Message ID | 20230217223112.550946-1-joe.slater@windriver.com |
---|---|
State | New |
Headers | show |
Series | [oe-core,1/2] Revert "tar: Fix CVE-2022-48303" | expand |
Why did you send it as revert and re-apply instead of just updating the .patch file? It would be much easier to review and to see what really changed. On Fri, Feb 17, 2023 at 11:31 PM Joe Slater <joe.slater@windriver.com> wrote: > This reverts commit 4573a584397f197fbc9170abec3c590ea36667f7. > > A fix is available from gnu. > > Signed-off-by: Joe Slater <joe.slater@windriver.com> > --- > .../tar/files/CVE-2022-48303.patch | 36 ------------------- > meta/recipes-extended/tar/tar_1.34.bb | 4 +-- > 2 files changed, 1 insertion(+), 39 deletions(-) > delete mode 100644 meta/recipes-extended/tar/files/CVE-2022-48303.patch > > diff --git a/meta/recipes-extended/tar/files/CVE-2022-48303.patch > b/meta/recipes-extended/tar/files/CVE-2022-48303.patch > deleted file mode 100644 > index a8e9f4ac7d..0000000000 > --- a/meta/recipes-extended/tar/files/CVE-2022-48303.patch > +++ /dev/null > @@ -1,36 +0,0 @@ > -From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001 > -From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com> > -Date: Wed, 11 Jan 2023 08:55:58 +0100 > -Subject: [PATCH] Fix savannah bug #62387 > - > -* src/list.c (from_header): Check for the end of field after leading byte > - (0x80 or 0xff) of base-256 encoded header value > - > -Upstream-Status: Backport > -[https://savannah.gnu.org/patch/download.php?file_id=54212] > -CVE: CVE-2022-48303 > -Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> > ---- > - src/list.c | 6 ++++++ > - 1 file changed, 6 insertions(+) > - > -diff --git a/src/list.c b/src/list.c > -index 9fafc425..bf41b581 100644 > ---- a/src/list.c > -+++ b/src/list.c > -@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char > const *type, > - << (CHAR_BIT * sizeof (uintmax_t) > - - LG_256 - (LG_256 - 2))); > - value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit; > -+ if (where == lim) > -+ { > -+ if (type && !silent) > -+ ERROR ((0, 0, _("Archive base-256 value is invalid"))); > -+ return -1; > -+ } > - for (;;) > - { > - value = (value << LG_256) + (unsigned char) *where++; > --- > -2.38.1 > - > diff --git a/meta/recipes-extended/tar/tar_1.34.bb > b/meta/recipes-extended/tar/tar_1.34.bb > index 22c04ba70a..7307cd57a2 100644 > --- a/meta/recipes-extended/tar/tar_1.34.bb > +++ b/meta/recipes-extended/tar/tar_1.34.bb > @@ -6,9 +6,7 @@ SECTION = "base" > LICENSE = "GPL-3.0-only" > LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" > > -SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2 \ > - file://CVE-2022-48303.patch \ > - " > +SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2" > > SRC_URI[sha256sum] = > "b44cc67f8a1f6b0250b7c860e952b37e8ed932a90bd9b1862a511079255646ff" > > -- > 2.25.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#101124): > https://lists.openembedded.org/g/openembedded-devel/message/101124 > Mute This Topic: https://lists.openembedded.org/mt/97039915/3617156 > Group Owner: openembedded-devel+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [ > Martin.Jansa@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > >
On Fri, Feb 17, 2023 at 11:37 PM Martin Jansa via lists.openembedded.org <Martin.Jansa=gmail.com@lists.openembedded.org> wrote: > Why did you send it as revert and re-apply instead of just updating the > .patch file? It would be much easier to review and to see what really > changed. > And it's also no wrong ML, so you can try again with oe-core ML. Hint: openembedded-core $ git config sendemail.to openembedded-core@lists.openembedded.org meta-openembedded $ git config sendemail.to openembedded-devel@lists.openembedded.org On Fri, Feb 17, 2023 at 11:31 PM Joe Slater <joe.slater@windriver.com> > wrote: > >> This reverts commit 4573a584397f197fbc9170abec3c590ea36667f7. >> >> A fix is available from gnu. >> >> Signed-off-by: Joe Slater <joe.slater@windriver.com> >> --- >> .../tar/files/CVE-2022-48303.patch | 36 ------------------- >> meta/recipes-extended/tar/tar_1.34.bb | 4 +-- >> 2 files changed, 1 insertion(+), 39 deletions(-) >> delete mode 100644 meta/recipes-extended/tar/files/CVE-2022-48303.patch >> >> diff --git a/meta/recipes-extended/tar/files/CVE-2022-48303.patch >> b/meta/recipes-extended/tar/files/CVE-2022-48303.patch >> deleted file mode 100644 >> index a8e9f4ac7d..0000000000 >> --- a/meta/recipes-extended/tar/files/CVE-2022-48303.patch >> +++ /dev/null >> @@ -1,36 +0,0 @@ >> -From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001 >> -From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com> >> -Date: Wed, 11 Jan 2023 08:55:58 +0100 >> -Subject: [PATCH] Fix savannah bug #62387 >> - >> -* src/list.c (from_header): Check for the end of field after leading byte >> - (0x80 or 0xff) of base-256 encoded header value >> - >> -Upstream-Status: Backport >> -[https://savannah.gnu.org/patch/download.php?file_id=54212] >> -CVE: CVE-2022-48303 >> -Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> >> ---- >> - src/list.c | 6 ++++++ >> - 1 file changed, 6 insertions(+) >> - >> -diff --git a/src/list.c b/src/list.c >> -index 9fafc425..bf41b581 100644 >> ---- a/src/list.c >> -+++ b/src/list.c >> -@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char >> const *type, >> - << (CHAR_BIT * sizeof (uintmax_t) >> - - LG_256 - (LG_256 - 2))); >> - value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit; >> -+ if (where == lim) >> -+ { >> -+ if (type && !silent) >> -+ ERROR ((0, 0, _("Archive base-256 value is invalid"))); >> -+ return -1; >> -+ } >> - for (;;) >> - { >> - value = (value << LG_256) + (unsigned char) *where++; >> --- >> -2.38.1 >> - >> diff --git a/meta/recipes-extended/tar/tar_1.34.bb >> b/meta/recipes-extended/tar/tar_1.34.bb >> index 22c04ba70a..7307cd57a2 100644 >> --- a/meta/recipes-extended/tar/tar_1.34.bb >> +++ b/meta/recipes-extended/tar/tar_1.34.bb >> @@ -6,9 +6,7 @@ SECTION = "base" >> LICENSE = "GPL-3.0-only" >> LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" >> >> -SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2 \ >> - file://CVE-2022-48303.patch \ >> - " >> +SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2" >> >> SRC_URI[sha256sum] = >> "b44cc67f8a1f6b0250b7c860e952b37e8ed932a90bd9b1862a511079255646ff" >> >> -- >> 2.25.1 >> >> >> >> >> > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#101126): > https://lists.openembedded.org/g/openembedded-devel/message/101126 > Mute This Topic: https://lists.openembedded.org/mt/97039915/3617156 > Group Owner: openembedded-devel+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [ > Martin.Jansa@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > >
To be able to cherry-pick the final patch. Comparing the patches won’t tell you much – they are totally different. Joe From: Martin Jansa <martin.jansa@gmail.com> Sent: Friday, February 17, 2023 2:37 PM To: Slater, Joseph <joe.slater@windriver.com> Cc: openembedded-devel@lists.openembedded.org; MacLeod, Randy <Randy.MacLeod@windriver.com>; Quesada, Rodolfo <Rodolfo.Quesada@windriver.com> Subject: Re: [oe] [oe-core][PATCH 1/2] Revert "tar: Fix CVE-2022-48303" Why did you send it as revert and re-apply instead of just updating the .patch file? It would be much easier to review and to see what really changed. On Fri, Feb 17, 2023 at 11:31 PM Joe Slater <joe.slater@windriver.com<mailto:joe.slater@windriver.com>> wrote: This reverts commit 4573a584397f197fbc9170abec3c590ea36667f7. A fix is available from gnu. Signed-off-by: Joe Slater <joe.slater@windriver.com<mailto:joe.slater@windriver.com>> --- .../tar/files/CVE-2022-48303.patch | 36 ------------------- meta/recipes-extended/tar/tar_1.34.bb<https://urldefense.com/v3/__http:/tar_1.34.bb__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgMPTpBG3$> | 4 +-- 2 files changed, 1 insertion(+), 39 deletions(-) delete mode 100644 meta/recipes-extended/tar/files/CVE-2022-48303.patch diff --git a/meta/recipes-extended/tar/files/CVE-2022-48303.patch b/meta/recipes-extended/tar/files/CVE-2022-48303.patch deleted file mode 100644 index a8e9f4ac7d..0000000000 --- a/meta/recipes-extended/tar/files/CVE-2022-48303.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com<mailto:mmuzila@gmail.com>> -Date: Wed, 11 Jan 2023 08:55:58 +0100 -Subject: [PATCH] Fix savannah bug #62387 - -* src/list.c (from_header): Check for the end of field after leading byte - (0x80 or 0xff) of base-256 encoded header value - -Upstream-Status: Backport -[https://savannah.gnu.org/patch/download.php?file_id=54212<https://urldefense.com/v3/__https:/savannah.gnu.org/patch/download.php?file_id=54212__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgB0ezNK4$>] -CVE: CVE-2022-48303 -Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com<mailto:chee.yang.lee@intel.com>> ---- - src/list.