60 lines
1.7 KiB
Diff
60 lines
1.7 KiB
Diff
|
From 479e2e47de5f2a9a3ecedda264976bde6945ce60 Mon Sep 17 00:00:00 2001
|
||
|
|
From: jikui <jikui2@huawei.com>
|
||
|
|
Date: Mon, 22 Nov 2021 10:24:24 +0800
|
||
|
|
Subject: [PATCH] busybox: fix CVE-2021-42374
|
||
|
|
|
||
|
|
backport from upstream:
|
||
|
|
https://git.busybox.net/busybox/patch/?h=1_34_stable&id=04f052c56ded5ab6a904e3a264a73dc0412b2e78
|
||
|
|
|
||
|
|
Signed-off-by: jikui <jikui2@huawei.com>
|
||
|
|
---
|
||
|
|
archival/libarchive/decompress_unlzma.c | 5 ++++-
|
||
|
|
testsuite/unlzma.tests | 10 ++++++----
|
||
|
|
2 files changed, 10 insertions(+), 5 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c
|
||
|
|
index 0744f23..fb5aac8 100644
|
||
|
|
--- a/archival/libarchive/decompress_unlzma.c
|
||
|
|
+++ b/archival/libarchive/decompress_unlzma.c
|
||
|
|
@@ -290,8 +290,11 @@ unpack_lzma_stream(transformer_state_t *xstate)
|
||
|
|
uint32_t pos;
|
||
|
|
|
||
|
|
pos = buffer_pos - rep0;
|
||
|
|
- if ((int32_t)pos < 0)
|
||
|
|
+ if ((int32_t)pos < 0) {
|
||
|
|
pos += header.dict_size;
|
||
|
|
+ if ((int32_t)pos < 0)
|
||
|
|
+ goto bad;
|
||
|
|
+ }
|
||
|
|
match_byte = buffer[pos];
|
||
|
|
do {
|
||
|
|
int bit;
|
||
|
|
diff --git a/testsuite/unlzma.tests b/testsuite/unlzma.tests
|
||
|
|
index 0e98afe..8c120b1 100755
|
||
|
|
--- a/testsuite/unlzma.tests
|
||
|
|
+++ b/testsuite/unlzma.tests
|
||
|
|
@@ -8,14 +8,16 @@
|
||
|
|
|
||
|
|
# Damaged encrypted streams
|
||
|
|
testing "unlzma (bad archive 1)" \
|
||
|
|
- "unlzma <unlzma_issue_1.lzma >/dev/null; echo \$?" \
|
||
|
|
-"1
|
||
|
|
+ "unlzma <unlzma_issue_1.lzma 2>&1 >/dev/null; echo \$?" \
|
||
|
|
+"unlzma: corrupted data
|
||
|
|
+1
|
||
|
|
" "" ""
|
||
|
|
|
||
|
|
# Damaged encrypted streams
|
||
|
|
testing "unlzma (bad archive 2)" \
|
||
|
|
- "unlzma <unlzma_issue_2.lzma >/dev/null; echo \$?" \
|
||
|
|
-"1
|
||
|
|
+ "unlzma <unlzma_issue_2.lzma 2>&1 >/dev/null; echo \$?" \
|
||
|
|
+"unlzma: corrupted data
|
||
|
|
+1
|
||
|
|
" "" ""
|
||
|
|
|
||
|
|
exit $FAILCOUNT
|
||
|
|
--
|
||
|
|
2.25.1
|
||
|
|
|