summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/cpio
diff options
context:
space:
mode:
authorChangqing Li <changqing.li@windriver.com>2019-12-27 16:08:05 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-12-30 08:47:12 +0000
commit2d4b6820c19a286eab020173e58052b1483c863e (patch)
treefa15ce3388763e709d73b7403b5688dca263548c /meta/recipes-extended/cpio
parent61f8a68e4e443fffd1c9eedd7f8100939fb14dd9 (diff)
downloadpoky-2d4b6820c19a286eab020173e58052b1483c863e.tar.gz
cpio: remove unused CVE patch
According to the home page, https://www.gnu.org/software/cpio/, CVE-2015-1197 have been fix in version 2.13, so removed this patch get from SUSE (From OE-Core rev: 6e37b0cba0d59e020ed031659aa050ce4e7c4ccd) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-extended/cpio')
-rw-r--r--meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch178
-rw-r--r--meta/recipes-extended/cpio/cpio_2.13.bb1
2 files changed, 0 insertions, 179 deletions
diff --git a/meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch b/meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch
deleted file mode 100644
index 5c999197ff..0000000000
--- a/meta/recipes-extended/cpio/cpio-2.13/0001-Fix-CVE-2015-1197.patch
+++ /dev/null
@@ -1,178 +0,0 @@
1From dcee489f821c1260a0136fcdfdb6ff4dd11086ac Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex.kanavin@gmail.com>
3Date: Wed, 9 Dec 2015 17:58:03 +0200
4Subject: [PATCH] Fix CVE-2015-1197
5
6Apply patch by Vitezslav Cizek of SuSE to fix CVE-2015-1197.
7Upstream is dormant or no longer existing. To restore the old
8behaviour use --extract-over-symlinks (Closes: #774669)
9This issue has been discovered by Alexander Cherepanov.
10Author: Vitezslav Cizek <vcizek@suse.cz>
11Bug-Debian: https://bugs.debian.org/774669
12
13Upstream-Status: Pending
14CVE: CVE-2015-1197
15Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
16Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
17
18---
19 doc/cpio.1 | 1 +
20 src/copyin.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
21 src/extern.h | 1 +
22 src/global.c | 3 +++
23 src/main.c | 7 +++++++
24 5 files changed, 74 insertions(+)
25
26diff --git a/doc/cpio.1 b/doc/cpio.1
27index 2a68241..dc4676c 100644
28--- a/doc/cpio.1
29+++ b/doc/cpio.1
30@@ -49,6 +49,7 @@ cpio \- copy files to and from archives
31 [\fB\-\-no\-preserve\-owner\fR] [\fB\-\-message=\fIMESSAGE\fR]
32 [\fB\-\-force\-local\fR] [\fB\-\-no\-absolute\-filenames\fR] [\fB\-\-sparse\fR]
33 [\fB\-\-only\-verify\-crc\fR] [\fB\-\-to\-stdout\fR] [\fB\-\-quiet\fR]
34+[\fB\-\-extract\-over\-symlinks\fR]
35 [\fB\-\-rsh\-command=\fICOMMAND\fR]
36 [\fIpattern\fR...] [\fB<\fR \fIarchive\fR]
37
38diff --git a/src/copyin.c b/src/copyin.c
39index cde911e..053afe7 100644
40--- a/src/copyin.c
41+++ b/src/copyin.c
42@@ -695,6 +695,51 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
43 free (link_name);
44 }
45
46+
47+static int
48+path_contains_symlink(char *path)
49+{
50+ struct stat st;
51+ char *slash;
52+ char *nextslash;
53+
54+ /* we got NULL pointer or empty string */
55+ if (!path || !*path) {
56+ return false;
57+ }
58+
59+ slash = path;
60+
61+ while ((nextslash = strchr(slash + 1, '/')) != NULL) {
62+ slash = nextslash;
63+ *slash = '\0';
64+
65+ if (lstat(path, &st) != 0) {
66+ if (errno == ELOOP) {
67+ /* ELOOP - too many symlinks */
68+ *slash = '/';
69+ return true;
70+ } else if (errno == ENOMEM) {
71+ /* No memory for lstat - terminate */
72+ xalloc_die();
73+ } else {
74+ /* cannot lstat path - give up */
75+ *slash = '/';
76+ return false;
77+ }
78+ }
79+
80+ if (S_ISLNK(st.st_mode)) {
81+ *slash = '/';
82+ return true;
83+ }
84+
85+ *slash = '/';
86+ }
87+
88+ return false;
89+}
90+
91 static void
92 copyin_file (struct cpio_file_stat *file_hdr, int in_file_des)
93 {
94@@ -1468,6 +1513,23 @@ process_copy_in ()
95 {
96 /* Copy the input file into the directory structure. */
97
98+ /* Can we write files over symlinks? */
99+ if (!extract_over_symlinks)
100+ {
101+ if (path_contains_symlink(file_hdr.c_name))
102+ {
103+ /* skip the file */
104+ /*
105+ fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name);
106+ tape_toss_input (in_file_des, file_hdr.c_filesize);
107+ tape_skip_padding (in_file_des, file_hdr.c_filesize);
108+ continue;
109+ */
110+ /* terminate */
111+ error (1, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name);
112+ }
113+ }
114+
115 /* Do we need to rename the file? */
116 if (rename_flag || rename_batch_file)
117 {
118diff --git a/src/extern.h b/src/extern.h
119index e27d662..d864bde 100644
120--- a/src/extern.h
121+++ b/src/extern.h
122@@ -96,6 +96,7 @@ extern char input_is_special;
123 extern char output_is_special;
124 extern char input_is_seekable;
125 extern char output_is_seekable;
126+extern bool extract_over_symlinks;
127 extern int (*xstat) ();
128 extern void (*copy_function) ();
129 extern char *change_directory_option;
130diff --git a/src/global.c b/src/global.c
131index 57e505a..336fce4 100644
132--- a/src/global.c
133+++ b/src/global.c
134@@ -187,6 +187,9 @@ bool to_stdout_option = false;
135 /* The name this program was run with. */
136 char *program_name;
137
138+/* Extract files over symbolic links */
139+bool extract_over_symlinks;
140+
141 /* A pointer to either lstat or stat, depending on whether
142 dereferencing of symlinks is done for input files. */
143 int (*xstat) ();
144diff --git a/src/main.c b/src/main.c
145index a13861f..87cb309 100644
146--- a/src/main.c
147+++ b/src/main.c
148@@ -59,6 +59,7 @@ enum cpio_options {
149 DEBUG_OPTION,
150 BLOCK_SIZE_OPTION,
151 TO_STDOUT_OPTION,
152+ EXTRACT_OVER_SYMLINKS,
153 RENUMBER_INODES_OPTION,
154 IGNORE_DEVNO_OPTION,
155 DEVICE_INDEPENDENT_OPTION
156@@ -243,6 +244,8 @@ static struct argp_option options[] = {
157 N_("Create leading directories where needed"), GRID+1 },
158 {"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0,
159 N_("Do not change the ownership of the files"), GRID+1 },
160+ {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0,
161+ N_("Force writing over symbolic links"), GRID+1 },
162 {"unconditional", 'u', NULL, 0,
163 N_("Replace all files unconditionally"), GRID+1 },
164 {"sparse", SPARSE_OPTION, NULL, 0,
165@@ -432,6 +435,10 @@ crc newc odc bin ustar tar (all-caps also recognized)"), arg));
166 no_chown_flag = true;
167 break;
168
169+ case EXTRACT_OVER_SYMLINKS: /* --extract-over-symlinks */
170+ extract_over_symlinks = true;
171+ break;
172+
173 case 'o': /* Copy-out mode. */
174 if (copy_function != 0)
175 USAGE_ERROR ((0, 0, _("Mode already defined")));
176--
1772.6.2
178
diff --git a/meta/recipes-extended/cpio/cpio_2.13.bb b/meta/recipes-extended/cpio/cpio_2.13.bb
index 69615a9a0f..ecea8c6d8e 100644
--- a/meta/recipes-extended/cpio/cpio_2.13.bb
+++ b/meta/recipes-extended/cpio/cpio_2.13.bb
@@ -8,7 +8,6 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=f27defe1e96c2e1ecd4e0c9be8967949"
8 8
9SRC_URI = "${GNU_MIRROR}/cpio/cpio-${PV}.tar.gz \ 9SRC_URI = "${GNU_MIRROR}/cpio/cpio-${PV}.tar.gz \
10 file://0001-Unset-need_charset_alias-when-building-for-musl.patch \ 10 file://0001-Unset-need_charset_alias-when-building-for-musl.patch \
11 file://0001-Fix-CVE-2015-1197.patch \
12 " 11 "
13 12
14SRC_URI[md5sum] = "389c5452d667c23b5eceb206f5000810" 13SRC_URI[md5sum] = "389c5452d667c23b5eceb206f5000810"