1From 0bec3de89a03c7c998b755ff6091ab1e0f6c43b7 Mon Sep 17 00:00:00 2001
2From: "Steven M. Schweda" <sms@antinode.info>
3Date: Sat, 15 Jun 2019 18:13:11 -0700
4Subject: [PATCH] Fix CVE-2014-8141: out-of-bounds read issues in
5 getZip64Data()
6
7---
8 fileio.c | 9 +++++++-
9 process.c | 68 +++++++++++++++++++++++++++++++++++++++++--------------
10 2 files changed, 59 insertions(+), 18 deletions(-)
11
12diff --git a/fileio.c b/fileio.c
13index ba0a1d0..36bfea3 100644
14--- a/fileio.c
15+++ b/fileio.c
16@@ -176,6 +176,8 @@ static ZCONST char Far FilenameTooLongTrunc[] =
17 #endif
18 static ZCONST char Far ExtraFieldTooLong[] =
19 "warning: extra field too long (%d). Ignoring...\n";
20+static ZCONST char Far ExtraFieldCorrupt[] =
21+ "warning: extra field (type: 0x%04x) corrupt. Continuing...\n";
22
23 #ifdef WINDLL
24 static ZCONST char Far DiskFullQuery[] =
25@@ -2295,7 +2297,12 @@ int do_string(__G__ length, option) /* return PK-type error code */
26 if (readbuf(__G__ (char *)G.extra_field, length) == 0)
27 return PK_EOF;
28 /* Looks like here is where extra fields are read */
29- getZip64Data(__G__ G.extra_field, length);
30+ if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
31+ {
32+ Info(slide, 0x401, ((char *)slide,
33+ LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
34+ error = PK_WARN;
35+ }
36 #ifdef UNICODE_SUPPORT
37 G.unipath_filename = NULL;
38 if (G.UzO.U_flag < 2) {
39diff --git a/process.c b/process.c
40index 3228bde..df683ea 100644
41--- a/process.c
42+++ b/process.c
43@@ -1,5 +1,5 @@
44 /*
45- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
46+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
47
48 See the accompanying file LICENSE, version 2009-Jan-02 or later
49 (the contents of which are also included in unzip.h) for terms of use.
50@@ -1901,48 +1901,82 @@ int getZip64Data(__G__ ef_buf, ef_len)
51 and a 4-byte version of disk start number.
52 Sets both local header and central header fields. Not terribly clever,
53 but it means that this procedure is only called in one place.
54+
55+ 2014-12-05 SMS.
56+ Added checks to ensure that enough data are available before calling
57+ makeint64() or makelong(). Replaced various sizeof() values with
58+ simple ("4" or "8") constants. (The Zip64 structures do not depend
59+ on our variable sizes.) Error handling is crude, but we should now
60+ stay within the buffer.
61 ---------------------------------------------------------------------------*/
62
63+#define Z64FLGS 0xffff
64+#define Z64FLGL 0xffffffff
65+
66 if (ef_len == 0 || ef_buf == NULL)
67 return PK_COOL;
68
69 Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
70 ef_len));
71
72- while (ef_len >= EB_HEADSIZE) {
73+ while (ef_len >= EB_HEADSIZE)
74+ {
75 eb_id = makeword(EB_ID + ef_buf);
76 eb_len = makeword(EB_LEN + ef_buf);
77
78- if (eb_len > (ef_len - EB_HEADSIZE)) {
79- /* discovered some extra field inconsistency! */
80+ if (eb_len > (ef_len - EB_HEADSIZE))
81+ {
82+ /* Extra block length exceeds remaining extra field length. */
83 Trace((stderr,
84 "getZip64Data: block length %u > rest ef_size %u\n", eb_len,
85 ef_len - EB_HEADSIZE));
86 break;
87 }
88- if (eb_id == EF_PKSZ64) {
89-
90+ if (eb_id == EF_PKSZ64)
91+ {
92 int offset = EB_HEADSIZE;
93
94- if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
95- G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
96- offset += sizeof(G.crec.ucsize);
97+ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
98+ {
99+ if (offset+ 8 > ef_len)
100+ return PK_ERR;
101+
102+ G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
103+ offset += 8;
104 }
105- if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
106- G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
107- offset += sizeof(G.crec.csize);
108+
109+ if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
110+ {
111+ if (offset+ 8 > ef_len)
112+ return PK_ERR;
113+
114+ G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
115+ offset += 8;
116 }
117- if (G.crec.relative_offset_local_header == 0xffffffff){
118+
119+ if (G.crec.relative_offset_local_header == Z64FLGL)
120+ {
121+ if (offset+ 8 > ef_len)
122+ return PK_ERR;
123+
124 G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
125- offset += sizeof(G.crec.relative_offset_local_header);
126+ offset += 8;
127 }
128- if (G.crec.disk_number_start == 0xffff){
129+
130+ if (G.crec.disk_number_start == Z64FLGS)
131+ {
132+ if (offset+ 4 > ef_len)
133+ return PK_ERR;
134+
135 G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
136- offset += sizeof(G.crec.disk_number_start);
137+ offset += 4;
138 }
139+#if 0
140+ break; /* Expect only one EF_PKSZ64 block. */
141+#endif /* 0 */
142 }
143
144- /* Skip this extra field block */
145+ /* Skip this extra field block. */
146 ef_buf += (eb_len + EB_HEADSIZE);
147 ef_len -= (eb_len + EB_HEADSIZE);
148 }
149--
1502.20.1
151
