mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-01 06:21:56 -09:00
fb8958e3dc
In Buildroot there are multiple way to apply patches on a package [1]
- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.
To make the CycloneDX SBOM generation not dependant on downloading the
packages, the two last options have the downside of not appearing on the
generated SBOM.
The unzip package is downloading a tarball from the Debian mirror with
the `<pkg>_PATCH` method [2].
To improve the tracking of the patched vulnerabilities for the unzip
package this commit import the patches previously downloaded with the
`_PATCH` variable in the Buildroot tree.
This allows to add the `CVE:` trailer [3] on the patches that fix
vulnerabilities to better track which patch is fixing the vulnerability.
[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] https://snapshot.debian.org/archive/debian/20250311T215724Z/pool/main/u/unzip/unzip_6.0-29.debian.tar.xz
[3] 1167d0ff3d docs/manual: mention CVE trailer
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
45 lines
1.6 KiB
Diff
45 lines
1.6 KiB
Diff
From: mancha <mancha1 AT zoho DOT com>
|
|
Date: Wed, 11 Feb 2015
|
|
Subject: Info-ZIP UnZip buffer overflow
|
|
Bug-Debian: https://bugs.debian.org/776589
|
|
|
|
By carefully crafting a corrupt ZIP archive with "extra fields" that
|
|
purport to have compressed blocks larger than the corresponding
|
|
uncompressed blocks in STORED no-compression mode, an attacker can
|
|
trigger a heap overflow that can result in application crash or
|
|
possibly have other unspecified impact.
|
|
|
|
This patch ensures that when extra fields use STORED mode, the
|
|
"compressed" and uncompressed block sizes match.
|
|
|
|
CVE: CVE-2014-9636
|
|
Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/12-cve-2014-9636-test-compr-eb.patch
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
|
|
--- a/extract.c
|
|
+++ b/extract.c
|
|
@@ -2228,6 +2228,7 @@
|
|
ulg eb_ucsize;
|
|
uch *eb_ucptr;
|
|
int r;
|
|
+ ush eb_compr_method;
|
|
|
|
if (compr_offset < 4) /* field is not compressed: */
|
|
return PK_OK; /* do nothing and signal OK */
|
|
@@ -2244,6 +2245,15 @@
|
|
((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
|
|
return IZ_EF_TRUNC; /* no/bad compressed data! */
|
|
|
|
+ /* 2015-02-10 Mancha(?), Michal Zalewski, Tomas Hoger, SMS.
|
|
+ * For STORE method, compressed and uncompressed sizes must agree.
|
|
+ * http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450
|
|
+ */
|
|
+ eb_compr_method = makeword( eb + (EB_HEADSIZE + compr_offset));
|
|
+ if ((eb_compr_method == STORED) &&
|
|
+ (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
|
|
+ return PK_ERR;
|
|
+
|
|
if (
|
|
#ifdef INT_16BIT
|
|
(((ulg)(extent)eb_ucsize) != eb_ucsize) ||
|