Date: Fri, 15 Jul 2016 11:25:07 +0000 (UTC) From: Raphael Kubo da Costa <rakuco@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r418576 - in head/archivers/p7zip: . files Message-ID: <201607151125.u6FBP72f008720@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rakuco Date: Fri Jul 15 11:25:07 2016 New Revision: 418576 URL: https://svnweb.freebsd.org/changeset/ports/418576 Log: Add patches for CVE-2016-2334 and CVE-2016-2335. While here, use PORTREVISION?= instead of PORTREVISION= to avoid needlessly bumping PORTREVISION in archivers/p7zip-codec-rar. PR: 211114 Submitted by: Piotr Kubaj <pkubaj@anongoth.pl> MFH: 2016Q3 Security: a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49 Security: d706a3a3-4a7c-11e6-97f7-5453ed2e2b49 Added: head/archivers/p7zip/files/patch-CPP_7zip_Archive_HfsHandler.cpp (contents, props changed) head/archivers/p7zip/files/patch-CPP_7zip_Archive_Udf_UdfIn.cpp (contents, props changed) Modified: head/archivers/p7zip/Makefile Modified: head/archivers/p7zip/Makefile ============================================================================== --- head/archivers/p7zip/Makefile Fri Jul 15 11:23:23 2016 (r418575) +++ head/archivers/p7zip/Makefile Fri Jul 15 11:25:07 2016 (r418576) @@ -3,6 +3,7 @@ PORTNAME= p7zip PORTVERSION= 15.14 +PORTREVISION?= 1 CATEGORIES= archivers MASTER_SITES= SF DISTNAME= ${PORTNAME}_${DISTVERSION}_src_all Added: head/archivers/p7zip/files/patch-CPP_7zip_Archive_HfsHandler.cpp ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/archivers/p7zip/files/patch-CPP_7zip_Archive_HfsHandler.cpp Fri Jul 15 11:25:07 2016 (r418576) @@ -0,0 +1,25 @@ +Patch for CVE-2016-2334. + +Obtained from: https://sourceforge.net/p/p7zip/discussion/383043/thread/9d0fb86b/ +--- CPP/7zip/Archive/HfsHandler.cpp.orig Fri Jun 19 06:52:08 2015 ++++ CPP/7zip/Archive/HfsHandler.cpp Mon May 23 20:37:42 2016 +@@ -987,7 +987,9 @@ HRESULT CDatabase::LoadCatalog(const CFork &fork, cons + item.GroupID = Get32(r + 0x24); + item.AdminFlags = r[0x28]; + item.OwnerFlags = r[0x29]; ++ */ + item.FileMode = Get16(r + 0x2A); ++ /* + item.special.iNodeNum = Get16(r + 0x2C); // or .linkCount + item.FileType = Get32(r + 0x30); + item.FileCreator = Get32(r + 0x34); +@@ -1571,6 +1573,9 @@ HRESULT CHandler::ExtractZlibFile( + blockSize = (UInt32)rem; + + UInt32 size = GetUi32(tableBuf + i * 8 + 4); ++ ++ if (size > buf.Size() || size > kCompressionBlockSize + 1) ++ return S_FALSE; + + RINOK(ReadStream_FALSE(inStream, buf, size)); + Added: head/archivers/p7zip/files/patch-CPP_7zip_Archive_Udf_UdfIn.cpp ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/archivers/p7zip/files/patch-CPP_7zip_Archive_Udf_UdfIn.cpp Fri Jul 15 11:25:07 2016 (r418576) @@ -0,0 +1,18 @@ +Patch for CVE-2016-2335. + +Obtained from: https://sourceforge.net/p/p7zip/discussion/383043/thread/9d0fb86b/ +--- CPP/7zip/Archive/Udf/UdfIn.cpp.orig Fri Nov 20 15:40:08 2015 ++++ CPP/7zip/Archive/Udf/UdfIn.cpp Mon May 23 20:37:46 2016 +@@ -389,7 +389,11 @@ HRESULT CInArchive::ReadFileItem(int volIndex, int fsI + return S_FALSE; + CFile &file = Files.Back(); + const CLogVol &vol = LogVols[volIndex]; +- CPartition &partition = Partitions[vol.PartitionMaps[lad.Location.PartitionRef].PartitionIndex]; ++ unsigned partitionRef = lad.Location.PartitionRef; ++ ++ if (partitionRef >= vol.PartitionMaps.Size()) ++ return S_FALSE; ++ CPartition &partition = Partitions[vol.PartitionMaps[partitionRef].PartitionIndex]; + + UInt32 key = lad.Location.Pos; + UInt32 value;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201607151125.u6FBP72f008720>