mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

less: Fix for CVE-2022-48624

Browse Source 
Upstream-Status: Backport [c6ac6de496]

(From OE-Core rev: e088a7e59532ede45549e6120be43531fa77855a)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Vijay Anusuri
2024-02-26 12:25:30 +05:30
committed by Steve Sakoman
parent dee3046d2b
commit 5fc659fd02
2 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
meta/recipes-extended/less/less/CVE-2022-48624.patch Normal file
View File

@@ -0,0 +1,41 @@
From c6ac6de49698be84d264a0c4c0c40bb870b10144 Mon Sep 17 00:00:00 2001
From: Mark Nudelman <markn@greenwoodsoftware.com>
Date: Sat, 25 Jun 2022 11:54:43 -0700
Subject: [PATCH] Shell-quote filenames when invoking LESSCLOSE.
Upstream-Status: Backport [https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144]
CVE: CVE-2022-48624
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
filename.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/filename.c b/filename.c
index 5824e385..dff20c08 100644
--- a/filename.c
+++ b/filename.c
@@ -972,6 +972,8 @@ close_altfile(altfilename, filename)
{
#if HAVE_POPEN
char *lessclose;
+ char *qfilename;
+ char *qaltfilename;
FILE *fd;
char *cmd;
int len;
@@ -986,9 +988,13 @@ close_altfile(altfilename, filename)
error("LESSCLOSE ignored; must contain no more than 2 %%s", NULL_PARG);
return;
}
- len = (int) (strlen(lessclose) + strlen(filename) + strlen(altfilename) + 2);
+ qfilename = shell_quote(filename);
+ qaltfilename = shell_quote(altfilename);
+ len = (int) (strlen(lessclose) + strlen(qfilename) + strlen(qaltfilename) + 2);
cmd = (char *) ecalloc(len, sizeof(char));
- SNPRINTF2(cmd, len, lessclose, filename, altfilename);
+ SNPRINTF2(cmd, len, lessclose, qfilename, qaltfilename);
+ free(qaltfilename);
+ free(qfilename);
fd = shellcmd(cmd);
free(cmd);
if (fd != NULL)

1
meta/recipes-extended/less/less_551.bb
View File

@@ -26,6 +26,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \
DEPENDS = "ncurses"
SRC_URI = "http://www.greenwoodsoftware.com/${BPN}/${BPN}-${PV}.tar.gz \
file://CVE-2022-48624.patch \
"
SRC_URI[md5sum] = "4ad4408b06d7a6626a055cb453f36819"