diff --git a/.checkpackageignore b/.checkpackageignore index cde66729d2..a36e188480 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -1105,7 +1105,6 @@ package/uhttpd/0002-Fix-TCP_FASTOPEN-related-compile-error.patch lib_patch.Upstr package/unbound/S70unbound Shellcheck package/unifdef/0001-Makefile-fix-error-on-install.patch lib_patch.Upstream package/unscd/S46unscd Shellcheck lib_sysv.Indent lib_sysv.Variables -package/unzip/0001-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch lib_patch.Upstream package/upmpdcli/S99upmpdcli Shellcheck lib_sysv.Indent lib_sysv.Variables package/uqmi/0001-uqmi-avoid-gcc-12.x-false-error-reporting-storing-th.patch lib_patch.Upstream package/urg/0001-select-h.patch lib_patch.Upstream diff --git a/package/unzip/0001-manpages-in-section-1-not-in-section-1l.patch b/package/unzip/0001-manpages-in-section-1-not-in-section-1l.patch new file mode 100644 index 0000000000..9d8f3ef241 --- /dev/null +++ b/package/unzip/0001-manpages-in-section-1-not-in-section-1l.patch @@ -0,0 +1,297 @@ +From: Santiago Vila +Subject: In Debian, manpages are in section 1, not in section 1L +X-Debian-version: 5.52-3 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/01-manpages-in-section-1-not-in-section-1l.patch +Signed-off-by: Thomas Perale + +--- a/man/funzip.1 ++++ b/man/funzip.1 +@@ -20,7 +20,7 @@ + .in -4n + .. + .\" ========================================================================= +-.TH FUNZIP 1L "20 April 2009 (v3.95)" "Info-ZIP" ++.TH FUNZIP 1 "20 April 2009 (v3.95)" "Info-ZIP" + .SH NAME + funzip \- filter for extracting from a ZIP archive in a pipe + .PD +@@ -78,7 +78,7 @@ + .EE + .PP + To use \fIzip\fP and \fIfunzip\fP in place of \fIcompress\fP(1) and +-\fIzcat\fP(1) (or \fIgzip\fP(1L) and \fIgzcat\fP(1L)) for tape backups: ++\fIzcat\fP(1) (or \fIgzip\fP(1) and \fIgzcat\fP(1)) for tape backups: + .PP + .EX + tar cf \- . | zip \-7 | dd of=/dev/nrst0 obs=8k +@@ -108,8 +108,8 @@ + .PD + .\" ========================================================================= + .SH "SEE ALSO" +-\fIgzip\fP(1L), \fIunzip\fP(1L), \fIunzipsfx\fP(1L), \fIzip\fP(1L), +-\fIzipcloak\fP(1L), \fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L) ++\fIgzip\fP(1), \fIunzip\fP(1), \fIunzipsfx\fP(1), \fIzip\fP(1), ++\fIzipcloak\fP(1), \fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1) + .PD + .\" ========================================================================= + .SH URL +--- a/man/unzip.1 ++++ b/man/unzip.1 +@@ -20,7 +20,7 @@ + .in -4n + .. + .\" ========================================================================= +-.TH UNZIP 1L "20 April 2009 (v6.0)" "Info-ZIP" ++.TH UNZIP 1 "20 April 2009 (v6.0)" "Info-ZIP" + .SH NAME + unzip \- list, test and extract compressed files in a ZIP archive + .PD +@@ -34,7 +34,7 @@ + \fIunzip\fP will list, test, or extract files from a ZIP archive, commonly + found on MS-DOS systems. The default behavior (with no options) is to extract + into the current directory (and subdirectories below it) all files from the +-specified ZIP archive. A companion program, \fIzip\fP(1L), creates ZIP ++specified ZIP archive. A companion program, \fIzip\fP(1), creates ZIP + archives; both programs are compatible with archives created by PKWARE's + \fIPKZIP\fP and \fIPKUNZIP\fP for MS-DOS, but in many cases the program + options or default behaviors differ. +@@ -105,8 +105,8 @@ + list of all possible flags. The exhaustive list follows: + .TP + .B \-Z +-\fIzipinfo\fP(1L) mode. If the first option on the command line is \fB\-Z\fP, +-the remaining options are taken to be \fIzipinfo\fP(1L) options. See the ++\fIzipinfo\fP(1) mode. If the first option on the command line is \fB\-Z\fP, ++the remaining options are taken to be \fIzipinfo\fP(1) options. See the + appropriate manual page for a description of these options. + .TP + .B \-A +@@ -178,7 +178,7 @@ + compressed size and compression ratio figures are independent of the entry's + encryption status and show the correct compression performance. (The complete + size of the encrypted compressed data stream for zipfile entries is reported +-by the more verbose \fIzipinfo\fP(1L) reports, see the separate manual.) ++by the more verbose \fIzipinfo\fP(1) reports, see the separate manual.) + When no zipfile is specified (that is, the complete command is simply + ``\fCunzip \-v\fR''), a diagnostic screen is printed. In addition to + the normal header with release date and version, \fIunzip\fP lists the +@@ -379,8 +379,8 @@ + .TP + .B \-N + [Amiga] extract file comments as Amiga filenotes. File comments are created +-with the \-c option of \fIzip\fP(1L), or with the \-N option of the Amiga port +-of \fIzip\fP(1L), which stores filenotes as comments. ++with the \-c option of \fIzip\fP(1), or with the \-N option of the Amiga port ++of \fIzip\fP(1), which stores filenotes as comments. + .TP + .B \-o + overwrite existing files without prompting. This is a dangerous option, so +@@ -598,7 +598,7 @@ + As suggested by the examples above, the default variable names are UNZIP_OPTS + for VMS (where the symbol used to install \fIunzip\fP as a foreign command + would otherwise be confused with the environment variable), and UNZIP +-for all other operating systems. For compatibility with \fIzip\fP(1L), ++for all other operating systems. For compatibility with \fIzip\fP(1), + UNZIPOPT is also accepted (don't ask). If both UNZIP and UNZIPOPT + are defined, however, UNZIP takes precedence. \fIunzip\fP's diagnostic + option (\fB\-v\fP with no zipfile name) can be used to check the values +@@ -648,8 +648,8 @@ + a password is not known, entering a null password (that is, just a carriage + return or ``Enter'') is taken as a signal to skip all further prompting. + Only unencrypted files in the archive(s) will thereafter be extracted. (In +-fact, that's not quite true; older versions of \fIzip\fP(1L) and +-\fIzipcloak\fP(1L) allowed null passwords, so \fIunzip\fP checks each encrypted ++fact, that's not quite true; older versions of \fIzip\fP(1) and ++\fIzipcloak\fP(1) allowed null passwords, so \fIunzip\fP checks each encrypted + file to see if the null password works. This may result in ``false positives'' + and extraction errors, as noted above.) + .PP +@@ -943,8 +943,8 @@ + .PD + .\" ========================================================================= + .SH "SEE ALSO" +-\fIfunzip\fP(1L), \fIzip\fP(1L), \fIzipcloak\fP(1L), \fIzipgrep\fP(1L), +-\fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L) ++\fIfunzip\fP(1), \fIzip\fP(1), \fIzipcloak\fP(1), \fIzipgrep\fP(1), ++\fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1) + .PD + .\" ========================================================================= + .SH URL +--- a/man/unzipsfx.1 ++++ b/man/unzipsfx.1 +@@ -20,7 +20,7 @@ + .in -4n + .. + .\" ========================================================================= +-.TH UNZIPSFX 1L "20 April 2009 (v6.0)" "Info-ZIP" ++.TH UNZIPSFX 1 "20 April 2009 (v6.0)" "Info-ZIP" + .SH NAME + unzipsfx \- self-extracting stub for prepending to ZIP archives + .PD +@@ -30,7 +30,7 @@ + .PD + .\" ========================================================================= + .SH DESCRIPTION +-\fIunzipsfx\fP is a modified version of \fIunzip\fP(1L) designed to be ++\fIunzipsfx\fP is a modified version of \fIunzip\fP(1) designed to be + prepended to existing ZIP archives in order to form self-extracting archives. + Instead of taking its first non-flag argument to be the zipfile(s) to be + extracted, \fIunzipsfx\fP seeks itself under the name by which it was invoked +@@ -109,7 +109,7 @@ + .PD + .\" ========================================================================= + .SH OPTIONS +-\fIunzipsfx\fP supports the following \fIunzip\fP(1L) options: \fB\-c\fP ++\fIunzipsfx\fP supports the following \fIunzip\fP(1) options: \fB\-c\fP + and \fB\-p\fP (extract to standard output/screen), \fB\-f\fP and \fB\-u\fP + (freshen and update existing files upon extraction), \fB\-t\fP (test + archive) and \fB\-z\fP (print archive comment). All normal listing options +@@ -118,11 +118,11 @@ + those creating self-extracting archives may wish to include a short listing + in the zipfile comment. + .PP +-See \fIunzip\fP(1L) for a more complete description of these options. ++See \fIunzip\fP(1) for a more complete description of these options. + .PD + .\" ========================================================================= + .SH MODIFIERS +-\fIunzipsfx\fP currently supports all \fIunzip\fP(1L) modifiers: \fB\-a\fP ++\fIunzipsfx\fP currently supports all \fIunzip\fP(1) modifiers: \fB\-a\fP + (convert text files), \fB\-n\fP (never overwrite), \fB\-o\fP (overwrite + without prompting), \fB\-q\fP (operate quietly), \fB\-C\fP (match names + case-insensitively), \fB\-L\fP (convert uppercase-OS names to lowercase), +@@ -137,18 +137,18 @@ + of course continue to be supported since the zipfile format implies ASCII + storage of text files.) + .PP +-See \fIunzip\fP(1L) for a more complete description of these modifiers. ++See \fIunzip\fP(1) for a more complete description of these modifiers. + .PD + .