[packages/unzip] Rel 8. SECURITY: CAN-2026-2034440, CAN-2026-2034442, CAN-2026-2034443.
arekm
arekm at pld-linux.org
Tue Oct 20 21:50:42 CEST 2026
commit c81213d40a606d4e5af197a0efae2bb7c9961406
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Tue Oct 20 21:50:16 2026 +0200
Rel 8. SECURITY: CAN-2026-2034440, CAN-2026-2034442, CAN-2026-2034443.
unzip-6.0-CAN-2026-2034440.patch | 78 ++++++++++++++++++++++++++++++++++++++++
unzip-6.0-CAN-2026-2034442.patch | 30 ++++++++++++++++
unzip-6.0-CAN-2026-2034443.patch | 20 +++++++++++
unzip.spec | 12 ++++++-
4 files changed, 139 insertions(+), 1 deletion(-)
---
diff --git a/unzip.spec b/unzip.spec
index 174e61c..2122e52 100644
--- a/unzip.spec
+++ b/unzip.spec
@@ -10,7 +10,7 @@ Summary(tr.UTF-8): pkzip ve benzeri programların ürettiği zip arşivlerini a
Summary(uk.UTF-8): Розпаковувач файлів .zip
Name: unzip
Version: 6.00
-Release: 7
+Release: 8
License: distributable
Group: Applications/Archiving
Source0: https://downloads.sourceforge.net/project/infozip/UnZip%206.x%20(latest)/UnZip%206.0/%{name}60.tar.gz?/%{name}60.tgz
@@ -95,6 +95,13 @@ Patch38: unzip-6.0-RHEL-86228.patch
Patch39: unzip-6.0-CVE-2022-0529-and-0530.patch
Patch40: unzip-6.0-cve-2021-4217.patch
+
+# heap out-of-bounds read in the EF_IZUNIX3 extra field handler
+Patch41: unzip-6.0-CAN-2026-2034440.patch
+# heap buffer overflow in memextract() STORED path
+Patch42: unzip-6.0-CAN-2026-2034442.patch
+# stack out-of-bounds NUL write in the EF_SMARTZIP handler
+Patch43: unzip-6.0-CAN-2026-2034443.patch
URL: https://infozip.sourceforge.net/
# unix/configure probes for it; without the BR the resulting binary silently
# loses bzip2 (method 12) support
@@ -211,6 +218,9 @@ PKZIP та PKUNZIP від PKWARE для MS-DOS, але в багатьох ви
%patch -P38 -p1
%patch -P39 -p1
%patch -P40 -p1
+%patch -P41 -p1
+%patch -P42 -p1
+%patch -P43 -p1
%build
# IZ_HAVE_UXUIDGID is needed for right functionality of unzip -X
diff --git a/unzip-6.0-CAN-2026-2034440.patch b/unzip-6.0-CAN-2026-2034440.patch
new file mode 100644
index 0000000..fbe2baf
--- /dev/null
+++ b/unzip-6.0-CAN-2026-2034440.patch
@@ -0,0 +1,78 @@
+# Heap out-of-bounds read in the EF_IZUNIX3 extra field handler: the UID/GID
+# sizes are taken from the archive and not bounded by the block length.
+#
+# Upstream fix by Paul Marquess, from Debian can-2026-2034440.patch.
+--- a/process.c
++++ b/process.c
+@@ -2982,7 +2982,7 @@
+ have_new_type_eb = 2;
+
+ /* Ignore any prior EF_IZUNIX/EF_PKUNIX/EF_IZUNIX2 UID/GID. */
+- flags &= 0x0ff;
++ flags &= EB_UT_FL_TIMES;
+ /*
+ Version 1 byte version of this extra field, currently 1
+ UIDSize 1 byte Size of UID field
+@@ -2992,24 +2992,43 @@
+ */
+
+ #ifdef IZ_HAVE_UXUIDGID
++ /* Check for a legitimate extra block length, a non-NULL
++ * destination pointer, and "ux" version 1 (which is all we
++ * understand).
++ */
+ if ((eb_len >= EB_UX3_MINLEN)
+ && (z_uidgid != NULL)
+ && ((*((EB_HEADSIZE + 0) + ef_buf) == 1)))
+ /* only know about version 1 */
+ {
+- uch uid_size;
+- uch gid_size;
++ /* uid_size is read from the archive, so check it and the
++ * resulting total size against eb_len before using either
++ * to address or read the block.
