commit: 321b6dff172bbb2e7177843b79cdbb953d028ef4 Author: Michael Orlitzky <mjo <AT> gentoo <DOT> org> AuthorDate: Sun Mar 8 16:18:22 2026 +0000 Commit: Michael Orlitzky <mjo <AT> gentoo <DOT> org> CommitDate: Sun Mar 8 23:17:26 2026 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=321b6dff
app-antivirus/clamav: new -r4 of the 0.103.x branch 1. Backport upstream pointer alignment patch 2. Fix the C23 build by renaming an internal "alignof" 3. Bump the impersonated freshclam version to latest 4. No version bound is needed on dev-libs/libpcre 5. The ipv6 ./configure check had an implicit function decl Signed-off-by: Michael Orlitzky <mjo <AT> gentoo.org> app-antivirus/clamav/clamav-0.103.12-r4.ebuild | 244 +++++++++++++++++++++ .../files/clamav-0.103.12-c23-has-alignof.patch | 22 ++ ...av-0.103.12-fix-configure-implicit-memset.patch | 10 + ...clamav-0.103.12-impersonate-user-agent-r1.patch | 17 ++ .../clamav-0.103.12-pointer-misalignment.patch | 29 +++ 5 files changed, 322 insertions(+) diff --git a/app-antivirus/clamav/clamav-0.103.12-r4.ebuild b/app-antivirus/clamav/clamav-0.103.12-r4.ebuild new file mode 100644 index 000000000000..bd08eac19713 --- /dev/null +++ b/app-antivirus/clamav/clamav-0.103.12-r4.ebuild @@ -0,0 +1,244 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +inherit autotools flag-o-matic systemd tmpfiles + +DESCRIPTION="Clam Anti-Virus Scanner" +HOMEPAGE="https://www.clamav.net/"; +SRC_URI="https://www.clamav.net/downloads/production/${P}.tar.gz"; + +LICENSE="GPL-2 unRAR" +SLOT="0/lts" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86" +IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv libclamav-only milter metadata-analysis-api selinux systemd test xml" + +REQUIRED_USE="libclamav-only? ( !clamonacc !clamdtop !clamsubmit !milter !metadata-analysis-api )" + +RESTRICT="!test? ( test )" + +# Require acct-{user,group}/clamav at build time so that we can set +# the permissions on /var/lib/clamav in src_install rather than in +# pkg_postinst; calling "chown" on the live filesystem scares me. +CDEPEND="acct-group/clamav + acct-user/clamav + dev-libs/libltdl + dev-libs/libmspack + || ( dev-libs/libpcre2 dev-libs/libpcre ) + dev-libs/tomsfastmath + >=virtual/zlib-1.2.2:= + bzip2? ( app-arch/bzip2 ) + clamdtop? ( sys-libs/ncurses:0 ) + clamsubmit? ( net-misc/curl dev-libs/json-c:= ) + elibc_musl? ( sys-libs/fts-standalone ) + iconv? ( virtual/libiconv ) + !libclamav-only? ( net-misc/curl ) + dev-libs/openssl:0= + milter? ( mail-filter/libmilter:= ) + xml? ( dev-libs/libxml2:= )" + +# We need at least autoconf-2.69-r5 because that's the first (patched) +# version of it in Gentoo that supports ./configure --runstatedir. +BDEPEND=">=dev-build/autoconf-2.69-r5 + virtual/pkgconfig" + +DEPEND="${CDEPEND} + metadata-analysis-api? ( dev-libs/json-c:* ) + test? ( dev-libs/check )" +RDEPEND="${CDEPEND} + selinux? ( sec-policy/selinux-clamav )" + +PATCHES=( + "${FILESDIR}/${PN}-0.102.1-libxml2_pkgconfig.patch" #661328 + "${FILESDIR}/${PN}-0.102.2-fix-curl-detection.patch" #709616 + "${FILESDIR}/${PN}-0.103.0-system-tomsfastmath.patch" # 649394 + "${FILESDIR}/${PN}-0.103.1-upstream-openrc.patch" + "${FILESDIR}/${PN}-0.103.12-missing-const.patch" + "${FILESDIR}/${PN}-0.103.12-fix-lzma-uaf.patch" + "${FILESDIR}/${PN}-0.103.12-cve-2025-20260.patch" + "${FILESDIR}/${PN}-0.103.12-impersonate-user-agent.patch" + "${FILESDIR}/${PN}-0.103.12-impersonate-user-agent-r1.patch" + "${FILESDIR}/${PN}-0.103.12-pointer-misalignment.patch" + "${FILESDIR}/${PN}-0.103.12-c23-has-alignof.patch" + "${FILESDIR}/${PN}-0.103.12-fix-configure-implicit-memset.patch" +) + +src_prepare() { + default + + # Be extra sure that we're using the system copy of tomsfastmath + einfo "removing bundled copy of dev-libs/tomsfastmath" + rm -r libclamav/tomsfastmath || \ + die "failed to remove bundled tomsfastmath" + + AT_NO_RECURSIVE="yes" eautoreconf +} + +src_configure() { + use elibc_musl && append-ldflags -lfts + use ppc64 && append-flags -mminimal-toc + + # according to configure help it should be + # $(use_enable xml) + # but that does not work + # do not add this, since --disable-xml seems to override + # --without-xml + JSONUSE="--without-libjson" + + if use clamsubmit || use metadata-analysis-api; then + # either of those 2 requires libjson. + # clamsubmit will be built as soon as libjson and curl are found + # but we only install the binary if requested + JSONUSE="--with-libjson=${EPREFIX}/usr" + fi + + local myeconfargs=( + $(use_enable bzip2) + $(use_enable clamonacc) + $(use_enable clamdtop) + $(use_enable milter) + $(use_enable test check) + $(use_with xml) + $(use_with iconv) + ${JSONUSE} + $(use_enable libclamav-only) + $(use_with !libclamav-only libcurl) + --enable-ipv6 + --with-system-libmspack + --cache-file="${S}"/config.cache + --disable-experimental + --disable-static + --disable-zlib-vcheck + --enable-id-check + --with-dbdir="${EPREFIX}"/var/lib/clamav + # Don't call --with-zlib=/usr (see bug #699296) + --with-zlib + --disable-llvm + --enable-openrc + --runstatedir=/run + ) + econf "${myeconfargs[@]}" +} + +src_install() { + default + + rm -rf "${ED}"/var/lib/clamav || die + + if ! use libclamav-only ; then + if use systemd; then + # The tmpfiles entry is behind USE=systemd because the + # OpenRC service scripts should (and do) ensure that the + # directories they need exist and have the correct + # permissions without the help of tmpfiles. + newtmpfiles "${FILESDIR}/tmpfiles.d/clamav-r1.conf" clamav.conf + systemd_newunit "${FILESDIR}/clamd_at.service" "[email protected]" + systemd_dounit "${FILESDIR}/clamd.service" + systemd_newunit "${FILESDIR}/freshclamd.service-r1" \ + "freshclamd.service" + fi + + insinto /etc/logrotate.d + newins "${FILESDIR}/clamd.logrotate" clamd + newins "${FILESDIR}/freshclam.logrotate" freshclam + use milter && \ + newins "${FILESDIR}/clamav-milter.logrotate-r1" clamav-milter + + # Modify /etc/{clamd,freshclam}.conf to be usable out of the box + sed -i -e "s:^\(Example\):\# \1:" \ + -e "s/^#\(PidFile .*\)/\1/" \ + -e "s/^#\(LocalSocket .*\)/\1/" \ + -e "s/^#\(User .*\)/\1/" \ + -e "s:^\#\(LogFile\) .*:\1 ${EPREFIX}/var/log/clamav/clamd.log:" \ + -e "s:^\#\(LogTime\).*:\1 yes:" \ + -e "s/^#\(DatabaseDirectory .*\)/\1/" \ + "${ED}"/etc/clamd.conf.sample || die + + sed -i -e "s:^\(Example\):\# \1:" \ + -e "s/^#\(PidFile .*\)/\1/" \ + -e "s/^#\(DatabaseOwner .*\)/\1/" \ + -e "s:^\#\(UpdateLogFile\) .