Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cpio rebuild

Browse Source
This commit is contained in:
Rmys
2026-04-05 22:21:22 +03:00
parent a80ffa0e4b
commit 1b445835cf
13 changed files with 57 additions and 382 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/cpio/actions.py
+2
View File
@@ -10,6 +10,7 @@ from pisi.actionsapi import shelltools
from pisi.actionsapi import get
def setup():
pisitools.cflags.add("-std=gnu17")
#who knows pisitools.dosed :)
cmd="sed -i '/gets is a security hole/d' gnu/stdio.in.h"
shelltools.system(cmd)
@@ -18,6 +19,7 @@ def setup():
--with-rmt=/usr/sbin/rmt \
--disable-rpath")
def build():
autotools.make()
system/base/cpio/files/CVE-2010-0624-rpatelib-overflow.patch
-14
View File
@@ -1,14 +0,0 @@
Index: cpio-2.9/lib/rtapelib.c
===================================================================
--- cpio-2.9.orig/lib/rtapelib.c
+++ cpio-2.9/lib/rtapelib.c
@@ -573,6 +573,9 @@ rmt_read__ (int handle, char *buffer, si
|| (status = get_status (handle)) == SAFE_READ_ERROR)
return SAFE_READ_ERROR;
+ if (status > length)
+ return SAFE_READ_ERROR;
+
for (counter = 0; counter < status; counter += rlen, buffer += rlen)
{
rlen = safe_read (READ_SIDE (handle), buffer, status - counter);
system/base/cpio/files/cpio-2.12-CVE-2016-2037.patch
-42
View File
@@ -1,42 +0,0 @@
Other calls to cpio_safer_name_suffix seem to be safe.
* src/copyin.c (process_copy_in): Make sure that file_hdr.c_name
has at least two bytes allocated.
* src/util.c (cpio_safer_name_suffix): Document that use of this
function requires to be careful.
---
src/copyin.c | 2 ++
src/util.c | 5 ++++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/copyin.c b/src/copyin.c
index cde911e..032d35f 100644
--- a/src/copyin.c
+++ b/src/copyin.c
@@ -1430,6 +1430,8 @@ process_copy_in ()
break;
}
+ if (file_hdr.c_namesize <= 1)
+ file_hdr.c_name = xrealloc(file_hdr.c_name, 2);
cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
false);
diff --git a/src/util.c b/src/util.c
index 6ff6032..2763ac1 100644
--- a/src/util.c
+++ b/src/util.c
@@ -1411,7 +1411,10 @@ set_file_times (int fd,
}
/* Do we have to ignore absolute paths, and if so, does the filename
- have an absolute path? */
+ have an absolute path?
+ Before calling this function make sure that the allocated NAME buffer has
+ capacity at least 2 bytes to allow us to store the "." string inside. */
+
void
cpio_safer_name_suffix (char *name, bool link_target, bool absolute_names,
bool strip_leading_dots)
--
2.5.0
system/base/cpio/files/cpio-2.12-gcc-10.patch
-13
View File
@@ -1,13 +0,0 @@
diff -Nuar a/global.c b/global.c
--- a/src/global.c 2020-11-09 15:08:34.291658902 +0300
+++ b/src/global.c 2020-11-09 15:09:50.426653408 +0300
@@ -184,9 +184,6 @@
/* Extract to standard output? */
bool to_stdout_option = false;
-/* The name this program was run with. */
-char *program_name;
-
/* Extract files over symbolic links */
bool extract_over_symlinks;
system/base/cpio/files/cpio-2.12-name-overflow.patch
-15
View File
@@ -1,15 +0,0 @@
https://bugs.gentoo.org/572428
https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00002.html
http://seclists.org/oss-sec/2016/q1/136
--- a/src/copyin.c
+++ b/src/copyin.c
@@ -1385,6 +1385,8 @@
break;
}
+ if (file_hdr.c_namesize <= 1)
+ file_hdr.c_name = xrealloc (file_hdr.c_name, 2);
cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
false);
system/base/cpio/files/cpio-2.12-no-overwrite-symlinks.patch
-153
View File
@@ -1,153 +0,0 @@
Index: cpio-2.12/src/copyin.c
===================================================================
--- cpio-2.12.orig/src/copyin.c 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/copyin.c 2016-03-15 16:59:17.044993467 +0100
@@ -695,6 +695,51 @@
free (link_name);
}
+
+static int
+path_contains_symlink(char *path)
+{
+ struct stat st;
+ char *slash;
+ char *nextslash;
+
+ /* we got NULL pointer or empty string */
+ if (!path || !*path) {
+ return false;
+ }
+
+ slash = path;
+
+ while ((nextslash = strchr(slash + 1, '/')) != NULL) {
+ slash = nextslash;
+ *slash = '\0';
+
+ if (lstat(path, &st) != 0) {
+ if (errno == ELOOP) {
+ /* ELOOP - too many symlinks */
+ *slash = '/';
+ return true;
+ } else if (errno == ENOMEM) {
