From 29b004b1786eb788c62dfb878575cd76f914d053 Mon Sep 17 00:00:00 2001 From: liweigang Date: Wed, 8 May 2024 15:20:05 +0800 Subject: [PATCH] sync upstream patch for modify patch6008 Signed-off-by: liweigang (cherry picked from commit 272acc9587aa074d969d2c337d2eaa2daa2a551d) --- backport-CVE-2020-18770.patch | 38 +++++++++++++---------------------- zziplib.spec | 5 ++++- 2 files changed, 18 insertions(+), 25 deletions(-) diff --git a/backport-CVE-2020-18770.patch b/backport-CVE-2020-18770.patch index 9687103..9244a6f 100644 --- a/backport-CVE-2020-18770.patch +++ b/backport-CVE-2020-18770.patch @@ -1,33 +1,23 @@ -From 99462cac1c6581bce36fe17fd1f430cbe114f0af Mon Sep 17 00:00:00 2001 -From: Valentin Lefebvre -Date: Wed, 20 Sep 2023 12:04:56 +0200 -Subject: [PATCH] mmappend.c: pre-check header trailer magic - -* Avoid potential ASAN:SIGSEGV invalid memory access by pre-check the header - trailer magic. -* CVE-2020-18770 - -Signed-off-by: Valentin Lefebvre +From 803f49aaae16b7f2899e4769afdfc673a21fa9e8 Mon Sep 17 00:00:00 2001 +From: Guido Draheim +Date: Mon, 26 Feb 2024 23:17:12 +0100 +Subject: [PATCH] #69 assert full zzip_file_header --- - zzip/mmapped.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) + zzip/mmapped.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/zzip/mmapped.c b/zzip/mmapped.c -index 8af18f4..49990e6 100644 +index 2071882..306ba51 100644 --- a/zzip/mmapped.c +++ b/zzip/mmapped.c -@@ -269,7 +269,9 @@ zzip_disk_entry_to_file_header(ZZIP_DISK * disk, struct zzip_disk_entry *entry) - return 0; - } - ___ struct zzip_file_header *file_header = (void *) ptr; -- if (zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC) -+ if (file_header != 'P' || /* quick pre-check for trailer magic */ -+ zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC) -+ +@@ -276,7 +276,8 @@ struct zzip_file_header * + zzip_disk_entry_to_file_header(ZZIP_DISK * disk, struct zzip_disk_entry *entry) + { + zzip_byte_t *const ptr = disk->buffer + zzip_disk_entry_fileoffset(entry); +- if (disk->buffer > ptr || ptr >= disk->endbuf) ++ zzip_byte_t *const end = ptr + sizeof(struct zzip_file_header); ++ if (disk->buffer > ptr || end >= disk->endbuf || end <= NULL) { errno = EBADMSG; return 0; --- -2.40.1 - diff --git a/zziplib.spec b/zziplib.spec index 0c9406f..ff286e1 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -4,7 +4,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool Name: zziplib Version: 0.13.71 -Release: 5 +Release: 6 Summary: Lightweight library for zip compression License: LGPLv2+ or MPLv1.1 URL: http://zziplib.sourceforge.net @@ -95,6 +95,9 @@ find %{buildroot} -type f -name "*.la" -delete -print %{_mandir}/man3/* %changelog +* Wed May 08 2024 liweigang - 0.13.71-6 +- sync upstream patch for modify patch6008 + * Wed Sep 27 2023 licihua - 0.13.71-5 - fix CVE-2020-18770 -- Gitee