From 8c18d70e3d3ea80e0204ca3d5ff79183493235c5 Mon Sep 17 00:00:00 2001 From: Ahsan Hussain Date: Mon, 31 Jan 2022 13:55:48 +0500 Subject: staging: use relative path in sysroot_stage_dir() A regression form cpio CVE-2021-38185 caused the tool to hang for paths greater than 128 character long. It was reported here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992098 We were able to reliable reproduce this with dunfell, meta-freescale recipe imx-boot https://github.com/Freescale/meta-freescale/blob/dunfell/recipes-bsp/imx-mkimage/imx-boot_1.0.bb Using relative path on the affected host fixes the issue as this is always short, being in the same work dir. It would be harmless, and useful to generally use the relative path for sysroot_stage_dir() (From OE-Core rev: a1ec3154a53fd9e3f87a53f25113b7f90bcfb489) Signed-off-by: Ahsan Hussain Signed-off-by: Richard Purdie --- meta/classes/staging.bbclass | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/meta/classes/staging.bbclass b/meta/classes/staging.bbclass index b8a14ff02e..71302b6e12 100644 --- a/meta/classes/staging.bbclass +++ b/meta/classes/staging.bbclass @@ -49,9 +49,10 @@ sysroot_stage_dir() { fi mkdir -p "$dest" + rdest=$(realpath --relative-to="$src" "$dest") ( cd $src - find . -print0 | cpio --null -pdlu $dest + find . -print0 | cpio --null -pdlu $rdest ) } -- cgit v1.2.3-54-g00ecf