+ /* No memory for lstat - terminate */
+ xalloc_die();
+ } else {
+ /* cannot lstat path - give up */
+ *slash = '/';
+ return false;
+ }
+ }
+
+ if (S_ISLNK(st.st_mode)) {
+ *slash = '/';
+ return true;
+ }
+
+ *slash = '/';
+ }
+
+ return false;
+}
+
static void
copyin_file (struct cpio_file_stat *file_hdr, int in_file_des)
{
@@ -1468,6 +1513,23 @@
{
/* Copy the input file into the directory structure. */
+ /* Can we write files over symlinks? */
+ if (!extract_over_symlinks)
+ {
+ if (path_contains_symlink(file_hdr.c_name))
+ {
+ /* skip the file */
+ /*
+ fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name);
+ tape_toss_input (in_file_des, file_hdr.c_filesize);
+ tape_skip_padding (in_file_des, file_hdr.c_filesize);
+ continue;
+ */
+ /* terminate */
+ error (1, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name);
+ }
+ }
+
/* Do we need to rename the file? */
if (rename_flag || rename_batch_file)
{
Index: cpio-2.12/src/global.c
===================================================================
--- cpio-2.12.orig/src/global.c 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/global.c 2016-03-15 17:01:38.559293625 +0100
@@ -187,6 +187,9 @@
/* The name this program was run with. */
char *program_name;
+/* Extract files over symbolic links */
+bool extract_over_symlinks;
+
/* A pointer to either lstat or stat, depending on whether
dereferencing of symlinks is done for input files. */
int (*xstat) ();
Index: cpio-2.12/src/main.c
===================================================================
--- cpio-2.12.orig/src/main.c 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/main.c 2016-03-15 17:03:14.295363569 +0100
@@ -61,7 +61,8 @@
TO_STDOUT_OPTION,
RENUMBER_INODES_OPTION,
IGNORE_DEVNO_OPTION,
- DEVICE_INDEPENDENT_OPTION
+ DEVICE_INDEPENDENT_OPTION,
+ EXTRACT_OVER_SYMLINKS
};
const char *program_authors[] =
@@ -243,6 +244,8 @@
N_("Create leading directories where needed"), GRID+1 },
{"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0,
N_("Do not change the ownership of the files"), GRID+1 },
+ {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0,
+ N_("Force writing over symbolic links"), GRID+1 },
{"unconditional", 'u', NULL, 0,
N_("Replace all files unconditionally"), GRID+1 },
{"sparse", SPARSE_OPTION, NULL, 0,
@@ -432,6 +435,10 @@
no_chown_flag = true;
break;
+ case EXTRACT_OVER_SYMLINKS: /* --extract-over-symlinks */
+ extract_over_symlinks = true;
+ break;
+
case 'o': /* Copy-out mode. */
if (copy_function != 0)
USAGE_ERROR ((0, 0, _("Mode already defined")));
Index: cpio-2.12/src/extern.h
===================================================================
--- cpio-2.12.orig/src/extern.h 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/extern.h 2016-03-15 17:07:29.203583995 +0100
@@ -96,6 +96,7 @@
extern char output_is_special;
extern char input_is_seekable;
extern char output_is_seekable;
+extern bool extract_over_symlinks;
extern int (*xstat) ();
extern void (*copy_function) ();
extern char *change_directory_option;
Index: cpio-2.12/doc/cpio.1
===================================================================
--- cpio-2.12.orig/doc/cpio.1 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/doc/cpio.1 2016-03-15 17:09:00.610213320 +0100
@@ -49,6 +49,7 @@
[\fB\-\-no\-preserve\-owner\fR] [\fB\-\-message=\fIMESSAGE\fR]
[\fB\-\-force\-local\fR] [\fB\-\-no\-absolute\-filenames\fR] [\fB\-\-sparse\fR]
[\fB\-\-only\-verify\-crc\fR] [\fB\-\-to\-stdout\fR] [\fB\-\-quiet\fR]
+[\-\-extract\-over\-symlinks]
[\fB\-\-rsh\-command=\fICOMMAND\fR]
[\fIpattern\fR...] [\fB<\fR \fIarchive\fR]
system/base/cpio/files/cpio-2.12-non-gnu-compilers.patch
-11
View File
@@ -1,11 +0,0 @@
--- cpio-2.12/src/cpiohdr.h
+++ cpio-2.12/src/cpiohdr.h
@@ -25,6 +25,8 @@
# ifdef HAVE_ATTRIB_PACKED
# define ATTRIB_PACKED __attribute__((packed))
+# else
+# define ATTRIB_PACKED
# endif
# ifdef HAVE_PRAGMA_PACK
system/base/cpio/files/cpio-2.12-svr4compat.patch
-22
View File
@@ -1,22 +0,0 @@
--- cpio-2.12/doc/cpio.texi.orig 2015-12-31 15:56:15.606713144 -0500
+++ cpio-2.12/doc/cpio.texi 2015-12-31 16:00:05.186934057 -0500
@@ -261,7 +261,8 @@ Sets the I/O block size to @var{block-si
@item -B
Set the I/O block size to 5120 bytes.
