Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cpio rebuild

Browse Source
This commit is contained in:
idriskalp
2019-12-27 12:45:48 +03:00
parent 895bdcc61c
commit 21194f6619
6 changed files with 256 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/cpio/files/cpio-2.12-CVE-2016-2037.patch
+42
View File
@@ -0,0 +1,42 @@
Other calls to cpio_safer_name_suffix seem to be safe.
* src/copyin.c (process_copy_in): Make sure that file_hdr.c_name
has at least two bytes allocated.
* src/util.c (cpio_safer_name_suffix): Document that use of this
function requires to be careful.
---
src/copyin.c | 2 ++
src/util.c | 5 ++++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/copyin.c b/src/copyin.c
index cde911e..032d35f 100644
--- a/src/copyin.c
+++ b/src/copyin.c
@@ -1430,6 +1430,8 @@ process_copy_in ()
break;
}
+ if (file_hdr.c_namesize <= 1)
+ file_hdr.c_name = xrealloc(file_hdr.c_name, 2);
cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
false);
diff --git a/src/util.c b/src/util.c
index 6ff6032..2763ac1 100644
--- a/src/util.c
+++ b/src/util.c
@@ -1411,7 +1411,10 @@ set_file_times (int fd,
}
/* Do we have to ignore absolute paths, and if so, does the filename
- have an absolute path? */
+ have an absolute path?
+ Before calling this function make sure that the allocated NAME buffer has
+ capacity at least 2 bytes to allow us to store the "." string inside. */
+
void
cpio_safer_name_suffix (char *name, bool link_target, bool absolute_names,
bool strip_leading_dots)
--
2.5.0
system/base/cpio/files/cpio-2.12-name-overflow.patch
+15
View File
@@ -0,0 +1,15 @@
https://bugs.gentoo.org/572428
https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00002.html
http://seclists.org/oss-sec/2016/q1/136
--- a/src/copyin.c
+++ b/src/copyin.c
@@ -1385,6 +1385,8 @@
break;
}
+ if (file_hdr.c_namesize <= 1)
+ file_hdr.c_name = xrealloc (file_hdr.c_name, 2);
cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
false);
system/base/cpio/files/cpio-2.12-no-overwrite-symlinks.patch
+153
View File
@@ -0,0 +1,153 @@
Index: cpio-2.12/src/copyin.c
===================================================================
--- cpio-2.12.orig/src/copyin.c 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/copyin.c 2016-03-15 16:59:17.044993467 +0100
@@ -695,6 +695,51 @@
free (link_name);
}
+
+static int
+path_contains_symlink(char *path)
+{
+ struct stat st;
+ char *slash;
+ char *nextslash;
+
+ /* we got NULL pointer or empty string */
+ if (!path || !*path) {
+ return false;
+ }
+
+ slash = path;
+
+ while ((nextslash = strchr(slash + 1, '/')) != NULL) {
+ slash = nextslash;
+ *slash = '\0';
+
+ if (lstat(path, &st) != 0) {
+ if (errno == ELOOP) {
+ /* ELOOP - too many symlinks */
+ *slash = '/';
+ return true;
+ } else if (errno == ENOMEM) {
+ /* No memory for lstat - terminate */
+ xalloc_die();
+ } else {
+ /* cannot lstat path - give up */
+ *slash = '/';
+ return false;
+ }
+ }
+
+ if (S_ISLNK(st.st_mode)) {
+ *slash = '/';
+ return true;
+ }
+
+ *slash = '/';
+ }
+
+ return false;
+}
+
static void
copyin_file (struct cpio_file_stat *file_hdr, int in_file_des)
{
@@ -1468,6 +1513,23 @@
{
/* Copy the input file into the directory structure. */
+ /* Can we write files over symlinks? */
+ if (!extract_over_symlinks)
+ {
+ if (path_contains_symlink(file_hdr.c_name))
+ {
+ /* skip the file */
+ /*
+ fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name);
+ tape_toss_input (in_file_des, file_hdr.c_filesize);
+ tape_skip_padding (in_file_des, file_hdr.c_filesize);
+ continue;
+ */
+ /* terminate */
+ error (1, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name);
+ }
+ }
+
/* Do we need to rename the file? */
if (rename_flag || rename_batch_file)
{
Index: cpio-2.12/src/global.c
===================================================================
--- cpio-2.12.orig/src/global.c 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/global.c 2016-03-15 17:01:38.559293625 +0100
@@ -187,6 +187,9 @@
/* The name this program was run with. */
char *program_name;
+/* Extract files over symbolic links */
+bool extract_over_symlinks;
+
/* A pointer to either lstat or stat, depending on whether
dereferencing of symlinks is done for input files. */
int (*xstat) ();
Index: cpio-2.12/src/main.c
