cpio: fix bug CVE-2014-9112 for cpio-2.8

Obtain detain from following URL. http://lists.gnu.org/archive/html/bug-cpio/2014-12/msg00000.html http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d (From OE-Core rev: 732fc8de55a9c7987608162879959c03423de907) Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
author: Bian Naimeng <biannm@cn.fujitsu.com> 2014-12-08 13:45:06 +0800
committer: Richard Purdie <richard.purdie@linuxfoundation.org> 2014-12-11 11:34:56 +0000
commit: 8018f6167b7343373fe53c6d2bc53c569228b3cb (patch)
tree: 7c35bec63d470a5b6c0b5df8c10579da4c669272
parent: adb8c0d6555c788c547e46d8126a5783364edee1 (diff)
download: poky-8018f6167b7343373fe53c6d2bc53c569228b3cb.tar.gz
2 files changed, 221 insertions, 3 deletions
diff --git a/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch b/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch
new file mode 100644
index 0000000000..0148e70797
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch
@@ -0,0 +1,217 @@
+cpio: Fix memory overrun on reading improperly created link records
+Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
+http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d
+  * src/copyin.c (get_link_name): New function.
+  (list_file, copyin_link): use get_link_name
+  * tests/symlink-bad-length.at: New file.
+  * tests/symlink-long.at: New file.
+  * tests/Makefile.am: Add new files.
+  * tests/testsuite.at: Likewise.
+  See http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
+Upstream-Status: Backport
+Signed-off-by: Sergey Poznyakoff <gray@gnu.org.ua>
+diff -Nurp cpio-2.8.orig/src/copyin.c cpio-2.8/src/copyin.c
+--- cpio-2.8.orig/src/copyin.c  2007-06-07 19:58:03.000000000 +0800
+++ cpio-2.8/src/copyin.c       2014-12-08 11:30:01.159791484 +0800
+@@ -126,6 +126,28 @@ tape_skip_padding (int in_file_des, int
+ }
+ 
+ 
+static char *
+get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
+{
+  off_t n = file_hdr->c_filesize + 1;
+  char *link_name;
+
+  if (n == 0 || n > SIZE_MAX)
+    {
+      error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
+      link_name = NULL;
+    }
+  else
+    {
+      link_name = xmalloc (n);
+      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
+      link_name[file_hdr->c_filesize] = '\0';
+      tape_skip_padding (in_file_des, file_hdr->c_filesize);
+    }
+  return link_name;
+}
+
+
+ static void
+ list_file(struct cpio_file_stat* file_hdr, int in_file_des)
+ {
+@@ -136,21 +158,16 @@ list_file(struct cpio_file_stat* file_hd
+        {
+          if (archive_format != arf_tar && archive_format != arf_ustar)
+            {
+-             char *link_name = NULL;   /* Name of hard and symbolic links.  */
+-
+-             link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
+-             link_name[file_hdr->c_filesize] = '\0';
+-             tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
+-             long_format (file_hdr, link_name);
+-             free (link_name);
+-             tape_skip_padding (in_file_des, file_hdr->c_filesize);
+-             return;
+             char *link_name = get_link_name (file_hdr, in_file_des);
+             if (link_name)
+               {
+                 long_format (file_hdr, link_name);
+                 free (link_name);
+               }
+            }
+          else
+-           {
+              long_format (file_hdr, file_hdr->c_tar_linkname);
+-             return;
+-           }
+         return;
+        }
+       else
+ #endif
+@@ -732,10 +749,7 @@ copyin_link(struct cpio_file_stat *file_
+ 
+   if (archive_format != arf_tar && archive_format != arf_ustar)
+     {
+-      link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
+-      link_name[file_hdr->c_filesize] = '\0';
+-      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
+-      tape_skip_padding (in_file_des, file_hdr->c_filesize);
+      link_name = get_link_name (file_hdr, in_file_des);
+     }
+   else
+     {
+diff -Nurp cpio-2.8.orig/tests/Makefile.am cpio-2.8/tests/Makefile.am
+--- cpio-2.8.orig/tests/Makefile.am     2006-10-24 18:32:13.000000000 +0800
+++ cpio-2.8/tests/Makefile.am  2014-12-08 11:30:52.387789482 +0800
+@@ -45,6 +45,8 @@ TESTSUITE_AT = \
+  testsuite.at\
+  inout.at\
+  symlink.at\
+ symlink-bad-length.at\
+ symlink-long.at\
+  version.at
+ 
+ TESTSUITE = $(srcdir)/testsuite
+diff -Nurp cpio-2.8.orig/tests/symlink-bad-length.at cpio-2.8/tests/symlink-bad-length.at
+--- cpio-2.8.orig/tests/symlink-bad-length.at   1970-01-01 08:00:00.000000000 +0800
+++ cpio-2.8/tests/symlink-bad-length.at        2014-12-08 11:33:25.283783507 +0800
+@@ -0,0 +1,49 @@
+# Process this file with autom4te to create testsuite.  -*- Autotest -*-
+# Copyright (C) 2014 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3, or (at your option)
+# any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301 USA.
+
+# Cpio v2.11 did segfault with badly set symlink length.
+# References:
+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
+
+AT_SETUP([symlink-bad-length])
+AT_KEYWORDS([symlink-long copyout])
+
+AT_DATA([ARCHIVE.base64],
+[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
+JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
+UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+])
+
+AT_CHECK([
+base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
+cpio -ntv < ARCHIVE
+test $? -eq 2
+],
+[0],
+[-rw-rw-r--   1 10029    10031          13 Nov 25 13:52 FILE
+],[cpio: LINK: stored filename length too big
+cpio: premature end of file
+])
+
+AT_CLEANUP
+diff -Nurp cpio-2.8.orig/tests/symlink-long.at cpio-2.8/tests/symlink-long.at
+--- cpio-2.8.orig/tests/symlink-long.at 1970-01-01 08:00:00.000000000 +0800
+++ cpio-2.8/tests/symlink-long.at      2014-12-08 11:34:28.807781024 +0800
+@@ -0,0 +1,46 @@
+# Process this file with autom4te to create testsuite.  -*- Autotest -*-
+# Copyright (C) 2014 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3, or (at your option)
+# any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301 USA.
+
+# Cpio v2.11.90 changed the way symlink name is read from archive.
+# References:
+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
+
+AT_SETUP([symlink-long])
+AT_KEYWORDS([symlink-long copyout])
+
+AT_CHECK([
+
+# len(dirname) > READBUFSIZE
+dirname=
+for i in {1..52}; do
+    dirname="xxxxxxxxx/$dirname"
+    mkdir "$dirname"
+done
+ln -s "$dirname" x || AT_SKIP_TEST
+
+echo x | cpio -o > ar
+list=`cpio -tv < ar | sed 's|.*-> ||'`
+test "$list" = "$dirname" && echo success || echo fail
+],
+[0],
+[success
+],[2 blocks
+2 blocks
+])
+
+AT_CLEANUP
+diff -Nurp cpio-2.8.orig/tests/testsuite.at cpio-2.8/tests/testsuite.at
+--- cpio-2.8.orig/tests/testsuite.at    2006-10-24 18:32:13.000000000 +0800
+++ cpio-2.8/tests/testsuite.at 2014-12-08 11:34:56.515779942 +0800
+@@ -31,3 +31,5 @@ m4_include([version.at])
+ 
+ m4_include([inout.at])
+ m4_include([symlink.at])
+m4_include([symlink-bad-length.at])
+m4_include([symlink-long.at])
diff --git a/meta/recipes-extended/cpio/cpio_2.8.bb b/meta/recipes-extended/cpio/cpio_2.8.bb
index b6da207b92..3f97dbe2ce 100644
--- a/meta/recipes-extended/cpio/cpio_2.8.bb
+++ b/meta/recipes-extended/cpio/cpio_2.8.bb
@@ -3,11 +3,12 @@ require cpio_v2.inc
 LICENSE = "GPLv2"
 LIC_FILES_CHKSUM = "file://COPYING;md5=b7f772ea3a2489231cb4872656cac34b"
-PR = "r3"
+PR = "r4"
 SRC_URI += "file://m4extensions.patch \
-    file://avoid_heap_overflow.patch \
+            file://avoid_heap_overflow.patch \
-    "
+            file://fix-memory-overrun.patch \
+           "
 SRC_URI[md5sum] = "0caa356e69e149fb49b76bacc64615a1"
 SRC_URI[sha256sum] = "1b203248874c3b5a728b351f06513e5282f73e0170b7f207fbf8c39f28f6b4ad"
author	Bian Naimeng <biannm@cn.fujitsu.com>	2014-12-08 13:45:06 +0800
committer	Richard Purdie <richard.purdie@linuxfoundation.org>	2014-12-11 11:34:56 +0000
commit	8018f6167b7343373fe53c6d2bc53c569228b3cb (patch)
tree	7c35bec63d470a5b6c0b5df8c10579da4c669272
parent	adb8c0d6555c788c547e46d8126a5783364edee1 (diff)
download	poky-8018f6167b7343373fe53c6d2bc53c569228b3cb.tar.gz

