summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch
diff options
context:
space:
mode:
authorMartin Jansa <martin.jansa@gmail.com>2015-05-21 13:23:15 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-07-16 20:45:25 +0100
commitb9ec9f7425cd11fada2ba104122b0f1ea823ae28 (patch)
tree337f9dde5d4cc29f2c69004a16e2991a06a706cf /meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch
parent9e4aad97c3b4395edeb9dc44bfad1092cdf30a47 (diff)
downloadpoky-b9ec9f7425cd11fada2ba104122b0f1ea823ae28.tar.gz
squashfs-tools: enable building unsquashfs and fix squashfs-4.2-fix-CVE-2012-4025.patch
* build unsqaushfs, useful when debuging corrupt squashfs from mksquashfs * squashfs-4.2-fix-CVE-2012-4025.patch fixes CVE in unsquashfs which we weren't building and it actually breaks building it, because someone missed squashfs_fs.h change from the original change * add git headers in all patches and fix references to new github repository (From OE-Core rev: e1a2540227250d854d5bba278634bcc9e7572cda) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch')
-rw-r--r--meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch40
1 files changed, 33 insertions, 7 deletions
diff --git a/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch b/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch
index 0dabfba663..a5cdecf95b 100644
--- a/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch
+++ b/meta/recipes-devtools/squashfs-tools/squashfs-tools/squashfs-4.2-fix-CVE-2012-4025.patch
@@ -1,7 +1,11 @@
1From fef997df2a1d6609af55e30eb67b65c786588fcb Mon Sep 17 00:00:00 2001
2From: "yanjun.zhu" <yanjun.zhu@windriver.com>
3Date: Wed, 20 May 2015 18:18:47 +0200
4Subject: [PATCH 4/4] Fix CVE-2012-4025
5
1Upstream-Status: Backport 6Upstream-Status: Backport
2 7
3Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi? 8Reference: https://github.com/plougher/squashfs-tools/commit/8515b3d420f502c5c0236b86e2d6d7e3b23c190e
4p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e
5 9
6Integer overflow in the queue_init function in unsquashfs.c in 10Integer overflow in the queue_init function in unsquashfs.c in
7unsquashfs in Squashfs 4.2 and earlier allows remote attackers 11unsquashfs in Squashfs 4.2 and earlier allows remote attackers
@@ -10,10 +14,29 @@ superblock of a .sqsh file, leading to a heap-based buffer overflow.
10 14
11http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025 15http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025
12 16
13Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> 17Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
18Signed-off-by: Martin Jansa <martin.jansa@lge.com>
19---
20 squashfs-tools/squashfs_fs.h | 1 +
21 squashfs-tools/unsquashfs.c | 110 +++++++++++++++++++++++++++++++++++++++----
22 2 files changed, 103 insertions(+), 8 deletions(-)
14 23
15--- a/unsquashfs.c 2012-11-30 17:57:57.000000000 +0800 24diff --git a/squashfs_fs.h b/squashfs_fs.h
16+++ b/unsquashfs.c 2012-11-30 17:58:09.000000000 +0800 25index d4fba1b..6227be2 100644
26--- a/squashfs_fs.h
27+++ b/squashfs_fs.h
28@@ -39,6 +39,7 @@
29 #define SQUASHFS_FILE_LOG 17
30
31 #define SQUASHFS_FILE_MAX_SIZE 1048576
32+#define SQUASHFS_FILE_MAX_LOG 20
33
34 /* Max number of uids and gids */
35 #define SQUASHFS_IDS 65536
36diff --git a/unsquashfs.c b/unsquashfs.c
37index 4fc04e8..078d6ca 100644
38--- a/unsquashfs.c
39+++ b/unsquashfs.c
17@@ -33,6 +33,7 @@ 40@@ -33,6 +33,7 @@
18 #include <sys/types.h> 41 #include <sys/types.h>
19 #include <sys/time.h> 42 #include <sys/time.h>
@@ -58,7 +81,7 @@ Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
58 queue->data = malloc(sizeof(void *) * (size + 1)); 81 queue->data = malloc(sizeof(void *) * (size + 1));
59 if(queue->data == NULL) 82 if(queue->data == NULL)
60 EXIT_UNSQUASH("Out of memory in queue_init\n"); 83 EXIT_UNSQUASH("Out of memory in queue_init\n");
61@@ -1948,13 +1971,30 @@ void initialise_threads(int fragment_buf 84@@ -1948,13 +1971,30 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size)
62 * allocate to_reader, to_deflate and to_writer queues. Set based on 85 * allocate to_reader, to_deflate and to_writer queues. Set based on
63 * open file limit and cache size, unless open file limit is unlimited, 86 * open file limit and cache size, unless open file limit is unlimited,
64 * in which case set purely based on cache limits 87 * in which case set purely based on cache limits
@@ -90,7 +113,7 @@ Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
90 113
91 to_reader = queue_init(all_buffers_size); 114 to_reader = queue_init(all_buffers_size);
92 to_deflate = queue_init(all_buffers_size); 115 to_deflate = queue_init(all_buffers_size);
93@@ -2059,6 +2099,32 @@ void progress_bar(long long current, lon 116@@ -2059,6 +2099,32 @@ void progress_bar(long long current, long long max, int columns)
94 } 117 }
95 118
96 119
@@ -188,3 +211,6 @@ Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
188 initialise_threads(fragment_buffer_size, data_buffer_size); 211 initialise_threads(fragment_buffer_size, data_buffer_size);
189 212
190 fragment_data = malloc(block_size); 213 fragment_data = malloc(block_size);
214--
2152.1.4
216