Browse Source

gnu: cpio: Update to 2.13 [fixes CVE-2015-1197, CVE-2019-14866].

* gnu/packages/cpio.scm (cpio): Update to 2.13.
Remove "cpio-CVE-2016-2037.patch".
* gnu/local.mk (dist_patch_DATA): Remove it.
gn-latest-20200428
Ludovic Courtès 2 years ago
parent
commit
81ffe63773
No known key found for this signature in database GPG Key ID: 90B11993D9AEBB5
3 changed files with 2 additions and 53 deletions
  1. +0
    -1
      gnu/local.mk
  2. +2
    -3
      gnu/packages/cpio.scm
  3. +0
    -49
      gnu/packages/patches/cpio-CVE-2016-2037.patch

+ 0
- 1
gnu/local.mk View File

@ -760,7 +760,6 @@ dist_patch_DATA = \
%D%/packages/patches/coda-use-system-libs.patch \
%D%/packages/patches/combinatorial-blas-awpm.patch \
%D%/packages/patches/combinatorial-blas-io-fix.patch \
%D%/packages/patches/cpio-CVE-2016-2037.patch \
%D%/packages/patches/cpufrequtils-fix-aclocal.patch \
%D%/packages/patches/crawl-upgrade-saves.patch \
%D%/packages/patches/crda-optional-gcrypt.patch \


+ 2
- 3
gnu/packages/cpio.scm View File

@ -28,15 +28,14 @@
(define-public cpio
(package
(name "cpio")
(version "2.12")
(version "2.13")
(source (origin
(method url-fetch)
(uri (string-append "mirror://gnu/cpio/cpio-"
version ".tar.bz2"))
(sha256
(base32
"0vi9q475h1rki53100zml75vxsykzyhrn70hidy41s5c2rc8r6bh"))
(patches (search-patches "cpio-CVE-2016-2037.patch"))))
"0vbgnhkawdllgnkdn6zn1f56fczwk0518krakz2qbwhxmv2vvdga"))))
(build-system gnu-build-system)
(home-page "https://www.gnu.org/software/cpio/")
(synopsis "Manage cpio and tar file archives")


+ 0
- 49
gnu/packages/patches/cpio-CVE-2016-2037.patch View File

@ -1,49 +0,0 @@
Fix CVE-2016-2037 (out of bounds write in process_copy_in()).
Copied from upstream mailing list:
https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html
---
Other calls to cpio_safer_name_suffix seem to be safe.
.
* src/copyin.c (process_copy_in): Make sure that file_hdr.c_name
has at least two bytes allocated.
* src/util.c (cpio_safer_name_suffix): Document that use of this
function requires to be careful.
Author: Pavel Raiskup <praiskup@redhat.com>
---
src/copyin.c | 2 ++
src/util.c | 5 ++++-
2 files changed, 6 insertions(+), 1 deletion(-)
Index: cpio-2.11+dfsg/src/copyin.c
===================================================================
--- cpio-2.11+dfsg.orig/src/copyin.c
+++ cpio-2.11+dfsg/src/copyin.c
@@ -1433,6 +1433,8 @@ process_copy_in ()
break;
}
+ if (file_hdr.c_namesize <= 1)
+ file_hdr.c_name = xrealloc(file_hdr.c_name, 2);
cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
false);
Index: cpio-2.11+dfsg/src/util.c
===================================================================
--- cpio-2.11+dfsg.orig/src/util.c
+++ cpio-2.11+dfsg/src/util.c
@@ -1374,7 +1374,10 @@ set_file_times (int fd,
}
/* Do we have to ignore absolute paths, and if so, does the filename
- have an absolute path? */
+ have an absolute path?
+ Before calling this function make sure that the allocated NAME buffer has
+ capacity at least 2 bytes to allow us to store the "." string inside. */
+
void
cpio_safer_name_suffix (char *name, bool link_target, bool absolute_names,
bool strip_leading_dots)

Loading…
Cancel
Save