Upgrade vim numpy and Cython for CVE fixes (#1868)

This commit is contained in:
chalamalasetty 2022-01-08 00:01:11 -08:00 коммит произвёл GitHub
Родитель 03b96db394
Коммит 6a5cd72ab3
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
15 изменённых файлов: 29 добавлений и 441 удалений

Просмотреть файл

@ -1,5 +1,5 @@
{
"Signatures": {
"Cython-0.29.13.tar.gz": "af71d040fa9fa1af0ea2b7a481193776989ae93ae828eb018416cac771aef07f"
"cython-0.29.24.tar.gz": "a5efb97612f0f97164e87c54cc295b2e2d06c539487670079963adeab872de80"
}
}

Просмотреть файл

@ -1,15 +1,14 @@
%global upname cython
Name: Cython
Version: 0.29.13
Release: 7%{?dist}
Version: 0.29.24
Release: 1%{?dist}
Summary: Language for writing Python extension modules
Vendor: Microsoft
Distribution: Mariner
License: ASL 2.0
URL: https://www.cython.org
#Source0: https://github.com/%{upname}/%{upname}/archive/%{version}.tar.gz
Source0: %{name}-%{version}.tar.gz
Patch0: cython-py38.patch
Source0: %{upname}-%{version}.tar.gz
BuildRequires: gcc
BuildRequires: python3-devel
@ -59,6 +58,9 @@ rm -rf %{buildroot}%{python3_sitelib}/setuptools/tests
%{python3_sitearch}/__pycache__/%{upname}.*
%changelog
* Thu Jan 06 2022 Suresh Babu Chalamalasetty <schalam@microsoft.com> - 0.29.24-1
- Update version to 0.29.24
* Fri Dec 03 2021 Thomas Crain <thcrain@microsoft.com> - 0.29.13-7
- Add upstream patch to enable generating code for Python >= 3.8
- License verified

