diff --git a/system/base/cpio/actions.py b/system/base/cpio/actions.py index c0af42da..ef024bd0 100644 --- a/system/base/cpio/actions.py +++ b/system/base/cpio/actions.py @@ -10,6 +10,7 @@ from pisi.actionsapi import shelltools from pisi.actionsapi import get def setup(): + pisitools.cflags.add("-std=gnu17") #who knows pisitools.dosed :) cmd="sed -i '/gets is a security hole/d' gnu/stdio.in.h" shelltools.system(cmd) @@ -18,6 +19,7 @@ def setup(): --with-rmt=/usr/sbin/rmt \ --disable-rpath") + def build(): autotools.make() diff --git a/system/base/cpio/files/CVE-2010-0624-rpatelib-overflow.patch b/system/base/cpio/files/CVE-2010-0624-rpatelib-overflow.patch deleted file mode 100644 index 55a6e7c7..00000000 --- a/system/base/cpio/files/CVE-2010-0624-rpatelib-overflow.patch +++ /dev/null @@ -1,14 +0,0 @@ -Index: cpio-2.9/lib/rtapelib.c -=================================================================== ---- cpio-2.9.orig/lib/rtapelib.c -+++ cpio-2.9/lib/rtapelib.c -@@ -573,6 +573,9 @@ rmt_read__ (int handle, char *buffer, si - || (status = get_status (handle)) == SAFE_READ_ERROR) - return SAFE_READ_ERROR; - -+ if (status > length) -+ return SAFE_READ_ERROR; -+ - for (counter = 0; counter < status; counter += rlen, buffer += rlen) - { - rlen = safe_read (READ_SIDE (handle), buffer, status - counter); diff --git a/system/base/cpio/files/cpio-2.12-CVE-2016-2037.patch b/system/base/cpio/files/cpio-2.12-CVE-2016-2037.patch deleted file mode 100644 index 3979d131..00000000 --- a/system/base/cpio/files/cpio-2.12-CVE-2016-2037.patch +++ /dev/null @@ -1,42 +0,0 @@ -Other calls to cpio_safer_name_suffix seem to be safe. - -* src/copyin.c (process_copy_in): Make sure that file_hdr.c_name -has at least two bytes allocated. -* src/util.c (cpio_safer_name_suffix): Document that use of this -function requires to be careful. ---- - src/copyin.c | 2 ++ - src/util.c | 5 ++++- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/src/copyin.c b/src/copyin.c -index cde911e..032d35f 100644 ---- a/src/copyin.c -+++ b/src/copyin.c -@@ -1430,6 +1430,8 @@ process_copy_in () - break; - } - -+ if (file_hdr.c_namesize <= 1) -+ file_hdr.c_name = xrealloc(file_hdr.c_name, 2); - cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag, - false); - -diff --git a/src/util.c b/src/util.c -index 6ff6032..2763ac1 100644 ---- a/src/util.c -+++ b/src/util.c -@@ -1411,7 +1411,10 @@ set_file_times (int fd, - } - - /* Do we have to ignore absolute paths, and if so, does the filename -- have an absolute path? */ -+ have an absolute path? -+ Before calling this function make sure that the allocated NAME buffer has -+ capacity at least 2 bytes to allow us to store the "." string inside. */ -+ - void - cpio_safer_name_suffix (char *name, bool link_target, bool absolute_names, - bool strip_leading_dots) --- -2.5.0 diff --git a/system/base/cpio/files/cpio-2.12-gcc-10.patch b/system/base/cpio/files/cpio-2.12-gcc-10.patch deleted file mode 100644 index 0af8f91a..00000000 --- a/system/base/cpio/files/cpio-2.12-gcc-10.