4e76995571
fixes for CVE-2017-5974, CVE-2017-5975, CVE-2017-5976, CVE-2017-5978, CVE-2017-5979, CVE-2017-5980 and CVE-2017-5981. Patches from SuSe via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854727#35
50 lines
1.6 KiB
Diff
50 lines
1.6 KiB
Diff
Index: zziplib-0.13.62/bins/unzzipcat.c
|
|
===================================================================
|
|
--- bins/unzzipcat.c
|
|
+++ bins/unzzipcat.c
|
|
@@ -91,8 +91,11 @@ main (int argc, char ** argv)
|
|
for (; entry ; entry = zzip_disk_findnext(disk, entry))
|
|
{
|
|
char* name = zzip_disk_entry_strdup_name (disk, entry);
|
|
- printf ("%s\n", name);
|
|
- free (name);
|
|
+ if (name)
|
|
+ {
|
|
+ printf ("%s\n", name);
|
|
+ free (name);
|
|
+ }
|
|
}
|
|
return 0;
|
|
}
|
|
@@ -112,10 +115,13 @@ main (int argc, char ** argv)
|
|
for (; entry ; entry = zzip_disk_findnext(disk, entry))
|
|
{
|
|
char* name = zzip_disk_entry_strdup_name (disk, entry);
|
|
- if (! fnmatch (argv[argn], name,
|
|
- FNM_NOESCAPE|FNM_PATHNAME|FNM_PERIOD))
|
|
- zzip_disk_cat_file (disk, name, stdout);
|
|
- free (name);
|
|
+ if (name)
|
|
+ {
|
|
+ if (! fnmatch (argv[argn], name,
|
|
+ FNM_NOESCAPE|FNM_PATHNAME|FNM_PERIOD))
|
|
+ zzip_disk_cat_file (disk, name, stdout);
|
|
+ free (name);
|
|
+ }
|
|
}
|
|
}
|
|
return 0;
|
|
Index: zziplib-0.13.62/zzip/fseeko.c
|
|
===================================================================
|
|
--- zzip/fseeko.c
|
|
+++ zzip/fseeko.c
|
|
@@ -300,7 +300,8 @@ zzip_entry_findfirst(FILE * disk)
|
|
* central directory was written directly before : */
|
|
root = mapoffs - rootsize;
|
|
}
|
|
- } else if (zzip_disk64_trailer_check_magic(p))
|
|
+ } else if ((p + sizeof(struct zzip_disk64_trailer)) <= (buffer + mapsize)
|
|
+ && zzip_disk64_trailer_check_magic(p))
|
|
{
|
|
struct zzip_disk64_trailer *trailer =
|
|
(struct zzip_disk64_trailer *) p;
|