Просмотреть файл

@ -1,77 +0,0 @@
From db91122a1be428973c280eb049fe007b36be3d2e Mon Sep 17 00:00:00 2001
From: Pablo Galindo <pablogsal@gmail.com>
Date: Mon, 7 Oct 2019 19:34:19 +0100
Subject: [PATCH 1/2] Explicitly initialize tp_print in Python 3.8
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When compiling cython-generated extension modules in Python3.8rc1
this error is emitted by the compiler:
_ext.cpp:8104:1: error: missing initializer for member _typeobject::tp_print [-Werror=missing-field-initializers]
The reason is that Python3.8 moved the tp_print slot (d917cfe4051) to
the end of the _typeobject struct and reused the original position for
tp_vectorcall_offset. The current generated code does not initialize the
deprecated tp_print slot that was moved to the end of the struct.
---
Cython/Compiler/TypeSlots.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/Cython/Compiler/TypeSlots.py b/Cython/Compiler/TypeSlots.py
index 1be18f7674..85095ca4db 100644
--- a/Cython/Compiler/TypeSlots.py
+++ b/Cython/Compiler/TypeSlots.py
@@ -893,7 +893,8 @@ def get_slot_code_by_name(scope, slot_name):
slot_table = (
ConstructorSlot("tp_dealloc", '__dealloc__'),
- EmptySlot("tp_print"), #MethodSlot(printfunc, "tp_print", "__print__"),
+ EmptySlot("tp_print", ifdef="PY_VERSION_HEX <= 0x030400b4"),
+ EmptySlot("tp_vectorcall_offset", ifdef="PY_VERSION_HEX >= 0x030400b4"),
EmptySlot("tp_getattr"),
EmptySlot("tp_setattr"),
@@ -956,6 +957,7 @@ def get_slot_code_by_name(scope, slot_name):
EmptySlot("tp_version_tag"),
EmptySlot("tp_finalize", ifdef="PY_VERSION_HEX >= 0x030400a1"),
EmptySlot("tp_vectorcall", ifdef="PY_VERSION_HEX >= 0x030800b1"),
+ EmptySlot("tp_print", ifdef="PY_VERSION_HEX >= 0x030800b1"),
)
#------------------------------------------------------------------------------------------
From f906964236e0cebbf983b51e527114fe1b22c4ff Mon Sep 17 00:00:00 2001
From: Pablo Galindo <pablogsal@gmail.com>
Date: Tue, 8 Oct 2019 11:59:01 +0100
Subject: [PATCH 2/2] Correct version for tp_print/tp_vectorcall_offset
---
Cython/Compiler/TypeSlots.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/Cython/Compiler/TypeSlots.py b/Cython/Compiler/TypeSlots.py
index 85095ca4db..dca313ca50 100644
--- a/Cython/Compiler/TypeSlots.py
+++ b/Cython/Compiler/TypeSlots.py
@@ -893,8 +893,8 @@ def get_slot_code_by_name(scope, slot_name):
slot_table = (
ConstructorSlot("tp_dealloc", '__dealloc__'),
- EmptySlot("tp_print", ifdef="PY_VERSION_HEX <= 0x030400b4"),
- EmptySlot("tp_vectorcall_offset", ifdef="PY_VERSION_HEX >= 0x030400b4"),
+ EmptySlot("tp_print", ifdef="PY_VERSION_HEX < 0x030800b4"),
+ EmptySlot("tp_vectorcall_offset", ifdef="PY_VERSION_HEX >= 0x030800b4"),
EmptySlot("tp_getattr"),
EmptySlot("tp_setattr"),
@@ -957,7 +957,7 @@ def get_slot_code_by_name(scope, slot_name):
EmptySlot("tp_version_tag"),
EmptySlot("tp_finalize", ifdef="PY_VERSION_HEX >= 0x030400a1"),
EmptySlot("tp_vectorcall", ifdef="PY_VERSION_HEX >= 0x030800b1"),
- EmptySlot("tp_print", ifdef="PY_VERSION_HEX >= 0x030800b1"),
+ EmptySlot("tp_print", ifdef="PY_VERSION_HEX >= 0x030800b4"),
)
#------------------------------------------------------------------------------------------

Просмотреть файл

@ -1,50 +0,0 @@
diff -ruN a/tests/run/generators_py35.py b/tests/run/generators_py35.py
--- a/tests/run/generators_py35.py 1969-12-31 16:00:00.000000000 -0800
+++ b/tests/run/generators_py35.py 2021-04-30 00:40:03.333141340 -0700
@@ -0,0 +1,24 @@
+# mode: run
+# tag: generators, pure3.5
+
+from __future__ import generator_stop
+
+# "generator_stop" was only added in Py3.5.
+
+
+def with_outer_raising(*args):
+ """
+ >>> x = with_outer_raising(1, 2, 3)
+ >>> try:
+ ... list(x())
+ ... except RuntimeError:
+ ... print("OK!")
+ ... else:
+ ... print("NOT RAISED!")
+ OK!
+ """
+ def generator():
+ for i in args:
+ yield i
+ raise StopIteration
+ return generator
\ No newline at end of file
diff -ruN a/tests/run/generators_py.py b/tests/run/generators_py.py
--- a/tests/run/generators_py.py 2021-04-30 00:38:33.905610251 -0700
+++ b/tests/run/generators_py.py 2021-04-30 00:40:43.292935879 -0700
@@ -81,17 +81,6 @@
yield i
return generator
-def with_outer_raising(*args):
- """
- >>> x = with_outer_raising(1, 2, 3)
- >>> list(x())
- [1, 2, 3]
- """
- def generator():
- for i in args:
- yield i
- raise StopIteration
- return generator
def test_close():
"""

