pool/zziplib
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 568759 from home:scarabeus_iv:branches:devel:libraries:c_c++

Browse Source 
- Drop tests as they fail completely anyway, not finding lib needing
  zip command, this should allow us to kill python dependency
- Also drop docs subdir avoiding python dependency for it
  * The generated xmls were used for mans too but we shipped those
    only in devel pkg and as such we will live without them

- Version update to 0.13.67:
  * Various fixes found by fuzzing
  * Merged bellow patches
- Remove merged patches:
  * zziplib-CVE-2017-5974.patch
  * zziplib-CVE-2017-5975.patch
  * zziplib-CVE-2017-5976.patch
  * zziplib-CVE-2017-5978.patch
  * zziplib-CVE-2017-5979.patch
  * zziplib-CVE-2017-5981.patch
- Switch to github tarball as upstream seem no longer pull it to
  sourceforge
- Remove no longer applying patch zziplib-unzipcat-NULL-name.patch
  * The sourcecode was quite changed for this to work this way
    anymore, lets hope this is fixed too

OBS-URL: https://build.opensuse.org/request/show/568759
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zziplib?expand=0&rev=21
This commit is contained in:
Marcus Meissner 2018-01-26 16:23:16 +00:00 committed by Git OBS Bridge
parent cd3445e47b
commit d31eba1de7
11 changed files with 38 additions and 241 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
v0.13.67.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:1278178bdabac832da6bbf161033d890d335a2e38493c5af553ff5ce7b9b0220
size 1072276

3
zziplib-0.13.62.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:a1b8033f1a1fd6385f4820b01ee32d8eca818409235d22caf5119e0078c7525b
size 685770

22
zziplib-CVE-2017-5974.patch
View File

@ -1,22 +0,0 @@
Index: zziplib-0.13.62/zzip/memdisk.c
===================================================================
--- zziplib-0.13.62.orig/zzip/memdisk.c
+++ zziplib-0.13.62/zzip/memdisk.c
@@ -216,12 +216,12 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
/* override sizes/offsets with zip64 values for largefile support */
zzip_extra_zip64 *block = (zzip_extra_zip64 *)
zzip_mem_entry_extra_block(item, ZZIP_EXTRA_zip64);
- if (block)
+ if (block && ZZIP_GET16(block->z_datasize) >= (8 + 8 + 8 + 4))
{
- item->zz_usize = __zzip_get64(block->z_usize);
- item->zz_csize = __zzip_get64(block->z_csize);
- item->zz_offset = __zzip_get64(block->z_offset);
- item->zz_diskstart = __zzip_get32(block->z_diskstart);
+ item->zz_usize = ZZIP_GET64(block->z_usize);
+ item->zz_csize = ZZIP_GET64(block->z_csize);
+ item->zz_offset = ZZIP_GET64(block->z_offset);
+ item->zz_diskstart = ZZIP_GET32(block->z_diskstart);
}
}
/* NOTE:

26
zziplib-CVE-2017-5975.patch
View File

@ -1,26 +0,0 @@
Index: zziplib-0.13.62/zzip/memdisk.c
===================================================================
--- zziplib-0.13.62.orig/zzip/memdisk.c
+++ zziplib-0.13.62/zzip/memdisk.c
@@ -173,6 +173,8 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
return 0; /* errno=ENOMEM; */
___ struct zzip_file_header *header =
zzip_disk_entry_to_file_header(disk, entry);
+ if (!header)
+ { free(item); return 0; }
/* there is a number of duplicated information in the file header
* or the disk entry block. Theoretically some part may be missing
* that exists in the other, ... but we will prefer the disk entry.
Index: zziplib-0.13.62/zzip/mmapped.c
===================================================================
--- zziplib-0.13.62.orig/zzip/mmapped.c
+++ zziplib-0.13.62/zzip/mmapped.c
@@ -289,6 +289,8 @@ zzip_disk_entry_to_file_header(ZZIP_DISK
(disk->buffer + zzip_disk_entry_fileoffset(entry));
if (disk->buffer > file_header || file_header >= disk->endbuf)
return 0;
+ if (ZZIP_GET32(file_header) != ZZIP_FILE_HEADER_MAGIC)
+ return 0;
return (struct zzip_file_header *) file_header;
}

