summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/cpio
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-extended/cpio')
-rw-r--r--meta/recipes-extended/cpio/cpio-2.11/cpio-CVE-2015-1197.patch154
-rw-r--r--meta/recipes-extended/cpio/cpio-2.11/fix-memory-overrun.patch220
-rw-r--r--meta/recipes-extended/cpio/cpio-2.11/remove-gets.patch20
-rw-r--r--meta/recipes-extended/cpio/cpio-2.11/statdef.patch17
-rw-r--r--meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch25
-rw-r--r--meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch217
-rw-r--r--meta/recipes-extended/cpio/cpio-2.8/m4extensions.patch31
-rw-r--r--meta/recipes-extended/cpio/cpio-2.8/statdef.patch15
-rw-r--r--meta/recipes-extended/cpio/cpio_2.11.bb14
-rw-r--r--meta/recipes-extended/cpio/cpio_2.8.bb17
-rw-r--r--meta/recipes-extended/cpio/cpio_v2.inc40
11 files changed, 770 insertions, 0 deletions
diff --git a/meta/recipes-extended/cpio/cpio-2.11/cpio-CVE-2015-1197.patch b/meta/recipes-extended/cpio/cpio-2.11/cpio-CVE-2015-1197.patch
new file mode 100644
index 0000000000..b54afb867f
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.11/cpio-CVE-2015-1197.patch
@@ -0,0 +1,154 @@
1Description: CVE-2015-1197
2 Apply patch by Vitezslav Cizek of SuSE to fix CVE-2015-1197.
3 Upstream is dormant or no longer existing. To restore the old
4 behaviour use --extract-over-symlinks (Closes: #774669)
5 This issue has been discovered by Alexander Cherepanov.
6Author: Vitezslav Cizek <vcizek@suse.cz>
7Bug-Debian: https://bugs.debian.org/774669
8
9Upstream-Status: Backport
10
11Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
12
13--- cpio-2.11+dfsg.orig/doc/cpio.1
14+++ cpio-2.11+dfsg/doc/cpio.1
15@@ -22,6 +22,7 @@ cpio \- copy files to and from archives
16 [\-\-owner=[user][:.][group]] [\-\-no-preserve-owner] [\-\-message=message]
17 [\-\-force\-local] [\-\-no\-absolute\-filenames] [\-\-sparse]
18 [\-\-only\-verify\-crc] [\-\-to\-stdout] [\-\-quiet] [\-\-rsh-command=command]
19+[\-\-extract\-over\-symlinks]
20 [\-\-help] [\-\-version] [pattern...] [< archive]
21
22 .B cpio
23--- cpio-2.11+dfsg.orig/src/copyin.c
24+++ cpio-2.11+dfsg/src/copyin.c
25@@ -700,6 +700,51 @@ copyin_link (struct cpio_file_stat *file
26 free (link_name);
27 }
28
29+
30+static int
31+path_contains_symlink(char *path)
32+{
33+ struct stat st;
34+ char *slash;
35+ char *nextslash;
36+
37+ /* we got NULL pointer or empty string */
38+ if (!path || !*path) {
39+ return false;
40+ }
41+
42+ slash = path;
43+
44+ while ((nextslash = strchr(slash + 1, '/')) != NULL) {
45+ slash = nextslash;
46+ *slash = '\0';
47+
48+ if (lstat(path, &st) != 0) {
49+ if (errno == ELOOP) {
50+ /* ELOOP - too many symlinks */
51+ *slash = '/';
52+ return true;
53+ } else if (errno == ENOMEM) {
54+ /* No memory for lstat - terminate */
55+ xalloc_die();
56+ } else {
57+ /* cannot lstat path - give up */
58+ *slash = '/';
59+ return false;
60+ }
61+ }
62+
63+ if (S_ISLNK(st.st_mode)) {
64+ *slash = '/';
65+ return true;
66+ }
67+
68+ *slash = '/';
69+ }
70+
71+ return false;
72+}
73+
74 static void
75 copyin_file (struct cpio_file_stat *file_hdr, int in_file_des)
76 {
77@@ -1471,6 +1516,23 @@ process_copy_in ()
78 {
79 /* Copy the input file into the directory structure. */
80
81+ /* Can we write files over symlinks? */
82+ if (!extract_over_symlinks)
83+ {
84+ if (path_contains_symlink(file_hdr.c_name))
85+ {
86+ /* skip the file */
87+ /*
88+ fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name);
89+ tape_toss_input (in_file_des, file_hdr.c_filesize);
90+ tape_skip_padding (in_file_des, file_hdr.c_filesize);
91+ continue;
92+ */
93+ /* terminate */
94+ error (1, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name);
95+ }
96+ }
97+
98 /* Do we need to rename the file? */
99 if (rename_flag || rename_batch_file)
100 {
101--- cpio-2.11+dfsg.orig/src/extern.h
102+++ cpio-2.11+dfsg/src/extern.h
103@@ -95,6 +95,7 @@ extern char input_is_special;
104 extern char output_is_special;
105 extern char input_is_seekable;
106 extern char output_is_seekable;
107+extern bool extract_over_symlinks;
108 extern int (*xstat) ();
109 extern void (*copy_function) ();
110
111--- cpio-2.11+dfsg.orig/src/global.c
112+++ cpio-2.11+dfsg/src/global.c
113@@ -187,6 +187,9 @@ bool to_stdout_option = false;
114 /* The name this program was run with. */
115 char *program_name;
116
117+/* Extract files over symbolic links */
118+bool extract_over_symlinks;
119+
120 /* A pointer to either lstat or stat, depending on whether
121 dereferencing of symlinks is done for input files. */
122 int (*xstat) ();
123--- cpio-2.11+dfsg.orig/src/main.c
124+++ cpio-2.11+dfsg/src/main.c
125@@ -57,7 +57,8 @@ enum cpio_options {
126 FORCE_LOCAL_OPTION,
127 DEBUG_OPTION,
128 BLOCK_SIZE_OPTION,
129- TO_STDOUT_OPTION
130+ TO_STDOUT_OPTION,
131+ EXTRACT_OVER_SYMLINKS
132 };
133
134 const char *program_authors[] =
135@@ -222,6 +223,8 @@ static struct argp_option options[] = {
136 N_("Create leading directories where needed"), GRID+1 },
137 {"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0,
138 N_("Do not change the ownership of the files"), GRID+1 },
139+ {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0,
140+ N_("Force writing over symbolic links"), GRID+1 },
141 {"unconditional", 'u', NULL, 0,
142 N_("Replace all files unconditionally"), GRID+1 },
143 {"sparse", SPARSE_OPTION, NULL, 0,
144@@ -412,6 +415,10 @@ crc newc odc bin ustar tar (all-caps als
145 no_chown_flag = true;
146 break;
147
148+ case EXTRACT_OVER_SYMLINKS: /* --extract-over-symlinks */
149+ extract_over_symlinks = true;
150+ break;
151+
152 case 'o': /* Copy-out mode. */
153 if (copy_function != 0)
154 error (PAXEXIT_FAILURE, 0, _("Mode already defined"));
diff --git a/meta/recipes-extended/cpio/cpio-2.11/fix-memory-overrun.patch b/meta/recipes-extended/cpio/cpio-2.11/fix-memory-overrun.patch
new file mode 100644
index 0000000000..89cd3cfa50
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.11/fix-memory-overrun.patch
@@ -0,0 +1,220 @@
1cpio: Fix memory overrun on reading improperly created link records
2
3Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
4
5http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d
6
7 * src/copyin.c (get_link_name): New function.
8 (list_file, copyin_link): use get_link_name
9
10 * tests/symlink-bad-length.at: New file.
11 * tests/symlink-long.at: New file.
12 * tests/Makefile.am: Add new files.
13 * tests/testsuite.at: Likewise.
