mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
c9659fd9e8
In Buildroot there are multiple way to apply patches on a package [1]
- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.
To make the CycloneDX SBOM generation not dependant on downloading the
packages, the two last options have the downside of not appearing on the
generated SBOM.
The heirloom-mailx package is downloading a tarball from the Debian
mirror with the `<pkg>_PATCH` method [2].
To improve the tracking of the patched vulnerabilities for the
heirloom-mailx package this commit import the patches previously
downloaded with the `_PATCH` variable in the Buildroot tree. This allows
to add the `CVE:` trailer [3] on the patches that fix vulnerabilities to
better track which patch is fixing the vulnerability.
[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] http://snapshot.debian.org/archive/debian/20150815T155609Z/pool/main/h/heirloom-mailx/heirloom-mailx_12.5-5.debian.tar.xz
[3] 1167d0ff3d docs/manual: mention CVE trailer
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
30 lines
840 B
Diff
30 lines
840 B
Diff
From 73fefa0c1ac70043ec84f2d8b8f9f683213f168d Mon Sep 17 00:00:00 2001
|
|
From: Florian Weimer <fweimer@redhat.com>
|
|
Date: Mon, 17 Nov 2014 13:11:32 +0100
|
|
Subject: [PATCH] globname: Invoke wordexp with WRDE_NOCMD (CVE-2004-2771)
|
|
|
|
CVE: CVE-2004-2771
|
|
Upstream: https://sources.debian.org/patches/heirloom-mailx/12.5-4/0014-globname-Invoke-wordexp-with-WRDE_NOCMD.patch/
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
fio.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/fio.c b/fio.c
|
|
index 1529236..774a204 100644
|
|
--- a/fio.c
|
|
+++ b/fio.c
|
|
@@ -497,7 +497,7 @@ globname(char *name)
|
|
sigemptyset(&nset);
|
|
sigaddset(&nset, SIGCHLD);
|
|
sigprocmask(SIG_BLOCK, &nset, NULL);
|
|
- i = wordexp(name, &we, 0);
|
|
+ i = wordexp(name, &we, WRDE_NOCMD);
|
|
sigprocmask(SIG_UNBLOCK, &nset, NULL);
|
|
switch (i) {
|
|
case 0:
|
|
--
|
|
1.9.3
|
|
|
|
|