From 875b7a90e70a3c2210ff7f4f2ae202ac008d40ba Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Thu, 9 Oct 2025 22:14:29 +0200 Subject: [PATCH] package/zip: add patch for CVE-2018-13410 Fixes the following vulnerability: - CVE-2018-13410 Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands For more information, see: - https://nvd.nist.gov//vuln/detail/CVE-2018-13410 This patch also includes the patch 0009 which address a buffer overflow when passing unicode characters that doesn't have a CVE assigned. Tested with `./support/testing/run-tests -d dl -o output_folder -k tests.package.test_zip` Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit 7cb0419b92f5f35ca830e8c60d8080dd17f1dfb5) Signed-off-by: Thomas Perale --- ...009-buffer-overflow-unicode-filename.patch | 23 +++++++++++++++++ .../0010-buffer-overflow-cve-2018-13410.patch | 25 +++++++++++++++++++ package/zip/zip.mk | 3 +++ 3 files changed, 51 insertions(+) create mode 100644 package/zip/0009-buffer-overflow-unicode-filename.patch create mode 100644 package/zip/0010-buffer-overflow-cve-2018-13410.patch diff --git a/package/zip/0009-buffer-overflow-unicode-filename.patch b/package/zip/0009-buffer-overflow-unicode-filename.patch new file mode 100644 index 0000000000..860b453735 --- /dev/null +++ b/package/zip/0009-buffer-overflow-unicode-filename.patch @@ -0,0 +1,23 @@ +From: Shengjing Zhu +Subject: Fix buffer overflow when filename contains unicode characters +Bug-Debian: https://bugs.debian.org/1077054 +Bug-Debian: https://bugs.debian.org/1093629 +Bug-Ubuntu: https://launchpad.net/bugs/2062535 +Forwarded: https://sourceforge.net/p/infozip/bugs/81/ +Origin: https://src.fedoraproject.org/rpms/zip/raw/f41/f/buffer_overflow.patch + +Upstream: https://sources.debian.org/src/zip/3.0-15/debian/patches/14-buffer-overflow-unicode-filename.patch +Signed-off-by: Thomas Perale +--- +diff -Nura a/fileio.c b/fileio.c +--- a/fileio.c ++++ b/fileio.c +@@ -3502,7 +3502,7 @@ + if ((wc_string = (wchar_t *)malloc((wsize + 1) * sizeof(wchar_t))) == NULL) { + ZIPERR(ZE_MEM, "local_to_wide_string"); + } +- wsize = mbstowcs(wc_string, local_string, strlen(local_string) + 1); ++ wsize = mbstowcs(wc_string, local_string, wsize + 1); + wc_string[wsize] = (wchar_t) 0; + + /* in case wchar_t is not zwchar */ diff --git a/package/zip/0010-buffer-overflow-cve-2018-13410.patch b/package/zip/0010-buffer-overflow-cve-2018-13410.patch new file mode 100644 index 0000000000..399ab37bc5 --- /dev/null +++ b/package/zip/0010-buffer-overflow-cve-2018-13410.patch @@ -0,0 +1,25 @@ +From: Florent 'Skia' Jacquet +Subject: Fix buffer overflow when using '-T -TT' +Bug-Debian: https://bugs.debian.org/1093629 +Bug-Ubuntu: https://launchpad.net/bugs/2093024 +Forwarded: https://sourceforge.net/p/infozip/bugs/81/ + +strlen(unzip_path) + strlen(zipname) + " " + "'" + "'" + '\0' +The additional space required in the `cmd` buffer is 4, not 3. + +CVE: CVE-2018-13410 +Upstream: https://sources.debian.org/src/zip/3.0-15/debian/patches/15-buffer-overflow-cve-2018-13410.patch +Signed-off-by: Thomas Perale +--- +diff -Nura a/zip.c b/zip.c +--- a/zip.c ++++ b/zip.c +@@ -1437,7 +1437,7 @@ + /* Replace first {} with archive name. If no {} append name to string. */ + here = strstr(unzip_path, "{}"); + +- if ((cmd = malloc(strlen(unzip_path) + strlen(zipname) + 3)) == NULL) { ++ if ((cmd = malloc(strlen(unzip_path) + strlen(zipname) + 4)) == NULL) { + ziperr(ZE_MEM, "building command string for testing archive"); + } + diff --git a/package/zip/zip.mk b/package/zip/zip.mk index 0457ba9414..0a66c146bf 100644 --- a/package/zip/zip.mk +++ b/package/zip/zip.mk @@ -12,6 +12,9 @@ ZIP_LICENSE = Info-ZIP ZIP_LICENSE_FILES = LICENSE ZIP_CPE_ID_VENDOR = info-zip_project +# 0010-buffer-overflow-cve-2018-13410.patch +ZIP_IGNORE_CVES += CVE-2018-13410 + ifeq ($(BR2_PACKAGE_BZIP2),y) ZIP_DEPENDENCIES += bzip2 endif