summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch156
-rw-r--r--meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch43
-rw-r--r--meta/recipes-devtools/rsync/rsync_3.2.7.bb2
3 files changed, 201 insertions, 0 deletions
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
new file mode 100644
index 0000000000..d654067fab
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
@@ -0,0 +1,156 @@
1From 0902b52f6687b1f7952422080d50b93108742e53 Mon Sep 17 00:00:00 2001
2From: Wayne Davison <wayne@opencoder.net>
3Date: Tue, 29 Oct 2024 22:55:29 -0700
4Subject: [PATCH] Some checksum buffer fixes.
5
6- Put sum2_array into sum_struct to hold an array of sum2 checksums
7 that are each xfer_sum_len bytes.
8- Remove sum2 buf from sum_buf.
9- Add macro sum2_at() to access each sum2 array element.
10- Throw an error if a sums header has an s2length larger than
11 xfer_sum_len.
12
13CVE: CVE-2024-12084
14
15Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=0902b52f6687b1f7952422080d50b93108742e53]
16
17Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
18---
19 io.c | 3 ++-
20 match.c | 8 ++++----
21 rsync.c | 5 ++++-
22 rsync.h | 4 +++-
23 sender.c | 4 +++-
24 5 files changed, 16 insertions(+), 8 deletions(-)
25
26diff --git a/io.c b/io.c
27index a99ac0ec..bb60eeca 100644
28--- a/io.c
29+++ b/io.c
30@@ -55,6 +55,7 @@ extern int read_batch;
31 extern int compat_flags;
32 extern int protect_args;
33 extern int checksum_seed;
34+extern int xfer_sum_len;
35 extern int daemon_connection;
36 extern int protocol_version;
37 extern int remove_source_files;
38@@ -1977,7 +1978,7 @@ void read_sum_head(int f, struct sum_struct *sum)
39 exit_cleanup(RERR_PROTOCOL);
40 }
41 sum->s2length = protocol_version < 27 ? csum_length : (int)read_int(f);
42- if (sum->s2length < 0 || sum->s2length > MAX_DIGEST_LEN) {
43+ if (sum->s2length < 0 || sum->s2length > xfer_sum_len) {
44 rprintf(FERROR, "Invalid checksum length %d [%s]\n",
45 sum->s2length, who_am_i());
46 exit_cleanup(RERR_PROTOCOL);
47diff --git a/match.c b/match.c
48index cdb30a15..36e78ed2 100644
49--- a/match.c
50+++ b/match.c
51@@ -232,7 +232,7 @@ static void hash_search(int f,struct sum_struct *s,
52 done_csum2 = 1;
53 }
54
55- if (memcmp(sum2,s->sums[i].sum2,s->s2length) != 0) {
56+ if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0) {
57 false_alarms++;
58 continue;
59 }
60@@ -252,7 +252,7 @@ static void hash_search(int f,struct sum_struct *s,
61 if (i != aligned_i) {
62 if (sum != s->sums[aligned_i].sum1
63 || l != s->sums[aligned_i].len
64- || memcmp(sum2, s->sums[aligned_i].sum2, s->s2length) != 0)
65+ || memcmp(sum2, sum2_at(s, aligned_i), s->s2length) != 0)
66 goto check_want_i;
67 i = aligned_i;
68 }
69@@ -271,7 +271,7 @@ static void hash_search(int f,struct sum_struct *s,
70 if (sum != s->sums[i].sum1)
71 goto check_want_i;
72 get_checksum2((char *)map, l, sum2);
73- if (memcmp(sum2, s->sums[i].sum2, s->s2length) != 0)
74+ if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0)
75 goto check_want_i;
76 /* OK, we have a re-alignment match. Bump the offset
77 * forward to the new match point. */
78@@ -290,7 +290,7 @@ static void hash_search(int f,struct sum_struct *s,
79 && (!updating_basis_file || s->sums[want_i].offset >= offset
80 || s->sums[want_i].flags & SUMFLG_SAME_OFFSET)
81 && sum == s->sums[want_i].sum1
82- && memcmp(sum2, s->sums[want_i].sum2, s->s2length) == 0) {
83+ && memcmp(sum2, sum2_at(s, want_i), s->s2length) == 0) {
84 /* we've found an adjacent match - the RLL coder
85 * will be happy */
86 i = want_i;
87diff --git a/rsync.c b/rsync.c
88index cd288f57..b130aba5 100644
89--- a/rsync.c
90+++ b/rsync.c
91@@ -437,7 +437,10 @@ int read_ndx_and_attrs(int f_in, int f_out, int *iflag_ptr, uchar *type_ptr, cha
92 */
93 void free_sums(struct sum_struct *s)
94 {
95- if (s->sums) free(s->sums);
96+ if (s->sums) {
97+ free(s->sums);
98+ free(s->sum2_array);
99+ }
100 free(s);
101 }
102
103diff --git a/rsync.h b/rsync.h
104index d3709fe0..8ddbe702 100644
105--- a/rsync.h
106+++ b/rsync.h
107@@ -958,12 +958,12 @@ struct sum_buf {
108 uint32 sum1; /**< simple checksum */
