logo

oasis

Own branch of Oasis Linux (upstream: <https://git.sr.ht/~mcf/oasis/>) git clone https://anongit.hacktivis.me/git/oasis.git

0028-Fix-for-CVE-2022-0529-and-CVE-2022-0530.patch (6754B)

    

  1. From 7c5862de85894d5387c855b5df6e5509c97f5bdf Mon Sep 17 00:00:00 2001
  2. From: "Steven M. Schweda" <sms@antinode.info>
  3. Date: Mon, 28 Apr 2025 12:57:34 -0700
  4. Subject: [PATCH] Fix for CVE-2022-0529 and CVE-2022-0530
  6. ---
  7.  fileio.c  | 34 +++++++++++++++++++++++++---------
  8.  process.c | 55 ++++++++++++++++++++++++++++++++++++++++++++-----------
  9.  2 files changed, 69 insertions(+), 20 deletions(-)
  11. diff --git a/fileio.c b/fileio.c
  12. index 6290824..50a74fc 100644
  13. --- a/fileio.c
  14. +++ b/fileio.c
  15. @@ -171,8 +171,10 @@ static ZCONST char Far ReadError[] = "error:  zipfile read error\n";
  16.  static ZCONST char Far FilenameTooLongTrunc[] =
  17.    "warning:  filename too long--truncating.\n";
  18.  #ifdef UNICODE_SUPPORT
  19. +   static ZCONST char Far UFilenameCorrupt[] =
  20. +     "error: Unicode filename corrupt.\n";
  21.     static ZCONST char Far UFilenameTooLongTrunc[] =
  22. -     "warning:  Converted unicode filename too long--truncating.\n";
  23. +     "warning:  Converted Unicode filename too long--truncating.\n";
  24.  #endif
  25.  static ZCONST char Far ExtraFieldTooLong[] =
  26.    "warning:  extra field too long (%d).  Ignoring...\n";
  27. @@ -2361,16 +2363,30 @@ int do_string(__G__ length, option)   /* return PK-type error code */
  28.                    /* convert UTF-8 to local character set */
  29.                    fn = utf8_to_local_string(G.unipath_filename,
  30.                                              G.unicode_escape_all);
  31. -                  /* make sure filename is short enough */
  32. -                  if (strlen(fn) >= FILNAMSIZ) {
  33. -                    fn[FILNAMSIZ - 1] = '\0';
  34. +
  35. +                  /* 2022-07-22 SMS, et al.  CVE-2022-0530
  36. +                   * Detect conversion failure, emit message.
  37. +                   * Continue with unconverted name.
  38. +                   */
  39. +                  if (fn == NULL)
  40. +                  {
  41.                      Info(slide, 0x401, ((char *)slide,
  42. -                      LoadFarString(UFilenameTooLongTrunc)));
  43. -                    error = PK_WARN;
  44. +                     LoadFarString(UFilenameCorrupt)));
  45. +                    error = PK_ERR;
  46. +                  }
  47. +                  else
  48. +                  {
  49. +                    /* make sure filename is short enough */
  50. +                    if (strlen(fn) >= FILNAMSIZ) {
  51. +                      fn[FILNAMSIZ - 1] = '\0';
  52. +                      Info(slide, 0x401, ((char *)slide,
  53. +                        LoadFarString(UFilenameTooLongTrunc)));
  54. +                      error = PK_WARN;
  55. +                    }
  56. +                    /* replace filename with converted UTF-8 */
  57. +                    strcpy(G.filename, fn);
  58. +                    free(fn);
  59.                    }
  60. -                  /* replace filename with converted UTF-8 */
  61. -                  strcpy(G.filename, fn);
  62. -                  free(fn);
  63.                  }
  64.  # endif /* UNICODE_WCHAR */
  65.                  if (G.unipath_filename != G.filename_full)
  66. diff --git a/process.c b/process.c
  67. index d2a846e..a7d5b87 100644
  68. --- a/process.c
  69. +++ b/process.c
  70. @@ -222,6 +222,8 @@ static ZCONST char Far ZipfileCommTrunc1[] =
  71.       "\nwarning:  Unicode Path version > 1\n";
  72.     static ZCONST char Far UnicodeMismatchError[] =
  73.       "\nwarning:  Unicode Path checksum invalid\n";
  74. +   static ZCONST char Far UFilenameTooLongTrunc[] =
  75. +     "warning:  filename too long (P1) -- truncating.\n";
  76.  #endif
  77.  
  78.  
  79. @@ -1915,7 +1917,7 @@ int getZip64Data(__G__ ef_buf, ef_len)
