diff --git a/0006-CVE-2021-41072.patch b/0001-CVE-2021-41072.patch similarity index 63% rename from 0006-CVE-2021-41072.patch rename to 0001-CVE-2021-41072.patch index b0581e5..38221b4 100644 --- a/0006-CVE-2021-41072.patch +++ b/0001-CVE-2021-41072.patch @@ -14,9 +14,11 @@ Signed-off-by: Phillip Lougher squashfs-tools/unsquashfs.h | 1 + 7 files changed, 14 insertions(+), 17 deletions(-) +diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c +index acba821b..7598499d 100644 --- a/squashfs-tools/unsquash-1.c +++ b/squashfs-tools/unsquash-1.c -@@ -316,8 +316,7 @@ static struct dir *squashfs_opendir(unsi +@@ -373,8 +373,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse return dir; corrupted: @@ -26,6 +28,8 @@ Signed-off-by: Phillip Lougher return NULL; } +diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c +index c2d4f42b..0c8dfbb6 100644 --- a/squashfs-tools/unsquash-1234.c +++ b/squashfs-tools/unsquash-1234.c @@ -25,8 +25,8 @@ @@ -50,9 +54,11 @@ Signed-off-by: Phillip Lougher + free(dir->dirs); + free(dir); +} +diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c +index 0746b3d4..86f62ba8 100644 --- a/squashfs-tools/unsquash-2.c +++ b/squashfs-tools/unsquash-2.c -@@ -417,8 +417,7 @@ static struct dir *squashfs_opendir(unsi +@@ -465,8 +465,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse return dir; corrupted: @@ -62,9 +68,11 @@ Signed-off-by: Phillip Lougher return NULL; } +diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c +index 094caaa6..c04aa9ee 100644 --- a/squashfs-tools/unsquash-3.c +++ b/squashfs-tools/unsquash-3.c -@@ -444,8 +444,7 @@ static struct dir *squashfs_opendir(unsi +@@ -499,8 +499,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse return dir; corrupted: @@ -74,9 +82,11 @@ Signed-off-by: Phillip Lougher return NULL; } +diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c +index 3a1b9e16..ff62dccc 100644 --- a/squashfs-tools/unsquash-4.c +++ b/squashfs-tools/unsquash-4.c -@@ -380,8 +380,7 @@ static struct dir *squashfs_opendir(unsi +@@ -436,8 +436,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse return dir; corrupted: @@ -86,9 +96,11 @@ Signed-off-by: Phillip Lougher return NULL; } +diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c +index 7b590bd5..04be53cd 100644 --- a/squashfs-tools/unsquashfs.c +++ b/squashfs-tools/unsquashfs.c -@@ -1290,13 +1290,6 @@ unsigned int *offset, unsigned int *type +@@ -1350,13 +1350,6 @@ unsigned int *offset, unsigned int *type) } @@ -102,9 +114,11 @@ Signed-off-by: Phillip Lougher char *get_component(char *target, char **targname) { char *start; +diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h +index 2e9201cd..5ecb2ab7 100644 --- a/squashfs-tools/unsquashfs.h +++ b/squashfs-tools/unsquashfs.h -@@ -264,4 +264,5 @@ extern long long *alloc_index_table(int) +@@ -291,4 +291,5 @@ extern long long *alloc_index_table(int); /* unsquash-1234.c */ extern int check_name(char *, int); diff --git a/0001-Fix-typos-update-URLs-in-squashfs-tools-Makefile.patch b/0001-Fix-typos-update-URLs-in-squashfs-tools-Makefile.patch deleted file mode 100644 index cc549b5..0000000 --- a/0001-Fix-typos-update-URLs-in-squashfs-tools-Makefile.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 515b2579acd24241eefd7237debcecab11c7f2cd Mon Sep 17 00:00:00 2001 -From: Blake Riley -Date: Thu, 29 Aug 2019 14:41:50 +1000 -Subject: [PATCH 1/4] Fix typos, update URLs in squashfs-tools Makefile - -This updates URLs for a few compression libraries, which have moved since the Makefile instructions were written. -Also, instructions now refer to the appropriate compressor arg, not always "the XZ_SUPPORT line below". ---- - squashfs-tools/Makefile | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/squashfs-tools/Makefile b/squashfs-tools/Makefile -index 46c0772..aee4b96 100644 ---- a/squashfs-tools/Makefile -+++ b/squashfs-tools/Makefile -@@ -42,7 +42,7 @@ GZIP_SUPPORT = 1 - # your distribution package manager. - # - # To build install the library and uncomment --# the XZ_SUPPORT line below. -+# the LZO_SUPPORT line below. - # - #LZO_SUPPORT = 1 - -@@ -50,8 +50,8 @@ GZIP_SUPPORT = 1 - ########### Building LZ4 support ############# - # - # Yann Collet's LZ4 tools are supported --# LZ4 homepage: http://fastcompression.blogspot.com/p/lz4.html --# LZ4 source repository: http://code.google.com/p/lz4 -+# LZ4 homepage: https://lz4.github.io/lz4/ -+# LZ4 source repository: https://github.com/lz4/lz4/ - # - # Development packages (libraries and header files) should be - # supported by most modern distributions. Please refer to -@@ -66,7 +66,7 @@ GZIP_SUPPORT = 1 - ########### Building ZSTD support ############ - # - # The ZSTD library is supported --# ZSTD homepage: http://zstd.net -+# ZSTD homepage: https://facebook.github.io/zstd/ - # ZSTD source repository: https://github.com/facebook/zstd - # - # Development packages (libraries and header files) should be -@@ -74,7 +74,7 @@ GZIP_SUPPORT = 1 - # your distribution package manager. - # - # To build install the library and uncomment --# the XZ_SUPPORT line below. -+# the ZSTD_SUPPORT line below. - # - #ZSTD_SUPPORT = 1 - -@@ -273,7 +273,7 @@ endif - # COMP_DEFAULT must be a selected compressor - # - ifeq (, $(findstring $(COMP_DEFAULT), $(COMPRESSORS))) --$(error "COMP_DEFAULT is set to ${COMP_DEFAULT}, which isn't selected to be \ -+$(error "COMP_DEFAULT is set to ${COMP_DEFAULT}, which isn't selected to be \ - built!") - endif - --- -1.8.3.1 - diff --git a/0007-CVE-2021-41072.patch b/0002-CVE-2021-41072.patch similarity index 69% rename from 0007-CVE-2021-41072.patch rename to 0002-CVE-2021-41072.patch index f88f3f0..00ea2bb 100644 --- a/0007-CVE-2021-41072.patch +++ b/0002-CVE-2021-41072.patch @@ -16,17 +16,21 @@ Signed-off-by: Phillip Lougher squashfs-tools/unsquashfs.h | 2 +- 6 files changed, 10 insertions(+), 5 deletions(-) +diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c +index 7598499d..d0121c6b 100644 --- a/squashfs-tools/unsquash-1.c +++ b/squashfs-tools/unsquash-1.c -@@ -303,7 +303,7 @@ static struct dir *squashfs_opendir(unsi - "realloc failed!