diff --git a/cpio.spec b/cpio.spec index 8caddf42178b45e406f78186a4defa3438e52447..feded0519c1a468e086a4a3bbb5b4ed5783a2228 100644 --- a/cpio.spec +++ b/cpio.spec @@ -1,6 +1,6 @@ Name: cpio Version: 2.13 -Release: 1 +Release: 2 Summary: A GNU archiving program License: GPLv3+ @@ -16,6 +16,7 @@ Patch5: cpio-2.10-longnames-split.patch Patch6: cpio-2.11-crc-fips-nit.patch Patch7: add-option-to-add-metadata-in-copy-out-mode.patch Patch8: Fix-use-after-free-and-return-appropriate-error.patch +Patch9: revert-CVE-2015-1197.patch Provides: bundled(gnulib) Provides: /bin/cpio @@ -32,6 +33,7 @@ tape, or a pipe. %autosetup -n %{name}-%{version} -p1 %build +autoreconf -fi %configure --with-rmt="%{_sysconfdir}/rmt" %make_build @@ -57,6 +59,12 @@ make check %{_datadir}/man/man1/%{name}.1.gz %changelog +* Thu Nov 26 2020 Liquor - 2.13-2 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:revert fix CVE-2015-1197 because it causes shutdowm problems + * Sun Aug 23 2020 chengquan - 2.13-1 - Update software to v2.13 diff --git a/revert-CVE-2015-1197.patch b/revert-CVE-2015-1197.patch new file mode 100644 index 0000000000000000000000000000000000000000..eacd27b46e168c26830fd156385536baca8e65ff --- /dev/null +++ b/revert-CVE-2015-1197.patch @@ -0,0 +1,109 @@ +From 250cae97153b438f5644e5d96814a7f5cb8c80e5 Mon Sep 17 00:00:00 2001 +From: Liquor +Date: Thu, 26 Nov 2020 19:13:13 +0800 +Subject: [PATCH] revert "CVE-2015-1197" + +reason:https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html +--- + src/copyin.c | 5 ++--- + tests/CVE-2015-1197.at | 43 ------------------------------------------ + tests/Makefile.am | 1 - + tests/testsuite.at | 1 - + 4 files changed, 2 insertions(+), 48 deletions(-) + delete mode 100644 tests/CVE-2015-1197.at + +diff --git a/src/copyin.c b/src/copyin.c +index de31636..bf3b0a8 100644 +--- a/src/copyin.c ++++ b/src/copyin.c +@@ -645,14 +645,13 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des) + link_name = xstrdup (file_hdr->c_tar_linkname); + } + +- cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false); +- + res = UMASKED_SYMLINK (link_name, file_hdr->c_name, + file_hdr->c_mode); + if (res < 0 && create_dir_flag) + { + create_all_directories (file_hdr->c_name); +- res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode); ++ res = UMASKED_SYMLINK (link_name, file_hdr->c_name, ++ file_hdr->c_mode); + } + if (res < 0) + { +diff --git a/tests/CVE-2015-1197.at b/tests/CVE-2015-1197.at +deleted file mode 100644 +index 6079af7..0000000 +--- a/tests/CVE-2015-1197.at ++++ /dev/null +@@ -1,43 +0,0 @@ +-# Process this file with autom4te to create testsuite. -*- Autotest -*- +-# Copyright (C) 2009-2019 Free Software Foundation, Inc. +-# +-# This program is free software; you can redistribute it and/or modify +-# it under the terms of the GNU General Public License as published by +-# the Free Software Foundation; either version 3, or (at your option) +-# any later version. +-# +-# This program is distributed in the hope that it will be useful, +-# but WITHOUT ANY WARRANTY; without even the implied warranty of +-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +-# GNU General Public License for more details. +-# +-# You should have received a copy of the GNU General Public License +-# along with this program. If not, see . +- +-AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)]) +-AT_CHECK([ +-tempdir=$(pwd)/tmp +-mkdir $tempdir +-touch $tempdir/file +-ln -s $tempdir dir +-AT_DATA([filelist], +-[dir +-dir/file +-]) +-ln -s /tmp dir +-touch /tmp/file +-cpio -o < filelist > test.cpio +-rm dir /tmp/file +-cpio --no-absolute-filenames -iv < test.cpio +-], +-[2], +-[], +-[1 block +-cpio: Removing leading `/' from hard link targets +-dir +-cpio: dir/file: Cannot open: No such file or directory +-dir/file +-1 block +-]) +-AT_CLEANUP +- +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 65bf470..a71c057 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -56,7 +56,6 @@ TESTSUITE_AT = \ + symlink-to-stdout.at\ + version.at\ + big-block-size.at\ +- CVE-2015-1197.at\ + CVE-2019-14866.at + + TESTSUITE = $(srcdir)/testsuite +diff --git a/tests/testsuite.at b/tests/testsuite.at +index aa56bb9..58ed1d2 100644 +--- a/tests/testsuite.at ++++ b/tests/testsuite.at +@@ -44,5 +44,4 @@ m4_include([setstat04.at]) + m4_include([setstat05.at]) + m4_include([big-block-size.at]) + +-m4_include([CVE-2015-1197.at]) + m4_include([CVE-2019-14866.at]) +-- +2.27.0 +