summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnuj Mittal <anuj.mittal@intel.com>2019-07-30 19:00:11 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-09-30 16:44:41 +0100
commit70fa47b5e0ce12fba2ec92d7aaaf15ea4e6d49af (patch)
tree68e24095494b3ccda9fb8b5ce6c8956c403f160d
parentf691e4104f1c09246676e83351aa1dd3431c5793 (diff)
downloadpoky-70fa47b5e0ce12fba2ec92d7aaaf15ea4e6d49af.tar.gz
patch: fix CVE-2019-13636
(From OE-Core rev: 78193d3037c5ce7333b344e651c78e6e2e5ca371) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/patch/patch/CVE-2019-13636.patch113
-rw-r--r--meta/recipes-devtools/patch/patch_2.7.6.bb1
2 files changed, 114 insertions, 0 deletions
diff --git a/meta/recipes-devtools/patch/patch/CVE-2019-13636.patch b/meta/recipes-devtools/patch/patch/CVE-2019-13636.patch
new file mode 100644
index 0000000000..9f8b6db0b9
--- /dev/null
+++ b/meta/recipes-devtools/patch/patch/CVE-2019-13636.patch
@@ -0,0 +1,113 @@
1From dce4683cbbe107a95f1f0d45fabc304acfb5d71a Mon Sep 17 00:00:00 2001
2From: Andreas Gruenbacher <agruen@gnu.org>
3Date: Mon, 15 Jul 2019 16:21:48 +0200
4Subject: Don't follow symlinks unless --follow-symlinks is given
5
6* src/inp.c (plan_a, plan_b), src/util.c (copy_to_fd, copy_file,
7append_to_file): Unless the --follow-symlinks option is given, open files with
8the O_NOFOLLOW flag to avoid following symlinks. So far, we were only doing
9that consistently for input files.
10* src/util.c (create_backup): When creating empty backup files, (re)create them
11with O_CREAT | O_EXCL to avoid following symlinks in that case as well.
12
13CVE: CVE-2019-13636
14Upstream-Status: Backport[https://git.savannah.gnu.org/cgit/patch.git/patch/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a]
15Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
16
17---
18 src/inp.c | 12 ++++++++++--
19 src/util.c | 14 +++++++++++---
20 2 files changed, 21 insertions(+), 5 deletions(-)
21
22diff --git a/src/inp.c b/src/inp.c
23index 32d0919..22d7473 100644
24--- a/src/inp.c
25+++ b/src/inp.c
26@@ -238,8 +238,13 @@ plan_a (char const *filename)
27 {
28 if (S_ISREG (instat.st_mode))
29 {
30- int ifd = safe_open (filename, O_RDONLY|binary_transput, 0);
31+ int flags = O_RDONLY | binary_transput;
32 size_t buffered = 0, n;
33+ int ifd;
34+
35+ if (! follow_symlinks)
36+ flags |= O_NOFOLLOW;
37+ ifd = safe_open (filename, flags, 0);
38 if (ifd < 0)
39 pfatal ("can't open file %s", quotearg (filename));
40
41@@ -340,6 +345,7 @@ plan_a (char const *filename)
42 static void
43 plan_b (char const *filename)
44 {
45+ int flags = O_RDONLY | binary_transput;
46 int ifd;
47 FILE *ifp;
48 int c;
49@@ -353,7 +359,9 @@ plan_b (char const *filename)
50
51 if (instat.st_size == 0)
52 filename = NULL_DEVICE;
53- if ((ifd = safe_open (filename, O_RDONLY | binary_transput, 0)) < 0
54+ if (! follow_symlinks)
55+ flags |= O_NOFOLLOW;
56+ if ((ifd = safe_open (filename, flags, 0)) < 0
