cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security update to 2.13:

Browse Source 
* Fix CVE-2015-1197
* Fix CVE-2016-2037
* Fix CVE-2019-14866
* Remove --extract-over-symlinks option again, which was part of an earlier
non-upstream fix for CVE-2015-1197.
This commit is contained in:
naddy 2019-11-10 10:23:02 +00:00
parent 1db8329e4b
commit 88696794a0
10 changed files with 27 additions and 179 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
archivers/gcpio/Makefile
View File

@ -1,10 +1,9 @@
# $OpenBSD: Makefile,v 1.28 2019/07/12 20:43:28 sthen Exp $
# $OpenBSD: Makefile,v 1.29 2019/11/10 10:23:02 naddy Exp $
COMMENT= GNU cpio copies files to and from archives
DISTNAME= cpio-2.12
DISTNAME= cpio-2.13
PKGNAME= g${DISTNAME}
REVISION= 1
CATEGORIES= archivers
HOMEPAGE= https://www.gnu.org/software/cpio/

4
archivers/gcpio/distinfo
View File

@ -1,2 +1,2 @@
SHA256 (cpio-2.12.tar.bz2) = cJmMWBas6EB8ixAcm6H/0+u+y6H1AxBGiTMHWA7BKW4=
SIZE (cpio-2.12.tar.bz2) = 1258605
SHA256 (cpio-2.13.tar.bz2) = 6rW9xa4d8oXFnypPFAqY/DNnigv2G9umfZQ2ria0b20=
SIZE (cpio-2.13.tar.bz2) = 1354559

16
archivers/gcpio/patches/patch-doc_cpio_1
View File

@ -1,12 +1,13 @@
$OpenBSD: patch-doc_cpio_1,v 1.4 2015/09/17 20:16:49 naddy Exp $
$OpenBSD: patch-doc_cpio_1,v 1.5 2019/11/10 10:23:02 naddy Exp $
CVE-2015-1197: cpio directory traversal
--- doc/cpio.1.orig Sat Sep 12 12:57:30 2015
+++ doc/cpio.1 Wed Sep 16 23:20:28 2015
Index: doc/cpio.1
--- doc/cpio.1.orig
+++ doc/cpio.1
@@ -15,9 +15,9 @@
.\" along with GNU cpio. If not, see <http://www.gnu.org/licenses/>.
.TH CPIO 1 "December 1, 2014" "CPIO" "GNU CPIO"
.TH CPIO 1 "June 21, 2018" "CPIO" "GNU CPIO"
.SH NAME
-cpio \- copy files to and from archives
+gcpio \- copy files to and from archives
@ -25,11 +26,8 @@ CVE-2015-1197: cpio directory traversal
{\fB\-i\fR|\fB\-\-extract\fR} [\fB\-bcdfmnrtsuvBSV\fR] [\fB\-C\fR \fIBYTES\fR]
[\fB\-E\fR \fIFILE\fR] [\fB\-H\fR \fIFORMAT\fR]
[\fB\-M\fR \fIMESSAGE\fR] [\fB\-R\fR [\fIUSER\fR][\fB:.\fR][\fIGROUP\fR]]
@@ -50,9 +50,10 @@ cpio \- copy files to and from archives
[\fB\-\-force\-local\fR] [\fB\-\-no\-absolute\-filenames\fR] [\fB\-\-sparse\fR]
[\fB\-\-only\-verify\-crc\fR] [\fB\-\-to\-stdout\fR] [\fB\-\-quiet\fR]
@@ -52,7 +52,7 @@ cpio \- copy files to and from archives
[\fB\-\-rsh\-command=\fICOMMAND\fR]
+[\fB\-\-extract\-over\-symlinks\fR]
[\fIpattern\fR...] [\fB<\fR \fIarchive\fR]
-.B cpio
@ -37,7 +35,7 @@ CVE-2015-1197: cpio directory traversal
{\fB\-p\fR|\fB\-\-pass\-through\fR} [\fB\-0adlmuvLV\fR]
[\fB\-R\fR [\fIUSER\fR][\fB:.\fR][\fIGROUP\fR]]
[\fB\-\-null\fR] [\fB\-\-reset\-access\-time\fR]
@@ -63,7 +64,7 @@ cpio \- copy files to and from archives
@@ -63,7 +63,7 @@ cpio \- copy files to and from archives
[\fB\-\-no\-preserve\-owner\fR] [\fB\-\-sparse\fR]
\fIdestination-directory\fR \fB<\fR \fIname-list\fR

82
archivers/gcpio/patches/patch-src_copyin_c
View File

@ -1,82 +0,0 @@
$OpenBSD: patch-src_copyin_c,v 1.4 2015/09/17 20:16:49 naddy Exp $
CVE-2015-1197: cpio directory traversal
--- src/copyin.c.orig Sat Sep 12 12:57:30 2015
+++ src/copyin.c Wed Sep 16 23:21:15 2015
@@ -695,6 +695,51 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_f
free (link_name);
}
+
+static int
+path_contains_symlink(char *path)
+{
+ struct stat st;
+ char *slash;
+ char *nextslash;
+
+ /* we got NULL pointer or empty string */
+ if (!path || !*path) {
+ return false;
+ }
+
+ slash = path;
+
+ while ((nextslash = strchr(slash + 1, '/')) != NULL) {
+ slash = nextslash;
+ *slash = '\0';
+
+ if (lstat(path, &st) != 0) {
+ if (errno == ELOOP) {
+ /* ELOOP - too many symlinks */
+ *slash = '/';
+ return true;
+ } else if (errno == ENOMEM) {
+ /* No memory for lstat - terminate */
+ xalloc_die();
+ } else {
+ /* cannot lstat path - give up */
+ *slash = '/';
+ return false;
+ }
+ }
+
+ if (S_ISLNK(st.st_mode)) {
+ *slash = '/';
+ return true;
+ }
+
+ *slash = '/';
+ }
+
+ return false;
+}
+
static void
copyin_file (struct cpio_file_stat *file_hdr, int in_file_des)
{
@@ -1467,6 +1512,23 @@ process_copy_in ()
else
{
/* Copy the input file into the directory structure. */
+
+ /* Can we write files over symlinks? */
+ if (!extract_over_symlinks)
+ {
+ if (path_contains_symlink(file_hdr.c_name))
+ {
+ /* skip the file */
+ /*
+ fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name);
+ tape_toss_input (in_file_des, file_hdr.c_filesize);
+ tape_skip_padding (in_file_des, file_hdr.c_filesize);
+ continue;
+ */
+ /* terminate */
+ error (PAXEXIT_FAILURE, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name);
+ }
+ }
/* Do we need to rename the file? */
if (rename_flag || rename_batch_file)

14
archivers/gcpio/patches/patch-src_extern_h
View File

@ -1,14 +0,0 @@
$OpenBSD: patch-src_extern_h,v 1.2 2015/09/17 20:16:49 naddy Exp $
CVE-2015-1197: cpio directory traversal
--- src/extern.h.orig Sat Sep 12 12:57:30 2015
+++ src/extern.h Wed Sep 16 23:21:15 2015
@@ -96,6 +96,7 @@ extern char input_is_special;
extern char output_is_special;
extern char input_is_seekable;
extern char output_is_seekable;
+extern bool extract_over_symlinks;
extern int (*xstat) ();
extern void (*copy_function) ();
extern char *change_directory_option;

16
archivers/gcpio/patches/patch-src_global_c
View File

@ -1,16 +0,0 @@
$OpenBSD: patch-src_global_c,v 1.1 2015/03/31 15:36:52 naddy Exp $
CVE-2015-1197: cpio directory traversal
--- src/global.c.orig Fri Feb 12 11:19:23 2010
+++ src/global.c Sun Mar 29 21:11:10 2015
@@ -187,6 +187,9 @@ bool to_stdout_option = false;
/* The name this program was run with. */
char *program_name;
+/* Extract files over symbolic links */
+bool extract_over_symlinks;
+
/* A pointer to either lstat or stat, depending on whether
dereferencing of symlinks is done for input files. */
int (*xstat) ();

