diff --git a/backport-CVE-2020-18770.patch b/backport-CVE-2020-18770.patch index 96871037cf0c981bf79c1edbc7bcf7bb71fb093c..9244a6fac1073f2c29244c9768a91b99a78267c7 100644 --- a/backport-CVE-2020-18770.patch +++ b/backport-CVE-2020-18770.patch @@ -1,33 +1,23 @@ -From 99462cac1c6581bce36fe17fd1f430cbe114f0af Mon Sep 17 00:00:00 2001 -From: Valentin Lefebvre -Date: Wed, 20 Sep 2023 12:04:56 +0200 -Subject: [PATCH] mmappend.c: pre-check header trailer magic - -* Avoid potential ASAN:SIGSEGV invalid memory access by pre-check the header - trailer magic. -* CVE-2020-18770 - -Signed-off-by: Valentin Lefebvre +From 803f49aaae16b7f2899e4769afdfc673a21fa9e8 Mon Sep 17 00:00:00 2001 +From: Guido Draheim +Date: Mon, 26 Feb 2024 23:17:12 +0100 +Subject: [PATCH] #69 assert full zzip_file_header --- - zzip/mmapped.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) + zzip/mmapped.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/zzip/mmapped.c b/zzip/mmapped.c -index 8af18f4..49990e6 100644 +index 2071882..306ba51 100644 --- a/zzip/mmapped.c +++ b/zzip/mmapped.c -@@ -269,7 +269,9 @@ zzip_disk_entry_to_file_header(ZZIP_DISK * disk, struct zzip_disk_entry *entry) - return 0; - } - ___ struct zzip_file_header *file_header = (void *) ptr; -- if (zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC) -+ if (file_header != 'P' || /* quick pre-check for trailer magic */ -+ zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC) -+ +@@ -276,7 +276,8 @@ struct zzip_file_header * + zzip_disk_entry_to_file_header(ZZIP_DISK * disk, struct zzip_disk_entry *entry) + { + zzip_byte_t *const ptr = disk->buffer + zzip_disk_entry_fileoffset(entry); +- if (disk->buffer > ptr || ptr >= disk->endbuf) ++ zzip_byte_t *const end = ptr + sizeof(struct zzip_file_header); ++ if (disk->buffer > ptr || end >= disk->endbuf || end <= NULL) { errno = EBADMSG; return 0; --- -2.40.1 - diff --git a/zziplib.spec b/zziplib.spec index 0c9406ff99a603ac72db99ab0ba19542f1d75d6a..ff286e1f7a472326b108e65d2f7d02471c8883fa 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -4,7 +4,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool Name: zziplib Version: 0.13.71 -Release: 5 +Release: 6 Summary: Lightweight library for zip compression License: LGPLv2+ or MPLv1.1 URL: http://zziplib.sourceforge.net @@ -95,6 +95,9 @@ find %{buildroot} -type f -name "*.la" -delete -print %{_mandir}/man3/* %changelog +* Wed May 08 2024 liweigang - 0.13.71-6 +- sync upstream patch for modify patch6008 + * Wed Sep 27 2023 licihua - 0.13.71-5 - fix CVE-2020-18770