From bca7285d84c53c846f8598083d1c94f672429a7f Mon Sep 17 00:00:00 2001 From: "yanjun.zhu" Date: Fri, 30 Nov 2012 19:41:23 +0800 Subject: squashfs: fix for CVE-2012-4024 Reference:http://squashfs.git.sourceforge.net/git/gitweb.cgi?p= squashfs/squashfs;a=commit;h=19c38fba0be1ce949ab44310d7f49887576cc123 Fix potential stack overflow in get_component() where an individual pathname component in an extract file (specified on the command line or in an extract file) could exceed the 1024 byte sized targname allocated on the stack. Fix by dynamically allocating targname rather than storing it as a fixed size on the stack. [YOCTO #3513] (From OE-Core rev: 972ea6c674e10cf23bedbbc581b78baa3f7c7b9b) Signed-off-by: yanjun.zhu Signed-off-by: Richard Purdie --- meta/recipes-devtools/squashfs-tools/squashfs-tools_4.2.bb | 3 +++ 1 file changed, 3 insertions(+) (limited to 'meta/recipes-devtools/squashfs-tools/squashfs-tools_4.2.bb') diff --git a/meta/recipes-devtools/squashfs-tools/squashfs-tools_4.2.bb b/meta/recipes-devtools/squashfs-tools/squashfs-tools_4.2.bb index c54081be9f..9922f1ef51 100644 --- a/meta/recipes-devtools/squashfs-tools/squashfs-tools_4.2.bb +++ b/meta/recipes-devtools/squashfs-tools/squashfs-tools_4.2.bb @@ -3,6 +3,7 @@ DESCRIPTION = "Tools to manipulate Squashfs filesystems." SECTION = "base" LICENSE = "GPL-2 & PD" +FILESEXTRAPATHS_prepend := "${THISDIR}/patches:" LIC_FILES_CHKSUM = "file://../COPYING;md5=0636e73ff0215e8d672dc4c32c317bb3 \ file://../../7zC.txt;beginline=12;endline=16;md5=2056cd6d919ebc3807602143c7449a7c \ " @@ -12,6 +13,8 @@ PR = "1" SRC_URI = "${SOURCEFORGE_MIRROR}/squashfs/squashfs${PV}.tar.gz;name=squashfs \ http://downloads.sourceforge.net/sevenzip/lzma465.tar.bz2;name=lzma \ " +SRC_URI += "file://squashfs-4.2-fix-CVE-2012-4024.patch \ + " SRC_URI[squashfs.md5sum] = "1b7a781fb4cf8938842279bd3e8ee852" SRC_URI[squashfs.sha256sum] = "d9e0195aa922dbb665ed322b9aaa96e04a476ee650f39bbeadb0d00b24022e96" SRC_URI[lzma.md5sum] = "29d5ffd03a5a3e51aef6a74e9eafb759" -- cgit v1.2.3-54-g00ecf