*:\1 ${EPREFIX}/var/log/clamav/freshclam.log:" \ + -e "s:^\#\(NotifyClamd\).*:\1 ${EPREFIX}/etc/clamd.conf:" \ + -e "s:^\#\(ScriptedUpdates\).*:\1 yes:" \ + -e "s/^#\(DatabaseDirectory .*\)/\1/" \ + "${ED}"/etc/freshclam.conf.sample || die + + if use milter ; then + # Note: only keep the "unix" ClamdSocket and MilterSocket! + sed -i -e "s:^\(Example\):\# \1:" \ + -e "s/^#\(PidFile .*\)/\1/" \ + -e "s/^#\(ClamdSocket unix:.*\)/\1/" \ + -e "s/^#\(User .*\)/\1/" \ + -e "s/^#\(MilterSocket unix:.*\)/\1/" \ + -e "s:^\#\(LogFile\) .*:\1 ${EPREFIX}/var/log/clamav/clamav-milter.log:" \ + "${ED}"/etc/clamav-milter.conf.sample || die + + cat >> "${ED}"/etc/conf.d/clamd <<-EOF + MILTER_NICELEVEL=19 + START_MILTER=no + EOF + + systemd_newunit "${FILESDIR}/clamav-milter.service-r1" clamav-milter.service + fi + + local i + for i in clamd freshclam clamav-milter + do + if [[ -f "${ED}"/etc/"${i}".conf.sample ]]; then + mv "${ED}"/etc/"${i}".conf{.sample,} || die + fi + done + + # These both need to be writable by the clamav user. + # TODO: use syslog by default; that's what it's for. + diropts -o clamav -g clamav + keepdir /var/lib/clamav + keepdir /var/log/clamav + fi + + if use doc ; then + local HTML_DOCS=( docs/html/. ) + einstalldocs + + if ! use libclamav-only ; then + doman docs/man/*.[1-8] + fi + fi + + find "${ED}" -name '*.la' -delete || die +} + +src_test() { + if use libclamav-only ; then + ewarn "Test target not available when USE=libclamav-only is set, skipping tests ..." + return 0 + fi + + emake quick-check +} + +pkg_postinst() { + if ! use libclamav-only ; then + if use systemd ; then + tmpfiles_process clamav.conf + fi + fi + + if use milter ; then + elog "For simple instructions how to setup the clamav-milter read the" + elog "clamav-milter.README.gentoo in /usr/share/doc/${PF}" + fi + + local databases=( "${EROOT}"/var/lib/clamav/main.c[lv]d ) + if [[ ! -f "${databases}" ]] ; then + ewarn "You must run freshclam manually to populate the virus database" + ewarn "before starting clamav for the first time." + fi + + ewarn "This version of ClamAV provides separate OpenRC services" + ewarn "for clamd, freshclam, clamav-milter, and clamonacc. The" + ewarn "clamd service now starts only the clamd daemon itself. You" + ewarn "should add freshclam (and perhaps clamav-milter) to any" + ewarn "runlevels that previously contained clamd." +} diff --git a/app-antivirus/clamav/files/clamav-0.103.12-c23-has-alignof.patch b/app-antivirus/clamav/files/clamav-0.103.12-c23-has-alignof.patch new file mode 100644 index 000000000000..29865d11db37 --- /dev/null +++ b/app-antivirus/clamav/files/clamav-0.103.12-c23-has-alignof.patch @@ -0,0 +1,22 @@ +This is an internal function used once; we can just rename it. + +--- a/libclamav/mpool.c 2024-09-03 14:18:28.000000000 -0400 ++++ b/libclamav/mpool.c 2026-03-08 12:04:26.313585301 -0400 +@@ -422,7 +422,7 @@ + return fragsz[bits]; + } + +-static inline unsigned int alignof(size_t size) ++static inline unsigned int _clamav_alignof(size_t size) + { + /* conservative estimate of alignment. + * A struct that needs alignment of 'align' is padded by the compiler +@@ -618,7 +618,7 @@ + + void *mpool_malloc(struct MP *mp, size_t size) + { +- size_t align = alignof(size); ++ size_t