Bug#1142905: unzip: stack out-of-bounds NUL write in EF_SMARTZIP handler [CAN-2026-2034443]
Paul Marquess <[email protected]>
| Newsgroups | gmane.linux.debian.devel.bugs.rc |
|---|---|
| Message-ID | <AMBP190MB244283972A07C6CF33C28CC5E5CB2__11452.8534629912$1785240443$gmane$org@AMBP190MB2442.EURP190.PROD.OUTLOOK.COM> |
Your analysis of the issue is spot on. Official patch enclosed.
1142905.patch
(application/octet-stream, 937 B)
diff --git a/zipinfo.c b/zipinfo.c
index 0be3e5b..058db65 100644
--- a/zipinfo.c
+++ b/zipinfo.c
@@ -1702,9 +1702,12 @@ static int zi_long(__G__ pEndprev, error_in_archive)
if ((eb_datalen == EB_SMARTZIP_HLEN) &&
makelong(ef_ptr) == 0x70695A64 /* "dZip" */) {
char filenameBuf[32];
+ int filename_length = ef_ptr[32] ;
zi_showMacTypeCreator(__G__ &ef_ptr[4]);
memcpy(filenameBuf, &ef_ptr[33], 31);
- filenameBuf[ef_ptr[32]] = '\0';
+ if (filename_length > 31)
+ filename_length = 31;
+ filenameBuf[filename_length] = '\0';
A_TO_N(filenameBuf);
Info(slide, 0, ((char *)slide,
LoadFarString(ZipItFname), filenameBuf));