From patchwork Wed Dec 3 15:12:17 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Korsgaard X-Patchwork-Id: 417471 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from silver.osuosl.org (silver.osuosl.org [140.211.166.136]) by ozlabs.org (Postfix) with ESMTP id AFD0B1400E7 for ; Thu, 4 Dec 2014 02:12:37 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id D0DAC34290; Wed, 3 Dec 2014 15:12:36 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XEYmgNKblf4Q; Wed, 3 Dec 2014 15:12:31 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by silver.osuosl.org (Postfix) with ESMTP id 2A5A1340CC; Wed, 3 Dec 2014 15:12:30 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from silver.osuosl.org (silver.osuosl.org [140.211.166.136]) by ash.osuosl.org (Postfix) with ESMTP id 565D71C1E95 for ; Wed, 3 Dec 2014 15:12:29 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 4C55D33EAF for ; Wed, 3 Dec 2014 15:12:29 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iUNS4-ydCJr9 for ; Wed, 3 Dec 2014 15:12:25 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-wi0-f180.google.com (mail-wi0-f180.google.com [209.85.212.180]) by silver.osuosl.org (Postfix) with ESMTPS id 7D23633B94 for ; Wed, 3 Dec 2014 15:12:25 +0000 (UTC) Received: by mail-wi0-f180.google.com with SMTP id n3so24723795wiv.1 for ; Wed, 03 Dec 2014 07:12:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id; bh=vaXe4wg6DJtO8/+mwWtwAxg/YzQC08hRdwJWkqnXx0c=; b=bKZqUBpIXu4RYqq7RtbsFnXzDt6Q7kvqWhtqPp3c26RAa9QYsj9HE8FoQ+V14v86vu LOeStsMoBFmcpiN/qWEssYzc2HnFYgYSiHJqN783lIVgc5Uwq9k3EOJPEVHzdkbaX9KQ +2UnmBxS5mceVe24SxDdqnLggHtxM4K3MTzIMIb4D7F2ypIhayzcjCBXqwwZticFCYAX vVEOkU3wc9JIcrrxeU2JqbCmYAYTJKaqRgaaoT3POvAaBG63waE5Dfi3Ii3Gji472Zhs ifwI5VL+J3VZnLmlCl5q7wTnGXx7M3lSrwo0BMjAJKGt6c6pPzHRBuloGNTFhojcElZu NZZw== X-Received: by 10.180.76.201 with SMTP id m9mr100423255wiw.52.1417619544093; Wed, 03 Dec 2014 07:12:24 -0800 (PST) Received: from dell.be.48ers.dk ([91.183.168.190]) by mx.google.com with ESMTPSA id eu15sm37486796wid.18.2014.12.03.07.12.22 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 03 Dec 2014 07:12:23 -0800 (PST) Received: from peko by dell.be.48ers.dk with local (Exim 4.84) (envelope-from ) id 1XwBbK-0008Aj-4i; Wed, 03 Dec 2014 16:12:22 +0100 From: Peter Korsgaard To: buildroot@uclibc.org Date: Wed, 3 Dec 2014 16:12:17 +0100 Message-Id: <1417619537-31377-1-git-send-email-peter@korsgaard.com> X-Mailer: git-send-email 2.1.3 Subject: [Buildroot] [PATCH] package: add python-pam X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" Upstream is no longer available, so get the tarball + important patches from Fedora. Signed-off-by: Peter Korsgaard --- package/Config.in | 1 + package/python-pam/0001-nofree.patch | 68 +++++++++++ .../0002-memory-errors-CVE2012-1502.patch | 136 +++++++++++++++++++++ package/python-pam/Config.in | 15 +++ package/python-pam/python-pam.mk | 16 +++ 5 files changed, 236 insertions(+) create mode 100644 package/python-pam/0001-nofree.patch create mode 100644 package/python-pam/0002-memory-errors-CVE2012-1502.patch create mode 100644 package/python-pam/Config.in create mode 100644 package/python-pam/python-pam.mk diff --git a/package/Config.in b/package/Config.in index b8fc7d1..f4f0998 100644 --- a/package/Config.in +++ b/package/Config.in @@ -511,6 +511,7 @@ menu "external python modules" source "package/python-networkmanager/Config.in" source "package/python-nfc/Config.in" source "package/python-numpy/Config.in" + source "package/python-pam/Config.in" source "package/python-posix-ipc/Config.in" source "package/python-protobuf/Config.in" source "package/python-pyasn/Config.in" diff --git a/package/python-pam/0001-nofree.patch b/package/python-pam/0001-nofree.patch new file mode 100644 index 0000000..7de8801 --- /dev/null +++ b/package/python-pam/0001-nofree.patch @@ -0,0 +1,68 @@ +[PATCH] deallocate the conversation response only in case of error + +Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679714 + +Downloaded from: +http://pkgs.fedoraproject.org/cgit/PyPAM.git/plain/PyPAM-0.5.0-nofree.patch + +Signed-off-by: Peter Korsgaard +diff --git a/PAMmodule.c b/PAMmodule.c +index 03cb799..a7ff8a5 100644 +--- a/PAMmodule.c ++++ b/PAMmodule.c +@@ -24,8 +24,6 @@ typedef struct { + char *service; + char *user; + PyObject *callback; +- struct pam_response *response_data; +- int response_len; + PyObject *user_data; + void *dlh1, *dlh2; + } PyPAMObject; +@@ -54,15 +52,6 @@ static int PyPAM_conv(int num_msg, const struct pam_message **msg, + + Py_INCREF(self); + +- if (NULL != self->response_data) { +- for (int i = 0; i < self->response_len; i++) { +- free(self->response_data[0].resp); +- } +- free(self->response_data); +- self->response_data = NULL; +- self->response_len = 0; +- } +- + PyObject* msgList = PyList_New(num_msg); + + for (int i = 0; i < num_msg; i++) { +@@ -92,6 +81,10 @@ static int PyPAM_conv(int num_msg, const struct pam_message **msg, + char* resp_text; + int resp_retcode = 0; + if (!PyArg_ParseTuple(respTuple, "si", &resp_text, &resp_retcode)) { ++ while (i > 0) { ++ free((--spr)->resp); ++ --i; ++ } + free(*resp); + Py_DECREF(respList); + return PAM_CONV_ERR; +@@ -100,10 +93,6 @@ static int PyPAM_conv(int num_msg, const struct pam_message **msg, + spr->resp_retcode = resp_retcode; + Py_DECREF(respTuple); + } +- +- // Save this so we can free it later. +- self->response_data = *resp; +- self->response_len = PyList_Size(respList); + + Py_DECREF(respList); + +@@ -144,8 +133,6 @@ static PyObject * PyPAM_pam(PyObject *self, PyObject *args) + p->user = NULL; + Py_INCREF(Py_None); + p->callback = Py_None; +- p->response_data = NULL; +- p->response_len = 0; + Py_INCREF(Py_None); + p->user_data = Py_None; + diff --git a/package/python-pam/0002-memory-errors-CVE2012-1502.patch b/package/python-pam/0002-memory-errors-CVE2012-1502.patch new file mode 100644 index 0000000..62405db --- /dev/null +++ b/package/python-pam/0002-memory-errors-CVE2012-1502.patch @@ -0,0 +1,136 @@ +[PATCH] Fix Double Free Corruption (CVE2012-1502) + +Downloaded from: +http://pkgs.fedoraproject.org/cgit/PyPAM.git/plain/PyPAM-0.5.0-memory-errors.patch + +For details, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1502 + +Signed-off-by: Peter Korsgaard +diff -up PyPAM-0.5.0/PAMmodule.c.memory PyPAM-0.5.0/PAMmodule.c +--- PyPAM-0.5.0/PAMmodule.c.memory 2012-05-07 17:22:54.503914026 +0200 ++++ PyPAM-0.5.0/PAMmodule.c 2012-05-07 17:23:15.644381942 +0200 +@@ -37,33 +37,48 @@ static void PyPAM_Err(PyPAMObject *self, + + err_msg = pam_strerror(self->pamh, result); + error = Py_BuildValue("(si)", err_msg, result); +- Py_INCREF(PyPAM_Error); + PyErr_SetObject(PyPAM_Error, error); ++ Py_XDECREF(error); + } + + static int PyPAM_conv(int num_msg, const struct pam_message **msg, + struct pam_response **resp, void *appdata_ptr) + { +- PyObject *args; +- ++ PyObject *args, *msgList, *respList, *item; ++ struct pam_response *response, *spr; + PyPAMObject* self = (PyPAMObject *) appdata_ptr; ++ + if (self->callback == NULL) + return PAM_CONV_ERR; + + Py_INCREF(self); + +- PyObject* msgList = PyList_New(num_msg); +- ++ msgList = PyList_New(num_msg); ++ if (msgList == NULL) { ++ Py_DECREF(self); ++ return PAM_CONV_ERR; ++ } ++ + for (int i = 0; i < num_msg; i++) { +- PyList_SetItem(msgList, i, +- Py_BuildValue("(si)", msg[i]->msg, msg[i]->msg_style)); ++ item = Py_BuildValue("(si)", msg[i]->msg, msg[i]->msg_style); ++ if (item == NULL) { ++ Py_DECREF(msgList); ++ Py_DECREF(self); ++ return PAM_CONV_ERR; ++ } ++ PyList_SetItem(msgList, i, item); + } +- ++ + args = Py_BuildValue("(OO)", self, msgList); +- PyObject* respList = PyEval_CallObject(self->callback, args); ++ if (args == NULL) { ++ Py_DECREF(self); ++ Py_DECREF(msgList); ++ return PAM_CONV_ERR; ++ } ++ respList = PyEval_CallObject(self->callback, args); + Py_DECREF(args); + Py_DECREF(self); +- ++ + if (respList == NULL) + return PAM_CONV_ERR; + +@@ -71,11 +86,15 @@ static int PyPAM_conv(int num_msg, const + Py_DECREF(respList); + return PAM_CONV_ERR; + } +- +- *resp = (struct pam_response *) malloc( ++ ++ response = (struct pam_response *) malloc( + PyList_Size(respList) * sizeof(struct pam_response)); ++ if (response == NULL) { ++ Py_DECREF(respList); ++ return PAM_CONV_ERR; ++ } ++ spr = response; + +- struct pam_response* spr = *resp; + for (int i = 0; i < PyList_Size(respList); i++, spr++) { + PyObject* respTuple = PyList_GetItem(respList, i); + char* resp_text; +@@ -85,7 +104,7 @@ static int PyPAM_conv(int num_msg, const + free((--spr)->resp); + --i; + } +- free(*resp); ++ free(response); + Py_DECREF(respList); + return PAM_CONV_ERR; + } +@@ -95,7 +114,8 @@ static int PyPAM_conv(int num_msg, const + } + + Py_DECREF(respList); +- ++ *resp = response; ++ + return PAM_SUCCESS; + } + +@@ -122,7 +142,11 @@ static PyObject * PyPAM_pam(PyObject *se + PyPAMObject_Type.ob_type = &PyType_Type; + p = (PyPAMObject *) PyObject_NEW(PyPAMObject, &PyPAMObject_Type); + ++ if (p == NULL) ++ return NULL; ++ + if ((spc = (struct pam_conv *) malloc(sizeof(struct pam_conv))) == NULL) { ++ Py_DECREF((PyObject *)p); + PyErr_SetString(PyExc_MemoryError, "out of memory"); + return NULL; + } +@@ -455,9 +479,15 @@ static PyObject * PyPAM_getenvlist(PyObj + } + + retval = PyList_New(0); ++ if (retval == NULL) ++ return NULL; + + while ((cp = *(result++)) != NULL) { + entry = Py_BuildValue("s", cp); ++ if (entry == NULL) { ++ Py_DECREF(retval); ++ return NULL; ++ } + PyList_Append(retval, entry); + Py_DECREF(entry); + } diff --git a/package/python-pam/Config.in b/package/python-pam/Config.in new file mode 100644 index 0000000..b2ab6c8 --- /dev/null +++ b/package/python-pam/Config.in @@ -0,0 +1,15 @@ +comment "python-pam needs a toolchain w/ wchar, locale, dynamic library" + depends on BR2_PACKAGE_PYTHON + depends on !BR2_ENABLE_LOCALE || !BR2_USE_WCHAR || BR2_PREFER_STATIC_LIB + +config BR2_PACKAGE_PYTHON_PAM + bool "python-pam" + depends on BR2_PACKAGE_PYTHON # C extension not compatible with python3 + depends on BR2_ENABLE_LOCALE # linux-pam + depends on BR2_USE_WCHAR # linux-pam + depends on !BR2_PREFER_STATIC_LIB # linux-pam + select BR2_PACKAGE_LINUX_PAM + help + PAM (Pluggable Authentication Module) bindings for Python. + + https://admin.fedoraproject.org/pkgdb/package/PyPAM/ diff --git a/package/python-pam/python-pam.mk b/package/python-pam/python-pam.mk new file mode 100644 index 0000000..1e8a593 --- /dev/null +++ b/package/python-pam/python-pam.mk @@ -0,0 +1,16 @@ +################################################################################ +# +# python-pam +# +################################################################################ + +PYTHON_PAM_VERSION = 0.5.0 +PYTHON_PAM_SOURCE = PyPAM-$(PYTHON_PAM_VERSION).tar.gz +# pangalactic.org gone +PYTHON_PAM_SITE = http://pkgs.fedoraproject.org/repo/pkgs/PyPAM/PyPAM-0.5.0.tar.gz/f1e7c2c56421dda28a75ace59a3c8871/ +PYTHON_PAM_SETUP_TYPE = distutils +PYTHON_PAM_LICENSE = LGPLv2.1 +PYTHON_PAM_LICENSE_FILES = COPYING +PYTHON_PAM_DEPENDENCIES = linux-pam + +$(eval $(python-package))