diff options
| author | Alex Vong <alexvong1995@gmail.com> | 2019-01-05 23:20:41 +0800 |
|---|---|---|
| committer | Alex Vong <alexvong1995@gmail.com> | 2019-01-07 05:42:34 +0800 |
| commit | c824dedf711dc4aa33e005fa291a3aec58a9e2e2 (patch) | |
| tree | 9869dce2671ec91de478d2bd63b5aa4fc09690d9 /gnu/packages/patches/libarchive-CVE-2018-1000877.patch | |
| parent | b7ec276e570a4c41d2b333848c7488d65322209c (diff) | |
| download | gnu-guix-c824dedf711dc4aa33e005fa291a3aec58a9e2e2.tar gnu-guix-c824dedf711dc4aa33e005fa291a3aec58a9e2e2.tar.gz | |
gnu: libarchive: Replace with libarchive 3.3.3 and fix CVE-2018-{1000877,1000878,1000880}.
* gnu/packages/backup.scm (libarchive)[source, home-page]: Use HTTPS.
[replacement]: New field.
(libarchive-3.3.3): New variable.
* gnu/packages/patches/libarchive-CVE-2018-1000877.patch,
gnu/packages/patches/libarchive-CVE-2018-1000878.patch,
gnu/packages/patches/libarchive-CVE-2018-1000880.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
Diffstat (limited to 'gnu/packages/patches/libarchive-CVE-2018-1000877.patch')
| -rw-r--r-- | gnu/packages/patches/libarchive-CVE-2018-1000877.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/gnu/packages/patches/libarchive-CVE-2018-1000877.patch b/gnu/packages/patches/libarchive-CVE-2018-1000877.patch new file mode 100644 index 0000000000..5b68884a0f --- /dev/null +++ b/gnu/packages/patches/libarchive-CVE-2018-1000877.patch @@ -0,0 +1,45 @@ +Fix CVE-2018-1000877: + +https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 +https://github.com/libarchive/libarchive/pull/1105 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000877 +https://security-tracker.debian.org/tracker/CVE-2018-1000877 + +Patch copied from upstream source repository: + +https://github.com/libarchive/libarchive/commit/021efa522ad729ff0f5806c4ce53e4a6cc1daa31 + +From 021efa522ad729ff0f5806c4ce53e4a6cc1daa31 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens <dja@axtens.net> +Date: Tue, 20 Nov 2018 17:56:29 +1100 +Subject: [PATCH] Avoid a double-free when a window size of 0 is specified + +new_size can be 0 with a malicious or corrupted RAR archive. + +realloc(area, 0) is equivalent to free(area), so the region would +be free()d here and the free()d again in the cleanup function. + +Found with a setup running AFL, afl-rb, and qsym. +--- + libarchive/archive_read_support_format_rar.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c +index 23452222..6f419c27 100644 +--- a/libarchive/archive_read_support_format_rar.c ++++ b/libarchive/archive_read_support_format_rar.c +@@ -2300,6 +2300,11 @@ parse_codes(struct archive_read *a) + new_size = DICTIONARY_MAX_SIZE; + else + new_size = rar_fls((unsigned int)rar->unp_size) << 1; ++ if (new_size == 0) { ++ archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, ++ "Zero window size is invalid."); ++ return (ARCHIVE_FATAL); ++ } + new_window = realloc(rar->lzss.window, new_size); + if (new_window == NULL) { + archive_set_error(&a->archive, ENOMEM, +-- +2.20.1 + |