spice: security bump to version 0.12.6
authorPeter Korsgaard <peter@korsgaard.com>
Wed, 21 Jun 2017 22:07:42 +0000 (00:07 +0200)
committerPeter Korsgaard <peter@korsgaard.com>
Thu, 22 Jun 2017 21:25:24 +0000 (23:25 +0200)
Fixes the following security issues:

CVE-2015-3247: Race condition in the worker_update_monitors_config function
in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial
of service (heap-based memory corruption and QEMU-KVM crash) or possibly
execute arbitrary code on the host via unspecified vectors.

CVE-2015-5260: Heap-based buffer overflow in SPICE before 0.12.6 allows
guest OS users to cause a denial of service (heap-based memory corruption
and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL
commands related to the surface_id parameter.

CVE-2015-5261: Heap-based buffer overflow in SPICE before 0.12.6 allows
guest OS users to read and write to arbitrary memory locations on the host
via guest QXL commands related to surface creation.

Client/gui support is gone upstream (moved to spice-gtk / virt-viewer), so
add Config.in.legacy handling for them.

Lz4 is a new optional dependency, so handle it.

The spice protocol definition is no longer included and instead used from
spice-protocol.  The build system uses pkg-config --variable=codegendir to
find the build time path of this, which doesn't take our STAGING_DIR prefix
into consideration, so it needs some help.  The installed protocol
definition will likewise be newer than the generated files, so we need to
workaround that to ensure they are not regenerated (which needs host python
/ pyparsing).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Config.in.legacy
package/spice/Config.in
package/spice/spice.hash
package/spice/spice.mk

index dc99b7c2eb523c054c2d363ead022019e49866bf..361d331dc9e18f8d382afbbb195c568be6e6587a 100644 (file)
@@ -145,6 +145,22 @@ endif
 ###############################################################################
 comment "Legacy options removed in 2017.08"
 
+config BR2_PACKAGE_SPICE_CLIENT
+       bool "spice client support removed"
+       select BR2_LEGACY
+       help
+         Spice client support has been removed upstream. The
+         functionality now lives in the spice-gtk widget and
+         virt-viewer.
+
+config BR2_PACKAGE_SPICE_GUI
+       bool "spice gui support removed"
+       select BR2_LEGACY
+       help
+         Spice gui support has been removed upstream. The
+         functionality now lives in the spice-gtk widget and
+         virt-viewer.
+
 config BR2_PACKAGE_SPICE_TUNNEL
        bool "spice network redirection removed"
        select BR2_LEGACY
index 220f9994dad7d161d93d5531530ca0250c2b6c30..2241b55b3d8b533628047d8778406056b3a2ae23 100644 (file)
@@ -22,38 +22,3 @@ config BR2_PACKAGE_SPICE
          This package implements the server-part of Spice.
 
