From d8f2d46cbc9925e034a68aaaf60aad788d9373c1 Mon Sep 17 00:00:00 2001 From: drh Date: Mon, 23 Dec 2019 21:04:33 +0000 Subject: [PATCH] Fix the zipfile() function in the zipfile extension so that it is able to deal with goofy filenames that contain embedded zeros. Code for CVE-2019-19959 fixing Modified by openEuler build team Removed manifest changes and adapt to old code. FossilOrigin-Name: cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf --- ext/misc/zipfile.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/misc/zipfile.c b/ext/misc/zipfile.c index 9f2258e..3a87ec2 100644 --- a/ext/misc/zipfile.c +++ b/ext/misc/zipfile.c @@ -1631,7 +1631,7 @@ static int zipfileUpdate( zFree = sqlite3_mprintf("%s/", zPath); if( zFree==0 ){ rc = SQLITE_NOMEM; } zPath = (const char*)zFree; - nPath++; + nPath = (int)strlen(zPath); } } @@ -2032,11 +2032,11 @@ void zipfileStep(sqlite3_context *pCtx, int nVal, sqlite3_value **apVal){ }else{ if( zName[nName-1]!='/' ){ zName = zFree = sqlite3_mprintf("%s/", zName); - nName++; if( zName==0 ){ rc = SQLITE_NOMEM; goto zipfile_step_out; } + nName = (int)strlen(zName); }else{ while( nName>1 && zName[nName-2]=='/' ) nName--; } -- 1.8.3.1