<div dir="ltr">This doesn't apply to master, can you rebase.<div><br></div><div>Ross</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 27 September 2017 at 05:25, Zhixiong Chi <span dir="ltr"><<a href="mailto:zhixiong.chi@windriver.com" target="_blank">zhixiong.chi@windriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">read_header in archive_read_support_format_<wbr>rar.c suffers from an<br>
off-by-one error for UTF-16 names in RAR archives, leading to an<br>
out-of-bounds read in archive_read_format_rar_read_<wbr>header.<br>
Backport the patch from<br>
<a href="https://github.com/libarchive/libarchive/commit" rel="noreferrer" target="_blank">https://github.com/libarchive/<wbr>libarchive/commit</a><br>
commit 5562545b5562f6d12a4ef991fae158<wbr>bf4ccf92b6<br>
<br>
CVE: CVE-2017-14502<br>
<br>
Signed-off-by: Zhixiong Chi <<a href="mailto:zhixiong.chi@windriver.com">zhixiong.chi@windriver.com</a>><br>
---<br>
.../libarchive/libarchive/CVE-<wbr>2017-14502.patch | 35 ++++++++++++++++++++++<br>
.../libarchive/<a href="http://libarchive_3.3.2.bb" rel="noreferrer" target="_blank">libarchive_3.3.<wbr>2.bb</a> | 1 +<br>
2 files changed, 36 insertions(+)<br>
create mode 100644 meta/recipes-extended/<wbr>libarchive/libarchive/CVE-<wbr>2017-14502.patch<br>
<br>
diff --git a/meta/recipes-extended/<wbr>libarchive/libarchive/CVE-<wbr>2017-14502.patch b/meta/recipes-extended/<wbr>libarchive/libarchive/CVE-<wbr>2017-14502.patch<br>
new file mode 100644<br>
index 0000000..442c671<br>
--- /dev/null<br>
+++ b/meta/recipes-extended/<wbr>libarchive/libarchive/CVE-<wbr>2017-14502.patch<br>
@@ -0,0 +1,35 @@<br>
+From 5562545b5562f6d12a4ef991fae158<wbr>bf4ccf92b6 Mon Sep 17 00:00:00 2001<br>
+From: Joerg Sonnenberger <<a href="mailto:joerg@bec.de">joerg@bec.de</a>><br>
+Date: Sat, 9 Sep 2017 17:47:32 +0200<br>
+Subject: [PATCH] Avoid a read off-by-one error for UTF16 names in RAR<br>
+ archives.<br>
+<br>
+Reported-By: OSS-Fuzz issue 573<br>
+<br>
+CVE: CVE-2017-14502<br>
+<br>
+Upstream-Status: Backport<br>
+---<br>
+ libarchive/archive_read_<wbr>support_format_rar.c | 6 +++++-<br>
+ 1 file changed, 5 insertions(+), 1 deletion(-)<br>
+<br>
+diff --git a/libarchive/archive_read_<wbr>support_format_rar.c b/libarchive/archive_read_<wbr>support_format_rar.c<br>
+index cbb14c3..751de69 100644<br>
+--- a/libarchive/archive_read_<wbr>support_format_rar.c<br>
++++ b/libarchive/archive_read_<wbr>support_format_rar.c<br>
+@@ -1496,7 +1496,11 @@ read_header(struct archive_read *a, struct archive_entry *entry,<br>
+ return (ARCHIVE_FATAL);<br>
+ }<br>
+ filename[filename_size++] = '\0';<br>
+- filename[filename_size++] = '\0';<br>
++ /*<br>
++ * Do not increment filename_size here as the computations below<br>
++ * add the space for the terminating NUL explicitly.<br>
++ */<br>
++ filename[filename_size] = '\0';<br>
+<br>
+ /* Decoded unicode form is UTF-16BE, so we have to update a string<br>
+ * conversion object for it. */<br>
+--<br>
+1.9.1<br>
+<br>
diff --git a/meta/recipes-extended/<wbr>libarchive/<a href="http://libarchive_3.3.2.bb" rel="noreferrer" target="_blank">libarchive_3.3.2.bb</a> b/meta/recipes-extended/<wbr>libarchive/<a href="http://libarchive_3.3.2.bb" rel="noreferrer" target="_blank">libarchive_3.3.2.bb</a><br>
index 5c3895e..0196eb3 100644<br>
--- a/meta/recipes-extended/<wbr>libarchive/<a href="http://libarchive_3.3.2.bb" rel="noreferrer" target="_blank">libarchive_3.3.2.bb</a><br>
+++ b/meta/recipes-extended/<wbr>libarchive/<a href="http://libarchive_3.3.2.bb" rel="noreferrer" target="_blank">libarchive_3.3.2.bb</a><br>
@@ -32,6 +32,7 @@ PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4,<wbr>"<br>
EXTRA_OECONF += "--enable-largefile"<br>
<br>
SRC_URI = "<a href="http://libarchive.org/downloads/libarchive-${PV}.tar.gz" rel="noreferrer" target="_blank">http://libarchive.org/<wbr>downloads/libarchive-${PV}.<wbr>tar.gz</a> \<br>
+ file://CVE-2017-14502.patch \<br>
"<br>
<br>
SRC_URI[md5sum] = "<wbr>4583bd6b2ebf7e0e8963d90879eb1b<wbr>27"<br>
<span class="HOEnZb"><font color="#888888">--<br>
1.9.1<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote></div><br></div>