busybox rebuild CVE-2021-28831.patch

system/base/busybox/files/busybox-1.33.0-CVE-2021-28831.patch

@@ -0,0 +1,33 @@
+diff -up busybox-1.33.0/archival/libarchive/decompress_gunzip.c.CVE-2021-28831 busybox-1.33.0/archival/libarchive/decompress_gunzip.c
+--- busybox-1.33.0/archival/libarchive/decompress_gunzip.c.CVE-2021-28831	2021-03-22 13:55:11.883398937 -0400
++++ busybox-1.33.0/archival/libarchive/decompress_gunzip.c	2021-03-22 13:56:09.316681291 -0400
+@@ -220,10 +220,20 @@ static const uint8_t border[] ALIGN1 = {
+  * each table.
+  * t: table to free
+  */
++#define BAD_HUFT(p) ((uintptr_t)(p) & 1)
++#define ERR_RET     ((huft_t*)(uintptr_t)1)
+ static void huft_free(huft_t *p)
+ {
+ 	huft_t *q;
+ 
++	/*
++	 * If 'p' has the error bit set we have to clear it, otherwise we might run
++	 * into a segmentation fault or an invalid pointer to free(p)
++	 */
++	if (BAD_HUFT(p)) {
++		p = (huft_t*)((uintptr_t)(p) ^ (uintptr_t)(ERR_RET));
++	}
++
+ 	/* Go through linked list, freeing from the malloced (t[-1]) address. */
+ 	while (p) {
+ 		q = (--p)->v.t;
+@@ -289,8 +299,6 @@ static unsigned fill_bitbuffer(STATE_PAR
+  * or a valid pointer to a Huffman table, ORed with 0x1 if incompete table
+  * is given: "fixed inflate" decoder feeds us such data.
+  */
+-#define BAD_HUFT(p) ((uintptr_t)(p) & 1)
+-#define ERR_RET     ((huft_t*)(uintptr_t)1)
+ static huft_t* huft_build(const unsigned *b, const unsigned n,
+ 			const unsigned s, const struct cp_ext *cp_ext,
+ 			unsigned *m)

system/base/busybox/files/config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.33.0
-# Fri Feb 19 12:30:54 2021
+# Sun Mar 21 15:29:45 2021
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -485,9 +485,9 @@ CONFIG_FEATURE_XARGS_SUPPORT_ARGS_FILE=y
 #
 # Init Utilities
 #
-CONFIG_BOOTCHARTD=y
+# CONFIG_BOOTCHARTD is not set
-CONFIG_FEATURE_BOOTCHARTD_BLOATED_HEADER=y
+# CONFIG_FEATURE_BOOTCHARTD_BLOATED_HEADER is not set
-CONFIG_FEATURE_BOOTCHARTD_CONFIG_FILE=y
+# CONFIG_FEATURE_BOOTCHARTD_CONFIG_FILE is not set
 CONFIG_HALT=y
 CONFIG_POWEROFF=y
 CONFIG_REBOOT=y
@@ -496,15 +496,15 @@ CONFIG_REBOOT=y
 CONFIG_TELINIT_PATH=""
 CONFIG_INIT=y
 CONFIG_LINUXRC=y
-CONFIG_FEATURE_USE_INITTAB=y
+# CONFIG_FEATURE_USE_INITTAB is not set
 # CONFIG_FEATURE_KILL_REMOVED is not set
 CONFIG_FEATURE_KILL_DELAY=0
-CONFIG_FEATURE_INIT_SCTTY=y
+# CONFIG_FEATURE_INIT_SCTTY is not set
 # CONFIG_FEATURE_INIT_SYSLOG is not set
-CONFIG_FEATURE_INIT_QUIET=y
+# CONFIG_FEATURE_INIT_QUIET is not set
-CONFIG_FEATURE_INIT_COREDUMPS=y
+# CONFIG_FEATURE_INIT_COREDUMPS is not set
-CONFIG_INIT_TERMINAL_TYPE="linux"
+CONFIG_INIT_TERMINAL_TYPE=""
-CONFIG_FEATURE_INIT_MODIFY_CMDLINE=y
+# CONFIG_FEATURE_INIT_MODIFY_CMDLINE is not set
 
