From patchwork Sat Nov 22 22:16:52 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 75243 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34DF9CFD30D for ; Sat, 22 Nov 2025 22:17:14 +0000 (UTC) Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2755.1763849826765635340 for ; Sat, 22 Nov 2025 14:17:08 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=cXt2qxYd; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.228, mailfrom: fm-256628-202511222217034988fbffec0002077c-43b3hn@rts-flowmailer.siemens.com) Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 202511222217034988fbffec0002077c for ; Sat, 22 Nov 2025 23:17:03 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=yL9Ur5XHR5me4e5o0+J2po0/31+VuNpiju2Kmm+hw1k=; b=cXt2qxYdLnT/0WfdLhybaeLHnzdpsJZ4t/gAgfHGu3xoBi9SRuJJyHLSSvdCfkytmrunb+ vi+XCeskDuKdadOGNX3BElDcBOkYn5rQHM2g6bmhTQ/xNujllIKQnFEn6N+PJlViSy8ozXdj gSI6F/WiLouaSnPKDLqr8vPbIMJXoV+nENAscsLGwqwxJ+hbQTE1JMO0xrXXco6TAvW6hX/T G4O+LSTMuKxtP3oJhyuUAQMx6wQRICHnc6e6z1iLf+/3Evvi1rdVJlDUQxsBrdFNG9jT43aU wzus1C7dWgWDLkpnXBhaVJqD6aknoyFcfCZIgFvOIlJKsNqd8sRsGDrA==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [OE-core][scarthgap][PATCH 1/3] libarchive: patch 3.8.3 security issue 1 Date: Sat, 22 Nov 2025 23:16:52 +0100 Message-Id: <20251122221654.3047008-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 22 Nov 2025 22:17:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/226720 From: Peter Marko Pick patch [2] as listed in [1]. To apply it cleanly, add two additional patches from branch patch/3.8. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2753 Signed-off-by: Peter Marko --- ...request-2696-from-al3xtjames-mkstemp.patch | 28 +++ ...st-2749-from-KlaraSystems-des-tempdi.patch | 186 +++++++++++++++++ ...st-2753-from-KlaraSystems-des-temp-f.patch | 190 ++++++++++++++++++ .../libarchive/libarchive_3.7.9.bb | 3 + 4 files changed, 407 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2696-from-al3xtjames-mkstemp.patch create mode 100644 meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch create mode 100644 meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch diff --git a/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2696-from-al3xtjames-mkstemp.patch b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2696-from-al3xtjames-mkstemp.patch new file mode 100644 index 00000000000..c6a4c026d15 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2696-from-al3xtjames-mkstemp.patch @@ -0,0 +1,28 @@ +From 53d2bc4f89fcbd7414b92bd242f6cdc901941f55 Mon Sep 17 00:00:00 2001 +From: Tim Kientzle +Date: Sat, 16 Aug 2025 10:27:11 -0600 +Subject: [PATCH] Merge pull request #2696 from al3xtjames/mkstemp + +Fix mkstemp path in setup_mac_metadata + +(cherry picked from commit 892f33145093d1c9b962b6521a6480dfea66ae00) + +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/53d2bc4f89fcbd7414b92bd242f6cdc901941f55] +Signed-off-by: Peter Marko +--- + libarchive/archive_read_disk_entry_from_file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libarchive/archive_read_disk_entry_from_file.c b/libarchive/archive_read_disk_entry_from_file.c +index 19d04977..87389642 100644 +--- a/libarchive/archive_read_disk_entry_from_file.c ++++ b/libarchive/archive_read_disk_entry_from_file.c +@@ -364,7 +364,7 @@ setup_mac_metadata(struct archive_read_disk *a, + tempdir = _PATH_TMP; + archive_string_init(&tempfile); + archive_strcpy(&tempfile, tempdir); +- archive_strcat(&tempfile, "tar.md.XXXXXX"); ++ archive_strcat(&tempfile, "/tar.md.XXXXXX"); + tempfd = mkstemp(tempfile.s); + if (tempfd < 0) { + archive_set_error(&a->archive, errno, diff --git a/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch new file mode 100644 index 00000000000..cab8e5e651c --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch @@ -0,0 +1,186 @@ +From 82e31ba4a9afcce0c7c19e591ccd8653196d84a0 Mon Sep 17 00:00:00 2001 +From: Tim Kientzle +Date: Mon, 13 Oct 2025 10:57:18 -0700 +Subject: [PATCH] Merge pull request #2749 from KlaraSystems/des/tempdir + +Unify temporary directory handling + +(cherry picked from commit d207d816d065c79dc2cb992008c3ba9721c6a276) + +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/82e31ba4a9afcce0c7c19e591ccd8653196d84a0] +Signed-off-by: Peter Marko +--- + CMakeLists.txt | 6 ++- + configure.ac | 6 ++- + libarchive/archive_private.h | 1 + + .../archive_read_disk_entry_from_file.c | 14 +++---- + libarchive/archive_read_disk_posix.c | 3 -- + libarchive/archive_util.c | 38 ++++++++++++++++--- + 6 files changed, 49 insertions(+), 19 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index f44adc77..fc9aca4e 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -1455,15 +1455,19 @@ CHECK_FUNCTION_EXISTS_GLIBC(ftruncate HAVE_FTRUNCATE) + CHECK_FUNCTION_EXISTS_GLIBC(futimens HAVE_FUTIMENS) + CHECK_FUNCTION_EXISTS_GLIBC(futimes HAVE_FUTIMES) + CHECK_FUNCTION_EXISTS_GLIBC(futimesat HAVE_FUTIMESAT) ++CHECK_FUNCTION_EXISTS_GLIBC(getegid HAVE_GETEGID) + CHECK_FUNCTION_EXISTS_GLIBC(geteuid HAVE_GETEUID) + CHECK_FUNCTION_EXISTS_GLIBC(getgrgid_r HAVE_GETGRGID_R) + CHECK_FUNCTION_EXISTS_GLIBC(getgrnam_r HAVE_GETGRNAM_R) + CHECK_FUNCTION_EXISTS_GLIBC(getline HAVE_GETLINE) ++CHECK_FUNCTION_EXISTS_GLIBC(getpid HAVE_GETPID) + CHECK_FUNCTION_EXISTS_GLIBC(getpwnam_r HAVE_GETPWNAM_R) + CHECK_FUNCTION_EXISTS_GLIBC(getpwuid_r HAVE_GETPWUID_R) +-CHECK_FUNCTION_EXISTS_GLIBC(getpid HAVE_GETPID) ++CHECK_FUNCTION_EXISTS_GLIBC(getresgid HAVE_GETRESGID) ++CHECK_FUNCTION_EXISTS_GLIBC(getresuid HAVE_GETRESUID) + CHECK_FUNCTION_EXISTS_GLIBC(getvfsbyname HAVE_GETVFSBYNAME) + CHECK_FUNCTION_EXISTS_GLIBC(gmtime_r HAVE_GMTIME_R) ++CHECK_FUNCTION_EXISTS_GLIBC(issetugid HAVE_ISSETUGID) + CHECK_FUNCTION_EXISTS_GLIBC(lchflags HAVE_LCHFLAGS) + CHECK_FUNCTION_EXISTS_GLIBC(lchmod HAVE_LCHMOD) + CHECK_FUNCTION_EXISTS_GLIBC(lchown HAVE_LCHOWN) +diff --git a/configure.ac b/configure.ac +index aae0f381..a1a8f380 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -810,8 +810,10 @@ AC_CHECK_FUNCS([arc4random_buf chflags chown chroot ctime_r]) + AC_CHECK_FUNCS([fchdir fchflags fchmod fchown fcntl fdopendir fnmatch fork]) + AC_CHECK_FUNCS([fstat fstatat fstatfs fstatvfs ftruncate]) + AC_CHECK_FUNCS([futimens futimes futimesat]) +-AC_CHECK_FUNCS([geteuid getline getpid getgrgid_r getgrnam_r]) +-AC_CHECK_FUNCS([getpwnam_r getpwuid_r getvfsbyname gmtime_r]) ++AC_CHECK_FUNCS([getegid geteuid getline getpid getresgid getresuid]) ++AC_CHECK_FUNCS([getgrgid_r getgrnam_r getpwnam_r getpwuid_r]) ++AC_CHECK_FUNCS([getvfsbyname gmtime_r]) ++AC_CHECK_FUNCS([issetugid]) + AC_CHECK_FUNCS([lchflags lchmod lchown link linkat localtime_r lstat lutimes]) + AC_CHECK_FUNCS([mbrtowc memmove memset]) + AC_CHECK_FUNCS([mkdir mkfifo mknod mkstemp]) +diff --git a/libarchive/archive_private.h b/libarchive/archive_private.h +index 050fc63c..3a926c68 100644 +--- a/libarchive/archive_private.h ++++ b/libarchive/archive_private.h +@@ -158,6 +158,7 @@ int __archive_check_magic(struct archive *, unsigned int magic, + __LA_NORETURN void __archive_errx(int retvalue, const char *msg); + + void __archive_ensure_cloexec_flag(int fd); ++int __archive_get_tempdir(struct archive_string *); + int __archive_mktemp(const char *tmpdir); + #if defined(_WIN32) && !defined(__CYGWIN__) + int __archive_mkstemp(wchar_t *templates); +diff --git a/libarchive/archive_read_disk_entry_from_file.c b/libarchive/archive_read_disk_entry_from_file.c +index 87389642..42af4034 100644 +--- a/libarchive/archive_read_disk_entry_from_file.c ++++ b/libarchive/archive_read_disk_entry_from_file.c +@@ -338,7 +338,7 @@ setup_mac_metadata(struct archive_read_disk *a, + int ret = ARCHIVE_OK; + void *buff = NULL; + int have_attrs; +- const char *name, *tempdir; ++ const char *name; + struct archive_string tempfile; + + (void)fd; /* UNUSED */ +@@ -357,14 +357,12 @@ setup_mac_metadata(struct archive_read_disk *a, + if (have_attrs == 0) + return (ARCHIVE_OK); + +- tempdir = NULL; +- if (issetugid() == 0) +- tempdir = getenv("TMPDIR"); +- if (tempdir == NULL) +- tempdir = _PATH_TMP; + archive_string_init(&tempfile); +- archive_strcpy(&tempfile, tempdir); +- archive_strcat(&tempfile, "/tar.md.XXXXXX"); ++ if (__archive_get_tempdir(&tempfile) != ARCHIVE_OK) { ++ ret = ARCHIVE_WARN; ++ goto cleanup; ++ } ++ archive_strcat(&tempfile, "tar.md.XXXXXX"); + tempfd = mkstemp(tempfile.s); + if (tempfd < 0) { + archive_set_error(&a->archive, errno, +diff --git a/libarchive/archive_read_disk_posix.c b/libarchive/archive_read_disk_posix.c +index ba0046d7..54a8e661 100644 +--- a/libarchive/archive_read_disk_posix.c ++++ b/libarchive/archive_read_disk_posix.c +@@ -1578,9 +1578,6 @@ setup_current_filesystem(struct archive_read_disk *a) + # endif + #endif + int r, xr = 0; +-#if !defined(HAVE_STRUCT_STATFS_F_NAMEMAX) +- long nm; +-#endif + + t->current_filesystem->synthetic = -1; + t->current_filesystem->remote = -1; +diff --git a/libarchive/archive_util.c b/libarchive/archive_util.c +index 900abd0c..d048bbc9 100644 +--- a/libarchive/archive_util.c ++++ b/libarchive/archive_util.c +@@ -443,11 +443,39 @@ __archive_mkstemp(wchar_t *template) + #else + + static int +-get_tempdir(struct archive_string *temppath) ++__archive_issetugid(void) + { +- const char *tmp; ++#ifdef HAVE_ISSETUGID ++ return (issetugid()); ++#elif HAVE_GETRESUID ++ uid_t ruid, euid, suid; ++ gid_t rgid, egid, sgid; ++ if (getresuid(&ruid, &euid, &suid) != 0) ++ return (-1); ++ if (ruid != euid || ruid != suid) ++ return (1); ++ if (getresgid(&ruid, &egid, &sgid) != 0) ++ return (-1); ++ if (rgid != egid || rgid != sgid) ++ return (1); ++#elif HAVE_GETEUID ++ if (geteuid() != getuid()) ++ return (1); ++#if HAVE_GETEGID ++ if (getegid() != getgid()) ++ return (1); ++#endif ++#endif ++ return (0); ++} + +- tmp = getenv("TMPDIR"); ++int ++__archive_get_tempdir(struct archive_string *temppath) ++{ ++ const char *tmp = NULL; ++ ++ if (__archive_issetugid() == 0) ++ tmp = getenv("TMPDIR"); + if (tmp == NULL) + #ifdef _PATH_TMP + tmp = _PATH_TMP; +@@ -474,7 +502,7 @@ __archive_mktemp(const char *tmpdir) + + archive_string_init(&temp_name); + if (tmpdir == NULL) { +- if (get_tempdir(&temp_name) != ARCHIVE_OK) ++ if (__archive_get_tempdir(&temp_name) != ARCHIVE_OK) + goto exit_tmpfile; + } else { + archive_strcpy(&temp_name, tmpdir); +@@ -536,7 +564,7 @@ __archive_mktempx(const char *tmpdir, char *template) + if (template == NULL) { + archive_string_init(&temp_name); + if (tmpdir == NULL) { +- if (get_tempdir(&temp_name) != ARCHIVE_OK) ++ if (__archive_get_tempdir(&temp_name) != ARCHIVE_OK) + goto exit_tmpfile; + } else + archive_strcpy(&temp_name, tmpdir); diff --git a/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch new file mode 100644 index 00000000000..a5e05957761 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch @@ -0,0 +1,190 @@ +From c3593848067cea3b41bc11eec15f391318675cb4 Mon Sep 17 00:00:00 2001 +From: Tim Kientzle +Date: Tue, 28 Oct 2025 17:13:18 -0700 +Subject: [PATCH] Merge pull request #2753 from KlaraSystems/des/temp-files + +Create temporary files in the target directory + +(cherry picked from commit d2e861769c25470427656b36a14b535f17d47d03) + +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/c3593848067cea3b41bc11eec15f391318675cb4] +Signed-off-by: Peter Marko +--- + .../archive_read_disk_entry_from_file.c | 10 ++--- + libarchive/archive_string.c | 20 ++++++++++ + libarchive/archive_string.h | 4 ++ + libarchive/archive_write_disk_posix.c | 20 ++++++---- + libarchive/test/test_archive_string.c | 38 +++++++++++++++++++ + 5 files changed, 79 insertions(+), 13 deletions(-) + +diff --git a/libarchive/archive_read_disk_entry_from_file.c b/libarchive/archive_read_disk_entry_from_file.c +index 42af4034..121af198 100644 +--- a/libarchive/archive_read_disk_entry_from_file.c ++++ b/libarchive/archive_read_disk_entry_from_file.c +@@ -358,12 +358,10 @@ setup_mac_metadata(struct archive_read_disk *a, + return (ARCHIVE_OK); + + archive_string_init(&tempfile); +- if (__archive_get_tempdir(&tempfile) != ARCHIVE_OK) { +- ret = ARCHIVE_WARN; +- goto cleanup; +- } +- archive_strcat(&tempfile, "tar.md.XXXXXX"); +- tempfd = mkstemp(tempfile.s); ++ archive_strcpy(&tempfile, name); ++ archive_string_dirname(&tempfile); ++ archive_strcat(&tempfile, "/tar.XXXXXXXX"); ++ tempfd = __archive_mkstemp(tempfile.s); + if (tempfd < 0) { + archive_set_error(&a->archive, errno, + "Could not open extended attribute file"); +diff --git a/libarchive/archive_string.c b/libarchive/archive_string.c +index 3bb97833..740308b6 100644 +--- a/libarchive/archive_string.c ++++ b/libarchive/archive_string.c +@@ -2039,6 +2039,26 @@ archive_strncat_l(struct archive_string *as, const void *_p, size_t n, + return (r); + } + ++struct archive_string * ++archive_string_dirname(struct archive_string *as) ++{ ++ /* strip trailing separators */ ++ while (as->length > 1 && as->s[as->length - 1] == '/') ++ as->length--; ++ /* strip final component */ ++ while (as->length > 0 && as->s[as->length - 1] != '/') ++ as->length--; ++ /* empty path -> cwd */ ++ if (as->length == 0) ++ return (archive_strcat(as, ".")); ++ /* strip separator(s) */ ++ while (as->length > 1 && as->s[as->length - 1] == '/') ++ as->length--; ++ /* terminate */ ++ as->s[as->length] = '\0'; ++ return (as); ++} ++ + #if HAVE_ICONV + + /* +diff --git a/libarchive/archive_string.h b/libarchive/archive_string.h +index e8987867..d5f5c03a 100644 +--- a/libarchive/archive_string.h ++++ b/libarchive/archive_string.h +@@ -192,6 +192,10 @@ void archive_string_vsprintf(struct archive_string *, const char *, + void archive_string_sprintf(struct archive_string *, const char *, ...) + __LA_PRINTF(2, 3); + ++/* Equivalent to dirname(3) */ ++struct archive_string * ++archive_string_dirname(struct archive_string *); ++ + /* Translates from MBS to Unicode. */ + /* Returns non-zero if conversion failed in any way. */ + int archive_wstring_append_from_mbs(struct archive_wstring *dest, +diff --git a/libarchive/archive_write_disk_posix.c b/libarchive/archive_write_disk_posix.c +index 6fcf3929..cd256203 100644 +--- a/libarchive/archive_write_disk_posix.c ++++ b/libarchive/archive_write_disk_posix.c +@@ -412,12 +412,14 @@ static ssize_t _archive_write_disk_data_block(struct archive *, const void *, + static int + la_mktemp(struct archive_write_disk *a) + { ++ struct archive_string *tmp = &a->_tmpname_data; + int oerrno, fd; + mode_t mode; + +- archive_string_empty(&a->_tmpname_data); +- archive_string_sprintf(&a->_tmpname_data, "%s.XXXXXX", a->name); +- a->tmpname = a->_tmpname_data.s; ++ archive_strcpy(tmp, a->name); ++ archive_string_dirname(tmp); ++ archive_strcat(tmp, "/tar.XXXXXXXX"); ++ a->tmpname = tmp->s; + + fd = __archive_mkstemp(a->tmpname); + if (fd == -1) +@@ -4283,8 +4285,10 @@ create_tempdatafork(struct archive_write_disk *a, const char *pathname) + int tmpfd; + + archive_string_init(&tmpdatafork); +- archive_strcpy(&tmpdatafork, "tar.md.XXXXXX"); +- tmpfd = mkstemp(tmpdatafork.s); ++ archive_strcpy(&tmpdatafork, pathname); ++ archive_string_dirname(&tmpdatafork); ++ archive_strcat(&tmpdatafork, "/tar.XXXXXXXX"); ++ tmpfd = __archive_mkstemp(tmpdatafork.s); + if (tmpfd < 0) { + archive_set_error(&a->archive, errno, + "Failed to mkstemp"); +@@ -4363,8 +4367,10 @@ set_mac_metadata(struct archive_write_disk *a, const char *pathname, + * silly dance of writing the data to disk just so that + * copyfile() can read it back in again. */ + archive_string_init(&tmp); +- archive_strcpy(&tmp, "tar.mmd.XXXXXX"); +- fd = mkstemp(tmp.s); ++ archive_strcpy(&tmp, pathname); ++ archive_string_dirname(&tmp); ++ archive_strcat(&tmp, "/tar.XXXXXXXX"); ++ fd = __archive_mkstemp(tmp.s); + + if (fd < 0) { + archive_set_error(&a->archive, errno, +diff --git a/libarchive/test/test_archive_string.c b/libarchive/test/test_archive_string.c +index 30f7a800..bf822c0d 100644 +--- a/libarchive/test/test_archive_string.c ++++ b/libarchive/test/test_archive_string.c +@@ -353,6 +353,43 @@ test_archive_string_sprintf(void) + archive_string_free(&s); + } + ++static void ++test_archive_string_dirname(void) ++{ ++ static struct pair { const char *str, *exp; } pairs[] = { ++ { "", "." }, ++ { "/", "/" }, ++ { "//", "/" }, ++ { "///", "/" }, ++ { "./", "." }, ++ { ".", "." }, ++ { "..", "." }, ++ { "foo", "." }, ++ { "foo/", "." }, ++ { "foo//", "." }, ++ { "foo/bar", "foo" }, ++ { "foo/bar/", "foo" }, ++ { "foo/bar//", "foo" }, ++ { "foo//bar", "foo" }, ++ { "foo//bar/", "foo" }, ++ { "foo//bar//", "foo" }, ++ { "/foo", "/" }, ++ { "//foo", "/" }, ++ { "//foo/", "/" }, ++ { "//foo//", "/" }, ++ { 0 }, ++ }; ++ struct pair *pair; ++ struct archive_string s; ++ ++ archive_string_init(&s); ++ for (pair = pairs; pair->str; pair++) { ++ archive_strcpy(&s, pair->str); ++ archive_string_dirname(&s); ++ assertEqualString(pair->exp, s.s); ++ } ++} ++ + DEFINE_TEST(test_archive_string) + { + test_archive_string_ensure(); +@@ -364,6 +401,7 @@ DEFINE_TEST(test_archive_string) + test_archive_string_concat(); + test_archive_string_copy(); + test_archive_string_sprintf(); ++ test_archive_string_dirname(); + } + + static const char *strings[] = diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index f4b1be23371..88e9fbf8e99 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -38,6 +38,9 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://CVE-2025-5918-0001.patch \ file://CVE-2025-5918-0002.patch \ file://CVE-2025-5918-0003.patch \ + file://0001-Merge-pull-request-2696-from-al3xtjames-mkstemp.patch \ + file://0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch \ + file://0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch \ " UPSTREAM_CHECK_URI = "http://libarchive.org/" From patchwork Sat Nov 22 22:16:53 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 75244 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CAC9CFD313 for ; Sat, 22 Nov 2025 22:17:44 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3808.1763849853875325492 for ; Sat, 22 Nov 2025 14:17:35 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=CtA9DQQZ; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-202511222217319d85adee08000207c7-b3e_7d@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 202511222217319d85adee08000207c7 for ; Sat, 22 Nov 2025 23:17:31 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=kRZjDCig4K7k9hlVHT2la4fjFfl36uqkIwsa+7XdJD0=; b=CtA9DQQZEOKeU4C6CGaO1g5Ur251UNZd3Wa+qEDL0zirGws6OwdSRyLPlzCqOhr7PxZl3P LtJkS8R+q3CjxEVOMmWKUv9XQKlYgzCXw8cYqN3FMgQZrdgqOPPpiRRou1Bxn571r4EzQZ2d +ORytYdemnvKQlhY5HpIdkCK12qXMVKwaHgUf5thXEgFWgGHlBdN/fFDSQ+h481ouMmzBp4u vpkRxt1dFgdp/iLkQjz2pTjX2hSRZxe/fG7ROdDmqmLbD7x/Jp3YLeAkBC40SYBkG3MrKec1 +7DSl0YIErlV8gGLs82IpSUj8cEcHsU5KhYz7hgEQF4JcrhDpKkcMgcQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [OE-core][scarthgap][PATCH 2/3] libarchive: patch 3.8.3 security issue 2 Date: Sat, 22 Nov 2025 23:16:53 +0100 Message-Id: <20251122221654.3047008-2-peter.marko@siemens.com> In-Reply-To: <20251122221654.3047008-1-peter.marko@siemens.com> References: <20251122221654.3047008-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 22 Nov 2025 22:17:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/226721 From: Peter Marko Pick patch [2] as listed in [1]. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2768 Signed-off-by: Peter Marko --- ...-request-2768-from-Commandoss-master.patch | 28 +++++++++++++++++++ .../libarchive/libarchive_3.7.9.bb | 1 + 2 files changed, 29 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2768-from-Commandoss-master.patch diff --git a/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2768-from-Commandoss-master.patch b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2768-from-Commandoss-master.patch new file mode 100644 index 00000000000..66e88c91b4f --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/0001-Merge-pull-request-2768-from-Commandoss-master.patch @@ -0,0 +1,28 @@ +From 82b57a9740aa6d084edcf4592a3b8e49f63dec98 Mon Sep 17 00:00:00 2001 +From: Tim Kientzle +Date: Fri, 31 Oct 2025 22:07:19 -0700 +Subject: [PATCH] Merge pull request #2768 from Commandoss/master + +Fix for an out-of-bounds buffer overrun when using p[H_LEVEL_OFFSET] + +(cherry picked from commit ce614c65246158bcb0dc1f9c1dce5a5af65f9827) + +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/82b57a9740aa6d084edcf4592a3b8e49f63dec98] +Signed-off-by: Peter Marko +--- + libarchive/archive_read_support_format_lha.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c +index 2a84ad9d..abf8b879 100644 +--- a/libarchive/archive_read_support_format_lha.c ++++ b/libarchive/archive_read_support_format_lha.c +@@ -690,7 +690,7 @@ archive_read_format_lha_read_header(struct archive_read *a, + * a pathname and a symlink has '\' character, a directory + * separator in DOS/Windows. So we should convert it to '/'. + */ +- if (p[H_LEVEL_OFFSET] == 0) ++ if (lha->level == 0) + lha_replace_path_separator(lha, entry); + + archive_entry_set_mode(entry, lha->mode); diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index 88e9fbf8e99..da11e052a71 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -41,6 +41,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://0001-Merge-pull-request-2696-from-al3xtjames-mkstemp.patch \ file://0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch \ file://0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch \ + file://0001-Merge-pull-request-2768-from-Commandoss-master.patch \ " UPSTREAM_CHECK_URI = "http://libarchive.org/" From patchwork Sat Nov 22 22:16:54 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 75245 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CA77CFD30D for ; Sat, 22 Nov 2025 22:17:44 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3812.1763849861209501182 for ; Sat, 22 Nov 2025 14:17:41 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=Vgf8Kbeg; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-20251122221739051ff2590f0002072f-o8bquy@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20251122221739051ff2590f0002072f for ; Sat, 22 Nov 2025 23:17:39 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=B4oLvkXTzLu0Fjrbnfu5WwX4zcKgcBa2Of5LkNnqoCo=; b=Vgf8KbegioNyuiDCMG2GJRfp3GA/R6BCuHnOV+EGVe2X7KfQuvk88uBXTm9UwsezsuXGrt P3qKN9FnQxqhUuGA+6/QIqkiWX0BaFT/+dBQk/f2OHgNNJZ+cZOKLj7LZOIsyOyX22b9+sWD KfU7bm2cXfSYvcytu86rOe7ll1noxxoa3Ypvl6EXRDbbBQLpp18/2zX0bkvRQZ4eLcan4lvq Od39buRifS1HQn028N41szdAPx5bEsx5CHqYiJWxn01kwa8pgxMAF5qqDQXWj7vCwmeZzUjA ms1nBzblrbWzeFaXn+V9H/R/m5HlACfrg9p0mqeC7/quAn1i3ChVumxQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [OE-core][scarthgap][PATCH 3/3] libarchive: patch CVE-2025-60753 Date: Sat, 22 Nov 2025 23:16:54 +0100 Message-Id: <20251122221654.3047008-3-peter.marko@siemens.com> In-Reply-To: <20251122221654.3047008-1-peter.marko@siemens.com> References: <20251122221654.3047008-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 22 Nov 2025 22:17:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/226722 From: Peter Marko Pick patch from [3] marked in [2] mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-60753 [2] https://github.com/libarchive/libarchive/issues/2725 [3] https://github.com/libarchive/libarchive/pull/2787 Signed-off-by: Peter Marko --- .../libarchive/CVE-2025-60753.patch | 76 +++++++++++++++++++ .../libarchive/libarchive_3.7.9.bb | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2025-60753.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2025-60753.