diff options
| -rw-r--r-- | utils/tar/Makefile | 10 | ||||
| -rw-r--r-- | utils/tar/patches/001-CVE-2016-6321.patch | 30 |
2 files changed, 5 insertions, 35 deletions
diff --git a/utils/tar/Makefile b/utils/tar/Makefile index bae2adcd4..fb5277091 100644 --- a/utils/tar/Makefile +++ b/utils/tar/Makefile @@ -1,5 +1,5 @@ # -# Copyright (C) 2008-2016 OpenWrt.org +# Copyright (C) 2008-2017 OpenWrt.org # # This is free software, licensed under the GNU General Public License v2. # See /LICENSE for more information. @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=tar -PKG_VERSION:=1.29 -PKG_RELEASE:=3 +PKG_VERSION:=1.30 +PKG_RELEASE:=1 -PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=@GNU/$(PKG_NAME) -PKG_HASH:=236b11190c0a3a6885bdb8d61424f2b36a5872869aa3f7f695dea4b4843ae2f2 +PKG_HASH:=f1bf92dbb1e1ab27911a861ea8dde8208ee774866c46c0bb6ead41f4d1f4d2d3 PKG_MAINTAINER:=Álvaro Fernández Rojas <noltari@gmail.com> PKG_LICENSE:=GPL-3.0 diff --git a/utils/tar/patches/001-CVE-2016-6321.patch b/utils/tar/patches/001-CVE-2016-6321.patch deleted file mode 100644 index 078347376..000000000 --- a/utils/tar/patches/001-CVE-2016-6321.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 7340f67b9860ea0531c1450e5aa261c50f67165d Mon Sep 17 00:00:00 2001 -From: Paul Eggert <eggert@Penguin.CS.UCLA.EDU> -Date: Sat, 29 Oct 2016 21:04:40 -0700 -Subject: When extracting, skip ".." members - -* src/extract.c (extract_archive): Skip members whose names -contain "..". ---- a/src/extract.c -+++ b/src/extract.c -@@ -1629,12 +1629,20 @@ extract_archive (void) - { - char typeflag; - tar_extractor_t fun; -+ bool skip_dotdot_name; - - fatal_exit_hook = extract_finish; - - set_next_block_after (current_header); - -+ skip_dotdot_name = (!absolute_names_option -+ && contains_dot_dot (current_stat_info.orig_file_name)); -+ if (skip_dotdot_name) -+ ERROR ((0, 0, _("%s: Member name contains '..'"), -+ quotearg_colon (current_stat_info.orig_file_name))); -+ - if (!current_stat_info.file_name[0] -+ || skip_dotdot_name - || (interactive_option - && !confirm ("extract", current_stat_info.file_name))) - { |