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -Nuar a/global.c b/global.c ---- a/src/global.c 2020-11-09 15:08:34.291658902 +0300 -+++ b/src/global.c 2020-11-09 15:09:50.426653408 +0300 -@@ -184,9 +184,6 @@ - /* Extract to standard output? */ - bool to_stdout_option = false; - --/* The name this program was run with. */ --char *program_name; -- - /* Extract files over symbolic links */ - bool extract_over_symlinks; - diff --git a/system/base/cpio/files/cpio-2.12-name-overflow.patch b/system/base/cpio/files/cpio-2.12-name-overflow.patch deleted file mode 100644 index f8524688..00000000 --- a/system/base/cpio/files/cpio-2.12-name-overflow.patch +++ /dev/null @@ -1,15 +0,0 @@ -https://bugs.gentoo.org/572428 -https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00002.html -http://seclists.org/oss-sec/2016/q1/136 - ---- a/src/copyin.c -+++ b/src/copyin.c -@@ -1385,6 +1385,8 @@ - break; - } - -+ if (file_hdr.c_namesize <= 1) -+ file_hdr.c_name = xrealloc (file_hdr.c_name, 2); - cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag, - false); - diff --git a/system/base/cpio/files/cpio-2.12-no-overwrite-symlinks.patch b/system/base/cpio/files/cpio-2.12-no-overwrite-symlinks.patch deleted file mode 100644 index 7f09a419..00000000 --- a/system/base/cpio/files/cpio-2.12-no-overwrite-symlinks.patch +++ /dev/null @@ -1,153 +0,0 @@ -Index: cpio-2.12/src/copyin.c -=================================================================== ---- cpio-2.12.orig/src/copyin.c 2015-09-12 12:57:30.000000000 +0200 -+++ cpio-2.12/src/copyin.c 2016-03-15 16:59:17.044993467 +0100 -@@ -695,6 +695,51 @@ - free (link_name); - } - -+ -+static int -+path_contains_symlink(char *path) -+{ -+ struct stat st; -+ char *slash; -+ char *nextslash; -+ -+ /* we got NULL pointer or empty string */ -+ if (!path || !*path) { -+ return false; -+ } -+ -+ slash = path; -+ -+ while ((nextslash = strchr(slash + 1, '/')) != NULL) { -+ slash = nextslash; -+ *slash = '\0'; -+ -+ if (lstat(path, &st) != 0) { -+ if (errno == ELOOP) { -+ /* ELOOP - too many symlinks */ -+ *slash = '/'; -+ return true; -+ } else if (errno == ENOMEM) { -+ /* No memory for lstat - terminate */ -+ xalloc_die(); -+ } else { -+ /* cannot lstat path - give up */ -+ *slash = '/'; -+ return false; -+ } -+ } -+ -+ if (S_ISLNK(st.st_mode)) { -+ *slash = '/'; -+ return true; -+ } -+ -+ *slash = '/'; -+ } -+ -+ return false; -+} -+ - static void - copyin_file (struct cpio_file_stat *file_hdr, int in_file_des) - { -@@ -1468,6 +1513,23 @@ - { - /* Copy the input file into the directory structure. */ - -+ /* Can we write files over symlinks? */ -+ if (!extract_over_symlinks) -+ { -+ if (path_contains_symlink(file_hdr.c_name)) -+ { -+ /* skip the file */ -+ /* -+ fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name); -+ tape_toss_input (in_file_des, file_hdr.c_filesize); -+ tape_skip_padding (in_file_des, file_hdr.c_filesize); -+ continue; -+ */ -+ /* terminate */ -+ error (1, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name); -+ } -+ } -+ - /* Do we need to rename the file? */ - if (rename_flag || rename_batch_file) - { -Index: cpio-2.12/src/global.c -=================================================================== ---- cpio-2.12.orig/src/global.c 2015-09-12 12:57:30.000000000 +0200 -+++ cpio-2.12/src/global.c 2016-03-15 17:01:38.559293625 +0100 -@@ -187,6 +187,9 @@ - /* The name this program was run with. */ - char *program_name; - -+/* Extract files over symbolic links */ -+bool extract_over_symlinks; -+ - /* A pointer to either lstat or stat, depending on whether - dereferencing of symlinks is done for input files. */ - int (*xstat) (); -Index: cpio-2.12/src/main.c -=================================================================== ---- cpio-2.12.orig/src/main.c 2015-09-12 12:57:30.000000000 +0200 -+++ cpio-2.12/src/main.c 2016-03-15 17:03:14.295363569 +0100 -@@ -61,7 +61,8 @@ - TO_STDOUT_OPTION, - RENUMBER_INODES_OPTION, - IGNORE_DEVNO_OPTION, -- DEVICE_INDEPENDENT_OPTION -+ DEVICE_INDEPENDENT_OPTION, -+ EXTRACT_OVER_SYMLINKS - }; - - const char *program_authors[] = -@@ -243,6 +244,8 @@ - N_("Create leading directories where needed"), GRID+1 }, - {"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0, - N_("Do not change the ownership of the files"), GRID+1 }, -+ {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0, -+ N_("Force writing over symbolic links"), GRID+1 }, - {"unconditional", 'u', NULL, 0, - N_("Replace all files unconditionally"), GRID+1 }, - {"sparse", SPARSE_OPTION, NULL, 0, -@@ -432,6 +435,10 @@ - no_chown_flag = true; - break; - -+ case EXTRACT_OVER_SYMLINKS: /* --extract-over-symlinks */ -+ extract_over_symlinks = true; -+ break; -+ - case 'o': /* Copy-out mode. */ - if (copy_function != 0) - USAGE_ERROR ((0, 0, _("Mode already defined"))); -Index: cpio-2.12/src/extern.h -=================================================================== ---- cpio-2.12.orig/src/extern.h 2015-09-12 12:57:30.000000000 +0200 -+++ cpio-2.12/src/extern.h 2016-03-15 17:07:29.203583995 +0100 -@@ -96,6 +96,7 @@ - extern char output_is_special; - extern char input_is_seekable; - extern char output_is_seekable; -+extern bool extract_over_symlinks; - extern int (*xstat) (); - extern void (*copy_function) (); - extern char *change_directory_option; - -Index: cpio-2.12/doc/cpio.1 -=================================================================== ---- cpio-2.12.orig/doc/cpio.1 2015-09-12 12:57:30.000000000 +0200 -+++ cpio-2.12/doc/cpio.1 2016-03-15 17:09:00.610213320 +0100 -@@ -49,6 +49,7 @@ - [\fB\-\-no\-preserve\-owner\fR] [\fB\-\-message=\fIMESSAGE\fR] - [\fB\-\-force\-local\fR] [\fB\-\-no\-absolute\-filenames\fR] [\fB\-\-sparse\fR] - [\fB\-\-only\-verify\-crc\fR] [\fB\-\-to\-stdout\fR] [\fB\-\-quiet\fR] -+[\-\-extract\-over\-symlinks] - [\fB\-\-rsh\-command=\fICOMMAND\fR] - [\fIpattern\fR...] [\fB<\fR \fIarchive\fR] - diff --git a/system/base/cpio/files/cpio-2.12-non-gnu-compilers.patch b/system/base/cpio/files/cpio-2.12-non-gnu-compilers.patch deleted file mode 100644 index c7fc7f95..00000000 --- a/system/base/cpio/files/cpio-2.12-non-gnu-compilers.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- cpio-2.12/src/cpiohdr.h -+++ cpio-2.12/src/cpiohdr.h -@@ -25,6 +25,8 @@ - - # ifdef HAVE_ATTRIB_PACKED - # define ATTRIB_PACKED __attribute__((packed)) -+# else -+# define ATTRIB_PACKED - # endif - - # ifdef HAVE_PRAGMA_PACK diff --git a/system/base/cpio/files/cpio-2.12-svr4compat.patch b/system/base/cpio/files/cpio-2.12-svr4compat.patch deleted file mode 100644 index 45e1a875..00000000 --- a/system/base/cpio/files/cpio-2.12-svr4compat.patch +++ /dev/null @@ -1,22 +0,0 @@ ---- cpio-2.12/doc/cpio.texi.orig 2015-12-31 15:56:15.606713144 -0500 -+++ cpio-2.12/doc/cpio.texi 2015-12-31 16:00:05.186934057 -0500 -@@ -261,7 +261,8 @@ Sets the I/O block size to @var{block-si - @item -B - Set the I/O block size to 5120 bytes. - @item -c --Use the old portable (ASCII) archive format. -+Identical to ``-H newc'', use the new (SVR4) portable format. -+If you wish the old portable (ASCII) archive format, use ``-H odc'' instead. - @item -C @var{number} - @itemx --io-size=@var{number} - Set the I/O block size to the given @var{number} of bytes. ---- cpio-2.12/src/main.c.orig 2015-12-31 15:56:15.606713144 -0500 -+++ cpio-2.12/src/main.c 2015-12-31 16:02:24.047067176 -0500 -@@ -329,6 +329,7 @@ parse_opt (int key, char *arg, struct ar - case 'c': /* Use the old portable ASCII format. */ - if (archive_format != arf_unknown) - USAGE_ERROR ((0, 0, _("Archive format multiply defined"))); -+#define SVR4_COMPAT - #ifdef SVR4_COMPAT - archive_format = arf_newascii; /* -H newc. */ - #else diff --git a/system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch b/system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch deleted file mode 100644 index 326489a5..00000000 --- a/system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch +++ /dev/null @@ -1,47 +0,0 @@ -https://sources.debian.org/patches/cpio/2.13%2Bdfsg-7.1/revert-CVE-2015-1197-handling.patch/ -https://bugs.gentoo.org/700020 - -From: Chris Lamb -Date: Sat, 1 Feb 2020 13:36:37 +0100 -Subject: Fix a regression in handling of CVE-2015-1197 & - --no-absolute-filenames. - -See: - - * https://bugs.debian.org/946267 - * https://bugs.debian.org/946469 - -This reverts (most of): https://git.savannah.gnu.org/cgit/cpio.git/diff/?id=45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca&id2=3177d660a4c62a6acb538b0f7c54ba423698889a ---- a/src/copyin.c -+++ b/src/copyin.c -@@ -646,8 +646,6 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des) - link_name = xstrdup (file_hdr->c_tar_linkname); - } - -- cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false); -- - res = UMASKED_SYMLINK (link_name, file_hdr->c_name, - file_hdr->c_mode); - if (res < 0 && create_dir_flag) ---- a/tests/testsuite -+++ b/tests/testsuite -@@ -2787,7 +2787,7 @@ read at_status <"$at_status_file" - #AT_START_14 - at_fn_group_banner 14 'CVE-2015-1197.at:17' \ - "CVE-2015-1197 (--no-absolute-filenames for symlinks)" "" --at_xfail=no -+at_xfail=yes - ( - $as_echo "14. $at_setup_line: testing $at_desc ..." - $at_traceon - ---- a/tests/CVE-2015-1197.at -+++ b/tests/CVE-2015-1197.at -@@ -15,6 +15,7 @@ - # along with this program. If not, see . - - AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)]) -+AT_XFAIL_IF([true]) - AT_CHECK([ - tempdir=$(pwd)/tmp - mkdir $tempdir diff --git a/system/base/cpio/files/cpio-2.7-svr4compat.patch b/system/base/cpio/files/cpio-2.7-svr4compat.patch deleted file mode 100644 index 17967c1e..00000000 --- a/system/base/cpio/files/cpio-2.7-svr4compat.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff -Naurp cpio-2.9/doc/cpio.texi cpio-2.9.oden/doc/cpio.texi ---- cpio-2.9/doc/cpio.texi 2007-06-28 10:59:24.000000000 +0200 -+++ cpio-2.9.oden/doc/cpio.texi 2008-12-20 16:52:22.000000000 +0100 -@@ -331,7 +331,8 @@ block size is 512 bytes. - Set the I/O block size to @var{block-size} * 512 bytes. - - @item -c --Use the old portable (ASCII) archive format. -+Identical to "-H newc", use the new (SVR4) portable format. -+If you wish the old portable (ASCII) archive format, use "-H odc" instead. - - @item -C @var{io-size} - @itemx --io-size=@var{io-size} -diff -Naurp cpio-2.9/src/main.c cpio-2.9.oden/src/main.c ---- cpio-2.9/src/main.c 2007-06-28 12:46:41.000000000 +0200 -+++ cpio-2.9.oden/src/main.c 2008-12-20 16:52:22.000000000 +0100 -@@ -338,6 +338,7 @@ parse_opt (int key, char *arg, struct ar - case 'c': /* Use the old portable ASCII format. */ - if (archive_format != arf_unknown) - error (0, EXIT_FAILURE, _("Archive format multiply defined")); -+#define SVR4_COMPAT - #ifdef SVR4_COMPAT - archive_format = arf_newascii; /* -H newc. */ - #else diff --git a/system/base/cpio/files/cpio-2.9-exitCode.patch b/system/base/cpio/files/cpio-2.9-exitCode.patch deleted file mode 100644 index 8c300a51..00000000 --- a/system/base/cpio/files/cpio-2.9-exitCode.patch +++ /dev/null @@ -1,39 +0,0 @@ -Subject: [PATCH 2/7] set exit code to 1 when cpio fails to store file > 4GB - (#183224) - -diff --git a/src/copyout.c b/src/copyout.c -index fa999bd..6e82f4c 100644 ---- a/src/copyout.c -+++ b/src/copyout.c -@@ -287,7 +287,7 @@ field_width_error (const char *filename, const char *fieldname, - { - char valbuf[UINTMAX_STRSIZE_BOUND + 1]; - char maxbuf[UINTMAX_STRSIZE_BOUND + 1]; -- error (0, 0, _("%s: value %s %s out of allowed range 0..%s"), -+ error (1, 0, _("%s: value %s %s out of allowed range 0..%s"), - filename, fieldname, - STRINGIFY_BIGINT (value, valbuf), - STRINGIFY_BIGINT (MAX_VAL_WITH_DIGITS (width - nul, LG_8), -diff --git a/tests/CVE-2019-14866.at b/tests/CVE-2019-14866.at -index 530365a..5a4e15c 100644 ---- a/tests/CVE-2019-14866.at -+++ b/tests/CVE-2019-14866.at -@@ -30,6 +30,5 @@ fi - [0], - [], - [cpio: file: value size 17179869184 out of allowed range 0..8589934591 --2 blocks - ]) - AT_CLEANUP -diff --git a/tests/testsuite b/tests/testsuite -index 10531d1..d69dad9 100755 ---- a/tests/testsuite -+++ b/tests/testsuite -@@ -2927,7 +2927,6 @@ fi - at_status=$? at_failed=false - $at_check_filter - echo >>"$at_stderr"; printf "%s\n" "cpio: file: value size 17179869184 out of allowed range 0..8589934591 --2 blocks - " | \ - $at_diff - "$at_stderr" || at_failed=: - at_fn_diff_devnull "$at_stdout" || at_failed=: diff --git a/system/base/cpio/files/f42137f5.patch b/system/base/cpio/files/f42137f5.patch new file mode 100644 index 00000000..70433c00 --- /dev/null +++ b/system/base/cpio/files/f42137f5.patch @@ -0,0 +1,45 @@ +From f42137f5ab9cf07d1e62edc05e0212688d3ebaa2 Mon Sep 17 00:00:00 2001 +From: Sergey Poznyakoff +Date: Tue, 6 May 2025 21:02:43 +0300 +Subject: Fix c23 conformity + +--- + src/extern.h | 4 ++-- + src/global.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/extern.h b/src/extern.h +index bf3d5b3..455119b 100644 +--- a/src/extern.h ++++ b/src/extern.h +@@ -96,8 +96,8 @@ extern char input_is_special; + extern char output_is_special; + extern char input_is_seekable; + extern char output_is_seekable; +-extern int (*xstat) (); +-extern void (*copy_function) (); ++extern int (*xstat) (const char *, struct stat *); ++extern void (*copy_function) (void); + extern char *change_directory_option; + + #define STRINGIFY_BIGINT(i, b) umaxtostr (i, b) +diff --git a/src/global.c b/src/global.c +index 66686f2..5c6ab16 100644 +--- a/src/global.c ++++ b/src/global.c +@@ -184,10 +184,10 @@ bool to_stdout_option = false; + + /* A pointer to either lstat or stat, depending on whether + dereferencing of symlinks is done for input files. */ +-int (*xstat) (); ++int (*xstat) (const char *, struct stat *); + + /* Which copy operation to perform. (-i, -o, -p) */ +-void (*copy_function) () = 0; ++void (*copy_function) (void) = 0; + + char *change_directory_option; + +-- +cgit v1.2.3 + diff --git a/system/base/cpio/pspec.xml b/system/base/cpio/pspec.xml index 54131977..d136744b 100644 --- a/system/base/cpio/pspec.xml +++ b/system/base/cpio/pspec.xml @@ -1,5 +1,5 @@ - + cpio @@ -18,7 +18,8 @@ gentoo/cpio-2.12-non-gnu-compilers.patch - gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch --> + + f42137f5.patch @@ -34,6 +35,13 @@ + + 2026-04-05 + 2.15 + Rebuild. + Mustafa Cinasal + muscnsl@gmail.com + 2024-01-15 2.15