diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/compression.scm | 1 | ||||
| -rw-r--r-- | gnu/packages/patches/libzip-CVE-2017-12858.patch | 45 |
3 files changed, 47 insertions, 0 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index b2d85a5425..2ff87dfa5c 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -807,6 +807,7 @@ dist_patch_DATA = \ %D%/packages/patches/libxslt-generated-ids.patch \ %D%/packages/patches/libxslt-CVE-2016-4738.patch \ %D%/packages/patches/libxt-guix-search-paths.patch \ + %D%/packages/patches/libzip-CVE-2017-12858.patch \ %D%/packages/patches/lierolibre-check-unaligned-access.patch \ %D%/packages/patches/lierolibre-is-free-software.patch \ %D%/packages/patches/lierolibre-newer-libconfig.patch \ diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm index 0a97ba7e60..4e316e0b5a 100644 --- a/gnu/packages/compression.scm +++ b/gnu/packages/compression.scm @@ -1525,6 +1525,7 @@ manipulate, read, and write Zip archive files.") (method url-fetch) (uri (string-append "https://nih.at/libzip/libzip-" version ".tar.gz")) + (patches (search-patches "libzip-CVE-2017-12858.patch")) (sha256 (base32 "17vxj2ffsxwh8lkc6801ppmwj15jp8q58rin76znxfbx88789ybc")))) diff --git a/gnu/packages/patches/libzip-CVE-2017-12858.patch b/gnu/packages/patches/libzip-CVE-2017-12858.patch new file mode 100644 index 0000000000..8125173f95 --- /dev/null +++ b/gnu/packages/patches/libzip-CVE-2017-12858.patch @@ -0,0 +1,45 @@ +Fix CVE-2017-12858: + +http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12858 + +Patch copied from upstream source repository: + +https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796 + +From 2217022b7d1142738656d891e00b3d2d9179b796 Mon Sep 17 00:00:00 2001 +From: Thomas Klausner <tk@giga.or.at> +Date: Mon, 14 Aug 2017 10:55:44 +0200 +Subject: [PATCH] Fix double free(). + +Found by Brian 'geeknik' Carpenter using AFL. +--- + THANKS | 1 + + lib/zip_dirent.c | 3 --- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/THANKS b/THANKS +index be0cca9..a80ee1d 100644 +--- a/THANKS ++++ b/THANKS +@@ -12,6 +12,7 @@ BALATON Zoltan <balaton@eik.bme.hu> + Benjamin Gilbert <bgilbert@backtick.net> + Boaz Stolk <bstolk@aweta.nl> + Bogdan <bogiebog@gmail.com> ++Brian 'geeknik' Carpenter <geeknik@protonmail.ch> + Chris Nehren <cnehren+libzip@pobox.com> + Coverity <info@coverity.com> + Dane Springmeyer <dane.springmeyer@gmail.com> +diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c +index a369900..e5a7cc9 100644 +--- a/lib/zip_dirent.c ++++ b/lib/zip_dirent.c +@@ -579,9 +579,6 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo + } + + if (!_zip_dirent_process_winzip_aes(zde, error)) { +- if (!from_buffer) { +- _zip_buffer_free(buffer); +- } + return -1; + } + |