summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch
diff options
context:
space:
mode:
authoryanjun.zhu <yanjun.zhu@windriver.com>2012-12-11 10:00:32 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2013-01-03 12:34:25 (GMT)
commita86e32a18b542c2c3c5ce0faf5b162fc6c2ebd50 (patch)
tree974bfda48f23773723b23652f1d0edc927aa799d /meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch
parent156c2554b76cde2d6d9350aaaf9848986201375d (diff)
downloadpoky-a86e32a18b542c2c3c5ce0faf5b162fc6c2ebd50.tar.gz
squashfs: fix CVE-2012-4025
CQID:WIND00366813 Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi? p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025 (From OE-Core rev: e6fddd1961061895e9335fa94b636163efdc9caa) Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> [YOCTO #3564] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch')
-rw-r--r--meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch38
1 files changed, 38 insertions, 0 deletions
diff --git a/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch
new file mode 100644
index 0000000..fa075f9
--- /dev/null
+++ b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch
@@ -0,0 +1,38 @@
1Upstream-Status: Backport
2
3unsquashfs: add a commment and fix some other comments
4
5Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
6
7diff -urpN a/unsquashfs.c b/unsquashfs.c
8--- a/unsquashfs.c 2012-11-30 15:27:14.000000000 +0800
9+++ b/unsquashfs.c 2012-11-30 15:27:56.000000000 +0800
10@@ -814,7 +814,7 @@ int write_file(struct inode *inode, char
11
12 /*
13 * the writer thread is queued a squashfs_file structure describing the
14- * file. If the file has one or more blocks or a fragments they are
15+ * file. If the file has one or more blocks or a fragment they are
16 * queued separately (references to blocks in the cache).
17 */
18 file->fd = file_fd;
19@@ -838,7 +838,7 @@ int write_file(struct inode *inode, char
20 block->offset = 0;
21 block->size = i == file_end ? inode->data & (block_size - 1) :
22 block_size;
23- if(block_list[i] == 0) /* sparse file */
24+ if(block_list[i] == 0) /* sparse block */
25 block->buffer = NULL;
26 else {
27 block->buffer = cache_get(data_cache, start,
28@@ -2161,6 +2161,10 @@ options:
29 block_size = sBlk.s.block_size;
30 block_log = sBlk.s.block_log;
31
32+ /*
33+ * convert from queue size in Mbytes to queue size in
34+ * blocks
35+ */
36 fragment_buffer_size <<= 20 - block_log;
37 data_buffer_size <<= 20 - block_log;
38 initialise_threads(fragment_buffer_size, data_buffer_size);