13 Nov, 2013
1 commit
-
getenv() may return NULL if given environment variable does not exist
which leads to NULL dereference when calling strncat.Besides that, the environment variable name was copied to a temporary
env_var buffer, but this copying can be avoided by simply using the input
string.Lastly, the whole loop can be greatly simplified by using the snprintf
function instead of the playing with strncat.By the way, the current implementation allows a recursive variable
expansion, as in:$ echo 'out ${A} out ' | A='a ${B} a' B=b /tmp/a
out a b a outI'm assuming this is just a side effect and not a conscious decision
(especially as this may lead to infinite loop), but I didn't want to
change this behaviour without consulting.If the current behaviour is deamed incorrect, I'll be happy to send
a patch without recursive processing.Signed-off-by: Michal Nazarewicz
Cc: Kees Cook
Cc: Jiri Kosina
Cc: Jesper Juhl
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
19 Nov, 2012
1 commit
-
Just a completely trivial patch to remove a completely redundant blank
line from usr/gen_init_cpio.cSigned-off-by: Jesper Juhl
Signed-off-by: Jiri Kosina
26 Oct, 2012
1 commit
-
Fix possible overflow of the buffer used for expanding environment
variables when building file list.In the extremely unlikely case of an attacker having control over the
environment variables visible to gen_init_cpio, control over the
contents of the file gen_init_cpio parses, and gen_init_cpio was built
without compiler hardening, the attacker can gain arbitrary execution
control via a stack buffer overflow.$ cat usr/crash.list
file foo ${BIG}${BIG}${BIG}${BIG}${BIG}${BIG} 0755 0 0
$ BIG=$(perl -e 'print "A" x 4096;') ./usr/gen_init_cpio usr/crash.list
*** buffer overflow detected ***: ./usr/gen_init_cpio terminatedThis also replaces the space-indenting with tabs.
Patch based on existing fix extracted from grsecurity.
Signed-off-by: Kees Cook
Cc: Michal Marek
Cc: Brad Spengler
Cc: PaX Team
Cc:
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
18 Apr, 2011
1 commit
-
gen_init_cpio gets the current time and uses it for each symlink,
special file, and directory. Grab the current time once and make it
possible to override it with the KBUILD_BUILD_TIMESTAMP variable for
reproducible builds.Signed-off-by: Michal Marek
06 Jan, 2011
1 commit
-
Cc: Jesper Juhl
Cc: Michal Marek
Signed-off-by: Andrew Morton
Signed-off-by: Michal Marek
29 Dec, 2010
1 commit
-
In usr/gen_init_cpio.c::cpio_mkfile() a call to stat() is made based on
pathname, subsequently the file is open()'ed and then the value of the
initial stat() call is used to allocate a buffer. This is not safe since
the file may change between the call to stat() and the call to open().
Safer to just open() the file and then do fstat() using the filedescriptor
returned by open.Signed-off-by: Jesper Juhl
Acked-by: Jeff Garzik
Signed-off-by: Michal Marek
02 Dec, 2010
1 commit
-
When we extracted the generated cpio archive using "cpio -id" command,
it complained,cpio: Removing leading `/' from member names
var/run
cpio: Removing leading `/' from member names
var/lib
cpio: Removing leading `/' from member names
var/lib/miscIt is worse with the latest "cpio" or "pax", which tries to overwrite
the host file system with the leading '/'.So the leading '/' of file names should be removed. This is consistent
with the initramfs come with major distributions such as Fedora or
Debian, etc.Signed-off-by: Thomas Chou
Acked-by: Mike Frysinger
Signed-off-by: Michal Marek
12 Dec, 2009
1 commit
-
On compilers with security warnings enabled by default, we get:
usr/gen_init_cpio.c: In function ‘cpio_mkfile’:
usr/gen_init_cpio.c:357: warning: ignoring return value of ‘fwrite’,
declared with attribute warn_unused_resultSo check the return value and handle errors accordingly.
Signed-off-by: Mike Frysinger
Signed-off-by: Michal Marek
23 Sep, 2009
1 commit
-
Signed-off-by: Trevor Keith
Cc: Sam Ravnborg
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
04 Dec, 2008
1 commit
-
Modify gen_init_cpio so that lines that specify files can contain
what looks like a shell variable that's expanded during processing.For example:
file /sbin/kinit ${RFS_BASE}/usr/src/klibc/kinit/kinit 0755 0 0
given RFS_BASE is "/some/directory" in the environment
would be expanded to
file /sbin/kinit /some/directory/usr/src/klibc/kinit/kinit 0755 0 0
If several environment variables appear in a line, they are all expanded
with processing happening from left to right.
Undefined variables expand to a null string.
Syntax errors stop processing, letting the existing error handling
show the user offending line.This patch helps embedded folks who frequently create several
RFS directories and then switch between them as they're tuning
an initramfs.Signed-off-by: gene.sally@timesys.com
Signed-off-by: Sam Ravnborg
17 Jul, 2007
1 commit
-
Treat an argument of "-" as meaning "read stdin for cpio files" so
gen_init_cpio can be piped into.Signed-off-by: Mike Frysinger
Signed-off-by: Andrew Morton
Signed-off-by: Sam Ravnborg
12 Feb, 2007
1 commit
-
Extend usr/gen_init_cpio.c "file" entry, adding support for hard links.
Previous format:
fileNew format:
file []The hard links specification is optional, keeping the previous
behaviour.All hard links are defined sequentially in the resulting cpio and the
file data is present only in the last link. This is the behaviour of
GNU's cpio and is supported by the kernel initramfs extractor.Signed-off-by: Luciano Rocha
Cc: Al Viro
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
20 Apr, 2006
1 commit
-
Fix potential NULL pointer deref in gen_init_cpio.c spotted by coverity
checker. This fixes coverity bug #86Without this patch we risk dereferencing a NULL `type' in the
"if ('\n' == *type) {" line.Signed-off-by: Jesper Juhl
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
17 Apr, 2005
1 commit
-
Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.Let it rip!