diff options
author | yanjun.zhu <yanjun.zhu@windriver.com> | 2012-12-11 18:00:32 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2013-02-14 15:19:52 +0000 |
commit | 54dd30e514412198734e8ddf56fca98f078e4fc1 (patch) | |
tree | 694276392c93e48679ee1c945dcef4c2f12a56eb /meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch | |
parent | 19f39c5d069a556c9b1c9af82cd9edd92772c0c5 (diff) | |
download | poky-54dd30e514412198734e8ddf56fca98f078e4fc1.tar.gz |
squashfs: fix CVE-2012-4025
CQID:WIND00366813
Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi?
p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e
Integer overflow in the queue_init function in unsquashfs.c in
unsquashfs in Squashfs 4.2 and earlier allows remote attackers
to execute arbitrary code via a crafted block_log field in the
superblock of a .sqsh file, leading to a heap-based buffer overflow.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025
(From OE-Core rev: 4493173c1ab7a0528e0c74935a105e474521ed1c)
Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
[YOCTO #3564]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch')
-rw-r--r-- | meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch new file mode 100644 index 0000000000..fa075f9e7d --- /dev/null +++ b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch | |||
@@ -0,0 +1,38 @@ | |||
1 | Upstream-Status: Backport | ||
2 | |||
3 | unsquashfs: add a commment and fix some other comments | ||
4 | |||
5 | Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> | ||
6 | |||
7 | diff -urpN a/unsquashfs.c b/unsquashfs.c | ||
8 | --- a/unsquashfs.c 2012-11-30 15:27:14.000000000 +0800 | ||
9 | +++ b/unsquashfs.c 2012-11-30 15:27:56.000000000 +0800 | ||
10 | @@ -814,7 +814,7 @@ int write_file(struct inode *inode, char | ||
11 | |||
12 | /* | ||
13 | * the writer thread is queued a squashfs_file structure describing the | ||
14 | - * file. If the file has one or more blocks or a fragments they are | ||
15 | + * file. If the file has one or more blocks or a fragment they are | ||
16 | * queued separately (references to blocks in the cache). | ||
17 | */ | ||
18 | file->fd = file_fd; | ||
19 | @@ -838,7 +838,7 @@ int write_file(struct inode *inode, char | ||
20 | block->offset = 0; | ||
21 | block->size = i == file_end ? inode->data & (block_size - 1) : | ||
22 | block_size; | ||
23 | - if(block_list[i] == 0) /* sparse file */ | ||
24 | + if(block_list[i] == 0) /* sparse block */ | ||
25 | block->buffer = NULL; | ||
26 | else { | ||
27 | block->buffer = cache_get(data_cache, start, | ||
28 | @@ -2161,6 +2161,10 @@ options: | ||
29 | block_size = sBlk.s.block_size; | ||
30 | block_log = sBlk.s.block_log; | ||
31 | |||
32 | + /* | ||
33 | + * convert from queue size in Mbytes to queue size in | ||
34 | + * blocks | ||
35 | + */ | ||
36 | fragment_buffer_size <<= 20 - block_log; | ||
37 | data_buffer_size <<= 20 - block_log; | ||
38 | initialise_threads(fragment_buffer_size, data_buffer_size); | ||