  80.      Sets both local header and central header fields.  Not terribly clever,
  81.      but it means that this procedure is only called in one place.
  82.  
  83. -    2014-12-05 SMS.
  84. +    2014-12-05 SMS.  (oCERT.org report.)  CVE-2014-8141.
  85.      Added checks to ensure that enough data are available before calling
  86.      makeint64() or makelong().  Replaced various sizeof() values with
  87.      simple ("4" or "8") constants.  (The Zip64 structures do not depend
  88. @@ -1947,9 +1949,10 @@ int getZip64Data(__G__ ef_buf, ef_len)
  89.                ef_len - EB_HEADSIZE));
  90.              break;
  91.          }
  92. +
  93.          if (eb_id == EF_PKSZ64)
  94.          {
  95. -          int offset = EB_HEADSIZE;
  96. +          unsigned offset = EB_HEADSIZE;
  97.  
  98.            if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
  99.            {
  100. @@ -2046,7 +2049,7 @@ int getUnicodeData(__G__ ef_buf, ef_len)
  101.          }
  102.          if (eb_id == EF_UNIPATH) {
  103.  
  104. -          int offset = EB_HEADSIZE;
  105. +          unsigned offset = EB_HEADSIZE;
  106.            ush ULen = eb_len - 5;
  107.            ulg chksum = CRCVAL_INITIAL;
  108.  
  109. @@ -2504,16 +2507,17 @@ char *wide_to_local_string(wide_string, escape_all)
  110.    int state_dependent;
  111.    int wsize = 0;
  112.    int max_bytes = MB_CUR_MAX;
  113. -  char buf[9];
  114. +  char buf[ MB_CUR_MAX+ 1];             /* ("+1" not really needed?) */
  115.    char *buffer = NULL;
  116.    char *local_string = NULL;
  117. +  size_t buffer_size;                   /* CVE-2022-0529 */
  118.  
  119.    for (wsize = 0; wide_string[wsize]; wsize++) ;
  120.  
  121.    if (max_bytes < MAX_ESCAPE_BYTES)
  122.      max_bytes = MAX_ESCAPE_BYTES;
  123. -
  124. -  if ((buffer = (char *)malloc(wsize * max_bytes + 1)) == NULL) {
  125. +  buffer_size = wsize * max_bytes + 1;          /* Reused below. */
  126. +  if ((buffer = (char *)malloc( buffer_size)) == NULL) {
  127.      return NULL;
  128.    }
  129.  
  130. @@ -2551,8 +2555,28 @@ char *wide_to_local_string(wide_string, escape_all)
  131.      } else {
  132.        /* no MB for this wide */
  133.          /* use escape for wide character */
  134. -        char *escape_string = wide_to_escape_string(wide_string[i]);
  135. -        strcat(buffer, escape_string);
  136. +        size_t buffer_len;
  137. +        size_t escape_string_len;
  138. +        char *escape_string;
  139. +        int err_msg = 0;
  140. +
  141. +        escape_string = wide_to_escape_string(wide_string[i]);
  142. +        buffer_len = strlen( buffer);
  143. +        escape_string_len = strlen( escape_string);
  144. +
  145. +        /* Append escape string, as space allows. */
  146. +        /* 2022-07-18 SMS, et al.  CVE-2022-0529 */
  147. +        if (escape_string_len > buffer_size- buffer_len- 1)
  148. +        {
  149. +            escape_string_len = buffer_size- buffer_len- 1;
  150. +            if (err_msg == 0)
  151. +            {
  152. +                err_msg = 1;
  153. +                Info(slide, 0x401, ((char *)slide,
  154. +                 LoadFarString( UFilenameTooLongTrunc)));
  155. +            }
  156. +        }
  157. +        strncat( buffer, escape_string, escape_string_len);
  158.          free(escape_string);
  159.      }
  160.    }
  161. @@ -2604,9 +2628,18 @@ char *utf8_to_local_string(utf8_string, escape_all)
  162.    ZCONST char *utf8_string;
  163.    int escape_all;
  164.  {
  165. -  zwchar *wide = utf8_to_wide_string(utf8_string);
  166. -  char *loc = wide_to_local_string(wide, escape_all);
  167. -  free(wide);
  168. +  zwchar *wide;
  169. +  char *loc = NULL;
  170. +
  171. +  wide = utf8_to_wide_string( utf8_string);
  172. +
  173. +  /* 2022-07-25 SMS, et al.  CVE-2022-0530 */
  174. +  if (wide != NULL)
  175. +  {
  176. +    loc = wide_to_local_string( wide, escape_all);
  177. +    free( wide);
  178. +  }
  179. +
  180.    return loc;
  181.  }
  182.  
  183. -- 
  184. 2.45.2