rpms
/
squashfs-tools
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: rpms:c8
Branches Tags
rpms:c8
rpms:c9
rpms:c9-beta
rpms:c8-beta
rpms:c9s
rpms:c8s
rpms:imports/c9/squashfs-tools-4.4-10.git1.el9
rpms:imports/c9/squashfs-tools-4.4-8.git1.el9
rpms:imports/c9-beta/squashfs-tools-4.4-8.git1.el9
rpms:imports/c9-beta/squashfs-tools-4.4-7.git1.el9
rpms:imports/c8-beta/squashfs-tools-4.3-20.el8
rpms:imports/c8-beta/squashfs-tools-4.3-19.el8
rpms:imports/c8-beta/squashfs-tools-4.3-17.el8
rpms:imports/c8s/squashfs-tools-4.3-20.el8
rpms:imports/c8/squashfs-tools-4.3-20.el8
rpms:imports/c8/squashfs-tools-4.3-19.el8
rpms:imports/c8/squashfs-tools-4.3-17.el8
...
pull from: rpms:c9-beta
Branches Tags
rpms:c9
rpms:c9-beta
rpms:c8-beta
rpms:c9s
rpms:c8s
rpms:c8
rpms:imports/c9/squashfs-tools-4.4-10.git1.el9
rpms:imports/c9/squashfs-tools-4.4-8.git1.el9
rpms:imports/c9-beta/squashfs-tools-4.4-8.git1.el9
rpms:imports/c9-beta/squashfs-tools-4.4-7.git1.el9
rpms:imports/c8-beta/squashfs-tools-4.3-20.el8
rpms:imports/c8-beta/squashfs-tools-4.3-19.el8
rpms:imports/c8-beta/squashfs-tools-4.3-17.el8
rpms:imports/c8s/squashfs-tools-4.3-20.el8
rpms:imports/c8/squashfs-tools-4.3-20.el8
rpms:imports/c8/squashfs-tools-4.3-19.el8
rpms:imports/c8/squashfs-tools-4.3-17.el8

No commits in common. "c8" and "c9-beta" have entirely different histories.
c8 ... c9-beta

18 changed files with 915 additions and 479 deletions
Show Stats Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/squashfs4.3.tar.gz
SOURCES/4.4-git.1.tar.gz

2
.squashfs-tools.metadata
View File

@ -1 +1 @@
a615979db9cee82e4a934a1455577f597d290b41 SOURCES/squashfs4.3.tar.gz
ccdbdb36be907de767019f2f35e985c6fad1bc2c SOURCES/4.4-git.1.tar.gz

11
SOURCES/2gb.patch
View File

@ -1,11 +0,0 @@
--- squashfs-tools/mksquashfs.c.orig 2014-09-13 11:08:27.352318167 -0500
+++ squashfs-tools/mksquashfs.c 2014-09-13 11:09:36.701132044 -0500
@@ -2055,7 +2055,7 @@
inline int is_fragment(struct inode_info *inode)
{
- int file_size = inode->buf.st_size;
+ off_t file_size = inode->buf.st_size;
/*
* If this block is to be compressed differently to the

