From de1fac5dd7af7b774775151381ae33e28d9ee4f3 Mon Sep 17 00:00:00 2001 From: Wang Mingyu Date: Mon, 20 Jan 2020 04:26:44 -0800 Subject: file: upgrade 5.37 -> 5.38 CVE-2019-18218.patch Removed since it is included in 5.38. (From OE-Core rev: 2ac297f8906354bf3a1578b5e78df040b4712b81) Signed-off-by: Wang Mingyu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- .../file/file/CVE-2019-18218.patch | 55 ---------------------- meta/recipes-devtools/file/file_5.37.bb | 50 -------------------- meta/recipes-devtools/file/file_5.38.bb | 49 +++++++++++++++++++ 3 files changed, 49 insertions(+), 105 deletions(-) delete mode 100644 meta/recipes-devtools/file/file/CVE-2019-18218.patch delete mode 100644 meta/recipes-devtools/file/file_5.37.bb create mode 100644 meta/recipes-devtools/file/file_5.38.bb diff --git a/meta/recipes-devtools/file/file/CVE-2019-18218.patch b/meta/recipes-devtools/file/file/CVE-2019-18218.patch deleted file mode 100644 index 3d02c5ad4b..0000000000 --- a/meta/recipes-devtools/file/file/CVE-2019-18218.patch +++ /dev/null @@ -1,55 +0,0 @@ -cdf_read_property_info in cdf.c in file through 5.37 does not restrict the -number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte -out-of-bounds write). - -CVE: CVE-2019-18218 -Upstream-Status: Backport -Signed-off-by: Ross Burton - -From 46a8443f76cec4b41ec736eca396984c74664f84 Mon Sep 17 00:00:00 2001 -From: Christos Zoulas -Date: Mon, 26 Aug 2019 14:31:39 +0000 -Subject: [PATCH] Limit the number of elements in a vector (found by oss-fuzz) - ---- - src/cdf.c | 9 ++++----- - src/cdf.h | 1 + - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/src/cdf.c b/src/cdf.c -index 9d6396742..bb81d6374 100644 ---- a/src/cdf.c -+++ b/src/cdf.c -@@ -1016,8 +1016,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, - goto out; - } - nelements = CDF_GETUINT32(q, 1); -- if (nelements == 0) { -- DPRINTF(("CDF_VECTOR with nelements == 0\n")); -+ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) { -+ DPRINTF(("CDF_VECTOR with nelements == %" -+ SIZE_T_FORMAT "u\n", nelements)); - goto out; - } - slen = 2; -@@ -1060,8 +1061,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, - goto out; - inp += nelem; - } -- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", -- nelements)); - for (j = 0; j < nelements && i < sh.sh_properties; - j++, i++) - { -diff --git a/src/cdf.h b/src/cdf.h -index 2f7e554b7..05056668f 100644 ---- a/src/cdf.h -+++ b/src/cdf.h -@@ -48,6 +48,7 @@ - typedef int32_t cdf_secid_t; - - #define CDF_LOOP_LIMIT 10000 -+#define CDF_ELEMENT_LIMIT 100000 - - #define CDF_SECID_NULL 0 - #define CDF_SECID_FREE -1 diff --git a/meta/recipes-devtools/file/file_5.37.bb b/meta/recipes-devtools/file/file_5.37.bb deleted file mode 100644 index a96ccc0d39..0000000000 --- a/meta/recipes-devtools/file/file_5.37.bb +++ /dev/null @@ -1,50 +0,0 @@ -SUMMARY = "File classification tool" -DESCRIPTION = "File attempts to classify files depending \ -on their contents and prints a description if a match is found." -HOMEPAGE = "http://www.darwinsys.com/file/" -SECTION = "console/utils" - -# two clause BSD -LICENSE = "BSD-2-Clause" -LIC_FILES_CHKSUM = "file://COPYING;beginline=2;md5=0251eaec1188b20d9a72c502ecfdda1b" - -DEPENDS = "zlib file-replacement-native" -DEPENDS_class-native = "zlib-native" - -SRC_URI = "git://github.com/file/file.git \ - file://CVE-2019-18218.patch" - -SRCREV = "a0d5b0e4e9f97d74a9911e95cedd579852e25398" -S = "${WORKDIR}/git" - -inherit autotools update-alternatives - -EXTRA_OECONF += "--disable-libseccomp" - -ALTERNATIVE_${PN} = "file" -ALTERNATIVE_LINK_NAME[file] = "${bindir}/file" - -EXTRA_OEMAKE_append_class-target = "-e FILE_COMPILE=${STAGING_BINDIR_NATIVE}/file-native/file" -EXTRA_OEMAKE_append_class-nativesdk = "-e FILE_COMPILE=${STAGING_BINDIR_NATIVE}/file-native/file" - -FILES_${PN} += "${datadir}/misc/*.mgc" - -do_compile_append_class-native() { - oe_runmake check -} - -do_install_append_class-native() { - create_cmdline_wrapper ${D}/${bindir}/file \ - --magic-file ${datadir}/misc/magic.mgc -} - -do_install_append_class-nativesdk() { - create_cmdline_wrapper ${D}/${bindir}/file \ - --magic-file ${datadir}/misc/magic.mgc -} - -BBCLASSEXTEND = "native nativesdk" -PROVIDES_append_class-native = " file-replacement-native" -# Don't use NATIVE_PACKAGE_PATH_SUFFIX as that hides libmagic from anyone who -# depends on file-replacement-native. -bindir_append_class-native = "/file-native" diff --git a/meta/recipes-devtools/file/file_5.38.bb b/meta/recipes-devtools/file/file_5.38.bb new file mode 100644 index 0000000000..99c75988c2 --- /dev/null +++ b/meta/recipes-devtools/file/file_5.38.bb @@ -0,0 +1,49 @@ +SUMMARY = "File classification tool" +DESCRIPTION = "File attempts to classify files depending \ +on their contents and prints a description if a match is found." +HOMEPAGE = "http://www.darwinsys.com/file/" +SECTION = "console/utils" + +# two clause BSD +LICENSE = "BSD-2-Clause" +LIC_FILES_CHKSUM = "file://COPYING;beginline=2;md5=0251eaec1188b20d9a72c502ecfdda1b" + +DEPENDS = "zlib file-replacement-native" +DEPENDS_class-native = "zlib-native" + +SRC_URI = "git://github.com/file/file.git" + +SRCREV = "ec41083645689a787cdd00cb3b5bf578aa79e46c" +S = "${WORKDIR}/git" + +inherit autotools update-alternatives + +EXTRA_OECONF += "--disable-libseccomp" + +ALTERNATIVE_${PN} = "file" +ALTERNATIVE_LINK_NAME[file] = "${bindir}/file" + +EXTRA_OEMAKE_append_class-target = "-e FILE_COMPILE=${STAGING_BINDIR_NATIVE}/file-native/file" +EXTRA_OEMAKE_append_class-nativesdk = "-e FILE_COMPILE=${STAGING_BINDIR_NATIVE}/file-native/file" + +FILES_${PN} += "${datadir}/misc/*.mgc" + +do_compile_append_class-native() { + oe_runmake check +} + +do_install_append_class-native() { + create_cmdline_wrapper ${D}/${bindir}/file \ + --magic-file ${datadir}/misc/magic.mgc +} + +do_install_append_class-nativesdk() { + create_cmdline_wrapper ${D}/${bindir}/file \ + --magic-file ${datadir}/misc/magic.mgc +} + +BBCLASSEXTEND = "native nativesdk" +PROVIDES_append_class-native = " file-replacement-native" +# Don't use NATIVE_PACKAGE_PATH_SUFFIX as that hides libmagic from anyone who +# depends on file-replacement-native. +bindir_append_class-native = "/file-native" -- cgit v1.2.3-54-g00ecf