 #
 # Login/Password Management Utilities
@@ -587,8 +587,8 @@ CONFIG_DEFAULT_DEPMOD_FILE="modules.dep"
 #
 # Linux System Utilities
 #
-# CONFIG_ACPID is not set
+CONFIG_ACPID=y
-# CONFIG_FEATURE_ACPID_COMPAT is not set
+CONFIG_FEATURE_ACPID_COMPAT=y
 CONFIG_BLKDISCARD=y
 CONFIG_BLKID=y
 CONFIG_FEATURE_BLKID_TYPE=y
@@ -651,7 +651,7 @@ CONFIG_MKFS_MINIX=y
 CONFIG_FEATURE_MINIX2=y
 # CONFIG_MKFS_REISER is not set
 CONFIG_MKDOSFS=y
-# CONFIG_MKFS_VFAT is not set
+CONFIG_MKFS_VFAT=y
 CONFIG_MKSWAP=y
 CONFIG_FEATURE_MKSWAP_UUID=y
 CONFIG_MORE=y
@@ -889,7 +889,7 @@ CONFIG_IFENSLAVE=y
 CONFIG_IFPLUGD=y
 CONFIG_IFUP=y
 CONFIG_IFDOWN=y
-CONFIG_IFUPDOWN_IFSTATE_PATH="/var/run/ifstate"
+CONFIG_IFUPDOWN_IFSTATE_PATH=""
 CONFIG_FEATURE_IFUPDOWN_IP=y
 CONFIG_FEATURE_IFUPDOWN_IPV4=y
 CONFIG_FEATURE_IFUPDOWN_IPV6=y
@@ -985,7 +985,7 @@ CONFIG_ZCIP=y
 CONFIG_UDHCPD=y
 CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC=y
 CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY=y
-CONFIG_DHCPD_LEASES_FILE="/var/lib/misc/udhcpd.leases"
+CONFIG_DHCPD_LEASES_FILE=""
 CONFIG_DUMPLEASES=y
 CONFIG_DHCPRELAY=y
 CONFIG_UDHCPC=y
@@ -1024,7 +1024,7 @@ CONFIG_FEATURE_POPMAILDIR_DELIVERY=y
 CONFIG_REFORMIME=y
 CONFIG_FEATURE_REFORMIME_COMPAT=y
 CONFIG_SENDMAIL=y
-CONFIG_FEATURE_MIME_CHARSET="us-ascii"
+CONFIG_FEATURE_MIME_CHARSET=""
 
 #
 # Process Utilities
@@ -1081,7 +1081,7 @@ CONFIG_RUNSV=y
 CONFIG_RUNSVDIR=y
 # CONFIG_FEATURE_RUNSVDIR_LOG is not set
 CONFIG_SV=y
-CONFIG_SV_DEFAULT_SERVICE_DIR="/var/service"
+CONFIG_SV_DEFAULT_SERVICE_DIR=""
 CONFIG_SVC=y
 CONFIG_SVOK=y
 CONFIG_SVLOGD=y

system/base/busybox/pspec.xml

@@ -20,7 +20,7 @@
             <!-- This patch is essential for udhcp to request root-path from dhcpd and required by ptsp -->
             <Patch level="1">udhcp-rootpath-rq.patch</Patch>
             <Patch level="1">suppress-job-control-warning.patch</Patch>
-<!--             <Patch level="1">fix-include.patch</Patch> -->
+            <Patch level="1">busybox-1.33.0-CVE-2021-28831.patch</Patch>
             <!--Patch>ifplugd.patch</Patch-->
         </Patches>
     </Source>
@@ -33,6 +33,13 @@
     </Package>
 
     <History>
+        <Update release="8">
+            <Date>2021-03-23</Date>
+            <Version>1.33.0</Version>
+            <Comment>Rebuild.</Comment>
+            <Name>Mustafa Cinasal</Name>
+            <Email>muscnsl@gmail.com</Email>
+        </Update>
         <Update release="7">
             <Date>2020-12-31</Date>
             <Version>1.33.0</Version>