55
zziplib-CVE-2017-5976.patch
View File

@ -1,55 +0,0 @@
Index: zziplib-0.13.62/zzip/memdisk.c
===================================================================
--- zziplib-0.13.62.orig/zzip/memdisk.c
+++ zziplib-0.13.62/zzip/memdisk.c
@@ -201,6 +201,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
{
void *mem = malloc(ext1 + 2);
item->zz_ext[1] = mem;
+ item->zz_extlen[1] = ext1 + 2;
memcpy(mem, ptr1, ext1);
((char *) (mem))[ext1 + 0] = 0;
((char *) (mem))[ext1 + 1] = 0;
@@ -209,6 +210,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
{
void *mem = malloc(ext2 + 2);
item->zz_ext[2] = mem;
+ item->zz_extlen[2] = ext2 + 2;
memcpy(mem, ptr2, ext2);
((char *) (mem))[ext2 + 0] = 0;
((char *) (mem))[ext2 + 1] = 0;
@@ -245,8 +247,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
while (1)
{
ZZIP_EXTRA_BLOCK *ext = entry->zz_ext[i];
- if (ext)
+ if (ext && (entry->zz_extlen[i] >= zzip_extra_block_headerlength))
{
+ char *endblock = (char *)ext + entry->zz_extlen[i];
+
while (*(short *) (ext->z_datatype))
{
if (datatype == zzip_extra_block_get_datatype(ext))
@@ -257,6 +261,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
e += zzip_extra_block_headerlength;
e += zzip_extra_block_get_datasize(ext);
ext = (void *) e;
+ if (e >= endblock)
+ {
+ break;
+ }
____;
}
}
Index: zziplib-0.13.62/zzip/memdisk.h
===================================================================
--- zziplib-0.13.62.orig/zzip/memdisk.h
+++ zziplib-0.13.62/zzip/memdisk.h
@@ -66,6 +66,7 @@ struct _zzip_mem_entry {
int zz_filetype; /* (from "z_filetype") */
char* zz_comment; /* zero-terminated (from "comment") */
ZZIP_EXTRA_BLOCK* zz_ext[3]; /* terminated by null in z_datatype */
+ int zz_extlen[3]; /* length of zz_ext[i] in bytes */
}; /* the extra blocks are NOT converted */
#define _zzip_mem_disk_findfirst(_d_) ((_d_)->list)

31
zziplib-CVE-2017-5978.patch
View File

@ -1,31 +0,0 @@
Index: zziplib-0.13.62/zzip/memdisk.c
===================================================================
--- zziplib-0.13.62.orig/zzip/memdisk.c
+++ zziplib-0.13.62/zzip/memdisk.c
@@ -180,7 +180,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
* that exists in the other, ... but we will prefer the disk entry.
*/
item->zz_comment = zzip_disk_entry_strdup_comment(disk, entry);
- item->zz_name = zzip_disk_entry_strdup_name(disk, entry);
+ item->zz_name = zzip_disk_entry_strdup_name(disk, entry) ?: strdup("");
item->zz_data = zzip_file_header_to_data(header);
item->zz_flags = zzip_disk_entry_get_flags(entry);
item->zz_compr = zzip_disk_entry_get_compr(entry);
@@ -197,7 +197,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
int /* */ ext2 = zzip_file_header_get_extras(header);
char *_zzip_restrict ptr2 = zzip_file_header_to_extras(header);
- if (ext1)
+ if (ext1 && ((ptr1 + ext1) < disk->endbuf))
{
void *mem = malloc(ext1 + 2);
item->zz_ext[1] = mem;
@@ -206,7 +206,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
((char *) (mem))[ext1 + 0] = 0;
((char *) (mem))[ext1 + 1] = 0;
}
- if (ext2)
+ if (ext2 && ((ptr2 + ext2) < disk->endbuf))
{
void *mem = malloc(ext2 + 2);
item->zz_ext[2] = mem;

