Hello community,
here is the log from the commit of package unzip for openSUSE:Factory checked
in at 2018-07-04 23:52:05
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/unzip (Old)
and /work/SRC/openSUSE:Factory/.unzip.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "unzip"
Wed Jul 4 23:52:05 2018 rev:43 rq:619412 version:6.00
Changes:
--------
--- /work/SRC/openSUSE:Factory/unzip/unzip-rcc.changes 2018-05-23
16:06:28.499754826 +0200
+++ /work/SRC/openSUSE:Factory/.unzip.new/unzip-rcc.changes 2018-07-04
23:53:27.980002354 +0200
@@ -1,0 +2,10 @@
+Wed Jun 27 11:39:10 UTC 2018 - kstreit...@suse.com
+
+- Add unzip60-total_disks_zero.patch that fixes a bug when unzip is
+ unable to process Windows zip64 archives because Windows
+ archivers set total_disks field to 0 but per standard, valid
+ values are 1 and higher [bnc#910683]
+- Add Fix-CVE-2014-9636-unzip-buffer-overflow.patch to fix heap
+ overflow for STORED field data [bnc#914442] [CVE-2014-9636]
+
+-------------------------------------------------------------------
unzip.changes: same change
New:
----
Fix-CVE-2014-9636-unzip-buffer-overflow.patch
unzip60-total_disks_zero.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ unzip-rcc.spec ++++++
--- /var/tmp/diff_new_pack.m9DXmS/_old 2018-07-04 23:53:28.664001599 +0200
+++ /var/tmp/diff_new_pack.m9DXmS/_new 2018-07-04 23:53:28.668001595 +0200
@@ -57,6 +57,8 @@
Patch17: CVE-2016-9844.patch
Patch18: CVE-2014-9913.patch
Patch19: CVE-2018-1000035.patch
+Patch20: Fix-CVE-2014-9636-unzip-buffer-overflow.patch
+Patch21: unzip60-total_disks_zero.patch
Requires(post): update-alternatives
Requires(postun): update-alternatives
Recommends: %{_name}-doc
@@ -100,6 +102,8 @@
%patch17 -p1
%patch18 -p1
%patch19 -p0
+%patch20 -p1
+%patch21 -p1
%build
export RPM_OPT_FLAGS="%{optflags} \
++++++ unzip.spec ++++++
--- /var/tmp/diff_new_pack.m9DXmS/_old 2018-07-04 23:53:28.680001581 +0200
+++ /var/tmp/diff_new_pack.m9DXmS/_new 2018-07-04 23:53:28.684001577 +0200
@@ -57,6 +57,8 @@
Patch17: CVE-2016-9844.patch
Patch18: CVE-2014-9913.patch
Patch19: CVE-2018-1000035.patch
+Patch20: Fix-CVE-2014-9636-unzip-buffer-overflow.patch
+Patch21: unzip60-total_disks_zero.patch
Requires(post): update-alternatives
Requires(postun): update-alternatives
Recommends: %{_name}-doc
@@ -100,6 +102,8 @@
%patch17 -p1
%patch18 -p1
%patch19 -p0
+%patch20 -p1
+%patch21 -p1
%build
export RPM_OPT_FLAGS="%{optflags} \
++++++ Fix-CVE-2014-9636-unzip-buffer-overflow.patch ++++++
>From 190040ebfcf5395a6ccedede2cc9343d34f0a108 Mon Sep 17 00:00:00 2001
From: mancha <mancha1 AT zoho DOT com>
Date: Wed, 11 Feb 2015
Subject: Info-ZIP UnZip buffer overflow
By carefully crafting a corrupt ZIP archive with "extra fields" that
purport to have compressed blocks larger than the corresponding
uncompressed blocks in STORED no-compression mode, an attacker can
trigger a heap overflow that can result in application crash or
possibly have other unspecified impact.
This patch ensures that when extra fields use STORED mode, the
"compressed" and uncompressed block sizes match.
---
extract.c | 7 +++++++
1 file changed, 7 insertions(+)
--- unzip60/extract.c
+++ unzip60/extract.c
@@ -2230,6 +2230,7 @@ static int test_compr_eb(__G__ eb, eb_si
ulg eb_ucsize;
uch *eb_ucptr;
int r;
+ ush method;
if (compr_offset < 4) /* field is not compressed: */
return PK_OK; /* do nothing and signal OK */
@@ -2246,6 +2247,13 @@ static int test_compr_eb(__G__ eb, eb_si
((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
return IZ_EF_TRUNC; /* no/bad compressed data! */
+ method = makeword(eb + (EB_HEADSIZE + compr_offset));
+ if ((method == STORED) &&
+ (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
+ return PK_ERR; /* compressed & uncompressed
+ * should match in STORED
+ * method */
+
if (
#ifdef INT_16BIT
(((ulg)(extent)eb_ucsize) != eb_ucsize) ||
++++++ unzip60-total_disks_zero.patch ++++++
Index: unzip60/process.c
===================================================================
--- unzip60.orig/process.c
+++ unzip60/process.c
@@ -1286,7 +1286,8 @@ static int find_ecrec64(__G__ searchlen)
G.ecrec.number_this_disk, ecloc64_total_disks); fflush(stdout);
#endif
if ((G.ecrec.number_this_disk != 0xFFFF) &&
- (G.ecrec.number_this_disk != ecloc64_total_disks - 1)) {
+ (G.ecrec.number_this_disk != ecloc64_total_disks - 1) &&
+ (ecloc64_total_disks != 0)) {
/* Note: For some unknown reason, the developers at PKWARE decided to
store the "zip64 total disks" value as a counter starting from 1,
whereas all other "split/span volume" related fields use 0-based
@@ -1296,6 +1297,9 @@ static int find_ecrec64(__G__ searchlen)
When this is not the case, the found ecrec64 locator cannot be valid.
-> This is not a Zip64 archive.
*/
+ /* There are archive creators that put 0 in total disks when it should
+ be 1. We should handle this. This is done by the added check above.
+ */
Trace((stderr,
"\ninvalid ECLOC64, differing disk# (ECR %u, ECL64 %lu)\n",
G.ecrec.number_this_disk, ecloc64_total_disks - 1));
