lzip/zutils
1
0
Fork 0
Code Issues Activity

Adding patch from upstream to fix a buffer overrun in zcat [CVE-2018-1000637] (Closes: #902936).

Browse source 
Signed-off-by: Daniel Baumann <daniel@debian.org>
This commit is contained in:
Daniel Baumann 2025-02-24 06:08:28 +01:00
parent 454cd28d9e
commit 4a058e46d6
Signed by: daniel
GPG key ID: FBB4F0E80A80222F
2 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
debian/patches/0003-zcat-buffer-overrun.patch vendored Normal file
View file

@ -0,0 +1,18 @@
Author: Antonio Diaz-Diaz <antonio@gnu.org>
Description: zcat.cc: Fixed a buffer overrun on outbuf when '-v' is used [CVE-2018-1000637] (Closes: #902936).
diff -Naurp zutils.orig/zcat.cc zutils/zcat.cc
--- zutils.orig/zcat.cc
+++ zutils/zcat.cc
@@ -229,8 +229,9 @@ int cat( int infd, const int format_inde
enum { buffer_size = 4096 };
// buffer with space for sentinel newline at the end
uint8_t * const inbuf = new uint8_t[buffer_size+1];
- // buffer with space for character quoting and 255-digit line number
- uint8_t * const outbuf = new uint8_t[(4*buffer_size)+256];
+ // buffer with space for character quoting, 255-digit line number and
+ // worst case flushing respect to inbuf.
+ uint8_t * const outbuf = new uint8_t[(5*buffer_size)+256];
int retval = 0;
Children children;
if( !set_data_feeder( &infd, children, format_index ) ) retval = 1;

1
debian/patches/series vendored
View file

@ -1,2 +1,3 @@
0001-build.patch 0001-build.patch
0002-zupdate.patch 0002-zupdate.patch
0003-zcat-buffer-overrun.patch