\n"); +@@ -360,7 +360,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse dir->dirs = new_dir; } + - strcpy(dir->dirs[dir->dir_count].name, dire->name); + dir->dirs[dir->dir_count].name = strdup(dire->name); dir->dirs[dir->dir_count].start_block = dirh.start_block; dir->dirs[dir->dir_count].offset = dire->offset; +diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c +index 0c8dfbb6..ac46d9da 100644 --- a/squashfs-tools/unsquash-1234.c +++ b/squashfs-tools/unsquash-1234.c @@ -60,6 +60,11 @@ int check_name(char *name, int size) @@ -41,42 +45,50 @@ Signed-off-by: Phillip Lougher free(dir->dirs); free(dir); } +diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c +index 86f62ba8..e8479807 100644 --- a/squashfs-tools/unsquash-2.c +++ b/squashfs-tools/unsquash-2.c -@@ -404,7 +404,7 @@ static struct dir *squashfs_opendir(unsi - "realloc failed!\n"); +@@ -452,7 +452,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse dir->dirs = new_dir; } + - strcpy(dir->dirs[dir->dir_count].name, dire->name); + dir->dirs[dir->dir_count].name = strdup(dire->name); dir->dirs[dir->dir_count].start_block = dirh.start_block; dir->dirs[dir->dir_count].offset = dire->offset; +diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c +index c04aa9ee..8223f274 100644 --- a/squashfs-tools/unsquash-3.c +++ b/squashfs-tools/unsquash-3.c -@@ -431,7 +431,7 @@ static struct dir *squashfs_opendir(unsi - "realloc failed!\n"); +@@ -486,7 +486,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse dir->dirs = new_dir; } + - strcpy(dir->dirs[dir->dir_count].name, dire->name); + dir->dirs[dir->dir_count].name = strdup(dire->name); dir->dirs[dir->dir_count].start_block = dirh.start_block; dir->dirs[dir->dir_count].offset = dire->offset; +diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c +index ff62dccc..1e199a7c 100644 --- a/squashfs-tools/unsquash-4.c +++ b/squashfs-tools/unsquash-4.c -@@ -367,7 +367,7 @@ static struct dir *squashfs_opendir(unsi - "realloc failed!\n"); +@@ -423,7 +423,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse dir->dirs = new_dir; } + - strcpy(dir->dirs[dir->dir_count].name, dire->name); + dir->dirs[dir->dir_count].name = strdup(dire->name); dir->dirs[dir->dir_count].start_block = dirh.start_block; dir->dirs[dir->dir_count].offset = dire->offset; +diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h +index 5ecb2ab7..583fbe4d 100644 --- a/squashfs-tools/unsquashfs.h +++ b/squashfs-tools/unsquashfs.h -@@ -165,7 +165,7 @@ struct queue { +@@ -164,7 +164,7 @@ struct queue { #define DIR_ENT_SIZE 16 struct dir_ent { diff --git a/0002-Support-creating-sockets-in-unsquashfs.patch b/0002-Support-creating-sockets-in-unsquashfs.patch deleted file mode 100644 index 32ba4ef..0000000 --- a/0002-Support-creating-sockets-in-unsquashfs.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 585656b9aeb942c48b810149f976d59c54b9199d Mon Sep 17 00:00:00 2001 -From: Kevin Vigor -Date: Mon, 9 Sep 2019 08:55:40 -0700 -Subject: [PATCH 2/4] Support creating sockets in unsquashfs. - ---- - squashfs-tools/unsquashfs.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c -index 727f1d5..aec66c7 100644 ---- a/squashfs-tools/unsquashfs.c -+++ b/squashfs-tools/unsquashfs.c -@@ -55,7 +55,7 @@ squashfs_operations *(*read_filesystem_tables)(); - struct compressor *comp; - - int bytes = 0, swap, file_count = 0, dir_count = 0, sym_count = 0, -- dev_count = 0, fifo_count = 0; -+ dev_count = 0, fifo_count = 0, socket_count = 0; - struct hash_table_entry *inode_table_hash[65536], *directory_table_hash[65536]; - int fd; - unsigned int cached_frag = SQUASHFS_INVALID_FRAG; -@@ -1192,7 +1192,14 @@ int create_inode(char *pathname, struct inode *i) - case SQUASHFS_SOCKET_TYPE: - case SQUASHFS_LSOCKET_TYPE: - TRACE("create_inode: socket\n"); -- ERROR("create_inode: socket %s ignored\n", pathname); -+ -+ if (mknod(pathname, S_IFSOCK | i->mode, 0) == -1) { -+ ERROR("create_inode: failed to create socket %s, " -+ "because %s\n", -+ pathname, strerror(errno)); -+ goto failed; -+ } -+ socket_count++; - break; - default: - EXIT_UNSQUASH_STRICT("Unknown inode type %d in create_inode_table!