Compare commits
11 Commits
0dfcb07f37
...
e7eb7307f1
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e7eb7307f1 | ||
|
|
e30d940847 | ||
|
|
a2f1faa632 | ||
|
|
63d1b918b4 | ||
|
|
d6965ccd4e | ||
|
|
9e35ca583e | ||
|
|
f38c236fc4 | ||
|
|
8859f72ca7 | ||
|
|
4da855bf53 | ||
|
|
d68b535dd0 | ||
|
|
bcd7641fe3 |
43
backport-0001-CVE-2022-1271.patch
Normal file
43
backport-0001-CVE-2022-1271.patch
Normal file
@ -0,0 +1,43 @@
|
||||
From dc9740df61e575e8c3148b7bd3c147a81ea00c7c Mon Sep 17 00:00:00 2001
|
||||
From: Lasse Collin <lasse.collin@tukaani.org>
|
||||
Date: Mon, 4 Apr 2022 23:52:49 -0700
|
||||
Subject: zgrep: avoid exploit via multi-newline file names
|
||||
|
||||
* zgrep.in: The issue with the old code is that with multiple
|
||||
newlines, the N-command will read the second line of input,
|
||||
then the s-commands will be skipped because it's not the end
|
||||
of the file yet, then a new sed cycle starts and the pattern
|
||||
space is printed and emptied. So only the last line or two get
|
||||
escaped. This patch makes sed read all lines into the pattern
|
||||
space and then do the escaping.
|
||||
|
||||
This vulnerability was discovered by:
|
||||
cleemy desu wayo working with Trend Micro Zero Day Initiative
|
||||
---
|
||||
zgrep.in | 10 +++++++---
|
||||
1 file changed, 7 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/zgrep.in b/zgrep.in
|
||||
index 345dae3..bdf7da2 100644
|
||||
--- a/zgrep.in
|
||||
+++ b/zgrep.in
|
||||
@@ -222,9 +222,13 @@ do
|
||||
'* | *'&'* | *'\'* | *'|'*)
|
||||
i=$(printf '%s\n' "$i" |
|
||||
sed '
|
||||
- $!N
|
||||
- $s/[&\|]/\\&/g
|
||||
- $s/\n/\\n/g
|
||||
+ :start
|
||||
+ $!{
|
||||
+ N
|
||||
+ b start
|
||||
+ }
|
||||
+ s/[&\|]/\\&/g
|
||||
+ s/\n/\\n/g
|
||||
');;
|
||||
esac
|
||||
sed_script="s|^|$i:|"
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
77
backport-0002-CVE-2022-1271.patch
Normal file
77
backport-0002-CVE-2022-1271.patch
Normal file
@ -0,0 +1,77 @@
|
||||
From d74a30d45c6834c8e9f87115197370fe86656d81 Mon Sep 17 00:00:00 2001
|
||||
From: Jim Meyering <meyering@fb.com>
|
||||
Date: Mon, 4 Apr 2022 23:52:49 -0700
|
||||
Subject: zgrep: add NEWS and tests for this exploitable bug
|
||||
|
||||
* tests/zgrep-abuse: New file, based on PoC by cleemy desu wayo.
|
||||
* tests/Makefile.am (TESTS): Add it.
|
||||
* NEWS: Mention the exploit.
|
||||
The bug appears to have been present since the beginning.
|
||||
---
|
||||
tests/Makefile.am | 1 +
|
||||
tests/zgrep-abuse | 41 +++++++++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 42 insertions(+)
|
||||
create mode 100755 tests/zgrep-abuse
|
||||
|
||||
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
||||
index 691bbf8..d565211 100644
|
||||
--- a/tests/Makefile.am
|
||||
+++ b/tests/Makefile.am
|
||||
@@ -34,6 +34,7 @@ TESTS = \
|
||||
z-suffix \
|
||||
zdiff \
|
||||
zgrep-f \
|
||||
+ zgrep-abuse \
|
||||
zgrep-context \
|
||||
zgrep-signal \
|
||||
znew-k
|
||||
diff --git a/tests/zgrep-abuse b/tests/zgrep-abuse
|
||||
new file mode 100755
|
||||
index 0000000..3e8a8f9
|
||||
--- /dev/null
|
||||
+++ b/tests/zgrep-abuse
|
||||
@@ -0,0 +1,41 @@
|
||||
+#!/bin/sh
|
||||
+# Show how zgrep applied to a crafted file name may overwrite
|
||||
+# a selected file with chosen content. Fixed in gzip-1.12.
|
||||
+
|
||||
+# Copyright (C) 2022 Free Software Foundation, Inc.
|
||||
+
|
||||
+# This program is free software: you can redistribute it and/or modify
|
||||
+# it under the terms of the GNU General Public License as published by
|
||||
+# the Free Software Foundation, either version 3 of the License, or
|
||||
+# (at your option) any later version.
|
||||
+
|
||||
+# This program is distributed in the hope that it will be useful,
|
||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
+# GNU General Public License for more details.
|
||||
+
|
||||
+# You should have received a copy of the GNU General Public License
|
||||
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
+# limit so don't run it by default.
|
||||
+
|
||||
+. "${srcdir=.}/init.sh"; path_prepend_ ..
|
||||
+
|
||||
+: > z || framework_failure_
|
||||
+echo test |gzip > 'z|
|
||||
+p
|
||||
+1s|.*|chosen-content|
|
||||
+1w hacked
|
||||
+etouch .\x2fhacked2
|
||||
+d
|
||||
+#
|
||||
+#' || framework_failure_
|
||||
+
|
||||
+fail=0
|
||||
+
|
||||
+zgrep test z* > /dev/null
|
||||
+
|
||||
+# Before the fix, each of these would be created.
|
||||
+test -f hacked && fail=1
|
||||
+test -f hacked2 && fail=1
|
||||
+
|
||||
+Exit $fail
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
46
backport-0003-CVE-2022-1271.patch
Normal file
46
backport-0003-CVE-2022-1271.patch
Normal file
@ -0,0 +1,46 @@
|
||||
From c99f320d5c0fd98fe88d9cea5407eb7ad9d50e8a Mon Sep 17 00:00:00 2001
|
||||
From: Paul Eggert <eggert@cs.ucla.edu>
|
||||
Date: Mon, 4 Apr 2022 23:52:49 -0700
|
||||
Subject: zgrep: port to POSIX sed
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
* zgrep.in (res): When escaping the file name do not rely on GNU
|
||||
sed’s extension to POSIX with respect to s/.../\n/. Instead, use
|
||||
features that should also work with AIX and/or Solaris sed. This is
|
||||
simpler anyway, and would have prevented the recently-fixed bug.
|
||||
---
|
||||
zgrep.in | 15 ++++-----------
|
||||
1 file changed, 4 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/zgrep.in b/zgrep.in
|
||||
index bdf7da2..6a16dd1 100644
|
||||
--- a/zgrep.in
|
||||
+++ b/zgrep.in
|
||||
@@ -220,18 +220,11 @@ do
|
||||
case $i in
|
||||
(*'
|
||||
'* | *'&'* | *'\'* | *'|'*)
|
||||
- i=$(printf '%s\n' "$i" |
|
||||
- sed '
|
||||
- :start
|
||||
- $!{
|
||||
- N
|
||||
- b start
|
||||
- }
|
||||
- s/[&\|]/\\&/g
|
||||
- s/\n/\\n/g
|
||||
- ');;
|
||||
+ icolon=$(printf '%s\n' "$i:" |
|
||||
+ sed -e 's/[&\|]/\\&/g' -e '$!s/$/\\/');;
|
||||
+ (*) icolon="$i:";;
|
||||
esac
|
||||
- sed_script="s|^|$i:|"
|
||||
+ sed_script="s|^|$icolon|"
|
||||
|
||||
# Fail if grep or sed fails.
|
||||
r=$(
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
@ -1,9 +0,0 @@
|
||||
test -f /usr/libexec/grepconf.sh
|
||||
if ( $status == 1 ) exit
|
||||
|
||||
/usr/libexec/grepconf.sh -c
|
||||
if ( $status == 1 ) exit
|
||||
|
||||
alias zgrep 'zgrep --color=auto'
|
||||
alias zfgrep 'zfgrep --color=auto'
|
||||
alias zegrep 'zegrep --color=auto'
|
||||
@ -1,6 +0,0 @@
|
||||
[ -f /usr/libexec/grepconf.sh ] || return
|
||||
|
||||
/usr/libexec/grepconf.sh -c || return
|
||||
alias zgrep='zgrep --color=auto' 2>/dev/null
|
||||
alias zfgrep='zfgrep --color=auto' 2>/dev/null
|
||||
alias zegrep='zegrep --color=auto' 2>/dev/null
|
||||
189
gnulib.patch
189
gnulib.patch
@ -1,189 +0,0 @@
|
||||
From 1831628c0630ae96a43586b2a25ca51cbdba3e53 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Eggert <address@hidden>
|
||||
Date: Mon, 5 Mar 2018 10:56:29 -0800
|
||||
Subject: [PATCH] fflush: adjust to glibc 2.28 libio.h removal
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Problem reported by Daniel P. Berrangé in:
|
||||
https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
|
||||
* lib/fbufmode.c (fbufmode):
|
||||
* lib/fflush.c (clear_ungetc_buffer_preserving_position)
|
||||
(disable_seek_optimization, rpl_fflush):
|
||||
* lib/fpending.c (__fpending):
|
||||
* lib/fpurge.c (fpurge):
|
||||
* lib/freadable.c (freadable):
|
||||
* lib/freadahead.c (freadahead):
|
||||
* lib/freading.c (freading):
|
||||
* lib/freadptr.c (freadptr):
|
||||
* lib/freadseek.c (freadptrinc):
|
||||
* lib/fseeko.c (fseeko):
|
||||
* lib/fseterr.c (fseterr):
|
||||
* lib/fwritable.c (fwritable):
|
||||
* lib/fwriting.c (fwriting):
|
||||
Check _IO_EOF_SEEN instead of _IO_ftrylockfile.
|
||||
* lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]:
|
||||
Define if not already defined.
|
||||
---
|
||||
ChangeLog | 23 +++++++++++++++++++++++
|
||||
lib/fbufmode.c | 2 +-
|
||||
lib/fflush.c | 6 +++---
|
||||
lib/fpending.c | 2 +-
|
||||
lib/fpurge.c | 2 +-
|
||||
lib/freadable.c | 2 +-
|
||||
lib/freadahead.c | 2 +-
|
||||
lib/freading.c | 2 +-
|
||||
lib/freadptr.c | 2 +-
|
||||
lib/freadseek.c | 2 +-
|
||||
lib/fseeko.c | 4 ++--
|
||||
lib/fseterr.c | 2 +-
|
||||
lib/fwritable.c | 2 +-
|
||||
lib/fwriting.c | 2 +-
|
||||
lib/stdio-impl.h | 6 ++++++
|
||||
15 files changed, 45 insertions(+), 16 deletions(-)
|
||||
|
||||
diff --git a/ChangeLog b/ChangeLog
|
||||
index 667f91663..beb835670 100644
|
||||
--- a/ChangeLog
|
||||
+++ b/ChangeLog
|
||||
@@ -1,3 +1,26 @@
|
||||
+2018-03-05 Paul Eggert <address@hidden>
|
||||
+
|
||||
+ fflush: adjust to glibc 2.28 libio.h removal
|
||||
+ Problem reported by Daniel P. Berrangé in:
|
||||
+ https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
|
||||
+ * lib/fbufmode.c (fbufmode):
|
||||
+ * lib/fflush.c (clear_ungetc_buffer_preserving_position)
|
||||
+ (disable_seek_optimization, rpl_fflush):
|
||||
+ * lib/fpending.c (__fpending):
|
||||
+ * lib/fpurge.c (fpurge):
|
||||
+ * lib/freadable.c (freadable):
|
||||
+ * lib/freadahead.c (freadahead):
|
||||
+ * lib/freading.c (freading):
|
||||
+ * lib/freadptr.c (freadptr):
|
||||
+ * lib/freadseek.c (freadptrinc):
|
||||
+ * lib/fseeko.c (fseeko):
|
||||
+ * lib/fseterr.c (fseterr):
|
||||
+ * lib/fwritable.c (fwritable):
|
||||
+ * lib/fwriting.c (fwriting):
|
||||
+ Check _IO_EOF_SEEN instead of _IO_ftrylockfile.
|
||||
+ * lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]:
|
||||
+ Define if not already defined.
|
||||
+
|
||||
2018-01-07 Jim Meyering <meyering@fb.com>
|
||||
|
||||
version 1.9
|
||||
* NEWS: Record release date.
