Re: [Buildroot] [PATCH] package/cramfs: bump to version 2.2

On 15/08/26 12:03, Thomas Petazzoni via buildroot wrote:
> Changes:
>
> Security and robustness release.  Notable cramfsck changes:
>
>    * Reject dirent names containing "/", "." or ".." to close a path
>      traversal during `cramfsck -x` (reported in issue #12).
>    * Open regular files with O_CREAT|O_EXCL during extraction to
>      prevent duplicate-dirent attacks from truncating files reached
>      via a previously-extracted symlink.
>    * Fix outbuffer NUL termination and a 1-byte overflow in
>      do_symlink when running with both -v and -x.
>    * Harden romfs_read against truncated/malformed images by
>      zero-filling the window buffer and checking lseek/read returns.
>    * Reject directory entries that extend past their parent's size.
>
> Documentation: README now documents cramfsck and lists all current
> mkcramfs options; stale hard-link and endianness claims corrected;
> NOTES trimmed of the 25-year-old Future Development section.
>
> (See https://github.com/npitre/cramfs-tools/releases/tag/v2.2)
>
> Signed-off-by: Thomas Petazzoni <[email protected]>
Applied to 2025.02.x and 2026.05.x, thanks !
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot