From ddd9a0a49307e444a1bacd6440a9c8dfb2321861 Mon Sep 17 00:00:00 2001 From: Zhao Hang Date: Tue, 28 May 2024 13:58:38 +0800 Subject: [PATCH 01/10] update to python3-3.6.8-62.src.rpm Signed-off-by: Zhao Hang --- ...7-4559.patch => 00397-tarfile-filter.patch | 0 00408-CVE-2022-48560.patch | 24 +- 00414-skip_test_zlib_s390x.patch | 88 +++++ ...-addresses-in-email-parseaddr-111116.patch | 0 ...s-for-xmlpullparser-with-expat-2-6-0.patch | 90 +++++ 00426-CVE-2023-6597.patch | 291 +++++++++++++++ 00427-CVE-2024-0450.patch | 346 ++++++++++++++++++ 1001-python3-anolis-add-loongarch.patch | 12 - 1002-fix-faulthandler_register-stack.patch | 43 --- ...-by-value-for-structs-on-loongarch64.patch | 39 -- Python-3.6.8-sw.patch | 45 --- add-anolis-platform.patch | 12 - dist | 1 + python3.spec | 151 ++++++-- 14 files changed, 940 insertions(+), 202 deletions(-) rename 1004-backport-CVE-2007-4559.patch => 00397-tarfile-filter.patch (100%) create mode 100644 00414-skip_test_zlib_s390x.patch rename 1005-backport-CVE-2023-27043.patch => 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch (100%) create mode 100644 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch create mode 100644 00426-CVE-2023-6597.patch create mode 100644 00427-CVE-2024-0450.patch delete mode 100644 1001-python3-anolis-add-loongarch.patch delete mode 100644 1002-fix-faulthandler_register-stack.patch delete mode 100644 1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch delete mode 100644 Python-3.6.8-sw.patch delete mode 100644 add-anolis-platform.patch create mode 100644 dist diff --git a/1004-backport-CVE-2007-4559.patch b/00397-tarfile-filter.patch similarity index 100% rename from 1004-backport-CVE-2007-4559.patch rename to 00397-tarfile-filter.patch diff --git a/00408-CVE-2022-48560.patch b/00408-CVE-2022-48560.patch index c2924d0..9b6cfb1 100644 --- a/00408-CVE-2022-48560.patch +++ b/00408-CVE-2022-48560.patch @@ -1,8 +1,13 @@ -From f154e5583386b06dc3a188677231bd43da2646ce Mon Sep 17 00:00:00 2001 -From: wangkaiqiang -Date: Wed, 17 Jan 2024 15:12:09 +0800 -Subject: [PATCH] Fix posible crash in heapq with custom comparison operators +From c563f409ea30bcb0623d785428c9257917371b76 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Thu, 23 Jan 2020 06:49:19 -0800 +Subject: [PATCH] bpo-39421: Fix posible crash in heapq with custom comparison + operators (GH-18118) (GH-18146) +(cherry picked from commit 79f89e6e5a659846d1068e8b1bd8e491ccdef861) + +Co-authored-by: Pablo Galindo --- Lib/test/test_heapq.py | 31 ++++++++++++++++ .../2020-01-22-15-53-37.bpo-39421.O3nG7u.rst | 2 ++ @@ -11,10 +16,10 @@ Subject: [PATCH] Fix posible crash in heapq with custom comparison operators create mode 100644 Misc/NEWS.d/next/Core and Builtins/2020-01-22-15-53-37.bpo-39421.O3nG7u.rst diff --git a/Lib/test/test_heapq.py b/Lib/test/test_heapq.py -index 2f8c648..7c3fb02 100644 +index 2f8c648d84a58..7c3fb0210f69b 100644 --- a/Lib/test/test_heapq.py +++ b/Lib/test/test_heapq.py -@@ -414,6 +414,37 @@ class TestErrorHandling: +@@ -414,6 +414,37 @@ def test_heappop_mutating_heap(self): with self.assertRaises((IndexError, RuntimeError)): self.module.heappop(heap) @@ -54,14 +59,14 @@ index 2f8c648..7c3fb02 100644 module = py_heapq diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-01-22-15-53-37.bpo-39421.O3nG7u.rst b/Misc/NEWS.d/next/Core and Builtins/2020-01-22-15-53-37.bpo-39421.O3nG7u.rst new file mode 100644 -index 0000000..bae0081 +index 0000000000000..bae008150ee12 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2020-01-22-15-53-37.bpo-39421.O3nG7u.rst @@ -0,0 +1,2 @@ +Fix possible crashes when operating with the functions in the :mod:`heapq` +module and custom comparison operators. diff --git a/Modules/_heapqmodule.c b/Modules/_heapqmodule.c -index b499e1f..0fb35ff 100644 +index b499e1f668aae..0fb35ffe5ec48 100644 --- a/Modules/_heapqmodule.c +++ b/Modules/_heapqmodule.c @@ -29,7 +29,11 @@ siftdown(PyListObject *heap, Py_ssize_t startpos, Py_ssize_t pos) @@ -136,6 +141,3 @@ index b499e1f..0fb35ff 100644 if (cmp < 0) return -1; childpos += ((unsigned)cmp ^ 1); /* increment when cmp==0 */ --- -2.31.1 - diff --git a/00414-skip_test_zlib_s390x.patch b/00414-skip_test_zlib_s390x.patch new file mode 100644 index 0000000..05e3fbd --- /dev/null +++ b/00414-skip_test_zlib_s390x.patch @@ -0,0 +1,88 @@ +From 0d02ff99721f7650e39ba4c7d8fe06f412bbb591 Mon Sep 17 00:00:00 2001 +From: Victor Stinner +Date: Wed, 13 Dec 2023 11:50:26 +0100 +Subject: [PATCH] bpo-46623: Skip two test_zlib tests on s390x (GH-31096) + +Skip test_pair() and test_speech128() of test_zlib on s390x since +they fail if zlib uses the s390x hardware accelerator. +--- + Lib/test/test_zlib.py | 32 +++++++++++++++++++ + .../2022-02-03-09-45-26.bpo-46623.vxzuhV.rst | 2 ++ + 2 files changed, 34 insertions(+) + create mode 100644 Misc/NEWS.d/next/Tests/2022-02-03-09-45-26.bpo-46623.vxzuhV.rst + +diff --git a/Lib/test/test_zlib.py b/Lib/test/test_zlib.py +index b7170b4..770a425 100644 +--- a/Lib/test/test_zlib.py ++++ b/Lib/test/test_zlib.py +@@ -1,6 +1,7 @@ + import unittest + from test import support + import binascii ++import os + import pickle + import random + import sys +@@ -15,6 +16,35 @@ requires_Decompress_copy = unittest.skipUnless( + hasattr(zlib.decompressobj(), "copy"), + 'requires Decompress.copy()') + ++# bpo-46623: On s390x, when a hardware accelerator is used, using different ++# ways to compress data with zlib can produce different compressed data. ++# Simplified test_pair() code: ++# ++# def func1(data): ++# return zlib.compress(data) ++# ++# def func2(data) ++# co = zlib.compressobj() ++# x1 = co.compress(data) ++# x2 = co.flush() ++# return x1 + x2 ++# ++# On s390x if zlib uses a hardware accelerator, func1() creates a single ++# "final" compressed block whereas func2() produces 3 compressed blocks (the ++# last one is a final block). On other platforms with no accelerator, func1() ++# and func2() produce the same compressed data made of a single (final) ++# compressed block. ++# ++# Only the compressed data is different, the decompression returns the original ++# data: ++# ++# zlib.decompress(func1(data)) == zlib.decompress(func2(data)) == data ++# ++# Make the assumption that s390x always has an accelerator to simplify the skip ++# condition. Windows doesn't have os.uname() but it doesn't support s390x. ++skip_on_s390x = unittest.skipIf(hasattr(os, 'uname') and os.uname().machine == 's390x', ++ 'skipped on s390x') ++ + + class VersionTestCase(unittest.TestCase): + +@@ -174,6 +204,7 @@ class CompressTestCase(BaseCompressTestCase, unittest.TestCase): + bufsize=zlib.DEF_BUF_SIZE), + HAMLET_SCENE) + ++ @skip_on_s390x + def test_speech128(self): + # compress more data + data = HAMLET_SCENE * 128 +@@ -225,6 +256,7 @@ class CompressTestCase(BaseCompressTestCase, unittest.TestCase): + + class CompressObjectTestCase(BaseCompressTestCase, unittest.TestCase): + # Test compression object ++ @skip_on_s390x + def test_pair(self): + # straightforward compress/decompress objects + datasrc = HAMLET_SCENE * 128 +diff --git a/Misc/NEWS.d/next/Tests/2022-02-03-09-45-26.bpo-46623.vxzuhV.rst b/Misc/NEWS.d/next/Tests/2022-02-03-09-45-26.bpo-46623.vxzuhV.rst +new file mode 100644 +index 0000000..be085c0 +--- /dev/null ++++ b/Misc/NEWS.d/next/Tests/2022-02-03-09-45-26.bpo-46623.vxzuhV.rst +@@ -0,0 +1,2 @@ ++Skip test_pair() and test_speech128() of test_zlib on s390x since they fail ++if zlib uses the s390x hardware accelerator. Patch by Victor Stinner. +-- +2.43.0 + diff --git a/1005-backport-CVE-2023-27043.patch b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch similarity index 100% rename from 1005-backport-CVE-2023-27043.patch rename to 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch diff --git a/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch b/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch new file mode 100644 index 0000000..c07a97f --- /dev/null +++ b/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch @@ -0,0 +1,90 @@ +From 87acab66e124912549fbc3151f27ca7fae76386c Mon Sep 17 00:00:00 2001 +From: Serhiy Storchaka +Date: Tue, 23 Apr 2024 19:54:00 +0200 +Subject: [PATCH] gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 + +Feeding the parser by too small chunks defers parsing to prevent +CVE-2023-52425. Future versions of Expat may be more reactive. + +(cherry picked from commit 4a08e7b3431cd32a0daf22a33421cd3035343dc4) +--- + Lib/test/test_xml_etree.py | 53 +++++++++++-------- + ...