diff options
author | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2018-06-14 19:52:03 +0300 |
---|---|---|
committer | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2018-08-28 03:22:11 +0300 |
commit | d5ae7d902a40f26a8c26f4c6d300226689738716 (patch) | |
tree | 85c711404990dd5e37447cd7492c3017815790b7 /poky/meta/recipes-core/busybox | |
parent | 0639c5b2c542e0ed9465cc9d8e5100ac0063038f (diff) | |
download | openbmc-d5ae7d902a40f26a8c26f4c6d300226689738716.tar.xz |
Sumo refresh
Update external subtrees to latest Yocto sumo.
Change-Id: I8364f32bef079841c6e57f1c587f4b1bedf62fef
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'poky/meta/recipes-core/busybox')
3 files changed, 148 insertions, 0 deletions
diff --git a/poky/meta/recipes-core/busybox/busybox/busybox-fix-lzma-segfaults.patch b/poky/meta/recipes-core/busybox/busybox/busybox-fix-lzma-segfaults.patch new file mode 100644 index 000000000..da6dfa802 --- /dev/null +++ b/poky/meta/recipes-core/busybox/busybox/busybox-fix-lzma-segfaults.patch @@ -0,0 +1,106 @@ +busybox-1.27.2: Fix lzma segfaults + +[No upstream tracking] -- https://bugs.busybox.net/show_bug.cgi?id=10871 + +libarchive: check buffer index in lzma_decompress + +With specific defconfig busybox fails to check zip fileheader magic +(archival/unzip.c) and uses (archival/libarchive/decompress_unlzma.c) +for decompression which leads to segmentation fault. It prevents accessing into +buffer, which is smaller than pos index. Patch includes multiple segmentation +fault fixes. + +Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=a36986bb80289c1cd8d15a557e49207c9a42946b] +bug: 10436 10871 +Signed-off-by: Andrej Valek <andrej.valek@siemens.com> + +diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c +index a904087..29eee2a 100644 +--- a/archival/libarchive/decompress_unlzma.c ++++ b/archival/libarchive/decompress_unlzma.c +@@ -11,6 +11,14 @@ + #include "libbb.h" + #include "bb_archive.h" + ++ ++#if 0 ++# define dbg(...) bb_error_msg(__VA_ARGS__) ++#else ++# define dbg(...) ((void)0) ++#endif ++ ++ + #if ENABLE_FEATURE_LZMA_FAST + # define speed_inline ALWAYS_INLINE + # define size_inline +@@ -217,6 +225,7 @@ unpack_lzma_stream(transformer_state_t *xstate) + rc_t *rc; + int i; + uint8_t *buffer; ++ uint32_t buffer_size; + uint8_t previous_byte = 0; + size_t buffer_pos = 0, global_pos = 0; + int len = 0; +@@ -246,7 +255,8 @@ unpack_lzma_stream(transformer_state_t *xstate) + if (header.dict_size == 0) + header.dict_size++; + +- buffer = xmalloc(MIN(header.dst_size, header.dict_size)); ++ buffer_size = MIN(header.dst_size, header.dict_size); ++ buffer = xmalloc(buffer_size); + + { + int num_probs; +@@ -341,8 +351,12 @@ unpack_lzma_stream(transformer_state_t *xstate) + state = state < LZMA_NUM_LIT_STATES ? 