import cpio-2.13-16.el9
This commit is contained in:
		
							parent
							
								
									d2eeff895c
								
							
						
					
					
						commit
						02c288a5ec
					
				
							
								
								
									
										621
									
								
								SOURCES/cpio-2.13-CVE-2021-38185.patch
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										621
									
								
								SOURCES/cpio-2.13-CVE-2021-38185.patch
									
									
									
									
									
										Normal file
									
								
							| @ -0,0 +1,621 @@ | ||||
| From a458d64ad1e47c0912c2ba0702a148c396984105 Mon Sep 17 00:00:00 2001 | ||||
| From: Ondrej Dubaj <odubaj@redhat.com> | ||||
| Date: Mon, 13 Sep 2021 08:13:08 +0200 | ||||
| Subject: [PATCH] * src/dstring.c (ds_init): Take a single argument.  | ||||
|  (ds_free):  New function. (ds_resize): Take a single argument.  Use  | ||||
|  x2nrealloc to expand  the storage.  | ||||
|  (ds_reset,ds_append,ds_concat,ds_endswith): New function.  (ds_fgetstr):  | ||||
|  Rewrite.  In particular, this fixes integer overflow.  (ds_resize): Take  | ||||
|  additional argument: number of  bytes to leave available after ds_idx.  All  | ||||
|  uses changed. * src/dstring.h (dynamic_string): Keep both the allocated  | ||||
|  length (ds_size) and  index of the  next free byte in the string (ds_idx).  | ||||
|  (ds_init,ds_resize):  Change  signature. (ds_len): New macro.  | ||||
|  (ds_free,ds_reset,ds_append,ds_concat,ds_endswith): New protos. * | ||||
|  src/copyin.c: Use new ds_ functions. (read_name_from_file): Handle len == 0.  | ||||
|  (read_name_from_file): Print error message and skip file if its name is not  | ||||
|  nul-terminated. (long_format): Cast rdev numbers to unsigned long * | ||||
|  src/copyout.c: Likewise. * src/copypass.c: Likewise. * src/util.c: Likewise. | ||||
|  (tape_empty_output_buffer): Fix condition. * src/idcache.c | ||||
|  (getuser,getgroup): Use umaxtostr instead of sprintf. * src/userspec.c | ||||
|  (parse_user_spec): Likewise. * configure.ac: Raise version number to 2.13.90. | ||||
| 
 | ||||
| ---
 | ||||
|  configure.ac   |  6 ++-- | ||||
|  src/copyin.c   | 69 ++++++++++++++++++++++------------------ | ||||
|  src/copyout.c  | 16 ++++------ | ||||
|  src/copypass.c | 32 +++++++++---------- | ||||
|  src/dstring.c  | 85 ++++++++++++++++++++++++++++++++++++-------------- | ||||
|  src/dstring.h  | 30 +++++++++--------- | ||||
|  src/idcache.c  | 11 +++---- | ||||
|  src/userspec.c |  9 ++---- | ||||
|  src/util.c     |  9 ++---- | ||||
|  9 files changed, 150 insertions(+), 117 deletions(-) | ||||
| 
 | ||||
| diff --git a/configure.ac b/configure.ac
 | ||||
| index 2132256..875b44f 100644
 | ||||
| --- a/configure.ac
 | ||||
| +++ b/configure.ac
 | ||||
| @@ -15,13 +15,13 @@ dnl
 | ||||
|  dnl You should have received a copy of the GNU General Public License | ||||
|  dnl along with this program.  If not, see <http://www.gnu.org/licenses/>. | ||||
|   | ||||
| -AC_INIT([GNU cpio], [2.13], [bug-cpio@gnu.org],,
 | ||||
| +AC_INIT([GNU cpio], [2.13.90], [bug-cpio@gnu.org],,
 | ||||
|          [http://www.gnu.org/software/cpio]) | ||||
|  AC_CONFIG_SRCDIR(src/cpio.h) | ||||
|  AC_CONFIG_AUX_DIR([build-aux]) | ||||
|  AC_CONFIG_HEADERS([config.h]) | ||||
| -AC_PREREQ([2.63])
 | ||||
| -AM_INIT_AUTOMAKE([1.11.1 gnits tar-ustar dist-bzip2 std-options silent-rules])
 | ||||
| +AC_PREREQ([2.64])
 | ||||
| +AM_INIT_AUTOMAKE([1.15 gnits tar-ustar dist-bzip2 std-options silent-rules])
