From e7a491969d68e1a9526e461955480ba9b6479431 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=A1bor=20Cs=C3=A1rdi?= Date: Wed, 15 May 2024 16:35:53 +0200 Subject: [PATCH] Patch R 4.0.0 - R 4.3.3 for CVE-2024-27322 We also update the NEWS file, so by grepping for 'CVE-2024-27322' one can tell if the patched version is installed or not. --- builder/patches/R-4.0.0.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.0.1.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.0.2.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.0.3.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.0.4.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.0.5.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.1.0.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.1.1.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.1.2.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.1.3.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.2.0.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.2.1.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.2.2.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.2.3.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.3.0.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.3.1.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.3.2.patch | 62 +++++++++++++++++++++++++++++++++++ builder/patches/R-4.3.3.patch | 62 +++++++++++++++++++++++++++++++++++ 18 files changed, 1116 insertions(+) create mode 100644 builder/patches/R-4.0.0.patch create mode 100644 builder/patches/R-4.0.1.patch create mode 100644 builder/patches/R-4.0.2.patch create mode 100644 builder/patches/R-4.0.3.patch create mode 100644 builder/patches/R-4.0.4.patch create mode 100644 builder/patches/R-4.0.5.patch create mode 100644 builder/patches/R-4.1.0.patch create mode 100644 builder/patches/R-4.1.1.patch create mode 100644 builder/patches/R-4.1.2.patch create mode 100644 builder/patches/R-4.1.3.patch create mode 100644 builder/patches/R-4.2.0.patch create mode 100644 builder/patches/R-4.2.1.patch create mode 100644 builder/patches/R-4.2.2.patch create mode 100644 builder/patches/R-4.2.3.patch create mode 100644 builder/patches/R-4.3.0.patch create mode 100644 builder/patches/R-4.3.1.patch create mode 100644 builder/patches/R-4.3.2.patch create mode 100644 builder/patches/R-4.3.3.patch diff --git a/builder/patches/R-4.0.0.patch b/builder/patches/R-4.0.0.patch new file mode 100644 index 0000000..4c9671e --- /dev/null +++ b/builder/patches/R-4.0.0.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 1e5bc60..1ce0c7b 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN 4.0.0: + + SIGNIFICANT USER-VISIBLE CHANGES: diff --git a/builder/patches/R-4.0.1.patch b/builder/patches/R-4.0.1.patch new file mode 100644 index 0000000..0cf0e42 --- /dev/null +++ b/builder/patches/R-4.0.1.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 8cd0e5c..10e38db 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.0.1: + + NEW FEATURES: diff --git a/builder/patches/R-4.0.2.patch b/builder/patches/R-4.0.2.patch new file mode 100644 index 0000000..0971053 --- /dev/null +++ b/builder/patches/R-4.0.2.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 502ee68..704deb0 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.0.2: + + UTILITIES: diff --git a/builder/patches/R-4.0.3.patch b/builder/patches/R-4.0.3.patch new file mode 100644 index 0000000..32d23f2 --- /dev/null +++ b/builder/patches/R-4.0.3.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 7983a71..16c6674 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.0.3: + + NEW FEATURES: diff --git a/builder/patches/R-4.0.4.patch b/builder/patches/R-4.0.4.patch new file mode 100644 index 0000000..cc6ab87 --- /dev/null +++ b/builder/patches/R-4.0.4.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index ceaf22c..0688cd2 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.0.4: + + NEW FEATURES: diff --git a/builder/patches/R-4.0.5.patch b/builder/patches/R-4.0.5.patch new file mode 100644 index 0000000..a42d27e --- /dev/null +++ b/builder/patches/R-4.0.5.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index b20a8ee..7ed2d27 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.0.5: + + BUG FIXES: diff --git a/builder/patches/R-4.1.0.patch b/builder/patches/R-4.1.0.patch new file mode 100644 index 0000000..aa02ef2 --- /dev/null +++ b/builder/patches/R-4.1.0.