CVS commit: pkgsrc/devel/gputils

["David A. Holland" <dholland%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   dholland
Date:           Wed Sep 14 14:10:50 UTC 2016

Modified Files:
        pkgsrc/devel/gputils: Makefile distinfo
Added Files:
        pkgsrc/devel/gputils/patches: patch-libgputils_gparchive.c
            patch-libgputils_gpreadobj.c patch-libgputils_gpsystem.c

Log Message:
Improve input paranoia and error reporting in gplib, pursuant to the
sdcc3 build problem being discussed on tech-pkg.


To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.22 pkgsrc/devel/gputils/Makefile
cvs rdiff -u -r1.11 -r1.12 pkgsrc/devel/gputils/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/devel/gputils/patches/patch-libgputils_gparchive.c \
    pkgsrc/devel/gputils/patches/patch-libgputils_gpreadobj.c \
    pkgsrc/devel/gputils/patches/patch-libgputils_gpsystem.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/gputils/Makefile
diff -u pkgsrc/devel/gputils/Makefile:1.21 pkgsrc/devel/gputils/Makefile:1.22
--- pkgsrc/devel/gputils/Makefile:1.21  Tue Mar 15 20:39:52 2016
+++ pkgsrc/devel/gputils/Makefile       Wed Sep 14 14:10:50 2016
@@ -1,7 +1,8 @@
-# $NetBSD: Makefile,v 1.21 2016/03/15 20:39:52 bouyer Exp $
+# $NetBSD: Makefile,v 1.22 2016/09/14 14:10:50 dholland Exp $
 
 DISTNAME=      gputils-1.4.2-1
 PKGNAME=       gputils-1.4.2.1
+PKGREVISION=   1
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_SOURCEFORGE:=gputils/}
 WRKSRC=                ${WRKDIR}/gputils-1.4.2

Index: pkgsrc/devel/gputils/distinfo
diff -u pkgsrc/devel/gputils/distinfo:1.11 pkgsrc/devel/gputils/distinfo:1.12
--- pkgsrc/devel/gputils/distinfo:1.11  Tue Mar 15 20:39:52 2016
+++ pkgsrc/devel/gputils/distinfo       Wed Sep 14 14:10:50 2016
@@ -1,6 +1,9 @@
-$NetBSD: distinfo,v 1.11 2016/03/15 20:39:52 bouyer Exp $
+$NetBSD: distinfo,v 1.12 2016/09/14 14:10:50 dholland Exp $
 
 SHA1 (gputils-1.4.2-1.tar.gz) = f71ce8419b497ff8fc72aa11344919095726f40e
 RMD160 (gputils-1.4.2-1.tar.gz) = 0084c8160f4c2c6fd75db7cbda37aba116e98220
 SHA512 (gputils-1.4.2-1.tar.gz) = dfa469157008b9cac486f353ac9089326d093d7daa7e4b909d018e703963ed09481e76a3afb275ed2d9ca0bf41c53de635bb55ff3dbe0509f48e801986982341
 Size (gputils-1.4.2-1.tar.gz) = 12505612 bytes
+SHA1 (patch-libgputils_gparchive.c) = cf6ddbc27ae797ef38ef075280fa004b06583d0b
+SHA1 (patch-libgputils_gpreadobj.c) = eb67daa2d27310ac842c0902df136d281b5d3a1b
+SHA1 (patch-libgputils_gpsystem.c) = 539dc4947a31ed634f320689d528dd1efa79da3a

Added files:

