mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 08:14:09 -09:00
7cb0419b92
Fixes the following vulnerability:
- CVE-2018-13410
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used,
allows attackers to cause a denial of service (invalid free and
application crash) or possibly have unspecified other impact because
of an off-by-one error. NOTE: it is unclear whether there are
realistic scenarios in which an untrusted party controls the -TT
value, given that the entire purpose of -TT is execution of
arbitrary commands
For more information, see:
- https://nvd.nist.gov//vuln/detail/CVE-2018-13410
This patch also includes the patch 0009 which address a buffer overflow
when passing unicode characters that doesn't have a CVE assigned.
Tested with `./support/testing/run-tests -d dl -o output_folder -k tests.package.test_zip`
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
26 lines
992 B
Diff
26 lines
992 B
Diff
From: Florent 'Skia' Jacquet <florent.jacquet@canonical.com>
|
|
Subject: Fix buffer overflow when using '-T -TT'
|
|
Bug-Debian: https://bugs.debian.org/1093629
|
|
Bug-Ubuntu: https://launchpad.net/bugs/2093024
|
|
Forwarded: https://sourceforge.net/p/infozip/bugs/81/
|
|
|
|
strlen(unzip_path) + strlen(zipname) + " " + "'" + "'" + '\0'
|
|
The additional space required in the `cmd` buffer is 4, not 3.
|
|
|
|
CVE: CVE-2018-13410
|
|
Upstream: https://sources.debian.org/src/zip/3.0-15/debian/patches/15-buffer-overflow-cve-2018-13410.patch
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
diff -Nura a/zip.c b/zip.c
|
|
--- a/zip.c
|
|
+++ b/zip.c
|
|
@@ -1437,7 +1437,7 @@
|
|
/* Replace first {} with archive name. If no {} append name to string. */
|
|
here = strstr(unzip_path, "{}");
|
|
|
|
- if ((cmd = malloc(strlen(unzip_path) + strlen(zipname) + 3)) == NULL) {
|
|
+ if ((cmd = malloc(strlen(unzip_path) + strlen(zipname) + 4)) == NULL) {
|
|
ziperr(ZE_MEM, "building command string for testing archive");
|
|
}
|
|
|