dev-libs/capnproto: Security cleanup (bug #618180)

[Whissi]

Security cleanup, dropping an old vulnerable version.

[gentoo-repo-qa-bot]

Pull Request assignment

Areas affected: ebuilds
Packages affected: dev-libs/capnproto

dev-libs/capnproto: @aballier

[aballier]

0.5.3.1 is the fixed version

please fix commit message accordingly

[Whissi]

Sorry, I don't follow. From https://bugs.gentoo.org/show_bug.cgi?id=618180#c0:

However, these fuzz tests were introduced after the 0.5.x release branch,
hence are not currently present in release versions of Cap'n Proto, only in
git. A 0.6 release will come soon, fixing this.

The bugfix commit forces the compiler to perform all checks by casting the
relevant pointers to uintptr_t. According to the standard, unsigned integers
implement modulo arithmetic, rather than leaving
overflow undefined, thus the compiler cannot make the assumptions that lead
to eliding the check. This change has been shown to fix the problem in
practice. However, this quick fix does not technically
avoid undefined behavior, as the code still computes pointers that point to
invalid locations before they are checked. A technically-correct solution
has been implemented in the next commit,
2ca8e41140ebc618b8fb314b393b0a507568cf21. However, as this required more
extensive refactoring, it is not appropriate for cherry-picking, and will
only land in versions 0.6 and up.

So to be really safe and avoid problems we should drop v0.5.3.1 and keep only >=0.6.0 which should contain all the fixes/refactoring work.

Is there actual any reason why you want to keep =0.5.3.1?

[aballier]

no reason to keep 0.5.3.1 but the commit msg should still be fixed as people using 0.5.3.1 are still safe I think

anyway, this is really nitpick, so merge as is if you wish

[gentoo-repo-qa-bot]

😞 The QA check for this pull request has found the following issues:

Issues inherited from Gentoo (may be modified by PR):
https://qa-reports.gentoo.org/output/gentoo-ci/1c8752063/output.html#sci-biology/mammoth
https://qa-reports.gentoo.org/output/gentoo-ci/1c8752063/output.html#sci-chemistry/ambertools
https://qa-reports.gentoo.org/output/gentoo-ci/1c8752063/output.html#sci-chemistry/gamess
https://qa-reports.gentoo.org/output/gentoo-ci/1c8752063/output.html#sci-chemistry/mead
https://qa-reports.gentoo.org/output/gentoo-ci/1c8752063/output.html#sys-libs/suacomp

[FuzzyGophers]

tree is clean.