0
0
mirror of https://github.com/openwrt/packages.git synced 2025-02-07 05:49:50 +00:00
packages/utils/unzip/patches/007-integer-underflow-csiz_decrypted.patch
Álvaro Fernández Rojas b88213b3a7 unzip: patch CVE-2015-7696, CVE-2015-7697 and integer underflow
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
2015-11-01 16:19:56 +01:00

22 lines
900 B
Diff

--- a/extract.c
+++ b/extract.c
@@ -1257,8 +1257,17 @@ static int extract_or_test_entrylist(__G
if (G.lrec.compression_method == STORED) {
zusz_t csiz_decrypted = G.lrec.csize;
- if (G.pInfo->encrypted)
+ if (G.pInfo->encrypted) {
+ if (csiz_decrypted <= 12) {
+ /* handle the error now to prevent unsigned overflow */
+ Info(slide, 0x401, ((char *)slide,
+ LoadFarStringSmall(ErrUnzipNoFile),
+ LoadFarString(InvalidComprData),
+ LoadFarStringSmall2(Inflate)));
+ return PK_ERR;
+ }
csiz_decrypted -= 12;
+ }
if (G.lrec.ucsize != csiz_decrypted) {
Info(slide, 0x401, ((char *)slide,
LoadFarStringSmall2(WrnStorUCSizCSizDiff),