lede-packages-rs

git clone git://archive.git.mtrnord.blog/MTRNord/lede-packages-rs.git
Log | Files | Refs | README | LICENSE

001-CVE-2014-8139-crc-overflow.patch (1970B)

      1 --- a/extract.c
      2 +++ b/extract.c
      3 @@ -1,5 +1,5 @@
      4  /*
      5 -  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
      6 +  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.
      7  
      8    See the accompanying file LICENSE, version 2009-Jan-02 or later
      9    (the contents of which are also included in unzip.h) for terms of use.
     10 @@ -298,6 +298,8 @@ char ZCONST Far TruncNTSD[] =
     11  #ifndef SFX
     12     static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
     13       EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
     14 +   static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \
     15 +     EF block length (%u bytes) invalid (< %d)\n";
     16     static ZCONST char Far InvalidComprDataEAs[] =
     17       " invalid compressed data for EAs\n";
     18  #  if (defined(WIN32) && defined(NTSD_EAS))
     19 @@ -2023,7 +2025,8 @@ static int TestExtraField(__G__ ef, ef_l
     20          ebID = makeword(ef);
     21          ebLen = (unsigned)makeword(ef+EB_LEN);
     22  
     23 -        if (ebLen > (ef_len - EB_HEADSIZE)) {
     24 +        if (ebLen > (ef_len - EB_HEADSIZE))
     25 +        {
     26             /* Discovered some extra field inconsistency! */
     27              if (uO.qflag)
     28                  Info(slide, 1, ((char *)slide, "%-22s ",
     29 @@ -2158,11 +2161,19 @@ static int TestExtraField(__G__ ef, ef_l
     30                  }
     31                  break;
     32              case EF_PKVMS:
     33 -                if (makelong(ef+EB_HEADSIZE) !=
     34 +                if (ebLen < 4)
     35 +                {
     36 +                    Info(slide, 1,
     37 +                     ((char *)slide, LoadFarString(TooSmallEBlength),
     38 +                     ebLen, 4));
     39 +                }
     40 +                else if (makelong(ef+EB_HEADSIZE) !=
     41                      crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4),
     42                            (extent)(ebLen-4)))
     43 +                {
     44                      Info(slide, 1, ((char *)slide,
     45                        LoadFarString(BadCRC_EAs)));
     46 +                }
     47                  break;
     48              case EF_PKW32:
     49              case EF_PKUNIX: