diff options
| author | yanjun.zhu <yanjun.zhu@windriver.com> | 2012-12-11 18:00:32 +0800 |
|---|---|---|
| committer | Saul Wold <sgw@linux.intel.com> | 2012-12-14 15:17:20 -0800 |
| commit | bb1611d4830bb7aff2371afdb2a77a4ca7298c7d (patch) | |
| tree | 2554a4ceed0b038190a8059685405af973dc7f75 /meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch | |
| parent | accbcea94091800a90df0f5141990c110ff35ee5 (diff) | |
| download | openembedded-core-bb1611d4830bb7aff2371afdb2a77a4ca7298c7d.tar.gz openembedded-core-bb1611d4830bb7aff2371afdb2a77a4ca7298c7d.tar.bz2 openembedded-core-bb1611d4830bb7aff2371afdb2a77a4ca7298c7d.zip | |
squashfs: fix CVE-2012-4025
CQID:WIND00366813
Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi?
p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e
Integer overflow in the queue_init function in unsquashfs.c in
unsquashfs in Squashfs 4.2 and earlier allows remote attackers
to execute arbitrary code via a crafted block_log field in the
superblock of a .sqsh file, leading to a heap-based buffer overflow.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025
Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
[YOCTO #3564]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Diffstat (limited to 'meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch')
| -rw-r--r-- | meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch new file mode 100644 index 0000000000..fa075f9e7d --- /dev/null +++ b/meta/recipes-devtools/squashfs-tools/patches/squashfs-add-a-commment-and-fix-some-other-comments.patch @@ -0,0 +1,38 @@ +Upstream-Status: Backport + +unsquashfs: add a commment and fix some other comments + +Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> + +diff -urpN a/unsquashfs.c b/unsquashfs.c +--- a/unsquashfs.c 2012-11-30 15:27:14.000000000 +0800 ++++ b/unsquashfs.c 2012-11-30 15:27:56.000000000 +0800 +@@ -814,7 +814,7 @@ int write_file(struct inode *inode, char + + /* + * the writer thread is queued a squashfs_file structure describing the +- * file. If the file has one or more blocks or a fragments they are ++ * file. If the file has one or more blocks or a fragment they are + * queued separately (references to blocks in the cache). + */ + file->fd = file_fd; +@@ -838,7 +838,7 @@ int write_file(struct inode *inode, char + block->offset = 0; + block->size = i == file_end ? inode->data & (block_size - 1) : + block_size; +- if(block_list[i] == 0) /* sparse file */ ++ if(block_list[i] == 0) /* sparse block */ + block->buffer = NULL; + else { + block->buffer = cache_get(data_cache, start, +@@ -2161,6 +2161,10 @@ options: + block_size = sBlk.s.block_size; + block_log = sBlk.s.block_log; + ++ /* ++ * convert from queue size in Mbytes to queue size in ++ * blocks ++ */ + fragment_buffer_size <<= 20 - block_log; + data_buffer_size <<= 20 - block_log; + initialise_threads(fragment_buffer_size, data_buffer_size); |