CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

libarchive: patch CVE-2025-60753

Browse Source 
Pick patch from [3] marked in [2] mentioned in [1].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-60753
[2] https://github.com/libarchive/libarchive/issues/2725
[3] https://github.com/libarchive/libarchive/pull/2787

(From OE-Core rev: 1fbd9eddbdf0da062df0510cabff6f6ee33d5752)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko 2025-11-22 23:16:54 +01:00 committed by Steve Sakoman
parent 842fd60ebb
commit e6bfeed8f3
2 changed files with 77 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
meta/recipes-extended/libarchive/libarchive/CVE-2025-60753.patch Normal file
View File

@ -0,0 +1,76 @@
From 3150539edb18690c2c5f81c37fd2d3a35c69ace5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?ARJANEN=20Lo=C3=AFc=20Jean=20David?= <ljd@luigiscorner.mu>
Date: Fri, 14 Nov 2025 20:34:48 +0100
Subject: [PATCH] Fix bsdtar zero-length pattern issue.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Uses the sed-like way (and Java-like, and .Net-like, and Javascript-like…) to fix this issue of advancing the string to be processed by one if the match is zero-length.
Fixes libarchive/libarchive#2725 and solves libarchive/libarchive#2438.
CVE: CVE-2025-60753
Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/3150539edb18690c2c5f81c37fd2d3a35c69ace5]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
tar/subst.c | 19 ++++++++++++-------
tar/test/test_option_s.c | 8 +++++++-
2 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/tar/subst.c b/tar/subst.c
index 9747abb9..902a4d64 100644
--- a/tar/subst.c
+++ b/tar/subst.c
@@ -235,7 +235,9 @@ apply_substitution(struct bsdtar *bsdtar, const char *name, char **result,
(*result)[0] = 0;
}
- while (1) {
+ char isEnd = 0;
+ do {
+ isEnd = *name == '\0';
if (regexec(&rule->re, name, 10, matches, 0))
break;
@@ -290,12 +292,15 @@ apply_substitution(struct bsdtar *bsdtar, const char *name, char **result,
}
realloc_strcat(result, rule->result + j);
-
- name += matches[0].rm_eo;
-
- if (!rule->global)
- break;
- }
+ if (matches[0].rm_eo > 0) {
+ name += matches[0].rm_eo;
+ } else {
+ // We skip a character because the match is 0-length
+ // so we need to add it to the output
+ realloc_strncat(result, name, 1);
+ name += 1;
+ }
+ } while (rule->global && !isEnd); // Testing one step after because sed et al. run 0-length patterns a last time on the empty string at the end
}
if (got_match)
diff --git a/tar/test/test_option_s.c b/tar/test/test_option_s.c
index 564793b9..90b4c471 100644
--- a/tar/test/test_option_s.c
+++ b/tar/test/test_option_s.c
@@ -42,7 +42,13 @@ DEFINE_TEST(test_option_s)
systemf("%s -cf test1_2.tar -s /d1/d2/ in/d1/foo", testprog);
systemf("%s -xf test1_2.tar -C test1", testprog);
assertFileContents("foo", 3, "test1/in/d2/foo");
-
+ systemf("%s -cf test1_3.tar -s /o/#/g in/d1/foo", testprog);
+ systemf("%s -xf test1_3.tar -C test1", testprog);
+ assertFileContents("foo", 3, "test1/in/d1/f##");
+ // For the 0-length pattern check, remember that "test1/" isn't part of the string affected by the regexp
+ systemf("%s -cf test1_4.tar -s /f*/\\<~\\>/g in/d1/foo", testprog);
+ systemf("%s -xf test1_4.tar -C test1", testprog);
+ assertFileContents("foo", 3, "test1/<>i<>n<>/<>d<>1<>/<f><>o<>o<>");
/*
* Test 2: Basic substitution when extracting archive.
*/

1
meta/recipes-extended/libarchive/libarchive_3.7.9.bb
View File

@ -42,6 +42,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
file://0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch \
file://0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch \
file://0001-Merge-pull-request-2768-from-Commandoss-master.patch \
file://CVE-2025-60753.patch \
"
UPSTREAM_CHECK_URI = "http://libarchive.org/"