package/busybox/0003-g-unzip-fix-recent-breakage.patch

   1 From 6bd3fff51aa74e2ee2d87887b12182a3b09792ef Mon Sep 17 00:00:00 2001
   2 From: Denys Vlasenko <vda.linux@googlemail.com>
   3 Date: Fri, 30 Oct 2015 23:41:53 +0100
   4 Subject: [PATCH] [g]unzip: fix recent breakage.
   5
   6 Also, do emit error message we so painstakingly pass from gzip internals
   7
   8 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
   9 Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
  10 ---
  11  archival/libarchive/decompress_gunzip.c | 33 +++++++++++++++++++++------------
  12  testsuite/unzip.tests                   |  1 +
  13  2 files changed, 22 insertions(+), 12 deletions(-)
  14
  15 diff --git a/archival/libarchive/decompress_gunzip.c b/archival/libarchive/decompress_gunzip.c
  16 index 30bf451..20e4d9a 100644
  17 --- a/archival/libarchive/decompress_gunzip.c
  18 +++ b/archival/libarchive/decompress_gunzip.c
  19 @@ -309,8 +309,7 @@ static int huft_build(const unsigned *b, const unsigned n,
  20         huft_t *q;              /* points to current table */
  21         huft_t r;               /* table entry for structure assignment */
  22         huft_t *u[BMAX];        /* table stack */
  23 -       unsigned v[N_MAX];      /* values in order of bit length */
  24 -       unsigned v_end;
  25 +       unsigned v[N_MAX + 1];  /* values in order of bit length. last v[] is never used */
  26         int ws[BMAX + 1];       /* bits decoded stack */
  27         int w;                  /* bits decoded */
  28         unsigned x[BMAX + 1];   /* bit offsets, then code stack */
  29 @@ -365,15 +364,17 @@ static int huft_build(const unsigned *b, const unsigned n,
  30                 *xp++ = j;
  31         }
  32
  33 -       /* Make a table of values in order of bit lengths */
  34 +       /* Make a table of values in order of bit lengths.
  35 +        * To detect bad input, unused v[i]'s are set to invalid value UINT_MAX.
  36 +        * In particular, last v[i] is never filled and must not be accessed.
  37 +        */
  38 +       memset(v, 0xff, sizeof(v));
  39         p = b;
  40         i = 0;
  41 -       v_end = 0;
  42         do {
  43                 j = *p++;
  44                 if (j != 0) {
  45                         v[x[j]++] = i;
  46 -                       v_end = x[j];
  47                 }
  48         } while (++i < n);
  49
  50 @@ -435,7 +436,9 @@ static int huft_build(const unsigned *b, const unsigned n,
  51
  52                         /* set up table entry in r */
  53                         r.b = (unsigned char) (k - w);
  54 -                       if (p >= v + v_end) { // Was "if (p >= v + n)" but v[] can be shorter!
  55 +                       if (/*p >= v + n || -- redundant, caught by the second check: */
  56 +                           *p == UINT_MAX /* do we access uninited v[i]? (see memset(v))*/
  57 +                       ) {
  58                                 r.e = 99; /* out of values--invalid code */
  59                         } else if (*p < s) {
  60                                 r.e = (unsigned char) (*p < 256 ? 16 : 15);     /* 256 is EOB code */
  61 @@ -520,8 +523,9 @@ static NOINLINE int inflate_codes(STATE_PARAM_ONLY)
  62                 e = t->e;
  63                 if (e > 16)
  64                         do {
  65 -                               if (e == 99)
  66 -                                       abort_unzip(PASS_STATE_ONLY);;
  67 +                               if (e == 99) {
  68 +                                       abort_unzip(PASS_STATE_ONLY);
  69 +                               }
  70                                 bb >>= t->b;
  71                                 k -= t->b;
  72                                 e -= 16;
  73 @@ -557,8 +561,9 @@ static NOINLINE int inflate_codes(STATE_PARAM_ONLY)
  74                         e = t->e;
  75                         if (e > 16)
  76                                 do {
  77 -                                       if (e == 99)
  78 +                                       if (e == 99) {
  79                                                 abort_unzip(PASS_STATE_ONLY);
  80 +                                       }
  81                                         bb >>= t->b;
  82                                         k -= t->b;
  83                                         e -= 16;
  84 @@ -824,8 +829,9 @@ static int inflate_block(STATE_PARAM smallint *e)
  85
  86                 b_dynamic >>= 4;
  87                 k_dynamic -= 4;
  88 -               if (nl > 286 || nd > 30)
  89 +               if (nl > 286 || nd > 30) {
  90                         abort_unzip(PASS_STATE_ONLY);   /* bad lengths */
  91 +               }
  92
  93                 /* read in bit-length-code lengths */
  94                 for (j = 0; j < nb; j++) {
  95 @@ -906,12 +912,14 @@ static int inflate_block(STATE_PARAM smallint *e)
  96                 bl = lbits;
  97
  98                 i = huft_build(ll, nl, 257, cplens, cplext, &inflate_codes_tl, &bl);
  99 -               if (i != 0)
 100 +               if (i != 0) {
 101                         abort_unzip(PASS_STATE_ONLY);
 102 +               }
 103                 bd = dbits;
 104                 i = huft_build(ll + nl, nd, 0, cpdist, cpdext, &inflate_codes_td, &bd);
 105 -               if (i != 0)
 106 +               if (i != 0) {
 107                         abort_unzip(PASS_STATE_ONLY);
 108 +               }
 109
 110                 /* set up data for inflate_codes() */
 111                 inflate_codes_setup(PASS_STATE bl, bd);
 112 @@ -999,6 +1007,7 @@ inflate_unzip_internal(STATE_PARAM transformer_state_t *xstate)
 113         error_msg = "corrupted data";
 114         if (setjmp(error_jmp)) {
 115                 /* Error from deep inside zip machinery */
 116 +               bb_error_msg(error_msg);
 117                 n = -1;
 118                 goto ret;
 119         }
 120 diff --git a/testsuite/unzip.tests b/testsuite/unzip.tests
 121 index ca0a458..d8738a3 100755
 122 --- a/testsuite/unzip.tests
 123 +++ b/testsuite/unzip.tests
 124 @@ -34,6 +34,7 @@ rm foo.zip
 125  testing "unzip (bad archive)" "uudecode; unzip bad.zip 2>&1; echo \$?" \
 126  "Archive:  bad.zip
 127    inflating: ]3j½r«I\e\12K-%Ix
 128 +unzip: corrupted data
 129  unzip: inflate error
 130  1
 131  " \
 132 --
 133 2.6.2
 134