diff --git a/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch b/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch new file mode 100644 index 0000000000..0148e70797 --- /dev/null +++ b/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch
@@ -0,0 +1,217 @@
		1	cpio: Fix memory overrun on reading improperly created link records
		2
		3	Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
		4
		5	http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d
		6
		7	* src/copyin.c (get_link_name): New function.
		8	(list_file, copyin_link): use get_link_name
		9
		10	* tests/symlink-bad-length.at: New file.
		11	* tests/symlink-long.at: New file.
		12	* tests/Makefile.am: Add new files.
		13	* tests/testsuite.at: Likewise.
		14
		15	See http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
		16
		17	Upstream-Status: Backport
		18
		19	Signed-off-by: Sergey Poznyakoff <gray@gnu.org.ua>
		20
		21	diff -Nurp cpio-2.8.orig/src/copyin.c cpio-2.8/src/copyin.c
		22	--- cpio-2.8.orig/src/copyin.c 2007-06-07 19:58:03.000000000 +0800
		23	+++ cpio-2.8/src/copyin.c 2014-12-08 11:30:01.159791484 +0800
		24	@@ -126,6 +126,28 @@ tape_skip_padding (int in_file_des, int
		25	}
		26
		27
		28	+static char *
		29	+get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
		30	+{
		31	+ off_t n = file_hdr->c_filesize + 1;
		32	+ char *link_name;
		33	+
		34	+ if (n == 0 \|\| n > SIZE_MAX)
		35	+ {
		36	+ error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
		37	+ link_name = NULL;
		38	+ }
		39	+ else
		40	+ {
		41	+ link_name = xmalloc (n);
		42	+ tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
		43	+ link_name[file_hdr->c_filesize] = '\0';
		44	+ tape_skip_padding (in_file_des, file_hdr->c_filesize);
		45	+ }
		46	+ return link_name;
		47	+}
		48	+
		49	+
		50	static void
		51	list_file(struct cpio_file_stat* file_hdr, int in_file_des)
		52	{
		53	@@ -136,21 +158,16 @@ list_file(struct cpio_file_stat* file_hd
		54	{
		55	if (archive_format != arf_tar && archive_format != arf_ustar)
		56	{
		57	- char link_name = NULL; / Name of hard and symbolic links. */
		58	-
		59	- link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
		60	- link_name[file_hdr->c_filesize] = '\0';
		61	- tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
		62	- long_format (file_hdr, link_name);
		63	- free (link_name);
		64	- tape_skip_padding (in_file_des, file_hdr->c_filesize);
		65	- return;
		66	+ char *link_name = get_link_name (file_hdr, in_file_des);
		67	+ if (link_name)
		68	+ {
		69	+ long_format (file_hdr, link_name);
		70	+ free (link_name);
		71	+ }
		72	}
		73	else
		74	- {
		75	long_format (file_hdr, file_hdr->c_tar_linkname);
		76	- return;
		77	- }
		78	+ return;
		79	}
		80	else
		81	#endif
		82	@@ -732,10 +749,7 @@ copyin_link(struct cpio_file_stat *file_
		83
		84	if (archive_format != arf_tar && archive_format != arf_ustar)
		85	{
		86	- link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
		87	- link_name[file_hdr->c_filesize] = '\0';
		88	- tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
		89	- tape_skip_padding (in_file_des, file_hdr->c_filesize);
		90	+ link_name = get_link_name (file_hdr, in_file_des);
		91	}
		92	else
		93	{
