diff options
| author |   Catalin Enache <catalin.enache@windriver.com> | 2016-01-27 18:22:21 +0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2016-01-29 18:14:54 +0000 |
| commit | 562310ac906ffc4a7f1be5fce6e2e8395724fcff (patch) | |
| tree | 6a61586ff4ba7179f5a263502392f4962e228bc1 /meta/recipes-devtools/dpkg | |
| parent | 62b25b3489b44969e4adad657daebfaffdb4de56 (diff) | |
| download | openembedded-core-562310ac906ffc4a7f1be5fce6e2e8395724fcff.tar.gz | |
dpkg: fix CVE-2015-0860
Backported and cherry picked upstream commit:
https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?h=wheezy&id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0
Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Diffstat (limited to 'meta/recipes-devtools/dpkg')
| -rw-r--r-- | meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch | 35 | ||||
| -rw-r--r-- | meta/recipes-devtools/dpkg/dpkg_1.18.2.bb | 1 |
2 files changed, 36 insertions, 0 deletions
diff --git a/meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch b/meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch new file mode 100644 index 0000000000..2fd3c3bb90 --- /dev/null +++ b/meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch @@ -0,0 +1,35 @@ +From 708e60ea4e16afb1d85da60dd73cb374a987653d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Hanno=20B=C3=B6ck?= <hanno@hboeck.de> +Date: Thu, 19 Nov 2015 20:03:10 +0100 +Subject: [PATCH 1/1] dpkg-deb: Fix off-by-one write access on ctrllenbuf + variable + +This affects old format .deb packages. + +CVE: CVE-2015-0860 +Warned-by: afl +Signed-off-by: Guillem Jover <guillem@debian.org> + +Upstream-Status: Backport + +Signed-off-by: Catalin Enache <catalin.enache@windriver.com> +--- + dpkg-deb/extract.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/dpkg-deb/extract.c b/dpkg-deb/extract.c +index 5a9587a..e39fb35 100644 +--- a/dpkg-deb/extract.c ++++ b/dpkg-deb/extract.c +@@ -247,7 +247,7 @@ extracthalf(const char *debar, const char *dir, + if (errstr) + ohshit(_("archive has invalid format version: %s"), errstr); + +- r = read_line(arfd, ctrllenbuf, 1, sizeof(ctrllenbuf)); ++ r = read_line(arfd, ctrllenbuf, 1, sizeof(ctrllenbuf) - 1); + if (r < 0) + read_fail(r, debar, _("archive control member size")); + if (sscanf(ctrllenbuf, "%jd%c%d", &ctrllennum, &nlc, &dummy) != 2 || +-- +1.9.1 + diff --git a/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb b/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb index dd1109bbad..eab896c342 100644 --- a/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb +++ b/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb @@ -13,6 +13,7 @@ SRC_URI += "file://noman.patch \ file://0004-The-lutimes-function-doesn-t-work-properly-for-all-s.patch \ file://0005-dpkg-compiler.m4-remove-Wvla.patch \ file://0006-add-musleabi-to-known-target-tripets.patch \ + file://dpkg-CVE-2015-0860.patch \ " SRC_URI[md5sum] = "63b9d869081ec49adeef6c5ff62d6576" |