Bugzilla Bug 112140

Red Hat reports: 
 
A buffer overflow issue was reported to our bugzilla. 
 
It seems when creating a cpio archive, it is possible to overflow a buffer 
on the stack with a very large file (sparse files should suffice).  This 
issue only affects 64 bit platforms as the sizeof(long) isn't large enough 
to cause an overflow on 32 bit systems.

Do we have a link to a patch for this problem yet?

Only the Redhat bug. I guess we can dig up a patch from them at some point. 
Otherwise I'll try V-S. 

Patch is attached to the Redhat bug now I see. 

Base system please bump with patch

Sadly the upstream patch does not apply cleanly to ours or even a vanilla
cpio-2.6

patching file src/copyout.c
Hunk #3 FAILED at 290.
1 out of 9 hunks FAILED -- saving rejects to file src/copyout.c.rej

Looking at the rej/patch hunk 3 is rather large. 
Larger than I feel confortable redoing for the sake of this bug.

Suggestion: contact upstream and request a vanilla patch or we need to find 
somebody who does not have anything todo for the better hanlf of a day. I think 
contacting upstream is probably the way to go.

Yes, upstream HEAD (on which the upstream/RedHat patches are) is quite far from
vanilla 2.6... Apart from the 64-bit checksum thing, there have been some TOCTOU
security updates and a few complete rewrites :/

So there are several options (stick to vanilla, HEAD, Debian patchset...), and
it's best for the maintainers (base-system herd) to choose between those, even
before contacting upstream at <gray@gnu.org.ua>...

cpio-2.6-r5 now in portage with patches from Fedora

Arches please test and mark stable. Only 64-bit arches are concerned, but
others
can/should mark it as well.

Hm. Not sure this is a security issue, in fact.

This happens when creating the cpio archive, meaning you'd have to create a very
strange content and entice someone else to create an archive with it...

Apparently everyone agrees with it since CVE was not assigned, and nobody
released an advisory for this (while it was posted on v-s quite some time ago).

So I'd stable it on 64-bit archs and close it without GLSA.

sparc stable.

RH bug is closed with Severity security. 
 
I agree on the no GLSA part. 

stable on ppc64 

stable on ppc-macos

sorry for the bugspam, forgot to check the checkbox

Stable on x86.

Stable on alpha

Cheers,
Ferdy

stable on amd64

Marked stable

Closing without GLSA. 
 
mips don't forget to mark stable and sorry for any bugspam. 

stable on mips.