commit 47f3afd
hovercats
·
2024-04-30 01:11:16 +0000 UTC
parent ac43795
repo/unzip: drop, in favor of the one from oasis
32 files changed,
+0,
-1951
+0,
-31
1@@ -1,31 +0,0 @@
2-#!/bin/sh -e
3-
4-for p in *.patch; do
5- patch -p1 < "$p"
6-done
7-
8-export DESTDIR="$1"
9-export LDFLAGS="$LDFLAGS -static"
10-export CFLAGS="$CFLAGS \
11- -D_FILE_OFFSET_BITS=64 \
12- -DWILD_STOP_AT_DIR \
13- -DLARGE_FILE_SUPPORT \
14- -DUNICODE_SUPPORT \
15- -DUNICODE_WCHAR \
16- -DUTF8_MAYBE_NATIVE \
17- -DNO_LCHMOD \
18- -LDDATE_FORMAT=DF_YMD \
19- -DNATIVE"
20-
21-make \
22- LF2="$LDFLAGS" CF="$CFLAGS $CPPFLAGS -I." \
23- prefix="$1/usr" \
24- -f unix/Makefile unzips
25-
26-make \
27- prefix="$1/usr" \
28- MANDIR="$1/usr/share/man/man1" \
29- -f unix/Makefile install
30-
31-# Compress manpages
32-find "$1/usr/share/man" -type f -exec gzip -n -9 {} +
+0,
-29
1@@ -1,29 +0,0 @@
2-5969810311361d686f6408091d60d0a36bf29f1abfae05831be9c42e69aaf67f6f
3-14a524e4b8fa0576c4d4a46a1b39cb9d783154e631270095497c6eddfd42e74e89
4-f9d787008b7fefce52dc2b2d1ab306d11ffb10ad948125f2d3e4854ed443f92151
5-0a109f191c29e67e85d9dd00d3d68e1cae3bd24db5cd2ecf8758ab977bf9aa61a8
6-cae7141a54c8ce8a6080385391bda61e9352b1ed060e19b4a1107322491ed5ce48
7-3ba49afc6bc0e2856c2fb542372fc9d01d73c6ebf90b42bce8c195dce4f6ea60bb
8-a86fc891e61383eb2d3bfeb6f745a8898fe6bde7988065a6341aca451d5c56c332
9-a0ae032ad29c4a55b08a1d70251483b1bf26744777251295d571bdd3f9aed752f2
10-496299e7e55a8ee8ddfaaf060880c4edf55cde980a781eefbc064527e9499464e2
11-dd7b45cc908ba296607be0f25d3c9858a78bdc76c1aa03bfd8faba64eb99f946e0
12-deb35954bd14c41feca4630675b218d2760c0a72c2a583ad34de46f9b6fdb439f9
13-40e23490d4012a3d60faf51f61d5aace88555c3e4b88859b918ed2822bf727392d
14-2bac1b5b7039eaf8e5bcbf2d15b4c096a70b57ee7d61e8e14d0809df0090b10dc2
15-764205d76dc3d959efe7cd221cde896383d6d88f8ac588505ec21423a49df45dcc
16-5f3ba78d33ee7012cebb7702609e6360feed808c8a1d8bf8545348c4736e6f7c97
17-80aae983bda3cd6f1aab6a1b5f0891bbac4c3310fe2628194ae12847bf0303e8d3
18-eb58b94d1cc9f93a3e24a8652e6636d2929b710e077fcb8bd548e69cf1fd37582c
19-ec11baa02294b90c915300e209ae8f8747cc0ba14c54dc543f125dfd7a73f3c430
20-9871056e67f47ce9698b5bb50e8f65cf2e750a4f6c6af53304df1f4c40ebfbc77d
21-22be381e9e86b37282920418d14265d027ea434fad79b952482d409db3eec61470
22-62eada60854366ff9db91fcf5d1450e28205faca989156adda1fe771a690821a89
23-02db5a813642fc9c0cef6621b0bc17ea7899d618d3b6ae70891bbf63a7d3ac64fe
24-1c752da7d554901b29f43aaeb427776359dc4cc4b378e454b29dee26cb64ef3154
25-92ae3240adee386963fa34241435c9955aedc3e37203752ec37cb1a5d36dd87ddf
26-6abdb144fbdaa1cf3c498c7c71ea6ca317f0326d36fb1e4c0d3096650d0d8fb783
27-0e8b5dceeab1d0e054374abaab6d63edea4dee180d9167a7333d550ed42341f97d
28-5333cf5ef9e3a8a952b9fb0861665c5ee32ced7cdfbab52f4a170c1d3702ff3bbc
29-aed0b9882b97feac1d61504ad2e49585d70bae438d9498c028498422a7217601b2
30-885605de5f2c59ad6508544cf7d9e97a369dbed6ec7a7ca387ef2837166f08ed20
1@@ -1,14 +0,0 @@
2-From: Santiago Vila <sanvila@debian.org>
3-Subject: zipinfo.c: Do not crash when hostver byte is >= 100
4-
5---- a/zipinfo.c
6-+++ b/zipinfo.c
7-@@ -2114,7 +2114,7 @@
8- else
9- attribs[9] = (xattr & UNX_ISVTX)? 'T' : '-'; /* T==undefined */
10-
11-- sprintf(&attribs[12], "%u.%u", hostver/10, hostver%10);
12-+ sprintf(&attribs[11], "%2u.%u", hostver/10, hostver%10);
13- break;
14-
15- } /* end switch (hostnum: external attributes format) */
1@@ -1,21 +0,0 @@
2-From: Steven Schweda
3-Subject: Handle the PKWare verification bit of internal attributes
4-Bug-Debian: http://bugs.debian.org/630078
5-X-Debian-version: 6.0-5
6-
7---- a/process.c
8-+++ b/process.c
9-@@ -1729,6 +1729,13 @@
10- else if (uO.L_flag > 1) /* let -LL force lower case for all names */
11- G.pInfo->lcflag = 1;
12-
13-+ /* Handle the PKWare verification bit, bit 2 (0x0004) of internal
14-+ attributes. If this is set, then a verification checksum is in the
15-+ first 3 bytes of the external attributes. In this case all we can use
16-+ for setting file attributes is the last external attributes byte. */
17-+ if (G.crec.internal_file_attributes & 0x0004)
18-+ G.crec.external_file_attributes &= (ulg)0xff;
19-+
20- /* do Amigas (AMIGA_) also have volume labels? */
21- if (IS_VOLID(G.crec.external_file_attributes) &&
22- (G.pInfo->hostnum == FS_FAT_ || G.pInfo->hostnum == FS_HPFS_ ||
1@@ -1,17 +0,0 @@
2-From: Jérémy Bobbio <lunar@debian.org>
3-Subject: Remove build date
4-Bug-Debian: https://bugs.debian.org/782851
5- In order to make unzip build reproducibly, we remove the
6- (already optional) build date from the binary.
7-
8---- a/unix/unix.c
9-+++ b/unix/unix.c
10-@@ -1705,7 +1705,7 @@
11- #endif /* Sun */
12- #endif /* SGI */
13-
14--#ifdef __DATE__
15-+#if 0
16- " on ", __DATE__
17- #else
18- "", ""
1@@ -1,29 +0,0 @@
2-From: sms
3-Subject: Restore uid and gid information when requested
4-Bug-Debian: http://bugs.debian.org/689212
5-X-Debian-version: 6.0-8
6-
7---- a/process.c
8-+++ b/process.c
9-@@ -2904,7 +2904,7 @@
10- #ifdef IZ_HAVE_UXUIDGID
11- if (eb_len >= EB_UX3_MINLEN
12- && z_uidgid != NULL
13-- && (*((EB_HEADSIZE + 0) + ef_buf) == 1)
14-+ && (*((EB_HEADSIZE + 0) + ef_buf) == 1))
15- /* only know about version 1 */
16- {
17- uch uid_size;
18-@@ -2916,10 +2916,10 @@
19- flags &= ~0x0ff; /* ignore any previous UNIX field */
20-
21- if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf,
22-- uid_size, z_uidgid[0])
23-+ uid_size, &z_uidgid[0])
24- &&
25- read_ux3_value((EB_HEADSIZE + uid_size + 3) + ef_buf,
26-- gid_size, z_uidgid[1]) )
27-+ gid_size, &z_uidgid[1]) )
28- {
29- flags |= EB_UX2_VALID; /* signal success */
30- }
1@@ -1,15 +0,0 @@
2-From: "Steven M. Schweda" <sms@antinode.info>
3-Subject: Fix lame code in fileio.c
4-Bug-Debian: https://bugs.debian.org/929502
5-X-Debian-version: 6.0-23
6-
7---- a/fileio.c
8-+++ b/fileio.c
9-@@ -2477,6 +2477,7 @@
10- */
11- return (((zusz_t)sig[7]) << 56)
12- + (((zusz_t)sig[6]) << 48)
13-+ + (((zusz_t)sig[5]) << 40)
14- + (((zusz_t)sig[4]) << 32)
15- + (zusz_t)((((ulg)sig[3]) << 24)
16- + (((ulg)sig[2]) << 16)
+0,
-75
1@@ -1,75 +0,0 @@
2---- a/extract.c
3-+++ b/extract.c
4-@@ -1,5 +1,5 @@
5- /*
6-- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
7-+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
8-
9- See the accompanying file LICENSE, version 2009-Jan-02 or later
10- (the contents of which are also included in unzip.h) for terms of use.
11-@@ -298,6 +298,8 @@
12- #ifndef SFX
13- static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
14- EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
15-+ static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \
16-+ EF block length (%u bytes) invalid (< %d)\n";
17- static ZCONST char Far InvalidComprDataEAs[] =
18- " invalid compressed data for EAs\n";
19- # if (defined(WIN32) && defined(NTSD_EAS))
20-@@ -2032,7 +2034,8 @@
21- ebID = makeword(ef);
22- ebLen = (unsigned)makeword(ef+EB_LEN);
23-
24-- if (ebLen > (ef_len - EB_HEADSIZE)) {
25-+ if (ebLen > (ef_len - EB_HEADSIZE))
26-+ {
27- /* Discovered some extra field inconsistency! */
28- if (uO.qflag)
29- Info(slide, 1, ((char *)slide, "%-22s ",
30-@@ -2167,11 +2170,29 @@
31- }
32- break;
33- case EF_PKVMS:
34-- if (makelong(ef+EB_HEADSIZE) !=
35-- crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4),
36-- (extent)(ebLen-4)))
37-- Info(slide, 1, ((char *)slide,
38-- LoadFarString(BadCRC_EAs)));
39-+ /* 2015-01-30 SMS. Added sufficient-bytes test/message
40-+ * here. (Removed defective ebLen test above.)
41-+ *
42-+ * If sufficient bytes (EB_PKVMS_MINLEN) are available,
43-+ * then compare the stored CRC value with the calculated
44-+ * CRC for the remainder of the data (and complain about
45-+ * a mismatch).
46-+ */
47-+ if (ebLen < EB_PKVMS_MINLEN)
48-+ {
49-+ /* Insufficient bytes available. */
50-+ Info( slide, 1,
51-+ ((char *)slide, LoadFarString( TooSmallEBlength),
52-+ ebLen, EB_PKVMS_MINLEN));
53-+ }
54-+ else if (makelong(ef+ EB_HEADSIZE) !=
55-+ crc32(CRCVAL_INITIAL,
56-+ (ef+ EB_HEADSIZE+ EB_PKVMS_MINLEN),
57-+ (extent)(ebLen- EB_PKVMS_MINLEN)))
58-+ {
59-+ Info(slide, 1, ((char *)slide,
60-+ LoadFarString(BadCRC_EAs)));
61-+ }
62- break;
63- case EF_PKW32:
64- case EF_PKUNIX:
65---- a/unzpriv.h
66-+++ b/unzpriv.h
67-@@ -1806,6 +1806,8 @@
68- #define EB_NTSD_VERSION 4 /* offset of NTSD version byte */
69- #define EB_NTSD_MAX_VER (0) /* maximum version # we know how to handle */
70-
71-+#define EB_PKVMS_MINLEN 4 /* minimum data length of PKVMS extra block */
72-+
73- #define EB_ASI_CRC32 0 /* offset of ASI Unix field's crc32 checksum */
74- #define EB_ASI_MODE 4 /* offset of ASI Unix permission mode field */
75-
76-
+0,
-26
1@@ -1,26 +0,0 @@
2-From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=969621&action=diff
3-(unzip60/ path prefix added)
4-
5---- unzip60/extract.c 2009-03-14 02:32:52.000000000 +0100
6-+++ unzip60/extract.c 2014-12-05 22:43:13.000000000 +0100
7-@@ -2221,10 +2234,17 @@ static int test_compr_eb(__G__ eb, eb_si
8- if (compr_offset < 4) /* field is not compressed: */
9- return PK_OK; /* do nothing and signal OK */
10-
11-+ /* Return no/bad-data error status if any problem is found:
12-+ * 1. eb_size is too small to hold the uncompressed size
13-+ * (eb_ucsize). (Else extract eb_ucsize.)
14-+ * 2. eb_ucsize is zero (invalid). 2014-12-04 SMS.
15-+ * 3. eb_ucsize is positive, but eb_size is too small to hold
16-+ * the compressed data header.
17-+ */
18- if ((eb_size < (EB_UCSIZE_P + 4)) ||
19-- ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L &&
20-- eb_size <= (compr_offset + EB_CMPRHEADLEN)))
21-- return IZ_EF_TRUNC; /* no compressed data! */
22-+ ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) ||
23-+ ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
24-+ return IZ_EF_TRUNC; /* no/bad compressed data! */
25-
26- if (
27- #ifdef INT_16BIT
+0,
-136
1@@ -1,136 +0,0 @@
2-From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=969625&action=diff
3-(unzip60/ path prefix added)
4-
5---- unzip60/process.c 2009-03-06 02:25:10.000000000 +0100
6-+++ unzip60/process.c 2014-12-05 22:42:39.000000000 +0100
7-@@ -1,5 +1,5 @@
8- /*
9-- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
10-+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
11-
12- See the accompanying file LICENSE, version 2009-Jan-02 or later
13- (the contents of which are also included in unzip.h) for terms of use.
14-@@ -1888,48 +1888,82 @@ int getZip64Data(__G__ ef_buf, ef_len)
15- and a 4-byte version of disk start number.
16- Sets both local header and central header fields. Not terribly clever,
17- but it means that this procedure is only called in one place.
18-+
19-+ 2014-12-05 SMS.
20-+ Added checks to ensure that enough data are available before calling
21-+ makeint64() or makelong(). Replaced various sizeof() values with
22-+ simple ("4" or "8") constants. (The Zip64 structures do not depend
23-+ on our variable sizes.) Error handling is crude, but we should now
24-+ stay within the buffer.
25- ---------------------------------------------------------------------------*/
26-
27-+#define Z64FLGS 0xffff
28-+#define Z64FLGL 0xffffffff
29-+
30- if (ef_len == 0 || ef_buf == NULL)
31- return PK_COOL;
32-
33- Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
34- ef_len));
35-
36-- while (ef_len >= EB_HEADSIZE) {
37-+ while (ef_len >= EB_HEADSIZE)
38-+ {
39- eb_id = makeword(EB_ID + ef_buf);
40- eb_len = makeword(EB_LEN + ef_buf);
41-
42-- if (eb_len > (ef_len - EB_HEADSIZE)) {
43-- /* discovered some extra field inconsistency! */
44-+ if (eb_len > (ef_len - EB_HEADSIZE))
45-+ {
46-+ /* Extra block length exceeds remaining extra field length. */
47- Trace((stderr,
48- "getZip64Data: block length %u > rest ef_size %u\n", eb_len,
49- ef_len - EB_HEADSIZE));
50- break;
51- }
52-- if (eb_id == EF_PKSZ64) {
53--
54-+ if (eb_id == EF_PKSZ64)
55-+ {
56- int offset = EB_HEADSIZE;
57-
58-- if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
59-- G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
60-- offset += sizeof(G.crec.ucsize);
61-+ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
62-+ {
63-+ if (offset+ 8 > ef_len)
64-+ return PK_ERR;
65-+
66-+ G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
67-+ offset += 8;
68- }
69-- if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
70-- G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
71-- offset += sizeof(G.crec.csize);
72-+
73-+ if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
74-+ {
75-+ if (offset+ 8 > ef_len)
76-+ return PK_ERR;
77-+
78-+ G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
79-+ offset += 8;
80- }
81-- if (G.crec.relative_offset_local_header == 0xffffffff){
82-+
83-+ if (G.crec.relative_offset_local_header == Z64FLGL)
84-+ {
85-+ if (offset+ 8 > ef_len)
86-+ return PK_ERR;
87-+
88- G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
89-- offset += sizeof(G.crec.relative_offset_local_header);
90-+ offset += 8;
91- }
92-- if (G.crec.disk_number_start == 0xffff){
93-+
94-+ if (G.crec.disk_number_start == Z64FLGS)
95-+ {
96-+ if (offset+ 4 > ef_len)
97-+ return PK_ERR;
98-+
99- G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
100-- offset += sizeof(G.crec.disk_number_start);
101-+ offset += 4;
102- }
103-+#if 0
104-+ break; /* Expect only one EF_PKSZ64 block. */
105-+#endif /* 0 */
106- }
107-
108-- /* Skip this extra field block */
109-+ /* Skip this extra field block. */
110- ef_buf += (eb_len + EB_HEADSIZE);
111- ef_len -= (eb_len + EB_HEADSIZE);
112- }
113---- unzip60/fileio.c 2009-04-20 02:03:44.000000000 +0200
114-+++ unzip60/fileio.c 2014-12-05 22:44:16.000000000 +0100
115-@@ -176,6 +176,8 @@ static ZCONST char Far FilenameTooLongTr
116- #endif
117- static ZCONST char Far ExtraFieldTooLong[] =
118- "warning: extra field too long (%d). Ignoring...\n";
119-+static ZCONST char Far ExtraFieldCorrupt[] =
120-+ "warning: extra field (type: 0x%04x) corrupt. Continuing...\n";
121-
122- #ifdef WINDLL
123- static ZCONST char Far DiskFullQuery[] =
124-@@ -2295,7 +2297,12 @@ int do_string(__G__ length, option) /*
125- if (readbuf(__G__ (char *)G.extra_field, length) == 0)
126- return PK_EOF;
127- /* Looks like here is where extra fields are read */
128-- getZip64Data(__G__ G.extra_field, length);
129-+ if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
130-+ {
131-+ Info(slide, 0x401, ((char *)slide,
132-+ LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
133-+ error = PK_WARN;
134-+ }
135- #ifdef UNICODE_SUPPORT
136- G.unipath_filename = NULL;
137- if (G.UzO.U_flag < 2) {
+0,
-42
1@@ -1,42 +0,0 @@
2-From 190040ebfcf5395a6ccedede2cc9343d34f0a108 Mon Sep 17 00:00:00 2001
3-From: mancha <mancha1 AT zoho DOT com>
4-Date: Wed, 11 Feb 2015
5-Subject: Info-ZIP UnZip buffer overflow
6-
7-By carefully crafting a corrupt ZIP archive with "extra fields" that
8-purport to have compressed blocks larger than the corresponding
9-uncompressed blocks in STORED no-compression mode, an attacker can
10-trigger a heap overflow that can result in application crash or
11-possibly have other unspecified impact.
12-
13-This patch ensures that when extra fields use STORED mode, the
14-"compressed" and uncompressed block sizes match.
15-
16----
17- extract.c | 8 ++++++++
18- 1 file changed, 8 insertions(+)
19-
20---- a/extract.c
21-+++ b/extract.c
22-@@ -2217,6 +2217,7 @@ static int test_compr_eb(__G__ eb, eb_si
23- ulg eb_ucsize;
24- uch *eb_ucptr;
25- int r;
26-+ ush method;
27-
28- if (compr_offset < 4) /* field is not compressed: */
29- return PK_OK; /* do nothing and signal OK */
30-@@ -2226,6 +2227,13 @@ static int test_compr_eb(__G__ eb, eb_si
31- eb_size <= (compr_offset + EB_CMPRHEADLEN)))
32- return IZ_EF_TRUNC; /* no compressed data! */
33-
34-+ method = makeword(eb + (EB_HEADSIZE + compr_offset));
35-+ if ((method == STORED) &&
36-+ (eb_size - compr_offset - EB_CMPRHEADLEN != eb_ucsize))
37-+ return PK_ERR; /* compressed & uncompressed
38-+ * should match in STORED
39-+ * method */
40-+
41- if (
42- #ifdef INT_16BIT
43- (((ulg)(extent)eb_ucsize) != eb_ucsize) ||
+0,
-29
1@@ -1,29 +0,0 @@
2-From: "Steven M. Schweda" <sms@antinode.info>
3-Subject: Fix CVE-2014-9913, buffer overflow in unzip
4-Bug: https://sourceforge.net/p/infozip/bugs/27/
5-Bug-Debian: https://bugs.debian.org/847485
6-Bug-Ubuntu: https://launchpad.net/bugs/387350
7-X-Debian-version: 6.0-21
8-
9---- a/list.c
10-+++ b/list.c
11-@@ -339,7 +339,18 @@
12- G.crec.compression_method == ENHDEFLATED) {
13- methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3];
14- } else if (methnum >= NUM_METHODS) {
15-- sprintf(&methbuf[4], "%03u", G.crec.compression_method);
16-+ /* 2013-02-26 SMS.
17-+ * http://sourceforge.net/p/infozip/bugs/27/ CVE-2014-9913.
18-+ * Unexpectedly large compression methods overflow
19-+ * &methbuf[]. Use the old, three-digit decimal format
20-+ * for values which fit. Otherwise, sacrifice the
21-+ * colon, and use four-digit hexadecimal.
22-+ */
23-+ if (G.crec.compression_method <= 999) {
24-+ sprintf( &methbuf[ 4], "%03u", G.crec.compression_method);
25-+ } else {
26-+ sprintf( &methbuf[ 3], "%04X", G.crec.compression_method);
27-+ }
28- }
29-
30- #if 0 /* GRR/Euro: add this? */
+0,
-28
1@@ -1,28 +0,0 @@
2-From: "Steven M. Schweda" <sms@antinode.info>
3-Subject: Fix CVE-2016-9844, buffer overflow in zipinfo
4-Bug-Debian: https://bugs.debian.org/847486
5-Bug-Ubuntu: https://launchpad.net/bugs/1643750
6-X-Debian-version: 6.0-21
7-
8---- a/zipinfo.c
9-+++ b/zipinfo.c
10-@@ -1921,7 +1921,18 @@
11- ush dnum=(ush)((G.crec.general_purpose_bit_flag>>1) & 3);
12- methbuf[3] = dtype[dnum];
13- } else if (methnum >= NUM_METHODS) { /* unknown */
14-- sprintf(&methbuf[1], "%03u", G.crec.compression_method);
15-+ /* 2016-12-05 SMS.
16-+ * https://launchpad.net/bugs/1643750
17-+ * Unexpectedly large compression methods overflow
18-+ * &methbuf[]. Use the old, three-digit decimal format
19-+ * for values which fit. Otherwise, sacrifice the "u",
20-+ * and use four-digit hexadecimal.
21-+ */
22-+ if (G.crec.compression_method <= 999) {
23-+ sprintf( &methbuf[ 1], "%03u", G.crec.compression_method);
24-+ } else {
25-+ sprintf( &methbuf[ 0], "%04X", G.crec.compression_method);
26-+ }
27- }
28-
29- for (k = 0; k < 15; ++k)
1@@ -1,34 +0,0 @@
2---- a/fileio.c 2014-12-05 05:06:05 -0600
3-+++ b/fileio.c 2017-11-14 01:06:28 -0600
4-@@ -1,5 +1,5 @@
5- /*
6-- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
7-+ Copyright (c) 1990-2017 Info-ZIP. All rights reserved.
8-
9- See the accompanying file LICENSE, version 2009-Jan-02 or later
10- (the contents of which are also included in unzip.h) for terms of use.
11-@@ -1582,6 +1582,8 @@
12- int r = IZ_PW_ENTERED;
13- char *m;
14- char *prompt;
15-+ char *ep;
16-+ char *zp;
17-
18- #ifndef REENTRANT
19- /* tell picky compilers to shut up about "unused variable" warnings */
20-@@ -1590,9 +1592,12 @@
21-
22- if (*rcnt == 0) { /* First call for current entry */
23- *rcnt = 2;
24-- if ((prompt = (char *)malloc(2*FILNAMSIZ + 15)) != (char *)NULL) {
25-- sprintf(prompt, LoadFarString(PasswPrompt),
26-- FnFilter1(zfn), FnFilter2(efn));
27-+ zp = FnFilter1( zfn);
28-+ ep = FnFilter2( efn);
29-+ prompt = (char *)malloc( /* Slightly too long (2* "%s"). */
30-+ sizeof( PasswPrompt)+ strlen( zp)+ strlen( ep));
31-+ if (prompt != (char *)NULL) {
32-+ sprintf(prompt, LoadFarString(PasswPrompt), zp, ep);
33- m = prompt;
34- } else
35- m = (char *)LoadFarString(PasswPrompt2);
+0,
-13
1@@ -1,13 +0,0 @@
2-diff --git a/list.c b/list.c
3-index f7359c3..4c3d703 100644
4---- a/list.c
5-+++ b/list.c
6-@@ -97,7 +97,7 @@ int list_files(__G) /* return PK-type error code */
7- {
8- int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL;
9- #ifndef WINDLL
10-- char sgn, cfactorstr[10];
11-+ char sgn, cfactorstr[13];
12- int longhdr=(uO.vflag>1);
13- #endif
14- int date_format;
+0,
-54
1@@ -1,54 +0,0 @@
2-From 731d698377dbd1f5b1b90efeb8094602ed59fc40 Mon Sep 17 00:00:00 2001
3-From: Nils Bars <nils.bars@t-online.de>
4-Date: Mon, 17 Jan 2022 16:53:16 +0000
5-Subject: [PATCH] Fix null pointer dereference and use of uninitialized data
6-
7-This fixes a bug that causes use of uninitialized heap data if `readbuf` fails
8-to read as many bytes as indicated by the extra field length attribute.
9-Furthermore, this fixes a null pointer dereference if an archive contains an
10-`EF_UNIPATH` extra field but does not have a filename set.
11----
12- fileio.c | 5 ++++-
13- process.c | 6 +++++-
14- 2 files changed, 9 insertions(+), 2 deletions(-)
15-
16-diff --git a/fileio.c b/fileio.c
17-index 6290824..95ea68b 100644
18---- a/fileio.c
19-+++ b/fileio.c
20-@@ -2308,8 +2308,11 @@ int do_string(__G__ length, option) /* return PK-type error code */
21- seek_zipf(__G__ G.cur_zipfile_bufstart - G.extra_bytes +
22- (G.inptr-G.inbuf) + length);
23- } else {
24-- if (readbuf(__G__ (char *)G.extra_field, length) == 0)
25-+ unsigned bytes_read = readbuf(__G__ (char *)G.extra_field, length);
26-+ if (bytes_read == 0)
27- return PK_EOF;
28-+ if (bytes_read != length)
29-+ return PK_ERR;
30- /* Looks like here is where extra fields are read */
31- if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
32- {
33-diff --git a/process.c b/process.c
34-index d2a846e..cba2463 100644
35---- a/process.c
36-+++ b/process.c
37-@@ -2064,10 +2064,14 @@ int getUnicodeData(__G__ ef_buf, ef_len)
38- G.unipath_checksum = makelong(offset + ef_buf);
39- offset += 4;
40-
41-+ if (!G.filename_full) {
42-+ /* Check if we have a unicode extra section but no filename set */
43-+ return PK_ERR;
44-+ }
45-+
46- /*
47- * Compute 32-bit crc
48- */
49--
50- chksum = crc32(chksum, (uch *)(G.filename_full),
51- strlen(G.filename_full));
52-
53---
54-2.25.1
55-
1@@ -1,173 +0,0 @@
2-From: Steven M. Schweda <sms@antinode.info>
3-Subject: Fix for CVE-2022-0529 and CVE-2022-0530
4-Bug-Debian: https://bugs.debian.org/1010355
5-X-Debian-version: 6.0-27
6-
7---- a/fileio.c
8-+++ b/fileio.c
9-@@ -171,8 +171,10 @@
10- static ZCONST char Far FilenameTooLongTrunc[] =
11- "warning: filename too long--truncating.\n";
12- #ifdef UNICODE_SUPPORT
13-+ static ZCONST char Far UFilenameCorrupt[] =
14-+ "error: Unicode filename corrupt.\n";
15- static ZCONST char Far UFilenameTooLongTrunc[] =
16-- "warning: Converted unicode filename too long--truncating.\n";
17-+ "warning: Converted Unicode filename too long--truncating.\n";
18- #endif
19- static ZCONST char Far ExtraFieldTooLong[] =
20- "warning: extra field too long (%d). Ignoring...\n";
21-@@ -2361,16 +2363,30 @@
22- /* convert UTF-8 to local character set */
23- fn = utf8_to_local_string(G.unipath_filename,
24- G.unicode_escape_all);
25-- /* make sure filename is short enough */
26-- if (strlen(fn) >= FILNAMSIZ) {
27-- fn[FILNAMSIZ - 1] = '\0';
28-+
29-+ /* 2022-07-22 SMS, et al. CVE-2022-0530
30-+ * Detect conversion failure, emit message.
31-+ * Continue with unconverted name.
32-+ */
33-+ if (fn == NULL)
34-+ {
35- Info(slide, 0x401, ((char *)slide,
36-- LoadFarString(UFilenameTooLongTrunc)));
37-- error = PK_WARN;
38-+ LoadFarString(UFilenameCorrupt)));
39-+ error = PK_ERR;
40-+ }
41-+ else
42-+ {
43-+ /* make sure filename is short enough */
44-+ if (strlen(fn) >= FILNAMSIZ) {
45-+ fn[FILNAMSIZ - 1] = '\0';
46-+ Info(slide, 0x401, ((char *)slide,
47-+ LoadFarString(UFilenameTooLongTrunc)));
48-+ error = PK_WARN;
49-+ }
50-+ /* replace filename with converted UTF-8 */
51-+ strcpy(G.filename, fn);
52-+ free(fn);
53- }
54-- /* replace filename with converted UTF-8 */
55-- strcpy(G.filename, fn);
56-- free(fn);
57- }
58- # endif /* UNICODE_WCHAR */
59- if (G.unipath_filename != G.filename_full)
60---- a/process.c
61-+++ b/process.c
62-@@ -222,6 +222,8 @@
63- "\nwarning: Unicode Path version > 1\n";
64- static ZCONST char Far UnicodeMismatchError[] =
65- "\nwarning: Unicode Path checksum invalid\n";
66-+ static ZCONST char Far UFilenameTooLongTrunc[] =
67-+ "warning: filename too long (P1) -- truncating.\n";
68- #endif
69-
70-
71-@@ -1915,7 +1917,7 @@
72- Sets both local header and central header fields. Not terribly clever,
73- but it means that this procedure is only called in one place.
74-
75-- 2014-12-05 SMS.
76-+ 2014-12-05 SMS. (oCERT.org report.) CVE-2014-8141.
77- Added checks to ensure that enough data are available before calling
78- makeint64() or makelong(). Replaced various sizeof() values with
79- simple ("4" or "8") constants. (The Zip64 structures do not depend
80-@@ -1947,9 +1949,10 @@
81- ef_len - EB_HEADSIZE));
82- break;
83- }
84-+
85- if (eb_id == EF_PKSZ64)
86- {
87-- int offset = EB_HEADSIZE;
88-+ unsigned offset = EB_HEADSIZE;
89-
90- if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
91- {
92-@@ -2046,7 +2049,7 @@
93- }
94- if (eb_id == EF_UNIPATH) {
95-
96-- int offset = EB_HEADSIZE;
97-+ unsigned offset = EB_HEADSIZE;
98- ush ULen = eb_len - 5;
99- ulg chksum = CRCVAL_INITIAL;
100-
101-@@ -2504,16 +2507,17 @@
102- int state_dependent;
103- int wsize = 0;
104- int max_bytes = MB_CUR_MAX;
105-- char buf[9];
106-+ char buf[ MB_CUR_MAX+ 1]; /* ("+1" not really needed?) */
107- char *buffer = NULL;
108- char *local_string = NULL;
109-+ size_t buffer_size; /* CVE-2022-0529 */
110-
111- for (wsize = 0; wide_string[wsize]; wsize++) ;
112-
113- if (max_bytes < MAX_ESCAPE_BYTES)
114- max_bytes = MAX_ESCAPE_BYTES;
115--
116-- if ((buffer = (char *)malloc(wsize * max_bytes + 1)) == NULL) {
117-+ buffer_size = wsize * max_bytes + 1; /* Reused below. */
118-+ if ((buffer = (char *)malloc( buffer_size)) == NULL) {
119- return NULL;
120- }
121-
122-@@ -2551,8 +2555,28 @@
123- } else {
124- /* no MB for this wide */
125- /* use escape for wide character */
126-- char *escape_string = wide_to_escape_string(wide_string[i]);
127-- strcat(buffer, escape_string);
128-+ size_t buffer_len;
129-+ size_t escape_string_len;
130-+ char *escape_string;
131-+ int err_msg = 0;
132-+
133-+ escape_string = wide_to_escape_string(wide_string[i]);
134-+ buffer_len = strlen( buffer);
135-+ escape_string_len = strlen( escape_string);
136-+
137-+ /* Append escape string, as space allows. */
138-+ /* 2022-07-18 SMS, et al. CVE-2022-0529 */
139-+ if (escape_string_len > buffer_size- buffer_len- 1)
140-+ {
141-+ escape_string_len = buffer_size- buffer_len- 1;
142-+ if (err_msg == 0)
143-+ {
144-+ err_msg = 1;
145-+ Info(slide, 0x401, ((char *)slide,
146-+ LoadFarString( UFilenameTooLongTrunc)));
147-+ }
148-+ }
149-+ strncat( buffer, escape_string, escape_string_len);
150- free(escape_string);
151- }
152- }
153-@@ -2604,9 +2628,18 @@
154- ZCONST char *utf8_string;
155- int escape_all;
156- {
157-- zwchar *wide = utf8_to_wide_string(utf8_string);
158-- char *loc = wide_to_local_string(wide, escape_all);
159-- free(wide);
160-+ zwchar *wide;
161-+ char *loc = NULL;
162-+
163-+ wide = utf8_to_wide_string( utf8_string);
164-+
165-+ /* 2022-07-25 SMS, et al. CVE-2022-0530 */
166-+ if (wide != NULL)
167-+ {
168-+ loc = wide_to_local_string( wide, escape_all);
169-+ free( wide);
170-+ }
171-+
172- return loc;
173- }
174-
+0,
-38
1@@ -1,38 +0,0 @@
2-From mboxrd@z Thu Jan 1 00:00:00 1970
3-From: Andreas Schwab <schwab@linux-m68k.org>
4-Subject: Re: "git archive" seems to be broken wrt zip files
5-Date: Sun, 11 Sep 2011 15:14:36 +0200
6-Jeff King <peff@peff.net> writes:
7-
8-> IOW, the zip file looks right. I wonder if this is actually a bug in
9-> "unzip".
