Skip to content

Commit 5177e01

Browse files
[AUTO-CHERRYPICK] Patch javapackages-bootstrap for CVE-2021-36373 [Medium], CVE-2021-36374 [Medium] - branch main (#12666)
Co-authored-by: kgodara912 <kshigodara@outlook.com>
1 parent 5e63d8e commit 5177e01

3 files changed

Lines changed: 132 additions & 1 deletion

File tree

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
From 1fa58fb3a05631cb019340ff429de2c85a214b29 Mon Sep 17 00:00:00 2001
2+
From: Stefan Bodewig <bodewig@apache.org>
3+
Date: Sat, 10 Jul 2021 11:10:12 +0200
4+
Subject: [PATCH] port some fixes from Commons Compress
5+
6+
---
7+
.../org/apache/tools/tar/TarInputStream.java | 7 +++++--
8+
.../org/apache/tools/zip/AsiExtraField.java | 12 +++++++----
9+
src/main/org/apache/tools/zip/ZipFile.java | 20 ++++++++++++++++++-
10+
3 files changed, 32 insertions(+), 7 deletions(-)
11+
12+
diff --git a/src/main/org/apache/tools/tar/TarInputStream.java b/src/main/org/apache/tools/tar/TarInputStream.java
13+
index 0477d5c..71e4cc0 100644
14+
--- a/src/main/org/apache/tools/tar/TarInputStream.java
15+
+++ b/src/main/org/apache/tools/tar/TarInputStream.java
16+
@@ -436,11 +436,13 @@ public class TarInputStream extends FilterInputStream {
17+
String keyword = coll.toString("UTF-8");
18+
// Get rest of entry
19+
final int restLen = len - read;
20+
- byte[] rest = new byte[restLen];
21+
+ ByteArrayOutputStream bos = new ByteArrayOutputStream();
22+
int got = 0;
23+
while (got < restLen && (ch = i.read()) != -1) {
24+
- rest[got++] = (byte) ch;
25+
+ bos.write((byte) ch);
26+
+ got++;
27+
}
28+
+ bos.close();
29+
if (got != restLen) {
30+
throw new IOException("Failed to read "
31+
+ "Paxheader. Expected "
32+
@@ -448,6 +450,7 @@ public class TarInputStream extends FilterInputStream {
33+
+ " bytes, read "
34+
+ got);
35+
}
36+
+ byte[] rest = bos.toByteArray();
37+
// Drop trailing NL
38+
String value = new String(rest, 0,
39+
restLen - 1, StandardCharsets.UTF_8);
40+
diff --git a/src/main/org/apache/tools/zip/AsiExtraField.java b/src/main/org/apache/tools/zip/AsiExtraField.java
41+
index 8afddb5..fdd81c6 100644
42+
--- a/src/main/org/apache/tools/zip/AsiExtraField.java
43+
+++ b/src/main/org/apache/tools/zip/AsiExtraField.java
44+
@@ -307,14 +307,18 @@ public class AsiExtraField implements ZipExtraField, UnixStat, Cloneable {
45+
46+
int newMode = ZipShort.getValue(tmp, 0);
47+
// CheckStyle:MagicNumber OFF
48+
- byte[] linkArray = new byte[(int) ZipLong.getValue(tmp, 2)];
49+
+ final int linkArrayLength = (int) ZipLong.getValue(tmp, 2);
50+
+ if (linkArrayLength < 0 || linkArrayLength > tmp.length - 10) {
51+
+ throw new ZipException("Bad symbolic link name length " + linkArrayLength
52+
+ + " in ASI extra field");
53+
+ }
54+
uid = ZipShort.getValue(tmp, 6);
55+
gid = ZipShort.getValue(tmp, 8);
56+
-
57+
- if (linkArray.length == 0) {
58+
+ if (linkArrayLength == 0) {
59+
link = "";
60+
} else {
61+
- System.arraycopy(tmp, 10, linkArray, 0, linkArray.length);
62+
+ final byte[] linkArray = new byte[linkArrayLength];
63+
+ System.arraycopy(tmp, 10, linkArray, 0, linkArrayLength);
64+
link = new String(linkArray); // Uses default charset - see class Javadoc
65+
}
66+
// CheckStyle:MagicNumber ON
67+
diff --git a/src/main/org/apache/tools/zip/ZipFile.java b/src/main/org/apache/tools/zip/ZipFile.java
68+
index dfb6bcf..8806ae7 100644
69+
--- a/src/main/org/apache/tools/zip/ZipFile.java
70+
+++ b/src/main/org/apache/tools/zip/ZipFile.java
71+
@@ -541,6 +541,9 @@ public class ZipFile implements Closeable {
72+
ze.setExternalAttributes(ZipLong.getValue(CFH_BUF, off));
73+
off += WORD;
74+
75+
+ if (archive.length() - archive.getFilePointer() < fileNameLen) {
76+
+ throw new EOFException();
77+
+ }
78+
final byte[] fileName = new byte[fileNameLen];
79+
archive.readFully(fileName);
80+
ze.setName(entryEncoding.decode(fileName), fileName);
81+
@@ -550,12 +553,18 @@ public class ZipFile implements Closeable {
82+
// data offset will be filled later
83+
entries.add(ze);
84+
85+
+ if (archive.length() - archive.getFilePointer() < extraLen) {
86+
+ throw new EOFException();
87+
+ }
88+
final byte[] cdExtraData = new byte[extraLen];
89+
archive.readFully(cdExtraData);
90+
ze.setCentralDirectoryExtra(cdExtraData);
91+
92+
setSizesAndOffsetFromZip64Extra(ze, offset, diskStart);
93+
94+
+ if (archive.length() - archive.getFilePointer() < commentLen) {
95+
+ throw new EOFException();
96+
+ }
97+
final byte[] comment = new byte[commentLen];
98+
archive.readFully(comment);
99+
ze.setComment(entryEncoding.decode(comment));
100+
@@ -881,9 +890,18 @@ public class ZipFile implements Closeable {
101+
}
102+
lenToSkip -= skipped;
103+
}
104+
+ if (archive.length() - archive.getFilePointer() < extraFieldLen) {
105+
+ throw new EOFException();
106+
+ }
107+
final byte[] localExtraData = new byte[extraFieldLen];
108+
archive.readFully(localExtraData);
109+
- ze.setExtra(localExtraData);
110+
+ try {
111+
+ ze.setExtra(localExtraData);
112+
+ } catch (RuntimeException ex) {
113+
+ final ZipException z = new ZipException("Invalid extra data in entry " + ze.getName());
114+
+ z.initCause(ex);
115+
+ throw z;
116+
+ }
117+
offsetEntry.dataOffset = offset + LFH_OFFSET_FOR_FILENAME_LENGTH
118+
+ SHORT + SHORT + fileNameLen + extraFieldLen;
119+
120+
--
121+
2.34.1
122+
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Addressed as part of CVE-2021-36373.patch

SPECS/javapackages-bootstrap/javapackages-bootstrap.spec

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
Name: javapackages-bootstrap
1515
Version: 1.5.0
16-
Release: 5%{?dist}
16+
Release: 6%{?dist}
1717
Summary: A means of bootstrapping Java Packages Tools
1818
# For detailed info see the file javapackages-bootstrap-PACKAGE-LICENSING
1919
License: ASL 2.0 and ASL 1.1 and (ASL 2.0 or EPL-2.0) and (EPL-2.0 or GPLv2 with exceptions) and MIT and (BSD with advertising) and BSD-3-Clause and EPL-1.0 and EPL-2.0 and CDDL-1.0 and xpp and CC0 and Public Domain
@@ -140,6 +140,7 @@ Patch0: 0001-Bind-to-OpenJDK-11-for-runtime.patch
140140
Patch1: 0001-Remove-usage-of-ArchiveStreamFactory.patch
141141
Patch2: CVE-2023-37460.patch
142142
Patch3: Internal-Java-API.patch
143+
Patch4: CVE-2021-36373.patch
143144

144145
Provides: bundled(ant) = 1.10.9
145146
Provides: bundled(apache-parent) = 23
@@ -300,6 +301,10 @@ pushd "downstream/plexus-archiver"
300301
%patch2 -p1
301302
popd
302303

304+
pushd "downstream/ant"
305+
%patch4 -p1
306+
popd
307+
303308
# remove guava.xml from javapackage-bootstrap 1.5.0
304309
# import guava.xml 32.1.3 from Fedora 40
305310
# edit version from guava.properties
@@ -384,6 +389,9 @@ sed -i 's|/usr/lib/jvm/java-11-openjdk|%{java_home}|' %{buildroot}%{launchersPat
384389
%doc AUTHORS
385390

386391
%changelog
392+
* Wed Feb 26 2025 Kshitiz Godara <kgodara@microsoft.com> - 1.5.0-6
393+
- Patch CVE-2021-36373 and CVE-2021-36374.
394+
387395
* Fri Mar 22 2024 Riken Maharjan <rmaharjan@microsoft.com> - 1.5.0-5
388396
- Update Guava to fix CVE-2023-2976 using Fedora 40 (License: MIT).
389397

0 commit comments

Comments
 (0)