new file mode 100644
@@ -0,0 +1,34 @@
+From 405fc8998181353bd510864ca251dc233afec276 Mon Sep 17 00:00:00 2001
+From: Vitaly Chikunov <vt@altlinux.org>
+Date: Wed, 6 Jan 2021 23:43:41 +0300
+Subject: [PATCH] rpmio: Fix lzopen_internal mode parsing when 'Tn' is used
+
+When there is number after "T" (suggested number of threads or "0" for
+getncpus), lzopen_internal() mode parser would skip one byte, and when
+it's at the end of the string it would then parse undesired garbage from
+the memory, making intermittent compression failures.
+
+Fixes: 7740d1098 ("Add support for multithreaded xz compression")
+Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
+
+Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/commit/405fc8998181353bd510864ca251dc233afec276]
+
+---
+ rpmio/rpmio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rpmio/rpmio.c b/rpmio/rpmio.c
+index ed1e25140..9d32ec6d9 100644
+--- a/rpmio/rpmio.c
++++ b/rpmio/rpmio.c
+@@ -798,6 +798,7 @@ static LZFILE *lzopen_internal(const char *mode, int fd, int xz)
+ * should've processed
+ * */
+ while (isdigit(*++mode));
++ --mode;
+ }
+ #ifdef HAVE_LZMA_MT
+ else
+--
+2.25.1
+
@@ -44,6 +44,7 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;branch=rpm-4.14.x;protoc
file://0001-mono-find-provides-requires-do-not-use-monodis-from-.patch \
file://0001-Rip-out-partial-support-for-unused-MD2-and-RIPEMD160.patch \
file://0001-rpmplugins.c-call-dlerror-prior-to-dlsym.patch \
+ file://0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch \
file://CVE-2021-3421.patch \
file://CVE-2021-20266.patch \
"
rpmbuild can start processing random memory when processing the value provided by XZ_THREADS, and unintentionally disable encoding for a file descriptor that in fact requires encoding to be enabled in order for lzwrite() to actually create an rpm. *** Fdopen(0x7f2030002b30,w6T16.xzdio) | fdio 23 fp (nil) ==> lzopen_internal("w6T16", 23, 1) ==> lzopen_internal set encoding ==> lzopen_internal clear encoding ==> Fdopen(0x7f2030002b30,"w6T16.xzdio") returns fd 0x7f2030002b30 | xzdio 0x7f2030004e30 fp 23 | fdio -1 fp (nil) ==> lzwrite(0x7f2030004e30, 0x7f20789d8070, 6) encoding 0 ==> Fwrite(0x7f2030002b30,0x7f20789d8070,6) rc -1 | xzdio 0x7f2030004e30 fp 23 | fdio -1 fp (nil) error: create archive failed: cpio: write When the encoding bit gets cleared on the LZFILE* struct, lzwrite() then rightfully complains when it detects !lzfile->encoding, which then gets bubbled up as a write failure when we go to create the archive. This fix is available in the rpm 4.17-release. Signed-off-by: Kyle Russell <bkylerussell@gmail.com> --- ..._internal-mode-parsing-when-Tn-is-us.patch | 34 +++++++++++++++++++ meta/recipes-devtools/rpm/rpm_4.14.2.1.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-devtools/rpm/files/0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch