SliTaz Repositories

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/p7zip/stuff/patches/CVE-2018-5996.patch	Sat Feb 24 16:17:33 2018 +0200
     1.3 @@ -0,0 +1,221 @@
     1.4 +From: Robert Luberda <robert@debian.org>
     1.5 +Date: Sun, 28 Jan 2018 23:47:40 +0100
     1.6 +Subject: CVE-2018-5996
     1.7 +
     1.8 +Hopefully fix Memory Corruptions via RAR PPMd (CVE-2018-5996) by
     1.9 +applying a few changes from 7Zip 18.00-beta.
    1.10 +
    1.11 +Bug-Debian: https://bugs.debian.org/#888314
    1.12 +---
    1.13 + CPP/7zip/Compress/Rar1Decoder.cpp | 13 +++++++++----
    1.14 + CPP/7zip/Compress/Rar1Decoder.h   |  1 +
    1.15 + CPP/7zip/Compress/Rar2Decoder.cpp | 10 +++++++++-
    1.16 + CPP/7zip/Compress/Rar2Decoder.h   |  1 +
    1.17 + CPP/7zip/Compress/Rar3Decoder.cpp | 23 ++++++++++++++++++++---
    1.18 + CPP/7zip/Compress/Rar3Decoder.h   |  2 ++
    1.19 + 6 files changed, 42 insertions(+), 8 deletions(-)
    1.20 +
    1.21 +diff --git a/CPP/7zip/Compress/Rar1Decoder.cpp b/CPP/7zip/Compress/Rar1Decoder.cpp
    1.22 +index 1aaedcc..68030c7 100644
    1.23 +--- a/CPP/7zip/Compress/Rar1Decoder.cpp
    1.24 ++++ b/CPP/7zip/Compress/Rar1Decoder.cpp
    1.25 +@@ -29,7 +29,7 @@ public:
    1.26 + };
    1.27 + */
    1.28 + 
    1.29 +-CDecoder::CDecoder(): m_IsSolid(false) { }
    1.30 ++CDecoder::CDecoder(): m_IsSolid(false), _errorMode(false) { }
    1.31 + 
    1.32 + void CDecoder::InitStructures()
    1.33 + {
    1.34 +@@ -406,9 +406,14 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
    1.35 +   InitData();
    1.36 +   if (!m_IsSolid)
    1.37 +   {
    1.38 ++    _errorMode = false;
    1.39 +     InitStructures();
    1.40 +     InitHuff();
    1.41 +   }
    1.42 ++
    1.43 ++  if (_errorMode)
    1.44 ++    return S_FALSE;
    1.45 ++
    1.46 +   if (m_UnpackSize > 0)
    1.47 +   {
    1.48 +     GetFlagsBuf();
    1.49 +@@ -477,9 +482,9 @@ STDMETHODIMP CDecoder::Code(ISequentialInStream *inStream, ISequentialOutStream
    1.50 +     const UInt64 *inSize, const UInt64 *outSize, ICompressProgressInfo *progress)
    1.51 + {
    1.52 +   try { return CodeReal(inStream, outStream, inSize, outSize, progress); }
    1.53 +-  catch(const CInBufferException &e) { return e.ErrorCode; }
    1.54 +-  catch(const CLzOutWindowException &e) { return e.ErrorCode; }
    1.55 +-  catch(...) { return S_FALSE; }
    1.56 ++  catch(const CInBufferException &e) { _errorMode = true; return e.ErrorCode; }
    1.57 ++  catch(const CLzOutWindowException &e) { _errorMode = true; return e.ErrorCode; }
    1.58 ++  catch(...) { _errorMode = true; return S_FALSE; }
    1.59 + }
    1.60 + 
    1.61 + STDMETHODIMP CDecoder::SetDecoderProperties2(const Byte *data, UInt32 size)
    1.62 +diff --git a/CPP/7zip/Compress/Rar1Decoder.h b/CPP/7zip/Compress/Rar1Decoder.h
    1.63 +index 630f089..01b606b 100644
    1.64 +--- a/CPP/7zip/Compress/Rar1Decoder.h
    1.65 ++++ b/CPP/7zip/Compress/Rar1Decoder.h
    1.66 +@@ -39,6 +39,7 @@ public:
    1.67 + 
    1.68 +   Int64 m_UnpackSize;
    1.69 +   bool m_IsSolid;
    1.70 ++  bool _errorMode;
    1.71 + 
    1.72 +   UInt32 ReadBits(int numBits);
    1.73 +   HRESULT CopyBlock(UInt32 distance, UInt32 len);
    1.74 +diff --git a/CPP/7zip/Compress/Rar2Decoder.cpp b/CPP/7zip/Compress/Rar2Decoder.cpp
    1.75 +index b3f2b4b..0580c8d 100644
    1.76 +--- a/CPP/7zip/Compress/Rar2Decoder.cpp
    1.77 ++++ b/CPP/7zip/Compress/Rar2Decoder.cpp
    1.78 +@@ -80,7 +80,8 @@ static const UInt32 kHistorySize = 1 << 20;
    1.79 + static const UInt32 kWindowReservSize = (1 << 22) + 256;
    1.80 + 
    1.81 + CDecoder::CDecoder():
    1.82 +-  m_IsSolid(false)
    1.83 ++  m_IsSolid(false),
    1.84 ++  m_TablesOK(false)
    1.85 + {
    1.86 + }
    1.87 + 
    1.88 +@@ -100,6 +101,8 @@ UInt32 CDecoder::ReadBits(unsigned numBits) { return m_InBitStream.ReadBits(numB
    1.89 + 
    1.90 + bool CDecoder::ReadTables(void)
    1.91 + {
    1.92 ++  m_TablesOK = false;
    1.93 ++
    1.94 +   Byte levelLevels[kLevelTableSize];
    1.95 +   Byte newLevels[kMaxTableSize];
    1.96 +   m_AudioMode = (ReadBits(1) == 1);
    1.97 +@@ -170,6 +173,8 @@ bool CDecoder::ReadTables(void)
    1.98 +   }
    1.99 +   
   1.100 +   memcpy(m_LastLevels, newLevels, kMaxTableSize);
   1.101 ++  m_TablesOK = true;
   1.102 ++
   1.103 +   return true;
   1.104 + }
   1.105 + 
   1.106 +@@ -344,6 +349,9 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
   1.107 +       return S_FALSE;
   1.108 +   }
   1.109 + 
   1.110 ++  if (!m_TablesOK)
   1.111 ++    return S_FALSE;
   1.112 ++
   1.113 +   UInt64 startPos = m_OutWindowStream.GetProcessedSize();
   1.114 +   while (pos < unPackSize)
   1.115 +   {
   1.116 +diff --git a/CPP/7zip/Compress/Rar2Decoder.h b/CPP/7zip/Compress/Rar2Decoder.h
   1.117 +index 3a0535c..0e9005f 100644
   1.118 +--- a/CPP/7zip/Compress/Rar2Decoder.h
   1.119 ++++ b/CPP/7zip/Compress/Rar2Decoder.h
   1.120 +@@ -139,6 +139,7 @@ class CDecoder :
   1.121 + 
   1.122 +   UInt64 m_PackSize;
   1.123 +   bool m_IsSolid;
   1.124 ++  bool m_TablesOK;
   1.125 + 
   1.126 +   void InitStructures();
   1.127 +   UInt32 ReadBits(unsigned numBits);
   1.128 +diff --git a/CPP/7zip/Compress/Rar3Decoder.cpp b/CPP/7zip/Compress/Rar3Decoder.cpp
   1.129 +index 3bf2513..6cb8a6a 100644
   1.130 +--- a/CPP/7zip/Compress/Rar3Decoder.cpp
   1.131 ++++ b/CPP/7zip/Compress/Rar3Decoder.cpp
   1.132 +@@ -92,7 +92,8 @@ CDecoder::CDecoder():
   1.133 +   _writtenFileSize(0),
   1.134 +   _vmData(0),
   1.135 +   _vmCode(0),
   1.136 +-  m_IsSolid(false)
   1.137 ++  m_IsSolid(false),
   1.138 ++  _errorMode(false)
   1.139 + {
   1.140 +   Ppmd7_Construct(&_ppmd);
   1.141 + }
   1.142 +@@ -545,6 +546,9 @@ HRESULT CDecoder::ReadTables(bool &keepDecompressing)
   1.143 +     return InitPPM();
   1.144 +   }
