diff --git a/pkgs/tools/misc/coreutils/CVE-2025-5278.patch b/pkgs/tools/misc/coreutils/CVE-2025-5278.patch deleted file mode 100644 index 197a77020fe2..000000000000 --- a/pkgs/tools/misc/coreutils/CVE-2025-5278.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 8c9602e3a145e9596dc1a63c6ed67865814b6633 Mon Sep 17 00:00:00 2001 -From: Pádraig Brady -Date: Tue, 20 May 2025 16:03:44 +0100 -Subject: sort: fix buffer under-read (CWE-127) - -* src/sort.c (begfield): Check pointer adjustment -to avoid Out-of-range pointer offset (CWE-823). -(limfield): Likewise. -* tests/sort/sort-field-limit.sh: Add a new test, -which triggers with ASAN or Valgrind. -* tests/local.mk: Reference the new test. -* NEWS: Mention bug fix introduced in v7.2 (2009). -Fixes https://bugs.gnu.org/78507 ---- - NEWS | 5 +++++ - src/sort.c | 12 ++++++++++-- - tests/local.mk | 1 + - tests/sort/sort-field-limit.sh | 35 +++++++++++++++++++++++++++++++++++ - 4 files changed, 51 insertions(+), 2 deletions(-) - create mode 100755 tests/sort/sort-field-limit.sh - -The new tests is NOT added in NixOS. - -diff --git a/NEWS b/NEWS -index 6ff403206..923aa72f8 100644 ---- a/NEWS -+++ b/NEWS -@@ -8,6 +8,11 @@ GNU coreutils NEWS -*- outline -*- - copying to non-NFS files from NFSv4 files with trivial ACLs. - [bug introduced in coreutils-9.6] - -+ sort with key character offsets of SIZE_MAX, could induce -+ a read of 1 byte before an allocated heap buffer. For example: -+ 'sort +0.18446744073709551615R input' on 64 bit systems. -+ [bug introduced in coreutils-7.2] -+ - - * Noteworthy changes in release 9.7 (2025-04-09) [stable] - -diff --git a/src/sort.c b/src/sort.c -index b10183b6f..7af1a2512 100644 ---- a/src/sort.c -+++ b/src/sort.c -@@ -1644,7 +1644,11 @@ begfield (struct line const *line, struct keyfield const *key) - ++ptr; - - /* Advance PTR by SCHAR (if possible), but no further than LIM. */ -- ptr = MIN (lim, ptr + schar); -+ size_t remaining_bytes = lim - ptr; -+ if (schar < remaining_bytes) -+ ptr += schar; -+ else -+ ptr = lim; - - return ptr; - } -@@ -1746,7 +1750,11 @@ limfield (struct line const *line, struct keyfield const *key) - ++ptr; - - /* Advance PTR by ECHAR (if possible), but no further than LIM. */ -- ptr = MIN (lim, ptr + echar); -+ size_t remaining_bytes = lim - ptr; -+ if (echar < remaining_bytes) -+ ptr += echar; -+ else -+ ptr = lim; - } - - return ptr; diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix index ee01ad87f88f..4f6b61521dec 100644 --- a/pkgs/tools/misc/coreutils/default.nix +++ b/pkgs/tools/misc/coreutils/default.nix @@ -48,24 +48,13 @@ let in stdenv.mkDerivation rec { pname = "coreutils" + (optionalString (!minimal) "-full"); - version = "9.7"; + version = "9.8"; src = fetchurl { url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz"; - hash = "sha256-6LsmrQKT+bWh/EP7QrqXDjEsZs6SwbCxZxPXUA2yUb8="; + hash = "sha256-5tT9LYUskUGhwqGKE9FGoM1+RRlfcik6TkwETsbMyhU="; }; - patches = [ - # Heap buffer overflow that's been here since coreutils 7.2 in 2009: - # https://www.openwall.com/lists/oss-security/2025/05/27/2 - ./CVE-2025-5278.patch - - # Fixes test-float-h failure on ppc64 with C23 - # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html - # Multiple upstream commits squashed with adjustments, see header - ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch - ]; - postPatch = '' # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems. sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh diff --git a/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch b/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch deleted file mode 100644 index 1b1e210efadd..000000000000 --- a/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch +++ /dev/null @@ -1,230 +0,0 @@ -Applies the following incremental gnulib commits: - -- 55a366a06fbd98bf13adc531579e3513cee97a32 -- 65ed9d3b24ad09fd61d326c83e7f1b05f6e9d65f -- ce8e9de0bf34bc63dffc67ab384334c509175f64 -- 6164b4cb0887b5331a4e64449107decd37d32735 - -With adjustments specific to the structure & differences in coreutils: - -- gnulib code is split across lib and gnulib-tests -- A Makefile.in is used for the test flags instead of the fancy automake modules - in the upstream gnulib project, so we add -lm to the float test there. - Surrounding texts in this file are slightly different in every project. ---- -diff '--color=auto' -ruN a/gnulib-tests/Makefile.in b/gnulib-tests/Makefile.in ---- a/gnulib-tests/Makefile.in 2025-04-09 10:05:54.000000000 +0000 -+++ b/gnulib-tests/Makefile.in 2025-07-09 10:00:23.767927263 +0000 -@@ -1496,7 +1496,7 @@ - $(am__DEPENDENCIES_1) - test_float_h_SOURCES = test-float-h.c - test_float_h_OBJECTS = test-float-h.