diff --git a/debian/changelog b/debian/changelog index 7826fbab2b0b2e4819e41b831bd30ba7698fdd60..c1344daa7817510aa1bc5cdbe58e90615f0f21c9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,5 +1,13 @@ +squashfs-tools (1:4.4-ok2) yangtze; urgency=medium + + Amedass CVE-2021-40153 安全更新 + + -- haoyu Mon, 13 Mar 2023 15:31:20 +0800 + squashfs-tools (1:4.4-ok1) yangtze; urgency=medium * Build for openKylin. -- openKylinBot Mon, 25 Apr 2022 22:03:04 +0800 + + diff --git a/squashfs-tools/Makefile b/squashfs-tools/Makefile index 46c0772b4769758b4f7ed08a392d037bda48da4a..de06bb2fba1031cb812f5fe459a8df0fdc00da75 100644 --- a/squashfs-tools/Makefile +++ b/squashfs-tools/Makefile @@ -156,7 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o action.o swap.o pseudo.o compressor.o \ caches-queues-lists.o UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \ - unsquash-4.o unsquash-123.o unsquash-34.o swap.o compressor.o unsquashfs_info.o + unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \ + compressor.o unsquashfs_info.o CFLAGS ?= -O2 CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \ @@ -350,6 +351,8 @@ unsquash-123.o: unsquashfs.h unsquash-123.c squashfs_fs.h squashfs_compat.h unsquash-34.o: unsquashfs.h unsquash-34.c +unsquash-1234.o: unsquash-1234.c + unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h unsquashfs_info.o: unsquashfs.h squashfs_fs.h diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c index 34eced36a31876b35cbf93d73d66503d87647cbe..28326cb1aa8cdc421aab1c1ac4188a168556ff0c 100644 --- a/squashfs-tools/unsquash-1.c +++ b/squashfs-tools/unsquash-1.c @@ -2,7 +2,7 @@ * Unsquash a squashfs filesystem. This is a highly compressed read only * filesystem. * - * Copyright (c) 2009, 2010, 2011, 2012, 2019 + * Copyright (c) 2009, 2010, 2011, 2012, 2019, 2021 * Phillip Lougher * * This program is free software; you can redistribute it and/or @@ -285,6 +285,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse memcpy(dire->name, directory_table + bytes, dire->size + 1); dire->name[dire->size + 1] = '\0'; + + /* check name for invalid characters (i.e /, ., ..) */ + if(check_name(dire->name, dire->size + 1) == FALSE) { + ERROR("File system corrupted: invalid characters in name\n"); + goto corrupted; + } + TRACE("squashfs_opendir: directory entry %s, inode " "%d:%d, type %d\n", dire->name, dirh.start_block, dire->offset, dire->type); diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c new file mode 100644 index 0000000000000000000000000000000000000000..c2d4f42b133b928bf2daf2957b80f8965496e28b --- /dev/null +++ b/squashfs-tools/unsquash-1234.c @@ -0,0 +1,58 @@ +/* + * Unsquash a squashfs filesystem. This is a highly compressed read only + * filesystem. + * + * Copyright (c) 2021 + * Phillip Lougher + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2, + * or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * unsquash-1234.c + * + * Helper functions used by unsquash-1, unsquash-2, unsquash-3 and + * unsquash-4. + */ + +#define TRUE 1 +#define FALSE 0 +/* + * Check name for validity, name should not + * - be ".", "./", or + * - be "..", "../" or + * - have a "/" anywhere in the name, or + * - be shorter than the expected size + */ +int check_name(char *name, int size) +{ + char *start = name; + + if(name[0] == '.') { + if(name[1] == '.') + name++; + if(name[1] == '/' || name[1] == '\0') + return FALSE; + } + + while(name[0] != '/' && name[0] != '\0') + name ++; + + if(name[0] == '/') + return FALSE; + + if((name - start) != size) + return FALSE; + + return TRUE; +} diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c index 4b3d767ed1139d11697ac9cfb0f48a8ccb86259d..474064e17c3fea5c63a3d38a3925fbbbe5290331 100644 --- a/squashfs-tools/unsquash-2.c +++ b/squashfs-tools/unsquash-2.c @@ -2,7 +2,7 @@ * Unsquash a squashfs filesystem. This is a highly compressed read only * filesystem. * - * Copyright (c) 2009, 2010, 2013, 2019 + * Copyright (c) 2009, 2010, 2013, 2019, 2021 * Phillip Lougher * * This program is free software; you can redistribute it and/or @@ -386,6 +386,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse memcpy(dire->name, directory_table + bytes, dire->size + 1); dire->name[dire->size + 1] = '\0'; + + /* check name for invalid characters (i.e /, ., ..) */ + if(check_name(dire->name, dire->size + 1) == FALSE) { + ERROR("File system corrupted: invalid characters in name\n"); + goto corrupted; + } + TRACE("squashfs_opendir: directory entry %s, inode " "%d:%d, type %d\n", dire->name, dirh.start_block, dire->offset, dire->type); diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c index 02c31fc56baf92f3953f4f209b572f7ba15712fe..65cfe4d9ac4eb6eb558c8b1ed327e7c6e83408ef 100644 --- a/squashfs-tools/unsquash-3.c +++ b/squashfs-tools/unsquash-3.c @@ -2,7 +2,7 @@ * Unsquash a squashfs filesystem. This is a highly compressed read only * filesystem. * - * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019 + * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021 * Phillip Lougher * * This program is free software; you can redistribute it and/or @@ -413,6 +413,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse memcpy(dire->name, directory_table + bytes, dire->size + 1); dire->name[dire->size + 1] = '\0'; + + /* check name for invalid characters (i.e /, ., ..) */ + if(check_name(dire->name, dire->size + 1) == FALSE) { + ERROR("File system corrupted: invalid characters in name\n"); + goto corrupted; + } + TRACE("squashfs_opendir: directory entry %s, inode " "%d:%d, type %d\n", dire->name, dirh.start_block, dire->offset, dire->type); diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c index 8475835cde8c24e9f12a2c13dbe827bef75f82a4..aa23a841585626a4c56d71529cfa6a9a3c270d3b 100644 --- a/squashfs-tools/unsquash-4.c +++ b/squashfs-tools/unsquash-4.c @@ -2,7 +2,7 @@ * Unsquash a squashfs filesystem. This is a highly compressed read only * filesystem. * - * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019 + * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021 * Phillip Lougher * * This program is free software; you can redistribute it and/or @@ -349,6 +349,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse memcpy(dire->name, directory_table + bytes, dire->size + 1); dire->name[dire->size + 1] = '\0'; + + /* check name for invalid characters (i.e /, ., ..) */ + if(check_name(dire->name, dire->size + 1) == FALSE) { + ERROR("File system corrupted: invalid characters in name\n"); + goto corrupted; + } + TRACE("squashfs_opendir: directory entry %s, inode " "%d:%d, type %d\n", dire->name, dirh.start_block, dire->offset, dire->type); diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h index 934618b264e495dbc686abd3e2bea049bfa44a5e..db1da7a0c777c25b6fe8dd33972590878d6dd339 100644 --- a/squashfs-tools/unsquashfs.h +++ b/squashfs-tools/unsquashfs.h @@ -4,7 +4,7 @@ * Unsquash a squashfs filesystem. This is a highly compressed read only * filesystem. * - * Copyright (c) 2009, 2010, 2013, 2014, 2019 + * Copyright (c) 2009, 2010, 2013, 2014, 2019, 2021 * Phillip Lougher * * This program is free software; you can redistribute it and/or @@ -261,4 +261,7 @@ extern int read_ids(int, long long, long long, unsigned int **); /* unsquash-34.c */ extern long long *alloc_index_table(int); + +/* unsquash-1234.c */ +extern int check_name(char *, int); #endif