Auto merge of #155210 - Mark-Simulacrum:stable-next, r=Mark-Simulacrum
[stable] Rust 1.95.0 release https://forge.rust-lang.org/release/process.html#stable-pr This also backports: * Patch musl's CVE-2026-6042 and CVE-2026-40200 rust-lang/rust#155171 and cherry picks latest release notes. r? me
This commit is contained in:
bors
260
RELEASES.md
260
RELEASES.md
@@ -1,3 +1,263 @@
|
||||
Version 1.95 (2026-04-16)
|
||||
==========================
|
||||
|
||||
<a id="1.95-Language"></a>
|
||||
|
||||
Language
|
||||
--------
|
||||
- [Stabilize `if let` guards on match arms](https://github.com/rust-lang/rust/pull/141295)
|
||||
- [`irrefutable_let_patterns` lint no longer lints on let chains](https://github.com/rust-lang/rust/pull/146832)
|
||||
- [Support importing path-segment keywords with renaming](https://github.com/rust-lang/rust/pull/146972)
|
||||
- [Stabilize inline assembly for PowerPC and PowerPC64](https://github.com/rust-lang/rust/pull/147996)
|
||||
- [const-eval: be more consistent in the behavior of padding during typed copies](https://github.com/rust-lang/rust/pull/148967)
|
||||
- [Const blocks are no longer evaluated to determine if expressions involving fallible operations can implicitly be constant-promoted.](https://github.com/rust-lang/rust/pull/150557). Expressions whose ability to implicitly be promoted would depend on the result of a const block are no longer implicitly promoted.
|
||||
- [Make operational semantics of pattern matching independent of crate and module](https://github.com/rust-lang/rust/pull/150681)
|
||||
|
||||
|
||||
<a id="1.95-Compiler"></a>
|
||||
|
||||
Compiler
|
||||
--------
|
||||
- [Stabilize `--remap-path-scope` for controlling the scoping of how paths get remapped in the resulting binary](https://github.com/rust-lang/rust/pull/147611)
|
||||
|
||||
|
||||
<a id="1.95-Platform-Support"></a>
|
||||
|
||||
Platform Support
|
||||
----------------
|
||||
- [Promote `powerpc64-unknown-linux-musl` to Tier 2 with host tools](https://github.com/rust-lang/rust/pull/149962)
|
||||
- [Promote `aarch64-apple-tvos` to Tier 2](https://github.com/rust-lang/rust/pull/152021)
|
||||
- [Promote `aarch64-apple-tvos-sim` to Tier 2](https://github.com/rust-lang/rust/pull/152021)
|
||||
- [Promote `aarch64-apple-watchos` to Tier 2](https://github.com/rust-lang/rust/pull/152021)
|
||||
- [Promote `aarch64-apple-watchos-sim` to Tier 2](https://github.com/rust-lang/rust/pull/152021)
|
||||
- [Promote `aarch64-apple-visionos` to Tier 2](https://github.com/rust-lang/rust/pull/152021)
|
||||
- [Promote `aarch64-apple-visionos-sim` to Tier 2](https://github.com/rust-lang/rust/pull/152021)
|
||||
|
||||
|
||||
Refer to Rust's [platform support page][platform-support-doc]
|
||||
for more information on Rust's tiered platform support.
|
||||
|
||||
[platform-support-doc]: https://doc.rust-lang.org/rustc/platform-support.html
|
||||
|
||||
<a id="1.95-Libraries"></a>
|
||||
|
||||
Libraries
|
||||
---------
|
||||
- [`thread::scope`: document how join interacts with TLS destructors](https://github.com/rust-lang/rust/pull/149482)
|
||||
- [Speed up `str::contains` on aarch64 targets with `neon` target feature enabled by default](https://github.com/rust-lang/rust/pull/152176)
|
||||
|
||||
|
||||
<a id="1.95-Stabilized-APIs"></a>
|
||||
|
||||
Stabilized APIs
|
||||
---------------
|
||||
|
||||
- [`MaybeUninit<[T; N]>: From<[MaybeUninit<T>; N]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-From%3CMaybeUninit%3C%5BT;+N%5D%3E%3E-for-%5BMaybeUninit%3CT%3E;+N%5D)
|
||||
- [`MaybeUninit<[T; N]>: AsRef<[MaybeUninit<T>; N]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-AsRef%3C%5BMaybeUninit%3CT%3E;+N%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E)
|
||||
- [`MaybeUninit<[T; N]>: AsRef<[MaybeUninit<T>]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-AsRef%3C%5BMaybeUninit%3CT%3E%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E)
|
||||
- [`MaybeUninit<[T; N]>: AsMut<[MaybeUninit<T>; N]>`](https://doc.rust-lang.org/beta/std/mem/union.MaybeUninit.html#impl-AsMut%3C%5BMaybeUninit%3CT%3E;+N%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E)
|
||||
- [`MaybeUninit<[T; N]>: AsMut<[MaybeUninit<T>]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-AsMut%3C%5BMaybeUninit%3CT%3E%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E)
|
||||
- [`[MaybeUninit<T>; N]: From<MaybeUninit<[T; N]>>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-From%3C%5BMaybeUninit%3CT%3E;+N%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E)
|
||||
- [`Cell<[T; N]>: AsRef<[Cell<T>; N]>`](https://doc.rust-lang.org/stable/std/cell/struct.Cell.html#impl-AsRef%3C%5BCell%3CT%3E;+N%5D%3E-for-Cell%3C%5BT;+N%5D%3E)
|
||||
- [`Cell<[T; N]>: AsRef<[Cell<T>]>`](https://doc.rust-lang.org/stable/std/cell/struct.Cell.html#impl-AsRef%3C%5BCell%3CT%3E%5D%3E-for-Cell%3C%5BT;+N%5D%3E)
|
||||
- [`Cell<[T]>: AsRef<[Cell<T>]>`](https://doc.rust-lang.org/stable/std/cell/struct.Cell.html#impl-AsRef%3C%5BCell%3CT%3E%5D%3E-for-Cell%3C%5BT%5D%3E)
|
||||
- [`bool: TryFrom<{integer}>`](https://doc.rust-lang.org/stable/std/primitive.bool.html#impl-TryFrom%3Cu128%3E-for-bool)
|
||||
- [`AtomicPtr::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicPtr.html#method.update)
|
||||
- [`AtomicPtr::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicPtr.html#method.try_update)
|
||||
- [`AtomicBool::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicBool.html#method.update)
|
||||
- [`AtomicBool::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicBool.html#method.try_update)
|
||||
- [`AtomicIn::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicIsize.html#method.update)
|
||||
- [`AtomicIn::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicIsize.html#method.try_update)
|
||||
- [`AtomicUn::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicUsize.html#method.update)
|
||||
- [`AtomicUn::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicUsize.html#method.try_update)