 | ||||
|   | ||||
|  # Enable silent rules by default: | ||||
|  AM_SILENT_RULES([yes]) | ||||
| diff --git a/src/copyin.c b/src/copyin.c
 | ||||
| index 93b006a..df5da9c 100644
 | ||||
| --- a/src/copyin.c
 | ||||
| +++ b/src/copyin.c
 | ||||
| @@ -56,10 +56,10 @@ query_rename(struct cpio_file_stat* file_hdr, FILE *tty_in, FILE *tty_out,
 | ||||
|    static dynamic_string new_name;	/* New file name for rename option.  */ | ||||
|    static int initialized_new_name = false; | ||||
|    if (!initialized_new_name) | ||||
| -  {
 | ||||
| -    ds_init (&new_name, 128);
 | ||||
| -    initialized_new_name = true;
 | ||||
| -  }
 | ||||
| +    {
 | ||||
| +      ds_init (&new_name);
 | ||||
| +      initialized_new_name = true;
 | ||||
| +    }
 | ||||
|   | ||||
|    if (rename_flag) | ||||
|      { | ||||
| @@ -756,8 +756,9 @@ long_format (struct cpio_file_stat *file_hdr, char const *link_name)
 | ||||
|   | ||||
|    if ((file_hdr->c_mode & CP_IFMT) == CP_IFCHR | ||||
|        || (file_hdr->c_mode & CP_IFMT) == CP_IFBLK) | ||||
| -    printf ("%3lu, %3lu ", file_hdr->c_rdev_maj,
 | ||||
| -	    file_hdr->c_rdev_min);
 | ||||
| +    printf ("%3lu, %3lu ",
 | ||||
| +	    (unsigned long) file_hdr->c_rdev_maj,
 | ||||
| +	    (unsigned long) file_hdr->c_rdev_min);
 | ||||
|    else | ||||
|      printf ("%8"PRIuMAX" ", (uintmax_t) file_hdr->c_filesize); | ||||
|   | ||||
| @@ -777,21 +778,20 @@ long_format (struct cpio_file_stat *file_hdr, char const *link_name)
 | ||||
|     already in `save_patterns' (from the command line) are preserved.  */ | ||||
|   | ||||
|  static void | ||||
| -read_pattern_file ()
 | ||||
| +read_pattern_file (void)
 | ||||
|  { | ||||
| -  int max_new_patterns;
 | ||||
| -  char **new_save_patterns;
 | ||||
| -  int new_num_patterns;
 | ||||
| +  char **new_save_patterns = NULL;
 | ||||
| +  size_t max_new_patterns;
 | ||||
| +  size_t new_num_patterns;
 | ||||
|    int i; | ||||
| -  dynamic_string pattern_name;
 | ||||
| +  dynamic_string pattern_name = DYNAMIC_STRING_INITIALIZER;
 | ||||
|    FILE *pattern_fp; | ||||
|   | ||||
|    if (num_patterns < 0) | ||||
|      num_patterns = 0; | ||||
| -  max_new_patterns = 1 + num_patterns;
 | ||||
| -  new_save_patterns = (char **) xmalloc (max_new_patterns * sizeof (char *));
 | ||||
|    new_num_patterns = num_patterns; | ||||
| -  ds_init (&pattern_name, 128);
 | ||||
| +  max_new_patterns = num_patterns;
 | ||||
| +  new_save_patterns = xcalloc (max_new_patterns, sizeof (new_save_patterns[0]));
 | ||||
|   | ||||
|    pattern_fp = fopen (pattern_file_name, "r"); | ||||
|    if (pattern_fp == NULL) | ||||
| @@ -800,16 +800,16 @@ read_pattern_file ()
 | ||||
|    { | ||||
|      while (ds_fgetstr (pattern_fp, &pattern_name, '\n') != NULL) | ||||
|        { | ||||
| -        if (new_num_patterns >= max_new_patterns)
 | ||||
| -        {
 | ||||
| -          max_new_patterns += 1;
 | ||||
| -          new_save_patterns = (char **)
 | ||||
| -          xrealloc ((char *) new_save_patterns,
 | ||||
| -            max_new_patterns * sizeof (char *));
 | ||||
| -        }
 | ||||
| +        if (new_num_patterns == max_new_patterns)
 | ||||
| +          new_save_patterns = x2nrealloc (new_save_patterns,
 | ||||
| +                  &max_new_patterns,
 | ||||
| +                  sizeof (new_save_patterns[0]));
 | ||||
|          new_save_patterns[new_num_patterns] = xstrdup (pattern_name.ds_string); | ||||
|          ++new_num_patterns; | ||||
|        } | ||||
| +
