Accepting request 619404 from home:kstreitova:branches:Archiving
- Add unzip60-total_disks_zero.patch that fixes a bug when unzip is unable to process Windows zip64 archives because Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher [bnc#910683] - Add Fix-CVE-2014-9636-unzip-buffer-overflow.patch to fix heap overflow for STORED field data [bnc#914442] [CVE-2014-9636] - Add unzip60-total_disks_zero.patch that fixes a bug when unzip is unable to process Windows zip64 archives because Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher [bnc#910683] - Add Fix-CVE-2014-9636-unzip-buffer-overflow.patch to fix heap overflow for STORED field data [bnc#914442] [CVE-2014-9636] OBS-URL: https://build.opensuse.org/request/show/619404 OBS-URL: https://build.opensuse.org/package/show/Archiving/unzip?expand=0&rev=49
This commit is contained in:
Martin Pluskal
Git OBS Bridge
parent
5c47713ede
commit
04e2f23972
41
Fix-CVE-2014-9636-unzip-buffer-overflow.patch
Normal file
41
Fix-CVE-2014-9636-unzip-buffer-overflow.patch
Normal file
@ -0,0 +1,41 @@
|
||||
From 190040ebfcf5395a6ccedede2cc9343d34f0a108 Mon Sep 17 00:00:00 2001
|
||||
From: mancha <mancha1 AT zoho DOT com>
|
||||
Date: Wed, 11 Feb 2015
|
||||
Subject: Info-ZIP UnZip buffer overflow
|
||||
|
||||
By carefully crafting a corrupt ZIP archive with "extra fields" that
|
||||
purport to have compressed blocks larger than the corresponding
|
||||
uncompressed blocks in STORED no-compression mode, an attacker can
|
||||
trigger a heap overflow that can result in application crash or
|
||||
possibly have other unspecified impact.
|
||||
|
||||
This patch ensures that when extra fields use STORED mode, the
|
||||
"compressed" and uncompressed block sizes match.
|
||||
|
||||
---
|
||||
extract.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
--- unzip60/extract.c
|
||||
+++ unzip60/extract.c
|
||||
@@ -2230,6 +2230,7 @@ static int test_compr_eb(__G__ eb, eb_si
|
||||
ulg eb_ucsize;
|
||||
uch *eb_ucptr;
|
||||
int r;
|
||||
+ ush method;
|
||||
|
||||
if (compr_offset < 4) /* field is not compressed: */
|
||||
return PK_OK; /* do nothing and signal OK */
|
||||
@@ -2246,6 +2247,13 @@ static int test_compr_eb(__G__ eb, eb_si
|
||||
((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
|
||||
return IZ_EF_TRUNC; /* no/bad compressed data! */
|
||||
|
||||
+ method = makeword(eb + (EB_HEADSIZE + compr_offset));
|
||||
+ if ((method == STORED) &&
|
||||
+ (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
|
||||
+ return PK_ERR; /* compressed & uncompressed
|
||||
+ * should match in STORED
|
||||
+ * method */
|
||||
+
|
||||
if (
|
||||
#ifdef INT_16BIT
|
||||
(((ulg)(extent)eb_ucsize) != eb_ucsize) ||
|
||||
@ -1,3 +1,13 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Jun 27 11:39:10 UTC 2018 - kstreitova@suse.com
|
||||
|
||||
- Add unzip60-total_disks_zero.patch that fixes a bug when unzip is
|
||||
unable to process Windows zip64 archives because Windows
|
||||
archivers set total_disks field to 0 but per standard, valid
|
||||
values are 1 and higher [bnc#910683]
|
||||
- Add Fix-CVE-2014-9636-unzip-buffer-overflow.patch to fix heap
|
||||
overflow for STORED field data [bnc#914442] [CVE-2014-9636]
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed May 16 19:44:45 UTC 2018 - antoine.belvire@opensuse.org
|
||||
|
||||
|
||||
@ -57,6 +57,8 @@ Patch16: CVE-2015-7697.patch
|
||||
Patch17: CVE-2016-9844.patch
|
||||
Patch18: CVE-2014-9913.patch
|
||||
Patch19: CVE-2018-1000035.patch
|
||||
Patch20: Fix-CVE-2014-9636-unzip-buffer-overflow.patch
|
||||
Patch21: unzip60-total_disks_zero.patch
|
||||
Requires(post): update-alternatives
|
||||
Requires(postun): update-alternatives
|
||||
Recommends: %{_name}-doc
|
||||
@ -100,6 +102,8 @@ functionality. This version can also extract encrypted archives.