587
SOURCES/CVE-2021-41072-c9s-combined.patch Normal file
View File

@ -0,0 +1,587 @@
diff -Nupr a/squashfs-tools/Makefile b/squashfs-tools/Makefile
--- a/squashfs-tools/Makefile 2023-06-26 23:18:33.104153303 -0500
+++ b/squashfs-tools/Makefile 2023-06-26 23:19:49.230107688 -0500
@@ -156,8 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o
caches-queues-lists.o
UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \
- unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \
- compressor.o unsquashfs_info.o
+ unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o unsquash-12.o \
+ swap.o compressor.o unsquashfs_info.o
CFLAGS ?= -O2
CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \
@@ -353,6 +353,8 @@ unsquash-34.o: unsquashfs.h unsquash-34.
unsquash-1234.o: unsquash-1234.c
+unsquash-12.o: unsquash-12.c unsquashfs.h
+
unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h
unsquashfs_info.o: unsquashfs.h squashfs_fs.h
diff -Nupr a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c
--- a/squashfs-tools/unsquash-1234.c 2023-06-26 23:18:33.104153303 -0500
+++ b/squashfs-tools/unsquash-1234.c 2023-06-26 23:19:49.230107688 -0500
@@ -25,8 +25,8 @@
* unsquash-4.
*/
-#define TRUE 1
-#define FALSE 0
+#include "unsquashfs.h"
+
/*
* Check name for validity, name should not
* - be ".", "./", or
@@ -56,3 +56,40 @@ int check_name(char *name, int size)
return TRUE;
}
+
+
+void squashfs_closedir(struct dir *dir)
+{
+ struct dir_ent *ent = dir->dirs;
+
+ while(ent) {
+ struct dir_ent *tmp = ent;
+
+ ent = ent->next;
+ free(tmp->name);
+ free(tmp);
+ }
+
+ free(dir);
+}
+
+
+/*
+ * Check directory for duplicate names. As the directory should be sorted,
+ * duplicates will be consecutive. Obviously we also need to check if the
+ * directory has been deliberately unsorted, to evade this check.
+ */
+int check_directory(struct dir *dir)
+{
+ int i;
+ struct dir_ent *ent;
+
+ if (dir->dir_count < 2)
+ return TRUE;
+
+ for (ent = dir->dirs, i = 0; i < dir->dir_count - 1; ent = ent->next, i++)
+ if (strcmp(ent->name, ent->next->name) >= 0)
+ return FALSE;
+
+ return TRUE;
+}
diff -Nupr a/squashfs-tools/unsquash-12.c b/squashfs-tools/unsquash-12.c
--- a/squashfs-tools/unsquash-12.c 1969-12-31 18:00:00.000000000 -0600
+++ b/squashfs-tools/unsquash-12.c 2023-06-26 23:19:49.230107688 -0500
@@ -0,0 +1,103 @@
+/*
+ * Unsquash a squashfs filesystem. This is a highly compressed read only
+ * filesystem.
+ *
+ * Copyright (c) 2021
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * unsquash-12.c
+ *
+ * Helper functions used by unsquash-1 and unsquash-2.
+ */
+
+#include "unsquashfs.h"
+
+/*
+ * Bottom up linked list merge sort.
+ *
+ */
+void sort_directory(struct dir *dir)
+{
+ struct dir_ent *cur, *l1, *l2, *next;
+ int len1, len2, stride = 1;
+
+ if (dir->dir_count < 2)
+ return;
+
+ /*
+ * We can consider our linked-list to be made up of stride length
+ * sublists. Each iteration around this loop merges adjacent
+ * stride length sublists into larger 2*stride sublists. We stop
+ * when stride becomes equal to the entire list.
+ *
+ * Initially stride = 1 (by definition a sublist of 1 is sorted), and
+ * these 1 element sublists are merged into 2 element sublists, which
+ * are then merged into 4 element sublists and so on.
+ */
+ do {
+ l2 = dir->dirs; /* head of current linked list */
+ cur = NULL; /* empty output list */
+
+ /*
+ * Iterate through the linked list, merging adjacent sublists.
+ * On each interation l2 points to the next sublist pair to be
+ * merged (if there's only one sublist left this is simply added
+ * to the output list)
+ */
+ while (l2) {
+ l1 = l2;
+ for (len1 = 0; l2 && len1 < stride; len1 ++, l2 = l2->next);
+ len2 = stride;
+
+ /*
+ * l1 points to first sublist.
+ * l2 points to second sublist.
+ * Merge them onto the output list
+ */
+ while (len1 && l2 && len2) {
+ if(strcmp(l1->name, l2->name) <= 0) {
+ next = l1;
+ l1 = l1->next;
+ len1 --;
+ } else {
+ next = l2;
+ l2 = l2->next;
+ len2 --;
+ }
+
+ if (cur) {
+ cur->next = next;
+ cur = next;
+ } else
+ dir->dirs = cur = next;
+ }
+ /*
+ * One sublist is now empty, copy the other one onto the
+ * output list
+ */
+ for (; len1; len1 --, l1 = l1->next) {
+ if(cur) {
+ cur->next = l1;
+ cur = l1;
+ } else
+ dir->dirs = cur = l1;
+ }
+ }
+ cur->next = NULL;
+ stride = stride << 1;
+ } while(stride < dir->dir_count);
+}
diff -Nupr a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
--- a/squashfs-tools/unsquash-1.c 2023-06-26 23:18:33.104153303 -0500
+++ b/squashfs-tools/unsquash-1.c 2023-06-26 23:19:49.230107688 -0500
@@ -207,7 +207,7 @@ static struct dir *squashfs_opendir(unsi
long long start;
int bytes;
int dir_count, size;
- struct dir_ent *new_dir;
+ struct dir_ent *ent, *cur_ent = NULL;
struct dir *dir;
TRACE("squashfs_opendir: inode start block %d, offset %d\n",
@@ -220,7 +220,7 @@ static struct dir *squashfs_opendir(unsi
EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n");
dir->dir_count = 0;
- dir->cur_entry = 0;
+ dir->cur_entry = NULL;
dir->mode = (*i)->mode;
dir->uid = (*i)->uid;
dir->guid = (*i)->gid;
@@ -295,29 +295,36 @@ static struct dir *squashfs_opendir(unsi
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
- if((dir->dir_count % DIR_ENT_SIZE) == 0) {
- new_dir = realloc(dir->dirs, (dir->dir_count +
- DIR_ENT_SIZE) * sizeof(struct dir_ent));
- if(new_dir == NULL)
- EXIT_UNSQUASH("squashfs_opendir: "
- "realloc failed!\n");
- dir->dirs = new_dir;
- }
- strcpy(dir->dirs[dir->dir_count].name, dire->name);
- dir->dirs[dir->dir_count].start_block =
- dirh.start_block;
- dir->dirs[dir->dir_count].offset = dire->offset;
- dir->dirs[dir->dir_count].type = dire->type;
+
+ ent = malloc(sizeof(struct dir_ent));
+ if(ent == NULL)
+ MEM_ERROR();
+
+ ent->name = strdup(dire->name);
+ ent->start_block = dirh.start_block;
+ ent->offset = dire->offset;
+ ent->type = dire->type;
+ ent->next = NULL;
+ if (cur_ent == NULL)
+ dir->dirs = ent;
+ else
+ cur_ent->next = ent;
+ cur_ent = ent;
dir->dir_count ++;
bytes += dire->size + 1;
}
}
+ /* check directory for duplicate names. Need to sort directory first */
+ sort_directory(dir);
+ if (check_directory(dir) == FALSE) {
+ ERROR("File system corrupted: directory has duplicate names\n");
+ goto corrupted;
+ }
return dir;
corrupted:
- free(dir->dirs);
- free(dir);
+ squashfs_closedir(dir);
return NULL;
}
diff -Nupr a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c
--- a/squashfs-tools/unsquash-2.c 2023-06-26 23:18:33.104153303 -0500
+++ b/squashfs-tools/unsquash-2.c 2023-06-26 23:19:49.230107688 -0500
@@ -29,6 +29,7 @@ static squashfs_fragment_entry_2 *fragme
static unsigned int *uid_table, *guid_table;
static char *inode_table, *directory_table;
static squashfs_operations ops;
+int needs_sorting = FALSE;
static void read_block_list(unsigned int *block_list, char *block_ptr, int blocks)
{
@@ -308,7 +309,7 @@ static struct dir *squashfs_opendir(unsi
long long start;
int bytes;
int dir_count, size;
- struct dir_ent *new_dir;
+ struct dir_ent *ent, *cur_ent = NULL;
struct dir *dir;
TRACE("squashfs_opendir: inode start block %d, offset %d\n",
@@ -321,7 +322,7 @@ static struct dir *squashfs_opendir(unsi
EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n");
dir->dir_count = 0;
- dir->cur_entry = 0;
+ dir->cur_entry = NULL;
dir->mode = (*i)->mode;
dir->uid = (*i)->uid;
dir->guid = (*i)->gid;
@@ -396,29 +397,41 @@ static struct dir *squashfs_opendir(unsi
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
