diff options
| author | Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> | 2018-08-22 17:30:31 +0530 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2018-08-23 07:45:32 +0100 |
| commit | d6479f5d2e6de17bac8662f5057d87176524c6fa (patch) | |
| tree | 4ae64b298231dff243bad95c80e320737a5fdcb2 | |
| parent | eee93149a49274dc3deed7d89754ee4bda240575 (diff) | |
| download | openembedded-core-d6479f5d2e6de17bac8662f5057d87176524c6fa.tar.gz openembedded-core-d6479f5d2e6de17bac8662f5057d87176524c6fa.tar.bz2 openembedded-core-d6479f5d2e6de17bac8662f5057d87176524c6fa.zip | |
libarchive: CVE-2017-14503
Reject LHA archive entries with negative size.
Affects libarchive = 3.3.2
Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
| -rw-r--r-- | meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch | 33 | ||||
| -rw-r--r-- | meta/recipes-extended/libarchive/libarchive_3.3.2.bb | 1 |
2 files changed, 34 insertions, 0 deletions
diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch new file mode 100644 index 0000000000..779ca854eb --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch @@ -0,0 +1,33 @@ +From 2c8c83b9731ff822fad6cc8c670ea5519c366a14 Mon Sep 17 00:00:00 2001 +From: Joerg Sonnenberger <joerg@bec.de> +Date: Thu, 19 Jul 2018 21:14:53 +0200 +Subject: [PATCH] Reject LHA archive entries with negative size. + +CVE: CVE-2017-14503 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/2c8c83b9731ff822fad6cc8c670ea5519c366a14] + +Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> +--- + libarchive/archive_read_support_format_lha.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c +index b8ef4ae1..95c99bb1 100644 +--- a/libarchive/archive_read_support_format_lha.c ++++ b/libarchive/archive_read_support_format_lha.c +@@ -701,6 +701,12 @@ archive_read_format_lha_read_header(struct archive_read *a, + * Prepare variables used to read a file content. + */ + lha->entry_bytes_remaining = lha->compsize; ++ if (lha->entry_bytes_remaining < 0) { ++ archive_set_error(&a->archive, ++ ARCHIVE_ERRNO_FILE_FORMAT, ++ "Invalid LHa entry size"); ++ return (ARCHIVE_FATAL); ++ } + lha->entry_offset = 0; + lha->entry_crc_calculated = 0; + +-- +2.13.3 + diff --git a/meta/recipes-extended/libarchive/libarchive_3.3.2.bb b/meta/recipes-extended/libarchive/libarchive_3.3.2.bb index 5daca2731e..3269716473 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.3.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.3.2.bb @@ -36,6 +36,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://CVE-2017-14166.patch \ file://CVE-2017-14502.patch \ file://non-recursive-extract-and-list.patch \ + file://CVE-2017-14503.patch \ " SRC_URI[md5sum] = "4583bd6b2ebf7e0e8963d90879eb1b27" |