main/nodejs: fix CVE-2017-1000381 and Constant Hashtable Seeds

See: https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/

3 files changed, 114 insertions, 5 deletions

diff --git a/main/nodejs/APKBUILD b/main/nodejs/APKBUILD
index 7a91b7558e..6cb252fb63 100644
--- a/main/nodejs/APKBUILD
+++ b/main/nodejs/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Eivind Uggedal <eivind@uggedal.com>
 pkgname=nodejs
 pkgver=4.3.2
-pkgrel=0
+pkgrel=1
 pkgdesc='Evented I/O for V8 javascript'
 url='http://nodejs.org/'
 arch='all'
@@ -10,7 +10,9 @@ license='MIT'
 makedepends="$depends_dev python openssl-dev zlib-dev libuv-dev
 	linux-headers paxmark"
 subpackages="$pkgname-dev $pkgname-doc"
-source="http://nodejs.org/dist/v$pkgver/node-v$pkgver.tar.gz"
+source="http://nodejs.org/dist/v$pkgver/node-v$pkgver.tar.gz
+	disable-v8-snapshots.patch
+	CVE-2017-1000381.patch"
 _builddir="$srcdir"/node-v$pkgver
 
 prepare() {
@@ -48,6 +50,12 @@ package() {
 	done
 }
 
-md5sums="f08960ee686899b80e8539815154f4b5  node-v4.3.2.tar.gz"
-sha256sums="1f92f6d31f7292ce56db57d6703efccf3e6c945948f5901610cefa69e78d3498  node-v4.3.2.tar.gz"
-sha512sums="9a97ba4482baf6900144f64f9c43629e9e141048158e94281d8c1fae57a8f883e1cafb98c89040ba492779ebf87eb7e608c322fa8a5b119ce82aef7df7e3e2b7  node-v4.3.2.tar.gz"
+md5sums="f08960ee686899b80e8539815154f4b5  node-v4.3.2.tar.gz
+d998206a37c79196a51357960cd130b6  disable-v8-snapshots.patch
+50254b0414ef2c8714bb6c33e2f6b465  CVE-2017-1000381.patch"
+sha256sums="1f92f6d31f7292ce56db57d6703efccf3e6c945948f5901610cefa69e78d3498  node-v4.3.2.tar.gz
+9cdf57315d194a33edd3215cb51e255d4b12eb8698768eed1e746342d0a834a8  disable-v8-snapshots.patch
+13a6636d71c834b75e939755e37271542dfceeddd4fb0d74bfa01d949a201d76  CVE-2017-1000381.patch"
+sha512sums="9a97ba4482baf6900144f64f9c43629e9e141048158e94281d8c1fae57a8f883e1cafb98c89040ba492779ebf87eb7e608c322fa8a5b119ce82aef7df7e3e2b7  node-v4.3.2.tar.gz
+c0a65e05a0bc12423bde8741dd35258017d6c649e8308bd791fc3734a2308ef41af813096274473f7ff3d05dafce3c647ba09c9e4ee75605d9cd20a0ae9c9084  disable-v8-snapshots.patch
+57738244c3b0484f24a0082cf3f1d582dead809a3962e89a692c288829c4a4e5dd60695dbe6a76081db1dbc92bf6f9dcfaff892b99f9985aff5d4231d9a13145  CVE-2017-1000381.patch"
diff --git a/main/nodejs/CVE-2017-1000381.patch b/main/nodejs/CVE-2017-1000381.patch
new file mode 100644
index 0000000000..ae8212226c
--- /dev/null
+++ b/main/nodejs/CVE-2017-1000381.patch
@@ -0,0 +1,54 @@
+From 75bc33d16fbc46f026cf913a08dff80167c370d1 Mon Sep 17 00:00:00 2001
+From: David Drysdale <drysdale@google.com>
+Date: Mon, 22 May 2017 10:54:10 +0100
+Subject: [PATCH] deps: cherry-pick 9478908a49 from cares upstream
+
+Original commit message:
+
+  ares_parse_naptr_reply: check sufficient data
+
+  Check that there is enough data for the required elements
+  of an NAPTR record (2 int16, 3 bytes for string lengths)
+  before processing a record.
+
+This patch fixes CVE-2017-1000381
+
+The c-ares function ares_parse_naptr_reply(), which is used for
+parsing NAPTR responses, could be triggered to read memory outside
+of the given input buffer if the passed in DNS response packet was
+crafted in a particular way.
+
+Refs: https://c-ares.haxx.se/adv_20170620.html
+Refs: https://c-ares.haxx.se/CVE-2017-1000381.patch
+PR-URL: https://github.com/nodejs/node-private/pull/88
+Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
+Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
+
+Patch-Source: https://github.com/nodejs/node/commit/75bc33d16f
+See: https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/
+---
+ deps/cares/src/ares_parse_naptr_reply.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/deps/cares/src/ares_parse_naptr_reply.c b/deps/cares/src/ares_parse_naptr_reply.c
+index 11634df984..717d355778 100644
+--- a/deps/cares/src/ares_parse_naptr_reply.c
++++ b/deps/cares/src/ares_parse_naptr_reply.c
+@@ -110,6 +110,12 @@ ares_parse_naptr_reply (const unsigned char *abuf, int alen,
+           status = ARES_EBADRESP;
+           break;
+         }
++      /* RR must contain at least 7 bytes = 2 x int16 + 3 x name */
++      if (rr_len < 7)
++        {
++          status = ARES_EBADRESP;
++          break;
++        }
+ 
+       /* Check if we are really looking at a NAPTR record */
+       if (rr_class == C_IN && rr_type == T_NAPTR)
+@@ -185,4 +191,3 @@ ares_parse_naptr_reply (const unsigned char *abuf, int alen,
+ 
+   return ARES_SUCCESS;
+ }
+-
diff --git a/main/nodejs/disable-v8-snapshots.patch b/main/nodejs/disable-v8-snapshots.patch
new file mode 100644
index 0000000000..00bdfd639e
--- /dev/null
+++ b/main/nodejs/disable-v8-snapshots.patch
@@ -0,0 +1,47 @@
+From: Ali Ijaz Sheikh <ofrobots@google.com>
+Date: Thu, 1 Jun 2017 17:55:42 -0700
+Subject: [PATCH] build: disable V8 snapshots
+
+PR-URL: https://github.com/nodejs/node-private/pull/84
+Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
+Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
+Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
+
+Patch-Source: https://github.com/nodejs/node/commit/9d51bdc9d4
+See: https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/
+
+--- a/configure
++++ b/configure
+@@ -339,12 +339,12 @@
+ # Dummy option for backwards compatibility
+ parser.add_option('--with-snapshot',
+     action='store_true',
+-    dest='unused_with_snapshot',
++    dest='with_snapshot',
+     help=optparse.SUPPRESS_HELP)
+ 
+ parser.add_option('--without-snapshot',
+     action='store_true',
+-    dest='without_snapshot',
++    dest='unused_without_snapshot',
+     help=optparse.SUPPRESS_HELP)
+ 
+ parser.add_option('--without-ssl',
+@@ -667,7 +667,7 @@
+   o['variables']['node_byteorder'] = sys.byteorder
+ 
+   cross_compiling = target_arch != host_arch
+-  want_snapshots = not options.without_snapshot
++  want_snapshots = 1 if options.with_snapshot else 0
+   o['variables']['want_separate_host_toolset'] = int(
+       cross_compiling and want_snapshots)
+ 
+@@ -778,7 +778,7 @@
+   o['variables']['v8_no_strict_aliasing'] = 1  # Work around compiler bugs.
+   o['variables']['v8_optimized_debug'] = 0  # Compile with -O0 in debug builds.
+   o['variables']['v8_random_seed'] = 0  # Use a random seed for hash tables.
+-  o['variables']['v8_use_snapshot'] = 'false' if options.without_snapshot else 'true'
++  o['variables']['v8_use_snapshot'] = b(options.with_snapshot)
+ 
+ def configure_openssl(o):
+   o['variables']['node_use_openssl'] = b(not options.without_ssl)