From 562310ac906ffc4a7f1be5fce6e2e8395724fcff Mon Sep 17 00:00:00 2001 From: Catalin Enache Date: Wed, 27 Jan 2016 18:22:21 +0800 Subject: dpkg: fix CVE-2015-0860 Backported and cherry picked upstream commit: https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?h=wheezy&id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0 Signed-off-by: Catalin Enache Signed-off-by: Ross Burton --- .../dpkg/dpkg/dpkg-CVE-2015-0860.patch | 35 ++++++++++++++++++++++ meta/recipes-devtools/dpkg/dpkg_1.18.2.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch (limited to 'meta/recipes-devtools/dpkg') diff --git a/meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch b/meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch new file mode 100644 index 0000000000..2fd3c3bb90 --- /dev/null +++ b/meta/recipes-devtools/dpkg/dpkg/dpkg-CVE-2015-0860.patch @@ -0,0 +1,35 @@ +From 708e60ea4e16afb1d85da60dd73cb374a987653d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Hanno=20B=C3=B6ck?= +Date: Thu, 19 Nov 2015 20:03:10 +0100 +Subject: [PATCH 1/1] dpkg-deb: Fix off-by-one write access on ctrllenbuf + variable + +This affects old format .deb packages. + +CVE: CVE-2015-0860 +Warned-by: afl +Signed-off-by: Guillem Jover + +Upstream-Status: Backport + +Signed-off-by: Catalin Enache +--- + dpkg-deb/extract.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/dpkg-deb/extract.c b/dpkg-deb/extract.c +index 5a9587a..e39fb35 100644 +--- a/dpkg-deb/extract.c ++++ b/dpkg-deb/extract.c +@@ -247,7 +247,7 @@ extracthalf(const char *debar, const char *dir, + if (errstr) + ohshit(_("archive has invalid format version: %s"), errstr); + +- r = read_line(arfd, ctrllenbuf, 1, sizeof(ctrllenbuf)); ++ r = read_line(arfd, ctrllenbuf, 1, sizeof(ctrllenbuf) - 1); + if (r < 0) + read_fail(r, debar, _("archive control member size")); + if (sscanf(ctrllenbuf, "%jd%c%d", &ctrllennum, &nlc, &dummy) != 2 || +-- +1.9.1 + diff --git a/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb b/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb index dd1109bbad..eab896c342 100644 --- a/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb +++ b/meta/recipes-devtools/dpkg/dpkg_1.18.2.bb @@ -13,6 +13,7 @@ SRC_URI += "file://noman.patch \ file://0004-The-lutimes-function-doesn-t-work-properly-for-all-s.patch \ file://0005-dpkg-compiler.m4-remove-Wvla.patch \ file://0006-add-musleabi-to-known-target-tripets.patch \ + file://dpkg-CVE-2015-0860.patch \ " SRC_URI[md5sum] = "63b9d869081ec49adeef6c5ff62d6576" -- cgit 1.2.3-korg