summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-extended/libarchive/libarchive/0001-Set-xattrs-after-setting-times.patch59
-rw-r--r--meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2013-0211.patch39
-rw-r--r--meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2015-2304.patch152
-rw-r--r--meta/recipes-extended/libarchive/libarchive/mkdir.patch45
-rw-r--r--meta/recipes-extended/libarchive/libarchive/pkgconfig.patch25
-rw-r--r--meta/recipes-extended/libarchive/libarchive_3.2.0.bb (renamed from meta/recipes-extended/libarchive/libarchive_3.1.2.bb)11
6 files changed, 3 insertions, 328 deletions
diff --git a/meta/recipes-extended/libarchive/libarchive/0001-Set-xattrs-after-setting-times.patch b/meta/recipes-extended/libarchive/libarchive/0001-Set-xattrs-after-setting-times.patch
deleted file mode 100644
index 6d74e867e6..0000000000
--- a/meta/recipes-extended/libarchive/libarchive/0001-Set-xattrs-after-setting-times.patch
+++ /dev/null
@@ -1,59 +0,0 @@
1From 545ded56095c570426fe102ff2192889681ea75c Mon Sep 17 00:00:00 2001
2From: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
3Date: Mon, 29 Feb 2016 14:38:25 +0200
4Subject: [PATCH] Set xattrs after setting times
5
6With Integrity Measurement Architecture (IMA) enabled in Linux
7kernel the security.ima extended attribute gets overwritten
8when setting times on a file with a futimens() call. So it's safer
9to set xattrs after times.
10
11Upstream-Status: Submitted [https://github.com/libarchive/libarchive/pull/664]
12
13Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
14
15---
16 libarchive/archive_write_disk_posix.c | 21 +++++++++++----------
17 1 file changed, 11 insertions(+), 10 deletions(-)
18
19diff --git a/libarchive/archive_write_disk_posix.c b/libarchive/archive_write_disk_posix.c
20index 0fc6193..27c9c1e 100644
21--- a/libarchive/archive_write_disk_posix.c
22+++ b/libarchive/archive_write_disk_posix.c
23@@ -1620,16 +1620,6 @@ _archive_write_disk_finish_entry(struct archive *_a)
24 }
25
26 /*
27- * Security-related extended attributes (such as
28- * security.capability on Linux) have to be restored last,
29- * since they're implicitly removed by other file changes.
30- */
31- if (a->todo & TODO_XATTR) {
32- int r2 = set_xattrs(a);
33- if (r2 < ret) ret = r2;
34- }
35-
36- /*
37 * Some flags prevent file modification; they must be restored after
38 * file contents are written.
39 */
40@@ -1648,6 +1638,17 @@ _archive_write_disk_finish_entry(struct archive *_a)
41 }
42
43 /*
44+ * Security-related extended attributes (such as
45+ * security.capability or security.ima on Linux) have to be restored last,
46+ * since they're implicitly removed by other file changes like setting
47+ * times.
48+ */
49+ if (a->todo & TODO_XATTR) {
50+ int r2 = set_xattrs(a);
51+ if (r2 < ret) ret = r2;
52+ }
53+
54+ /*
55 * Mac extended metadata includes ACLs.
56 */
57 if (a->todo & TODO_MAC_METADATA) {
58--
592.5.0
diff --git a/meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2013-0211.patch b/meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2013-0211.patch
deleted file mode 100644
index 19523f4b89..0000000000
--- a/meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2013-0211.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1From 2f55d6bd308ea61975558c2469ae349dba297e89 Mon Sep 17 00:00:00 2001
2From: Robert Yang <liezhi.yang@windriver.com>
3Date: Sat, 22 Feb 2014 14:35:59 +0800
4Subject: [PATCH] Fix CVE-2013-0211
5
6This patch comes from:https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4
7
8Upstream-Status: Backport
9CVE: CVE-2013-0211
10
11Signed-off-by: Baogen shang <baogen.shang@windriver.com>
12
13Update the patch because of uprev on 20140222
14
15Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
16---
17 libarchive/archive_write.c | 4 ++++
18 1 file changed, 4 insertions(+)
19
20diff --git a/libarchive/archive_write.c b/libarchive/archive_write.c
21index a3d1a33..a323588 100644
22--- a/libarchive/archive_write.c
23+++ b/libarchive/archive_write.c
24@@ -671,8 +671,12 @@ static ssize_t
25 _archive_write_data(struct archive *_a, const void *buff, size_t s)
26 {
27 struct archive_write *a = (struct archive_write *)_a;
28+ const size_t max_write = INT_MAX;
29 archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC,
30 ARCHIVE_STATE_DATA, "archive_write_data");
31+ /* In particular, this catches attempts to pass negative values. */
32+ if (s > max_write)
33+ s = max_write;
34 archive_clear_error(&a->archive);
35 return ((a->format_write_data)(a, buff, s));
36 }
37--
381.8.2.1
39
diff --git a/meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2015-2304.patch b/meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2015-2304.patch
deleted file mode 100644
index 5c24396354..0000000000
--- a/meta/recipes-extended/libarchive/libarchive/libarchive-CVE-2015-2304.patch
+++ /dev/null
@@ -1,152 +0,0 @@
1From 59357157706d47c365b2227739e17daba3607526 Mon Sep 17 00:00:00 2001
2From: Alessandro Ghedini <alessandro@ghedini.me>
3Date: Sun, 1 Mar 2015 12:07:45 +0100
4Subject: [PATCH] Add ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS option
5
6This fixes a directory traversal in the cpio tool.
