From 25d6478d8fb90e817a7e2fa4ee74929a53480593 Mon Sep 17 00:00:00 2001 From: Thilo Fromm Date: Thu, 5 Nov 2026 08:59:35 +0100 Subject: [PATCH] Update to latest Gentoo, drop outdated patches This change drops user patches from - coreos-overlay/coreos/user-patches/sys-apps/coreutils (only apply to coreutils 9.11 and older) - coreos-overlay/coreos/user-patches/dev-lang/python (only apply to python 3.13.16 and older) It also updates the Gentoo submodule to latest upstream, which (among other changes) stabilises coreutils 9.12. Without removing our custom patches, that upgrade would cause build breakage. --- .../dev-lang/python/0001-cve-2026-19672.patch | 98 ------------------- .../user-patches/dev-lang/python/README.md | 3 - .../0001-uniq-fix-read-overrun-with-w.patch | 33 ------- .../0002-unexpand-fix-heap-overflow.patch | 35 ------- .../user-patches/sys-apps/coreutils/README.md | 3 - sdk_container/src/third_party/gentoo | 2 +- 6 files changed, 1 insertion(+), 173 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/0001-cve-2026-19672.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0002-unexpand-fix-heap-overflow.patch delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/README.md diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/0001-cve-2026-19672.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/0001-cve-2026-19672.patch deleted file mode 100644 index 07250a72123..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/0001-cve-2026-19672.patch +++ /dev/null @@ -1,98 +0,0 @@ -From c7979f3a819011a3222bd16e671264b1e34282cb Mon Sep 17 00:00:00 2001 -From: "Miss Islington (bot)" - <31488909+miss-islington@users.noreply.github.com> -Date: Wed, 19 Aug 2026 15:33:25 +0200 -Subject: [PATCH] [3.13] gh-155999: `tarfile`: handle a member that leaves the - destination but comes back (GH-156000) (#156042) - -(cherry picked from commit 97688346ada2df3e5b9c279348862c3d64ab0823) - -Co-authored-by: Stan Ulbrych ---- - Doc/library/tarfile.rst | 8 ++++++++ - Lib/tarfile.py | 7 +++++++ - Lib/test/test_tarfile.py | 14 ++++++++++++++ - .../2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst | 5 +++++ - 4 files changed, 34 insertions(+) - create mode 100644 Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst - -diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst -index c820e3d159b9a5b..d5c5328210cd7e4 100644 ---- a/Doc/library/tarfile.rst -+++ b/Doc/library/tarfile.rst -@@ -1049,6 +1049,10 @@ reused in custom filters: - paths (in case the name is absolute - even after stripping slashes, e.g. ``C:/foo`` on Windows). - This raises :class:`~tarfile.AbsolutePathError`. -+ - Normalize filenames (:attr:`TarInfo.name`) that contain ``..`` components -+ using :func:`os.path.normpath`. -+ Note that this removes internal ``..`` components, which may change the -+ meaning of the name if it traverses symbolic links. - - :ref:`Refuse ` to extract files whose absolute - path (after following symlinks) would end up outside the destination. - This raises :class:`~tarfile.OutsideDestinationError`. -@@ -1057,6 +1061,10 @@ reused in custom filters: - - Return the modified ``TarInfo`` member. - -+ .. versionchanged:: next -+ -+ Filenames containing ``..`` components are now normalized. -+ - .. function:: data_filter(member, path) - - Implements the ``'data'`` filter. -diff --git a/Lib/tarfile.py b/Lib/tarfile.py -index 9da2667abe15da6..3c59eac5d9a0f11 100755 ---- a/Lib/tarfile.py -+++ b/Lib/tarfile.py -@@ -808,6 +808,13 @@ def _get_filtered_attrs(member, dest_path, for_data=True): - # For example, 'C:/foo' on Windows. - raise AbsolutePathError(member) - # Ensure we stay in the destination -+ if '..' in name.replace(os.sep, '/').split('/'): -+ # Directories are created from the name as given, so a name that -+ # leaves the destination part-way through would create them -+ # outside it even if the resolved path stays inside. -+ normalized = os.path.normpath(name) -+ if normalized != name: -+ name = new_attrs['name'] = normalized - target_path = os.path.realpath(os.path.join(dest_path, name), - strict=os.path.ALLOW_MISSING) - if os.path.commonpath([target_path, dest_path]) != dest_path: -diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py -index 31e844328b31901..86fe8efac2e3495 100644 ---- a/Lib/test/test_tarfile.py -+++ b/Lib/test/test_tarfile.py -@@ -3948,6 +3948,20 @@ def test_absolute(self): - tarfile.AbsolutePathError, - """['"].