[PR PATCH] openjdk8: update to 8u252b09 (various CVEs)

[PR PATCH] openjdk8: update to 8u252b09 (various CVEs)

[pullmoll]

[-- Attachment #1: Type: text/plain, Size: 471 bytes --]

There is a new pull request by pullmoll against master on the void-packages repository

https://github.com/pullmoll/void-packages openjdk8
https://github.com/void-linux/void-packages/pull/21440

openjdk8: update to 8u252b09 (various CVEs)
CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757
CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803
CVE-2020-2805

[ci skip]

A patch file from https://github.com/void-linux/void-packages/pull/21440.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-openjdk8-21440.patch --]
[-- Type: text/x-diff, Size: 7731 bytes --]

From fd0f26f3e3b3fcf315f81c2edcd6dd8c6c4585f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=BCrgen=20Buchm=C3=BCller?= <pullmoll@t-online.de>
Date: Tue, 28 Apr 2020 22:28:57 +0200
Subject: [PATCH] openjdk8: update to 8u252b09 (various CVEs)

CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757
CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803
CVE-2020-2805

[ci skip]
---
 ...005_8158260-pr2991-rh1341258-aarch64.patch | 34 -------
 .../patches/102_jdk-getmntent-buffer.patch    | 88 -------------------
 srcpkgs/openjdk8/template                     | 22 ++---
 3 files changed, 11 insertions(+), 133 deletions(-)
 delete mode 100644 srcpkgs/openjdk8/patches/005_8158260-pr2991-rh1341258-aarch64.patch
 delete mode 100644 srcpkgs/openjdk8/patches/102_jdk-getmntent-buffer.patch