-02-08-14-21-28.gh-issue-115133.ycl4ko.rst | 2 + + 2 files changed, 33 insertions(+), 22 deletions(-) + create mode 100644 Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst + +diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py +index acaa519..c01af47 100644 +--- a/Lib/test/test_xml_etree.py ++++ b/Lib/test/test_xml_etree.py +@@ -1044,28 +1044,37 @@ class XMLPullParserTest(unittest.TestCase): + self.assertEqual([(action, elem.tag) for action, elem in events], + expected) + +- def test_simple_xml(self): +- for chunk_size in (None, 1, 5): +- with self.subTest(chunk_size=chunk_size): +- parser = ET.XMLPullParser() +- self.assert_event_tags(parser, []) +- self._feed(parser, "\n", chunk_size) +- self.assert_event_tags(parser, []) +- self._feed(parser, +- "\n text\n", chunk_size) +- self.assert_event_tags(parser, [('end', 'element')]) +- self._feed(parser, "texttail\n", chunk_size) +- self._feed(parser, "\n", chunk_size) +- self.assert_event_tags(parser, [ +- ('end', 'element'), +- ('end', 'empty-element'), +- ]) +- self._feed(parser, "\n", chunk_size) +- self.assert_event_tags(parser, [('end', 'root')]) +- self.assertIsNone(parser.close()) ++ def test_simple_xml(self, chunk_size=None): ++ parser = ET.XMLPullParser() ++ self.assert_event_tags(parser, []) ++ self._feed(parser, "\n", chunk_size) ++ self.assert_event_tags(parser, []) ++ self._feed(parser, ++ "\n text\n", chunk_size) ++ self.assert_event_tags(parser, [('end', 'element')]) ++ self._feed(parser, "texttail\n", chunk_size) ++ self._feed(parser, "\n", chunk_size) ++ self.assert_event_tags(parser, [ ++ ('end', 'element'), ++ ('end', 'empty-element'), ++ ]) ++ self._feed(parser, "\n", chunk_size) ++ self.assert_event_tags(parser, [('end', 'root')]) ++ self.assertIsNone(parser.close()) ++ ++ @unittest.expectedFailure ++ def test_simple_xml_chunk_1(self): ++ self.test_simple_xml(chunk_size=1) ++ ++ @unittest.expectedFailure ++ def test_simple_xml_chunk_5(self): ++ self.test_simple_xml(chunk_size=5) ++ ++ def test_simple_xml_chunk_22(self): ++ self.test_simple_xml(chunk_size=22) + + def test_feed_while_iterating(self): + parser = ET.XMLPullParser() +diff --git a/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst +new file mode 100644 +index 0000000..6f10152 +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst +@@ -0,0 +1,2 @@ ++Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat ++2.6.0. +-- +2.44.0 + diff --git a/00426-CVE-2023-6597.patch b/00426-CVE-2023-6597.patch new file mode 100644 index 0000000..f12c109 --- /dev/null +++ b/00426-CVE-2023-6597.patch @@ -0,0 +1,291 @@ +From 82f1ea4b72be40f58fd0a9a37f8d8d2f7d16f9e0 Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Wed, 24 Apr 2024 00:19:23 +0200 +Subject: [PATCH] CVE-2023-6597 + +Co-authored-by: Søren Løvborg +Co-authored-by: Serhiy Storchaka +--- + Lib/tempfile.py | 44 +++++++++- + Lib/test/test_tempfile.py | 166 +++++++++++++++++++++++++++++++++++--- + 2 files changed, 199 insertions(+), 11 deletions(-) + +diff --git a/Lib/tempfile.py b/Lib/tempfile.py +index 2cb5434..d79b70c 100644 +--- a/Lib/tempfile.py ++++ b/Lib/tempfile.py +@@ -276,6 +276,23 @@ def _mkstemp_inner(dir, pre, suf, flags, output_type): + "No usable temporary file name found") + + ++def _dont_follow_symlinks(func, path, *args): ++ # Pass follow_symlinks=False, unless not supported on this platform. ++ if func in _os.supports_follow_symlinks: ++ func(path, *args, follow_symlinks=False) ++ elif _os.name == 'nt' or not _os.path.islink(path): ++ func(path, *args) ++ ++ ++def _resetperms(path): ++ try: ++ chflags = _os.chflags ++ except AttributeError: ++ pass ++ else: ++ _dont_follow_symlinks(chflags, path, 0) ++ _dont_follow_symlinks(_os.chmod, path, 0o700) ++ + # User visible interfaces. + + def gettempprefix(): +@@ -794,9 +811,32 @@ class TemporaryDirectory(object): + self, self._cleanup, self.name, + warn_message="Implicitly cleaning up {!r}".format(self)) + ++ @classmethod ++ def _rmtree(cls, name): ++ def onerror(func, path, exc_info): ++ if issubclass(exc_info[0], PermissionError): ++ try: ++ if path != name: ++ _resetperms(_os.path.dirname(path)) ++ _resetperms(path) ++ ++ try: ++ _os.unlink(path) ++ # PermissionError is raised on FreeBSD for directories ++ except (IsADirectoryError, PermissionError): ++ cls._rmtree(path) ++ except FileNotFoundError: ++ pass ++ elif issubclass(exc_info[0], FileNotFoundError): ++ pass ++ else: ++ raise ++ ++ _shutil.rmtree(name, onerror=onerror) ++ + @classmethod + def _cleanup(cls, name, warn_message): +- _shutil.rmtree(name) ++ cls._rmtree(name) + _warnings.warn(warn_message, ResourceWarning) + + def __repr__(self): +@@ -810,4 +850,4 @@ class TemporaryDirectory(object): + + def cleanup(self): + if self._finalizer.detach(): +- _shutil.rmtree(self.name) ++ self._rmtree(self.name) +diff --git a/Lib/test/test_tempfile.py b/Lib/test/test_tempfile.py +index 710756b..c5560e1 100644 +--- a/Lib/test/test_tempfile.py ++++ b/Lib/test/test_tempfile.py +@@ -1298,19 +1298,25 @@ class NulledModules: + class TestTemporaryDirectory(BaseTestCase): + """Test TemporaryDirectory().""" + +- def do_create(self, dir=None, pre="", suf="", recurse=1): ++ def do_create(self, dir=None, pre="", suf="", recurse=1, dirs=1, files=1): + if dir is None: + dir = tempfile.gettempdir() + tmp = tempfile.TemporaryDirectory(dir=dir, prefix=pre, suffix=suf) + self.nameCheck(tmp.name, dir, pre, suf) +- # Create a subdirectory and some files +- if recurse: +- d1 = self.do_create(tmp.name, pre, suf, recurse-1) +- d1.name = None +- with open(os.path.join(tmp.name, "test.txt"), "wb") as f: +- f.write(b"Hello world!") ++ self.do_create2(tmp.name, recurse, dirs, files) + return tmp + ++ def do_create2(self, path, recurse=1, dirs=1, files=1): ++ # Create subdirectories and some files ++ if recurse: ++ for i in range(dirs): ++ name = os.path.join(path, "dir%d" % i) ++ os.mkdir(name) ++ self.do_create2(name, recurse-1, dirs, files) ++ for i in range(files): ++ with open(os.path.join(path, "test%d.txt" % i), "wb") as f: ++ f.write(b"Hello world!") ++ + def test_mkdtemp_failure(self): + # Check no additional exception if mkdtemp fails + # Previously would raise AttributeError instead +@@ -1350,11 +1356,108 @@ class TestTemporaryDirectory(BaseTestCase): + "TemporaryDirectory %s exists after cleanup" % d1.name) + self.assertTrue(os.path.exists(d2.name), + "Directory pointed to by a symlink was deleted") +- self.assertEqual(os.listdir(d2.name), ['test.txt'], ++ self.assertEqual(os.listdir(d2.name), ['test0.txt'], + "Contents of the directory pointed to by a symlink " + "were deleted") + d2.cleanup() + ++ @support.skip_unless_symlink ++ def test_cleanup_with_symlink_modes(self): ++ # cleanup() should not follow symlinks when fixing mode bits (#91133) ++ with self.do_create(recurse=0) as d2: ++ file1 = os.path.join(d2, 'file1') ++ open(file1, 'wb').close() ++ dir1 = os.path.join(d2, 'dir1') ++ os.mkdir(dir1) ++ for mode in range(8): ++ mode <<= 6 ++ with self.subTest(mode=format(mode, '03o')): ++ def test(target, target_is_directory): ++ d1 = self.do_create(recurse=0) ++ symlink = os.path.join(d1.name, 'symlink') ++ os.symlink(target, symlink, ++ target_is_directory=target_is_directory) ++ try: ++ os.chmod(symlink, mode, follow_symlinks=False) ++ except NotImplementedError: ++ pass ++ try: ++ os.chmod(symlink, mode) ++ except FileNotFoundError: ++ pass ++ os.chmod(d1.name, mode) ++ d1.cleanup() ++ self.assertFalse(os.path.exists(d1.name)) ++ ++ with self.subTest('nonexisting file'): ++ test('nonexisting', target_is_directory=False) ++ with self.subTest('nonexisting dir'): ++ test('nonexisting', target_is_directory=True) ++ ++ with self.subTest('existing file'): ++ os.chmod(file1, mode) ++ old_mode = os.stat(file1).st_mode ++ test(file1, target_is_directory=False) ++ new_mode = os.stat(file1).st_mode ++ self.assertEqual(new_mode, old_mode, ++ '%03o != %03o' % (new_mode, old_mode)) ++ ++ with self.subTest('existing dir'): ++ os.chmod(dir1, mode) ++ old_mode = os.stat(dir1).st_mode ++ test(dir1, target_is_directory=True) ++ new_mode = os.stat(dir1).st_mode ++ self.assertEqual(new_mode, old_mode, ++ '%03o != %03o' % (new_mode, old_mode)) ++ ++ @unittest.skipUnless(hasattr(os, 'chflags'), 'requires os.chflags') ++ @support.skip_unless_symlink ++ def test_cleanup_with_symlink_flags(self): ++ # cleanup() should not follow symlinks when fixing flags (#91133) ++ flags = stat.UF_IMMUTABLE | stat.UF_NOUNLINK ++ self.check_flags(flags) ++ ++ with self.do_create(recurse=0) as d2: ++ file1 = os.path.join(d2, 'file1') ++ open(file1, 'wb').close() ++ dir1 = os.path.join(d2, 'dir1') ++ os.mkdir(dir1) ++ def test(target, target_is_directory): ++ d1 = self.do_create(recurse=0) ++ symlink = os.path.join(d1.name, 'symlink') ++ os.symlink(target, symlink, ++ target_is_directory=target_is_directory) ++ try: ++ os.chflags(symlink, flags, follow_symlinks=False) ++ except NotImplementedError: ++ pass ++ try: ++ os.chflags(symlink, flags) ++ except FileNotFoundError: ++ pass ++ os.chflags(d1.name, flags) ++ d1.cleanup() ++ self.assertFalse(os.path.exists(d1.name)) ++ ++ with self.subTest('nonexisting file'): ++ test('nonexisting', target_is_directory=False) ++ with self.subTest('nonexisting dir'): ++ test('nonexisting', target_is_directory=True) ++ ++ with self.subTest('existing file'): ++ os.chflags(file1, flags) ++ old_flags = os.stat(file1).st_flags ++ test(file1, target_is_directory=False) ++ new_flags = os.stat(file1).st_flags ++ self.assertEqual(new_flags, old_flags) ++ ++ with self.subTest('existing dir'): ++ os.chflags(dir1, flags) ++ old_flags = os.stat(dir1).st_flags ++ test(dir1, target_is_directory=True) ++ new_flags = os.stat(dir1).st_flags ++ self.assertEqual(new_flags, old_flags) ++ + @support.cpython_only + def test_del_on_collection(self): + # A TemporaryDirectory is deleted when garbage collected +@@ -1385,7 +1488,7 @@ class TestTemporaryDirectory(BaseTestCase): + + tmp2 = os.path.join(tmp.name, 'test_dir') + os.mkdir(tmp2) +- with open(os.path.join(tmp2, "test.txt"), "w") as f: ++ with open(os.path.join(tmp2, "test0.txt"), "w") as f: + f.write("Hello world!") + + {mod}.tmp = tmp +@@ -1453,6 +1556,51 @@ class TestTemporaryDirectory(BaseTestCase): + self.assertEqual(name, d.name) + self.assertFalse(os.path.exists(name)) + ++ def test_modes(self): ++ for mode in range(8): ++ mode <<= 6 ++ with self.subTest(mode=format(mode, '03o')): ++ d = self.do_create(recurse=3, dirs=2, files=2) ++ with d: ++ # Change files and directories mode recursively. ++ for root, dirs, files in os.walk(d.name, topdown=False): ++ for name in files: ++ os.chmod(os.path.join(root, name), mode) ++ os.chmod(root, mode) ++ d.cleanup() ++ self.assertFalse(os.path.exists(d.name)) ++ ++ def check_flags(self, flags): ++ # skip the test if these flags are not supported (ex: FreeBSD 13) ++ filename = support.TESTFN ++ try: ++ open(filename, "w").close() ++ try: ++ os.chflags(filename, flags) ++ except OSError as exc: ++ # "OSError: [Errno 45] Operation not supported" ++ self.skipTest(f"chflags() doesn't support flags " ++ f"{flags:#b}: {exc}") ++ else: ++ os.chflags(filename, 0) ++ finally: ++ support.unlink(filename) ++ ++ @unittest.skipUnless(hasattr(os, 'chflags'), 'requires os.lchflags') ++ def test_flags(self): ++ flags = stat.UF_IMMUTABLE | stat.UF_NOUNLINK ++ self.check_flags(flags) ++ ++ d = self.do_create(recurse=3, dirs=2, files=2) ++ with d: ++ # Change files and directories flags recursively. ++ for root, dirs, files in os.walk(d.name, topdown=False): ++ for name in files: ++ os.chflags(os.path.join(root, name), flags) ++ os.chflags(root, flags) ++ d.cleanup() ++ self.assertFalse(os.path.exists(d.name)) ++ + + if __name__ == "__main__": + unittest.main() +-- +2.44.0 + diff --git a/00427-CVE-2024-0450.patch b/00427-CVE-2024-0450.patch new file mode 100644 index 0000000..e9aad8d --- /dev/null +++ b/00427-CVE-2024-0450.patch @@ -0,0 +1,346 @@ +From 066df4fd454d6ff9be66e80b2a65995b10af174f Mon Sep 17 00:00:00 2001 +From: John Jolly +Date: Tue, 30 Jan 2018 01:51:35 -0700 +Subject: [PATCH] bpo-22908: Add seek and tell functionality to ZipExtFile + (GH-4966) + +This allows for nested zip files, tar files within zip files, zip files within tar files, etc. + +Contributed by: John Jolly +--- + Doc/library/zipfile.rst | 6 +- + Lib/test/test_zipfile.py | 34 ++++++++ + Lib/zipfile.py | 82 +++++++++++++++++++ + .../2017-12-21-22-00-11.bpo-22908.cVm89I.rst | 2 + + 4 files changed, 121 insertions(+), 3 deletions(-) + create mode 100644 Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst + +diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst +index d58efe0b417516..7c9a8c80225491 100644 +--- a/Doc/library/zipfile.rst ++++ b/Doc/library/zipfile.rst +@@ -246,9 +246,9 @@ ZipFile Objects + With *mode* ``'r'`` the file-like object + (``ZipExtFile``) is read-only and provides the following methods: + :meth:`~io.BufferedIOBase.read`, :meth:`~io.IOBase.readline`, +- :meth:`~io.IOBase.readlines`, :meth:`__iter__`, +- :meth:`~iterator.__next__`. These objects can operate independently of +- the ZipFile. ++ :meth:`~io.IOBase.readlines`, :meth:`~io.IOBase.seek`, ++ :meth:`~io.IOBase.tell`, :meth:`__iter__`, :meth:`~iterator.__next__`. ++ These objects can operate independently of the ZipFile. + + With ``mode='w'``, a writable file handle is returned, which supports the + :meth:`~io.BufferedIOBase.write` method. While a writable file handle is open, +diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py +index 94db858a1517c4..61c3e349a69ef4 100644 +--- a/Lib/test/test_zipfile.py ++++ b/Lib/test/test_zipfile.py +@@ -1628,6 +1628,40 @@ def test_open_conflicting_handles(self): + self.assertEqual(zipf.read('baz'), msg3) + self.assertEqual(zipf.namelist(), ['foo', 'bar', 'baz']) + ++ def test_seek_tell(self): ++ # Test seek functionality ++ txt = b"Where's Bruce?" ++ bloc = txt.find(b"Bruce") ++ # Check seek on a file ++ with zipfile.ZipFile(TESTFN, "w") as zipf: ++ zipf.writestr("foo.txt", txt) ++ with zipfile.ZipFile(TESTFN, "r") as zipf: ++ with zipf.open("foo.txt", "r") as fp: ++ fp.seek(bloc, os.SEEK_SET) ++ self.assertEqual(fp.tell(), bloc) ++ fp.seek(-bloc, os.SEEK_CUR) ++ self.assertEqual(fp.tell(), 0) ++ fp.seek(bloc, os.SEEK_CUR) ++ self.assertEqual(fp.tell(), bloc) ++ self.assertEqual(fp.read(5), txt[bloc:bloc+5]) ++ fp.seek(0, os.SEEK_END) ++ self.assertEqual(fp.tell(), len(txt)) ++ # Check seek on memory file ++ data = io.BytesIO() ++ with zipfile.ZipFile(data, mode="w") as zipf: ++ zipf.writestr("foo.txt", txt) ++ with zipfile.ZipFile(data, mode="r") as zipf: ++ with zipf.open("foo.txt", "r") as fp: ++ fp.seek(bloc, os.SEEK_SET) ++ self.assertEqual(fp.tell(), bloc) ++ fp.seek(-bloc, os.SEEK_CUR) ++ self.assertEqual(fp.tell(), 0) ++ fp.seek(bloc, os.SEEK_CUR) ++ self.assertEqual(fp.tell(), bloc) ++ self.assertEqual(fp.read(5), txt[bloc:bloc+5]) ++ fp.seek(0, os.SEEK_END) ++ self.assertEqual(fp.tell(), len(txt)) ++ + def tearDown(self): + unlink(TESTFN) + unlink(TESTFN2) +diff --git a/Lib/zipfile.py b/Lib/zipfile.py +index f9db45f58a2bde..5df7b1bf75b9d9 100644 +--- a/Lib/zipfile.py ++++ b/Lib/zipfile.py +@@ -696,6 +696,18 @@ def __init__(self, file, pos, close, lock, writing): + self._close = close + self._lock = lock + self._writing = writing ++ self.seekable = file.seekable ++ self.tell = file.tell ++ ++ def seek(self, offset, whence=0): ++ with self._lock: ++ if self.writing(): ++ raise ValueError("Can't reposition in the ZIP file while " ++ "there is an open writing handle on it. " ++ "Close the writing handle before trying to read.") ++ self._file.seek(self._pos) ++ self._pos = self._file.tell() ++ return self._pos + + def read(self, n=-1): + with self._lock: +@@ -746,6 +758,9 @@ class ZipExtFile(io.BufferedIOBase): + # Read from compressed files in 4k blocks. + MIN_READ_SIZE = 4096 + ++ # Chunk size to read during seek ++ MAX_SEEK_READ = 1 << 24 ++ + def __init__(self, fileobj, mode, zipinfo, decrypter=None, + close_fileobj=False): + self._fileobj = fileobj +@@ -778,6 +793,17 @@ def __init__(self, fileobj, mode, zipinfo, decrypter=None, + else: + self._expected_crc = None + ++ self._seekable = False ++ try: ++ if fileobj.seekable(): ++ self._orig_compress_start = fileobj.tell() ++ self._orig_compress_size = zipinfo.compress_size ++ self._orig_file_size = zipinfo.file_size ++ self._orig_start_crc = self._running_crc ++ self._seekable = True ++ except AttributeError: ++ pass ++ + def __repr__(self): + result = ['<%s.