Просмотреть файл

@ -1,39 +0,0 @@
--- cython-0.28.5/tests/run/builtin_abs.pyx 2018-08-03 06:58:02.000000000 +0000
+++ cython-0.28.5/tests/run/builtin_abs.pyx 2019-01-10 22:47:02.208468689 +0000
@@ -50,10 +50,8 @@
True
>>> int_abs(-5.1) == 5
True
- >>> int_abs(-max_int-1) #doctest: +ELLIPSIS
- Traceback (most recent call last):
- ...
- OverflowError: ...
+ >>> int_abs(-max_int-1) #doctest: +ELLIPSIS
+ -2147483648
>>> int_abs(max_int) == abs(max_int) or (max_int, int_abs(max_int), abs(max_int))
True
"""
@@ -78,10 +76,8 @@
True
>>> long_abs(-5.1) == 5
True
- >>> long_abs(-max_long-1) #doctest: +ELLIPSIS
- Traceback (most recent call last):
- ...
- OverflowError: ...
+ >>> long_abs(-max_long-1) #doctest: +ELLIPSIS
+ -9223372036854775808
>>> long_abs(max_long) == abs(max_long) or (max_long, long_abs(max_long), abs(max_long))
True
"""
@@ -107,9 +103,7 @@
>>> long_long_abs(-(2**33)) == 2**33
True
>>> long_long_abs(-max_long_long-1) #doctest: +ELLIPSIS
- Traceback (most recent call last):
- ...
- OverflowError: ...
+ -9223372036854775808
>>> long_long_abs(max_long_long) == abs(max_long_long) or (max_long_long, long_long_abs(max_long_long), abs(max_long_long))
True
"""

Просмотреть файл

@ -1,55 +0,0 @@
From 271010f1037150e95017f803f4214b8861e528f2 Mon Sep 17 00:00:00 2001
From: Warren Weckesser <warren.weckesser@gmail.com>
Date: Mon, 20 Dec 2021 10:35:31 -0500
Subject: [PATCH] BUG: f2py: Simplify creation of an exception message. Closes
gh-19000.
Backported to numpy 1.16.6
Signed-off-by: Henry Beberman <henry.beberman@microsoft.com>
diff -Naur a/numpy/f2py/src/fortranobject.c b/numpy/f2py/src/fortranobject.c
--- a/numpy/f2py/src/fortranobject.c 2019-12-27 16:24:44.000000000 -0800
+++ b/numpy/f2py/src/fortranobject.c 2021-12-28 12:29:32.501872648 -0800
@@ -595,14 +595,14 @@
npy_intp *dims);
static int
-count_negative_dimensions(const int rank,
- const npy_intp *dims) {
- int i=0,r=0;
- while (i<rank) {
- if (dims[i] < 0) ++r;
- ++i;
+find_first_negative_dimension(const int rank, const npy_intp *dims)
+{
+ for (int i = 0; i < rank; ++i) {
+ if (dims[i] < 0) {
+ return i;
+ }
}
- return r;
+ return -1;
}
#ifdef DEBUG_COPY_ND_ARRAY
@@ -679,14 +679,12 @@
|| ((intent & F2PY_OPTIONAL) && (obj==Py_None))
) {
/* intent(cache), optional, intent(hide) */
- if (count_negative_dimensions(rank,dims) > 0) {
- int i;
- strcpy(mess, "failed to create intent(cache|hide)|optional array"
- "-- must have defined dimensions but got (");
- for(i=0;i<rank;++i)
- sprintf(mess+strlen(mess),"%" NPY_INTP_FMT ",",dims[i]);
- strcat(mess, ")");
- PyErr_SetString(PyExc_ValueError,mess);
+ int i = find_first_negative_dimension(rank, dims);
+ if (i >= 0) {
+ PyErr_Format(PyExc_ValueError,
+ "failed to create intent(cache|hide)|optional array"
+ " -- must have defined dimensions, but dims[%d] = %"
+ NPY_INTP_FMT, i, dims[i]);
return NULL;
}
arr = (PyArrayObject *)

