diff mbox series

staging: use relative path in sysroot_stage_dir()

Message ID 20220131085548.25074-1-ahsan_hussain@mentor.com
State Accepted, archived
Commit a1ec3154a53fd9e3f87a53f25113b7f90bcfb489
Headers show
Series staging: use relative path in sysroot_stage_dir() | expand

Commit Message

ahussain Jan. 31, 2022, 8:55 a.m. UTC 
From: Ahsan Hussain <ahsan_hussain@mentor.com>

A regression form cpio CVE-2021-38185 caused the tool to hang for paths
greater than 128 character long. It was reported here:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992098

We were able to reliable reproduce this with dunfell, meta-freescale
recipe imx-boot

https://github.com/Freescale/meta-freescale/blob/dunfell/recipes-bsp/imx-mkimage/imx-boot_1.0.bb

Using relative path on the affected host fixes the issue as this is
always short, being in the same work dir. It would be harmless, and
useful to generally use the relative path for sysroot_stage_dir()

Signed-off-by: Ahsan Hussain <ahsan_hussain@mentor.com>
---
 meta/classes/staging.bbclass | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

ahussain Feb. 10, 2022, 5:35 a.m. UTC | #1 
Hello maintainers,

Can we get a feedback on this.

Thanks,
Ahsan
diff mbox series

Patch

diff --git a/meta/classes/staging.bbclass b/meta/classes/staging.bbclass
index 25f77c7735..4f278b2205 100644
--- a/meta/classes/staging.bbclass
+++ b/meta/classes/staging.bbclass
@@ -49,9 +49,10 @@  sysroot_stage_dir() {
 	fi
 
 	mkdir -p "$dest"
+	rdest=$(realpath --relative-to="$src" "$dest")
 	(
 		cd $src
-		find . -print0 | cpio --null -pdlu $dest
+		find . -print0 | cpio --null -pdlu $rdest
 	)
 }