package/archiver/unzip/CVE-2014-8139.patch

   1 # --- T2-COPYRIGHT-NOTE-BEGIN ---
   2 # T2 SDE: package/*/unzip/CVE-2014-8139.patch
   3 # Copyright (C) 2022 The T2 SDE Project
   4 #
   5 # This Copyright note is generated by scripts/Create-CopyPatch,
   6 # more information can be found in the files COPYING and README.
   7 #
   8 # This patch file is dual-licensed. It is available under the license the
   9 # patched project is licensed under, as long as it is an OpenSource license
  10 # as defined at http://www.opensource.org/ (e.g. BSD, X11) or under the terms
  11 # of the GNU General Public License version 2 as used by the T2 SDE.
  12 # --- T2-COPYRIGHT-NOTE-END ---
  13
  14 --- a/extract.c
  15 +++ b/extract.c
  16 @@ -1,5 +1,5 @@
  17  /*
  18 -  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
  19 +  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.
  20
  21    See the accompanying file LICENSE, version 2009-Jan-02 or later
  22    (the contents of which are also included in unzip.h) for terms of use.
  23 @@ -298,6 +298,8 @@
  24  #ifndef SFX
  25     static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
  26       EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
  27 +   static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \
  28 +     EF block length (%u bytes) invalid (< %d)\n";
  29     static ZCONST char Far InvalidComprDataEAs[] =
  30       " invalid compressed data for EAs\n";
  31  #  if (defined(WIN32) && defined(NTSD_EAS))
  32 @@ -2032,7 +2034,8 @@
  33          ebID = makeword(ef);
  34          ebLen = (unsigned)makeword(ef+EB_LEN);
  35
  36 -        if (ebLen > (ef_len - EB_HEADSIZE)) {
  37 +        if (ebLen > (ef_len - EB_HEADSIZE))
  38 +        {
  39             /* Discovered some extra field inconsistency! */
  40              if (uO.qflag)
  41                  Info(slide, 1, ((char *)slide, "%-22s ",
  42 @@ -2167,11 +2170,29 @@
  43                  }
  44                  break;
  45              case EF_PKVMS:
  46 -                if (makelong(ef+EB_HEADSIZE) !=
  47 -                    crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4),
  48 -                          (extent)(ebLen-4)))
  49 -                    Info(slide, 1, ((char *)slide,
  50 -                      LoadFarString(BadCRC_EAs)));
  51 +                /* 2015-01-30 SMS.  Added sufficient-bytes test/message
  52 +                 * here.  (Removed defective ebLen test above.)
  53 +                 *
  54 +                 * If sufficient bytes (EB_PKVMS_MINLEN) are available,
  55 +                 * then compare the stored CRC value with the calculated
  56 +                 * CRC for the remainder of the data (and complain about
  57 +                 * a mismatch).
  58 +                 */
  59 +                if (ebLen < EB_PKVMS_MINLEN)
  60 +                {
  61 +                    /* Insufficient bytes available. */
  62 +                    Info( slide, 1,
  63 +                     ((char *)slide, LoadFarString( TooSmallEBlength),
  64 +                     ebLen, EB_PKVMS_MINLEN));
  65 +                }
  66 +                else if (makelong(ef+ EB_HEADSIZE) !=
  67 +                 crc32(CRCVAL_INITIAL,
  68 +                 (ef+ EB_HEADSIZE+ EB_PKVMS_MINLEN),
  69 +                 (extent)(ebLen- EB_PKVMS_MINLEN)))
  70 +                {
  71 +                     Info(slide, 1, ((char *)slide,
  72 +                       LoadFarString(BadCRC_EAs)));
  73 +                }
  74                  break;
  75              case EF_PKW32:
  76              case EF_PKUNIX:
  77 --- a/unzpriv.h
  78 +++ b/unzpriv.h
  79 @@ -1806,6 +1806,8 @@
  80  #define EB_NTSD_VERSION   4    /* offset of NTSD version byte */
  81  #define EB_NTSD_MAX_VER   (0)  /* maximum version # we know how to handle */
  82
  83 +#define EB_PKVMS_MINLEN   4    /* minimum data length of PKVMS extra block */
  84 +
  85  #define EB_ASI_CRC32      0    /* offset of ASI Unix field's crc32 checksum */
  86  #define EB_ASI_MODE       4    /* offset of ASI Unix permission mode field */
  87
  88