diff --git a/srcpkgs/openjdk8/patches/005_8158260-pr2991-rh1341258-aarch64.patch b/srcpkgs/openjdk8/patches/005_8158260-pr2991-rh1341258-aarch64.patch
deleted file mode 100644
index 12c843af107..00000000000
--- a/srcpkgs/openjdk8/patches/005_8158260-pr2991-rh1341258-aarch64.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-# HG changeset patch
-# User simonis
-# Date 1466155884 -7200
-#      Fri Jun 17 11:31:24 2016 +0200
-# Node ID 4b40867e627dd9043bc67a4795caa9834ef69478
-# Parent  3fc29347b27fdd2075e6ec6d80bb26ab2bf667c1
-8158260, PR2991, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions
-Summary: Adjust instruction generation. Includes portions of 8026049 for test case.
-Reviewed-by: goetz
-Contributed-by: gromero@linux.vnet.ibm.com, horii@jp.ibm.com
-
-diff -Nru openjdk.orig/hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp openjdk/hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp
---- openjdk.orig/hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp	2018-03-21 09:00:58.000000000 +0000
-+++ openjdk/hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp	2018-03-21 09:54:01.579562708 +0000
-@@ -1,6 +1,6 @@
- /*
-- * Copyright (c) 2013, Red Hat Inc.
-  * Copyright (c) 1997, 2012, Oracle and/or its affiliates.
-+ * Copyright (c) 2015, Red Hat Inc. All rights reserved.
-  * All rights reserved.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-@@ -296,6 +296,11 @@
-     UsePopCountInstruction = true;
-   }
- 
-+  // This machine allows unaligned memory accesses
-+  if (FLAG_IS_DEFAULT(UseUnalignedAccesses)) {
-+    FLAG_SET_DEFAULT(UseUnalignedAccesses, true);
-+  }
-+
-   if (FLAG_IS_DEFAULT(UseMontgomeryMultiplyIntrinsic)) {
-     UseMontgomeryMultiplyIntrinsic = true;
-   }
diff --git a/srcpkgs/openjdk8/patches/102_jdk-getmntent-buffer.patch b/srcpkgs/openjdk8/patches/102_jdk-getmntent-buffer.patch
deleted file mode 100644
index 075a9d42385..00000000000
--- a/srcpkgs/openjdk8/patches/102_jdk-getmntent-buffer.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-Give a much bigger buffer to getmntent_r.
-
-https://bugs.alpinelinux.org/issues/7093
-
-diff --git a/openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c b/openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c
-index c8500db..d0b85d6 100644
---- openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c
-+++ openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c
-@@ -33,6 +33,7 @@
- #include <dlfcn.h>
- #include <errno.h>
- #include <mntent.h>
-+#include <limits.h>
- 
- #include "sun_nio_fs_LinuxNativeDispatcher.h"
- 
-@@ -173,8 +174,8 @@ Java_sun_nio_fs_LinuxNativeDispatcher_getmntent(JNIEnv* env, jclass this,
-     jlong value, jobject entry)
- {
-     struct mntent ent;
--    char buf[1024];
--    int buflen = sizeof(buf);
-+    char *buf = NULL;
-+    const size_t buflen = PATH_MAX * 4;
-     struct mntent* m;
-     FILE* fp = jlong_to_ptr(value);
-     jsize len;
-@@ -183,10 +184,17 @@ Java_sun_nio_fs_LinuxNativeDispatcher_getmntent(JNIEnv* env, jclass this,
-     char* dir;
-     char* fstype;
-     char* options;
-+    jint res = -1;
- 
--    m = getmntent_r(fp, &ent, (char*)&buf, buflen);
--    if (m == NULL)
-+    buf = malloc(buflen);
-+    if (buf == NULL) {
-+        JNU_ThrowOutOfMemoryError(env, "native heap");
-         return -1;
-+    }
-+    m = getmntent_r(fp, &ent, buf, buflen);
-+    if (m == NULL)
-+        goto out;
-+
-     name = m->mnt_fsname;
-     dir = m->mnt_dir;
-     fstype = m->mnt_type;
-@@ -195,32 +203,35 @@ Java_sun_nio_fs_LinuxNativeDispatcher_getmntent(JNIEnv* env, jclass this,
-     len = strlen(name);
-     bytes = (*env)->NewByteArray(env, len);
-     if (bytes == NULL)
--        return -1;
-+        goto out;
-     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)name);
-     (*env)->SetObjectField(env, entry, entry_name, bytes);
- 
-     len = strlen(dir);
-     bytes = (*env)->NewByteArray(env, len);
-     if (bytes == NULL)
--        return -1;
-+        goto out;
-     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)dir);
-     (*env)->SetObjectField(env, entry, entry_dir, bytes);
- 
-     len = strlen(fstype);
-     bytes = (*env)->NewByteArray(env, len);
-     if (bytes == NULL)
--        return -1;
-+        goto out;
-     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)fstype);
-     (*env)->SetObjectField(env, entry, entry_fstype, bytes);
- 
-     len = strlen(options);
-     bytes = (*env)->NewByteArray(env, len);
-     if (bytes == NULL)
--        return -1;
-+        goto out;
-     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)options);
-     (*env)->SetObjectField(env, entry, entry_options, bytes);
- 
--    return 0;
-+    res = 0;
-+out:
-+    free(buf);
-+    return res;
- }
- 
- JNIEXPORT void JNICALL
diff --git a/srcpkgs/openjdk8/template b/srcpkgs/openjdk8/template
index 7113d6e8ba0..ad1c3a23b6e 100644
--- a/srcpkgs/openjdk8/template
+++ b/srcpkgs/openjdk8/template
@@ -3,13 +3,13 @@
 # TODO: make -headless versions
 # TODO: config files?
 _java_ver=8
-_jdk_update=242
-_jdk_build=01
+_jdk_update=252
+_jdk_build=09
 _main_ver=${_java_ver}u${_jdk_update}
 _final_jdk_home="usr/lib/jvm/java-1.8-openjdk"
 pkgname=openjdk8
 version="${_java_ver}u${_jdk_update}b${_jdk_build}"
-revision=2
+revision=1
 # we're using aarch64 port repo to get aarch64 JIT; the repo is
 # otherwise the same as the normal one, just with aarch64 port added
 _repo_ver="aarch64-shenandoah-jdk${version/b/-b}"
@@ -52,14 +52,14 @@ distfiles="
  http://hg.openjdk.java.net/aarch64-port/jdk8u-shenandoah/langtools/archive/${_repo_ver}.tar.gz>langtools-${_repo_ver}.tar.gz
  http://hg.openjdk.java.net/aarch64-port/jdk8u-shenandoah/nashorn/archive/${_repo_ver}.tar.gz>nashorn-${_repo_ver}.tar.gz"
 
