From 1107712e372f7593ad729764c0c2644d0e4aa675 Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Mon, 8 Apr 2024 15:32:58 +0300 Subject: Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094). While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines. - On machines that see lots bots poking at the SSH port, the backdoor noticeably increased CPU load, resulting in degraded user experience and thus overwhelmingly negative user feedback. - The maintainer who added the backdoor has disappeared. - Backdoors are bad for security. This reverts the following without making any other changes: 6e636819 Tests: Update two test files. a3a29bbd Tests: Test --single-stream can decompress bad-3-corrupt_lzma2.xz. 0b4ccc91 Tests: Update RISC-V test files. 8c9b8b20 liblzma: Fix typos in crc32_fast.c and crc64_fast.c. 82ecc538 liblzma: Fix false Valgrind error report with GCC. cf44e4b7 Tests: Add a few test files. 3060e107 Tests: Use smaller dictionary size in RISC-V test files. e2870db5 Tests: Add two RISC-V Filter test files. The RISC-V test files also have real content that tests the filter but the real content would fit into much smaller files. A generator program would need to be available as well. Thanks to Andres Freund for finding and reporting it and making it public quickly so others could act without a delay. See: https://www.openwall.com/lists/oss-security/2024/03/29/4 --- src/liblzma/check/crc64_fast.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src/liblzma/check/crc64_fast.c') diff --git a/src/liblzma/check/crc64_fast.c b/src/liblzma/check/crc64_fast.c index 52cddb2c..5728b45e 100644 --- a/src/liblzma/check/crc64_fast.c +++ b/src/liblzma/check/crc64_fast.c @@ -98,7 +98,9 @@ typedef uint64_t (*crc64_func_type)( # pragma GCC diagnostic ignored "-Wunused-function" #endif -lzma_resolver_attributes +#ifdef CRC_USE_IFUNC +__attribute__((__no_profile_instrument_function__)) +#endif static crc64_func_type crc64_resolve(void) { -- cgit v1.2.3