From 8d92ac7a1a132dd440456f0a342214b49aadaa28 Mon Sep 17 00:00:00 2001 From: Jamis Buck Date: Tue, 13 Feb 2024 09:31:46 -0700 Subject: [PATCH 1/4] final tweaks for BSON 5 release --- release.sh | 27 +++++++++++++++++++++++---- release/jruby/Dockerfile | 4 ++-- release/jruby/install.sh | 6 +++++- release/mri/Dockerfile | 2 +- 4 files changed, 31 insertions(+), 8 deletions(-) diff --git a/release.sh b/release.sh index b48e116a4..735653c9d 100755 --- a/release.sh +++ b/release.sh @@ -6,12 +6,26 @@ NAME=bson RELEASE_NAME=bson-ruby-release VERSION_REQUIRE=bson/version VERSION_CONSTANT_NAME=BSON::VERSION +CMD=echo if ! test -f gem-private_key.pem; then echo "gem-private_key.pem missing - cannot release" 1>&2 exit 1 fi +if test -z "$PRODUCTION_RELEASE"; then + echo "PRODUCTION_RELEASE is not set. The script will run in 'dry run'" + echo "mode. The gems will be built, but not actually published. To" + echo "publish the gems, set the PRODUCTION_RELEASE env variable to 1 and" + echo "re-run this script." +else + echo "PRODUCTION_RELEASE is set. Gems will be built and published." + CMD='' +fi + +echo +read -p "-- Press RETURN to continue, or CTRL-C to abort --" + VERSION=`ruby -Ilib -r$VERSION_REQUIRE -e "puts $VERSION_CONSTANT_NAME"` echo "Releasing $NAME $VERSION" @@ -41,8 +55,13 @@ echo Built: $NAME-$VERSION.gem echo Built: $NAME-$VERSION-java.gem echo -git tag -a v$VERSION -m "Tagging release: $VERSION" -git push origin v$VERSION +if test -z "$PRODUCTION_RELEASE"; then + echo "*** SHOWING COMMANDS IN 'DRY RUN' MODE ***" + echo +fi + +$CMD git tag -a v$VERSION -m "Tagging release: $VERSION" +$CMD git push origin v$VERSION -gem push $NAME-$VERSION.gem -gem push $NAME-$VERSION-java.gem +$CMD gem push $NAME-$VERSION.gem +$CMD gem push $NAME-$VERSION-java.gem diff --git a/release/jruby/Dockerfile b/release/jruby/Dockerfile index 137a8a710..51c9ccd7b 100644 --- a/release/jruby/Dockerfile +++ b/release/jruby/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:9 +FROM debian:latest ENV DEBIAN_FRONTEND=noninteractive @@ -7,7 +7,7 @@ ENV DEBIAN_FRONTEND=noninteractive # https://github.com/hazelcast/hazelcast/issues/14214 RUN apt-get update && \ - apt-get -y install openjdk-8-jdk ruby git curl make g++ + apt-get -y install openjdk-17-jdk ruby git curl make g++ WORKDIR /rubies COPY release/jruby/install.sh /rubies/ diff --git a/release/jruby/install.sh b/release/jruby/install.sh index a7ffca329..d8cd2950f 100755 --- a/release/jruby/install.sh +++ b/release/jruby/install.sh @@ -8,4 +8,8 @@ cd /rubies git clone https://github.com/rbenv/ruby-build.git PREFIX=/usr ./ruby-build/install.sh -ruby-build -v jruby-9.3.13.0 /rubies/jruby +# JRuby 9.3.9.0 is the most recent version that uses +# JOpenSSL 0.12.2. More recent versions use JOpenSSL 0.14.2, +# which appears to be unable to build signed gems. +# See: https://github.com/jruby/jruby-openssl/issues/292 +ruby-build -v jruby-9.3.9.0 /rubies/jruby diff --git a/release/mri/Dockerfile b/release/mri/Dockerfile index b6da2a23c..6cfee88eb 100644 --- a/release/mri/Dockerfile +++ b/release/mri/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:10 +FROM debian:latest ENV DEBIAN_FRONTEND=noninteractive From 92b0df5b96c00a5d166d863a7574dc02f2b9b0e0 Mon Sep 17 00:00:00 2001 From: Jamis Buck Date: Thu, 21 Mar 2024 16:09:11 -0600 Subject: [PATCH 2/4] SECBUG-240 strlen might read beyond end of buffer --- ext/bson/read.c | 21 ++++++++++++++++++--- ext/bson/write.c | 4 ++++ 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/ext/bson/read.c b/ext/bson/read.c index 8571315cc..36d96f353 100644 --- a/ext/bson/read.c +++ b/ext/bson/read.c @@ -29,6 +29,7 @@ static VALUE pvt_get_symbol(byte_buffer_t *b, VALUE rb_buffer, int argc, VALUE * static VALUE pvt_get_boolean(byte_buffer_t *b); static VALUE pvt_read_field(byte_buffer_t *b, VALUE rb_buffer, uint8_t type, int argc, VALUE *argv); static void pvt_skip_cstring(byte_buffer_t *b); +static size_t pvt_strnlen(const byte_buffer_t *b); void pvt_raise_decode_error(volatile VALUE msg) { VALUE klass = pvt_const_get_3("BSON", "Error", "BSONDecodeError"); @@ -143,7 +144,7 @@ VALUE rb_bson_byte_buffer_get_bytes(VALUE self, VALUE i) } VALUE pvt_get_boolean(byte_buffer_t *b){ - VALUE result; + VALUE result = Qnil; char byte_value; ENSURE_BSON_READ(b, 1); byte_value = *READ_PTR(b); @@ -236,7 +237,7 @@ VALUE rb_bson_byte_buffer_get_cstring(VALUE self) int length; TypedData_Get_Struct(self, byte_buffer_t, &rb_byte_buffer_data_type, b); - length = (int)strlen(READ_PTR(b)); + length = (int)pvt_strnlen(b); ENSURE_BSON_READ(b, length); string = rb_enc_str_new(READ_PTR(b), length, rb_utf8_encoding()); b->read_position += length + 1; @@ -249,7 +250,7 @@ VALUE rb_bson_byte_buffer_get_cstring(VALUE self) void pvt_skip_cstring(byte_buffer_t *b) { int length; - length = (int)strlen(READ_PTR(b)); + length = (int)pvt_strnlen(b); ENSURE_BSON_READ(b, length); b->read_position += length + 1; } @@ -453,3 +454,17 @@ VALUE rb_bson_byte_buffer_get_array(int argc, VALUE *argv, VALUE self){ return array; } + +/** + * Returns the length of the given string `str`. If no null-terminating byte + * is present when `len` bytes have been scanned, then `len` is + * returned. + */ +size_t pvt_strnlen(const byte_buffer_t *b) { + const char *ptr = memchr(READ_PTR(b), '\0', READ_SIZE(b)); + + if (!ptr) + rb_raise(rb_eRangeError, "string is too long (possibly not null-terminated)"); + + return (size_t)(ptr - READ_PTR(b)); +} diff --git a/ext/bson/write.c b/ext/bson/write.c index 9b167c2cc..c426129a1 100644 --- a/ext/bson/write.c +++ b/ext/bson/write.c @@ -633,6 +633,10 @@ void pvt_put_array_index(byte_buffer_t *b, int32_t index) c_str = buffer; snprintf(buffer, sizeof(buffer), "%d", index); } + // strlen is a potential vector for out-of-bounds errors, but + // the only way for that to happen here, specifically, is if `index` + // is greater than 10e16 - 1, which is far beyond the domain of an + // int32. length = strlen(c_str) + 1; ENSURE_BSON_WRITE(b, length); memcpy(WRITE_PTR(b), c_str, length); From f4c6027c1d424cd5ba18f907842e980421ce7ea5 Mon Sep 17 00:00:00 2001 From: Jamis Buck Date: Wed, 27 Mar 2024 16:28:42 -0600 Subject: [PATCH 3/4] ruby 2.6 isn't supported --- .evergreen/config.yml | 23 +++++++++++++++++------ .evergreen/update-evergreen-configs | 6 +++--- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/.evergreen/config.yml b/.evergreen/config.yml index 033980ccc..0e4bf69c2 100644 --- a/.evergreen/config.yml +++ b/.evergreen/config.yml @@ -29,6 +29,7 @@ timeout: script: | ls -la + # ----------------------------------------------- # .evergreen/config/functions.yml.erb # ----------------------------------------------- @@ -240,6 +241,7 @@ tasks: commands: - func: "run tests" + # ----------------------------------------------- # .evergreen/config/axes.yml.erb # ----------------------------------------------- @@ -276,34 +278,42 @@ axes: - id: ruby display_name: Ruby Version values: + - id: ruby-3.2 display_name: ruby-3.2 variables: RVM_RUBY: ruby-3.2 + - id: ruby-3.1 display_name: ruby-3.1 variables: RVM_RUBY: ruby-3.1 + - id: ruby-3.0 display_name: ruby-3.0 variables: RVM_RUBY: ruby-3.0 + - id: ruby-2.7 display_name: ruby-2.7 variables: RVM_RUBY: ruby-2.7 + - id: ruby-2.6 display_name: ruby-2.6 variables: RVM_RUBY: ruby-2.6 + + - id: jruby-9.4 + display_name: jruby-9.4 + variables: + RVM_RUBY: jruby-9.4 + - id: jruby-9.3 display_name: jruby-9.3 variables: RVM_RUBY: jruby-9.3 - - id: jruby-9.2 - display_name: jruby-9.2 - variables: - RVM_RUBY: jruby-9.2 + - id: "as" display_name: ActiveSupport @@ -337,6 +347,7 @@ axes: variables: COMPACT: true + # ----------------------------------------------- # .evergreen/config/variants.yml.erb # ----------------------------------------------- @@ -373,13 +384,13 @@ buildvariants: - name: "test" - matrix_name: "special-os" - matrix_spec: { ruby: ["ruby-3.2", "ruby-3.1", "jruby-9.3"], special-os: '*' } + matrix_spec: { ruby: ["ruby-3.2", "ruby-3.1", "jruby-9.4"], special-os: '*' } display_name: "${ruby}, ${special-os}" tasks: - name: "test" - matrix_name: "jruby" - matrix_spec: { ruby: ["jruby-9.3", "jruby-9.2"], all-os: rhel } + matrix_spec: { ruby: ["jruby-9.4", "jruby-9.3"], all-os: rhel } display_name: "${ruby}, ${all-os}" tasks: - name: "test" diff --git a/.evergreen/update-evergreen-configs b/.evergreen/update-evergreen-configs index 5bf7985a6..699c2de08 100755 --- a/.evergreen/update-evergreen-configs +++ b/.evergreen/update-evergreen-configs @@ -75,7 +75,7 @@ module ConfigProcessor # these are used for testing against a few recent ruby versions def recent_rubies - @recent_rubies ||= %w[ ruby-3.2 ruby-3.1 jruby-9.3 ] + @recent_rubies ||= %w[ ruby-3.2 ruby-3.1 jruby-9.4 ] end # the most recently released, stable version of Ruby (make sure this @@ -96,7 +96,7 @@ module ConfigProcessor # as above, but including the most recent JRuby release def sample_rubies - @sample_rubies ||= sample_mri_rubies + %w[ jruby-9.3 ] + @sample_rubies ||= sample_mri_rubies + %w[ jruby-9.4 ] end # older Ruby versions provided by 10gen/mongo-ruby-toolchain @@ -106,7 +106,7 @@ module ConfigProcessor # all supported JRuby versions provided by 10gen/mongo-ruby-toolchain def jrubies - @jrubies ||= %w[ jruby-9.3 jruby-9.2 ] + @jrubies ||= %w[ jruby-9.4 jruby-9.3 ] end # all supported MRI ruby versions From f56fa4d9b7706395cbff3a9e9f4fd7289fdf045c Mon Sep 17 00:00:00 2001 From: Jamis Buck Date: Wed, 27 Mar 2024 16:32:00 -0600 Subject: [PATCH 4/4] nix 2.6 --- .github/workflows/bson-ruby.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bson-ruby.yml b/.github/workflows/bson-ruby.yml index bad6da830..ebcd288b6 100644 --- a/.github/workflows/bson-ruby.yml +++ b/.github/workflows/bson-ruby.yml @@ -20,7 +20,7 @@ jobs: fail-fast: false matrix: os: [ ubuntu, macos, windows ] - ruby: [ 2.6, 2.7, 3.0, 3.1, head ] + ruby: [ 2.7, 3.0, 3.1, 3.2, 3.3, head ] include: - { os: windows , ruby: mingw } exclude: