diff options
author | Leonardo Arena <rnalrd@alpinelinux.org> | 2019-08-20 14:32:22 +0000 |
---|---|---|
committer | Leonardo Arena <rnalrd@alpinelinux.org> | 2019-08-20 14:41:25 +0000 |
commit | e284f33911a902aeeb7e7220cde91133bcf46d43 (patch) | |
tree | b270ddcdfe6ec3bc024fdb2859313819eb1ab09a /main | |
parent | 9efccd10b731a53429a96bea0144057e3753ddef (diff) | |
download | aports-e284f33911a902aeeb7e7220cde91133bcf46d43.tar.bz2 aports-e284f33911a902aeeb7e7220cde91133bcf46d43.tar.xz |
main/libarchive: security upgrade to 3.3.3
Diffstat (limited to 'main')
-rw-r--r-- | main/libarchive/APKBUILD | 14 | ||||
-rw-r--r-- | main/libarchive/CVE-2017-14166.patch | 36 |
2 files changed, 8 insertions, 42 deletions
diff --git a/main/libarchive/APKBUILD b/main/libarchive/APKBUILD index a3ed3e8338..d098ec568a 100644 --- a/main/libarchive/APKBUILD +++ b/main/libarchive/APKBUILD @@ -1,19 +1,22 @@ # Contributor: Sergei Lukin <sergej.lukin@gmail.com> # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=libarchive -pkgver=3.3.2 -pkgrel=2 +pkgver=3.3.3 +pkgrel=0 pkgdesc="library that can create and read several streaming archive formats" url="http://libarchive.org/" arch="all" license="BSD" makedepends="zlib-dev bzip2-dev xz-dev lz4-dev acl-dev libressl-dev expat-dev" subpackages="$pkgname-dev $pkgname-doc $pkgname-tools" -source="http://www.libarchive.org/downloads/$pkgname-$pkgver.tar.gz - CVE-2017-14166.patch" +source="http://www.libarchive.org/downloads/$pkgname-$pkgver.tar.gz" builddir="$srcdir/$pkgname-$pkgver" # secfixes: +# 3.3.3-r0: +# - CVE-2017-14501 +# - CVE-2017-14502 +# - CVE-2017-14503 # 3.3.2-r1: # - CVE-2017-14166 @@ -39,5 +42,4 @@ tools() { mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ } -sha512sums="1e538cd7d492f54b11c16c56f12c1632ba14302a3737ec0db786272aec0c8020f1e27616a7654d57e26737e5ed9bfc9a62f1fdda61a95c39eb726aa7c2f673e4 libarchive-3.3.2.tar.gz -7cc9dbafd970c07fb4421b7a72a075cc0a000db77df4432222539c58625c93c45f01a144838b551980bc0c6dc5b4c3ab852eb1433006c3174581ba0897010dbe CVE-2017-14166.patch" +sha512sums="9d12b47d6976efa9f98e62c25d8b85fd745d4e9ca7b7e6d36bfe095dfe5c4db017d4e785d110f3758f5938dad6f1a1b009267fd7e82cb7212e93e1aea237bab7 libarchive-3.3.3.tar.gz" diff --git a/main/libarchive/CVE-2017-14166.patch b/main/libarchive/CVE-2017-14166.patch deleted file mode 100644 index b729ae41e0..0000000000 --- a/main/libarchive/CVE-2017-14166.patch +++ /dev/null @@ -1,36 +0,0 @@ -From fa7438a0ff4033e4741c807394a9af6207940d71 Mon Sep 17 00:00:00 2001 -From: Joerg Sonnenberger <joerg@bec.de> -Date: Tue, 5 Sep 2017 18:12:19 +0200 -Subject: [PATCH] Do something sensible for empty strings to make fuzzers - happy. - ---- - libarchive/archive_read_support_format_xar.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/libarchive/archive_read_support_format_xar.c b/libarchive/archive_read_support_format_xar.c -index 7a22beb9d..93eeacc5e 100644 ---- a/libarchive/archive_read_support_format_xar.c -+++ b/libarchive/archive_read_support_format_xar.c -@@ -1040,6 +1040,9 @@ atol10(const char *p, size_t char_cnt) - uint64_t l; - int digit; - -+ if (char_cnt == 0) -+ return (0); -+ - l = 0; - digit = *p - '0'; - while (digit >= 0 && digit < 10 && char_cnt-- > 0) { -@@ -1054,7 +1057,10 @@ atol8(const char *p, size_t char_cnt) - { - int64_t l; - int digit; -- -+ -+ if (char_cnt == 0) -+ return (0); -+ - l = 0; - while (char_cnt-- > 0) { - if (*p >= '0' && *p <= '7') |