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 39cdf12..d162c18 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.1.0: + + FUTURE DIRECTIONS: diff --git a/builder/patches/R-4.1.1.patch b/builder/patches/R-4.1.1.patch new file mode 100644 index 0000000..1866d8e --- /dev/null +++ b/builder/patches/R-4.1.1.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index b58c1e2..96c03e7 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.1.1: + + NEW FEATURES: diff --git a/builder/patches/R-4.1.2.patch b/builder/patches/R-4.1.2.patch new file mode 100644 index 0000000..c79e4c7 --- /dev/null +++ b/builder/patches/R-4.1.2.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index ec745b3..0a3929b 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.1.2: + + C-LEVEL FACILITIES: diff --git a/builder/patches/R-4.1.3.patch b/builder/patches/R-4.1.3.patch new file mode 100644 index 0000000..4ebf677 --- /dev/null +++ b/builder/patches/R-4.1.3.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index a93a043..59d0dc8 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.1.3: + + NEW FEATURES: diff --git a/builder/patches/R-4.2.0.patch b/builder/patches/R-4.2.0.patch new file mode 100644 index 0000000..e17454a --- /dev/null +++ b/builder/patches/R-4.2.0.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 690d0d4..91658c3 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.2.0: + + SIGNIFICANT USER-VISIBLE CHANGES: diff --git a/builder/patches/R-4.2.1.patch b/builder/patches/R-4.2.1.patch new file mode 100644 index 0000000..b345c95 --- /dev/null +++ b/builder/patches/R-4.2.1.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 238859d..3c8f99f 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.2.1: + + NEW FEATURES: diff --git a/builder/patches/R-4.2.2.patch b/builder/patches/R-4.2.2.patch new file mode 100644 index 0000000..6159f97 --- /dev/null +++ b/builder/patches/R-4.2.2.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 08256d2..9dbe631 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.2.2: + + NEW FEATURES: diff --git a/builder/patches/R-4.2.3.patch b/builder/patches/R-4.2.3.patch new file mode 100644 index 0000000..a2dc58a --- /dev/null +++ b/builder/patches/R-4.2.3.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index a30f7d3..d914b72 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.2.3: + + C-LEVEL FACILITIES: diff --git a/builder/patches/R-4.3.0.patch b/builder/patches/R-4.3.0.patch new file mode 100644 index 0000000..f3b8b10 --- /dev/null +++ b/builder/patches/R-4.3.0.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 2e83bc3..185f45f 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.3.0: + + SIGNIFICANT USER-VISIBLE CHANGES: diff --git a/builder/patches/R-4.3.1.patch b/builder/patches/R-4.3.1.patch new file mode 100644 index 0000000..bbaa9f7 --- /dev/null +++ b/builder/patches/R-4.3.1.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 317399c..4235d4d 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.3.1: + + C-LEVEL FACILITIES: diff --git a/builder/patches/R-4.3.2.patch b/builder/patches/R-4.3.2.patch new file mode 100644 index 0000000..28ec436 --- /dev/null +++ b/builder/patches/R-4.3.2.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index ae99650..8c618d8 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.3.2: + + NEW FEATURES: diff --git a/builder/patches/R-4.3.3.patch b/builder/patches/R-4.3.3.patch new file mode 100644 index 0000000..6cd860f --- /dev/null +++ b/builder/patches/R-4.3.3.patch @@ -0,0 +1,62 @@ +commit c06f7f2518673a75f9b36f2af9caf7b69ab4952e +Author: luke +Date: Sun Mar 31 19:35:58 2024 +0000 + + readRDS() and unserialize() now signal an errorr instead of returning a PROMSXP. + + + git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f71311..a190fbf8f3 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); +diff --git a/doc/NEWS b/doc/NEWS +index 7effa64..88f396d 100644 +--- a/doc/NEWS ++++ b/doc/NEWS +@@ -1,5 +1,10 @@ + R News + ++CHANGES IN POSIT'S BUILD FROM https://github.com/rstudio/r-builds ++ ++ * readRDS() and unserialize() now signal an error instead of returning a PROMSXP, ++ to fix CVE-2024-27322. ++ + CHANGES IN R 4.3.3: + + NEW FEATURES: