0028-Fix-for-CVE-2022-0529-and-CVE-2022-0530.patch (6754B)
1 From 7c5862de85894d5387c855b5df6e5509c97f5bdf Mon Sep 17 00:00:00 2001 2 From: "Steven M. Schweda" <sms@antinode.info> 3 Date: Mon, 28 Apr 2025 12:57:34 -0700 4 Subject: [PATCH] Fix for CVE-2022-0529 and CVE-2022-0530 5 6 --- 7 fileio.c | 34 +++++++++++++++++++++++++--------- 8 process.c | 55 ++++++++++++++++++++++++++++++++++++++++++++----------- 9 2 files changed, 69 insertions(+), 20 deletions(-) 10 11 diff --git a/fileio.c b/fileio.c 12 index 6290824..50a74fc 100644 13 --- a/fileio.c 14 +++ b/fileio.c 15 @@ -171,8 +171,10 @@ static ZCONST char Far ReadError[] = "error: zipfile read error\n"; 16 static ZCONST char Far FilenameTooLongTrunc[] = 17 "warning: filename too long--truncating.\n"; 18 #ifdef UNICODE_SUPPORT 19 + static ZCONST char Far UFilenameCorrupt[] = 20 + "error: Unicode filename corrupt.\n"; 21 static ZCONST char Far UFilenameTooLongTrunc[] = 22 - "warning: Converted unicode filename too long--truncating.\n"; 23 + "warning: Converted Unicode filename too long--truncating.\n"; 24 #endif 25 static ZCONST char Far ExtraFieldTooLong[] = 26 "warning: extra field too long (%d). Ignoring...\n"; 27 @@ -2361,16 +2363,30 @@ int do_string(__G__ length, option) /* return PK-type error code */ 28 /* convert UTF-8 to local character set */ 29 fn = utf8_to_local_string(G.unipath_filename, 30 G.unicode_escape_all); 31 - /* make sure filename is short enough */ 32 - if (strlen(fn) >= FILNAMSIZ) { 33 - fn[FILNAMSIZ - 1] = '\0'; 34 + 35 + /* 2022-07-22 SMS, et al. CVE-2022-0530 36 + * Detect conversion failure, emit message. 37 + * Continue with unconverted name. 38 + */ 39 + if (fn == NULL) 40 + { 41 Info(slide, 0x401, ((char *)slide, 42 - LoadFarString(UFilenameTooLongTrunc))); 43 - error = PK_WARN; 44 + LoadFarString(UFilenameCorrupt))); 45 + error = PK_ERR; 46 + } 47 + else 48 + { 49 + /* make sure filename is short enough */ 50 + if (strlen(fn) >= FILNAMSIZ) { 51 + fn[FILNAMSIZ - 1] = '\0'; 52 + Info(slide, 0x401, ((char *)slide, 53 + LoadFarString(UFilenameTooLongTrunc))); 54 + error = PK_WARN; 55 + } 56 + /* replace filename with converted UTF-8 */ 57 + strcpy(G.filename, fn); 58 + free(fn); 59 } 60 - /* replace filename with converted UTF-8 */ 61 - strcpy(G.filename, fn); 62 - free(fn); 63 } 64 # endif /* UNICODE_WCHAR */ 65 if (G.unipath_filename != G.filename_full) 66 diff --git a/process.c b/process.c 67 index d2a846e..a7d5b87 100644 68 --- a/process.c 69 +++ b/process.c 70 @@ -222,6 +222,8 @@ static ZCONST char Far ZipfileCommTrunc1[] = 71 "\nwarning: Unicode Path version > 1\n"; 72 static ZCONST char Far UnicodeMismatchError[] = 73 "\nwarning: Unicode Path checksum invalid\n"; 74 + static ZCONST char Far UFilenameTooLongTrunc[] = 75 + "warning: filename too long (P1) -- truncating.\n"; 76 #endif 77 78 79 @@ -1915,7 +1917,7 @@ int getZip64Data(__G__ ef_buf, ef_len) 80 Sets both local header and central header fields. Not terribly clever, 81 but it means that this procedure is only called in one place. 