%s' % (self.__class__.__module__, + self.__class__.__qualname__)] +@@ -963,6 +989,62 @@ def close(self): + finally: + super().close() + ++ def seekable(self): ++ return self._seekable ++ ++ def seek(self, offset, whence=0): ++ if not self._seekable: ++ raise io.UnsupportedOperation("underlying stream is not seekable") ++ curr_pos = self.tell() ++ if whence == 0: # Seek from start of file ++ new_pos = offset ++ elif whence == 1: # Seek from current position ++ new_pos = curr_pos + offset ++ elif whence == 2: # Seek from EOF ++ new_pos = self._orig_file_size + offset ++ else: ++ raise ValueError("whence must be os.SEEK_SET (0), " ++ "os.SEEK_CUR (1), or os.SEEK_END (2)") ++ ++ if new_pos > self._orig_file_size: ++ new_pos = self._orig_file_size ++ ++ if new_pos < 0: ++ new_pos = 0 ++ ++ read_offset = new_pos - curr_pos ++ buff_offset = read_offset + self._offset ++ ++ if buff_offset >= 0 and buff_offset < len(self._readbuffer): ++ # Just move the _offset index if the new position is in the _readbuffer ++ self._offset = buff_offset ++ read_offset = 0 ++ elif read_offset < 0: ++ # Position is before the current position. Reset the ZipExtFile ++ ++ self._fileobj.seek(self._orig_compress_start) ++ self._running_crc = self._orig_start_crc ++ self._compress_left = self._orig_compress_size ++ self._left = self._orig_file_size ++ self._readbuffer = b'' ++ self._offset = 0 ++ self._decompressor = zipfile._get_decompressor(self._compress_type) ++ self._eof = False ++ read_offset = new_pos ++ ++ while read_offset > 0: ++ read_len = min(self.MAX_SEEK_READ, read_offset) ++ self.read(read_len) ++ read_offset -= read_len ++ ++ return self.tell() ++ ++ def tell(self): ++ if not self._seekable: ++ raise io.UnsupportedOperation("underlying stream is not seekable") ++ filepos = self._orig_file_size - self._left - len(self._readbuffer) + self._offset ++ return filepos ++ + + class _ZipWriteFile(io.BufferedIOBase): + def __init__(self, zf, zinfo, zip64): +diff --git a/Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst b/Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst +new file mode 100644 +index 00000000000000..4f3cc0166019f1 +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst +@@ -0,0 +1,2 @@ ++Added seek and tell to the ZipExtFile class. This only works if the file ++object used to open the zipfile is seekable. + + +From 55beb125db2942b5362454e05542e9661e964a65 Mon Sep 17 00:00:00 2001 +From: Serhiy Storchaka +Date: Tue, 23 Apr 2024 14:29:31 +0200 +Subject: [PATCH] gh-109858: Protect zipfile from "quoted-overlap" zipbomb + (GH-110016) (GH-113916) + +Raise BadZipFile when try to read an entry that overlaps with other entry or +central directory. +(cherry picked from commit 66363b9a7b9fe7c99eba3a185b74c5fdbf842eba) +--- + Lib/test/test_zipfile.py | 60 +++++++++++++++++++ + Lib/zipfile.py | 12 ++++ + ...-09-28-13-15-51.gh-issue-109858.43e2dg.rst | 3 + + 3 files changed, 75 insertions(+) + create mode 100644 Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst + +diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py +index 7f82586..0379909 100644 +--- a/Lib/test/test_zipfile.py ++++ b/Lib/test/test_zipfile.py +@@ -1644,6 +1644,66 @@ class OtherTests(unittest.TestCase): + fp.seek(0, os.SEEK_END) + self.assertEqual(fp.tell(), len(txt)) + ++ @requires_zlib ++ def test_full_overlap(self): ++ data = ( ++ b'PK\x03\x04\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2\x1e' ++ b'8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00a\xed' ++ b'\xc0\x81\x08\x00\x00\x00\xc00\xd6\xfbK\\d\x0b`P' ++ b'K\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2' ++ b'\x1e8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00\x00' ++ b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00aPK' ++ b'\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2\x1e' ++ b'8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00\x00\x00' ++ b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00bPK\x05' ++ b'\x06\x00\x00\x00\x00\x02\x00\x02\x00^\x00\x00\x00/\x00\x00' ++ b'\x00\x00\x00' ++ ) ++ with zipfile.ZipFile(io.BytesIO(data), 'r') as zipf: ++ self.assertEqual(zipf.namelist(), ['a', 'b']) ++ zi = zipf.getinfo('a') ++ self.assertEqual(zi.header_offset, 0) ++ self.assertEqual(zi.compress_size, 16) ++ self.assertEqual(zi.file_size, 1033) ++ zi = zipf.getinfo('b') ++ self.assertEqual(zi.header_offset, 0) ++ self.assertEqual(zi.compress_size, 16) ++ self.assertEqual(zi.file_size, 1033) ++ self.assertEqual(len(zipf.read('a')), 1033) ++ with self.assertRaisesRegex(zipfile.BadZipFile, 'File name.*differ'): ++ zipf.read('b') ++ ++ @requires_zlib ++ def test_quoted_overlap(self): ++ data = ( ++ b'PK\x03\x04\x14\x00\x00\x00\x08\x00\xa0lH\x05Y\xfc' ++ b'8\x044\x00\x00\x00(\x04\x00\x00\x01\x00\x00\x00a\x00' ++ b'\x1f\x00\xe0\xffPK\x03\x04\x14\x00\x00\x00\x08\x00\xa0l' ++ b'H\x05\xe2\x1e8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00' ++ b'\x00\x00b\xed\xc0\x81\x08\x00\x00\x00\xc00\xd6\xfbK\\' ++ b'd\x0b`PK\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0' ++ b'lH\x05Y\xfc8\x044\x00\x00\x00(\x04\x00\x00\x01' ++ b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' ++ b'\x00aPK\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0l' ++ b'H\x05\xe2\x1e8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00' ++ b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\x00\x00\x00' ++ b'bPK\x05\x06\x00\x00\x00\x00\x02\x00\x02\x00^\x00\x00' ++ b'\x00S\x00\x00\x00\x00\x00' ++ ) ++ with zipfile.ZipFile(io.BytesIO(data), 'r') as zipf: ++ self.assertEqual(zipf.namelist(), ['a', 'b']) ++ zi = zipf.getinfo('a') ++ self.assertEqual(zi.header_offset, 0) ++ self.assertEqual(zi.compress_size, 52) ++ self.assertEqual(zi.file_size, 1064) ++ zi = zipf.getinfo('b') ++ self.assertEqual(zi.header_offset, 36) ++ self.assertEqual(zi.compress_size, 16) ++ self.assertEqual(zi.file_size, 1033) ++ with self.assertRaisesRegex(zipfile.BadZipFile, 'Overlapped entries'): ++ zipf.read('a') ++ self.assertEqual(len(zipf.read('b')), 1033) ++ + def tearDown(self): + unlink(TESTFN) + unlink(TESTFN2) +diff --git a/Lib/zipfile.py b/Lib/zipfile.py +index 0ab9fac..e6d7676 100644 +--- a/Lib/zipfile.py ++++ b/Lib/zipfile.py +@@ -338,6 +338,7 @@ class ZipInfo (object): + 'compress_size', + 'file_size', + '_raw_time', ++ '_end_offset', + ) + + def __init__(self, filename="NoName", date_time=(1980,1,1,0,0,0)): +@@ -376,6 +377,7 @@ class ZipInfo (object): + self.volume = 0 # Volume number of file header + self.internal_attr = 0 # Internal attributes + self.external_attr = 0 # External file attributes ++ self._end_offset = None # Start of the next local header or central directory + # Other attributes are set by class ZipFile: + # header_offset Byte offset to the file header + # CRC CRC-32 of the uncompressed file +@@ -1346,6 +1348,12 @@ class ZipFile: + if self.debug > 