| author | Vladimir Marek <Vladimir.Marek@oracle.com> |
| Fri, 26 Feb 2016 15:01:20 +0100 | |
| changeset 5537 | fb31633dac76 |
| parent 3586 | components/unzip/patches/CVE-2014-8140.patch@189b6ab19f2e |
| permissions | -rw-r--r-- |
|
3586
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
1 |
Source: |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
2 |
https://bugzilla.redhat.com/show_bug.cgi?id=1174851 |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
3 |
Info: |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
4 |
http://www.ocert.org/advisories/ocert-2014-011.html |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
5 |
|
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
6 |
--- a/extract.c 2009-03-14 02:32:52.000000000 +0100 |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
7 |
+++ b/extract.c 2014-12-05 22:43:13.000000000 +0100 |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
8 |
@@ -2221,10 +2234,17 @@ static int test_compr_eb(__G__ eb, eb_si |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
9 |
if (compr_offset < 4) /* field is not compressed: */ |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
10 |
return PK_OK; /* do nothing and signal OK */ |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
11 |
|
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
12 |
+ /* Return no/bad-data error status if any problem is found: |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
13 |
+ * 1. eb_size is too small to hold the uncompressed size |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
14 |
+ * (eb_ucsize). (Else extract eb_ucsize.) |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
15 |
+ * 2. eb_ucsize is zero (invalid). 2014-12-04 SMS. |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
16 |
+ * 3. eb_ucsize is positive, but eb_size is too small to hold |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
17 |
+ * the compressed data header. |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
18 |
+ */ |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
19 |
if ((eb_size < (EB_UCSIZE_P + 4)) || |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
20 |
- ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L && |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
21 |
- eb_size <= (compr_offset + EB_CMPRHEADLEN))) |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
22 |
- return IZ_EF_TRUNC; /* no compressed data! */ |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
23 |
+ ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) || |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
24 |
+ ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN)))) |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
25 |
+ return IZ_EF_TRUNC; /* no/bad compressed data! */ |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
26 |
|
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
27 |
if ( |
|
189b6ab19f2e
20298643 problem in UTILITY/ZIP
Jiri Sasek <Jiri.Sasek@Oracle.COM>
parents:
diff
changeset
|
28 |
#ifdef INT_16BIT |