termux-packages/packages/unzip/bugfix-cve20149636.patch
Leonid Pliushch fe6c4f8171 unzip: apply patches to fix some CVEs
Unzip was not updated from on 20 April 2009 but contain serious
issues already fixed in Linux distributions.

Termux should implement these fixes as well.

This will fix:

 * CVE-2014-8139
 * CVE-2014-8140
 * CVE-2014-8141
 * CVE-2014-9636
 * CVE-2015-7696
 * CVE-2015-7697

Patches were obtained from https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/unzip.
2019-01-13 18:36:38 +01:00

26 lines
1.0 KiB
Diff

diff --git a/extract.c b/extract.c
index a0a4929..9ef80b3 100644
--- a/extract.c
+++ b/extract.c
@@ -2214,6 +2214,7 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
ulg eb_ucsize;
uch *eb_ucptr;
int r;
+ ush method;
if (compr_offset < 4) /* field is not compressed: */
return PK_OK; /* do nothing and signal OK */
@@ -2223,6 +2224,12 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
eb_size <= (compr_offset + EB_CMPRHEADLEN)))
return IZ_EF_TRUNC; /* no compressed data! */
+ method = makeword(eb + (EB_HEADSIZE + compr_offset));
+ if ((method == STORED) && (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
+ return PK_ERR; /* compressed & uncompressed
+ * should match in STORED
+ * method */
+
if (
#ifdef INT_16BIT
(((ulg)(extent)eb_ucsize) != eb_ucsize) ||