| From: "Steven M. Schweda" <sms@antinode.info> |
| Subject: Fix CVE-2014-9913, buffer overflow in unzip |
| Bug: https://sourceforge.net/p/infozip/bugs/27/ |
| Bug-Debian: https://bugs.debian.org/847485 |
| Bug-Ubuntu: https://launchpad.net/bugs/387350 |
| X-Debian-version: 6.0-21 |
| |
| Upstream-Status: Backport |
| CVE: CVE-2014-9913 |
| Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> |
| |
| --- a/list.c |
| +++ b/list.c |
| @@ -339,7 +339,18 @@ |
| G.crec.compression_method == ENHDEFLATED) { |
| methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3]; |
| } else if (methnum >= NUM_METHODS) { |
| - sprintf(&methbuf[4], "%03u", G.crec.compression_method); |
| + /* 2013-02-26 SMS. |
| + * http://sourceforge.net/p/infozip/bugs/27/ CVE-2014-9913. |
| + * Unexpectedly large compression methods overflow |
| + * &methbuf[]. Use the old, three-digit decimal format |
| + * for values which fit. Otherwise, sacrifice the |
| + * colon, and use four-digit hexadecimal. |
| + */ |
| + if (G.crec.compression_method <= 999) { |
| + sprintf( &methbuf[ 4], "%03u", G.crec.compression_method); |
| + } else { |
| + sprintf( &methbuf[ 3], "%04X", G.crec.compression_method); |
| + } |
| } |
| |
| #if 0 /* GRR/Euro: add this? */ |