diff options
| -rw-r--r-- | gnu/local.mk | 3 | ||||
| -rw-r--r-- | gnu/packages/backup.scm | 14 | ||||
| -rw-r--r-- | gnu/packages/patches/libarchive-CVE-2018-1000877.patch | 45 | ||||
| -rw-r--r-- | gnu/packages/patches/libarchive-CVE-2018-1000878.patch | 86 | ||||
| -rw-r--r-- | gnu/packages/patches/libarchive-CVE-2018-1000880.patch | 51 |
5 files changed, 7 insertions, 192 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 0ba0d1f194..7c68b40976 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -982,9 +982,6 @@ dist_patch_DATA = \ %D%/packages/patches/liba52-link-with-libm.patch \ %D%/packages/patches/liba52-set-soname.patch \ %D%/packages/patches/liba52-use-mtune-not-mcpu.patch \ - %D%/packages/patches/libarchive-CVE-2018-1000877.patch \ - %D%/packages/patches/libarchive-CVE-2018-1000878.patch \ - %D%/packages/patches/libarchive-CVE-2018-1000880.patch \ %D%/packages/patches/libbase-fix-includes.patch \ %D%/packages/patches/libbase-use-own-logging.patch \ %D%/packages/patches/libbonobo-activation-test-race.patch \ diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm index f62c5c3c00..beb3b09077 100644 --- a/gnu/packages/backup.scm +++ b/gnu/packages/backup.scm @@ -197,18 +197,18 @@ backups (called chunks) to allow easy burning to CD/DVD.") (define-public libarchive (package (name "libarchive") - (version "3.3.3") + (version "3.4.0") (source (origin (method url-fetch) - (uri (string-append "https://libarchive.org/downloads/libarchive-" - version ".tar.gz")) - (patches (search-patches "libarchive-CVE-2018-1000877.patch" - "libarchive-CVE-2018-1000878.patch" - "libarchive-CVE-2018-1000880.patch")) + (uri (list (string-append "https://libarchive.org/downloads/libarchive-" + version ".tar.gz") + (string-append "https://github.com/libarchive/libarchive" + "/releases/download/v" version "/libarchive-" + version ".tar.gz"))) (sha256 (base32 - "0bhfncid058p7n1n8v29l6wxm3mhdqfassscihbsxfwz3iwb2zms")))) + "0pl25mmz1b1cnwf35kxmygyy9g7z7hslxbx329a9yx8csh7dahw6")))) (build-system gnu-build-system) (inputs `(("zlib" ,zlib) diff --git a/gnu/packages/patches/libarchive-CVE-2018-1000877.patch b/gnu/packages/patches/libarchive-CVE-2018-1000877.patch deleted file mode 100644 index 5b68884a0f..0000000000 --- a/gnu/packages/patches/libarchive-CVE-2018-1000877.patch +++ /dev/null @@ -1,45 +0,0 @@ -Fix CVE-2018-1000877: - -https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 -https://github.com/libarchive/libarchive/pull/1105 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000877 -https://security-tracker.debian.org/tracker/CVE-2018-1000877 - -Patch copied from upstream source repository: - -https://github.com/libarchive/libarchive/commit/021efa522ad729ff0f5806c4ce53e4a6cc1daa31 - -From 021efa522ad729ff0f5806c4ce53e4a6cc1daa31 Mon Sep 17 00:00:00 2001 -From: Daniel Axtens <dja@axtens.net> -Date: Tue, 20 Nov 2018 17:56:29 +1100 -Subject: [PATCH] Avoid a double-free when a window size of 0 is specified - -new_size can be 0 with a malicious or corrupted RAR archive. - -realloc(area, 0) is equivalent to free(area), so the region would -be free()d here and the free()d again in the cleanup function. - -Found with a setup running AFL, afl-rb, and qsym. ---- - libarchive/archive_read_support_format_rar.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c -index 23452222..6f419c27 100644 ---- a/libarchive/archive_read_support_format_rar.c -+++ b/libarchive/archive_read_support_format_rar.c -@@ -2300,6 +2300,11 @@ parse_codes(struct archive_read *a) - new_size = DICTIONARY_MAX_SIZE; - else - new_size = rar_fls((unsigned int)rar->unp_size) << 1; -+ if (new_size == 0) { -+ archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, -+ "Zero window size is invalid."); -+ return (ARCHIVE_FATAL); -+ } - new_window = realloc(rar->lzss.window, new_size); - if (new_window == NULL) { - archive_set_error(&a->archive, ENOMEM, --- -2.20.1 - diff --git a/gnu/packages/patches/libarchive-CVE-2018-1000878.patch b/gnu/packages/patches/libarchive-CVE-2018-1000878.patch deleted file mode 100644 index fef0881320..0000000000 --- a/gnu/packages/patches/libarchive-CVE-2018-1000878.patch +++ /dev/null @@ -1,86 +0,0 @@ -Fix CVE-2018-1000878: - -https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 -https://github.com/libarchive/libarchive/pull/1105 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000878 -https://security-tracker.debian.org/tracker/CVE-2018-1000878 - -Patch copied from upstream source repository: - -https://github.com/libarchive/libarchive/commit/bfcfe6f04ed20db2504db8a254d1f40a1d84eb28 - -From bfcfe6f04ed20db2504db8a254d1f40a1d84eb28 Mon Sep 17 00:00:00 2001 -From: Daniel Axtens <dja@axtens.net> -Date: Tue, 4 Dec 2018 00:55:22 +1100 -Subject: [PATCH] rar: file split across multi-part archives must match - -Fuzzing uncovered