18 changed files with 1179 additions and 90 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/4.4-git.1.tar.gz
+SOURCES/squashfs4.3.tar.gz
--- a/.squashfs-tools.metadata
+++ b/.squashfs-tools.metadata
@ -1 +1 @@
-ccdbdb36be907de767019f2f35e985c6fad1bc2c SOURCES/4.4-git.1.tar.gz
+a615979db9cee82e4a934a1455577f597d290b41 SOURCES/squashfs4.3.tar.gz
--- a/SOURCES/2gb.patch
+++ b/SOURCES/2gb.patch
@ -0,0 +1,11 @@
 --- squashfs-tools/mksquashfs.c.orig	2014-09-13 11:08:27.352318167 -0500
 +++ squashfs-tools/mksquashfs.c	2014-09-13 11:09:36.701132044 -0500
@@ -2055,7 +2055,7 @@
 inline int is_fragment(struct inode_info *inode)
 {
 -	int file_size = inode->buf.st_size;
 +	off_t file_size = inode->buf.st_size;
 	/*
 	 * If this block is to be compressed differently to the
--- a/SOURCES/CVE-2021-41072-c8s-combined.patch
+++ b/SOURCES/CVE-2021-41072-c8s-combined.patch
@ -0,0 +1,477 @@
 diff -Nupr a/squashfs-tools/Makefile b/squashfs-tools/Makefile
 --- a/squashfs-tools/Makefile	2023-06-26 23:57:01.519732066 -0500
 +++ b/squashfs-tools/Makefile	2023-06-26 23:57:52.192705923 -0500
@@ -117,7 +117,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o
 	caches-queues-lists.o
 UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \
 -	unsquash-4.o unsquash-1234.o swap.o compressor.o unsquashfs_info.o
 +	unsquash-4.o unsquash-1234.o unsquash-12.o swap.o compressor.o \
 +	unsquashfs_info.o
 CFLAGS ?= -O2
 CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \
@@ -294,6 +295,8 @@ unsquash-4.o: unsquashfs.h unsquash-4.c
 unsquash-1234.o: unsquash-1234.c
 +unsquash-12.o: unsquash-12.c unsquashfs.h
 +
 unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h
 unsquashfs_info.o: unsquashfs.h squashfs_fs.h
 diff -Nupr a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c
 --- a/squashfs-tools/unsquash-1234.c	2023-06-26 23:57:01.519732066 -0500
 +++ b/squashfs-tools/unsquash-1234.c	2023-06-26 23:57:52.192705923 -0500
@@ -25,6 +25,8 @@
  * unsquash-4.
  */
 +#include "unsquashfs.h"
 +
 #define TRUE 1
 #define FALSE 0
 /*
@@ -56,3 +58,23 @@ int check_name(char *name, int size)
 	return TRUE;
 }
 +
 +/*
 + * Check directory for duplicate names.  As the directory should be sorted,
 + * duplicates will be consecutive.  Obviously we also need to check if the
 + * directory has been deliberately unsorted, to evade this check.
 + */
 +int check_directory(struct dir *dir)
 +{
 +	int i;
 +	struct dir_ent *ent;
 +
 +	if (dir->dir_count < 2)
 +		return TRUE;
 +
 +	for (ent = dir->dirs, i = 0; i < dir->dir_count - 1; ent = ent->next, i++)
 +		if (strcmp(ent->name, ent->next->name) >= 0)
 +			return FALSE;
 +
 +	return TRUE;
 +}
 diff -Nupr a/squashfs-tools/unsquash-12.c b/squashfs-tools/unsquash-12.c
 --- a/squashfs-tools/unsquash-12.c	1969-12-31 18:00:00.000000000 -0600
 +++ b/squashfs-tools/unsquash-12.c	2023-06-26 23:57:52.192705923 -0500
@@ -0,0 +1,103 @@
 +/*
 + * Unsquash a squashfs filesystem.  This is a highly compressed read only
 + * filesystem.
 + *
 + * Copyright (c) 2021
 + * Phillip Lougher <phillip@squashfs.org.uk>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License
 + * as published by the Free Software Foundation; either version 2,
 + * or (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program; if not, write to the Free Software
 + * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 + *
 + * unsquash-12.c
 + *
 + * Helper functions used by unsquash-1 and unsquash-2.
 + */
 +
 +#include "unsquashfs.h"
 +
 +/*
 + * Bottom up linked list merge sort.
 + *
 + */
 +void sort_directory(struct dir *dir)
 +{
 +	struct dir_ent *cur, *l1, *l2, *next;
 +	int len1, len2, stride = 1;
 +
 +	if (dir->dir_count < 2)
 +		return;
 +
 +	/*
 +	 * We can consider our linked-list to be made up of stride length
 +	 * sublists. Each iteration around this loop merges adjacent
 +	 * stride length sublists into larger 2*stride sublists.  We stop
 +	 * when stride becomes equal to the entire list.
 +	 *
 +	 * Initially stride = 1 (by definition a sublist of 1 is sorted), and
 +	 * these 1 element sublists are merged into 2 element sublists,  which
 +	 * are then merged into 4 element sublists and so on.
 +	 */
 +	do {
 +		l2 = dir->dirs; /* head of current linked list */
 +		cur = NULL; /* empty output list */
 +
 +		/*
 +		 * Iterate through the linked list, merging adjacent sublists.
 +		 * On each interation l2 points to the next sublist pair to be
 +		 * merged (if there's only one sublist left this is simply added
 +		 * to the output list)
 +		 */
 +		while (l2) {
 +			l1 = l2;
 +			for (len1 = 0; l2 && len1 < stride; len1 ++, l2 = l2->next);
 +			len2 = stride;
 +
 +			/*
 +			 * l1 points to first sublist.
 +			 * l2 points to second sublist.