-checksum="f251afdc71f252c4d2559f9d49cbce3128ffcba2185b5d3a0e7020d5d214bab7
- 27590eaa48dcddaf9a8aa305333b5e619acede415f7a091afd9cca8fd69ccf85
- af73a2b1a6bf2d59e5c2cb87253844c2969489f37ac6ad352c60599ea8a7e116
- 7ecb436b63feceec86b0aefca3b95e2b03d08503a26233b0d5f09441826925db
- 93bbcdfa489d4e5b68a7ccc5faf92ef74ea5ac5b2e3f93314158ea50624fd1c2
- 6bd28277bb73c29d189c70ca2d61263e698406d89e54403c09f19a4e852a703a
- 287d716a3f4ecd8a7c2e579a7514a0998c0164f544084cc90d8a476813663904
- e272f22edc8f43c4c2dfcce6073b7689332a05014ead734dff24537a49e23682"
+checksum="92c682ee19844341a21853c7db8bd7654d2e6e50a4c8d630b6b6be34c2591341
+ 5ced6b56b60a658c04092ee6152462b4f3f84465b654f4bc874f03a2bc6539fb
+ 255a113a1a299caef89b928ebcdb6964f0e63009089a07c162562beb20aa42c8
+ ec9a858770e348fe60817a67e670e268fb2445d64f99b6d4d33556f4e2f0c1d1
+ 96ae2b2362f3d45874247b11bd8df59914fbfab051513e908eda11bb71a5837b
+ de5fe5813d47092e048f6860dc58dad8a2dbd2b9e7272493cff78cd7ad7aa82d
+ a971f578c3d8550f0b96b01ac24fc408cdcc7f2923d530d5ada81bba8caef9fe
+ 02d4042b042c457b0ed41cc6c95cfe005badec55b5fc19f03f57aebbc7121e52"
 
 build_options="docs"
 desc_option_docs="Build documentation"

Re: openjdk8: update to 8u252b09 (various CVEs)

[pullmoll]

[-- Attachment #1: Type: text/plain, Size: 248 bytes --]

New comment by pullmoll on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-620842674

Comment:
I only tested x86_64 with an app I sometimes use. Still build for all arches to see if there are problems,

Re: openjdk8: update to 8u252b09 (various CVEs)

[pullmoll]

[-- Attachment #1: Type: text/plain, Size: 257 bytes --]

New comment by pullmoll on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-620842674

Comment:
I only tested x86_64 with an app I sometimes use. Still building for all other arches to see if there are problems,

Re: openjdk8: update to 8u252b09 (various CVEs)

[pullmoll]

[-- Attachment #1: Type: text/plain, Size: 333 bytes --]

New comment by pullmoll on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-620842674

Comment:
I only tested x86_64 with an app I sometimes use. Still building for all other arches to see if there are problems,

Edit: Built for all target arches except `mips*` which is not supported.

Re: openjdk8: update to 8u252b09 (various CVEs)

[q66]

[-- Attachment #1: Type: text/plain, Size: 170 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-620954567

Comment:
lgtm, i will give it a spin later

Re: openjdk8: update to 8u252b09 (various CVEs)

[pullmoll]

[-- Attachment #1: Type: text/plain, Size: 1825 bytes --]

New comment by pullmoll on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-621792413

