GNU logs - #48656, boring messages

Message sent to guix-patches@HIDDEN:

Subject: [bug#48656] [PATCH] gnu: lz4: Add a patch for CVE-2021-3520.
Resent-From: Solene Rapenne <solene@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: guix-patches@HIDDEN
Resent-Date: Tue, 25 May 2021 18:25:01 +0000
Resent-Message-ID: <handler.48656.B.162196706931998 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 48656 <at> debbugs.gnu.org
DomainKey-Signature: a=rsa-sha1; c=nofws; d=perso.pw; h=date:from:to
 :subject:message-id:mime-version:content-type
 :content-transfer-encoding; q=dns; s=1337; b=MjemXaWE8ffyWqt5Z+l
 stIomTsjmg7p3OdCwltXrYC/1V67Iq323KKnlm7QcVs5NJzp9k1lOooBvT59GMh6
 lJY4JQZlz9txlq6h12/zSQ4YPBa/hQH/nSJgodY3zx/jkaw75/AdMAxnV0/tjjjO
 APxt4xJd84uaIhwIkKsqMTuw=
Date: Tue, 25 May 2021 20:24:07 +0200
From: Solene Rapenne <solene@HIDDEN>
Message-ID: <20210525202407.383e1713@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Received-SPF: pass client-ip=163.172.223.238; envelope-from=solene@HIDDEN;
 helo=perso.pw
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.4 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.4 (--)

This imports a patch that is not committed upstream yet
but pending for merge on github

https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7

This is already widely used in many distributions distributing lz4

---
 gnu/packages/compression.scm                 |  7 +++++--
 gnu/packages/patches/lz4-CVE-2021-3520.patch | 15 +++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 gnu/packages/patches/lz4-CVE-2021-3520.patch

diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index 64816a30c0..53ab999151 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -33,6 +33,7 @@
 ;;; Copyright =C2=A9 2021 Antoine C=C3=B4t=C3=A9 <antoine.cote@HIDDEN>
 ;;; Copyright =C2=A9 2021 Vincent Legoll <vincent.legoll@HIDDEN>
 ;;; Copyright =C2=A9 2021 Simon Tournier <zimon.toutoune@HIDDEN>
+;;; Copyright =C2=A9 2021 Solene Rapenne <solene@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -810,15 +811,17 @@ decompression of some loosely related file formats us=
ed by Microsoft.")
                            (commit (string-append "v" version))))
        (sha256
         (base32 "1w02kazh1fps3sji2sn89fz862j1199c5ajrqcgl1bnlxj09kcbz"))
+       (patches
+        (search-patches "lz4-CVE-2021-3520.patch"))
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (outputs (list "out" "static"))
     (native-inputs
-     `(;; For tests.
+     `( ;; For tests.
        ("python" ,python)
        ("valgrind" ,valgrind)))
     (arguments
-     `(;; Not designed for parallel testing.
+     `( ;; Not designed for parallel testing.
        ;; See https://github.com/lz4/lz4/issues/957#issuecomment-737419821
        #:parallel-tests? #f
        #:test-target "test"
diff --git a/gnu/packages/patches/lz4-CVE-2021-3520.patch b/gnu/packages/pa=
tches/lz4-CVE-2021-3520.patch
new file mode 100644
index 0000000000..100baa4758
--- /dev/null
+++ b/gnu/packages/patches/lz4-CVE-2021-3520.patch
@@ -0,0 +1,15 @@
+Not merged patch fixing CVE-2021-3520
+https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7
+
+Index: b/lib/lz4.c
+--- a/lib/lz4.c.orig
++++ b/lib/lz4.c
+@@ -1749,7 +1749,7 @@ LZ4_decompress_generic(
+                  const size_t dictSize         /* note : =3D 0 if noDict =
*/
+                  )
+ {
+-    if (src =3D=3D NULL) { return -1; }
++    if ((src =3D=3D NULL) || (outputSize < 0)) { return -1; }
+=20
+     {   const BYTE* ip =3D (const BYTE*) src;
+         const BYTE* const iend =3D ip + srcSize;
--=20
2.31.1

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Solene Rapenne <solene@HIDDEN>
Subject: bug#48656: Acknowledgement ([PATCH] gnu: lz4: Add a patch for
 CVE-2021-3520.)
Message-ID: <handler.48656.B.162196706931998.ack <at> debbugs.gnu.org>
References: <20210525202407.383e1713@HIDDEN>
X-Gnu-PR-Message: ack 48656
X-Gnu-PR-Package: guix-patches
X-Gnu-PR-Keywords: patch
Reply-To: 48656 <at> debbugs.gnu.org
Date: Tue, 25 May 2021 18:25:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 guix-patches@HIDDEN

If you wish to submit further information on this problem, please
send it to 48656 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
48656: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D48656
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to guix-patches@HIDDEN:

Subject: [bug#48656] [PATCH] gnu: lz4: Add a patch for CVE-2021-3520.
Resent-From: Leo Famulari <leo@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: guix-patches@HIDDEN
Resent-Date: Tue, 25 May 2021 19:08:02 +0000
Resent-Message-ID: <handler.48656.B.16219696373572 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 48656 <at> debbugs.gnu.org
Date: Tue, 25 May 2021 15:07:05 -0400
From: Leo Famulari <leo@HIDDEN>
Message-ID: <YK1K2RvBsq92Feg2@HIDDEN>
References: <20210525202407.383e1713@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210525202407.383e1713@HIDDEN>
Received-SPF: pass client-ip=66.111.4.28; envelope-from=leo@HIDDEN;
 helo=out4-smtp.messagingengine.com
X-Spam_score_int: -27
X-Spam_score: -2.8
X-Spam_bar: --
X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001,
 SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.4 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.4 (--)

On Tue, May 25, 2021 at 08:24:07PM +0200, Solene Rapenne via Guix-patches via wrote:
> This imports a patch that is not committed upstream yet
> but pending for merge on github
> 
> https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7
> 
> This is already widely used in many distributions distributing lz4
> 
> ---
>  gnu/packages/compression.scm                 |  7 +++++--
>  gnu/packages/patches/lz4-CVE-2021-3520.patch | 15 +++++++++++++++

When adding a new patch file, you have to register it in 'gnu/local.mk'.

Is there any discussion about this upstream? Why isn't it included in
lz4 yet?

Message sent to guix-patches@HIDDEN:

Subject: [bug#48656] [PATCH] gnu: lz4: Add a patch for CVE-2021-3520.
Resent-From: Leo Famulari <leo@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: guix-patches@HIDDEN
Resent-Date: Tue, 25 May 2021 19:08:02 +0000
Resent-Message-ID: <handler.48656.B48656.16219696343562 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 48656 <at> debbugs.gnu.org
Date: Tue, 25 May 2021 15:07:05 -0400
From: Leo Famulari <leo@HIDDEN>
Message-ID: <YK1K2RvBsq92Feg2@HIDDEN>
References: <20210525202407.383e1713@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210525202407.383e1713@HIDDEN>
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

On Tue, May 25, 2021 at 08:24:07PM +0200, Solene Rapenne via Guix-patches via wrote:
> This imports a patch that is not committed upstream yet
> but pending for merge on github
> 
> https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7
> 
> This is already widely used in many distributions distributing lz4
> 
> ---
>  gnu/packages/compression.scm                 |  7 +++++--
>  gnu/packages/patches/lz4-CVE-2021-3520.patch | 15 +++++++++++++++

When adding a new patch file, you have to register it in 'gnu/local.mk'.

Is there any discussion about this upstream? Why isn't it included in
lz4 yet?

Last modified: Tue, 25 May 2021 19:15:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.