pkgs/tools/archivers/unzip/CVE-2014-8140.diff

   1 From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=969621&action=diff
   2 (unzip60/ path prefix added)
   3
   4 --- unzip60/extract.c   2009-03-14 02:32:52.000000000 +0100
   5 +++ unzip60/extract.c   2014-12-05 22:43:13.000000000 +0100
   6 @@ -2221,10 +2234,17 @@ static int test_compr_eb(__G__ eb, eb_si
   7      if (compr_offset < 4)                /* field is not compressed: */
   8          return PK_OK;                    /* do nothing and signal OK */
   9
  10 +    /* Return no/bad-data error status if any problem is found:
  11 +     *    1. eb_size is too small to hold the uncompressed size
  12 +     *       (eb_ucsize).  (Else extract eb_ucsize.)
  13 +     *    2. eb_ucsize is zero (invalid).  2014-12-04 SMS.
  14 +     *    3. eb_ucsize is positive, but eb_size is too small to hold
  15 +     *       the compressed data header.
  16 +     */
  17      if ((eb_size < (EB_UCSIZE_P + 4)) ||
  18 -        ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L &&
  19 -         eb_size <= (compr_offset + EB_CMPRHEADLEN)))
  20 -        return IZ_EF_TRUNC;               /* no compressed data! */
  21 +     ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) ||
  22 +     ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
  23 +        return IZ_EF_TRUNC;             /* no/bad compressed data! */
  24
  25      if (
  26  #ifdef INT_16BIT