14
15 See http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
16
17Upstream-Status: Backport
18
19Signed-off-by: Sergey Poznyakoff <gray@gnu.org.ua>
20
21diff -Nurp cpio-2.11.orig/src/copyin.c cpio-2.11/src/copyin.c
22--- cpio-2.11.orig/src/copyin.c 2010-02-15 18:02:23.000000000 +0800
23+++ cpio-2.11/src/copyin.c 2014-12-08 13:14:04.355547508 +0800
24@@ -126,6 +126,28 @@ tape_skip_padding (int in_file_des, off_
25 }
26
27
28+static char *
29+get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
30+{
31+ off_t n = file_hdr->c_filesize + 1;
32+ char *link_name;
33+
34+ if (n == 0 || n > SIZE_MAX)
35+ {
36+ error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
37+ link_name = NULL;
38+ }
39+ else
40+ {
41+ link_name = xmalloc (n);
42+ tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
43+ link_name[file_hdr->c_filesize] = '\0';
44+ tape_skip_padding (in_file_des, file_hdr->c_filesize);
45+ }
46+ return link_name;
47+}
48+
49+
50 static void
51 list_file(struct cpio_file_stat* file_hdr, int in_file_des)
52 {
53@@ -136,21 +158,16 @@ list_file(struct cpio_file_stat* file_hd
54 {
55 if (archive_format != arf_tar && archive_format != arf_ustar)
56 {
57- char *link_name = NULL; /* Name of hard and symbolic links. */
58-
59- link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
60- link_name[file_hdr->c_filesize] = '\0';
61- tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
62- long_format (file_hdr, link_name);
63- free (link_name);
64- tape_skip_padding (in_file_des, file_hdr->c_filesize);
65- return;
66+ char *link_name = get_link_name (file_hdr, in_file_des);
67+ if (link_name)
68+ {
69+ long_format (file_hdr, link_name);
70+ free (link_name);
71+ }
72 }
73 else
74- {
75 long_format (file_hdr, file_hdr->c_tar_linkname);
76- return;
77- }
78+ return;
79 }
80 else
81 #endif
82@@ -650,10 +667,7 @@ copyin_link(struct cpio_file_stat *file_
83
84 if (archive_format != arf_tar && archive_format != arf_ustar)
85 {
86- link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
87- link_name[file_hdr->c_filesize] = '\0';
88- tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
89- tape_skip_padding (in_file_des, file_hdr->c_filesize);
90+ link_name = get_link_name (file_hdr, in_file_des);
91 }
92 else
93 {
94diff -Nurp cpio-2.11.orig/tests/Makefile.am cpio-2.11/tests/Makefile.am
95--- cpio-2.11.orig/tests/Makefile.am 2010-02-15 18:02:23.000000000 +0800
96+++ cpio-2.11/tests/Makefile.am 2014-12-08 13:14:49.931545727 +0800
97@@ -52,6 +52,8 @@ TESTSUITE_AT = \
98 setstat04.at\
99 setstat05.at\
100 symlink.at\
101+ symlink-bad-length.at\
102+ symlink-long.at\
103 version.at
104
105 TESTSUITE = $(srcdir)/testsuite
106diff -Nurp cpio-2.11.orig/tests/symlink-bad-length.at cpio-2.11/tests/symlink-bad-length.at
107--- cpio-2.11.orig/tests/symlink-bad-length.at 1970-01-01 08:00:00.000000000 +0800
108+++ cpio-2.11/tests/symlink-bad-length.at 2014-12-08 13:17:45.979538847 +0800
109@@ -0,0 +1,49 @@
110+# Process this file with autom4te to create testsuite. -*- Autotest -*-
111+# Copyright (C) 2014 Free Software Foundation, Inc.
112+
113+# This program is free software; you can redistribute it and/or modify
114+# it under the terms of the GNU General Public License as published by
115+# the Free Software Foundation; either version 3, or (at your option)
116+# any later version.
117+
118+# This program is distributed in the hope that it will be useful,
119+# but WITHOUT ANY WARRANTY; without even the implied warranty of
120+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
121+# GNU General Public License for more details.
122+
123+# You should have received a copy of the GNU General Public License
124+# along with this program; if not, write to the Free Software
125+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
126+# 02110-1301 USA.
127+
128+# Cpio v2.11 did segfault with badly set symlink length.
129+# References:
130+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
131+
132+AT_SETUP([symlink-bad-length])
133+AT_KEYWORDS([symlink-long copyout])
134+
135+AT_DATA([ARCHIVE.base64],
136+[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
137+JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
138+UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
139+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
140+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
141+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
142+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
143+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
144+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
145+])
146+
147+AT_CHECK([
148+base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
149+cpio -ntv < ARCHIVE
150+test $? -eq 2
151+],
152+[0],
153+[-rw-rw-r-- 1 10029 10031 13 Nov 25 13:52 FILE
154+],[cpio: LINK: stored filename length too big
155+cpio: premature end of file
156+])
157+
158+AT_CLEANUP
159diff -Nurp cpio-2.11.orig/tests/symlink-long.at cpio-2.11/tests/symlink-long.at
160--- cpio-2.11.orig/tests/symlink-long.at 1970-01-01 08:00:00.000000000 +0800
161+++ cpio-2.11/tests/symlink-long.at 2014-12-08 13:17:57.219538408 +0800
162@@ -0,0 +1,46 @@
163+# Process this file with autom4te to create testsuite. -*- Autotest -*-
164+# Copyright (C) 2014 Free Software Foundation, Inc.
165+
166+# This program is free software; you can redistribute it and/or modify
167+# it under the terms of the GNU General Public License as published by
168+# the Free Software Foundation; either version 3, or (at your option)
169+# any later version.
170+
171+# This program is distributed in the hope that it will be useful,
172+# but WITHOUT ANY WARRANTY; without even the implied warranty of
173+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
174+# GNU General Public License for more details.
175+
176+# You should have received a copy of the GNU General Public License
177+# along with this program; if not, write to the Free Software
178+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
179+# 02110-1301 USA.
180+
181+# Cpio v2.11.90 changed the way symlink name is read from archive.
182+# References:
183+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
184+
185+AT_SETUP([symlink-long])
186+AT_KEYWORDS([symlink-long copyout])
187+
188+AT_CHECK([
189+
190+# len(dirname) > READBUFSIZE
191+dirname=
192+for i in {1..52}; do
193+ dirname="xxxxxxxxx/$dirname"
194+ mkdir "$dirname"
195+done
196+ln -s "$dirname" x || AT_SKIP_TEST
197+
198+echo x | cpio -o > ar
199+list=`cpio -tv < ar | sed 's|.*-> ||'`
200+test "$list" = "$dirname" && echo success || echo fail
201+],
202+[0],
203+[success
204+],[2 blocks
205+2 blocks
206+])
207+
208+AT_CLEANUP
209diff -Nurp cpio-2.11.orig/tests/testsuite.at cpio-2.11/tests/testsuite.at
210--- cpio-2.11.orig/tests/testsuite.at 2010-02-15 18:02:23.000000000 +0800
211+++ cpio-2.11/tests/testsuite.at 2014-12-08 13:15:13.515544805 +0800
212@@ -31,6 +31,8 @@ m4_include([version.at])
213
214 m4_include([inout.at])
215 m4_include([symlink.at])
216+m4_include([symlink-bad-length.at])
217+m4_include([symlink-long.at])
218 m4_include([interdir.at])
219
220 m4_include([setstat01.at])
diff --git a/meta/recipes-extended/cpio/cpio-2.11/remove-gets.patch b/meta/recipes-extended/cpio/cpio-2.11/remove-gets.patch
new file mode 100644
index 0000000000..b4d113d3a5
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.11/remove-gets.patch
@@ -0,0 +1,20 @@
1ISO C11 removes the specification of gets() from the C language, eglibc 2.16+ removed it
2
3Signed-off-by: Khem Raj <raj.khem@gmail.com>
4
5Upstream-Status: Pending
6Index: cpio-2.11/gnu/stdio.in.h
7===================================================================
8--- cpio-2.11.orig/gnu/stdio.in.h 2012-07-04 12:13:43.133066247 -0700
9+++ cpio-2.11/gnu/stdio.in.h 2012-07-04 12:14:10.189067564 -0700
10@@ -138,8 +138,10 @@
11 /* It is very rare that the developer ever has full control of stdin,
12 so any use of gets warrants an unconditional warning. Assume it is
13 always declared, since it is required by C89. */
14+#if defined gets
15 #undef gets
16 _GL_WARN_ON_USE (gets, "gets is a security hole - use fgets instead");
17+#endif
18
19 #if @GNULIB_FOPEN@
20 # if @REPLACE_FOPEN@
diff --git a/meta/recipes-extended/cpio/cpio-2.11/statdef.patch b/meta/recipes-extended/cpio/cpio-2.11/statdef.patch
new file mode 100644
index 0000000000..a6b8e82a0b
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.11/statdef.patch
@@ -0,0 +1,17 @@
1Avoid multiple stat definitions
2Patch taken from cpio mailing list posting 2010-03-19
3
4Upstream-Status: Pending
5
6Signed-off-by: Scott Garman <scott.a.garman@intel.com>
7
8diff -urN cpio-2.11.orig/src/filetypes.h cpio-2.11/src/filetypes.h
9--- cpio-2.11.orig/src/filetypes.h 2010-02-12 02:19:23.000000000 -0800
10+++ cpio-2.11/src/filetypes.h 2010-07-23 13:17:25.000000000 -0700
11@@ -82,4 +82,6 @@
12 #define lstat stat
13 #endif
14 int lstat ();
15+#ifndef stat
16 int stat ();
17+#endif
diff --git a/meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch b/meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch
new file mode 100644
index 0000000000..49a7cf52a6
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.8/avoid_heap_overflow.patch
@@ -0,0 +1,25 @@
1Upstream-Status: Inappropriate [bugfix: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0624]
2
3This patch avoids heap overflow reported by :
4http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0624
5
6This is a clean patch for the GPLv2 tar recipe.
7
8the GPLv2 tar recipe patch is also applicable to this GPLv2 cpio
9recipe, as they share code.
10
11Nitin A Kamble <nitin.a.kamble@intel.com> 2011/04/25
12
13Index: tar-1.17/lib/rtapelib.c
14===================================================================
15--- tar-1.17.orig/lib/rtapelib.c
16+++ tar-1.17/lib/rtapelib.c
17@@ -570,7 +570,7 @@ rmt_read__ (int handle, char *buffer, si
18
19 sprintf (command_buffer, "R%lu\n", (unsigned long) length);
20 if (do_command (handle, command_buffer) == -1
21- || (status = get_status (handle)) == SAFE_READ_ERROR)
22+ || ((status = get_status (handle)) == SAFE_READ_ERROR) || (status > length))
23 return SAFE_READ_ERROR;
24
25 for (counter = 0; counter < status; counter += rlen, buffer += rlen)
diff --git a/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch b/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch
new file mode 100644
index 0000000000..0148e70797
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.8/fix-memory-overrun.patch
@@ -0,0 +1,217 @@
1cpio: Fix memory overrun on reading improperly created link records
2
3Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
4
5http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d
6
7 * src/copyin.c (get_link_name): New function.
8 (list_file, copyin_link): use get_link_name
9
10 * tests/symlink-bad-length.at: New file.
11 * tests/symlink-long.at: New file.
12 * tests/Makefile.am: Add new files.
13 * tests/testsuite.at: Likewise.
14
15 See http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
16
17Upstream-Status: Backport
18
19Signed-off-by: Sergey Poznyakoff <gray@gnu.org.ua>
20
21diff -Nurp cpio-2.8.orig/src/copyin.c cpio-2.8/src/copyin.c
22--- cpio-2.8.orig/src/copyin.c 2007-06-07 19:58:03.000000000 +0800
23+++ cpio-2.8/src/copyin.c 2014-12-08 11:30:01.159791484 +0800
24@@ -126,6 +126,28 @@ tape_skip_padding (int in_file_des, int
25 }
26
27
28+static char *
29+get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
30+{
31+ off_t n = file_hdr->c_filesize + 1;
32+ char *link_name;
33+
34+ if (n == 0 || n > SIZE_MAX)
35+ {
36+ error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
37+ link_name = NULL;
38+ }
39+ else
40+ {
41+ link_name = xmalloc (n);
42+ tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
43+ link_name[file_hdr->c_filesize] = '\0';
44+ tape_skip_padding (in_file_des, file_hdr->c_filesize);
45+ }
46+ return link_name;
47+}
48+
49+
50 static void
51 list_file(struct cpio_file_stat* file_hdr, int in_file_des)
52 {
53@@ -136,21 +158,16 @@ list_file(struct cpio_file_stat* file_hd
54 {
55 if (archive_format != arf_tar && archive_format != arf_ustar)
56 {
57- char *link_name = NULL; /* Name of hard and symbolic links. */
58-
59- link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
60- link_name[file_hdr->c_filesize] = '\0';
61- tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
62- long_format (file_hdr, link_name);
63- free (link_name);
64- tape_skip_padding (in_file_des, file_hdr->c_filesize);
65- return;
66+ char *link_name = get_link_name (file_hdr, in_file_des);
67+ if (link_name)
68+ {
69+ long_format (file_hdr, link_name);
70+ free (link_name);
71+ }
72 }
73 else
74- {
75 long_format (file_hdr, file_hdr->c_tar_linkname);
76- return;
77- }
78+ return;
79 }
80 else
81 #endif
82@@ -732,10 +749,7 @@ copyin_link(struct cpio_file_stat *file_
83
84 if (archive_format != arf_tar && archive_format != arf_ustar)
85 {
86- link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