\" ========================================================================= + .SH "ENVIRONMENT OPTIONS" +-\fIunzipsfx\fP uses the same environment variables as \fIunzip\fP(1L) does, ++\fIunzipsfx\fP uses the same environment variables as \fIunzip\fP(1) does, + although this is likely to be an issue only for the person creating and +-testing the self-extracting archive. See \fIunzip\fP(1L) for details. ++testing the self-extracting archive. See \fIunzip\fP(1) for details. + .PD + .\" ========================================================================= + .SH DECRYPTION +-Decryption is supported exactly as in \fIunzip\fP(1L); that is, interactively +-with a non-echoing prompt for the password(s). See \fIunzip\fP(1L) for ++Decryption is supported exactly as in \fIunzip\fP(1); that is, interactively ++with a non-echoing prompt for the password(s). See \fIunzip\fP(1) for + details. Once again, note that if the archive has no encrypted files there + is no reason to use a version of \fIunzipsfx\fP with decryption support; + that only adds to the size of the archive. +@@ -286,7 +286,7 @@ + from anywhere in the user's path. The situation is not known for AmigaDOS, + Atari TOS, MacOS, etc. + .PP +-As noted above, a number of the normal \fIunzip\fP(1L) functions have ++As noted above, a number of the normal \fIunzip\fP(1) functions have + been removed in order to make \fIunzipsfx\fP smaller: usage and diagnostic + info, listing functions and extraction to other directories. Also, only + stored and deflated files are supported. The latter limitation is mainly +@@ -303,17 +303,17 @@ + defined as a ``debug hunk.'') There may be compatibility problems between + the ROM levels of older Amigas and newer ones. + .PP +-All current bugs in \fIunzip\fP(1L) exist in \fIunzipsfx\fP as well. ++All current bugs in \fIunzip\fP(1) exist in \fIunzipsfx\fP as well. + .PD + .\" ========================================================================= + .SH DIAGNOSTICS + \fIunzipsfx\fP's exit status (error level) is identical to that of +-\fIunzip\fP(1L); see the corresponding man page. ++\fIunzip\fP(1); see the corresponding man page. + .PD + .\" ========================================================================= + .SH "SEE ALSO" +-\fIfunzip\fP(1L), \fIunzip\fP(1L), \fIzip\fP(1L), \fIzipcloak\fP(1L), +-\fIzipgrep\fP(1L), \fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L) ++\fIfunzip\fP(1), \fIunzip\fP(1), \fIzip\fP(1), \fIzipcloak\fP(1), ++\fIzipgrep\fP(1), \fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1) + .PD + .PD + .\" ========================================================================= +@@ -330,7 +330,7 @@ + .\" ========================================================================= + .SH AUTHORS + Greg Roelofs was responsible for the basic modifications to UnZip necessary +-to create UnZipSFX. See \fIunzip\fP(1L) for the current list of Zip-Bugs ++to create UnZipSFX. See \fIunzip\fP(1) for the current list of Zip-Bugs + authors, or the file CONTRIBS in the UnZip source distribution for the + full list of Info-ZIP contributors. + .PD +--- a/man/zipgrep.1 ++++ b/man/zipgrep.1 +@@ -8,7 +8,7 @@ + .\" zipgrep.1 by Greg Roelofs. + .\" + .\" ========================================================================= +-.TH ZIPGREP 1L "20 April 2009" "Info-ZIP" ++.TH ZIPGREP 1 "20 April 2009" "Info-ZIP" + .SH NAME + zipgrep \- search files in a ZIP archive for lines matching a pattern + .PD +@@ -21,7 +21,7 @@ + .SH DESCRIPTION + \fIzipgrep\fP will search files within a ZIP archive for lines matching + the given string or pattern. \fIzipgrep\fP is a shell script and requires +-\fIegrep\fP(1) and \fIunzip\fP(1L) to function. Its output is identical to ++\fIegrep\fP(1) and \fIunzip\fP(1) to function. Its output is identical to + that of \fIegrep\fP(1). + .PD + .\" ========================================================================= +@@ -69,8 +69,8 @@ + .PD + .\" ========================================================================= + .SH "SEE ALSO" +-\fIegrep\fP(1), \fIunzip\fP(1L), \fIzip\fP(1L), \fIfunzip\fP(1L), +-\fIzipcloak\fP(1L), \fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L) ++\fIegrep\fP(1), \fIunzip\fP(1), \fIzip\fP(1), \fIfunzip\fP(1), ++\fIzipcloak\fP(1), \fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1) + .PD + .\" ========================================================================= + .SH URL +--- a/man/zipinfo.1 ++++ b/man/zipinfo.1 +@@ -34,7 +34,7 @@ + .in -4n + .. + .\" ========================================================================= +-.TH ZIPINFO 1L "20 April 2009 (v3.0)" "Info-ZIP" ++.TH ZIPINFO 1 "20 April 2009 (v3.0)" "Info-ZIP" + .SH NAME + zipinfo \- list detailed information about a ZIP archive + .PD +@@ -272,7 +272,7 @@ + Note that because of limitations in the MS-DOS format used to store file + times, the seconds field is always rounded to the nearest even second. + For Unix files this is expected to change in the next major releases of +-\fIzip\fP(1L) and \fIunzip\fP. ++\fIzip\fP(1) and \fIunzip\fP. + .PP + In addition to individual file information, a default zipfile listing + also includes header and trailer lines: +@@ -361,7 +361,7 @@ + As suggested above, the default variable names are ZIPINFO_OPTS for VMS + (where the symbol used to install \fIzipinfo\fP as a foreign command + would otherwise be confused with the environment variable), and ZIPINFO +-for all other operating systems. For compatibility with \fIzip\fP(1L), ++for all other operating systems. For compatibility with \fIzip\fP(1), + ZIPINFOOPT is also accepted (don't ask). If both ZIPINFO and ZIPINFOOPT + are defined, however, ZIPINFO takes precedence. \fIunzip\fP's diagnostic + option (\fB\-v\fP with no zipfile name) can be used to check the values +@@ -496,8 +496,8 @@ + .PP + .\" ========================================================================= + .SH "SEE ALSO" +-\fIls\fP(1), \fIfunzip\fP(1L), \fIunzip\fP(1L), \fIunzipsfx\fP(1L), +-\fIzip\fP(1L), \fIzipcloak\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L) ++\fIls\fP(1), \fIfunzip\fP(1), \fIunzip\fP(1), \fIunzipsfx\fP(1), ++\fIzip\fP(1), \fIzipcloak\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1) + .PD + .\" ========================================================================= + .SH URL diff --git a/package/unzip/0002-this-is-debian-unzip.patch b/package/unzip/0002-this-is-debian-unzip.patch new file mode 100644 index 0000000000..8a9bd69a23 --- /dev/null +++ b/package/unzip/0002-this-is-debian-unzip.patch @@ -0,0 +1,18 @@ +From: Santiago Vila +Subject: "Branding patch": UnZip by Debian. Original by Info-ZIP. +X-Debian-version: 5.52-5 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/02-this-is-debian-unzip.patch +Signed-off-by: Thomas Perale + +--- a/unzip.c ++++ b/unzip.c +@@ -570,8 +570,7 @@ + #else /* !VMS */ + # ifdef COPYRIGHT_CLEAN + static ZCONST char Far UnzipUsageLine1[] = "\ +-UnZip %d.%d%d%s of %s, by Info-ZIP. Maintained by C. Spieler. Send\n\ +-bug reports using http://www.info-zip.org/zip-bug.html; see README for details.\ ++UnZip %d.%d%d%s of %s, by Debian. Original by Info-ZIP.\ + \n\n"; + # else + static ZCONST char Far UnzipUsageLine1[] = "\ diff --git a/package/unzip/0003-include-unistd-for-kfreebsd.patch b/package/unzip/0003-include-unistd-for-kfreebsd.patch new file mode 100644 index 0000000000..419c5954c1 --- /dev/null +++ b/package/unzip/0003-include-unistd-for-kfreebsd.patch @@ -0,0 +1,17 @@ +From: Aurelien Jarno +Subject: #include for kFreeBSD +Bug-Debian: https://bugs.debian.org/340693 +X-Debian-version: 5.52-8 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/03-include-unistd-for-kfreebsd.patch +Signed-off-by: Thomas Perale + +--- a/unix/unxcfg.h ++++ b/unix/unxcfg.h +@@ -52,6 +52,7 @@ + + #include /* off_t, time_t, dev_t, ... */ + #include ++#include + + #ifdef NO_OFF_T + typedef long zoff_t; diff --git a/package/unzip/0004-handle-pkware-verification-bit.patch b/package/unzip/0004-handle-pkware-verification-bit.patch new file mode 100644 index 0000000000..58a3f2092e --- /dev/null +++ b/package/unzip/0004-handle-pkware-verification-bit.patch @@ -0,0 +1,23 @@ +From: "Steven M. Schweda" +Subject: Handle the PKWare verification bit of internal attributes +Bug-Debian: https://bugs.debian.org/630078 +X-Debian-version: 6.0-5 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/04-handle-pkware-verification-bit.patch +Signed-off-by: Thomas Perale + +--- a/process.c ++++ b/process.c +@@ -1729,6 +1729,13 @@ + else if (uO.L_flag > 1) /* let -LL force lower case for all names */ + G.pInfo->lcflag = 1; + ++ /* Handle the PKWare verification bit, bit 2 (0x0004) of internal ++ attributes. If this is set, then a verification checksum is in the ++ first 3 bytes of the external attributes. In this case all we can use ++ for setting file attributes is the last external attributes byte. */ ++ if (G.crec.internal_file_attributes & 0x0004) ++ G.crec.external_file_attributes &= (ulg)0xff; ++ + /* do Amigas (AMIGA_) also have volume labels? */ + if (IS_VOLID(G.crec.external_file_attributes) && + (G.pInfo->hostnum == FS_FAT_ || G.pInfo->hostnum == FS_HPFS_ || diff --git a/package/unzip/0005-fix-uid-gid-handling.patch b/package/unzip/0005-fix-uid-gid-handling.patch new file mode 100644 index 0000000000..eb229f5f2a --- /dev/null +++ b/package/unzip/0005-fix-uid-gid-handling.patch @@ -0,0 +1,31 @@ +From: "Steven M. Schweda" +Subject: Restore uid and gid information when requested +Bug-Debian: https://bugs.debian.org/689212 +X-Debian-version: 6.0-8 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/05-fix-uid-gid-handling.patch +Signed-off-by: Thomas Perale + +--- a/process.c ++++ b/process.c +@@ -2904,7 +2904,7 @@ + #ifdef IZ_HAVE_UXUIDGID + if (eb_len >= EB_UX3_MINLEN + && z_uidgid != NULL +- && (*((EB_HEADSIZE + 0) + ef_buf) == 1) ++ && (*((EB_HEADSIZE + 0) + ef_buf) == 1)) + /* only know about version 1 */ + { + uch uid_size; +@@ -2916,10 +2916,10 @@ + flags &= ~0x0ff; /* ignore any previous UNIX field */ + + if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf, +- uid_size, z_uidgid[0]) ++ uid_size, &z_uidgid[0]) + && + read_ux3_value((EB_HEADSIZE + uid_size + 3) + ef_buf, +- gid_size, z_uidgid[1]) ) ++ gid_size, &z_uidgid[1]) ) + { + flags |= EB_UX2_VALID; /* signal success */ + } diff --git a/package/unzip/0006-initialize-the-symlink-flag.patch b/package/unzip/0006-initialize-the-symlink-flag.patch new file mode 100644 index 0000000000..70c02edaef --- /dev/null +++ b/package/unzip/0006-initialize-the-symlink-flag.patch @@ -0,0 +1,22 @@ +From: Andreas Schwab +Subject: Initialize the symlink flag +Bug-Debian: https://bugs.debian.org/717029 +X-Debian-version: 6.0-10 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/06-initialize-the-symlink-flag.patch +Signed-off-by: Thomas Perale + +--- a/process.c ++++ b/process.c +@@ -1758,6 +1758,12 @@ + = (G.crec.general_purpose_bit_flag & (1 << 11)) == (1 << 11); + #endif + ++#ifdef SYMLINKS ++ /* Initialize the symlink flag, may be set by the platform-specific ++ mapattr function. */ ++ G.pInfo->symlink = 0; ++#endif ++ + return PK_COOL; + + } /* end function process_cdir_file_hdr() */ diff --git a/package/unzip/0007-increase-size-of-cfactorstr.patch b/package/unzip/0007-increase-size-of-cfactorstr.patch new file mode 100644 index 0000000000..2d13962f7f --- /dev/null +++ b/package/unzip/0007-increase-size-of-cfactorstr.patch @@ -0,0 +1,19 @@ +From: "Steven M. Schweda" +Subject: Increase size of cfactorstr array to avoid buffer overflow +Bug-Debian: https://bugs.debian.org/741384 +X-Debian-version: 6.0-11 +CVE: CVE-2018-18384 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/07-increase-size-of-cfactorstr.patch +Signed-off-by: Thomas Perale + +--- a/list.c ++++ b/list.c +@@ -97,7 +97,7 @@ + { + int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL; + #ifndef WINDLL +- char sgn, cfactorstr[10]; ++ char sgn, cfactorstr[12]; + int longhdr=(uO.vflag>1); + #endif + int date_format; diff --git a/package/unzip/0008-allow-greater-hostver-values.patch b/package/unzip/0008-allow-greater-hostver-values.patch new file mode 100644 index 0000000000..10038cfed6 --- /dev/null +++ b/package/unzip/0008-allow-greater-hostver-values.patch @@ -0,0 +1,16 @@ +From: Santiago Vila +Subject: zipinfo.c: Do not crash when hostver byte is >= 100 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/08-allow-greater-hostver-values.patch +Signed-off-by: Thomas Perale + +--- a/zipinfo.c ++++ b/zipinfo.c +@@ -2114,7 +2114,7 @@ + else + attribs[9] = (xattr & UNX_ISVTX)? 'T' : '-'; /* T==undefined */ + +- sprintf(&attribs[12], "%u.%u", hostver/10, hostver%10); ++ sprintf(&attribs[11], "%2u.%u", hostver/10, hostver%10); + break; + + } /* end switch (hostnum: external attributes format) */ diff --git a/package/unzip/0009-cve-2014-8139-crc-overflow.patch b/package/unzip/0009-cve-2014-8139-crc-overflow.patch new file mode 100644 index 0000000000..5ff301a344 --- /dev/null +++ b/package/unzip/0009-cve-2014-8139-crc-overflow.patch @@ -0,0 +1,56 @@ +From: "Steven M. Schweda" +Subject: Fix CVE-2014-8139: CRC32 verification heap-based overflow +Bug-Debian: https://bugs.debian.org/773722 +CVE: CVE-2014-8139 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/09-cve-2014-8139-crc-overflow.patch +Signed-off-by: Thomas Perale + +--- a/extract.c ++++ b/extract.c +@@ -1,5 +1,5 @@ + /* +- Copyright (c) 1990-2009 Info-ZIP. All rights reserved. ++ Copyright (c) 1990-2014 Info-ZIP. All rights reserved. + + See the accompanying file LICENSE, version 2009-Jan-02 or later + (the contents of which are also included in unzip.h) for terms of use. +@@ -298,6 +298,8 @@ + #ifndef SFX + static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \ + EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n"; ++ static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \ ++ EF block length (%u bytes) invalid (< %d)\n"; + static ZCONST char Far InvalidComprDataEAs[] = + " invalid compressed data for EAs\n"; + # if (defined(WIN32) && defined(NTSD_EAS)) +@@ -2023,7 +2025,8 @@ + ebID = makeword(ef); + ebLen = (unsigned)makeword(ef+EB_LEN); + +- if (ebLen > (ef_len - EB_HEADSIZE)) { ++ if (ebLen > (ef_len - EB_HEADSIZE)) ++ { + /* Discovered some extra field inconsistency! */ + if (uO.qflag) + Info(slide, 1, ((char *)slide, "%-22s ", +@@ -2158,11 +2161,19 @@ + } + break; + case EF_PKVMS: +- if (makelong(ef+EB_HEADSIZE) != ++ if (ebLen < 4) ++ { ++ Info(slide, 1, ++ ((char *)slide, LoadFarString(TooSmallEBlength), ++ ebLen, 4)); ++ } ++ else if (makelong(ef+EB_HEADSIZE) != + crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4), + (extent)(ebLen-4))) ++ { + Info(slide, 1, ((char *)slide, + LoadFarString(BadCRC_EAs))); ++ } + break; + case EF_PKW32: + case EF_PKUNIX: diff --git a/package/unzip/0010-cve-2014-8140-test-compr-eb.patch b/package/unzip/0010-cve-2014-8140-test-compr-eb.patch new file mode 100644 index 0000000000..046efca3b5 --- /dev/null +++ b/package/unzip/0010-cve-2014-8140-test-compr-eb.patch @@ -0,0 +1,30 @@ +From: "Steven M. Schweda" +Subject: Fix CVE-2014-8140: out-of-bounds write issue in test_compr_eb() +Bug-Debian: https://bugs.debian.org/773722 +CVE: CVE-2014-8140 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/10-cve-2014-8140-test-compr-eb.patch +Signed-off-by: Thomas Perale + +--- a/extract.c ++++ b/extract.c +@@ -2232,10 +2232,17 @@ + if (compr_offset < 4) /* field is not compressed: */ + return PK_OK; /* do nothing and signal OK */ + ++ /* Return no/bad-data error status if any problem is found: ++ * 1. eb_size is too small to hold the uncompressed size ++ * (eb_ucsize). (Else extract eb_ucsize.) ++ * 2. eb_ucsize is zero (invalid). 2014-12-04 SMS. ++ * 3. eb_ucsize is positive, but eb_size is too small to hold ++ * the compressed data header. ++ */ + if ((eb_size < (EB_UCSIZE_P + 4)) || +- ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L && +- eb_size <= (compr_offset + EB_CMPRHEADLEN))) +- return IZ_EF_TRUNC; /* no compressed data! */ ++ ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) || ++ ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN)))) ++ return IZ_EF_TRUNC; /* no/bad compressed data! */ + + if ( + #ifdef INT_16BIT diff --git a/package/unzip/0011-cve-2014-8141-getzip64data.patch b/package/unzip/0011-cve-2014-8141-getzip64data.patch new file mode 100644 index 0000000000..6e1835bda2 --- /dev/null +++ b/package/unzip/0011-cve-2014-8141-getzip64data.patch @@ -0,0 +1,140 @@ +From: "Steven M. Schweda" +Subject: Fix CVE-2014-8141: out-of-bounds read issues in getZip64Data() +Bug-Debian: https://bugs.debian.org/773722 +CVE: CVE-2014-8141 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/11-cve-2014-8141-getzip64data.patch +Signed-off-by: Thomas Perale + +--- a/fileio.c ++++ b/fileio.c +@@ -176,6 +176,8 @@ + #endif + static ZCONST char Far ExtraFieldTooLong[] = + "warning: extra field too long (%d). Ignoring...\n"; ++static ZCONST char Far ExtraFieldCorrupt[] = ++ "warning: extra field (type: 0x%04x) corrupt. Continuing...\n"; + + #ifdef WINDLL + static ZCONST char Far DiskFullQuery[] = +@@ -2295,7 +2297,12 @@ + if (readbuf(__G__ (char *)G.extra_field, length) == 0) + return PK_EOF; + /* Looks like here is where extra fields are read */ +- getZip64Data(__G__ G.extra_field, length); ++ if (getZip64Data(__G__ G.extra_field, length) != PK_COOL) ++ { ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString( ExtraFieldCorrupt), EF_PKSZ64)); ++ error = PK_WARN; ++ } + #ifdef UNICODE_SUPPORT + G.unipath_filename = NULL; + if (G.UzO.U_flag < 2) { +--- a/process.c ++++ b/process.c +@@ -1,5 +1,5 @@ + /* +- Copyright (c) 1990-2009 Info-ZIP. All rights reserved. ++ Copyright (c) 1990-2014 Info-ZIP. All rights reserved. + + See the accompanying file LICENSE, version 2009-Jan-02 or later + (the contents of which are also included in unzip.h) for terms of use. +@@ -1901,48 +1901,82 @@ + and a 4-byte version of disk start number. + Sets both local header and central header fields. Not terribly clever, + but it means that this procedure is only called in one place. ++ ++ 2014-12-05 SMS. ++ Added checks to ensure that enough data are available before calling ++ makeint64() or makelong(). Replaced various sizeof() values with ++ simple ("4" or "8") constants. (The Zip64 structures do not depend ++ on our variable sizes.) Error handling is crude, but we should now ++ stay within the buffer. + ---------------------------------------------------------------------------*/ + ++#define Z64FLGS 0xffff ++#define Z64FLGL 0xffffffff ++ + if (ef_len == 0 || ef_buf == NULL) + return PK_COOL; + + Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n", + ef_len)); + +- while (ef_len >= EB_HEADSIZE) { ++ while (ef_len >= EB_HEADSIZE) ++ { + eb_id = makeword(EB_ID + ef_buf); + eb_len = makeword(EB_LEN + ef_buf); + +- if (eb_len > (ef_len - EB_HEADSIZE)) { +- /* discovered some extra field inconsistency! */ ++ if (eb_len > (ef_len - EB_HEADSIZE)) ++ { ++ /* Extra block length exceeds remaining extra field length. */ + Trace((stderr, + "getZip64Data: block length %u > rest ef_size %u\n", eb_len, + ef_len - EB_HEADSIZE)); + break; + } +- if (eb_id == EF_PKSZ64) { +- ++ if (eb_id == EF_PKSZ64) ++ { + int offset = EB_HEADSIZE; + +- if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){ +- G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf); +- offset += sizeof(G.crec.ucsize); ++ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL)) ++ { ++ if (offset+ 8 > ef_len) ++ return PK_ERR; ++ ++ G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf); ++ offset += 8; + } +- if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){ +- G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf); +- offset += sizeof(G.crec.csize); ++ ++ if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL)) ++ { ++ if (offset+ 8 > ef_len) ++ return PK_ERR; ++ ++ G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf); ++ offset += 8; + } +- if (G.crec.relative_offset_local_header == 0xffffffff){ ++ ++ if (G.crec.relative_offset_local_header == Z64FLGL) ++ { ++ if (offset+ 8 > ef_len) ++ return PK_ERR; ++ + G.crec.relative_offset_local_header = makeint64(offset + ef_buf); +- offset += sizeof(G.crec.relative_offset_local_header); ++ offset += 8; + } +- if (G.crec.disk_number_start == 0xffff){ ++ ++ if (G.crec.disk_number_start == Z64FLGS) ++ { ++ if (offset+ 4 > ef_len) ++ return PK_ERR; ++ + G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf); +- offset += sizeof(G.crec.disk_number_start); ++ offset += 4; + } ++#if 0 ++ break; /* Expect only one EF_PKSZ64 block. */ ++#endif /* 0 */ + } + +- /* Skip this extra field block */ ++ /* Skip this extra field block. */ + ef_buf += (eb_len + EB_HEADSIZE); + ef_len -= (eb_len + EB_HEADSIZE); + } diff --git a/package/unzip/0012-cve-2014-9636-test-compr-eb.patch b/package/unzip/0012-cve-2014-9636-test-compr-eb.patch new file mode 100644 index 0000000000..a68a249e2b --- /dev/null +++ b/package/unzip/0012-cve-2014-9636-test-compr-eb.patch @@ -0,0 +1,44 @@ +From: mancha +Date: Wed, 11 Feb 2015 +Subject: Info-ZIP UnZip buffer overflow +Bug-Debian: https://bugs.debian.org/776589 + +By carefully crafting a corrupt ZIP archive with "extra fields" that +purport to have compressed blocks larger than the corresponding +uncompressed blocks in STORED no-compression mode, an attacker can +trigger a heap overflow that can result in application crash or +possibly have other unspecified impact. + +This patch ensures that when extra fields use STORED mode, the +"compressed" and uncompressed block sizes match. + +CVE: CVE-2014-9636 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/12-cve-2014-9636-test-compr-eb.patch +Signed-off-by: Thomas Perale + +--- a/extract.c ++++ b/extract.c +@@ -2228,6 +2228,7 @@ + ulg eb_ucsize; + uch *eb_ucptr; + int r; ++ ush eb_compr_method; + + if (compr_offset < 4) /* field is not compressed: */ + return PK_OK; /* do nothing and signal OK */ +@@ -2244,6 +2245,15 @@ + ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN)))) + return IZ_EF_TRUNC; /* no/bad compressed data! */ + ++ /* 2015-02-10 Mancha(?), Michal Zalewski, Tomas Hoger, SMS. ++ * For STORE method, compressed and uncompressed sizes must agree. ++ * http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450 ++ */ ++ eb_compr_method = makeword( eb + (EB_HEADSIZE + compr_offset)); ++ if ((eb_compr_method == STORED) && ++ (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize)) ++ return PK_ERR; ++ + if ( + #ifdef INT_16BIT + (((ulg)(extent)eb_ucsize) != eb_ucsize) || diff --git a/package/unzip/0013-remove-build-date.patch b/package/unzip/0013-remove-build-date.patch new file mode 100644 index 0000000000..48353aa8d4 --- /dev/null +++ b/package/unzip/0013-remove-build-date.patch @@ -0,0 +1,20 @@ +From: Jérémy Bobbio +Subject: Remove build date +Bug-Debian: https://bugs.debian.org/782851 + In order to make unzip build reproducibly, we remove the + (already optional) build date from the binary. + +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/13-remove-build-date.patch +Signed-off-by: Thomas Perale + +--- a/unix/unix.c ++++ b/unix/unix.c +@@ -1705,7 +1705,7 @@ + #endif /* Sun */ + #endif /* SGI */ + +-#ifdef __DATE__ ++#if 0 + " on ", __DATE__ + #else + "", "" diff --git a/package/unzip/0014-cve-2015-7696.patch b/package/unzip/0014-cve-2015-7696.patch new file mode 100644 index 0000000000..b64b2b829a --- /dev/null +++ b/package/unzip/0014-cve-2015-7696.patch @@ -0,0 +1,35 @@ +From: Petr Stodulka +Date: Mon, 14 Sep 2015 18:23:17 +0200 +Subject: Upstream fix for heap overflow +Bug-Debian: https://bugs.debian.org/802162 +Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1260944 +Origin: https://bugzilla.redhat.com/attachment.cgi?id=1073002 +Forwarded: yes +CVE: CVE-2015-7696 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/14-cve-2015-7696.patch +Signed-off-by: Thomas Perale +--- + crypt.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/crypt.c ++++ b/crypt.c +@@ -465,7 +465,17 @@ + GLOBAL(pInfo->encrypted) = FALSE; + defer_leftover_input(__G); + for (n = 0; n < RAND_HEAD_LEN; n++) { +- b = NEXTBYTE; ++ /* 2012-11-23 SMS. (OUSPG report.) ++ * Quit early if compressed size < HEAD_LEN. The resulting ++ * error message ("unable to get password") could be improved, ++ * but it's better than trying to read nonexistent data, and ++ * then continuing with a negative G.csize. (See ++ * fileio.c:readbyte()). ++ */ ++ if ((b = NEXTBYTE) == (ush)EOF) ++ { ++ return PK_ERR; ++ } + h[n] = (uch)b; + Trace((stdout, " (%02x)", h[n])); + } diff --git a/package/unzip/0015-cve-2015-7697.patch b/package/unzip/0015-cve-2015-7697.patch new file mode 100644 index 0000000000..e60b40cdeb --- /dev/null +++ b/package/unzip/0015-cve-2015-7697.patch @@ -0,0 +1,29 @@ +From: Kamil Dudka +Date: Mon, 14 Sep 2015 18:24:56 +0200 +Subject: fix infinite loop when extracting empty bzip2 data +Bug-Debian: https://bugs.debian.org/802160 +Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1260944 +Origin: other, https://bugzilla.redhat.com/attachment.cgi?id=1073339 + +CVE: CVE-2015-7697 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/15-cve-2015-7697.patch +Signed-off-by: Thomas Perale +--- + extract.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/extract.c ++++ b/extract.c +@@ -2729,6 +2729,12 @@ + int repeated_buf_err; + bz_stream bstrm; + ++ if (G.incnt <= 0 && G.csize <= 0L) { ++ /* avoid an infinite loop */ ++ Trace((stderr, "UZbunzip2() got empty input\n")); ++ return 2; ++ } ++ + #if (defined(DLL) && !defined(NO_SLIDE_REDIR)) + if (G.redirect_slide) + wsize = G.redirect_size, redirSlide = G.redirect_buffer; diff --git a/package/unzip/0016-fix-integer-underflow-csiz-decrypted.patch b/package/unzip/0016-fix-integer-underflow-csiz-decrypted.patch new file mode 100644 index 0000000000..bc01506c50 --- /dev/null +++ b/package/unzip/0016-fix-integer-underflow-csiz-decrypted.patch @@ -0,0 +1,34 @@ +From: Kamil Dudka +Date: Tue, 22 Sep 2015 18:52:23 +0200 +Subject: [PATCH] extract: prevent unsigned overflow on invalid input +Origin: other, https://bugzilla.redhat.com/attachment.cgi?id=1075942 +Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1260944 + +Suggested-by: Stefan Cornelius +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch +Signed-off-by: Thomas Perale +--- + extract.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/extract.c ++++ b/extract.c +@@ -1257,8 +1257,17 @@ + if (G.lrec.compression_method == STORED) { + zusz_t csiz_decrypted = G.lrec.csize; + +- if (G.pInfo->encrypted) ++ if (G.pInfo->encrypted) { ++ if (csiz_decrypted < 12) { ++ /* handle the error now to prevent unsigned overflow */ ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarStringSmall(ErrUnzipNoFile), ++ LoadFarString(InvalidComprData), ++ LoadFarStringSmall2(Inflate))); ++ return PK_ERR; ++ } + csiz_decrypted -= 12; ++ } + if (G.lrec.ucsize != csiz_decrypted) { + Info(slide, 0x401, ((char *)slide, + LoadFarStringSmall2(WrnStorUCSizCSizDiff), diff --git a/package/unzip/0017-restore-unix-timestamps-accurately.patch b/package/unzip/0017-restore-unix-timestamps-accurately.patch new file mode 100644 index 0000000000..484fa2df9c --- /dev/null +++ b/package/unzip/0017-restore-unix-timestamps-accurately.patch @@ -0,0 +1,43 @@ +From: "Steven M. Schweda" +Subject: Do not ignore extra fields containing Unix Timestamps +Bug-Debian: https://bugs.debian.org/842993 +X-Debian-version: 6.0-21 + +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/17-restore-unix-timestamps-accurately.patch +Signed-off-by: Thomas Perale +--- a/process.c ++++ b/process.c +@@ -2914,10 +2914,13 @@ + break; + + case EF_IZUNIX2: +- if (have_new_type_eb == 0) { +- flags &= ~0x0ff; /* ignore any previous IZUNIX field */ ++ if (have_new_type_eb == 0) { /* (< 1) */ + have_new_type_eb = 1; + } ++ if (have_new_type_eb <= 1) { ++ /* Ignore any prior (EF_IZUNIX/EF_PKUNIX) UID/GID. */ ++ flags &= 0x0ff; ++ } + #ifdef IZ_HAVE_UXUIDGID + if (have_new_type_eb > 1) + break; /* IZUNIX3 overrides IZUNIX2 e.f. block ! */ +@@ -2933,6 +2936,8 @@ + /* new 3rd generation Unix ef */ + have_new_type_eb = 2; + ++ /* Ignore any prior EF_IZUNIX/EF_PKUNIX/EF_IZUNIX2 UID/GID. */ ++ flags &= 0x0ff; + /* + Version 1 byte version of this extra field, currently 1 + UIDSize 1 byte Size of UID field +@@ -2953,8 +2958,6 @@ + uid_size = *((EB_HEADSIZE + 1) + ef_buf); + gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf); + +- flags &= ~0x0ff; /* ignore any previous UNIX field */ +- + if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf, + uid_size, &z_uidgid[0]) + && diff --git a/package/unzip/0018-cve-2014-9913-unzip-buffer-overflow.patch b/package/unzip/0018-cve-2014-9913-unzip-buffer-overflow.patch new file mode 100644 index 0000000000..5be35bc084 --- /dev/null +++ b/package/unzip/0018-cve-2014-9913-unzip-buffer-overflow.patch @@ -0,0 +1,32 @@ +From: "Steven M. Schweda" +Subject: Fix CVE-2014-9913, buffer overflow in unzip +Bug: https://sourceforge.net/p/infozip/bugs/27/ +Bug-Debian: https://bugs.debian.org/847485 +Bug-Ubuntu: https://launchpad.net/bugs/387350 +X-Debian-version: 6.0-21 + +CVE: CVE-2014-9913 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/18-cve-2014-9913-unzip-buffer-overflow.patch +Signed-off-by: Thomas Perale +--- a/list.c ++++ b/list.c +@@ -339,7 +339,18 @@ + G.crec.compression_method == ENHDEFLATED) { + methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3]; + } else if (methnum >= NUM_METHODS) { +- sprintf(&methbuf[4], "%03u", G.crec.compression_method); ++ /* 2013-02-26 SMS. ++ * http://sourceforge.net/p/infozip/bugs/27/ CVE-2014-9913. ++ * Unexpectedly large compression methods overflow ++ * &methbuf[]. Use the old, three-digit decimal format ++ * for values which fit. Otherwise, sacrifice the ++ * colon, and use four-digit hexadecimal. ++ */ ++ if (G.crec.compression_method <= 999) { ++ sprintf( &methbuf[ 4], "%03u", G.crec.compression_method); ++ } else { ++ sprintf( &methbuf[ 3], "%04X", G.crec.compression_method); ++ } + } + + #if 0 /* GRR/Euro: add this? */ diff --git a/package/unzip/0019-cve-2016-9844-zipinfo-buffer-overflow.patch b/package/unzip/0019-cve-2016-9844-zipinfo-buffer-overflow.patch new file mode 100644 index 0000000000..9760e6a3bb --- /dev/null +++ b/package/unzip/0019-cve-2016-9844-zipinfo-buffer-overflow.patch @@ -0,0 +1,31 @@ +From: "Steven M. Schweda" +Subject: Fix CVE-2016-9844, buffer overflow in zipinfo +Bug-Debian: https://bugs.debian.org/847486 +Bug-Ubuntu: https://launchpad.net/bugs/1643750 +X-Debian-version: 6.0-21 + +CVE: CVE-2016-9844 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch +Signed-off-by: Thomas Perale +--- a/zipinfo.c ++++ b/zipinfo.c +@@ -1921,7 +1921,18 @@ + ush dnum=(ush)((G.crec.general_purpose_bit_flag>>1) & 3); + methbuf[3] = dtype[dnum]; + } else if (methnum >= NUM_METHODS) { /* unknown */ +- sprintf(&methbuf[1], "%03u", G.crec.compression_method); ++ /* 2016-12-05 SMS. ++ * https://launchpad.net/bugs/1643750 ++ * Unexpectedly large compression methods overflow ++ * &methbuf[]. Use the old, three-digit decimal format ++ * for values which fit. Otherwise, sacrifice the "u", ++ * and use four-digit hexadecimal. ++ */ ++ if (G.crec.compression_method <= 999) { ++ sprintf( &methbuf[ 1], "%03u", G.crec.compression_method); ++ } else { ++ sprintf( &methbuf[ 0], "%04X", G.crec.compression_method); ++ } + } + + for (k = 0; k < 15; ++k) diff --git a/package/unzip/0020-cve-2018-1000035-unzip-buffer-overflow.patch b/package/unzip/0020-cve-2018-1000035-unzip-buffer-overflow.patch new file mode 100644 index 0000000000..e105ae86df --- /dev/null +++ b/package/unzip/0020-cve-2018-1000035-unzip-buffer-overflow.patch @@ -0,0 +1,39 @@ +From: Karol Babioch +Subject: Fix buffer overflow in password protected zip archives +Bug-Debian: https://bugs.debian.org/889838 +Origin: https://bugzilla.novell.com/attachment.cgi?id=759406 +X-Debian-version: 6.0-22 + +CVE: CVE-2018-1000035 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch +Signed-off-by: Thomas Perale +--- a/fileio.c ++++ b/fileio.c +@@ -1582,6 +1582,10 @@ + int r = IZ_PW_ENTERED; + char *m; + char *prompt; ++ char *zfnf; ++ char *efnf; ++ size_t zfnfl; ++ int isOverflow; + + #ifndef REENTRANT + /* tell picky compilers to shut up about "unused variable" warnings */ +@@ -1590,7 +1594,15 @@ + + if (*rcnt == 0) { /* First call for current entry */ + *rcnt = 2; +- if ((prompt = (char *)malloc(2*FILNAMSIZ + 15)) != (char *)NULL) { ++ zfnf = FnFilter1(zfn); ++ efnf = FnFilter2(efn); ++ zfnfl = strlen(zfnf); ++ isOverflow = TRUE; ++ if (2*FILNAMSIZ >= zfnfl && (2*FILNAMSIZ - zfnfl) >= strlen(efnf)) ++ { ++ isOverflow = FALSE; ++ } ++ if ((isOverflow == FALSE) && ((prompt = (char *)malloc(2*FILNAMSIZ + 15)) != (char *)NULL)) { + sprintf(prompt, LoadFarString(PasswPrompt), + FnFilter1(zfn), FnFilter2(efn)); + m = prompt; diff --git a/package/unzip/0021-fix-warning-messages-on-big-files.patch b/package/unzip/0021-fix-warning-messages-on-big-files.patch new file mode 100644 index 0000000000..fd9cb49f9c --- /dev/null +++ b/package/unzip/0021-fix-warning-messages-on-big-files.patch @@ -0,0 +1,16 @@ +From: "Steven M. Schweda" +Subject: Fix lame code in fileio.c +Bug-Debian: https://bugs.debian.org/929502 +X-Debian-version: 6.0-23 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/21-fix-warning-messages-on-big-files.patch +Signed-off-by: Thomas Perale +--- a/fileio.c ++++ b/fileio.c +@@ -2477,6 +2477,7 @@ + */ + return (((zusz_t)sig[7]) << 56) + + (((zusz_t)sig[6]) << 48) ++ + (((zusz_t)sig[5]) << 40) + + (((zusz_t)sig[4]) << 32) + + (zusz_t)((((ulg)sig[3]) << 24) + + (((ulg)sig[2]) << 16) diff --git a/package/unzip/0022-cve-2019-13232-fix-bug-in-undefer-input.patch b/package/unzip/0022-cve-2019-13232-fix-bug-in-undefer-input.patch new file mode 100644 index 0000000000..529ddf9aa9 --- /dev/null +++ b/package/unzip/0022-cve-2019-13232-fix-bug-in-undefer-input.patch @@ -0,0 +1,25 @@ +From: Mark Adler +Subject: Fix bug in undefer_input() that misplaced the input state. +Origin: https://github.com/madler/unzip/commit/41beb477c5744bc396fa1162ee0c14218ec12213 +Bug-Debian: https://bugs.debian.org/931433 +X-Debian-version: 6.0-24 + + Fix bug in undefer_input() that misplaced the input state. + +CVE: CVE-2019-13232 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch +Signed-off-by: Thomas Perale +--- a/fileio.c ++++ b/fileio.c +@@ -532,8 +532,10 @@ + * This condition was checked when G.incnt_leftover was set > 0 in + * defer_leftover_input(), and it is NOT allowed to touch G.csize + * before calling undefer_input() when (G.incnt_leftover > 0) +- * (single exception: see read_byte()'s "G.csize <= 0" handling) !! ++ * (single exception: see readbyte()'s "G.csize <= 0" handling) !! + */ ++ if (G.csize < 0L) ++ G.csize = 0L; + G.incnt = G.incnt_leftover + (int)G.csize; + G.inptr = G.inptr_leftover - (int)G.csize; + G.incnt_leftover = 0; diff --git a/package/unzip/0023-cve-2019-13232-zip-bomb-with-overlapped-entries.patch b/package/unzip/0023-cve-2019-13232-zip-bomb-with-overlapped-entries.patch new file mode 100644 index 0000000000..60b218262a --- /dev/null +++ b/package/unzip/0023-cve-2019-13232-zip-bomb-with-overlapped-entries.patch @@ -0,0 +1,338 @@ +From: Mark Adler +Subject: Detect and reject a zip bomb using overlapped entries. +Origin: https://github.com/madler/unzip/commit/47b3ceae397d21bf822bc2ac73052a4b1daf8e1c +Bug-Debian: https://bugs.debian.org/931433 +X-Debian-version: 6.0-24 + + Detect and reject a zip bomb using overlapped entries. + + This detects an invalid zip file that has at least one entry that + overlaps with another entry or with the central directory to the + end of the file. A Fifield zip bomb uses overlapped local entries + to vastly increase the potential inflation ratio. Such an invalid + zip file is rejected. + + See https://www.bamsoftware.com/hacks/zipbomb/ for David Fifield's + analysis, construction, and examples of such zip bombs. + + The detection maintains a list of covered spans of the zip files + so far, where the central directory to the end of the file and any + bytes preceding the first entry at zip file offset zero are + considered covered initially. Then as each entry is decompressed + or tested, it is considered covered. When a new entry is about to + be processed, its initial offset is checked to see if it is + contained by a covered span. If so, the zip file is rejected as + invalid. + + This commit depends on a preceding commit: "Fix bug in + undefer_input() that misplaced the input state." + +CVE: CVE-2019-13232 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch +Signed-off-by: Thomas Perale +--- a/extract.c ++++ b/extract.c +@@ -321,6 +321,125 @@ + "\nerror: unsupported extra-field compression type (%u)--skipping\n"; + static ZCONST char Far BadExtraFieldCRC[] = + "error [%s]: bad extra-field CRC %08lx (should be %08lx)\n"; ++static ZCONST char Far