diff options
Diffstat (limited to 'source')
-rw-r--r-- | source/a/tar/CVE-2022-48303.patch | 31 | ||||
-rwxr-xr-x | source/a/tar/tar.SlackBuild | 7 | ||||
-rwxr-xr-x | source/d/mercurial/mercurial.SlackBuild | 4 |
3 files changed, 38 insertions, 4 deletions
diff --git a/source/a/tar/CVE-2022-48303.patch b/source/a/tar/CVE-2022-48303.patch new file mode 100644 index 000000000..b248fb089 --- /dev/null +++ b/source/a/tar/CVE-2022-48303.patch @@ -0,0 +1,31 @@ +From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com> +Date: Wed, 11 Jan 2023 08:55:58 +0100 +Subject: [PATCH] Fix savannah bug #62387 + +* src/list.c (from_header): Check for the end of field after leading byte + (0x80 or 0xff) of base-256 encoded header value +--- + src/list.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/list.c b/src/list.c +index 9fafc425..bf41b581 100644 +--- a/src/list.c ++++ b/src/list.c +@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char const *type, + << (CHAR_BIT * sizeof (uintmax_t) + - LG_256 - (LG_256 - 2))); + value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit; ++ if (where == lim) ++ { ++ if (type && !silent) ++ ERROR ((0, 0, _("Archive base-256 value is invalid"))); ++ return -1; ++ } + for (;;) + { + value = (value << LG_256) + (unsigned char) *where++; +-- +2.38.1 + diff --git a/source/a/tar/tar.SlackBuild b/source/a/tar/tar.SlackBuild index a22fe1eb2..20dcd4956 100755 --- a/source/a/tar/tar.SlackBuild +++ b/source/a/tar/tar.SlackBuild @@ -1,6 +1,6 @@ #!/bin/bash -# Copyright 2005-2022 Patrick J. Volkerding, Sebeka, MN, USA +# Copyright 2005-2023 Patrick J. Volkerding, Sebeka, MN, USA # All rights reserved. # # Redistribution and use of this script, with or without modification, is @@ -24,7 +24,7 @@ cd $(dirname $0) ; CWD=$(pwd) PKGNAM=tar VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)} -BUILD=${BUILD:-2} +BUILD=${BUILD:-3} NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "} @@ -78,6 +78,9 @@ find . \ # The "A lone zero block at %s" messages also cause problems: zcat $CWD/tar.nolonezero.diff.gz | patch -p1 --verbose || exit 1 +# Patch for CVE-2022-48303: +zcat $CWD/CVE-2022-48303.patch.gz | patch -p1 --verbose || exit 1 + FORCE_UNSAFE_CONFIGURE=1 \ CFLAGS="$SLKCFLAGS" \ ./configure \ diff --git a/source/d/mercurial/mercurial.SlackBuild b/source/d/mercurial/mercurial.SlackBuild index 5074b56a5..b5660cb1c 100755 --- a/source/d/mercurial/mercurial.SlackBuild +++ b/source/d/mercurial/mercurial.SlackBuild @@ -1,6 +1,6 @@ #!/bin/bash -# Copyright 2008, 2009, 2010, 2017, 2018 Patrick J. Volkerding, Sebeka, MN, USA +# Copyright 2008, 2009, 2010, 2017, 2018, 2023 Patrick J. Volkerding, Sebeka, MN, USA # All rights reserved. # # Redistribution and use of this script, with or without modification, is @@ -55,7 +55,7 @@ rm -rf mercurial-$VERSION tar xvf $CWD/mercurial-$VERSION.tar.?z || exit 1 cd mercurial-$VERSION || exit 1 -chown -R root.root . +chown -R root:root . find . \ \( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \ -exec chmod 755 {} \+ -o \ |