File zziplib-CVE-2017-5976.patch of Package zziplib

Overview Repositories Revisions Requests Users Attributes Meta

File zziplib-CVE-2017-5976.patch of Package zziplib

Index: zziplib-0.13.62/zzip/memdisk.c
===================================================================
--- zziplib-0.13.62.orig/zzip/memdisk.c
+++ zziplib-0.13.62/zzip/memdisk.c
@@ -201,6 +201,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
         {
             void *mem = malloc(ext1 + 2);
             item->zz_ext[1] = mem;
+	    item->zz_extlen[1] = ext1 + 2;
             memcpy(mem, ptr1, ext1);
             ((char *) (mem))[ext1 + 0] = 0;
             ((char *) (mem))[ext1 + 1] = 0;
@@ -209,6 +210,7 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZI
         {
             void *mem = malloc(ext2 + 2);
             item->zz_ext[2] = mem;
+	    item->zz_extlen[2] = ext2 + 2;
             memcpy(mem, ptr2, ext2);
             ((char *) (mem))[ext2 + 0] = 0;
             ((char *) (mem))[ext2 + 1] = 0;
@@ -245,8 +247,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
     while (1)
     {
         ZZIP_EXTRA_BLOCK *ext = entry->zz_ext[i];
-        if (ext)
+        if (ext && (entry->zz_extlen[i] >= zzip_extra_block_headerlength))
         {
+	    char *endblock = (char *)ext + entry->zz_extlen[i];
+
             while (*(short *) (ext->z_datatype))
             {
                 if (datatype == zzip_extra_block_get_datatype(ext))
@@ -257,6 +261,10 @@ zzip_mem_entry_extra_block(ZZIP_MEM_ENTR
                 e += zzip_extra_block_headerlength;
                 e += zzip_extra_block_get_datasize(ext);
                 ext = (void *) e;
+		if (e >= endblock)
+		{
+		    break;
+		}
                 ____;
             }
         }
Index: zziplib-0.13.62/zzip/memdisk.h
===================================================================
--- zziplib-0.13.62.orig/zzip/memdisk.h
+++ zziplib-0.13.62/zzip/memdisk.h
@@ -66,6 +66,7 @@ struct _zzip_mem_entry {
     int              zz_filetype;  /* (from "z_filetype") */
     char*            zz_comment;   /* zero-terminated (from "comment") */
     ZZIP_EXTRA_BLOCK* zz_ext[3];   /* terminated by null in z_datatype */
+    int              zz_extlen[3]; /* length of zz_ext[i] in bytes */
 };                                 /* the extra blocks are NOT converted */
 
 #define _zzip_mem_disk_findfirst(_d_) ((_d_)->list)

Places

File zziplib-CVE-2017-5976.patch of Package zziplib

Places