!18 [sync] PR-15: fix CVE-2024-54661

From: @openeuler-sync-bot 
Reviewed-by: @wk333 
Signed-off-by: @wk333

backport-CVE-2024-54661-Arbitrary-file-overwr.patch

@@ -0,0 +1,112 @@
+From 4ee1f31cf80019c5907876576d6dfd49368d660f Mon Sep 17 00:00:00 2001
+From: Gerhard Rieger <gerhard@dest-unreach.org>
+Date: Fri, 6 Dec 2024 11:42:09 +0100
+Subject: [PATCH] Version 1.8.0.2 - CVE-2024-54661: Arbitrary file overwrite in
+ readline.sh
+
+Conflict:only the modified content of readline.sh and test.sh is rounded.
+Reference:https://repo.or.cz/socat.git/patch/4ee1f31cf80019c5907876576d6dfd49368d660f
+---
+ readline.sh | 10 +++++++--
+ test.sh     | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 71 insertions(+), 2 deletions(-)
+
+diff --git a/readline.sh b/readline.sh
+index b6f8438..1045303 100755
+--- a/readline.sh
++++ b/readline.sh
+@@ -22,9 +22,15 @@ if [ "$withhistfile" ]; then
+ else
+     HISTOPT=
+ fi
+-mkdir -p /tmp/$USER || exit 1
+ #
+ #
+ 
+-exec socat -d readline"$HISTOPT",noecho='[Pp]assword:' exec:"$PROGRAM",sigint,pty,setsid,ctty,raw,echo=0,stderr 2>/tmp/$USER/stderr2
++if test -w .; then
++    STDERR=./socat-readline.${1##*/}.log
++    rm -f $STDERR
++else
++    STDERR=/dev/null
++fi
++
++exec socat -d readline"$HISTOPT",noecho='[Pp]assword:' exec:"$PROGRAM",sigint,pty,setsid,ctty,raw,echo=0,stderr 2>$STDERR
+ 
+diff --git a/test.sh b/test.sh
+index 46bebf8..5204ac7 100755
+--- a/test.sh
++++ b/test.sh
+@@ -19154,6 +19154,69 @@ esac
+ N=$((N+1))
+ 
+ 
++# Test the readline.sh file overwrite vulnerability
++NAME=READLINE_SH_OVERWRITE
++case "$TESTS" in
++*%$N%*|*%functions%*|*%bugs%*|*%readline%*|*%security%*|*%$NAME%*)
++TEST="$NAME: Test the readline.sh file overwrite vulnerability"
++# Create a symlink /tmp/$USER/stderr2 pointing to a temporary file,
++# run readline.sh
++# When the temporary file is kept the test succeeded
++if ! eval $NUMCOND; then :
++elif ! cond=$(checkconds \
++                  "" \
++                  "" \
++                  "readline.sh" \
++                  "" \
++                  "" \
++                  "" \
++                  "" ); then
++    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
++    numCANT=$((numCANT+1))
++    listCANT="$listCANT $N"
++    namesCANT="$namesCANT $NAME"
++else
++    tf="$td/test$N.file"
++    te="$td/test$N.stderr"
++    tdiff="$td/test$N.diff"
++    da="test$N $(date) $RANDOM"
++    echo "$da" >"$tf"
++    ln -sf "$tf" /tmp/$USER/stderr2
++    CMD0="readline.sh cat"
++    printf "test $F_n $TEST... " $N
++    $CMD0 </dev/null >/dev/null 2>"${te}0"
++    rc0=$?
++#    if [ "$rc0" -ne 0 ]; then
++#       $PRINTF "$CANT (rc0=$rc0)\n"
++#       echo "$CMD0"
++#       cat "${te}0" >&2
++#       numCANT=$((numCANT+1))
++#       listCANT="$listCANT $N"
++#       namesCANT="$namesCANT $NAME"
++#    elif ! echo "$da" |diff - "$tf" >$tdiff; then
++    if ! echo "$da" |diff - "$tf" >$tdiff; then
++        $PRINTF "$FAILED (diff)\n"
++        echo "$CMD0 &"
++        cat "${te}0" >&2
++        echo "// diff:" >&2
++        cat "$tdiff" >&2
++        numFAIL=$((numFAIL+1))
++        listFAIL="$listFAIL $N"
++        namesFAIL="$namesFAIL $NAME"
++    else
++        $PRINTF "$OK\n"
++        if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi
++        if [ "$DEBUG" ];   then cat "${te}0" >&2; fi
++        if [ "$VERBOSE" ]; then echo "$CMD1"; fi
++        if [ "$DEBUG" ];   then cat "${te}1" >&2; fi
++        numOK=$((numOK+1))
++        listOK="$listOK $N"
++    fi
++fi # NUMCOND
++ ;;
++esac
++N=$((N+1))
++
+ # end of common tests
+ 
+ ##################################################################################
+-- 
+2.33.0
+

