开源软件构建与测试

Changes of Revision 3

_service:tar_scm:zziplib.spec Changed

@@ -1,11 +1,14 @@
 Name:            zziplib
 Version:         0.13.74
-Release:         1
+Release:         3
 Summary:         Lightweight library for zip compression
 License:         LGPLv2+ or MPLv1.1
 URL:             http://zziplib.sourceforge.net
 Source0:         https://github.com/gdraheim/zziplib/archive/refs/tags/v0.13.74.tar.gz
 
+Patch0001:       fix-CVE-2024-39134.patch
+Patch0002:       fix-CVE-2024-39133.patch
+
 BuildRequires:   perl-interpreter  zip xmlto
 BuildRequires:   zlib-devel SDL-devel pkgconfig autoconf automake gcc make
 BuildRequires:   cmake
@@ -38,7 +41,7 @@
 This package includes help documentation and manuals related to zziplib.
 
 %prep
-%setup -q
+%autosetup -p1 -n %{name}-%{version}
 
 %build
 %cmake -B "%{_vpath_builddir}" -DZZIP_TESTCVE=OFF
@@ -69,6 +72,12 @@
 %{_mandir}/man3/*
 
 %changelog
+* Mon Aug 12 2024 baiguo <baiguo@kylinos.cn> - 0.13.74-3
+- fix CVE-2024-39133
+
+* Fri Aug 9 2024 baiguo <baiguo@kylinos.cn> - 0.13.74-2
+- fix CVE-2024-39134
+
 * Tue Jul  9 2024 dillon chen <dillon.chen@gmail.com> - 0.13.74-1
 - update to 0.13.74

_service:tar_scm:fix-CVE-2024-39133.patch Added

@@ -0,0 +1,31 @@
+From 550e30e76a550d933fe72fc14209403c48d5f5bf Mon Sep 17 00:00:00 2001
+From: vlefebvre <valentin.lefebvre@suse.com>
+Date: Tue, 6 Aug 2024 16:01:02 +0200
+Subject: PATCH parse_root_dir: Verify size of extra obtained
+Reference:https://github.com/keentux/zziplib/commit/550e30e76a550d933fe72fc14209403c48d5f5bf
+
+* Fix the issue #164 where extra_ptr could be alocated without enough
+  bytes to check the magic value.
+
+Signed-off-by: vlefebvre <valentin.lefebvre@suse.com>
+---
+ zzip/zip.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/zzip/zip.c b/zzip/zip.c
+index 56b5966..d4c447e 100644
+--- a/zzip/zip.c
++++ b/zzip/zip.c
+@@ -524,7 +524,8 @@ __zzip_parse_root_directory(int fd, struct _disk_trailer* trailer, struct zzip_d
+         hdr->d_namlen         = u_namlen;
+ 
+         /* looking for ZIP64 extras when csize on intmax */
+-        if (u_extras && (hdr->d_csize & 0xFFFFu == 0xFFFFu)) {
++        if (u_extras >= __sizeof(struct zzip_extra_zip64) &&
++            (hdr->d_csize & 0xFFFFu == 0xFFFFu)) {
+             DBG3("%i extras bytes (%i)", u_extras, sizeof(struct zzip_extra_zip64));
+             zzip_off64_t zz_extras = zz_offset + sizeof(*d) + u_namlen;
+             zzip_byte_t* extras_ptr;
+-- 
+2.27.0
+

_service:tar_scm:fix-CVE-2024-39134.patch Added

@@ -0,0 +1,39 @@
+From 2a84ae73e93b0c1f4f12f2c58104f8327d10e41b Mon Sep 17 00:00:00 2001
+From: vlefebvre <valentin.lefebvre@suse.com>
+Date: Wed, 7 Aug 2024 11:10:05 +0200
+Subject: PATCH fetch_disk_trailer: Don't truncate the size verif
+Reference:https://github.com/gdraheim/zziplib/commit/2a84ae73e93b0c1f4f12f2c58104f8327d10e41b
+* We must check if the tail obtained have the size of the zzip_disk_trailer
+  struct. end - tail should be at least >= of the size but not size - 2.
+  Where truncated by 2 was good for pre-C99 compilers.
+* Fix gdraheim#165
+
+---
+ zzip/zip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/zzip/zip.c b/zzip/zip.c
+index b5b8be0..56b5966 100644
+--- a/zzip/zip.c
++++ b/zzip/zip.c
+@@ -291,7 +291,7 @@ __zzip_fetch_disk_trailer(int fd, zzip_off_t filesize, struct _disk_trailer* _zz
+             register unsigned char* tail;
+             for (tail = end - 1; (tail >= mapped); tail--) {
+                 if ((*tail == 'P') && /* quick pre-check for trailer magic */
+-                    end - tail >= __sizeof(struct zzip_disk_trailer) - 2 &&
++                    end - tail >= __sizeof(struct zzip_disk_trailer) &&
+                     zzip_disk_trailer_check_magic(tail)) {
+ #ifndef ZZIP_DISK64_TRAILER
+                     /* if the file-comment is not present, it happens
+@@ -327,7 +327,7 @@ __zzip_fetch_disk_trailer(int fd, zzip_off_t filesize, struct _disk_trailer* _zz
+                         return (0);
+                     }
+                 }
+-                else if ((*tail == 'P') && end - tail >= __sizeof(struct zzip_disk64_trailer) - 2 &&
++                else if ((*tail == 'P') && end - tail >= __sizeof(struct zzip_disk64_trailer) &&				
+                          zzip_disk64_trailer_check_magic(tail)) {
+ #ifndef ZZIP_DISK64_TRAILER
+                     return (ZZIP_DIR_LARGEFILE);
+-- 
+2.27.0
+