 +			 * Merge them onto the output list
 +			 */
 +			while (len1 && l2 && len2) {
 +				if(strcmp(l1->name, l2->name) <= 0) {
 +					next = l1;
 +					l1 = l1->next;
 +					len1 --;
 +				} else {
 +					next = l2;
 +					l2 = l2->next;
 +					len2 --;
 +				}
 +
 +				if (cur) {
 +					cur->next = next;
 +					cur = next;
 +				} else
 +					dir->dirs = cur = next;
 +			}
 +			/*
 +			 * One sublist is now empty, copy the other one onto the
 +			 * output list
 +			 */
 +			for (; len1; len1 --, l1 = l1->next) {
 +				if(cur) {
 +					cur->next = l1;
 +					cur = l1;
 +				} else
 +					dir->dirs = cur = l1;
 +			}
 +		}
 +		cur->next = NULL;
 +		stride = stride << 1;
 +	} while(stride < dir->dir_count);
 +}
 diff -Nupr a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
 --- a/squashfs-tools/unsquash-1.c	2023-06-26 23:57:01.519732066 -0500
 +++ b/squashfs-tools/unsquash-1.c	2023-06-26 23:57:52.192705923 -0500
@@ -211,7 +211,7 @@ struct dir *squashfs_opendir_1(unsigned
 	long long start;
 	int bytes;
 	int dir_count, size;
 -	struct dir_ent *new_dir;
 +	struct dir_ent *ent, *cur_ent = NULL;
 	struct dir *dir;
 	TRACE("squashfs_opendir: inode start block %d, offset %d\n",
@@ -224,7 +224,7 @@ struct dir *squashfs_opendir_1(unsigned
 		EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n");
 	dir->dir_count = 0;
 -	dir->cur_entry = 0;
 +	dir->cur_entry = NULL;
 	dir->mode = (*i)->mode;
 	dir->uid = (*i)->uid;
 	dir->guid = (*i)->gid;
@@ -295,29 +295,37 @@ struct dir *squashfs_opendir_1(unsigned
 			TRACE("squashfs_opendir: directory entry %s, inode "
 				"%d:%d, type %d\n", dire->name,
 				dirh.start_block, dire->offset, dire->type);
 -			if((dir->dir_count % DIR_ENT_SIZE) == 0) {
 -				new_dir = realloc(dir->dirs, (dir->dir_count +
 -					DIR_ENT_SIZE) * sizeof(struct dir_ent));
 -				if(new_dir == NULL)
 -					EXIT_UNSQUASH("squashfs_opendir: "
 -						"realloc failed!\n");
 -				dir->dirs = new_dir;
 -			}
 -			strcpy(dir->dirs[dir->dir_count].name, dire->name);
 -			dir->dirs[dir->dir_count].start_block =
 -				dirh.start_block;
 -			dir->dirs[dir->dir_count].offset = dire->offset;
 -			dir->dirs[dir->dir_count].type = dire->type;
 +
 +			ent = malloc(sizeof(struct dir_ent));
 +			if (ent == NULL)
 +				MEM_ERROR();
 +
 +			ent->name = strdup(dire->name);
 +			ent->start_block = dirh.start_block;
 +			ent->offset = dire->offset;
 +			ent->type = dire->type;
 +			ent->next = NULL;
 +			if (cur_ent == NULL)
 +				dir->dirs = ent;
 +			else
 +				cur_ent->next = ent;
 +			cur_ent = ent;
 			dir->dir_count ++;
 			bytes += dire->size + 1;
 		}
 	}
 +	/* check directory for duplicate names. Need to sort directory first */
 +	sort_directory(dir);
 +	if (check_directory(dir) == FALSE) {
 +		ERROR("File system corrupted: directory has duplicate names\n");
 +		goto corrupted;
 +	}
 +
 	return dir;
 corrupted:
 -	free(dir->dirs);
 -	free(dir);
 +	squashfs_closedir(dir);
 	return NULL;
 }
 diff -Nupr a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
 --- a/squashfs-tools/unsquash-3.c	2023-06-26 23:57:01.519732066 -0500
 +++ b/squashfs-tools/unsquash-3.c	2023-06-26 23:57:52.192705923 -0500
@@ -288,7 +288,7 @@ struct dir *squashfs_opendir_3(unsigned
 	long long start;
 	int bytes;
 	int dir_count, size;
 -	struct dir_ent *new_dir;
 +	struct dir_ent *ent, *cur_ent = NULL;
 	struct dir *dir;
 	TRACE("squashfs_opendir: inode start block %d, offset %d\n",
@@ -301,7 +301,7 @@ struct dir *squashfs_opendir_3(unsigned
 		EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n");
 	dir->dir_count = 0;
 -	dir->cur_entry = 0;
 +	dir->cur_entry = NULL;
 	dir->mode = (*i)->mode;
 	dir->uid = (*i)->uid;
 	dir->guid = (*i)->gid;
@@ -373,28 +373,35 @@ struct dir *squashfs_opendir_3(unsigned
 			TRACE("squashfs_opendir: directory entry %s, inode "
 				"%d:%d, type %d\n", dire->name,
 				dirh.start_block, dire->offset, dire->type);
 -			if((dir->dir_count % DIR_ENT_SIZE) == 0) {
 -				new_dir = realloc(dir->dirs, (dir->dir_count +
 -					DIR_ENT_SIZE) * sizeof(struct dir_ent));
 -				if(new_dir == NULL)
 -					EXIT_UNSQUASH("squashfs_opendir: "
 -						"realloc failed!\n");
 -				dir->dirs = new_dir;
 -			}
 -			strcpy(dir->dirs[dir->dir_count].name, dire->name);
 -			dir->dirs[dir->dir_count].start_block =
 -				dirh.start_block;
 -			dir->dirs[dir->dir_count].offset = dire->offset;
 -			dir->dirs[dir->dir_count].type = dire->type;
 +
 +			ent = malloc(sizeof(struct dir_ent));
 +			if (ent == NULL)
 +				MEM_ERROR();
 +
 +			ent->name = strdup(dire->name);
 +			ent->start_block = dirh.start_block;
 +			ent->offset = dire->offset;
 +			ent->type = dire->type;
 +			ent->next = NULL;
 +			if (cur_ent == NULL)
 +				dir->dirs = ent;
 +			else
 +				cur_ent->next = ent;
 +			cur_ent = ent;
 			dir->dir_count ++;
 			bytes += dire->size + 1;
 		}
 	}
 +	/* check directory for duplicate names and sorting */
 +	if (check_directory(dir) == FALSE) {
 +		ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
 +		goto corrupted;
 +	}
 +
 	return dir;
 corrupted:
 -	free(dir->dirs);
 -	free(dir);
 +	squashfs_closedir(dir);
 	return NULL;
 }
 diff -Nupr a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
 --- a/squashfs-tools/unsquash-4.c	2023-06-26 23:57:01.519732066 -0500
 +++ b/squashfs-tools/unsquash-4.c	2023-06-26 23:57:52.193705923 -0500
@@ -268,7 +268,7 @@ struct dir *squashfs_opendir_4(unsigned
 	long long start;
 	int bytes;
 	int dir_count, size;
 -	struct dir_ent *new_dir;
 +	struct dir_ent *ent, *cur_ent = NULL;
 	struct dir *dir;
 	TRACE("squashfs_opendir: inode start block %d, offset %d\n",
@@ -281,7 +281,7 @@ struct dir *squashfs_opendir_4(unsigned
 		EXIT_UNSQUASH("squashfs_opendir: malloc failed!\n");
 	dir->dir_count = 0;
 -	dir->cur_entry = 0;
 +	dir->cur_entry = NULL;
 	dir->mode = (*i)->mode;
 	dir->uid = (*i)->uid;
 	dir->guid = (*i)->gid;
@@ -342,29 +342,36 @@ struct dir *squashfs_opendir_4(unsigned
 			TRACE("squashfs_opendir: directory entry %s, inode "
 				"%d:%d, type %d\n", dire->name,
 				dirh.start_block, dire->offset, dire->type);
 -			if((dir->dir_count % DIR_ENT_SIZE) == 0) {
 -				new_dir = realloc(dir->dirs, (dir->dir_count +
 -					DIR_ENT_SIZE) * sizeof(struct dir_ent));
 -				if(new_dir == NULL)
 -					EXIT_UNSQUASH("squashfs_opendir: "
 -						"realloc failed!\n");
 -				dir->dirs = new_dir;
 -			}
 -			strcpy(dir->dirs[dir->dir_count].name, dire->name);
 -			dir->dirs[dir->dir_count].start_block =
 -				dirh.start_block;
 -			dir->dirs[dir->dir_count].offset = dire->offset;
 -			dir->dirs[dir->dir_count].type = dire->type;
 +
 +			ent = malloc(sizeof(struct dir_ent));
 +			if (ent == NULL)
 +				MEM_ERROR();
 +
 +			ent->name = strdup(dire->name);
