diff --git a/backport-CVE-2019-20352.patch b/backport-CVE-2019-20352.patch deleted file mode 100644 index d7e89c0851f398daf2acdefd407e95a963c07bac..0000000000000000000000000000000000000000 --- a/backport-CVE-2019-20352.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 7c88289e222dc5ef9f53f9e86ecaab1924744b88 Mon Sep 17 00:00:00 2001 -From: Cyrill Gorcunov -Date: Tue, 18 Aug 2020 11:25:14 +0300 -Subject: [PATCH] BR3392711: preproc: fix memory corruption in - expand_one_smacro - -https://github.com/netwide-assembler/nasm/commit/7c88289e222dc5ef9f53f9e86ecaab1924744b88 - -The mempcpy helper returns *last* byte pointer thus when -we call set_text_free we have to pass a pointer to the -start of the string. - -Signed-off-by: Cyrill Gorcunov ---- - asm/preproc.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/asm/preproc.c b/asm/preproc.c -index fec9520..1368cee 100644 ---- a/asm/preproc.c -+++ b/asm/preproc.c -@@ -5531,7 +5531,7 @@ static SMacro *expand_one_smacro(Token ***tpp) - { - size_t mlen = strlen(m->name); - size_t len; -- char *p; -+ char *p, *from; - - t->type = mstart->type; - if (t->type == TOK_LOCAL_MACRO) { -@@ -5544,15 +5544,15 @@ static SMacro *expand_one_smacro(Token ***tpp) - plen = pep - psp; - - len = mlen + plen; -- p = nasm_malloc(len + 1); -+ from = p = nasm_malloc(len + 1); - p = mempcpy(p, psp, plen); - } else { - len = mlen; -- p = nasm_malloc(len + 1); -+ from = p = nasm_malloc(len + 1); - } - p = mempcpy(p, m->name, mlen); - *p = '\0'; -- set_text_free(t, p, len); -+ set_text_free(t, from, len); - - t->next = tline; - break; --- -2.23.0 - diff --git a/backport-CVE-2020-24241-1.patch b/backport-CVE-2020-24241-1.patch deleted file mode 100644 index c5d4290f1ae801ff994d343f4c484376c4c5ad9f..0000000000000000000000000000000000000000 --- a/backport-CVE-2020-24241-1.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 6ac6ac57e3d01ea8ed4ea47706eb724b59176461 Mon Sep 17 00:00:00 2001 -From: "H. Peter Anvin (Intel)" -Date: Thu, 30 Jul 2020 15:46:12 -0700 -Subject: [PATCH] parser: when flattening an eop, must preserve any data buffer - -https://github.com/netwide-assembler/nasm/commit/6ac6ac57e3d01ea8ed4ea47706eb724b59176461 - -An eop may have a data buffer associated with it as part of the same -memory allocation. Therefore, we need to move "subexpr" up instead of -merging it into "eop". - -This *partially* resolves BR 3392707, but that test case still -triggers a violation when using -gcv8. - -Reported-by: Suhwan -Signed-off-by: H. Peter Anvin (Intel) ---- - asm/parser.c | 16 +++++++++++----- - test/br3392707.asm | 21 +++++++++++++++++++++ - 2 files changed, 32 insertions(+), 5 deletions(-) - create mode 100644 test/br3392707.asm - -diff --git a/asm/parser.c b/asm/parser.c -index dbd2240c..584e40c9 100644 ---- a/asm/parser.c -+++ b/asm/parser.c -@@ -458,11 +458,17 @@ static int parse_eops(extop **result, bool critical, int elem) - /* Subexpression is empty */ - eop->type = EOT_NOTHING; - } else if (!subexpr->next) { -- /* Subexpression is a single element, flatten */ -- eop->val = subexpr->val; -- eop->type = subexpr->type; -- eop->dup *= subexpr->dup; -- nasm_free(subexpr); -+ /* -+ * Subexpression is a single element, flatten. -+ * Note that if subexpr has an allocated buffer associated -+ * with it, freeing it would free the buffer, too, so -+ * we need to move subexpr up, not eop down. -+ */ -+ if (!subexpr->elem) -+ subexpr->elem = eop->elem; -+ subexpr->dup *= eop->dup; -+ nasm_free(eop); -+ eop = subexpr; - } else { - eop->type = EOT_EXTOP; - } -diff --git a/test/br3392707.asm b/test/br3392707.asm -new file mode 100644 -index 00000000..6e84c5b4 ---- /dev/null -+++ b/test/br3392707.asm -@@ -0,0 +1,21 @@ -+ bits 32 -+ -+ db 33 -+ db (44) -+; db (44,55) -- error -+ db %(44.55) -+ db %('XX','YY') -+ db ('AA') -+ db %('BB') -+ db ? -+ db 6 dup (33) -+ db 6 dup (33, 34) -+ db 6 dup (33, 34), 35 -+ db 7 dup (99) -+ db 7 dup (?,?) -+ dw byte (?,44) -+ -+ dw 0xcc, 4 dup byte ('PQR'), ?, 0xabcd -+ -+ dd 16 dup (0xaaaa, ?, 0xbbbbbb) -+ dd 64 dup (?) diff --git a/backport-CVE-2020-24241-2.patch b/backport-CVE-2020-24241-2.patch deleted file mode 100644 index 3886794e1adcd8ed0af754dfb5db4452f622e0c7..0000000000000000000000000000000000000000 --- a/backport-CVE-2020-24241-2.