b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

log4cxx: 0.10.0 -> 1.1.0

Browse source 
Fixes CVE-2023-31038.
https://lists.apache.org/thread/vgjlpdf353vv91gryspwxrzj6p0fbjd9

https://github.com/apache/logging-log4cxx/compare/v0_10_0...rel/v1.1.0
This commit is contained in:
Thomas Gerbet 2023-05-18 16:00:28 +02:00
parent e51209796c
commit f550c12a25
2 changed files with 6 additions and 138 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
pkgs/development/libraries/log4cxx/default.nix
View file

@ -1,37 +1,22 @@
{ lib, stdenv, fetchurl, libtool, libxml2, cppunit, boost
{ lib, stdenv, fetchurl, libtool, cmake, libxml2, cppunit, boost
, apr, aprutil, db, expat
}:
stdenv.mkDerivation rec {
pname = "log4cxx";
version = "0.10.0";
version = "1.1.0";
src = fetchurl {
url = "http://apache.mirrors.hoobly.com/logging/log4cxx/${version}/apache-${pname}-${version}.tar.gz";
sha256 = "130cjafck1jlqv92mxbn47yhxd2ccwwnprk605c6lmm941i3kq0d";
url = "mirror://apache/logging/log4cxx/${version}/apache-${pname}-${version}.tar.gz";
hash = "sha256-H8fYJpdTQYS8D3VzSNlp0khSuUj2PWsXKD/R7inCwoo=";
};
patches = [
# adapted from upstream commit; will be fixed in next version
./narrowing-fixes.patch
];
postPatch = ''
sed -i -e '1,/^#include/ {
/^#include/i \
#include <cstdio> \
#include <cstdlib> \
#include <cstring>
}' src/examples/cpp/console.cpp \
src/main/cpp/inputstreamreader.cpp \
src/main/cpp/socketoutputstream.cpp
'' + lib.optionalString stdenv.isDarwin ''
sed -i 's/namespace std { class locale; }/#include <locale>/' src/main/include/log4cxx/helpers/simpledateformat.h
sed -i 's/\(#include <cctype>\)/\1\n#include <cstdlib>/' src/main/cpp/stringhelper.cpp
substituteInPlace CMakeLists.txt --replace "\\\''${prefix}/" ""
'';
buildInputs = [ libxml2 cppunit boost apr aprutil db expat ];
nativeBuildInputs = [ libtool ];
nativeBuildInputs = [ libtool cmake ];
meta = {
homepage = "https://logging.apache.org/log4cxx/index.html";

117
pkgs/development/libraries/log4cxx/narrowing-fixes.patch
View file

@ -1,117 +0,0 @@
diff --git a/src/main/cpp/locationinfo.cpp b/src/main/cpp/locationinfo.cpp
index e76ea29..bd22a1d 100644
--- a/src/main/cpp/locationinfo.cpp
+++ b/src/main/cpp/locationinfo.cpp
@@ -149,18 +149,21 @@ void LocationInfo::write(ObjectOutputStream& os, Pool& p) const {
os.writeNull(p);
} else {
char prolog[] = {
- 0x72, 0x00, 0x21, 0x6F, 0x72, 0x67, 0x2E,
- 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2E, 0x6C,
- 0x6F, 0x67, 0x34, 0x6A, 0x2E, 0x73, 0x70, 0x69,
- 0x2E, 0x4C, 0x6F, 0x63, 0x61, 0x74, 0x69, 0x6F,
- 0x6E, 0x49, 0x6E, 0x66, 0x6F, 0xED, 0x99, 0xBB,
- 0xE1, 0x4A, 0x91, 0xA5, 0x7C, 0x02, 0x00, 0x01,
- 0x4C, 0x00, 0x08, 0x66, 0x75, 0x6C, 0x6C, 0x49,
- 0x6E, 0x66, 0x6F,
- 0x74, 0x00, 0x12, 0x4C, 0x6A,
- 0x61, 0x76, 0x61, 0x2F, 0x6C, 0x61, 0x6E, 0x67,
- 0x2F, 0x53, 0x74, 0x72, 0x69, 0x6E, 0x67, 0x3B,
- 0x78, 0x70 };
+ 0x72,
+ 0x00,
+ 0x21, 0x6F, 0x72, 0x67, 0x2E, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2E,
+ 0x6C, 0x6F, 0x67, 0x34, 0x6A, 0x2E, 0x73, 0x70, 0x69, 0x2E, 0x4C, 0x6F,
+ 0x63, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x49, 0x6E, 0x66, 0x6F, static_cast<char>(0xED),
+ static_cast<char>(0x99), static_cast<char>(0xBB), static_cast<char>(0xE1),
+ 0x4A, static_cast<char>(0x91), static_cast<char>(0xA5), 0x7C, 0x02,
+ 0x00,
+ 0x01, 0x4C,
+ 0x00,
+ 0x08, 0x66, 0x75, 0x6C, 0x6C, 0x49, 0x6E, 0x66, 0x6F, 0x74,
+ 0x00,
+ 0x12, 0x4C, 0x6A, 0x61, 0x76, 0x61, 0x2F, 0x6C, 0x61, 0x6E, 0x67, 0x2F,
+ 0x53, 0x74, 0x72, 0x69, 0x6E, 0x67, 0x3B, 0x78, 0x70
+ };
os.writeProlog("org.apache.log4j.spi.LocationInfo", 2, prolog, sizeof(prolog), p);
char* line = p.itoa(lineNumber);
//
diff --git a/src/main/cpp/loggingevent.cpp b/src/main/cpp/loggingevent.cpp
index 1c0d4be..edbf40b 100644
--- a/src/main/cpp/loggingevent.cpp
+++ b/src/main/cpp/loggingevent.cpp
@@ -242,7 +242,7 @@ void LoggingEvent::writeProlog(ObjectOutputStream& os, Pool& p) {
0x68, 0x65, 0x2E, 0x6C, 0x6F, 0x67, 0x34, 0x6A,
0x2E, 0x73, 0x70, 0x69, 0x2E, 0x4C, 0x6F, 0x67,
0x67, 0x69, 0x6E, 0x67, 0x45, 0x76, 0x65, 0x6E,
- 0x74, 0xF3, 0xF2, 0xB9, 0x23, 0x74, 0x0B, 0xB5,
+ 0x74, static_cast<char>(0xF3), static_cast<char>(0xF2), static_cast<char>(0xB9), 0x23, 0x74, 0x0B, static_cast<char>(0xB5),
0x3F, 0x03, 0x00, 0x0A, 0x5A, 0x00, 0x15, 0x6D,
0x64, 0x63, 0x43, 0x6F, 0x70, 0x79, 0x4C, 0x6F,
0x6F, 0x6B, 0x75, 0x70, 0x52, 0x65, 0x71, 0x75,
diff --git a/src/main/cpp/objectoutputstream.cpp b/src/main/cpp/objectoutputstream.cpp
index 7cd696b..5442420 100644
--- a/src/main/cpp/objectoutputstream.cpp
+++ b/src/main/cpp/objectoutputstream.cpp
@@ -36,7 +36,7 @@ ObjectOutputStream::ObjectOutputStream(OutputStreamPtr outputStream, Pool& p)
objectHandle(0x7E0000),
classDescriptions(new ClassDescriptionMap())
{
- char start[] = { 0xAC, 0xED, 0x00, 0x05 };
+ char start[] = { static_cast<char>(0xAC), static_cast<char>(0xED), 0x00, 0x05 };
ByteBuffer buf(start, sizeof(start));
os->write(buf, p);
}
@@ -81,15 +81,15 @@ void ObjectOutputStream::writeObject(const MDC::Map& val, Pool& p) {
//
// TC_OBJECT and the classDesc for java.util.Hashtable
//
- char prolog[] = {
- 0x72, 0x00, 0x13, 0x6A, 0x61, 0x76, 0x61,
- 0x2E, 0x75, 0x74, 0x69, 0x6C, 0x2E, 0x48, 0x61,
- 0x73, 0x68, 0x74, 0x61, 0x62, 0x6C, 0x65, 0x13,
- 0xBB, 0x0F, 0x25, 0x21, 0x4A, 0xE4, 0xB8, 0x03,
- 0x00, 0x02, 0x46, 0x00, 0x0A, 0x6C, 0x6F, 0x61,
- 0x64, 0x46, 0x61, 0x63, 0x74, 0x6F, 0x72, 0x49,
- 0x00, 0x09, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68,
- 0x6F, 0x6C, 0x64, 0x78, 0x70 };
+ char prolog[] = {
+ 0x72, 0x00, 0x13, 0x6A, 0x61, 0x76, 0x61,
+ 0x2E, 0x75, 0x74, 0x69, 0x6C, 0x2E, 0x48, 0x61,
+ 0x73, 0x68, 0x74, 0x61, 0x62, 0x6C, 0x65, 0x13,
+ static_cast<char>(0xBB), 0x0F, 0x25, 0x21, 0x4A, static_cast<char>(0xE4), static_cast<char>(0xB8), 0x03,
+ 0x00, 0x02, 0x46, 0x00, 0x0A, 0x6C, 0x6F, 0x61,
+ 0x64, 0x46, 0x61, 0x63, 0x74, 0x6F, 0x72, 0x49,
+ 0x00, 0x09, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68,
+ 0x6F, 0x6C, 0x64, 0x78, 0x70 };
writeProlog("java.util.Hashtable", 1, prolog, sizeof(prolog), p);
//
// loadFactor = 0.75, threshold = 5, blockdata start, buckets.size = 7
diff --git a/src/test/cpp/xml/domtestcase.cpp b/src/test/cpp/xml/domtestcase.cpp
index a500628..29d67dd 100644
--- a/src/test/cpp/xml/domtestcase.cpp
+++ b/src/test/cpp/xml/domtestcase.cpp
@@ -190,9 +190,9 @@ public:
DOMConfigurator::configure(LOG4CXX_TEST_STR("input/xml/DOMTestCase3.xml"));
LOG4CXX_INFO(logger, "File name is expected to end with a superscript 3");
#if LOG4CXX_LOGCHAR_IS_UTF8
- const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, 0xC2, 0xB3, 0 };
+ const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, static_cast<logchar>(0xC2), static_cast<logchar>(0xB3), 0 };
#else
- const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, 0xB3, 0 };
+ const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, static_cast<logchar>(0xB3), 0 };
#endif
File file;
file.setPath(fname);
@@ -209,9 +209,9 @@ public:
DOMConfigurator::configure(LOG4CXX_TEST_STR("input/xml/DOMTestCase4.xml"));
LOG4CXX_INFO(logger, "File name is expected to end with an ideographic 4");
#if LOG4CXX_LOGCHAR_IS_UTF8
- const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, 0xE3, 0x86, 0x95, 0 };
+ const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, static_cast<logchar>(0xE3), static_cast<logchar>(0x86), static_cast<logchar>(0x95), 0 };
#else
- const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, 0x3195, 0 };
+ const logchar fname[] = { 0x6F, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2F, 0x64, 0x6F, 0x6D, static_cast<logchar>(0x3195), 0 };
#endif
File file;
file.setPath(fname);