2: + print("total", total) + ++ end_offset = self.start_dir ++ for zinfo in sorted(self.filelist, ++ key=lambda zinfo: zinfo.header_offset, ++ reverse=True): ++ zinfo._end_offset = end_offset ++ end_offset = zinfo.header_offset + + def namelist(self): + """Return a list of file names in the archive.""" +@@ -1500,6 +1508,10 @@ class ZipFile: + 'File name in directory %r and header %r differ.' + % (zinfo.orig_filename, fname)) + ++ if (zinfo._end_offset is not None and ++ zef_file.tell() + zinfo.compress_size > zinfo._end_offset): ++ raise BadZipFile(f"Overlapped entries: {zinfo.orig_filename!r} (possible zip bomb)") ++ + # check for encrypted flag & handle password + is_encrypted = zinfo.flag_bits & 0x1 + zd = None +diff --git a/Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst b/Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst +new file mode 100644 +index 0000000..be279ca +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst +@@ -0,0 +1,3 @@ ++Protect :mod:`zipfile` from "quoted-overlap" zipbomb. It now raises ++BadZipFile when try to read an entry that overlaps with other entry or ++central directory. +-- +2.44.0 + diff --git a/1001-python3-anolis-add-loongarch.patch b/1001-python3-anolis-add-loongarch.patch deleted file mode 100644 index 3a1e801..0000000 --- a/1001-python3-anolis-add-loongarch.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Nurp Python-3.6.8.orig/configure.ac Python-3.6.8/configure.ac ---- Python-3.6.8.orig/configure.ac 2021-01-07 07:03:34.660156250 +0000 -+++ Python-3.6.8/configure.ac 2021-01-07 07:04:44.785156250 +0000 -@@ -824,6 +824,8 @@ cat >> conftest.c < -Date: Wed, 14 Aug 2019 23:35:27 +0200 -Subject: [PATCH] bpo-21131: Fix faulthandler.register(chain=True) stack - (GH-15276) - -faulthandler now allocates a dedicated stack of SIGSTKSZ*2 bytes, -instead of just SIGSTKSZ bytes. Calling the previous signal handler -in faulthandler signal handler uses more than SIGSTKSZ bytes of stack -memory on some platforms. ---- - .../next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst | 4 ++++ - Modules/faulthandler.c | 6 +++++- - 2 files changed, 9 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst - -diff --git a/Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst b/Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst -new file mode 100644 -index 000000000000..d330aca1c17d ---- /dev/null -+++ b/Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst -@@ -0,0 +1,4 @@ -+Fix ``faulthandler.register(chain=True)`` stack. faulthandler now allocates a -+dedicated stack of ``SIGSTKSZ*2`` bytes, instead of just ``SIGSTKSZ`` bytes. -+Calling the previous signal handler in faulthandler signal handler uses more -+than ``SIGSTKSZ`` bytes of stack memory on some platforms. -diff --git a/Modules/faulthandler.c b/Modules/faulthandler.c -index 2331051f7907..5dbbcad057e6 100644 ---- a/Modules/faulthandler.c -+++ b/Modules/faulthandler.c -@@ -1325,7 +1325,11 @@ _PyFaulthandler_Init(int enable) - * be able to allocate memory on the stack, even on a stack overflow. If it - * fails, ignore the error. */ - stack.ss_flags = 0; -- stack.ss_size = SIGSTKSZ; -+ /* bpo-21131: allocate dedicated stack of SIGSTKSZ*2 bytes, instead of just -+ SIGSTKSZ bytes. Calling the previous signal handler in faulthandler -+ signal handler uses more than SIGSTKSZ bytes of stack memory on some -+ platforms. */ -+ stack.ss_size = SIGSTKSZ * 2; - stack.ss_sp = PyMem_Malloc(stack.ss_size); - if (stack.ss_sp != NULL) { - err = sigaltstack(&stack, &old_stack); diff --git a/1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch b/1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch deleted file mode 100644 index 2b3cd0d..0000000 --- a/1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 52b9fb9288eaec8d1b9eaa756c4079ed7e5baf5f Mon Sep 17 00:00:00 2001 -From: Liwei Ge -Date: Wed, 28 Sep 2022 17:50:16 +0800 -Subject: [PATCH] ctypes: pass by value for structs on loongarch64 - ---- - Lib/test/test_sysconfig.py | 2 +- - Modules/_ctypes/callproc.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py -index 90e6719..384fe39 100644 ---- a/Lib/test/test_sysconfig.py -+++ b/Lib/test/test_sysconfig.py -@@ -407,7 +407,7 @@ class TestSysConfig(unittest.TestCase): - import platform, re - machine = platform.machine() - suffix = sysconfig.get_config_var('EXT_SUFFIX') -- if re.match('(aarch64|arm|mips|ppc|powerpc|s390|sparc)', machine): -+ if re.match('(aarch64|arm|loongarch64|mips|ppc|powerpc|s390|sparc)', machine): - self.assertTrue('linux' in suffix, suffix) - if re.match('(i[3-6]86|x86_64)$', machine): - if ctypes.sizeof(ctypes.c_char_p()) == 4: -diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c -index 2bb289b..7b3577f 100644 ---- a/Modules/_ctypes/callproc.c -+++ b/Modules/_ctypes/callproc.c -@@ -1050,7 +1050,7 @@ GetComError(HRESULT errcode, GUID *riid, IUnknown *pIunk) - #endif - - #if (defined(__x86_64__) && (defined(__MINGW64__) || defined(__CYGWIN__))) || \ -- defined(__aarch64__) -+ defined(__aarch64__) || defined(__loongarch__) - #define CTYPES_PASS_BY_REF_HACK - #define POW2(x) (((x & ~(x - 1)) == x) ? x : 0) - #define IS_PASS_BY_REF(x) (x > 8 || !POW2(x)) --- -2.27.0 - diff --git a/Python-3.6.8-sw.patch b/Python-3.6.8-sw.patch deleted file mode 100644 index 1925652..0000000 --- a/Python-3.6.8-sw.patch +++ /dev/null @@ -1,45 +0,0 @@ -diff -Naur Python-3.6.8.org/configure.ac Python-3.6.8.sw/configure.ac ---- Python-3.6.8.org/configure.ac 2023-05-17 15:31:40.509671581 +0800 -+++ Python-3.6.8.sw/configure.ac 2023-05-17 15:33:36.428751614 +0800 -@@ -784,6 +784,8 @@ - # else - aarch64_be-linux-gnu - # endif -+# elif defined(__sw_64__) -+ sw_64-linux-gnu - # elif defined(__alpha__) - alpha-linux-gnu - # elif defined(__ARM_EABI__) && defined(__ARM_PCS_VFP) -@@ -1808,7 +1810,7 @@ - # support. Without this, treatment of subnormals doesn't follow - # the standard. - case $host in -- alpha*) -+ alpha* | sw_64* ) - BASECFLAGS="$BASECFLAGS -mieee" - ;; - esac -diff -Naur Python-3.6.8.org/Lib/test/test_sysconfig.py Python-3.6.8.sw/Lib/test/test_sysconfig.py ---- Python-3.6.8.org/Lib/test/test_sysconfig.py 2023-05-17 15:31:40.495671088 +0800 -+++ Python-3.6.8.sw/Lib/test/test_sysconfig.py 2023-05-17 15:34:19.362262761 +0800 -@@ -407,7 +407,7 @@ - import platform, re - machine = platform.machine() - suffix = sysconfig.get_config_var('EXT_SUFFIX') -- if re.match('(aarch64|arm|loongarch64|mips|ppc|powerpc|s390|sparc)', machine): -+ if re.match('(aarch64|arm|sw_64|loongarch64|mips|ppc|powerpc|s390|sparc)', machine): - self.assertTrue('linux' in suffix, suffix) - if re.match('(i[3-6]86|x86_64)$', machine): - if ctypes.sizeof(ctypes.c_char_p()) == 4: -diff -Naur Python-3.6.8.org/Modules/_ctypes/callproc.c Python-3.6.8.sw/Modules/_ctypes/callproc.c ---- Python-3.6.8.org/Modules/_ctypes/callproc.c 2023-05-17 15:31:40.495671088 +0800 -+++ Python-3.6.8.sw/Modules/_ctypes/callproc.c 2023-05-17 15:37:29.182943941 +0800 -@@ -1050,7 +1050,7 @@ - #endif - - #if (defined(__x86_64__) && (defined(__MINGW64__) || defined(__CYGWIN__))) || \ -- defined(__aarch64__) || defined(__loongarch__) -+ defined(__aarch64__) || defined(__loongarch__) || defined(__sw_64__) - #define CTYPES_PASS_BY_REF_HACK - #define POW2(x) (((x & ~(x - 1)) == x) ? x : 0) - #define IS_PASS_BY_REF(x) (x > 8 || !POW2(x)) diff --git a/add-anolis-platform.patch b/add-anolis-platform.patch deleted file mode 100644 index 9952007..0000000 --- a/add-anolis-platform.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Nur Python-3.6.8/Lib/platform.py Python-3.6.8.new/Lib/platform.py ---- Python-3.6.8/Lib/platform.py 2018-12-24 05:37:14.000000000 +0800 -+++ Python-3.6.8.new/Lib/platform.py 2020-11-26 11:18:27.345369745 +0800 -@@ -297,7 +297,7 @@ - # and http://www.die.net/doc/linux/man/man1/lsb_release.1.html - - _supported_dists = ( -- 'SuSE', 'debian', 'fedora', 'redhat', 'centos', -+ 'SuSE', 'debian', 'fedora', 'redhat', 'centos', 'anolis', - 'mandrake', 'mandriva', 'rocks', 'slackware', 'yellowdog', 'gentoo', - 'UnitedLinux', 'turbolinux', 'arch', 'mageia') - diff --git a/dist b/dist new file mode 100644 index 0000000..1fe92cf --- /dev/null +++ b/dist @@ -0,0 +1 @@ +an8_10 diff --git a/python3.spec b/python3.spec index 1fa0ca8..0f87e57 100644 --- a/python3.spec +++ b/python3.spec @@ -1,4 +1,3 @@ -%define anolis_release .0.2 # ================== # Top-level metadata # ================== @@ -15,7 +14,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well Version: %{pybasever}.8 -Release: 56%{anolis_release}%{?dist}.1 +Release: 62%{?dist} License: Python @@ -168,15 +167,11 @@ License: Python # need different filenames. Use "64" or "32" according to the word size. # Currently, the best way to determine an architecture's word size happens to # be checking %%{_lib}. -%ifnarch sw_64 %if "%{_lib}" == "lib64" %global wordsize 64 %else %global wordsize 32 %endif -%else -%global wordsize 64 -%endif # %ifnarch sw_64 # ======================= @@ -770,6 +765,19 @@ Patch387: 00387-cve-2020-10735-prevent-dos-by-very-large-int.patch # the behavior to linear. Patch394: 00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch +# 00397 # +# Add filters for tarfile extraction (CVE-2007-4559, PEP-706) +# The first patches in the file backport the upstream fix: +# - https://github.com/python/cpython/pull/104583 +# (see the linked issue for merged backports) +# Next-to-last patch fixes determination of symlink targets, which were treated +# as relative to the root of the archive, +# rather than the directory containing the symlink. +# Not yet upstream as of this writing. +# The last patch is Red Hat configuration, see KB for documentation: +# - https://access.redhat.com/articles/7004769 +Patch397: 00397-tarfile-filter.patch + # 00399 # # CVE-2023-24329 # @@ -809,6 +817,63 @@ Patch408: 00408-CVE-2022-48560.patch # Resolved upstream: https://github.com/python/cpython/commit/a63234c49b2fbfb6f0aca32525e525ce3d43b2b4 Patch413: 00413-CVE-2022-48564.patch +# 00414 # +# +# Skip test_pair() and test_speech128() of test_zlib on s390x since +# they fail if zlib uses the s390x hardware accelerator. +Patch414: 00414-skip_test_zlib_s390x.patch + +# 00415 # +# [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (#111116) +# +# Detect email address parsing errors and return empty tuple to +# indicate the parsing error (old API). Add an optional 'strict' +# parameter to getaddresses() and parseaddr() functions. Patch by +# Thomas Dwyer. +# +# Upstream PR: https://github.com/python/cpython/pull/111116 +# +# Second patch implmenets the possibility to restore the old behavior via +# config file or environment variable. +Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch + +# 00422 # +# gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 +# +# Feeding the parser by too small chunks defers parsing to prevent +# CVE-2023-52425. Future versions of Expat may be more reactive. +# +# Patch rebased because the CVE fix is backported to older expat in RHEL. +Patch422: 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch + +# 426 # +# CVE-2023-6597 +# +# Path traversal on tempfile.TemporaryDirectory +# +# Upstream: https://github.com/python/cpython/issues/91133 +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-6597 +# +# To backport the fix cleanly the patch contains also this rebased commit: +# Fix permission errors in TemporaryDirectory cleanup +# https://github.com/python/cpython/commit/e9b51c0ad81da1da11ae65840ac8b50a8521373c +Patch426: 00426-CVE-2023-6597.patch + +# 427 # +# CVE-2024-0450 +# +# The zipfile module is vulnerable to zip-bombs leading to denial of service. +# +# Upstream: https://github.com/python/cpython/issues/109858 +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-0450 +# +# To backport the fix cleanly also this change is backported: +# Add seek and tell functionality to ZipExtFile +# https://github.com/python/cpython/commit/066df4fd454d6ff9be66e80b2a65995b10af174f +# +# Patch rebased from 3.8. +Patch427: 00427-CVE-2024-0450.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -818,17 +883,6 @@ Patch413: 00413-CVE-2022-48564.patch # # https://fedoraproject.org/wiki/SIGs/Python/PythonPatches -# add anolis platform dist -Patch1000: add-anolis-platform.patch - -Patch1001: 1001-python3-anolis-add-loongarch.patch -Patch1002: 1002-fix-faulthandler_register-stack.patch -Patch1003: 1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch -# https://github.com/python/cpython/commit/79e63e528795c700a8bd198c15f3322ee25ea786 -Patch1004: 1004-backport-CVE-2007-4559.patch -# https://github.com/python/cpython/commit/4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 -Patch1005: 1005-backport-CVE-2023-27043.patch -Patch10000: Python-3.6.8-sw.patch # ========================================== # Descriptions, and metadata for subpackages @@ -1034,6 +1088,7 @@ configuration, browsers, and other dialogs. %package tkinter Summary: A GUI toolkit for Python Requires: platform-python = %{version}-%{release} +Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description tkinter The Tkinter (Tk interface) library is a graphical user interface toolkit for @@ -1165,18 +1220,16 @@ git apply %{PATCH351} %patch386 -p1 %patch387 -p1 %patch394 -p1 +%patch397 -p1 %patch399 -p1 %patch404 -p1 %patch408 -p1 %patch413 -p1 - -%patch1000 -p1 -%patch1001 -p1 -%patch1002 -p1 -%patch1003 -p1 -%patch1004 -p1 -%patch1005 -p1 -%patch10000 -p1 +%patch414 -p1 +%patch415 -p1 +%patch422 -p1 +%patch426 -p1 +%patch427 -p1 # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) @@ -2108,34 +2161,52 @@ fi # ====================================================== %changelog -* Mon Mar 25 2024 wxiat - 3.6.8-56.0.2.1 -- cherry-pick `add sw patch #1182efa2f05c5804a55d35d45a9d72f97b64a9b2`. -- cherry-pick `sw use python of wordsize 64 #862dabb407d3f98c64f3a9d2675fcd3a6300a21f`. +* Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 +- Security fix for CVE-2024-0450 +Resolves: RHEL-33683 + +* Wed Apr 24 2024 Lumír Balhar - 3.6.8-61 +- Security fix for CVE-2023-6597 +Resolves: RHEL-33671 -* Mon Jan 22 2024 Bo Liu - 3.6.8-56.0.1.1 +* Wed Apr 24 2024 Lumír Balhar - 3.6.8-60 +- Fix build with expat with fixed CVE-2023-52425 +Related: RHEL-33671 + +* Thu Jan 04 2024 Lumír Balhar - 3.6.8-59 - Security fix for CVE-2023-27043 +Resolves: RHEL-20610 -* Wed Jan 17 2024 Kaiqiang Wang - 3.6.8-55.0.1.1 +* Tue Dec 12 2023 Lumír Balhar - 3.6.8-58 - Security fix for CVE-2022-48564 +Resolves: RHEL-16674 +- Skip tests failing on s390x +Resolves: RHEL-19252 -* Wed Jan 17 2024 Kaiqiang Wang - 3.6.8-54.0.1.1 +* Thu Nov 23 2023 Lumír Balhar - 3.6.8-57 - Security fix for CVE-2022-48560 +Resolves: RHEL-16707 -* Tue Jan 09 2024 hezhongkun - 3.6.8-53.0.1.1 -- Fix CVE-2023-40217: Check for & avoid the ssl +* Thu Sep 07 2023 Charalampos Stratakis - 3.6.8-56 +- Security fix for CVE-2023-40217 +Resolves: RHEL-3041 -* Mon Jan 8 2024 sunxinpeng -3.6.8-52.0.1.1 -- repair security fix for CVE-2007-4559 +* Wed Aug 09 2023 Petr Viktorin - 3.6.8-55 +- Fix symlink handling in the fix for CVE-2007-4559 +Resolves: rhbz#263261 -* Thu Jun 15 2023 zhangbinchen - 3.6.8-51.0.1.1 -- Add Anolis platform cherry-pick [9a96461] -- Support Loongarch for python3 -- Fix testcase fails on loongarch64 +* Fri Jul 07 2023 Charalampos Stratakis - 3.6.8-54 +- Bump release for rebuild +Resolves: rhbz#2173917 -* Wed May 31 2023 Charalampos Stratakis - 3.6.8-51.1 +* Fri Jun 30 2023 Charalampos Stratakis - 3.6.8-53 - Security fix for CVE-2023-24329 Resolves: rhbz#2173917 +* Tue Jun 06 2023 Petr Viktorin - 3.6.8-52 +- Add filters for tarfile extraction (CVE-2007-4559, PEP-706) +Resolves: rhbz#263261 + * Tue Jan 24 2023 Charalampos Stratakis - 3.6.8-51 - Properly strip the LTO bytecode from python.o Resolves: rhbz#2137707 -- Gitee From 4d5e406a4313f333ca98bfb7372c45e36cd9987a Mon Sep 17 00:00:00 2001 From: songmingliang Date: Fri, 22 Apr 2022 14:46:55 +0800 Subject: [PATCH 