unzip: add patches for four CVEs (via NetBSD)
This commit is contained in:
Alessio Sergi
parent
b7a725a337
commit
17c99dd113
5 changed files with 244 additions and 1 deletions
86
srcpkgs/unzip/patches/patch-extract.c
Normal file
86
srcpkgs/unzip/patches/patch-extract.c
Normal file
|
|
@ -0,0 +1,86 @@
|
||||||
|
$NetBSD: patch-extract.c,v 1.1 2014/12/25 16:48:33 wiz Exp $
|
||||||
|
|
||||||
|
Fixes for
|
||||||
|
* https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8139
|
||||||
|
* https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140
|
||||||
|
* http://sf.net/projects/mancha/files/sec/unzip-6.0_overflow2.diff via
|
||||||
|
http://seclists.org/oss-sec/2014/q4/1131 and
|
||||||
|
http://seclists.org/oss-sec/2014/q4/507
|
||||||
|
|
||||||
|
--- extract.c.orig 2009-03-14 01:32:52.000000000 +0000
|
||||||
|
+++ extract.c
|
||||||
|
@@ -1,5 +1,5 @@
|
||||||
|
/*
|
||||||
|
- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
|
||||||
|
+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
|
||||||
|
|
||||||
|
See the accompanying file LICENSE, version 2009-Jan-02 or later
|
||||||
|
(the contents of which are also included in unzip.h) for terms of use.
|
||||||
|
@@ -298,6 +298,8 @@ char ZCONST Far TruncNTSD[] =
|
||||||
|
#ifndef SFX
|
||||||
|
static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
|
||||||
|
EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
|
||||||
|
+ static ZCONST char Far TooSmallEFlength[] = "bad extra-field entry:\n \
|
||||||
|
+ EF block length (%u bytes) invalid (< %d)\n";
|
||||||
|
static ZCONST char Far InvalidComprDataEAs[] =
|
||||||
|
" invalid compressed data for EAs\n";
|
||||||
|
# if (defined(WIN32) && defined(NTSD_EAS))
|
||||||
|
@@ -2023,7 +2025,8 @@ static int TestExtraField(__G__ ef, ef_l
|
||||||
|
ebID = makeword(ef);
|
||||||
|
ebLen = (unsigned)makeword(ef+EB_LEN);
|
||||||
|
|
||||||
|
- if (ebLen > (ef_len - EB_HEADSIZE)) {
|
||||||
|
+ if (ebLen > (ef_len - EB_HEADSIZE))
|
||||||
|
+ {
|
||||||
|
/* Discovered some extra field inconsistency! */
|
||||||
|
if (uO.qflag)
|
||||||
|
Info(slide, 1, ((char *)slide, "%-22s ",
|
||||||
|
@@ -2032,6 +2035,16 @@ static int TestExtraField(__G__ ef, ef_l
|
||||||
|
ebLen, (ef_len - EB_HEADSIZE)));
|
||||||
|
return PK_ERR;
|
||||||
|
}
|
||||||
|
+ else if (ebLen < EB_HEADSIZE)
|
||||||
|
+ {
|
||||||
|
+ /* Extra block length smaller than header length. */
|
||||||
|
+ if (uO.qflag)
|
||||||
|
+ Info(slide, 1, ((char *)slide, "%-22s ",
|
||||||
|
+ FnFilter1(G.filename)));
|
||||||
|
+ Info(slide, 1, ((char *)slide, LoadFarString(TooSmallEFlength),
|
||||||
|
+ ebLen, EB_HEADSIZE));
|
||||||
|
+ return PK_ERR;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
switch (ebID) {
|
||||||
|
case EF_OS2:
|
||||||
|
@@ -2217,14 +2230,28 @@ static int test_compr_eb(__G__ eb, eb_si
|
||||||
|
ulg eb_ucsize;
|
||||||
|
uch *eb_ucptr;
|
||||||
|
int r;
|
||||||
|
+ ush method;
|
||||||
|
|
||||||
|
if (compr_offset < 4) /* field is not compressed: */
|
||||||
|
return PK_OK; /* do nothing and signal OK */
|
||||||
|
|
||||||
|
+ /* Return no/bad-data error status if any problem is found:
|
||||||
|
+ * 1. eb_size is too small to hold the uncompressed size
|
||||||
|
+ * (eb_ucsize). (Else extract eb_ucsize.)
|
||||||
|
+ * 2. eb_ucsize is zero (invalid). 2014-12-04 SMS.
|
||||||
|
+ * 3. eb_ucsize is positive, but eb_size is too small to hold
|
||||||
|
+ * the compressed data header.
