aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches/unzip-CVE-2014-9636.patch
diff options
context:
space:
mode:
authorMark H Weaver <mhw@netris.org>2015-10-08 10:01:02 -0400
committerMark H Weaver <mhw@netris.org>2015-10-08 10:07:44 -0400
commit48e4a9f32f93c404b6fb4472164d8e00d12b2937 (patch)
tree8057d803846a751ff0a2beef9f66b45d8f9a0765 /gnu/packages/patches/unzip-CVE-2014-9636.patch
parente91e28d60c66362b7114d7a3ed7809609f2c1b4b (diff)
downloadguix-48e4a9f32f93c404b6fb4472164d8e00d12b2937.tar
guix-48e4a9f32f93c404b6fb4472164d8e00d12b2937.tar.gz
gnu: unzip: Add various fixes.
* gnu/packages/patches/unzip-increase-size-of-cfactorstr.patch: Delete file. Replace with ... * gnu/packages/patches/unzip-overflow-long-fsize.patch: ... this new file. * gnu/packages/patches/unzip-attribs-overflow.patch, gnu/packages/patches/unzip-fix-overflows-and-infloop.patch, gnu/packages/patches/unzip-format-secure.patch: New files. * gnu/packages/patches/unzip-CVE-2014-9636.patch: Replace contents with fixed patch from Fedora. * gnu-system.am (dist_patch_DATA): Adjust accordingly. * gnu/packages/zip.scm (unzip)[source]: Adjust list of patches.
Diffstat (limited to 'gnu/packages/patches/unzip-CVE-2014-9636.patch')
-rw-r--r--gnu/packages/patches/unzip-CVE-2014-9636.patch40
1 files changed, 14 insertions, 26 deletions
diff --git a/gnu/packages/patches/unzip-CVE-2014-9636.patch b/gnu/packages/patches/unzip-CVE-2014-9636.patch
index a38c3da51c..03c1e3c068 100644
--- a/gnu/packages/patches/unzip-CVE-2014-9636.patch
+++ b/gnu/packages/patches/unzip-CVE-2014-9636.patch
@@ -1,40 +1,28 @@
-Copied from Debian.
+Copied from Fedora.
-From: mancha <mancha1 AT zoho DOT com>
-Date: Mon, 3 Nov 2014
-Subject: Info-ZIP UnZip buffer overflow
-Bug-Debian: http://bugs.debian.org/776589
-
-By carefully crafting a corrupt ZIP archive with "extra fields" that
-purport to have compressed blocks larger than the corresponding
-uncompressed blocks in STORED no-compression mode, an attacker can
-trigger a heap overflow that can result in application crash or
-possibly have other unspecified impact.
-
-This patch ensures that when extra fields use STORED mode, the
-"compressed" and uncompressed block sizes match.
+http://pkgs.fedoraproject.org/cgit/unzip.git/plain/unzip-6.0-overflow.patch?id=d18f821e
+diff --git a/extract.c b/extract.c
+index a0a4929..9ef80b3 100644
--- a/extract.c
+++ b/extract.c
-@@ -2228,6 +2228,7 @@
+@@ -2214,6 +2214,7 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
ulg eb_ucsize;
uch *eb_ucptr;
int r;
-+ ush eb_compr_method;
++ ush method;
if (compr_offset < 4) /* field is not compressed: */
return PK_OK; /* do nothing and signal OK */
-@@ -2244,6 +2245,14 @@
- ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
- return IZ_EF_TRUNC; /* no/bad compressed data! */
+@@ -2223,6 +2224,12 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
+ eb_size <= (compr_offset + EB_CMPRHEADLEN)))
+ return IZ_EF_TRUNC; /* no compressed data! */
-+ /* 2014-11-03 Michal Zalewski, SMS.
-+ * For STORE method, compressed and uncompressed sizes must agree.
-+ * http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450
-+ */
-+ eb_compr_method = makeword( eb + (EB_HEADSIZE + compr_offset));
-+ if ((eb_compr_method == STORED) && (eb_size - compr_offset != eb_ucsize))
-+ return PK_ERR;
++ method = makeword(eb + (EB_HEADSIZE + compr_offset));
++ if ((method == STORED) && (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
++ return PK_ERR; /* compressed & uncompressed
++ * should match in STORED
++ * method */
+
if (
#ifdef INT_16BIT