diff --git a/main/tar/APKBUILD b/main/tar/APKBUILD index c50c11fead9f393610354de16e5319697c120576..904bd4fb4dfabb19b9fbd1b02d23cb571df10cd6 100644 --- a/main/tar/APKBUILD +++ b/main/tar/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Carlo Landmeter <clandmeter@alpinelinux.org> pkgname=tar pkgver=1.34 -pkgrel=1 +pkgrel=2 pkgdesc="Utility used to store, backup, and transport files" url="https://www.gnu.org/software/tar/" arch="all" @@ -9,9 +9,13 @@ license="GPL-3.0-or-later" makedepends="acl-dev" subpackages="$pkgname-doc" source="https://ftp.gnu.org/gnu/tar/tar-$pkgver.tar.xz - ignore-apk-tools-checksums.patch" + ignore-apk-tools-checksums.patch + CVE-2022-48303.patch + " # secfixes: +# 1.34-r2: +# - CVE-2022-48303 # 1.34-r0: # - CVE-2021-20193 # 1.29-r1: @@ -51,5 +55,8 @@ package() { ln -s /bin/tar "$pkgdir"/usr/bin/tar } -sha512sums="5e77c4a7b49983ad7d15238c2bce28be7a8aa437b4b1815fc00abd13096da308b6bba196cc6e3ed79d85e62823d520ae0d8fcda2d93873842cf84dc3369fc902 tar-1.34.tar.xz -9cde0f1509328bc5fe2cb46642b53c7681c548cf28a2fb83eda7e9374c9c0ad27a0cd55b9c0cc93951def58dafa55ee71cace5493ddcb7966ee94dc5f1099739 ignore-apk-tools-checksums.patch" +sha512sums=" +5e77c4a7b49983ad7d15238c2bce28be7a8aa437b4b1815fc00abd13096da308b6bba196cc6e3ed79d85e62823d520ae0d8fcda2d93873842cf84dc3369fc902 tar-1.34.tar.xz +9cde0f1509328bc5fe2cb46642b53c7681c548cf28a2fb83eda7e9374c9c0ad27a0cd55b9c0cc93951def58dafa55ee71cace5493ddcb7966ee94dc5f1099739 ignore-apk-tools-checksums.patch +b35768ace1dc2f95ab75063c32a0207013c360ad5e8e6875c17184255602288a126579b65d71cc9a655b0687fe81264c3f427004c27ba0ba3a872a8893953fc3 CVE-2022-48303.patch +" diff --git a/main/tar/CVE-2022-48303.patch b/main/tar/CVE-2022-48303.patch new file mode 100644 index 0000000000000000000000000000000000000000..95a7d6e6dc214cb4f51555a83b8f6357dc00978d --- /dev/null +++ b/main/tar/CVE-2022-48303.patch @@ -0,0 +1,33 @@ +Patch-Source: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8 +see: https://savannah.gnu.org/bugs/?62387 +-- +From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001 +From: Sergey Poznyakoff <gray@gnu.org> +Date: Sat, 11 Feb 2023 11:57:39 +0200 +Subject: Fix boundary checking in base-256 decoder + +* src/list.c (from_header): Base-256 encoding is at least 2 bytes +long. +--- + src/list.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/list.c b/src/list.c +index 9fafc42..86bcfdd 100644 +--- a/src/list.c ++++ b/src/list.c +@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type, + where++; + } + } +- else if (*where == '\200' /* positive base-256 */ +- || *where == '\377' /* negative base-256 */) ++ else if (where <= lim - 2 ++ && (*where == '\200' /* positive base-256 */ ++ || *where == '\377' /* negative base-256 */)) + { + /* Parse base-256 output. A nonnegative number N is + represented as (256**DIGS)/2 + N; a negative number -N is +-- +cgit v1.1 +