diff options
Diffstat (limited to 'meta/recipes-extended/unzip/unzip/18-cve-2014-9913-unzip-buffer-overflow.patch')
-rw-r--r-- | meta/recipes-extended/unzip/unzip/18-cve-2014-9913-unzip-buffer-overflow.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/meta/recipes-extended/unzip/unzip/18-cve-2014-9913-unzip-buffer-overflow.patch b/meta/recipes-extended/unzip/unzip/18-cve-2014-9913-unzip-buffer-overflow.patch new file mode 100644 index 0000000000..eb76e2ea7d --- /dev/null +++ b/meta/recipes-extended/unzip/unzip/18-cve-2014-9913-unzip-buffer-overflow.patch | |||
@@ -0,0 +1,33 @@ | |||
1 | From: "Steven M. Schweda" <sms@antinode.info> | ||
2 | Subject: Fix CVE-2014-9913, buffer overflow in unzip | ||
3 | Bug: https://sourceforge.net/p/infozip/bugs/27/ | ||
4 | Bug-Debian: https://bugs.debian.org/847485 | ||
5 | Bug-Ubuntu: https://launchpad.net/bugs/387350 | ||
6 | X-Debian-version: 6.0-21 | ||
7 | |||
8 | Upstream-Status: Backport | ||
9 | |||
10 | Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> | ||
11 | |||
12 | --- a/list.c | ||
13 | +++ b/list.c | ||
14 | @@ -339,7 +339,18 @@ | ||
15 | G.crec.compression_method == ENHDEFLATED) { | ||
16 | methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3]; | ||
17 | } else if (methnum >= NUM_METHODS) { | ||
18 | - sprintf(&methbuf[4], "%03u", G.crec.compression_method); | ||
19 | + /* 2013-02-26 SMS. | ||
20 | + * http://sourceforge.net/p/infozip/bugs/27/ CVE-2014-9913. | ||
21 | + * Unexpectedly large compression methods overflow | ||
22 | + * &methbuf[]. Use the old, three-digit decimal format | ||
23 | + * for values which fit. Otherwise, sacrifice the | ||
24 | + * colon, and use four-digit hexadecimal. | ||
25 | + */ | ||
26 | + if (G.crec.compression_method <= 999) { | ||
27 | + sprintf( &methbuf[ 4], "%03u", G.crec.compression_method); | ||
28 | + } else { | ||
29 | + sprintf( &methbuf[ 3], "%04X", G.crec.compression_method); | ||
30 | + } | ||
31 | } | ||
32 | |||
33 | #if 0 /* GRR/Euro: add this? */ | ||