|
||||
- [`cfg_select!`](https://doc.rust-lang.org/stable/std/macro.cfg_select.html)
|
||||
- [`mod core::range`](https://doc.rust-lang.org/stable/core/range/index.html)
|
||||
- [`core::range::RangeInclusive`](https://doc.rust-lang.org/stable/core/range/struct.RangeInclusive.html)
|
||||
- [`core::range::RangeInclusiveIter`](https://doc.rust-lang.org/stable/core/range/struct.RangeInclusiveIter.html)
|
||||
- [`core::hint::cold_path`](https://doc.rust-lang.org/stable/core/hint/fn.cold_path.html)
|
||||
- [`<*const T>::as_ref_unchecked`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_ref_unchecked)
|
||||
- [`<*mut T>::as_ref_unchecked`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_ref_unchecked-1)
|
||||
- [`<*mut T>::as_mut_unchecked`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_mut_unchecked)
|
||||
|
||||
|
||||
These previously stable APIs are now stable in const contexts:
|
||||
|
||||
- [`fmt::from_fn`](https://doc.rust-lang.org/stable/std/fmt/fn.from_fn.html)
|
||||
- [`ControlFlow::is_break`](https://doc.rust-lang.org/stable/core/ops/enum.ControlFlow.html#method.is_break)
|
||||
- [`ControlFlow::is_continue`](https://doc.rust-lang.org/stable/core/ops/enum.ControlFlow.html#method.is_continue)
|
||||
|
||||
|
||||
<a id="1.95-Cargo"></a>
|
||||
|
||||
Cargo
|
||||
-----
|
||||
- [docs(report): enhance man pages for `cargo report *`](https://github.com/rust-lang/cargo/pull/16430/)<a id="1.95-Rustdoc"></a>
|
||||
|
||||
Rustdoc
|
||||
-----
|
||||
- [In search results, rank unstable items lower](https://github.com/rust-lang/rust/pull/149460)
|
||||
- [Add new "hide deprecated items" setting in rustdoc](https://github.com/rust-lang/rust/pull/151091)
|
||||
<a id="1.95-Compatibility-Notes"></a>
|
||||
|
||||
Compatibility Notes
|
||||
-------------------
|
||||
- [Array coercions may now result in less inference constraints than before](https://github.com/rust-lang/rust/pull/140283)
|
||||
- Importing `$crate` without renaming, i.e. `use $crate::{self};`, is now no longer permitted due to stricter error checking for `self` imports.
|
||||
- [const-eval: be more consistent in the behavior of padding during typed copies.](https://github.com/rust-lang/rust/pull/148967)
|
||||
In very rare cases, this may cause compilation errors due to bytes from parts of a pointer ending up in the padding bytes of a `const` or `static`.
|
||||
- [A future-incompatibility warning lint `ambiguous_glob_imported_traits` is now reported when using an ambiguously glob imported trait](https://github.com/rust-lang/rust/pull/149058)
|
||||
- [Check lifetime bounds of types mentioning only type parameters](https://github.com/rust-lang/rust/pull/149389)
|
||||
- [Report more visibility-related ambiguous import errors](https://github.com/rust-lang/rust/pull/149596)
|
||||
- [Deprecate `Eq::assert_receiver_is_total_eq` and emit future compatibility warnings on manual impls](https://github.com/rust-lang/rust/pull/149978)
|
||||
- [powerpc64: Use the ELF ABI version set in target spec instead of guessing](https://github.com/rust-lang/rust/pull/150468) (fixes the ELF ABI used by the OpenBSD target)
|
||||
- Matching on a `#[non_exhaustive]` enum [now reads the discriminant, even if the enum has only one variant](https://github.com/rust-lang/rust/pull/150681). This can cause closures to capture values that they previously wouldn't.
|
||||
- `mut ref` and `mut ref mut` patterns, part of the unstable [Match Ergonomics 2024 RFC](https://github.com/rust-lang/rust/issues/123076), were accidentally allowed on stable within struct pattern field shorthand. These patterns are now correctly feature-gated as unstable in this position.
|
||||
- [Add future-compatibility warning for derive helper attributes which conflict with built-in attributes](https://github.com/rust-lang/rust/pull/151152)
|
||||
- [JSON target specs](https://doc.rust-lang.org/rustc/targets/custom.html) have been destabilized and now require `-Z unstable-options` to use. Previously, they could not be used without the standard library, which has no stable build mechanism. In preparation for the `build-std` project adding that support, JSON target specs are being proactively gated to ensure they remain unstable even if `build-std` is stabilized. Cargo now includes the `-Z json-target-spec` CLI flag to automatically pass `-Z unstable-options` to the compiler when needed. See [#150151](https://github.com/rust-lang/rust/pull/150151), [#151534](https://github.com/rust-lang/rust/pull/150151), and [rust-lang/cargo#16557](https://github.com/rust-lang/cargo/pull/16557).
|
||||
- [The arguments of `#[feature]` attributes on invalid targets are now checked](https://github.com/rust-lang/rust/issues/153764)
|
||||
|
||||
|
||||
<a id="1.95-Internal-Changes"></a>
|
||||
|
||||
Internal Changes
|
||||
----------------
|
||||
|
||||
These changes do not affect any public interfaces of Rust, but they represent
|
||||
significant improvements to the performance or internals of rustc and related
|
||||
tools.
|
||||
|
||||
- [Update to LLVM 22](https://github.com/rust-lang/rust/pull/150722)
|
||||
|
||||
|
||||
Version 1.94.1 (2026-03-26)
|
||||
===========================
|
||||
|
||||
<a id="1.94.1"></a>
|
||||
|
||||
* [Fix `std::thread::spawn` on wasm32-wasip1-threads](https://github.com/rust-lang/rust/pull/153634)
|
||||
* [Remove new methods added to `std::os::windows::fs::OpenOptionsExt`](https://github.com/rust-lang/rust/pull/153491)
|
||||
The new methods were unstable, but the trait itself is not sealed and so
|
||||
cannot be extended with non-default methods.
|
||||
* [Clippy: fix ICE in `match_same_arms`](https://github.com/rust-lang/rust-clippy/pull/16685)
|
||||
* [Cargo: update tar to 0.4.45](https://github.com/rust-lang/cargo/pull/16769)
|
||||
This resolves CVE-2026-33055 and CVE-2026-33056. Users of crates.io are not affected.
|
||||
See [blog](https://blog.rust-lang.org/2026/03/21/cve-2026-33056/) for more details.
