Skip to contentSkip to conversation

GPLv2 tar & cpio recipe fixes

PATCH In review Nitin A Kamble 2 participants 4 messages Apr 26, 2011 – May 6, 2011

lore
Share & tools
lore

Nitin A Kamble

author
#0 lore raw

cover GPLv2 tar & cpio recipe fixes

From: Nitin A Kamble <[email protected]>

Acked by Scott Garman, who is maintainer of GPLv3 tar & cpio recipes.

Pull URL: git://git.pokylinux.org/poky-contrib.git
Branch: nitin/misc
Browse: http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=nitin/misc

Thanks,
Nitin A Kamble <[email protected]>
---

Nitin A Kamble (2):
tar-1.17 (GPLv2) bugfix
cpio-2.8 (GPLv2) bug fix

 .../cpio/cpio-2.8/avoid_heap_overflow.patch        |   25 ++++++++++++++++++++
 meta/recipes-extended/cpio/cpio_2.8.bb             |    6 +++-
 .../tar/tar-1.17/avoid_heap_overflow.patch         |   22 +++++++++++++++++
 meta/recipes-extended/tar/tar_1.17.bb              |    3 +-
 4 files changed, 53 insertions(+), 3 deletions(-)
 create mode 100644 meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch
 create mode 100644 meta/recipes-extended/tar/tar-1.17/avoid_heap_overflow.patch
Signature · 1 line
1.7.2.2
author
#1 lore raw

PATCH 1/2 tar-1.17 (GPLv2) bugfix

From: Nitin A Kamble <[email protected]>

Signed-off-by Nitin A Kamble <[email protected]>
---
 .../tar/tar-1.17/avoid_heap_overflow.patch         |   22 ++++++++++++++++++++
 meta/recipes-extended/tar/tar_1.17.bb              |    3 +-
 2 files changed, 24 insertions(+), 1 deletions(-)
 create mode 100644 meta/recipes-extended/tar/tar-1.17/avoid_heap_overflow.patch
meta/recipes-extended/tar/tar-1.17/avoid_heap_overflow.patch new file +22 -0
new file mode 100644
index 0000000..abfd0ae
@@ -0,0 +1,22 @@
+Upstream-Status="Inappropriate [bugfix: https://wiki.yoctoproject.org/collab/Tar_GPLv3-v2_transfer_info http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0624]"
+
+This patch avoids heap overflow reported by :
+http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0624
+
+This is a clean patch for the GPLv2 tar recipe.
+
+Nitin A Kamble <[email protected]> 2011/04/25
+
+Index: tar-1.17/lib/rtapelib.c
+===================================================================
+--- tar-1.17.orig/lib/rtapelib.c
++++ tar-1.17/lib/rtapelib.c
+@@ -570,7 +570,7 @@ rmt_read__ (int handle, char *buffer, si
+ 
+   sprintf (command_buffer, "R%lu\n", (unsigned long) length);
+   if (do_command (handle, command_buffer) == -1
+-      || (status = get_status (handle)) == SAFE_READ_ERROR)
++      || ((status = get_status (handle)) == SAFE_READ_ERROR) || (status > length))
+     return SAFE_READ_ERROR;
+ 
+   for (counter = 0; counter < status; counter += rlen, buffer += rlen)
meta/recipes-extended/tar/tar_1.17.bb +2 -1
index be74542..138ea71 100644
@@ -3,10 +3,11 @@ require tar.inc
 LICENSE = "GPLv2"
 LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552"
 
-PR = "r0"
+PR = "r1"
 
 SRC_URI += "file://m4extensions.patch \
     file://gcc43build.patch \
+    file://avoid_heap_overflow.patch \
     "
 
 SRC_URI[md5sum] = "c6c4f1c075dbf0f75c29737faa58f290"
Signature · 1 line
1.7.2.2
author
#2 lore raw

PATCH 2/2 cpio-2.8 (GPLv2) bug fix

In reply to Nitin A Kamble

From: Nitin A Kamble <[email protected]>

Signed-off-by Nitin A Kamble <[email protected]>
---
 .../cpio/cpio-2.8/avoid_heap_overflow.patch        |   25 ++++++++++++++++++++
 meta/recipes-extended/cpio/cpio_2.8.bb             |    6 +++-
 2 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch
meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch new file +25 -0
new file mode 100644
index 0000000..71f5675
@@ -0,0 +1,25 @@
+Upstream-Status="Inappropriate [bugfix: https://wiki.yoctoproject.org/collab/Tar_GPLv3-v2_transfer_info http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0624]"
+
+This patch avoids heap overflow reported by :
+http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0624
+
+This is a clean patch for the GPLv2 tar recipe.
+
+the GPLv2 tar recipe patch is also applicable to this GPLv2 cpio 
+recipe, as they share code.
+
+Nitin A Kamble <[email protected]> 2011/04/25
+
+Index: tar-1.17/lib/rtapelib.c
+===================================================================
+--- tar-1.17.orig/lib/rtapelib.c
++++ tar-1.17/lib/rtapelib.c
+@@ -570,7 +570,7 @@ rmt_read__ (int handle, char *buffer, si
+ 
+   sprintf (command_buffer, "R%lu\n", (unsigned long) length);
+   if (do_command (handle, command_buffer) == -1
+-      || (status = get_status (handle)) == SAFE_READ_ERROR)
++      || ((status = get_status (handle)) == SAFE_READ_ERROR) || (status > length))
+     return SAFE_READ_ERROR;
+ 
+   for (counter = 0; counter < status; counter += rlen, buffer += rlen)
meta/recipes-extended/cpio/cpio_2.8.bb +4 -2
index 412d19f..006e4f6 100644
@@ -3,9 +3,11 @@ require cpio_v2.inc
 LICENSE = "GPLv2"
 LIC_FILES_CHKSUM = "file://COPYING;md5=b7f772ea3a2489231cb4872656cac34b"
 
-PR = "r0"
+PR = "r1"
 
-SRC_URI += "file://m4extensions.patch"
+SRC_URI += "file://m4extensions.patch \
+    file://avoid_heap_overflow.patch \
+    "
 
 SRC_URI[md5sum] = "0caa356e69e149fb49b76bacc64615a1"
 SRC_URI[sha256sum] = "1b203248874c3b5a728b351f06513e5282f73e0170b7f207fbf8c39f28f6b4ad"
Signature · 1 line
1.7.2.2
#3 lore raw
In reply to Nitin A Kamble
Quoted 17 lines · Nitin A Kamble

From: Nitin A Kamble<[email protected]>

Acked by Scott Garman, who is maintainer of GPLv3 tar& cpio recipes.

Pull URL: git://git.pokylinux.org/poky-contrib.git
Branch: nitin/misc
Browse: http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=nitin/misc

Thanks,
Nitin A Kamble<[email protected]>
---

Nitin A Kamble (2):

   tar-1.17 (GPLv2) bugfix
   cpio-2.8 (GPLv2) bug fix
Quoted 8 lines
  .../cpio/cpio-2.8/avoid_heap_overflow.patch        |   25 ++++++++++++++++++++
  meta/recipes-extended/cpio/cpio_2.8.bb             |    6 +++-
  .../tar/tar-1.17/avoid_heap_overflow.patch         |   22 +++++++++++++++++
  meta/recipes-extended/tar/tar_1.17.bb              |    3 +-
  4 files changed, 53 insertions(+), 3 deletions(-)

create mode 100644 meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch create mode 100644 meta/recipes-extended/tar/tar-1.17/avoid_heap_overflow.patch

Pulled into Master

Thanks
Sau!