 +			ent->start_block = dirh.start_block;
 +			ent->offset = dire->offset;
 +			ent->type = dire->type;
 +			ent->next = NULL;
 +			if (cur_ent == NULL)
 +				dir->dirs = ent;
 +			else
 +				cur_ent->next = ent;
 +			cur_ent = ent;
 			dir->dir_count ++;
 			bytes += dire->size + 1;
 		}
 	}
 +	/* check directory for duplicate names and sorting */
 +	if (check_directory(dir) == FALSE) {
 +		ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
 +		goto corrupted;
 +	}
 +
 	return dir;
 corrupted:
 -	free(dir->dirs);
 -	free(dir);
 +	squashfs_closedir(dir);
 	return NULL;
 }
 diff -Nupr a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
 --- a/squashfs-tools/unsquashfs.c	2023-06-26 23:57:01.520732065 -0500
 +++ b/squashfs-tools/unsquashfs.c	2023-06-26 23:57:52.193705923 -0500
@@ -1231,14 +1231,18 @@ failed:
 int squashfs_readdir(struct dir *dir, char **name, unsigned int *start_block,
 unsigned int *offset, unsigned int *type)
 {
 -	if(dir->cur_entry == dir->dir_count)
 +	if (dir->cur_entry == NULL)
 +		dir->cur_entry = dir->dirs;
 +	else
 +		dir->cur_entry = dir->cur_entry->next;
 +
 +	if (dir->cur_entry == NULL)
 		return FALSE;
 -	*name = dir->dirs[dir->cur_entry].name;
 -	*start_block = dir->dirs[dir->cur_entry].start_block;
 -	*offset = dir->dirs[dir->cur_entry].offset;
 -	*type = dir->dirs[dir->cur_entry].type;
 -	dir->cur_entry ++;
 +	*name = dir->cur_entry->name;
 +	*start_block = dir->cur_entry->start_block;
 +	*offset = dir->cur_entry->offset;
 +	*type = dir->cur_entry->type;
 	return TRUE;
 }
@@ -1246,7 +1250,16 @@ unsigned int *offset, unsigned int *type
 void squashfs_closedir(struct dir *dir)
 {
 -	free(dir->dirs);
 +	struct dir_ent *ent = dir->dirs;
 +
 +	while (ent) {
 +		struct dir_ent *tmp = ent;
 +
 +		ent = ent->next;
 +		free(tmp->name);
 +		free(tmp);
 +	}
 +
 	free(dir);
 }
@@ -1895,6 +1908,7 @@ int read_super(char *source)
 	 * 1.x, 2.x and 3.x filesystems use gzip compression.
 	 */
 	comp = lookup_compressor("gzip");
 +
 	return TRUE;
 failed_mount:
 diff -Nupr a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
 --- a/squashfs-tools/unsquashfs.h	2023-06-26 23:57:01.520732065 -0500
 +++ b/squashfs-tools/unsquashfs.h	2023-06-26 23:57:52.193705923 -0500
@@ -168,21 +168,22 @@ struct queue {
 #define DIR_ENT_SIZE	16
 struct dir_ent	{
 -	char		name[SQUASHFS_NAME_LEN + 1];
 +	char            *name;
 	unsigned int	start_block;
 	unsigned int	offset;
 	unsigned int	type;
 +	struct dir_ent  *next;
 };
 struct dir {
 	int		dir_count;
 -	int 		cur_entry;
 	unsigned int	mode;
 	uid_t		uid;
 	gid_t		guid;
 	unsigned int	mtime;
 	unsigned int xattr;
 	struct dir_ent	*dirs;
 +	struct dir_ent  *cur_entry;
 };
 struct file_entry {
@@ -278,4 +279,10 @@ extern int read_uids_guids_4();
 /* unsquash-1234.c */
 extern int check_name(char *, int);
 +
 +extern void squashfs_closedir(struct dir *);
 +extern int check_directory(struct dir *);
 +
 +/* unsquash-12.c */
 +extern void sort_directory(struct dir *);
 #endif
--- a/SOURCES/PAE.patch
+++ b/SOURCES/PAE.patch
@ -0,0 +1,159 @@
 From 55f7ba830d40d438f0b0663a505e0c227fc68b6b Mon Sep 17 00:00:00 2001
 From: Phillip Lougher <phillip@squashfs.org.uk>
 Date: Tue, 10 Jun 2014 21:51:52 +0100
 Subject: mksquashfs: fix phys mem calculation for 32-bit processes on
 PAE/64-bit kernels
 When adding the code to base default memory usage on physical memory
 (by default use 25% of physical memory), I made an oversight.  I assumed
 the process would be able to address 25% of physical memory.
 However, for 32-bit processes running on a PAE kernel or 64-bit kernel,
 25% of physical memory can easily exceed the addressible memory for a
 32-bit process, e.g. if a machine has 24 GB of physical memory, the
 code would asume the process could easily use 6 GB.
 A 32-bit process by definition can only address 4 GB (32-bit pointers).
 But, due to the typical kernel/user-space split (1GB/3GB, or 2GB/2GB)
 on PAE kernels, a 32-bit process may only be able to address 2 GB.
 So, if Mksquashfs is a 32-bit application running on a PAE/64-bit kernel,
 the code assumes it can address much more memory than it really can, which
 means it runs out of memory.
 The fix is to impose a maximum default limit on 32-bit kernels, or
 otherwise to never use a value more than 25% of the address space.  If
 we assume the maximum address space is 2 GB, then the maximum becomes
 512 MB.  But, given most kernels used the 1GB/3GB split, that may be
 unduely conservative, and 25% of 3 GB (756 MB) may be better.  This
 patch compromises on 640 MB, which is mid-way between the 512 MB and 756 MB
 values.  It is also the fixed default value previously used by Mksquashfs.
 This patch also alters the code which imposes a maximum size.  Previously
 it was believed limiting to the physical memory size was adequate.  But
 obviously this needs to be updated to take into account a 32-bit process
 may only be able to address 2 GB.  In the process I've also taken the
 opportunity to limit all requests to no more than 75% of physical memory.
 Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
 diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
 index 86f82bb..5370ecf 100644
 --- a/squashfs-tools/mksquashfs.c
 +++ b/squashfs-tools/mksquashfs.c
@@ -304,7 +304,7 @@ void restorefs();
 struct dir_info *scan1_opendir(char *pathname, char *subpath, int depth);
 void write_filesystem_tables(struct squashfs_super_block *sBlk, int nopad);
 unsigned short get_checksum_mem(char *buff, int bytes);
 -int get_physical_memory();
 +void check_usable_phys_mem(int total_mem);
 void prep_exit()
@@ -4053,11 +4053,7 @@ void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
 		BAD_ERROR("Queue sizes rediculously too large\n");
 	total_mem += fwriteq;
 -	if(total_mem > get_physical_memory()) {
 -		ERROR("Total queue sizes larger than physical memory.\n");
 -		ERROR("Mksquashfs will exhaust physical memory and thrash.\n");
 -		BAD_ERROR("Queues too large\n");
 -	}
 +	check_usable_phys_mem(total_mem);
 	/*
 	 * convert from queue size in Mbytes to queue size in
@@ -4879,6 +4875,72 @@ int get_physical_memory()
 }
 +void check_usable_phys_mem(int total_mem)
 +{
 +	/*
 +	 * We want to allow users to use as much of their physical
 +	 * memory as they wish.  However, for practical reasons there are
 +	 * limits which need to be imposed, to protect users from themselves
 +	 * and to prevent people from using Mksquashfs as a DOS attack by using
 +	 * all physical memory.   Mksquashfs uses memory to cache data from disk
 +	 * to optimise performance.  It is pointless to ask it to use more
 +	 * than 75% of physical memory, as this causes thrashing and it is thus
 +	 * self-defeating.
