fix CVE-2022-4899
This commit is contained in:
zhoupengcheng11
parent
e08a183510
commit
b78ee7f036
85
backport-0001-CVE-2022-4899.patch
Normal file
85
backport-0001-CVE-2022-4899.patch
Normal file
@ -0,0 +1,85 @@
|
||||
From f9f27de91c89d826c6a39c3ef44fb1b02f9a43aa Mon Sep 17 00:00:00 2001
|
||||
From: Elliot Gorokhovsky <embg@fb.com>
|
||||
Date: Fri, 29 Jul 2022 14:44:22 -0700
|
||||
Subject: [PATCH] Disallow empty output directory
|
||||
|
||||
Reference:https://github.com/facebook/zstd/commit/f9f27de91c89d826c6a39c3ef44fb1b02f9a43aa
|
||||
Conflict:NA
|
||||
---
|
||||
programs/zstdcli.c | 18 ++++++++++++++++--
|
||||
tests/cli-tests/basic/output_dir.sh | 7 +++++++
|
||||
.../cli-tests/basic/output_dir.sh.stderr.exact | 2 ++
|
||||
.../cli-tests/basic/output_dir.sh.stdout.exact | 2 ++
|
||||
4 files changed, 27 insertions(+), 2 deletions(-)
|
||||
create mode 100755 tests/cli-tests/basic/output_dir.sh
|
||||
create mode 100644 tests/cli-tests/basic/output_dir.sh.stderr.exact
|
||||
create mode 100644 tests/cli-tests/basic/output_dir.sh.stdout.exact
|
||||
|
||||
diff --git a/programs/zstdcli.c b/programs/zstdcli.c
|
||||
index bfe18c0..50ef3ba 100644
|
||||
--- a/programs/zstdcli.c
|
||||
+++ b/programs/zstdcli.c
|
||||
@@ -990,7 +990,14 @@ int main(int argCount, const char* argv[])
|
||||
if (longCommandWArg(&argument, "--stream-size=")) { streamSrcSize = readSizeTFromChar(&argument); continue; }
|
||||
if (longCommandWArg(&argument, "--target-compressed-block-size=")) { targetCBlockSize = readSizeTFromChar(&argument); continue; }
|
||||
if (longCommandWArg(&argument, "--size-hint=")) { srcSizeHint = readSizeTFromChar(&argument); continue; }
|
||||
- if (longCommandWArg(&argument, "--output-dir-flat")) { NEXT_FIELD(outDirName); continue; }
|
||||
+ if (longCommandWArg(&argument, "--output-dir-flat")) {
|
||||
+ NEXT_FIELD(outDirName);
|
||||
+ if (strlen(outDirName) == 0) {
|
||||
+ DISPLAY("error: output dir cannot be empty string (did you mean to pass '.' instead?)\n");
|
||||
+ CLEAN_RETURN(1);
|
||||
+ }
|
||||
+ continue;
|
||||
+ }
|
||||
#ifdef ZSTD_MULTITHREAD
|
||||
if (longCommandWArg(&argument, "--auto-threads")) {
|
||||
const char* threadDefault = NULL;
|
||||
@@ -1001,7 +1008,14 @@ int main(int argCount, const char* argv[])
|
||||
}
|
||||
#endif
|
||||
#ifdef UTIL_HAS_MIRRORFILELIST
|
||||
- if (longCommandWArg(&argument, "--output-dir-mirror")) { NEXT_FIELD(outMirroredDirName); continue; }
|
||||
+ if (longCommandWArg(&argument, "--output-dir-mirror")) {
|
||||
+ NEXT_FIELD(outMirroredDirName);
|
||||
+ if (strlen(outMirroredDirName) == 0) {
|
||||
+ DISPLAY("error: output dir cannot be empty string (did you mean to pass '.' instead?)\n");
|
||||
+ CLEAN_RETURN(1);
|
||||
+ }
|
||||
+ continue;
|
||||
+ }
|
||||
#endif
|
||||
#ifndef ZSTD_NOTRACE
|
||||
if (longCommandWArg(&argument, "--trace")) { char const* traceFile; NEXT_FIELD(traceFile); TRACE_enable(traceFile); continue; }
|
||||
diff --git a/tests/cli-tests/basic/output_dir.sh b/tests/cli-tests/basic/output_dir.sh
|
||||
new file mode 100755
|
||||
index 0000000..a8819d2
|
||||
--- /dev/null
|
||||
+++ b/tests/cli-tests/basic/output_dir.sh
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/sh
|
||||
+
|
||||
+println "+ zstd -r * --output-dir-mirror=\"\""
|
||||
+zstd -r * --output-dir-mirror="" && die "Should not allow empty output dir!"
|
||||
+println "+ zstd -r * --output-dir-flat=\"\""
|
||||
+zstd -r * --output-dir-flat="" && die "Should not allow empty output dir!"
|
||||
+exit 0
|
||||
diff --git a/tests/cli-tests/basic/output_dir.sh.stderr.exact b/tests/cli-tests/basic/output_dir.sh.stderr.exact
|
||||
new file mode 100644
|
||||
index 0000000..e12b504
|
||||
--- /dev/null
|
||||
+++ b/tests/cli-tests/basic/output_dir.sh.stderr.exact
|
||||
@@ -0,0 +1,2 @@
|
||||
+error: output dir cannot be empty string (did you mean to pass '.' instead?)
|
||||
+error: output dir cannot be empty string (did you mean to pass '.' instead?)
