summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4024.patch
diff options
context:
space:
mode:
authorSaul Wold <sgw@linux.intel.com>2014-07-15 13:24:45 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2014-07-17 12:28:51 +0100
commit774c339afee606096ecb67ba487989d5cf2031db (patch)
tree0cf9c10614ca01bc155c9b9b33e4fcc53b62c3de /meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4024.patch
parent5effba27882bc35df24d2e1b5d9c8b0daecf8467 (diff)
downloadpoky-774c339afee606096ecb67ba487989d5cf2031db.tar.gz
squashfs-tools: Upgrade to 4.3
Remove patches that are now implemented upstream COPYING file has formating change no change to licence itself (From OE-Core rev: 518d6b32aa9d84e572ccd6d04368f4c5bdb222ec) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4024.patch')
-rw-r--r--meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4024.patch72
1 files changed, 0 insertions, 72 deletions
diff --git a/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4024.patch b/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4024.patch
deleted file mode 100644
index 8b9904fd56..0000000000
--- a/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4024.patch
+++ /dev/null
@@ -1,72 +0,0 @@
1Upstream-Status: Backport
2
3Reference:http://squashfs.git.sourceforge.net/git/gitweb.cgi?p=
4squashfs/squashfs;a=commit;h=19c38fba0be1ce949ab44310d7f49887576cc123
5
6Fix potential stack overflow in get_component() where an individual
7pathname component in an extract file (specified on the command line
8or in an extract file) could exceed the 1024 byte sized targname
9allocated on the stack.
10
11Fix by dynamically allocating targname rather than storing it as
12a fixed size on the stack.
13
14Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
15diff -urpN a/unsquashfs.c b/unsquashfs.c
16--- a/unsquashfs.c 2012-11-29 17:04:08.000000000 +0800
17+++ b/unsquashfs.c 2012-11-29 17:04:25.000000000 +0800
18@@ -1034,15 +1034,18 @@ void squashfs_closedir(struct dir *dir)
19 }
20
21
22-char *get_component(char *target, char *targname)
23+char *get_component(char *target, char **targname)
24 {
25+ char *start;
26+
27 while(*target == '/')
28 target ++;
29
30+ start = target;
31 while(*target != '/' && *target!= '\0')
32- *targname ++ = *target ++;
33+ target ++;
34
35- *targname = '\0';
36+ *targname = strndup(start, target - start);
37
38 return target;
39 }
40@@ -1068,12 +1071,12 @@ void free_path(struct pathname *paths)
41
42 struct pathname *add_path(struct pathname *paths, char *target, char *alltarget)
43 {
44- char targname[1024];
45+ char *targname;
46 int i, error;
47
48 TRACE("add_path: adding \"%s\" extract file\n", target);
49
50- target = get_component(target, targname);
51+ target = get_component(target, &targname);
52
53 if(paths == NULL) {
54 paths = malloc(sizeof(struct pathname));
55@@ -1097,7 +1100,7 @@ struct pathname *add_path(struct pathnam
56 sizeof(struct path_entry));
57 if(paths->name == NULL)
58 EXIT_UNSQUASH("Out of memory in add_path\n");
59- paths->name[i].name = strdup(targname);
60+ paths->name[i].name = targname;
61 paths->name[i].paths = NULL;
62 if(use_regex) {
63 paths->name[i].preg = malloc(sizeof(regex_t));
64@@ -1130,6 +1133,8 @@ struct pathname *add_path(struct pathnam
65 /*
66 * existing matching entry
67 */
68+ free(targname);
69+
70 if(paths->name[i].paths == NULL) {
71 /*
72 * No sub-directory which means this is the leaf