|
||||
|
||||
Version 1.94.0 (2026-03-05)
|
||||
==========================
|
||||
|
||||
<a id="1.94.0-Language"></a>
|
||||
|
||||
Language
|
||||
--------
|
||||
- [Impls and impl items inherit `dead_code` lint level of the corresponding traits and trait items](https://github.com/rust-lang/rust/pull/144113)
|
||||
- [Stabilize additional 29 RISC-V target features including large portions of the RVA22U64 / RVA23U64 profiles](https://github.com/rust-lang/rust/pull/145948)
|
||||
- [Add warn-by-default `unused_visibilities` lint for visibility on `const _` declarations](https://github.com/rust-lang/rust/pull/147136)
|
||||
- [Update to Unicode 17](https://github.com/rust-lang/rust/pull/148321)
|
||||
- [Avoid incorrect lifetime errors for closures](https://github.com/rust-lang/rust/pull/148329)
|
||||
|
||||
<a id="1.94.0-Platform-Support"></a>
|
||||
|
||||
Platform Support
|
||||
----------------
|
||||
|
||||
- [Add `riscv64im-unknown-none-elf` as a tier 3 target](https://github.com/rust-lang/rust/pull/148790)
|
||||
|
||||
Refer to Rust's [platform support page][platform-support-doc]
|
||||
for more information on Rust's tiered platform support.
|
||||
|
||||
[platform-support-doc]: https://doc.rust-lang.org/rustc/platform-support.html
|
||||
|
||||
<a id="1.94.0-Libraries"></a>
|
||||
|
||||
Libraries
|
||||
---------
|
||||
|
||||
- [Relax `T: Ord` bound for some `BinaryHeap<T>` methods.](https://github.com/rust-lang/rust/pull/149408)
|
||||
|
||||
<a id="1.94.0-Stabilized-APIs"></a>
|
||||
|
||||
Stabilized APIs
|
||||
---------------
|
||||
|
||||
- [`<[T]>::array_windows`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.array_windows)
|
||||
- [`<[T]>::element_offset`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.element_offset)
|
||||
- [`LazyCell::get`](https://doc.rust-lang.org/stable/std/cell/struct.LazyCell.html#method.get)
|
||||
- [`LazyCell::get_mut`](https://doc.rust-lang.org/stable/std/cell/struct.LazyCell.html#method.get_mut)
|
||||
- [`LazyCell::force_mut`](https://doc.rust-lang.org/stable/std/cell/struct.LazyCell.html#method.force_mut)
|
||||
- [`LazyLock::get`](https://doc.rust-lang.org/stable/std/sync/struct.LazyLock.html#method.get)
|
||||
- [`LazyLock::get_mut`](https://doc.rust-lang.org/stable/std/sync/struct.LazyLock.html#method.get_mut)
|
||||
- [`LazyLock::force_mut`](https://doc.rust-lang.org/stable/std/sync/struct.LazyLock.html#method.force_mut)
|
||||
- [`impl TryFrom<char> for usize`](https://doc.rust-lang.org/stable/std/convert/trait.TryFrom.html#impl-TryFrom%3Cchar%3E-for-usize)
|
||||
- [`std::iter::Peekable::next_if_map`](https://doc.rust-lang.org/stable/std/iter/struct.Peekable.html#method.next_if_map)
|
||||
- [`std::iter::Peekable::next_if_map_mut`](https://doc.rust-lang.org/stable/std/iter/struct.Peekable.html#method.next_if_map_mut)
|
||||
- [x86 `avx512fp16` intrinsics](https://github.com/rust-lang/rust/issues/127213)
|
||||
(excluding those that depend directly on the unstable `f16` type)
|
||||
- [AArch64 NEON fp16 intrinsics](https://github.com/rust-lang/rust/issues/136306)
|
||||
(excluding those that depend directly on the unstable `f16` type)
|
||||
- [`f32::consts::EULER_GAMMA`](https://doc.rust-lang.org/stable/std/f32/consts/constant.EULER_GAMMA.html)
|
||||
- [`f64::consts::EULER_GAMMA`](https://doc.rust-lang.org/stable/std/f64/consts/constant.EULER_GAMMA.html)
|
||||
- [`f32::consts::GOLDEN_RATIO`](https://doc.rust-lang.org/stable/std/f32/consts/constant.GOLDEN_RATIO.html)
|
||||
- [`f64::consts::GOLDEN_RATIO`](https://doc.rust-lang.org/stable/std/f64/consts/constant.GOLDEN_RATIO.html)
|
||||
|
||||
|
||||
These previously stable APIs are now stable in const contexts:
|
||||
|
||||
- [`f32::mul_add`](https://doc.rust-lang.org/stable/std/primitive.f32.html#method.mul_add)
|
||||
- [`f64::mul_add`](https://doc.rust-lang.org/stable/std/primitive.f64.html#method.mul_add)
|
||||
|
||||
|
||||
<a id="1.94.0-Cargo"></a>
|
||||
|
||||
Cargo
|
||||
-----
|
||||
|
||||
- Stabilize the config include key. The top-level include config key allows loading additional config files, enabling better organization, sharing, and management of Cargo configurations across projects and environments. [docs](https://doc.rust-lang.org/nightly/cargo/reference/config.html#including-extra-configuration-files) [#16284](https://github.com/rust-lang/cargo/pull/16284)
|
||||
- Stabilize the pubtime field in registry index. This records when a crate version was published and enables time-based dependency resolution in the future. Note that crates.io will gradually backfill existing packages when a new version is published. Not all crates have pubtime yet. [#16369](https://github.com/rust-lang/cargo/pull/16369) [#16372](https://github.com/rust-lang/cargo/pull/16372)
|
||||
- Cargo now parses [TOML v1.1](https://toml.io/en/v1.1.0) for manifests and configuration files. Note that using these features in Cargo.toml will raise your development MSRV, but the published manifest remains compatible with older parsers. [#16415](https://github.com/rust-lang/cargo/pull/16415)
|
||||
- [Make `CARGO_BIN_EXE_<crate>` available at runtime ](https://github.com/rust-lang/cargo/pull/16421/)
|
||||
|
||||
<a id="1.94.0-Compatibility-Notes"></a>
|
||||
|
||||
Compatibility Notes
|
||||
-------------------
|
||||
- [Forbid freely casting lifetime bounds of `dyn`-types](https://github.com/rust-lang/rust/pull/136776)
|
||||
- [Make closure capturing have consistent and correct behaviour around patterns](https://github.com/rust-lang/rust/pull/138961)
|
||||
Some finer details of how precise closure captures get affected by pattern matching have been changed. In some cases, this can cause a non-move closure that was previously capturing an entire variable by move, to now capture only part of that variable by move, and other parts by borrow. This can cause the borrow checker to complain where it previously didn't, or cause `Drop` to run at a different point in time.
|
||||
- [Standard library macros are now imported via prelude, not via injected `#[macro_use]`](https://github.com/rust-lang/rust/pull/139493)
|
||||
This will raise an error if macros of the same name are glob imported.