|
||||
%patch17 -p1
|
||||
%patch18 -p1
|
||||
%patch19 -p0
|
||||
%patch20 -p1
|
||||
%patch21 -p1
|
||||
|
||||
%build
|
||||
export RPM_OPT_FLAGS="%{optflags} \
|
||||
|
||||
@ -1,3 +1,13 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Jun 27 11:39:10 UTC 2018 - kstreitova@suse.com
|
||||
|
||||
- Add unzip60-total_disks_zero.patch that fixes a bug when unzip is
|
||||
unable to process Windows zip64 archives because Windows
|
||||
archivers set total_disks field to 0 but per standard, valid
|
||||
values are 1 and higher [bnc#910683]
|
||||
- Add Fix-CVE-2014-9636-unzip-buffer-overflow.patch to fix heap
|
||||
overflow for STORED field data [bnc#914442] [CVE-2014-9636]
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed May 16 19:44:45 UTC 2018 - antoine.belvire@opensuse.org
|
||||
|
||||
|
||||
@ -57,6 +57,8 @@ Patch16: CVE-2015-7697.patch
|
||||
Patch17: CVE-2016-9844.patch
|
||||
Patch18: CVE-2014-9913.patch
|
||||
Patch19: CVE-2018-1000035.patch
|
||||
Patch20: Fix-CVE-2014-9636-unzip-buffer-overflow.patch
|
||||
Patch21: unzip60-total_disks_zero.patch
|
||||
Requires(post): update-alternatives
|
||||
Requires(postun): update-alternatives
|
||||
Recommends: %{_name}-doc
|
||||
@ -100,6 +102,8 @@ functionality. This version can also extract encrypted archives.
|
||||
%patch17 -p1
|
||||
%patch18 -p1
|
||||
%patch19 -p0
|
||||
%patch20 -p1
|
||||
%patch21 -p1
|
||||
|
||||
%build
|
||||
export RPM_OPT_FLAGS="%{optflags} \
|
||||
|
||||
24
unzip60-total_disks_zero.patch
Normal file
24
unzip60-total_disks_zero.patch
Normal file
@ -0,0 +1,24 @@
|
||||
Index: unzip60/process.c
|
||||
===================================================================
|
||||
--- unzip60.orig/process.c
|
||||
+++ unzip60/process.c
|
||||
@@ -1286,7 +1286,8 @@ static int find_ecrec64(__G__ searchlen)
|
||||
G.ecrec.number_this_disk, ecloc64_total_disks); fflush(stdout);
|
||||
#endif
|
||||
if ((G.ecrec.number_this_disk != 0xFFFF) &&
|
||||
- (G.ecrec.number_this_disk != ecloc64_total_disks - 1)) {
|
||||
+ (G.ecrec.number_this_disk != ecloc64_total_disks - 1) &&
|
||||
+ (ecloc64_total_disks != 0)) {
|
||||
/* Note: For some unknown reason, the developers at PKWARE decided to
|
||||
store the "zip64 total disks" value as a counter starting from 1,
|
||||
whereas all other "split/span volume" related fields use 0-based
|
||||
@@ -1296,6 +1297,9 @@ static int find_ecrec64(__G__ searchlen)
|
||||
When this is not the case, the found ecrec64 locator cannot be valid.
|
||||
-> This is not a Zip64 archive.
|
||||
*/
|
||||
+ /* There are archive creators that put 0 in total disks when it should
|
||||
+ be 1. We should handle this. This is done by the added check above.
|
||||
+ */
|
||||
Trace((stderr,
|
||||
"\ninvalid ECLOC64, differing disk# (ECR %u, ECL64 %lu)\n",
|
||||
G.ecrec.number_this_disk, ecloc64_total_disks - 1));
|
||||
Loading…
Reference in New Issue
Block a user