unofficial mirror of guix-patches@gnu.org 
 help / color / mirror / code / Atom feed
blob 2b9a9e2ffed01cf5241ea140c959d617db71b5b6 1493 bytes (raw)
name: gnu/packages/patches/libarchive-remove-potential-backdoor.patch 	 # note: path name is non-authoritative(*)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
Remove code added by 'JiaT75', the malicious actor that backdoored `xz`:

https://github.com/libarchive/libarchive/pull/2101

At libarchive, they are reviewing all code contributed by this actor:

https://github.com/libarchive/libarchive/issues/2103

See the original disclosure and subsequent discussion for more
information about this incident:

https://seclists.org/oss-sec/2024/q1/268

Patch copied from upstream source repository:

https://github.com/libarchive/libarchive/pull/2101/commits/e200fd8abfb4cf895a1cab4d89b67e6eefe83942

From 6110e9c82d8ba830c3440f36b990483ceaaea52c Mon Sep 17 00:00:00 2001
From: Ed Maste <emaste@freebsd.org>
Date: Fri, 29 Mar 2024 18:02:06 -0400
Subject: [PATCH] tar: make error reporting more robust and use correct errno
 (#2101)

As discussed in #1609.
---
 tar/read.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tar/read.c b/tar/read.c
index af3d3f42..a7f14a07 100644
--- a/tar/read.c
+++ b/tar/read.c
@@ -371,8 +371,9 @@ read_archive(struct bsdtar *bsdtar, char mode, struct archive *writer)
 			if (r != ARCHIVE_OK) {
 				if (!bsdtar->verbose)
 					safe_fprintf(stderr, "%s", archive_entry_pathname(entry));
-				fprintf(stderr, ": %s: ", archive_error_string(a));
-				fprintf(stderr, "%s", strerror(errno));
+				safe_fprintf(stderr, ": %s: %s",
+				    archive_error_string(a),
+				    strerror(archive_errno(a)));
 				if (!bsdtar->verbose)
 					fprintf(stderr, "\n");
 				bsdtar->return_value = 1;
-- 
2.41.0


debug log:

solving 2b9a9e2ffe ...
found 2b9a9e2ffe in https://git.savannah.gnu.org/cgit/guix.git

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).