13
zziplib-CVE-2017-5979.patch
View File

@ -1,13 +0,0 @@
Index: zziplib-0.13.62/zzip/fseeko.c
===================================================================
--- zziplib-0.13.62.orig/zzip/fseeko.c
+++ zziplib-0.13.62/zzip/fseeko.c
@@ -255,7 +255,7 @@ zzip_entry_findfirst(FILE * disk)
return 0;
/* we read out chunks of 8 KiB in the hope to match disk granularity */
___ zzip_off_t pagesize = PAGESIZE; /* getpagesize() */
- ___ ZZIP_ENTRY *entry = malloc(sizeof(*entry));
+ ___ ZZIP_ENTRY *entry = calloc(1, sizeof(*entry));
if (! entry)
return 0;
___ unsigned char *buffer = malloc(pagesize);

14
zziplib-CVE-2017-5981.patch
View File

@ -1,14 +0,0 @@
Index: zziplib-0.13.62/zzip/fseeko.c
===================================================================
--- zziplib-0.13.62.orig/zzip/fseeko.c
+++ zziplib-0.13.62/zzip/fseeko.c
@@ -311,7 +311,8 @@ zzip_entry_findfirst(FILE * disk)
} else
continue;
- assert(0 <= root && root < mapsize);
+ if (root < 0 || root >= mapsize)
+ goto error;
if (fseeko(disk, root, SEEK_SET) == -1)
goto error;
if (fread(disk_(entry), 1, sizeof(*disk_(entry)), disk)

50
zziplib-unzipcat-NULL-name.patch
View File

@ -1,50 +0,0 @@
Index: zziplib-0.13.62/bins/unzzipcat.c
===================================================================
--- zziplib-0.13.62.orig/bins/unzzipcat.c
+++ zziplib-0.13.62/bins/unzzipcat.c
@@ -91,8 +91,11 @@ main (int argc, char ** argv)
for (; entry ; entry = zzip_disk_findnext(disk, entry))
{
char* name = zzip_disk_entry_strdup_name (disk, entry);
- printf ("%s\n", name);
- free (name);
+ if (name)
+ {
+ printf ("%s\n", name);
+ free (name);
+ }
}
return 0;
}
@@ -112,10 +115,13 @@ main (int argc, char ** argv)
for (; entry ; entry = zzip_disk_findnext(disk, entry))
{
char* name = zzip_disk_entry_strdup_name (disk, entry);
- if (! fnmatch (argv[argn], name,
- FNM_NOESCAPE|FNM_PATHNAME|FNM_PERIOD))
- zzip_disk_cat_file (disk, name, stdout);
- free (name);
+ if (name)
+ {
+ if (! fnmatch (argv[argn], name,
+ FNM_NOESCAPE|FNM_PATHNAME|FNM_PERIOD))
+ zzip_disk_cat_file (disk, name, stdout);
+ free (name);
+ }
}
}
return 0;
Index: zziplib-0.13.62/zzip/fseeko.c
===================================================================
--- zziplib-0.13.62.orig/zzip/fseeko.c
+++ zziplib-0.13.62/zzip/fseeko.c
@@ -300,7 +300,8 @@ zzip_entry_findfirst(FILE * disk)
* central directory was written directly before : */
root = mapoffs - rootsize;
}
- } else if (zzip_disk64_trailer_check_magic(p))
+ } else if ((p + sizeof(struct zzip_disk64_trailer)) <= (buffer + mapsize)
+ && zzip_disk64_trailer_check_magic(p))
{
struct zzip_disk64_trailer *trailer =
(struct zzip_disk64_trailer *) p;