align = _clamav_alignof(size); + size_t i, needed = align_increase(size + FRAG_OVERHEAD, align); + const unsigned int sbits = to_bits(needed); + struct FRAG *f = NULL; diff --git a/app-antivirus/clamav/files/clamav-0.103.12-fix-configure-implicit-memset.patch b/app-antivirus/clamav/files/clamav-0.103.12-fix-configure-implicit-memset.patch new file mode 100644 index 000000000000..6488788dfc2f --- /dev/null +++ b/app-antivirus/clamav/files/clamav-0.103.12-fix-configure-implicit-memset.patch @@ -0,0 +1,10 @@ +--- a/m4/reorganization/code_checks/ipv6.m4 2026-03-08 19:07:09.837852090 -0400 ++++ b/m4/reorganization/code_checks/ipv6.m4 2026-03-08 19:07:18.569859889 -0400 +@@ -7,6 +7,7 @@ + AC_MSG_CHECKING([for IPv6 support]) + AC_CACHE_VAL([have_cv_ipv6],[ + AC_TRY_RUN([ ++ #include <string.h> + #include <sys/types.h> + #include <sys/socket.h> + #include <netdb.h> diff --git a/app-antivirus/clamav/files/clamav-0.103.12-impersonate-user-agent-r1.patch b/app-antivirus/clamav/files/clamav-0.103.12-impersonate-user-agent-r1.patch new file mode 100644 index 000000000000..6c0d8f169593 --- /dev/null +++ b/app-antivirus/clamav/files/clamav-0.103.12-impersonate-user-agent-r1.patch @@ -0,0 +1,17 @@ +Applies on TOP of the -r0 patch to save space! + +diff --git a/etc/freshclam.conf.sample b/etc/freshclam.conf.sample +index 5d38500..b5612b4 100644 +--- a/etc/freshclam.conf.sample.in.in ++++ b/etc/freshclam.conf.sample.in.in +@@ -138,7 +138,7 @@ DatabaseMirror database.clamav.net + # As of ClamAV 0.103.3, this setting may not be used when updating from the + # clamav.net CDN and can only be used when updating from a private mirror. + # Default: clamav/version_number (OS: ..., ARCH: ..., CPU: ..., UUID: ...) +-HTTPUserAgent ClamAV/1.4.3 ++HTTPUserAgent ClamAV/1.5.2 + + # Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for + # multi-homed systems. +-- +2.45.2 diff --git a/app-antivirus/clamav/files/clamav-0.103.12-pointer-misalignment.patch b/app-antivirus/clamav/files/clamav-0.103.12-pointer-misalignment.patch new file mode 100644 index 000000000000..168e6107f340 --- /dev/null +++ b/app-antivirus/clamav/files/clamav-0.103.12-pointer-misalignment.patch @@ -0,0 +1,29 @@ +From 5faf172810f7641b895ce0fcc6ceee7b1a5cc3f1 Mon Sep 17 00:00:00 2001 +From: Valerie Snyder <[email protected]> +Date: Tue, 24 Feb 2026 14:06:16 -0500 +Subject: [PATCH] Fix pointer alignment issue in OLE2 XLM macro extraction + +Fix issue reading from a pointer which can cause a crash on systems that +have strict pointer alignment requirements. + +Thank you to Hsuan-Ming Chen at Synology PSIRT for identify this issue +and proposing this fix. +--- + libclamav/xlm_extract.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/libclamav/xlm_extract.c b/libclamav/xlm_extract.c +index daaa26af0d..2257f19b75 100644 +--- a/libclamav/xlm_extract.c ++++ b/libclamav/xlm_extract.c +@@ -4044,7 +4044,9 @@ static cl_error_t parse_formula(FILE *out_file, char data[], unsigned data_size) + goto done; + } + +- double val = *(double *)&data[data_pos + 1]; ++ double val; ++ /* Avoid unaligned double loads (may SIGBUS on 32-bit ARM). */ ++ memcpy(&val, &data[data_pos + 1], sizeof(val)); + + len = fprintf(out_file, " %f", val); + if (len < 0) {
