KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

bzip2: Fix CVE-2016-3189

Browse source 
Issue causes a crash with specially crafted bzip2 files.

More info: https://nvd.nist.gov/vuln/detail/CVE-2016-3189

Taken from Fedora.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
This commit is contained in:
Rosen Penev 2018-08-22 19:07:56 -07:00 committed by Jo-Philipp Wich
parent 6b4ba118ac
commit f9469efbfa
2 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package/utils/bzip2/Makefile
View file

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=bzip2
PKG_VERSION:=1.0.6
PKG_RELEASE:=3
PKG_RELEASE:=4
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://www.bzip.org/$(PKG_VERSION)

11
package/utils/bzip2/patches/010-CVE-2016-3189.patch Normal file
View file

@ -0,0 +1,11 @@
diff -up ./bzip2recover.c.old ./bzip2recover.c
--- ./bzip2recover.c.old 2016-03-22 08:49:38.855620000 +0100
+++ ./bzip2recover.c 2016-03-30 10:22:27.341430099 +0200
@@ -457,6 +457,7 @@ Int32 main ( Int32 argc, Char** argv )
bsPutUChar ( bsWr, 0x50 ); bsPutUChar ( bsWr, 0x90 );
bsPutUInt32 ( bsWr, blockCRC );
bsClose ( bsWr );
+ outFile = NULL;
}
if (wrBlock >= rbCtr) break;
wrBlock++;