squashfs: fix CVE-2012-4025

CQID:WIND00366813

Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi?
p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e

Integer overflow in the queue_init function in unsquashfs.c in
unsquashfs in Squashfs 4.2 and earlier allows remote attackers
to execute arbitrary code via a crafted block_log field in the
superblock of a .sqsh file, leading to a heap-based buffer overflow.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025

(From OE-Core rev: bb1611d4830bb7aff2371afdb2a77a4ca7298c7d)

Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>

[YOCTO #3564]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 38 insertions, 0 deletions

diff --git a/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch
new file mode 100644
index 0000000000..fa075f9e7d
--- /dev/null
+++ b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch
@@ -0,0 +1,38 @@
+Upstream-Status: Backport
+
+unsquashfs: add a commment and fix some other comments
+
+Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> 
+
+diff -urpN a/unsquashfs.c b/unsquashfs.c
+--- a/unsquashfs.c      2012-11-30 15:27:14.000000000 +0800
++++ b/unsquashfs.c      2012-11-30 15:27:56.000000000 +0800
+@@ -814,7 +814,7 @@ int write_file(struct inode *inode, char
+ 
+        /*
+         * the writer thread is queued a squashfs_file structure describing the
+-        * file.  If the file has one or more blocks or a fragments they are
++        * file.  If the file has one or more blocks or a fragment they are
+         * queued separately (references to blocks in the cache).
+         */
+        file->fd = file_fd;
+@@ -838,7 +838,7 @@ int write_file(struct inode *inode, char
+                block->offset = 0;
+                block->size = i == file_end ? inode->data & (block_size - 1) :
+                        block_size;
+-               if(block_list[i] == 0) /* sparse file */
++               if(block_list[i] == 0) /* sparse block */
+                        block->buffer = NULL;
+                else {
+                        block->buffer = cache_get(data_cache, start,
+@@ -2161,6 +2161,10 @@ options:
+        block_size = sBlk.s.block_size;
+        block_log = sBlk.s.block_log;
+ 
++       /*
++        * convert from queue size in Mbytes to queue size in
++        * blocks
++        */
+        fragment_buffer_size <<= 20 - block_log;
+        data_buffer_size <<= 20 - block_log;
+        initialise_threads(fragment_buffer_size, data_buffer_size);