From e2d067d76035974a77bcb15526d5414b3823a123 Mon Sep 17 00:00:00 2001 From: "Scott R. Parish" Date: Thu, 26 May 2016 12:24:41 -0700 Subject: [PATCH 1/4] chromium: Update to latest stable and beta channel Overview of updated versions: stable: 50.0.2661.102 -> 51.0.2704.63 beta: 51.0.2704.47 -> 51.0.2704.63 I tried to update dev, but couldn't get it to compile, it was failing with a "'isnan' was not declared in this scope. As far as I can tell, at the moment the beta and stable channels are on the same version. The stable update addresses the following security issues: * High CVE-2016-1672: Cross-origin bypass in extension bindings. Credit to Mariusz Mlynski. * High CVE-2016-1673: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. * High CVE-2016-1674: Cross-origin bypass in extensions. Credit to Mariusz Mlynski. * High CVE-2016-1675: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. * High CVE-2016-1676: Cross-origin bypass in extension bindings. Credit to Rob Wu. * Medium CVE-2016-1677: Type confusion in V8. Credit to Guang Gong of Qihoo 360. * High CVE-2016-1678: Heap overflow in V8. Credit to Christian Holler. * High CVE-2016-1679: Heap use-after-free in V8 bindings. Credit to Rob Wu. * High CVE-2016-1680: Heap use-after-free in Skia. Credit to Atte Kettunen of OUSPG. * High CVE-2016-1681: Heap overflow in PDFium. Credit to Aleksandar Nikolic of Cisco Talos. * Medium CVE-2016-1682: CSP bypass for ServiceWorker. Credit to KingstonTime. * Medium CVE-2016-1683: Out-of-bounds access in libxslt. Credit to Nicolas Gregoire. * Medium CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas Gregoire. * Medium CVE-2016-1685: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB. * Medium CVE-2016-1686: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB. * Medium CVE-2016-1687: Information leak in extensions. Credit to Rob Wu. * Medium CVE-2016-1688: Out-of-bounds read in V8. Credit to Max Korenko. * Medium CVE-2016-1689: Heap buffer overflow in media. Credit to Atte Kettunen of OUSPG. * Medium CVE-2016-1690: Heap use-after-free in Autofill. Credit to Rob Wu. * Low CVE-2016-1691: Heap buffer-overflow in Skia. Credit to Atte Kettunen of OUSPG. * Low CVE-2016-1692: Limited cross-origin bypass in ServiceWorker. Credit to Til Jasper Ullrich. * Low CVE-2016-1693: HTTP Download of Software Removal Tool. Credit to Khalil Zhani. * Low CVE-2016-1694: HPKP pins removed on cache clearance. Credit to Ryan Lester and Bryant Zadegan. See: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html --- .../networking/browsers/chromium/upstream-info.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix index 4cc459397d3..e633f25558b 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix @@ -1,9 +1,9 @@ # This file is autogenerated from update.sh in the same directory. { beta = { - sha256 = "0l1434wqhi6c24qyb5ysg1wnd0s9l9i1k6kh6wr3s4acrsbb7p12"; - sha256bin64 = "1ssw92l8zwj8x0zs5h6vxl7d7gj0lqb0x71vsazgd4d0p23nglb1"; - version = "51.0.2704.47"; + sha256 = "1sgfwh2b0aw6l5v4ggk7frcy306x3ygxk81p3h6zdy5s1rpf8hxj"; + sha256bin64 = "1kjnxxf2ak8v1akzxz46r7a7r6bhxjb2y9fhr1fqvks3m4jc5zqw"; + version = "51.0.2704.63"; }; dev = { sha256 = "0czp4p434yqr5rv3w2vypkyis13x8lc4xph8yh84r9big1ga6fqs"; @@ -11,8 +11,8 @@ version = "52.0.2729.3"; }; stable = { - sha256 = "1ijpbmn38znjjb3h8579x5gsclgjx122lvm0afv17gf2j3w5w4qj"; - sha256bin64 = "17vqvxmy6llg7dpc3pxi0qhwpm9qc9rsq8lgknhwwygvkl8g14sb"; - version = "50.0.2661.102"; + sha256 = "1sgfwh2b0aw6l5v4ggk7frcy306x3ygxk81p3h6zdy5s1rpf8hxj"; + sha256bin64 = "1kjnxxf2ak8v1akzxz46r7a7r6bhxjb2y9fhr1fqvks3m4jc5zqw"; + version = "51.0.2704.63"; }; } From 0f4095ec5069515a5ecdcb3f9b9b0d18ff090a30 Mon Sep 17 00:00:00 2001 From: aszlig Date: Fri, 27 May 2016 21:48:34 +0200 Subject: [PATCH 2/4] chromium: Fix hash for beta Debian package I'm not sure how the wrong hash ended up being there, but I've checked the hash from three different machines (and networks) just to be sure I didn't make a mistake. Signed-off-by: aszlig --- .../applications/networking/browsers/chromium/upstream-info.