Blame SOURCES/libarchive-3.1.2-CVE-2016-4809.patch
|
 |
58251f |
From fd7e0c02e272913a0a8b6d492c7260dfca0b1408 Mon Sep 17 00:00:00 2001
|
|
|
58251f |
From: Tim Kientzle <kientzle@acm.org>
|
|
|
58251f |
Date: Sat, 14 May 2016 12:37:37 -0700
|
|
|
58251f |
Subject: [PATCH] Reject cpio symlinks that exceed 1MB
|
|
|
58251f |
|
|
|
58251f |
---
|
|
|
58251f |
libarchive/archive_read_support_format_cpio.c | 5 +++++
|
|
|
58251f |
1 file changed, 5 insertions(+)
|
|
|
58251f |
|
|
|
58251f |
diff --git a/libarchive/archive_read_support_format_cpio.c b/libarchive/archive_read_support_format_cpio.c
|
|
|
58251f |
index c2ca85b..b09db0e 100644
|
|
|
58251f |
--- a/libarchive/archive_read_support_format_cpio.c
|
|
|
58251f |
+++ b/libarchive/archive_read_support_format_cpio.c
|
|
|
58251f |
@@ -401,6 +401,11 @@ archive_read_format_cpio_read_header(struct archive_read *a,
|
|
|
58251f |
|
|
|
58251f |
/* If this is a symlink, read the link contents. */
|
|
|
58251f |
if (archive_entry_filetype(entry) == AE_IFLNK) {
|
|
|
58251f |
+ if (cpio->entry_bytes_remaining > 1024 * 1024) {
|
|
|
58251f |
+ archive_set_error(&a->archive, ENOMEM,
|
|
|
58251f |
+ "Rejecting malformed cpio archive: symlink contents exceed 1 megabyte");
|
|
|
58251f |
+ return (ARCHIVE_FATAL);
|
|
|
58251f |
+ }
|
|
|
58251f |
h = __archive_read_ahead(a,
|
|
|
58251f |
(size_t)cpio->entry_bytes_remaining, NULL);
|
|
|
58251f |
if (h == NULL)
|
|
|
58251f |
--
|
|
|
58251f |
2.7.4
|
|
|
58251f |
|