develooper Front page | perl.perl5.porters | Postings from July 2018

[perl #133411] Cross-compilation of dist/Storable fails

Thread Next
From:
Philip Prindeville
Date:
July 31, 2018 03:53
Subject:
[perl #133411] Cross-compilation of dist/Storable fails
Message ID:
rt-4.0.24-7334-1532923800-146.133411-75-0@perl.org
# New Ticket Created by  Philip Prindeville 
# Please include the string:  [perl #133411]
# in the subject line of all future correspondence about this issue. 
# <URL: https://rt.perl.org/Ticket/Display.html?id=133411 >


I’m the package maintainer for Perl on OpenWrt.

We’re trying to ship 5.28.0 since 5.26.2 and below have the Archive::Tar CVE-2018-12015.

Unfortunately, dist/Storable/stacksize is not a cross-compilation friendly script, since it assumes that one is never cross-compiling.  Clearly that’s not the case.

The bug manifests as:

cd dist/Storable ; LD_LIBRARY_PATH=/home/philipp/lede/build_dir/target-x86_64_musl/perl/perl-5.28.0 make lib/Storable/Limit.pm
make[4]: Entering directory '/home/philipp/lede/build_dir/target-x86_64_musl/perl/perl-5.28.0/dist/Storable'
/home/philipp/lede/build_dir/target-x86_64_musl/perl/perl-5.28.0/dist/Storable/../../../../../../staging_dir/hostpkg/usr/bin/perl "-I../../lib" -MExtUtils::Command -e 'mkpath' -- ../../lib
"../../../../../../staging_dir/hostpkg/usr/bin/perl" "-I../../lib" "-I../../lib" stacksize --core
Should not run during miniperl
Makefile:283: recipe for target 'lib/Storable/Limit.pm' failed
make[4]: *** [lib/Storable/Limit.pm] Error 255
make[4]: Leaving directory '/home/philipp/lede/build_dir/target-x86_64_musl/perl/perl-5.28.0/dist/Storable'
Makefile:446: recipe for target 'dist/Storable/lib/Storable/Limit.pm' failed
make[3]: *** [dist/Storable/lib/Storable/Limit.pm] Error 2

And it’s exactly because we are cross-compiling that we build and use miniperl, as well as setting:

usecrosscompile=‘define’

in config.sh.

We’ve been calling out this issue for almost a month now, and it’s the sole blocker to updating our distro's migration to 5.28.0 and hence mitigating the CVE.

This is urgent.

Thanks

========
philipp@ubuntu16:~/lede/build_dir/target-x86_64_musl/perl/perl-5.28.0$ ./miniperl -V
Summary of my perl5 (revision 5 version 28 subversion 0) configuration:

 Platform:
   osname=linux
   osvers=4.8.0-58-generic
   archname=x86_64-linux-thread-multi
   uname='linux ubuntu16 4.8.0-58-generic #63~16.04.1-ubuntu smp mon jun 26 18:08:51 utc 2017 x86_64 x86_64 x86_64 gnulinux '
   config_args='-der -Uusedl -Duserelocatableinc -Dprefix=/home/philipp/lede/staging_dir/hostpkg/usr -Dusethreads'
   hint=recommended
   useposix=true
   d_sigaction=define
   useithreads=define
   usemultiplicity=define
   use64bitint=define
   use64bitall=define
   uselongdouble=undef
   usemymalloc=n
   default_inc_excludes_dot=define
   bincompat5005=undef
 Compiler:
   cc='cc'
   ccflags ='-D_REENTRANT -D_GNU_SOURCE -fwrapv -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64'
   optimize='-O2'
   cppflags='-D_REENTRANT -D_GNU_SOURCE -fwrapv -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include'
   ccversion=''
   gccversion='5.4.0 20160609'
   gccosandvers=''
   intsize=4
   longsize=8
   ptrsize=8
   doublesize=8
   byteorder=12345678
   doublekind=3
   d_longlong=define
   longlongsize=8
   d_longdbl=define
   longdblsize=16
   longdblkind=3
   ivtype='long'
   ivsize=8
   nvtype='double'
   nvsize=8
   Off_t='off_t'
   lseeksize=8
   alignbytes=8
   prototype=define
 Linker and Libraries:
   ld='ld'
   ldflags =' -fstack-protector-strong -L/usr/local/lib'
   libpth=/usr/local/lib /usr/lib/gcc/x86_64-linux-gnu/5/include-fixed /usr/include/x86_64-linux-gnu /usr/lib /lib/x86_64-linux-gnu /lib/../lib /usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib
   libs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
   perllibs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
   libc=libc-2.23.so
   so=so
   useshrplib=false
   libperl=libperl.a
   gnulibc_version='2.23'
 Dynamic Linking:
   dlsrc=dl_none.xs
   dlext=none
   d_dlsymun=undef
   ccdlflags=''
   cccdlflags=''
   lddlflags=''


Characteristics of this binary (from libperl): 
 Compile-time options:
   HAS_TIMES
   MULTIPLICITY
   PERLIO_LAYERS
   PERL_COPY_ON_WRITE
   PERL_DONT_CREATE_GVSV
   PERL_IMPLICIT_CONTEXT
   PERL_MALLOC_WRAP
   PERL_OP_PARENT
   PERL_PRESERVE_IVUV
   USE_64_BIT_ALL
   USE_64_BIT_INT
   USE_ITHREADS
   USE_LARGE_FILES
   USE_LOCALE
   USE_LOCALE_COLLATE
   USE_LOCALE_CTYPE
   USE_LOCALE_NUMERIC
   USE_LOCALE_TIME
   USE_PERLIO
   USE_PERL_ATOF
   USE_REENTRANT_API
 Built under linux
 @INC:
   /home/philipp/lede/staging_dir/hostpkg/usr/lib/perl5/site_perl/5.28.0/x86_64-linux-thread-multi
   /home/philipp/lede/staging_dir/hostpkg/usr/lib/perl5/site_perl/5.28.0
   /home/philipp/lede/staging_dir/hostpkg/usr/lib/perl5/5.28.0/x86_64-linux-thread-multi
   /home/philipp/lede/staging_dir/hostpkg/usr/lib/perl5/5.28.0


Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About