$(OBJEXT) --test_float_h_LDADD = $(LDADD) -+test_float_h_LDADD = $(LDADD) -lm - test_float_h_DEPENDENCIES = libtests.a ../lib/libcoreutils.a \ - libtests.a ../lib/libcoreutils.a libtests.a \ - $(am__DEPENDENCIES_1) -diff '--color=auto' -ruN a/gnulib-tests/test-float-h.c b/gnulib-tests/test-float-h.c ---- a/gnulib-tests/test-float-h.c 2025-01-01 09:32:30.000000000 +0000 -+++ b/gnulib-tests/test-float-h.c 2025-07-09 10:00:13.837937094 +0000 -@@ -101,6 +101,8 @@ - - /* ------------------------------------------------------------------------- */ - -+#include -+ - #include "fpucw.h" - #include "isnanf-nolibm.h" - #include "isnand-nolibm.h" -@@ -396,6 +398,44 @@ - - /* -------------------- Check macros for 'long double' -------------------- */ - -+static int -+test_isfinitel (long double volatile x) -+{ -+ if (x != x) -+ return 0; -+ long double volatile zero = x * 0; -+ return zero == 0; -+} -+ -+/* Return X after normalization. This makes a difference on platforms -+ where long double can represent unnormalized values. For example, -+ suppose x = 1 + 2**-106 on PowerPC with IBM long double where -+ FLT_RADIX = 2, LDBL_MANT_DIG = 106, and LDBL_EPSILON = 2**-105. -+ Then 1 < x < 1 + LDBL_EPSILON, and normalize_long_double (x) returns 1. */ -+static long double -+normalize_long_double (long double volatile x) -+{ -+ if (FLT_RADIX == 2 && test_isfinitel (x)) -+ { -+ int xexp; -+ long double volatile -+ frac = frexpl (x, &xexp), -+ significand = frac * pow2l (LDBL_MANT_DIG), -+ normalized_significand = truncl (significand), -+ normalized_x = normalized_significand * pow2l (xexp - LDBL_MANT_DIG); -+ -+ /* The test_isfinitel defends against PowerPC with IBM long double, -+ which fritzes out near LDBL_MAX. */ -+ if (test_isfinitel (normalized_x)) -+ x = normalized_x; -+ } -+ else -+ { -+ /* Hope that X is already normalized. */ -+ } -+ return x; -+} -+ - static void - test_long_double (void) - { -@@ -455,7 +495,7 @@ - for (n = 0; n <= 2 * LDBL_MANT_DIG; n++) - { - volatile long double half_n = pow2l (- n); /* 2^-n */ -- volatile long double x = me - half_n; -+ volatile long double x = normalize_long_double (me - half_n); - if (x < me) - ASSERT (x <= 1.0L); - } -@@ -483,8 +523,12 @@ - ASSERT (!LDBL_IS_IEC_60559); - #endif - -+ printf("LDBL_NORM_MAX: %LF\n", LDBL_NORM_MAX); -+ printf("LDBL_MAX: %LF\n", LDBL_MAX); -+ printf("normalize_long_double(LDBL_MAX): %LF\n", normalize_long_double(LDBL_MAX)); -+ - /* Check the value of LDBL_NORM_MAX. */ -- ASSERT (LDBL_NORM_MAX == LDBL_MAX); -+ ASSERT (LDBL_NORM_MAX == normalize_long_double (LDBL_MAX)); - - /* Check the value of LDBL_SNAN. */ - ASSERT (isnanl (LDBL_SNAN)); -diff '--color=auto' -ruN a/lib/float.c b/lib/float.c ---- a/lib/float.c 2025-01-01 09:32:29.000000000 +0000 -+++ b/lib/float.c 2025-07-09 10:00:13.837937094 +0000 -@@ -23,7 +23,7 @@ - #if GNULIB_defined_long_double_union - # if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__ - const union gl_long_double_union gl_LDBL_MAX = -- { { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL } }; -+ { { DBL_MAX, DBL_MAX / 0x1p53 } }; - # elif defined __i386__ - const union gl_long_double_union gl_LDBL_MAX = - { { 0xFFFFFFFF, 0xFFFFFFFF, 32766 } }; -diff '--color=auto' -ruN a/lib/float.in.h b/lib/float.in.h ---- a/lib/float.in.h 2025-01-01 09:32:29.000000000 +0000 -+++ b/lib/float.in.h 2025-07-09 10:00:13.837937094 +0000 -@@ -113,44 +113,38 @@ - # define LDBL_MAX_10_EXP 4932 - #endif - --/* On AIX 7.1 with gcc 4.2, the values of LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX are -- wrong. -- On Linux/PowerPC with gcc 4.4, the value of LDBL_MAX is wrong. */ --#if (defined _ARCH_PPC || defined _POWER) && defined _AIX && (LDBL_MANT_DIG == 106) && defined __GNUC__ -+/* On PowerPC with gcc 15 when using __ibm128 long double, the value of -+ LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX, and LDBL_NORM_MAX are wrong. */ -+#if ((defined _ARCH_PPC || defined _POWER) && LDBL_MANT_DIG == 106 \ -+ && defined __GNUC__) - # undef LDBL_MIN_EXP - # define LDBL_MIN_EXP DBL_MIN_EXP - # undef LDBL_MIN_10_EXP - # define LDBL_MIN_10_EXP DBL_MIN_10_EXP - # undef LDBL_MIN - # define LDBL_MIN 2.22507385850720138309023271733240406422e-308L /* DBL_MIN = 2^-1022 */ --#endif --#if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__ - # undef LDBL_MAX --/* LDBL_MAX is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xFFFFFFFF }. -- It is not easy to define: -- #define LDBL_MAX 1.79769313486231580793728971405302307166e308L -- is too small, whereas -- #define LDBL_MAX 1.79769313486231580793728971405302307167e308L -- is too large. Apparently a bug in GCC decimal-to-binary conversion. -- Also, I can't get values larger than -- #define LDBL63 ((long double) (1ULL << 63)) -- #define LDBL882 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63) -- #define LDBL945 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63) -- #define LDBL1008 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63) -- #define LDBL_MAX (LDBL1008 * 65535.0L + LDBL945 * (long double) 9223372036821221375ULL + LDBL882 * (long double) 4611686018427387904ULL) -- which is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xF8000000 }. -- So, define it like this through a reference to an external variable -+/* LDBL_MAX is 2**1024 - 2**918, represented as: { 0x7FEFFFFF, 0xFFFFFFFF, -+ 0x7C9FFFFF, 0xFFFFFFFF }. -+ -+ Do not write it as a constant expression, as GCC would likely treat -+ that as infinity due to the vagaries of this platform's funky arithmetic. -+ Instead, define it through a reference to an external variable. -+ Like the following, but using a union to avoid type mismatches: - -- const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL }; -+ const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / 0x1p53 }; - extern const long double LDBL_MAX; - -- or through a pointer cast -+ The following alternative would not work as well when GCC is optimizing: -+ -+ #define LDBL_MAX (*(long double const *) (double[]) -+ { DBL_MAX, DBL_MAX / 0x1p53 }) - -- #define LDBL_MAX \ -- (*(const long double *) (double[]) { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL }) -+ The following alternative would require GCC 6 or later: - -- Unfortunately, this is not a constant expression, and the latter expression -- does not work well when GCC is optimizing.. */ -+ #define LDBL_MAX __builtin_pack_longdouble (DBL_MAX, DBL_MAX / 0x1p53) -+ -+ Unfortunately none of the alternatives are constant expressions. */ - # if !GNULIB_defined_long_double_union - union gl_long_double_union - { -@@ -161,6 +155,8 @@ - # endif - extern const union gl_long_double_union gl_LDBL_MAX; - # define LDBL_MAX (gl_LDBL_MAX.ld) -+# undef LDBL_NORM_MAX -+# define LDBL_NORM_MAX LDBL_MAX - #endif - - /* On IRIX 6.5, with cc, the value of LDBL_MANT_DIG is wrong. -@@ -181,6 +177,21 @@ - # endif - #endif - -+/* On PowerPC platforms, 'long double' has a double-double representation. -+ Up to ISO C 17, this was outside the scope of ISO C because it can represent -+ numbers with mantissas of the form 1.<52 bits><52 bits>, such as -+ 1.0L + 4.94065645841246544176568792868221e-324L = 1 + 2^-1074; see -+ ISO C 17 § 5.2.4.2.2.(3). -+ In ISO C 23, wording has been included that makes this 'long double' -+ representation compliant; see ISO C 23 § 5.2.5.3.3.(8)-(9). In this setting, -+ numbers with mantissas of the form 1.<52 bits><52 bits> are -+ called "unnormalized". And since LDBL_EPSILON must be normalized (per -+ ISO C 23 § 5.2.5.3.3.(33)), it must be 2^-105. */ -+#if defined __powerpc__ && LDBL_MANT_DIG == 106 -+# undef LDBL_EPSILON -+# define LDBL_EPSILON 2.46519032881566189191165176650870696773e-32L /* 2^-105 */ -+#endif -+ - /* ============================ ISO C11 support ============================ */ - - /* 'float' properties */ -@@ -309,7 +320,11 @@ - # endif - #endif - #ifndef LDBL_NORM_MAX --# define LDBL_NORM_MAX LDBL_MAX -+# ifdef __LDBL_NORM_MAX__ -+# define LDBL_NORM_MAX __LDBL_NORM_MAX__ -+# else -+# define LDBL_NORM_MAX LDBL_MAX -+# endif - #endif - #ifndef LDBL_SNAN - /* For sh, beware of . */