname(); err != nil { - panic(err) - } else { - os.Stdout.WriteString(name) - } -} diff --git a/internal/rosa/package/net-tools/CVE-2025-46836.patch b/internal/rosa/package/net-tools/CVE-2025-46836.patch new file mode 100644 index 00000000..dadff1ad --- /dev/null +++ b/internal/rosa/package/net-tools/CVE-2025-46836.patch @@ -0,0 +1,115 @@ +From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001 +From: Zephkeks +Date: Tue, 13 May 2025 11:04:17 +0200 +Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in + get_name() + +Coordinated as GHSA-pfwf-h6m3-63wf +--- + lib/interface.c | 63 ++++++++++++++++++++++++++++++------------------- + 1 file changed, 39 insertions(+), 24 deletions(-) + +diff --git a/lib/interface.c b/lib/interface.c +index 71d4163..a054f12 100644 +--- a/lib/interface.c ++++ b/lib/interface.c +@@ -211,32 +211,47 @@ static int if_readconf(void) + } + + static const char *get_name(char *name, const char *p) ++/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied ++ and the destination buffer is always NUL‑terminated. */ + { +- while (isspace(*p)) +- p++; +- while (*p) { +- if (isspace(*p)) +- break; +- if (*p == ':') { /* could be an alias */ +- const char *dot = p++; +- while (*p && isdigit(*p)) p++; +- if (*p == ':') { +- /* Yes it is, backup and copy it. */ +- p = dot; +- *name++ = *p++; +- while (*p && isdigit(*p)) { +- *name++ = *p++; +- } +- } else { +- /* No, it isn't */ +- p = dot; +- } +- p++; +- break; +- } +- *name++ = *p++; ++ char *dst = name; /* current write ptr */ ++ const char *end = name + IFNAMSIZ - 1; /* last byte we may write */ ++ ++ /* Skip leading white‑space. */ ++ while (isspace((unsigned char)*p)) ++ ++p; ++ ++ /* Copy until white‑space, end of string, or buffer full. */ ++ while (*p && !isspace((unsigned char)*p) && dst < end) { ++ if (*p == ':') { /* possible alias veth0:123: */ ++ const char *dot = p; /* remember the colon */ ++ ++p; ++ while (*p && isdigit((unsigned char)*p)) ++ ++p; ++ ++ if (*p == ':') { /* confirmed alias */ ++ p = dot; /* rewind and copy it all */ ++ ++ /* copy the colon */ ++ if (dst < end) ++ *dst++ = *p++; ++ ++ /* copy the digits */ ++ while (*p && isdigit((unsigned char)*p) && dst < end) ++ *dst++ = *p++; ++ ++ if (*p == ':') /* consume trailing colon */ ++ ++p; ++ } else { /* if so treat as normal */ ++ p = dot; ++ } ++ break; /* interface name ends here */ ++ } ++ ++ *dst++ = *p++; /* ordinary character copy */ + } +- *name++ = '\0'; ++ ++ *dst = '\0'; /* always NUL‑terminate */ + return p; + } + +From ddb0e375fb9ca95bb69335540b85bbdaa2714348 Mon Sep 17 00:00:00 2001 +From: Bernd Eckenfels +Date: Sat, 17 May 2025 21:53:23 +0200 +Subject: [PATCH] Interface statistic regression after 7a8f42fb2 + +--- + lib/interface.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/lib/interface.c b/lib/interface.c +index a054f12..ca4adf1 100644 +--- a/lib/interface.c ++++ b/lib/interface.c +@@ -239,12 +239,11 @@ static const char *get_name(char *name, const char *p) + /* copy the digits */ + while (*p && isdigit((unsigned char)*p) && dst < end) + *dst++ = *p++; +- +- if (*p == ':') /* consume trailing colon */ +- ++p; + } else { /* if so treat as normal */ + p = dot; + } ++ if (*p == ':') /* consume trailing colon */ ++ ++p; + break; /* interface name ends here */ + } + diff --git a/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch b/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch new file mode 100644 index 00000000..c000a826 --- /dev/null +++ b/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch @@ -0,0 +1,53 @@ +From a7926399a04ee8e629a02a2aeb6de1952d42d559 Mon Sep 17 00:00:00 2001 +From: Bernd Eckenfels +Date: Sat, 17 May 2025 21:11:07 +0200 +Subject: [PATCH] ipmaddr.c: Stack-based buffer Overflow in parse_hex() + +Coordinated as GHSA-h667-qrp8-gj58. +--- + ipmaddr.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/ipmaddr.c b/ipmaddr.c +index 64b7564..623fadd 100644 +--- a/ipmaddr.c ++++ b/ipmaddr.c +@@ -91,17 +91,17 @@ static int parse_lla(char *str, char *addr) + return len; + } + +-static int parse_hex(char *str, unsigned char *addr) ++static int parse_hex(char *str, unsigned char *dst, size_t dstlen) + { + int len=0; + +- while (*str) { ++ while (len < dstlen && *str) { + int tmp; + if (str[1] == 0) + return -1; + if (sscanf(str, "%02x", &tmp) != 1) + return -1; +- addr[len] = tmp; ++ dst[len] = tmp; + len++; + str += 2; + } +@@ -152,7 +152,7 @@ void read_dev_mcast(struct ma_info **result_p) + + m.addr.family = AF_PACKET; + +- len = parse_hex(hexa, (unsigned char*)&m.addr.data); ++ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data)); + if (len >= 0) { + struct ma_info *ma = xmalloc(sizeof(m)); + memcpy(ma, &m, sizeof(m)); +@@ -222,7 +222,7 @@ void read_igmp6(struct ma_info **result_p) + + m.addr.family = AF_INET6; + +- len = parse_hex(hexa, (unsigned char*)&m.addr.data); ++ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data)); + if (len >= 0) { + struct ma_info *ma = xmalloc(sizeof(m)); + memcpy(ma, &m, sizeof(m)); diff --git a/internal/rosa/package/net-tools/GHSA-w7jq-cmw2-cq59.patch b/internal/rosa/package/net-tools/GHSA-w7jq-cmw2-cq59.patch new file mode 100644 index 00000000..768814d5 --- /dev/null +++ b/internal/rosa/package/net-tools/GHSA-w7jq-cmw2-cq59.patch @@ -0,0 +1,71 @@ +From 84041080a5d4794045b098ced90e0309bcbcff44 Mon Sep 17 00:00:00 2001 +From: Zephkeks +Date: Sat, 17 May 2025 22:11:37 +0200 +Subject: [PATCH] proc.c: Stack-based Buffer Overflow in net-tools + (proc_gen_fmt) + +Coordinated as GHSA-w7jq-cmw2-cq59. +--- + lib/proc.c | 37 ++++++++++++++++++++++++++++++++++--- + 1 file changed, 34 insertions(+), 3 deletions(-) + +diff --git a/lib/proc.c b/lib/proc.c +index d51d09f..02aae49 100644 +--- a/lib/proc.c ++++ b/lib/proc.c +@@ -17,6 +17,8 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...) + char buf[512], format[512] = ""; + char *title, *head, *hdr; + va_list ap; ++ size_t format_len = 0; ++ size_t format_size = sizeof(format); + + if (!fgets(buf, (sizeof buf) - 1, fh)) + return NULL; +@@ -33,14 +35,43 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...) + *hdr++ = 0; + + if (!strcmp(title, head)) { +- strcat(format, va_arg(ap, char *)); ++ const char *arg = va_arg(ap, char *); ++ size_t arg_len = strlen(arg); ++ ++ /* Check if we have enough space for format specifier + space */ ++ if (format_len + arg_len + 1 >= format_size) { ++ fprintf(stderr, "warning: format buffer overflow in %s\n", name); ++ va_end(ap); ++ return NULL; ++ } ++ ++ strcpy(format + format_len, arg); ++ format_len += arg_len; ++ + title = va_arg(ap, char *); + if (!title) + break; + } else { +- strcat(format, "%*s"); /* XXX */ ++ /* Check if we have enough space for "%*s" */ ++ if (format_len + 3 >= format_size) { ++ fprintf(stderr, "warning: format buffer overflow in %s\n", name); ++ va_end(ap); ++ return NULL; ++ } ++ ++ strcpy(format + format_len, "%*s"); ++ format_len += 3; + } +- strcat(format, " "); ++ ++ /* Check if we have space for the trailing space */ ++ if (format_len + 1 >= format_size) { ++ fprintf(stderr, "warning: format buffer overflow in %s\n", name); ++ va_end(ap); ++ return NULL; ++ } ++ ++ format[format_len++] = ' '; ++ format[format_len] = '\0'; + } + va_end(ap); + diff --git a/internal/rosa/package/net-tools/f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch b/internal/rosa/package/net-tools/f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch new file mode 100644 index 00000000..6ba420f3 --- /dev/null +++ b/internal/rosa/package/net-tools/f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch @@ -0,0 +1,22 @@ +From f84cd22a921c25c56a6c194d4825dbd9ceea0e5f Mon Sep 17 00:00:00 2001 +From: Bernd +Date: Sat, 22 Mar 2025 00:17:10 +0100 +Subject: [PATCH] Update proc.c; remove redundant null check (CodeQL #3) (#44) + +--- + lib/proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/proc.c b/lib/proc.c +index ce85fd1..d51d09f 100644 +--- a/lib/proc.c ++++ b/lib/proc.c +@@ -35,7 +35,7 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...) + if (!strcmp(title, head)) { + strcat(format, va_arg(ap, char *)); + title = va_arg(ap, char *); +- if (!title || !head) ++ if (!title) + break; + } else { + strcat(format, "%*s"); /* XXX */ diff --git a/internal/rosa/package/net-tools/package.az b/internal/rosa/package/net-tools/package.az new file mode 100644 index 00000000..62a50289 --- /dev/null +++ b/internal/rosa/package/net-tools/package.az @@ -0,0 +1,33 @@ +package net-tools { + description = "the collection of base networking utilities for Linux"; + anitya = 10231; + + version# = "2.10"; + source = remoteTar { + url = "https://downloads.sourceforge.net/project/net-tools/"+ + "net-tools-"+version+".tar.xz"; + compress = xz; + checksum = "YLmSUeHOYnhYhjvnisX6MQNkPJRzOIgSZBHRiWmBdzzziWYJVY6hOpM8eWnAZ11N"; + }; + patches = [ + "CVE-2025-46836.patch", + "GHSA-h667-qrp8-gj58.patch", + "f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch", + "GHSA-w7jq-cmw2-cq59.patch", + ]; + + enterSource = true; + writable = true; + + exec = make { + chdir = false; + configureName = "(set +o pipefail && yes '' | make config)"; + check = nil; + }; + + inputs = [ + bash, + + kernel-headers, + ]; +}