diff options
author | Changqing Li <changqing.li@windriver.com> | 2019-12-27 16:08:05 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2019-12-30 08:47:12 +0000 |
commit | 2d4b6820c19a286eab020173e58052b1483c863e (patch) | |
tree | fa15ce3388763e709d73b7403b5688dca263548c /meta/recipes-extended/cpio | |
parent | 61f8a68e4e443fffd1c9eedd7f8100939fb14dd9 (diff) | |
download | poky-2d4b6820c19a286eab020173e58052b1483c863e.tar.gz |
cpio: remove unused CVE patch
According to the home page, https://www.gnu.org/software/cpio/,
CVE-2015-1197 have been fix in version 2.13, so removed
this patch get from SUSE
(From OE-Core rev: 6e37b0cba0d59e020ed031659aa050ce4e7c4ccd)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-extended/cpio')
-rw-r--r-- | meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch | 178 | ||||
-rw-r--r-- | meta/recipes-extended/cpio/cpio_2.13.bb | 1 |
2 files changed, 0 insertions, 179 deletions
diff --git a/meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch b/meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch deleted file mode 100644 index 5c999197ff..0000000000 --- a/meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch +++ /dev/null | |||
@@ -1,178 +0,0 @@ | |||
1 | From dcee489f821c1260a0136fcdfdb6ff4dd11086ac Mon Sep 17 00:00:00 2001 | ||
2 | From: Alexander Kanavin <alex.kanavin@gmail.com> | ||
3 | Date: Wed, 9 Dec 2015 17:58:03 +0200 | ||
4 | Subject: [PATCH] Fix CVE-2015-1197 | ||
5 | |||
6 | Apply patch by Vitezslav Cizek of SuSE to fix CVE-2015-1197. | ||
7 | Upstream is dormant or no longer existing. To restore the old | ||
8 | behaviour use --extract-over-symlinks (Closes: #774669) | ||
9 | This issue has been discovered by Alexander Cherepanov. | ||
10 | Author: Vitezslav Cizek <vcizek@suse.cz> | ||
11 | Bug-Debian: https://bugs.debian.org/774669 | ||
12 | |||
13 | Upstream-Status: Pending | ||
14 | CVE: CVE-2015-1197 | ||
15 | Signed-off-by: Robert Yang <liezhi.yang@windriver.com> | ||
16 | Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> | ||
17 | |||
18 | --- | ||
19 | doc/cpio.1 | 1 + | ||
20 | src/copyin.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
21 | src/extern.h | 1 + | ||
22 | src/global.c | 3 +++ | ||
23 | src/main.c | 7 +++++++ | ||
24 | 5 files changed, 74 insertions(+) | ||
25 | |||
26 | diff --git a/doc/cpio.1 b/doc/cpio.1 | ||
27 | index 2a68241..dc4676c 100644 | ||
28 | --- a/doc/cpio.1 | ||
29 | +++ b/doc/cpio.1 | ||
30 | @@ -49,6 +49,7 @@ cpio \- copy files to and from archives | ||
31 | [\fB\-\-no\-preserve\-owner\fR] [\fB\-\-message=\fIMESSAGE\fR] | ||
32 | [\fB\-\-force\-local\fR] [\fB\-\-no\-absolute\-filenames\fR] [\fB\-\-sparse\fR] | ||
33 | [\fB\-\-only\-verify\-crc\fR] [\fB\-\-to\-stdout\fR] [\fB\-\-quiet\fR] | ||
34 | +[\fB\-\-extract\-over\-symlinks\fR] | ||
35 | [\fB\-\-rsh\-command=\fICOMMAND\fR] | ||
36 | [\fIpattern\fR...] [\fB<\fR \fIarchive\fR] | ||
37 | |||
38 | diff --git a/src/copyin.c b/src/copyin.c | ||
39 | index cde911e..053afe7 100644 | ||
40 | --- a/src/copyin.c | ||
41 | +++ b/src/copyin.c | ||
42 | @@ -695,6 +695,51 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des) | ||
43 | free (link_name); | ||
44 | } | ||
45 | |||
46 | + | ||
47 | +static int | ||
48 | +path_contains_symlink(char *path) | ||
49 | +{ | ||
50 | + struct stat st; | ||
51 | + char *slash; | ||
52 | + char *nextslash; | ||
53 | + | ||
54 | + /* we got NULL pointer or empty string */ | ||
55 | + if (!path || !*path) { | ||
56 | + return false; | ||
57 | + } | ||
58 | + | ||
59 | + slash = path; | ||
60 | + | ||
61 | + while ((nextslash = strchr(slash + 1, '/')) != NULL) { | ||
62 | + slash = nextslash; | ||
63 | + *slash = '\0'; | ||
64 | + | ||
65 | + if (lstat(path, &st) != 0) { | ||
66 | + if (errno == ELOOP) { | ||
67 | + /* ELOOP - too many symlinks */ | ||
68 | + *slash = '/'; | ||
69 | + return true; | ||
70 | + } else if (errno == ENOMEM) { | ||
71 | + /* No memory for lstat - terminate */ | ||
72 | + xalloc_die(); | ||
73 | + } else { | ||
74 | + /* cannot lstat path - give up */ | ||
75 | + *slash = '/'; | ||
76 | + return false; | ||
77 | + } | ||
78 | + } | ||
79 | + | ||
80 | + if (S_ISLNK(st.st_mode)) { | ||
81 | + *slash = '/'; | ||
82 | + return true; | ||
83 | + } | ||
84 | + | ||
85 | + *slash = '/'; | ||
86 | + } | ||
87 | + | ||
88 | + return false; | ||
89 | +} | ||
90 | + | ||
91 | static void | ||
92 | copyin_file (struct cpio_file_stat *file_hdr, int in_file_des) | ||
93 | { | ||
94 | @@ -1468,6 +1513,23 @@ process_copy_in () | ||
95 | { | ||
96 | /* Copy the input file into the directory structure. */ | ||
97 | |||
98 | + /* Can we write files over symlinks? */ | ||
99 | + if (!extract_over_symlinks) | ||
100 | + { | ||
101 | + if (path_contains_symlink(file_hdr.c_name)) | ||
102 | + { | ||
103 | + /* skip the file */ | ||
104 | + /* | ||
105 | + fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name); | ||
106 | + tape_toss_input (in_file_des, file_hdr.c_filesize); | ||
107 | + tape_skip_padding (in_file_des, file_hdr.c_filesize); | ||
108 | + continue; | ||
109 | + */ | ||
110 | + /* terminate */ | ||
111 | + error (1, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name); | ||
112 | + } | ||
113 | + } | ||
114 | + | ||
115 | /* Do we need to rename the file? */ | ||
116 | if (rename_flag || rename_batch_file) | ||
117 | { | ||
118 | diff --git a/src/extern.h b/src/extern.h | ||
119 | index e27d662..d864bde 100644 | ||
120 | --- a/src/extern.h | ||
121 | +++ b/src/extern.h | ||
122 | @@ -96,6 +96,7 @@ extern char input_is_special; | ||
123 | extern char output_is_special; | ||
124 | extern char input_is_seekable; | ||
125 | extern char output_is_seekable; | ||
126 | +extern bool extract_over_symlinks; | ||
127 | extern int (*xstat) (); | ||
128 | extern void (*copy_function) (); | ||
129 | extern char *change_directory_option; | ||
130 | diff --git a/src/global.c b/src/global.c | ||
131 | index 57e505a..336fce4 100644 | ||
132 | --- a/src/global.c | ||
133 | +++ b/src/global.c | ||
134 | @@ -187,6 +187,9 @@ bool to_stdout_option = false; | ||
135 | /* The name this program was run with. */ | ||
136 | char *program_name; | ||
137 | |||
138 | +/* Extract files over symbolic links */ | ||
139 | +bool extract_over_symlinks; | ||
140 | + | ||
141 | /* A pointer to either lstat or stat, depending on whether | ||
142 | dereferencing of symlinks is done for input files. */ | ||
143 | int (*xstat) (); | ||
144 | diff --git a/src/main.c b/src/main.c | ||
145 | index a13861f..87cb309 100644 | ||
146 | --- a/src/main.c | ||
147 | +++ b/src/main.c | ||
148 | @@ -59,6 +59,7 @@ enum cpio_options { | ||
149 | DEBUG_OPTION, | ||
150 | BLOCK_SIZE_OPTION, | ||
151 | TO_STDOUT_OPTION, | ||
152 | + EXTRACT_OVER_SYMLINKS, | ||
153 | RENUMBER_INODES_OPTION, | ||
154 | IGNORE_DEVNO_OPTION, | ||
155 | DEVICE_INDEPENDENT_OPTION | ||
156 | @@ -243,6 +244,8 @@ static struct argp_option options[] = { | ||
157 | N_("Create leading directories where needed"), GRID+1 }, | ||
158 | {"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0, | ||
159 | N_("Do not change the ownership of the files"), GRID+1 }, | ||
160 | + {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0, | ||
161 | + N_("Force writing over symbolic links"), GRID+1 }, | ||
162 | {"unconditional", 'u', NULL, 0, | ||
163 | N_("Replace all files unconditionally"), GRID+1 }, | ||
164 | {"sparse", SPARSE_OPTION, NULL, 0, | ||
165 | @@ -432,6 +435,10 @@ crc newc odc bin ustar tar (all-caps also recognized)"), arg)); | ||
166 | no_chown_flag = true; | ||
167 | break; | ||
168 | |||
169 | + case EXTRACT_OVER_SYMLINKS: /* --extract-over-symlinks */ | ||
170 | + extract_over_symlinks = true; | ||
171 | + break; | ||
172 | + | ||
173 | case 'o': /* Copy-out mode. */ | ||
174 | if (copy_function != 0) | ||
175 | USAGE_ERROR ((0, 0, _("Mode already defined"))); | ||
176 | -- | ||
177 | 2.6.2 | ||
178 | |||
diff --git a/meta/recipes-extended/cpio/cpio_2.13.bb b/meta/recipes-extended/cpio/cpio_2.13.bb index 69615a9a0f..ecea8c6d8e 100644 --- a/meta/recipes-extended/cpio/cpio_2.13.bb +++ b/meta/recipes-extended/cpio/cpio_2.13.bb | |||
@@ -8,7 +8,6 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=f27defe1e96c2e1ecd4e0c9be8967949" | |||
8 | 8 | ||
9 | SRC_URI = "${GNU_MIRROR}/cpio/cpio-${PV}.tar.gz \ | 9 | SRC_URI = "${GNU_MIRROR}/cpio/cpio-${PV}.tar.gz \ |
10 | file://0001-Unset-need_charset_alias-when-building-for-musl.patch \ | 10 | file://0001-Unset-need_charset_alias-when-building-for-musl.patch \ |
11 | file://0001-Fix-CVE-2015-1197.patch \ | ||
12 | " | 11 | " |
13 | 12 | ||
14 | SRC_URI[md5sum] = "389c5452d667c23b5eceb206f5000810" | 13 | SRC_URI[md5sum] = "389c5452d667c23b5eceb206f5000810" |