|
||||
diff --git a/lib/fflush.c b/lib/fflush.c
|
||||
index 983ade0ff..a6edfa105 100644
|
||||
--- a/lib/fflush.c
|
||||
+++ b/lib/fflush.c
|
||||
@@ -33,7 +33,7 @@
|
||||
#undef fflush
|
||||
|
||||
|
||||
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
|
||||
/* Clear the stream's ungetc buffer, preserving the value of ftello (fp). */
|
||||
static void
|
||||
@@ -72,7 +72,7 @@ clear_ungetc_buffer (FILE *fp)
|
||||
|
||||
#endif
|
||||
|
||||
-#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
|
||||
+#if ! (defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
|
||||
|
||||
# if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT
|
||||
/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
|
||||
@@ -148,7 +148,7 @@ rpl_fflush (FILE *stream)
|
||||
if (stream == NULL || ! freading (stream))
|
||||
return fflush (stream);
|
||||
|
||||
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
|
||||
clear_ungetc_buffer_preserving_position (stream);
|
||||
|
||||
diff --git a/lib/fpurge.c b/lib/fpurge.c
|
||||
index b1d417c7a..3aedcc373 100644
|
||||
--- a/lib/fpurge.c
|
||||
+++ b/lib/fpurge.c
|
||||
@@ -62,7 +62,7 @@ fpurge (FILE *fp)
|
||||
/* Most systems provide FILE as a struct and the necessary bitmask in
|
||||
<stdio.h>, because they need it for implementing getc() and putc() as
|
||||
fast macros. */
|
||||
-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
fp->_IO_read_end = fp->_IO_read_ptr;
|
||||
fp->_IO_write_ptr = fp->_IO_write_base;
|
||||
/* Avoid memory leak when there is an active ungetc buffer. */
|
||||
diff --git a/lib/freading.c b/lib/freading.c
|
||||
index 73c28acdd..c24d0c88a 100644
|
||||
--- a/lib/freading.c
|
||||
+++ b/lib/freading.c
|
||||
@@ -31,7 +31,7 @@ freading (FILE *fp)
|
||||
/* Most systems provide FILE as a struct and the necessary bitmask in
|
||||
<stdio.h>, because they need it for implementing getc() and putc() as
|
||||
fast macros. */
|
||||
-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
return ((fp->_flags & _IO_NO_WRITES) != 0
|
||||
|| ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0
|
||||
&& fp->_IO_read_base != NULL));
|
||||
diff --git a/lib/fseeko.c b/lib/fseeko.c
|
||||
index 0101ab55f..193f4e8ce 100644
|
||||
--- a/lib/fseeko.c
|
||||
+++ b/lib/fseeko.c
|
||||
@@ -47,7 +47,7 @@ fseeko (FILE *fp, off_t offset, int whence)
|
||||
#endif
|
||||
|
||||
/* These tests are based on fpurge.c. */
|
||||
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
if (fp->_IO_read_end == fp->_IO_read_ptr
|
||||
&& fp->_IO_write_ptr == fp->_IO_write_base
|
||||
&& fp->_IO_save_base == NULL)
|
||||
@@ -123,7 +123,7 @@ fseeko (FILE *fp, off_t offset, int whence)
|
||||
return -1;
|
||||
}
|
||||
|
||||
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
fp->_flags &= ~_IO_EOF_SEEN;
|
||||
fp->_offset = pos;
|
||||
#elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
|
||||
diff --git a/lib/fseterr.c b/lib/fseterr.c
|
||||
index 82649c3ac..adb637256 100644
|
||||
--- a/lib/fseterr.c
|
||||
+++ b/lib/fseterr.c
|
||||
@@ -29,7 +29,7 @@ fseterr (FILE *fp)
|
||||
/* Most systems provide FILE as a struct and the necessary bitmask in
|
||||
<stdio.h>, because they need it for implementing getc() and putc() as
|
||||
fast macros. */
|
||||
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
|
||||
fp->_flags |= _IO_ERR_SEEN;
|
||||
#elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
|
||||
/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
|
||||
diff --git a/lib/stdio-impl.h b/lib/stdio-impl.h
