cpio: unbundle patch (fetch from my GitHub acct.)

pkgs/tools/archivers/cpio/CVE-2015-1197-cpio-2.12.patch

···
-Original: https://marc.info/?l=oss-security&m=142289947619786&w=2
-
-Re-applied to 2.12 by Tobias Geerinckx-Rice
-<[e-mail]> - any bugs are (probably) mine.
-
-diff -Naur cpio-2.12a/doc/cpio.1 cpio-2.12b/doc/cpio.1
---- cpio-2.12a/doc/cpio.1	2015-09-12 12:57:30.000000000 +0200
-+++ cpio-2.12b/doc/cpio.1	2015-09-18 05:35:48.158146735 +0200
-@@ -29,6 +29,7 @@
- [\fB\-\-block\-size=\fIblocks\fR] [\fB\-\-dereference\fR]
- [\fB\-\-io\-size=\fIBYTES\fR] [\fB\-\-quiet\fR]
- [\fB\-\-force\-local\fR] [\fB\-\-rsh\-command=\fICOMMAND\fR]
-+[\fB\-\-extract\-over\-symlinks]
- \fB<\fR \fIname-list\fR [\fB>\fR \fIarchive\fR]
- 
- .B cpio
-diff -Naur cpio-2.12a/src/copyin.c cpio-2.12b/src/copyin.c
---- cpio-2.12a/src/copyin.c	2015-09-12 12:57:30.000000000 +0200
-+++ cpio-2.12b/src/copyin.c	2015-09-18 05:31:22.088544481 +0200
-@@ -695,6 +695,50 @@
-   free (link_name);
- }
- 
-+static int
-+path_contains_symlink(char *path)
-+{
-+  struct stat st;
-+  char *slash;
-+  char *nextslash;
-+
-+  /* we got NULL pointer or empty string */
-+  if (!path || !*path) {
-+    return false;
-+  }
-+
-+  slash = path;
-+
-+  while ((nextslash = strchr(slash + 1, '/')) != NULL) {
-+    slash = nextslash;
-+    *slash = '\0';
-+
-+    if (lstat(path, &st) != 0) {
-+      if (errno == ELOOP) {
-+        /* ELOOP - too many symlinks */
-+        *slash = '/';
-+        return true;
-+      } else if (errno == ENOMEM) {
-+        /* No memory for lstat - terminate */
-+        xalloc_die();
-+      } else {
-+        /* cannot lstat path - give up */
-+        *slash = '/';
-+        return false;
-+      }
-+    }
-+
-+    if (S_ISLNK(st.st_mode)) {
-+      *slash = '/';
-+      return true;
-+    }
-+
-+    *slash = '/';
-+  }
-+
-+  return false;
-+}
-+
- static void
- copyin_file (struct cpio_file_stat *file_hdr, int in_file_des)
- {
-@@ -1468,6 +1512,23 @@
- 	{
- 	  /* Copy the input file into the directory structure.  */
- 
-+          /* Can we write files over symlinks? */
-+          if (!extract_over_symlinks)
-+            {
-+              if (path_contains_symlink(file_hdr.c_name))
-+                {
-+                  /* skip the file */
-+                  /*
-+                  fprintf(stderr, "Can't write over symlinks. Skipping %s\n", file_hdr.c_name);
-+                  tape_toss_input (in_file_des, file_hdr.c_filesize);
-+                  tape_skip_padding (in_file_des, file_hdr.c_filesize);
-+                  continue;
-+                  */
-+                  /* terminate */
-+	          error (1, 0, _("Can't write over symlinks: %s\n"), file_hdr.c_name);
-+                }
-+            }
-+
- 	  /* Do we need to rename the file? */
- 	  if (rename_flag || rename_batch_file)
- 	    {
-diff -Naur cpio-2.12a/src/extern.h cpio-2.12b/src/extern.h
---- cpio-2.12a/src/extern.h	2015-09-12 12:57:30.000000000 +0200
-+++ cpio-2.12b/src/extern.h	2015-09-18 05:34:45.208241420 +0200
-@@ -96,6 +96,7 @@
- extern char output_is_special;
- extern char input_is_seekable;
- extern char output_is_seekable;
-+extern bool extract_over_symlinks;
- extern int (*xstat) ();
- extern void (*copy_function) ();
- extern char *change_directory_option;
-diff -Naur cpio-2.12a/src/global.c cpio-2.12b/src/global.c
---- cpio-2.12a/src/global.c	2015-09-12 12:57:30.000000000 +0200
-+++ cpio-2.12b/src/global.c	2015-09-18 05:32:00.598487355 +0200
-@@ -187,6 +187,9 @@
- /* The name this program was run with.  */
- char *program_name;
- 
-+/* Extract files over symbolic links */
-+bool extract_over_symlinks;
-+
- /* A pointer to either lstat or stat, depending on whether
-    dereferencing of symlinks is done for input files.  */
- int (*xstat) ();
-diff -Naur cpio-2.12a/src/main.c cpio-2.12b/src/main.c
---- cpio-2.12a/src/main.c	2015-09-12 12:57:30.000000000 +0200
-+++ cpio-2.12b/src/main.c	2015-09-18 05:34:20.018279218 +0200
-@@ -59,6 +59,7 @@
-   DEBUG_OPTION,                  
-   BLOCK_SIZE_OPTION,             
-   TO_STDOUT_OPTION,
-+  EXTRACT_OVER_SYMLINKS,
-   RENUMBER_INODES_OPTION,
-   IGNORE_DEVNO_OPTION,
-   DEVICE_INDEPENDENT_OPTION
-@@ -243,6 +244,8 @@
-    N_("Create leading directories where needed"), GRID+1 },
-   {"no-preserve-owner", NO_PRESERVE_OWNER_OPTION, 0, 0,
-    N_("Do not change the ownership of the files"), GRID+1 },
-+  {"extract-over-symlinks", EXTRACT_OVER_SYMLINKS, 0, 0,
-+   N_("Force writing over symbolic links"), GRID+1 },
-   {"unconditional", 'u', NULL, 0,
-    N_("Replace all files unconditionally"), GRID+1 },
-   {"sparse", SPARSE_OPTION, NULL, 0,
-@@ -432,6 +435,10 @@
-       no_chown_flag = true;
-       break;
- 
-+    case EXTRACT_OVER_SYMLINKS:		        /* --extract-over-symlinks */
-+      extract_over_symlinks = true;
-+      break;
-+
-     case 'o':		/* Copy-out mode.  */
-       if (copy_function != 0)
- 	USAGE_ERROR ((0, 0, _("Mode already defined")));

pkgs/tools/archivers/cpio/default.nix

···
     sha256 = "0vi9q475h1rki53100zml75vxsykzyhrn70hidy41s5c2rc8r6bh";
   };
 
-  patches = [ ./CVE-2015-1197-cpio-2.12.patch ];
+  patches = [
+    (fetchpatch {
+      name = "CVE-2015-1197-cpio-2.12.patch";
+      url = "https://gist.github.com/nckx/70b0bfa80ddfb86c2967/"
+        + "raw/e9b40d4d4b701f584f826775b75beb10751dc884/"
+        + "CVE-2015-1197-cpio-2.12.patch";
+      sha256 = "0ph43m4lavwkc4gnl5h9p3da4kb1pnhwk5l2qsky70dqri8pcr8v";
+    })
+  ];
 
   preConfigure = if stdenv.isCygwin then ''
     sed -i gnu/fpending.h -e 's,include <stdio_ext.h>,,'