		94	diff -Nurp cpio-2.8.orig/tests/Makefile.am cpio-2.8/tests/Makefile.am
		95	--- cpio-2.8.orig/tests/Makefile.am 2006-10-24 18:32:13.000000000 +0800
		96	+++ cpio-2.8/tests/Makefile.am 2014-12-08 11:30:52.387789482 +0800
		97	@@ -45,6 +45,8 @@ TESTSUITE_AT = \
		98	testsuite.at\
		99	inout.at\
		100	symlink.at\
		101	+ symlink-bad-length.at\
		102	+ symlink-long.at\
		103	version.at
		104
		105	TESTSUITE = $(srcdir)/testsuite
		106	diff -Nurp cpio-2.8.orig/tests/symlink-bad-length.at cpio-2.8/tests/symlink-bad-length.at
		107	--- cpio-2.8.orig/tests/symlink-bad-length.at 1970-01-01 08:00:00.000000000 +0800
		108	+++ cpio-2.8/tests/symlink-bad-length.at 2014-12-08 11:33:25.283783507 +0800
		109	@@ -0,0 +1,49 @@
		110	+# Process this file with autom4te to create testsuite. -- Autotest --
		111	+# Copyright (C) 2014 Free Software Foundation, Inc.
		112	+
		113	+# This program is free software; you can redistribute it and/or modify
		114	+# it under the terms of the GNU General Public License as published by
		115	+# the Free Software Foundation; either version 3, or (at your option)
		116	+# any later version.
		117	+
		118	+# This program is distributed in the hope that it will be useful,
		119	+# but WITHOUT ANY WARRANTY; without even the implied warranty of
		120	+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		121	+# GNU General Public License for more details.
		122	+
		123	+# You should have received a copy of the GNU General Public License
		124	+# along with this program; if not, write to the Free Software
		125	+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
		126	+# 02110-1301 USA.
		127	+
		128	+# Cpio v2.11 did segfault with badly set symlink length.
		129	+# References:
		130	+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
		131	+
		132	+AT_SETUP([symlink-bad-length])
		133	+AT_KEYWORDS([symlink-long copyout])
		134	+
		135	+AT_DATA([ARCHIVE.base64],
		136	+[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
		137	+JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
		138	+UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		139	+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		140	+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		141	+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		142	+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		143	+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		144	+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
		145	+])
		146	+
		147	+AT_CHECK([
		148	+base64 -d ARCHIVE.base64 > ARCHIVE \|\| AT_SKIP_TEST
		149	+cpio -ntv < ARCHIVE
		150	+test $? -eq 2
		151	+],
		152	+[0],
		153	+[-rw-rw-r-- 1 10029 10031 13 Nov 25 13:52 FILE
		154	+],[cpio: LINK: stored filename length too big
		155	+cpio: premature end of file
		156	+])
		157	+
		158	+AT_CLEANUP
		159	diff -Nurp cpio-2.8.orig/tests/symlink-long.at cpio-2.8/tests/symlink-long.at
		160	--- cpio-2.8.orig/tests/symlink-long.at 1970-01-01 08:00:00.000000000 +0800
		161	+++ cpio-2.8/tests/symlink-long.at 2014-12-08 11:34:28.807781024 +0800
		162	@@ -0,0 +1,46 @@
		163	+# Process this file with autom4te to create testsuite. -- Autotest --
		164	+# Copyright (C) 2014 Free Software Foundation, Inc.
