perl-static: add new package to [libre]

2 files changed, 163 insertions, 0 deletions

diff --git a/libre/perl-static/CVE-2016-2381_duplicate_env.diff b/libre/perl-static/CVE-2016-2381_duplicate_env.diff
new file mode 100644
index 000000000..80adf62d2
--- /dev/null
+++ b/libre/perl-static/CVE-2016-2381_duplicate_env.diff
@@ -0,0 +1,104 @@
+From 83e7ebed7afa79a2f50eca6b6330eae7c3a02d36 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony@develop-help.com>
+Date: Wed, 27 Jan 2016 11:52:15 +1100
+Subject: remove duplicate environment variables from environ
+
+If we see duplicate environment variables while iterating over
+environ[]:
+
+a) make sure we use the same value in %ENV that getenv() returns.
+
+Previously on a duplicate, %ENV would have the last entry for the name
+from environ[], but a typical getenv() would return the first entry.
+
+Rather than assuming all getenv() implementations return the first entry
+explicitly call getenv() to ensure they agree.
+
+b) remove duplicate entries from environ
+
+Previously if there was a duplicate definition for a name in environ[]
+setting that name in %ENV could result in an unsafe value being passed
+to a child process, so ensure environ[] has no duplicates.
+
+Patch-Name: fixes/CVE-2016-2381_duplicate_env.diff
+---
+ perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/perl.c b/perl.c
+index 80a76c2..ed25429 100644
+--- a/perl.c
++++ b/perl.c
+@@ -4303,23 +4303,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env)
+ 	}
+ 	if (env) {
+ 	  char *s, *old_var;
++          STRLEN nlen;
+ 	  SV *sv;
++          HV *dups = newHV();
++
+ 	  for (; *env; env++) {
+ 	    old_var = *env;
+ 
+ 	    if (!(s = strchr(old_var,'=')) || s == old_var)
+ 		continue;
++            nlen = s - old_var;
+ 
+ #if defined(MSDOS) && !defined(DJGPP)
+ 	    *s = '\0';
+ 	    (void)strupr(old_var);
+ 	    *s = '=';
+ #endif
+-	    sv = newSVpv(s+1, 0);
+-	    (void)hv_store(hv, old_var, s - old_var, sv, 0);
++            if (hv_exists(hv, old_var, nlen)) {
++                const char *name = savepvn(old_var, nlen);
++
++                /* make sure we use the same value as getenv(), otherwise code that
++                   uses getenv() (like setlocale()) might see a different value to %ENV
++                 */
++                sv = newSVpv(PerlEnv_getenv(name), 0);
++
++                /* keep a count of the dups of this name so we can de-dup environ later */
++                if (hv_exists(dups, name, nlen))
++                    ++SvIVX(*hv_fetch(dups, name, nlen, 0));
++                else
++                    (void)hv_store(dups, name, nlen, newSViv(1), 0);
++
++                Safefree(name);
++            }
++            else {
++                sv = newSVpv(s+1, 0);
++            }
++	    (void)hv_store(hv, old_var, nlen, sv, 0);
+ 	    if (env_is_not_environ)
+ 	        mg_set(sv);
+ 	  }
++          if (HvKEYS(dups)) {
++              /* environ has some duplicate definitions, remove them */
++              HE *entry;
++              hv_iterinit(dups);
++              while ((entry = hv_iternext_flags(dups, 0))) {
++                  STRLEN nlen;
++                  const char *name = HePV(entry, nlen);
++                  IV count = SvIV(HeVAL(entry));
++                  IV i;
++                  SV **valp = hv_fetch(hv, name, nlen, 0);
++
++                  assert(valp);
++
++                  /* try to remove any duplicate names, depending on the
++                   * implementation used in my_setenv() the iteration might
++                   * not be necessary, but let's be safe.
++                   */
++                  for (i = 0; i < count; ++i)
++                      my_setenv(name, 0);
++
++                  /* and set it back to the value we set $ENV{name} to */
++                  my_setenv(name, SvPV_nolen(*valp));
++              }
++          }
++          SvREFCNT_dec_NN(dups);
+       }
+ #endif /* USE_ENVIRON_ARRAY */
+ #endif /* !PERL_MICRO */
diff --git a/libre/perl-static/PKGBUILD b/libre/perl-static/PKGBUILD
new file mode 100644
index 000000000..a412e9d98
--- /dev/null
+++ b/libre/perl-static/PKGBUILD
@@ -0,0 +1,59 @@
+# Maintainer: Márcio Silva <coadde@parabola.nu>
+# based of perl
+
+_pkgname=perl
+pkgname=perl-static
+pkgver=5.22.1
+pkgrel=2
+pkgdesc="A highly capable, feature-rich programming language (static libraries only)"
+arch=(i686 x86_64 armv7h)
+license=('GPL' 'PerlArtistic')
+url="http://www.perl.org"
+groups=('base')
+depends=('gdbm-static' 'db-static' 'perl')
+source=(http://www.cpan.org/src/5.0/perl-${pkgver}.tar.bz2
+        CVE-2016-2381_duplicate_env.diff)
+options=('makeflags' '!purge' 'emptydirs' 'staticlibs')
+md5sums=('67242b9bd642b458bec884ed2a040910'
+         'a108f258b9ba1504b6051d123ccaa623')
+
+prepare() {
+  cd ${srcdir}/${_pkgname}-${pkgver}
+
+  patch -p1 -i "$srcdir/CVE-2016-2381_duplicate_env.diff"
+}
+
+build() {
+  cd ${srcdir}/${_pkgname}-${pkgver}
+
+  if [ "${CARCH}" = "x86_64" ]; then
+    # for x86_64
+    arch_opts="-Dcccdlflags='-fPIC'"
+  else
+    # for i686
+    arch_opts=""
+  fi
+
+  ./Configure -des -Dusethreads -Duseshrplib=false -Doptimize="${CFLAGS}" \
+    -Dprefix=/usr \
+    -Darchlib=/usr/lib/perl5/core_perl \
+    -Dinc_version_list=none \
+    ${arch_opts} \
+    -Dlddlflags="-static ${LDFLAGS}" -Dldflags="${LDFLAGS}" -Dso=none
+  make
+}
+
+check() {
+  cd ${srcdir}/${_pkgname}-${pkgver}
+  TEST_JOBS=$(echo $MAKEFLAGS | sed 's/.*-j\([0-9][0-9]*\).*/\1/') make test_harness
+#  make test
+}
+
+package() {
+  cd ${srcdir}/${_pkgname}-${pkgver}
+  make DESTDIR="$pkgdir" install
+
+  # remove conflicting files
+#  rm -vr ${pkgdir}/usr/{include,share}
+#  rm -v ${pkgdir}/usr/lib/lib*.so*
+}