cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

backport upstream patch to fix an out-of-bounds read

Browse Source 
ok naddy
This commit is contained in:
tj 2022-03-29 20:50:46 +00:00
parent 892fd742e7
commit fb26a05b22
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
archivers/libarchive/Makefile
View File

@ -1,6 +1,7 @@
COMMENT= multi-format archive and compression library
DISTNAME= libarchive-3.6.0
REVISION= 0
SHARED_LIBS= archive 12.0 # 19.0
CATEGORIES= archivers
HOMEPAGE= https://www.libarchive.org/

20
archivers/libarchive/patches/patch-libarchive_archive_read_support_format_zip_c Normal file
View File

@ -0,0 +1,20 @@
From cfaa28168a07ea4a53276b63068f94fce37d6aff Mon Sep 17 00:00:00 2001
From: Tim Kientzle <kientzle@acm.org>
Date: Thu, 24 Mar 2022 10:35:00 +0100
Subject: [PATCH] ZIP reader: fix possible out-of-bounds read in
zipx_lzma_alone_init()
Fixes #1672
Index: libarchive/archive_read_support_format_zip.c
--- libarchive/archive_read_support_format_zip.c.orig
+++ libarchive/archive_read_support_format_zip.c
@@ -1667,7 +1667,7 @@ zipx_lzma_alone_init(struct archive_read *a, struct zi
*/
/* Read magic1,magic2,lzma_params from the ZIPX stream. */
- if((p = __archive_read_ahead(a, 9, NULL)) == NULL) {
+ if(zip->entry_bytes_remaining < 9 || (p = __archive_read_ahead(a, 9, NULL)) == NULL) {
archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
"Truncated lzma data");
return (ARCHIVE_FATAL);