Comment:
FWIW installed `openjdk8`, `clojure`, and `leiningen` on my G5 (ppc64).
Then downloaded some [`clojure-examples`](https://github.com/wtfleming/clojure-examples) zip from github, extracted it and tried e.g. `cd clj-time;lein run project.clj`. This is the log output:
```
OpenJDK 64-Bit Server VM warning: TieredCompilation is disabled in this release.
OpenJDK 64-Bit Server VM warning: TieredCompilation is disabled in this release.
Exception in thread "main" clojure.lang.ArityException: Wrong number of args (1) passed to: core/-main, compiling:(/tmp/form-init2420431995921281456.clj:1:72)
	at clojure.lang.Compiler.load(Compiler.java:7142)
	at clojure.lang.Compiler.loadFile(Compiler.java:7086)
	at clojure.main$load_script.invoke(main.clj:274)
	at clojure.main$init_opt.invoke(main.clj:279)
	at clojure.main$initialize.invoke(main.clj:307)
	at clojure.main$null_opt.invoke(main.clj:342)
	at clojure.main$main.doInvoke(main.clj:420)
	at clojure.lang.RestFn.invoke(RestFn.java:421)
	at clojure.lang.Var.invoke(Var.java:383)
	at clojure.lang.AFn.applyToHelper(AFn.java:156)
	at clojure.lang.Var.applyTo(Var.java:700)
	at clojure.main.main(main.java:37)
Caused by: clojure.lang.ArityException: Wrong number of args (1) passed to: core/-main
	at clojure.lang.AFn.throwArity(AFn.java:429)
	at clojure.lang.AFn.invoke(AFn.java:32)
	at clojure.lang.Var.invoke(Var.java:379)
	at user$eval5.invoke(form-init2420431995921281456.clj:1)
	at clojure.lang.Compiler.eval(Compiler.java:6703)
	at clojure.lang.Compiler.eval(Compiler.java:6693)
	at clojure.lang.Compiler.load(Compiler.java:7130)
	... 11 more
```
or do you @Vaelatern have an example that should build ok?

Re: openjdk8: update to 8u252b09 (various CVEs)

[Vaelatern]

[-- Attachment #1: Type: text/plain, Size: 455 bytes --]

New comment by Vaelatern on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-621896594

Comment:
@pullmoll The `project.clj` is not typically run. You should instead try to `lein run` to run it.

```
 $ lein run
#<DateTime 1998-04-25T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T14:25:00.000Z>
```

Re: openjdk8: update to 8u252b09 (various CVEs)

[Vaelatern]

[-- Attachment #1: Type: text/plain, Size: 668 bytes --]

New comment by Vaelatern on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-621897287

Comment:
On my fresh install with only ever openjdk8-8u252b09:

```
Retrieving clj-time/clj-time/0.8.0/clj-time-0.8.0.pom from clojars
Retrieving joda-time/joda-time/2.3/joda-time-2.3.pom from central
Retrieving joda-time/joda-time/2.3/joda-time-2.3.jar from central
Retrieving clj-time/clj-time/0.8.0/clj-time-0.8.0.jar from clojars
#<DateTime 1998-04-25T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T14:25:00.000Z>
```

Re: openjdk8: update to 8u252b09 (various CVEs)

[Vaelatern]

[-- Attachment #1: Type: text/plain, Size: 680 bytes --]

New comment by Vaelatern on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-621897287

Comment:
On my fresh install with only ever openjdk8-8u252b09:

```
$ lein run
Retrieving clj-time/clj-time/0.8.0/clj-time-0.8.0.pom from clojars
Retrieving joda-time/joda-time/2.3/joda-time-2.3.pom from central
Retrieving joda-time/joda-time/2.3/joda-time-2.3.jar from central
Retrieving clj-time/clj-time/0.8.0/clj-time-0.8.0.jar from clojars
#<DateTime 1998-04-25T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T00:00:00.000Z>
#<DateTime 2014-01-22T14:25:00.000Z>
```

Re: openjdk8: update to 8u252b09 (various CVEs)

[pullmoll]

[-- Attachment #1: Type: text/plain, Size: 318 bytes --]

New comment by pullmoll on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-621921852

Comment:
Well, I don't know `clojure` nor `leiningen` :)
With `lein run` I get similar output, except for the Server VM warning, so I think we can say a simple test for ppc64 passed.

Re: openjdk8: update to 8u252b09 (various CVEs)

[q66]

[-- Attachment #1: Type: text/plain, Size: 211 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/pull/21440#issuecomment-621933363

Comment:
running the builds now, gonna merge this later if i don't run into anyhing

Re: [PR PATCH] [Merged]: openjdk8: update to 8u252b09 (various CVEs)

[q66]

[-- Attachment #1: Type: text/plain, Size: 317 bytes --]

There's a merged pull request on the void-packages repository

openjdk8: update to 8u252b09 (various CVEs)
https://github.com/void-linux/void-packages/pull/21440

Description:
CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757
CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803
CVE-2020-2805

[ci skip]