gnu/packages/patches/libarchive-CVE-2018-1000877.patch

   1 Fix CVE-2018-1000877:
   2
   3 https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909
   4 https://github.com/libarchive/libarchive/pull/1105
   5 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000877
   6 https://security-tracker.debian.org/tracker/CVE-2018-1000877
   7
   8 Patch copied from upstream source repository:
   9
  10 https://github.com/libarchive/libarchive/commit/021efa522ad729ff0f5806c4ce53e4a6cc1daa31
  11
  12 From 021efa522ad729ff0f5806c4ce53e4a6cc1daa31 Mon Sep 17 00:00:00 2001
  13 From: Daniel Axtens <dja@axtens.net>
  14 Date: Tue, 20 Nov 2018 17:56:29 +1100
  15 Subject: [PATCH] Avoid a double-free when a window size of 0 is specified
  16
  17 new_size can be 0 with a malicious or corrupted RAR archive.
  18
  19 realloc(area, 0) is equivalent to free(area), so the region would
  20 be free()d here and the free()d again in the cleanup function.
  21
  22 Found with a setup running AFL, afl-rb, and qsym.
  23 ---
  24  libarchive/archive_read_support_format_rar.c | 5 +++++
  25  1 file changed, 5 insertions(+)
  26
  27 diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
  28 index 23452222..6f419c27 100644
  29 --- a/libarchive/archive_read_support_format_rar.c
  30 +++ b/libarchive/archive_read_support_format_rar.c
  31 @@ -2300,6 +2300,11 @@ parse_codes(struct archive_read *a)
  32        new_size = DICTIONARY_MAX_SIZE;
  33      else
  34        new_size = rar_fls((unsigned int)rar->unp_size) << 1;
  35 +    if (new_size == 0) {
  36 +      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
  37 +                        "Zero window size is invalid.");
  38 +      return (ARCHIVE_FATAL);
  39 +    }
  40      new_window = realloc(rar->lzss.window, new_size);
  41      if (new_window == NULL) {
  42        archive_set_error(&a->archive, ENOMEM,
  43 --
  44 2.20.1
  45