 +	 */
 +	int mem = get_physical_memory();
 +
 +	mem = (mem >> 1) + (mem >> 2); /* 75% */
 +						
 +	if(total_mem > mem) {
 +		ERROR("Total memory requested is more than 75%% of physical "
 +						"memory.\n");
 +		ERROR("Mksquashfs uses memory to cache data from disk to "
 +						"optimise performance.\n");
 +		ERROR("It is pointless to ask it to use more than this amount "
 +						"of memory, as this\n");
 +		ERROR("causes thrashing and it is thus self-defeating.\n");
 +		BAD_ERROR("Requested memory size too large\n");
 +	}
 +
 +	if(sizeof(void *) == 4 && total_mem > 2048) {
 +		/*
 +		 * If we're running on a kernel with PAE or on a 64-bit kernel,
 +		 * then the 75% physical memory limit can still easily exceed
 +		 * the addressable memory by this process.
 +		 *
 +		 * Due to the typical kernel/user-space split (1GB/3GB, or
 +		 * 2GB/2GB), we have to conservatively assume the 32-bit
 +		 * processes can only address 2-3GB.  So refuse if the user
 +		 * tries to allocate more than 2GB.
 +		 */
 +		ERROR("Total memory requested may exceed maximum "
 +				"addressable memory by this process\n");
 +		BAD_ERROR("Requested memory size too large\n");
 +	}
 +}
 +
 +
 +int get_default_phys_mem()
 +{
 +	int mem = get_physical_memory() / SQUASHFS_TAKE;
 +
 +	if(sizeof(void *) == 4 && mem > 640) {
 +		/*
 +		 * If we're running on a kernel with PAE or on a 64-bit kernel,
 +		 * the default memory usage can exceed the addressable
 +		 * memory by this process.
 +		 * Due to the typical kernel/user-space split (1GB/3GB, or
 +		 * 2GB/2GB), we have to conservatively assume the 32-bit
 +		 * processes can only address 2-3GB.  So limit the  default
 +		 * usage to 640M, which gives room for other data.
 +		 */
 +		mem = 640;
 +	}
 +
 +	return mem;
 +}
 +
 +
 void calculate_queue_sizes(int mem, int *readq, int *fragq, int *bwriteq,
 							int *fwriteq)
 {
@@ -4890,7 +4952,7 @@ void calculate_queue_sizes(int mem, int *readq, int *fragq, int *bwriteq,
 #define VERSION() \
 -	printf("mksquashfs version 4.3 (2014/05/12)\n");\
 +	printf("mksquashfs version 4.3-git (2014/06/09)\n");\
 	printf("copyright (C) 2014 Phillip Lougher "\
 		"<phillip@squashfs.org.uk>\n\n"); \
 	printf("This program is free software; you can redistribute it and/or"\
@@ -4918,7 +4980,7 @@ int main(int argc, char *argv[])
 	int fragq;
 	int bwriteq;
 	int fwriteq;
 -	int total_mem = get_physical_memory() / SQUASHFS_TAKE;
 +	int total_mem = get_default_phys_mem();
 	int progress = TRUE;
 	int force_progress = FALSE;
 	struct file_buffer **fragment = NULL;
 -- 
 cgit v0.10.1
--- a/SOURCES/bz1602698.patch
+++ b/SOURCES/bz1602698.patch
@ -0,0 +1,95 @@
 diff -Nupr a/squashfs-tools/action.c b/squashfs-tools/action.c
 --- a/squashfs-tools/action.c	2014-05-09 23:54:13.000000000 -0500
 +++ b/squashfs-tools/action.c	2019-04-18 10:59:53.140496887 -0500
@@ -1094,8 +1094,14 @@ static int parse_sym_mode_args(struct ac
 	for (i = 0; i < args; i++) {
 		struct mode_data *entry = parse_sym_mode_arg(argv[i]);
 -		if (entry == NULL)
 +		if (entry == NULL) {
 +			while (head) {
 +				cur = head;
 +				head = head->next;
 +				free(cur);
 +			}
 			return 0;
 +		}
 		if (cur) {
 			cur->next = entry;
 diff -Nupr a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
 --- a/squashfs-tools/mksquashfs.c	2019-04-18 10:51:05.975460126 -0500
 +++ b/squashfs-tools/mksquashfs.c	2019-04-18 11:04:16.860682497 -0500
@@ -3537,11 +3537,11 @@ void dir_scan2(struct dir_info *dir, str
 			char *subpath = strdup(subpathname(dir_ent));
 			struct dir_info *sub_dir = scan1_opendir("", subpath,
 						dir->depth + 1);
 +			free(subpath);
 			if(sub_dir == NULL) {
 				ERROR_START("Could not create pseudo directory "
 					"\"%s\"", pseudo_ent->pathname);
 				ERROR_EXIT(", skipping...\n");
 -				free(subpath);
 				pseudo_ino --;
 				continue;
 			}
 diff -Nupr a/squashfs-tools/read_fs.c b/squashfs-tools/read_fs.c
 --- a/squashfs-tools/read_fs.c	2014-05-09 23:54:13.000000000 -0500
 +++ b/squashfs-tools/read_fs.c	2019-04-18 11:06:32.499233451 -0500
@@ -974,7 +974,8 @@ long long read_filesystem(char *root_nam
 error:
 	free(id_table);
 -	free(inode_table);
 +	if (inode_table)
 +		free(inode_table);
 	free(directory_table);
 	return 0;
 }
 diff -Nupr a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
 --- a/squashfs-tools/unsquash-4.c	2019-04-18 10:51:05.972460124 -0500
 +++ b/squashfs-tools/unsquash-4.c	2019-04-18 11:32:54.600160166 -0500
@@ -50,9 +50,11 @@ int read_fragment_table_4(long long *dir
 			"fragment table index\n");
 	fragment_table = malloc(bytes);
 -	if(fragment_table == NULL)
 +	if(fragment_table == NULL) {
 +		free(fragment_table_index);
 		EXIT_UNSQUASH("read_fragment_table: failed to allocate "
 			"fragment table\n");
 +	}
 	res = read_fs_bytes(fd, sBlk.s.fragment_table_start,
 		SQUASHFS_FRAGMENT_INDEX_BYTES(sBlk.s.fragments),
@@ -60,7 +62,7 @@ int read_fragment_table_4(long long *dir
 	if(res == FALSE) {
 		ERROR("read_fragment_table: failed to read fragment table "
 			"index\n");
 -		return FALSE;
 +		goto out;
 	}
 	SQUASHFS_INSWAP_FRAGMENT_INDEXES(fragment_table_index, indexes);
@@ -75,7 +77,8 @@ int read_fragment_table_4(long long *dir
 		if(length == FALSE) {
 			ERROR("read_fragment_table: failed to read fragment "
 				"table index\n");
 -			return FALSE;
 +			res = FALSE;
 +			goto out;
 		}
 	}
@@ -83,7 +86,10 @@ int read_fragment_table_4(long long *dir
 		SQUASHFS_INSWAP_FRAGMENT_ENTRY(&fragment_table[i]);
 	*directory_table_end = fragment_table_index[0];
 -	return TRUE;
 +	res = TRUE;
 +out:
 +	free(fragment_table_index);
 +	return res;
 }
--- a/SOURCES/bz1624173.patch
+++ b/SOURCES/bz1624173.patch
@ -0,0 +1,11 @@
 --- a/squashfs-tools/Makefile	2019-07-24 13:52:09.552920269 -0400
 +++ b/squashfs-tools/Makefile	2019-07-24 23:52:47.839665687 -0400
@@ -107,6 +107,8 @@ XATTR_DEFAULT = 1
 #        End of BUILD options section         #
 ###############################################
 +EXTRA_LDFLAGS += -z now -pie
 +
 INCLUDEDIR = -I.
 INSTALL_DIR = /usr/local/bin
--- a/SOURCES/bz1716278.patch
+++ b/SOURCES/bz1716278.patch
@ -1,15 +1,14 @@
-diff -Nupr a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
+--- a/squashfs-tools/mksquashfs.c	2019-08-06 11:03:34.071402614 -0400
--- a/squashfs-tools/mksquashfs.c	2020-10-30 06:13:56.000000000 -0500
+++ b/squashfs-tools/mksquashfs.c	2019-08-06 11:09:54.063340318 -0400
-+++ b/squashfs-tools/mksquashfs.c	2022-01-12 10:58:37.704782953 -0600
+@@ -267,6 +267,7 @@ pthread_mutex_t	pos_mutex = PTHREAD_MUTE
-@@ -290,6 +290,7 @@ int all_time_opt = FALSE;
+ pthread_mutex_t	dup_mutex = PTHREAD_MUTEX_INITIALIZER;
 int clamping = TRUE;
 /* user options that control parallelisation */
 +#define MAX_CPUS 256
 int processors = -1;
 int bwriter_size;
-@@ -4385,6 +4386,10 @@ void initialise_threads(int readq, int f
+@@ -4124,6 +4125,10 @@ void initialise_threads(int readq, int f
 #endif
 	}
--- a/SOURCES/bz1754815.patch
+++ b/SOURCES/bz1754815.patch
@ -0,0 +1,13 @@
 --- a/squashfs-tools/mksquashfs.c
 +++ b/squashfs-tools/mksquashfs.c
@@ -2447,8 +2447,8 @@ void *frag_deflator(void *arg)
 			write_buffer->block = bytes;
 			bytes += compressed_size;
 			fragments_outstanding --;
 -			pthread_mutex_unlock(&fragment_mutex);
 			queue_put(to_writer, write_buffer);
 +			pthread_mutex_unlock(&fragment_mutex);
 			TRACE("Writing fragment %lld, uncompressed size %d, "
 				"compressed size %d\n", file_buffer->block,
 				file_buffer->size, compressed_size);
--- a/SOURCES/bz1895017.patch
+++ b/SOURCES/bz1895017.patch
@ -0,0 +1,20 @@
 --- a/squashfs-tools/unsquashfs.c	2021-01-14 14:34:49.658184361 -0600
 +++ b/squashfs-tools/unsquashfs.c	2021-01-14 14:50:19.604100949 -0600
@@ -822,8 +822,6 @@ int set_attributes(char *pathname, int m
 {
 	struct utimbuf times = { time, time };
 -	write_xattr(pathname, xattr);
 -
 	if(utime(pathname, &times) == -1) {
 		ERROR("set_attributes: failed to set time on %s, because %s\n",
 			pathname, strerror(errno));
@@ -846,6 +844,8 @@ int set_attributes(char *pathname, int m
 		return FALSE;
 	}
 +	write_xattr(pathname, xattr);
 +
 	return TRUE;
 }
--- a/SOURCES/bz2000637.patch
+++ b/SOURCES/bz2000637.patch
@ -0,0 +1,204 @@
 diff -Nupr a/squashfs-tools/Makefile b/squashfs-tools/Makefile
 --- a/squashfs-tools/Makefile	2021-10-08 12:02:28.881477426 -0500
 +++ b/squashfs-tools/Makefile	2021-10-08 11:47:05.503307841 -0500
@@ -117,7 +117,7 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o
 	caches-queues-lists.o
 UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \
 -	unsquash-4.o swap.o compressor.o unsquashfs_info.o
 +	unsquash-4.o unsquash-1234.o swap.o compressor.o unsquashfs_info.o
 CFLAGS ?= -O2
 CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \
@@ -292,6 +292,8 @@ unsquash-3.o: unsquashfs.h unsquash-3.c
 unsquash-4.o: unsquashfs.h unsquash-4.c squashfs_fs.h squashfs_swap.h \
 	read_fs.h
 +unsquash-1234.o: unsquash-1234.c
 +
 unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h
 unsquashfs_info.o: unsquashfs.h squashfs_fs.h
 diff -Nupr a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c
 --- a/squashfs-tools/unsquash-1234.c	1969-12-31 18:00:00.000000000 -0600
 +++ b/squashfs-tools/unsquash-1234.c	2021-10-08 11:49:06.032243697 -0500
@@ -0,0 +1,58 @@
 +/*
 + * Unsquash a squashfs filesystem.  This is a highly compressed read only
 + * filesystem.
 + *
 + * Copyright (c) 2021
 + * Phillip Lougher <phillip@squashfs.org.uk>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License
 + * as published by the Free Software Foundation; either version 2,
 + * or (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program; if not, write to the Free Software
 + * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 + *
 + * unsquash-1234.c
 + *
 + * Helper functions used by unsquash-1, unsquash-2, unsquash-3 and
 + * unsquash-4.
 + */
 +
 +#define TRUE 1
 +#define FALSE 0
 +/*
 + * Check name for validity, name should not
 + *  - be ".", "./", or
 + *  - be "..", "../" or
 + *  - have a "/" anywhere in the name, or
 + *  - be shorter than the expected size
 + */
 +int check_name(char *name, int size)
 +{
 +	char *start = name;
 +
 +	if(name[0] == '.') {
 +		if(name[1] == '.')
 +			name++;
 +		if(name[1] == '/' || name[1] == '\0')
 +			return FALSE;
 +	}
 +
 +	while(name[0] != '/' && name[0] != '\0')
 +		name ++;
 +
 +	if(name[0] == '/')
 +		return FALSE;
 +
 +	if((name - start) != size)
 +		return FALSE;
 +
 +	return TRUE;
 +}
 diff -Nupr a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
 --- a/squashfs-tools/unsquash-1.c	2014-03-08 23:31:59.000000000 -0600
 +++ b/squashfs-tools/unsquash-1.c	2021-10-08 11:51:18.827274779 -0500
@@ -2,7 +2,7 @@
  * Unsquash a squashfs filesystem.  This is a highly compressed read only
  * filesystem.
  *
 - * Copyright (c) 2009, 2010, 2011, 2012
 + * Copyright (c) 2009, 2010, 2011, 2012, 2021
  * Phillip Lougher <phillip@squashfs.org.uk>
  *
  * This program is free software; you can redistribute it and/or
@@ -285,6 +285,13 @@ struct dir *squashfs_opendir_1(unsigned
 			memcpy(dire->name, directory_table + bytes,
 				dire->size + 1);
 			dire->name[dire->size + 1] = '\0';
 +
 +			/* check name for invalid characters (i.e /, ., ..) */
 +			if(check_name(dire->name, dire->size + 1) == FALSE) {
 +				ERROR("File system corrupted: invalid characters in name\n");
 +				goto corrupted;
 +			}
 +
 			TRACE("squashfs_opendir: directory entry %s, inode "
 				"%d:%d, type %d\n", dire->name,
 				dirh.start_block, dire->offset, dire->type);
 diff -Nupr a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
 --- a/squashfs-tools/unsquash-3.c	2014-03-08 23:31:59.000000000 -0600
 +++ b/squashfs-tools/unsquash-3.c	2021-10-08 11:56:30.881697731 -0500
@@ -2,7 +2,7 @@
  * Unsquash a squashfs filesystem.  This is a highly compressed read only
  * filesystem.
  *
 - * Copyright (c) 2009, 2010, 2011, 2012, 2013
 + * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2021
  * Phillip Lougher <phillip@squashfs.org.uk>
  *
  * This program is free software; you can redistribute it and/or
@@ -363,6 +363,13 @@ struct dir *squashfs_opendir_3(unsigned
 			memcpy(dire->name, directory_table + bytes,
 				dire->size + 1);
 			dire->name[dire->size + 1] = '\0';
 +
 +			/* check name for invalid characters (i.e /, ., ..) */
 +			if(check_name(dire->name, dire->size + 1) == FALSE) {
 +				ERROR("File system corrupted: invalid characters in name\n");
 +				goto corrupted;
 +			}
 +			
 			TRACE("squashfs_opendir: directory entry %s, inode "
 				"%d:%d, type %d\n", dire->name,
 				dirh.start_block, dire->offset, dire->type);
 diff -Nupr a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
 --- a/squashfs-tools/unsquash-4.c	2021-10-08 12:02:28.879477411 -0500
 +++ b/squashfs-tools/unsquash-4.c	2021-10-08 11:57:20.357081890 -0500
@@ -2,7 +2,7 @@
  * Unsquash a squashfs filesystem.  This is a highly compressed read only
  * filesystem.
  *
 - * Copyright (c) 2009, 2010, 2011, 2012, 2013
 + * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2021
  * Phillip Lougher <phillip@squashfs.org.uk>
  *
  * This program is free software; you can redistribute it and/or
@@ -332,6 +332,13 @@ struct dir *squashfs_opendir_4(unsigned
 			memcpy(dire->name, directory_table + bytes,
 				dire->size + 1);
 			dire->name[dire->size + 1] = '\0';
 +
 +			/* check name for invalid characters (i.e /, ., ..) */
 +			if(check_name(dire->name, dire->size + 1) == FALSE) {
 +				ERROR("File system corrupted: invalid characters in name\n");
 +				goto corrupted;
 +			}
 +
 			TRACE("squashfs_opendir: directory entry %s, inode "
 				"%d:%d, type %d\n", dire->name,
 				dirh.start_block, dire->offset, dire->type);
 diff -Nupr a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
 --- a/squashfs-tools/unsquashfs.c	2021-10-08 12:02:28.888477481 -0500
 +++ b/squashfs-tools/unsquashfs.c	2021-10-08 11:59:29.508084687 -0500
@@ -3,7 +3,7 @@
  * filesystem.
  *
  * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011,
 - * 2012, 2013, 2014
 + * 2012, 2013, 2014, 2021
  * Phillip Lougher <phillip@squashfs.org.uk>
  *
  * This program is free software; you can redistribute it and/or
@@ -2478,8 +2478,8 @@ int parse_number(char *arg, int *res)
 #define VERSION() \
 -	printf("unsquashfs version 4.3 (2014/05/12)\n");\
 -	printf("copyright (C) 2014 Phillip Lougher "\
 +	printf("unsquashfs version 4.3 (2021/10/8)\n");\
 +	printf("copyright (C) 2021 Phillip Lougher "\
 		"<phillip@squashfs.org.uk>\n\n");\
     	printf("This program is free software; you can redistribute it and/or"\
 		"\n");\
 diff -Nupr a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
 --- a/squashfs-tools/unsquashfs.h	2014-05-09 23:54:13.000000000 -0500
 +++ b/squashfs-tools/unsquashfs.h	2021-10-08 12:01:00.424790607 -0500
@@ -4,7 +4,7 @@
  * Unsquash a squashfs filesystem.  This is a highly compressed read only
  * filesystem.
  *
 - * Copyright (c) 2009, 2010, 2013, 2014
 + * Copyright (c) 2009, 2010, 2013, 2014, 2021
  * Phillip Lougher <phillip@squashfs.org.uk>
  *
  * This program is free software; you can redistribute it and/or
@@ -275,4 +275,7 @@ extern struct inode *read_inode_4(unsign
 extern struct dir *squashfs_opendir_4(unsigned int, unsigned int,
 	struct inode **);
 extern int read_uids_guids_4();
 +
 +/* unsquash-1234.c */
 +extern int check_name(char *, int);
 #endif
--- a/SOURCES/cve-2015-4645.patch
+++ b/SOURCES/cve-2015-4645.patch
@ -0,0 +1,29 @@
 diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
 index ecdaac796f09..2c0cf63daf67 100644
 --- a/squashfs-tools/unsquash-4.c
 +++ b/squashfs-tools/unsquash-4.c
@@ -31,9 +31,9 @@ static unsigned int *id_table;
 int read_fragment_table_4(long long *directory_table_end)
 {
 	int res, i;
 -	int bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
 -	int  indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
 -	long long fragment_table_index[indexes];
 +	size_t bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
 +	size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
 +	long long *fragment_table_index;
 	TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
 		"from 0x%llx\n", sBlk.s.fragments, indexes,
@@ -44,6 +44,11 @@ int read_fragment_table_4(long long *directory_table_end)
 		return TRUE;
 	}
 +	fragment_table_index = malloc(indexes*sizeof(long long));
 +	if(fragment_table_index == NULL)
 +		EXIT_UNSQUASH("read_fragment_table: failed to allocate "
 +			"fragment table index\n");
 +
 	fragment_table = malloc(bytes);
 	if(fragment_table == NULL)
 		EXIT_UNSQUASH("read_fragment_table: failed to allocate "
--- a/SOURCES/local-cve-fix.patch
+++ b/SOURCES/local-cve-fix.patch
@ -0,0 +1,11 @@
 --- squashfs-tools/unsquash-4.c.orig	2015-06-24 14:23:22.270710744 -0500
 +++ squashfs-tools/unsquash-4.c	2015-06-24 14:24:13.671243487 -0500
@@ -35,7 +35,7 @@
 	size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
 	long long *fragment_table_index;
 -	TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
 +	TRACE("read_fragment_table: %u fragments, reading %zu fragment indexes "
 		"from 0x%llx\n", sBlk.s.fragments, indexes,
 		sBlk.s.fragment_table_start);
--- a/SOURCES/mem-overflow.patch
+++ b/SOURCES/mem-overflow.patch
@ -0,0 +1,33 @@
 From 604b607d8ac91eb8afc0b6e3d917d5c073096103 Mon Sep 17 00:00:00 2001
 From: Phillip Lougher <phillip@squashfs.org.uk>
 Date: Wed, 11 Jun 2014 04:51:37 +0100
 Subject: mksquashfs: ensure value does not overflow a signed int in -mem
 option
 Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
 diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
 index 5370ecf..9676dc8 100644
 --- a/squashfs-tools/mksquashfs.c
 +++ b/squashfs-tools/mksquashfs.c
@@ -5193,7 +5193,16 @@ print_compressor_options:
 					 argv[0]);
 				exit(1);
 			}
 -			/* convert from bytes to Mbytes */
 +
 +			/*
 +			 * convert from bytes to Mbytes, ensuring the value
 +			 * does not overflow a signed int
 +			 */
 +			if(number >= (1LL << 51)) {
 +				ERROR("%s: -mem invalid mem size\n", argv[0]);
 +				exit(1);
 +			}
 +
 			total_mem = number / 1048576;
 			if(total_mem < (SQUASHFS_LOWMEM / SQUASHFS_TAKE)) {
 				ERROR("%s: -mem should be %d Mbytes or "
 -- 
 cgit v0.10.1
--- a/SOURCES/mksquashfs-sysmacros-fix.patch
+++ b/SOURCES/mksquashfs-sysmacros-fix.patch
@ -0,0 +1,22 @@
 diff -Nupr squashfs4.3.orig/squashfs-tools/mksquashfs.c squashfs4.3/squashfs-tools/mksquashfs.c
 --- squashfs4.3.orig/squashfs-tools/mksquashfs.c	2018-08-20 10:47:49.286289155 -0400
 +++ squashfs4.3/squashfs-tools/mksquashfs.c	2018-08-20 10:49:28.348541210 -0400
@@ -35,6 +35,7 @@
 #include <stddef.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 +#include <sys/sysmacros.h>
 #include <fcntl.h>
 #include <errno.h>
 #include <dirent.h>
 diff -Nupr squashfs4.3.orig/squashfs-tools/unsquashfs.c squashfs4.3/squashfs-tools/unsquashfs.c
 --- squashfs4.3.orig/squashfs-tools/unsquashfs.c	2018-08-20 10:47:49.283289208 -0400
 +++ squashfs4.3/squashfs-tools/unsquashfs.c	2018-08-20 10:58:44.238732579 -0400
@@ -35,6 +35,7 @@
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/resource.h>
 +#include <sys/sysmacros.h>
 #include <limits.h>
 #include <ctype.h>
--- a/SOURCES/mksquashfs.1
+++ b/SOURCES/mksquashfs.1
@ -1,4 +1,4 @@
-.TH MKSQUASHFS 1 "2020\-05\-12" "4.4" "create and append squashfs filesystems"
+.TH MKSQUASHFS 1 "2014\-05\-13" "4.3" "create and append squashfs filesystems"
 .SH NAME
 mksquashfs \- tool to create and append to squashfs filesystems
@ -50,8 +50,6 @@ set all file gids to gid.
 do not pad filesystem to a multiple of 4K.
 .IP "\-keep\-as\-directory" 4
 if one source directory is specified, create a root directory containing that directory, rather than the contents of the directory.
 .IP "\-all\-time time"
 32 bit integer indicating seconds since the epoch (1970\-01\-01) used for the timestamp for all files. The SOURCE_DATE_EPOCH environment variable can also be used.
 .SS Filesystem filter options
 .IP "\-p \fIPSEUDO_DEFINITION\fR" 4
@ -98,10 +96,6 @@ Deprecated. Use \-mem instead.
 Deprecated. Use \-mem instead.
 .IP "\-fragment\-queue \fISIZE\fR" 4
 Deprecated. Use \-mem instead.
 .IP "\-mkfs\-time time"
 32 bit integer indicating seconds since the epoch (1970\-01\-01). The SOURCE_DATE_EPOCH environment variable can also be used.
 .IP "-not\-reproducible"
 This option tells Mksquashfs that the files do not have to be strictly ordered.
 .SS Miscellaneous options
 .IP "\-root\-owned" 4
@ -139,10 +133,6 @@ Compress using LZ4 High Compression
 Compress using filter1,filter2,...,filterN in turn (in addition to no filter), and choose the best compression. Available filters: x86, arm, armthumb, powerpc, sparc, ia64.
 .IP "\-Xdict\-size \fIDICT_SIZE\fR" 4
 Use \fIDICT_SIZE\fR as the XZ dictionary size. The dictionary size can be specified as a percentage of the block size, or as an absolute value. The dictionary size must be less than or equal to the block size and 8192 bytes or larger. It must also be storable in the xz header as either 2^n or as 2^n+2^(n+1). Example dict\-sizes are 75%, 50%, 37.5%, 25%, or 32K, 16K, 8K etc.
 .IP "zstd" 4
 .IP "\-Xcompression-level <compression-level>" 4
 <compression-level> should be 1 .. 22 (default 15)
 .SH SEE ALSO
 unsquashfs(1)
@ -153,4 +143,4 @@ More information about mksquashfs and the squashfs filesystem can be found at <\
 .SH AUTHOR
 squashfs was written by Phillip Lougher <\fIplougher@users.sourceforge.net\fR>.
 .PP
-This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.4 for use with Fedora.
+This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.3 for use with Fedora.
--- a/SOURCES/unsquashfs.1
+++ b/SOURCES/unsquashfs.1
@ -1,4 +1,4 @@
-.TH UNSQUASHFS 1 "2020\-05\-12" "4.4" "uncompress squashfs filesystems"
+.TH UNSQUASHFS 1 "2014\-05\-13" "4.3" "uncompress squashfs filesystems"
 .SH NAME
 mksquashfs \- tool to uncompress squashfs filesystems
@ -63,4 +63,4 @@ More information about unsquashfs and the squashfs filesystem can be found at <\
 .SH AUTHOR
 squashfs was written by Phillip Lougher <\fIplougher@users.sourceforge.net\fR>.
 .PP
-This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.4 for use with Fedora.
+This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.3 for use with Fedora.
--- a/SPECS/squashfs-tools.spec
+++ b/SPECS/squashfs-tools.spec
@ -1,39 +1,77 @@
 Summary: Utility for the creation of squashfs filesystems
 %global forgeurl https://github.com/plougher/squashfs-tools
 Version: 4.4
 Name: squashfs-tools
-Release: 8.git1%{?dist}
+Version: 4.3
 Release: 21%{?dist}
 License: GPLv2+
-URL: %{forgeurl}/archive/4.4-git.1.tar.gz
+Group: System Environment/Base
-Source: 4.4-git.1.tar.gz
+URL: http://squashfs.sourceforge.net/
 Source0: http://downloads.sourceforge.net/squashfs/squashfs%{version}.tar.gz
 # manpages from http://ftp.debian.org/debian/pool/main/s/squashfs-tools/squashfs-tools_4.2+20121212-1.debian.tar.xz
 # The man pages have been modified for 4.3 for Fedora.
 Source1: mksquashfs.1
 Source2: unsquashfs.1
-
+# From master branch (55f7ba830d40d438f0b0663a505e0c227fc68b6b).
-Patch0: bz2023218.patch
+# 32 bit process can use too much memory when using PAE or 64 bit kernels
-
+Patch0:  PAE.patch
-BuildRequires: make
+# From master branch (604b607d8ac91eb8afc0b6e3d917d5c073096103).
-BuildRequires:  gcc
+# Prevent overflows when using the -mem option.
 Patch1:  mem-overflow.patch
 # From squashfs-devel@lists.sourceforge.net by Guan Xin <guanx.bac@gmail.com>
 # For https://bugzilla.redhat.com/show_bug.cgi?id=1141206
 Patch2:  2gb.patch
 # From https://github.com/gcanalesb/sasquatch/commit/6777e08cc38bc780d27c69c1d8c272867b74524f
 # Which is forked from Phillip's squashfs-tools, though it looks like 
 # the issue applies to us.
 Patch3:  cve-2015-4645.patch
 # Update formats to match changes in cve-2015-4645.patch
 Patch4:  local-cve-fix.patch
 # rhbz 1611746
 Patch5:  mksquashfs-sysmacros-fix.patch
 # rhbz 1602698
 Patch6:  bz1602698.patch
 # rhbz 1624173
 Patch7: bz1624173.patch
 # rhbz 1716278
 Patch8: bz1716278.patch
 # rhbz 1754815
 Patch9: bz1754815.patch
 # rhbz 1895017
 Patch10: bz1895017.patch
 # rhbz 2000637 - CVE-2021-40153
 Patch11: bz2000637.patch
 # rhbz 2007303 - CVE-2021-41072
 Patch12: CVE-2021-41072-c8s-combined.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 BuildRequires: zlib-devel
 BuildRequires: xz-devel
 BuildRequires: lzo-devel
 BuildRequires: libattr-devel
 BuildRequires: lz4-devel
 BuildRequires: libzstd-devel
 %description
 Squashfs is a highly compressed read-only filesystem for Linux.  This package
 contains the utilities for manipulating squashfs filesystems.
 %prep
-%setup -n %{name}-4.4-git.1
+%setup -q -n squashfs%{version}
 %patch0 -p1
 %patch1 -p1
 %patch2 -p0
 %patch3 -p1
 %patch4 -p0
 %patch5 -p1
 %patch6 -p1
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
 %patch10 -p1
 %patch11 -p1
 %patch12 -p1
 %build
 %set_build_flags
 pushd squashfs-tools
-CFLAGS="%{optflags}" XZ_SUPPORT=1 LZO_SUPPORT=1 LZMA_XZ_SUPPORT=1 LZ4_SUPPORT=1 ZSTD_SUPPORT=1 make %{?_smp_mflags}
+CFLAGS="%{optflags}" XZ_SUPPORT=1 LZO_SUPPORT=1 LZMA_XZ_SUPPORT=1 LZ4_SUPPORT=1 make %{?_smp_mflags}
 %install
 mkdir -p %{buildroot}%{_sbindir} %{buildroot}%{_mandir}/man1
@ -42,8 +80,12 @@ install -m 755 squashfs-tools/unsquashfs %{buildroot}%{_sbindir}/unsquashfs
 install -m 644 %{SOURCE1} %{buildroot}%{_mandir}/man1/mksquashfs.1
 install -m 644 %{SOURCE2} %{buildroot}%{_mandir}/man1/unsquashfs.1
 %clean
 rm -rf %{buildroot}
 %files
-%doc README ACKNOWLEDGEMENTS README-4.4 CHANGES COPYING USAGE
+%defattr(-,root,root,-)
 %doc README ACKNOWLEDGEMENTS DONATIONS PERFORMANCE.README README-4.3 CHANGES pseudo-file.example COPYING
 %doc README
 %{_mandir}/man1/*
@ -52,59 +94,32 @@ install -m 644 %{SOURCE2} %{buildroot}%{_mandir}/man1/unsquashfs.1
 %{_sbindir}/unsquashfs
 %changelog
-* Wed Jan 12 2022 Abhi Das <adas@redhat.com> - 4.4-8.git1
+* Fri Mar 29 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 4.3-21
- limit CPUs on large machines to avoid running out of resources
+- Rebuilt for MSVSphere 8.10 beta
-  rhbz#2023218
+
-
+* Mon Sep 18 2023 Abhi Das <adas@redhat.com> - 4.3-21
-* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 4.4-7.git1
+- CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
-  Related: rhbz#1991688
+  Resolves: rhbz#2007303 rhbz#2000637
-
+
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 4.4-6.git1
+* Thu Feb 25 2021 Abhi Das <adas@redhat.com> - 4.3-20
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+- rhbz#1895017 - unsquashfs does not preserve file capabilities
-
+  rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4-5.git1
+  Resolves: rhbz#1895017, rhbz#1754815
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
-
+* Tue Aug 06 2019 Abhi Das <adas@redhat.com> - 4.3-19
-* Sat Nov 14 2020 Bruno Wolff III <bruno@wolff.to> - 4.4-4.git1
+- rhbz#1602698 - Fix coverity issues
- Gating tests failed and unable to rerun them
+  rhbz#1624173 - Fix annocheck failures
-
+  rhbz#1716278 - limit max cpus in mksquashfs
-* Wed Nov 11 2020 Bruno Wolff III <bruno@wolff.to> - 4.4-3.git1
+  Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278
- New upstream release with a minor fix
+
-
+* Tue Aug 06 2019 Abhi Das <adas@redhat.com> - 4.3-18
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.4-2
+- Add manual gating test
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+  Resolves: rhbz#1682413
-
+
-* Tue May 12 2020 Bruno Wolff III <bruno@wolff.to> - 4.4-1.20200513gitc570c61
+* Mon Aug 20 2018 Josh Boyer <jwboyer@redhat.com> - 4.3-17
- Go to 4.4 release + plus a few upstream post release patches
+- Fix build against glibc 2.28
-
+  Resolves: rhbz#1611746
 * Sat Feb 08 2020 Bruno Wolff III <bruno@wolff.to> - 4.3-25
 - Fix duplicate definition flagged by gcc10
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-24
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 * Fri Jan 17 2020 Jeff Law <law@redhat.com> - 4.3-23
 - Fix undefined symbol when building with LTO due to incorrect
  use of inline function
 * Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-22
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Mon Jun 24 2019 Bruno Wolff III <bruno@wolff.to> - 4.3-21
 - Add zstd compression support (Sean Purcell via github.com/plougher/squashfs-tools)
 * Tue May 21 2019 Bruno Wolff III <bruno@wolff.to> - 4.3-20
 - Fix issue with LDFLAGS not being set
 * Tue May 21 2019 Bruno Wolff III <bruno@wolff.to> - 4.3-19
 - Fix issue with glibc changes
 * Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-18
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-17
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-16
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
`@ -1 +1 @@`
	`SOURCES/4.4-git.1.tar.gz`	`SOURCES/squashfs4.3.tar.gz`
`@ -1 +1 @@`
	`ccdbdb36be907de767019f2f35e985c6fad1bc2c SOURCES/4.4-git.1.tar.gz`	`a615979db9cee82e4a934a1455577f597d290b41 SOURCES/squashfs4.3.tar.gz`