|
dbb6a232
|
2021-03-18T06:56:55
|
|
path: don't use PATH_MAX, use PKGCONF_ITEM_SIZE * 4 for realpath buffer
|
|
fd1b8ccc
|
2021-03-18T06:22:11
|
|
main: if PKG_CONFIG_FDO_SYSROOT_RULES is set, or DESTDIR matches PKG_CONFIG_SYSROOT_DIRS, disable the automatic sysroot rewriting
Closes #205.
|
|
008d7069
|
2021-03-18T06:03:32
|
|
libpkgconf: personality: default: set want_default_static and want_default_pure to true on windows
|
|
f9531ce9
|
2021-03-18T05:59:54
|
|
add support for pkgconf_cross_personality_t.want_default_pure
|
|
52d19e1b
|
2021-03-18T05:44:45
|
|
libpkgconf: fileio: pkgconf_fgetline(): handle quoted=true when a comment introduction is encountered
Fixes #215.
|
|
ab404bc2
|
2021-02-03T06:54:52
|
|
Fix #209
This commit fixes #209 by applying the suggestion from
https://github.com/pkgconf/pkgconf/issues/209#issuecomment-771609136.
|
|
13a5d9a5
|
2021-01-08T10:56:41
|
|
libpkgconf: path: supply buffer to realpath
To avoid a crash on some platforms (like Darwin 9) provide a buffer to
realpath(3).
Darwin 9 (last PPC target) documents realpath needs to be given a buffer
to the resolved_path argument large enough to hold PATH_MAX bytes.
With NULL argument it crashes. Solaris makes no mention of
resolved_path to be allowed NULL, yet recent versions accept it and
malloc(3) accordingly.
Because the documentation explicitly mentions PATH_MAX being the limit
to what realpath(3) would write in resolved_path, switching to a static
buffer here doesn't limit resolution compared to dynamically allocating
a buffer by realpath(3).
While this change requires a bit more space on the stack, it avoids a
malloc/free sequence, and allows successful operation on (older)
platforms that lack support for dynamically allocating a return buffer
in realpath(3).
Signed-off-by: Fabian Groffen <grobian@gentoo.org>
|
|
de8fc9e4
|
2020-11-28T15:19:41
|
|
meson: install headers into pkgconf/libpkgconf instead of just libpkgconf
To mirror what the autotools build does
|
|
869f2a84
|
2020-11-28T16:01:16
|
|
pkgconf_pkg_parser_version_func: fix whitespace detection
In case the version string has no whitespace then strcspn() returns
strlen() of the input, so whitespace is only found if len != strlen.
This fixes invalid warnings when parsing version fields.
|
|
2a8bebf2
|
2020-06-11T18:00:56
|
|
libpkgconf: path: rewrite DOS paths in non-cygwin case too
|
|
f818a69b
|
2020-06-03T21:42:25
|
|
libpkgconf: pkg: fix out ouf boundary access
If a file with a matching "uninstalled" name exists but cannot be
parsed, an invalid memory area is accessed.
How to reproduce:
$ touch poc-uninstalled.pc
$ PKG_CONFIG_PATH=. pkgconf poc
|
|
ef135d81
|
2020-06-02T18:58:00
|
|
meson: remove some autotools cruft
|
|
354c8727
|
2020-05-30T19:19:48
|
|
libpkgconf: tuple: fix truncation when no overflow occurs
|
|
5eb9cae0
|
2020-05-31T00:25:54
|
|
libpkgconf: tuple: fix out of boundary write
This is the same issue which has been fixed in dependency code.
If a line contains a variable which is longer than PKGCONF_ITEM_SIZE,
then the varname buffer overflows.
The code itself still does not check if a closing } exists and
truncates variable names which are too long. Since these would
be functional changes and this commit is about a protection against
undefined behaviour on a language level, these changes are not
included.
Proof of concept:
$ echo "Description: poc" > poc.pc
$ echo "Version: 1" >> poc.pc
$ echo -n 'Name: ${'
$ dd if=/dev/zero bs=1 count=66535 | tr '\0' 'x' >> poc.pc
$ echo >> poc.pc
$ pkgconf poc.pc
On my Linux system, when compiled with gcc, the varname buffer overflows
directly into buf, which means that no crash can be notified.
It's easiest to figure out when adding strlen() and sizeof() output
as debug lines.
|
|
100bc605
|
2020-05-30T23:48:40
|
|
libpkgconf: fragment: fix out of boundary write
fragment_quote adds quotation to fragments if needed. It allocates a
buffer and grows it as needed.
Unfortunately the dst pointer is not updated after a realloc, which
means that dst still points into the old memory area. Further writing
characters into that area leads to out of boundy writes.
Proof of concept:
$ cat > poc.pc << EOF
Name: poc
Description: poc
Version: 1
CFlags: -Ia
CFlags: -I%%%%%%%%%%%%%%%%%%%%b
CFlags: -I%%%%%%%%%%%%%%%%%%%%c
CFlags: -Id
EOF
$ pkgconf --cflags poc.pc
Most reliable attempt is to compile pkgconf with address sanitizer,
but this file should lead to an abort on a glibc system due to modified
chunk pointers (tested with Linux on amd64).
But since this is undefined behaviour, it depends on system details.
|
|
dc04193c
|
2020-05-29T19:35:42
|
|
libpkgconf: fragment: fix out of boundary read
Parsing a fragment which consists only of a single dash leads to
an out of boundary read. It duplicates the following entry which
is not expected behaviour if another fragment follows.
Proof of concept:
$ cat > poc.pc << "EOF"
Name: poc
Description: poc
Version: 1
Cflags: - -I/somewhere
EOF
$ PKG_CONFIG_PATH=. pkgconf --cflags poc
-I/somewhere -I/somewhere
If - is the last entry, it leads to an out of boundary read, which is
easy to see if pkgconf is compiled with address sanitizer.
|
|
42b35531
|
2020-05-30T12:39:43
|
|
fix missing backslashes in paths on Windows
According to
https://docs.microsoft.com/fr-fr/windows/win32/fileio/naming-a-file
backslashes (with slashes) are a path separator, hence must no be
considered as an escape code.
The first fix, in argvsplit.c, disables this. But because of fragment_quote(),
the backslashes are doubled. Hence the second fix in fragment.c
With this pc file :
prefix=C:/Documents/msys2/opt/efl_64
libdir=${prefix}/lib
includedir=${prefix}/include
Name: eina
Description: efl: eina
Version: 1.24.99
Requires.private: iconv
Libs: -L${libdir} -leina -pthread -levil
Libs.private: -lpsapi -lole32 -lws2_32 -lsecur32 -luuid -lregex -lm
Cflags:-I${includedir}/eina-1 -I${includedir}/efl-1
-I${includedir}/eina-1/eina -pthread
pkgconf.exe --cflags eina
returns :
-IC:\Documents\msys2\opt\efl_64/include/eina-1
-IC:\Documents\msys2\opt\efl_64/include/efl-1
-IC:\Documents\msys2\opt\efl_64/include/eina-1/eina -pthread
-DWINICONV_CONST= -IC:\Documents\msys2\opt\ewpi_64/include
|
|
fb9acedc
|
2020-05-26T21:42:13
|
|
libpkgconf: dependency: fix out of boundary write
It is possible to trigger an out of boundary write in function
pkgconf_dependency_parse_str if a dependency line contains a very
long comparator. The comparator is stored in a temporary buffer which
has a size of PKGCONF_ITEM_SIZE.
The line which is parsed can be up to PKGCONF_BUFSIZE characters long,
which is larger than PKGCONF_ITEM_SIZE (although it depends on PATH_MAX).
Having a comparator which is longer than PKGCONF_ITEM_SIZE therefore
leads to an out of boundary write. Although it is undefined behaviour,
this can lead to an overridden compare variable, which in turn can lead
to an invalid instruction pointer, i.e. most likely a crash or code
execution (very unlikely).
Proof of concept:
$ echo "Requires: x " > poc.pc
$ dd if=/dev/zero bs=1 count=65535 | tr '\0' '<' >> poc.pc
$ pkgconf poc.pc
Eiter compile pkgconf with address sanitizer or run pkgconf multiple
times, eventually it might crash (assuming that ASLR is in place).
In order to fix this, I decided to use an end pointer to avoid OOB write.
