mirror of
https://git.yoctoproject.org/poky
synced 2026-02-07 01:06:37 +01:00
af06cbf82b
According to [1] which provided the fix link [2], but upstream author reworked it later [3][4][5] Backport and rebase all the patches for tracing [1] https://nvd.nist.gov/vuln/detail/CVE-2024-5569 [2]fd604bd34f[3]3cb5609002[4]f89b93f037[5]cc61e6140f(From OE-Core rev: 13bd99e17f0aca108839e81e9aa0b14351116fdf) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
49 lines
1.4 KiB
Diff
49 lines
1.4 KiB
Diff
From ef4ee19919bd49a9c1207ff8d87f83dd48aed436 Mon Sep 17 00:00:00 2001
|
|
From: "Jason R. Coombs" <jaraco@jaraco.com>
|
|
Date: Wed, 27 Nov 2024 23:35:28 -0800
|
|
Subject: [PATCH 4/5] Address infinite loop when zipfile begins with more than
|
|
one leading slash.
|
|
|
|
Alternate and more surgical fix for jaraco/zipp#119. Ref python/cpython#123270
|
|
|
|
Upstream-Status: Backport [https://github.com/jaraco/zipp/commit/f89b93f0370dd85d23d243e25dfc1f99f4d8de48]
|
|
Remove test codes
|
|
Rebase to v3.7.0
|
|
CVE: CVE-2024-5569
|
|
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
|
---
|
|
zipp.py | 8 ++++++--
|
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/zipp.py b/zipp.py
|
|
index 26b723c..236af49 100644
|
|
--- a/zipp.py
|
|
+++ b/zipp.py
|
|
@@ -37,7 +37,7 @@ def _parents(path):
|
|
def _ancestry(path):
|
|
"""
|
|
Given a path with elements separated by
|
|
- posixpath.sep, generate all elements of that path
|
|
+ posixpath.sep, generate all elements of that path.
|
|
|
|
>>> list(_ancestry('b/d'))
|
|
['b/d', 'b']
|
|
@@ -49,9 +49,13 @@ def _ancestry(path):
|
|
['b']
|
|
>>> list(_ancestry(''))
|
|
[]
|
|
+ Multiple separators are treated like a single.
|
|
+
|
|
+ >>> list(_ancestry('//b//d///f//'))
|
|
+ ['//b//d///f', '//b//d', '//b']
|
|
"""
|
|
path = path.rstrip(posixpath.sep)
|
|
- while path and path != posixpath.sep:
|
|
+ while path and not path.endswith(posixpath.sep):
|
|
yield path
|
|
path, tail = posixpath.split(path)
|
|
|
|
--
|
|
2.25.1
|
|
|