Index: pkgsrc/devel/gputils/patches/patch-libgputils_gparchive.c
diff -u /dev/null pkgsrc/devel/gputils/patches/patch-libgputils_gparchive.c:1.1
--- /dev/null   Wed Sep 14 14:10:50 2016
+++ pkgsrc/devel/gputils/patches/patch-libgputils_gparchive.c   Wed Sep 14 14:10:50 2016
@@ -0,0 +1,27 @@
+$NetBSD: patch-libgputils_gparchive.c,v 1.1 2016/09/14 14:10:50 dholland Exp $
+
+Be more paranoid about input, pursuant to a build failure in sdcc3
+that seems to involve gplib trying to allocate gigs of memory.
+
+--- libgputils/gparchive.c~    2015-12-12 14:47:51.000000000 +0000
++++ libgputils/gparchive.c
+@@ -333,10 +333,18 @@ gp_archive_read(const char *filename)
+ 
+     /* read the object file or symbol index into memory */
+     sscanf(new->header.ar_size, "%il", &object_size);
++    if (object_size < 0) {
++      gp_error("bad archive \"%s\" (negative entry size)", filename);
++    }
++    /* sanity check */
++    if (object_size > 100*1024*1024) {
++      gp_error("bad archive \"%s\" (unreasonable entry size %d)", filename,
++             object_size);
++    }
+     new->data.size = object_size;
+     new->data.file = (unsigned char *)GP_Malloc(object_size);
+     if (fread(new->data.file, sizeof(char), object_size, infile) != object_size) {
+-      gp_error("bad archive \"%s\"", filename);
++      gp_error("bad archive \"%s\" (read error)", filename);
+     }
+ 
+     /* insert the new member in the archive list */
Index: pkgsrc/devel/gputils/patches/patch-libgputils_gpreadobj.c
diff -u /dev/null pkgsrc/devel/gputils/patches/patch-libgputils_gpreadobj.c:1.1
--- /dev/null   Wed Sep 14 14:10:50 2016
+++ pkgsrc/devel/gputils/patches/patch-libgputils_gpreadobj.c   Wed Sep 14 14:10:50 2016
@@ -0,0 +1,23 @@
+$NetBSD: patch-libgputils_gpreadobj.c,v 1.1 2016/09/14 14:10:50 dholland Exp $
+
+Be more paranoid about input, pursuant to a build failure in sdcc3
+that seems to involve gplib trying to allocate gigs of memory.
+
+--- libgputils/gpreadobj.c~    2015-11-23 18:17:01.000000000 +0000
++++ libgputils/gpreadobj.c
+@@ -109,6 +109,15 @@ gp_read_file(const char *filename)
+   fstat(fileno(infile), &statbuf);
+   file->size = statbuf.st_size;
+ 
++  /* just in case */
++  if (file->size < 0) {
++    gp_error("File \"%s\" size is negative.", filename);
++  }
++  if (file->size > 100*1024*1024) {
++    gp_error("File \"%s\" size %ld is unreasonably large.", filename,
++           file->size);
++  }
++
+   /* read the object file into memory */
+   file->file = (unsigned char *)GP_Malloc(file->size);
+   n = fread(file->file, 1, file->size, infile);
Index: pkgsrc/devel/gputils/patches/patch-libgputils_gpsystem.c
diff -u /dev/null pkgsrc/devel/gputils/patches/patch-libgputils_gpsystem.c:1.1
--- /dev/null   Wed Sep 14 14:10:50 2016
+++ pkgsrc/devel/gputils/patches/patch-libgputils_gpsystem.c    Wed Sep 14 14:10:50 2016
@@ -0,0 +1,19 @@
+$NetBSD: patch-libgputils_gpsystem.c,v 1.1 2016/09/14 14:10:50 dholland Exp $
+
+Avoid possible integer wraparound reporting calloc failure, pursuant
+to a build failure in sdcc3 that seems to involve gplib trying to
+allocate gigs of memory.
+
+--- libgputils/gpsystem.c~     2015-12-06 12:44:33.000000000 +0000
++++ libgputils/gpsystem.c
+@@ -245,8 +245,8 @@ gp_calloc(size_t Nmemb, size_t Size, con
+   }
+ 
+   if ((m = calloc(Nmemb, Size)) == NULL) {
+-    fprintf(stderr, "%s() -- Could not allocate %zu bytes of memory. {%s.LINE-%zu, %s()}\n",
+-            __func__, Nmemb * Size, File, Line, Func);
++    fprintf(stderr, "%s() -- Could not allocate memory for %zu objects of %zu bytes each. {%s.LINE-%zu, %s()}\n",
++            __func__, Nmemb, Size, File, Line, Func);
+     exit(1);
+   }
+