package/unzip: configure with LARGE_FILE_SUPPORT by default
PATCH 1/1 package/unzip: configure with LARGE_FILE_SUPPORT by default
Buildroot always enable largefile support in the toolchains, and thus the associated definitions are always on. This leads to a problem in the unzip that on a 32-bit arch with these flags being passed in
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
But, the LARGE_FILE_SUPPORT not being defined will cause a size mismatch on the comparison of the zipfiles.
$ unzip test.zip
Archive: test.zip
error: invalid zip file with overlapped components (possible zip bomb)Simple solution is just enable LARGE_FILE_SUPPORT in cmake to get an expected extraction.
--- package/unzip/unzip.mk | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
package/unzip/unzip.mk +14 -0
@@ -28,4 +28,18 @@ UNZIP_IGNORE_CVES = \ CVE-2022-0529 \ CVE-2022-0530 +# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when +# necessary, redefining it on the command line causes some warnings. +UNZIP_TARGET_CFLAGS = \ + $(filter-out -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE,$(TARGET_CFLAGS)) + +# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when +# necessary, redefining it on the command line causes some warnings. +UNZIP_TARGET_CXXFLAGS = \ + $(filter-out -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE,$(TARGET_CXXFLAGS)) + +UNZIP_CONF_OPTS += \ + -DCMAKE_C_FLAGS="$(UNZIP_TARGET_CFLAGS) -DLARGE_FILE_SUPPORT" \ + -DCMAKE_CXX_FLAGS="$(UNZIP_TARGET_CXXFLAGS) -DLARGE_FILE_SUPPORT" + $(eval $(cmake-package))
Signature · 6 lines
2.39.2 (Apple Git-143) _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hello Charles,
Quoted 10 lines · On Tue, 20 Jun 2023 10:23:05 -0700 Charles Hardin <[email protected]> wrote:
Buildroot always enable largefile support in the toolchains, and thus the associated definitions are always on. This leads to a problem in the unzip that on a 32-bit arch with these flags being passed in
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
But, the
LARGE_FILE_SUPPORTnot being defined will cause a size mismatch on the comparison of the zipfiles.
Quoted 8 lines
$ unzip test.zip Archive: test.zip error: invalid zip file with overlapped components (possible zip bomb)Simple solution is just enable
LARGE_FILE_SUPPORTin cmake to get an expected extraction.Signed-off-by Charles Hardin <[email protected]>
I verified that the problem exists using qemu_arm_versatile_defconfig and that extraction works after applying the patch.
Thanks for the fix!
However I have a note, see below.
Quoted 9 lines
--- package/unzip/unzip.mk | 14 ++++++++++++++ 1 file changed, 14 insertions(+)package/unzip/unzip.mk +0
-0
package/unzip/unzip.mk UNZIP_IGNORE_CVES = \ · line 32
Quoted 5 lines
package/unzip/unzip.mk +2
-0@@ -28,4 +28,18 @@ UNZIP_IGNORE_CVES = \ CVE-2022-0529 \ CVE-2022-0530 +# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when +# necessary, redefining it on the command line causes some warnings.
"causes some warnings" -> "causes extraction errors"?
package/unzip/unzip.mk UNZIP_IGNORE_CVES = \ · line 37
Quoted 5 lines
package/unzip/unzip.mk +5
-0+UNZIP_TARGET_CFLAGS = \ + $(filter-out -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE,$(TARGET_CFLAGS)) + +# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when +# necessary, redefining it on the command line causes some warnings.
As above.
Luca
Signature · 7 lines
Luca Ceresoli, Bootlin Embedded Linux and Kernel engineering https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hello Luca,
Quoted 4 lines · On Mon, 26 Jun 2023 13:17:14 +0200 Luca Ceresoli via buildroot…
Review
Quoted 2 lines
(quoted diff) +2
-0+# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when +# necessary, redefining it on the command line causes some warnings."causes some warnings" -> "causes extraction errors"?
Actually no, the comment was correct. What causes the extraction error is the large of -DLARGE_FILE_SUPPORT (which is a unzip specific thing).
The thing is that when -DLARGE_FILE_SUPPORT is passed, the unzip build system defines on its own _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE, which causes a redefinition warning by gcc. So undefining _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE does not solve the extraction
error: it only avoids the redefinition warning from gcc.
Best regards,
Thomas
Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hello Thomas, Charles,
Quoted 10 lines · On Mon, 10 Jul 2023 22:01:54 +0200 Thomas Petazzoni…
Hello Luca,
Quoted 4 lines · On Mon, 26 Jun 2023 13:17:14 +0200 Luca Ceresoli via buildroot…
Review
Quoted 2 lines
(quoted diff) +2
-0+# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when +# necessary, redefining it on the command line causes some warnings."causes some warnings" -> "causes extraction errors"?
Quoted 8 lines
Actually no, the comment was correct. What causes the extraction error is the large of -DLARGE_FILE_SUPPORT (which is a unzip specific thing).
The thing is that when -DLARGE_FILE_SUPPORT is passed, the unzip build system defines on its own
_LARGEFILE_SOURCEand_LARGEFILE64_SOURCE, which causes a redefinition warning by gcc. So undefining_LARGEFILE_SOURCEand_LARGEFILE64_SOURCEdoes not solve the extraction
error: it only avoids the redefinition warning from gcc.
Indeed! Thanks for clarifying.
Luca
Signature · 7 lines
Luca Ceresoli, Bootlin Embedded Linux and Kernel engineering https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 14 lines · On Tue, 20 Jun 2023 10:23:05 -0700 Charles Hardin <[email protected]> wrote:
Buildroot always enable largefile support in the toolchains, and thus the associated definitions are always on. This leads to a problem in the unzip that on a 32-bit arch with these flags being passed in
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
But, the
LARGE_FILE_SUPPORTnot being defined will cause a size mismatch on the comparison of the zipfiles.$ unzip test.zip Archive: test.zip error: invalid zip file with overlapped components (possible zip bomb)
Quoted 7 lines
Simple solution is just enable
LARGE_FILE_SUPPORTin cmake to get an expected extraction.Signed-off-by Charles Hardin <[email protected]>--- package/unzip/unzip.mk | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
I slightly improved the commit log and applied. Thanks!
Thomas
Signature · 7 lines
Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 12 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Charles" == Charles Hardin <[email protected]> writes:
Buildroot always enable largefile support in the toolchains, and thus the associated definitions are always on. This leads to a problem in the unzip that on a 32-bit arch with these flags being passed in
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
But, the
LARGE_FILE_SUPPORTnot being defined will cause a size mismatch on the comparison of the zipfiles.
Quoted 8 lines
$ unzip test.zip Archive: test.zip error: invalid zip file with overlapped components (possible zip bomb)Simple solution is just enable
LARGE_FILE_SUPPORTin cmake to get an expected extraction.Signed-off-by Charles Hardin <[email protected]>
Committed to 2023.02.x and 2023.05.x, thanks.
Signature · 5 lines
Bye, Peter Korsgaard _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot