file: address CVE-2022-48554 (#10781)

Signed-off-by: Muhammad Falak R Wani <[email protected]>
Co-authored-by: jslobodzian <[email protected]>

Author: mfrw

SPECS/file/CVE-2022-48554.patch

@@ -0,0 +1,35 @@
+From 90d7e3a175210a1b9afc07b12e69e88e9e2092a7 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <[email protected]>
+Date: Mon, 14 Feb 2022 16:26:10 +0000
+Subject: [PATCH] PR/310: p870613: Don't use strlcpy to copy the string, it
+ will try to scan the source string to find out how much space is needed the
+ source string might not be NUL terminated.
+
+Signed-off-by: Muhammad Falak R Wani <[email protected]>
+---
+ src/funcs.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/funcs.c b/src/funcs.c
+index b926625..d32e85b 100644
+--- a/src/funcs.c
++++ b/src/funcs.c
+@@ -54,9 +54,12 @@ FILE_RCSID("@(#)$File: funcs.c,v 1.121 2021/02/05 22:29:07 christos Exp $")
+ protected char *
+ file_copystr(char *buf, size_t blen, size_t width, const char *str)
+ {
+-	if (++width > blen)
+-		width = blen;
+-	strlcpy(buf, str, width);
++	if (blen == 0)
++		return buf;
++	if (width >= blen)
++		width = blen - 1;
++	memcpy(buf, str, width);
++	buf[width] = '\0';
+ 	return buf;
+ }
+ 
+-- 
+2.40.1
+

SPECS/file/file.spec

@@ -1,14 +1,15 @@
 Summary:        Contains a utility for determining file types
 Name:           file
 Version:        5.40
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
 Group:          Applications/File
 URL:            https://www.darwinsys.com/file
 Source0:        http://ftp.astron.com/pub/file/%{name}-%{version}.tar.gz
 Patch1:         fix_xz_mime_type_reporting.patch
+Patch2:         CVE-2022-48554.patch
 Requires:       %{name}-libs = %{version}-%{release}
 Conflicts:      toybox
 
@@ -91,6 +92,9 @@ python3 setup.py install -O1 --skip-build --root %{buildroot}
 %{python3_sitelib}/__pycache__/*
 
 %changelog
+* Thu Oct 17 2024 Muhammad Falak <[email protected]> - 5.40-3
+- Address CVE-2022-48554
+
 * Tue Mar 15 2022 Bala <[email protected]> - 5.40-2
 - Add patch to fix xz mime type reporting
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -9,9 +9,9 @@ glibc-nscd-2.35-7.cm2.aarch64.rpm
 glibc-tools-2.35-7.cm2.aarch64.rpm
 zlib-1.2.13-2.cm2.aarch64.rpm
 zlib-devel-1.2.13-2.cm2.aarch64.rpm
-file-5.40-2.cm2.aarch64.rpm
-file-devel-5.40-2.cm2.aarch64.rpm
-file-libs-5.40-2.cm2.aarch64.rpm
+file-5.40-3.cm2.aarch64.rpm
+file-devel-5.40-3.cm2.aarch64.rpm
+file-libs-5.40-3.cm2.aarch64.rpm
 binutils-2.37-9.cm2.aarch64.rpm
 binutils-devel-2.37-9.cm2.aarch64.rpm
 gmp-6.2.1-4.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -9,9 +9,9 @@ glibc-nscd-2.35-7.cm2.x86_64.rpm
 glibc-tools-2.35-7.cm2.x86_64.rpm
 zlib-1.2.13-2.cm2.x86_64.rpm
 zlib-devel-1.2.13-2.cm2.x86_64.rpm
-file-5.40-2.cm2.x86_64.rpm
-file-devel-5.40-2.cm2.x86_64.rpm
-file-libs-5.40-2.cm2.x86_64.rpm
+file-5.40-3.cm2.x86_64.rpm
+file-devel-5.40-3.cm2.x86_64.rpm
+file-libs-5.40-3.cm2.x86_64.rpm
 binutils-2.37-9.cm2.x86_64.rpm
 binutils-devel-2.37-9.cm2.x86_64.rpm
 gmp-6.2.1-4.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -77,10 +77,10 @@ expat-2.6.3-1.cm2.aarch64.rpm
 expat-debuginfo-2.6.3-1.cm2.aarch64.rpm
 expat-devel-2.6.3-1.cm2.aarch64.rpm
 expat-libs-2.6.3-1.cm2.aarch64.rpm
-file-5.40-2.cm2.aarch64.rpm
-file-debuginfo-5.40-2.cm2.aarch64.rpm
-file-devel-5.40-2.cm2.aarch64.rpm
-file-libs-5.40-2.cm2.aarch64.rpm
+file-5.40-3.cm2.aarch64.rpm
+file-debuginfo-5.40-3.cm2.aarch64.rpm
+file-devel-5.40-3.cm2.aarch64.rpm
+file-libs-5.40-3.cm2.aarch64.rpm
 filesystem-1.1-20.cm2.aarch64.rpm
 filesystem-asc-1.1-20.cm2.aarch64.rpm
 findutils-4.8.0-5.cm2.aarch64.rpm
@@ -523,7 +523,7 @@ python3-libcap-ng-0.8.2-2.cm2.aarch64.rpm
 python3-libs-3.9.19-6.cm2.aarch64.rpm
 python3-libxml2-2.10.4-4.cm2.aarch64.rpm
 python3-lxml-4.9.1-1.cm2.aarch64.rpm
-python3-magic-5.40-2.cm2.noarch.rpm
+python3-magic-5.40-3.cm2.noarch.rpm
 python3-markupsafe-2.1.0-1.cm2.aarch64.rpm
 python3-newt-0.52.21-5.cm2.aarch64.rpm
 python3-pip-3.9.19-6.cm2.noarch.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -80,10 +80,10 @@ expat-2.6.3-1.cm2.x86_64.rpm
 expat-debuginfo-2.6.3-1.cm2.x86_64.rpm
 expat-devel-2.6.3-1.cm2.x86_64.rpm
 expat-libs-2.6.3-1.cm2.x86_64.rpm
-file-5.40-2.cm2.x86_64.rpm
-file-debuginfo-5.40-2.cm2.x86_64.rpm
-file-devel-5.40-2.cm2.x86_64.rpm
-file-libs-5.40-2.cm2.x86_64.rpm
+file-5.40-3.cm2.x86_64.rpm
+file-debuginfo-5.40-3.cm2.x86_64.rpm
+file-devel-5.40-3.cm2.x86_64.rpm
+file-libs-5.40-3.cm2.x86_64.rpm
 filesystem-1.1-20.cm2.x86_64.rpm
 filesystem-asc-1.1-20.cm2.x86_64.rpm
 findutils-4.8.0-5.cm2.x86_64.rpm
@@ -529,7 +529,7 @@ python3-libcap-ng-0.8.2-2.cm2.x86_64.rpm
 python3-libs-3.9.19-6.cm2.x86_64.rpm
 python3-libxml2-2.10.4-4.cm2.x86_64.rpm
 python3-lxml-4.9.1-1.cm2.x86_64.rpm
-python3-magic-5.40-2.cm2.noarch.rpm
+python3-magic-5.40-3.cm2.noarch.rpm
 python3-markupsafe-2.1.0-1.cm2.x86_64.rpm
 python3-newt-0.52.21-5.cm2.x86_64.rpm
 python3-pip-3.9.19-6.cm2.noarch.rpm