some UAF and memory overrun bugs where a file in a -single file archive reported that it was split across multiple -volumes. This was caused by ppmd7 operations calling -rar_br_fillup. This would invoke rar_read_ahead, which would in some -situations invoke archive_read_format_rar_read_header. That would -check the new file name against the old file name, and if they didn't -match up it would free the ppmd7 buffer and allocate a new -one. However, because the ppmd7 decoder wasn't actually done with the -buffer, it would continue to used the freed buffer. Both reads and -writes to the freed region can be observed. - -This is quite tricky to solve: once the buffer has been freed it is -too late, as the ppmd7 decoder functions almost universally assume -success - there's no way for ppmd_read to signal error, nor are there -good ways for functions like Range_Normalise to propagate them. So we -can't detect after the fact that we're in an invalid state - e.g. by -checking rar->cursor, we have to prevent ourselves from ever ending up -there. So, when we are in the dangerous part or rar_read_ahead that -assumes a valid split, we set a flag force read_header to either go -down the path for split files or bail. This means that the ppmd7 -decoder keeps a valid buffer and just runs out of data. - -Found with a combination of AFL, afl-rb and qsym. ---- - libarchive/archive_read_support_format_rar.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c -index 6f419c27..a8cc5c94 100644 ---- a/libarchive/archive_read_support_format_rar.c -+++ b/libarchive/archive_read_support_format_rar.c -@@ -258,6 +258,7 @@ struct rar - struct data_block_offsets *dbo; - unsigned int cursor; - unsigned int nodes; -+ char filename_must_match; - - /* LZSS members */ - struct huffman_code maincode; -@@ -1560,6 +1561,12 @@ read_header(struct archive_read *a, struct archive_entry *entry, - } - return ret; - } -+ else if (rar->filename_must_match) -+ { -+ archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, -+ "Mismatch of file parts split across multi-volume archive"); -+ return (ARCHIVE_FATAL); -+ } - - rar->filename_save = (char*)realloc(rar->filename_save, - filename_size + 1); -@@ -2933,12 +2940,14 @@ rar_read_ahead(struct archive_read *a, size_t min, ssize_t *avail) - else if (*avail == 0 && rar->main_flags & MHD_VOLUME && - rar->file_flags & FHD_SPLIT_AFTER) - { -+ rar->filename_must_match = 1; - ret = archive_read_format_rar_read_header(a, a->entry); - if (ret == (ARCHIVE_EOF)) - { - rar->has_endarc_header = 1; - ret = archive_read_format_rar_read_header(a, a->entry); - } -+ rar->filename_must_match = 0; - if (ret != (ARCHIVE_OK)) - return NULL; - return rar_read_ahead(a, min, avail); --- -2.20.1 - diff --git a/gnu/packages/patches/libarchive-CVE-2018-1000880.patch b/gnu/packages/patches/libarchive-CVE-2018-1000880.patch deleted file mode 100644 index 6834cabda0..0000000000 --- a/gnu/packages/patches/libarchive-CVE-2018-1000880.patch +++ /dev/null @@ -1,51 +0,0 @@ -Fix CVE-2018-1000880: - -https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 -https://github.com/libarchive/libarchive/pull/1105 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000880 -https://security-tracker.debian.org/tracker/CVE-2018-1000880 - -Patch copied from upstream source repository: - -https://github.com/libarchive/libarchive/commit/9c84b7426660c09c18cc349f6d70b5f8168b5680 - -From 9c84b7426660c09c18cc349f6d70b5f8168b5680 Mon Sep 17 00:00:00 2001 -From: Daniel Axtens <dja@axtens.net> -Date: Tue, 4 Dec 2018 16:33:42 +1100 -Subject: [PATCH] warc: consume data once read - -The warc decoder only used read ahead, it wouldn't actually consume -data that had previously been printed. This means that if you specify -an invalid content length, it will just reprint the same data over -and over and over again until it hits the desired length. - -This means that a WARC resource with e.g. -Content-Length: 666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666665 -but only a few hundred bytes of data, causes a quasi-infinite loop. - -Consume data in subsequent calls to _warc_read. - -Found with an AFL + afl-rb + qsym setup. ---- - libarchive/archive_read_support_format_warc.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libarchive/archive_read_support_format_warc.c b/libarchive/archive_read_support_format_warc.c -index e8753853..e8fc8428 100644 ---- a/libarchive/archive_read_support_format_warc.c -+++ b/libarchive/archive_read_support_format_warc.c -@@ -386,6 +386,11 @@ _warc_read(struct archive_read *a, const void **buf, size_t *bsz, int64_t *off) - return (ARCHIVE_EOF); - } - -+ if (w->unconsumed) { -+ __archive_read_consume(a, w->unconsumed); -+ w->unconsumed = 0U; -+ } -+ - rab = __archive_read_ahead(a, 1U, &nrd); - if (nrd < 0) { - *bsz = 0U; --- -2.20.1 - |