Alternative would be to increase the buffer size, but I try to avoid that
since this would be additional ~60 KB stack space for a very unlikely
situation.
|
|
c613eb5c
|
2020-05-26T13:41:39
|
|
libpkgconf: pkg: use a second pointer for demunging windows paths
|
|
e70b536e
|
2020-05-26T11:01:46
|
|
libpkgconf: pkg: when generating a search path, use the correct path separator
Before, this could result in generated paths like C:\foo\pkgconfig/bar.pc on Windows.
|
|
0253fddc
|
2020-05-26T07:41:16
|
|
libpkgconf: pkg: fix computation of pkgconf_pkg_t.id on Windows.
Windows allows both \ and / as valid path characters. A computed path
such as C:\development\libfoo\pkgconfig/foo.pc will result in a computed
pkgconf_pkg_t.id of "pkgconfig/foo".
Accordingly, correct the path normalization for checking for / after
the \ path has been dealt with in all cases.
|
|
9e16d270
|
2020-05-24T23:13:19
|
|
libpkgconf: personality: fix out of boundary access
It is possible to set the instruction pointer to undefined values by
using an operator larger than ':' in ASCII.
Since the personality function array does not have 256 entries, an
invalid operator can overflow the array.
Proof of concept:
$ echo "a _ b" > poc
$ ln -s $(which pkgconf) poc-pkgconf
$ ./poc-pkgconf
|
|
dd57abfe
|
2020-05-24T14:44:01
|
|
pkgconf 1.7.0.
|
|
4fb7683c
|
2020-05-24T14:40:47
|
|
add support for the PKGCONF_PKG_PKGF_DONT_MERGE_SPECIAL_FRAGMENTS flag used in build2.
|
|
011db1bb
|
2020-04-26T17:28:03
|
|
Do not complain about malformed whitespace from \n on Version line
Every version line has a newline at the end; the malformed whitespace checker
should just check for trailing spaces and tabs.
Resolves https://todo.sr.ht/~kaniini/pkgconf/15
|
|
382a89c1
|
2020-05-24T14:18:16
|
|
pkg: pkgconf_compare_version(): do not return levenshtein distance in strcmp() case
|
|
92745ad9
|
2020-05-24T21:51:14
|
|
libpkgconf: parser: fix out of boundary access
It is possible to trigger an out of boundary access with specially
crafted files. If a line consist of only a key and spaces, then
op will point to '\0'-ending of the buffer. Since p is iterated by
one byte right past this ending '\0', the next read access to p is
effectively out of bounds.
Theoretically this can also lead to out of boundary writes if spaces
are encountered.
Proof of concept (I recommend to compile with address sanitizer):
$ echo -n a > poc.pc
$ dd if=/dev/zero bs=1 count=65533 | tr '\0' ' ' >> poc.pc
$ pkgconf poc.pc
|
|
bd4ed1ca
|
2020-05-24T20:51:48
|
|
libpkgconf: fileio: prevent buffer overflow.
pkgconf_fgetline is called with a user-defined buffer, its size, and
a FILE stream to read input from.
If the buffer is almost completely filled and the file stream contains
an escaped character, then it is possible to trigger an off-by-one
buffer overflow with a '\0' character.
Easiest example to trigger this:
char buf[2];
pkgconf_fgetline(buf, sizeof(buf), stdin);
Enter "\\" (two backslashes) and press enter. If the library and the
program are compiled with address sanitizer, you will see the program
crashing. Otherwise it depends on your architecture what happens.
Since nobody should be using a buffer of only size 1 or 2, keep enough
space for a possibly escaped character in while loop by subtracting one
more byte for this situation, not just for '\0'.
|
|
48dc665a
|
2019-10-19T00:56:17
|
|
personality: add support for WantDefaultStatic setting
|
|
2adafc27
|
2019-08-23T12:47:22
|
|
libpkgconf: personality: return the default personality if loading a personality file failed
|
|
19aa93e3
|
2019-08-04T15:54:24
|
|
prepare for pkgconf 2.0 development
|
|
c862e030
|
2019-07-12T06:53:37
|
|
pkgconf 1.6.3.
|
|
c10f6999
|
2019-07-12T06:35:48
|
|
libpkgconf: pkg: generate diagnostic for and trim malformed versions
|
|
7a395932
|
2019-07-12T05:45:16
|
|
drop CMake support
|
|
c816ce69
|
2019-07-11T03:36:03
|
|
pkgconf 1.6.2. (closes #38, #40, #41)
|
|
7e0b0fad
|
2019-07-11T03:38:58
|
|
libpkgconf: path: fix memory leak when deduping paths (closes #39)
|
|
db9c1e96
|
2019-06-07T19:19:28
|
|
fix the order of header includes
config.h should be included before stdinc.h, otherwise large file
support is not enabled.
Downstream bug: https://bugs.gentoo.org/687548
|
|
ebfcaf50
|
2019-05-25T15:59:55
|
|
normalize include guards. closes #33
|
|
2d0c1f5c
|
2019-05-06T15:15:41
|
|
lite: disable debug logging
|
|
43ca536b
|
2019-05-06T15:13:17
|
|
lite: disable some bloat
|
|
662957ca
|
2019-03-23T22:33:55
|
|
libpkgconf: tuple: tighten quoting logic a bit
closes #12
|
|
3afd14c4
|
2019-03-23T22:27:05
|
|
libpkgconf: path: use realpath(3) to deduplicate the search path
closes #24
|
|
ba1f48e4
|
2019-03-23T22:17:04
|
|
libpkgconf: client: ensure PKG_CONFIG_LIBDIR being empty overrides the default search paths
closes #25
|
|
183e68df
|
2019-01-14T13:52:04
|
|
libpkgconf: add LIBPKGCONF_VERSION macro
|
|
6854265f
|
2019-01-14T13:48:23
|
|
libpkgconf: pkg: use pkgconf_fragment_copy_list() to clean up cflags gathering logic (closes #20)
|
|
36a5b7ac
|
2019-01-14T13:48:02
|
|
libpkgconf: fragment: add pkgconf_fragment_copy_list()
|
|
0ae52182
|
2019-01-14T13:11:59
|
|
libpkgconf: pkg: clean up pkgconf_parser interactions (closes #13)
|
|
2c059710
|
2018-09-17T15:20:28
|
|
Canonicalize paths before using them
This fixes a problem where on Windows the prefix would
not match if the prefix is generated with backslashes
and the rest of the variables use normal slashes
|
|
9f17da92
|
2018-09-17T15:20:00
|
|
On Windows the path prefix should be checked caseless
|
|
c9dffb85
|
2018-09-17T15:19:18
|
|
Fix build on windows with meson
|
|
9b7affe0
|
2018-07-28T19:06:33
|
|
tuple: Ensure buf length is always >= 1 in dequote
If a key is defined with no value, dequote will allocate a buffer with a
length of 0. Since the buffer's length is 0, any manipulation of its
content is UB.
Example .pc file:
prefix=/usr
exec_prefix=${prefix}
libdir=${exec_prefix}/lib
includedir=${prefix}/include
xcflags=
xlibs= -lSM -lICE -lX11
Name: Obt
Description: Openbox Toolkit Library
Version: 3.6
Requires: glib-2.0 libxml-2.0
Libs: -L${libdir} -lobt ${xlibs}
Cflags: -I${includedir}/openbox/3.6 ${xcflags}
Output using pkgconf 1.5.2 on x86_64 Linux/musl:
% pkgconf --cflags obt-3.5
-I/usr/include/openbox/3.6 \�\\�I\�\ -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/libxml2
|
|
fb08ae2b
|
2018-06-25T06:36:57
|
|
environment variables for system paths should override compiled-in defaults
|
|
6f05fec4
|
2018-06-16T16:35:44
|
|
pkg: give a correctly sized vtable to the parser
|
|
b46bb93c
|
2018-06-14T16:12:04
|
|
libpkgconf: tuple: properly dequote tuples when added from the parser (closes legacy github bug #186)
|
|
273d1d04
|
2018-05-29T17:36:04
|
|
use pkgconf_strlcpy
On Debian/Ubuntu I get:
CC libpkgconf/personality.lo
libpkgconf/personality.c: In function ‘load_personality_with_path’:
libpkgconf/personality.c:195:3: warning: implicit declaration of function ‘strlcpy’ [-Wimplicit-function-declaration]
strlcpy(pathbuf, path, sizeof pathbuf);
^~~~~~~
CC libpkgconf/parser.lo
CCLD libpkgconf.la
ar: `u' modifier ignored since `D' is the default (see `U')
CC cli/pkgconf-main.o
