libarchive: fix for CVE-2017-5601

An error in the lha_read_file_header_1() in libarchive 3.2.2 allows
remote attackers to trigger an out-of-bounds read memory access and
subsequently cause a crash via a specially crafted archive.

References:
==========
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5601
https://secuniaresearch.flexerasoftware.com//secunia_research/2017-3

Upstream patch:
https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>

2 files changed, 33 insertions, 0 deletions

diff --git a/recipes-extended/libarchive/libarchive/CVE-2017-5601.patch b/recipes-extended/libarchive/libarchive/CVE-2017-5601.patch
new file mode 100644
index 0000000..a5298f5
--- /dev/null
+++ b/recipes-extended/libarchive/libarchive/CVE-2017-5601.patch
@@ -0,0 +1,28 @@
+From 98dcbbf0bf4854bf987557e55e55fff7abbf3ea9 Mon Sep 17 00:00:00 2001
+From: Martin Matuska <martin@matuska.org>
+Date: Thu, 19 Jan 2017 22:00:18 +0100
+Subject: [PATCH] Fail with negative lha->compsize in lha_read_file_header_1()
+ Fixes a heap buffer overflow reported in Secunia SA74169
+
+CVE: CVE-2017-5601
+Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9.patch]
+
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ libarchive/archive_read_support_format_lha.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c
+index 52a5531b0..d77a7c2e4 100644
+--- a/libarchive/archive_read_support_format_lha.c
++++ b/libarchive/archive_read_support_format_lha.c
+@@ -924,6 +924,9 @@ lha_read_file_header_1(struct archive_read *a, struct lha *lha)
+        /* Get a real compressed file size. */
+        lha->compsize -= extdsize - 2;
+ 
++       if (lha->compsize < 0)
++               goto invalid;   /* Invalid compressed file size */
++
+        if (sum_calculated != headersum) {
+                archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+                    "LHa header sum error");
diff --git a/recipes-extended/libarchive/libarchive_%.bbappend b/recipes-extended/libarchive/libarchive_%.bbappend
new file mode 100644
index 0000000..b57d134
--- /dev/null
+++ b/recipes-extended/libarchive/libarchive_%.bbappend
@@ -0,0 +1,5 @@
+# look for files in the layer first
+FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
+
+SRC_URI += "file://CVE-2017-5601.patch \
+           "