\n", -@@ -2217,7 +2224,7 @@ void *progress_thread(void *arg) - if(progress_enabled) { - pthread_mutex_lock(&screen_mutex); - progress_bar(sym_count + dev_count + -- fifo_count + cur_blocks, total_inodes - -+ fifo_count + socket_count + cur_blocks, total_inodes - - total_files + total_blocks, columns); - pthread_mutex_unlock(&screen_mutex); - } -@@ -2410,7 +2417,7 @@ void disable_progress_bar() - { - pthread_mutex_lock(&screen_mutex); - if(progress_enabled) { -- progress_bar(sym_count + dev_count + fifo_count + cur_blocks, -+ progress_bar(sym_count + dev_count + fifo_count + socket_count + cur_blocks, - total_inodes - total_files + total_blocks, columns); - printf("\n"); - } -@@ -2983,6 +2990,7 @@ options: - printf("created %d symlinks\n", sym_count); - printf("created %d devices\n", dev_count); - printf("created %d fifos\n", fifo_count); -+ printf("created %d sockets\n", socket_count); - } - - return exit_code; --- -1.8.3.1 - diff --git a/0008-CVE-2021-41072.patch b/0003-CVE-2021-41072.patch similarity index 74% rename from 0008-CVE-2021-41072.patch rename to 0003-CVE-2021-41072.patch index 7072426..09fac90 100644 --- a/0008-CVE-2021-41072.patch +++ b/0003-CVE-2021-41072.patch @@ -17,19 +17,21 @@ Signed-off-by: Phillip Lougher squashfs-tools/unsquashfs.h | 3 ++- 7 files changed, 80 insertions(+), 68 deletions(-) +diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c +index d0121c6b..b6044341 100644 --- a/squashfs-tools/unsquash-1.c +++ b/squashfs-tools/unsquash-1.c -@@ -207,7 +207,7 @@ static struct dir *squashfs_opendir(unsi +@@ -254,7 +254,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse long long start; - int bytes; - int dir_count, size; + int bytes = 0; + int dir_count, size, res; - struct dir_ent *new_dir; + struct dir_ent *ent, *cur_ent = NULL; struct dir *dir; TRACE("squashfs_opendir: inode start block %d, offset %d\n", -@@ -220,7 +220,7 @@ static struct dir *squashfs_opendir(unsi - EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); +@@ -267,7 +267,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + MEM_ERROR(); dir->dir_count = 0; - dir->cur_entry = 0; @@ -37,27 +39,27 @@ Signed-off-by: Phillip Lougher dir->mode = (*i)->mode; dir->uid = (*i)->uid; dir->guid = (*i)->gid; -@@ -295,19 +295,20 @@ static struct dir *squashfs_opendir(unsi - TRACE("squashfs_opendir: directory entry %s, inode " +@@ -351,20 +351,20 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse "%d:%d, type %d\n", dire->name, dirh.start_block, dire->offset, dire->type); + - if((dir->dir_count % DIR_ENT_SIZE) == 0) { - new_dir = realloc(dir->dirs, (dir->dir_count + - DIR_ENT_SIZE) * sizeof(struct dir_ent)); - if(new_dir == NULL) -- EXIT_UNSQUASH("squashfs_opendir: " -- "realloc failed!\n"); +- MEM_ERROR(); +- - dir->dirs = new_dir; - } ++ ent = malloc(sizeof(struct dir_ent)); ++ if(ent == NULL) ++ MEM_ERROR(); + - dir->dirs[dir->dir_count].name = strdup(dire->name); - dir->dirs[dir->dir_count].start_block = - dirh.start_block; - dir->dirs[dir->dir_count].offset = dire->offset; - dir->dirs[dir->dir_count].type = dire->type; -+ ent = malloc(sizeof(struct dir_ent)); -+ if(ent == NULL) -+ MEM_ERROR(); -+ + ent->name = strdup(dire->name); + ent->start_block = dirh.start_block; + ent->offset = dire->offset; @@ -71,6 +73,8 @@ Signed-off-by: Phillip Lougher dir->dir_count ++; bytes += dire->size + 1; } +diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c +index ac46d9da..e389f8d6 100644 --- a/squashfs-tools/unsquash-1234.c +++ b/squashfs-tools/unsquash-1234.c @@ -60,11 +60,15 @@ int check_name(char *name, int size) @@ -93,19 +97,21 @@ Signed-off-by: Phillip Lougher - free(dir->dirs); free(dir); } +diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c +index e8479807..956f96f4 100644 --- a/squashfs-tools/unsquash-2.c +++ b/squashfs-tools/unsquash-2.c -@@ -308,7 +308,7 @@ static struct dir *squashfs_opendir(unsi +@@ -347,7 +347,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse long long start; - int bytes; - int dir_count, size; + int bytes = 0; + int dir_count, size, res; - struct dir_ent *new_dir; + struct dir_ent *ent, *cur_ent = NULL; struct dir *dir; TRACE("squashfs_opendir: inode start block %d, offset %d\n", -@@ -321,7 +321,7 @@ static struct dir *squashfs_opendir(unsi - EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); +@@ -360,7 +360,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + MEM_ERROR(); dir->dir_count = 0; - dir->cur_entry = 0; @@ -113,135 +119,26 @@ Signed-off-by: Phillip Lougher dir->mode = (*i)->mode; dir->uid = (*i)->uid; dir->guid = (*i)->gid; -@@ -396,19 +396,20 @@ static struct dir *squashfs_opendir(unsi - TRACE("squashfs_opendir: directory entry %s, inode " +@@ -444,19 +444,20 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse "%d:%d, type %d\n", dire->name, dirh.start_block, dire->offset, dire->type); + - if((dir->dir_count % DIR_ENT_SIZE) == 0) { - new_dir = realloc(dir->dirs, (dir->dir_count + - DIR_ENT_SIZE) * sizeof(struct dir_ent)); - if(new_dir == NULL) -- EXIT_UNSQUASH("squashfs_opendir: " -- "realloc failed!\n"); +- MEM_ERROR(); - dir->dirs = new_dir; - } ++ ent = malloc(sizeof(struct dir_ent)); ++ if(ent == NULL) ++ MEM_ERROR(); + - dir->dirs[dir->dir_count].name = strdup(dire->name); - dir->dirs[dir->dir_count].start_block = - dirh.start_block; - dir->dirs[dir->dir_count].offset = dire->offset; - dir->dirs[dir->dir_count].type = dire->type; -+ ent = malloc(sizeof(struct dir_ent)); -+ if(ent == NULL) -+ MEM_ERROR(); -+ -+ ent->name = strdup(dire->name); -+ ent->start_block = dirh.start_block; -+ ent->offset = dire->offset; -+ ent->type = dire->type; -+ ent->next = NULL; -+ if(cur_ent == NULL) -+ dir->dirs = ent; -+ else -+ cur_ent->next = ent; -+ cur_ent = ent; - dir->dir_count ++; - bytes += dire->size + 1; - } ---- a/squashfs-tools/unsquash-3.c -+++ b/squashfs-tools/unsquash-3.c -@@ -334,7 +334,7 @@ static struct dir *squashfs_opendir(unsi - long long start; - int bytes; - int dir_count, size; -- struct dir_ent *new_dir; -+ struct dir_ent *ent, *cur_ent = NULL; - struct dir *dir; - - TRACE("squashfs_opendir: inode start block %d, offset %d\n", -@@ -347,7 +347,7 @@ static struct dir *squashfs_opendir(unsi - EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); - - dir->dir_count = 0; -- dir->cur_entry = 0; -+ dir->cur_entry = NULL; - dir->mode = (*i)->mode; - dir->uid = (*i)->uid; - dir->guid = (*i)->gid; -@@ -423,19 +423,20 @@ static struct dir *squashfs_opendir(unsi - TRACE("squashfs_opendir: directory entry %s, inode " - "%d:%d, type %d\n", dire->name, - dirh.start_block, dire->offset, dire->type); -- if((dir->dir_count % DIR_ENT_SIZE) == 0) { -- new_dir = realloc(dir->dirs, (dir->dir_count + -- DIR_ENT_SIZE) * sizeof(struct dir_ent)); -- if(new_dir == NULL) -- EXIT_UNSQUASH("squashfs_opendir: " -- "realloc failed!\n"); -- dir->dirs = new_dir; -- } -- dir->dirs[dir->dir_count].name = strdup(dire->name); -- dir->dirs[dir->dir_count].start_block = -- dirh.start_block; -- dir->dirs[dir->dir_count].offset = dire->offset; -- dir->dirs[dir->dir_count].type = dire->type; -+ ent = malloc(sizeof(struct dir_ent)); -+ if(ent == NULL) -+ MEM_ERROR(); -+ -+ ent->name = strdup(dire->name); -+ ent->start_block = dirh.start_block; -+ ent->offset = dire->offset; -+ ent->type = dire->type; -+ ent->next = NULL; -+ if(cur_ent == NULL) -+ dir->dirs = ent; -+ else -+ cur_ent->next = ent; -+ cur_ent = ent; - dir->dir_count ++; - bytes += dire->size + 1; - } ---- a/squashfs-tools/unsquash-4.c -+++ b/squashfs-tools/unsquash-4.c -@@ -281,7 +281,7 @@ static struct dir *squashfs_opendir(unsi - long long start; - long long bytes; - int dir_count, size; -- struct dir_ent *new_dir; -+ struct dir_ent *ent, *cur_ent = NULL; - struct dir *dir; - - TRACE("squashfs_opendir: inode start block %d, offset %d\n", -@@ -294,7 +294,7 @@ static struct dir *squashfs_opendir(unsi - EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n"); - - dir->dir_count = 0; -- dir->cur_entry = 0; -+ dir->cur_entry = NULL; - dir->mode = (*i)->mode; - dir->uid = (*i)->uid; - dir->guid = (*i)->gid; -@@ -359,19 +359,20 @@ static struct dir *squashfs_opendir(unsi - TRACE("squashfs_opendir: directory entry %s, inode " - "%d:%d, type %d\n", dire->name, - dirh.start_block, dire->offset, dire->type); -- if((dir->dir_count % DIR_ENT_SIZE) == 0) { -- new_dir = realloc(dir->dirs, (dir->dir_count + -- DIR_ENT_SIZE) * sizeof(struct dir_ent)); -- if(new_dir == NULL) -- EXIT_UNSQUASH("squashfs_opendir: " -- "realloc failed!\n"); -- dir->dirs = new_dir; -- } -- dir->dirs[dir->dir_count].name = strdup(dire->name); -- dir->dirs[dir->dir_count].start_block = -- dirh.start_block; -- dir->dirs[dir->dir_count].offset = dire->offset; -- dir->dirs[dir->dir_count].type = dire->type; -+ ent = malloc(sizeof(struct dir_ent)); -+ if(ent == NULL) -+ MEM_ERROR(); -+ + ent->name = strdup(dire->name); + ent->start_block = dirh.start_block; + ent->offset = dire->offset; @@ -255,9 +152,121 @@ Signed-off-by: Phillip Lougher dir->dir_count ++; bytes += dire->size + 1; } +diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c +index 8223f274..835a574c 100644 +--- a/squashfs-tools/unsquash-3.c ++++ b/squashfs-tools/unsquash-3.c +@@ -381,7 +381,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + long long start; + int bytes = 0; + int dir_count, size, res; +- struct dir_ent *new_dir; ++ struct dir_ent *ent, *cur_ent = NULL; + struct dir *dir; + + TRACE("squashfs_opendir: inode start block %d, offset %d\n", +@@ -394,7 +394,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + MEM_ERROR(); + + dir->dir_count = 0; +- dir->cur_entry = 0; ++ dir->cur_entry = NULL; + dir->mode = (*i)->mode; + dir->uid = (*i)->uid; + dir->guid = (*i)->gid; +@@ -478,19 +478,20 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + "%d:%d, type %d\n", dire->name, + dirh.start_block, dire->offset, dire->type); + +- if((dir->dir_count % DIR_ENT_SIZE) == 0) { +- new_dir = realloc(dir->dirs, (dir->dir_count + +- DIR_ENT_SIZE) * sizeof(struct dir_ent)); +- if(new_dir == NULL) +- MEM_ERROR(); +- dir->dirs = new_dir; +- } ++ ent = malloc(sizeof(struct dir_ent)); ++ if(ent == NULL) ++ MEM_ERROR(); + +- dir->dirs[dir->dir_count].name = strdup(dire->name); +- dir->dirs[dir->dir_count].start_block = +- dirh.start_block; +- dir->dirs[dir->dir_count].offset = dire->offset; +- dir->dirs[dir->dir_count].type = dire->type; ++ ent->name = strdup(dire->name); ++ ent->start_block = dirh.start_block; ++ ent->offset = dire->offset; ++ ent->type = dire->type; ++ ent->next = NULL; ++ if(cur_ent == NULL) ++ dir->dirs = ent; ++ else ++ cur_ent->next = ent; ++ cur_ent = ent; + dir->dir_count ++; + bytes += dire->size + 1; + } +diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c +index 1e199a7c..694783da 100644 +--- a/squashfs-tools/unsquash-4.c ++++ b/squashfs-tools/unsquash-4.c +@@ -331,7 +331,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + struct squashfs_dir_entry *dire = (struct squashfs_dir_entry *) buffer; + long long start; + int bytes = 0, dir_count, size, res; +- struct dir_ent *new_dir; ++ struct dir_ent *ent, *cur_ent = NULL; + struct dir *dir; + + TRACE("squashfs_opendir: inode start block %d, offset %d\n", +@@ -344,7 +344,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + MEM_ERROR(); + + dir->dir_count = 0; +- dir->cur_entry = 0; ++ dir->cur_entry = NULL; + dir->mode = (*i)->mode; + dir->uid = (*i)->uid; + dir->guid = (*i)->gid; +@@ -415,19 +415,20 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse + "%d:%d, type %d\n", dire->name, + dirh.start_block, dire->offset, dire->type); + +- if((dir->dir_count % DIR_ENT_SIZE) == 0) { +- new_dir = realloc(dir->dirs, (dir->dir_count + +- DIR_ENT_SIZE) * sizeof(struct dir_ent)); +- if(new_dir == NULL) +- MEM_ERROR(); +- dir->dirs = new_dir; +- } ++ ent = malloc(sizeof(struct dir_ent)); ++ if(ent == NULL) ++ MEM_ERROR(); + +- dir->dirs[dir->dir_count].name = strdup(dire->name); +- dir->dirs[dir->dir_count].start_block = +- dirh.start_block; +- dir->dirs[dir->dir_count].offset = dire->offset; +- dir->dirs[dir->dir_count].type = dire->type; ++ ent->name = strdup(dire->name); ++ ent->start_block = dirh.start_block; ++ ent->offset = dire->offset; ++ ent->type = dire->type; ++ ent->next = NULL; ++ if(cur_ent == NULL) ++ dir->dirs = ent; ++ else ++ cur_ent->next = ent; ++ cur_ent = ent; + dir->dir_count ++; + bytes += dire->size + 1; + } +diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c +index 04be53cd..fee28ec1 100644 --- a/squashfs-tools/unsquashfs.c +++ b/squashfs-tools/unsquashfs.c -@@ -1277,14 +1277,18 @@ failed: +@@ -1337,14 +1337,18 @@ int create_inode(char *pathname, struct inode *i) int squashfs_readdir(struct dir *dir, char **name, unsigned int *start_block, unsigned int *offset, unsigned int *type) { @@ -282,9 +291,11 @@ Signed-off-by: Phillip Lougher return TRUE; } +diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h +index 583fbe4d..f8cf78cb 100644 --- a/squashfs-tools/unsquashfs.h +++ b/squashfs-tools/unsquashfs.h -@@ -169,17 +169,18 @@ struct dir_ent { +@@ -168,17 +168,18 @@ struct dir_ent { unsigned int start_block; unsigned int offset; unsigned int type; @@ -298,7 +309,7 @@ Signed-off-by: Phillip Lougher uid_t uid; gid_t guid; unsigned int mtime; - unsigned int xattr; + unsigned int xattr; struct dir_ent *dirs; + struct dir_ent *cur_entry; }; diff --git a/0003-squashfs-tools-fix-build-failure-against-gcc-10.patch b/0003-squashfs-tools-fix-build-failure-against-gcc-10.patch deleted file mode 100644 index 9e6a58d..0000000 --- a/0003-squashfs-tools-fix-build-failure-against-gcc-10.patch +++ /dev/null @@ -1,46 +0,0 @@ -From ce42828b8f2001eb691bf378ff5a351484f1f4c2 Mon Sep 17 00:00:00 2001 -From: Sergei Trofimovich -Date: Sun, 26 Jan 2020 18:35:13 +0000 -Subject: [PATCH 3/4] squashfs-tools: fix build failure against gcc-10 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -On gcc-10 (and gcc-9 -fno-common) build fails as: - -``` -cc ... -o mksquashfs -ld: read_fs.o:(.bss+0x0): - multiple definition of `fwriter_buffer'; mksquashfs.o:(.bss+0x400c90): first defined here -ld: read_fs.o:(.bss+0x8): - multiple definition of `bwriter_buffer'; mksquashfs.o:(.bss+0x400c98): first defined here -``` - -gcc-10 will change the default from -fcommon to fno-common: -https://gcc.gnu.org/PR85678. - -The error also happens if CFLAGS=-fno-common passed explicitly. - -Reported-by: Toralf Förster -Bug: https://bugs.gentoo.org/706456 -Signed-off-by: Sergei Trofimovich ---- - squashfs-tools/mksquashfs.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/squashfs-tools/mksquashfs.h b/squashfs-tools/mksquashfs.h -index 1beefef..b650306 100644 ---- a/squashfs-tools/mksquashfs.h -+++ b/squashfs-tools/mksquashfs.h -@@ -143,7 +143,7 @@ struct append_file { - #endif - - extern struct cache *reader_buffer, *fragment_buffer, *reserve_cache; --struct cache *bwriter_buffer, *fwriter_buffer; -+extern struct cache *bwriter_buffer, *fwriter_buffer; - extern struct queue *to_reader, *to_deflate, *to_writer, *from_writer, - *to_frag, *locked_fragment, *to_process_frag; - extern struct append_file **file_mapping; --- -1.8.3.1 - diff --git a/0009-CVE-2021-41072.patch b/0004-CVE-2021-41072.patch similarity index 79% rename from 0009-CVE-2021-41072.patch rename to 0004-CVE-2021-41072.patch index 4bc800e..e630afe 100644 --- a/0009-CVE-2021-41072.patch +++ b/0004-CVE-2021-41072.patch @@ -41,10 +41,12 @@ Signed-off-by: Phillip Lougher 8 files changed, 173 insertions(+), 2 deletions(-) create mode 100644 squashfs-tools/unsquash-12.c +diff --git a/squashfs-tools/Makefile b/squashfs-tools/Makefile +index 7262a2e0..1b544ed6 100755 --- a/squashfs-tools/Makefile +++ b/squashfs-tools/Makefile -@@ -156,8 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o - caches-queues-lists.o +@@ -160,8 +160,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o action.o swap.o pseudo.o compressor.o \ + caches-queues-lists.o reader.o tar.o UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \ - unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \ @@ -54,18 +56,20 @@ Signed-off-by: Phillip Lougher CFLAGS ?