10-
11-It is. This only happens if you have more then 16k entries and when one
12-of the 16k entry infos is reused it happend to be previously used for a
13-symlink entry.
14-
15-Here's a patch for unzip60 for reference:
16-
17---- a/process.c
18-+++ b/process.c
19-@@ -1751,6 +1751,12 @@ int process_cdir_file_hdr(__G) /* ret
20- = (G.crec.general_purpose_bit_flag & (1 << 11)) == (1 << 11);
21- #endif
22-
23-+#ifdef SYMLINKS
24-+ /* Initialize the symlink flag, may be set by the platform-specific
25-+ mapattr function. */
26-+ G.pInfo->symlink = 0;
27-+#endif
28-+
29- return PK_COOL;
30-
31- } /* end function process_cdir_file_hdr() */
32-
33-Andreas.
34-
35---
36-Andreas Schwab, schwab@linux-m68k.org
37-GPG Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
38-"And now for something completely different."
39-
1@@ -1,10 +0,0 @@
2-diff -up unzip60/crc_i386.S.exec-shield unzip60/crc_i386.S
3---- unzip60/crc_i386.S.exec-shield 2007-01-07 06:02:58.000000000 +0100
4-+++ unzip60/crc_i386.S 2009-11-18 11:16:39.630389312 +0100
5-@@ -302,3 +302,6 @@ _crc32: /* ulg c
6- #endif /* i386 || _i386 || _I386 || __i386 */
7-
8- #endif /* !USE_ZLIB && !CRC_TABLE_ONLY */
9-+
10-+.section .note.GNU-stack, "", @progbits
11-+.previous
1@@ -1,90 +0,0 @@
2-diff --git a/extract.c b/extract.c
3-index eeb2f57..a0a4929 100644
4---- a/extract.c
5-+++ b/extract.c
6-@@ -472,8 +472,8 @@ int extract_or_test_files(__G) /* return PK-type error code */
7- */
8- Info(slide, 0x401, ((char *)slide,
9- LoadFarString(CentSigMsg), j + blknum*DIR_BLKSIZ + 1));
10-- Info(slide, 0x401, ((char *)slide,
11-- LoadFarString(ReportMsg)));
12-+ Info(slide, 0x401,
13-+ ((char *)slide,"%s", LoadFarString(ReportMsg)));
14- error_in_archive = PK_BADERR;
15- }
16- reached_end = TRUE; /* ...so no more left to do */
17-@@ -752,8 +752,8 @@ int extract_or_test_files(__G) /* return PK-type error code */
18-
19- #ifndef SFX
20- if (no_endsig_found) { /* just to make sure */
21-- Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
22-- Info(slide, 0x401, ((char *)slide, LoadFarString(ReportMsg)));
23-+ Info(slide, 0x401, ((char *)slide,"%s", LoadFarString(EndSigMsg)));
24-+ Info(slide, 0x401, ((char *)slide,"%s", LoadFarString(ReportMsg)));
25- if (!error_in_archive) /* don't overwrite stronger error */
26- error_in_archive = PK_WARN;
27- }
28-diff --git a/list.c b/list.c
29-index 15e0011..f7359c3 100644
30---- a/list.c
31-+++ b/list.c
32-@@ -181,7 +181,7 @@ int list_files(__G) /* return PK-type error code */
33- Info(slide, 0x401,
34- ((char *)slide, LoadFarString(CentSigMsg), j));
35- Info(slide, 0x401,
36-- ((char *)slide, LoadFarString(ReportMsg)));
37-+ ((char *)slide,"%s", LoadFarString(ReportMsg)));
38- return PK_BADERR; /* sig not found */
39- }
40- }
41-@@ -507,7 +507,8 @@ int list_files(__G) /* return PK-type error code */
42- && (!G.ecrec.is_zip64_archive)
43- && (memcmp(G.sig, end_central_sig, 4) != 0)
44- ) { /* just to make sure again */
45-- Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
46-+ Info(slide, 0x401,
47-+ ((char *)slide,"%s", LoadFarString(EndSigMsg)));
48- error_in_archive = PK_WARN; /* didn't find sig */
49- }
50-
51-@@ -591,7 +592,7 @@ int get_time_stamp(__G__ last_modtime, nmember) /* return PK-type error code */
52- Info(slide, 0x401,
53- ((char *)slide, LoadFarString(CentSigMsg), j));
54- Info(slide, 0x401,
55-- ((char *)slide, LoadFarString(ReportMsg)));
56-+ ((char *)slide,"%s", LoadFarString(ReportMsg)));
57- return PK_BADERR; /* sig not found */
58- }
59- }
60-@@ -674,7 +675,7 @@ int get_time_stamp(__G__ last_modtime, nmember) /* return PK-type error code */
61- ---------------------------------------------------------------------------*/
62-
63- if (memcmp(G.sig, end_central_sig, 4)) { /* just to make sure again */
64-- Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
65-+ Info(slide, 0x401, ((char *)slide,"%s", LoadFarString(EndSigMsg)));
66- error_in_archive = PK_WARN;
67- }
68- if (*nmember == 0L && error_in_archive <= PK_WARN)
69-diff --git a/zipinfo.c b/zipinfo.c
70-index 6e22cc8..ac5c61b 100644
71---- a/zipinfo.c
72-+++ b/zipinfo.c
73-@@ -771,7 +771,7 @@ int zipinfo(__G) /* return PK-type error code */
74- Info(slide, 0x401,
75- ((char *)slide, LoadFarString(CentSigMsg), j));
76- Info(slide, 0x401,
77-- ((char *)slide, LoadFarString(ReportMsg)));
78-+ ((char *)slide,"%s", LoadFarString(ReportMsg)));
79- error_in_archive = PK_BADERR; /* sig not found */
80- break;
81- }
82-@@ -960,7 +960,8 @@ int zipinfo(__G) /* return PK-type error code */
83- && (!G.ecrec.is_zip64_archive)
84- && (memcmp(G.sig, end_central_sig, 4) != 0)
85- ) { /* just to make sure again */
86-- Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
87-+ Info(slide, 0x401,
88-+ ((char *)slide,"%s", LoadFarString(EndSigMsg)));
89- error_in_archive = PK_WARN; /* didn't find sig */
90- }
91-
1@@ -1,104 +0,0 @@
2-From bdd4a0cecd745cb4825e4508b5bdf2579731086a Mon Sep 17 00:00:00 2001
3-From: Petr Stodulka <pstodulk@redhat.com>
4-Date: Mon, 14 Sep 2015 18:23:17 +0200
5-Subject: [PATCH 1/3] upstream fix for heap overflow
6-
7-https://bugzilla.redhat.com/attachment.cgi?id=1073002
8----
9- crypt.c | 12 +++++++++++-
10- 1 file changed, 11 insertions(+), 1 deletion(-)
11-
12-diff --git a/crypt.c b/crypt.c
13-index 784e411..a8975f2 100644
14---- a/crypt.c
15-+++ b/crypt.c
16-@@ -465,7 +465,17 @@ int decrypt(__G__ passwrd)
17- GLOBAL(pInfo->encrypted) = FALSE;
18- defer_leftover_input(__G);
19- for (n = 0; n < RAND_HEAD_LEN; n++) {
20-- b = NEXTBYTE;
21-+ /* 2012-11-23 SMS. (OUSPG report.)
22-+ * Quit early if compressed size < HEAD_LEN. The resulting
23-+ * error message ("unable to get password") could be improved,
24-+ * but it's better than trying to read nonexistent data, and
25-+ * then continuing with a negative G.csize. (See
26-+ * fileio.c:readbyte()).