@item -c
-Use the old portable (ASCII) archive format.
+Identical to ``-H newc'', use the new (SVR4) portable format.
+If you wish the old portable (ASCII) archive format, use ``-H odc'' instead.
@item -C @var{number}
@itemx --io-size=@var{number}
Set the I/O block size to the given @var{number} of bytes.
--- cpio-2.12/src/main.c.orig 2015-12-31 15:56:15.606713144 -0500
+++ cpio-2.12/src/main.c 2015-12-31 16:02:24.047067176 -0500
@@ -329,6 +329,7 @@ parse_opt (int key, char *arg, struct ar
case 'c': /* Use the old portable ASCII format. */
if (archive_format != arf_unknown)
USAGE_ERROR ((0, 0, _("Archive format multiply defined")));
+#define SVR4_COMPAT
#ifdef SVR4_COMPAT
archive_format = arf_newascii; /* -H newc. */
#else
system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch
-47
View File
@@ -1,47 +0,0 @@
https://sources.debian.org/patches/cpio/2.13%2Bdfsg-7.1/revert-CVE-2015-1197-handling.patch/
https://bugs.gentoo.org/700020
From: Chris Lamb <lamby@debian.org>
Date: Sat, 1 Feb 2020 13:36:37 +0100
Subject: Fix a regression in handling of CVE-2015-1197 &
--no-absolute-filenames.
See:
* https://bugs.debian.org/946267
* https://bugs.debian.org/946469
This reverts (most of): https://git.savannah.gnu.org/cgit/cpio.git/diff/?id=45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca&id2=3177d660a4c62a6acb538b0f7c54ba423698889a
--- a/src/copyin.c
+++ b/src/copyin.c
@@ -646,8 +646,6 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
link_name = xstrdup (file_hdr->c_tar_linkname);
}
- cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false);
-
res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
file_hdr->c_mode);
if (res < 0 && create_dir_flag)
--- a/tests/testsuite
+++ b/tests/testsuite
@@ -2787,7 +2787,7 @@ read at_status <"$at_status_file"
#AT_START_14
at_fn_group_banner 14 'CVE-2015-1197.at:17' \
"CVE-2015-1197 (--no-absolute-filenames for symlinks)" ""
-at_xfail=no
+at_xfail=yes
(
$as_echo "14. $at_setup_line: testing $at_desc ..."
$at_traceon
--- a/tests/CVE-2015-1197.at
+++ b/tests/CVE-2015-1197.at
@@ -15,6 +15,7 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>.
AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)])
+AT_XFAIL_IF([true])
AT_CHECK([
tempdir=$(pwd)/tmp
mkdir $tempdir
system/base/cpio/files/cpio-2.7-svr4compat.patch
-24
View File
@@ -1,24 +0,0 @@
diff -Naurp cpio-2.9/doc/cpio.texi cpio-2.9.oden/doc/cpio.texi
--- cpio-2.9/doc/cpio.texi 2007-06-28 10:59:24.000000000 +0200
+++ cpio-2.9.oden/doc/cpio.texi 2008-12-20 16:52:22.000000000 +0100
@@ -331,7 +331,8 @@ block size is 512 bytes.
Set the I/O block size to @var{block-size} * 512 bytes.
@item -c
-Use the old portable (ASCII) archive format.
+Identical to "-H newc", use the new (SVR4) portable format.
+If you wish the old portable (ASCII) archive format, use "-H odc" instead.
