From 54dd30e514412198734e8ddf56fca98f078e4fc1 Mon Sep 17 00:00:00 2001 From: "yanjun.zhu" Date: Tue, 11 Dec 2012 18:00:32 +0800 Subject: squashfs: fix CVE-2012-4025 CQID:WIND00366813 Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi? p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025 (From OE-Core rev: 4493173c1ab7a0528e0c74935a105e474521ed1c) Signed-off-by: yanjun.zhu [YOCTO #3564] Signed-off-by: Saul Wold Signed-off-by: Richard Purdie --- ...dd-a-commment-and-fix-some-other-comments.patch | 38 ++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch (limited to 'meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch') diff --git a/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch new file mode 100644 index 0000000000..fa075f9e7d --- /dev/null +++ b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch @@ -0,0 +1,38 @@ +Upstream-Status: Backport + +unsquashfs: add a commment and fix some other comments + +Signed-off-by: yanjun.zhu + +diff -urpN a/unsquashfs.c b/unsquashfs.c +--- a/unsquashfs.c 2012-11-30 15:27:14.000000000 +0800 ++++ b/unsquashfs.c 2012-11-30 15:27:56.000000000 +0800 +@@ -814,7 +814,7 @@ int write_file(struct inode *inode, char + + /* + * the writer thread is queued a squashfs_file structure describing the +- * file. If the file has one or more blocks or a fragments they are ++ * file. If the file has one or more blocks or a fragment they are + * queued separately (references to blocks in the cache). + */ + file->fd = file_fd; +@@ -838,7 +838,7 @@ int write_file(struct inode *inode, char + block->offset = 0; + block->size = i == file_end ? inode->data & (block_size - 1) : + block_size; +- if(block_list[i] == 0) /* sparse file */ ++ if(block_list[i] == 0) /* sparse block */ + block->buffer = NULL; + else { + block->buffer = cache_get(data_cache, start, +@@ -2161,6 +2161,10 @@ options: + block_size = sBlk.s.block_size; + block_log = sBlk.s.block_log; + ++ /* ++ * convert from queue size in Mbytes to queue size in ++ * blocks ++ */ + fragment_buffer_size <<= 20 - block_log; + data_buffer_size <<= 20 - block_log; + initialise_threads(fragment_buffer_size, data_buffer_size); -- cgit v1.2.3-54-g00ecf