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 78df8828a0a5d8e2d8ff3dced562bf1778ce2e6c Mon Sep 17 00:00:00 2001 -From: "H. Peter Anvin (Intel)" -Date: Thu, 30 Jul 2020 17:06:24 -0700 -Subject: [PATCH] output/codeview.c: use list_for_each_safe() to free a list - -https://github.com/netwide-assembler/nasm/commit/78df8828a0a5d8e2d8ff3dced562bf1778ce2e6c - -Using list_for_each() is by definition not safe when freeing the -members of the list, use list_for_each_free() instead. - -Also, use nasm_new() and nasm_free() where appropriate. - -This was discovered as a downstream bug from BR 3392707. - -Signed-off-by: H. Peter Anvin (Intel) ---- - output/codeview.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -diff --git a/output/codeview.c b/output/codeview.c -index be3fd27a..8276a4f3 100644 ---- a/output/codeview.c -+++ b/output/codeview.c -@@ -305,7 +305,7 @@ static void build_type_table(struct coff_Section *const sect); - static void cv8_cleanup(void) - { - struct cv8_symbol *sym; -- struct source_file *file; -+ struct source_file *file, *ftmp; - - struct coff_Section *symbol_sect = coff_sects[cv8_state.symbol_sect]; - struct coff_Section *type_sect = coff_sects[cv8_state.type_sect]; -@@ -316,10 +316,10 @@ static void cv8_cleanup(void) - build_symbol_table(symbol_sect); - build_type_table(type_sect); - -- list_for_each(file, cv8_state.source_files) { -+ list_for_each_safe(file, ftmp, cv8_state.source_files) { - nasm_free(file->fullname); - saa_free(file->lines); -- free(file); -+ nasm_free(file); - } - hash_free(&cv8_state.file_hash); - -@@ -398,8 +398,7 @@ static struct source_file *register_file(const char *filename) - - fullpath = nasm_realpath(filename); - -- file = nasm_zalloc(sizeof(*file)); -- -+ nasm_new(file); - file->filename = filename; - file->fullname = fullpath; - file->fullnamelen = strlen(fullpath); diff --git a/nasm-2.15.03-xdoc.tar.bz2 b/nasm-2.15.03-xdoc.tar.bz2 deleted file mode 100644 index 51b13c4e19448ac2b026a49e26523e3b90fa5393..0000000000000000000000000000000000000000 Binary files a/nasm-2.15.03-xdoc.tar.bz2 and /dev/null differ diff --git a/nasm-2.15.03.tar.bz2 b/nasm-2.15.03.tar.bz2 deleted file mode 100644 index 11c5867764fb6e0802e8eb089f28dc331134ea3a..0000000000000000000000000000000000000000 Binary files a/nasm-2.15.03.tar.bz2 and /dev/null differ diff --git a/nasm-2.15.05-xdoc.tar.bz2 b/nasm-2.15.05-xdoc.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..28b35a88460b54e683e4809aa2ededca2f791597 Binary files /dev/null and b/nasm-2.15.05-xdoc.tar.bz2 differ diff --git a/nasm-2.15.05.tar.bz2 b/nasm-2.15.05.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..b41bc46e4dc95aa9a1595b18bf1bd2ff52cb1d8d Binary files /dev/null and b/nasm-2.15.05.tar.bz2 differ diff --git a/nasm.spec b/nasm.spec index 59a0a1a2343045c469fddc7fac1f1ddb69093c21..583cfb80c003cb6cbabf227a44fa09a115f57bcf 100644 --- a/nasm.spec +++ b/nasm.spec @@ -7,22 +7,19 @@ %endif Name: nasm -Version: 2.15.03 -Release: 7 +Version: 2.15.05 +Release: 1 Summary: The Netwide Assembler, a portable x86 assembler with Intel-like syntax License: BSD URL: http://www.nasm.us Source0: http://www.nasm.us/pub/nasm/releasebuilds/%{version}/%{name}-%{version}.tar.bz2 Source1: http://www.nasm.us/pub/nasm/releasebuilds/%{version}/%{name}-%{version}-xdoc.tar.bz2 -Patch6000: backport-CVE-2019-20352.patch -Patch6001: backport-CVE-2020-24241-1.patch -Patch6002: backport-CVE-2020-24241-2.patch -Patch6003: enable-make-check.patch -Patch6004: fix-help-info-error.patch +Patch6000: enable-make-check.patch +Patch6001: fix-help-info-error.patch # https://github.com/netwide-assembler/nasm/commit/2d4e6952417ec6f08b6f135d2b5d0e19b7dae30d -Patch6005: CVE-2022-44370.patch -Patch6006: CVE-2020-21528.patch +Patch6002: CVE-2022-44370.patch +Patch6003: CVE-2020-21528.patch #https://bugzilla.nasm.us/attachment.cgi?id=411648 BuildRequires: perl(Env) autoconf asciidoc xmlto gcc make git @@ -96,6 +93,11 @@ make test %{_mandir}/man1/ld* %changelog +* Wed Jun 26 2024 yaoxin - 2.15.05-1 +- Update to 2.15.05 + * fix %ifid with $ and $$ + * Add --reproducible option to suppress NASM version numbers and timestamps in output files + * Wed Aug 23 2023 hongjinghao - 2.15.03-7 - Fix CVE-2020-21528