 | ||||
| +    ds_free (&pattern_name);
 | ||||
| +
 | ||||
|      if (ferror (pattern_fp) || fclose (pattern_fp) == EOF) | ||||
|        close_error (pattern_file_name); | ||||
|    } | ||||
| @@ -999,8 +999,21 @@ read_in_header (struct cpio_file_stat *file_hdr, int in_des)
 | ||||
|  static void | ||||
|  read_name_from_file (struct cpio_file_stat *file_hdr, int fd, uintmax_t len) | ||||
|  { | ||||
| -  cpio_realloc_c_name (file_hdr, len);
 | ||||
| -  tape_buffered_read (file_hdr->c_name, fd, len);
 | ||||
| +  if (len == 0)
 | ||||
| +    {
 | ||||
| +      error (0, 0, _("malformed header: file name of zero length"));
 | ||||
| +    }
 | ||||
| +  else
 | ||||
| +    {
 | ||||
| +      cpio_realloc_c_name (file_hdr, len);
 | ||||
| +      tape_buffered_read (file_hdr->c_name, fd, len);
 | ||||
| +      if (file_hdr->c_name[len-1] != 0)
 | ||||
| +	{
 | ||||
| +	  error (0, 0, _("malformed header: file name is not nul-terminated"));
 | ||||
| +	  /* Skip this file */
 | ||||
| +	  len = 0;
 | ||||
| +	}
 | ||||
| +     }
 | ||||
|    file_hdr->c_namesize = len; | ||||
|  } | ||||
|   | ||||
| @@ -1197,9 +1210,8 @@ swab_array (char *ptr, int count)
 | ||||
|     in the file system.  */ | ||||
|   | ||||
|  void | ||||
| -process_copy_in ()
 | ||||
| +process_copy_in (void)
 | ||||
|  { | ||||
| -  char done = false;		/* True if trailer reached.  */
 | ||||
|    FILE *tty_in = NULL;		/* Interactive file for rename option.  */ | ||||
|    FILE *tty_out = NULL;		/* Interactive file for rename option.  */ | ||||
|    FILE *rename_in = NULL;	/* Batch file for rename option.  */ | ||||
| @@ -1271,7 +1283,7 @@ process_copy_in ()
 | ||||
|    change_dir (); | ||||
|     | ||||
|    /* While there is more input in the collection, process the input.  */ | ||||
| -  while (!done)
 | ||||
| +  while (1)
 | ||||
|      { | ||||
|        swapping_halfwords = swapping_bytes = false; | ||||
|   | ||||
| @@ -1305,10 +1317,7 @@ process_copy_in ()
 | ||||
|  	{ | ||||
|  	  /* Is this the header for the TRAILER file?  */ | ||||
|  	  if (strcmp (CPIO_TRAILER_NAME, file_hdr.c_name) == 0) | ||||
| -	    {
 | ||||
| -	      done = true;
 | ||||
| -	      break;
 | ||||
| -	    }
 | ||||
| +	    break;
 | ||||
|   | ||||
|  	  cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag, | ||||
|  				  false); | ||||
| diff --git a/src/copyout.c b/src/copyout.c
 | ||||
| index 4b7336b..421d36d 100644
 | ||||
| --- a/src/copyout.c
 | ||||
| +++ b/src/copyout.c
 | ||||
| @@ -594,9 +594,10 @@ assign_string (char **pvar, char *value)
 | ||||
|     The format of the header depends on the compatibility (-c) flag.  */ | ||||
|   | ||||
|  void | ||||
| -process_copy_out ()
 | ||||
| +process_copy_out (void)
 | ||||
|  { | ||||
| -  dynamic_string input_name;	/* Name of file read from stdin.  */
 | ||||
| +  dynamic_string input_name = DYNAMIC_STRING_INITIALIZER;
 | ||||
| +                                /* Name of file read from stdin.  */
 | ||||
|    struct stat file_stat;	/* Stat record for file.  */ | ||||
|    struct cpio_file_stat file_hdr = CPIO_FILE_STAT_INITIALIZER; | ||||
|                                  /* Output header information.  */ | ||||
| @@ -605,7 +606,6 @@ process_copy_out ()
 | ||||
|    char *orig_file_name = NULL; | ||||
|   | ||||
|    /* Initialize the copy out.  */ | ||||
| -  ds_init (&input_name, 128);
 | ||||
|    file_hdr.c_magic = 070707; | ||||
|   | ||||
|    /* Check whether the output file might be a tape.  */ | ||||
| @@ -657,14 +657,9 @@ process_copy_out ()
 | ||||
|  	    { | ||||
|  	      if (file_hdr.c_mode & CP_IFDIR) | ||||
|  		{ | ||||
| -		  int len = strlen (input_name.ds_string);
 | ||||
|  		  /* Make sure the name ends with a slash */ | ||||
| -		  if (input_name.ds_string[len-1] != '/')
 | ||||
| -		    {
 | ||||
| -		      ds_resize (&input_name, len + 2);
 | ||||
| -		      input_name.ds_string[len] = '/';
 | ||||
| -		      input_name.ds_string[len+1] = 0;
 | ||||
| -		    }
 | ||||
| +		  if (!ds_endswith (&input_name, '/'))
 | ||||
| +		    ds_append (&input_name, '/');
 | ||||
|  		} | ||||
|  	    } | ||||
|  	   | ||||
| @@ -875,6 +870,7 @@ process_copy_out ()
 | ||||
|  			 (unsigned long) blocks), (unsigned long) blocks); | ||||
|      } | ||||
|    cpio_file_stat_free (&file_hdr); | ||||
| +  ds_free (&input_name);
 | ||||
|  } | ||||
|   | ||||
|   | ||||
| diff --git a/src/copypass.c b/src/copypass.c
 | ||||
| index a5f9b7b..43bde7e 100644
 | ||||
| --- a/src/copypass.c
 | ||||
| +++ b/src/copypass.c
 | ||||
| @@ -48,10 +48,12 @@ set_copypass_perms (int fd, const char *name, struct stat *st)
 | ||||
|     If `link_flag', link instead of copying.  */ | ||||
|   | ||||
|  void | ||||
| -process_copy_pass ()
 | ||||
| +process_copy_pass (void)
 | ||||
|  { | ||||
| -  dynamic_string input_name;	/* Name of file from stdin.  */
 | ||||
| -  dynamic_string output_name;	/* Name of new file.  */
 | ||||
| +  dynamic_string input_name = DYNAMIC_STRING_INITIALIZER;
 | ||||
| +                                /* Name of file from stdin.  */
 | ||||
| +  dynamic_string output_name = DYNAMIC_STRING_INITIALIZER;
 | ||||
| +                                /* Name of new file.  */
 | ||||
|    size_t dirname_len;		/* Length of `directory_name'.  */ | ||||
|    int res;			/* Result of functions.  */ | ||||
|    char *slash;			/* For moving past slashes in input name.  */ | ||||
| @@ -65,25 +67,18 @@ process_copy_pass ()
 | ||||
|  				   created files  */ | ||||
|   | ||||
|    /* Initialize the copy pass.  */ | ||||
| -  ds_init (&input_name, 128);
 | ||||
|     | ||||
|    dirname_len = strlen (directory_name); | ||||
|    if (change_directory_option && !ISSLASH (directory_name[0])) | ||||
|      { | ||||
|        char *pwd = xgetcwd (); | ||||
|   | ||||
| -      dirname_len += strlen (pwd) + 1;
 | ||||
| -      ds_init (&output_name, dirname_len + 2);
 | ||||
| -      strcpy (output_name.ds_string, pwd);
 | ||||
| -      strcat (output_name.ds_string, "/");
 | ||||
| -      strcat (output_name.ds_string, directory_name);
 | ||||
| +      ds_concat (&output_name, pwd);
 | ||||
| +      ds_append (&output_name, '/');
 | ||||
|      } | ||||
| -  else
 | ||||
| -    {
 | ||||
| -      ds_init (&output_name, dirname_len + 2);
 | ||||
| -      strcpy (output_name.ds_string, directory_name);
 | ||||
| -    }
 | ||||
| -  output_name.ds_string[dirname_len] = '/';
 | ||||
| +  ds_concat (&output_name, directory_name);
 | ||||
| +  ds_append (&output_name, '/');
 | ||||
| +  dirname_len = ds_len (&output_name);
 | ||||
|    output_is_seekable = true; | ||||
|   | ||||
|    change_dir (); | ||||
| @@ -116,8 +111,8 @@ process_copy_pass ()
 | ||||
|        /* Make the name of the new file.  */ | ||||
|        for (slash = input_name.ds_string; *slash == '/'; ++slash) | ||||
|  	; | ||||
| -      ds_resize (&output_name, dirname_len + strlen (slash) + 2);
 | ||||
| -      strcpy (output_name.ds_string + dirname_len + 1, slash);
 | ||||
| +      ds_reset (&output_name, dirname_len);
