diff --git a/system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch b/system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch new file mode 100644 index 00000000..326489a5 --- /dev/null +++ b/system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch @@ -0,0 +1,47 @@ +https://sources.debian.org/patches/cpio/2.13%2Bdfsg-7.1/revert-CVE-2015-1197-handling.patch/ +https://bugs.gentoo.org/700020 + +From: Chris Lamb +Date: Sat, 1 Feb 2020 13:36:37 +0100 +Subject: Fix a regression in handling of CVE-2015-1197 & + --no-absolute-filenames. + +See: + + * https://bugs.debian.org/946267 + * https://bugs.debian.org/946469 + +This reverts (most of): https://git.savannah.gnu.org/cgit/cpio.git/diff/?id=45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca&id2=3177d660a4c62a6acb538b0f7c54ba423698889a +--- a/src/copyin.c ++++ b/src/copyin.c +@@ -646,8 +646,6 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des) + link_name = xstrdup (file_hdr->c_tar_linkname); + } + +- cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false); +- + res = UMASKED_SYMLINK (link_name, file_hdr->c_name, + file_hdr->c_mode); + if (res < 0 && create_dir_flag) +--- a/tests/testsuite ++++ b/tests/testsuite +@@ -2787,7 +2787,7 @@ read at_status <"$at_status_file" + #AT_START_14 + at_fn_group_banner 14 'CVE-2015-1197.at:17' \ + "CVE-2015-1197 (--no-absolute-filenames for symlinks)" "" +-at_xfail=no ++at_xfail=yes + ( + $as_echo "14. $at_setup_line: testing $at_desc ..." + $at_traceon + +--- a/tests/CVE-2015-1197.at ++++ b/tests/CVE-2015-1197.at +@@ -15,6 +15,7 @@ + # along with this program. If not, see . + + AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)]) ++AT_XFAIL_IF([true]) + AT_CHECK([ + tempdir=$(pwd)/tmp + mkdir $tempdir diff --git a/system/base/cpio/files/cpio-2.9-exitCode.patch b/system/base/cpio/files/cpio-2.9-exitCode.patch index 4a05ecfb..8c300a51 100644 --- a/system/base/cpio/files/cpio-2.9-exitCode.patch +++ b/system/base/cpio/files/cpio-2.9-exitCode.patch @@ -1,11 +1,39 @@ ---- cpio-2.9/src/copyout.c.exitCode 2007-06-28 10:54:43.000000000 +0200 -+++ cpio-2.9/src/copyout.c 2007-07-16 16:23:05.000000000 +0200 -@@ -297,7 +297,7 @@ to_ascii (char *where, uintmax_t v, size - static void - field_width_error (const char *filename, const char *fieldname) +Subject: [PATCH 2/7] set exit code to 1 when cpio fails to store file > 4GB + (#183224) + +diff --git a/src/copyout.c b/src/copyout.c +index fa999bd..6e82f4c 100644 +--- a/src/copyout.c ++++ b/src/copyout.c +@@ -287,7 +287,7 @@ field_width_error (const char *filename, const char *fieldname, { -- error (0, 0, _("%s: field width not sufficient for storing %s"), -+ error (1, 0, _("%s: field width not sufficient for storing %s"), - filename, fieldname); - } - + char valbuf[UINTMAX_STRSIZE_BOUND + 1]; + char maxbuf[UINTMAX_STRSIZE_BOUND + 1]; +- error (0, 0, _("%s: value %s %s out of allowed range 0..%s"), ++ error (1, 0, _("%s: value %s %s out of allowed range 0..