filan-recovers-the-option-d-that-needs-to-be-parsed.patch

@@ -0,0 +1,25 @@
+From a4b0405548cc5d12e0e5888061e1880ea524e8c6 Mon Sep 17 00:00:00 2001
+From: cherry530 <707078654@qq.com>
+Date: Wed, 3 Apr 2024 10:09:02 +0800
+Subject: [PATCH] filan recovers the option d that needs to be parsed
+
+Signed-off-by: cherry530 <707078654@qq.com>
+---
+ error.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/error.c b/error.c
+index d0a2a9e..3e91d93 100644
+--- a/error.c
++++ b/error.c
+@@ -197,6 +197,7 @@ void diag_set(char what, const char *arg) {
+    case 'p': diagopts.progname = arg;
+       openlog(diagopts.progname, LOG_PID, diagopts.logfacility);
+       break;
++   case 'd': --diagopts.msglevel; break;
+    case 'u': diagopts.micros = true; break;
+    default: msg(E_ERROR, "unknown diagnostic option %c", what);
+    }
+-- 
+2.27.0
+

socat.spec

@@ -2,12 +2,16 @@
 
 Summary:     Multipurpose relay
 Name:        socat
-Version:     1.7.3.2
+Version:     1.8.0.0
-Release:     8
+Release:     3
 License:     GPLv2
 Url:         http://www.dest-unreach.org/socat/
 Source:      http://www.dest-unreach.org/socat/download/%{name}-%{version}.tar.gz
 
+Patch0:      filan-recovers-the-option-d-that-needs-to-be-parsed.patch
+
+Patch6000:   backport-CVE-2024-54661-Arbitrary-file-overwr.patch
+
 BuildRequires: gcc openssl-devel readline-devel ncurses-devel
 BuildRequires: autoconf kernel-headers > 2.6.18
 BuildRequires: iproute net-tools coreutils procps-ng openssl iputils
@@ -22,7 +26,7 @@ line editor (readline), a program, or a combination of two of these.
 %package_help
 
 %prep
-%autosetup
+%autosetup -n %{name}-%{version} -p1
 iconv -f iso8859-1 -t utf-8 CHANGES > CHANGES.utf8
 mv CHANGES.utf8 CHANGES
 
@@ -50,15 +54,30 @@ cp -a *.sh %{buildroot}/%{_docdir}/socat/
 
 %files
 %license COPYING COPYING.OpenSSL
-%{_bindir}/socat
+%{_bindir}/socat*
 %{_bindir}/filan
 %{_bindir}/procan
 
 %files help
 %doc README SECURITY BUGREPORTS CHANGES DEVELOPMENT EXAMPLES FAQ PORTING
 %doc %{_docdir}/socat/*.sh
-%doc %{_mandir}/man1/socat.1*
+%doc %{_mandir}/man1/*
 
 %changelog
+* Thu Dec 12 2024 yueyuankun <yueyuankun@kylinos.cn> - 1.8.0.0-3
+- Fix CVE-2024-54661
+
+* Wed Apr 03 2024 xu_ping <707078654@qq.com> - 1.8.0.0-2
+- filan recovers the option d that needs to be parsed
+
+* Wed Feb 28 2024 liyanan <liyanan61@h-partners.com> - 1.8.0.0-1
+- update to 1.8.0.0
+
+* Fri Nov 11 2022 dan <fzhang@zhixundn.com> - 1.7.4.4-1
+- update to 1.7.4.4
+
+* Thu Jul 28 2022 fushanqing <fushanqing@kylinos.cn> - 1.7.4.3-1
+- update to 1.7.4.3
+
 * Tue Nov 19 2019 mengxian <mengxian@huawei.com> - 1.7.3.2-8
 - Package init