CC cli/pkgconf-getopt_long.o
CC cli/pkgconf-renderer-msvc.o
CCLD pkgconf
./.libs/libpkgconf.so: undefined reference to `strlcpy'
|
|
3ccc4454
|
2018-05-10T13:36:22
|
|
libpkgconf: personality: ensure the path list is properly initialized before searching for triplets
|
|
40897f24
|
2018-05-09T22:52:27
|
|
libpkgconf: personality: remove const from the default personality, since it's not really const
|
|
25b2105e
|
2018-05-09T22:52:07
|
|
libpkgconf: client: if tracing is disabled, don't try to trace
|
|
e6ce6c8e
|
2018-05-09T22:39:39
|
|
libpkgconf: personality: fixups
|
|
75134829
|
2018-05-09T22:08:28
|
|
libpkgconf: personality: fill in the rest of the personality parser
|
|
1244f8f8
|
2018-05-09T21:21:39
|
|
libpkgconf: refactor out the rfc822 message parser so that the cross-personality code can share it
|
|
f702967d
|
2018-05-09T19:56:30
|
|
libpkgconf: pkg: refactor pkgconf_pkg_new_from_file to prepare to factor out the rfc822 parser
|
|
0f17a4f3
|
2018-05-09T19:33:12
|
|
libpkgconf: pkg: mark owning client earlier, to allow for refactoring out the rfc822 parser
|
|
9439b683
|
2018-05-09T19:27:53
|
|
libpkgconf: personality: add stub cross personality loader
|
|
6b0e346c
|
2018-05-09T17:07:26
|
|
libpkgconf: refactor building the dir lists into separate concerns
|
|
854490c5
|
2018-05-09T16:54:21
|
|
libpkgconf: add basic support for cross-compile personality objects
|
|
43e8c7b4
|
2018-05-09T16:35:21
|
|
libpkgconf: path: add path list copying function
|
|
f36ccc1d
|
2018-04-03T12:46:35
|
|
libpkgconf: add support for Haiku
client: use BELIBRARIES
On Haiku, BELIBRARIES is the equivalent to LIBRARY_PATH on many other
systems, while LIBRARY_PATH is instead the LD_LIBRARY_PATH of Haiku.
pkg: bootstrap package search paths with Haiku's find_paths
This commit adds build_default_pkgconfig_path. The function appends
to the list given the default pkgconfig paths, and will supersede
get_default_pkgconfig_path
|
|
3f753fa3
|
2018-03-18T19:03:18
|
|
libpkgconf: dependency: preference uncoloured nodes in event of a dependency collision
|
|
7e9ed692
|
2018-03-18T18:04:02
|
|
libpkgconf: pkg: skip over -I cflags from Requires.internal nodes when building a cflags list
|
|
ad65bc4a
|
2018-03-18T18:01:59
|
|
libpkgconf: dependency: allow dependency nodes to be colored with traits
|
|
f03ec3ff
|
2018-03-18T15:46:53
|
|
libpkgconf: add support for proposed Requires.internal extension
|
|
a50bf726
|
2018-03-08T05:16:18
|
|
Fix incorrect comment (#178)
|
|
60c05f56
|
2018-03-08T05:00:22
|
|
Improve prefix rewriting on Windows (#177)
* cli: Default to rewriting prefix on Windows
This matches `pkg-config` behavior
* libpkgconf: Rewrite the prefix of all variables
|
|
83eea876
|
2018-03-07T05:27:54
|
|
meson: Fix defining PKGCONF_API (#174)
|
|
0d523391
|
2018-02-08T14:25:47
|
|
libpkgconf: pkg: ensure the dependency node has a solution associated with it
Sometimes this did not happen, e.g. when using providers as the solution (ref #172).
|
|
d5fd74d7
|
2018-01-22T15:13:14
|
|
libpkgconf: fragment: revert the quoting changes, but not the lexing changes
a few strange edge cases are causing problems (closes #168)
|
|
4a09efe0
|
2018-01-05T11:38:21
|
|
libpkgconf: pkg: fix harmless gcc7 compiler warning
|
|
a42f265c
|
2017-12-21T02:18:50
|
|
libpkgconf: pkg: include system libdir and includedir search paths as variables in builtin packages (closes #165)
|
|
cf96c562
|
2017-12-14T22:41:14
|
|
libpkgconf: argvsplit: fix escape handling in tokenizer (closes #163)
|
|
18abb4cc
|
2017-12-13T11:18:25
|
|
libpkgconf: fragment: fix nitpick warning reported by MSVC (closes #162)
|
|
e0bf4009
|
2017-12-12T00:21:21
|
|
libpkgconf: pkg: rename pkgconf_pkg_t.requires to pkgconf_pkg_t.required (closes #154)
C++20 makes requires a keyword, so we need to not use it in headers.
|
|
278a2bd6
|
2017-12-11T18:25:55
|
|
libpkgconf: fragment: rework quoting and lexing (closes #139, #153)
we now use POSIX-style quoting for all fragments. it is our belief that this is the
most optimal behaviour for portability, because all POSIX-compliant tools require
single-quotes to be considered as literal (closes #153).
because of this, we are able to remove some hacks on the lexer side which were there
to simulate pkg-config quoting, but were basically utterly wrong (closes #139).
|
|
973aff21
|
2017-12-11T17:39:12
|
|
libpkgconf: tuple: add some trace logging
|
|
72743575
|
2017-12-10T00:39:39
|
|
libpkgconf: fragment: track merged fragments, as they should never be quoted
|
|
cad2515b
|
2017-12-10T00:36:20
|
|
libpkgconf: fragment: there are no consumers of non-escaped rendered fragment lists, so deprecate the option
|
|
d2b69833
|
2017-12-08T13:39:40
|
|
libpkgconf: cache: fix refcount issue exposed by recent depgraph solver changes
|
|
19d91e90
|
2017-12-07T19:13:35
|
|
libpkgconf: fragment: allow for overriding the default fragment rendering behaviour
|
|
f7406afc
|
2017-12-05T18:04:42
|
|
libpkgconf: pkg: do not mention PKG_CONFIG_SKIP_CONFLICTS env var when simplified errors are requested (closes #134)
|
|
06abf28d
|
2017-12-05T17:46:57
|
|
libpkgconf: client: handle NULL client in pkgconf_trace calls
|
|
74d58d1b
|
2017-12-05T17:34:01
|
|
libpkgconf: pkg: cache solutions for already solved dependency graph nodes
in almost all cases, we partially solve the dependency graph multiple times, which
just wastes resources. if we record the solution to a given dependency node, further
iterations can make use of the previous solution without having to solve it again.
this is safe because all provides entries (including virtuals) are knowable prior to
solving the dependency graph the first time.
a nice side effect of this is that all packages are preloaded when querying
information about them (--cflags and related commands).
|
|
44b4b126
|
2017-12-05T17:32:00
|
|
libpkgconf: pkg: record which pkgconf_client_t owns each pkgconf_pkg_t object
|
|
4c0cc292
|
2017-12-05T17:24:57
|
|
libpkgconf: pkg: add refcount debugging
|
|
4589274c
|
2017-10-16T12:56:19
|
|
libpkgconf: start to remove PKGCONF_BUFSIZE allocations from the stack. (closes #149)
Patch by Karen Arutyunov.
|
|
12973857
|
2017-10-16T12:51:59
|
|
libpkgconf: fragment: remove obsolete code in pkgconf_fragment_should_munge()
|
|
36551cca
|
2017-10-16T11:30:22
|
|
libpkgconf: path: relocate the path before doing dedup checks (closes #151)
|
|
3bc2e21d
|
2017-10-16T11:25:52
|
|
libpkgconf: path: ensure entire buffer is zeroed before calling realpath() on it (closes #150)
|
|
6985a179
|
2017-10-11T17:03:21
|
|
libpkgconf: Fix issue when sysroot is '/'
If sysroot is /, simply do nothing.
This fixes #146
|
|
fae65710
|
2017-09-23T00:24:34
|
|
libpkgconf: argvsplit: handle double backslash case properly (closes #140)
|
|
abe0f5c8
|
2017-09-23T00:19:16
|
|
libpkgconf: fileio: fix quoting logic for double backslash case (ref #140)
|