%s"), + filename, fieldname, + STRINGIFY_BIGINT (value, valbuf), + STRINGIFY_BIGINT (MAX_VAL_WITH_DIGITS (width - nul, LG_8), +diff --git a/tests/CVE-2019-14866.at b/tests/CVE-2019-14866.at +index 530365a..5a4e15c 100644 +--- a/tests/CVE-2019-14866.at ++++ b/tests/CVE-2019-14866.at +@@ -30,6 +30,5 @@ fi + [0], + [], + [cpio: file: value size 17179869184 out of allowed range 0..8589934591 +-2 blocks + ]) + AT_CLEANUP +diff --git a/tests/testsuite b/tests/testsuite +index 10531d1..d69dad9 100755 +--- a/tests/testsuite ++++ b/tests/testsuite +@@ -2927,7 +2927,6 @@ fi + at_status=$? at_failed=false + $at_check_filter + echo >>"$at_stderr"; printf "%s\n" "cpio: file: value size 17179869184 out of allowed range 0..8589934591 +-2 blocks + " | \ + $at_diff - "$at_stderr" || at_failed=: + at_fn_diff_devnull "$at_stdout" || at_failed=: diff --git a/system/base/cpio/files/gentoo/cpio-2.12-non-gnu-compilers.patch b/system/base/cpio/files/gentoo/cpio-2.12-non-gnu-compilers.patch new file mode 100644 index 00000000..c7fc7f95 --- /dev/null +++ b/system/base/cpio/files/gentoo/cpio-2.12-non-gnu-compilers.patch @@ -0,0 +1,11 @@ +--- cpio-2.12/src/cpiohdr.h ++++ cpio-2.12/src/cpiohdr.h +@@ -25,6 +25,8 @@ + + # ifdef HAVE_ATTRIB_PACKED + # define ATTRIB_PACKED __attribute__((packed)) ++# else ++# define ATTRIB_PACKED + # endif + + # ifdef HAVE_PRAGMA_PACK diff --git a/system/base/cpio/files/gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch b/system/base/cpio/files/gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch new file mode 100644 index 00000000..87d7ec94 --- /dev/null +++ b/system/base/cpio/files/gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch @@ -0,0 +1,36 @@ +https://sources.debian.org/patches/cpio/2.13%2Bdfsg-7.1/revert-CVE-2015-1197-handling.patch/ +https://bugs.gentoo.org/700020 + +From: Chris Lamb +Date: Sat, 1 Feb 2020 13:36:37 +0100 +Subject: Fix a regression in handling of CVE-2015-1197 & + --no-absolute-filenames. + +See: + + * https://bugs.debian.org/946267 + * https://bugs.debian.org/946469 + +This reverts (most of): https://git.savannah.gnu.org/cgit/cpio.git/diff/?id=45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca&id2=3177d660a4c62a6acb538b0f7c54ba423698889a +--- a/tests/testsuite ++++ b/tests/testsuite +@@ -2787,7 +2787,7 @@ read at_status <"$at_status_file" + #AT_START_14 + at_fn_group_banner 14 'CVE-2015-1197.at:17' \ + "CVE-2015-1197 (--no-absolute-filenames for symlinks)" "" +-at_xfail=no ++at_xfail=yes + ( + $as_echo "14. $at_setup_line: testing $at_desc ..." + $at_traceon + +--- a/tests/CVE-2015-1197.at ++++ b/tests/CVE-2015-1197.at +@@ -15,6 +15,7 @@ + # along with this program. If not, see . + + AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)]) ++AT_XFAIL_IF([true]) + AT_CHECK([ + tempdir=$(pwd)/tmp + mkdir $tempdir diff --git a/system/base/cpio/pspec.xml b/system/base/cpio/pspec.xml index b2e72f83..54131977 100644 --- a/system/base/cpio/pspec.xml +++ b/system/base/cpio/pspec.xml @@ -12,20 +12,13 @@ app:console A file archival tool which can also read and write tar files GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. GNU cpio supports the following archive formats: binary, old ASCII, new ASCII, crc, HPUX binary, HPUX old ASCII, old tar, and POSIX.1 tar. - mirrors://gnu/cpio/cpio-2.12.tar.bz2 + mirrors://gnu/cpio/cpio-2.15.tar.bz2 texinfo - - cpio-2.9-exitCode.patch - CVE-2010-0624-rpatelib-overflow.patch - cpio-2.12-name-overflow.patch - cpio-2.12-non-gnu-compilers.patch - cpio-2.12-no-overwrite-symlinks.patch - cpio-2.12-svr4compat.patch - CVE-2010-0624-rpatelib-overflow.patch - cpio-2.12-gcc-10.patch + gentoo/cpio-2.12-non-gnu-compilers.patch + gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch --> @@ -41,6 +34,13 @@ + + 2024-01-15 + 2.15 + Version bump. + Mustafa Cinasal + muscnsl@gmail.com + 2020-12-09 2.12