francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
53 lines
1.5 KiB
Diff
53 lines
1.5 KiB
Diff
From c778d234c396e78bacef7c9bff0dd2bb9fb6aac8 Mon Sep 17 00:00:00 2001
|
|
From: shixuantong <1726671442@qq.com>
|
|
Date: Wed, 6 Apr 2022 17:40:57 +0800
|
|
Subject: [PATCH] Ensure that sz is greater than 0.
|
|
|
|
Authored by shixuantong <1726671442@qq.com>.
|
|
|
|
meta-openembedded uses Debian's release tarball [1]. Debian uses
|
|
repo.or.cz/libtar.git as their upstream [2]. repo.or.cz/libtar.git has
|
|
been inactive since 2013 [3].
|
|
|
|
CVE: CVE-2021-33643 CVE-2021-33644
|
|
|
|
Upstream-Status: Inactive-Upstream [lastrelease: 2013 lastcommit: 2013]
|
|
|
|
[1] https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/libtar/libtar_1.2.20.bb?h=master#n8
|
|
[2] http://svn.kibibyte.se/libtar/trunk/debian/control (rev 51; not tagged)
|
|
[3] https://repo.or.cz/libtar.git/shortlog/refs/heads/master
|
|
|
|
Signed-off-by: Katariina Lounento <katariina.lounento@vaisala.com>
|
|
---
|
|
lib/block.c | 10 ++++++++++
|
|
1 file changed, 10 insertions(+)
|
|
|
|
diff --git a/lib/block.c b/lib/block.c
|
|
index 092bc28..f12c4bc 100644
|
|
--- a/lib/block.c
|
|
+++ b/lib/block.c
|
|
@@ -118,6 +118,11 @@ th_read(TAR *t)
|
|
if (TH_ISLONGLINK(t))
|
|
{
|
|
sz = th_get_size(t);
|
|
+ if ((int)sz <= 0)
|
|
+ {
|
|
+ errno = EINVAL;
|
|
+ return -1;
|
|
+ }
|
|
blocks = (sz / T_BLOCKSIZE) + (sz % T_BLOCKSIZE ? 1 : 0);
|
|
if (blocks > ((size_t)-1 / T_BLOCKSIZE))
|
|
{
|
|
@@ -168,6 +173,11 @@ th_read(TAR *t)
|
|
if (TH_ISLONGNAME(t))
|
|
{
|
|
sz = th_get_size(t);
|
|
+ if ((int)sz <= 0)
|
|
+ {
|
|
+ errno = EINVAL;
|
|
+ return -1;
|
|
+ }
|
|
blocks = (sz / T_BLOCKSIZE) + (sz % T_BLOCKSIZE ? 1 : 0);
|
|
if (blocks > ((size_t)-1 / T_BLOCKSIZE))
|
|
{
|