          http://www.spice-space.org/
-
-if BR2_PACKAGE_SPICE
-
-comment "client depends on X.org"
-       depends on !BR2_PACKAGE_XORG7
-
-config BR2_PACKAGE_SPICE_CLIENT
-       bool "Enable client"
-       depends on BR2_PACKAGE_XORG7
-       depends on BR2_TOOLCHAIN_HAS_THREADS
-       depends on BR2_INSTALL_LIBSTDCPP
-       select BR2_PACKAGE_XLIB_LIBXFIXES
-       select BR2_PACKAGE_XLIB_LIBXRANDR
-       select BR2_PACKAGE_XLIB_LIBX11
-       select BR2_PACKAGE_XLIB_LIBXEXT
-       select BR2_PACKAGE_XLIB_LIBXRENDER
-       select BR2_PACKAGE_ALSA_LIB
-
-comment "client needs a toolchain w/ threads, C++"
-       depends on BR2_PACKAGE_XORG7
-       depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_INSTALL_LIBSTDCPP
-
-config BR2_PACKAGE_SPICE_GUI
-       bool "Enable GUI"
-       depends on BR2_PACKAGE_SPICE_CLIENT
-       depends on !BR2_STATIC_LIBS
-       select BR2_PACKAGE_CEGUI06
-       help
-         Say 'y' here to enable the Graphical User Interface (GUI)
-         start dialog.
-
-comment "gui needs a toolchain w/ dynamic library"
-       depends on BR2_STATIC_LIBS
-
-endif # BR2_PACKAGE_SPICE
index 0a943f033282cbd7846ea19888e103b5f93800fd..04bd516689e07c8a0f9458f0d8388af78e291cda 100644 (file)
@@ -1,2 +1,2 @@
 # Locally calculated
-sha256 4209a20d8f67cb99a8a6ac499cfe79a18d4ca226360457954a223d6795c2f581        spice-0.12.5.tar.bz2
+sha256 f148ea30135bf80a4f465ce723a1cd6d4ccb34c098b6298a020b378ace8569b6        spice-0.12.6.tar.bz2
index ba76a14d610473eb08a1a090417b3ad95fb1349b..f1fb46d29cbf67f974614d167033089bfe4c36d3 100644 (file)
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SPICE_VERSION = 0.12.5
+SPICE_VERSION = 0.12.6
 SPICE_SOURCE = spice-$(SPICE_VERSION).tar.bz2
 SPICE_SITE = http://www.spice-space.org/download/releases
 SPICE_LICENSE = LGPL-2.1+
@@ -35,38 +35,36 @@ else
 SPICE_CONF_OPTS += --disable-celt051
 endif
 
+ifeq ($(BR2_PACKAGE_LZ4),y)
+SPICE_CONF_OPTS += --enable-lz4
+SPICE_DEPENDENCIES += lz4
+else
+SPICE_CONF_OPTS += --disable-lz4
+endif
+
 # no enable/disable, detected using pkg-config
 ifeq ($(BR2_PACKAGE_OPUS),y)
 SPICE_DEPENDENCIES += opus
 endif
 
-ifeq ($(BR2_PACKAGE_SPICE_CLIENT),y)
-SPICE_CONF_OPTS += --enable-client
-SPICE_DEPENDENCIES += \
-       xlib_libXfixes \
-       xlib_libXrandr \
-       xlib_libX11 \
-       xlib_libXext \
-       xlib_libXrender \
-       alsa-lib
-else
-SPICE_CONF_OPTS += --disable-client
-endif
-
-ifeq ($(BR2_PACKAGE_SPICE_GUI),y)
-SPICE_CONF_OPTS += --enable-gui
-SPICE_DEPENDENCIES += cegui06
-else
-SPICE_CONF_OPTS += --disable-gui
-endif
+# build system uses pkg-config --variable=codegendir spice-protocol which
+# returns the runtime path rather than build time, so it needs some help
+SPICE_MAKE_OPTS = CODE_GENERATOR_BASEDIR=$(STAGING_DIR)/usr/lib/spice-protocol
+SPICE_INSTALL_STAGING_OPTS = $(SPICE_MAKE_OPTS) DESTDIR=$(STAGING_DIR) install
+SPICE_INSTALL_TARGET_OPTS = $(SPICE_MAKE_OPTS) DESTDIR=$(TARGET_DIR) install
 
 # spice uses a number of source files that are generated with python / pyparsing.
 # The generated files are part of the tarball, so python / pyparsing isn't needed
 # when building from the tarball, but the configure script gets confused and looks
 # for the wrong file name to know if it needs to check for python / pyparsing,
-# so convince it they aren't needed
+# so convince it they aren't needed.
+# It will also regenerate these files if the spice-protocol protocol definition
+# is newer than the generated files (which it will be when spice-protocol
+# installs it to staging), so ensure their timestamp is updated to skip this.
 define SPICE_NO_PYTHON_PYPARSING
+       mkdir -p $(@D)/client
        touch $(@D)/client/generated_marshallers.cpp
+       touch $(@D)/spice-common/common/generated_*
 endef
 
 SPICE_PRE_CONFIGURE_HOOKS += SPICE_NO_PYTHON_PYPARSING