109 int32 chain; /**< next hash-table collision */
110 short flags; /**< flag bits */
111- char sum2[SUM_LENGTH]; /**< checksum */
112 };
113
114 struct sum_struct {
115 OFF_T flength; /**< total file length */
116 struct sum_buf *sums; /**< points to info for each chunk */
117+ char *sum2_array; /**< checksums of length xfer_sum_len */
118 int32 count; /**< how many chunks */
119 int32 blength; /**< block_length */
120 int32 remainder; /**< flength % block_length */
121@@ -982,6 +982,8 @@ struct map_struct {
122 int status; /* first errno from read errors */
123 };
124
125+#define sum2_at(s, i) ((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
126+
127 #define NAME_IS_FILE (0) /* filter name as a file */
128 #define NAME_IS_DIR (1<<0) /* filter name as a dir */
129 #define NAME_IS_XATTR (1<<2) /* filter name as an xattr */
130diff --git a/sender.c b/sender.c
131index 3d4f052e..ab205341 100644
132--- a/sender.c
133+++ b/sender.c
134@@ -31,6 +31,7 @@ extern int log_before_transfer;
135 extern int stdout_format_has_i;
136 extern int logfile_format_has_i;
137 extern int want_xattr_optim;
138+extern int xfer_sum_len;
139 extern int csum_length;
140 extern int append_mode;
141 extern int copy_links;
142@@ -94,10 +95,11 @@ static struct sum_struct *receive_sums(int f)
143 return(s);
144
145 s->sums = new_array(struct sum_buf, s->count);
146+ s->sum2_array = new_array(char, s->count * xfer_sum_len);
147
148 for (i = 0; i < s->count; i++) {
149 s->sums[i].sum1 = read_int(f);
150- read_buf(f, s->sums[i].sum2, s->s2length);
151+ read_buf(f, sum2_at(s, i), s->s2length);
152
153 s->sums[i].offset = offset;
154 s->sums[i].flags = 0;
155--
1562.40.0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
new file mode 100644
index 0000000000..266b80c241
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
@@ -0,0 +1,43 @@
1From 42e2b56c4ede3ab164f9a5c6dae02aa84606a6c1 Mon Sep 17 00:00:00 2001
2From: Wayne Davison <wayne@opencoder.net>
3Date: Tue, 5 Nov 2024 11:01:03 -0800
4Subject: [PATCH] Another cast when multiplying integers.
5
6CVE: CVE-2024-12084
7
8Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=42e2b56c4ede3ab164f9a5c6dae02aa84606a6c1]
9
10Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
11---
12 rsync.h | 2 +-
13 sender.c | 2 +-
14 2 files changed, 2 insertions(+), 2 deletions(-)
15
16diff --git a/rsync.h b/rsync.h
17index 8ddbe702..0f9e277f 100644
18--- a/rsync.h
19+++ b/rsync.h
20@@ -982,7 +982,7 @@ struct map_struct {
21 int status; /* first errno from read errors */
22 };
23
24-#define sum2_at(s, i) ((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
25+#define sum2_at(s, i) ((s)->sum2_array + ((size_t)(i) * xfer_sum_len))
26
27 #define NAME_IS_FILE (0) /* filter name as a file */
28 #define NAME_IS_DIR (1<<0) /* filter name as a dir */
29diff --git a/sender.c b/sender.c
30index ab205341..2bbff2fa 100644
31--- a/sender.c
32+++ b/sender.c
33@@ -95,7 +95,7 @@ static struct sum_struct *receive_sums(int f)
34 return(s);
35
36 s->sums = new_array(struct sum_buf, s->count);
37- s->sum2_array = new_array(char, s->count * xfer_sum_len);
38+ s->sum2_array = new_array(char, (size_t)s->count * xfer_sum_len);
39
40 for (i = 0; i < s->count; i++) {
41 s->sums[i].sum1 = read_int(f);
42--
432.40.0
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.7.bb b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
index 130581a785..2f3ea61978 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.7.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
@@ -15,6 +15,8 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
15 file://makefile-no-rebuild.patch \ 15 file://makefile-no-rebuild.patch \
16 file://determism.patch \ 16 file://determism.patch \
17 file://0001-Add-missing-prototypes-to-function-declarations.patch \ 17 file://0001-Add-missing-prototypes-to-function-declarations.patch \
18 file://CVE-2024-12084-0001.patch \
19 file://CVE-2024-12084-0002.patch \
18 " 20 "
19SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb" 21SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"
20 22
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-01 21:23:46 +0000