0010-unzip-6.0-cve-2014-8139.patch (3323B)
1 diff --git a/extract.c b/extract.c 2 index 9ef80b3..c741b5f 100644 3 --- a/extract.c 4 +++ b/extract.c 5 @@ -1,5 +1,5 @@ 6 /* 7 - Copyright (c) 1990-2009 Info-ZIP. All rights reserved. 8 + Copyright (c) 1990-2014 Info-ZIP. All rights reserved. 9 10 See the accompanying file LICENSE, version 2009-Jan-02 or later 11 (the contents of which are also included in unzip.h) for terms of use. 12 @@ -298,6 +298,8 @@ char ZCONST Far TruncNTSD[] = 13 #ifndef SFX 14 static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \ 15 EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n"; 16 + static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \ 17 + EF block length (%u bytes) invalid (< %d)\n"; 18 static ZCONST char Far InvalidComprDataEAs[] = 19 " invalid compressed data for EAs\n"; 20 # if (defined(WIN32) && defined(NTSD_EAS)) 21 @@ -2020,7 +2022,8 @@ static int TestExtraField(__G__ ef, ef_len) 22 ebID = makeword(ef); 23 ebLen = (unsigned)makeword(ef+EB_LEN); 24 25 - if (ebLen > (ef_len - EB_HEADSIZE)) { 26 + if (ebLen > (ef_len - EB_HEADSIZE)) 27 + { 28 /* Discovered some extra field inconsistency! */ 29 if (uO.qflag) 30 Info(slide, 1, ((char *)slide, "%-22s ", 31 @@ -2155,11 +2158,29 @@ static int TestExtraField(__G__ ef, ef_len) 32 } 33 break; 34 case EF_PKVMS: 35 - if (makelong(ef+EB_HEADSIZE) != 36 - crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4), 37 - (extent)(ebLen-4))) 38 - Info(slide, 1, ((char *)slide, 39 - LoadFarString(BadCRC_EAs))); 40 + /* 2015-01-30 SMS. Added sufficient-bytes test/message 41 + * here. (Removed defective ebLen test above.) 42 + * 43 + * If sufficient bytes (EB_PKVMS_MINLEN) are available, 44 + * then compare the stored CRC value with the calculated 45 + * CRC for the remainder of the data (and complain about 46 + * a mismatch). 47 + */ 48 + if (ebLen < EB_PKVMS_MINLEN) 49 + { 50 + /* Insufficient bytes available. */ 51 + Info( slide, 1, 52 + ((char *)slide, LoadFarString( TooSmallEBlength), 53 + ebLen, EB_PKVMS_MINLEN)); 54 + } 55 + else if (makelong(ef+ EB_HEADSIZE) != 56 + crc32(CRCVAL_INITIAL, 57 + (ef+ EB_HEADSIZE+ EB_PKVMS_MINLEN), 58 + (extent)(ebLen- EB_PKVMS_MINLEN))) 59 + { 60 + Info(slide, 1, ((char *)slide, 61 + LoadFarString(BadCRC_EAs))); 62 + } 63 break; 64 case EF_PKW32: 65 case EF_PKUNIX: 66 diff --git a/unzpriv.h b/unzpriv.h 67 index 005cee0..5c83a6e 100644 68 --- a/unzpriv.h 69 +++ b/unzpriv.h 70 @@ -1806,6 +1806,8 @@ 71 #define EB_NTSD_VERSION 4 /* offset of NTSD version byte */ 72 #define EB_NTSD_MAX_VER (0) /* maximum version # we know how to handle */ 73 74 +#define EB_PKVMS_MINLEN 4 /* minimum data length of PKVMS extra block */ 75 + 76 #define EB_ASI_CRC32 0 /* offset of ASI Unix field's crc32 checksum */ 77 #define EB_ASI_MODE 4 /* offset of ASI Unix permission mode field */ 78 79