mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
5b3ffcea5e
CQID:WIND00366813 Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi? p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025 (From OE-Core rev: bb1611d4830bb7aff2371afdb2a77a4ca7298c7d) Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> [YOCTO #3564] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
39 lines
1.3 KiB
Diff
39 lines
1.3 KiB
Diff
Upstream-Status: Backport
|
|
|
|
unsquashfs: add a commment and fix some other comments
|
|
|
|
Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
|
|
|
|
diff -urpN a/unsquashfs.c b/unsquashfs.c
|
|
--- a/unsquashfs.c 2012-11-30 15:27:14.000000000 +0800
|
|
+++ b/unsquashfs.c 2012-11-30 15:27:56.000000000 +0800
|
|
@@ -814,7 +814,7 @@ int write_file(struct inode *inode, char
|
|
|
|
/*
|
|
* the writer thread is queued a squashfs_file structure describing the
|
|
- * file. If the file has one or more blocks or a fragments they are
|
|
+ * file. If the file has one or more blocks or a fragment they are
|
|
* queued separately (references to blocks in the cache).
|
|
*/
|
|
file->fd = file_fd;
|
|
@@ -838,7 +838,7 @@ int write_file(struct inode *inode, char
|
|
block->offset = 0;
|
|
block->size = i == file_end ? inode->data & (block_size - 1) :
|
|
block_size;
|
|
- if(block_list[i] == 0) /* sparse file */
|
|
+ if(block_list[i] == 0) /* sparse block */
|
|
block->buffer = NULL;
|
|
else {
|
|
block->buffer = cache_get(data_cache, start,
|
|
@@ -2161,6 +2161,10 @@ options:
|
|
block_size = sBlk.s.block_size;
|
|
block_log = sBlk.s.block_log;
|
|
|
|
+ /*
|
|
+ * convert from queue size in Mbytes to queue size in
|
|
+ * blocks
|
|
+ */
|
|
fragment_buffer_size <<= 20 - block_log;
|
|
data_buffer_size <<= 20 - block_log;
|
|
initialise_threads(fragment_buffer_size, data_buffer_size);
|