|
||||
diff --git a/tests/cli-tests/basic/output_dir.sh.stdout.exact b/tests/cli-tests/basic/output_dir.sh.stdout.exact
|
||||
new file mode 100644
|
||||
index 0000000..1e478cd
|
||||
--- /dev/null
|
||||
+++ b/tests/cli-tests/basic/output_dir.sh.stdout.exact
|
||||
@@ -0,0 +1,2 @@
|
||||
++ zstd -r * --output-dir-mirror=""
|
||||
++ zstd -r * --output-dir-flat=""
|
||||
--
|
||||
2.27.0
|
||||
|
||||
63
backport-0002-CVE-2022-4899.patch
Normal file
63
backport-0002-CVE-2022-4899.patch
Normal file
@ -0,0 +1,63 @@
|
||||
From e1873ad576cb478fff0e6e44ad99599cd5fd2846 Mon Sep 17 00:00:00 2001
|
||||
From: Elliot Gorokhovsky <embg@fb.com>
|
||||
Date: Fri, 29 Jul 2022 11:10:47 -0700
|
||||
Subject: [PATCH] Fix buffer underflow for null dir1
|
||||
|
||||
---
|
||||
programs/util.c | 38 +++++++++++++++++++-------------------
|
||||
1 file changed, 19 insertions(+), 19 deletions(-)
|
||||
|
||||
diff --git a/programs/util.c b/programs/util.c
|
||||
index f53eb03fbe..b874344c4d 100644
|
||||
--- a/programs/util.c
|
||||
+++ b/programs/util.c
|
||||
@@ -870,30 +870,30 @@ static const char * trimPath(const char *pathname)
|
||||
|
||||
static char* mallocAndJoin2Dir(const char *dir1, const char *dir2)
|
||||
{
|
||||
- const size_t dir1Size = strlen(dir1);
|
||||
- const size_t dir2Size = strlen(dir2);
|
||||
- char *outDirBuffer, *buffer, trailingChar;
|
||||
-
|
||||
assert(dir1 != NULL && dir2 != NULL);
|
||||
- outDirBuffer = (char *) malloc(dir1Size + dir2Size + 2);
|
||||
- CONTROL(outDirBuffer != NULL);
|
||||
+ { const size_t dir1Size = strlen(dir1);
|
||||
+ const size_t dir2Size = strlen(dir2);
|
||||
+ char *outDirBuffer, *buffer;
|
||||
|
||||
- memcpy(outDirBuffer, dir1, dir1Size);
|
||||
- outDirBuffer[dir1Size] = '\0';
|
||||
+ outDirBuffer = (char *) malloc(dir1Size + dir2Size + 2);
|
||||
+ CONTROL(outDirBuffer != NULL);
|
||||
|
||||
- if (dir2[0] == '.')
|
||||
- return outDirBuffer;
|
||||
+ memcpy(outDirBuffer, dir1, dir1Size);
|
||||
+ outDirBuffer[dir1Size] = '\0';
|
||||
|
||||
- buffer = outDirBuffer + dir1Size;
|
||||
- trailingChar = *(buffer - 1);
|
||||
- if (trailingChar != PATH_SEP) {
|
||||
- *buffer = PATH_SEP;
|
||||
- buffer++;
|
||||
- }
|
||||
- memcpy(buffer, dir2, dir2Size);
|
||||
- buffer[dir2Size] = '\0';
|
||||
+ if (dir2[0] == '.')
|
||||
+ return outDirBuffer;
|
||||
|
||||
- return outDirBuffer;
|
||||
+ buffer = outDirBuffer + dir1Size;
|
||||
+ if (dir1Size > 0 && *(buffer - 1) != PATH_SEP) {
|
||||
+ *buffer = PATH_SEP;
|
||||
+ buffer++;
|
||||
+ }
|
||||
+ memcpy(buffer, dir2, dir2Size);
|
||||
+ buffer[dir2Size] = '\0';
|
||||
+
|
||||
+ return outDirBuffer;
|
||||
+ }
|
||||
}
|
||||
|
||||
/* this function will return NULL if input srcFileName is not valid name for mirrored output path */
|
||||
@ -2,12 +2,15 @@
|
||||
|
||||
Name: zstd
|
||||
Version: 1.5.2
|
||||
Release: 1
|
||||
Release: 2
|
||||
Summary: A fast lossless compression algorithm
|
||||
License: BSD and GPLv2
|
||||
URL: https://github.com/facebook/zstd
|
||||
Source0: https://github.com/facebook/zstd/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
||||
|
||||
Patch6000: backport-0001-CVE-2022-4899.patch
|
||||
Patch6001: backport-0002-CVE-2022-4899.patch
|
||||
|
||||
Patch9000: add-test-c-result-print.patch
|
||||
|
||||
BuildRequires: gtest-devel gcc-c++ pkg-config
|
||||
@ -87,6 +90,9 @@ install -D -m644 programs/zstd.1 %{buildroot}%{_mandir}/man1/pzstd.1
|
||||
%{_mandir}/man1/*.1*
|
||||
|
||||
%changelog
|
||||
* Mon Apr 3 2023 zhoupengcheng <zhoupengcheng11@huawei.com> - 1.5.2.2
|
||||
* fix CVE-2022-4899
|
||||
|
||||
* Tue Jan 31 2023 zhoupengcheng <zhoupengcheng11@huawei.com> - 1.5.2.1
|
||||
* zstd update to 1.5.2
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user