===================================================================
--- cpio-2.12.orig/src/main.c 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/main.c 2016-03-15 17:03:14.295363569 +0100
@@ -61,7 +61,8 @@
TO_STDOUT_OPTION,
RENUMBER_INODES_OPTION,
IGNORE_DEVNO_OPTION,
- DEVICE_INDEPENDENT_OPTION
+ DEVICE_INDEPENDENT_OPTION,
+ EXTRACT_OVER_SYMLINKS
};
const char *program_authors[] =
@@ -243,6 +244,8 @@
N_("Create leading directories where needed"), GRID+1 },
{"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0,
N_("Do not change the ownership of the files"), GRID+1 },
+ {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0,
+ N_("Force writing over symbolic links"), GRID+1 },
{"unconditional", 'u', NULL, 0,
N_("Replace all files unconditionally"), GRID+1 },
{"sparse", SPARSE_OPTION, NULL, 0,
@@ -432,6 +435,10 @@
no_chown_flag = true;
break;
+ case EXTRACT_OVER_SYMLINKS: /* --extract-over-symlinks */
+ extract_over_symlinks = true;
+ break;
+
case 'o': /* Copy-out mode. */
if (copy_function != 0)
USAGE_ERROR ((0, 0, _("Mode already defined")));
Index: cpio-2.12/src/extern.h
===================================================================
--- cpio-2.12.orig/src/extern.h 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/src/extern.h 2016-03-15 17:07:29.203583995 +0100
@@ -96,6 +96,7 @@
extern char output_is_special;
extern char input_is_seekable;
extern char output_is_seekable;
+extern bool extract_over_symlinks;
extern int (*xstat) ();
extern void (*copy_function) ();
extern char *change_directory_option;
Index: cpio-2.12/doc/cpio.1
===================================================================
--- cpio-2.12.orig/doc/cpio.1 2015-09-12 12:57:30.000000000 +0200
+++ cpio-2.12/doc/cpio.1 2016-03-15 17:09:00.610213320 +0100
@@ -49,6 +49,7 @@
[\fB\-\-no\-preserve\-owner\fR] [\fB\-\-message=\fIMESSAGE\fR]
[\fB\-\-force\-local\fR] [\fB\-\-no\-absolute\-filenames\fR] [\fB\-\-sparse\fR]
[\fB\-\-only\-verify\-crc\fR] [\fB\-\-to\-stdout\fR] [\fB\-\-quiet\fR]
+[\-\-extract\-over\-symlinks]
[\fB\-\-rsh\-command=\fICOMMAND\fR]
[\fIpattern\fR...] [\fB<\fR \fIarchive\fR]
system/base/cpio/files/cpio-2.12-non-gnu-compilers.patch
+11
View File
@@ -0,0 +1,11 @@
--- cpio-2.12/src/cpiohdr.h
+++ cpio-2.12/src/cpiohdr.h
@@ -25,6 +25,8 @@
# ifdef HAVE_ATTRIB_PACKED
# define ATTRIB_PACKED __attribute__((packed))
+# else
+# define ATTRIB_PACKED
# endif
# ifdef HAVE_PRAGMA_PACK
system/base/cpio/files/cpio-2.12-svr4compat.patch
+22
View File
@@ -0,0 +1,22 @@
--- cpio-2.12/doc/cpio.texi.orig 2015-12-31 15:56:15.606713144 -0500
+++ cpio-2.12/doc/cpio.texi 2015-12-31 16:00:05.186934057 -0500
@@ -261,7 +261,8 @@ Sets the I/O block size to @var{block-si
@item -B
Set the I/O block size to 5120 bytes.
@item -c
-Use the old portable (ASCII) archive format.
+Identical to ``-H newc'', use the new (SVR4) portable format.
+If you wish the old portable (ASCII) archive format, use ``-H odc'' instead.
@item -C @var{number}
@itemx --io-size=@var{number}
Set the I/O block size to the given @var{number} of bytes.
--- cpio-2.12/src/main.c.orig 2015-12-31 15:56:15.606713144 -0500
+++ cpio-2.12/src/main.c 2015-12-31 16:02:24.047067176 -0500
@@ -329,6 +329,7 @@ parse_opt (int key, char *arg, struct ar
case 'c': /* Use the old portable ASCII format. */
if (archive_format != arf_unknown)
USAGE_ERROR ((0, 0, _("Archive format multiply defined")));
+#define SVR4_COMPAT
#ifdef SVR4_COMPAT
archive_format = arf_newascii; /* -H newc. */
#else
system/base/cpio/pspec.xml
+13
View File
@@ -17,6 +17,12 @@
<!--Patch level="1">cpio-2.7-svr4compat.patch</Patch-->
<Patch level="1">cpio-2.9-exitCode.patch</Patch>
<Patch level="1">CVE-2010-0624-rpatelib-overflow.patch</Patch>
<Patch level="1">cpio-2.12-name-overflow.patch</Patch>
<Patch level="1">cpio-2.12-non-gnu-compilers.patch</Patch>
<Patch level="1">cpio-2.12-no-overwrite-symlinks.patch</Patch>
<Patch level="1">cpio-2.12-svr4compat.patch</Patch>
<Patch level="1">CVE-2010-0624-rpatelib-overflow.patch</Patch>
</Patches>
</Source>
@@ -32,6 +38,13 @@
</Package>
<History>
<Update release="5">
<Date>2019-12-27</Date>
<Version>2.12</Version>
<Comment>Rebuild</Comment>
<Name>Idris Kalp</Name>
<Email>idriskalp@gmail.com</Email>
</Update>
<Update release="4">
<Date>2018-07-15</Date>
<Version>2.12</Version>