 | ||||
| +      ds_concat (&output_name, slash);
 | ||||
|   | ||||
|        existing_dir = false; | ||||
|        if (lstat (output_name.ds_string, &out_file_stat) == 0) | ||||
| @@ -335,6 +330,9 @@ process_copy_pass ()
 | ||||
|  			 (unsigned long) blocks), | ||||
|  	       (unsigned long) blocks); | ||||
|      } | ||||
| +
 | ||||
| +  ds_free (&input_name);
 | ||||
| +  ds_free (&output_name);
 | ||||
|  } | ||||
|   | ||||
|  /* Try and create a hard link from FILE_NAME to another file  | ||||
| diff --git a/src/dstring.c b/src/dstring.c
 | ||||
| index e9c063f..c788057 100644
 | ||||
| --- a/src/dstring.c
 | ||||
| +++ b/src/dstring.c
 | ||||
| @@ -22,6 +22,7 @@
 | ||||
|  #endif | ||||
|   | ||||
|  #include <stdio.h> | ||||
| +#include <stdlib.h>
 | ||||
|  #if defined(HAVE_STRING_H) || defined(STDC_HEADERS) | ||||
|  #include <string.h> | ||||
|  #else | ||||
| @@ -33,24 +34,40 @@
 | ||||
|  /* Initialiaze dynamic string STRING with space for SIZE characters.  */ | ||||
|   | ||||
|  void | ||||
| -ds_init (dynamic_string *string, int size)
 | ||||
| +ds_init (dynamic_string *string)
 | ||||
|  { | ||||
| -  string->ds_length = size;
 | ||||
| -  string->ds_string = (char *) xmalloc (size);
 | ||||
| +  memset (string, 0, sizeof *string);
 | ||||
|  } | ||||
|   | ||||
| -/* Expand dynamic string STRING, if necessary, to hold SIZE characters.  */
 | ||||
| +/* Free the dynamic string storage. */
 | ||||
|   | ||||
|  void | ||||
| -ds_resize (dynamic_string *string, int size)
 | ||||
| +ds_free (dynamic_string *string)
 | ||||
|  { | ||||
| -  if (size > string->ds_length)
 | ||||
| +  free (string->ds_string);
 | ||||
| +}
 | ||||
| +
 | ||||
| +/* Expand dynamic string STRING, if necessary.  */
 | ||||
| +
 | ||||
| +void
 | ||||
| +ds_resize (dynamic_string *string, size_t len)
 | ||||
| +{
 | ||||
| +  while (len + string->ds_idx >= string->ds_size)
 | ||||
|      { | ||||
| -      string->ds_length = size;
 | ||||
| -      string->ds_string = (char *) xrealloc ((char *) string->ds_string, size);
 | ||||
| +      string->ds_string = x2nrealloc (string->ds_string, &string->ds_size,
 | ||||
| +				      1);
 | ||||
|      } | ||||
|  } | ||||
|   | ||||
| +/* Reset the index of the dynamic string S to LEN. */
 | ||||
| +
 | ||||
| +void
 | ||||
| +ds_reset (dynamic_string *s, size_t len)
 | ||||
| +{
 | ||||
| +  ds_resize (s, len);
 | ||||
| +  s->ds_idx = len;
 | ||||
| +}
 | ||||
| +
 | ||||
|  /* Dynamic string S gets a string terminated by the EOS character | ||||
|     (which is removed) from file F.  S will increase | ||||
|     in size during the function if the string from F is longer than | ||||
| @@ -61,34 +78,49 @@ ds_resize (dynamic_string *string, int size)
 | ||||
|  char * | ||||
|  ds_fgetstr (FILE *f, dynamic_string *s, char eos) | ||||
|  { | ||||
| -  int insize;			/* Amount needed for line.  */
 | ||||
| -  int strsize;			/* Amount allocated for S.  */
 | ||||
|    int next_ch; | ||||
|   | ||||
|    /* Initialize.  */ | ||||
| -  insize = 0;
 | ||||
| -  strsize = s->ds_length;
 | ||||
| +  s->ds_idx = 0;
 | ||||
|   | ||||
|    /* Read the input string.  */ | ||||
| -  next_ch = getc (f);
 | ||||
| -  while (next_ch != eos && next_ch != EOF)
 | ||||
| +  while ((next_ch = getc (f)) != eos && next_ch != EOF)
 | ||||
|      { | ||||
| -      if (insize >= strsize - 1)
 | ||||
| -	{
 | ||||
| -	  ds_resize (s, strsize * 2 + 2);
 | ||||
| -	  strsize = s->ds_length;
 | ||||
| -	}
 | ||||
