]> CyberLeo.Net >> Repos - FreeBSD/stable/10.git/commit
MFC r302075:
authormm <mm@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Thu, 30 Jun 2016 12:44:15 +0000 (12:44 +0000)
committermm <mm@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Thu, 30 Jun 2016 12:44:15 +0000 (12:44 +0000)
commitd86443167ad684b68d42ad3c31a5013e0fb85ca7
tree2e5d2542532b32df0f9327ddb3a4e866cf594b32
parent0ae56fdcd0819ed79778ef8aec8e9e28c2334231
MFC r302075:

Update libarchive to 3.2.1 (bugfix and security fix release)

List of vendor fixes:
- fix exploitable heap overflow vulnerability in Rar decompression
  (vendor issue 719, CVE-2016-4302, TALOS-2016-0154)
- fix exploitable stack based buffer overflow vulnebarility in mtree
  parse_device functionality (vendor PR 715, CVE-2016-4301, TALOS-2016-0153)
- fix exploitable heap overflow vulnerability in 7-zip read_SubStreamsInfo
  (vendor issue 718, CVE-2016-4300, TALOS-2016-152)
- fix integer overflow when computing location of volume descriptor
  (vendor issue 717)
- fix buffer overflow when reading a crafred rar archive (vendor issue 521)
- fix possible buffer overflow when reading ISO9660 archives on machines
  where sizeof(int) < sizeof(size_t) (vendor issue 711)
- tar and cpio should fail if an input file named on the command line is
  missing (vendor issue 708)
- fix incorrect writing of gnutar filenames that are exactly 512 bytes
  long (vendor issue 682)
- allow tests to be run from paths that are equal or longer than 128
  characters (vendor issue 657)
- add memory allocation errors in archive_entry_xattr.c (vendor PR 603)
- remove dead code in archive_entry_xattr_add_entry() (vendor PR 716)
- fix broken decryption of ZIP files (vendor issue 553)
- manpage style, typo and description fixes

Post-3.2.1 vendor fixes:
- fix typo in cpio version reporting (Vendor PR 725, 726)
- fix argument range of ctype functions in libarchive_fe/passphrase.c
- fix ctype use and avoid empty loop bodies in WARC reader

Security: CVE-2016-4300, CVE-2016-4301, CVE-2016-4302

git-svn-id: svn://svn.freebsd.org/base/stable/10@302295 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
37 files changed:
contrib/libarchive/NEWS
contrib/libarchive/cat/test/main.c
contrib/libarchive/cpio/cpio.c
contrib/libarchive/cpio/test/main.c
contrib/libarchive/cpio/test/test_missing_file.c [new file with mode: 0644]
contrib/libarchive/cpio/test/test_option_version.c
contrib/libarchive/libarchive/archive.h
contrib/libarchive/libarchive/archive_entry.h
contrib/libarchive/libarchive/archive_entry_xattr.c
contrib/libarchive/libarchive/archive_ppmd7.c
contrib/libarchive/libarchive/archive_read_support_format_7zip.c
contrib/libarchive/libarchive/archive_read_support_format_iso9660.c
contrib/libarchive/libarchive/archive_read_support_format_lha.c
contrib/libarchive/libarchive/archive_read_support_format_mtree.c
contrib/libarchive/libarchive/archive_read_support_format_rar.c
contrib/libarchive/libarchive/archive_read_support_format_warc.c
contrib/libarchive/libarchive/archive_read_support_format_zip.c
contrib/libarchive/libarchive/archive_write_filter.3
contrib/libarchive/libarchive/archive_write_set_format_gnutar.c
contrib/libarchive/libarchive/archive_write_set_format_iso9660.c
contrib/libarchive/libarchive/archive_write_set_options.3
contrib/libarchive/libarchive/libarchive-formats.5
contrib/libarchive/libarchive/libarchive_changes.3
contrib/libarchive/libarchive/test/main.c
contrib/libarchive/libarchive/test/test_read_format_rar_invalid1.c [new file with mode: 0644]
contrib/libarchive/libarchive/test/test_read_format_rar_invalid1.rar.uu [new file with mode: 0644]
contrib/libarchive/libarchive/test/test_write_format_gnutar_filenames.c [new file with mode: 0644]
contrib/libarchive/libarchive_fe/passphrase.c
contrib/libarchive/tar/test/main.c
contrib/libarchive/tar/test/test_missing_file.c [new file with mode: 0644]
contrib/libarchive/tar/write.c
lib/libarchive/tests/Makefile
usr.bin/bsdcat/Makefile
usr.bin/cpio/Makefile
usr.bin/cpio/tests/Makefile
usr.bin/tar/Makefile
usr.bin/tar/tests/Makefile