87- link_name[file_hdr->c_filesize] = '\0';
88- tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
89- tape_skip_padding (in_file_des, file_hdr->c_filesize);
90+ link_name = get_link_name (file_hdr, in_file_des);
91 }
92 else
93 {
94diff -Nurp cpio-2.8.orig/tests/Makefile.am cpio-2.8/tests/Makefile.am
95--- cpio-2.8.orig/tests/Makefile.am 2006-10-24 18:32:13.000000000 +0800
96+++ cpio-2.8/tests/Makefile.am 2014-12-08 11:30:52.387789482 +0800
97@@ -45,6 +45,8 @@ TESTSUITE_AT = \
98 testsuite.at\
99 inout.at\
100 symlink.at\
101+ symlink-bad-length.at\
102+ symlink-long.at\
103 version.at
104
105 TESTSUITE = $(srcdir)/testsuite
106diff -Nurp cpio-2.8.orig/tests/symlink-bad-length.at cpio-2.8/tests/symlink-bad-length.at
107--- cpio-2.8.orig/tests/symlink-bad-length.at 1970-01-01 08:00:00.000000000 +0800
108+++ cpio-2.8/tests/symlink-bad-length.at 2014-12-08 11:33:25.283783507 +0800
109@@ -0,0 +1,49 @@
110+# Process this file with autom4te to create testsuite. -*- Autotest -*-
111+# Copyright (C) 2014 Free Software Foundation, Inc.
112+
113+# This program is free software; you can redistribute it and/or modify
114+# it under the terms of the GNU General Public License as published by
115+# the Free Software Foundation; either version 3, or (at your option)
116+# any later version.
117+
118+# This program is distributed in the hope that it will be useful,
119+# but WITHOUT ANY WARRANTY; without even the implied warranty of
120+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
121+# GNU General Public License for more details.
122+
123+# You should have received a copy of the GNU General Public License
124+# along with this program; if not, write to the Free Software
125+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
126+# 02110-1301 USA.
127+
128+# Cpio v2.11 did segfault with badly set symlink length.
129+# References:
130+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
131+
132+AT_SETUP([symlink-bad-length])
133+AT_KEYWORDS([symlink-long copyout])
134+
135+AT_DATA([ARCHIVE.base64],
136+[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
137+JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
138+UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
139+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
140+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
141+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
142+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
143+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
144+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
145+])
146+
147+AT_CHECK([
148+base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
149+cpio -ntv < ARCHIVE
150+test $? -eq 2
151+],
152+[0],
153+[-rw-rw-r-- 1 10029 10031 13 Nov 25 13:52 FILE
154+],[cpio: LINK: stored filename length too big
155+cpio: premature end of file
156+])
157+
158+AT_CLEANUP
159diff -Nurp cpio-2.8.orig/tests/symlink-long.at cpio-2.8/tests/symlink-long.at
160--- cpio-2.8.orig/tests/symlink-long.at 1970-01-01 08:00:00.000000000 +0800
161+++ cpio-2.8/tests/symlink-long.at 2014-12-08 11:34:28.807781024 +0800
162@@ -0,0 +1,46 @@
163+# Process this file with autom4te to create testsuite. -*- Autotest -*-
164+# Copyright (C) 2014 Free Software Foundation, Inc.
165+
166+# This program is free software; you can redistribute it and/or modify
167+# it under the terms of the GNU General Public License as published by
168+# the Free Software Foundation; either version 3, or (at your option)
169+# any later version.
