system/e2fsprogs: bump to 1.45.4

2 files changed, 4 insertions, 217 deletions

diff --git a/system/e2fsprogs/APKBUILD b/system/e2fsprogs/APKBUILD
index ba7869fe8..741de2e38 100644
--- a/system/e2fsprogs/APKBUILD
+++ b/system/e2fsprogs/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Valery Kartel <valery.kartel@gmail.com>
 # Maintainer: A. Wilcox <awilfox@adelielinux.org>
 pkgname=e2fsprogs
-pkgver=1.45.3
-pkgrel=1
+pkgver=1.45.4
+pkgrel=0
 pkgdesc="Standard ext2/3/4 filesystem utilities"
 url="http://e2fsprogs.sourceforge.net"
 arch="all"
@@ -13,7 +13,6 @@ makedepends="$depends_dev linux-headers"
 subpackages="$pkgname-lang $pkgname-dev $pkgname-doc libcom_err $pkgname-libs"
 source="https://www.kernel.org/pub/linux/kernel/people/tytso/$pkgname/v$pkgver/$pkgname-$pkgver.tar.xz
 	header-fix.patch
-	CVE-2019-5094.patch
 	"
 
 # secfixes:
@@ -59,6 +58,5 @@ libcom_err() {
 	mv "$pkgdir"/lib/libcom_err* "$subpkgdir"/lib/
 }
 
-sha512sums="9f898d353af48a1d357cb01f64187b6dfef671bb2e0450438530fe4fa9454fccc6b755c9469d81e702e6d85a4defd02ae0a493897a4b3284cb112e8444c9bf52  e2fsprogs-1.45.3.tar.xz
-34ca45c64a132bb4b507cd4ffb763c6d1b7979eccfed20f63417e514871b47639d32f2a3ecff090713c21a0f02ac503d5093960c80401d64081c592d01af279d  header-fix.patch
-f82cf01938eb150446a7014ba48d51578ace42aecd427e225a3640033a4d8f2ec5a29dd02a3c0dfa45d2140cb2187303397c2d0124a2f987304c25182cc9578a  CVE-2019-5094.patch"
+sha512sums="408f093a6674ef2316c451173481851041957617c550308d2969b983e11d988ddfc120626cd957c0759648bc357edf1d9971e6d46bed109c2af5f8a09bdc5bda  e2fsprogs-1.45.4.tar.xz
+34ca45c64a132bb4b507cd4ffb763c6d1b7979eccfed20f63417e514871b47639d32f2a3ecff090713c21a0f02ac503d5093960c80401d64081c592d01af279d  header-fix.patch"
diff --git a/system/e2fsprogs/CVE-2019-5094.patch b/system/e2fsprogs/CVE-2019-5094.patch
deleted file mode 100644
index 21baf660a..000000000
--- a/system/e2fsprogs/CVE-2019-5094.patch
+++ /dev/null
@@ -1,211 +0,0 @@
-From 8dbe7b475ec5e91ed767239f0e85880f416fc384 Mon Sep 17 00:00:00 2001
-From: Theodore Ts'o <tytso@mit.edu>
-Date: Sun, 1 Sep 2019 00:59:16 -0400
-Subject: libsupport: add checks to prevent buffer overrun bugs in quota code
-
-A maliciously corrupted file systems can trigger buffer overruns in
-the quota code used by e2fsck.  To fix this, add sanity checks to the
-quota header fields as well as to block number references in the quota
-tree.
-
-Addresses: CVE-2019-5094
-Addresses: TALOS-2019-0887
-Signed-off-by: Theodore Ts'o <tytso@mit.edu>
----
- lib/support/mkquota.c      |  1 +
- lib/support/quotaio_tree.c | 71 ++++++++++++++++++++++++++++++----------------
- lib/support/quotaio_v2.c   | 28 ++++++++++++++++++
- 3 files changed, 76 insertions(+), 24 deletions(-)
-
-diff --git a/lib/support/mkquota.c b/lib/support/mkquota.c
-index 0b9e7665..ddb53124 100644
---- a/lib/support/mkquota.c
-+++ b/lib/support/mkquota.c
-@@ -671,6 +671,7 @@ errcode_t quota_compare_and_update(quota_ctx_t qctx, enum quota_type qtype,
- 	err = qh.qh_ops->scan_dquots(&qh, scan_dquots_callback, &scan_data);
- 	if (err) {
- 		log_debug("Error scanning dquots");
-+		*usage_inconsistent = 1;
- 		goto out_close_qh;
- 	}
- 
-diff --git a/lib/support/quotaio_tree.c b/lib/support/quotaio_tree.c
-index a7c2028c..6cc4fb5b 100644
---- a/lib/support/quotaio_tree.c
-+++ b/lib/support/quotaio_tree.c
-@@ -540,6 +540,17 @@ struct dquot *qtree_read_dquot(struct quota_handle *h, qid_t id)
- 	return dquot;
- }
- 
-+static int check_reference(struct quota_handle *h, unsigned int blk)
-+{
-+	if (blk >= h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks) {
-+		log_err("Illegal reference (%u >= %u) in %s quota file",
-+			blk, h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks,
-+			quota_type2name(h->qh_type));
-+		return -1;
-+	}
-+	return 0;
-+}
-+
- /*
-  * Scan all dquots in file and call callback on each
-  */
-@@ -558,7 +569,7 @@ static int report_block(struct dquot *dquot, unsigned int blk, char *bitmap,
- 	int entries, i;
- 
- 	if (!buf)
--		return 0;
-+		return -1;
- 
- 	set_bit(bitmap, blk);
- 	read_blk(dquot->dq_h, blk, buf);
-@@ -580,23 +591,12 @@ static int report_block(struct dquot *dquot, unsigned int blk, char *bitmap,
- 	return entries;
- }
- 
--static void check_reference(struct quota_handle *h, unsigned int blk)
--{
--	if (blk >= h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks)
--		log_err("Illegal reference (%u >= %u) in %s quota file. "
--			"Quota file is probably corrupted.\n"
--			"Please run e2fsck (8) to fix it.",
--			blk,
--			h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks,
--			quota_type2name(h->qh_type));
--}
--
- static int report_tree(struct dquot *dquot, unsigned int blk, int depth,
- 		       char *bitmap,
- 		       int (*process_dquot) (struct dquot *, void *),
- 		       void *data)
- {
--	int entries = 0, i;
-+	int entries = 0, ret, i;
- 	dqbuf_t buf = getdqbuf();
- 	__le32 *ref = (__le32 *) buf;
- 
-@@ -607,22 +607,40 @@ static int report_tree(struct dquot *dquot, unsigned int blk, int depth,
- 	if (depth == QT_TREEDEPTH - 1) {
- 		for (i = 0; i < QT_BLKSIZE >> 2; i++) {
- 			blk = ext2fs_le32_to_cpu(ref[i]);
--			check_reference(dquot->dq_h, blk);
--			if (blk && !get_bit(bitmap, blk))
--				entries += report_block(dquot, blk, bitmap,
--							process_dquot, data);
-+			if (check_reference(dquot->dq_h, blk)) {
-+				entries = -1;
-+				goto errout;
-+			}
-+			if (blk && !get_bit(bitmap, blk)) {
-+				ret = report_block(dquot, blk, bitmap,
-+						   process_dquot, data);
-+				if (ret < 0) {
-+					entries = ret;