82 83 - 2014-12-05 SMS. 84 + 2014-12-05 SMS. (oCERT.org report.) CVE-2014-8141. 85 Added checks to ensure that enough data are available before calling 86 makeint64() or makelong(). Replaced various sizeof() values with 87 simple ("4" or "8") constants. (The Zip64 structures do not depend 88 @@ -1947,9 +1949,10 @@ int getZip64Data(__G__ ef_buf, ef_len) 89 ef_len - EB_HEADSIZE)); 90 break; 91 } 92 + 93 if (eb_id == EF_PKSZ64) 94 { 95 - int offset = EB_HEADSIZE; 96 + unsigned offset = EB_HEADSIZE; 97 98 if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL)) 99 { 100 @@ -2046,7 +2049,7 @@ int getUnicodeData(__G__ ef_buf, ef_len) 101 } 102 if (eb_id == EF_UNIPATH) { 103 104 - int offset = EB_HEADSIZE; 105 + unsigned offset = EB_HEADSIZE; 106 ush ULen = eb_len - 5; 107 ulg chksum = CRCVAL_INITIAL; 108 109 @@ -2504,16 +2507,17 @@ char *wide_to_local_string(wide_string, escape_all) 110 int state_dependent; 111 int wsize = 0; 112 int max_bytes = MB_CUR_MAX; 113 - char buf[9]; 114 + char buf[ MB_CUR_MAX+ 1]; /* ("+1" not really needed?) */ 115 char *buffer = NULL; 116 char *local_string = NULL; 117 + size_t buffer_size; /* CVE-2022-0529 */ 118 119 for (wsize = 0; wide_string[wsize]; wsize++) ; 120 121 if (max_bytes < MAX_ESCAPE_BYTES) 122 max_bytes = MAX_ESCAPE_BYTES; 123 - 124 - if ((buffer = (char *)malloc(wsize * max_bytes + 1)) == NULL) { 125 + buffer_size = wsize * max_bytes + 1; /* Reused below. */ 126 + if ((buffer = (char *)malloc( buffer_size)) == NULL) { 127 return NULL; 128 } 129 130 @@ -2551,8 +2555,28 @@ char *wide_to_local_string(wide_string, escape_all) 131 } else { 132 /* no MB for this wide */ 133 /* use escape for wide character */ 134 - char *escape_string = wide_to_escape_string(wide_string[i]); 135 - strcat(buffer, escape_string); 136 + size_t buffer_len; 137 + size_t escape_string_len; 138 + char *escape_string; 139 + int err_msg = 0; 140 + 141 + escape_string = wide_to_escape_string(wide_string[i]); 142 + buffer_len = strlen( buffer); 143 + escape_string_len = strlen( escape_string); 144 + 145 + /* Append escape string, as space allows. */ 146 + /* 2022-07-18 SMS, et al. CVE-2022-0529 */ 147 + if (escape_string_len > buffer_size- buffer_len- 1) 148 + { 149 + escape_string_len = buffer_size- buffer_len- 1; 150 + if (err_msg == 0) 151 + { 152 + err_msg = 1; 153 + Info(slide, 0x401, ((char *)slide, 154 + LoadFarString( UFilenameTooLongTrunc))); 155 + } 156 + } 157 + strncat( buffer, escape_string, escape_string_len); 158 free(escape_string); 159 } 160 } 161 @@ -2604,9 +2628,18 @@ char *utf8_to_local_string(utf8_string, escape_all) 162 ZCONST char *utf8_string; 163 int escape_all; 164 { 165 - zwchar *wide = utf8_to_wide_string(utf8_string); 166 - char *loc = wide_to_local_string(wide, escape_all); 167 - free(wide); 168 + zwchar *wide; 169 + char *loc = NULL; 170 + 171 + wide = utf8_to_wide_string( utf8_string); 172 + 173 + /* 2022-07-25 SMS, et al. CVE-2022-0530 */ 174 + if (wide != NULL) 175 + { 176 + loc = wide_to_local_string( wide, escape_all); 177 + free( wide); 178 + } 179 + 180 return loc; 181 } 182 183 -- 184 2.45.2 185