27-+ */
28-+ if ((b = NEXTBYTE) == (ush)EOF)
29-+ {
30-+ return PK_ERR;
31-+ }
32- h[n] = (uch)b;
33- Trace((stdout, " (%02x)", h[n]));
34- }
35---
36-2.4.6
37-
38-
39-From 4b48844661ff9569f2ecf582a387d46a5775b5d8 Mon Sep 17 00:00:00 2001
40-From: Kamil Dudka <kdudka@redhat.com>
41-Date: Mon, 14 Sep 2015 18:24:56 +0200
42-Subject: [PATCH 2/3] fix infinite loop when extracting empty bzip2 data
43-
44-Bug: https://sourceforge.net/p/infozip/patches/23/
45----
46- extract.c | 6 ++++++
47- 1 file changed, 6 insertions(+)
48-
49-diff --git a/extract.c b/extract.c
50-index 7134bfe..29db027 100644
51---- a/extract.c
52-+++ b/extract.c
53-@@ -2733,6 +2733,12 @@ __GDEF
54- int repeated_buf_err;
55- bz_stream bstrm;
56-
57-+ if (G.incnt <= 0 && G.csize <= 0L) {
58-+ /* avoid an infinite loop */
59-+ Trace((stderr, "UZbunzip2() got empty input\n"));
60-+ return 2;
61-+ }
62-+
63- #if (defined(DLL) && !defined(NO_SLIDE_REDIR))
64- if (G.redirect_slide)
65- wsize = G.redirect_size, redirSlide = G.redirect_buffer;
66---
67-2.4.6
68-
69-
70-From bd150334fb4084f5555a6be26b015a0671cb5b74 Mon Sep 17 00:00:00 2001
71-From: Kamil Dudka <kdudka@redhat.com>
72-Date: Tue, 22 Sep 2015 18:52:23 +0200
73-Subject: [PATCH 3/3] extract: prevent unsigned overflow on invalid input
74-
75-Suggested-by: Stefan Cornelius
76----
77- extract.c | 11 ++++++++++-
78- 1 file changed, 10 insertions(+), 1 deletion(-)
79-
80-diff --git a/extract.c b/extract.c
81-index 29db027..b9ae667 100644
82---- a/extract.c
83-+++ b/extract.c
84-@@ -1257,8 +1257,17 @@ static int extract_or_test_entrylist(__G__ numchunk,
85- if (G.lrec.compression_method == STORED) {
86- zusz_t csiz_decrypted = G.lrec.csize;
87-
88-- if (G.pInfo->encrypted)
89-+ if (G.pInfo->encrypted) {
90-+ if (csiz_decrypted < 12) {
91-+ /* handle the error now to prevent unsigned overflow */
92-+ Info(slide, 0x401, ((char *)slide,
93-+ LoadFarStringSmall(ErrUnzipNoFile),
94-+ LoadFarString(InvalidComprData),
95-+ LoadFarStringSmall2(Inflate)));
96-+ return PK_ERR;
97-+ }
98- csiz_decrypted -= 12;
99-+ }
100- if (G.lrec.ucsize != csiz_decrypted) {
101- Info(slide, 0x401, ((char *)slide,
102- LoadFarStringSmall2(WrnStorUCSizCSizDiff),
103---
104-2.5.2
105-
1@@ -1,41 +0,0 @@
2-From: "Steven M. Schweda" <sms@antinode.info>
3-Subject: Do not ignore extra fields containing Unix Timestamps
4-Bug-Debian: https://bugs.debian.org/842993
5-X-Debian-version: 6.0-21
6-
7---- a/process.c
8-+++ b/process.c
9-@@ -2914,10 +2914,13 @@
10- break;
11-
12- case EF_IZUNIX2:
13-- if (have_new_type_eb == 0) {
14-- flags &= ~0x0ff; /* ignore any previous IZUNIX field */
15-+ if (have_new_type_eb == 0) { /* (< 1) */
16- have_new_type_eb = 1;
17- }
18-+ if (have_new_type_eb <= 1) {
19-+ /* Ignore any prior (EF_IZUNIX/EF_PKUNIX) UID/GID. */
20-+ flags &= 0x0ff;
21-+ }
22- #ifdef IZ_HAVE_UXUIDGID
23- if (have_new_type_eb > 1)
24- break; /* IZUNIX3 overrides IZUNIX2 e.f. block ! */
25-@@ -2933,6 +2936,8 @@
26- /* new 3rd generation Unix ef */
27- have_new_type_eb = 2;
28-
29-+ /* Ignore any prior EF_IZUNIX/EF_PKUNIX/EF_IZUNIX2 UID/GID. */
30-+ flags &= 0x0ff;
31- /*
32- Version 1 byte version of this extra field, currently 1
33- UIDSize 1 byte Size of UID field
34-@@ -2953,8 +2958,6 @@
35- uid_size = *((EB_HEADSIZE + 1) + ef_buf);
36- gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf);
37-
38-- flags &= ~0x0ff; /* ignore any previous UNIX field */
39--
40- if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf,
41- uid_size, &z_uidgid[0])
42- &&
+0,
-25
1@@ -1,25 +0,0 @@
2-From 6fe72291a5563cdbcd2bdd87e36528537b7cdcfb Mon Sep 17 00:00:00 2001
3-From: Jakub Martisko <jamartis@redhat.com>
4-Date: Mon, 18 Nov 2019 14:17:46 +0100
5-Subject: [PATCH] update the man page
6-
7----
8- man/unzip.1 | 2 ++
9- 1 file changed, 2 insertions(+)
10-
11-diff --git a/man/unzip.1 b/man/unzip.1
12-index 21816d1..4d66073 100644
13---- a/man/unzip.1
14-+++ b/man/unzip.1
15-@@ -850,6 +850,8 @@ the specified zipfiles were not found.
16- invalid options were specified on the command line.
17- .IP 11
18- no matching files were found.
19-+.IP 12
20-+invalid zip file with overlapped components (possible zip-bomb). The zip-bomb checks can be disabled by using the UNZIP_DISABLE_ZIPBOMB_DETECTION=TRUE environment variable.
21- .IP 50
22- the disk is (or was) full during extraction.
23- .IP 51
24---
25-2.23.0
26-
+0,
-25
1@@ -1,25 +0,0 @@
2-From 41beb477c5744bc396fa1162ee0c14218ec12213 Mon Sep 17 00:00:00 2001
3-From: Mark Adler <madler@alumni.caltech.edu>
4-Date: Mon, 27 May 2019 08:20:32 -0700
5-Subject: [PATCH] Fix bug in undefer_input() that misplaced the input state.
6-
7----
8- fileio.c | 4 +++-
9- 1 file changed, 3 insertions(+), 1 deletion(-)
10-
11-diff --git a/fileio.c b/fileio.c
12-index c042987..bc00d74 100644
13---- a/fileio.c
14-+++ b/fileio.c
15-@@ -530,8 +530,10 @@ void undefer_input(__G)
16- * This condition was checked when G.incnt_leftover was set > 0 in
17- * defer_leftover_input(), and it is NOT allowed to touch G.csize
18- * before calling undefer_input() when (G.incnt_leftover > 0)
19-- * (single exception: see read_byte()'s "G.csize <= 0" handling) !!
20-+ * (single exception: see readbyte()'s "G.csize <= 0" handling) !!
21- */
22-+ if (G.csize < 0L)
23-+ G.csize = 0L;
24- G.incnt = G.incnt_leftover + (int)G.csize;
25- G.inptr = G.inptr_leftover - (int)G.csize;
26- G.incnt_leftover = 0;
+0,
-349
1@@ -1,349 +0,0 @@
2-From 47b3ceae397d21bf822bc2ac73052a4b1daf8e1c Mon Sep 17 00:00:00 2001
3-From: Mark Adler <madler@alumni.caltech.edu>
4-Date: Tue, 11 Jun 2019 22:01:18 -0700
5-Subject: [PATCH] Detect and reject a zip bomb using overlapped entries.
6-
7-This detects an invalid zip file that has at least one entry that
8-overlaps with another entry or with the central directory to the
9-end of the file. A Fifield zip bomb uses overlapped local entries
10-to vastly increase the potential inflation ratio. Such an invalid
11-zip file is rejected.
12-
13-See https://www.bamsoftware.com/hacks/zipbomb/ for David Fifield's
14-analysis, construction, and examples of such zip bombs.
15-
16-The detection maintains a list of covered spans of the zip files
17-so far, where the central directory to the end of the file and any
18-bytes preceding the first entry at zip file offset zero are
19-considered covered initially. Then as each entry is decompressed
20-or tested, it is considered covered. When a new entry is about to
21-be processed, its initial offset is checked to see if it is
22-contained by a covered span. If so, the zip file is rejected as
23-invalid.
24-
25-This commit depends on a preceding commit: "Fix bug in
26-undefer_input() that misplaced the input state."
27----
28- extract.c | 190 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
29- globals.c | 1 +
30- globals.h | 3 +
31- process.c | 11 ++++
32- unzip.h | 1 +
33- 5 files changed, 205 insertions(+), 1 deletion(-)
34-
35-diff --git a/extract.c b/extract.c
36-index 1acd769..0973a33 100644
37---- a/extract.c
38-+++ b/extract.c
39-@@ -319,6 +319,125 @@ static ZCONST char Far UnsupportedExtraField[] =
40- "\nerror: unsupported extra-field compression type (%u)--skipping\n";
41- static ZCONST char Far BadExtraFieldCRC[] =
42- "error [%s]: bad extra-field CRC %08lx (should be %08lx)\n";
43-+static ZCONST char Far NotEnoughMemCover[] =
44-+ "error: not enough memory for bomb detection\n";
45-+static ZCONST char Far OverlappedComponents[] =
46-+ "error: invalid zip file with overlapped components (possible zip bomb)\n";
47-+
48-+
49-+
50-+
51-+
52-+/* A growable list of spans. */
53-+typedef zoff_t bound_t;
54-+typedef struct {
55-+ bound_t beg; /* start of the span */
56-+ bound_t end; /* one past the end of the span */
57-+} span_t;
58-+typedef struct {
59-+ span_t *span; /* allocated, distinct, and sorted list of spans */
60-+ size_t num; /* number of spans in the list */
61-+ size_t max; /* allocated number of spans (num <= max) */
62-+} cover_t;
63-+
64-+/*
65-+ * Return the index of the first span in cover whose beg is greater than val.
66-+ * If there is no such span, then cover->num is returned.
67-+ */
68-+static size_t cover_find(cover, val)
69-+ cover_t *cover;
70-+ bound_t val;
71-+{
72-+ size_t lo = 0, hi = cover->num;
73-+ while (lo < hi) {
74-+ size_t mid = (lo + hi) >> 1;
75-+ if (val < cover->span[mid].beg)
76-+ hi = mid;
77-+ else
78-+ lo = mid + 1;
79-+ }
80-+ return hi;
81-+}
82-+
83-+/* Return true if val lies within any one of the spans in cover. */
84-+static int cover_within(cover, val)
85-+ cover_t *cover;
86-+ bound_t val;
87-+{
88-+ size_t pos = cover_find(cover, val);
89-+ return pos > 0 && val < cover->span[pos - 1].end;
90-+}
91-+
92-+/*
93-+ * Add a new span to the list, but only if the new span does not overlap any
94-+ * spans already in the list. The new span covers the values beg..end-1. beg
95-+ * must be less than end.
96-+ *
97-+ * Keep the list sorted and merge adjacent spans. Grow the allocated space for
98-+ * the list as needed. On success, 0 is returned. If the new span overlaps any
99-+ * existing spans, then 1 is returned and the new span is not added to the
100-+ * list. If the new span is invalid because beg is greater than or equal to
101-+ * end, then -1 is returned. If the list needs to be grown but the memory
102-+ * allocation fails, then -2 is returned.
103-+ */
104-+static int cover_add(cover, beg, end)
105-+ cover_t *cover;
106-+ bound_t beg;
107-+ bound_t end;
108-+{
109-+ size_t pos;
110-+ int prec, foll;
111-+
112-+ if (beg >= end)
113-+ /* The new span is invalid. */
114-+ return -1;
115-+
116-+ /* Find where the new span should go, and make sure that it does not
117-+ overlap with any existing spans. */
118-+ pos = cover_find(cover, beg);
119-+ if ((pos > 0 && beg < cover->span[pos - 1].end) ||
120-+ (pos < cover->num && end > cover->span[pos].beg))
121-+ return 1;
122-+
123-+ /* Check for adjacencies. */
124-+ prec = pos > 0 && beg == cover->span[pos - 1].end;
125-+ foll = pos < cover->num && end == cover->span[pos].beg;
126-+ if (prec && foll) {
127-+ /* The new span connects the preceding and following spans. Merge the
128-+ following span into the preceding span, and delete the following
129-+ span. */
130-+ cover->span[pos - 1].end = cover->span[pos].end;
131-+ cover->num--;
132-+ memmove(cover->span + pos, cover->span + pos + 1,
133-+ (cover->num - pos) * sizeof(span_t));
134-+ }
135-+ else if (prec)
136-+ /* The new span is adjacent only to the preceding span. Extend the end
137-+ of the preceding span. */
138-+ cover->span[pos - 1].end = end;
139-+ else if (foll)
140-+ /* The new span is adjacent only to the following span. Extend the
141-+ beginning of the following span. */
142-+ cover->span[pos].beg = beg;
143-+ else {
144-+ /* The new span has gaps between both the preceding and the following
145-+ spans. Assure that there is room and insert the span. */
146-+ if (cover->num == cover->max) {
147-+ size_t max = cover->max == 0 ? 16 : cover->max << 1;
148-+ span_t *span = realloc(cover->span, max * sizeof(span_t));
149-+ if (span == NULL)
150-+ return -2;
151-+ cover->span = span;
152-+ cover->max = max;
153-+ }
154-+ memmove(cover->span + pos + 1, cover->span + pos,
155-+ (cover->num - pos) * sizeof(span_t));
156-+ cover->num++;
157-+ cover->span[pos].beg = beg;
158-+ cover->span[pos].end = end;
159-+ }
160-+ return 0;
161-+}
162-
163-
164-
165-@@ -374,6 +493,29 @@ int extract_or_test_files(__G) /* return PK-type error code */
166- }
167- #endif /* !SFX || SFX_EXDIR */
168-
169-+ /* One more: initialize cover structure for bomb detection. Start with a
170-+ span that covers the central directory though the end of the file. */
171-+ if (G.cover == NULL) {
172-+ G.cover = malloc(sizeof(cover_t));
173-+ if (G.cover == NULL) {
174-+ Info(slide, 0x401, ((char *)slide,
175-+ LoadFarString(NotEnoughMemCover)));
176-+ return PK_MEM;
177-+ }
178-+ ((cover_t *)G.cover)->span = NULL;
179-+ ((cover_t *)G.cover)->max = 0;
180-+ }
181-+ ((cover_t *)G.cover)->num = 0;
182-+ if ((G.extra_bytes != 0 &&
183-+ cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) ||
184-+ cover_add((cover_t *)G.cover,
185-+ G.extra_bytes + G.ecrec.offset_start_central_directory,
186-+ G.ziplen) != 0) {
187-+ Info(slide, 0x401, ((char *)slide,
188-+ LoadFarString(NotEnoughMemCover)));
189-+ return PK_MEM;
190-+ }
191-+
192- /*---------------------------------------------------------------------------
193- The basic idea of this function is as follows. Since the central di-
194- rectory lies at the end of the zipfile and the member files lie at the
195-@@ -591,7 +733,8 @@ int extract_or_test_files(__G) /* return PK-type error code */
196- if (error > error_in_archive)
197- error_in_archive = error;
198- /* ...and keep going (unless disk full or user break) */
199-- if (G.disk_full > 1 || error_in_archive == IZ_CTRLC) {
200-+ if (G.disk_full > 1 || error_in_archive == IZ_CTRLC ||
201-+ error == PK_BOMB) {
202- /* clear reached_end to signal premature stop ... */
203- reached_end = FALSE;
204- /* ... and cancel scanning the central directory */
205-@@ -1060,6 +1203,11 @@ static int extract_or_test_entrylist(__G__ numchunk,
206-
207- /* seek_zipf(__G__ pInfo->offset); */
208- request = G.pInfo->offset + G.extra_bytes;
209-+ if (cover_within((cover_t *)G.cover, request)) {
210-+ Info(slide, 0x401, ((char *)slide,
211-+ LoadFarString(OverlappedComponents)));
212-+ return PK_BOMB;
213-+ }
214- inbuf_offset = request % INBUFSIZ;
215- bufstart = request - inbuf_offset;
216-
217-@@ -1591,6 +1739,18 @@ static int extract_or_test_entrylist(__G__ numchunk,
218- return IZ_CTRLC; /* cancel operation by user request */
219- }
220- #endif
221-+ error = cover_add((cover_t *)G.cover, request,
222-+ G.cur_zipfile_bufstart + (G.inptr - G.inbuf));
223-+ if (error < 0) {
224-+ Info(slide, 0x401, ((char *)slide,
225-+ LoadFarString(NotEnoughMemCover)));
226-+ return PK_MEM;
227-+ }
228-+ if (error != 0) {
229-+ Info(slide, 0x401, ((char *)slide,
230-+ LoadFarString(OverlappedComponents)));
231-+ return PK_BOMB;
232-+ }
233- #ifdef MACOS /* MacOS is no preemptive OS, thus call event-handling by hand */
234- UserStop();
235- #endif
236-@@ -1992,6 +2152,34 @@ static int extract_or_test_member(__G) /* return PK-type error code */
237- }
238-
239- undefer_input(__G);
240-+
241-+ if ((G.lrec.general_purpose_bit_flag & 8) != 0) {
242-+ /* skip over data descriptor (harder than it sounds, due to signature
243-+ * ambiguity)
244-+ */
245-+# define SIG 0x08074b50
246-+# define LOW 0xffffffff
247-+ uch buf[12];
248-+ unsigned shy = 12 - readbuf((char *)buf, 12);
249-+ ulg crc = shy ? 0 : makelong(buf);
250-+ ulg clen = shy ? 0 : makelong(buf + 4);
251-+ ulg ulen = shy ? 0 : makelong(buf + 8); /* or high clen if ZIP64 */
252-+ if (crc == SIG && /* if not SIG, no signature */
253-+ (G.lrec.crc32 != SIG || /* if not SIG, have signature */
254-+ (clen == SIG && /* if not SIG, no signature */
255-+ ((G.lrec.csize & LOW) != SIG || /* if not SIG, have signature */
256-+ (ulen == SIG && /* if not SIG, no signature */
257-+ (G.zip64 ? G.lrec.csize >> 32 : G.lrec.ucsize) != SIG
258-+ /* if not SIG, have signature */
259-+ )))))
260-+ /* skip four more bytes to account for signature */
261-+ shy += 4 - readbuf((char *)buf, 4);
262-+ if (G.zip64)
263-+ shy += 8 - readbuf((char *)buf, 8); /* skip eight more for ZIP64 */
264-+ if (shy)
265-+ error = PK_ERR;
266-+ }
267-+
268- return error;
269-
270- } /* end function extract_or_test_member() */
271-diff --git a/globals.c b/globals.c
272-index fa8cca5..1e0f608 100644
273---- a/globals.c
274-+++ b/globals.c
275-@@ -181,6 +181,7 @@ Uz_Globs *globalsCtor()
276- # if (!defined(NO_TIMESTAMPS))
277- uO.D_flag=1; /* default to '-D', no restoration of dir timestamps */
278- # endif
279-+ G.cover = NULL; /* not allocated yet */
280- #endif
281-
282- uO.lflag=(-1);
283-diff --git a/globals.h b/globals.h
284-index 11b7215..2bdcdeb 100644
285---- a/globals.h
286-+++ b/globals.h
287-@@ -260,12 +260,15 @@ typedef struct Globals {
288- ecdir_rec ecrec; /* used in unzip.c, extract.c */
289- z_stat statbuf; /* used by main, mapname, check_for_newer */
290-
291-+ int zip64; /* true if Zip64 info in extra field */
292-+
293- int mem_mode;
294- uch *outbufptr; /* extract.c static */
295- ulg outsize; /* extract.c static */
296- int reported_backslash; /* extract.c static */
297- int disk_full;
298- int newfile;
299-+ void **cover; /* used in extract.c for bomb detection */
300-
301- int didCRlast; /* fileio static */
302- ulg numlines; /* fileio static: number of lines printed */
303-diff --git a/process.c b/process.c
304-index 1e9a1e1..d2e4dc3 100644
305---- a/process.c
306-+++ b/process.c
307-@@ -637,6 +637,13 @@ void free_G_buffers(__G) /* releases all memory allocated in global vars */
308- }
309- #endif
310-
311-+ /* Free the cover span list and the cover structure. */
312-+ if (G.cover != NULL) {
313-+ free(*(G.cover));
314-+ free(G.cover);
315-+ G.cover = NULL;
316-+ }
317-+
318- } /* end function free_G_buffers() */
319-
320-
321-@@ -1890,6 +1897,8 @@ int getZip64Data(__G__ ef_buf, ef_len)
322- #define Z64FLGS 0xffff
323- #define Z64FLGL 0xffffffff
324-
325-+ G.zip64 = FALSE;
326-+
327- if (ef_len == 0 || ef_buf == NULL)
328- return PK_COOL;
329-
330-@@ -1927,6 +1936,8 @@ int getZip64Data(__G__ ef_buf, ef_len)
331- #if 0
332- break; /* Expect only one EF_PKSZ64 block. */
333- #endif /* 0 */
334-+
335-+ G.zip64 = TRUE;
336- }
337-
338- /* Skip this extra field block. */
339-diff --git a/unzip.h b/unzip.h
340-index 5b2a326..ed24a5b 100644
341---- a/unzip.h
342-+++ b/unzip.h
343-@@ -645,6 +645,7 @@ typedef struct _Uzp_cdir_Rec {
344- #define PK_NOZIP 9 /* zipfile not found */
345- #define PK_PARAM 10 /* bad or illegal parameters specified */
346- #define PK_FIND 11 /* no files found */
347-+#define PK_BOMB 12 /* likely zip bomb */
348- #define PK_DISK 50 /* disk full */
349- #define PK_EOF 51 /* unexpected EOF */
350-
+0,
-112
1@@ -1,112 +0,0 @@
2-From 6d351831be705cc26d897db44f878a978f4138fc Mon Sep 17 00:00:00 2001
3-From: Mark Adler <madler@alumni.caltech.edu>
4-Date: Thu, 25 Jul 2019 20:43:17 -0700
5-Subject: [PATCH] Do not raise a zip bomb alert for a misplaced central
6- directory.
7-
8-There is a zip-like file in the Firefox distribution, omni.ja,
9-which is a zip container with the central directory placed at the
10-start of the file instead of after the local entries as required
11-by the zip standard. This commit marks the actual location of the
12-central directory, as well as the end of central directory records,
13-as disallowed locations. This now permits such containers to not
14-raise a zip bomb alert, where in fact there are no overlaps.
15----
16- extract.c | 25 +++++++++++++++++++------
17- process.c | 6 ++++++
18- unzpriv.h | 10 ++++++++++
19- 3 files changed, 35 insertions(+), 6 deletions(-)
20-
21-diff --git a/extract.c b/extract.c
22-index 0973a33..1b73cb0 100644
23---- a/extract.c
24-+++ b/extract.c
25-@@ -493,8 +493,11 @@ int extract_or_test_files(__G) /* return PK-type error code */
26- }
27- #endif /* !SFX || SFX_EXDIR */
28-
29-- /* One more: initialize cover structure for bomb detection. Start with a
30-- span that covers the central directory though the end of the file. */
31-+ /* One more: initialize cover structure for bomb detection. Start with
32-+ spans that cover any extra bytes at the start, the central directory,
33-+ the end of central directory record (including the Zip64 end of central
34-+ directory locator, if present), and the Zip64 end of central directory
35-+ record, if present. */
36- if (G.cover == NULL) {
37- G.cover = malloc(sizeof(cover_t));
38- if (G.cover == NULL) {
39-@@ -506,15 +509,25 @@ int extract_or_test_files(__G) /* return PK-type error code */
40- ((cover_t *)G.cover)->max = 0;
41- }
42- ((cover_t *)G.cover)->num = 0;
43-- if ((G.extra_bytes != 0 &&
44-- cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) ||
45-- cover_add((cover_t *)G.cover,
46-+ if (cover_add((cover_t *)G.cover,
47- G.extra_bytes + G.ecrec.offset_start_central_directory,
48-- G.ziplen) != 0) {
49-+ G.extra_bytes + G.ecrec.offset_start_central_directory +
50-+ G.ecrec.size_central_directory) != 0) {
51- Info(slide, 0x401, ((char *)slide,
52- LoadFarString(NotEnoughMemCover)));
53- return PK_MEM;
54- }
55-+ if ((G.extra_bytes != 0 &&
56-+ cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) ||
57-+ (G.ecrec.have_ecr64 &&
58-+ cover_add((cover_t *)G.cover, G.ecrec.ec64_start,
59-+ G.ecrec.ec64_end) != 0) ||
60-+ cover_add((cover_t *)G.cover, G.ecrec.ec_start,
61-+ G.ecrec.ec_end) != 0) {
62-+ Info(slide, 0x401, ((char *)slide,
63-+ LoadFarString(OverlappedComponents)));
64-+ return PK_BOMB;
65-+ }
66-
67- /*---------------------------------------------------------------------------
68- The basic idea of this function is as follows. Since the central di-
69-diff --git a/process.c b/process.c
70-index d2e4dc3..d75d405 100644
71---- a/process.c
72-+++ b/process.c
73-@@ -1408,6 +1408,10 @@ static int find_ecrec64(__G__ searchlen) /* return PK-class error */
74-
75- /* Now, we are (almost) sure that we have a Zip64 archive. */
76- G.ecrec.have_ecr64 = 1;
77-+ G.ecrec.ec_start -= ECLOC64_SIZE+4;
78-+ G.ecrec.ec64_start = ecrec64_start_offset;
79-+ G.ecrec.ec64_end = ecrec64_start_offset +
80-+ 12 + makeint64(&byterec[ECREC64_LENGTH]);
81-
82- /* Update the "end-of-central-dir offset" for later checks. */
83- G.real_ecrec_offset = ecrec64_start_offset;
84-@@ -1542,6 +1546,8 @@ static int find_ecrec(__G__ searchlen) /* return PK-class error */
85- makelong(&byterec[OFFSET_START_CENTRAL_DIRECTORY]);
86- G.ecrec.zipfile_comment_length =
87- makeword(&byterec[ZIPFILE_COMMENT_LENGTH]);
88-+ G.ecrec.ec_start = G.real_ecrec_offset;
89-+ G.ecrec.ec_end = G.ecrec.ec_start + 22 + G.ecrec.zipfile_comment_length;
90-
91- /* Now, we have to read the archive comment, BEFORE the file pointer
92- is moved away backwards to seek for a Zip64 ECLOC64 structure.
93-diff --git a/unzpriv.h b/unzpriv.h
94-index dc9eff5..297b3c7 100644
95---- a/unzpriv.h
96-+++ b/unzpriv.h
97-@@ -2185,6 +2185,16 @@ typedef struct VMStimbuf {
98- int have_ecr64; /* valid Zip64 ecdir-record exists */
99- int is_zip64_archive; /* Zip64 ecdir-record is mandatory */
100- ush zipfile_comment_length;
101-+ zusz_t ec_start, ec_end; /* offsets of start and end of the
102-+ end of central directory record,
103-+ including if present the Zip64
104-+ end of central directory locator,
105-+ which immediately precedes the
106-+ end of central directory record */
107-+ zusz_t ec64_start, ec64_end; /* if have_ecr64 is true, then these
108-+ are the offsets of the start and
109-+ end of the Zip64 end of central
110-+ directory record */
111- } ecdir_rec;
112-
113-
+0,
-25
1@@ -1,25 +0,0 @@
2-From 5e2efcd633a4a1fb95a129a75508e7d769e767be Mon Sep 17 00:00:00 2001
3-From: Mark Adler <madler@alumni.caltech.edu>
4-Date: Sun, 9 Feb 2020 20:36:28 -0800
5-Subject: [PATCH] Fix bug in UZbunzip2() that incorrectly updated G.incnt.
6-
7-The update assumed a full buffer, which is not always full. This
8-could result in a false overlapped element detection when a small
9-bzip2-compressed file was unzipped. This commit remedies that.
10----
11- extract.c | 2 +-
12- 1 file changed, 1 insertion(+), 1 deletion(-)
13-
14-diff --git a/extract.c b/extract.c
15-index d9866f9..0cb7bfc 100644
16---- a/extract.c
17-+++ b/extract.c
18-@@ -3010,7 +3010,7 @@ __GDEF
19- #endif
20-
21- G.inptr = (uch *)bstrm.next_in;
22-- G.incnt = (G.inbuf + INBUFSIZ) - G.inptr; /* reset for other routines */
23-+ G.incnt -= G.inptr - G.inbuf; /* reset for other routines */
24-
25- uzbunzip_cleanup_exit:
26- err = BZ2_bzDecompressEnd(&bstrm);
+0,
-26
1@@ -1,26 +0,0 @@
2-From 5c572555cf5d80309a07c30cf7a54b2501493720 Mon Sep 17 00:00:00 2001
3-From: Mark Adler <madler@alumni.caltech.edu>
4-Date: Sun, 9 Feb 2020 21:39:09 -0800
5-Subject: [PATCH] Fix bug in UZinflate() that incorrectly updated G.incnt.
6-
7-The update assumed a full buffer, which is not always full. This
8-could result in a false overlapped element detection when a small
9-deflate-compressed file was unzipped using an old zlib. This
10-commit remedies that.
11----
12- inflate.c | 2 +-
13- 1 file changed, 1 insertion(+), 1 deletion(-)
14-
15-diff --git a/inflate.c b/inflate.c
16-index 2f5a015..70e3cc0 100644
17---- a/inflate.c
18-+++ b/inflate.c
19-@@ -700,7 +700,7 @@ int UZinflate(__G__ is_defl64)
20- G.dstrm.total_out));
21-
22- G.inptr = (uch *)G.dstrm.next_in;
23-- G.incnt = (G.inbuf + INBUFSIZ) - G.inptr; /* reset for other routines */
24-+ G.incnt -= G.inptr - G.inbuf; /* reset for other routines */
25-
26- uzinflate_cleanup_exit:
27- err = inflateReset(&G.dstrm);
+0,
-95
1@@ -1,95 +0,0 @@
2-From 122050bac16fae82a460ff739fb1ca0f106e9d85 Mon Sep 17 00:00:00 2001
3-From: Mark Adler <madler@alumni.caltech.edu>
4-Date: Sat, 2 Jan 2021 13:09:34 -0800
5-Subject: [PATCH] Determine Zip64 status entry-by-entry instead of for entire
6- file.
7-
8-Fixes a bug for zip files with mixed Zip64 and not Zip64 entries,
9-which resulted in an incorrect data descriptor length. The bug is
10-seen when a Zip64 entry precedes a non-Zip64 entry, in which case
11-the data descriptor would have been assumed to be larger than it
12-is, resulting in an incorrect bomb warning due to a perceived
13-overlap with the next entry. This commit determines and saves the
14-Zip64 status for each entry based on the central directory, and
15-then computes the length of each data descriptor accordingly.
16----
17- extract.c | 5 +++--
18- globals.h | 2 --
19- process.c | 4 +---
20- unzpriv.h | 1 +
21- 4 files changed, 5 insertions(+), 7 deletions(-)
22-
23-diff --git a/extract.c b/extract.c
24-index 504afd6..878817d 100644
25---- a/extract.c
26-+++ b/extract.c
27-@@ -658,6 +658,7 @@ int extract_or_test_files(__G) /* return PK-type error code */
28- break;
29- }
30- }
31-+ G.pInfo->zip64 = FALSE;
32- if ((error = do_string(__G__ G.crec.extra_field_length,
33- EXTRA_FIELD)) != 0)
34- {
35-@@ -2187,12 +2188,12 @@ static int extract_or_test_member(__G) /* return PK-type error code */
36- (clen == SIG && /* if not SIG, no signature */
37- ((G.lrec.csize & LOW) != SIG || /* if not SIG, have signature */
38- (ulen == SIG && /* if not SIG, no signature */
39-- (G.zip64 ? G.lrec.csize >> 32 : G.lrec.ucsize) != SIG
40-+ (G.pInfo->zip64 ? G.lrec.csize >> 32 : G.lrec.ucsize) != SIG
41- /* if not SIG, have signature */
42- )))))
43- /* skip four more bytes to account for signature */
44- shy += 4 - readbuf((char *)buf, 4);
45-- if (G.zip64)
46-+ if (G.pInfo->zip64)
47- shy += 8 - readbuf((char *)buf, 8); /* skip eight more for ZIP64 */
48- if (shy)
49- error = PK_ERR;
50-diff --git a/globals.h b/globals.h
51-index f9c6daf..a883c90 100644
52---- a/globals.h
53-+++ b/globals.h
54-@@ -261,8 +261,6 @@ typedef struct Globals {
55- ecdir_rec ecrec; /* used in unzip.c, extract.c */
56- z_stat statbuf; /* used by main, mapname, check_for_newer */
57-
58-- int zip64; /* true if Zip64 info in extra field */
59--
60- int mem_mode;
61- uch *outbufptr; /* extract.c static */
62- ulg outsize; /* extract.c static */
63-diff --git a/process.c b/process.c
64-index d75d405..d643c6f 100644
65---- a/process.c
66-+++ b/process.c
67-@@ -1903,8 +1903,6 @@ int getZip64Data(__G__ ef_buf, ef_len)
68- #define Z64FLGS 0xffff
69- #define Z64FLGL 0xffffffff
70-
71-- G.zip64 = FALSE;
72--
73- if (ef_len == 0 || ef_buf == NULL)
74- return PK_COOL;
75-
76-@@ -1943,7 +1941,7 @@ int getZip64Data(__G__ ef_buf, ef_len)
77- break; /* Expect only one EF_PKSZ64 block. */
78- #endif /* 0 */
79-
80-- G.zip64 = TRUE;
81-+ G.pInfo->zip64 = TRUE;
82- }
83-
84- /* Skip this extra field block. */
85-diff --git a/unzpriv.h b/unzpriv.h
86-index 09f288e..75b3359 100644
87---- a/unzpriv.h
88-+++ b/unzpriv.h
89-@@ -2034,6 +2034,7 @@ typedef struct min_info {
90- #ifdef UNICODE_SUPPORT
91- unsigned GPFIsUTF8: 1; /* crec gen_purpose_flag UTF-8 bit 11 is set */
92- #endif
93-+ unsigned zip64: 1; /* true if entry has Zip64 extra block */
94- #ifndef SFX
95- char Far *cfilname; /* central header version of filename */
96- #endif
+0,
-215
1@@ -1,215 +0,0 @@
2-From 5b44c818b96193b3e240f38f61985fa2bc780eb7 Mon Sep 17 00:00:00 2001
3-From: Jakub Martisko <jamartis@redhat.com>
4-Date: Tue, 30 Nov 2021 15:42:17 +0100
5-Subject: [PATCH] Add an option to disable the zipbomb detection
6-
7-This can be done by settting a newly introduced environment variable
8-UNZIP_DISABLE_ZIPBOMB_DETECTION to {TRUE,True,true}. If the variable is unset, or
9-set to any other value the zipbomb detection is left enabled.
