diff options
Diffstat (limited to 'meta/recipes-devtools/go/go-1.14/CVE-2022-2879.patch')
-rw-r--r-- | meta/recipes-devtools/go/go-1.14/CVE-2022-2879.patch | 111 |
1 files changed, 111 insertions, 0 deletions
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2022-2879.patch b/meta/recipes-devtools/go/go-1.14/CVE-2022-2879.patch new file mode 100644 index 0000000000..ea04a82d16 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.14/CVE-2022-2879.patch | |||
@@ -0,0 +1,111 @@ | |||
1 | From 9d339f1d0f53c4116a7cb4acfa895f31a07212ee Mon Sep 17 00:00:00 2001 | ||
2 | From: Damien Neil <dneil@google.com> | ||
3 | Date: Fri, 2 Sep 2022 20:45:18 -0700 | ||
4 | Subject: [PATCH] archive/tar: limit size of headers | ||
5 | |||
6 | Set a 1MiB limit on special file blocks (PAX headers, GNU long names, | ||
7 | GNU link names), to avoid reading arbitrarily large amounts of data | ||
8 | into memory. | ||
9 | |||
10 | Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting | ||
11 | this issue. | ||
12 | |||
13 | Fixes CVE-2022-2879 | ||
14 | Updates #54853 | ||
15 | Fixes #55926 | ||
16 | |||
17 | Change-Id: I85136d6ff1e0af101a112190e027987ab4335680 | ||
18 | Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1565555 | ||
19 | Reviewed-by: Tatiana Bradley <tatianabradley@google.com> | ||
20 | Run-TryBot: Roland Shoemaker <bracewell@google.com> | ||
21 | Reviewed-by: Roland Shoemaker <bracewell@google.com> | ||
22 | (cherry picked from commit 6ee768cef6b82adf7a90dcf367a1699ef694f3b2) | ||
23 | Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1591053 | ||
24 | Reviewed-by: Julie Qiu <julieqiu@google.com> | ||
25 | Reviewed-by: Damien Neil <dneil@google.com> | ||
26 | Reviewed-on: https://go-review.googlesource.com/c/go/+/438498 | ||
27 | TryBot-Result: Gopher Robot <gobot@golang.org> | ||
28 | Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> | ||
29 | Reviewed-by: Carlos Amedee <carlos@golang.org> | ||
30 | Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> | ||
31 | Run-TryBot: Carlos Amedee <carlos@golang.org> | ||
32 | |||
33 | Upstream-Status: Backport [https://github.com/golang/go/commit/0a723816cd2] | ||
34 | CVE: CVE-2022-2879 | ||
35 | Signed-off-by: Sunil Kumar <sukumar@mvista.com> | ||
36 | --- | ||
37 | src/archive/tar/format.go | 4 ++++ | ||
38 | src/archive/tar/reader.go | 14 ++++++++++++-- | ||
39 | src/archive/tar/writer.go | 3 +++ | ||
40 | 3 files changed, 19 insertions(+), 2 deletions(-) | ||
41 | |||
42 | diff --git a/src/archive/tar/format.go b/src/archive/tar/format.go | ||
43 | index cfe24a5..6642364 100644 | ||
44 | --- a/src/archive/tar/format.go | ||
45 | +++ b/src/archive/tar/format.go | ||
46 | @@ -143,6 +143,10 @@ const ( | ||
47 | blockSize = 512 // Size of each block in a tar stream | ||
48 | nameSize = 100 // Max length of the name field in USTAR format | ||
49 | prefixSize = 155 // Max length of the prefix field in USTAR format | ||
50 | + | ||
51 | + // Max length of a special file (PAX header, GNU long name or link). | ||
52 | + // This matches the limit used by libarchive. | ||
53 | + maxSpecialFileSize = 1 << 20 | ||
54 | ) | ||
55 | |||
56 | // blockPadding computes the number of bytes needed to pad offset up to the | ||
57 | diff --git a/src/archive/tar/reader.go b/src/archive/tar/reader.go | ||
58 | index 4f9135b..e996595 100644 | ||
59 | --- a/src/archive/tar/reader.go | ||
60 | +++ b/src/archive/tar/reader.go | ||
61 | @@ -104,7 +104,7 @@ func (tr *Reader) next() (*Header, error) { | ||
62 | continue // This is a meta header affecting the next header | ||
63 | case TypeGNULongName, TypeGNULongLink: | ||
64 | format.mayOnlyBe(FormatGNU) | ||
65 | - realname, err := ioutil.ReadAll(tr) | ||
66 | + realname, err := readSpecialFile(tr) | ||
67 | if err != nil { | ||
68 | return nil, err | ||
69 | } | ||
70 | @@ -294,7 +294,7 @@ func mergePAX(hdr *Header, paxHdrs map[string]string) (err error) { | ||
71 | // parsePAX parses PAX headers. | ||
72 | // If an extended header (type 'x') is invalid, ErrHeader is returned | ||
73 | func parsePAX(r io.Reader) (map[string]string, error) { | ||
74 | - buf, err := ioutil.ReadAll(r) | ||
75 | + buf, err := readSpecialFile(r) | ||
76 | if err != nil { | ||
77 | return nil, err | ||
78 | } | ||
79 | @@ -827,6 +827,16 @@ func tryReadFull(r io.Reader, b []byte) (n int, err error) { | ||
80 | return n, err | ||
81 | } | ||
82 | |||
83 | +// readSpecialFile is like ioutil.ReadAll except it returns | ||
84 | +// ErrFieldTooLong if more than maxSpecialFileSize is read. | ||
85 | +func readSpecialFile(r io.Reader) ([]byte, error) { | ||
86 | + buf, err := ioutil.ReadAll(io.LimitReader(r, maxSpecialFileSize+1)) | ||
87 | + if len(buf) > maxSpecialFileSize { | ||
88 | + return nil, ErrFieldTooLong | ||
89 | + } | ||
90 | + return buf, err | ||
91 | +} | ||
92 | + | ||
93 | // discard skips n bytes in r, reporting an error if unable to do so. | ||
94 | func discard(r io.Reader, n int64) error { | ||
95 | // If possible, Seek to the last byte before the end of the data section. | ||
96 | diff --git a/src/archive/tar/writer.go b/src/archive/tar/writer.go | ||
97 | index e80498d..893eac0 100644 | ||
98 | --- a/src/archive/tar/writer.go | ||
99 | +++ b/src/archive/tar/writer.go | ||
100 | @@ -199,6 +199,9 @@ func (tw *Writer) writePAXHeader(hdr *Header, paxHdrs map[string]string) error { | ||
101 | flag = TypeXHeader | ||
102 | } | ||
103 | data := buf.String() | ||
104 | + if len(data) > maxSpecialFileSize { | ||
105 | + return ErrFieldTooLong | ||
106 | + } | ||
107 | if err := tw.writeRawFile(name, data, flag, FormatPAX); err != nil || isGlobal { | ||
108 | return err // Global headers return here | ||
109 | } | ||
110 | -- | ||
111 | 2.7.4 | ||