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix index e633f25558b..7f3572021b8 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix @@ -2,7 +2,7 @@ { beta = { sha256 = "1sgfwh2b0aw6l5v4ggk7frcy306x3ygxk81p3h6zdy5s1rpf8hxj"; - sha256bin64 = "1kjnxxf2ak8v1akzxz46r7a7r6bhxjb2y9fhr1fqvks3m4jc5zqw"; + sha256bin64 = "14qj8l5dapha87ndyzcs3spaxp3s9sapcjcplkisbivis09a29cb"; version = "51.0.2704.63"; }; dev = { From c7a3645e7bfe8bd6db7d3d9a320c2f07ea582347 Mon Sep 17 00:00:00 2001 From: aszlig Date: Sat, 28 May 2016 19:04:22 +0200 Subject: [PATCH 3/4] chromium: Remove stuff for versions <= v51 We're already on version 52, so there really is no need to keep all those conditionals and old patches anymore. Tested dropping the unconditional build_fixes_46.patch via the Chromium VM tests. Signed-off-by: aszlig --- .../networking/browsers/chromium/common.nix | 21 +----- .../chromium/patches/build_fixes_46.patch | 14 ---- .../patches/nix_plugin_paths_46.patch | 75 ------------------- 3 files changed, 4 insertions(+), 106 deletions(-) delete mode 100644 pkgs/applications/networking/browsers/chromium/patches/build_fixes_46.patch delete mode 100644 pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_46.patch diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix index 9fbc8959ad2..5db308d5ad3 100644 --- a/pkgs/applications/networking/browsers/chromium/common.nix +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -57,7 +57,7 @@ let use_system_libevent = true; use_system_libexpat = true; use_system_libjpeg = true; - use_system_libpng = versionOlder upstream-info.version "51.0.0.0"; + use_system_libpng = false; use_system_libwebp = true; use_system_libxml = true; use_system_opus = true; @@ -123,15 +123,11 @@ let ++ optionals gnomeSupport [ gnome.GConf libgcrypt ] ++ optional enableSELinux libselinux ++ optionals cupsSupport [ libgcrypt cups ] - ++ optional pulseSupport libpulseaudio - ++ optional (versionOlder version "51.0.0.0") libexif; + ++ optional pulseSupport libpulseaudio; patches = [ - ./patches/build_fixes_46.patch ./patches/widevine.patch - (if versionOlder version "50.0.0.0" - then ./patches/nix_plugin_paths_46.patch - else ./patches/nix_plugin_paths_50.patch) + ./patches/nix_plugin_paths_50.patch ]; postPatch = '' @@ -141,18 +137,12 @@ let -e "/python_arch/s/: *'[^']*'/: '""'/" \ build/common.gypi chrome/chrome_tests.gypi - ${optionalString (versionOlder version "51.0.0.0") '' - sed -i -e '/module_path *=.*libexif.so/ { - s|= [^;]*|= base::FilePath().AppendASCII("${libexif}/lib/libexif.so")| - }' chrome/utility/media_galleries/image_metadata_extractor.cc - ''} - sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${libudev.out}/lib/\1!' \ device/udev_linux/udev?_loader.cc sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \ gpu/config/gpu_info_collector_linux.cc - '' + optionalString (!versionOlder version "51.0.0.0") '' + sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \ chrome/browser/ui/webui/engagement/site_engagement_ui.cc ''; @@ -185,9 +175,6 @@ let google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI"; google_default_client_id = "404761575300.apps.googleusercontent.com"; google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D"; - - } // optionalAttrs (versionOlder version "51.0.0.0") { - use_system_libexif = true; } // optionalAttrs proprietaryCodecs { # enable support for the H.264 codec proprietary_codecs = true; diff --git a/pkgs/applications/networking/browsers/chromium/patches/build_fixes_46.patch b/pkgs/applications/networking/browsers/chromium/patches/build_fixes_46.patch deleted file mode 100644 index c0aeb5d3a56..00000000000 --- a/pkgs/applications/networking/browsers/chromium/patches/build_fixes_46.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff --git a/chrome/test/data/webui_test_resources.grd b/chrome/test/data/webui_test_resources.grd -index 6f8530d..f92a76a 100644 ---- a/chrome/test/data/webui_test_resources.grd -+++ b/chrome/test/data/webui_test_resources.grd -@@ -6,9 +6,4 @@ - - - -- -- -- -- -- - diff --git a/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_46.patch b/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_46.patch deleted file mode 100644 index 7482be7062d..00000000000 --- a/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_46.patch +++ /dev/null @@ -1,75 +0,0 @@ -diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc -index 74bf041..5f34198 100644 ---- a/chrome/common/chrome_paths.cc -+++ b/chrome/common/chrome_paths.cc -@@ -66,21 +66,14 @@ static base::LazyInstance - g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER; - - // Gets the path for internal plugins. --bool GetInternalPluginsDirectory(base::FilePath* result) { --#if defined(OS_MACOSX) && !defined(OS_IOS) -- // If called from Chrome, get internal plugins from a subdirectory of the -- // framework. -- if (base::mac::AmIBundled()) { -- *result = chrome::GetFrameworkBundlePath(); -- DCHECK(!result->empty()); -- *result = result->Append("Internet Plug-Ins"); -- return true; -- } -- // In tests, just look in the module directory (below). --#endif -- -- // The rest of the world expects plugins in the module directory. -- return PathService::Get(base::DIR_MODULE, result); -+bool GetInternalPluginsDirectory(base::FilePath* result, -+ const std::string& ident) { -+ std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident; -+ const char* value = getenv(full_env.c_str()); -+ if (value == NULL) -+ return PathService::Get(base::DIR_MODULE, result); -+ else -+ *result = base::FilePath(value); - } - - #if defined(OS_WIN) -@@ -253,11 +246,11 @@ bool PathProvider(int key, base::FilePath* result) { - create_dir = true; - break; - case chrome::DIR_INTERNAL_PLUGINS: -- if (!GetInternalPluginsDirectory(&cur)) -+ if (!GetInternalPluginsDirectory(&cur, "ALL")) - return false; - break; - case chrome::DIR_PEPPER_FLASH_PLUGIN: -- if (!GetInternalPluginsDirectory(&cur)) -+ if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH")) - return false; - cur = cur.Append(kPepperFlashBaseDirectory); - break; -@@ -314,7 +307,7 @@ bool PathProvider(int key, base::FilePath* result) { - // We currently need a path here to look up whether the plugin is disabled - // and what its permissions are. - case chrome::FILE_NACL_PLUGIN: -- if (!GetInternalPluginsDirectory(&cur)) -+ if (!GetInternalPluginsDirectory(&cur, "NACL")) - return false; - cur = cur.Append(kInternalNaClPluginFileName); - break; -@@ -349,7 +342,7 @@ bool PathProvider(int key, base::FilePath* result) { - cur = cur.DirName(); - } - #else -- if (!GetInternalPluginsDirectory(&cur)) -+ if (!GetInternalPluginsDirectory(&cur, "PNACL")) - return false; - #endif - cur = cur.Append(FILE_PATH_LITERAL("pnacl")); -@@ -366,7 +359,7 @@ bool PathProvider(int key, base::FilePath* result) { - // In the component case, this is the source adapter. Otherwise, it is the - // actual Pepper module that gets loaded. - case chrome::FILE_WIDEVINE_CDM_ADAPTER: -- if (!GetInternalPluginsDirectory(&cur)) -+ if (!GetInternalPluginsDirectory(&cur, "WIDEVINE")) - return false; - cur = cur.AppendASCII(kWidevineCdmAdapterFileName); - break; From 79d18eb6045b33e081fbce4b66374ea75dfeeb5f Mon Sep 17 00:00:00 2001 From: aszlig Date: Sat, 28 May 2016 19:08:15 +0200 Subject: [PATCH 4/4] chromium: Update dev channel to v52.0.2743.10 With this update we need to rebase the nix_plugin_paths patch, which was done by @srp and I took it from his comment at: https://github.com/NixOS/nixpkgs/pull/15762#issuecomment-222230677 Other than that, using libjpeg from nixpkgs fails to link: https://headcounter.org/hydra/build/1114273 Rather than just using versionAtLeast to check for >= version 52, we're matching on the explicit version number. That way we can make sure that we (try to) build with system libjpeg again so we can keep it out of the overall Chromium build time. Built and tested using the VM tests on my Hydra at: https://headcounter.org/hydra/eval/322006 Signed-off-by: aszlig --- .../networking/browsers/chromium/common.nix | 10 ++- .../patches/nix_plugin_paths_52.patch | 70 +++++++++++++++++++ .../browsers/chromium/upstream-info.nix | 6 +- 3 files changed, 81 insertions(+), 5 deletions(-) create mode 100644 pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_52.patch diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix index 5db308d5ad3..4f4fbb8d3bf 100644 --- a/pkgs/applications/networking/browsers/chromium/common.nix +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -56,7 +56,8 @@ let use_system_flac = true; use_system_libevent = true; use_system_libexpat = true; - use_system_libjpeg = true; + # XXX: System libjpeg fails to link for version 52.0.2743.10 + use_system_libjpeg = upstream-info.version != "52.0.2743.10"; use_system_libpng = false; use_system_libwebp = true; use_system_libxml = true; @@ -127,7 +128,9 @@ let patches = [ ./patches/widevine.patch - ./patches/nix_plugin_paths_50.patch + (if versionOlder version "52.0.0.0" + then ./patches/nix_plugin_paths_50.patch + else ./patches/nix_plugin_paths_52.patch) ]; postPatch = '' @@ -145,6 +148,9 @@ let sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \ chrome/browser/ui/webui/engagement/site_engagement_ui.cc + '' + optionalString (versionAtLeast version "52.0.0.0") '' + sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \ + third_party/pdfium/xfa/fxbarcode/utils.h ''; gypFlags = mkGypFlags (gypFlagsUseSystemLibs // { diff --git a/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_52.patch b/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_52.patch new file mode 100644 index 00000000000..fc1b609479b --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_52.patch @@ -0,0 +1,70 @@ +diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc +index f4e119d..d9775bd 100644 +--- a/chrome/common/chrome_paths.cc ++++ b/chrome/common/chrome_paths.cc +@@ -68,21 +68,14 @@ static base::LazyInstance + g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER; + + // Gets the path for internal plugins. +-bool GetInternalPluginsDirectory(base::FilePath* result) { +-#if defined(OS_MACOSX) +- // If called from Chrome, get internal plugins from a subdirectory of the +- // framework. +- if (base::mac::AmIBundled()) { +- *result = chrome::GetFrameworkBundlePath(); +- DCHECK(!result->empty()); +- *result = result->Append("Internet Plug-Ins"); +- return true; +- } +- // In tests, just look in the module directory (below). +-#endif +- +- // The rest of the world expects plugins in the module directory. +- return PathService::Get(base::DIR_MODULE, result); ++bool GetInternalPluginsDirectory(base::FilePath* result, ++ const std::string& ident) { ++ std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident; ++ const char* value = getenv(full_env.c_str()); ++ if (value == NULL) ++ return PathService::Get(base::DIR_MODULE, result); ++ else ++ *result = base::FilePath(value); + } + + // Gets the path for bundled implementations of components. Note that these +@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) { + create_dir = true; + break; + case chrome::DIR_INTERNAL_PLUGINS: +- if (!GetInternalPluginsDirectory(&cur)) ++ if (!GetInternalPluginsDirectory(&cur, "ALL")) + return false; + break; + case chrome::DIR_COMPONENTS: +@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) { + return false; + break; + case chrome::DIR_PEPPER_FLASH_PLUGIN: +- if (!GetInternalPluginsDirectory(&cur)) ++ if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH")) + return false; + cur = cur.Append(kPepperFlashBaseDirectory); + break; +@@ -323,7 +316,7 @@ bool PathProvider(int key, base::FilePath* result) { + // We currently need a path here to look up whether the plugin is disabled + // and what its permissions are. + case chrome::FILE_NACL_PLUGIN: +- if (!GetInternalPluginsDirectory(&cur)) ++ if (!GetInternalPluginsDirectory(&cur, "NACL")) + return false; + cur = cur.Append(kInternalNaClPluginFileName); + break; +@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) { + cur = cur.DirName(); + } + #else +- if (!GetInternalPluginsDirectory(&cur)) ++ if (!GetInternalPluginsDirectory(&cur, "PNACL")) + return false; + #endif + cur = cur.Append(FILE_PATH_LITERAL("pnacl")); diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix index 7f3572021b8..073d7574502 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix @@ -6,9 +6,9 @@ version = "51.0.2704.63"; }; dev = { - sha256 = "0czp4p434yqr5rv3w2vypkyis13x8lc4xph8yh84r9big1ga6fqs"; - sha256bin64 = "0hahamx9k14czswqdh8iwh69lsml0acca5kxvp2kw471g3s55n78"; - version = "52.0.2729.3"; + sha256 = "1bbwbn0svgr2pfkza8pdq61bjzlj50axdm5bqqxi51hab51fc9ww"; + sha256bin64 = "1s02q72b84g9p5i7y1hh1c67qjb92934dqqwd7w6j0jz8ix71nzc"; + version = "52.0.2743.10"; }; stable = { sha256 = "1sgfwh2b0aw6l5v4ggk7frcy306x3ygxk81p3h6zdy5s1rpf8hxj";