36
archivers/gcpio/patches/patch-src_main_c
View File

@ -1,36 +0,0 @@
$OpenBSD: patch-src_main_c,v 1.4 2015/09/17 20:16:49 naddy Exp $
CVE-2015-1197: cpio directory traversal
--- src/main.c.orig Sat Sep 12 12:57:30 2015
+++ src/main.c Wed Sep 16 23:22:21 2015
@@ -61,7 +61,8 @@ enum cpio_options {
TO_STDOUT_OPTION,
RENUMBER_INODES_OPTION,
IGNORE_DEVNO_OPTION,
- DEVICE_INDEPENDENT_OPTION
+ DEVICE_INDEPENDENT_OPTION,
+ EXTRACT_OVER_SYMLINKS
};
const char *program_authors[] =
@@ -243,6 +244,8 @@ static struct argp_option options[] = {
N_("Create leading directories where needed"), GRID+1 },
{"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0,
N_("Do not change the ownership of the files"), GRID+1 },
+ {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0,
+ N_("Force writing over symbolic links"), GRID+1 },
{"unconditional", 'u', NULL, 0,
N_("Replace all files unconditionally"), GRID+1 },
{"sparse", SPARSE_OPTION, NULL, 0,
@@ -430,6 +433,10 @@ crc newc odc bin ustar tar (all-caps also recognized)"
USAGE_ERROR ((0, 0,
_("--no-preserve-owner cannot be used with --owner")));
no_chown_flag = true;
+ break;
+
+ case EXTRACT_OVER_SYMLINKS: /* --extract-over-symlinks */
+ extract_over_symlinks = true;
break;
case 'o': /* Copy-out mode. */

14
archivers/gcpio/patches/patch-tests_symlink-bad-length_at Normal file
View File

@ -0,0 +1,14 @@
$OpenBSD: patch-tests_symlink-bad-length_at,v 1.1 2019/11/10 10:23:02 naddy Exp $
Index: tests/symlink-bad-length.at
--- tests/symlink-bad-length.at.orig
+++ tests/symlink-bad-length.at
@@ -44,7 +44,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# but that could hurt backward compatibility.
AT_CHECK([
-base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
+b64decode -r ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
TZ=UTC cpio -ntv < ARCHIVE 2>stderr
cat stderr | grep -v \
-e 'stored filename length is out of range' \

16
archivers/gcpio/patches/patch-tests_symlink-long_at
View File

@ -1,16 +0,0 @@
$OpenBSD: patch-tests_symlink-long_at,v 1.1 2015/09/17 20:16:49 naddy Exp $
--- tests/symlink-long.at.orig Sat Sep 12 12:57:30 2015
+++ tests/symlink-long.at Wed Sep 16 22:12:00 2015
@@ -27,9 +27,11 @@ AT_CHECK([
# len(dirname) > READBUFSIZE
dirname=
-for i in {1..52}; do
+i=1
+while test $i -le 52; do
dirname="xxxxxxxxx/$dirname"
mkdir "$dirname"
+ i=`expr $i + 1`
done
ln -s "$dirname" x || AT_SKIP_TEST

3
archivers/gcpio/pkg/PLIST
View File

@ -1,4 +1,4 @@
@comment $OpenBSD: PLIST,v 1.9 2015/09/17 20:16:49 naddy Exp $
@comment $OpenBSD: PLIST,v 1.10 2019/11/10 10:23:02 naddy Exp $
@bin bin/gcpio
@info info/cpio.info
@comment lib/charset.alias
@ -19,6 +19,7 @@ share/locale/ja/LC_MESSAGES/cpio.mo
share/locale/ko/LC_MESSAGES/cpio.mo
share/locale/nl/LC_MESSAGES/cpio.mo
share/locale/pl/LC_MESSAGES/cpio.mo
share/locale/pt/LC_MESSAGES/cpio.mo
share/locale/pt_BR/LC_MESSAGES/cpio.mo
share/locale/ro/LC_MESSAGES/cpio.mo
share/locale/ru/LC_MESSAGES/cpio.mo