1From: sms 2Subject: Fix CVE-2014-8141: out-of-bounds read issues in getZip64Data() 3Bug-Debian: http://bugs.debian.org/773722 4 5The patch comes from unzip_6.0-8+deb7u2.debian.tar.gz 6 7Upstream-Status: Backport 8CVE: CVE-2014-8141 9 10Signed-off-by: Roy Li <rongqing.li@windriver.com> 11 12 13--- a/fileio.c 14+++ b/fileio.c 15@@ -176,6 +176,8 @@ 16 #endif 17 static ZCONST char Far ExtraFieldTooLong[] = 18 "warning: extra field too long (%d). Ignoring...\n"; 19+static ZCONST char Far ExtraFieldCorrupt[] = 20+ "warning: extra field (type: 0x%04x) corrupt. Continuing...\n"; 21 22 #ifdef WINDLL 23 static ZCONST char Far DiskFullQuery[] = 24@@ -2295,7 +2297,12 @@ 25 if (readbuf(__G__ (char *)G.extra_field, length) == 0) 26 return PK_EOF; 27 /* Looks like here is where extra fields are read */ 28- getZip64Data(__G__ G.extra_field, length); 29+ if (getZip64Data(__G__ G.extra_field, length) != PK_COOL) 30+ { 31+ Info(slide, 0x401, ((char *)slide, 32+ LoadFarString( ExtraFieldCorrupt), EF_PKSZ64)); 33+ error = PK_WARN; 34+ } 35 #ifdef UNICODE_SUPPORT 36 G.unipath_filename = NULL; 37 if (G.UzO.U_flag < 2) { 38--- a/process.c 39+++ b/process.c 40@@ -1,5 +1,5 @@ 41 /* 42- Copyright (c) 1990-2009 Info-ZIP. All rights reserved. 43+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved. 44 45 See the accompanying file LICENSE, version 2009-Jan-02 or later 46 (the contents of which are also included in unzip.h) for terms of use. 47@@ -1901,48 +1901,82 @@ 48 and a 4-byte version of disk start number. 49 Sets both local header and central header fields. Not terribly clever, 50 but it means that this procedure is only called in one place. 51+ 52+ 2014-12-05 SMS. 53+ Added checks to ensure that enough data are available before calling 54+ makeint64() or makelong(). Replaced various sizeof() values with 55+ simple ("4" or "8") constants. (The Zip64 structures do not depend 56+ on our variable sizes.) Error handling is crude, but we should now 57+ stay within the buffer. 58 ---------------------------------------------------------------------------*/ 59 60+#define Z64FLGS 0xffff 61+#define Z64FLGL 0xffffffff 62+ 63 if (ef_len == 0 || ef_buf == NULL) 64 return PK_COOL; 65 66 Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n", 67 ef_len)); 68 69- while (ef_len >= EB_HEADSIZE) { 70+ while (ef_len >= EB_HEADSIZE) 71+ { 72 eb_id = makeword(EB_ID + ef_buf); 73 eb_len = makeword(EB_LEN + ef_buf); 74 75- if (eb_len > (ef_len - EB_HEADSIZE)) { 76- /* discovered some extra field inconsistency! */ 77+ if (eb_len > (ef_len - EB_HEADSIZE)) 78+ { 79+ /* Extra block length exceeds remaining extra field length. */ 80 Trace((stderr, 81 "getZip64Data: block length %u > rest ef_size %u\n", eb_len, 82 ef_len - EB_HEADSIZE)); 83 break; 84 } 85- if (eb_id == EF_PKSZ64) { 86- 87+ if (eb_id == EF_PKSZ64) 88+ { 89 int offset = EB_HEADSIZE; 90 91- if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){ 92- G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf); 93- offset += sizeof(G.crec.ucsize); 94+ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL)) 95+ { 96+ if (offset+ 8 > ef_len) 97+ return PK_ERR; 98+ 99+ G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf); 100+ offset += 8; 101 } 102- if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){ 103- G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf); 104- offset += sizeof(G.crec.csize); 105+ 106+ if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL)) 107+ { 108+ if (offset+ 8 > ef_len) 109+ return PK_ERR; 110+ 111+ G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf); 112+ offset += 8; 113 } 114- if (G.crec.relative_offset_local_header == 0xffffffff){ 115+ 116+ if (G.crec.relative_offset_local_header == Z64FLGL) 117+ { 118+ if (offset+ 8 > ef_len) 119+ return PK_ERR; 120+ 121 G.crec.relative_offset_local_header = makeint64(offset + ef_buf); 122- offset += sizeof(G.crec.relative_offset_local_header); 123+ offset += 8; 124 } 125- if (G.crec.disk_number_start == 0xffff){ 126+ 127+ if (G.crec.disk_number_start == Z64FLGS) 128+ { 129+ if (offset+ 4 > ef_len) 130+ return PK_ERR; 131+ 132 G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf); 133- offset += sizeof(G.crec.disk_number_start); 134+ offset += 4; 135 } 136+#if 0 137+ break; /* Expect only one EF_PKSZ64 block. */ 138+#endif /* 0 */ 139 } 140 141- /* Skip this extra field block */ 142+ /* Skip this extra field block. */ 143 ef_buf += (eb_len + EB_HEADSIZE); 144 ef_len -= (eb_len + EB_HEADSIZE); 145 } 146