|
||||
For example if a crate defines their own `matches` macro and then glob imports that,
|
||||
it's now ambiguous whether the custom or standard library `matches` is meant and
|
||||
an explicit import of the name is required to resolve the ambiguity.
|
||||
One exception is `core::panic` and `std::panic`, if their import is ambiguous
|
||||
a new warning ([`ambiguous_panic_imports`](https://github.com/rust-lang/rust/issues/147319)) is raised.
|
||||
This may raise a new warning ([`ambiguous_panic_imports`](https://github.com/rust-lang/rust/issues/147319)) on `#![no_std]` code glob importing the std crate.
|
||||
Both `core::panic!` and `std::panic!` are then in scope and which is used is ambiguous.
|
||||
- [Don't strip shebang in expression-context `include!(…)`s](https://github.com/rust-lang/rust/pull/146377)
|
||||
This can cause previously working includes to no longer compile if they included files which started with a shebang.
|
||||
- [Ambiguous glob reexports are now also visible cross-crate](https://github.com/rust-lang/rust/pull/147984)
|
||||
This unifies behavior between local and cross-crate errors on these exports, which may introduce new ambiguity errors.
|
||||
- [Don't normalize where-clauses before checking well-formedness](https://github.com/rust-lang/rust/pull/148477)
|
||||
- [Introduce a future compatibility warning on codegen attributes on body-free trait methods](https://github.com/rust-lang/rust/pull/148756)
|
||||
These attributes currently have no effect in this position.
|
||||
- [On Windows `std::time::SystemTime::checked_sub_duration` will return `None` for times before the Windows epoch (1/1/1601)](https://github.com/rust-lang/rust/pull/148825)
|
||||
- [Lifetime identifiers such as `'a` are now NFC normalized](https://github.com/rust-lang/rust/pull/149192).
|
||||
- [Overhaul filename handling for cross-compiler consistency](https://github.com/rust-lang/rust/pull/149709)
|
||||
Any paths emitted by compiler now always respect the relative-ness of the paths and `--remap-path-prefix` given originally.
|
||||
One side-effect of this change is that paths emitted for local crates in Cargo (path dependencies and workspace members) are no longer absolute but relative when emitted as part of a diagnostic in a downstream crate.
|
||||
|
||||
<a id="1.94.0-Internal-Changes"></a>
|
||||
|
||||
Internal Changes
|
||||
----------------
|
||||
|
||||
These changes do not affect any public interfaces of Rust, but they represent
|
||||
significant improvements to the performance or internals of rustc and related
|
||||
tools.
|
||||
|
||||
- [Switch to `annotate-snippets` for error emission](https://github.com/rust-lang/rust/pull/150032)
|
||||
This should preserve mostly the same outputs in rustc error messages.
|
||||
|
||||
Version 1.93.1 (2026-02-12)
|
||||
===========================
|
||||
|
||||
|
||||
@@ -1 +1 @@
|
||||
beta
|
||||
stable
|
||||
|
||||
@@ -6,6 +6,8 @@ RUN sh /scripts/cross-apt-packages.sh
|
||||
WORKDIR /build
|
||||
|
||||
COPY scripts/musl-toolchain.sh /build/
|
||||
COPY scripts/musl-cve-2026-6042.diff /build/
|
||||
COPY scripts/musl-cve-2026-40200.diff /build/
|
||||
# We need to mitigate rust-lang/rust#34978 when compiling musl itself as well
|
||||
RUN CFLAGS="-Wa,--compress-debug-sections=none -Wl,--compress-debug-sections=none" \
|
||||
CXXFLAGS="-Wa,--compress-debug-sections=none -Wl,--compress-debug-sections=none" \
|
||||
|
||||
@@ -39,6 +39,8 @@ ENV \
|
||||
|
||||
WORKDIR /build/
|
||||
COPY scripts/musl.sh /build/
|
||||
COPY scripts/musl-cve-2026-6042.diff /build/
|
||||
COPY scripts/musl-cve-2026-40200.diff /build/
|
||||
RUN CC=gcc CFLAGS="-m32 -Wa,-mrelax-relocations=no" \
|
||||
CXX=g++ CXXFLAGS="-m32 -Wa,-mrelax-relocations=no" \
|
||||
bash musl.sh i686 --target=i686 && \
|
||||
|
||||
@@ -65,6 +65,8 @@ ENV PATH="/build/emsdk:/build/emsdk/upstream/emscripten:/build/emsdk/node/curren
|
||||
ENV STAGING_DIR=/tmp
|
||||
|
||||
COPY scripts/musl.sh /build
|
||||
COPY scripts/musl-cve-2026-6042.diff /build/
|
||||
COPY scripts/musl-cve-2026-40200.diff /build/
|
||||
RUN env \
|
||||
CC=arm-linux-gnueabi-gcc CFLAGS="-march=armv5te -marm -mfloat-abi=soft" \
|
||||
CXX=arm-linux-gnueabi-g++ CXXFLAGS="-march=armv5te -marm -mfloat-abi=soft" \
|
||||
|
||||
@@ -68,6 +68,8 @@ ENV \
|
||||
|
||||
WORKDIR /build
|
||||
COPY scripts/musl.sh /build
|
||||
COPY scripts/musl-cve-2026-6042.diff /build/
|
||||
COPY scripts/musl-cve-2026-40200.diff /build/
|
||||
RUN env \
|
||||
CC=arm-linux-gnueabi-gcc-9 CFLAGS="-march=armv7-a" \
|
||||
CXX=arm-linux-gnueabi-g++-9 CXXFLAGS="-march=armv7-a" \
|
||||
|
||||
@@ -25,6 +25,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
WORKDIR /build/
|
||||
|
||||
COPY scripts/musl-toolchain.sh /build/
|
||||
COPY scripts/musl-cve-2026-6042.diff /build/
|
||||
COPY scripts/musl-cve-2026-40200.diff /build/
|
||||
# We need to mitigate rust-lang/rust#34978 when compiling musl itself as well
|
||||
RUN CFLAGS="-Wa,-mrelax-relocations=no -Wa,--compress-debug-sections=none -Wl,--compress-debug-sections=none" \
|
||||
CXXFLAGS="-Wa,-mrelax-relocations=no -Wa,--compress-debug-sections=none -Wl,--compress-debug-sections=none" \
|
||||
|
||||
@@ -35,6 +35,8 @@ ENV PATH="/node/bin:${PATH}"
|
||||
|
||||
WORKDIR /build/
|
||||
COPY scripts/musl-toolchain.sh /build/
|
||||
COPY scripts/musl-cve-2026-6042.diff /build/
|
||||
COPY scripts/musl-cve-2026-40200.diff /build/
|
||||
RUN bash musl-toolchain.sh x86_64 && rm -rf build
|
||||
WORKDIR /
|
||||
|
||||
|
||||
179
src/ci/docker/scripts/musl-cve-2026-40200.diff
Normal file
179
src/ci/docker/scripts/musl-cve-2026-40200.diff
Normal file
@@ -0,0 +1,179 @@
|
||||
>From 228da39e38c1cae13cbe637e771412c1984dba5d Mon Sep 17 00:00:00 2001
|
||||
From: Rich Felker <dalias@aerifal.cx>
|
||||
Date: Thu, 9 Apr 2026 22:51:30 -0400
|
||||
Subject: [PATCH 1/3] qsort: fix leonardo heap corruption from bug in
|
||||
doubleword ctz primitive
|
||||
|
||||
the pntz function, implementing a "count trailing zeros" variant for a
|
||||
bit vector consisting of two size_t words, erroneously returned zero
|
||||
rather than the number of bits in the low word when the first bit set
|
||||
was the low bit of the high word.
|
||||
|
||||
as a result, a loop in the trinkle function which should have a
|
||||
guaranteed small bound on the number of iterations, could run
|
||||
unboundedly, thereby overflowing a stack-based working-space array
|
||||
which was sized for the bound.
|
||||
|
||||
CVE-2026-40200 has been assigned for this issue.
|
||||
---
|
||||
src/stdlib/qsort.c | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/stdlib/qsort.c b/src/stdlib/qsort.c
|
||||
index ab79dc6f..13219ab3 100644
|
||||
--- a/src/stdlib/qsort.c
|
||||
+++ b/src/stdlib/qsort.c
|
||||
@@ -34,11 +34,11 @@
|
||||
|
||||
typedef int (*cmpfun)(const void *, const void *, void *);
|
||||
|
||||
+/* returns index of first bit set, excluding the low bit assumed to always
|
||||
+ * be set, starting from low bit of p[0] up through high bit of p[1] */
|
||||
static inline int pntz(size_t p[2]) {
|
||||
- int r = ntz(p[0] - 1);
|
||||
- if(r != 0 || (r = 8*sizeof(size_t) + ntz(p[1])) != 8*sizeof(size_t)) {
|
||||
- return r;
|
||||
- }
|
||||
+ if (p[0] != 1) return ntz(p[0] - 1);
|
||||
+ if (p[1]) return 8*sizeof(size_t) + ntz(p[1]);
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
|
||||
>From b3291b9a9f77f1f993d2b4f8c68a26cf09221ae7 Mon Sep 17 00:00:00 2001
|
||||
From: Rich Felker <dalias@aerifal.cx>
|
||||
Date: Thu, 9 Apr 2026 23:40:53 -0400
|
||||
Subject: [PATCH 2/3] qsort: hard-preclude oob array writes independent of any
|
||||
invariants
|
||||
|
||||
while the root cause of CVE-2026-40200 was a faulty ctz primitive, the
|
||||
fallout of the bug would have been limited to erroneous sorting or
|
||||
infinite loop if not for the stores to a stack-based array that
|
||||
depended on trusting invariants in order not to go out of bounds.
|
||||
|
||||
increase the size of the array to a power of two so that we can mask
|
||||
indices into it to force them into range. in the absence of any
|
||||
further bug, the masking is a no-op, but it does not have any
|
||||
measurable performance cost, and it makes spatial memory safety
|
||||
trivial to prove (and for readers not familiar with the algorithms to
|
||||
trust).
|
||||
---
|
||||
src/stdlib/qsort.c | 20 +++++++++++++-------
|
||||
1 file changed, 13 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/src/stdlib/qsort.c b/src/stdlib/qsort.c
|
||||
index 13219ab3..e4bce9f7 100644
|
||||
--- a/src/stdlib/qsort.c
|
||||
+++ b/src/stdlib/qsort.c
|
||||
@@ -89,10 +89,16 @@ static inline void shr(size_t p[2], int n)
|
||||
p[1] >>= n;
|
||||
}
|
||||
|
||||
+/* power-of-two length for working array so that we can mask indices and
|
||||
+ * not depend on any invariant of the algorithm for spatial memory safety.
|
||||
+ * the original size was just 14*sizeof(size_t)+1 */
|
||||
+#define AR_LEN (16 * sizeof(size_t))
|
||||
+#define AR_MASK (AR_LEN - 1)
|
||||
+
|
||||
static void sift(unsigned char *head, size_t width, cmpfun cmp, void *arg, int pshift, size_t lp[])
|
||||
{
|
||||
unsigned char *rt, *lf;
|
||||
- unsigned char *ar[14 * sizeof(size_t) + 1];
|
||||
+ unsigned char *ar[AR_LEN];
|
||||
int i = 1;
|
||||
|
||||
ar[0] = head;
|
||||
@@ -104,16 +110,16 @@ static void sift(unsigned char *head, size_t width, cmpfun cmp, void *arg, int p
|
||||
break;
|
||||
}
|
||||
if(cmp(lf, rt, arg) >= 0) {
|
||||
- ar[i++] = lf;
|
||||
+ ar[i++ & AR_MASK] = lf;
|
||||
head = lf;
|
||||
pshift -= 1;
|
||||
} else {
|
||||
- ar[i++] = rt;
|
||||
+ ar[i++ & AR_MASK] = rt;
|
||||
head = rt;
|
||||
pshift -= 2;
|
||||
}
|
||||
}
|
||||
- cycle(width, ar, i);
|
||||
+ cycle(width, ar, i & AR_MASK);
|
||||
}
|
||||
|
||||
static void trinkle(unsigned char *head, size_t width, cmpfun cmp, void *arg, size_t pp[2], int pshift, int trusty, size_t lp[])
|
||||
@@ -121,7 +127,7 @@ static void trinkle(unsigned char *head, size_t width, cmpfun cmp, void *arg, si
|
||||
unsigned char *stepson,
|
||||
*rt, *lf;
|
||||
size_t p[2];
|
||||
- unsigned char *ar[14 * sizeof(size_t) + 1];
|
||||
+ unsigned char *ar[AR_LEN];
|
||||
int i = 1;
|
||||
int trail;
|
||||
|
||||
@@ -142,7 +148,7 @@ static void trinkle(unsigned char *head, size_t width, cmpfun cmp, void *arg, si
|
||||
}
|
||||
}
|
||||
|
||||
- ar[i++] = stepson;
|
||||
+ ar[i++ & AR_MASK] = stepson;
|
||||
head = stepson;
|
||||
trail = pntz(p);
|
||||
shr(p, trail);
|
||||
@@ -150,7 +156,7 @@ static void trinkle(unsigned char *head, size_t width, cmpfun cmp, void *arg, si
|
||||
trusty = 0;
|
||||
}
|
||||
if(!trusty) {
|
||||
- cycle(width, ar, i);
|
||||
+ cycle(width, ar, i & AR_MASK);
|
||||
sift(head, width, cmp, arg, pshift, lp);
|
||||
}
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
||||
|
||||
>From 5122f9f3c99fee366167c5de98b31546312921ab Mon Sep 17 00:00:00 2001
|
||||
From: Luca Kellermann <mailto.luca.kellermann@gmail.com>
|
||||
Date: Fri, 10 Apr 2026 03:03:22 +0200
|
||||
Subject: [PATCH 3/3] qsort: fix shift UB in shl and shr
|
||||
|
||||
if shl() or shr() are called with n==8*sizeof(size_t), n is adjusted
|
||||
to 0. the shift by (sizeof(size_t) * 8 - n) that then follows will
|
||||
consequently shift by the width of size_t, which is UB and in practice
|
||||
produces an incorrect result.