9 : 11; + + pos = buffer_pos - rep0; +- if ((int32_t)pos < 0) ++ if ((int32_t)pos < 0) { + pos += header.dict_size; ++ /* see unzip_bad_lzma_2.zip: */ ++ if (pos >= buffer_size) ++ goto bad; ++ } + previous_byte = buffer[pos]; + goto one_byte1; + #else +@@ -417,6 +431,10 @@ unpack_lzma_stream(transformer_state_t *xstate) + for (; num_bits2 != LZMA_NUM_ALIGN_BITS; num_bits2--) + rep0 = (rep0 << 1) | rc_direct_bit(rc); + rep0 <<= LZMA_NUM_ALIGN_BITS; ++ if ((int32_t)rep0 < 0) { ++ dbg("%d rep0:%d", __LINE__, rep0); ++ goto bad; ++ } + prob3 = p + LZMA_ALIGN; + } + i2 = 1; +@@ -450,8 +468,12 @@ unpack_lzma_stream(transformer_state_t *xstate) + IF_NOT_FEATURE_LZMA_FAST(string:) + do { + uint32_t pos = buffer_pos - rep0; +- if ((int32_t)pos < 0) ++ if ((int32_t)pos < 0) { + pos += header.dict_size; ++ /* more stringent test (see unzip_bad_lzma_1.zip): */ ++ if (pos >= buffer_size) ++ goto bad; ++ } + previous_byte = buffer[pos]; + IF_NOT_FEATURE_LZMA_FAST(one_byte2:) + buffer[buffer_pos++] = previous_byte; +@@ -478,6 +500,12 @@ unpack_lzma_stream(transformer_state_t *xstate) + IF_DESKTOP(total_written += buffer_pos;) + if (transformer_write(xstate, buffer, buffer_pos) != (ssize_t)buffer_pos) { + bad: ++ /* One of our users, bbunpack(), expects _us_ to emit ++ * the error message (since it's the best place to give ++ * potentially more detailed information). ++ * Do not fail silently. ++ */ ++ bb_error_msg("corrupted data"); + total_written = -1; /* failure */ + } + rc_free(rc); + diff --git a/poky/meta/recipes-core/busybox/busybox/umount-ignore-c.patch b/poky/meta/recipes-core/busybox/busybox/umount-ignore-c.patch new file mode 100644 index 000000000..9fe7998df --- /dev/null +++ b/poky/meta/recipes-core/busybox/busybox/umount-ignore-c.patch @@ -0,0 +1,40 @@ +Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br> +Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=426134128112738c97a665170b21153ef0764b7d] + +From 95ea12791c8623bf825bc711ac7790306e7e1adb Mon Sep 17 00:00:00 2001 +From: Shawn Landden <slandden@gmail.com> +Date: Mon, 8 Jan 2018 13:31:58 +0100 +Subject: [PATCH] umount: ignore -c +Organization: O.S. Systems Software LTDA. + +"-c, --no-canonicalize: Do not canonicalize paths." + +As busybox doesn't canonicalize paths in the first place it is safe to ignore +this option. + +See https://github.com/systemd/systemd/issues/7786 + +Signed-off-by: Shawn Landden <slandden@gmail.com> +Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com> +--- + util-linux/umount.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/util-linux/umount.c b/util-linux/umount.c +index 0c50dc9ee..0425c5b76 100644 +--- a/util-linux/umount.c ++++ b/util-linux/umount.c +@@ -68,8 +68,8 @@ static struct mntent *getmntent_r(FILE* stream, struct mntent* result, + } + #endif + +-/* ignored: -v -t -i */ +-#define OPTION_STRING "fldnra" "vt:i" ++/* ignored: -c -v -t -i */ ++#define OPTION_STRING "fldnra" "cvt:i" + #define OPT_FORCE (1 << 0) // Same as MNT_FORCE + #define OPT_LAZY (1 << 1) // Same as MNT_DETACH + #define OPT_FREELOOP (1 << 2) +-- +2.18.0 + diff --git a/poky/meta/recipes-core/busybox/busybox_1.27.2.bb b/poky/meta/recipes-core/busybox/busybox_1.27.2.bb index 36a6342aa..1ce4823d4 100644 --- a/poky/meta/recipes-core/busybox/busybox_1.27.2.bb +++ b/poky/meta/recipes-core/busybox/busybox_1.27.2.bb @@ -45,6 +45,8 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ file://CVE-2011-5325.patch \ file://CVE-2017-15873.patch \ file://busybox-CVE-2017-16544.patch \ + file://busybox-fix-lzma-segfaults.patch \ + file://umount-ignore-c.patch \ " SRC_URI_append_libc-musl = " file://musl.cfg " |