4e76995571
fixes for CVE-2017-5974, CVE-2017-5975, CVE-2017-5976, CVE-2017-5978, CVE-2017-5979, CVE-2017-5980 and CVE-2017-5981. Patches from SuSe via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854727#35
55 lines
2.1 KiB
Diff
55 lines
2.1 KiB
Diff
Index: zziplib-0.13.62/zzip/memdisk.c
|
|
===================================================================
|
|
--- zzip/memdisk.c
|
|
+++ zzip/memdisk.c
|
|
@@ -201,6 +201,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
|
|
{
|
|
void *mem = malloc(ext1 + 2);
|
|
item->zz_ext[1] = mem;
|
|
+ item->zz_extlen[1] = ext1 + 2;
|
|
memcpy(mem, ptr1, ext1);
|
|
((char *) (mem))[ext1 + 0] = 0;
|
|
((char *) (mem))[ext1 + 1] = 0;
|
|
@@ -209,6 +210,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
|
|
{
|
|
void *mem = malloc(ext2 + 2);
|
|
item->zz_ext[2] = mem;
|
|
+ item->zz_extlen[2] = ext2 + 2;
|
|
memcpy(mem, ptr2, ext2);
|
|
((char *) (mem))[ext2 + 0] = 0;
|
|
((char *) (mem))[ext2 + 1] = 0;
|
|
@@ -245,8 +247,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
|
|
while (1)
|
|
{
|
|
ZZIP_EXTRA_BLOCK *ext = entry->zz_ext[i];
|
|
- if (ext)
|
|
+ if (ext && (entry->zz_extlen[i] >= zzip_extra_block_headerlength))
|
|
{
|
|
+ char *endblock = (char *)ext + entry->zz_extlen[i];
|
|
+
|
|
while (*(short *) (ext->z_datatype))
|
|
{
|
|
if (datatype == zzip_extra_block_get_datatype(ext))
|
|
@@ -257,6 +261,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
|
|
e += zzip_extra_block_headerlength;
|
|
e += zzip_extra_block_get_datasize(ext);
|
|
ext = (void *) e;
|
|
+ if (e >= endblock)
|
|
+ {
|
|
+ break;
|
|
+ }
|
|
____;
|
|
}
|
|
}
|
|
Index: zziplib-0.13.62/zzip/memdisk.h
|
|
===================================================================
|
|
--- zzip/memdisk.h
|
|
+++ zzip/memdisk.h
|
|
@@ -66,6 +66,7 @@ struct _zzip_mem_entry {
|
|
int zz_filetype; /* (from "z_filetype") */
|
|
char* zz_comment; /* zero-terminated (from "comment") */
|
|
ZZIP_EXTRA_BLOCK* zz_ext[3]; /* terminated by null in z_datatype */
|
|
+ int zz_extlen[3]; /* length of zz_ext[i] in bytes */
|
|
}; /* the extra blocks are NOT converted */
|
|
|
|
#define _zzip_mem_disk_findfirst(_d_) ((_d_)->list)
|