| -      s->ds_string[insize++] = next_ch;
 | ||||
| -      next_ch = getc (f);
 | ||||
| +      ds_resize (s, 0);
 | ||||
| +      s->ds_string[s->ds_idx++] = next_ch;
 | ||||
|      } | ||||
| -  s->ds_string[insize++] = '\0';
 | ||||
| +  ds_resize (s, 0);
 | ||||
| +  s->ds_string[s->ds_idx] = '\0';
 | ||||
|   | ||||
| -  if (insize == 1 && next_ch == EOF)
 | ||||
| +  if (s->ds_idx == 0 && next_ch == EOF)
 | ||||
|      return NULL; | ||||
|    else | ||||
|      return s->ds_string; | ||||
|  } | ||||
|   | ||||
| +void
 | ||||
| +ds_append (dynamic_string *s, int c)
 | ||||
| +{
 | ||||
| +  ds_resize (s, 0);
 | ||||
| +  s->ds_string[s->ds_idx] = c;
 | ||||
| +  if (c)
 | ||||
| +    {
 | ||||
| +      s->ds_idx++;
 | ||||
| +      ds_resize (s, 0);
 | ||||
| +      s->ds_string[s->ds_idx] = 0;
 | ||||
| +    }      
 | ||||
| +}
 | ||||
| +
 | ||||
| +void
 | ||||
| +ds_concat (dynamic_string *s, char const *str)
 | ||||
| +{
 | ||||
| +  size_t len = strlen (str);
 | ||||
| +  ds_resize (s, len);
 | ||||
| +  memcpy (s->ds_string + s->ds_idx, str, len);
 | ||||
| +  s->ds_idx += len;
 | ||||
| +  s->ds_string[s->ds_idx] = 0;
 | ||||
| +}
 | ||||
| +
 | ||||
|  char * | ||||
|  ds_fgets (FILE *f, dynamic_string *s) | ||||
|  { | ||||
| @@ -100,3 +132,10 @@ ds_fgetname (FILE *f, dynamic_string *s)
 | ||||
|  { | ||||
|    return ds_fgetstr (f, s, '\0'); | ||||
|  } | ||||
| +
 | ||||
| +/* Return true if the dynamic string S ends with character C. */
 | ||||
| +int
 | ||||
| +ds_endswith (dynamic_string *s, int c)
 | ||||
| +{
 | ||||
| +  return (s->ds_idx > 0 && s->ds_string[s->ds_idx - 1] == c);
 | ||||
| +}
 | ||||
| diff --git a/src/dstring.h b/src/dstring.h
 | ||||
| index b5135fe..756cc1f 100644
 | ||||
| --- a/src/dstring.h
 | ||||
| +++ b/src/dstring.h
 | ||||
| @@ -17,10 +17,6 @@
 | ||||
|     Software Foundation, Inc., 51 Franklin Street, Fifth Floor, | ||||
|     Boston, MA 02110-1301 USA.  */ | ||||
|   | ||||
| -#ifndef NULL
 | ||||
| -#define NULL 0
 | ||||
| -#endif
 | ||||
| -
 | ||||
|  /* A dynamic string consists of record that records the size of an | ||||
|     allocated string and the pointer to that string.  The actual string | ||||
|     is a normal zero byte terminated string that can be used with the | ||||
| @@ -30,22 +26,24 @@
 | ||||
|   | ||||
|  typedef struct | ||||
|  { | ||||
| -  int ds_length;		/* Actual amount of storage allocated.  */
 | ||||
| -  char *ds_string;		/* String.  */
 | ||||
| +  size_t ds_size;   /* Actual amount of storage allocated.  */
 | ||||
| +  size_t ds_idx;    /* Index of the next free byte in the string. */
 | ||||
| +  char *ds_string;  /* String storage. */
 | ||||
|  } dynamic_string; | ||||
|   | ||||
| +#define DYNAMIC_STRING_INITIALIZER { 0, 0, NULL }
 | ||||
|   | ||||
| -/* Macros that look similar to the original string functions.
 | ||||
| -   WARNING:  These macros work only on pointers to dynamic string records.
 | ||||
| -   If used with a real record, an "&" must be used to get the pointer.  */
 | ||||
| -#define ds_strlen(s)		strlen ((s)->ds_string)
 | ||||
| -#define ds_strcmp(s1, s2)	strcmp ((s1)->ds_string, (s2)->ds_string)
 | ||||
| -#define ds_strncmp(s1, s2, n)	strncmp ((s1)->ds_string, (s2)->ds_string, n)
 | ||||
| -#define ds_index(s, c)		index ((s)->ds_string, c)
 | ||||
| -#define ds_rindex(s, c)		rindex ((s)->ds_string, c)
 | ||||
| +void ds_init (dynamic_string *string);
 | ||||
| +void ds_free (dynamic_string *string);
 | ||||