NotEnoughMemCover[] = ++ "error: not enough memory for bomb detection\n"; ++static ZCONST char Far OverlappedComponents[] = ++ "error: invalid zip file with overlapped components (possible zip bomb)\n"; ++ ++ ++ ++ ++ ++/* A growable list of spans. */ ++typedef zoff_t bound_t; ++typedef struct { ++ bound_t beg; /* start of the span */ ++ bound_t end; /* one past the end of the span */ ++} span_t; ++typedef struct { ++ span_t *span; /* allocated, distinct, and sorted list of spans */ ++ size_t num; /* number of spans in the list */ ++ size_t max; /* allocated number of spans (num <= max) */ ++} cover_t; ++ ++/* ++ * Return the index of the first span in cover whose beg is greater than val. ++ * If there is no such span, then cover->num is returned. ++ */ ++static size_t cover_find(cover, val) ++ cover_t *cover; ++ bound_t val; ++{ ++ size_t lo = 0, hi = cover->num; ++ while (lo < hi) { ++ size_t mid = (lo + hi) >> 1; ++ if (val < cover->span[mid].beg) ++ hi = mid; ++ else ++ lo = mid + 1; ++ } ++ return hi; ++} ++ ++/* Return true if val lies within any one of the spans in cover. */ ++static int cover_within(cover, val) ++ cover_t *cover; ++ bound_t val; ++{ ++ size_t pos = cover_find(cover, val); ++ return pos > 0 && val < cover->span[pos - 1].end; ++} ++ ++/* ++ * Add a new span to the list, but only if the new span does not overlap any ++ * spans already in the list. The new span covers the values beg..end-1. beg ++ * must be less than end. ++ * ++ * Keep the list sorted and merge adjacent spans. Grow the allocated space for ++ * the list as needed. On success, 0 is returned. If the new span overlaps any ++ * existing spans, then 1 is returned and the new span is not added to the ++ * list. If the new span is invalid because beg is greater than or equal to ++ * end, then -1 is returned. If the list needs to be grown but the memory ++ * allocation fails, then -2 is returned. ++ */ ++static int cover_add(cover, beg, end) ++ cover_t *cover; ++ bound_t beg; ++ bound_t end; ++{ ++ size_t pos; ++ int prec, foll; ++ ++ if (beg >= end) ++ /* The new span is invalid. */ ++ return -1; ++ ++ /* Find where the new span should go, and make sure that it does not ++ overlap with any existing spans. */ ++ pos = cover_find(cover, beg); ++ if ((pos > 0 && beg < cover->span[pos - 1].end) || ++ (pos < cover->num && end > cover->span[pos].beg)) ++ return 1; ++ ++ /* Check for adjacencies. */ ++ prec = pos > 0 && beg == cover->span[pos - 1].end; ++ foll = pos < cover->num && end == cover->span[pos].beg; ++ if (prec && foll) { ++ /* The new span connects the preceding and following spans. Merge the ++ following span into the preceding span, and delete the following ++ span. */ ++ cover->span[pos - 1].end = cover->span[pos].end; ++ cover->num--; ++ memmove(cover->span + pos, cover->span + pos + 1, ++ (cover->num - pos) * sizeof(span_t)); ++ } ++ else if (prec) ++ /* The new span is adjacent only to the preceding span. Extend the end ++ of the preceding span. */ ++ cover->span[pos - 1].end = end; ++ else if (foll) ++ /* The new span is adjacent only to the following span. Extend the ++ beginning of the following span. */ ++ cover->span[pos].beg = beg; ++ else { ++ /* The new span has gaps between both the preceding and the following ++ spans. Assure that there is room and insert the span. */ ++ if (cover->num == cover->max) { ++ size_t max = cover->max == 0 ? 16 : cover->max << 1; ++ span_t *span = realloc(cover->span, max * sizeof(span_t)); ++ if (span == NULL) ++ return -2; ++ cover->span = span; ++ cover->max = max; ++ } ++ memmove(cover->span + pos + 1, cover->span + pos, ++ (cover->num - pos) * sizeof(span_t)); ++ cover->num++; ++ cover->span[pos].beg = beg; ++ cover->span[pos].end = end; ++ } ++ return 0; ++} + + + +@@ -376,6 +495,29 @@ + } + #endif /* !SFX || SFX_EXDIR */ + ++ /* One more: initialize cover structure for bomb detection. Start with a ++ span that covers the central directory though the end of the file. */ ++ if (G.cover == NULL) { ++ G.cover = malloc(sizeof(cover_t)); ++ if (G.cover == NULL) { ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString(NotEnoughMemCover))); ++ return PK_MEM; ++ } ++ ((cover_t *)G.cover)->span = NULL; ++ ((cover_t *)G.cover)->max = 0; ++ } ++ ((cover_t *)G.cover)->num = 0; ++ if ((G.extra_bytes != 0 && ++ cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) || ++ cover_add((cover_t *)G.cover, ++ G.extra_bytes + G.ecrec.offset_start_central_directory, ++ G.ziplen) != 0) { ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString(NotEnoughMemCover))); ++ return PK_MEM; ++ } ++ + /*--------------------------------------------------------------------------- + The basic idea of this function is as follows. Since the central di- + rectory lies at the end of the zipfile and the member files lie at the +@@ -593,7 +735,8 @@ + if (error > error_in_archive) + error_in_archive = error; + /* ...and keep going (unless disk full or user break) */ +- if (G.disk_full > 1 || error_in_archive == IZ_CTRLC) { ++ if (G.disk_full > 1 || error_in_archive == IZ_CTRLC || ++ error == PK_BOMB) { + /* clear reached_end to signal premature stop ... */ + reached_end = FALSE; + /* ... and cancel scanning the central directory */ +@@ -1062,6 +1205,11 @@ + + /* seek_zipf(__G__ pInfo->offset); */ + request = G.pInfo->offset + G.extra_bytes; ++ if (cover_within((cover_t *)G.cover, request)) { ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString(OverlappedComponents))); ++ return PK_BOMB; ++ } + inbuf_offset = request % INBUFSIZ; + bufstart = request - inbuf_offset; + +@@ -1602,6 +1750,18 @@ + return IZ_CTRLC; /* cancel operation by user request */ + } + #endif ++ error = cover_add((cover_t *)G.cover, request, ++ G.cur_zipfile_bufstart + (G.inptr - G.inbuf)); ++ if (error < 0) { ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString(NotEnoughMemCover))); ++ return PK_MEM; ++ } ++ if (error != 0) { ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString(OverlappedComponents))); ++ return PK_BOMB; ++ } + #ifdef MACOS /* MacOS is no preemptive OS, thus call event-handling by hand */ + UserStop(); + #endif +@@ -2003,6 +2163,34 @@ + } + + undefer_input(__G); ++ ++ if ((G.lrec.general_purpose_bit_flag & 8) != 0) { ++ /* skip over data descriptor (harder than it sounds, due to signature ++ * ambiguity) ++ */ ++# define SIG 0x08074b50 ++# define LOW 0xffffffff ++ uch buf[12]; ++ unsigned shy = 12 - readbuf((char *)buf, 12); ++ ulg crc = shy ? 0 : makelong(buf); ++ ulg clen = shy ? 0 : makelong(buf + 4); ++ ulg ulen = shy ? 0 : makelong(buf + 8); /* or high clen if ZIP64 */ ++ if (crc == SIG && /* if not SIG, no signature */ ++ (G.lrec.crc32 != SIG || /* if not SIG, have signature */ ++ (clen == SIG && /* if not SIG, no signature */ ++ ((G.lrec.csize & LOW) != SIG || /* if not SIG, have signature */ ++ (ulen == SIG && /* if not SIG, no signature */ ++ (G.zip64 ? G.lrec.csize >> 32 : G.lrec.ucsize) != SIG ++ /* if not SIG, have signature */ ++ ))))) ++ /* skip four more bytes to account for signature */ ++ shy += 4 - readbuf((char *)buf, 4); ++ if (G.zip64) ++ shy += 8 - readbuf((char *)buf, 8); /* skip eight more for ZIP64 */ ++ if (shy) ++ error = PK_ERR; ++ } ++ + return error; + + } /* end function extract_or_test_member() */ +--- a/globals.c ++++ b/globals.c +@@ -181,6 +181,7 @@ + # if (!defined(NO_TIMESTAMPS)) + uO.D_flag=1; /* default to '-D', no restoration of dir timestamps */ + # endif ++ G.cover = NULL; /* not allocated yet */ + #endif + + uO.lflag=(-1); +--- a/globals.h ++++ b/globals.h +@@ -260,12 +260,15 @@ + ecdir_rec ecrec; /* used in unzip.c, extract.c */ + z_stat statbuf; /* used by main, mapname, check_for_newer */ + ++ int zip64; /* true if Zip64 info in extra field */ ++ + int mem_mode; + uch *outbufptr; /* extract.c static */ + ulg outsize; /* extract.c static */ + int reported_backslash; /* extract.c static */ + int disk_full; + int newfile; ++ void **cover; /* used in extract.c for bomb detection */ + + int didCRlast; /* fileio static */ + ulg numlines; /* fileio static: number of lines printed */ +--- a/process.c ++++ b/process.c +@@ -637,6 +637,13 @@ + } + #endif + ++ /* Free the cover span list and the cover structure. */ ++ if (G.cover != NULL) { ++ free(*(G.cover)); ++ free(G.cover); ++ G.cover = NULL; ++ } ++ + } /* end function free_G_buffers() */ + + +@@ -1913,6 +1920,8 @@ + #define Z64FLGS 0xffff + #define Z64FLGL 0xffffffff + ++ G.zip64 = FALSE; ++ + if (ef_len == 0 || ef_buf == NULL) + return PK_COOL; + +@@ -2084,6 +2093,8 @@ + (ZCONST char *)(offset + ef_buf), ULen); + G.unipath_filename[ULen] = '\0'; + } ++ ++ G.zip64 = TRUE; + } + + /* Skip this extra field block */ +--- a/unzip.h ++++ b/unzip.h +@@ -645,6 +645,7 @@ + #define PK_NOZIP 9 /* zipfile not found */ + #define PK_PARAM 10 /* bad or illegal parameters specified */ + #define PK_FIND 11 /* no files found */ ++#define PK_BOMB 12 /* likely zip bomb */ + #define PK_DISK 50 /* disk full */ + #define PK_EOF 51 /* unexpected EOF */ + diff --git a/package/unzip/0024-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch b/package/unzip/0024-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch new file mode 100644 index 0000000000..7b2092f1c5 --- /dev/null +++ b/package/unzip/0024-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch @@ -0,0 +1,106 @@ +From: Mark Adler +Subject: Do not raise a zip bomb alert for a misplaced central directory. +Origin: https://github.com/madler/unzip/commit/6d351831be705cc26d897db44f878a978f4138fc +Bug-Debian: https://bugs.debian.org/932404 +X-Debian-version: 6.0-25 + + Do not raise a zip bomb alert for a misplaced central directory. + + There is a zip-like file in the Firefox distribution, omni.ja, + which is a zip container with the central directory placed at the + start of the file instead of after the local entries as required + by the zip standard. This commit marks the actual location of the + central directory, as well as the end of central directory records, + as disallowed locations. This now permits such containers to not + raise a zip bomb alert, where in fact there are no overlaps. + +CVE: CVE-2019-13232 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch +Signed-off-by: Thomas Perale +--- a/extract.c ++++ b/extract.c +@@ -495,8 +495,11 @@ + } + #endif /* !SFX || SFX_EXDIR */ + +- /* One more: initialize cover structure for bomb detection. Start with a +- span that covers the central directory though the end of the file. */ ++ /* One more: initialize cover structure for bomb detection. Start with ++ spans that cover any extra bytes at the start, the central directory, ++ the end of central directory record (including the Zip64 end of central ++ directory locator, if present), and the Zip64 end of central directory ++ record, if present. */ + if (G.cover == NULL) { + G.cover = malloc(sizeof(cover_t)); + if (G.cover == NULL) { +@@ -508,15 +511,25 @@ + ((cover_t *)G.cover)->max = 0; + } + ((cover_t *)G.cover)->num = 0; +- if ((G.extra_bytes != 0 && +- cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) || +- cover_add((cover_t *)G.cover, ++ if (cover_add((cover_t *)G.cover, + G.extra_bytes + G.ecrec.offset_start_central_directory, +- G.ziplen) != 0) { ++ G.extra_bytes + G.ecrec.offset_start_central_directory + ++ G.ecrec.size_central_directory) != 0) { + Info(slide, 0x401, ((char *)slide, + LoadFarString(NotEnoughMemCover))); + return PK_MEM; + } ++ if ((G.extra_bytes != 0 && ++ cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) || ++ (G.ecrec.have_ecr64 && ++ cover_add((cover_t *)G.cover, G.ecrec.ec64_start, ++ G.ecrec.ec64_end) != 0) || ++ cover_add((cover_t *)G.cover, G.ecrec.ec_start, ++ G.ecrec.ec_end) != 0) { ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString(OverlappedComponents))); ++ return PK_BOMB; ++ } + + /*--------------------------------------------------------------------------- + The basic idea of this function is as follows. Since the central di- +--- a/process.c ++++ b/process.c +@@ -1408,6 +1408,10 @@ + + /* Now, we are (almost) sure that we have a Zip64 archive. */ + G.ecrec.have_ecr64 = 1; ++ G.ecrec.ec_start -= ECLOC64_SIZE+4; ++ G.ecrec.ec64_start = ecrec64_start_offset; ++ G.ecrec.ec64_end = ecrec64_start_offset + ++ 12 + makeint64(&byterec[ECREC64_LENGTH]); + + /* Update the "end-of-central-dir offset" for later checks. */ + G.real_ecrec_offset = ecrec64_start_offset; +@@ -1542,6 +1546,8 @@ + makelong(&byterec[OFFSET_START_CENTRAL_DIRECTORY]); + G.ecrec.zipfile_comment_length = + makeword(&byterec[ZIPFILE_COMMENT_LENGTH]); ++ G.ecrec.ec_start = G.real_ecrec_offset; ++ G.ecrec.ec_end = G.ecrec.ec_start + 22 + G.ecrec.zipfile_comment_length; + + /* Now, we have to read the archive comment, BEFORE the file pointer + is moved away backwards to seek for a Zip64 ECLOC64 structure. +--- a/unzpriv.h ++++ b/unzpriv.h +@@ -2185,6 +2185,16 @@ + int have_ecr64; /* valid Zip64 ecdir-record exists */ + int is_zip64_archive; /* Zip64 ecdir-record is mandatory */ + ush zipfile_comment_length; ++ zusz_t ec_start, ec_end; /* offsets of start and end of the ++ end of central directory record, ++ including if present the Zip64 ++ end of central directory locator, ++ which immediately precedes the ++ end of central directory record */ ++ zusz_t ec64_start, ec64_end; /* if have_ecr64 is true, then these ++ are the offsets of the start and ++ end of the Zip64 end of central ++ directory record */ + } ecdir_rec; + + diff --git a/package/unzip/0025-cve-2019-13232-fix-bug-in-uzbunzip2.patch b/package/unzip/0025-cve-2019-13232-fix-bug-in-uzbunzip2.patch new file mode 100644 index 0000000000..c743faa342 --- /dev/null +++ b/package/unzip/0025-cve-2019-13232-fix-bug-in-uzbunzip2.patch @@ -0,0 +1,26 @@ +From: Mark Adler +Subject: Fix bug in UZbunzip2() that incorrectly updated G.incnt +Origin: https://github.com/madler/unzip/commit/5e2efcd633a4a1fb95a129a75508e7d769e767be +Bug-Debian: https://bugs.debian.org/963996 +X-Debian-version: 6.0-26 + + Fix bug in UZbunzip2() that incorrectly updated G.incnt. + + The update assumed a full buffer, which is not always full. This + could result in a false overlapped element detection when a small + bzip2-compressed file was unzipped. This commit remedies that. + +CVE: CVE-2019-13232 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch +Signed-off-by: Thomas Perale +--- a/extract.c ++++ b/extract.c +@@ -3052,7 +3052,7 @@ + #endif + + G.inptr = (uch *)bstrm.next_in; +- G.incnt = (G.inbuf + INBUFSIZ) - G.inptr; /* reset for other routines */ ++ G.incnt -= G.inptr - G.inbuf; /* reset for other routines */ + + uzbunzip_cleanup_exit: + err = BZ2_bzDecompressEnd(&bstrm); diff --git a/package/unzip/0026-cve-2019-13232-fix-bug-in-uzinflate.patch b/package/unzip/0026-cve-2019-13232-fix-bug-in-uzinflate.patch new file mode 100644 index 0000000000..822e800a6e --- /dev/null +++ b/package/unzip/0026-cve-2019-13232-fix-bug-in-uzinflate.patch @@ -0,0 +1,26 @@ +From: Mark Adler +Subject: Fix bug in UZinflate() that incorrectly updated G.incnt. +Origin: https://github.com/madler/unzip/commit/5c572555cf5d80309a07c30cf7a54b2501493720 +X-Debian-version: 6.0-26 + + Fix bug in UZinflate() that incorrectly updated G.incnt. + + The update assumed a full buffer, which is not always full. This + could result in a false overlapped element detection when a small + deflate-compressed file was unzipped using an old zlib. This + commit remedies that. + +CVE: CVE-2019-13232 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch +Signed-off-by: Thomas Perale +--- a/inflate.c ++++ b/inflate.c +@@ -700,7 +700,7 @@ + G.dstrm.total_out)); + + G.inptr = (uch *)G.dstrm.next_in; +- G.incnt = (G.inbuf + INBUFSIZ) - G.inptr; /* reset for other routines */ ++ G.incnt -= G.inptr - G.inbuf; /* reset for other routines */ + + uzinflate_cleanup_exit: + err = inflateReset(&G.dstrm); diff --git a/package/unzip/0027-zipgrep-avoid-test-errors.patch b/package/unzip/0027-zipgrep-avoid-test-errors.patch new file mode 100644 index 0000000000..ac53dcd016 --- /dev/null +++ b/package/unzip/0027-zipgrep-avoid-test-errors.patch @@ -0,0 +1,17 @@ +From: Kevin Locke +Subject: zipgrep: Avoid test errors when no members present +Bug-Debian: https://bugs.debian.org/972233 +X-Debian-version: 6.0-26 + +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/27-zipgrep-avoid-test-errors.patch +Signed-off-by: Thomas Perale +--- a/unix/zipgrep ++++ b/unix/zipgrep +@@ -44,6 +44,7 @@ + opt="-$opt" + fi + ++sts=0 + status_grep_global=1 + IFS=' + ' diff --git a/package/unzip/0028-cve-2022-0529-and-cve-2022-0530.patch b/package/unzip/0028-cve-2022-0529-and-cve-2022-0530.patch new file mode 100644 index 0000000000..2a36b65b3c --- /dev/null +++ b/package/unzip/0028-cve-2022-0529-and-cve-2022-0530.patch @@ -0,0 +1,177 @@ +From: Steven M. Schweda +Subject: Fix for CVE-2022-0529 and CVE-2022-0530 +Bug-Debian: https://bugs.debian.org/1010355 +X-Debian-version: 6.0-27 + +CVE: CVE-2022-0529 +CVE: CVE-2022-0530 +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch +Signed-off-by: Thomas Perale +--- a/fileio.c ++++ b/fileio.c +@@ -171,8 +171,10 @@ + static ZCONST char Far FilenameTooLongTrunc[] = + "warning: filename too long--truncating.\n"; + #ifdef UNICODE_SUPPORT ++ static ZCONST char Far UFilenameCorrupt[] = ++ "error: Unicode filename corrupt.\n"; + static ZCONST char Far UFilenameTooLongTrunc[] = +- "warning: Converted unicode filename too long--truncating.\n"; ++ "warning: Converted Unicode filename too long--truncating.\n"; + #endif + static ZCONST char Far ExtraFieldTooLong[] = + "warning: extra field too long (%d). Ignoring...\n"; +@@ -2361,16 +2363,30 @@ + /* convert UTF-8 to local character set */ + fn = utf8_to_local_string(G.unipath_filename, + G.unicode_escape_all); +- /* make sure filename is short enough */ +- if (strlen(fn) >= FILNAMSIZ) { +- fn[FILNAMSIZ - 1] = '\0'; ++ ++ /* 2022-07-22 SMS, et al. CVE-2022-0530 ++ * Detect conversion failure, emit message. ++ * Continue with unconverted name. ++ */ ++ if (fn == NULL) ++ { + Info(slide, 0x401, ((char *)slide, +- LoadFarString(UFilenameTooLongTrunc))); +- error = PK_WARN; ++ LoadFarString(UFilenameCorrupt))); ++ error = PK_ERR; ++ } ++ else ++ { ++ /* make sure filename is short enough */ ++ if (strlen(fn) >= FILNAMSIZ) { ++ fn[FILNAMSIZ - 1] = '\0'; ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString(UFilenameTooLongTrunc))); ++ error = PK_WARN; ++ } ++ /* replace filename with converted UTF-8 */ ++ strcpy(G.filename, fn); ++ free(fn); + } +- /* replace filename with converted UTF-8 */ +- strcpy(G.filename, fn); +- free(fn); + } + # endif /* UNICODE_WCHAR */ + if (G.unipath_filename != G.filename_full) +--- a/process.c ++++ b/process.c +@@ -222,6 +222,8 @@ + "\nwarning: Unicode Path version > 1\n"; + static ZCONST char Far UnicodeMismatchError[] = + "\nwarning: Unicode Path checksum invalid\n"; ++ static ZCONST char Far UFilenameTooLongTrunc[] = ++ "warning: filename too long (P1) -- truncating.\n"; + #endif + + +@@ -1915,7 +1917,7 @@ + Sets both local header and central header fields. Not terribly clever, + but it means that this procedure is only called in one place. + +- 2014-12-05 SMS. ++ 2014-12-05 SMS. (oCERT.org report.) CVE-2014-8141. + Added checks to ensure that enough data are available before calling + makeint64() or makelong(). Replaced various sizeof() values with + simple ("4" or "8") constants. (The Zip64 structures do not depend +@@ -1947,9 +1949,10 @@ + ef_len - EB_HEADSIZE)); + break; + } ++ + if (eb_id == EF_PKSZ64) + { +- int offset = EB_HEADSIZE; ++ unsigned offset = EB_HEADSIZE; + + if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL)) + { +@@ -2046,7 +2049,7 @@ + } + if (eb_id == EF_UNIPATH) { + +- int offset = EB_HEADSIZE; ++ unsigned offset = EB_HEADSIZE; + ush ULen = eb_len - 5; + ulg chksum = CRCVAL_INITIAL; + +@@ -2504,16 +2507,17 @@ + int state_dependent; + int wsize = 0; + int max_bytes = MB_CUR_MAX; +- char buf[9]; ++ char buf[ MB_CUR_MAX+ 1]; /* ("+1" not really needed?) */ + char *buffer = NULL; + char *local_string = NULL; ++ size_t buffer_size; /* CVE-2022-0529 */ + + for (wsize = 0; wide_string[wsize]; wsize++) ; + + if (max_bytes < MAX_ESCAPE_BYTES) + max_bytes = MAX_ESCAPE_BYTES; +- +- if ((buffer = (char *)malloc(wsize * max_bytes + 1)) == NULL) { ++ buffer_size = wsize * max_bytes + 1; /* Reused below. */ ++ if ((buffer = (char *)malloc( buffer_size)) == NULL) { + return NULL; + } + +@@ -2551,8 +2555,28 @@ + } else { + /* no MB for this wide */ + /* use escape for wide character */ +- char *escape_string = wide_to_escape_string(wide_string[i]); +- strcat(buffer, escape_string); ++ size_t buffer_len; ++ size_t escape_string_len; ++ char *escape_string; ++ int err_msg = 0; ++ ++ escape_string = wide_to_escape_string(wide_string[i]); ++ buffer_len = strlen( buffer); ++ escape_string_len = strlen( escape_string); ++ ++ /* Append escape string, as space allows. */ ++ /* 2022-07-18 SMS, et al. CVE-2022-0529 */ ++ if (escape_string_len > buffer_size- buffer_len- 1) ++ { ++ escape_string_len = buffer_size- buffer_len- 1; ++ if (err_msg == 0) ++ { ++ err_msg = 1; ++ Info(slide, 0x401, ((char *)slide, ++ LoadFarString( UFilenameTooLongTrunc))); ++ } ++ } ++ strncat( buffer, escape_string, escape_string_len); + free(escape_string); + } + } +@@ -2604,9 +2628,18 @@ + ZCONST char *utf8_string; + int escape_all; + { +- zwchar *wide = utf8_to_wide_string(utf8_string); +- char *loc = wide_to_local_string(wide, escape_all); +- free(wide); ++ zwchar *wide; ++ char *loc = NULL; ++ ++ wide = utf8_to_wide_string( utf8_string); ++ ++ /* 2022-07-25 SMS, et al. CVE-2022-0530 */ ++ if (wide != NULL) ++ { ++ loc = wide_to_local_string( wide, escape_all); ++ free( wide); ++ } ++ + return loc; + } + diff --git a/package/unzip/0029-handle-windows-zip64-files.patch b/package/unzip/0029-handle-windows-zip64-files.patch new file mode 100644 index 0000000000..c4cd35fd0c --- /dev/null +++ b/package/unzip/0029-handle-windows-zip64-files.patch @@ -0,0 +1,21 @@ +From: Roy Tam +Subject: Handle Microsoft ZIP64 files by ignoring invalid "Total number of disks" field +Origin: https://sourceforge.net/p/infozip/bugs/42/ +Bug: https://sourceforge.net/p/infozip/bugs/42/ +Bug-Debian: https://bugs.debian.org/1064000 +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/2051952 +X-Debian-version: 6.0-29 + +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/29-handle-windows-zip64-files.patch +Signed-off-by: Thomas Perale +--- a/process.c ++++ b/process.c +@@ -1281,7 +1281,7 @@ + fprintf(stdout,"\nnumber of disks (ECR) %u, (ECLOC64) %lu\n", + G.ecrec.number_this_disk, ecloc64_total_disks); fflush(stdout); + #endif +- if ((G.ecrec.number_this_disk != 0xFFFF) && ++ if ((G.ecrec.number_this_disk != 0xFFFF) && ecloc64_total_disks && + (G.ecrec.number_this_disk != ecloc64_total_disks - 1)) { + /* Note: For some unknown reason, the developers at PKWARE decided to + store the "zip64 total disks" value as a counter starting from 1, diff --git a/package/unzip/0030-drop-conflicting-declarations.patch b/package/unzip/0030-drop-conflicting-declarations.patch new file mode 100644 index 0000000000..ff32e04d2d --- /dev/null +++ b/package/unzip/0030-drop-conflicting-declarations.patch @@ -0,0 +1,18 @@ +From: Santiago Vila +Subject: Drop conflicting declarations of gmtime() and localtime() +Bug-Debian: https://bugs.debian.org/1098043 +X-Debian-version: 6.0-29 + +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/30-drop-conflicting-declarations.patch +Signed-off-by: Thomas Perale +--- a/unix/unxcfg.h ++++ b/unix/unxcfg.h +@@ -118,7 +118,7 @@ + # endif + #else + # include +- struct tm *gmtime(), *localtime(); ++/* struct tm *gmtime(), *localtime(); */ + #endif + + #if (defined(BSD4_4) || (defined(SYSV) && defined(MODERN))) diff --git a/package/unzip/0031-fix-zipgrep.patch b/package/unzip/0031-fix-zipgrep.patch new file mode 100644 index 0000000000..374ca06f12 --- /dev/null +++ b/package/unzip/0031-fix-zipgrep.patch @@ -0,0 +1,20 @@ +From: Vincent Lefevre +Subject: Do not escape shell-special characters in "pat" +Bug-Debian: https://bugs.debian.org/1054628 +X-Debian-version: 6.0-29 + +Upstream: https://sources.debian.org/src/unzip/6.0-29/debian/patches/31-fix-zipgrep.patch +Signed-off-by: Thomas Perale +--- a/unix/zipgrep ++++ b/unix/zipgrep +@@ -49,10 +49,6 @@ + IFS=' + ' + +-# Escape shell-special characters in "pat". +-pat=` echo "$pat" | \ +- sed -e 's/\\\\/\\\\\\\\/g' -e 's/|/\\\|/g' -e 's/&/\\\&/g' ` +- + # Use "unzip -Z1" to get a listing of the specified members from the + # specified archive. Escape any backslashes in a file name. + for i in `unzip -Z1 "$zipfile" ${1+"$@"} | sed -e 's/\\\\/\\\\\\\\/g' `; do diff --git a/package/unzip/0001-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch b/package/unzip/0101-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch similarity index 99% rename from package/unzip/0001-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch rename to package/unzip/0101-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch index cbc58e484b..3ac6f85b40 100644 --- a/package/unzip/0001-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch +++ b/package/unzip/0101-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch @@ -19,6 +19,7 @@ build options and flags as the original Makefile does. [0] http://git.buildroot.net/buildroot/tree/package/infozip?id=2015.11-rc3 +Upstream: N/A Signed-off-by: Luca Ceresoli --- CMakeLists.txt | 17 +++++++++++++++++ diff --git a/package/unzip/unzip.mk b/package/unzip/unzip.mk index 5effebee4a..e83e9206b4 100644 --- a/package/unzip/unzip.mk +++ b/package/unzip/unzip.mk @@ -6,27 +6,50 @@ UNZIP_VERSION = 6.0 UNZIP_SOURCE = unzip_$(UNZIP_VERSION).orig.tar.gz -UNZIP_PATCH = unzip_$(UNZIP_VERSION)-27.debian.tar.xz UNZIP_SITE = https://snapshot.debian.org/archive/debian/20220916T090657Z/pool/main/u/unzip UNZIP_LICENSE = Info-ZIP UNZIP_LICENSE_FILES = LICENSE UNZIP_CPE_ID_VALID = YES -# unzip_$(UNZIP_VERSION)-27.debian.tar.xz has patches to fix: -UNZIP_IGNORE_CVES = \ - CVE-2014-8139 \ - CVE-2014-8140 \ - CVE-2014-8141 \ - CVE-2014-9636 \ - CVE-2014-9913 \ - CVE-2015-7696 \ - CVE-2015-7697 \ - CVE-2016-9844 \ - CVE-2018-18384 \ - CVE-2018-1000035 \ - CVE-2019-13232 \ - CVE-2022-0529 \ - CVE-2022-0530 +# 0009-cve-2014-8139-crc-overflow.patch +UNZIP_IGNORE_CVES += CVE-2014-8139 + +# 0010-cve-2014-8140-test-compr-eb.patch +UNZIP_IGNORE_CVES += CVE-2014-8140 + +# 0011-cve-2014-8141-getzip64data.patch +UNZIP_IGNORE_CVES += CVE-2014-8141 + +# 0012-cve-2014-9636-test-compr-eb.patch +UNZIP_IGNORE_CVES += CVE-2014-9636 + +# 0018-cve-2014-9913-unzip-buffer-overflow.patch +UNZIP_IGNORE_CVES += CVE-2014-9913 + +# 0014-cve-2015-7696.patch +UNZIP_IGNORE_CVES += CVE-2015-7696 + +# 0015-cve-2015-7697.patch +UNZIP_IGNORE_CVES += CVE-2015-7697 + +# 0019-cve-2016-9844-zipinfo-buffer-overflow.patch +UNZIP_IGNORE_CVES += CVE-2016-9844 + +# 0007-increase-size-of-cfactorstr.patch +UNZIP_IGNORE_CVES += CVE-2018-18384 + +# 0020-cve-2018-1000035-unzip-buffer-overflow.patch +UNZIP_IGNORE_CVES += CVE-2018-1000035 + +# 0022-cve-2019-13232-fix-bug-in-undefer-input.patch +# 0023-cve-2019-13232-zip-bomb-with-overlapped-entries.patch +# 0024-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch +# 0025-cve-2019-13232-fix-bug-in-uzbunzip2.patch +# 0026-cve-2019-13232-fix-bug-in-uzinflate.patch +UNZIP_IGNORE_CVES += CVE-2019-13232 + +# 0028-cve-2022-0529-and-cve-2022-0530.patch +UNZIP_IGNORE_CVES += CVE-2022-0529 CVE-2022-0530 # unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when # necessary, redefining it on the command line causes some warnings.