   1.145 + 
   1.146 ++  TablesRead = false;
   1.147 ++  TablesOK = false;
   1.148 ++
   1.149 +   _lzMode = true;
   1.150 +   PrevAlignBits = 0;
   1.151 +   PrevAlignCount = 0;
   1.152 +@@ -606,6 +610,9 @@ HRESULT CDecoder::ReadTables(bool &keepDecompressing)
   1.153 +       }
   1.154 +     }
   1.155 +   }
   1.156 ++  if (InputEofError())
   1.157 ++    return S_FALSE;
   1.158 ++
   1.159 +   TablesRead = true;
   1.160 + 
   1.161 +   // original code has check here:
   1.162 +@@ -623,6 +630,9 @@ HRESULT CDecoder::ReadTables(bool &keepDecompressing)
   1.163 +   RIF(m_LenDecoder.Build(&newLevels[kMainTableSize + kDistTableSize + kAlignTableSize]));
   1.164 + 
   1.165 +   memcpy(m_LastLevels, newLevels, kTablesSizesSum);
   1.166 ++
   1.167 ++  TablesOK = true;
   1.168 ++
   1.169 +   return S_OK;
   1.170 + }
   1.171 + 
   1.172 +@@ -824,7 +834,12 @@ HRESULT CDecoder::CodeReal(ICompressProgressInfo *progress)
   1.173 +     PpmEscChar = 2;
   1.174 +     PpmError = true;
   1.175 +     InitFilters();
   1.176 ++    _errorMode = false;
   1.177 +   }
   1.178 ++
   1.179 ++  if (_errorMode)
   1.180 ++    return S_FALSE;
   1.181 ++
   1.182 +   if (!m_IsSolid || !TablesRead)
   1.183 +   {
   1.184 +     bool keepDecompressing;
   1.185 +@@ -838,6 +853,8 @@ HRESULT CDecoder::CodeReal(ICompressProgressInfo *progress)
   1.186 +     bool keepDecompressing;
   1.187 +     if (_lzMode)
   1.188 +     {
   1.189 ++      if (!TablesOK)
   1.190 ++        return S_FALSE;
   1.191 +       RINOK(DecodeLZ(keepDecompressing))
   1.192 +     }
   1.193 +     else
   1.194 +@@ -901,8 +918,8 @@ STDMETHODIMP CDecoder::Code(ISequentialInStream *inStream, ISequentialOutStream
   1.195 +     _unpackSize = outSize ? *outSize : (UInt64)(Int64)-1;
   1.196 +     return CodeReal(progress);
   1.197 +   }
   1.198 +-  catch(const CInBufferException &e)  { return e.ErrorCode; }
   1.199 +-  catch(...) { return S_FALSE; }
   1.200 ++  catch(const CInBufferException &e)  { _errorMode = true; return e.ErrorCode; }
   1.201 ++  catch(...) { _errorMode = true; return S_FALSE; }
   1.202 +   // CNewException is possible here. But probably CNewException is caused
   1.203 +   // by error in data stream.
   1.204 + }
   1.205 +diff --git a/CPP/7zip/Compress/Rar3Decoder.h b/CPP/7zip/Compress/Rar3Decoder.h
   1.206 +index c130cec..2f72d7d 100644
   1.207 +--- a/CPP/7zip/Compress/Rar3Decoder.h
   1.208 ++++ b/CPP/7zip/Compress/Rar3Decoder.h
   1.209 +@@ -192,6 +192,7 @@ class CDecoder:
   1.210 +   UInt32 _lastFilter;
   1.211 + 
   1.212 +   bool m_IsSolid;
   1.213 ++  bool _errorMode;
   1.214 + 
   1.215 +   bool _lzMode;
   1.216 +   bool _unsupportedFilter;
   1.217 +@@ -200,6 +201,7 @@ class CDecoder:
   1.218 +   UInt32 PrevAlignCount;
   1.219 + 
   1.220 +   bool TablesRead;
   1.221 ++  bool TablesOK;
   1.222 + 
   1.223 +   CPpmd7 _ppmd;
   1.224 +   int PpmEscChar;