| +void ds_reset (dynamic_string *s, size_t len);
 | ||||
|   | ||||
| -void ds_init (dynamic_string *string, int size);
 | ||||
| -void ds_resize (dynamic_string *string, int size);
 | ||||
| +/* All functions below guarantee that s->ds_string[s->ds_idx] == '\0' */
 | ||||
|  char *ds_fgetname (FILE *f, dynamic_string *s); | ||||
|  char *ds_fgets (FILE *f, dynamic_string *s); | ||||
|  char *ds_fgetstr (FILE *f, dynamic_string *s, char eos); | ||||
| +void ds_append (dynamic_string *s, int c);
 | ||||
| +void ds_concat (dynamic_string *s, char const *str);
 | ||||
| +
 | ||||
| +#define ds_len(s) ((s)->ds_idx)
 | ||||
| +
 | ||||
| +int ds_endswith (dynamic_string *s, int c);
 | ||||
| diff --git a/src/idcache.c b/src/idcache.c
 | ||||
| index 33b0d3f..6bd1f3e 100644
 | ||||
| --- a/src/idcache.c
 | ||||
| +++ b/src/idcache.c
 | ||||
| @@ -34,6 +34,7 @@
 | ||||
|  #endif | ||||
|   | ||||
|  #include <unistd.h> | ||||
| +#include <inttostr.h>
 | ||||
|   | ||||
|  struct userid | ||||
|  { | ||||
| @@ -59,7 +60,6 @@ getuser (uid_t uid)
 | ||||
|  { | ||||
|    register struct userid *tail; | ||||
|    struct passwd *pwent; | ||||
| -  char usernum_string[20];
 | ||||
|   | ||||
|    for (tail = user_alist; tail; tail = tail->next) | ||||
|      if (tail->id.u == uid) | ||||
| @@ -70,8 +70,8 @@ getuser (uid_t uid)
 | ||||
|    tail->id.u = uid; | ||||
|    if (pwent == 0) | ||||
|      { | ||||
| -      sprintf (usernum_string, "%u", (unsigned) uid);
 | ||||
| -      tail->name = xstrdup (usernum_string);
 | ||||
| +      char nbuf[UINTMAX_STRSIZE_BOUND];
 | ||||
| +      tail->name = xstrdup (umaxtostr (uid, nbuf));
 | ||||
|      } | ||||
|    else | ||||
|      tail->name = xstrdup (pwent->pw_name); | ||||
| @@ -134,7 +134,6 @@ getgroup (gid_t gid)
 | ||||
|  { | ||||
|    register struct userid *tail; | ||||
|    struct group *grent; | ||||
| -  char groupnum_string[20];
 | ||||
|   | ||||
|    for (tail = group_alist; tail; tail = tail->next) | ||||
|      if (tail->id.g == gid) | ||||
| @@ -145,8 +144,8 @@ getgroup (gid_t gid)
 | ||||
|    tail->id.g = gid; | ||||
|    if (grent == 0) | ||||
|      { | ||||
| -      sprintf (groupnum_string, "%u", (unsigned int) gid);
 | ||||
| -      tail->name = xstrdup (groupnum_string);
 | ||||
| +      char nbuf[UINTMAX_STRSIZE_BOUND];
 | ||||
| +      tail->name = xstrdup (umaxtostr (gid, nbuf));
 | ||||
|      } | ||||
|    else | ||||
|      tail->name = xstrdup (grent->gr_name); | ||||
| diff --git a/src/userspec.c b/src/userspec.c
 | ||||
| index eb3640e..b03234e 100644
 | ||||
| --- a/src/userspec.c
 | ||||
| +++ b/src/userspec.c
 | ||||
| @@ -24,6 +24,7 @@
 | ||||
|  #include <stdio.h> | ||||
|  #include <ctype.h> | ||||
|  #include <sys/types.h> | ||||
| +#include <inttostr.h>
 | ||||
|   | ||||
|  #ifndef HAVE_ENDPWENT | ||||
|  # define endpwent() | ||||
| @@ -141,12 +142,8 @@ parse_user_spec (const char *spec_arg, uid_t *uid, gid_t *gid,
 | ||||
|  	      grp = getgrgid (pwd->pw_gid); | ||||
|  	      if (grp == NULL) | ||||
|  		{ | ||||
| -		  /* This is enough room to hold the unsigned decimal
 | ||||
| -		     representation of any 32-bit quantity and the trailing
 | ||||
| -		     zero byte.  */
 | ||||
| -		  char uint_buf[21];
 | ||||
| -		  sprintf (uint_buf, "%u", (unsigned) (pwd->pw_gid));
 | ||||
| -		  V_STRDUP (groupname, uint_buf);
 | ||||
| +		  char nbuf[UINTMAX_STRSIZE_BOUND];
 | ||||
| +		  V_STRDUP (groupname, umaxtostr (pwd->pw_gid, nbuf));
 | ||||
|  		} | ||||
|  	      else | ||||
|  		{ | ||||
| diff --git a/src/util.c b/src/util.c
 | ||||
| index 0e8d88c..b721f37 100644
 | ||||
| --- a/src/util.c
 | ||||
| +++ b/src/util.c
 | ||||
| @@ -79,8 +79,7 @@ tape_empty_output_buffer (int out_des)
 | ||||
|   | ||||
|        if (output_is_special | ||||
|  	  && (bytes_written >= 0 | ||||
| -	      || (bytes_written < 0
 | ||||
| -		  && (errno == ENOSPC || errno == EIO || errno == ENXIO))))
 | ||||
| +	      || (errno == ENOSPC || errno == EIO || errno == ENXIO)))
 | ||||
|  	{ | ||||
|  	  get_next_reel (out_des); | ||||
|  	  if (bytes_written > 0) | ||||
| @@ -846,11 +845,9 @@ get_next_reel (int tape_des)
 | ||||
|    FILE *tty_out;		/* File for interacting with user.  */ | ||||
|    int old_tape_des; | ||||
|    char *next_archive_name; | ||||
| -  dynamic_string new_name;
 | ||||
| +  dynamic_string new_name = DYNAMIC_STRING_INITIALIZER;
 | ||||
|    char *str_res; | ||||
|   | ||||
| -  ds_init (&new_name, 128);
 | ||||
| -
 | ||||
|    /* Open files for interactive communication.  */ | ||||
|    tty_in = fopen (TTY_NAME, "r"); | ||||
|    if (tty_in == NULL) | ||||
| @@ -925,7 +922,7 @@ get_next_reel (int tape_des)
 | ||||
|      error (PAXEXIT_FAILURE, 0, _("internal error: tape descriptor changed from %d to %d"), | ||||
|  	   old_tape_des, tape_des); | ||||
|   | ||||
| -  free (new_name.ds_string);
 | ||||
| +  ds_free (&new_name);
 | ||||
|    fclose (tty_in); | ||||
|    fclose (tty_out); | ||||
|  } | ||||
| -- 
 | ||||
| 2.31.1 | ||||
| 
 | ||||
| @ -1,7 +1,7 @@ | ||||
| Summary: A GNU archiving program | ||||
| Name: cpio | ||||
| Version: 2.13 | ||||
| Release: 15%{?dist} | ||||
| Release: 16%{?dist} | ||||
| License: GPLv3+ | ||||
| URL: https://www.gnu.org/software/cpio/ | ||||
| Source: https://ftp.gnu.org/gnu/cpio/cpio-%{version}.tar.bz2 | ||||
| @ -52,6 +52,18 @@ Patch11: cpio-2.11-retain-symlink-times.patch | ||||
| # http://git.savannah.gnu.org/cgit/paxutils.git/commit/?id=d247e3c2809a37b6d0c3067251d96bb7f12555e7 | ||||
| Patch12: cpio-2.13-reset-gid-uid.patch | ||||
| 
 | ||||
| # Fixed integer overflow in ds_fgetstr() | ||||
| # upstream patch (#1992512) | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061b | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dfc801c44a93bed7b3951905b188823d6a0432c8 | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=236684f6deb3178043fe72a8e2faca538fa2aae1 | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=4d169305dcb34137dc41acc761d8703eae2c63bf | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=86dacfe3e060ce95d5a2c0c5ec01f6437b0b6089 | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=7dd8ba91d8b6a2640e6c01c3e3a4234828646f23 | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=684b7ac5767e676cda78c161aeb7fe7b45a07529 | ||||
| # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=b1c85839bf1381f749dd45bf6a5a38924e3315a0 | ||||
| Patch13: cpio-2.13-CVE-2021-38185.patch | ||||
| 
 | ||||
| Provides: bundled(gnulib) | ||||
| Provides: bundled(paxutils) | ||||
| Provides: /bin/cpio | ||||
| @ -113,6 +125,9 @@ make check || { | ||||
| %{_infodir}/*.info* | ||||
| 
 | ||||
| %changelog | ||||
| * Thu Aug 26 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.13-16 | ||||
| - Fixed CVE-2021-38185 (#1992512) | ||||
| 
 | ||||
| * Thu Aug 19 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.13-15 | ||||
| - Revert patch for CVE-2021-38185 (#1992512) | ||||
| 
 | ||||
|  | ||||
		Loading…
	
		Reference in New Issue
	
	Block a user