7
8
9Upstream-Status: backport
10CVE: CVE-2015-2304
11
12Signed-off-by: Li Zhou <li.zhou@windriver.com>
13---
14 cpio/bsdcpio.1 | 3 ++-
15 cpio/cpio.c | 2 ++
16 libarchive/archive.h | 2 ++
17 libarchive/archive_write_disk.3 | 3 +++
18 libarchive/archive_write_disk_posix.c | 14 +++++++++++---
19 libarchive/test/test_write_disk_secure.c | 23 +++++++++++++++++++++++
20 6 files changed, 43 insertions(+), 4 deletions(-)
21
22diff --git a/cpio/bsdcpio.1 b/cpio/bsdcpio.1
23index f966aa0..e52546e 100644
24--- a/cpio/bsdcpio.1
25+++ b/cpio/bsdcpio.1
26@@ -156,7 +156,8 @@ See above for description.
27 .It Fl Fl insecure
28 (i and p mode only)
29 Disable security checks during extraction or copying.
30-This allows extraction via symbolic links and path names containing
31+This allows extraction via symbolic links, absolute paths,
32+and path names containing
33 .Sq ..
34 in the name.
35 .It Fl J , Fl Fl xz
36diff --git a/cpio/cpio.c b/cpio/cpio.c
37index 0acde11..b267e9b 100644
38--- a/cpio/cpio.c
39+++ b/cpio/cpio.c
40@@ -171,6 +171,7 @@ main(int argc, char *argv[])
41 cpio->extract_flags |= ARCHIVE_EXTRACT_NO_OVERWRITE_NEWER;
42 cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_SYMLINKS;
43 cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;
44+ cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS;
45 cpio->extract_flags |= ARCHIVE_EXTRACT_PERM;
46 cpio->extract_flags |= ARCHIVE_EXTRACT_FFLAGS;
47 cpio->extract_flags |= ARCHIVE_EXTRACT_ACL;
48@@ -256,6 +257,7 @@ main(int argc, char *argv[])
49 case OPTION_INSECURE:
50 cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_SYMLINKS;
51 cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_NODOTDOT;
52+ cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS;
53 break;
54 case 'L': /* GNU cpio */
55 cpio->option_follow_links = 1;
56diff --git a/libarchive/archive.h b/libarchive/archive.h
57index 1f0fc38..ef635ac 100644
58--- a/libarchive/archive.h
59+++ b/libarchive/archive.h
60@@ -649,6 +649,8 @@ __LA_DECL int archive_read_set_passphrase_callback(struct archive *,
61 /* Default: Do not use HFS+ compression if it was not compressed. */
62 /* This has no effect except on Mac OS v10.6 or later. */
63 #define ARCHIVE_EXTRACT_HFS_COMPRESSION_FORCED (0x8000)
64+/* Default: Do not reject entries with absolute paths */
65+#define ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS (0x10000)
66
67 __LA_DECL int archive_read_extract(struct archive *, struct archive_entry *,
68 int flags);
69diff --git a/libarchive/archive_write_disk.3 b/libarchive/archive_write_disk.3
70index fa925cc..a2e7afa 100644
71--- a/libarchive/archive_write_disk.3
72+++ b/libarchive/archive_write_disk.3
73@@ -177,6 +177,9 @@ The default is to not refuse such paths.
74 Note that paths ending in
75 .Pa ..
76 always cause an error, regardless of this flag.
77+.It Cm ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS
78+Refuse to extract an absolute path.
79+The default is to not refuse such paths.
80 .It Cm ARCHIVE_EXTRACT_SPARSE
81 Scan data for blocks of NUL bytes and try to recreate them with holes.
82 This results in sparse files, independent of whether the archive format
83diff --git a/libarchive/archive_write_disk_posix.c b/libarchive/archive_write_disk_posix.c
84index ab3bdac..c1290eb 100644
85--- a/libarchive/archive_write_disk_posix.c
86+++ b/libarchive/archive_write_disk_posix.c
87@@ -2509,8 +2509,9 @@ cleanup_pathname_win(struct archive_write_disk *a)
88 /*
89 * Canonicalize the pathname. In particular, this strips duplicate
90 * '/' characters, '.' elements, and trailing '/'. It also raises an
91- * error for an empty path, a trailing '..' or (if _SECURE_NODOTDOT is
92- * set) any '..' in the path.