-+					goto errout;
-+				}
-+				entries += ret;
-+			}
- 		}
- 	} else {
- 		for (i = 0; i < QT_BLKSIZE >> 2; i++) {
- 			blk = ext2fs_le32_to_cpu(ref[i]);
- 			if (blk) {
--				check_reference(dquot->dq_h, blk);
--				entries += report_tree(dquot, blk, depth + 1,
--						       bitmap, process_dquot,
--						       data);
-+				if (check_reference(dquot->dq_h, blk)) {
-+					entries = -1;
-+					goto errout;
-+				}
-+				ret = report_tree(dquot, blk, depth + 1,
-+						  bitmap, process_dquot,
-+						  data);
-+				if (ret < 0) {
-+					entries = ret;
-+					goto errout;
-+				}
-+				entries += ret;
- 			}
- 		}
- 	}
-+errout:
- 	freedqbuf(buf);
- 	return entries;
- }
-@@ -642,6 +660,7 @@ int qtree_scan_dquots(struct quota_handle *h,
- 		      int (*process_dquot) (struct dquot *, void *),
- 		      void *data)
- {
-+	int ret;
- 	char *bitmap;
- 	struct v2_mem_dqinfo *v2info = &h->qh_info.u.v2_mdqi;
- 	struct qtree_mem_dqinfo *info = &v2info->dqi_qtree;
-@@ -655,10 +674,14 @@ int qtree_scan_dquots(struct quota_handle *h,
- 		ext2fs_free_mem(&dquot);
- 		return -1;
- 	}
--	v2info->dqi_used_entries = report_tree(dquot, QT_TREEOFF, 0, bitmap,
--					       process_dquot, data);
-+	ret = report_tree(dquot, QT_TREEOFF, 0, bitmap, process_dquot, data);
-+	if (ret < 0)
-+		goto errout;
-+	v2info->dqi_used_entries = ret;
- 	v2info->dqi_data_blocks = find_set_bits(bitmap, info->dqi_blocks);
-+	ret = 0;
-+errout:
- 	ext2fs_free_mem(&bitmap);
- 	ext2fs_free_mem(&dquot);
--	return 0;
-+	return ret;
- }
-diff --git a/lib/support/quotaio_v2.c b/lib/support/quotaio_v2.c
-index 38be2a34..73906676 100644
---- a/lib/support/quotaio_v2.c
-+++ b/lib/support/quotaio_v2.c
-@@ -175,6 +175,8 @@ static int v2_check_file(struct quota_handle *h, int type, int fmt)
- static int v2_init_io(struct quota_handle *h)
- {
- 	struct v2_disk_dqinfo ddqinfo;
-+	struct v2_mem_dqinfo *info;
-+	__u64 filesize;
- 
- 	h->qh_info.u.v2_mdqi.dqi_qtree.dqi_entry_size =
- 		sizeof(struct v2r1_disk_dqblk);
-@@ -185,6 +187,32 @@ static int v2_init_io(struct quota_handle *h)
- 			 sizeof(ddqinfo)) != sizeof(ddqinfo))
- 		return -1;
- 	v2_disk2memdqinfo(&h->qh_info, &ddqinfo);
-+
-+	/* Check to make sure quota file info is sane */
-+	info = &h->qh_info.u.v2_mdqi;
-+	if (ext2fs_file_get_lsize(h->qh_qf.e2_file, &filesize))
-+		return -1;
-+	if ((filesize > (1U << 31)) ||
-+	    (info->dqi_qtree.dqi_blocks >
-+	     (filesize + QT_BLKSIZE - 1) >> QT_BLKSIZE_BITS)) {
-+		log_err("Quota inode %u corrupted: file size %llu; "
-+			"dqi_blocks %u", h->qh_qf.ino,
-+			filesize, info->dqi_qtree.dqi_blocks);
-+		return -1;
-+	}
-+	if (info->dqi_qtree.dqi_free_blk >= info->dqi_qtree.dqi_blocks) {
-+		log_err("Quota inode %u corrupted: free_blk %u; dqi_blocks %u",
-+			h->qh_qf.ino, info->dqi_qtree.dqi_free_blk,
-+			info->dqi_qtree.dqi_blocks);
-+		return -1;
-+	}
-+	if (info->dqi_qtree.dqi_free_entry >= info->dqi_qtree.dqi_blocks) {
-+		log_err("Quota inode %u corrupted: free_entry %u; "
-+			"dqi_blocks %u", h->qh_qf.ino,
-+			info->dqi_qtree.dqi_free_entry,
-+			info->dqi_qtree.dqi_blocks);
-+		return -1;
-+	}
- 	return 0;
- }
- 
--- 
-cgit 1.2-0.3.lf.el7
-