Compare commits

..

No commits in common. "41b046f739855618a36b03374ac5ebf6c36de874" and "79ed268e37daae2d1853b23840453743becfb644" have entirely different histories.

4 changed files with 7 additions and 72 deletions

View File

@ -1,28 +0,0 @@
From 39b180455ffcb100c4b3269bac9bf119063fd38c Mon Sep 17 00:00:00 2001
From: root <root@localhost.localdomain>
Date: Fri, 6 Sep 2024 16:32:43 +0800
Subject: [PATCH] CVE-2021-38291
---
3rdparty/libzipplugin/libzipplugin.cpp | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/3rdparty/libzipplugin/libzipplugin.cpp b/3rdparty/libzipplugin/libzipplugin.cpp
index 280378f..b9cab7f 100644
--- a/3rdparty/libzipplugin/libzipplugin.cpp
+++ b/3rdparty/libzipplugin/libzipplugin.cpp
@@ -741,6 +741,11 @@ ErrorType LibzipPlugin::extractEntry(zip_t *archive, zip_int64_t index, const Ex
}
strFileName = m_common->trans2uft8(statBuffer.name, m_mapFileCode[index]); // 解压文件名(压缩包中)
+ //fix 232873
+ if(strFileName.indexOf("../") != -1) {
+ qInfo() << "skipped ../ path component(s) in " << strFileName;
+ strFileName = strFileName.replace("../", "");
+ }
QString strOriginName = strFileName;
// 针对文件夹名称过长的情况,直接提示解压失败,文件夹名称过长
--
2.39.3

Binary file not shown.

Binary file not shown.

View File

@ -1,13 +1,15 @@
%define specrelease 2
%define specrelease 1%{?dist}
%if 0%{?openeuler}
%define specrelease 1
%endif
Name: deepin-compressor
Version: 5.12.13
Version: 5.10.5
Release: %{specrelease}
Summary: A fast and lightweight application for creating and extracting archives
License: GPLv3+
URL: https://github.com/linuxdeepin/deepin-devicemanager
Source0: %{name}-%{version}.tar.gz
Patch0001: backport-CVE-2021-38291.patch
BuildRequires: gcc-c++
BuildRequires: cmake
@ -28,19 +30,18 @@ BuildRequires: libarchive-devel
BuildRequires: minizip-devel
BuildRequires: poppler-cpp-devel
BuildRequires: gtest-devel gmock
BuildRequires: chrpath
Requires: p7zip
Requires: lz4-libs
Requires: unrar
Requires: deepin-shortcut-viewer
Requires: lzop
Recommends: unrar p7zip-plugins
%description
%{summary}.
%prep
%autosetup -p1
%autosetup
%build
export PATH=%{_qt5_bindir}:$PATH
@ -55,21 +56,6 @@ popd
%install
%make_install -C build INSTALL_ROOT="%buildroot"
# remove rpath info
for file in $(find %{buildroot}/ -executable -type f -exec file {} ';' | grep "\<ELF\>" | awk -F ':' '{print $1}')
do
if [ ! -u "$file" ]; then
if [ -w $file ]; then
chrpath -d $file
fi
fi
done
# add rpath path in ld.so.conf.d
mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d
echo "%{_bindir}/%{name}" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
echo "%{_libdir}/%{name}/plugins/" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
%files
%doc README.md
%license LICENSE
@ -82,30 +68,8 @@ echo "%{_libdir}/%{name}/plugins/" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{
%{_datadir}/mime/packages/%{name}.xml
%{_datadir}/deepin-manual/manual-assets/application/deepin-compressor/archive-manager/*
%{_datadir}/applications/context-menus/*.conf
%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
%post
/sbin/ldconfig
%postun
/sbin/ldconfig
%changelog
* Fri Sep 06 2024 pangqing <pangqing@uniontech.com> - 5.12.13-2
- CVE-2021-38291
* Fri Jul 28 2023 leeffo <liweiganga@uniontech.com> - 5.12.13-1
- upgrade to version 5.12.13
* Thu Mar 30 2023 liweiganga <liweiganga@uniontech.com> - 5.10.11-1
- update: update to 5.10.11
* Tue Mar 14 2023 liweigang <liweiganga@uniontech.com> - 5.10.5-3
- feat: remove rpath
* Fri Aug 05 2022 liweigang <liweiganga@uniontech.com> - 5.10.5-2
- fix nothing install requires
* Mon Jul 18 2022 konglidong <konglidong@uniontech.com> - 5.10.5-1
- update to 5.10.5
@ -123,4 +87,3 @@ echo "%{_libdir}/%{name}/plugins/" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{
* Thu Jul 30 2020 openEuler Buildteam <buildteam@openeuler.org> - 5.6.9-1
- Package init