From 59b6708b86f6feab8839af6c17d1fe7a6996d3bd Mon Sep 17 00:00:00 2001 From: wangkerong Date: Mon, 4 Jul 2022 10:16:14 +0800 Subject: [PATCH] fix CVE-2022-26280 --- backport-CVE-2022-26280.patch | 28 ++++++++++++++++++++++++++++ libarchive.spec | 6 +++++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2022-26280.patch diff --git a/backport-CVE-2022-26280.patch b/backport-CVE-2022-26280.patch new file mode 100644 index 0000000..2ab092e --- /dev/null +++ b/backport-CVE-2022-26280.patch @@ -0,0 +1,28 @@ +From cfaa28168a07ea4a53276b63068f94fce37d6aff Mon Sep 17 00:00:00 2001 +From: Tim Kientzle +Date: Thu, 24 Mar 2022 10:35:00 +0100 +Subject: [PATCH] ZIP reader: fix possible out-of-bounds read in + zipx_lzma_alone_init() + +Fixes #1672 + +Conflict:NA +Reference:https://github.com/libarchive/libarchive/commit/cfaa28168a07ea4a53276b63068f94fce37d6aff +--- + libarchive/archive_read_support_format_zip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c +index 38ada70b5..9d6c900b2 100644 +--- a/libarchive/archive_read_support_format_zip.c ++++ b/libarchive/archive_read_support_format_zip.c +@@ -1667,7 +1667,7 @@ zipx_lzma_alone_init(struct archive_read *a, struct zip *zip) + */ + + /* Read magic1,magic2,lzma_params from the ZIPX stream. */ +- if((p = __archive_read_ahead(a, 9, NULL)) == NULL) { ++ if(zip->entry_bytes_remaining < 9 || (p = __archive_read_ahead(a, 9, NULL)) == NULL) { + archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, + "Truncated lzma data"); + return (ARCHIVE_FATAL); + diff --git a/libarchive.spec b/libarchive.spec index 1d796ad..ce039f4 100644 --- a/libarchive.spec +++ b/libarchive.spec @@ -2,7 +2,7 @@ Name: libarchive Version: 3.5.2 -Release: 3 +Release: 4 Summary: Multi-format archive and compression library License: BSD @@ -16,6 +16,7 @@ BuildRequires: openssl-devel libxml2-devel lz4-devel automake libzstd-devel Patch6000: backport-libarchive-3.5.2-symlink-fix.patch Patch6001: backport-CVE-2021-36976.patch Patch6002: backport-CVE-2021-31566.patch +Patch6003: backport-CVE-2022-26280.patch Patch9000: libarchive-uninitialized-value.patch @@ -190,6 +191,9 @@ run_testsuite %{_bindir}/bsdcat %changelog +* Mon Jul 04 2022 wangkerong - 3.5.2-4 +- fix CVE-2022-26280 + * Sat Apr 09 2022 wangkerong - 3.5.2-3 - fix CVE-2021-36976,CVE-2021-31566,fix fuzz test -- Gitee