0013-unzip-6.0-cve-2018-1000035-heap-based-overflow.patch (1270B)
1 --- a/fileio.c 2014-12-05 05:06:05 -0600 2 +++ b/fileio.c 2017-11-14 01:06:28 -0600 3 @@ -1,5 +1,5 @@ 4 /* 5 - Copyright (c) 1990-2009 Info-ZIP. All rights reserved. 6 + Copyright (c) 1990-2017 Info-ZIP. All rights reserved. 7 8 See the accompanying file LICENSE, version 2009-Jan-02 or later 9 (the contents of which are also included in unzip.h) for terms of use. 10 @@ -1582,6 +1582,8 @@ 11 int r = IZ_PW_ENTERED; 12 char *m; 13 char *prompt; 14 + char *ep; 15 + char *zp; 16 17 #ifndef REENTRANT 18 /* tell picky compilers to shut up about "unused variable" warnings */ 19 @@ -1590,9 +1592,12 @@ 20 21 if (*rcnt == 0) { /* First call for current entry */ 22 *rcnt = 2; 23 - if ((prompt = (char *)malloc(2*FILNAMSIZ + 15)) != (char *)NULL) { 24 - sprintf(prompt, LoadFarString(PasswPrompt), 25 - FnFilter1(zfn), FnFilter2(efn)); 26 + zp = FnFilter1( zfn); 27 + ep = FnFilter2( efn); 28 + prompt = (char *)malloc( /* Slightly too long (2* "%s"). */ 29 + sizeof( PasswPrompt)+ strlen( zp)+ strlen( ep)); 30 + if (prompt != (char *)NULL) { 31 + sprintf(prompt, LoadFarString(PasswPrompt), zp, ep); 32 m = prompt; 33 } else 34 m = (char *)LoadFarString(PasswPrompt2);