mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
fb8958e3dc
In Buildroot there are multiple way to apply patches on a package [1]
- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.
To make the CycloneDX SBOM generation not dependant on downloading the
packages, the two last options have the downside of not appearing on the
generated SBOM.
The unzip package is downloading a tarball from the Debian mirror with
the `<pkg>_PATCH` method [2].
To improve the tracking of the patched vulnerabilities for the unzip
package this commit import the patches previously downloaded with the
`_PATCH` variable in the Buildroot tree.
This allows to add the `CVE:` trailer [3] on the patches that fix
vulnerabilities to better track which patch is fixing the vulnerability.
[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] https://snapshot.debian.org/archive/debian/20250311T215724Z/pool/main/u/unzip/unzip_6.0-29.debian.tar.xz
[3] 1167d0ff3d docs/manual: mention CVE trailer
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
141 lines
5.0 KiB
Diff
141 lines
5.0 KiB
Diff
From: "Steven M. Schweda" <sms@antinode.info>
|
|
Subject: Fix CVE-2014-8141: out-of-bounds read issues in getZip64Data()
|
|
Bug-Debian: https://bugs.debian.org/773722
|
|
CVE: CVE-2014-8141
|
|
Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/11-cve-2014-8141-getzip64data.patch
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
|
|
--- a/fileio.c
|
|
+++ b/fileio.c
|
|
@@ -176,6 +176,8 @@
|
|
#endif
|
|
static ZCONST char Far ExtraFieldTooLong[] =
|
|
"warning: extra field too long (%d). Ignoring...\n";
|
|
+static ZCONST char Far ExtraFieldCorrupt[] =
|
|
+ "warning: extra field (type: 0x%04x) corrupt. Continuing...\n";
|
|
|
|
#ifdef WINDLL
|
|
static ZCONST char Far DiskFullQuery[] =
|
|
@@ -2295,7 +2297,12 @@
|
|
if (readbuf(__G__ (char *)G.extra_field, length) == 0)
|
|
return PK_EOF;
|
|
/* Looks like here is where extra fields are read */
|
|
- getZip64Data(__G__ G.extra_field, length);
|
|
+ if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
|
|
+ {
|
|
+ Info(slide, 0x401, ((char *)slide,
|
|
+ LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
|
|
+ error = PK_WARN;
|
|
+ }
|
|
#ifdef UNICODE_SUPPORT
|
|
G.unipath_filename = NULL;
|
|
if (G.UzO.U_flag < 2) {
|
|
--- a/process.c
|
|
+++ b/process.c
|
|
@@ -1,5 +1,5 @@
|
|
/*
|
|
- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
|
|
+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
|
|
|
|
See the accompanying file LICENSE, version 2009-Jan-02 or later
|
|
(the contents of which are also included in unzip.h) for terms of use.
|
|
@@ -1901,48 +1901,82 @@
|
|
and a 4-byte version of disk start number.
|
|
Sets both local header and central header fields. Not terribly clever,
|
|
but it means that this procedure is only called in one place.
|
|
+
|
|
+ 2014-12-05 SMS.
|
|
+ Added checks to ensure that enough data are available before calling
|
|
+ makeint64() or makelong(). Replaced various sizeof() values with
|
|
+ simple ("4" or "8") constants. (The Zip64 structures do not depend
|
|
+ on our variable sizes.) Error handling is crude, but we should now
|
|
+ stay within the buffer.
|
|
---------------------------------------------------------------------------*/
|
|
|
|
+#define Z64FLGS 0xffff
|
|
+#define Z64FLGL 0xffffffff
|
|
+
|
|
if (ef_len == 0 || ef_buf == NULL)
|
|
return PK_COOL;
|
|
|
|
Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
|
|
ef_len));
|
|
|
|
- while (ef_len >= EB_HEADSIZE) {
|
|
+ while (ef_len >= EB_HEADSIZE)
|
|
+ {
|
|
eb_id = makeword(EB_ID + ef_buf);
|
|
eb_len = makeword(EB_LEN + ef_buf);
|
|
|
|
- if (eb_len > (ef_len - EB_HEADSIZE)) {
|
|
- /* discovered some extra field inconsistency! */
|
|
+ if (eb_len > (ef_len - EB_HEADSIZE))
|
|
+ {
|
|
+ /* Extra block length exceeds remaining extra field length. */
|
|
Trace((stderr,
|
|
"getZip64Data: block length %u > rest ef_size %u\n", eb_len,
|
|
ef_len - EB_HEADSIZE));
|
|
break;
|
|
}
|
|
- if (eb_id == EF_PKSZ64) {
|
|
-
|
|
+ if (eb_id == EF_PKSZ64)
|
|
+ {
|
|
int offset = EB_HEADSIZE;
|
|
|
|
- if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
|
|
- G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
|
|
- offset += sizeof(G.crec.ucsize);
|
|
+ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
|
|
+ {
|
|
+ if (offset+ 8 > ef_len)
|
|
+ return PK_ERR;
|
|
+
|
|
+ G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
|
|
+ offset += 8;
|
|
}
|
|
- if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
|
|
- G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
|
|
- offset += sizeof(G.crec.csize);
|
|
+
|
|
+ if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
|
|
+ {
|
|
+ if (offset+ 8 > ef_len)
|
|
+ return PK_ERR;
|
|
+
|
|
+ G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
|
|
+ offset += 8;
|
|
}
|
|
- if (G.crec.relative_offset_local_header == 0xffffffff){
|
|
+
|
|
+ if (G.crec.relative_offset_local_header == Z64FLGL)
|
|
+ {
|
|
+ if (offset+ 8 > ef_len)
|
|
+ return PK_ERR;
|
|
+
|
|
G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
|
|
- offset += sizeof(G.crec.relative_offset_local_header);
|
|
+ offset += 8;
|
|
}
|
|
- if (G.crec.disk_number_start == 0xffff){
|
|
+
|
|
+ if (G.crec.disk_number_start == Z64FLGS)
|
|
+ {
|
|
+ if (offset+ 4 > ef_len)
|
|
+ return PK_ERR;
|
|
+
|
|
G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
|
|
- offset += sizeof(G.crec.disk_number_start);
|
|
+ offset += 4;
|
|
}
|
|
+#if 0
|
|
+ break; /* Expect only one EF_PKSZ64 block. */
|
|
+#endif /* 0 */
|
|
}
|
|
|
|
- /* Skip this extra field block */
|
|
+ /* Skip this extra field block. */
|
|
ef_buf += (eb_len + EB_HEADSIZE);
|
|
ef_len -= (eb_len + EB_HEADSIZE);
|
|
}
|