28
zziplib.changes
View File

@ -1,3 +1,31 @@
-------------------------------------------------------------------
Tue Jan 23 20:18:19 UTC 2018 - tchvatal@suse.com
- Drop tests as they fail completely anyway, not finding lib needing
zip command, this should allow us to kill python dependency
- Also drop docs subdir avoiding python dependency for it
* The generated xmls were used for mans too but we shipped those
only in devel pkg and as such we will live without them
-------------------------------------------------------------------
Tue Jan 23 20:03:01 UTC 2018 - tchvatal@suse.com
- Version update to 0.13.67:
* Various fixes found by fuzzing
* Merged bellow patches
- Remove merged patches:
* zziplib-CVE-2017-5974.patch
* zziplib-CVE-2017-5975.patch
* zziplib-CVE-2017-5976.patch
* zziplib-CVE-2017-5978.patch
* zziplib-CVE-2017-5979.patch
* zziplib-CVE-2017-5981.patch
- Switch to github tarball as upstream seem no longer pull it to
sourceforge
- Remove no longer applying patch zziplib-unzipcat-NULL-name.patch
* The sourcecode was quite changed for this to work this way
anymore, lets hope this is fixed too
-------------------------------------------------------------------
Wed Nov 1 12:37:02 UTC 2017 - mpluskal@suse.com

34
zziplib.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package zziplib
#
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -18,32 +18,23 @@
%define lname libzzip-0-13
Name: zziplib
Version: 0.13.62
Version: 0.13.67
Release: 0
Summary: Free Zip Compression Library with an Easy-to-Use API
License: LGPL-2.1+
Group: System/Libraries
Url: http://zziplib.sourceforge.net
Source0: http://prdownloads.sourceforge.net/zziplib/%{name}-%{version}.tar.bz2
Source0: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz
Source2: baselibs.conf
Patch0: zziplib-0.13.62.patch
Patch1: zziplib-0.13.62-wronglinking.patch
Patch2: zziplib-largefile.patch
Patch3: zziplib-CVE-2017-5974.patch
Patch4: zziplib-CVE-2017-5975.patch
Patch5: zziplib-CVE-2017-5976.patch
Patch6: zziplib-CVE-2017-5978.patch
Patch7: zziplib-CVE-2017-5979.patch
Patch8: zziplib-unzipcat-NULL-name.patch
Patch9: zziplib-CVE-2017-5981.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: dos2unix
BuildRequires: fdupes
BuildRequires: libtool
BuildRequires: pkgconfig
BuildRequires: xmlto
BuildRequires: pkgconfig(python2)
BuildRequires: pkgconfig(zlib)
%description
@ -75,13 +66,8 @@ ZZipLib.
%patch0
%patch1
%patch2
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
# do not bother with html docs saving us python2 dependency
sed -i -e 's:docs ::g' Makefile.am
%build
autoreconf -fiv
@ -94,31 +80,25 @@ make %{?_smp_mflags}
%install
%make_install
# Fix wrong encoding
dos2unix docs/README.MSVC6
dos2unix docs/sdocbook.css
rm -f docs/Make* docs/zziplib-manpages.ar
find %{buildroot} -type f -name "*.la" -delete -print
%fdupes %{buildroot}
%check
make %{?_smp_mflags} check || exit 0
%post -n %{lname} -p /sbin/ldconfig
%postun -n %{lname} -p /sbin/ldconfig
%files -n %{lname}
%license COPYING.LIB
%{_libdir}/libzzip*.so.*
%files devel
%doc docs/README* docs/* ChangeLog README TODO
%doc docs/README* ChangeLog README TODO
%{_bindir}/unzzip*
%{_bindir}/zz*
%{_bindir}/unzip-mem
%{_libdir}/libzzip*.so
%{_includedir}/*
%{_libdir}/pkgconfig/*.pc
%{_mandir}/man3/*
%{_datadir}/aclocal/*.m4
%changelog