logo

oasis

Own branch of Oasis Linux (upstream: <https://git.sr.ht/~mcf/oasis/>) git clone https://anongit.hacktivis.me/git/oasis.git

0024-Do-not-raise-a-zip-bomb-alert-for-a-misplaced-centra.patch (5365B)

    

  1. From 9d516b8c761d3816f946aa8937ebf9fadfe6a002 Mon Sep 17 00:00:00 2001
  2. From: Mark Adler <madler@alumni.caltech.edu>
  3. Date: Fri, 31 Jan 2020 22:06:02 -0800
  4. Subject: [PATCH] Do not raise a zip bomb alert for a misplaced central
  5.  directory.
  7.     Do not raise a zip bomb alert for a misplaced central directory.
  9.     There is a zip-like file in the Firefox distribution, omni.ja,
  10.     which is a zip container with the central directory placed at the
  11.     start of the file instead of after the local entries as required
  12.     by the zip standard. This commit marks the actual location of the
  13.     central directory, as well as the end of central directory records,
  14.     as disallowed locations. This now permits such containers to not
  15.     raise a zip bomb alert, where in fact there are no overlaps.
  16. ---
  17.  extract.c | 25 +++++++++++++++++++------
  18.  process.c |  6 ++++++
  19.  unzpriv.h | 10 ++++++++++
  20.  3 files changed, 35 insertions(+), 6 deletions(-)
  22. diff --git a/extract.c b/extract.c
  23. index 1f078d1..ad5daac 100644
  24. --- a/extract.c
  25. +++ b/extract.c
  26. @@ -495,8 +495,11 @@ int extract_or_test_files(__G)    /* return PK-type error code */
  27.      }
  28.  #endif /* !SFX || SFX_EXDIR */
  29.  
  30. -    /* One more: initialize cover structure for bomb detection. Start with a
  31. -       span that covers the central directory though the end of the file. */
  32. +    /* One more: initialize cover structure for bomb detection. Start with
  33. +       spans that cover any extra bytes at the start, the central directory,
  34. +       the end of central directory record (including the Zip64 end of central
  35. +       directory locator, if present), and the Zip64 end of central directory
  36. +       record, if present. */
  37.      if (G.cover == NULL) {
  38.          G.cover = malloc(sizeof(cover_t));
  39.          if (G.cover == NULL) {
  40. @@ -508,15 +511,25 @@ int extract_or_test_files(__G)    /* return PK-type error code */
  41.          ((cover_t *)G.cover)->max = 0;
  42.      }
  43.      ((cover_t *)G.cover)->num = 0;
  44. -    if ((G.extra_bytes != 0 &&
  45. -         cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) ||
  46. -        cover_add((cover_t *)G.cover,
  47. +    if (cover_add((cover_t *)G.cover,
  48.                    G.extra_bytes + G.ecrec.offset_start_central_directory,
  49. -                  G.ziplen) != 0) {
  50. +                  G.extra_bytes + G.ecrec.offset_start_central_directory +
  51. +                  G.ecrec.size_central_directory) != 0) {
  52.          Info(slide, 0x401, ((char *)slide,
  53.            LoadFarString(NotEnoughMemCover)));
  54.          return PK_MEM;
  55.      }
  56. +    if ((G.extra_bytes != 0 &&
  57. +         cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) ||
  58. +        (G.ecrec.have_ecr64 &&
  59. +         cover_add((cover_t *)G.cover, G.ecrec.ec64_start,
  60. +                   G.ecrec.ec64_end) != 0) ||
  61. +        cover_add((cover_t *)G.cover, G.ecrec.ec_start,
  62. +                  G.ecrec.ec_end) != 0) {
  63. +        Info(slide, 0x401, ((char *)slide,
  64. +          LoadFarString(OverlappedComponents)));
  65. +        return PK_BOMB;
  66. +    }
  67.  
  68.  /*---------------------------------------------------------------------------
  69.      The basic idea of this function is as follows.  Since the central di-
  70. diff --git a/process.c b/process.c
  71. index e4e7aee..d2a846e 100644
  72. --- a/process.c
  73. +++ b/process.c
  74. @@ -1408,6 +1408,10 @@ static int find_ecrec64(__G__ searchlen)         /* return PK-class error */
  75.  
  76.      /* Now, we are (almost) sure that we have a Zip64 archive. */
  77.      G.ecrec.have_ecr64 = 1;
  78. +    G.ecrec.ec_start -= ECLOC64_SIZE+4;
  79. +    G.ecrec.ec64_start = ecrec64_start_offset;
  80. +    G.ecrec.ec64_end = ecrec64_start_offset +
  81. +                       12 + makeint64(&byterec[ECREC64_LENGTH]);
  82.  
  83.      /* Update the "end-of-central-dir offset" for later checks. */
  84.      G.real_ecrec_offset = ecrec64_start_offset;
  85. @@ -1542,6 +1546,8 @@ static int find_ecrec(__G__ searchlen)          /* return PK-class error */
  86.        makelong(&byterec[OFFSET_START_CENTRAL_DIRECTORY]);
  87.      G.ecrec.zipfile_comment_length =
  88.        makeword(&byterec[ZIPFILE_COMMENT_LENGTH]);
  89. +    G.ecrec.ec_start = G.real_ecrec_offset;
  90. +    G.ecrec.ec_end = G.ecrec.ec_start + 22 + G.ecrec.zipfile_comment_length;
  91.  
  92.      /* Now, we have to read the archive comment, BEFORE the file pointer
  93.         is moved away backwards to seek for a Zip64 ECLOC64 structure.
  94. diff --git a/unzpriv.h b/unzpriv.h
  95. index dc9eff5..297b3c7 100644
  96. --- a/unzpriv.h
  97. +++ b/unzpriv.h
  98. @@ -2185,6 +2185,16 @@ typedef struct VMStimbuf {
  99.         int have_ecr64;                  /* valid Zip64 ecdir-record exists */
  100.         int is_zip64_archive;            /* Zip64 ecdir-record is mandatory */
  101.         ush zipfile_comment_length;
  102. +       zusz_t ec_start, ec_end;         /* offsets of start and end of the
  103. +                                           end of central directory record,
  104. +                                           including if present the Zip64
  105. +                                           end of central directory locator,
  106. +                                           which immediately precedes the
  107. +                                           end of central directory record */
  108. +       zusz_t ec64_start, ec64_end;     /* if have_ecr64 is true, then these
  109. +                                           are the offsets of the start and
  110. +                                           end of the Zip64 end of central
  111. +                                           directory record */
  112.     } ecdir_rec;
  113.  
  114.  
  115. -- 
  116. 2.25.0