Merge branch 'master' into core-updates

1 files changed, 61 insertions, 0 deletions

diff --git a/gnu/packages/patches/zziplib-CVE-2017-5976.patch b/gnu/packages/patches/zziplib-CVE-2017-5976.patch
new file mode 100644
index 0000000000..17fc30e302
--- /dev/null
+++ b/gnu/packages/patches/zziplib-CVE-2017-5976.patch
@@ -0,0 +1,61 @@
+Fix CVE-2017-5976:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5976
+
+Patch copied from Debian.
+
+Index: zziplib-0.13.62/zzip/memdisk.c
+===================================================================
+--- zziplib-0.13.62.orig/zzip/memdisk.c
++++ zziplib-0.13.62/zzip/memdisk.c
+@@ -201,6 +201,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
+         {
+             void *mem = malloc(ext1 + 2);
+             item->zz_ext[1] = mem;
++	    item->zz_extlen[1] = ext1 + 2;
+             memcpy(mem, ptr1, ext1);
+             ((char *) (mem))[ext1 + 0] = 0;
+             ((char *) (mem))[ext1 + 1] = 0;
+@@ -209,6 +210,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
+         {
+             void *mem = malloc(ext2 + 2);
+             item->zz_ext[2] = mem;
++	    item->zz_extlen[2] = ext2 + 2;
+             memcpy(mem, ptr2, ext2);
+             ((char *) (mem))[ext2 + 0] = 0;
+             ((char *) (mem))[ext2 + 1] = 0;
+@@ -245,8 +247,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
+     while (1)
+     {
+         ZZIP_EXTRA_BLOCK *ext = entry->zz_ext[i];
+-        if (ext)
++        if (ext && (entry->zz_extlen[i] >= zzip_extra_block_headerlength))
+         {
++	    char *endblock = (char *)ext + entry->zz_extlen[i];
++
+             while (*(short *) (ext->z_datatype))
+             {
+                 if (datatype == zzip_extra_block_get_datatype(ext))
+@@ -257,6 +261,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
+                 e += zzip_extra_block_headerlength;
+                 e += zzip_extra_block_get_datasize(ext);
+                 ext = (void *) e;
++		if (e >= endblock)
++		{
++		    break;
++		}
+                 ____;
+             }
+         }
+Index: zziplib-0.13.62/zzip/memdisk.h
+===================================================================
+--- zziplib-0.13.62.orig/zzip/memdisk.h
++++ zziplib-0.13.62/zzip/memdisk.h
+@@ -66,6 +66,7 @@ struct _zzip_mem_entry {
+     int              zz_filetype;  /* (from "z_filetype") */
+     char*            zz_comment;   /* zero-terminated (from "comment") */
+     ZZIP_EXTRA_BLOCK* zz_ext[3];   /* terminated by null in z_datatype */
++    int              zz_extlen[3]; /* length of zz_ext[i] in bytes */
+ };                                 /* the extra blocks are NOT converted */
+ 
+ #define _zzip_mem_disk_findfirst(_d_) ((_d_)->list)