summaryrefslogtreecommitdiff
path: root/user/minizip
diff options
context:
space:
mode:
authorZach van Rijn <me@zv.io>2023-12-26 13:25:16 -0800
committerZach van Rijn <me@zv.io>2024-01-09 05:35:37 -0800
commit032425ed03d7a3a1309523d7ddb41142b2569604 (patch)
treebd186a85e70f146bd895248874c49d97763643e7 /user/minizip
parent3e5b843d44a57e91dc19a6a775e8820e40e29a31 (diff)
downloadpackages-032425ed03d7a3a1309523d7ddb41142b2569604.tar.gz
packages-032425ed03d7a3a1309523d7ddb41142b2569604.tar.bz2
packages-032425ed03d7a3a1309523d7ddb41142b2569604.tar.xz
packages-032425ed03d7a3a1309523d7ddb41142b2569604.zip
user/minizip: bump { 1.2.13 --> 1.3 }. patch CVE. fixes #1161.
Diffstat (limited to 'user/minizip')
-rw-r--r--user/minizip/APKBUILD10
-rw-r--r--user/minizip/CVE-2023-45853.patch40
2 files changed, 46 insertions, 4 deletions
diff --git a/user/minizip/APKBUILD b/user/minizip/APKBUILD
index c9257b909..b7de2ee8b 100644
--- a/user/minizip/APKBUILD
+++ b/user/minizip/APKBUILD
@@ -1,7 +1,7 @@
# Contributor: A. Wilcox <awilfox@adelielinux.org>
# Maintainer: A. Wilcox <awilfox@adelielinux.org>
pkgname=minizip
-pkgver=1.2.13
+pkgver=1.3
pkgrel=0
pkgdesc="Miniature ZIP archive manipulation library"
url="https://zlib.net"
@@ -10,7 +10,9 @@ license="zlib"
depends=""
makedepends="autoconf automake libtool zlib-dev"
subpackages="$pkgname-dev"
-source="https://zlib.net/zlib-$pkgver.tar.gz"
+source="https://zlib.net/zlib-$pkgver.tar.gz
+ CVE-2023-45853.patch
+ "
builddir="$srcdir"/zlib-$pkgver/contrib/minizip
prepare() {
@@ -32,5 +34,5 @@ check() {
package() {
make DESTDIR="$pkgdir" install
}
-
-sha512sums="99f0e843f52290e6950cc328820c0f322a4d934a504f66c7caa76bd0cc17ece4bf0546424fc95135de85a2656fed5115abb835fd8d8a390d60ffaf946c8887ad zlib-1.2.13.tar.gz"
+sha512sums="185795044461cd78a5545250e06f6efdb0556e8d1bfe44e657b509dd6f00ba8892c8eb3febe65f79ee0b192d6af857f0e0055326d33a881449f3833f92e5f8fb zlib-1.3.tar.gz
+06bb69fe70c3ad7b11e0cf43ff4f7e631010ccc9d74e736d2106d6bf7b4b0934da7c695011757b57511d176a2cf0b4955b854bb8e78a196abcf2792c40e9cea1 CVE-2023-45853.patch"
diff --git a/user/minizip/CVE-2023-45853.patch b/user/minizip/CVE-2023-45853.patch
new file mode 100644
index 000000000..66dfd5707
--- /dev/null
+++ b/user/minizip/CVE-2023-45853.patch
@@ -0,0 +1,40 @@
+This patch differs from upstream in the following way(s):
+
+* Paths changed to accommodate 'builddir'
+
+From 73331a6a0481067628f065ffe87bb1d8f787d10c Mon Sep 17 00:00:00 2001
+From: Hans Wennborg <hans@chromium.org>
+Date: Fri, 18 Aug 2023 11:05:33 +0200
+Subject: [PATCH] Reject overflows of zip header fields in minizip.
+
+This checks the lengths of the file name, extra field, and comment
+that would be put in the zip headers, and rejects them if they are
+too long. They are each limited to 65535 bytes in length by the zip
+format. This also avoids possible buffer overflows if the provided
+fields are too long.
+---
+ contrib/minizip/zip.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c
+index 3d3d4cadd..0446109b2 100644
+--- a/zip.c
++++ b/zip.c
+@@ -1043,6 +1043,17 @@ extern int ZEXPORT zipOpenNewFileInZip4_64(zipFile file, const char* filename, c
+ return ZIP_PARAMERROR;
+ #endif
+
++ // The filename and comment length must fit in 16 bits.
++ if ((filename!=NULL) && (strlen(filename)>0xffff))
++ return ZIP_PARAMERROR;
++ if ((comment!=NULL) && (strlen(comment)>0xffff))
++ return ZIP_PARAMERROR;
++ // The extra field length must fit in 16 bits. If the member also requires
++ // a Zip64 extra block, that will also need to fit within that 16-bit
++ // length, but that will be checked for later.
++ if ((size_extrafield_local>0xffff) || (size_extrafield_global>0xffff))
++ return ZIP_PARAMERROR;
++
+ zi = (zip64_internal*)file;
+
+ if (zi->in_opened_file_inzip == 1)