unzip-6.0-cve-2014-8139.patch 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980
  1. diff --git a/extract.c b/extract.c
  2. index 9ef80b3..c741b5f 100644
  3. --- a/extract.c
  4. +++ b/extract.c
  5. @@ -1,5 +1,5 @@
  6. /*
  7. - Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
  8. + Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
  9. See the accompanying file LICENSE, version 2009-Jan-02 or later
  10. (the contents of which are also included in unzip.h) for terms of use.
  11. @@ -298,6 +298,8 @@ char ZCONST Far TruncNTSD[] =
  12. #ifndef SFX
  13. static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
  14. EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
  15. + static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \
  16. + EF block length (%u bytes) invalid (< %d)\n";
  17. static ZCONST char Far InvalidComprDataEAs[] =
  18. " invalid compressed data for EAs\n";
  19. # if (defined(WIN32) && defined(NTSD_EAS))
  20. @@ -2020,7 +2022,8 @@ static int TestExtraField(__G__ ef, ef_len)
  21. ebID = makeword(ef);
  22. ebLen = (unsigned)makeword(ef+EB_LEN);
  23. - if (ebLen > (ef_len - EB_HEADSIZE)) {
  24. + if (ebLen > (ef_len - EB_HEADSIZE))
  25. + {
  26. /* Discovered some extra field inconsistency! */
  27. if (uO.qflag)
  28. Info(slide, 1, ((char *)slide, "%-22s ",
  29. @@ -2155,11 +2158,29 @@ static int TestExtraField(__G__ ef, ef_len)
  30. }
  31. break;
  32. case EF_PKVMS:
  33. - if (makelong(ef+EB_HEADSIZE) !=
  34. - crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4),
  35. - (extent)(ebLen-4)))
  36. - Info(slide, 1, ((char *)slide,
  37. - LoadFarString(BadCRC_EAs)));
  38. + /* 2015-01-30 SMS. Added sufficient-bytes test/message
  39. + * here. (Removed defective ebLen test above.)
  40. + *
  41. + * If sufficient bytes (EB_PKVMS_MINLEN) are available,
  42. + * then compare the stored CRC value with the calculated
  43. + * CRC for the remainder of the data (and complain about
  44. + * a mismatch).
  45. + */
  46. + if (ebLen < EB_PKVMS_MINLEN)
  47. + {
  48. + /* Insufficient bytes available. */
  49. + Info( slide, 1,
  50. + ((char *)slide, LoadFarString( TooSmallEBlength),
  51. + ebLen, EB_PKVMS_MINLEN));
  52. + }
  53. + else if (makelong(ef+ EB_HEADSIZE) !=
  54. + crc32(CRCVAL_INITIAL,
  55. + (ef+ EB_HEADSIZE+ EB_PKVMS_MINLEN),
  56. + (extent)(ebLen- EB_PKVMS_MINLEN)))
  57. + {
  58. + Info(slide, 1, ((char *)slide,
  59. + LoadFarString(BadCRC_EAs)));
  60. + }
  61. break;
  62. case EF_PKW32:
  63. case EF_PKUNIX:
  64. diff --git a/unzpriv.h b/unzpriv.h
  65. index 005cee0..5c83a6e 100644
  66. --- a/unzpriv.h
  67. +++ b/unzpriv.h
  68. @@ -1806,6 +1806,8 @@
  69. #define EB_NTSD_VERSION 4 /* offset of NTSD version byte */
  70. #define EB_NTSD_MAX_VER (0) /* maximum version # we know how to handle */
  71. +#define EB_PKVMS_MINLEN 4 /* minimum data length of PKVMS extra block */
  72. +
  73. #define EB_ASI_CRC32 0 /* offset of ASI Unix field's crc32 checksum */
  74. #define EB_ASI_MODE 4 /* offset of ASI Unix permission mode field */