Просмотреть файл

@ -1,23 +0,0 @@
From b8e741c66f71071c3406e592e1537570731bcb35 Mon Sep 17 00:00:00 2001
From: mattip <matti.picus@gmail.com>
Date: Sun, 26 May 2019 08:55:53 +0300
Subject: [PATCH] BUG: setup.py install --skip-build fails
---
numpy/distutils/command/install_clib.py | 3 +++
1 file changed, 3 insertions(+)
diff --git a/numpy/distutils/command/install_clib.py b/numpy/distutils/command/install_clib.py
index 662aa00bda9..6a73f7e3308 100644
--- a/numpy/distutils/command/install_clib.py
+++ b/numpy/distutils/command/install_clib.py
@@ -19,6 +19,9 @@ def finalize_options(self):
def run (self):
build_clib_cmd = get_cmd("build_clib")
+ if not build_clib_cmd.build_clib:
+ # can happen if the user specified `--skip-build`
+ build_clib_cmd.finalize_options()
build_dir = build_clib_cmd.build_clib
# We need the compiler to get the library name -> filename association

Просмотреть файл

@ -1,5 +1,5 @@
{
"Signatures": {
"numpy-1.16.6.tar.gz": "61562ddac78765969959500b0da9c6f9ba7d77eeb12ec3927afae5303df08777"
"numpy-1.22.0.tar.gz": "f2be14ba396780a6f662b8ba1a24466c9cf18a6a386174f614668e58387a13d7"
}
}

Просмотреть файл

@ -1,7 +1,7 @@
Summary: Array processing for numbers, strings, records, and objects
Name: numpy
Version: 1.16.6
Release: 4%{?dist}
Version: 1.22.0
Release: 1%{?dist}
# The custom license is inside numpy/core/src/multiarray/dragon4.c.
License: BSD AND ZLIB custom
Vendor: Microsoft Corporation
@ -9,14 +9,14 @@ Distribution: Mariner
Group: Development/Languages/Python
URL: https://numpy.org/
Source0: https://github.com/numpy/numpy/releases/download/v%{version}/%{name}-%{version}.tar.gz
Patch0: fix-setup-py-install.patch
Patch1: CVE-2021-41496.patch
BuildRequires: lapack-devel
BuildRequires: python3
BuildRequires: python3-devel
BuildRequires: python3-setuptools
BuildRequires: python3-xml
BuildRequires: python3-libs
BuildRequires: unzip
BuildRequires: python3-Cython >= 0.29.24
%if %{with_check}
BuildRequires: curl-devel
BuildRequires: openssl-devel
@ -47,10 +47,6 @@ This package includes a version of f2py that works properly with NumPy.
%autosetup -p1
%build
# xlocale.h has been removed from glibc 2.26
# The above include of locale.h is sufficient
# Further details: https://sourceware.org/git/?p=glibc.git;a=commit;h=f0be25b6336db7492e47d2e8e72eb8af53b5506d */
sed -i "/xlocale.h/d" numpy/core/src/common/numpyos.c
%py3_build
%install
@ -74,6 +70,9 @@ rm -rf test
%{_bindir}/f2py%{python3_version}
%changelog
* Thu Jan 06 2022 Suresh Babu Chalamalasetty <schalam@microsoft.com> - 1.22.0-1
- Update version to 1.22.0 fix CVE-2021-34141.
* Tue Dec 28 2021 Henry Beberman <henry.beberman@microsoft.com> - 1.16.6-4
- Backported upstream patch for CVE-2021-41496

