Commit d6fd3b37 authored by Robert Luberda's avatar Robert Luberda
Browse files

Update patch for CVE-2017-17969 

Replace 13-CVE-2017-17969.patch with a version used by recent security
update for stretch, which add a range check for another counter variable
parent 06e056de

debian/changelog

+7 −0
Original line number Diff line number Diff line 
p7zip (16.02+dfsg-6) unstable; urgency=medium



  * Replace 13-CVE-2017-17969.patch with a version used by recent security

    update for stretch, which add a range check for another counter variable.



 -- Robert Luberda <robert@debian.org>  Mon, 05 Feb 2018 20:27:45 +0100



p7zip (16.02+dfsg-5) unstable; urgency=medium



  * Hopefully fix ZIP Shrink: Heap Buffer Overflow (CVE-2017-17969). Thanks

debian/patches/09-man-update.patch

+2 −2
Original line number Diff line number Diff line
@@ -24,7 +24,7 @@ Bug-Debian: https://bugs.debian.org/636667 
 3 files changed, 426 insertions(+), 139 deletions(-)



diff --git a/man1/7z.1 b/man1/7z.1

index d2b7378..72e262b 100644

index d2b7378..fd39157 100644

--- a/man1/7z.1

+++ b/man1/7z.1

@@ -1,97 +1,187 @@
@@ -301,7 +301,7 @@ index d2b7378..72e262b 100644 
-Written for Debian by Mohammed Adnene Trojette.

+Written for Debian by Mohammed Adnene Trojette. Updated by Robert Luberda.

diff --git a/man1/7za.1 b/man1/7za.1

index ae5730b..218e245 100644

index ae5730b..b553f84 100644

--- a/man1/7za.1

+++ b/man1/7za.1

@@ -1,99 +1,190 @@

debian/patches/13-CVE-2017-17969.patch

+18 −9
Original line number Diff line number Diff line 
From: =?utf-8?q?Antoine_Beaupr=C3=A9?= <anarcat@debian.org>

Date: Sun, 28 Jan 2018 21:19:50 +0100

Subject: backport of the CVE-2017-17969 fix from 7zip 18.00-beta

Date: Fri, 2 Feb 2018 11:11:41 +0100

Subject: Heap-based buffer overflow in 7zip/Compress/ShrinkDecoder.cpp



Origin: vendor, https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/27d7/attachment/CVE-2017-17969.patch

Forwarded: https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/#27d7

Bug: https://sourceforge.net/p/p7zip/bugs/204/

Bug-Debian: https://bugs.debian.org/888297

Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-17969

Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>

Last-Update: 2018-02-01

Applied-Upstream: 18.00-beta

---

 CPP/7zip/Compress/ShrinkDecoder.cpp | 7 ++++++-

 1 file changed, 6 insertions(+), 1 deletion(-)



diff --git a/CPP/7zip/Compress/ShrinkDecoder.cpp b/CPP/7zip/Compress/ShrinkDecoder.cpp

index 80b7e67..4acdce5 100644

index 80b7e67..ca37764 100644

--- a/CPP/7zip/Compress/ShrinkDecoder.cpp

+++ b/CPP/7zip/Compress/ShrinkDecoder.cpp

@@ -121,7 +121,12 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *

@@ -121,8 +121,13 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *

     {

       _stack[i++] = _suffixes[cur];

       cur = _parents[cur];

-    }

+      if (i >= kNumItems)

+      if (cur >= kNumItems || i >= kNumItems)

+        break;

+     }

     }

-    

+

+    if (i >= kNumItems)

+    if (cur >= kNumItems || i >= kNumItems)

+      break;

     

+

     _stack[i++] = (Byte)cur;

     lastChar2 = (Byte)cur;