93+ * error for an empty path, a trailing '..', (if _SECURE_NODOTDOT is
94+ * set) any '..' in the path or (if ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS
95+ * is set) if the path is absolute.
96 */
97 static int
98 cleanup_pathname(struct archive_write_disk *a)
99@@ -2529,8 +2530,15 @@ cleanup_pathname(struct archive_write_disk *a)
100 cleanup_pathname_win(a);
101 #endif
102 /* Skip leading '/'. */
103- if (*src == '/')
104+ if (*src == '/') {
105+ if (a->flags & ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS) {
106+ archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
107+ "Path is absolute");
108+ return (ARCHIVE_FAILED);
109+ }
110+
111 separator = *src++;
112+ }
113
114 /* Scan the pathname one element at a time. */
115 for (;;) {
116diff --git a/libarchive/test/test_write_disk_secure.c b/libarchive/test/test_write_disk_secure.c
117index 31c5bfd..2c94206 100644
118--- a/libarchive/test/test_write_disk_secure.c
119+++ b/libarchive/test/test_write_disk_secure.c
120@@ -178,6 +178,29 @@ DEFINE_TEST(test_write_disk_secure)
121 assert(S_ISDIR(st.st_mode));
122 archive_entry_free(ae);
123
124+ /*
125+ * Without security checks, we should be able to
126+ * extract an absolute path.
127+ */
128+ assert((ae = archive_entry_new()) != NULL);
129+ archive_entry_copy_pathname(ae, "/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
130+ archive_entry_set_mode(ae, S_IFREG | 0777);
131+ assert(0 == archive_write_header(a, ae));
132+ assert(0 == archive_write_finish_entry(a));
133+ assertFileExists("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
134+ assert(0 == unlink("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp"));
135+
136+ /* But with security checks enabled, this should fail. */
137+ assert(archive_entry_clear(ae) != NULL);
138+ archive_entry_copy_pathname(ae, "/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
139+ archive_entry_set_mode(ae, S_IFREG | 0777);
140+ archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS);
141+ failure("Extracting an absolute path should fail here.");
142+ assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
143+ archive_entry_free(ae);
144+ assert(0 == archive_write_finish_entry(a));
145+ assertFileNotExists("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
146+
147 assertEqualInt(ARCHIVE_OK, archive_write_free(a));
148
149 /* Test the entries on disk. */
150--
1511.7.9.5
152
diff --git a/meta/recipes-extended/libarchive/libarchive/mkdir.patch b/meta/recipes-extended/libarchive/libarchive/mkdir.patch
deleted file mode 100644
index 509a2957a5..0000000000
--- a/meta/recipes-extended/libarchive/libarchive/mkdir.patch
+++ /dev/null
@@ -1,45 +0,0 @@
1Add missing mkdir calls so that out-of-tree builds work.
2
3Upstream-Status: Submitted (https://github.com/libarchive/libarchive/pull/534)
4Signed-off-by: Ross Burton <ross.burton@intel.com>
5
6diff --git a/Makefile.am b/Makefile.am
7index 3fa2d22..5ecca52 100644
8--- a/Makefile.am
9+++ b/Makefile.am
10@@ -508,6 +508,7 @@ libarchive_test_LDADD= $(LTLIBICONV)
11 # Building it automatically provides a sanity-check on libarchive_test_SOURCES
12 # above.
13 libarchive/test/list.h: Makefile
14+ $(MKDIR_P) libarchive/test
15 cat $(top_srcdir)/libarchive/test/test_*.c | grep DEFINE_TEST > libarchive/test/list.h
16
17 libarchive_TESTS_ENVIRONMENT= LIBARCHIVE_TEST_FILES=`cd $(top_srcdir);/bin/pwd`/libarchive/test LRZIP=NOCONFIG
18@@ -835,6 +836,7 @@ bsdtar_test_CPPFLAGS=\
19 $(PLATFORMCPPFLAGS)
20
21 tar/test/list.h: Makefile
22+ $(MKDIR_P) tar/test
23 cat $(top_srcdir)/tar/test/test_*.c | grep DEFINE_TEST > tar/test/list.h
24
25 if BUILD_BSDTAR
26@@ -975,6 +977,7 @@ bsdcpio_test_CPPFLAGS= \
27 bsdcpio_test_LDADD=libarchive_fe.la
28
29 cpio/test/list.h: Makefile
30+ $(MKDIR_P) cpio/test
31 cat $(top_srcdir)/cpio/test/test_*.c | grep DEFINE_TEST > cpio/test/list.h
32
33 if BUILD_BSDCPIO
34diff --git a/configure.ac b/configure.ac
35index 38bd299..7bdb00c 100644
36--- a/configure.ac
37+++ b/configure.ac
38@@ -102,6 +102,7 @@ AC_USE_SYSTEM_EXTENSIONS
39 AC_LIBTOOL_WIN32_DLL
40 AC_PROG_LIBTOOL
41 AC_CHECK_TOOL([STRIP],[strip])
42+AC_PROG_MKDIR_P
43
44 #
45 # Options for building bsdtar.
diff --git a/meta/recipes-extended/libarchive/libarchive/pkgconfig.patch b/meta/recipes-extended/libarchive/libarchive/pkgconfig.patch
deleted file mode 100644
index 346af91351..0000000000
--- a/meta/recipes-extended/libarchive/libarchive/pkgconfig.patch
+++ /dev/null
@@ -1,25 +0,0 @@
1Use pkg-config for the libxml2 dependency, not the -config script.
2
3Upstream-Status: Pending
4
5RP 2014/5/22
6
7Index: libarchive-3.1.2/configure.ac
8===================================================================
9--- libarchive-3.1.2.orig/configure.ac 2013-02-09 17:23:03.000000000 +0000
10+++ libarchive-3.1.2/configure.ac 2014-05-13 15:26:45.446499108 +0000
11@@ -329,10 +329,10 @@
12 AS_HELP_STRING([--without-expat], [Don't build support for xar through expat]))
13
14 if test "x$with_xml2" != "xno"; then
15- AC_PATH_PROG([XML2_CONFIG], [xml2-config],, [${PATH}])
16- if test "x$XML2_CONFIG" != "x"; then
17- CPPFLAGS="${CPPFLAGS} `${XML2_CONFIG} --cflags`"
18- LIBS="${LIBS} `${XML2_CONFIG} --libs`"
19+ PKG_CHECK_MODULES(PKG_XML2, [libxml-2.0],,)
20+ if test "x$PKG_XML2_CFLAGS" != "x"; then
21+ CPPFLAGS="${CPPFLAGS} ${PKG_XML2_CFLAGS}"
22+ LIBS="${LIBS} ${PKG_XML2_LIBS}"
23 AC_CHECK_LIB(xml2,xmlInitParser,[true],AC_MSG_FAILURE(Missing xml2 library))
24 else
25 AC_CHECK_LIB(xml2,xmlInitParser)
diff --git a/meta/recipes-extended/libarchive/libarchive_3.1.2.bb b/meta/recipes-extended/libarchive/libarchive_3.2.0.bb
index ed677ac318..e1f0202931 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.1.2.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.2.0.bb
@@ -3,7 +3,7 @@ DESCRIPTION = "C library and command-line tools for reading and writing tar, cpi
3HOMEPAGE = "http://www.libarchive.org/" 3HOMEPAGE = "http://www.libarchive.org/"
4SECTION = "devel" 4SECTION = "devel"
5LICENSE = "BSD" 5LICENSE = "BSD"
6LIC_FILES_CHKSUM = "file://COPYING;md5=b4e3ffd607d6686c6cb2f63394370841" 6LIC_FILES_CHKSUM = "file://COPYING;md5=ed99aca006bc346974bb745a35336425"
7 7
8DEPENDS = "e2fsprogs-native" 8DEPENDS = "e2fsprogs-native"
9 9
@@ -31,15 +31,10 @@ PACKAGECONFIG[lzo] = "--with-lzo2,--without-lzo2,lzo,"
31PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle," 31PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle,"
32 32
33SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ 33SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
34 file://libarchive-CVE-2013-0211.patch \
35 file://pkgconfig.patch \
36 file://libarchive-CVE-2015-2304.patch \
37 file://mkdir.patch \
38 file://0001-Set-xattrs-after-setting-times.patch \
39 " 34 "
40 35
41SRC_URI[md5sum] = "efad5a503f66329bb9d2f4308b5de98a" 36SRC_URI[md5sum] = "596210b5a9c2ff74a0f7ca34838d655f"
42SRC_URI[sha256sum] = "eb87eacd8fe49e8d90c8fdc189813023ccc319c5e752b01fb6ad0cc7b2c53d5e" 37SRC_URI[sha256sum] = "7bce45fd71ff01dc20d19edd78322d4965583d81b8bed8e26cacb65d6f5baa87"
43 38
44inherit autotools update-alternatives pkgconfig 39inherit autotools update-alternatives pkgconfig
45 40
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-15 10:48:07 +0000