Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #965 from IdrisKalp/master

Browse Source 
findutils && xz
This commit is contained in:
Idris Kalp
2019-12-11 19:32:06 +03:00
committed by GitHub
parent 1b52a6b6d9 01fd9858f0
commit f9856dbc03
5 changed files with 145 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/findutils/pspec.xml
+1
View File
@@ -16,6 +16,7 @@
<BuildDependencies>
<Dependency>gettext</Dependency>
<Dependency>texinfo</Dependency>
<Dependency versionFrom="2.30">glibc-devel</Dependency>
</BuildDependencies>
<Patches>
<Patch level="1">findutils-fedora-4.4.2-xautofs.patch</Patch>
system/base/xz/actions.py
+1
View File
@@ -15,6 +15,7 @@ def setup():
# Remove RPATH
pisitools.dosed("libtool", "^hardcode_libdir_flag_spec=.*", "hardcode_libdir_flag_spec=\"\"")
pisitools.dosed("libtool", "^runpath_var=LD_RUN_PATH", "runpath_var=DIE_RPATH_DIE")
shelltools.export("LDFLAGS", "-lpthread")
def build():
autotools.make()
system/base/xz/files/0001-liblzma-Avoid-memcpy-NULL-foo-0-because-it-is-undefi.patch
+101
View File
@@ -0,0 +1,101 @@
From 2a22de439ec63da1927b640eda309296a1e8dce5 Mon Sep 17 00:00:00 2001
From: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon, 13 May 2019 20:05:17 +0300
Subject: [PATCH] liblzma: Avoid memcpy(NULL, foo, 0) because it is undefined
behavior.
I should have always known this but I didn't. Here is an example
as a reminder to myself:
int mycopy(void *dest, void *src, size_t n)
{
memcpy(dest, src, n);
return dest == NULL;
}
In the example, a compiler may assume that dest != NULL because
passing NULL to memcpy() would be undefined behavior. Testing
with GCC 8.2.1, mycopy(NULL, NULL, 0) returns 1 with -O0 and -O1.
With -O2 the return value is 0 because the compiler infers that
dest cannot be NULL because it was already used with memcpy()
and thus the test for NULL gets optimized out.
In liblzma, if a null-pointer was passed to memcpy(), there were
no checks for NULL *after* the memcpy() call, so I cautiously
suspect that it shouldn't have caused bad behavior in practice,
but it's hard to be sure, and the problematic cases had to be
fixed anyway.
Thanks to Jeffrey Walton.
---
src/liblzma/common/common.c | 6 +++++-
src/liblzma/lz/lz_decoder.c | 12 +++++++++---
src/liblzma/simple/simple_coder.c | 10 +++++++++-
3 files changed, 23 insertions(+), 5 deletions(-)
diff --git a/src/liblzma/common/common.c b/src/liblzma/common/common.c
index 1399b92..18453ae 100644
--- a/src/liblzma/common/common.c
+++ b/src/liblzma/common/common.c
@@ -99,7 +99,11 @@ lzma_bufcpy(const uint8_t *restrict in, size_t *restrict in_pos,
const size_t out_avail = out_size - *out_pos;
const size_t copy_size = my_min(in_avail, out_avail);
- memcpy(out + *out_pos, in + *in_pos, copy_size);
+ // Call memcpy() only if there is something to copy. If there is
+ // nothing to copy, in or out might be NULL and then the memcpy()
+ // call would trigger undefined behavior.
+ if (copy_size > 0)
+ memcpy(out + *out_pos, in + *in_pos, copy_size);
*in_pos += copy_size;
*out_pos += copy_size;
diff --git a/src/liblzma/lz/lz_decoder.c b/src/liblzma/lz/lz_decoder.c
index bb21d0d..6c9024e 100644
--- a/src/liblzma/lz/lz_decoder.c
+++ b/src/liblzma/lz/lz_decoder.c
@@ -91,11 +91,17 @@ decode_buffer(lzma_coder *coder,
in, in_pos, in_size);
// Copy the decoded data from the dictionary to the out[]
- // buffer.
+ // buffer. Do it conditionally because out can be NULL
+ // (in which case copy_size is always 0). Calling memcpy()
+ // with a null-pointer is undefined even if the third
+ // argument is 0.
const size_t copy_size = coder->dict.pos - dict_start;
assert(copy_size <= out_size - *out_pos);
- memcpy(out + *out_pos, coder->dict.buf + dict_start,
- copy_size);
+
+ if (copy_size > 0)
+ memcpy(out + *out_pos, coder->dict.buf + dict_start,
+ copy_size);
+
*out_pos += copy_size;
// Reset the dictionary if so requested by coder->lz.code().
diff --git a/src/liblzma/simple/simple_coder.c b/src/liblzma/simple/simple_coder.c
index 13ebabc..4f499be 100644
--- a/src/liblzma/simple/simple_coder.c
+++ b/src/liblzma/simple/simple_coder.c
@@ -118,7 +118,15 @@ simple_code(void *coder_ptr, const lzma_allocator *allocator,
// coder->pos and coder->size yet. This way the coder can be
// restarted if the next filter in the chain returns e.g.
// LZMA_MEM_ERROR.
- memcpy(out + *out_pos, coder->buffer + coder->pos, buf_avail);
+ //
+ // Do the memcpy() conditionally because out can be NULL
+ // (in which case buf_avail is always 0). Calling memcpy()
+ // with a null-pointer is undefined even if the third
+ // argument is 0.
+ if (buf_avail > 0)
+ memcpy(out + *out_pos, coder->buffer + coder->pos,
+ buf_avail);
+
*out_pos += buf_avail;
// Copy/Encode/Decode more data to out[].
--
2.23.0
system/base/xz/files/0002-xz-Fix-an-integer-overflow-with-32-bit-off_t.patch
+38
View File
@@ -0,0 +1,38 @@
From 2402f7873dcae719d0ebddd23bb579074519ac52 Mon Sep 17 00:00:00 2001
From: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon, 24 Jun 2019 20:45:49 +0300
Subject: [PATCH] xz: Fix an integer overflow with 32-bit off_t.
Or any off_t which isn't very big (like signed 64 bit integer
that most system have). A small off_t could overflow if the
file being decompressed had long enough run of zero bytes,
which would result in corrupt output.
---
src/xz/file_io.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/xz/file_io.c b/src/xz/file_io.c
index d86b36e..c48df6e 100644
--- a/src/xz/file_io.c
+++ b/src/xz/file_io.c
@@ -1293,8 +1293,15 @@ io_write(file_pair *pair, const io_buf *buf, size_t size)
// if the file ends with sparse block, we must also return
// if size == 0 to avoid doing the lseek().
if (size == IO_BUFFER_SIZE) {
- if (is_sparse(buf)) {
- pair->dest_pending_sparse += size;
+ // Even if the block was sparse, treat it as non-sparse
+ // if the pending sparse amount is large compared to
+ // the size of off_t. In practice this only matters
+ // on 32-bit systems where off_t isn't always 64 bits.
+ const off_t pending_max
+ = (off_t)(1) << (sizeof(off_t) * CHAR_BIT - 2);
+ if (is_sparse(buf) && pair->dest_pending_sparse
+ < pending_max) {
+ pair->dest_pending_sparse += (off_t)(size);
return false;
}
} else if (size == 0) {
--
2.23.0
system/base/xz/pspec.xml
+4
View File
@@ -19,6 +19,10 @@
<BuildDependencies>
<Dependency versionFrom="8.0.1">readline-devel</Dependency>
</BuildDependencies>
<Patches>
<Patch level="1">0002-xz-Fix-an-integer-overflow-with-32-bit-off_t.patch</Patch>
<Patch level="1">0001-liblzma-Avoid-memcpy-NULL-foo-0-because-it-is-undefi.patch</Patch>
</Patches>
</Source>
<Package>