From d954db46e4b367f0ca70e2bc926f08f4f61c9569 Mon Sep 17 00:00:00 2001 From: Eric Sandeen Date: Mon, 18 May 2015 14:33:37 -0500 Subject: New upstream release v1.42.13 --- e2fsprogs-1.42.12-closefs-cve.patch | 51 ------------------------------------- 1 file changed, 51 deletions(-) delete mode 100644 e2fsprogs-1.42.12-closefs-cve.patch (limited to 'e2fsprogs-1.42.12-closefs-cve.patch') diff --git a/e2fsprogs-1.42.12-closefs-cve.patch b/e2fsprogs-1.42.12-closefs-cve.patch deleted file mode 100644 index af219c4..0000000 --- a/e2fsprogs-1.42.12-closefs-cve.patch +++ /dev/null @@ -1,51 +0,0 @@ -commit 49d0fe2a14f2a23da2fe299643379b8c1d37df73 -Author: Theodore Ts'o -Date: Fri Feb 6 12:46:39 2015 -0500 - - libext2fs: fix potential buffer overflow in closefs() - - The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if - s_first_meta_bg is too big" had a typo in the fix for - ext2fs_closefs(). In practice most of the security exposure was from - the openfs path, since this meant if there was a carefully crafted - file system, buffer overrun would be triggered when the file system was - opened. - - However, if corrupted file system didn't trip over some corruption - check, and then the file system was modified via tune2fs or debugfs, - such that the superblock was marked dirty and then written out via the - closefs() path, it's possible that the buffer overrun could be - triggered when the file system is closed. - - Also clear up a signed vs unsigned warning while we're at it. - - Thanks to Nick Kralevich for asking me to look at - compiler warning in the code in question, which led me to notice the - bug in f66e6ce4446. - - Addresses: CVE-2015-1572 - - Signed-off-by: Theodore Ts'o - -diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c -index 1f99113..ab5b2fb 100644 ---- a/lib/ext2fs/closefs.c -+++ b/lib/ext2fs/closefs.c -@@ -287,7 +287,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags) - dgrp_t j; - #endif - char *group_ptr; -- int old_desc_blocks; -+ blk64_t old_desc_blocks; - struct ext2fs_numeric_progress_struct progress; - - EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS); -@@ -346,7 +346,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags) - group_ptr = (char *) group_shadow; - if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) { - old_desc_blocks = fs->super->s_first_meta_bg; -- if (old_desc_blocks > fs->super->s_first_meta_bg) -+ if (old_desc_blocks > fs->desc_blocks) - old_desc_blocks = fs->desc_blocks; - } else - old_desc_blocks = fs->desc_blocks; -- cgit