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2025-60753.patch new file mode 100644 index 00000000000..730a6128c30 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2025-60753.patch @@ -0,0 +1,76 @@ +From 3150539edb18690c2c5f81c37fd2d3a35c69ace5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?ARJANEN=20Lo=C3=AFc=20Jean=20David?= +Date: Fri, 14 Nov 2025 20:34:48 +0100 +Subject: [PATCH] Fix bsdtar zero-length pattern issue. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Uses the sed-like way (and Java-like, and .Net-like, and Javascript-like…) to fix this issue of advancing the string to be processed by one if the match is zero-length. + +Fixes libarchive/libarchive#2725 and solves libarchive/libarchive#2438. + +CVE: CVE-2025-60753 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/3150539edb18690c2c5f81c37fd2d3a35c69ace5] +Signed-off-by: Peter Marko +--- + tar/subst.c | 19 ++++++++++++------- + tar/test/test_option_s.c | 8 +++++++- + 2 files changed, 19 insertions(+), 8 deletions(-) + +diff --git a/tar/subst.c b/tar/subst.c +index 9747abb9..902a4d64 100644 +--- a/tar/subst.c ++++ b/tar/subst.c +@@ -235,7 +235,9 @@ apply_substitution(struct bsdtar *bsdtar, const char *name, char **result, + (*result)[0] = 0; + } + +- while (1) { ++ char isEnd = 0; ++ do { ++ isEnd = *name == '\0'; + if (regexec(&rule->re, name, 10, matches, 0)) + break; + +@@ -290,12 +292,15 @@ apply_substitution(struct bsdtar *bsdtar, const char *name, char **result, + } + + realloc_strcat(result, rule->result + j); +- +- name += matches[0].rm_eo; +- +- if (!rule->global) +- break; +- } ++ if (matches[0].rm_eo > 0) { ++ name += matches[0].rm_eo; ++ } else { ++ // We skip a character because the match is 0-length ++ // so we need to add it to the output ++ realloc_strncat(result, name, 1); ++ name += 1; ++ } ++ } while (rule->global && !isEnd); // Testing one step after because sed et al. run 0-length patterns a last time on the empty string at the end + } + + if (got_match) +diff --git a/tar/test/test_option_s.c b/tar/test/test_option_s.c +index 564793b9..90b4c471 100644 +--- a/tar/test/test_option_s.c ++++ b/tar/test/test_option_s.c +@@ -42,7 +42,13 @@ DEFINE_TEST(test_option_s) + systemf("%s -cf test1_2.tar -s /d1/d2/ in/d1/foo", testprog); + systemf("%s -xf test1_2.tar -C test1", testprog); + assertFileContents("foo", 3, "test1/in/d2/foo"); +- ++ systemf("%s -cf test1_3.tar -s /o/#/g in/d1/foo", testprog); ++ systemf("%s -xf test1_3.tar -C test1", testprog); ++ assertFileContents("foo", 3, "test1/in/d1/f##"); ++ // For the 0-length pattern check, remember that "test1/" isn't part of the string affected by the regexp ++ systemf("%s -cf test1_4.tar -s /f*/\\<~\\>/g in/d1/foo", testprog); ++ systemf("%s -xf test1_4.tar -C test1", testprog); ++ assertFileContents("foo", 3, "test1/<>i<>n<>/<>d<>1<>/<>o<>o<>"); + /* + * Test 2: Basic substitution when extracting archive. + */ diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index da11e052a71..86ba53aaf2a 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -42,6 +42,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://0001-Merge-pull-request-2749-from-KlaraSystems-des-tempdi.patch \ file://0001-Merge-pull-request-2753-from-KlaraSystems-des-temp-f.patch \ file://0001-Merge-pull-request-2768-from-Commandoss-master.patch \ + file://CVE-2025-60753.patch \ " UPSTREAM_CHECK_URI = "http://libarchive.org/"