On Wed, Dec 07, 2016 at 01:55:47PM +0100, Marius Bakke wrote: > Ludovic Courtès <l...@gnu.org> writes: > > > That could go to the next ‘staging’ branch or ‘core-updates’, which > > might be merged first. (How come this many packages depend on tcsh?) > > tcsh is used by the 'boost' and 'texlive' packages.
Tcsh is a native-input of boost. I think that using a graft, as in the attached patch, should work. However, when applying this patch on top of a69bc7071ec (hydra: Fix wrong-num-args error when computing the cross jobs.) and building boost with this patch, the same derivation is built: $ ./pre-inst-env guix build boost && ./pre-inst-env guix build --no-grafts boost /gnu/store/nfg59rims86f87q5hasj8ngad3cd9dpa-boost-1.61.0 /gnu/store/nfg59rims86f87q5hasj8ngad3cd9dpa-boost-1.61.0 I'd expect it to change. Am I missing something?
From 7d84262b28a9a6d823d57ba25c316888ab044595 Mon Sep 17 00:00:00 2001 From: Leo Famulari <l...@famulari.name> Date: Wed, 7 Dec 2016 18:51:27 -0500 Subject: [PATCH] gnu: tcsh: Fix out of bounds read. * gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/shells.scm (tcsh)[replacement]: New field. (tcsh/fixed): New variable. --- gnu/local.mk | 1 + .../patches/tcsh-fix-out-of-bounds-read.patch | 31 ++++++++++++++++++++++ gnu/packages/shells.scm | 10 +++++++ 3 files changed, 42 insertions(+) create mode 100644 gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch diff --git a/gnu/local.mk b/gnu/local.mk index eec0e018b..72b64a6cc 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -884,6 +884,7 @@ dist_patch_DATA = \ %D%/packages/patches/tclxml-3.2-install.patch \ %D%/packages/patches/tcsh-do-not-define-BSDWAIT.patch \ %D%/packages/patches/tcsh-fix-autotest.patch \ + %D%/packages/patches/tcsh-fix-out-of-bounds-read.patch \ %D%/packages/patches/teensy-loader-cli-help.patch \ %D%/packages/patches/texi2html-document-encoding.patch \ %D%/packages/patches/texi2html-i18n.patch \ diff --git a/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch b/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch new file mode 100644 index 000000000..48c294f78 --- /dev/null +++ b/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch @@ -0,0 +1,31 @@ +Fix out-of-bounds read in c_substitute(): + +http://seclists.org/oss-sec/2016/q4/612 + +Patch copied from upstream source repository: + +https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 + +From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001 +From: christos <christos> +Date: Fri, 2 Dec 2016 16:59:28 +0000 +Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting + tcsh and hitting tab at the prompt) + +--- + ed.chared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ed.chared.c b/ed.chared.c +index 1277e53..310393e 100644 +--- ed.chared.c ++++ ed.chared.c +@@ -750,7 +750,7 @@ c_substitute(void) + /* + * If we found a history character, go expand it. + */ +- if (HIST != '\0' && *p == HIST) ++ if (p >= InputBuf && HIST != '\0' && *p == HIST) + nr_exp = c_excl(p); + else + nr_exp = 0; diff --git a/gnu/packages/shells.scm b/gnu/packages/shells.scm index f3350ef50..193160975 100644 --- a/gnu/packages/shells.scm +++ b/gnu/packages/shells.scm @@ -174,6 +174,7 @@ has a small feature set similar to a traditional Bourne shell.") (define-public tcsh (package (name "tcsh") + (replacement tcsh/fixed) (version "6.18.01") (source (origin (method url-fetch) @@ -231,6 +232,15 @@ command-line editor, programmable word completion, spelling correction, a history mechanism, job control and a C-like syntax.") (license bsd-4))) +(define tcsh/fixed + (package + (inherit tcsh) + (name "tcsh") + (source (origin + (inherit (package-source tcsh)) + (patches (cons (search-patch "tcsh-fix-out-of-bounds-read.patch") + (origin-patches (package-source tcsh)))))))) + (define-public zsh (package (name "zsh") -- 2.11.0
signature.asc
Description: PGP signature
