On Fri, 2023-02-17 at 15:01 -0800, Joe Slater wrote:
> This reverts commit 4573a584397f197fbc9170abec3c590ea36667f7.
>
> A fix is available from gnu.
>
> Signed-off-by: Joe Slater
> ---
> .../tar/files/CVE-2022-48303.patch| 36 ---
> meta/recipes-extended/tar/tar_1.34.bb | 4 +--
> 2 files changed, 1 insertion(+), 39 deletions(-)
> delete mode 100644 meta/recipes-extended/tar/files/CVE-2022-48303.patch
>
> diff --git a/meta/recipes-extended/tar/files/CVE-2022-48303.patch
> b/meta/recipes-extended/tar/files/CVE-2022-48303.patch
> deleted file mode 100644
> index a8e9f4ac7d..00
> --- a/meta/recipes-extended/tar/files/CVE-2022-48303.patch
> +++ /dev/null
> @@ -1,36 +0,0 @@
> -From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001
> -From: =?UTF-8?q?Matej=20Mu=C5=BEila?=
> -Date: Wed, 11 Jan 2023 08:55:58 +0100
> -Subject: [PATCH] Fix savannah bug #62387
> -
> -* src/list.c (from_header): Check for the end of field after leading byte
> - (0x80 or 0xff) of base-256 encoded header value
> -
> -Upstream-Status: Backport
> -[https://savannah.gnu.org/patch/download.php?file_id=54212]
> -CVE: CVE-2022-48303
> -Signed-off-by: Chee Yang Lee
>
> - src/list.c | 6 ++
> - 1 file changed, 6 insertions(+)
> -
> -diff --git a/src/list.c b/src/list.c
> -index 9fafc425..bf41b581 100644
> a/src/list.c
> -+++ b/src/list.c
> -@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char
> const *type,
> -<< (CHAR_BIT * sizeof (uintmax_t)
> -- LG_256 - (LG_256 - 2)));
> - value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit;
> -+ if (where == lim)
> -+{
> -+ if (type && !silent)
> -+ERROR ((0, 0, _("Archive base-256 value is invalid")));
> -+ return -1;
> -+}
> - for (;;)
> - {
> - value = (value << LG_256) + (unsigned char) *where++;
> ---
> -2.38.1
> -
> diff --git a/meta/recipes-extended/tar/tar_1.34.bb
> b/meta/recipes-extended/tar/tar_1.34.bb
> index 22c04ba70a..7307cd57a2 100644
> --- a/meta/recipes-extended/tar/tar_1.34.bb
> +++ b/meta/recipes-extended/tar/tar_1.34.bb
> @@ -6,9 +6,7 @@ SECTION = "base"
> LICENSE = "GPL-3.0-only"
> LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
>
> -SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2 \
> - file://CVE-2022-48303.patch \
> - "
> +SRC_URI = "${GNU_MIRROR}/tar/tar-${PV}.tar.bz2"
>
> SRC_URI[sha256sum] =
> "b44cc67f8a1f6b0250b7c860e952b37e8ed932a90bd9b1862a511079255646ff"
>
I appreciate why you've done this as a revert however I think it will
send out the wrong message when you view it in the changelog. I'd much
prefer we just have a single patch which updates the patch to the new
version.
I've squeshed these two commits together and tweaked the commit message
in this case for testing.
Cheers,
Richard
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#177317):
https://lists.openembedded.org/g/openembedded-core/message/177317
Mute This Topic: https://lists.openembedded.org/mt/97040412/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