++ */
++ unsigned uid_size;
++ unsigned gid_size;
+
+ uid_size = *((EB_HEADSIZE + 1) + ef_buf);
+- gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf);
+
+- if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf,
+- uid_size, &z_uidgid[0])
+- &&
+- read_ux3_value((EB_HEADSIZE + uid_size + 3) + ef_buf,
+- gid_size, &z_uidgid[1]) )
++ /* Valid: 1 (Version) + 1 (UIDSize) + UIDSize +
++ * 1 (GIDSize) + 2 (min GIDSize) <= eb_len.
++ */
++ if (5+ uid_size <= eb_len)
+ {
+- flags |= EB_UX2_VALID; /* signal success */
++ gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf);
++
++ /* Last, check total claimed xID sizes against eb_len. */
++ if (3+ uid_size+ gid_size == eb_len)
++ {
++ if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf,
++ uid_size, &z_uidgid[0])
++ &&
++ read_ux3_value((EB_HEADSIZE + uid_size + 3) + ef_buf,
++ gid_size, &z_uidgid[1]) )
++ {
++ flags |= EB_UX2_VALID; /* signal success */
++ }
++ }
+ }
+ }
+ #endif /* IZ_HAVE_UXUIDGID */
+--- a/unzpriv.h
++++ b/unzpriv.h
+@@ -1789,6 +1789,7 @@
+ #define EB_UT_FL_MTIME (1 << 0) /* mtime present */
+ #define EB_UT_FL_ATIME (1 << 1) /* atime present */
+ #define EB_UT_FL_CTIME (1 << 2) /* ctime present */
++# define EB_UT_FL_TIMES 0xff /* Mask for all time flag bits. */
+
+ #define EB_FLGS_OFFS 4 /* offset of flags area in generic compressed
+ extra field blocks (BEOS, MAC, and others) */
diff --git a/unzip-6.0-CAN-2026-2034442.patch b/unzip-6.0-CAN-2026-2034442.patch
new file mode 100644
index 0000000..92e8bed
--- /dev/null
+++ b/unzip-6.0-CAN-2026-2034442.patch
@@ -0,0 +1,30 @@
+# Heap buffer overflow in the STORED path of memextract(): the archive-supplied
+# length is copied into a buffer sized for the declared uncompressed size.
+#
+# Upstream fix by Paul Marquess, from Debian can-2026-2034442.patch.
+--- a/extract.c
++++ b/extract.c
+@@ -2632,6 +2632,10 @@
+
+ switch (method) {
+ case STORED:
++ if ((extent)G.incnt > tgtsize) {
++ error = PK_ERR;
++ break;
++ }
+ memcpy((char *)tgt, (char *)G.inptr, (extent)G.incnt);
+ G.outcnt = (ulg)G.csize; /* for CRC calculation */
+ break;
+@@ -2769,8 +2773,10 @@
+ decompress_bits(ucdata, usiz, ebdata+EB_IZVMS_HLEN);
+ break;
+ case EB_IZVMS_BCDEFL:
+- memextract(__G__ ucdata, (ulg)usiz,
+- ebdata+EB_IZVMS_HLEN, (ulg)csiz);
++ if (memextract(__G__ ucdata, (ulg)usiz, ebdata+EB_IZVMS_HLEN, (ulg)csiz) != PK_OK) {
++ free(ucdata);
++ ucdata = NULL;
++ }
+ break;
+ default:
+ free(ucdata);
diff --git a/unzip-6.0-CAN-2026-2034443.patch b/unzip-6.0-CAN-2026-2034443.patch
new file mode 100644
index 0000000..c354699
--- /dev/null
+++ b/unzip-6.0-CAN-2026-2034443.patch
@@ -0,0 +1,20 @@
+# Stack out-of-bounds NUL write in the EF_SMARTZIP handler: the filename
+# length byte from the archive indexes a 32-byte buffer unchecked.
+#
+# Upstream fix by Paul Marquess, from Debian can-2026-2034443.patch.
+--- a/zipinfo.c
++++ b/zipinfo.c
+@@ -1769,9 +1769,12 @@
+ if ((eb_datalen == EB_SMARTZIP_HLEN) &&
+ makelong(ef_ptr) == 0x70695A64 /* "dZip" */) {
+ char filenameBuf[32];
++ int filename_length = ef_ptr[32] ;
+ zi_showMacTypeCreator(__G__ &ef_ptr[4]);
+ memcpy(filenameBuf, &ef_ptr[33], 31);
+- filenameBuf[ef_ptr[32]] = '\0';
++ if (filename_length > 31)
++ filename_length = 31;
++ filenameBuf[filename_length] = '\0';
+ A_TO_N(filenameBuf);
+ Info(slide, 0, ((char *)slide,
+ LoadFarString(ZipItFname), filenameBuf));
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/unzip.git/commitdiff/c81213d40a606d4e5af197a0efae2bb7c9961406
More information about the pld-cvs-commit
mailing list