From d6479f5d2e6de17bac8662f5057d87176524c6fa Mon Sep 17 00:00:00 2001 From: Jagadeesh Krishnanjanappa Date: Wed, 22 Aug 2018 17:30:31 +0530 Subject: libarchive: CVE-2017-14503 Reject LHA archive entries with negative size. Affects libarchive = 3.3.2 Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Richard Purdie --- .../libarchive/libarchive/CVE-2017-14503.patch | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch (limited to 'meta/recipes-extended/libarchive/libarchive') diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch new file mode 100644 index 0000000000..779ca854eb --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2017-14503.patch @@ -0,0 +1,33 @@ +From 2c8c83b9731ff822fad6cc8c670ea5519c366a14 Mon Sep 17 00:00:00 2001 +From: Joerg Sonnenberger +Date: Thu, 19 Jul 2018 21:14:53 +0200 +Subject: [PATCH] Reject LHA archive entries with negative size. + +CVE: CVE-2017-14503 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/2c8c83b9731ff822fad6cc8c670ea5519c366a14] + +Signed-off-by: Jagadeesh Krishnanjanappa +--- + libarchive/archive_read_support_format_lha.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c +index b8ef4ae1..95c99bb1 100644 +--- a/libarchive/archive_read_support_format_lha.c ++++ b/libarchive/archive_read_support_format_lha.c +@@ -701,6 +701,12 @@ archive_read_format_lha_read_header(struct archive_read *a, + * Prepare variables used to read a file content. + */ + lha->entry_bytes_remaining = lha->compsize; ++ if (lha->entry_bytes_remaining < 0) { ++ archive_set_error(&a->archive, ++ ARCHIVE_ERRNO_FILE_FORMAT, ++ "Invalid LHa entry size"); ++ return (ARCHIVE_FATAL); ++ } + lha->entry_offset = 0; + lha->entry_crc_calculated = 0; + +-- +2.13.3 + -- cgit 1.2.3-korg