@item -C @var{io-size}
@itemx --io-size=@var{io-size}
diff -Naurp cpio-2.9/src/main.c cpio-2.9.oden/src/main.c
--- cpio-2.9/src/main.c 2007-06-28 12:46:41.000000000 +0200
+++ cpio-2.9.oden/src/main.c 2008-12-20 16:52:22.000000000 +0100
@@ -338,6 +338,7 @@ parse_opt (int key, char *arg, struct ar
case 'c': /* Use the old portable ASCII format. */
if (archive_format != arf_unknown)
error (0, EXIT_FAILURE, _("Archive format multiply defined"));
+#define SVR4_COMPAT
#ifdef SVR4_COMPAT
archive_format = arf_newascii; /* -H newc. */
#else
system/base/cpio/files/cpio-2.9-exitCode.patch
-39
View File
@@ -1,39 +0,0 @@
Subject: [PATCH 2/7] set exit code to 1 when cpio fails to store file > 4GB
(#183224)
diff --git a/src/copyout.c b/src/copyout.c
index fa999bd..6e82f4c 100644
--- a/src/copyout.c
+++ b/src/copyout.c
@@ -287,7 +287,7 @@ field_width_error (const char *filename, const char *fieldname,
{
char valbuf[UINTMAX_STRSIZE_BOUND + 1];
char maxbuf[UINTMAX_STRSIZE_BOUND + 1];
- error (0, 0, _("%s: value %s %s out of allowed range 0..%s"),
+ error (1, 0, _("%s: value %s %s out of allowed range 0..%s"),
filename, fieldname,
STRINGIFY_BIGINT (value, valbuf),
STRINGIFY_BIGINT (MAX_VAL_WITH_DIGITS (width - nul, LG_8),
diff --git a/tests/CVE-2019-14866.at b/tests/CVE-2019-14866.at
index 530365a..5a4e15c 100644
--- a/tests/CVE-2019-14866.at
+++ b/tests/CVE-2019-14866.at
@@ -30,6 +30,5 @@ fi
[0],
[],
[cpio: file: value size 17179869184 out of allowed range 0..8589934591
-2 blocks
])
AT_CLEANUP
diff --git a/tests/testsuite b/tests/testsuite
index 10531d1..d69dad9 100755
--- a/tests/testsuite
+++ b/tests/testsuite
@@ -2927,7 +2927,6 @@ fi
at_status=$? at_failed=false
$at_check_filter
echo >>"$at_stderr"; printf "%s\n" "cpio: file: value size 17179869184 out of allowed range 0..8589934591
-2 blocks
" | \
$at_diff - "$at_stderr" || at_failed=:
at_fn_diff_devnull "$at_stdout" || at_failed=:
system/base/cpio/files/f42137f5.patch
+45
View File
@@ -0,0 +1,45 @@
From f42137f5ab9cf07d1e62edc05e0212688d3ebaa2 Mon Sep 17 00:00:00 2001
From: Sergey Poznyakoff <gray@gnu.org>
Date: Tue, 6 May 2025 21:02:43 +0300
Subject: Fix c23 conformity
---
src/extern.h | 4 ++--
src/global.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/extern.h b/src/extern.h
index bf3d5b3..455119b 100644
--- a/src/extern.h
+++ b/src/extern.h
@@ -96,8 +96,8 @@ extern char input_is_special;
extern char output_is_special;
extern char input_is_seekable;
extern char output_is_seekable;
-extern int (*xstat) ();
-extern void (*copy_function) ();
+extern int (*xstat) (const char *, struct stat *);
+extern void (*copy_function) (void);
extern char *change_directory_option;
#define STRINGIFY_BIGINT(i, b) umaxtostr (i, b)
diff --git a/src/global.c b/src/global.c
index 66686f2..5c6ab16 100644
--- a/src/global.c
+++ b/src/global.c
@@ -184,10 +184,10 @@ bool to_stdout_option = false;
/* A pointer to either lstat or stat, depending on whether
dereferencing of symlinks is done for input files. */
-int (*xstat) ();
+int (*xstat) (const char *, struct stat *);
/* Which copy operation to perform. (-i, -o, -p) */
-void (*copy_function) () = 0;
+void (*copy_function) (void) = 0;
char *change_directory_option;
--
cgit v1.2.3
system/base/cpio/pspec.xml
+10 -2
View File
@@ -1,5 +1,5 @@
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<!DOCTYPE PISI SYSTEM "https://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
<Source>
<Name>cpio</Name>
@@ -18,7 +18,8 @@
</BuildDependencies>
<Patches>
<Patch level="1">gentoo/cpio-2.12-non-gnu-compilers.patch</Patch>
<Patch level="1">gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch</Patch> -->
<!-- <Patch level="1">gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch</Patch> -->
<Patch level="1">f42137f5.patch</Patch>
</Patches>
</Source>
@@ -34,6 +35,13 @@
</Package>
<History>
<Update release="8">
<Date>2026-04-05</Date>
<Version>2.15</Version>
<Comment>Rebuild.</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="7">
<Date>2024-01-15</Date>
<Version>2.15</Version>