*escaped.evil['"] has an absolute path""") - -+ def test_parent_dir_out_and_back(self): -+ # Test a member that leaves the destination and comes back. -+ # The containment check looks at the resolved path, which stays -+ # inside, but the intermediate directories are created from the -+ # name as given, which does not. -+ with ArchiveMaker() as arc: -+ arc.add(f'../escaped.evil/../{self.destdir.name}/sub/file', -+ content='content') -+ -+ for filter in 'tar', 'data': -+ with self.subTest(filter): -+ with self.check_context(arc.open(), filter): -+ self.expect_file('sub/file', content='content') -+ - @symlink_test - def test_parent_symlink(self): - # Test interplaying symlinks -diff --git a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst -new file mode 100644 -index 000000000000000..59b725e55bbffda ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst -@@ -0,0 +1,5 @@ -+Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating -+directories outside the destination for members whose name leaves the -+destination and returns to it, such as ``../evil/../dest/sub/file``. The -+containment check used the resolved path, but intermediate directories were -+created from the name as given. diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md deleted file mode 100644 index 4595c93cc43..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md +++ /dev/null @@ -1,3 +0,0 @@ -Patch `0001-cve-2026-19672.patch` fixes a security issue in tarfile -module. The patch can be dropped after updating to python 3.13.16 or -3.14.8. diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch deleted file mode 100644 index cd8aaf13a49..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch +++ /dev/null @@ -1,33 +0,0 @@ -From e2da005e28935f23b2c0f224f6fcbfe0d8c13c12 Mon Sep 17 00:00:00 2001 -From: Paul Eggert -Date: Tue, 28 Apr 2026 11:25:00 -0700 -Subject: [PATCH 1/2] uniq: fix read overrun with -w -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Problem reported by Michał Majchrowicz. -* src/uniq.c (find_field): Fix typo. -* tests/uniq/uniq.pl (add_z_variants): Test for the bug. ---- - src/uniq.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/uniq.c b/src/uniq.c -index 30463598a..5834596f9 100644 ---- a/src/uniq.c -+++ b/src/uniq.c -@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen) - else - { - char *ep = lp; -- for (idx_t i = check_chars; 0 < i && lp < lim; i--) -- ep += mcel_scan (lp, lim).len; -+ for (idx_t i = check_chars; 0 < i && ep < lim; i--) -+ ep += mcel_scan (ep, lim).len; - len = ep - lp; - } - --- -2.54.0 - diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0002-unexpand-fix-heap-overflow.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0002-unexpand-fix-heap-overflow.patch deleted file mode 100644 index 37f25033278..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0002-unexpand-fix-heap-overflow.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 6e661c674d213f49128efbb3107a7bb9ced7348a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?P=C3=A1draig=20Brady?= -Date: Tue, 28 Apr 2026 20:33:10 +0100 -Subject: [PATCH 2/2] unexpand: fix heap overflow -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -* src/unexpand.c (unexpand): Use xinmalloc() to gracefully -handle overflow. Also use the runtime locale specific MB_CUR_MAX -rather than the worst case MB_LEN_MAX. -* tests/unexpand/mb.sh: Add a test case that fails in a default -glibc build with either MB_CUR_MAX or MB_LEN_MAX. -* NEWS: Mention the bug fix. -Reported by Michał Majchrowicz. ---- - src/unexpand.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/unexpand.c b/src/unexpand.c -index 4fbf9d3f8..761c8ead0 100644 ---- a/src/unexpand.c -+++ b/src/unexpand.c -@@ -131,7 +131,7 @@ unexpand (void) - /* The worst case is a non-blank character, then one blank, then a - tab stop, then MAX_COLUMN_WIDTH - 1 blanks, then a non-blank; so - allocate MAX_COLUMN_WIDTH bytes to store the blanks. */ -- pending_blank = ximalloc (max_column_width * sizeof (char) * MB_LEN_MAX); -+ pending_blank = xinmalloc (max_column_width, MB_CUR_MAX); - - while (true) - { --- -2.54.0 - diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/README.md deleted file mode 100644 index be0ad83b615..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/README.md +++ /dev/null @@ -1,3 +0,0 @@ -The patches `0001-uniq-fix-read-overrun-with-w.patch` and -`0002-unexpand-fix-heap-overflow.patch` can be dropped after updating -to 9.12 (or 9.11.1). diff --git a/sdk_container/src/third_party/gentoo b/sdk_container/src/third_party/gentoo index 5f2bb58159c..9374e148b92 160000 --- a/sdk_container/src/third_party/gentoo +++ b/sdk_container/src/third_party/gentoo @@ -1 +1 @@ -Subproject commit 5f2bb58159ca5f10e9f8baf3b77a139c0afa304a +Subproject commit 9374e148b92394c5c8025d6a51ba2b217c42fd48