From bb62363012653011a88ea522845b838ba0d1e97b Mon Sep 17 00:00:00 2001 From: Francois Perrad Date: Wed, 20 Apr 2022 09:26:09 +0200 Subject: [PATCH] package/libarchive: security bump to version 3.6.1 Fixes the following security issues: - 7zip reader: fix PPMD read beyond boundary (#1671) - ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672) - ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685) - RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0) - fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50) - fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77) - fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715) Signed-off-by: Francois Perrad Signed-off-by: Arnout Vandecappelle (Essensium/Mind) (cherry picked from commit a33130d964af5ca07315f118dca7964c38b13f4d) [Peter: adjust commit message to make it clear that this is a security bump] Signed-off-by: Peter Korsgaard --- package/libarchive/libarchive.hash | 2 +- package/libarchive/libarchive.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libarchive/libarchive.hash b/package/libarchive/libarchive.hash index 5dd8e5c167..ca580b4977 100644 --- a/package/libarchive/libarchive.hash +++ b/package/libarchive/libarchive.hash @@ -1,4 +1,4 @@ # From https://www.libarchive.de/downloads/sha256sums -sha256 5cac725dd4be31c4a10b65d30f29dc957ea29ef3d758df6e46e8ae90a996a19a libarchive-3.5.3.tar.xz +sha256 5a411aceb978f43e626f0c2d1812ddd8807b645ed892453acabd532376c148e6 libarchive-3.6.1.tar.xz # Locally computed: sha256 b2cdf763345de2de34cebf54394df3c61a105c3b71288603c251f2fa638200ba COPYING diff --git a/package/libarchive/libarchive.mk b/package/libarchive/libarchive.mk index cf16c27e67..865f605e2f 100644 --- a/package/libarchive/libarchive.mk +++ b/package/libarchive/libarchive.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBARCHIVE_VERSION = 3.5.3 +LIBARCHIVE_VERSION = 3.6.1 LIBARCHIVE_SOURCE = libarchive-$(LIBARCHIVE_VERSION).tar.xz LIBARCHIVE_SITE = https://www.libarchive.de/downloads LIBARCHIVE_INSTALL_STAGING = YES