- if((dir->dir_count % DIR_ENT_SIZE) == 0) {
- new_dir = realloc(dir->dirs, (dir->dir_count +
- DIR_ENT_SIZE) * sizeof(struct dir_ent));
- if(new_dir == NULL)
- EXIT_UNSQUASH("squashfs_opendir: "
- "realloc failed!\n");
- dir->dirs = new_dir;
- }
- strcpy(dir->dirs[dir->dir_count].name, dire->name);
- dir->dirs[dir->dir_count].start_block =
- dirh.start_block;
- dir->dirs[dir->dir_count].offset = dire->offset;
- dir->dirs[dir->dir_count].type = dire->type;
+
+ ent = malloc(sizeof(struct dir_ent));
+ if (ent == NULL)
+ MEM_ERROR();
+
+ ent->name = strdup(dire->name);
+ ent->start_block = dirh.start_block;
+ ent->offset = dire->offset;
+ ent->type = dire->type;
+ ent->next = NULL;
+ if (cur_ent == NULL)
+ dir->dirs = ent;
+ else
+ cur_ent->next = ent;
+ cur_ent = ent;
dir->dir_count ++;
bytes += dire->size + 1;
}
}
+ if (needs_sorting)
+ sort_directory(dir);
+
+ /* check directory for duplicate names and sorting */
+ if (check_directory(dir) == FALSE) {
+ if (needs_sorting)
+ ERROR("File system corrupted: directory has duplicate names\n");
+ else
+ ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
+ goto corrupted;
+ }
return dir;
corrupted:
- free(dir->dirs);
- free(dir);
+ squashfs_closedir(dir);
return NULL;
}
diff -Nupr a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
--- a/squashfs-tools/unsquash-3.c 2023-06-26 23:18:33.105153302 -0500
+++ b/squashfs-tools/unsquash-3.c 2023-06-26 23:19:49.230107688 -0500
@@ -334,7 +334,7 @@ static struct dir *squashfs_opendir(unsi
long long start;
int bytes;
int dir_count, size;
- struct dir_ent *new_dir;
+ struct dir_ent *ent, *cur_ent = NULL;
struct dir *dir;
TRACE("squashfs_opendir: inode start block %d, offset %d\n",
@@ -347,7 +347,7 @@ static struct dir *squashfs_opendir(unsi
EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n");
dir->dir_count = 0;
- dir->cur_entry = 0;
+ dir->cur_entry = NULL;
dir->mode = (*i)->mode;
dir->uid = (*i)->uid;
dir->guid = (*i)->gid;
@@ -423,29 +423,36 @@ static struct dir *squashfs_opendir(unsi
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
- if((dir->dir_count % DIR_ENT_SIZE) == 0) {
- new_dir = realloc(dir->dirs, (dir->dir_count +
- DIR_ENT_SIZE) * sizeof(struct dir_ent));
- if(new_dir == NULL)
- EXIT_UNSQUASH("squashfs_opendir: "
- "realloc failed!\n");
- dir->dirs = new_dir;
- }
- strcpy(dir->dirs[dir->dir_count].name, dire->name);
- dir->dirs[dir->dir_count].start_block =
- dirh.start_block;
- dir->dirs[dir->dir_count].offset = dire->offset;
- dir->dirs[dir->dir_count].type = dire->type;
+
+ ent = malloc(sizeof(struct dir_ent));
+ if (ent == NULL)
+ MEM_ERROR();
+
+ ent->name = strdup(dire->name);
+ ent->start_block = dirh.start_block;
+ ent->offset = dire->offset;
+ ent->type = dire->type;
+ ent->next = NULL;
+ if (cur_ent == NULL)
+ dir->dirs = ent;
+ else
+ cur_ent->next = ent;
+ cur_ent = ent;
dir->dir_count ++;
bytes += dire->size + 1;
}
}
+ /* check directory for duplicate names and sorting */
+ if (check_directory(dir) == FALSE) {
+ ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
+ goto corrupted;
+ }
+
return dir;
corrupted:
- free(dir->dirs);
- free(dir);
+ squashfs_closedir(dir);
return NULL;
}
diff -Nupr a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
--- a/squashfs-tools/unsquash-4.c 2023-06-26 23:18:33.105153302 -0500
+++ b/squashfs-tools/unsquash-4.c 2023-06-26 23:19:49.231107688 -0500
@@ -281,7 +281,7 @@ static struct dir *squashfs_opendir(unsi
long long start;
long long bytes;
int dir_count, size;
- struct dir_ent *new_dir;
+ struct dir_ent *ent, *cur_ent = NULL;
struct dir *dir;
TRACE("squashfs_opendir: inode start block %d, offset %d\n",
@@ -294,7 +294,7 @@ static struct dir *squashfs_opendir(unsi
EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n");
dir->dir_count = 0;
- dir->cur_entry = 0;
+ dir->cur_entry = NULL;
dir->mode = (*i)->mode;
dir->uid = (*i)->uid;
dir->guid = (*i)->gid;
@@ -359,29 +359,36 @@ static struct dir *squashfs_opendir(unsi
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
- if((dir->dir_count % DIR_ENT_SIZE) == 0) {
- new_dir = realloc(dir->dirs, (dir->dir_count +
- DIR_ENT_SIZE) * sizeof(struct dir_ent));
- if(new_dir == NULL)
- EXIT_UNSQUASH("squashfs_opendir: "
- "realloc failed!\n");
- dir->dirs = new_dir;
- }
- strcpy(dir->dirs[dir->dir_count].name, dire->name);
- dir->dirs[dir->dir_count].start_block =
- dirh.start_block;
- dir->dirs[dir->dir_count].offset = dire->offset;
- dir->dirs[dir->dir_count].type = dire->type;
+
+ ent = malloc(sizeof(struct dir_ent));
+ if (ent == NULL)
+ MEM_ERROR();
+
+ ent->name = strdup(dire->name);
+ ent->start_block = dirh.start_block;
+ ent->offset = dire->offset;
+ ent->type = dire->type;
+ ent->next = NULL;
+ if (cur_ent == NULL)
+ dir->dirs = ent;
+ else
+ cur_ent->next = ent;
+ cur_ent = ent;
dir->dir_count ++;
bytes += dire->size + 1;
}
}
+ /* check directory for duplicate names and sorting */
+ if (check_directory(dir) == FALSE) {
+ ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
+ goto corrupted;
+ }
+
return dir;
corrupted:
- free(dir->dirs);
- free(dir);
+ squashfs_closedir(dir);
return NULL;
}
diff -Nupr a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
--- a/squashfs-tools/unsquashfs.c 2023-06-26 23:18:33.105153302 -0500
+++ b/squashfs-tools/unsquashfs.c 2023-06-26 23:19:49.231107688 -0500
@@ -78,6 +78,7 @@ int user_xattrs = FALSE;
int ignore_errors = FALSE;
int strict_errors = FALSE;
int use_localtime = TRUE;
+extern int needs_sorting;
int lookup_type[] = {
0,
@@ -1287,26 +1288,23 @@ failed:
int squashfs_readdir(struct dir *dir, char **name, unsigned int *start_block,
unsigned int *offset, unsigned int *type)
{
- if(dir->cur_entry == dir->dir_count)
+ if(dir->cur_entry == NULL)
+ dir->cur_entry = dir->dirs;
+ else
+ dir->cur_entry = dir->cur_entry->next;
+
+ if (dir->cur_entry == NULL)
return FALSE;
- *name = dir->dirs[dir->cur_entry].name;
- *start_block = dir->dirs[dir->cur_entry].start_block;
- *offset = dir->dirs[dir->cur_entry].offset;
- *type = dir->dirs[dir->cur_entry].type;
- dir->cur_entry ++;
+ *name = dir->cur_entry->name;
+ *start_block = dir->cur_entry->start_block;
+ *offset = dir->cur_entry->offset;
+ *type = dir->cur_entry->type;
return TRUE;
}
-void squashfs_closedir(struct dir *dir)
-{
- free(dir->dirs);
- free(dir);
-}
-
-
char *get_component(char *target, char **targname)
{
char *start;
@@ -1959,6 +1957,10 @@ int read_super(char *source)
* 1.x, 2.x and 3.x filesystems use gzip compression.
*/
comp = lookup_compressor("gzip");
+
+ if (sBlk_3.s_minor == 0)
+ needs_sorting = TRUE;
+
return TRUE;
failed_mount:
diff -Nupr a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
--- a/squashfs-tools/unsquashfs.h 2023-06-26 23:18:33.106153301 -0500
+++ b/squashfs-tools/unsquashfs.h 2023-06-26 23:19:49.231107688 -0500
@@ -165,21 +165,22 @@ struct queue {
#define DIR_ENT_SIZE 16
struct dir_ent {
- char name[SQUASHFS_NAME_LEN + 1];
+ char *name;
unsigned int start_block;
unsigned int offset;
unsigned int type;
+ struct dir_ent *next;
};
struct dir {
int dir_count;
- int cur_entry;
unsigned int mode;
uid_t uid;
gid_t guid;
unsigned int mtime;
unsigned int xattr;
struct dir_ent *dirs;
+ struct dir_ent *cur_entry;
};
struct file_entry {
@@ -264,4 +265,9 @@ extern long long *alloc_index_table(int)
/* unsquash-1234.c */
extern int check_name(char *, int);
+extern void squashfs_closedir(struct dir *);
+extern int check_directory(struct dir *);
+
+/* unsquash-12.c */
+extern void sort_directory(struct dir *);
#endif

159
SOURCES/PAE.patch
View File

@ -1,159 +0,0 @@
From 55f7ba830d40d438f0b0663a505e0c227fc68b6b Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Tue, 10 Jun 2014 21:51:52 +0100
Subject: mksquashfs: fix phys mem calculation for 32-bit processes on
PAE/64-bit kernels
When adding the code to base default memory usage on physical memory
(by default use 25% of physical memory), I made an oversight. I assumed
the process would be able to address 25% of physical memory.
However, for 32-bit processes running on a PAE kernel or 64-bit kernel,
25% of physical memory can easily exceed the addressible memory for a
32-bit process, e.g. if a machine has 24 GB of physical memory, the
code would asume the process could easily use 6 GB.
A 32-bit process by definition can only address 4 GB (32-bit pointers).
But, due to the typical kernel/user-space split (1GB/3GB, or 2GB/2GB)
on PAE kernels, a 32-bit process may only be able to address 2 GB.
So, if Mksquashfs is a 32-bit application running on a PAE/64-bit kernel,
the code assumes it can address much more memory than it really can, which
means it runs out of memory.
The fix is to impose a maximum default limit on 32-bit kernels, or
otherwise to never use a value more than 25% of the address space. If
we assume the maximum address space is 2 GB, then the maximum becomes
512 MB. But, given most kernels used the 1GB/3GB split, that may be
unduely conservative, and 25% of 3 GB (756 MB) may be better. This
patch compromises on 640 MB, which is mid-way between the 512 MB and 756 MB
values. It is also the fixed default value previously used by Mksquashfs.
This patch also alters the code which imposes a maximum size. Previously
it was believed limiting to the physical memory size was adequate. But
obviously this needs to be updated to take into account a 32-bit process
may only be able to address 2 GB. In the process I've also taken the
opportunity to limit all requests to no more than 75% of physical memory.
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
index 86f82bb..5370ecf 100644
--- a/squashfs-tools/mksquashfs.c
+++ b/squashfs-tools/mksquashfs.c
@@ -304,7 +304,7 @@ void restorefs();
struct dir_info *scan1_opendir(char *pathname, char *subpath, int depth);
void write_filesystem_tables(struct squashfs_super_block *sBlk, int nopad);
unsigned short get_checksum_mem(char *buff, int bytes);
-int get_physical_memory();
+void check_usable_phys_mem(int total_mem);
void prep_exit()
@@ -4053,11 +4053,7 @@ void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
BAD_ERROR("Queue sizes rediculously too large\n");
total_mem += fwriteq;
- if(total_mem > get_physical_memory()) {
- ERROR("Total queue sizes larger than physical memory.\n");
- ERROR("Mksquashfs will exhaust physical memory and thrash.\n");
- BAD_ERROR("Queues too large\n");
- }
+ check_usable_phys_mem(total_mem);
/*
* convert from queue size in Mbytes to queue size in
@@ -4879,6 +4875,72 @@ int get_physical_memory()
}
+void check_usable_phys_mem(int total_mem)
+{
+ /*
+ * We want to allow users to use as much of their physical
+ * memory as they wish. However, for practical reasons there are
+ * limits which need to be imposed, to protect users from themselves
+ * and to prevent people from using Mksquashfs as a DOS attack by using
+ * all physical memory. Mksquashfs uses memory to cache data from disk
+ * to optimise performance. It is pointless to ask it to use more
+ * than 75% of physical memory, as this causes thrashing and it is thus
+ * self-defeating.
+ */
+ int mem = get_physical_memory();
+
+ mem = (mem >> 1) + (mem >> 2); /* 75% */
+
+ if(total_mem > mem) {
+ ERROR("Total memory requested is more than 75%% of physical "
+ "memory.\n");
+ ERROR("Mksquashfs uses memory to cache data from disk to "
+ "optimise performance.\n");
+ ERROR("It is pointless to ask it to use more than this amount "
+ "of memory, as this\n");
+ ERROR("causes thrashing and it is thus self-defeating.\n");
+ BAD_ERROR("Requested memory size too large\n");
+ }
+
+ if(sizeof(void *) == 4 && total_mem > 2048) {
+ /*
+ * If we're running on a kernel with PAE or on a 64-bit kernel,
+ * then the 75% physical memory limit can still easily exceed
+ * the addressable memory by this process.
+ *
+ * Due to the typical kernel/user-space split (1GB/3GB, or
+ * 2GB/2GB), we have to conservatively assume the 32-bit
+ * processes can only address 2-3GB. So refuse if the user
+ * tries to allocate more than 2GB.
+ */
+ ERROR("Total memory requested may exceed maximum "
+ "addressable memory by this process\n");
+ BAD_ERROR("Requested memory size too large\n");
+ }
+}
+
+
+int get_default_phys_mem()
+{
+ int mem = get_physical_memory() / SQUASHFS_TAKE;
+
+ if(sizeof(void *) == 4 && mem > 640) {
+ /*
+ * If we're running on a kernel with PAE or on a 64-bit kernel,
+ * the default memory usage can exceed the addressable
+ * memory by this process.
+ * Due to the typical kernel/user-space split (1GB/3GB, or
+ * 2GB/2GB), we have to conservatively assume the 32-bit
+ * processes can only address 2-3GB. So limit the default
+ * usage to 640M, which gives room for other data.
+ */
+ mem = 640;
+ }
+
+ return mem;
+}
+
+
void calculate_queue_sizes(int mem, int *readq, int *fragq, int *bwriteq,
int *fwriteq)
{
@@ -4890,7 +4952,7 @@ void calculate_queue_sizes(int mem, int *readq, int *fragq, int *bwriteq,
#define VERSION() \
- printf("mksquashfs version 4.3 (2014/05/12)\n");\
+ printf("mksquashfs version 4.3-git (2014/06/09)\n");\
printf("copyright (C) 2014 Phillip Lougher "\
"<phillip@squashfs.org.uk>\n\n"); \
printf("This program is free software; you can redistribute it and/or"\
@@ -4918,7 +4980,7 @@ int main(int argc, char *argv[])
int fragq;
int bwriteq;
int fwriteq;
- int total_mem = get_physical_memory() / SQUASHFS_TAKE;
+ int total_mem = get_default_phys_mem();
int progress = TRUE;
int force_progress = FALSE;
struct file_buffer **fragment = NULL;
--
cgit v0.10.1

95
SOURCES/bz1602698.patch
View File

@ -1,95 +0,0 @@
diff -Nupr a/squashfs-tools/action.c b/squashfs-tools/action.c
--- a/squashfs-tools/action.c 2014-05-09 23:54:13.000000000 -0500
+++ b/squashfs-tools/action.c 2019-04-18 10:59:53.140496887 -0500
@@ -1094,8 +1094,14 @@ static int parse_sym_mode_args(struct ac
for (i = 0; i < args; i++) {
struct mode_data *entry = parse_sym_mode_arg(argv[i]);
- if (entry == NULL)
+ if (entry == NULL) {
+ while (head) {
+ cur = head;
+ head = head->next;
+ free(cur);
+ }
return 0;
+ }
if (cur) {
cur->next = entry;
diff -Nupr a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
--- a/squashfs-tools/mksquashfs.c 2019-04-18 10:51:05.975460126 -0500
+++ b/squashfs-tools/mksquashfs.c 2019-04-18 11:04:16.860682497 -0500
@@ -3537,11 +3537,11 @@ void dir_scan2(struct dir_info *dir, str
char *subpath = strdup(subpathname(dir_ent));
struct dir_info *sub_dir = scan1_opendir("", subpath,
dir->depth + 1);
+ free(subpath);
if(sub_dir == NULL) {
ERROR_START("Could not create pseudo directory "
"\"%s\"", pseudo_ent->pathname);
ERROR_EXIT(", skipping...\n");
- free(subpath);
pseudo_ino --;
continue;
}
diff -Nupr a/squashfs-tools/read_fs.c b/squashfs-tools/read_fs.c
--- a/squashfs-tools/read_fs.c 2014-05-09 23:54:13.000000000 -0500
+++ b/squashfs-tools/read_fs.c 2019-04-18 11:06:32.499233451 -0500
@@ -974,7 +974,8 @@ long long read_filesystem(char *root_nam
error:
free(id_table);
- free(inode_table);
+ if (inode_table)
+ free(inode_table);
free(directory_table);
return 0;
}
diff -Nupr a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
--- a/squashfs-tools/unsquash-4.c 2019-04-18 10:51:05.972460124 -0500
+++ b/squashfs-tools/unsquash-4.c 2019-04-18 11:32:54.600160166 -0500
@@ -50,9 +50,11 @@ int read_fragment_table_4(long long *dir
"fragment table index\n");
fragment_table = malloc(bytes);
- if(fragment_table == NULL)
+ if(fragment_table == NULL) {
+ free(fragment_table_index);
EXIT_UNSQUASH("read_fragment_table: failed to allocate "
"fragment table\n");
+ }
res = read_fs_bytes(fd, sBlk.s.fragment_table_start,
SQUASHFS_FRAGMENT_INDEX_BYTES(sBlk.s.fragments),
@@ -60,7 +62,7 @@ int read_fragment_table_4(long long *dir
if(res == FALSE) {
ERROR("read_fragment_table: failed to read fragment table "
"index\n");
- return FALSE;
+ goto out;
}
SQUASHFS_INSWAP_FRAGMENT_INDEXES(fragment_table_index, indexes);
@@ -75,7 +77,8 @@ int read_fragment_table_4(long long *dir
if(length == FALSE) {
ERROR("read_fragment_table: failed to read fragment "
"table index\n");
- return FALSE;
+ res = FALSE;
+ goto out;
}
}
@@ -83,7 +86,10 @@ int read_fragment_table_4(long long *dir
SQUASHFS_INSWAP_FRAGMENT_ENTRY(&fragment_table[i]);
*directory_table_end = fragment_table_index[0];
- return TRUE;
+ res = TRUE;
+out:
+ free(fragment_table_index);
+ return res;
}

11
SOURCES/bz1624173.patch
View File

@ -1,11 +0,0 @@
--- a/squashfs-tools/Makefile 2019-07-24 13:52:09.552920269 -0400
+++ b/squashfs-tools/Makefile 2019-07-24 23:52:47.839665687 -0400
@@ -107,6 +107,8 @@ XATTR_DEFAULT = 1
# End of BUILD options section #
###############################################
+EXTRA_LDFLAGS += -z now -pie
+
INCLUDEDIR = -I.
INSTALL_DIR = /usr/local/bin

13
SOURCES/bz1754815.patch
View File

@ -1,13 +0,0 @@
--- a/squashfs-tools/mksquashfs.c
+++ b/squashfs-tools/mksquashfs.c
@@ -2447,8 +2447,8 @@ void *frag_deflator(void *arg)
write_buffer->block = bytes;
bytes += compressed_size;
fragments_outstanding --;
- pthread_mutex_unlock(&fragment_mutex);
queue_put(to_writer, write_buffer);
+ pthread_mutex_unlock(&fragment_mutex);
TRACE("Writing fragment %lld, uncompressed size %d, "
"compressed size %d\n", file_buffer->block,
file_buffer->size, compressed_size);

20
SOURCES/bz1895017.patch
View File

@ -1,20 +0,0 @@
--- a/squashfs-tools/unsquashfs.c 2021-01-14 14:34:49.658184361 -0600
+++ b/squashfs-tools/unsquashfs.c 2021-01-14 14:50:19.604100949 -0600
@@ -822,8 +822,6 @@ int set_attributes(char *pathname, int m
{
struct utimbuf times = { time, time };
- write_xattr(pathname, xattr);
-
if(utime(pathname, &times) == -1) {
ERROR("set_attributes: failed to set time on %s, because %s\n",
pathname, strerror(errno));
@@ -846,6 +844,8 @@ int set_attributes(char *pathname, int m
return FALSE;
}
+ write_xattr(pathname, xattr);
+
return TRUE;
}

231
SOURCES/bz2000638.patch Normal file
View File

@ -0,0 +1,231 @@
diff -Nupr a/squashfs-tools/Makefile b/squashfs-tools/Makefile
--- a/squashfs-tools/Makefile 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/Makefile 2021-10-01 09:21:50.323315827 -0500
@@ -156,7 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o
caches-queues-lists.o
UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \
- unsquash-4.o unsquash-123.o unsquash-34.o swap.o compressor.o unsquashfs_info.o
+ unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \
+ compressor.o unsquashfs_info.o
CFLAGS ?= -O2
CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \
@@ -350,6 +351,8 @@ unsquash-123.o: unsquashfs.h unsquash-12
unsquash-34.o: unsquashfs.h unsquash-34.c
+unsquash-1234.o: unsquash-1234.c
+
unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h
unsquashfs_info.o: unsquashfs.h squashfs_fs.h
diff -Nupr a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c
--- a/squashfs-tools/unsquash-1234.c 1969-12-31 18:00:00.000000000 -0600
+++ b/squashfs-tools/unsquash-1234.c 2021-10-01 09:21:50.323315827 -0500
@@ -0,0 +1,58 @@
+/*
+ * Unsquash a squashfs filesystem. This is a highly compressed read only
+ * filesystem.
+ *
+ * Copyright (c) 2021
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * unsquash-1234.c
+ *
+ * Helper functions used by unsquash-1, unsquash-2, unsquash-3 and
+ * unsquash-4.
+ */
+
+#define TRUE 1
+#define FALSE 0
+/*
+ * Check name for validity, name should not
+ * - be ".", "./", or
+ * - be "..", "../" or
+ * - have a "/" anywhere in the name, or
+ * - be shorter than the expected size
+ */
+int check_name(char *name, int size)
+{
+ char *start = name;
+
+ if(name[0] == '.') {
+ if(name[1] == '.')
+ name++;
+ if(name[1] == '/' || name[1] == '\0')
+ return FALSE;
+ }
+
+ while(name[0] != '/' && name[0] != '\0')
+ name ++;
+
+ if(name[0] == '/')
+ return FALSE;
+
+ if((name - start) != size)
+ return FALSE;
+
+ return TRUE;
+}
diff -Nupr a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
--- a/squashfs-tools/unsquash-1.c 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/unsquash-1.c 2021-10-01 09:21:50.323315827 -0500
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2019
+ * Copyright (c) 2009, 2010, 2011, 2012, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -285,6 +285,13 @@ static struct dir *squashfs_opendir(unsi
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff -Nupr a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c
--- a/squashfs-tools/unsquash-2.c 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/unsquash-2.c 2021-10-01 09:21:50.323315827 -0500
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2013, 2019
+ * Copyright (c) 2009, 2010, 2013, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -386,6 +386,13 @@ static struct dir *squashfs_opendir(unsi
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff -Nupr a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
--- a/squashfs-tools/unsquash-3.c 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/unsquash-3.c 2021-10-01 09:21:50.324315841 -0500
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -413,6 +413,13 @@ static struct dir *squashfs_opendir(unsi
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff -Nupr a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
--- a/squashfs-tools/unsquash-4.c 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/unsquash-4.c 2021-10-01 09:21:50.324315841 -0500
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -349,6 +349,13 @@ static struct dir *squashfs_opendir(unsi
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff -Nupr a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
--- a/squashfs-tools/unsquashfs.c 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/unsquashfs.c 2021-10-01 09:23:29.009735964 -0500
@@ -3,7 +3,7 @@
* filesystem.
*
* Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011,
- * 2012, 2013, 2014, 2017, 2019
+ * 2012, 2013, 2014, 2017, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -2620,8 +2620,8 @@ int parse_number(char *start, int *res)
#define VERSION() \
- printf("unsquashfs version 4.4-git.1 (2020/10/30)\n");\
- printf("copyright (C) 2020 Phillip Lougher "\
+ printf("unsquashfs version 4.4-git.1 (2021/1/17)\n");\
+ printf("copyright (C) 2021 Phillip Lougher "\
"<phillip@squashfs.org.uk>\n\n");\
printf("This program is free software; you can redistribute it and/or"\
"\n");\
diff -Nupr a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
--- a/squashfs-tools/unsquashfs.h 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/unsquashfs.h 2021-10-01 09:21:50.325315855 -0500
@@ -4,7 +4,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2013, 2014, 2019
+ * Copyright (c) 2009, 2010, 2013, 2014, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -261,4 +261,7 @@ extern int read_ids(int, long long, long
/* unsquash-34.c */
extern long long *alloc_index_table(int);
+
+/* unsquash-1234.c */
+extern int check_name(char *, int);
#endif

11
SOURCES/bz1716278.patch → SOURCES/bz2023218.patch
View File

@ -1,14 +1,15 @@
--- a/squashfs-tools/mksquashfs.c 2019-08-06 11:03:34.071402614 -0400
+++ b/squashfs-tools/mksquashfs.c 2019-08-06 11:09:54.063340318 -0400
@@ -267,6 +267,7 @@ pthread_mutex_t pos_mutex = PTHREAD_MUTE
pthread_mutex_t dup_mutex = PTHREAD_MUTEX_INITIALIZER;
diff -Nupr a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
--- a/squashfs-tools/mksquashfs.c 2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/mksquashfs.c 2022-01-12 10:58:37.704782953 -0600
@@ -290,6 +290,7 @@ int all_time_opt = FALSE;
int clamping = TRUE;
/* user options that control parallelisation */
+#define MAX_CPUS 256
int processors = -1;
int bwriter_size;
@@ -4124,6 +4125,10 @@ void initialise_threads(int readq, int f
@@ -4385,6 +4386,10 @@ void initialise_threads(int readq, int f
#endif
}

29
SOURCES/cve-2015-4645.patch
View File

@ -1,29 +0,0 @@
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index ecdaac796f09..2c0cf63daf67 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -31,9 +31,9 @@ static unsigned int *id_table;
int read_fragment_table_4(long long *directory_table_end)
{
int res, i;
- int bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
- int indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
- long long fragment_table_index[indexes];
+ size_t bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
+ size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
+ long long *fragment_table_index;
TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
"from 0x%llx\n", sBlk.s.fragments, indexes,
@@ -44,6 +44,11 @@ int read_fragment_table_4(long long *directory_table_end)
return TRUE;
}
+ fragment_table_index = malloc(indexes*sizeof(long long));
+ if(fragment_table_index == NULL)
+ EXIT_UNSQUASH("read_fragment_table: failed to allocate "
+ "fragment table index\n");
+
fragment_table = malloc(bytes);
if(fragment_table == NULL)
EXIT_UNSQUASH("read_fragment_table: failed to allocate "

11
SOURCES/local-cve-fix.patch
View File

@ -1,11 +0,0 @@
--- squashfs-tools/unsquash-4.c.orig 2015-06-24 14:23:22.270710744 -0500
+++ squashfs-tools/unsquash-4.c 2015-06-24 14:24:13.671243487 -0500
@@ -35,7 +35,7 @@
size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
long long *fragment_table_index;
- TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
+ TRACE("read_fragment_table: %u fragments, reading %zu fragment indexes "
"from 0x%llx\n", sBlk.s.fragments, indexes,
sBlk.s.fragment_table_start);

33
SOURCES/mem-overflow.patch
View File

@ -1,33 +0,0 @@
From 604b607d8ac91eb8afc0b6e3d917d5c073096103 Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Wed, 11 Jun 2014 04:51:37 +0100
Subject: mksquashfs: ensure value does not overflow a signed int in -mem
option
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
index 5370ecf..9676dc8 100644
--- a/squashfs-tools/mksquashfs.c
+++ b/squashfs-tools/mksquashfs.c
@@ -5193,7 +5193,16 @@ print_compressor_options:
argv[0]);
exit(1);
}
- /* convert from bytes to Mbytes */
+
+ /*
+ * convert from bytes to Mbytes, ensuring the value
+ * does not overflow a signed int
+ */
+ if(number >= (1LL << 51)) {
+ ERROR("%s: -mem invalid mem size\n", argv[0]);
+ exit(1);
+ }
+
total_mem = number / 1048576;
if(total_mem < (SQUASHFS_LOWMEM / SQUASHFS_TAKE)) {
ERROR("%s: -mem should be %d Mbytes or "
--
cgit v0.10.1

22
SOURCES/mksquashfs-sysmacros-fix.patch
View File

@ -1,22 +0,0 @@
diff -Nupr squashfs4.3.orig/squashfs-tools/mksquashfs.c squashfs4.3/squashfs-tools/mksquashfs.c
--- squashfs4.3.orig/squashfs-tools/mksquashfs.c 2018-08-20 10:47:49.286289155 -0400
+++ squashfs4.3/squashfs-tools/mksquashfs.c 2018-08-20 10:49:28.348541210 -0400
@@ -35,6 +35,7 @@
#include <stddef.h>
#include <sys/types.h>
#include <sys/stat.h>
+#include <sys/sysmacros.h>
#include <fcntl.h>
#include <errno.h>
#include <dirent.h>
diff -Nupr squashfs4.3.orig/squashfs-tools/unsquashfs.c squashfs4.3/squashfs-tools/unsquashfs.c
--- squashfs4.3.orig/squashfs-tools/unsquashfs.c 2018-08-20 10:47:49.283289208 -0400
+++ squashfs4.3/squashfs-tools/unsquashfs.c 2018-08-20 10:58:44.238732579 -0400
@@ -35,6 +35,7 @@
#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
+#include <sys/sysmacros.h>
#include <limits.h>
#include <ctype.h>

14
SOURCES/mksquashfs.1
View File

@ -1,4 +1,4 @@
.TH MKSQUASHFS 1 "2014\-05\-13" "4.3" "create and append squashfs filesystems"
.TH MKSQUASHFS 1 "2020\-05\-12" "4.4" "create and append squashfs filesystems"
.SH NAME
mksquashfs \- tool to create and append to squashfs filesystems
@ -50,6 +50,8 @@ set all file gids to gid.
do not pad filesystem to a multiple of 4K.
.IP "\-keep\-as\-directory" 4
if one source directory is specified, create a root directory containing that directory, rather than the contents of the directory.
.IP "\-all\-time time"
32 bit integer indicating seconds since the epoch (1970\-01\-01) used for the timestamp for all files. The SOURCE_DATE_EPOCH environment variable can also be used.
.SS Filesystem filter options
.IP "\-p \fIPSEUDO_DEFINITION\fR" 4
@ -96,6 +98,10 @@ Deprecated. Use \-mem instead.
Deprecated. Use \-mem instead.
.IP "\-fragment\-queue \fISIZE\fR" 4
Deprecated. Use \-mem instead.
.IP "\-mkfs\-time time"
32 bit integer indicating seconds since the epoch (1970\-01\-01). The SOURCE_DATE_EPOCH environment variable can also be used.
.IP "-not\-reproducible"
This option tells Mksquashfs that the files do not have to be strictly ordered.
.SS Miscellaneous options
.IP "\-root\-owned" 4
@ -133,6 +139,10 @@ Compress using LZ4 High Compression
Compress using filter1,filter2,...,filterN in turn (in addition to no filter), and choose the best compression. Available filters: x86, arm, armthumb, powerpc, sparc, ia64.
.IP "\-Xdict\-size \fIDICT_SIZE\fR" 4
Use \fIDICT_SIZE\fR as the XZ dictionary size. The dictionary size can be specified as a percentage of the block size, or as an absolute value. The dictionary size must be less than or equal to the block size and 8192 bytes or larger. It must also be storable in the xz header as either 2^n or as 2^n+2^(n+1). Example dict\-sizes are 75%, 50%, 37.5%, 25%, or 32K, 16K, 8K etc.
.IP "zstd" 4
.IP "\-Xcompression-level <compression-level>" 4
<compression-level> should be 1 .. 22 (default 15)
.SH SEE ALSO
unsquashfs(1)
@ -143,4 +153,4 @@ More information about mksquashfs and the squashfs filesystem can be found at <\
.SH AUTHOR
squashfs was written by Phillip Lougher <\fIplougher@users.sourceforge.net\fR>.
.PP
This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.3 for use with Fedora.
This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.4 for use with Fedora.

4
SOURCES/unsquashfs.1
View File

@ -1,4 +1,4 @@
.TH UNSQUASHFS 1 "2014\-05\-13" "4.3" "uncompress squashfs filesystems"
.TH UNSQUASHFS 1 "2020\-05\-12" "4.4" "uncompress squashfs filesystems"
.SH NAME
mksquashfs \- tool to uncompress squashfs filesystems
@ -63,4 +63,4 @@ More information about unsquashfs and the squashfs filesystem can be found at <\
.SH AUTHOR
squashfs was written by Phillip Lougher <\fIplougher@users.sourceforge.net\fR>.
.PP
This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.3 for use with Fedora.
This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.4 for use with Fedora.

139
SPECS/squashfs-tools.spec
View File

@ -1,71 +1,43 @@
Summary: Utility for the creation of squashfs filesystems
%global forgeurl https://github.com/plougher/squashfs-tools
Version: 4.4
Name: squashfs-tools
Version: 4.3
Release: 20%{?dist}
Release: 10.git1%{?dist}
License: GPLv2+
Group: System Environment/Base
URL: http://squashfs.sourceforge.net/
Source0: http://downloads.sourceforge.net/squashfs/squashfs%{version}.tar.gz
URL: %{forgeurl}/archive/4.4-git.1.tar.gz
Source: 4.4-git.1.tar.gz
# manpages from http://ftp.debian.org/debian/pool/main/s/squashfs-tools/squashfs-tools_4.2+20121212-1.debian.tar.xz
# The man pages have been modified for 4.3 for Fedora.
Source1: mksquashfs.1
Source2: unsquashfs.1
# From master branch (55f7ba830d40d438f0b0663a505e0c227fc68b6b).
# 32 bit process can use too much memory when using PAE or 64 bit kernels
Patch0: PAE.patch
# From master branch (604b607d8ac91eb8afc0b6e3d917d5c073096103).
# Prevent overflows when using the -mem option.
Patch1: mem-overflow.patch
# From squashfs-devel@lists.sourceforge.net by Guan Xin <guanx.bac@gmail.com>
# For https://bugzilla.redhat.com/show_bug.cgi?id=1141206
Patch2: 2gb.patch
# From https://github.com/gcanalesb/sasquatch/commit/6777e08cc38bc780d27c69c1d8c272867b74524f
# Which is forked from Phillip's squashfs-tools, though it looks like
# the issue applies to us.
Patch3: cve-2015-4645.patch
# Update formats to match changes in cve-2015-4645.patch
Patch4: local-cve-fix.patch
# rhbz 1611746
Patch5: mksquashfs-sysmacros-fix.patch
# rhbz 1602698
Patch6: bz1602698.patch
# rhbz 1624173
Patch7: bz1624173.patch
# rhbz 1716278
Patch8: bz1716278.patch
# rhbz 1754815
Patch9: bz1754815.patch
# rhbz 1895017
Patch10: bz1895017.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
Patch0: bz2023218.patch
Patch1: bz2000638.patch
Patch2: CVE-2021-41072-c9s-combined.patch
BuildRequires: make
BuildRequires: gcc
BuildRequires: zlib-devel
BuildRequires: xz-devel
BuildRequires: lzo-devel
BuildRequires: libattr-devel
BuildRequires: lz4-devel
BuildRequires: libzstd-devel
%description
Squashfs is a highly compressed read-only filesystem for Linux. This package
contains the utilities for manipulating squashfs filesystems.
%prep
%setup -q -n squashfs%{version}
%setup -n %{name}-4.4-git.1
%patch0 -p1
%patch1 -p1
%patch2 -p0
%patch3 -p1
%patch4 -p0
%patch5 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
%patch10 -p1
%patch2 -p1
%build
%set_build_flags
pushd squashfs-tools
CFLAGS="%{optflags}" XZ_SUPPORT=1 LZO_SUPPORT=1 LZMA_XZ_SUPPORT=1 LZ4_SUPPORT=1 make %{?_smp_mflags}
CFLAGS="%{optflags}" XZ_SUPPORT=1 LZO_SUPPORT=1 LZMA_XZ_SUPPORT=1 LZ4_SUPPORT=1 ZSTD_SUPPORT=1 make %{?_smp_mflags}
%install
mkdir -p %{buildroot}%{_sbindir} %{buildroot}%{_mandir}/man1
@ -74,12 +46,8 @@ install -m 755 squashfs-tools/unsquashfs %{buildroot}%{_sbindir}/unsquashfs
install -m 644 %{SOURCE1} %{buildroot}%{_mandir}/man1/mksquashfs.1
install -m 644 %{SOURCE2} %{buildroot}%{_mandir}/man1/unsquashfs.1
%clean
rm -rf %{buildroot}
%files
%defattr(-,root,root,-)
%doc README ACKNOWLEDGEMENTS DONATIONS PERFORMANCE.README README-4.3 CHANGES pseudo-file.example COPYING
%doc README ACKNOWLEDGEMENTS README-4.4 CHANGES COPYING USAGE
%doc README
%{_mandir}/man1/*
@ -88,24 +56,67 @@ rm -rf %{buildroot}
%{_sbindir}/unsquashfs
%changelog
* Thu Feb 25 2021 Abhi Das <adas@redhat.com> - 4.3-20
- rhbz#1895017 - unsquashfs does not preserve file capabilities
rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
Resolves: rhbz#1895017, rhbz#1754815
* Wed Sep 13 2023 Abhi Das <adas@redhat.com> - 4.4-10.git1
- CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
rhbz#2007304
* Tue Aug 06 2019 Abhi Das <adas@redhat.com> - 4.3-19
- rhbz#1602698 - Fix coverity issues
rhbz#1624173 - Fix annocheck failures
rhbz#1716278 - limit max cpus in mksquashfs
Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278
* Mon May 30 2022 Abhi Das <adas@redhat.com> - 4.4-9.git1
- CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
rhbz#2000638
* Tue Aug 06 2019 Abhi Das <adas@redhat.com> - 4.3-18
- Add manual gating test
Resolves: rhbz#1682413
* Wed Jan 12 2022 Abhi Das <adas@redhat.com> - 4.4-8.git1
- limit CPUs on large machines to avoid running out of resources
rhbz#2023218
* Mon Aug 20 2018 Josh Boyer <jwboyer@redhat.com> - 4.3-17
- Fix build against glibc 2.28
Resolves: rhbz#1611746
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 4.4-7.git1
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 4.4-6.git1
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4-5.git1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Sat Nov 14 2020 Bruno Wolff III <bruno@wolff.to> - 4.4-4.git1
- Gating tests failed and unable to rerun them
* Wed Nov 11 2020 Bruno Wolff III <bruno@wolff.to> - 4.4-3.git1
- New upstream release with a minor fix
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue May 12 2020 Bruno Wolff III <bruno@wolff.to> - 4.4-1.20200513gitc570c61
- Go to 4.4 release + plus a few upstream post release patches
* Sat Feb 08 2020 Bruno Wolff III <bruno@wolff.to> - 4.3-25
- Fix duplicate definition flagged by gcc10
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-24
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Jan 17 2020 Jeff Law <law@redhat.com> - 4.3-23
- Fix undefined symbol when building with LTO due to incorrect
use of inline function
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-22
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Jun 24 2019 Bruno Wolff III <bruno@wolff.to> - 4.3-21
- Add zstd compression support (Sean Purcell via github.com/plougher/squashfs-tools)
* Tue May 21 2019 Bruno Wolff III <bruno@wolff.to> - 4.3-20
- Fix issue with LDFLAGS not being set
* Tue May 21 2019 Bruno Wolff III <bruno@wolff.to> - 4.3-19
- Fix issue with glibc changes
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-17
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-16
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild