File CVE-2019-1000019.patch of Package libarchive.13055

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2019-1000019.patch of Package libarchive.13055

commit 65a23f5dbee4497064e9bb467f81138a62b0dae1
Author: Daniel Axtens <dja@axtens.net>
Date:   Tue Jan 1 16:01:40 2019 +1100

7zip: fix crash when parsing certain archives
    
    Fuzzing with CRCs disabled revealed that a call to get_uncompressed_data()
    would sometimes fail to return at least 'minimum' bytes. This can cause
    the crc32() invocation in header_bytes to read off into invalid memory.
    
    A specially crafted archive can use this to cause a crash.
    
    An ASAN trace is below, but ASAN is not required - an uninstrumented
    binary will also crash.
    
    ==7719==ERROR: AddressSanitizer: SEGV on unknown address 0x631000040000 (pc 0x7fbdb3b3ec1d bp 0x7ffe77a51310 sp 0x7ffe77a51150 T0)
    ==7719==The signal is caused by a READ memory access.
        #0 0x7fbdb3b3ec1c in crc32_z (/lib/x86_64-linux-gnu/libz.so.1+0x2c1c)
        #1 0x84f5eb in header_bytes (/tmp/libarchive/bsdtar+0x84f5eb)
        #2 0x856156 in read_Header (/tmp/libarchive/bsdtar+0x856156)
        #3 0x84e134 in slurp_central_directory (/tmp/libarchive/bsdtar+0x84e134)
        #4 0x849690 in archive_read_format_7zip_read_header (/tmp/libarchive/bsdtar+0x849690)
        #5 0x5713b7 in _archive_read_next_header2 (/tmp/libarchive/bsdtar+0x5713b7)
        #6 0x570e63 in _archive_read_next_header (/tmp/libarchive/bsdtar+0x570e63)
        #7 0x6f08bd in archive_read_next_header (/tmp/libarchive/bsdtar+0x6f08bd)
        #8 0x52373f in read_archive (/tmp/libarchive/bsdtar+0x52373f)
        #9 0x5257be in tar_mode_x (/tmp/libarchive/bsdtar+0x5257be)
        #10 0x51daeb in main (/tmp/libarchive/bsdtar+0x51daeb)
        #11 0x7fbdb27cab96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
        #12 0x41dd09 in _start (/tmp/libarchive/bsdtar+0x41dd09)
    
    This was primarly done with afl and FairFuzz. Some early corpus entries
    may have been generated by qsym.

Index: libarchive-3.1.2/libarchive/archive_read_support_format_7zip.c
===================================================================
--- libarchive-3.1.2.orig/libarchive/archive_read_support_format_7zip.c
+++ libarchive-3.1.2/libarchive/archive_read_support_format_7zip.c
@@ -2886,13 +2886,7 @@ get_uncompressed_data(struct archive_rea
 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
 		/* Copy mode. */
 
-		/*
-		 * Note: '1' here is a performance optimization.
-		 * Recall that the decompression layer returns a count of
-		 * available bytes; asking for more than that forces the
-		 * decompressor to combine reads by copying data.
-		 */
-		*buff = __archive_read_ahead(a, 1, &bytes_avail);
+		*buff = __archive_read_ahead(a, minimum, &bytes_avail);
 		if (bytes_avail <= 0) {
 			archive_set_error(&a->archive,
 			    ARCHIVE_ERRNO_FILE_FORMAT,

Places

File CVE-2019-1000019.patch of Package libarchive.13055

Places