logo

oasis

Own branch of Oasis Linux (upstream: <https://git.sr.ht/~mcf/oasis/>) git clone https://anongit.hacktivis.me/git/oasis.git

0012-Info-ZIP-UnZip-buffer-overflow.patch (1834B)


  1. From 14342a8a5ddafa76a8aa9800da078d415f50af71 Mon Sep 17 00:00:00 2001
  2. From: mancha <mancha1@zoho.com>
  3. Date: Wed, 11 Feb 2015 12:27:06 +0000
  4. Subject: [PATCH] Info-ZIP UnZip buffer overflow
  5. By carefully crafting a corrupt ZIP archive with "extra fields" that
  6. purport to have compressed blocks larger than the corresponding
  7. uncompressed blocks in STORED no-compression mode, an attacker can
  8. trigger a heap overflow that can result in application crash or
  9. possibly have other unspecified impact.
  10. This patch ensures that when extra fields use STORED mode, the
  11. "compressed" and uncompressed block sizes match.
  12. ---
  13. extract.c | 10 ++++++++++
  14. 1 file changed, 10 insertions(+)
  15. diff --git a/extract.c b/extract.c
  16. index ec31e60..f951b9f 100644
  17. --- a/extract.c
  18. +++ b/extract.c
  19. @@ -2228,6 +2228,7 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
  20. ulg eb_ucsize;
  21. uch *eb_ucptr;
  22. int r;
  23. + ush eb_compr_method;
  24. if (compr_offset < 4) /* field is not compressed: */
  25. return PK_OK; /* do nothing and signal OK */
  26. @@ -2244,6 +2245,15 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
  27. ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
  28. return IZ_EF_TRUNC; /* no/bad compressed data! */
  29. + /* 2015-02-10 Mancha(?), Michal Zalewski, Tomas Hoger, SMS.
  30. + * For STORE method, compressed and uncompressed sizes must agree.
  31. + * http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450
  32. + */
  33. + eb_compr_method = makeword( eb + (EB_HEADSIZE + compr_offset));
  34. + if ((eb_compr_method == STORED) &&
  35. + (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
  36. + return PK_ERR;
  37. +
  38. if (
  39. #ifdef INT_16BIT
  40. (((ulg)(extent)eb_ucsize) != eb_ucsize) ||
  41. --
  42. 2.20.1