diff --git a/SPECS/lua/CVE-2022-33099.patch b/SPECS/lua/CVE-2022-33099.patch new file mode 100644 index 0000000000..e7c35ff51b --- /dev/null +++ b/SPECS/lua/CVE-2022-33099.patch @@ -0,0 +1,62 @@ +From 42d40581dd919fb134c07027ca1ce0844c670daf Mon Sep 17 00:00:00 2001 +From: Roberto Ierusalimschy +Date: Fri, 20 May 2022 13:14:33 -0300 +Subject: [PATCH] Save stack space while handling errors + +Because error handling (luaG_errormsg) uses slots from EXTRA_STACK, +and some errors can recur (e.g., string overflow while creating an +error message in 'luaG_runerror', or a C-stack overflow before calling +the message handler), the code should use stack slots with parsimony. + +This commit fixes the bug "Lua-stack overflow when C stack overflows +while handling an error". + +Patch taken from upstream which was applied to version 5.4.4 and adjusted for version 5.4.3. + +--- + ldebug.c | 5 ++++- + lvm.c | 6 ++++-- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/src/ldebug.c b/src/ldebug.c +index 1feaab2..5524fae 100644 +--- a/src/ldebug.c ++++ b/src/ldebug.c +@@ -783,8 +783,11 @@ l_noret luaG_runerror (lua_State *L, const char *fmt, ...) { + va_start(argp, fmt); + msg = luaO_pushvfstring(L, fmt, argp); /* format message */ + va_end(argp); +- if (isLua(ci)) /* if Lua function, add source:line information */ ++ if (isLua(ci)) { /* if Lua function, add source:line information */ + luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci)); ++ setobjs2s(L, L->top - 2, L->top - 1); /* remove 'msg' from the stack */ ++ L->top--; ++ } + luaG_errormsg(L); + } + +diff --git a/src/lvm.c b/src/lvm.c +index c9729bc..51b9614 100644 +--- a/src/lvm.c ++++ b/src/lvm.c +@@ -656,8 +656,10 @@ void luaV_concat (lua_State *L, int total) { + /* collect total length and number of strings */ + for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) { + size_t l = vslen(s2v(top - n - 1)); +- if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) ++ if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) { ++ L->top = top - total; /* pop strings to avoid wasting stack */ + luaG_runerror(L, "string length overflow"); ++ } + tl += l; + } + if (tl <= LUAI_MAXSHORTLEN) { /* is result a short string? */ +@@ -672,7 +674,7 @@ void luaV_concat (lua_State *L, int total) { + setsvalue2s(L, top - n, ts); /* create result */ + } + total -= n-1; /* got 'n' strings to create 1 new */ +- L->top -= n-1; /* popped 'n' strings and pushed one */ ++ L->top = top - (n - 1); /* popped 'n' strings and pushed one */ + } while (total > 1); /* repeat until only 1 result left */ + } + diff --git a/SPECS/lua/lua.spec b/SPECS/lua/lua.spec index a1752985e3..0c5a96ed83 100644 --- a/SPECS/lua/lua.spec +++ b/SPECS/lua/lua.spec @@ -14,7 +14,7 @@ Summary: Powerful light-weight programming language Name: lua Version: %{major_version}.3 -Release: 3%{?dist} +Release: 4%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -44,6 +44,7 @@ Patch19: %{name}-5.4.3-bug3.patch Patch20: CVE-2021-43519.patch Patch21: CVE-2022-28805.patch Patch22: CVE-2021-44647.patch +Patch23: CVE-2022-33099.patch BuildRequires: autoconf BuildRequires: automake @@ -219,6 +220,9 @@ popd %{_libdir}/*.a %changelog +* Wed Jul 13 2022 Mandeep Plaha - 5.4.3-4 +- Patching CVE-2022-33099. + * Tue Jun 07 2022 Pawel Winogrodzki - 5.4.3-3 - Patching CVE-2021-44647. diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 20c5696fad..6527eb933e 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -205,8 +205,8 @@ libltdl-2.4.6-8.cm2.aarch64.rpm libltdl-devel-2.4.6-8.cm2.aarch64.rpm pcre-8.45-2.cm2.aarch64.rpm pcre-libs-8.45-2.cm2.aarch64.rpm -lua-5.4.3-3.cm2.aarch64.rpm -lua-libs-5.4.3-3.cm2.aarch64.rpm +lua-5.4.3-4.cm2.aarch64.rpm +lua-libs-5.4.3-4.cm2.aarch64.rpm mariner-rpm-macros-2.0-16.cm2.noarch.rpm mariner-check-macros-2.0-16.cm2.noarch.rpm libassuan-2.5.5-2.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 5b3f42c4b3..ad8eaf3c22 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -205,8 +205,8 @@ libltdl-2.4.6-8.cm2.x86_64.rpm libltdl-devel-2.4.6-8.cm2.x86_64.rpm pcre-8.45-2.cm2.x86_64.rpm pcre-libs-8.45-2.cm2.x86_64.rpm -lua-5.4.3-3.cm2.x86_64.rpm -lua-libs-5.4.3-3.cm2.x86_64.rpm +lua-5.4.3-4.cm2.x86_64.rpm +lua-libs-5.4.3-4.cm2.x86_64.rpm mariner-rpm-macros-2.0-16.cm2.noarch.rpm mariner-check-macros-2.0-16.cm2.noarch.rpm libassuan-2.5.5-2.cm2.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 19515356f3..97df546f18 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -209,13 +209,13 @@ libxml2-devel-2.9.14-1.cm2.aarch64.rpm libxslt-1.1.34-7.cm2.aarch64.rpm libxslt-debuginfo-1.1.34-7.cm2.aarch64.rpm libxslt-devel-1.1.34-7.cm2.aarch64.rpm -lua-5.4.3-3.cm2.aarch64.rpm -lua-debuginfo-5.4.3-3.cm2.aarch64.rpm -lua-devel-5.4.3-3.cm2.aarch64.rpm -lua-libs-5.4.3-3.cm2.aarch64.rpm +lua-5.4.3-4.cm2.aarch64.rpm +lua-debuginfo-5.4.3-4.cm2.aarch64.rpm +lua-devel-5.4.3-4.cm2.aarch64.rpm +lua-libs-5.4.3-4.cm2.aarch64.rpm lua-rpm-macros-1-6.cm2.noarch.rpm lua-srpm-macros-1-6.cm2.noarch.rpm -lua-static-5.4.3-3.cm2.aarch64.rpm +lua-static-5.4.3-4.cm2.aarch64.rpm lz4-1.9.3-1.cm2.aarch64.rpm lz4-debuginfo-1.9.3-1.cm2.aarch64.rpm lz4-devel-1.9.3-1.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 9324c4101e..910c5c6bcc 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -209,13 +209,13 @@ libxml2-devel-2.9.14-1.cm2.x86_64.rpm libxslt-1.1.34-7.cm2.x86_64.rpm libxslt-debuginfo-1.1.34-7.cm2.x86_64.rpm libxslt-devel-1.1.34-7.cm2.x86_64.rpm -lua-5.4.3-3.cm2.x86_64.rpm -lua-debuginfo-5.4.3-3.cm2.x86_64.rpm -lua-devel-5.4.3-3.cm2.x86_64.rpm -lua-libs-5.4.3-3.cm2.x86_64.rpm +lua-5.4.3-4.cm2.x86_64.rpm +lua-debuginfo-5.4.3-4.cm2.x86_64.rpm +lua-devel-5.4.3-4.cm2.x86_64.rpm +lua-libs-5.4.3-4.cm2.x86_64.rpm lua-rpm-macros-1-6.cm2.noarch.rpm lua-srpm-macros-1-6.cm2.noarch.rpm -lua-static-5.4.3-3.cm2.x86_64.rpm +lua-static-5.4.3-4.cm2.x86_64.rpm lz4-1.9.3-1.cm2.x86_64.rpm lz4-debuginfo-1.9.3-1.cm2.x86_64.rpm lz4-devel-1.9.3-1.cm2.x86_64.rpm