logo

oasis

Own branch of Oasis Linux (upstream: <https://git.sr.ht/~mcf/oasis/>) git clone https://anongit.hacktivis.me/git/oasis.git

0009-Fix-CVE-2014-8139-CRC32-verification-heap-based-over.patch (2373B)

    

  1. From 9decdbe830f233fad7428df99e0c2d34887ac3cf Mon Sep 17 00:00:00 2001
  2. From: "Steven M. Schweda" <sms@antinode.info>
  3. Date: Sat, 15 Jun 2019 18:13:11 -0700
  4. Subject: [PATCH] Fix CVE-2014-8139: CRC32 verification heap-based overflow
  6. ---
  7.  extract.c | 17 ++++++++++++++---
  8.  1 file changed, 14 insertions(+), 3 deletions(-)
  10. diff --git a/extract.c b/extract.c
  11. index 1acd769..df0fa1c 100644
  12. --- a/extract.c
  13. +++ b/extract.c
  14. @@ -1,5 +1,5 @@
  15.  /*
  16. -  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
  17. +  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.
  18.  
  19.    See the accompanying file LICENSE, version 2009-Jan-02 or later
  20.    (the contents of which are also included in unzip.h) for terms of use.
  21. @@ -298,6 +298,8 @@ char ZCONST Far TruncNTSD[] =
  22.  #ifndef SFX
  23.     static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
  24.       EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
  25. +   static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \
  26. +     EF block length (%u bytes) invalid (< %d)\n";
  27.     static ZCONST char Far InvalidComprDataEAs[] =
  28.       " invalid compressed data for EAs\n";
  29.  #  if (defined(WIN32) && defined(NTSD_EAS))
  30. @@ -2023,7 +2025,8 @@ static int TestExtraField(__G__ ef, ef_len)
  31.          ebID = makeword(ef);
  32.          ebLen = (unsigned)makeword(ef+EB_LEN);
  33.  
  34. -        if (ebLen > (ef_len - EB_HEADSIZE)) {
  35. +        if (ebLen > (ef_len - EB_HEADSIZE))
  36. +        {
  37.             /* Discovered some extra field inconsistency! */
  38.              if (uO.qflag)
  39.                  Info(slide, 1, ((char *)slide, "%-22s ",
  40. @@ -2158,11 +2161,19 @@ static int TestExtraField(__G__ ef, ef_len)
  41.                  }
  42.                  break;
  43.              case EF_PKVMS:
  44. -                if (makelong(ef+EB_HEADSIZE) !=
  45. +                if (ebLen < 4)
  46. +                {
  47. +                    Info(slide, 1,
  48. +                     ((char *)slide, LoadFarString(TooSmallEBlength),
  49. +                     ebLen, 4));
  50. +                }
  51. +                else if (makelong(ef+EB_HEADSIZE) !=
  52.                      crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4),
  53.                            (extent)(ebLen-4)))
  54. +                {
  55.                      Info(slide, 1, ((char *)slide,
  56.                        LoadFarString(BadCRC_EAs)));
  57. +                }
  58.                  break;
  59.              case EF_PKW32:
  60.              case EF_PKUNIX:
  61. -- 
  62. 2.20.1