mirror of
https://git.yoctoproject.org/poky
synced 2026-05-09 17:39:31 +00:00
Joe Slater
add828fa4f
Fixes CVE-2022-48303 by checking Base-256 encoding is at least 2 bytes long. GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-48303 Upstream patch: https://savannah.gnu.org/bugs/?62387 https://git.savannah.gnu.org/cgit/tar.git/patch/src/list.c?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8 (From OE-Core rev: 0043c9d3f7b65a0cbb0a27c37b4825b8f5511dec) Signed-off-by: Rodolfo Quesada Zumbado <rodolfo.zumbado@windriver.com> Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
44 lines
1.4 KiB
Diff
44 lines
1.4 KiB
Diff
From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001
|
|
From: Sergey Poznyakoff <gray@gnu.org>
|
|
Date: Sat, 11 Feb 2023 11:57:39 +0200
|
|
Subject: Fix boundary checking in base-256 decoder
|
|
|
|
* src/list.c (from_header): Base-256 encoding is at least 2 bytes
|
|
long.
|
|
|
|
Upstream-Status: Backport [see reference below]
|
|
CVE: CVE-2022-48303
|
|
|
|
Reference to upstream patch:
|
|
https://savannah.gnu.org/bugs/?62387
|
|
https://git.savannah.gnu.org/cgit/tar.git/patch/src/list.c?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8
|
|
|
|
Signed-off-by: Rodolfo Quesada Zumbado <rodolfo.zumbado@windriver.com>
|
|
Signed-off-by: Joe Slater <joe.slater@windriver.com>
|
|
---
|
|
src/list.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)Signed-off-by: Rodolfo Quesada Zumbado <rodolfo.zumbado@windriver.com>
|
|
|
|
|
|
(limited to 'src/list.c')
|
|
|
|
diff --git a/src/list.c b/src/list.c
|
|
index 9fafc42..86bcfdd 100644
|
|
--- a/src/list.c
|
|
+++ b/src/list.c
|
|
@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
|
|
where++;
|
|
}
|
|
}
|
|
- else if (*where == '\200' /* positive base-256 */
|
|
- || *where == '\377' /* negative base-256 */)
|
|
+ else if (where <= lim - 2
|
|
+ && (*where == '\200' /* positive base-256 */
|
|
+ || *where == '\377' /* negative base-256 */))
|
|
{
|
|
/* Parse base-256 output. A nonnegative number N is
|
|
represented as (256**DIGS)/2 + N; a negative number -N is
|
|
--
|
|
cgit v1.1
|
|
|