FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=stable%2F11 2023-09-11T07:05:29Z 2023-09-11T07:05:29Z Martin Matuska mm@FreeBSD.org 2023-09-07T15:18:12Z urn:sha1:5ed7eb0d97ba4436218e810f61bd059acba984c2 This commit fixes a couple of security vulnerabilities in the PAX writer: 1. Heap overflow in url_encode() in archive_write_set_format_pax.c 2. NULL dereference in archive_write_pax_header_xattrs() 3. Another NULL dereference in archive_write_pax_header_xattrs() 4. NULL dereference in archive_write_pax_header_xattr() Security: No known reference yet Obtained from: https://github.com/libarchive/libarchive/commit/1b4e0d0f9 MFC after: 3 days (cherry picked from commit f10f65999fe56e92f00b5bc5d27ac342cfea5364) 2023-01-24T22:27:50Z Mark Adler fork@madler.net 2022-07-30T22:51:11Z urn:sha1:e59d10aff6edc088850be553252020230a560514 If the extra field was larger than the space the user provided with inflateGetHeader(), and if multiple calls of inflate() delivered the extra header data, then there could be a buffer overflow of the provided space. This commit assures that provided space is not exceeded. (cherry picked from zlib commit eff308af425b67093bab25f80f1ae950166bece1) (cherry picked from zlib commit 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d) (cherry picked from commit dc3509f1aafcd966f3dd9226115cf94b691ff3c7) (cherry picked from commit 2969066f73fc67a614144ac09b9f3f5291937fed) (cherry picked from commit 10cc2bf5f7a592981ee00d22eb13e100beed1e64) 2022-12-28T22:16:47Z Martin Matuska mm@FreeBSD.org 2022-12-13T19:21:13Z urn:sha1:9597624d82c7ebd845c11bf4c7e27d6bbf42dd96 Libarchive 3.6.2 Important bug fixes: rar5 reader: fix possible garbled output with bsdtar -O (#1745) mtree reader: support reading mtree files with tabs (#1783) various small fixes for issues found by CodeQL (cherry picked from commit bd5e624a861433dee76fe00a8acedc9564425332) 2022-12-28T22:16:37Z Dag-Erling Smørgrav des@FreeBSD.org 2022-11-17T16:11:41Z urn:sha1:bc6e05e52d17b7697fd43eaa2019e8259b411410 Differential Revision: https://reviews.freebsd.org/D37398 (cherry picked from commit f1ad5e3931996d222e87140c5621323b6986e1ff) 2022-12-28T22:16:10Z Martin Matuska mm@FreeBSD.org 2022-04-12T18:12:34Z urn:sha1:2bfc51f5435447ab4a49788b336d5f0f6d924d83 Libarchive 3.6.1 Bug fixes: PR #1549: archive_digest: check return value of EVP_DigestInit() (cherry picked from commit 7ec51a3e2b91caaea5c1de1a4c7b362b20d35a62) 2022-12-28T22:15:58Z Martin Matuska mm@FreeBSD.org 2022-04-03T12:21:28Z urn:sha1:c237fe8275a3532c6f9e686a9f8cf9aaeb8b168e Bugfixes: IS #1685 and OSS-Fuzz #38764 (security): (ISO reader) fix possible heap buffer overflow in read_children() IS #1715 and OSS-Fuzz #46279 (security): (RARv4 reader) fix heap-use-after-free in run_filters() (cherry picked from commit 9f690fcfdc050f566466ac10cca29ff43bf4fe92) 2022-12-28T22:15:40Z Martin Matuska mm@FreeBSD.org 2022-03-26T10:04:36Z urn:sha1:d9a2aa38186be58c2a296aface3ac51dba688a86 Bugfixes: IS #1672 and OSS-Fuzz #38766: (zip reader) fix possible out-of-bounds read in zipx_lzma_alone_init() PR #1676: (mtree reader) remove the unused variable "detected_bytes" PR #1674: (doc) fix use of At mdoc(7) macro in cpio.5 (cherry picked from commit 0c9c2eb394b4a5694bc5ea11b326f334c735c813) 2022-11-21T20:51:18Z Hans Petter Selasky hselasky@FreeBSD.org 2022-11-14T14:20:09Z urn:sha1:906f88a5d67cab3e3a81b8d584f5abdaa15b2360 Else out-of-bound reads and undefined behaviour may happen. The current code only checked for the presence of the first of four bytes. Make sure the fields in question have the minium size required. No functional change intended. Reviewed by: rrs@ Sponsored by: NVIDIA Networking (cherry picked from commit 3492caf512ae090816b4ffa275be43b2f5cfc460) 2022-06-06T20:09:38Z Hans Petter Selasky hselasky@FreeBSD.org 2022-06-02T18:33:21Z urn:sha1:bc92b6240ddf6ab11813abe439653308da14ee54 When the TCP sequence number subtracted is greater than 2**32 minus the window size, or 2**31 minus the window size, the use of unsigned long as an intermediate variable, may result in an incorrect retransmit length computation on all 64-bit platforms. While at it create a helper macro to facilitate the computation of the difference between two TCP sequence numbers. Differential Revision: https://reviews.freebsd.org/D35388 Reviewed by: rscheff Sponsored by: NVIDIA Networking (cherry picked from commit 28173d49dccb91e50be9c401dbad1da908a5dc75) 2022-06-06T19:10:43Z Stefan Eßer se@FreeBSD.org 2022-02-20T14:24:43Z urn:sha1:9feba5ab9023bac268f5f26fae1bc6d8ffbd49eb Use strtoll() to parse the argument of the -S option. FreeBSD has supported 64 bit file offsets for more than 25 years on all architectures and off_t is a 64 bit integer type for that reason. While strtol() returns a 64 bit value on 64 LP64 architectures, it is limit to 32 bit on e.g. i386. The strtoll() function returns a 64 but result on all supported architectures and therefore supports the possible file lengths and file offsets on 32 bit archtectures. Reported by: antoine (cherry picked from commit 32066c96fa00fc19c8355e1956ca5aa9ead37673)