amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: unzip: Reorganize security fixes for improved clarity.

Browse source 
* gnu/packages/patches/unzip-fix-overflows-and-infloop.patch: Delete
  file.  Its contents are now split into the following new files:
* gnu/packages/patches/unzip-CVE-2015-7696.patch,
  gnu/packages/patches/unzip-CVE-2015-7697.patch,
  gnu/packages/patches/unzip-overflow-on-invalid-input.patch: New files.
* gnu-system.am (dist_patch_DATA): Adjust accordingly.
* gnu/packages/zip.scm (unzip)[source]: Adjust patches accordingly.
This commit is contained in:
Mark H Weaver 2015-10-22 14:54:43 -04:00
parent d3365d4866
commit 51de92a08e
6 changed files with 109 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

28
gnu/packages/patches/unzip-CVE-2015-7697.patch Normal file
View file

@ -0,0 +1,28 @@
Copied from Debian.
From: Kamil Dudka <kdudka@redhat.com>
Date: Mon, 14 Sep 2015 18:24:56 +0200
Subject: fix infinite loop when extracting empty bzip2 data
Bug-Debian: https://bugs.debian.org/802160
Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1260944
Origin: other, https://bugzilla.redhat.com/attachment.cgi?id=1073339
---
extract.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/extract.c
+++ b/extract.c
@@ -2728,6 +2728,12 @@
int repeated_buf_err;
bz_stream bstrm;
+ if (G.incnt <= 0 && G.csize <= 0L) {
+ /* avoid an infinite loop */
+ Trace((stderr, "UZbunzip2() got empty input\n"));
+ return 2;
+ }
+
#if (defined(DLL) && !defined(NO_SLIDE_REDIR))
if (G.redirect_slide)
wsize = G.redirect_size, redirSlide = G.redirect_buffer;