From owner-svn-ports-all@freebsd.org Wed Sep 27 16:53:53 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0FDADE08FD4; Wed, 27 Sep 2017 16:53:53 +0000 (UTC) (envelope-from rakuco@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id D2CD87E9E6; Wed, 27 Sep 2017 16:53:52 +0000 (UTC) (envelope-from rakuco@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v8RGrpWL049750; Wed, 27 Sep 2017 16:53:51 GMT (envelope-from rakuco@FreeBSD.org) Received: (from rakuco@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v8RGrpIH049748; Wed, 27 Sep 2017 16:53:51 GMT (envelope-from rakuco@FreeBSD.org) Message-Id: <201709271653.v8RGrpIH049748@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: rakuco set sender to rakuco@FreeBSD.org using -f From: Raphael Kubo da Costa Date: Wed, 27 Sep 2017 16:53:51 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r450769 - in branches/2017Q3/archivers/libzip: . files X-SVN-Group: ports-branches X-SVN-Commit-Author: rakuco X-SVN-Commit-Paths: in branches/2017Q3/archivers/libzip: . files X-SVN-Commit-Revision: 450769 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Sep 2017 16:53:53 -0000 Author: rakuco Date: Wed Sep 27 16:53:51 2017 New Revision: 450769 URL: https://svnweb.freebsd.org/changeset/ports/450769 Log: MFH: r450768 Add a patch for CVE-2017-14107. This is a minor security vulnerability that can lead to a denial of service issue in libzip when a specially crafted archive is used. PR: 222638 Security: b2952517-07e5-4d19-8850-21c5b7e0623f Security: CVE-2017-14107 Approved by: ports-secteam (blanket approval) Added: branches/2017Q3/archivers/libzip/files/patch-CVE-2017-14107 - copied unchanged from r450768, head/archivers/libzip/files/patch-CVE-2017-14107 Modified: branches/2017Q3/archivers/libzip/Makefile Directory Properties: branches/2017Q3/ (props changed) Modified: branches/2017Q3/archivers/libzip/Makefile ============================================================================== --- branches/2017Q3/archivers/libzip/Makefile Wed Sep 27 16:52:20 2017 (r450768) +++ branches/2017Q3/archivers/libzip/Makefile Wed Sep 27 16:53:51 2017 (r450769) @@ -3,6 +3,7 @@ PORTNAME= libzip PORTVERSION= 1.1.3 +PORTREVISION= 1 CATEGORIES= archivers devel MASTER_SITES= http://www.nih.at/libzip/ Copied: branches/2017Q3/archivers/libzip/files/patch-CVE-2017-14107 (from r450768, head/archivers/libzip/files/patch-CVE-2017-14107) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2017Q3/archivers/libzip/files/patch-CVE-2017-14107 Wed Sep 27 16:53:51 2017 (r450769, copy of r450768, head/archivers/libzip/files/patch-CVE-2017-14107) @@ -0,0 +1,27 @@ +From 9b46957ec98d85a572e9ef98301247f39338a3b5 Mon Sep 17 00:00:00 2001 +From: Thomas Klausner +Date: Tue, 29 Aug 2017 10:25:03 +0200 +Subject: [PATCH] Make eocd checks more consistent between zip and zip64 cases. + +--- + lib/zip_open.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/lib/zip_open.c b/lib/zip_open.c +index 3bd593b..9d3a4cb 100644 +--- lib/zip_open.c ++++ lib/zip_open.c +@@ -847,7 +847,12 @@ _zip_read_eocd64(zip_source_t *src, zip_buffer_t *buffer, zip_uint64_t buf_offse + zip_error_set(error, ZIP_ER_SEEK, EFBIG); + return NULL; + } +- if ((flags & ZIP_CHECKCONS) && offset+size != eocd_offset) { ++ if (offset+size > buf_offset + eocd_offset) { ++ /* cdir spans past EOCD record */ ++ zip_error_set(error, ZIP_ER_INCONS, 0); ++ return NULL; ++ } ++ if ((flags & ZIP_CHECKCONS) && offset+size != buf_offset + eocd_offset) { + zip_error_set(error, ZIP_ER_INCONS, 0); + return NULL; + }