|
||||
|
||||
return early in this case. the bitvector p was already shifted by the
|
||||
required amount.
|
||||
---
|
||||
src/stdlib/qsort.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/src/stdlib/qsort.c b/src/stdlib/qsort.c
|
||||
index e4bce9f7..28607450 100644
|
||||
--- a/src/stdlib/qsort.c
|
||||
+++ b/src/stdlib/qsort.c
|
||||
@@ -71,6 +71,7 @@ static inline void shl(size_t p[2], int n)
|
||||
n -= 8 * sizeof(size_t);
|
||||
p[1] = p[0];
|
||||
p[0] = 0;
|
||||
+ if (!n) return;
|
||||
}
|
||||
p[1] <<= n;
|
||||
p[1] |= p[0] >> (sizeof(size_t) * 8 - n);
|
||||
@@ -83,6 +84,7 @@ static inline void shr(size_t p[2], int n)
|
||||
n -= 8 * sizeof(size_t);
|
||||
p[0] = p[1];
|
||||
p[1] = 0;
|
||||
+ if (!n) return;
|
||||
}
|
||||
p[0] >>= n;
|
||||
p[0] |= p[1] << (sizeof(size_t) * 8 - n);
|
||||
--
|
||||
2.21.0
|
||||
|
||||
|
||||
321
src/ci/docker/scripts/musl-cve-2026-6042.diff
Normal file
321
src/ci/docker/scripts/musl-cve-2026-6042.diff
Normal file
@@ -0,0 +1,321 @@
|
||||
>From 67219f0130ec7c876ac0b299046460fad31caabf Mon Sep 17 00:00:00 2001
|
||||
From: Rich Felker <dalias@aerifal.cx>
|
||||
Date: Mon, 30 Mar 2026 16:00:50 -0400
|
||||
Subject: [PATCH] fix pathological slowness & incorrect mappings in iconv
|
||||
gb18030 decoder
|
||||
|
||||
in order to implement the "UTF" aspect of gb18030 (ability to
|
||||
represent arbitrary unicode characters not present in the 2-byte
|
||||
mapping), we have to apply the index obtained from the encoded 4-byte
|
||||
sequence into the set of unmapped characters. this was done by
|
||||
scanning repeatedly over the table of mapped characters and counting
|
||||
off mapped characters below a running index by which to adjust the
|
||||
running index by on each iteration. this iterative process eventually
|
||||
leaves us with the value of the Nth unmapped character replacing the
|
||||
index, but depending on which particular character that is, the number
|
||||
of iterations needed to find it can be in the tens of thousands, and
|
||||
each iteration traverses the whole 126x190 table in the inner loop.
|
||||
this can lead to run times exceeding an entire second per character on
|
||||
moderate-speed machines.
|
||||
|
||||
on top of that, the transformation logic produced wrong results for
|
||||
BMP characters above the the surrogate range, as a result of not
|
||||
correctly accounting for it being excluded, and for characters outside
|
||||
the BMP, as a result of a misunderstanding of how gb18030 encodes
|
||||
them.
|
||||
|
||||
this patch replaces the unmapped character lookup with a single linear
|
||||
search of a list of unmapped ranges. there are only 206 such ranges,
|
||||
and these are permanently assigned and unchangeable as a consequence
|
||||
of the character encoding having to be stable, so a simple array of
|
||||
16-bit start/length values for each range consumes only 824 bytes, a
|
||||
very reasonable size cost here.
|
||||
|
||||
this new table accounts for the previously-incorrect surrogate
|
||||
handling, and non-BMP characters are handled correctly by a single
|
||||
offset, without the need for any unmapped-range search.
|
||||
|
||||
there are still a small number of mappings that are incorrect due to
|
||||
late changes made in the definition of gb18030, swapping PUA
|
||||
codepoints with proper Unicode characters. correcting these requires a
|
||||
postprocessing step that will be added later.
|
||||
---
|
||||
src/locale/gb18030utf.h | 206 ++++++++++++++++++++++++++++++++++++++++
|
||||
src/locale/iconv.c | 33 +++++--
|
||||
2 files changed, 230 insertions(+), 9 deletions(-)
|
||||
create mode 100644 src/locale/gb18030utf.h
|
||||
|
||||
diff --git a/src/locale/gb18030utf.h b/src/locale/gb18030utf.h
|
||||
new file mode 100644
|
||||
index 00000000..322a2440
|
||||
--- /dev/null
|
||||
+++ b/src/locale/gb18030utf.h
|
||||
@@ -0,0 +1,206 @@
|
||||
+{ 0x80, 36 },
|
||||
+{ 0xa5, 2 },
|
||||
+{ 0xa9, 7 },
|
||||
+{ 0xb2, 5 },
|
||||
+{ 0xb8, 31 },
|
||||
+{ 0xd8, 8 },
|
||||
+{ 0xe2, 6 },
|
||||
+{ 0xeb, 1 },
|
||||
+{ 0xee, 4 },
|
||||
+{ 0xf4, 3 },
