mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 16:01:54 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libarchive: security bump to v3.8.1

Browse Source 
This fixes the following CVEs:

- CVE-2025-5914
    Libarchive: double free at archive_read_format_rar_seek_data()
    in archive_read_support_format_rar.c
    https://www.cve.org/CVERecord?id=CVE-2025-5914

- CVE-2025-5915
    Libarchive: heap buffer over read in copy_from_lzss_window()
    at archive_read_support_format_rar.c
    https://www.cve.org/CVERecord?id=CVE-2025-5915

- CVE-2025-5916
    Libarchive: integer overflow while reading warc files
    at archive_read_support_format_warc.c
    https://www.cve.org/CVERecord?id=CVE-2025-5916

- CVE-2025-5917
    Libarchive: off by one error in build_ustar_entry_name()
    at archive_write_set_format_pax.c
    https://www.cve.org/CVERecord?id=CVE-2025-5917

- CVE-2025-5918
    Libarchive: reading past eof may be triggered for piped file streams
    https://www.cve.org/CVERecord?id=CVE-2025-5918

See the release notes:
- https://github.com/libarchive/libarchive/releases/tag/v3.8.0
- https://github.com/libarchive/libarchive/releases/tag/v3.8.1

In addition to the version bump, the following changes are required:
- The COPYING file has been edited upstream because of filename change on a
  sub-licensed component; see
  c26f037745
- The upstream "sha256sums" is currently unavailable, so the archive checksum
  has been computed locally
- Drop patches for libiconv in configure.ac, which has been properly addressed
  upstream in https://github.com/libarchive/libarchive/pull/2611
- Following the above, AUTORECONF is not needed any longer
- Drop mbedtls patch that has been applied upstream

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 95db5707df)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2025-06-26 10:54:44 +02:00
committed by Thomas Perale
parent 8154e1226d
commit 91895774f8
4 changed files with 5 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
package/libarchive/0001-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch
View File

@@ -1,31 +0,0 @@
From 3879afd473a256173cc626e16293f3fe8875f2d6 Mon Sep 17 00:00:00 2001
From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Date: Sat, 6 Jan 2024 09:53:23 +0100
Subject: [PATCH] Revert "Only add "iconv" to the .pc file if needed (#1825)"
This reverts commit 1f35c466aaa9444335a1b854b0b7223b0d2346c2.
Upstream: no dedicated PR for this revert but there is already plenty of PRs/issues to fix iconv build ...
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
configure.ac | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/configure.ac b/configure.ac
index 93f7af94..204a4e69 100644
--- a/configure.ac
+++ b/configure.ac
@@ -455,9 +455,7 @@ if test "x$with_iconv" != "xno"; then
AC_CHECK_HEADERS([localcharset.h])
am_save_LIBS="$LIBS"
LIBS="${LIBS} ${LIBICONV}"
- if test -n "$LIBICONV"; then
- LIBSREQUIRED="$LIBSREQUIRED${LIBSREQUIRED:+ }iconv"
- fi
+ LIBSREQUIRED="$LIBSREQUIRED${LIBSREQUIRED:+ }iconv"
AC_CHECK_FUNCS([locale_charset])
LIBS="${am_save_LIBS}"
if test "x$ac_cv_func_locale_charset" != "xyes"; then
--
2.43.0

27
package/libarchive/0002-autotools-do-not-add-iconv-for-Requires.private.patch
View File

@@ -1,27 +0,0 @@
From 619c1be8d38ff79622db8f66f3b02832795315f9 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Wed, 14 Dec 2022 09:04:39 +0100
Subject: [PATCH] autotools: do not add iconv for Requires.private
There is no pkgconfig file for iconv, thus things break with this
change. Let's drop iconv from Requires.private.
Fixes: a83f3d32 ("autotools: Fix static linking when openssl is enabled in windows")
Upstream: https://github.com/libarchive/libarchive/pull/1817/commits/619c1be8d38ff79622db8f66f3b02832795315f9
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
configure.ac | 1 -
1 file changed, 1 deletion(-)
diff --git a/configure.ac b/configure.ac
index 99bff20d1..f245d0c55 100644
--- a/configure.ac
+++ b/configure.ac
@@ -455,7 +455,6 @@ if test "x$with_iconv" != "xno"; then
AC_CHECK_HEADERS([localcharset.h])
am_save_LIBS="$LIBS"
LIBS="${LIBS} ${LIBICONV}"
- LIBSREQUIRED="$LIBSREQUIRED${LIBSREQUIRED:+ }iconv"
AC_CHECK_FUNCS([locale_charset])
LIBS="${am_save_LIBS}"
if test "x$ac_cv_func_locale_charset" != "xyes"; then

7
package/libarchive/libarchive.hash
View File

@@ -1,4 +1,5 @@
# From https://www.libarchive.de/downloads/sha256sums
sha256 ed8b5732e4cd6e30fae909fb945cad8ff9cb7be5c6cdaa3944ec96e4a200c04c libarchive-3.7.9.tar.xz
# Locally computed after verifying the signature from
# https://www.libarchive.de/downloads/libarchive-3.8.1.tar.xz.asc
sha256 19f917d42d530f98815ac824d90c7eaf648e9d9a50e4f309c812457ffa5496b5 libarchive-3.8.1.tar.xz
# Locally computed:
sha256 b2cdf763345de2de34cebf54394df3c61a105c3b71288603c251f2fa638200ba COPYING
sha256 30e556b3959e3985d66efefec5eaac51d4995053caa1d3cffe6eb916f146f229 COPYING

6
package/libarchive/libarchive.mk
View File

@@ -4,17 +4,13 @@
#
################################################################################
LIBARCHIVE_VERSION = 3.7.9
LIBARCHIVE_VERSION = 3.8.1
LIBARCHIVE_SOURCE = libarchive-$(LIBARCHIVE_VERSION).tar.xz
LIBARCHIVE_SITE = https://www.libarchive.de/downloads
LIBARCHIVE_INSTALL_STAGING = YES
LIBARCHIVE_LICENSE = BSD-2-Clause, BSD-3-Clause, CC0-1.0, OpenSSL, Apache-2.0
LIBARCHIVE_LICENSE_FILES = COPYING
LIBARCHIVE_CPE_ID_VENDOR = libarchive
# We're patching configure.ac
LIBARCHIVE_AUTORECONF = YES
# needed for autoreconf
LIBARCHIVE_DEPENDENCIES += host-pkgconf
ifeq ($(BR2_PACKAGE_LIBARCHIVE_BSDTAR),y)
ifeq ($(BR2_STATIC_LIBS),y)