Skip to content

CVE-2019-12900 #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 10, 2024
Merged

CVE-2019-12900 #8

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3ebc21a
Use bzip2-clib, fixing CVE-2019-12900
hasufell Mar 10, 2024
3c804f1
Introduce system-bzlib flag
hasufell Mar 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions bzlib.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,12 @@ extra-source-files: cbits/bzlib_private.h cbits/LICENSE

tested-with: GHC==9.8.2, GHC==9.6.4, GHC==9.4.8, GHC==9.2.8, GHC==9.0.2, GHC==8.10.7, GHC==8.8.4, GHC==8.6.5, GHC==8.4.4, GHC==8.2.2, GHC==8.0.2, GHC==7.10.3, GHC==7.8.4, GHC==7.6.3, GHC==7.4.2, GHC==7.2.2, GHC==7.0.4

flag system-bzlib
description:
Use system bzlib rather than the bundled sources
default: True
manual: True
Comment on lines +27 to +31
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the right default, imo.

Using bundled C sources should be the last resort. Even under windows you can build against bzip2 just fine: https://packages.msys2.org/base/mingw-w64-bzip2

Unfortunately, upstream does not provide a pkg-config file, so we can't use the auto fallback mechanism.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand your position, but my experience with other packages is that practically it would force Windows users to stay on the older, vulnerable version of bzlib.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, feel free to cherry-pick the first commit then, which keeps the old behavior.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I'll merge and revert the second commit then.


source-repository head
type: git
location: https://github.com/haskell/bzlib.git
Expand All @@ -39,17 +45,11 @@ library
build-depends: fail < 5
includes: bzlib.h
ghc-options: -Wall
if !os(windows)
-- Normally we use the the standard system bz2 lib:
extra-libraries: bz2

if flag(system-bzlib)
extra-libraries: bz2
else
-- However for the benefit of users of Windows (which does not have zlib
-- by default) we bundle a complete copy of the C sources of bzip2-1.0.6
c-sources: cbits/blocksort.c cbits/bzlib.c cbits/compress.c
cbits/crctable.c cbits/decompress.c cbits/huffman.c
cbits/randtable.c
include-dirs: cbits
install-includes: bzlib.h
build-depends: bzip2-clib

test-suite tests
type: exitcode-stdio-1.0
Expand Down