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/src/list.c b/src/list.c -index 9fafc425..bf41b581 100644 ---- a/src/list.c -+++ b/src/list.c -@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char const *type, - << (CHAR_BIT * sizeof (uintmax_t) - - LG_256 - (LG_256 - 2))); - value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit; -+ if (where == lim) -+ { -+ if (type && !silent) -+ ERROR ((0, 0, _("Archive base-256 value is invalid"))); -+ return -1; -+ } - for (;;) - { - value = (value << LG_256) + (unsigned char) *where++; --- -2.38.1 - diff --git a/meta/recipes-extended/tar/tar_1.34.bb<https://urldefense.com/v3/__http:/tar_1.34.bb__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgMPTpBG3$> b/meta/recipes-extended/tar/tar_1.34.bb<https://urldefense.com/v3/__http:/tar_1.34.bb__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgMPTpBG3$> index 22c04ba70a..7307cd57a2 100644 --- a/meta/recipes-extended/tar/tar_1.34.bb<https://urldefense.com/v3/__http:/tar_1.34.bb__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgMPTpBG3$> +++ b/meta/recipes-extended/tar/tar_1.34.bb<https://urldefense.com/v3/__http:/tar_1.34.bb__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgMPTpBG3$> @@ -6,9 +6,7 @@ SECTION = "base" LICENSE = "GPL-3.0-only" LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" -SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2 \ - file://CVE-2022-48303.patch \ - " +SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2" SRC_URI[sha256sum] = "b44cc67f8a1f6b0250b7c860e952b37e8ed932a90bd9b1862a511079255646ff" -- 2.25.1 -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#101124): https://lists.openembedded.org/g/openembedded-devel/message/101124<https://urldefense.com/v3/__https:/lists.openembedded.org/g/openembedded-devel/message/101124__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgIgONYbT$> Mute This Topic: https://lists.openembedded.org/mt/97039915/3617156<https://urldefense.com/v3/__https:/lists.openembedded.org/mt/97039915/3617156__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgMqrlRv2$> Group Owner: openembedded-devel+owner@lists.openembedded.org<mailto:openembedded-devel%2Bowner@lists.openembedded.org> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub<https://urldefense.com/v3/__https:/lists.openembedded.org/g/openembedded-devel/unsub__;!!AjveYdw8EvQ!a8aDKkQZ4LVrbnnja8bpsEmZW0p9s3rW1nSk9nmq6eWOez1RpWHjaPDgo8d1ebDoOE4wOwJVUaZV0p-PgEMhvn0r$> [Martin.Jansa@gmail.com<mailto:Martin.Jansa@gmail.com>] -=-=-=-=-=-=-=-=-=-=-=-
diff --git a/meta/recipes-extended/tar/files/CVE-2022-48303.patch b/meta/recipes-extended/tar/files/CVE-2022-48303.patch deleted file mode 100644 index a8e9f4ac7d..0000000000 --- a/meta/recipes-extended/tar/files/CVE-2022-48303.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com> -Date: Wed, 11 Jan 2023 08:55:58 +0100 -Subject: [PATCH] Fix savannah bug #62387 - -* src/list.c (from_header): Check for the end of field after leading byte - (0x80 or 0xff) of base-256 encoded header value - -Upstream-Status: Backport -[https://savannah.gnu.org/patch/download.php?file_id=54212] -CVE: CVE-2022-48303 -Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> ---- - src/list.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/src/list.c b/src/list.c -index 9fafc425..bf41b581 100644 ---- a/src/list.c -+++ b/src/list.c -@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char const *type, - << (CHAR_BIT * sizeof (uintmax_t) - - LG_256 - (LG_256 - 2))); - value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit; -+ if (where == lim) -+ { -+ if (type && !silent) -+ ERROR ((0, 0, _("Archive base-256 value is invalid"))); -+ return -1; -+ } - for (;;) - { - value = (value << LG_256) + (unsigned char) *where++; --- -2.38.1 - diff --git a/meta/recipes-extended/tar/tar_1.34.bb b/meta/recipes-extended/tar/tar_1.34.bb index 22c04ba70a..7307cd57a2 100644 --- a/meta/recipes-extended/tar/tar_1.34.bb +++ b/meta/recipes-extended/tar/tar_1.34.bb @@ -6,9 +6,7 @@ SECTION = "base" LICENSE = "GPL-3.0-only" LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" -SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2 \ - file://CVE-2022-48303.patch \ - " +SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2" SRC_URI[sha256sum] = "b44cc67f8a1f6b0250b7c860e952b37e8ed932a90bd9b1862a511079255646ff"
This reverts commit 4573a584397f197fbc9170abec3c590ea36667f7. A fix is available from gnu. Signed-off-by: Joe Slater <joe.slater@windriver.com> --- .../tar/files/CVE-2022-48303.patch | 36 ------------------- meta/recipes-extended/tar/tar_1.34.bb | 4 +-- 2 files changed, 1 insertion(+), 39 deletions(-) delete mode 100644 meta/recipes-extended/tar/files/CVE-2022-48303.patch