|
||||
index 78d896e9f..05c5752a2 100644
|
||||
--- a/lib/stdio-impl.h
|
||||
+++ b/lib/stdio-impl.h
|
||||
@@ -18,6 +18,12 @@
|
||||
the same implementation of stdio extension API, except that some fields
|
||||
have different naming conventions, or their access requires some casts. */
|
||||
|
||||
+/* Glibc 2.28 made _IO_IN_BACKUP private. For now, work around this
|
||||
+ problem by defining it ourselves. FIXME: Do not rely on glibc
|
||||
+ internals. */
|
||||
+#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN
|
||||
+# define _IO_IN_BACKUP 0x100
|
||||
+#endif
|
||||
|
||||
/* BSD stdio derived implementations. */
|
||||
|
||||
--
|
||||
2.14.3
|
||||
|
||||
76
gzexe.patch
76
gzexe.patch
@ -1,38 +1,38 @@
|
||||
From 21cd963565a43dabd59516bd4cca5c76a614f255 Mon Sep 17 00:00:00 2001
|
||||
From: Jakub Martisko <jamartis@redhat.com>
|
||||
Date: Tue, 26 Mar 2019 12:29:30 +0100
|
||||
Subject: [PATCH] Fix: the value of the skip variable in the gzexe
|
||||
|
||||
---
|
||||
gzexe.in | 4 ++--
|
||||
tests/Makefile.am | 1 +
|
||||
tests/gzexe | 20 ++++++++++++++++++++
|
||||
3 files changed, 23 insertions(+), 2 deletions(-)
|
||||
create mode 100755 tests/gzexe
|
||||
|
||||
diff --git a/gzexe.in b/gzexe.in
|
||||
index 6c61183..cffa84e 100644
|
||||
--- a/gzexe.in
|
||||
+++ b/gzexe.in
|
||||
@@ -145,7 +145,7 @@ for i do
|
||||
if test $decomp -eq 0; then
|
||||
(cat <<'EOF' &&
|
||||
#!/bin/sh
|
||||
-skip=44
|
||||
+skip=49
|
||||
|
||||
tab=' '
|
||||
nl='
|
||||
@@ -201,7 +201,7 @@ EOF
|
||||
|
||||
else
|
||||
# decompression
|
||||
- skip=44
|
||||
+ skip=49
|
||||
skip_line=`sed -e 1d -e 2q "$file"`
|
||||
case $skip_line in
|
||||
skip=[0-9] | skip=[0-9][0-9] | skip=[0-9][0-9][0-9])
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
From 21cd963565a43dabd59516bd4cca5c76a614f255 Mon Sep 17 00:00:00 2001
|
||||
From: Jakub Martisko <jamartis@redhat.com>
|
||||
Date: Tue, 26 Mar 2019 12:29:30 +0100
|
||||
Subject: [PATCH] Fix: the value of the skip variable in the gzexe
|
||||
|
||||
---
|
||||
gzexe.in | 4 ++--
|
||||
tests/Makefile.am | 1 +
|
||||
tests/gzexe | 20 ++++++++++++++++++++
|
||||
3 files changed, 23 insertions(+), 2 deletions(-)
|
||||
create mode 100755 tests/gzexe
|
||||
|
||||
diff --git a/gzexe.in b/gzexe.in
|
||||
index 6c61183..cffa84e 100644
|
||||
--- a/gzexe.in
|
||||
+++ b/gzexe.in
|
||||
@@ -145,7 +145,7 @@ for i do
|
||||
if test $decomp -eq 0; then
|
||||
(cat <<'EOF' &&
|
||||
#!/bin/sh
|
||||
-skip=44
|
||||
+skip=49
|
||||
|
||||
tab=' '
|
||||
nl='
|
||||
@@ -201,7 +201,7 @@ EOF
|
||||
|
||||
else
|
||||
# decompression
|
||||
- skip=44
|
||||
+ skip=49
|
||||
skip_line=`sed -e 1d -e 2q "$file"`
|
||||
case $skip_line in
|
||||
skip=[0-9] | skip=[0-9][0-9] | skip=[0-9][0-9][0-9])
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
|
||||
BIN
gzip-1.10.tar.xz
Normal file
BIN
gzip-1.10.tar.xz
Normal file
Binary file not shown.
BIN
gzip-1.9.tar.xz
BIN
gzip-1.9.tar.xz
Binary file not shown.
@ -1,37 +0,0 @@
|
||||
From 26c140cf5377585d38d2a13a949e109724d4d406 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Eggert <eggert@cs.ucla.edu>
|
||||
Date: Fri, 30 Nov 2018 13:00:42 -0800
|
||||
Subject: [PATCH 11/23] gzip: fix use of uninitialized memory
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Problem reported by Hanno Böck (Bug#33501).
|
||||
* NEWS: Mention this.
|
||||
* inflate.c (inflate_dynamic): Return if code is invalid.
|
||||
Fix by Mark Adler.
|
||||
* tests/hufts: Add test case for the bug.
|
||||
---
|
||||
inflate.c | 6 ++++++
|
||||
1 files changed, 6 insertions(+), 0 deletion(-)
|
||||
|
||||
diff --git a/inflate.c b/inflate.c
|
||||
index d372685..bcafcf1 100644
|
||||
--- a/inflate.c
|
||||
+++ b/inflate.c
|
||||
@@ -799,6 +799,12 @@ inflate_dynamic(void)
|
||||
NEEDBITS((unsigned)bl)
|
||||
j = (td = tl + ((unsigned)b & m))->b;
|
||||
DUMPBITS(j)
|
||||
+ if (td->e == 99)
|
||||
+ {
|
||||
+ /* Invalid code. */
|
||||
+ huft_free (tl);
|
||||
+ return 2;
|
||||
+ }
|
||||
j = td->v.n;
|
||||
if (j < 16) /* length of code in bits (0..15) */
|
||||
ll[i++] = l = j; /* save last length in l */
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
38
gzip.spec
38
gzip.spec
@ -1,21 +1,21 @@
|
||||
Name: gzip
|
||||
Version: 1.9
|
||||
Release: 17
|
||||
Version: 1.10
|
||||
Release: 3
|
||||
Summary: A data compression utility
|
||||
|
||||
License: GPLv3+ and GFDL
|
||||
License: GPLv3+
|
||||
URL: https://www.gnu.org/software/gzip
|
||||
Source0: https://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
|
||||
Source1: colorzgrep.csh
|
||||
Source2: colorzgrep.sh
|
||||
|
||||
Patch0: gnulib.patch
|
||||
Patch1: gzip-fix-use-of-uninitialized-memory.patch
|
||||
Patch2: gzexe.patch
|
||||
Patch0: gzexe.patch
|
||||
Patch9000: fix-verbose-disable.patch
|
||||
Patch9100: performance-neoncrc32-and-prfm.patch
|
||||
|
||||
BuildRequires: gcc texinfo
|
||||
Patch6000: backport-0001-CVE-2022-1271.patch
|
||||
Patch6001: backport-0002-CVE-2022-1271.patch
|
||||
Patch6002: backport-0003-CVE-2022-1271.patch
|
||||
|
||||
BuildRequires: gcc texinfo automake autoconf
|
||||
Requires: coreutils
|
||||
Conflicts: filesystem < 3
|
||||
Provides: /bin/gunzip
|
||||
@ -37,15 +37,13 @@ has the suffix .gz.
|
||||
%ifarch aarch64
|
||||
export CFLAGS="${CFLAGS:-%optflags} -march=armv8-a+crc"
|
||||
%endif
|
||||
autoreconf
|
||||
%configure
|
||||
%make_build
|
||||
|
||||
%install
|
||||
rm -rf %RPM_BUILD_ROOT
|
||||
%make_install
|
||||
mkdir -p %{buildroot}%{_sysconfdir}/profile.d
|
||||
install -m 0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/profile.d
|
||||
install -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/profile.d
|
||||
# ncompress provides uncompress, may cause conflict.
|
||||
rm -f %{buildroot}%{_bindir}/uncompress
|
||||
|
||||
@ -57,7 +55,6 @@ make check
|
||||
%doc AUTHORS ChangeLog README
|
||||
%license COPYING
|
||||
%{_bindir}/*
|
||||
%{_sysconfdir}/profile.d/*
|
||||
%exclude %{_infodir}/dir
|
||||
|
||||
%files help
|
||||
@ -66,6 +63,21 @@ make check
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%changelog
|
||||
* Wed Apr 20 2022 shixuantong <shixuantong@h-partners.com> - 1.10-3
|
||||
- fix CVE-2022-1271
|
||||
|
||||
* Thu Apr 14 2022 renhongxun <renhongxun@h-partners.com> - 1.10-2
|
||||
- update license from GPLv3+,GFDL to GPLv3+
|
||||
|
||||
* Fri Apr 24 2020 BruceGW <gyl93216@163.com> - 1.10-1
|
||||
- update upstream to 1.10
|
||||
|
||||
* Fri Jan 17 2020 openEuler Buildteam <buildteam@openeuler.org> - 1.9-18
|
||||
- Type:performance improve
|
||||
- ID:NA
|
||||
- SUG:NA
|
||||
- DESC:delete useless scripts for grep
|
||||
|
||||
* Mon Nov 11 2019 liqiang<liqiang64@huawei.com> - 1.9-17
|
||||
- Type:performance improve
|
||||
- ID:NA
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user