		165	+
		166	+# This program is free software; you can redistribute it and/or modify
		167	+# it under the terms of the GNU General Public License as published by
		168	+# the Free Software Foundation; either version 3, or (at your option)
		169	+# any later version.
		170	+
		171	+# This program is distributed in the hope that it will be useful,
		172	+# but WITHOUT ANY WARRANTY; without even the implied warranty of
		173	+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		174	+# GNU General Public License for more details.
		175	+
		176	+# You should have received a copy of the GNU General Public License
		177	+# along with this program; if not, write to the Free Software
		178	+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
		179	+# 02110-1301 USA.
		180	+
		181	+# Cpio v2.11.90 changed the way symlink name is read from archive.
		182	+# References:
		183	+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
		184	+
		185	+AT_SETUP([symlink-long])
		186	+AT_KEYWORDS([symlink-long copyout])
		187	+
		188	+AT_CHECK([
		189	+
		190	+# len(dirname) > READBUFSIZE
		191	+dirname=
		192	+for i in {1..52}; do
		193	+ dirname="xxxxxxxxx/$dirname"
		194	+ mkdir "$dirname"
		195	+done
		196	+ln -s "$dirname" x \|\| AT_SKIP_TEST
		197	+
		198	+echo x \| cpio -o > ar
		199	+list=`cpio -tv < ar \| sed 's\|.*-> \|\|'`
		200	+test "$list" = "$dirname" && echo success \|\| echo fail
		201	+],
		202	+[0],
		203	+[success
		204	+],[2 blocks
		205	+2 blocks
		206	+])
		207	+
		208	+AT_CLEANUP
		209	diff -Nurp cpio-2.8.orig/tests/testsuite.at cpio-2.8/tests/testsuite.at
		210	--- cpio-2.8.orig/tests/testsuite.at 2006-10-24 18:32:13.000000000 +0800
		211	+++ cpio-2.8/tests/testsuite.at 2014-12-08 11:34:56.515779942 +0800
		212	@@ -31,3 +31,5 @@ m4_include([version.at])
		213
		214	m4_include([inout.at])
		215	m4_include([symlink.at])
		216	+m4_include([symlink-bad-length.at])
		217	+m4_include([symlink-long.at])


diff --git a/meta/recipes-extended/cpio/cpio_2.8.bb b/meta/recipes-extended/cpio/cpio_2.8.bb index b6da207b92..3f97dbe2ce 100644 --- a/meta/recipes-extended/cpio/cpio_2.8.bb +++ b/meta/recipes-extended/cpio/cpio_2.8.bb
@@ -3,11 +3,12 @@ require cpio_v2.inc
3	LICENSE = "GPLv2"	3	LICENSE = "GPLv2"
4	LIC_FILES_CHKSUM = "file://COPYING;md5=b7f772ea3a2489231cb4872656cac34b"	4	LIC_FILES_CHKSUM = "file://COPYING;md5=b7f772ea3a2489231cb4872656cac34b"
5		5
6	PR = "r3"	6	PR = "r4"
7		7
8	SRC_URI += "file://m4extensions.patch \	8	SRC_URI += "file://m4extensions.patch \
9	file://avoid_heap_overflow.patch \	9	file://avoid_heap_overflow.patch \
10	"	10	file://fix-memory-overrun.patch \
		11	"
11		12
12	SRC_URI[md5sum] = "0caa356e69e149fb49b76bacc64615a1"	13	SRC_URI[md5sum] = "0caa356e69e149fb49b76bacc64615a1"
13	SRC_URI[sha256sum] = "1b203248874c3b5a728b351f06513e5282f73e0170b7f207fbf8c39f28f6b4ad"	14	SRC_URI[sha256sum] = "1b203248874c3b5a728b351f06513e5282f73e0170b7f207fbf8c39f28f6b4ad"