diff options
| author | Efraim Flashner <efraim@flashner.co.il> | 2021-03-24 15:28:33 +0200 |
|---|---|---|
| committer | Efraim Flashner <efraim@flashner.co.il> | 2021-03-24 20:50:44 +0200 |
| commit | 2aab587f842908a886e3bd08b028885dddd650e0 (patch) | |
| tree | 87c0723a9ae2c69ab6920d90b6e87ad8510492fe /gnu/packages/patches/unzip-CVE-2016-9844.patch | |
| parent | 5664bcdcb0e4c10dfe48dd5e4730fc3c746a21e2 (diff) | |
| parent | 65c46e79e0495fe4d32f6f2725d7233fff10fd70 (diff) | |
Merge remote-tracking branch 'origin/master' into core-updates
Diffstat (limited to 'gnu/packages/patches/unzip-CVE-2016-9844.patch')
| -rw-r--r-- | gnu/packages/patches/unzip-CVE-2016-9844.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/gnu/packages/patches/unzip-CVE-2016-9844.patch b/gnu/packages/patches/unzip-CVE-2016-9844.patch new file mode 100644 index 00000000000..0e4a1733971 --- /dev/null +++ b/gnu/packages/patches/unzip-CVE-2016-9844.patch @@ -0,0 +1,39 @@ +From 754137e70cf58a64ad524b704a86b651ba0cde07 Mon Sep 17 00:00:00 2001 +From: Petr Stodulka <pstodulk@redhat.com> +Date: Wed, 14 Dec 2016 16:30:36 +0100 +Subject: [PATCH] Fix CVE-2016-9844 (rhbz#1404283) + +Fixes buffer overflow in zipinfo in similar way like fix for +CVE-2014-9913 provided by upstream. +--- + zipinfo.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/zipinfo.c b/zipinfo.c +index c03620e..accca2a 100644 +--- a/zipinfo.c ++++ b/zipinfo.c +@@ -1984,7 +1984,19 @@ static int zi_short(__G) /* return PK-type error code */ + ush dnum=(ush)((G.crec.general_purpose_bit_flag>>1) & 3); + methbuf[3] = dtype[dnum]; + } else if (methnum >= NUM_METHODS) { /* unknown */ +- sprintf(&methbuf[1], "%03u", G.crec.compression_method); ++ /* 2016-12-05 SMS. ++ * https://launchpad.net/bugs/1643750 ++ * Unexpectedly large compression methods overflow ++ * &methbuf[]. Use the old, three-digit decimal format ++ * for values which fit. Otherwise, sacrifice the "u", ++ * and use four-digit hexadecimal. ++ */ ++ if (G.crec.compression_method <= 999) { ++ sprintf( &methbuf[ 1], "%03u", G.crec.compression_method); ++ } else { ++ sprintf( &methbuf[ 0], "%04X", G.crec.compression_method); ++ } ++ + } + + for (k = 0; k < 15; ++k) +-- +2.5.5 + |