= -O2 CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \ -@@ -353,6 +353,8 @@ unsquash-34.o: unsquashfs.h unsquash-34. +@@ -393,6 +393,8 @@ unsquash-34.o: unsquashfs.h unsquash-34.c unsquashfs_error.h - unsquash-1234.o: unsquash-1234.c + unsquash-1234.o: unsquash-1234.c unsquashfs_error.h +unsquash-1234.o: unsquash-12.c + - unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h + unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h unsquashfs_error.h - unsquashfs_info.o: unsquashfs.h squashfs_fs.h + unsquashfs_info.o: unsquashfs.h squashfs_fs.h unsquashfs_error.h +diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c +index b6044341..88866fcd 100644 --- a/squashfs-tools/unsquash-1.c +++ b/squashfs-tools/unsquash-1.c -@@ -314,6 +314,12 @@ static struct dir *squashfs_opendir(unsi +@@ -370,6 +370,12 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse } } @@ -78,6 +82,9 @@ Signed-off-by: Phillip Lougher return dir; corrupted: +diff --git a/squashfs-tools/unsquash-12.c b/squashfs-tools/unsquash-12.c +new file mode 100644 +index 00000000..61bf1284 --- /dev/null +++ b/squashfs-tools/unsquash-12.c @@ -0,0 +1,110 @@ @@ -191,6 +198,8 @@ Signed-off-by: Phillip Lougher + stride = stride << 1; + } while(stride < dir->dir_count); +} +diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c +index e389f8d6..98a81ed0 100644 --- a/squashfs-tools/unsquash-1234.c +++ b/squashfs-tools/unsquash-1234.c @@ -72,3 +72,24 @@ void squashfs_closedir(struct dir *dir) @@ -218,17 +227,19 @@ Signed-off-by: Phillip Lougher + + return TRUE; +} +diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c +index 956f96f4..0e36f7d5 100644 --- a/squashfs-tools/unsquash-2.c +++ b/squashfs-tools/unsquash-2.c -@@ -29,6 +29,7 @@ static squashfs_fragment_entry_2 *fragme +@@ -29,6 +29,7 @@ + static squashfs_fragment_entry_2 *fragment_table; static unsigned int *uid_table, *guid_table; - static char *inode_table, *directory_table; static squashfs_operations ops; +static int needs_sorting = FALSE; - static void read_block_list(unsigned int *block_list, char *block_ptr, int blocks) - { -@@ -415,6 +416,17 @@ static struct dir *squashfs_opendir(unsi + + static void read_block_list(unsigned int *block_list, long long start, +@@ -463,6 +464,17 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse } } @@ -246,9 +257,22 @@ Signed-off-by: Phillip Lougher return dir; corrupted: +@@ -596,6 +608,10 @@ int read_super_2(squashfs_operations **s_ops, void *s) + * 2.x filesystems use gzip compression. + */ + comp = lookup_compressor("gzip"); ++ ++ if(sBlk_3->s_minor == 0) ++ needs_sorting = TRUE; ++ + return TRUE; + } + +diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c +index 835a574c..01235626 100644 --- a/squashfs-tools/unsquash-3.c +++ b/squashfs-tools/unsquash-3.c -@@ -442,6 +442,12 @@ static struct dir *squashfs_opendir(unsi +@@ -497,6 +497,12 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse } } @@ -261,9 +285,11 @@ Signed-off-by: Phillip Lougher return dir; corrupted: +diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c +index 694783da..c615bb83 100644 --- a/squashfs-tools/unsquash-4.c +++ b/squashfs-tools/unsquash-4.c -@@ -378,6 +378,12 @@ static struct dir *squashfs_opendir(unsi +@@ -434,6 +434,12 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse } } @@ -276,9 +302,11 @@ Signed-off-by: Phillip Lougher return dir; corrupted: +diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h +index f8cf78cb..bf2a80d0 100644 --- a/squashfs-tools/unsquashfs.h +++ b/squashfs-tools/unsquashfs.h -@@ -266,4 +266,8 @@ extern long long *alloc_index_table(int) +@@ -293,4 +293,8 @@ extern long long *alloc_index_table(int); /* unsquash-1234.c */ extern int check_name(char *, int); extern void squashfs_closedir(struct dir *); diff --git a/0004-xattr-Initialize-header-to-avoid-valgrind-warning.patch b/0004-xattr-Initialize-header-to-avoid-valgrind-warning.patch deleted file mode 100644 index e37307e..0000000 --- a/0004-xattr-Initialize-header-to-avoid-valgrind-warning.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 250f2f52fa3074c66b426a20200ad6934bc071de Mon Sep 17 00:00:00 2001 -From: Henrik Grindal Bakken -Date: Wed, 6 Dec 2017 13:18:51 +0100 -Subject: [PATCH 4/4] xattr: Initialize header to avoid valgrind warning - -The 'unused' field was written uninitialized to disk. This introduces -a randomness into the file system, and it also ends up as a valgrind -warning. - -Signed-off-by: Phillip Lougher ---- - squashfs-tools/xattr.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/squashfs-tools/xattr.c b/squashfs-tools/xattr.c -index 64dfd82..b802965 100644 ---- a/squashfs-tools/xattr.c -+++ b/squashfs-tools/xattr.c -@@ -425,7 +425,7 @@ long long write_xattrs() - int i, avail_bytes; - char *datap = data_cache; - long long start_bytes = bytes; -- struct squashfs_xattr_table header; -+ struct squashfs_xattr_table header = {}; - - if(xattr_ids == 0) - return SQUASHFS_INVALID_BLK; --- -1.8.3.1 - diff --git a/0005-CVE-2021-40153.patch b/0005-CVE-2021-40153.patch deleted file mode 100644 index 3185c87..0000000 --- a/0005-CVE-2021-40153.patch +++ /dev/null @@ -1,264 +0,0 @@ -From 39971ca17a17520cefeb84f65e028d5004a579b2 Mon Sep 17 00:00:00 2001 -From: Phillip Lougher -Date: Sat, 16 Jan 2021 20:08:55 +0000 -Subject: [PATCH] Unsquashfs: fix write outside destination directory exploit - -An issue on Github (https://github.com/plougher/squashfs-tools/issues/72) -shows how some specially crafted Squashfs filesystems containing -invalid file names (with '/' and ..) can cause Unsquashfs to write -files outside of the destination directory. - -This commit fixes this exploit by checking all names for -validity. - -In doing so I have also added checks for '.' and for names that -are shorter than they should be (names in the file system should -not have '\0' terminators). - -Signed-off-by: Phillip Lougher ---- - squashfs-tools/Makefile | 5 ++- - squashfs-tools/unsquash-1.c | 9 +++++- - squashfs-tools/unsquash-1234.c | 58 ++++++++++++++++++++++++++++++++++ - squashfs-tools/unsquash-2.c | 9 +++++- - squashfs-tools/unsquash-3.c | 9 +++++- - squashfs-tools/unsquash-4.c | 9 +++++- - squashfs-tools/unsquashfs.c | 4 +-- - squashfs-tools/unsquashfs.h | 5 ++- - 8 files changed, 100 insertions(+), 8 deletions(-) - create mode 100644 squashfs-tools/unsquash-1234.c - -diff --git a/squashfs-tools/Makefile b/squashfs-tools/Makefile -index 46c0772..de06bb2 100644 ---- a/squashfs-tools/Makefile -+++ b/squashfs-tools/Makefile -@@ -156,7 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o action.o swap.o pseudo.o compressor.o \ - caches-queues-lists.o - - UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \ -- unsquash-4.o unsquash-123.o unsquash-34.o swap.o compressor.o unsquashfs_info.o -+ unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \ -+ compressor.o unsquashfs_info.o - - CFLAGS ?= -O2 - CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \ -@@ -350,6 +351,8 @@ unsquash-123.o: unsquashfs.h unsquash-123.c squashfs_fs.h squashfs_compat.h - - unsquash-34.o: unsquashfs.h unsquash-34.c - -+unsquash-1234.o: unsquash-1234.c -+ - unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h - - unsquashfs_info.o: unsquashfs.h squashfs_fs.h -diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c -index 34eced3..28326cb 100644 ---- a/squashfs-tools/unsquash-1.c -+++ b/squashfs-tools/unsquash-1.c -@@ -2,7 +2,7 @@ - * Unsquash a squashfs filesystem. This is a highly compressed read only - * filesystem. - * -- * Copyright (c) 2009, 2010, 2011, 2012, 2019 -+ * Copyright (c) 2009, 2010, 2011, 2012, 2019, 2021 - * Phillip Lougher - * - * This program is free software; you can redistribute it and/or -@@ -285,6 +285,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse - memcpy(dire->name, directory_table + bytes, - dire->size + 1); - dire->name[dire->size + 1] = '\0'; -+ -+ /* check name for invalid characters (i.e /, ., ..) */ -+ if(check_name(dire->name, dire->size + 1) == FALSE) { -+ ERROR("File system corrupted: invalid characters in name\n"); -+ goto corrupted; -+ } -+ - TRACE("squashfs_opendir: directory entry %s, inode " - "%d:%d, type %d\n", dire->name, - dirh.start_block, dire->offset, dire->type); -diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c -new file mode 100644 -index 0000000..c2d4f42 ---- /dev/null -+++ b/squashfs-tools/unsquash-1234.c -@@ -0,0 +1,58 @@ -+/* -+ * Unsquash a squashfs filesystem. This is a highly compressed read only -+ * filesystem. -+ * -+ * Copyright (c) 2021 -+ * Phillip Lougher -+ * -+ * This program is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU General Public License -+ * as published by the Free Software Foundation; either version 2, -+ * or (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program; if not, write to the Free Software -+ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -+ * -+ * unsquash-1234.c -+ * -+ * Helper functions used by unsquash-1, unsquash-2, unsquash-3 and -+ * unsquash-4. -+ */ -+ -+#define TRUE 1 -+#define FALSE 0 -+/* -+ * Check name for validity, name should not -+ * - be ".", "./", or -+ * - be "..", "../" or -+ * - have a "/" anywhere in the name, or -+ * - be shorter than the expected size -+ */ -+int check_name(char *name, int size) -+{ -+ char *start = name; -+ -+ if(name[0] == '.') { -+ if(name[1] == '.') -+ name++; -+ if(name[1] == '/' || name[1] == '\0') -+ return FALSE; -+ } -+ -+ while(name[0] != '/' && name[0] != '\0') -+ name ++; -+ -+ if(name[0] == '/') -+ return FALSE; -+ -+ if((name - start) != size) -+ return FALSE; -+ -+ return TRUE; -+} -diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c -index 4b3d767..474064e 100644 ---- a/squashfs-tools/unsquash-2.c -+++ b/squashfs-tools/unsquash-2.c -@@ -2,7 +2,7 @@ - * Unsquash a squashfs filesystem. This is a highly compressed read only - * filesystem. - * -- * Copyright (c) 2009, 2010, 2013, 2019 -+ * Copyright (c) 2009, 2010, 2013, 2019, 2021 - * Phillip Lougher - * - * This program is free software; you can redistribute it and/or -@@ -386,6 +386,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse - memcpy(dire->name, directory_table + bytes, - dire->size + 1); - dire->name[dire->size + 1] = '\0'; -+ -+ /* check name for invalid characters (i.e /, ., ..) */ -+ if(check_name(dire->name, dire->size + 1) == FALSE) { -+ ERROR("File system corrupted: invalid characters in name\n"); -+ goto corrupted; -+ } -+ - TRACE("squashfs_opendir: directory entry %s, inode " - "%d:%d, type %d\n", dire->name, - dirh.start_block, dire->offset, dire->type); -diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c -index 02c31fc..65cfe4d 100644 ---- a/squashfs-tools/unsquash-3.c -+++ b/squashfs-tools/unsquash-3.c -@@ -2,7 +2,7 @@ - * Unsquash a squashfs filesystem. This is a highly compressed read only - * filesystem. - * -- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019 -+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021 - * Phillip Lougher - * - * This program is free software; you can redistribute it and/or -@@ -413,6 +413,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse - memcpy(dire->name, directory_table + bytes, - dire->size + 1); - dire->name[dire->size + 1] = '\0'; -+ -+ /* check name for invalid characters (i.e /, ., ..) */ -+ if(check_name(dire->name, dire->size + 1) == FALSE) { -+ ERROR("File system corrupted: invalid characters in name\n"); -+ goto corrupted; -+ } -+ - TRACE("squashfs_opendir: directory entry %s, inode " - "%d:%d, type %d\n", dire->name, - dirh.start_block, dire->offset, dire->type); -diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c -index 8475835..aa23a84 100644 ---- a/squashfs-tools/unsquash-4.c -+++ b/squashfs-tools/unsquash-4.c -@@ -2,7 +2,7 @@ - * Unsquash a squashfs filesystem. This is a highly compressed read only - * filesystem. - * -- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019 -+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021 - * Phillip Lougher - * - * This program is free software; you can redistribute it and/or -@@ -349,6 +349,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse - memcpy(dire->name, directory_table + bytes, - dire->size + 1); - dire->name[dire->size + 1] = '\0'; -+ -+ /* check name for invalid characters (i.e /, ., ..) */ -+ if(check_name(dire->name, dire->size + 1) == FALSE) { -+ ERROR("File system corrupted: invalid characters in name\n"); -+ goto corrupted; -+ } -+ - TRACE("squashfs_opendir: directory entry %s, inode " - "%d:%d, type %d\n", dire->name, - dirh.start_block, dire->offset, dire->type); -diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c -index 727f1d5..f1c3552 100644 ---- a/squashfs-tools/unsquashfs.c -+++ b/squashfs-tools/unsquashfs.c -@@ -2610,8 +2610,8 @@ int parse_number(char *start, int *res) - - - #define VERSION() \ -- printf("unsquashfs version 4.4 (2019/08/29)\n");\ -- printf("copyright (C) 2019 Phillip Lougher "\ -+ printf("unsquashfs version 4.4-git (2021/01/17)\n");\ -+ printf("copyright (C) 2021 Phillip Lougher "\ - "\n\n");\ - printf("This program is free software; you can redistribute it and/or"\ - "\n");\ -diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h -index 934618b..db1da7a 100644 ---- a/squashfs-tools/unsquashfs.h -+++ b/squashfs-tools/unsquashfs.h -@@ -4,7 +4,7 @@ - * Unsquash a squashfs filesystem. This is a highly compressed read only - * filesystem. - * -- * Copyright (c) 2009, 2010, 2013, 2014, 2019 -+ * Copyright (c) 2009, 2010, 2013, 2014, 2019, 2021 - * Phillip Lougher - * - * This program is free software; you can redistribute it and/or -@@ -261,4 +261,7 @@ extern int read_ids(int, long long, long long, unsigned int **); - - /* unsquash-34.c */ - extern long long *alloc_index_table(int); -+ -+/* unsquash-1234.c */ -+extern int check_name(char *, int); - #endif --- -2.23.0 - diff --git a/0010-CVE-2021-41072.patch b/0005-CVE-2021-41072.patch similarity index 68% rename from 0010-CVE-2021-41072.patch rename to 0005-CVE-2021-41072.patch index bb199ab..7857fb6 100644 --- a/0010-CVE-2021-41072.patch +++ b/0005-CVE-2021-41072.patch @@ -8,14 +8,16 @@ Signed-off-by: Phillip Lougher squashfs-tools/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) +diff --git a/squashfs-tools/Makefile b/squashfs-tools/Makefile +index 1b544ed6..5d6a8de2 100755 --- a/squashfs-tools/Makefile +++ b/squashfs-tools/Makefile -@@ -353,7 +353,7 @@ unsquash-34.o: unsquashfs.h unsquash-34. +@@ -393,7 +393,7 @@ unsquash-34.o: unsquashfs.h unsquash-34.c unsquashfs_error.h - unsquash-1234.o: unsquash-1234.c + unsquash-1234.o: unsquash-1234.c unsquashfs_error.h -unsquash-1234.o: unsquash-12.c +unsquash-12.o: unsquash-12.c unsquashfs.h - unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h + unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h unsquashfs_error.h diff --git a/squashfs-tools.spec b/squashfs-tools.spec index 39d73e6..c6b14ff 100644 --- a/squashfs-tools.spec +++ b/squashfs-tools.spec @@ -1,22 +1,17 @@ Name: squashfs-tools -Version: 4.4 -Release: 5 +Version: 4.5 +Release: 1 Summary: Utility for the squashfs filesystems License: GPLv2+ URL: http://squashfs.sourceforge.net/ Source0: http://downloads.sourceforge.net/squashfs/squashfs%{version}.tar.gz -Patch1: 0001-Fix-typos-update-URLs-in-squashfs-tools-Makefile.patch -Patch2: 0002-Support-creating-sockets-in-unsquashfs.patch -Patch3: 0003-squashfs-tools-fix-build-failure-against-gcc-10.patch -Patch4: 0004-xattr-Initialize-header-to-avoid-valgrind-warning.patch -Patch5: 0005-CVE-2021-40153.patch -Patch6: 0006-CVE-2021-41072.patch -Patch7: 0007-CVE-2021-41072.patch -Patch8: 0008-CVE-2021-41072.patch -Patch9: 0009-CVE-2021-41072.patch -Patch10: 0010-CVE-2021-41072.patch +Patch1: 0001-CVE-2021-41072.patch +Patch2: 0002-CVE-2021-41072.patch +Patch3: 0003-CVE-2021-41072.patch +Patch4: 0004-CVE-2021-41072.patch +Patch5: 0005-CVE-2021-41072.patch BuildRequires: zlib-devel xz-devel libzstd-devel BuildRequires: lzo-devel libattr-devel lz4-devel gcc @@ -27,7 +22,7 @@ It uses either gzip/xz/lzo/lz4/zstd compression to compress both files, inodes and directories. %prep -%autosetup -n squashfs%{version} -p1 +%autosetup -n squashfs-tools-%{version} -p1 %build CFLAGS="%{optflags}" XZ_SUPPORT=1 LZO_SUPPORT=1 LZMA_XZ_SUPPORT=1 LZ4_SUPPORT=1 ZSTD_SUPPORT=1 \ @@ -39,7 +34,7 @@ install -D -m 755 squashfs-tools/unsquashfs %{buildroot}%{_sbindir}/unsquashfs %files %defattr(-,root,root) -%doc ACKNOWLEDGEMENTS README-4.4 +%doc ACKNOWLEDGEMENTS README-4.5 %license COPYING %{_sbindir}/mksquashfs %{_sbindir}/unsquashfs @@ -47,6 +42,9 @@ install -D -m 755 squashfs-tools/unsquashfs %{buildroot}%{_sbindir}/unsquashfs %changelog +* Thu Nov 25 2021 yanglongkang - 4.5-1 +- update to 4.5 + * Tue Nov 9 2021 yanglongkang - 4.4-5 - Fix CVE-2021-41053 CVE-2021-41072 diff --git a/squashfs4.4.tar.gz b/squashfs4.4.tar.gz deleted file mode 100644 index 283ed38..0000000 Binary files a/squashfs4.4.tar.gz and /dev/null differ diff --git a/squashfs4.5.tar.gz b/squashfs4.5.tar.gz new file mode 100644 index 0000000..070de00 Binary files /dev/null and b/squashfs4.5.tar.gz differ