Просмотреть файл

@ -1,58 +0,0 @@
From bd228fd097b41a798f90944b5d1245eddd484142 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 25 Nov 2021 10:50:12 +0000
Subject: [PATCH] patch 8.2.3669: buffer overflow with long help argument
Problem: Buffer overflow with long help argument.
Solution: Use snprintf().
---
src/help.c | 3 +--
src/testdir/test_help.vim | 9 +++++++++
src/version.c | 2 ++
3 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/src/help.c b/src/help.c
index 28d914c8233..d67f78b08ec 100644
--- a/src/help.c
+++ b/src/help.c
@@ -422,8 +422,7 @@ find_help_tags(
|| (vim_strchr((char_u *)"%_z@", arg[1]) != NULL
&& arg[2] != NUL)))
{
- STRCPY(d, "/\\\\");
- STRCPY(d + 3, arg + 1);
+ vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
// Check for "/\\_$", should be "/\\_\$"
if (d[3] == '_' && d[4] == '$')
STRCPY(d + 4, "\\$");
diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
index 15cc642d173..6e32edd368e 100644
--- a/src/testdir/test_help.vim
+++ b/src/testdir/test_help.vim
@@ -134,4 +134,13 @@ func Test_help_window_height()
close
endfunc
+func Test_help_long_argument()
+ try
+ exe 'help \%' .. repeat('0', 1021)
+ catch
+ call assert_match("E149:", v:exception)
+ endtry
+endfunc
+
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index a225e182f2c..da5871e32f8 100644
--- a/src/version.c
+++ b/src/version.c
@@ -757,6 +757,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 3669,
/**/
3668,
/**/

Просмотреть файл

@ -1,62 +0,0 @@
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index d74ef90..c2aef92 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -6849,13 +6849,17 @@ ex_open(exarg_T *eap)
regmatch.regprog = vim_regcomp(eap->arg, magic_isset() ? RE_MAGIC : 0);
if (regmatch.regprog != NULL)
{
+ // make a copy of the line, when searching for a mark it might be
+ // flushed
+ char_u *line = vim_strsave(ml_get_curline());
+
regmatch.rm_ic = p_ic;
- p = ml_get_curline();
- if (vim_regexec(&regmatch, p, (colnr_T)0))
- curwin->w_cursor.col = (colnr_T)(regmatch.startp[0] - p);
+ if (vim_regexec(&regmatch, line, (colnr_T)0))
+ curwin->w_cursor.col = (colnr_T)(regmatch.startp[0] - line);
else
emsg(_(e_nomatch));
vim_regfree(regmatch.regprog);
+ vim_free(line);
}
// Move to the NUL, ignore any other arguments.
eap->arg += STRLEN(eap->arg);
diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
index 1ca5062..7031115 100644
--- a/src/testdir/test_ex_mode.vim
+++ b/src/testdir/test_ex_mode.vim
@@ -121,6 +121,19 @@ func Test_open_command()
close!
endfunc
+func Test_open_command_flush_line()
+ " this was accessing freed memory: the regexp match uses a pointer to the
+ " current line which becomes invalid when searching for the ') mark.
+ new
+ call setline(1, ['one', 'two. three'])
+ s/one/ONE
+ try
+ open /\%')/
+ catch /E479/
+ endtry
+ bwipe!
+endfunc
+
" Test for :g/pat/visual to run vi commands in Ex mode
" This used to hang Vim before 8.2.0274.
func Test_Ex_global()
diff --git a/src/version.c b/src/version.c
index da5871e..db81cca 100644
--- a/src/version.c
+++ b/src/version.c
@@ -757,6 +757,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 3741,
/**/
3669,
/**/

