From 8b0aae25e85fafcf65545dbdbd1a42a183485a91 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Aug 26 2022 13:55:09 +0000 Subject: fix out-of-bounds read in gnu_long{name,link} Resolves: CVE-2021-33643 Resolves: CVE-2021-33644 --- diff --git a/libtar-1.2.20-CVE-2021-33643-CVE-2021-33644.patch b/libtar-1.2.20-CVE-2021-33643-CVE-2021-33644.patch new file mode 100644 index 0000000..f6692c3 --- /dev/null +++ b/libtar-1.2.20-CVE-2021-33643-CVE-2021-33644.patch @@ -0,0 +1,40 @@ +From 3936c7aa74d89e7a91dfbb2c1b7bfcad58a0355d Mon Sep 17 00:00:00 2001 +From: shixuantong <1726671442@qq.com> +Date: Wed, 6 Apr 2022 17:40:57 +0800 +Subject: [PATCH 1/2] Ensure that sz is greater than 0. + +--- + lib/block.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/lib/block.c b/lib/block.c +index 092bc28..f12c4bc 100644 +--- a/lib/block.c ++++ b/lib/block.c +@@ -118,6 +118,11 @@ th_read(TAR *t) + if (TH_ISLONGLINK(t)) + { + sz = th_get_size(t); ++ if ((int)sz <= 0) ++ { ++ errno = EINVAL; ++ return -1; ++ } + blocks = (sz / T_BLOCKSIZE) + (sz % T_BLOCKSIZE ? 1 : 0); + if (blocks > ((size_t)-1 / T_BLOCKSIZE)) + { +@@ -168,6 +173,11 @@ th_read(TAR *t) + if (TH_ISLONGNAME(t)) + { + sz = th_get_size(t); ++ if ((int)sz <= 0) ++ { ++ errno = EINVAL; ++ return -1; ++ } + blocks = (sz / T_BLOCKSIZE) + (sz % T_BLOCKSIZE ? 1 : 0); + if (blocks > ((size_t)-1 / T_BLOCKSIZE)) + { +-- +2.37.1 + 81'>diff
path: root/gnu/packages/dc.scm
AgeCommit message (Expand)Author
2019-12-01gnu: ncdc: Update to 1.22.1....* gnu/packages/dc.scm (ncdc): Update to 1.22.1. Tobias Geerinckx-Rice
2019-05-21gnu: ncdc: Update to 1.22....* gnu/packages/dc.scm (ncdc): Update to 1.22. Tobias Geerinckx-Rice
2019-04-15gnu: ncdc: Update to 1.21....* gnu/packages/dc.scm (ncdc): Update to 1.21. Tobias Geerinckx-Rice
2019-01-16gnu: Move sqlite to separate module....* gnu/packages/databases.scm (sqlite, sqlite-3.26.0, sqlite-with-fts5, sqlite-with-column-metadata): Move variables from here... * gnu/packages/sqlite.scm: ...to this new module. * gnu/local.mk (GNU_SYSTEM_MODULES): Add it. * gnu/packages/apl.scm, gnu/packages/bittorrent.scm, gnu/packages/calendar.scm, gnu/packages/code.scm, gnu/packages/crypto.scm, gnu/packages/databases.scm, gnu/packages/dc.scm, gnu/packages/disk.scm, gnu/packages/ebook.scm, gnu/packages/education.scm, gnu/packages/emacs.scm, gnu/packages/emulators.scm, gnu/packages/file-systems.scm, gnu/packages/freedesktop.scm, gnu/packages/ftp.scm, gnu/packages/games.scm, gnu/packages/geo.scm, gnu/packages/gnome.scm, gnu/packages/gnunet.scm, gnu/packages/gnupg.scm, gnu/packages/gnuzilla.scm, gnu/packages/gps.scm, gnu/packages/guile.scm, gnu/packages/ibus.scm, gnu/packages/kerberos.scm, gnu/packages/kodi.scm, gnu/packages/lisp.scm, gnu/packages/mail.scm, gnu/packages/messaging.scm, gnu/packages/mpd.scm, gnu/packages/music.scm, gnu/packages/networking.scm, gnu/packages/nfs.scm, gnu/packages/ocaml.scm, gnu/packages/package-management.scm, gnu/packages/pdf.scm, gnu/packages/photo.scm, gnu/packages/php.scm, gnu/packages/python.scm, gnu/packages/qt.scm, gnu/packages/ruby.scm, gnu/packages/scheme.scm, gnu/packages/sync.scm, gnu/packages/syndication.scm, gnu/packages/version-control.scm, gnu/packages/video.scm, gnu/packages/web-browsers.scm, gnu/packages/webkit.scm: Adjust module references. Ricardo Wurmus