mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-19 16:40:46 -09:00
06c6c49fe8
This commit adds four upstream patches fixing the CVE-2025-31115
vulnerability. The reason there is four patches instead of one is to
exactly follow the advisory recommendation [1], which proposes the
patch [2]. This patch is in fact a concatenation of four commits. In
Buildroot, we track package patches as formatted by git, with extra
"Upstream:" headers. The patch [2] was split here in four for a
clearer traceability.
With the addition of those patches, the XZ_IGNORE_CVES is set
accordingly.
Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-31115
[1] https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
[2] https://tukaani.org/xz/xz-cve-2025-31115.patch
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 38494a0a61)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
30 lines
1.0 KiB
Diff
30 lines
1.0 KiB
Diff
From 9f508dead050cd51f53aff3807c7319e2e6773cf Mon Sep 17 00:00:00 2001
|
|
From: Lasse Collin <lasse.collin@tukaani.org>
|
|
Date: Thu, 3 Apr 2025 14:34:42 +0300
|
|
Subject: [PATCH] liblzma: mt dec: Fix a comment
|
|
|
|
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
|
Thanks-to: Sam James <sam@gentoo.org>
|
|
Upstream: https://github.com/tukaani-project/xz/commit/831b55b971cf579ee16a854f177c36b20d3c6999
|
|
Signed-off-by: Julien Olivain <ju.o@free.fr>
|
|
---
|
|
src/liblzma/common/stream_decoder_mt.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/liblzma/common/stream_decoder_mt.c b/src/liblzma/common/stream_decoder_mt.c
|
|
index 244624a4..6f06f1d1 100644
|
|
--- a/src/liblzma/common/stream_decoder_mt.c
|
|
+++ b/src/liblzma/common/stream_decoder_mt.c
|
|
@@ -347,7 +347,7 @@ worker_enable_partial_update(void *thr_ptr)
|
|
|
|
|
|
/// Things do to at THR_STOP or when finishing a Block.
|
|
-/// This is called with thr->mutex locked.
|
|
+/// This is called with thr->coder->mutex locked.
|
|
static void
|
|
worker_stop(struct worker_thread *thr)
|
|
{
|
|
--
|
|
2.49.0
|
|
|