From 2c96a67d9ba53dc152dce72e8ff08b5078a77b8c Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sat, 15 Aug 2026 12:03:06 +0200 Subject: [PATCH] package/cramfs: bump to version 2.2 Changes: Security and robustness release. Notable cramfsck changes: * Reject dirent names containing "/", "." or ".." to close a path traversal during `cramfsck -x` (reported in issue #12). * Open regular files with O_CREAT|O_EXCL during extraction to prevent duplicate-dirent attacks from truncating files reached via a previously-extracted symlink. * Fix outbuffer NUL termination and a 1-byte overflow in do_symlink when running with both -v and -x. * Harden romfs_read against truncated/malformed images by zero-filling the window buffer and checking lseek/read returns. * Reject directory entries that extend past their parent's size. Documentation: README now documents cramfsck and lists all current mkcramfs options; stale hard-link and endianness claims corrected; NOTES trimmed of the 25-year-old Future Development section. (See https://github.com/npitre/cramfs-tools/releases/tag/v2.2) Signed-off-by: Thomas Petazzoni Signed-off-by: Julien Olivain --- package/cramfs/cramfs.hash | 2 +- package/cramfs/cramfs.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/cramfs/cramfs.hash b/package/cramfs/cramfs.hash index 672266b468..3795c862c9 100644 --- a/package/cramfs/cramfs.hash +++ b/package/cramfs/cramfs.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 cdb7a4ecad034f063b6456b37cdf653ae31758a224c32161e54712a9d7f01cc3 cramfs-2.1.tar.gz +sha256 6217c93cbfa79ae720bad4139739c1bd7a665928a9bfc2dd820b98df27c66da2 cramfs-2.2.tar.gz sha256 204d8eff92f95aac4df6c8122bc1505f468f3a901e5a4cc08940e0ede1938994 COPYING diff --git a/package/cramfs/cramfs.mk b/package/cramfs/cramfs.mk index 85706d1a8e..a6196ca85e 100644 --- a/package/cramfs/cramfs.mk +++ b/package/cramfs/cramfs.mk @@ -4,7 +4,7 @@ # ################################################################################ -CRAMFS_VERSION = 2.1 +CRAMFS_VERSION = 2.2 CRAMFS_SITE = $(call github,npitre,cramfs-tools,v$(CRAMFS_VERSION)) CRAMFS_LICENSE = GPL-2.0+ CRAMFS_LICENSE_FILES = COPYING