Просмотреть файл

@ -1,50 +0,0 @@
From 605ec91e5a7330d61be313637e495fa02a6dc264 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 18 Dec 2021 16:54:31 +0000
Subject: [PATCH] patch 8.2.3847: illegal memory access when using a lambda
with an error
Problem: Illegal memory access when using a lambda with an error.
Solution: Avoid skipping over the NUL after a string.
Backported to vim 8.2.3668
Signed-off-by: Henry Beberman <henry.beberman@microsoft.com>
---
src/eval.c | 7 +++++--
src/testdir/test_lambda.vim | 2 ++
2 files changed, 6 insertions(+), 2 deletions(-)
diff -Naur a/src/eval.c b/src/eval.c
--- a/src/eval.c 2021-11-24 12:28:31.000000000 -0800
+++ b/src/eval.c 2021-12-28 11:47:30.087348603 -0800
@@ -3850,12 +3850,15 @@
++*arg;
ret = eval1(arg, rettv, evalarg);
*arg = skipwhite_and_linebreak(*arg, evalarg);
- if (**arg != ')')
+ if (**arg == ')')
+ {
+ ++*arg;
+ }
+ else
{
emsg(_(e_missing_close));
ret = FAIL;
}
- ++*arg;
}
if (ret != OK)
return FAIL;
diff -Naur a/src/testdir/test_lambda.vim b/src/testdir/test_lambda.vim
--- a/src/testdir/test_lambda.vim 2021-11-24 12:28:31.000000000 -0800
+++ b/src/testdir/test_lambda.vim 2021-12-28 11:48:19.397209114 -0800
@@ -64,6 +64,8 @@
call assert_fails('echo {a, a -> a + a}(1, 2)', 'E853:')
call assert_fails('echo {a, b -> a + b)}(1, 2)', 'E451:')
echo assert_fails('echo 10->{a -> a + 2}', 'E107:')
+
+ call assert_fails('eval 0->(', "E110: Missing ')'")
endfunc
func Test_not_lamda()

Просмотреть файл

@ -1,5 +1,5 @@
{
"Signatures": {
"vim-8.2.3668.tar.gz": "54e26c92d2d0ef186a2c8f913adbd4041646f210534fdbf607525d24b5d78956"
"vim-8.2.4006.tar.gz": "c3381d75f5b7695a3f191431950548d808761b370555db2333e44fc6827810d4"
}
}
}

Просмотреть файл

@ -1,17 +1,14 @@
%define debug_package %{nil}
Summary: Text editor
Name: vim
Version: 8.2.3668
Release: 4%{?dist}
Version: 8.2.4006
Release: 1%{?dist}
License: Vim
Vendor: Microsoft Corporation
Distribution: Mariner
Group: Applications/Editors
URL: https://www.vim.org
Source0: https://github.com/%{name}/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
Patch0: CVE-2021-4019.patch
Patch1: CVE-2021-4069.patch
Patch2: CVE-2021-4136.patch
BuildRequires: ncurses-devel
Provides: vi = %{release}-%{version}
Provides: %{name}-minimal = %{version}-%{release}
@ -195,6 +192,9 @@ fi
%{_bindir}/vimdiff
%changelog
* Thu Jan 06 2022 Suresh Babu Chalamalasetty <schalam@microsoft.com> - 8.2.4006-1
- Update version to 8.2.4006 to fix CVE CVE-2021-4166.
* Tue Dec 28 2021 Henry Beberman <henry.beberman@microsoft.com> - 8.2.3668-4
- Backported patch for CVE-2021-4136 from upstream
@ -295,3 +295,4 @@ fi
* Wed Nov 5 2014 Divya Thaluru <dthaluru@vmware.com> - 7.4-1
- Initial build First version.

Просмотреть файл

@ -2467,8 +2467,8 @@
"type": "other",
"other": {
"name": "Cython",
"version": "0.28.5",
"downloadUrl": "https://github.com/cython/cython/archive/0.28.5.tar.gz"
"version": "0.29.24",
"downloadUrl": "https://github.com/cython/cython/archive/0.29.24.tar.gz"
}
}
},
@ -14843,8 +14843,8 @@
"type": "other",
"other": {
"name": "numpy",
"version": "1.16.6",
"downloadUrl": "https://github.com/numpy/numpy/releases/download/v1.16.6/numpy-1.16.6.tar.gz"
"version": "1.22.0",
"downloadUrl": "https://github.com/numpy/numpy/releases/download/v1.22.0/numpy-1.22.0.tar.gz"
}
}
},
@ -28947,8 +28947,8 @@
"type": "other",
"other": {
"name": "vim",
"version": "8.2.3668",
"downloadUrl": "https://github.com/vim/vim/archive/v8.2.3668.tar.gz"
"version": "8.2.4006",
"downloadUrl": "https://github.com/vim/vim/archive/v8.2.4006.tar.gz"
}
}
},