|
||||||
|
+ */
|
||||||
|
if ((eb_size < (EB_UCSIZE_P + 4)) ||
|
||||||
|
- ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L &&
|
||||||
|
- eb_size <= (compr_offset + EB_CMPRHEADLEN)))
|
||||||
|
- return IZ_EF_TRUNC; /* no compressed data! */
|
||||||
|
+ ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) ||
|
||||||
|
+ ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
|
||||||
|
+ return IZ_EF_TRUNC; /* no/bad compressed data! */
|
||||||
|
+
|
||||||
|
+ method = makeword(eb + (EB_HEADSIZE + compr_offset));
|
||||||
|
+ if ((method == STORED) && (eb_size - compr_offset != eb_ucsize))
|
||||||
|
+ return PK_ERR; /* compressed & uncompressed
|
||||||
|
+ * should match in STORED
|
||||||
|
+ * method */
|
||||||
|
|
||||||
|
if (
|
||||||
|
#ifdef INT_16BIT
|
||||||
29
srcpkgs/unzip/patches/patch-fileio.c
Normal file
29
srcpkgs/unzip/patches/patch-fileio.c
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
$NetBSD: patch-fileio.c,v 1.1 2014/12/25 16:48:33 wiz Exp $
|
||||||
|
|
||||||
|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8141
|
||||||
|
|
||||||
|
--- fileio.c.orig 2009-04-20 00:03:44.000000000 +0000
|
||||||
|
+++ fileio.c
|
||||||
|
@@ -176,6 +176,8 @@ static ZCONST char Far FilenameTooLongTr
|
||||||
|
#endif
|
||||||
|
static ZCONST char Far ExtraFieldTooLong[] =
|
||||||
|
"warning: extra field too long (%d). Ignoring...\n";
|
||||||
|
+static ZCONST char Far ExtraFieldCorrupt[] =
|
||||||
|
+ "warning: extra field (type: 0x%04x) corrupt. Continuing...\n";
|
||||||
|
|
||||||
|
#ifdef WINDLL
|
||||||
|
static ZCONST char Far DiskFullQuery[] =
|
||||||
|
@@ -2295,7 +2297,12 @@ int do_string(__G__ length, option) /*
|
||||||
|
if (readbuf(__G__ (char *)G.extra_field, length) == 0)
|
||||||
|
return PK_EOF;
|
||||||
|
/* Looks like here is where extra fields are read */
|
||||||
|
- getZip64Data(__G__ G.extra_field, length);
|
||||||
|
+ if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
|
||||||
|
+ {
|
||||||
|
+ Info(slide, 0x401, ((char *)slide,
|
||||||
|
+ LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
|
||||||
|
+ error = PK_WARN;
|
||||||
|
+ }
|
||||||
|
#ifdef UNICODE_SUPPORT
|
||||||
|
G.unipath_filename = NULL;
|
||||||
|
if (G.UzO.U_flag < 2) {
|
||||||
16
srcpkgs/unzip/patches/patch-list.c
Normal file
16
srcpkgs/unzip/patches/patch-list.c
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
$NetBSD: patch-list.c,v 1.1 2015/01/06 14:12:45 wiz Exp $
|
||||||
|
|
||||||
|
Big-hammer fix for
|
||||||
|
http://seclists.org/oss-sec/2014/q4/497
|
||||||
|
|
||||||
|
--- list.c.orig 2009-02-08 17:11:34.000000000 +0000
|
||||||
|
+++ list.c
|
||||||
|
@@ -116,7 +116,7 @@ int list_files(__G) /* return PK-type
|
||||||
|
ulg acl_size, tot_aclsize=0L, tot_aclfiles=0L;
|
||||||
|
#endif
|
||||||
|
min_info info;
|
||||||
|
- char methbuf[8];
|
||||||
|
+ char methbuf[80];
|
||||||
|
static ZCONST char dtype[]="NXFS"; /* see zi_short() */
|
||||||
|
static ZCONST char Far method[NUM_METHODS+1][8] =
|
||||||
|
{"Stored", "Shrunk", "Reduce1", "Reduce2", "Reduce3", "Reduce4",
|
||||||
112
srcpkgs/unzip/patches/patch-process.c
Normal file
112
srcpkgs/unzip/patches/patch-process.c
Normal file
|
|
@ -0,0 +1,112 @@
|
||||||
|
$NetBSD: patch-process.c,v 1.1 2014/12/25 16:48:33 wiz Exp $
|
||||||
|
|
||||||
|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8141
|
||||||
|
|
||||||
|
--- process.c.orig 2009-03-06 01:25:10.000000000 +0000
|
||||||
|
+++ process.c
|
||||||
|
@@ -1,5 +1,5 @@
|
||||||
|
/*
|
||||||
|
- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
|
||||||
|
+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
|
||||||
|
|
||||||
|
See the accompanying file LICENSE, version 2009-Jan-02 or later
|
||||||
|
(the contents of which are also included in unzip.h) for terms of use.
|
||||||
|
@@ -1888,48 +1888,82 @@ int getZip64Data(__G__ ef_buf, ef_len)
|
||||||
|
and a 4-byte version of disk start number.
|
||||||
|
Sets both local header and central header fields. Not terribly clever,
|
||||||
|
but it means that this procedure is only called in one place.
|
||||||
|
+
|
||||||
|
+ 2014-12-05 SMS.
|
||||||
|
+ Added checks to ensure that enough data are available before calling
|
||||||
|
+ makeint64() or makelong(). Replaced various sizeof() values with
|
||||||
|
+ simple ("4" or "8") constants. (The Zip64 structures do not depend
|
||||||
|
+ on our variable sizes.) Error handling is crude, but we should now
|
||||||
|
+ stay within the buffer.
|
||||||
|
---------------------------------------------------------------------------*/
|
||||||
|
|
||||||
|
+#define Z64FLGS 0xffff
|
||||||
|
+#define Z64FLGL 0xffffffff
|
||||||
|
+
|
||||||
|
if (ef_len == 0 || ef_buf == NULL)
|
||||||
|
return PK_COOL;
|
||||||
|
|
||||||
|
Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
|
||||||
|
ef_len));
|
||||||
|
|
||||||
|
- while (ef_len >= EB_HEADSIZE) {
|
||||||
|
+ while (ef_len >= EB_HEADSIZE)
|
||||||
|
+ {
|
||||||
|
eb_id = makeword(EB_ID + ef_buf);
|
||||||
|
eb_len = makeword(EB_LEN + ef_buf);
|
||||||
|
|
||||||
|
- if (eb_len > (ef_len - EB_HEADSIZE)) {
|
||||||
|
- /* discovered some extra field inconsistency! */
|
||||||
|
+ if (eb_len > (ef_len - EB_HEADSIZE))
|
||||||
|
+ {
|
||||||
|
+ /* Extra block length exceeds remaining extra field length. */
|
||||||
|
Trace((stderr,
|
||||||
|
"getZip64Data: block length %u > rest ef_size %u\n", eb_len,
|
||||||
|
ef_len - EB_HEADSIZE));
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
- if (eb_id == EF_PKSZ64) {
|
||||||
|
-
|
||||||
|
+ if (eb_id == EF_PKSZ64)
|
||||||
|
+ {
|
||||||
|
int offset = EB_HEADSIZE;
|
||||||
|
|
||||||
|
- if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
|
||||||
|
- G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
|
||||||
|
- offset += sizeof(G.crec.ucsize);
|
||||||
|
+ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
|
||||||
|
+ {
|
||||||
|
+ if (offset+ 8 > ef_len)
|
||||||
|
+ return PK_ERR;
|
||||||
|
+
|
||||||
|
+ G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
|
||||||
|
+ offset += 8;
|
||||||
|
}
|
||||||
|
- if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
|
||||||
|
- G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
|
||||||
|
- offset += sizeof(G.crec.csize);
|
||||||
|
+
|
||||||
|
+ if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
|
||||||
|
+ {
|
||||||
|
+ if (offset+ 8 > ef_len)
|
||||||
|
+ return PK_ERR;
|
||||||
|
+
|
||||||
|
+ G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
|
||||||
|
+ offset += 8;
|
||||||
|
}
|
||||||
|
- if (G.crec.relative_offset_local_header == 0xffffffff){
|
||||||
|
+
|
||||||
|
+ if (G.crec.relative_offset_local_header == Z64FLGL)
|
||||||
|
+ {
|
||||||
|
+ if (offset+ 8 > ef_len)
|
||||||
|
+ return PK_ERR;
|
||||||
|
+
|
||||||
|
G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
|
||||||
|
- offset += sizeof(G.crec.relative_offset_local_header);
|
||||||
|
+ offset += 8;
|
||||||
|
}
|
||||||
|
- if (G.crec.disk_number_start == 0xffff){
|
||||||
|
+
|
||||||
|
+ if (G.crec.disk_number_start == Z64FLGS)
|
||||||
|
+ {
|
||||||
|
+ if (offset+ 4 > ef_len)
|
||||||
|
+ return PK_ERR;
|
||||||
|
+
|
||||||
|
G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
|
||||||
|
- offset += sizeof(G.crec.disk_number_start);
|
||||||
|
+ offset += 4;
|
||||||
|
}
|
||||||
|
+#if 0
|
||||||
|
+ break; /* Expect only one EF_PKSZ64 block. */
|
||||||
|
+#endif /* 0 */
|
||||||
|
}
|
||||||
|
|
||||||
|
- /* Skip this extra field block */
|
||||||
|
+ /* Skip this extra field block. */
|
||||||
|
ef_buf += (eb_len + EB_HEADSIZE);
|
||||||
|
ef_len -= (eb_len + EB_HEADSIZE);
|
||||||
|
}
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
# Template file for 'unzip'
|
# Template file for 'unzip'
|
||||||
pkgname=unzip
|
pkgname=unzip
|
||||||
version=6.0
|
version=6.0
|
||||||
revision=5
|
revision=6
|
||||||
makedepends="bzip2-devel"
|
makedepends="bzip2-devel"
|
||||||
wrksrc=unzip60
|
wrksrc=unzip60
|
||||||
short_desc="List, test and extract compressed files in a ZIP archive"
|
short_desc="List, test and extract compressed files in a ZIP archive"
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue