ad0bb50dc7
Fixes CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Peter: add _IGNORE_CVES entry] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
56 lines
1.4 KiB
Makefile
56 lines
1.4 KiB
Makefile
################################################################################
|
|
#
|
|
# tar
|
|
#
|
|
################################################################################
|
|
|
|
TAR_VERSION = 1.34
|
|
TAR_SOURCE = tar-$(TAR_VERSION).tar.xz
|
|
TAR_SITE = $(BR2_GNU_MIRROR)/tar
|
|
# busybox installs in /bin, so we need tar to install as well in /bin
|
|
# so that we don't end up with two different tar
|
|
TAR_CONF_OPTS = --exec-prefix=/
|
|
TAR_LICENSE = GPL-3.0+
|
|
TAR_LICENSE_FILES = COPYING
|
|
TAR_CPE_ID_VENDOR = gnu
|
|
|
|
# 0002-Fix-boundary-checking-in-base-256-decoder.patch
|
|
TAR_IGNORE_CVES += CVE-2022-48303
|
|
|
|
ifeq ($(BR2_PACKAGE_ACL),y)
|
|
TAR_DEPENDENCIES += acl
|
|
TAR_CONF_OPTS += --with-posix-acls
|
|
else
|
|
TAR_CONF_OPTS += --without-posix-acls
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ATTR),y)
|
|
TAR_DEPENDENCIES += attr
|
|
TAR_CONF_OPTS += --with-xattrs
|
|
else
|
|
TAR_CONF_OPTS += --without-xattrs
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|
|
|
|
# host-tar: use cpio.gz instead of tar.gz to prevent chicken-egg problem
|
|
# of needing tar to build tar.
|
|
HOST_TAR_SOURCE = tar-$(TAR_VERSION).cpio.gz
|
|
|
|
define HOST_TAR_EXTRACT_CMDS
|
|
mkdir -p $(@D)
|
|
cd $(@D) && \
|
|
$(call suitable-extractor,$(HOST_TAR_SOURCE)) $(TAR_DL_DIR)/$(HOST_TAR_SOURCE) | cpio -i --preserve-modification-time
|
|
mv $(@D)/tar-$(HOST_TAR_VERSION)/* $(@D)
|
|
rmdir $(@D)/tar-$(HOST_TAR_VERSION)
|
|
endef
|
|
|
|
HOST_TAR_CONF_OPTS = --without-selinux
|
|
|
|
# we are built before ccache
|
|
HOST_TAR_CONF_ENV = \
|
|
CC="$(HOSTCC_NOCCACHE)" \
|
|
CXX="$(HOSTCXX_NOCCACHE)"
|
|
|
|
$(eval $(host-autotools-package))
|