diff options
author | Alexander Kanavin <alex.kanavin@gmail.com> | 2022-12-28 08:37:18 +0100 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-01-12 04:56:26 -1000 |
commit | 41e1b4c29e45a9022eea8f89dfb09b6eb2eae60b (patch) | |
tree | 3b9872b3081438c1b022299171ce7c1bb37959e9 | |
parent | 874b72fe259cd3a23f4613fccfe2e9cc3f79cd6a (diff) | |
download | openembedded-core-contrib-41e1b4c29e45a9022eea8f89dfb09b6eb2eae60b.tar.gz |
libarchive: upgrade 3.6.1 -> 3.6.2
Libarchive 3.6.2 is a bugfix and security release.
Important security fixes:
NULL pointer dereference vulnerability in archive_write.c (#1754, #1759, CVE-2022-36227)
Important bug fixes:
include ZSTD in Windows builds (#1688)
SSL fixes on Windows (#1714, #1723, #1724)
rar5 reader: fix possible garbled output with bsdtar -O (#1745)
mtree reader: support reading mtree files with tabs (#1783)
various small fixes for issues found by CodeQL
Use --without-iconv as otherwise autotools write a bogus iconv
dependency into .pc file.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit edce1bce81fe2f47fb2c5e2b94ebda73f95cbaea)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 93b972845a28b62ea01ee0f4a1e043bd58fc0892)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
-rw-r--r-- | meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch | 42 | ||||
-rw-r--r-- | meta/recipes-extended/libarchive/libarchive_3.6.2.bb (renamed from meta/recipes-extended/libarchive/libarchive_3.6.1.bb) | 8 |
2 files changed, 3 insertions, 47 deletions
diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch deleted file mode 100644 index d0d143710c..0000000000 --- a/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b5332ed6d59ba5113a0a2c67fd82b69fcd5cde68 Mon Sep 17 00:00:00 2001 -From: obiwac <obiwac@gmail.com> -Date: Fri, 22 Jul 2022 22:41:10 +0200 -Subject: [PATCH] libarchive: CVE-2022-36227 Handle a `calloc` returning NULL - (fixes #1754) - -Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/bff38efe8c110469c5080d387bec62a6ca15b1a5] -CVE: CVE-2022-36227 -Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com ---- - libarchive/archive_write.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/libarchive/archive_write.c b/libarchive/archive_write.c -index 66592e8..27626b5 100644 ---- a/libarchive/archive_write.c -+++ b/libarchive/archive_write.c -@@ -201,6 +201,10 @@ __archive_write_allocate_filter(struct archive *_a) - struct archive_write_filter *f; - - f = calloc(1, sizeof(*f)); -+ -+ if (f == NULL) -+ return (NULL); -+ - f->archive = _a; - f->state = ARCHIVE_WRITE_FILTER_STATE_NEW; - if (a->filter_first == NULL) -@@ -548,6 +552,10 @@ archive_write_open2(struct archive *_a, void *client_data, - a->client_data = client_data; - - client_filter = __archive_write_allocate_filter(_a); -+ -+ if (client_filter == NULL) -+ return (ARCHIVE_FATAL); -+ - client_filter->open = archive_write_client_open; - client_filter->write = archive_write_client_write; - client_filter->close = archive_write_client_close; --- -2.25.1 - diff --git a/meta/recipes-extended/libarchive/libarchive_3.6.1.bb b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb index df9df5e0a6..acc84de9da 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.6.1.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb @@ -30,14 +30,12 @@ PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4," PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls," PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd," -EXTRA_OECONF += "--enable-largefile" +EXTRA_OECONF += "--enable-largefile --without-iconv" -SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ - file://CVE-2022-36227.patch \ - " +SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz" UPSTREAM_CHECK_URI = "http://libarchive.org/" -SRC_URI[sha256sum] = "c676146577d989189940f1959d9e3980d28513d74eedfbc6b7f15ea45fe54ee2" +SRC_URI[sha256sum] = "ba6d02f15ba04aba9c23fd5f236bb234eab9d5209e95d1c4df85c44d5f19b9b3" inherit autotools update-alternatives pkgconfig |