170+
171+# This program is distributed in the hope that it will be useful,
172+# but WITHOUT ANY WARRANTY; without even the implied warranty of
173+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
174+# GNU General Public License for more details.
175+
176+# You should have received a copy of the GNU General Public License
177+# along with this program; if not, write to the Free Software
178+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
179+# 02110-1301 USA.
180+
181+# Cpio v2.11.90 changed the way symlink name is read from archive.
182+# References:
183+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
184+
185+AT_SETUP([symlink-long])
186+AT_KEYWORDS([symlink-long copyout])
187+
188+AT_CHECK([
189+
190+# len(dirname) > READBUFSIZE
191+dirname=
192+for i in {1..52}; do
193+ dirname="xxxxxxxxx/$dirname"
194+ mkdir "$dirname"
195+done
196+ln -s "$dirname" x || AT_SKIP_TEST
197+
198+echo x | cpio -o > ar
199+list=`cpio -tv < ar | sed 's|.*-> ||'`
200+test "$list" = "$dirname" && echo success || echo fail
201+],
202+[0],
203+[success
204+],[2 blocks
205+2 blocks
206+])
207+
208+AT_CLEANUP
209diff -Nurp cpio-2.8.orig/tests/testsuite.at cpio-2.8/tests/testsuite.at
210--- cpio-2.8.orig/tests/testsuite.at 2006-10-24 18:32:13.000000000 +0800
211+++ cpio-2.8/tests/testsuite.at 2014-12-08 11:34:56.515779942 +0800
212@@ -31,3 +31,5 @@ m4_include([version.at])
213
214 m4_include([inout.at])
215 m4_include([symlink.at])
216+m4_include([symlink-bad-length.at])
217+m4_include([symlink-long.at])
diff --git a/meta/recipes-extended/cpio/cpio-2.8/m4extensions.patch b/meta/recipes-extended/cpio/cpio-2.8/m4extensions.patch
new file mode 100644
index 0000000000..e16585dd3f
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.8/m4extensions.patch
@@ -0,0 +1,31 @@
1Upstream-Status: Inappropriate [licensing]
2
3# Define AC_USE_SYSTEM_EXTENSIONS only if it was previously undefined.
4# This is needed to configure correctly with newer versions of autoconf.
5
6diff -urN cpio-2.8.orig/m4/extensions.m4 cpio-2.8/m4/extensions.m4
7--- cpio-2.8.orig/m4/extensions.m4 2006-10-12 04:34:45.000000000 -0700
8+++ cpio-2.8/m4/extensions.m4 2010-07-23 14:37:36.000000000 -0700
9@@ -1,4 +1,4 @@
10-# serial 4 -*- Autoconf -*-
11+# serial 5 -*- Autoconf -*-
12 # Enable extensions on systems that normally disable them.
13
14 # Copyright (C) 2003, 2006 Free Software Foundation, Inc.
15@@ -16,6 +16,7 @@
16 # ------------------------
17 # Enable extensions on systems that normally disable them,
18 # typically due to standards-conformance issues.