57 || ! (ifp = fdopen (ifd, binary_transput ? "rb" : "r")))
58 pfatal ("Can't open file %s", quotearg (filename));
59 if (TMPINNAME_needs_removal)
60diff --git a/src/util.c b/src/util.c
61index 1cc08ba..fb38307 100644
62--- a/src/util.c
63+++ b/src/util.c
64@@ -388,7 +388,7 @@ create_backup (char const *to, const struct stat *to_st, bool leave_original)
65
66 try_makedirs_errno = ENOENT;
67 safe_unlink (bakname);
68- while ((fd = safe_open (bakname, O_CREAT | O_WRONLY | O_TRUNC, 0666)) < 0)
69+ while ((fd = safe_open (bakname, O_CREAT | O_EXCL | O_WRONLY | O_TRUNC, 0666)) < 0)
70 {
71 if (errno != try_makedirs_errno)
72 pfatal ("Can't create file %s", quotearg (bakname));
73@@ -579,10 +579,13 @@ create_file (char const *file, int open_flags, mode_t mode,
74 static void
75 copy_to_fd (const char *from, int tofd)
76 {
77+ int from_flags = O_RDONLY | O_BINARY;
78 int fromfd;
79 ssize_t i;
80
81- if ((fromfd = safe_open (from, O_RDONLY | O_BINARY, 0)) < 0)
82+ if (! follow_symlinks)
83+ from_flags |= O_NOFOLLOW;
84+ if ((fromfd = safe_open (from, from_flags, 0)) < 0)
85 pfatal ("Can't reopen file %s", quotearg (from));
86 while ((i = read (fromfd, buf, bufsize)) != 0)
87 {
88@@ -625,6 +628,8 @@ copy_file (char const *from, char const *to, struct stat *tost,
89 else
90 {
91 assert (S_ISREG (mode));
92+ if (! follow_symlinks)
93+ to_flags |= O_NOFOLLOW;
94 tofd = create_file (to, O_WRONLY | O_BINARY | to_flags, mode,
95 to_dir_known_to_exist);
96 copy_to_fd (from, tofd);
97@@ -640,9 +645,12 @@ copy_file (char const *from, char const *to, struct stat *tost,
98 void
99 append_to_file (char const *from, char const *to)
100 {
101+ int to_flags = O_WRONLY | O_APPEND | O_BINARY;
102 int tofd;
103
104- if ((tofd = safe_open (to, O_WRONLY | O_BINARY | O_APPEND, 0)) < 0)
105+ if (! follow_symlinks)
106+ to_flags |= O_NOFOLLOW;
107+ if ((tofd = safe_open (to, to_flags, 0)) < 0)
108 pfatal ("Can't reopen file %s", quotearg (to));
109 copy_to_fd (from, tofd);
110 if (close (tofd) != 0)
111--
112cgit v1.0-41-gc330
113
diff --git a/meta/recipes-devtools/patch/patch_2.7.6.bb b/meta/recipes-devtools/patch/patch_2.7.6.bb
index 85b0db7333..8cf20a3597 100644
--- a/meta/recipes-devtools/patch/patch_2.7.6.bb
+++ b/meta/recipes-devtools/patch/patch_2.7.6.bb
@@ -6,6 +6,7 @@ SRC_URI += "file://0001-Unset-need_charset_alias-when-building-for-musl.patch \
6 file://0003-Allow-input-files-to-be-missing-for-ed-style-patches.patch \ 6 file://0003-Allow-input-files-to-be-missing-for-ed-style-patches.patch \
7 file://0004-Fix-arbitrary-command-execution-in-ed-style-patches-.patch \ 7 file://0004-Fix-arbitrary-command-execution-in-ed-style-patches-.patch \
8 file://0001-Fix-swapping-fake-lines-in-pch_swap.patch \ 8 file://0001-Fix-swapping-fake-lines-in-pch_swap.patch \
9 file://CVE-2019-13636.patch \
9" 10"
10 11
11SRC_URI[md5sum] = "4c68cee989d83c87b00a3860bcd05600" 12SRC_URI[md5sum] = "4c68cee989d83c87b00a3860bcd05600"