|
||||
+{ 0xf8, 1 },
|
||||
+{ 0xfb, 1 },
|
||||
+{ 0xfd, 4 },
|
||||
+{ 0x102, 17 },
|
||||
+{ 0x114, 7 },
|
||||
+{ 0x11c, 15 },
|
||||
+{ 0x12c, 24 },
|
||||
+{ 0x145, 3 },
|
||||
+{ 0x149, 4 },
|
||||
+{ 0x14e, 29 },
|
||||
+{ 0x16c, 98 },
|
||||
+{ 0x1cf, 1 },
|
||||
+{ 0x1d1, 1 },
|
||||
+{ 0x1d3, 1 },
|
||||
+{ 0x1d5, 1 },
|
||||
+{ 0x1d7, 1 },
|
||||
+{ 0x1d9, 1 },
|
||||
+{ 0x1db, 1 },
|
||||
+{ 0x1dd, 28 },
|
||||
+{ 0x1fa, 87 },
|
||||
+{ 0x252, 15 },
|
||||
+{ 0x262, 101 },
|
||||
+{ 0x2c8, 1 },
|
||||
+{ 0x2cc, 13 },
|
||||
+{ 0x2da, 183 },
|
||||
+{ 0x3a2, 1 },
|
||||
+{ 0x3aa, 7 },
|
||||
+{ 0x3c2, 1 },
|
||||
+{ 0x3ca, 55 },
|
||||
+{ 0x402, 14 },
|
||||
+{ 0x450, 1 },
|
||||
+{ 0x452, 7102 },
|
||||
+{ 0x2011, 2 },
|
||||
+{ 0x2017, 1 },
|
||||
+{ 0x201a, 2 },
|
||||
+{ 0x201e, 7 },
|
||||
+{ 0x2027, 9 },
|
||||
+{ 0x2031, 1 },
|
||||
+{ 0x2034, 1 },
|
||||
+{ 0x2036, 5 },
|
||||
+{ 0x203c, 112 },
|
||||
+{ 0x20ad, 86 },
|
||||
+{ 0x2104, 1 },
|
||||
+{ 0x2106, 3 },
|
||||
+{ 0x210a, 12 },
|
||||
+{ 0x2117, 10 },
|
||||
+{ 0x2122, 62 },
|
||||
+{ 0x216c, 4 },
|
||||
+{ 0x217a, 22 },
|
||||
+{ 0x2194, 2 },
|
||||
+{ 0x219a, 110 },
|
||||
+{ 0x2209, 6 },
|
||||
+{ 0x2210, 1 },
|
||||
+{ 0x2212, 3 },
|
||||
+{ 0x2216, 4 },
|
||||
+{ 0x221b, 2 },
|
||||
+{ 0x2221, 2 },
|
||||
+{ 0x2224, 1 },
|
||||
+{ 0x2226, 1 },
|
||||
+{ 0x222c, 2 },
|
||||
+{ 0x222f, 5 },
|
||||
+{ 0x2238, 5 },
|
||||
+{ 0x223e, 10 },
|
||||
+{ 0x2249, 3 },
|
||||
+{ 0x224d, 5 },
|
||||
+{ 0x2253, 13 },
|
||||
+{ 0x2262, 2 },
|
||||
+{ 0x2268, 6 },
|
||||
+{ 0x2270, 37 },
|
||||
+{ 0x2296, 3 },
|
||||
+{ 0x229a, 11 },
|
||||
+{ 0x22a6, 25 },
|
||||
+{ 0x22c0, 82 },
|
||||
+{ 0x2313, 333 },
|
||||
+{ 0x246a, 10 },
|
||||
+{ 0x249c, 100 },
|
||||
+{ 0x254c, 4 },
|
||||
+{ 0x2574, 13 },
|
||||
+{ 0x2590, 3 },
|
||||
+{ 0x2596, 10 },
|
||||
+{ 0x25a2, 16 },
|
||||
+{ 0x25b4, 8 },
|
||||
+{ 0x25be, 8 },
|
||||
+{ 0x25c8, 3 },
|
||||
+{ 0x25cc, 2 },
|
||||
+{ 0x25d0, 18 },
|
||||
+{ 0x25e6, 31 },
|
||||
+{ 0x2607, 2 },
|
||||
+{ 0x260a, 54 },
|
||||
+{ 0x2641, 1 },
|
||||
+{ 0x2643, 2110 },
|
||||
+{ 0x2e82, 2 },
|
||||
+{ 0x2e85, 3 },
|
||||
+{ 0x2e89, 2 },
|
||||
+{ 0x2e8d, 10 },
|
||||
+{ 0x2e98, 15 },
|
||||
+{ 0x2ea8, 2 },
|
||||
+{ 0x2eab, 3 },
|
||||
+{ 0x2eaf, 4 },
|
||||
+{ 0x2eb4, 2 },
|
||||
+{ 0x2eb8, 3 },
|
||||
+{ 0x2ebc, 14 },
|
||||
+{ 0x2ecb, 293 },
|
||||
+{ 0x2ffc, 4 },
|
||||
+{ 0x3004, 1 },
|
||||
+{ 0x3018, 5 },
|
||||
+{ 0x301f, 2 },
|
||||
+{ 0x302a, 20 },
|
||||
+{ 0x303f, 2 },
|
||||
+{ 0x3094, 7 },
|
||||
+{ 0x309f, 2 },
|
||||
+{ 0x30f7, 5 },
|
||||
+{ 0x30ff, 6 },
|
||||
+{ 0x312a, 246 },
|
||||
+{ 0x322a, 7 },
|
||||
+{ 0x3232, 113 },
|
||||
+{ 0x32a4, 234 },
|
||||
+{ 0x3390, 12 },
|
||||
+{ 0x339f, 2 },
|
||||
+{ 0x33a2, 34 },
|
||||
+{ 0x33c5, 9 },
|
||||
+{ 0x33cf, 2 },
|
||||
+{ 0x33d3, 2 },
|
||||
+{ 0x33d6, 113 },
|
||||
+{ 0x3448, 43 },
|
||||
+{ 0x3474, 298 },
|
||||
+{ 0x359f, 111 },
|
||||
+{ 0x360f, 11 },
|
||||
+{ 0x361b, 765 },
|
||||
+{ 0x3919, 85 },
|
||||
+{ 0x396f, 96 },
|
||||
+{ 0x39d1, 14 },
|
||||
+{ 0x39e0, 147 },
|
||||
+{ 0x3a74, 218 },
|
||||
+{ 0x3b4f, 287 },
|
||||
+{ 0x3c6f, 113 },
|
||||
+{ 0x3ce1, 885 },
|
||||
+{ 0x4057, 264 },
|
||||
+{ 0x4160, 471 },
|
||||
+{ 0x4338, 116 },
|
||||
+{ 0x43ad, 4 },
|
||||
+{ 0x43b2, 43 },
|
||||
+{ 0x43de, 248 },
|
||||
+{ 0x44d7, 373 },
|
||||
+{ 0x464d, 20 },
|
||||
+{ 0x4662, 193 },
|
||||
+{ 0x4724, 5 },
|
||||
+{ 0x472a, 82 },
|
||||
+{ 0x477d, 16 },
|
||||
+{ 0x478e, 441 },
|
||||
+{ 0x4948, 50 },
|
||||
+{ 0x497b, 2 },
|
||||
+{ 0x497e, 4 },
|
||||
+{ 0x4984, 1 },
|
||||
+{ 0x4987, 20 },
|
||||
+{ 0x499c, 3 },
|
||||
+{ 0x49a0, 22 },
|
||||
+{ 0x49b8, 703 },
|
||||
+{ 0x4c78, 39 },
|
||||
+{ 0x4ca4, 111 },
|
||||
+{ 0x4d1a, 148 },
|
||||
+{ 0x4daf, 81 },
|
||||
+{ 0x9fa6, 14426 },
|
||||
+{ 0xe76c, 1 },
|
||||
+{ 0xe7c8, 1 },
|
||||
+{ 0xe7e7, 13 },
|
||||
+{ 0xe815, 1 },
|
||||
+{ 0xe819, 5 },
|
||||
+{ 0xe81f, 7 },
|
||||
+{ 0xe827, 4 },
|
||||
+{ 0xe82d, 4 },
|
||||
+{ 0xe833, 8 },
|
||||
+{ 0xe83c, 7 },
|
||||
+{ 0xe844, 16 },
|
||||
+{ 0xe856, 14 },
|
||||
+{ 0xe865, 4295 },
|
||||
+{ 0xf92d, 76 },
|
||||
+{ 0xf97a, 27 },
|
||||
+{ 0xf996, 81 },
|
||||
+{ 0xf9e8, 9 },
|
||||
+{ 0xf9f2, 26 },
|
||||
+{ 0xfa10, 1 },
|
||||
+{ 0xfa12, 1 },
|
||||
+{ 0xfa15, 3 },
|
||||
+{ 0xfa19, 6 },
|
||||
+{ 0xfa22, 1 },
|
||||
+{ 0xfa25, 2 },
|
||||
+{ 0xfa2a, 1030 },
|
||||
+{ 0xfe32, 1 },
|
||||
+{ 0xfe45, 4 },
|
||||
+{ 0xfe53, 1 },
|
||||
+{ 0xfe58, 1 },
|
||||
+{ 0xfe67, 1 },
|
||||
+{ 0xfe6c, 149 },
|
||||
+{ 0xff5f, 129 },
|
||||
+{ 0xffe6, 26 },
|
||||
diff --git a/src/locale/iconv.c b/src/locale/iconv.c
|
||||
index 52178950..4151411d 100644
|
||||
--- a/src/locale/iconv.c
|
||||
+++ b/src/locale/iconv.c
|
||||
@@ -74,6 +74,10 @@ static const unsigned short gb18030[126][190] = {
|
||||
#include "gb18030.h"
|
||||
};
|
||||
|
||||
+static const unsigned short gb18030utf[][2] = {
|
||||
+#include "gb18030utf.h"
|
||||
+};
|
||||
+
|
||||
static const unsigned short big5[89][157] = {
|
||||
#include "big5.h"
|
||||
};
|
||||
@@ -224,6 +228,8 @@ static unsigned uni_to_jis(unsigned c)
|
||||
}
|
||||
}
|
||||
|
||||
+#define countof(a) (sizeof (a) / sizeof *(a))
|
||||
+
|
||||
size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restrict out, size_t *restrict outb)
|
||||
{
|
||||
size_t x=0;
|
||||
@@ -430,15 +436,24 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
|
||||
d = *((unsigned char *)*in + 3);
|
||||
if (d-'0'>9) goto ilseq;
|
||||
c += d-'0';
|
||||
- c += 128;
|
||||
- for (d=0; d<=c; ) {
|
||||
- k = 0;
|
||||
- for (int i=0; i<126; i++)
|
||||
- for (int j=0; j<190; j++)
|
||||
- if (gb18030[i][j]-d <= c-d)
|
||||
- k++;
|
||||
- d = c+1;
|
||||
- c += k;
|
||||
+ /* Starting at 90 30 81 30 (189000), mapping is
|
||||
+ * linear without gaps, to U+10000 and up. */
|
||||
+ if (c >= 189000) {
|
||||
+ c -= 189000;
|
||||
+ c += 0x10000;
|
||||
+ if (c >= 0x110000) goto ilseq;
|
||||
+ break;
|
||||
+ }
|
||||
+ /* Otherwise we must process an index into set
|
||||
+ * of characters unmapped by 2-byte table. */
|
||||
+ for (int i=0; ; i++) {
|
||||
+ if (i==countof(gb18030utf))
|
||||
+ goto ilseq;
|
||||
+ if (c<gb18030utf[i][1]) {
|
||||
+ c += gb18030utf[i][0];
|
||||
+ break;
|
||||
+ }
|
||||
+ c -= gb18030utf[i][1];
|
||||
}
|
||||
break;
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
||||
|
||||
@@ -48,6 +48,12 @@ cd musl-cross-make
|
||||
# A version that includes support for building musl 1.2.5
|
||||
git checkout 3635262e4524c991552789af6f36211a335a77b3
|
||||
|
||||
# Patch CVE-2026-6042: https://www.openwall.com/lists/oss-security/2026/04/09/19
|
||||
# Patch CVE-2026-40200: https://www.openwall.com/lists/musl/2026/04/10/3
|
||||
# These should be removed when musl-cross-make adds them, or we upgrade to musl >= 1.2.7.
|
||||
cp /build/musl-cve-2026-6042.diff ./patches/musl-1.2.5/0003-cve-2026-6042.diff
|
||||
cp /build/musl-cve-2026-40200.diff ./patches/musl-1.2.5/0004-cve-2026-40200.diff
|
||||
|
||||
hide_output make -j$(nproc) TARGET=$TARGET MUSL_VER=1.2.5 LINUX_HEADERS_SITE=$LINUX_HEADERS_SITE LINUX_VER=$LINUX_VER
|
||||
hide_output make install TARGET=$TARGET MUSL_VER=1.2.5 LINUX_HEADERS_SITE=$LINUX_HEADERS_SITE LINUX_VER=$LINUX_VER OUTPUT=$OUTPUT
|
||||
|
||||
|
||||
@@ -71,6 +71,19 @@ EOF
|
||||
*outb -= k;
|
||||
break;
|
||||
EOF
|
||||
|
||||
# Apply patches for CVE-2026-6042 and CVE-2026-40200.
|
||||
#
|
||||
# At the time of adding these patches no release containing them has been published by the musl
|
||||
# project, so we just apply them directly on top of the version we were distributing already. The
|
||||
# patches should be removed once we upgrade to musl >= 1.2.7.
|
||||
#
|
||||
# Advisory: https://www.openwall.com/lists/oss-security/2026/04/09/19
|
||||
# Patches: https://www.openwall.com/lists/musl/2026/04/03/2/1
|
||||
patch -p1 -d $MUSL </build/musl-cve-2026-6042.diff
|
||||
# Advisory: https://www.openwall.com/lists/musl/2026/04/10/3
|
||||
# Patches: https://www.openwall.com/lists/musl/2026/04/10/3/1
|
||||
patch -p1 -d $MUSL </build/musl-cve-2026-40200.diff
|
||||
fi
|
||||
|
||||
cd $MUSL
|
||||
|
||||
Reference in New Issue
Block a user