mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 08:30:47 -09:00
76db7e8a10
In Buildroot there are multiple way to apply patches on a package [1] - Adding `.patch` file in the package directory. - Define `<pkg>_PATCH` variable with the location of the patch tar.gz. It used to download Debian patches tarball. - Implement custom patching logic with `PRE`/`POST` patches hooks. To make the CycloneDX SBOM generation not dependant on downloading the packages, the two last options have the downside of not appearing on the generated SBOM. The unzip package is downloading a tarball from the Debian mirror with the `<pkg>_PATCH` method [2]. To improve the tracking of the patched vulnerabilities for the unzip package this commit import the patches previously downloaded with the `_PATCH` variable in the Buildroot tree. This allows to add the `CVE:` trailer [3] on the patches that fix vulnerabilities to better track which patch is fixing the vulnerability. [1] https://buildroot.org/downloads/manual/manual.html#patch-policy [2] https://snapshot.debian.org/archive/debian/20250311T215724Z/pool/main/u/unzip/unzip_6.0-29.debian.tar.xz [3]1167d0ff3ddocs/manual: mention CVE trailer Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> (cherry picked from commitfb8958e3dc) Signed-off-by: Thomas Perale <thomas.perale@mind.be>
35 lines
1.4 KiB
Diff
35 lines
1.4 KiB
Diff
From: Kamil Dudka <kdudka@redhat.com>
|
|
Date: Tue, 22 Sep 2015 18:52:23 +0200
|
|
Subject: [PATCH] extract: prevent unsigned overflow on invalid input
|
|
Origin: other, https://bugzilla.redhat.com/attachment.cgi?id=1075942
|
|
Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1260944
|
|
|
|
Suggested-by: Stefan Cornelius
|
|
Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
extract.c | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
--- a/extract.c
|
|
+++ b/extract.c
|
|
@@ -1257,8 +1257,17 @@
|
|
if (G.lrec.compression_method == STORED) {
|
|
zusz_t csiz_decrypted = G.lrec.csize;
|
|
|
|
- if (G.pInfo->encrypted)
|
|
+ if (G.pInfo->encrypted) {
|
|
+ if (csiz_decrypted < 12) {
|
|
+ /* handle the error now to prevent unsigned overflow */
|
|
+ Info(slide, 0x401, ((char *)slide,
|
|
+ LoadFarStringSmall(ErrUnzipNoFile),
|
|
+ LoadFarString(InvalidComprData),
|
|
+ LoadFarStringSmall2(Inflate)));
|
|
+ return PK_ERR;
|
|
+ }
|
|
csiz_decrypted -= 12;
|
|
+ }
|
|
if (G.lrec.ucsize != csiz_decrypted) {
|
|
Info(slide, 0x401, ((char *)slide,
|
|
LoadFarStringSmall2(WrnStorUCSizCSizDiff),
|