diff options
author | Andrej Valek <andrej.valek@siemens.com> | 2023-03-14 09:48:16 +0100 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2023-03-25 23:00:58 +0000 |
commit | 51a742eab1a8b2f84aee82b8ad77cd5a237c6283 (patch) | |
tree | 715875dc2ef108b9ca6514c4f4cde60d79742858 | |
parent | 11f05ffddd0a7adf05b1c016f73b10ddfa2daa10 (diff) | |
download | poky-51a742eab1a8b2f84aee82b8ad77cd5a237c6283.tar.gz |
libarchive: fix CVE-2022-26280
Backport fix from https://github.com/libarchive/libarchive/issues/1672
(From OE-Core rev: b23482f9ea1cc930a3d5ecfe5fc465e2f720a949)
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-extended/libarchive/libarchive/CVE-2022-26280.patch | 29 | ||||
-rw-r--r-- | meta/recipes-extended/libarchive/libarchive_3.4.2.bb | 1 |
2 files changed, 30 insertions, 0 deletions
diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2022-26280.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2022-26280.patch new file mode 100644 index 0000000000..501fcc5848 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2022-26280.patch | |||
@@ -0,0 +1,29 @@ | |||
1 | From cfaa28168a07ea4a53276b63068f94fce37d6aff Mon Sep 17 00:00:00 2001 | ||
2 | From: Tim Kientzle <kientzle@acm.org> | ||
3 | Date: Thu, 24 Mar 2022 10:35:00 +0100 | ||
4 | Subject: [PATCH] ZIP reader: fix possible out-of-bounds read in | ||
5 | zipx_lzma_alone_init() | ||
6 | |||
7 | Fixes #1672 | ||
8 | |||
9 | CVE: CVE-2022-26280 | ||
10 | Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/cfaa28168a07ea4a53276b63068f94fce37d6aff] | ||
11 | Signed-off-by: Andrej Valek <andrej.valek@siemens.com> | ||
12 | |||
13 | --- | ||
14 | libarchive/archive_read_support_format_zip.c | 2 +- | ||
15 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
16 | |||
17 | diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c | ||
18 | index 38ada70b5..9d6c900b2 100644 | ||
19 | --- a/libarchive/archive_read_support_format_zip.c | ||
20 | +++ b/libarchive/archive_read_support_format_zip.c | ||
21 | @@ -1667,7 +1667,7 @@ zipx_lzma_alone_init(struct archive_read *a, struct zip *zip) | ||
22 | */ | ||
23 | |||
24 | /* Read magic1,magic2,lzma_params from the ZIPX stream. */ | ||
25 | - if((p = __archive_read_ahead(a, 9, NULL)) == NULL) { | ||
26 | + if(zip->entry_bytes_remaining < 9 || (p = __archive_read_ahead(a, 9, NULL)) == NULL) { | ||
27 | archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, | ||
28 | "Truncated lzma data"); | ||
29 | return (ARCHIVE_FATAL); | ||
diff --git a/meta/recipes-extended/libarchive/libarchive_3.4.2.bb b/meta/recipes-extended/libarchive/libarchive_3.4.2.bb index e0a6174d8b..582787d3f3 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.4.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.4.2.bb | |||
@@ -39,6 +39,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ | |||
39 | file://CVE-2021-23177.patch \ | 39 | file://CVE-2021-23177.patch \ |
40 | file://CVE-2021-31566-01.patch \ | 40 | file://CVE-2021-31566-01.patch \ |
41 | file://CVE-2021-31566-02.patch \ | 41 | file://CVE-2021-31566-02.patch \ |
42 | file://CVE-2022-26280.patch \ | ||
42 | file://CVE-2022-36227.patch \ | 43 | file://CVE-2022-36227.patch \ |
43 | " | 44 | " |
44 | 45 | ||