19+m4_ifdef([AC_USE_SYSTEM_EXTENSIONS], [], [
20 AC_DEFUN([AC_USE_SYSTEM_EXTENSIONS],
21 [
22 AC_BEFORE([$0], [AC_COMPILE_IFELSE])
23@@ -48,7 +49,7 @@
24 AC_DEFINE([__EXTENSIONS__])
25 AC_DEFINE([_POSIX_PTHREAD_SEMANTICS])
26 AC_DEFINE([_TANDEM_SOURCE])
27-])
28+])])
29
30 # gl_USE_SYSTEM_EXTENSIONS
31 # ------------------------
diff --git a/meta/recipes-extended/cpio/cpio-2.8/statdef.patch b/meta/recipes-extended/cpio/cpio-2.8/statdef.patch
new file mode 100644
index 0000000000..a00799fea9
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio-2.8/statdef.patch
@@ -0,0 +1,15 @@
1Upstream-Status: Inappropriate [licensing]
2
3# Avoid multiple stat definitions
4# Patch taken from cpio mailing list posting 2010-03-19
5
6diff -urN cpio-2.11.orig/src/filetypes.h cpio-2.11/src/filetypes.h
7--- cpio-2.11.orig/src/filetypes.h 2010-02-12 02:19:23.000000000 -0800
8+++ cpio-2.11/src/filetypes.h 2010-07-23 13:17:25.000000000 -0700
9@@ -82,4 +82,6 @@
10 #define lstat stat
11 #endif
12 int lstat ();
13+#ifndef stat
14 int stat ();
15+#endif
diff --git a/meta/recipes-extended/cpio/cpio_2.11.bb b/meta/recipes-extended/cpio/cpio_2.11.bb
new file mode 100644
index 0000000000..053888f1c0
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio_2.11.bb
@@ -0,0 +1,14 @@
1include cpio_v2.inc
2
3LICENSE = "GPLv3"
4LIC_FILES_CHKSUM = "file://COPYING;md5=f27defe1e96c2e1ecd4e0c9be8967949"
5
6PR = "r5"
7
8SRC_URI += "file://remove-gets.patch \
9 file://fix-memory-overrun.patch \
10 file://cpio-CVE-2015-1197.patch \
11 "
12
13SRC_URI[md5sum] = "1112bb6c45863468b5496ba128792f6c"
14SRC_URI[sha256sum] = "601b1d774cd6e4cd39416203c91ec59dbd65dd27d79d75e1a9b89497ea643978"
diff --git a/meta/recipes-extended/cpio/cpio_2.8.bb b/meta/recipes-extended/cpio/cpio_2.8.bb
new file mode 100644
index 0000000000..3f97dbe2ce
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio_2.8.bb
@@ -0,0 +1,17 @@
1require cpio_v2.inc
2
3LICENSE = "GPLv2"
4LIC_FILES_CHKSUM = "file://COPYING;md5=b7f772ea3a2489231cb4872656cac34b"
5
6PR = "r4"
7
8SRC_URI += "file://m4extensions.patch \
9 file://avoid_heap_overflow.patch \
10 file://fix-memory-overrun.patch \
11 "
12
13SRC_URI[md5sum] = "0caa356e69e149fb49b76bacc64615a1"
14SRC_URI[sha256sum] = "1b203248874c3b5a728b351f06513e5282f73e0170b7f207fbf8c39f28f6b4ad"
15
16# Required to build with gcc 4.3 and later:
17CFLAGS += "-fgnu89-inline"
diff --git a/meta/recipes-extended/cpio/cpio_v2.inc b/meta/recipes-extended/cpio/cpio_v2.inc
new file mode 100644
index 0000000000..93de4bb92b
--- /dev/null
+++ b/meta/recipes-extended/cpio/cpio_v2.inc
@@ -0,0 +1,40 @@
1SUMMARY = "GNU cpio is a program to manage archives of files"
2DESCRIPTION = "GNU cpio is a tool for creating and extracting archives, or copying files from one place to \
3another. It handles a number of cpio formats as well as reading and writing tar files."
4HOMEPAGE = "http://www.gnu.org/software/cpio/"
5SECTION = "base"
6
7DEPENDS = "texinfo-native"
8
9SRC_URI = "${GNU_MIRROR}/cpio/cpio-${PV}.tar.gz \
10 file://statdef.patch \
11 "
12
13inherit autotools gettext texinfo
14
15S = "${WORKDIR}/cpio-${PV}"
16
17EXTRA_OECONF += "DEFAULT_RMT_DIR=${base_sbindir}"
18
19do_install () {
20 autotools_do_install
21 install -d ${D}${base_bindir}/
22 mv "${D}${bindir}/cpio" "${D}${base_bindir}/cpio"
23 rmdir ${D}${bindir}/
24}
25
26PACKAGES =+ "${PN}-rmt"
27
28FILES_${PN}-rmt = "${base_sbindir}/rmt*"
29
30inherit update-alternatives
31
32ALTERNATIVE_PRIORITY = "100"
33
34ALTERNATIVE_${PN} = "cpio"
35ALTERNATIVE_${PN}-rmt = "rmt"
36
37ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio"
38
39ALTERNATIVE_PRIORITY[rmt] = "50"
40ALTERNATIVE_LINK_NAME[rmt] = "${base_sbindir}/rmt"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-02 12:28:41 +0000