diff options
| author | Zach van Rijn <me@zv.io> | 2023-12-26 13:25:16 -0800 |
|---|---|---|
| committer | Zach van Rijn <me@zv.io> | 2024-01-09 05:35:37 -0800 |
| commit | 032425ed03d7a3a1309523d7ddb41142b2569604 (patch) | |
| tree | bd186a85e70f146bd895248874c49d97763643e7 | |
| parent | 3e5b843d44a57e91dc19a6a775e8820e40e29a31 (diff) | |
| download | packages-032425ed03d7a3a1309523d7ddb41142b2569604.tar.gz packages-032425ed03d7a3a1309523d7ddb41142b2569604.tar.bz2 packages-032425ed03d7a3a1309523d7ddb41142b2569604.tar.xz packages-032425ed03d7a3a1309523d7ddb41142b2569604.zip | |
user/minizip: bump { 1.2.13 --> 1.3 }. patch CVE. fixes #1161.
| -rw-r--r-- | user/minizip/APKBUILD | 10 | ||||
| -rw-r--r-- | user/minizip/CVE-2023-45853.patch | 40 |
2 files changed, 46 insertions, 4 deletions
diff --git a/user/minizip/APKBUILD b/user/minizip/APKBUILD index c9257b909..b7de2ee8b 100644 --- a/user/minizip/APKBUILD +++ b/user/minizip/APKBUILD @@ -1,7 +1,7 @@ # Contributor: A. Wilcox <awilfox@adelielinux.org> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=minizip -pkgver=1.2.13 +pkgver=1.3 pkgrel=0 pkgdesc="Miniature ZIP archive manipulation library" url="https://zlib.net" @@ -10,7 +10,9 @@ license="zlib" depends="" makedepends="autoconf automake libtool zlib-dev" subpackages="$pkgname-dev" -source="https://zlib.net/zlib-$pkgver.tar.gz" +source="https://zlib.net/zlib-$pkgver.tar.gz + CVE-2023-45853.patch + " builddir="$srcdir"/zlib-$pkgver/contrib/minizip prepare() { @@ -32,5 +34,5 @@ check() { package() { make DESTDIR="$pkgdir" install } - -sha512sums="99f0e843f52290e6950cc328820c0f322a4d934a504f66c7caa76bd0cc17ece4bf0546424fc95135de85a2656fed5115abb835fd8d8a390d60ffaf946c8887ad zlib-1.2.13.tar.gz" +sha512sums="185795044461cd78a5545250e06f6efdb0556e8d1bfe44e657b509dd6f00ba8892c8eb3febe65f79ee0b192d6af857f0e0055326d33a881449f3833f92e5f8fb zlib-1.3.tar.gz +06bb69fe70c3ad7b11e0cf43ff4f7e631010ccc9d74e736d2106d6bf7b4b0934da7c695011757b57511d176a2cf0b4955b854bb8e78a196abcf2792c40e9cea1 CVE-2023-45853.patch" diff --git a/user/minizip/CVE-2023-45853.patch b/user/minizip/CVE-2023-45853.patch new file mode 100644 index 000000000..66dfd5707 --- /dev/null +++ b/user/minizip/CVE-2023-45853.patch @@ -0,0 +1,40 @@ +This patch differs from upstream in the following way(s): + +* Paths changed to accommodate 'builddir' + +From 73331a6a0481067628f065ffe87bb1d8f787d10c Mon Sep 17 00:00:00 2001 +From: Hans Wennborg <hans@chromium.org> +Date: Fri, 18 Aug 2023 11:05:33 +0200 +Subject: [PATCH] Reject overflows of zip header fields in minizip. + +This checks the lengths of the file name, extra field, and comment +that would be put in the zip headers, and rejects them if they are +too long. They are each limited to 65535 bytes in length by the zip +format. This also avoids possible buffer overflows if the provided +fields are too long. +--- + contrib/minizip/zip.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c +index 3d3d4cadd..0446109b2 100644 +--- a/zip.c ++++ b/zip.c +@@ -1043,6 +1043,17 @@ extern int ZEXPORT zipOpenNewFileInZip4_64(zipFile file, const char* filename, c + return ZIP_PARAMERROR; + #endif + ++ // The filename and comment length must fit in 16 bits. ++ if ((filename!=NULL) && (strlen(filename)>0xffff)) ++ return ZIP_PARAMERROR; ++ if ((comment!=NULL) && (strlen(comment)>0xffff)) ++ return ZIP_PARAMERROR; ++ // The extra field length must fit in 16 bits. If the member also requires ++ // a Zip64 extra block, that will also need to fit within that 16-bit ++ // length, but that will be checked for later. ++ if ((size_extrafield_local>0xffff) || (size_extrafield_global>0xffff)) ++ return ZIP_PARAMERROR; ++ + zi = (zip64_internal*)file; + + if (zi->in_opened_file_inzip == 1) |