10-
11-Example:
12- UNZIP_DISABLE_ZIPBOMB_DETECTION=True unzip ./zbsm.zip -d ./test
13----
14- extract.c | 85 ++++++++++++++++++++++++++++++-------------------------
15- unzip.c | 15 ++++++++--
16- unzip.h | 1 +
17- 3 files changed, 60 insertions(+), 41 deletions(-)
18-
19-diff --git a/extract.c b/extract.c
20-index 878817d..3e58071 100644
21---- a/extract.c
22-+++ b/extract.c
23-@@ -322,7 +322,8 @@ static ZCONST char Far BadExtraFieldCRC[] =
24- static ZCONST char Far NotEnoughMemCover[] =
25- "error: not enough memory for bomb detection\n";
26- static ZCONST char Far OverlappedComponents[] =
27-- "error: invalid zip file with overlapped components (possible zip bomb)\n";
28-+ "error: invalid zip file with overlapped components (possible zip bomb)\n \
29-+To unzip the file anyway, rerun the command with UNZIP_DISABLE_ZIPBOMB_DETECTION=TRUE environmnent variable\n";
30-
31-
32-
33-@@ -502,35 +503,37 @@ int extract_or_test_files(__G) /* return PK-type error code */
34- the end of central directory record (including the Zip64 end of central
35- directory locator, if present), and the Zip64 end of central directory
36- record, if present. */
37-- if (G.cover == NULL) {
38-+ if (uO.zipbomb == TRUE) {
39-+ if (G.cover == NULL) {
40- G.cover = malloc(sizeof(cover_t));
41- if (G.cover == NULL) {
42-- Info(slide, 0x401, ((char *)slide,
43-- LoadFarString(NotEnoughMemCover)));
44-- return PK_MEM;
45-+ Info(slide, 0x401, ((char *)slide,
46-+ LoadFarString(NotEnoughMemCover)));
47-+ return PK_MEM;
48- }
49- ((cover_t *)G.cover)->span = NULL;
50- ((cover_t *)G.cover)->max = 0;
51-- }
52-- ((cover_t *)G.cover)->num = 0;
53-- if (cover_add((cover_t *)G.cover,
54-- G.extra_bytes + G.ecrec.offset_start_central_directory,
55-- G.extra_bytes + G.ecrec.offset_start_central_directory +
56-- G.ecrec.size_central_directory) != 0) {
57-+ }
58-+ ((cover_t *)G.cover)->num = 0;
59-+ if (cover_add((cover_t *)G.cover,
60-+ G.extra_bytes + G.ecrec.offset_start_central_directory,
61-+ G.extra_bytes + G.ecrec.offset_start_central_directory +
62-+ G.ecrec.size_central_directory) != 0) {
63- Info(slide, 0x401, ((char *)slide,
64-- LoadFarString(NotEnoughMemCover)));
65-+ LoadFarString(NotEnoughMemCover)));
66- return PK_MEM;
67-- }
68-- if ((G.extra_bytes != 0 &&
69-- cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) ||
70-- (G.ecrec.have_ecr64 &&
71-- cover_add((cover_t *)G.cover, G.ecrec.ec64_start,
72-- G.ecrec.ec64_end) != 0) ||
73-- cover_add((cover_t *)G.cover, G.ecrec.ec_start,
74-- G.ecrec.ec_end) != 0) {
75-+ }
76-+ if ((G.extra_bytes != 0 &&
77-+ cover_add((cover_t *)G.cover, 0, G.extra_bytes) != 0) ||
78-+ (G.ecrec.have_ecr64 &&
79-+ cover_add((cover_t *)G.cover, G.ecrec.ec64_start,
80-+ G.ecrec.ec64_end) != 0) ||
81-+ cover_add((cover_t *)G.cover, G.ecrec.ec_start,
82-+ G.ecrec.ec_end) != 0) {
83- Info(slide, 0x401, ((char *)slide,
84-- LoadFarString(OverlappedComponents)));
85-+ LoadFarString(OverlappedComponents)));
86- return PK_BOMB;
87-+ }
88- }
89-
90- /*---------------------------------------------------------------------------
91-@@ -1222,10 +1225,12 @@ static int extract_or_test_entrylist(__G__ numchunk,
92-
93- /* seek_zipf(__G__ pInfo->offset); */
94- request = G.pInfo->offset + G.extra_bytes;
95-- if (cover_within((cover_t *)G.cover, request)) {
96-+ if (uO.zipbomb == TRUE) {
97-+ if (cover_within((cover_t *)G.cover, request)) {
98- Info(slide, 0x401, ((char *)slide,
99-- LoadFarString(OverlappedComponents)));
100-+ LoadFarString(OverlappedComponents)));
101- return PK_BOMB;
102-+ }
103- }
104- inbuf_offset = request % INBUFSIZ;
105- bufstart = request - inbuf_offset;
106-@@ -1758,17 +1763,19 @@ reprompt:
107- return IZ_CTRLC; /* cancel operation by user request */
108- }
109- #endif
110-- error = cover_add((cover_t *)G.cover, request,
111-- G.cur_zipfile_bufstart + (G.inptr - G.inbuf));
112-- if (error < 0) {
113-+ if (uO.zipbomb == TRUE) {
114-+ error = cover_add((cover_t *)G.cover, request,
115-+ G.cur_zipfile_bufstart + (G.inptr - G.inbuf));
116-+ if (error < 0) {
117- Info(slide, 0x401, ((char *)slide,
118-- LoadFarString(NotEnoughMemCover)));
119-+ LoadFarString(NotEnoughMemCover)));
120- return PK_MEM;
121-- }
122-- if (error != 0) {
123-+ }
124-+ if (error != 0) {
125- Info(slide, 0x401, ((char *)slide,
126-- LoadFarString(OverlappedComponents)));
127-+ LoadFarString(OverlappedComponents)));
128- return PK_BOMB;
129-+ }
130- }
131- #ifdef MACOS /* MacOS is no preemptive OS, thus call event-handling by hand */
132- UserStop();
133-@@ -2171,8 +2178,8 @@ static int extract_or_test_member(__G) /* return PK-type error code */
134- }
135-
136- undefer_input(__G);
137--
138-- if ((G.lrec.general_purpose_bit_flag & 8) != 0) {
139-+ if (uO.zipbomb == TRUE) {
140-+ if ((G.lrec.general_purpose_bit_flag & 8) != 0) {
141- /* skip over data descriptor (harder than it sounds, due to signature
142- * ambiguity)
143- */
144-@@ -2189,16 +2196,16 @@ static int extract_or_test_member(__G) /* return PK-type error code */
145- ((G.lrec.csize & LOW) != SIG || /* if not SIG, have signature */
146- (ulen == SIG && /* if not SIG, no signature */
147- (G.pInfo->zip64 ? G.lrec.csize >> 32 : G.lrec.ucsize) != SIG
148-- /* if not SIG, have signature */
149-+ /* if not SIG, have signature */
150- )))))
151-- /* skip four more bytes to account for signature */
152-- shy += 4 - readbuf((char *)buf, 4);
153-+ /* skip four more bytes to account for signature */
154-+ shy += 4 - readbuf((char *)buf, 4);
155- if (G.pInfo->zip64)
156-- shy += 8 - readbuf((char *)buf, 8); /* skip eight more for ZIP64 */
157-+ shy += 8 - readbuf((char *)buf, 8); /* skip eight more for ZIP64 */
158- if (shy)
159-- error = PK_ERR;
160-+ error = PK_ERR;
161-+ }
162- }
163--
164- return error;
165-
166- } /* end function extract_or_test_member() */
167-diff --git a/unzip.c b/unzip.c
168-index 8dbfc95..abb3644 100644
169---- a/unzip.c
170-+++ b/unzip.c
171-@@ -1329,10 +1329,9 @@ int uz_opts(__G__ pargc, pargv)
172- int *pargc;
173- char ***pargv;
174- {
175-- char **argv, *s;
176-+ char **argv, *s, *zipbomb_envar;
177- int argc, c, error=FALSE, negative=0, showhelp=0;
178-
179--
180- argc = *pargc;
181- argv = *pargv;
182-
183-@@ -1923,6 +1922,18 @@ opts_done: /* yes, very ugly...but only used by UnZipSFX with -x xlist */
184- else
185- G.extract_flag = TRUE;
186-
187-+ /* Disable the zipbomb detection, this is the only option set only via the shell variables but it should at least not clash with something in the future. */
188-+ zipbomb_envar = getenv("UNZIP_DISABLE_ZIPBOMB_DETECTION");
189-+ uO.zipbomb = TRUE;
190-+ if (zipbomb_envar != NULL) {
191-+ /* strcasecmp might be a better approach here but it is POSIX-only */
192-+ if ((strcmp ("TRUE", zipbomb_envar) == 0)
193-+ || (strcmp ("True", zipbomb_envar) == 0)
194-+ || (strcmp ("true",zipbomb_envar) == 0)) {
195-+ uO.zipbomb = FALSE;
196-+ }
197-+ }
198-+
199- *pargc = argc;
200- *pargv = argv;
201- return PK_OK;
202-diff --git a/unzip.h b/unzip.h
203-index ed24a5b..e7665e8 100644
204---- a/unzip.h
205-+++ b/unzip.h
206-@@ -559,6 +559,7 @@ typedef struct _UzpOpts {
207- #ifdef UNIX
208- int cflxflag; /* -^: allow control chars in extracted filenames */
209- #endif
210-+ int zipbomb;
211- #endif /* !FUNZIP */
212- } UzpOpts;
213-
214---
215-2.33.0
216-
+0,
-29
1@@ -1,29 +0,0 @@
2-https://versaweb.dl.sourceforge.net/project/infozip/UnZip%206.x%20%28latest%29/UnZip%206.0/unzip60.tar.gz
3-patches/08-allow-greater-hostver-values.patch
4-patches/10-unzip-handle-pkware-verify.patch
5-patches/13-remove-build-date.patch
6-patches/20-unzip-uidgid-fix.patch
7-patches/21-fix-warning-messages-on-big-files.patch
8-patches/CVE-2014-8139.patch
9-patches/CVE-2014-8140.patch
10-patches/CVE-2014-8141.patch
11-patches/CVE-2014-9636.patch
12-patches/CVE-2014-9913.patch
13-patches/CVE-2016-9844.patch
14-patches/CVE-2018-1000035.patch
15-patches/CVE-2018-18384.patch
16-patches/CVE-2021-4217.patch
17-patches/CVE-2022-0529-and-CVE-2022-0530.patch
18-patches/large-symlinks.patch
19-patches/unzip-6.0-exec-shield.patch
20-patches/unzip-6.0-format-secure.patch
21-patches/unzip-6.0-heap-overflow-infloop.patch
22-patches/unzip-6.0-timestamp.patch
23-patches/zipbomb-manpage.patch
24-patches/zipbomb-part1.patch
25-patches/zipbomb-part2.patch
26-patches/zipbomb-part3.patch
27-patches/zipbomb-part4.patch
28-patches/zipbomb-part5.patch
29-patches/zipbomb-part6.patch
30-patches/zipbomb-switch.patch
+0,
-1
1@@ -1 +0,0 @@
2-6.0 2