| Andrew Geissler | 595f630 | 2022-01-24 19:11:47 +0000 | [diff] [blame] | 1 | The commit is required by the fix for CVE-2021-41072. |
| 2 | |
| 3 | Upstream-Status: Backport [https://github.com/plougher/squashfs-tools/commit/1993a4e] |
| 4 | |
| 5 | Signed-off-by: Kai Kang <kai.kang@windriver.com> |
| 6 | |
| 7 | From 1993a4e7aeda04962bf26e84c15fba8b58837e10 Mon Sep 17 00:00:00 2001 |
| 8 | From: Phillip Lougher <phillip@squashfs.org.uk> |
| 9 | Date: Sun, 12 Sep 2021 20:09:13 +0100 |
| 10 | Subject: [PATCH] unsquashfs: dynamically allocate name |
| 11 | |
| 12 | Dynamically allocate name rather than store it |
| 13 | directly in structure. |
| 14 | |
| 15 | Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> |
| 16 | --- |
| 17 | squashfs-tools/unsquash-1.c | 2 +- |
| 18 | squashfs-tools/unsquash-1234.c | 5 +++++ |
| 19 | squashfs-tools/unsquash-2.c | 2 +- |
| 20 | squashfs-tools/unsquash-3.c | 2 +- |
| 21 | squashfs-tools/unsquash-4.c | 2 +- |
| 22 | squashfs-tools/unsquashfs.h | 2 +- |
| 23 | 6 files changed, 10 insertions(+), 5 deletions(-) |
| 24 | |
| 25 | diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c |
| 26 | index 7598499..d0121c6 100644 |
| 27 | --- a/squashfs-tools/unsquash-1.c |
| 28 | +++ b/squashfs-tools/unsquash-1.c |
| 29 | @@ -360,7 +360,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse |
| 30 | dir->dirs = new_dir; |
| 31 | } |
| 32 | |
| 33 | - strcpy(dir->dirs[dir->dir_count].name, dire->name); |
| 34 | + dir->dirs[dir->dir_count].name = strdup(dire->name); |
| 35 | dir->dirs[dir->dir_count].start_block = |
| 36 | dirh.start_block; |
| 37 | dir->dirs[dir->dir_count].offset = dire->offset; |
| 38 | diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c |
| 39 | index 0c8dfbb..ac46d9d 100644 |
| 40 | --- a/squashfs-tools/unsquash-1234.c |
| 41 | +++ b/squashfs-tools/unsquash-1234.c |
| 42 | @@ -60,6 +60,11 @@ int check_name(char *name, int size) |
| 43 | |
| 44 | void squashfs_closedir(struct dir *dir) |
| 45 | { |
| 46 | + int i; |
| 47 | + |
| 48 | + for(i = 0; i < dir->dir_count; i++) |
| 49 | + free(dir->dirs[i].name); |
| 50 | + |
| 51 | free(dir->dirs); |
| 52 | free(dir); |
| 53 | } |
| 54 | diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c |
| 55 | index 86f62ba..e847980 100644 |
| 56 | --- a/squashfs-tools/unsquash-2.c |
| 57 | +++ b/squashfs-tools/unsquash-2.c |
| 58 | @@ -452,7 +452,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse |
| 59 | dir->dirs = new_dir; |
| 60 | } |
| 61 | |
| 62 | - strcpy(dir->dirs[dir->dir_count].name, dire->name); |
| 63 | + dir->dirs[dir->dir_count].name = strdup(dire->name); |
| 64 | dir->dirs[dir->dir_count].start_block = |
| 65 | dirh.start_block; |
| 66 | dir->dirs[dir->dir_count].offset = dire->offset; |
| 67 | diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c |
| 68 | index c04aa9e..8223f27 100644 |
| 69 | --- a/squashfs-tools/unsquash-3.c |
| 70 | +++ b/squashfs-tools/unsquash-3.c |
| 71 | @@ -486,7 +486,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse |
| 72 | dir->dirs = new_dir; |
| 73 | } |
| 74 | |
| 75 | - strcpy(dir->dirs[dir->dir_count].name, dire->name); |
| 76 | + dir->dirs[dir->dir_count].name = strdup(dire->name); |
| 77 | dir->dirs[dir->dir_count].start_block = |
| 78 | dirh.start_block; |
| 79 | dir->dirs[dir->dir_count].offset = dire->offset; |
| 80 | diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c |
| 81 | index ff62dcc..1e199a7 100644 |
| 82 | --- a/squashfs-tools/unsquash-4.c |
| 83 | +++ b/squashfs-tools/unsquash-4.c |
| 84 | @@ -423,7 +423,7 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse |
| 85 | dir->dirs = new_dir; |
| 86 | } |
| 87 | |
| 88 | - strcpy(dir->dirs[dir->dir_count].name, dire->name); |
| 89 | + dir->dirs[dir->dir_count].name = strdup(dire->name); |
| 90 | dir->dirs[dir->dir_count].start_block = |
| 91 | dirh.start_block; |
| 92 | dir->dirs[dir->dir_count].offset = dire->offset; |
| 93 | diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h |
| 94 | index 5ecb2ab..583fbe4 100644 |
| 95 | --- a/squashfs-tools/unsquashfs.h |
| 96 | +++ b/squashfs-tools/unsquashfs.h |
| 97 | @@ -164,7 +164,7 @@ struct queue { |
| 98 | #define DIR_ENT_SIZE 16 |
| 99 | |
| 100 | struct dir_ent { |
| 101 | - char name[SQUASHFS_NAME_LEN + 1]; |
| 102 | + char *name; |
| 103 | unsigned int start_block; |
| 104 | unsigned int offset; |
| 105 | unsigned int type; |
| 106 | -- |
| 107 | 2.17.1 |
| 108 | |