02/10] rebrand: add anolis platform distribution --- add-anolis-platform.patch | 12 ++++++++++++ python3.spec | 10 +++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 add-anolis-platform.patch diff --git a/add-anolis-platform.patch b/add-anolis-platform.patch new file mode 100644 index 0000000..9952007 --- /dev/null +++ b/add-anolis-platform.patch @@ -0,0 +1,12 @@ +diff -Nur Python-3.6.8/Lib/platform.py Python-3.6.8.new/Lib/platform.py +--- Python-3.6.8/Lib/platform.py 2018-12-24 05:37:14.000000000 +0800 ++++ Python-3.6.8.new/Lib/platform.py 2020-11-26 11:18:27.345369745 +0800 +@@ -297,7 +297,7 @@ + # and http://www.die.net/doc/linux/man/man1/lsb_release.1.html + + _supported_dists = ( +- 'SuSE', 'debian', 'fedora', 'redhat', 'centos', ++ 'SuSE', 'debian', 'fedora', 'redhat', 'centos', 'anolis', + 'mandrake', 'mandriva', 'rocks', 'slackware', 'yellowdog', 'gentoo', + 'UnitedLinux', 'turbolinux', 'arch', 'mageia') + diff --git a/python3.spec b/python3.spec index 0f87e57..1385959 100644 --- a/python3.spec +++ b/python3.spec @@ -1,3 +1,4 @@ +%define anolis_release .0.1 # ================== # Top-level metadata # ================== @@ -14,7 +15,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well Version: %{pybasever}.8 -Release: 62%{?dist} +Release: 62%{anolis_release}%{?dist} License: Python @@ -883,6 +884,8 @@ Patch427: 00427-CVE-2024-0450.patch # # https://fedoraproject.org/wiki/SIGs/Python/PythonPatches +# add anolis platform dist +Patch1000: add-anolis-platform.patch # ========================================== # Descriptions, and metadata for subpackages @@ -1231,6 +1234,8 @@ git apply %{PATCH351} %patch426 -p1 %patch427 -p1 +%patch1000 -p1 + # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) rm configure pyconfig.h.in @@ -2161,6 +2166,9 @@ fi # ====================================================== %changelog +* Tue May 28 2024 zhangbinchen - 3.6.8-62.0.1 +- Add Anolis platform + * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 Resolves: RHEL-33683 -- Gitee From 9221f322ac8890a9315aa9e7bb6f3e2ed69a278c Mon Sep 17 00:00:00 2001 From: songmingliang Date: Thu, 5 May 2022 15:48:46 +0800 Subject: [PATCH 03/10] add loongarch support Signed-off-by: songmingliang --- 1001-python3-anolis-add-loongarch.patch | 12 ++++++++++++ python3.spec | 4 ++++ 2 files changed, 16 insertions(+) create mode 100644 1001-python3-anolis-add-loongarch.patch diff --git a/1001-python3-anolis-add-loongarch.patch b/1001-python3-anolis-add-loongarch.patch new file mode 100644 index 0000000..3a1e801 --- /dev/null +++ b/1001-python3-anolis-add-loongarch.patch @@ -0,0 +1,12 @@ +diff -Nurp Python-3.6.8.orig/configure.ac Python-3.6.8/configure.ac +--- Python-3.6.8.orig/configure.ac 2021-01-07 07:03:34.660156250 +0000 ++++ Python-3.6.8/configure.ac 2021-01-07 07:04:44.785156250 +0000 +@@ -824,6 +824,8 @@ cat >> conftest.c < - 3.6.8-62.0.1 - Add Anolis platform +- Support Loongarch for python3 (songmingliang@uniontech.com) * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee From 9b8a089fd2375e11da8b7bad97631960a636f6bd Mon Sep 17 00:00:00 2001 From: Liwei Ge Date: Wed, 28 Sep 2022 17:56:54 +0800 Subject: [PATCH 04/10] build: fix testcase failure with loongarch64 https://bugzilla.openanolis.cn/show_bug.cgi?id=2295 --- 1002-fix-faulthandler_register-stack.patch | 43 +++++++++++++++++++ ...-by-value-for-structs-on-loongarch64.patch | 39 +++++++++++++++++ python3.spec | 5 +++ 3 files changed, 87 insertions(+) create mode 100644 1002-fix-faulthandler_register-stack.patch create mode 100644 1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch diff --git a/1002-fix-faulthandler_register-stack.patch b/1002-fix-faulthandler_register-stack.patch new file mode 100644 index 0000000..13b7090 --- /dev/null +++ b/1002-fix-faulthandler_register-stack.patch @@ -0,0 +1,43 @@ +From ef158444cbe271d08d40c374316d3a2ffd6dea76 Mon Sep 17 00:00:00 2001 +From: Victor Stinner +Date: Wed, 14 Aug 2019 23:35:27 +0200 +Subject: [PATCH] bpo-21131: Fix faulthandler.register(chain=True) stack + (GH-15276) + +faulthandler now allocates a dedicated stack of SIGSTKSZ*2 bytes, +instead of just SIGSTKSZ bytes. Calling the previous signal handler +in faulthandler signal handler uses more than SIGSTKSZ bytes of stack +memory on some platforms. +--- + .../next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst | 4 ++++ + Modules/faulthandler.c | 6 +++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst + +diff --git a/Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst b/Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst +new file mode 100644 +index 000000000000..d330aca1c17d +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2019-08-14-15-34-23.bpo-21131.0MMQRi.rst +@@ -0,0 +1,4 @@ ++Fix ``faulthandler.register(chain=True)`` stack. faulthandler now allocates a ++dedicated stack of ``SIGSTKSZ*2`` bytes, instead of just ``SIGSTKSZ`` bytes. ++Calling the previous signal handler in faulthandler signal handler uses more ++than ``SIGSTKSZ`` bytes of stack memory on some platforms. +diff --git a/Modules/faulthandler.c b/Modules/faulthandler.c +index 2331051f7907..5dbbcad057e6 100644 +--- a/Modules/faulthandler.c ++++ b/Modules/faulthandler.c +@@ -1325,7 +1325,11 @@ _PyFaulthandler_Init(int enable) + * be able to allocate memory on the stack, even on a stack overflow. If it + * fails, ignore the error. */ + stack.ss_flags = 0; +- stack.ss_size = SIGSTKSZ; ++ /* bpo-21131: allocate dedicated stack of SIGSTKSZ*2 bytes, instead of just ++ SIGSTKSZ bytes. Calling the previous signal handler in faulthandler ++ signal handler uses more than SIGSTKSZ bytes of stack memory on some ++ platforms. */ ++ stack.ss_size = SIGSTKSZ * 2; + stack.ss_sp = PyMem_Malloc(stack.ss_size); + if (stack.ss_sp != NULL) { + err = sigaltstack(&stack, &old_stack); diff --git a/1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch b/1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch new file mode 100644 index 0000000..2b3cd0d --- /dev/null +++ b/1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch @@ -0,0 +1,39 @@ +From 52b9fb9288eaec8d1b9eaa756c4079ed7e5baf5f Mon Sep 17 00:00:00 2001 +From: Liwei Ge +Date: Wed, 28 Sep 2022 17:50:16 +0800 +Subject: [PATCH] ctypes: pass by value for structs on loongarch64 + +--- + Lib/test/test_sysconfig.py | 2 +- + Modules/_ctypes/callproc.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py +index 90e6719..384fe39 100644 +--- a/Lib/test/test_sysconfig.py ++++ b/Lib/test/test_sysconfig.py +@@ -407,7 +407,7 @@ class TestSysConfig(unittest.TestCase): + import platform, re + machine = platform.machine() + suffix = sysconfig.get_config_var('EXT_SUFFIX') +- if re.match('(aarch64|arm|mips|ppc|powerpc|s390|sparc)', machine): ++ if re.match('(aarch64|arm|loongarch64|mips|ppc|powerpc|s390|sparc)', machine): + self.assertTrue('linux' in suffix, suffix) + if re.match('(i[3-6]86|x86_64)$', machine): + if ctypes.sizeof(ctypes.c_char_p()) == 4: +diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c +index 2bb289b..7b3577f 100644 +--- a/Modules/_ctypes/callproc.c ++++ b/Modules/_ctypes/callproc.c +@@ -1050,7 +1050,7 @@ GetComError(HRESULT errcode, GUID *riid, IUnknown *pIunk) + #endif + + #if (defined(__x86_64__) && (defined(__MINGW64__) || defined(__CYGWIN__))) || \ +- defined(__aarch64__) ++ defined(__aarch64__) || defined(__loongarch__) + #define CTYPES_PASS_BY_REF_HACK + #define POW2(x) (((x & ~(x - 1)) == x) ? x : 0) + #define IS_PASS_BY_REF(x) (x > 8 || !POW2(x)) +-- +2.27.0 + diff --git a/python3.spec b/python3.spec index 9479c4a..aaf7b65 100644 --- a/python3.spec +++ b/python3.spec @@ -888,6 +888,8 @@ Patch427: 00427-CVE-2024-0450.patch Patch1000: add-anolis-platform.patch Patch1001: 1001-python3-anolis-add-loongarch.patch +Patch1002: 1002-fix-faulthandler_register-stack.patch +Patch1003: 1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch # ========================================== # Descriptions, and metadata for subpackages @@ -1238,6 +1240,8 @@ git apply %{PATCH351} %patch1000 -p1 %patch1001 -p1 +%patch1002 -p1 +%patch1003 -p1 # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) @@ -2172,6 +2176,7 @@ fi * Tue May 28 2024 zhangbinchen - 3.6.8-62.0.1 - Add Anolis platform - Support Loongarch for python3 (songmingliang@uniontech.com) +- Fix testcase fails on loongarch64 (geliwei@openanolis.org) * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee From e96a5b8dac06b3ea6f6fc3ff24976c5d7a8b1e85 Mon Sep 17 00:00:00 2001 From: sunxinpeng Date: Tue, 9 Jan 2024 09:39:30 +0800 Subject: [PATCH 05/10] repair security fix for CVE-2007-4559 --- python3.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/python3.spec b/python3.spec index aaf7b65..a113e14 100644 --- a/python3.spec +++ b/python3.spec @@ -2177,6 +2177,7 @@ fi - Add Anolis platform - Support Loongarch for python3 (songmingliang@uniontech.com) - Fix testcase fails on loongarch64 (geliwei@openanolis.org) +- repair security fix for CVE-2007-4559 (sunxinpeng@inspur.com) * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee From 36e99f41ece664cc5a0773ab4df2ea1f6a14d211 Mon Sep 17 00:00:00 2001 From: hezhongkun Date: Tue, 9 Jan 2024 12:45:04 +0800 Subject: [PATCH 06/10] repair security fix for CVE-2023-40217 --- python3.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/python3.spec b/python3.spec index a113e14..93a79c5 100644 --- a/python3.spec +++ b/python3.spec @@ -2178,6 +2178,7 @@ fi - Support Loongarch for python3 (songmingliang@uniontech.com) - Fix testcase fails on loongarch64 (geliwei@openanolis.org) - repair security fix for CVE-2007-4559 (sunxinpeng@inspur.com) +- Fix CVE-2023-40217: Check for & avoid the ssl (hezhongkun@inspur.com) * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee From 483e5fa68adb176b52e83c01bbc06199b6dfa7cf Mon Sep 17 00:00:00 2001 From: wangkaiqiang Date: Wed, 17 Jan 2024 15:18:57 +0800 Subject: [PATCH 07/10] Fix posible crash in heapq with custom comparison operators --- python3.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/python3.spec b/python3.spec index 93a79c5..3b5019d 100644 --- a/python3.spec +++ b/python3.spec @@ -2179,6 +2179,7 @@ fi - Fix testcase fails on loongarch64 (geliwei@openanolis.org) - repair security fix for CVE-2007-4559 (sunxinpeng@inspur.com) - Fix CVE-2023-40217: Check for & avoid the ssl (hezhongkun@inspur.com) +- Security fix for CVE-2022-48560 (wangkaiqiang@inspur.com) * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee From 3c1699319449a976427e2a46ff124745a7a435ff Mon Sep 17 00:00:00 2001 From: wangkaiqiang Date: Thu, 18 Jan 2024 11:26:13 +0800 Subject: [PATCH 08/10] fix CVE-2022-48564 --- python3.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/python3.spec b/python3.spec index 3b5019d..256218b 100644 --- a/python3.spec +++ b/python3.spec @@ -2180,6 +2180,7 @@ fi - repair security fix for CVE-2007-4559 (sunxinpeng@inspur.com) - Fix CVE-2023-40217: Check for & avoid the ssl (hezhongkun@inspur.com) - Security fix for CVE-2022-48560 (wangkaiqiang@inspur.com) +- Security fix for CVE-2022-48564 (wangkaiqiang@inspur.com) * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee From c3f4d733d5d34fedaaa1ffd00fd43c6334d3ef12 Mon Sep 17 00:00:00 2001 From: Bo Liu Date: Tue, 23 Jan 2024 07:04:21 +0800 Subject: [PATCH 09/10] fix CVE-2023-27043 Signed-off-by: Bo Liu --- python3.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/python3.spec b/python3.spec index 256218b..1fc93d8 100644 --- a/python3.spec +++ b/python3.spec @@ -2181,6 +2181,7 @@ fi - Fix CVE-2023-40217: Check for & avoid the ssl (hezhongkun@inspur.com) - Security fix for CVE-2022-48560 (wangkaiqiang@inspur.com) - Security fix for CVE-2022-48564 (wangkaiqiang@inspur.com) +- Security fix for CVE-2023-27043 (liubo03@inspur.com) * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee From 4a5318f6ba6c905af80fbebd75905a86618930a8 Mon Sep 17 00:00:00 2001 From: wxiat Date: Thu, 29 Jun 2023 16:45:50 +0800 Subject: [PATCH 10/10] cherry-pick `add sw patch #1182efa2f05c5804a55d35d45a9d72f97b64a9b2`. cherry-pick `sw use python of wordsize 64 #862dabb407d3f98c64f3a9d2675fcd3a6300a21f`. Signed-off-by: Weisson --- Python-3.6.8-sw.patch | 45 +++++++++++++++++++++++++++++++++++++++++++ python3.spec | 8 ++++++++ 2 files changed, 53 insertions(+) create mode 100644 Python-3.6.8-sw.patch diff --git a/Python-3.6.8-sw.patch b/Python-3.6.8-sw.patch new file mode 100644 index 0000000..1925652 --- /dev/null +++ b/Python-3.6.8-sw.patch @@ -0,0 +1,45 @@ +diff -Naur Python-3.6.8.org/configure.ac Python-3.6.8.sw/configure.ac +--- Python-3.6.8.org/configure.ac 2023-05-17 15:31:40.509671581 +0800 ++++ Python-3.6.8.sw/configure.ac 2023-05-17 15:33:36.428751614 +0800 +@@ -784,6 +784,8 @@ + # else + aarch64_be-linux-gnu + # endif ++# elif defined(__sw_64__) ++ sw_64-linux-gnu + # elif defined(__alpha__) + alpha-linux-gnu + # elif defined(__ARM_EABI__) && defined(__ARM_PCS_VFP) +@@ -1808,7 +1810,7 @@ + # support. Without this, treatment of subnormals doesn't follow + # the standard. + case $host in +- alpha*) ++ alpha* | sw_64* ) + BASECFLAGS="$BASECFLAGS -mieee" + ;; + esac +diff -Naur Python-3.6.8.org/Lib/test/test_sysconfig.py Python-3.6.8.sw/Lib/test/test_sysconfig.py +--- Python-3.6.8.org/Lib/test/test_sysconfig.py 2023-05-17 15:31:40.495671088 +0800 ++++ Python-3.6.8.sw/Lib/test/test_sysconfig.py 2023-05-17 15:34:19.362262761 +0800 +@@ -407,7 +407,7 @@ + import platform, re + machine = platform.machine() + suffix = sysconfig.get_config_var('EXT_SUFFIX') +- if re.match('(aarch64|arm|loongarch64|mips|ppc|powerpc|s390|sparc)', machine): ++ if re.match('(aarch64|arm|sw_64|loongarch64|mips|ppc|powerpc|s390|sparc)', machine): + self.assertTrue('linux' in suffix, suffix) + if re.match('(i[3-6]86|x86_64)$', machine): + if ctypes.sizeof(ctypes.c_char_p()) == 4: +diff -Naur Python-3.6.8.org/Modules/_ctypes/callproc.c Python-3.6.8.sw/Modules/_ctypes/callproc.c +--- Python-3.6.8.org/Modules/_ctypes/callproc.c 2023-05-17 15:31:40.495671088 +0800 ++++ Python-3.6.8.sw/Modules/_ctypes/callproc.c 2023-05-17 15:37:29.182943941 +0800 +@@ -1050,7 +1050,7 @@ + #endif + + #if (defined(__x86_64__) && (defined(__MINGW64__) || defined(__CYGWIN__))) || \ +- defined(__aarch64__) || defined(__loongarch__) ++ defined(__aarch64__) || defined(__loongarch__) || defined(__sw_64__) + #define CTYPES_PASS_BY_REF_HACK + #define POW2(x) (((x & ~(x - 1)) == x) ? x : 0) + #define IS_PASS_BY_REF(x) (x > 8 || !POW2(x)) diff --git a/python3.spec b/python3.spec index 1fc93d8..4568a43 100644 --- a/python3.spec +++ b/python3.spec @@ -168,11 +168,15 @@ License: Python # need different filenames. Use "64" or "32" according to the word size. # Currently, the best way to determine an architecture's word size happens to # be checking %%{_lib}. +%ifnarch sw_64 %if "%{_lib}" == "lib64" %global wordsize 64 %else %global wordsize 32 %endif +%else +%global wordsize 64 +%endif # %ifnarch sw_64 # ======================= @@ -890,6 +894,7 @@ Patch1000: add-anolis-platform.patch Patch1001: 1001-python3-anolis-add-loongarch.patch Patch1002: 1002-fix-faulthandler_register-stack.patch Patch1003: 1003-ctypes-pass-by-value-for-structs-on-loongarch64.patch +Patch10000: Python-3.6.8-sw.patch # ========================================== # Descriptions, and metadata for subpackages @@ -1242,6 +1247,7 @@ git apply %{PATCH351} %patch1001 -p1 %patch1002 -p1 %patch1003 -p1 +%patch10000 -p1 # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) @@ -2182,6 +2188,8 @@ fi - Security fix for CVE-2022-48560 (wangkaiqiang@inspur.com) - Security fix for CVE-2022-48564 (wangkaiqiang@inspur.com) - Security fix for CVE-2023-27043 (liubo03@inspur.com) +- cherry-pick `add sw patch #1182efa2f05c5804a55d35d45a9d72f97b64a9b2`. (Weisson@linux.alibaba.com) + cherry-pick `sw use python of wordsize 64 #862dabb407d3f98c64f3a9d2675fcd3a6300a21f`. * Wed Apr 24 2024 Lumír Balhar - 3.6.8-62 - Security fix for CVE-2024-0450 -- Gitee