From c5463adc43bacaa0a8cbbeb32b4b02554186e3e1 Mon Sep 17 00:00:00 2001 From: Anuj Mittal Date: Wed, 21 Aug 2019 09:58:16 +0800 Subject: rsync: fix CVEs for included zlib rsync includes its own copy of zlib and doesn't recommend linking with the system version [1]. Import CVE fixes that impact zlib version 1.2.8 [2] that is currently used by rsync. [1] https://git.samba.org/rsync.git/?p=rsync.git;a=blob;f=zlib/README.rsync [2] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3agnu%3azlib%3a1.2.8 (From OE-Core rev: a55fbb4cb489853dfb0b4553f6e187c3f3633f48) (From OE-Core rev: 93ce13106abc05f4a68a6265590e3770f0bf49a2) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../rsync/files/CVE-2016-9842.patch | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 meta/recipes-devtools/rsync/files/CVE-2016-9842.patch (limited to 'meta/recipes-devtools/rsync/files/CVE-2016-9842.patch') diff --git a/meta/recipes-devtools/rsync/files/CVE-2016-9842.patch b/meta/recipes-devtools/rsync/files/CVE-2016-9842.patch new file mode 100644 index 0000000000..810d8a3fdb --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2016-9842.patch @@ -0,0 +1,33 @@ +From e54e1299404101a5a9d0cf5e45512b543967f958 Mon Sep 17 00:00:00 2001 +From: Mark Adler +Date: Sat, 5 Sep 2015 17:45:55 -0700 +Subject: [PATCH] Avoid shifts of negative values inflateMark(). + +The C standard says that bit shifts of negative integers is +undefined. This casts to unsigned values to assure a known +result. + +CVE: CVE-2016-9842 +Upstream-Status: Backport +Signed-off-by: Anuj Mittal +--- + inflate.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/zlib/inflate.c b/zlib/inflate.c +index 2889e3a0..a7184167 100644 +--- a/zlib/inflate.c ++++ b/zlib/inflate.c +@@ -1506,9 +1506,10 @@ z_streamp strm; + { + struct inflate_state FAR *state; + +- if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16; ++ if (strm == Z_NULL || strm->state == Z_NULL) ++ return (long)(((unsigned long)0 - 1) << 16); + state = (struct inflate_state FAR *)strm->state; +- return ((long)(state->back) << 16) + ++ return (long)(((unsigned long)((long)state->back)) << 16) + + (state->mode == COPY ? state->length : + (state->mode == MATCH ? state->was - state->length : 0)); + } -- cgit v1.2.3-54-g00ecf