From 169d8bbaf13b12233bfeb5396341848ccd0f728a Mon Sep 17 00:00:00 2001 From: liningjie Date: Tue, 17 Oct 2023 10:32:33 +0800 Subject: [PATCH] Fix CVE-2023-45853 --- backport-CVE-2023-45853.patch | 39 +++++++++++++++++++++++++++++++++++ zlib.spec | 6 +++++- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-45853.patch diff --git a/backport-CVE-2023-45853.patch b/backport-CVE-2023-45853.patch new file mode 100644 index 0000000..f750e0f --- /dev/null +++ b/backport-CVE-2023-45853.patch @@ -0,0 +1,39 @@ +From 73331a6a0481067628f065ffe87bb1d8f787d10c Mon Sep 17 00:00:00 2001 +From: Hans Wennborg +Date: Fri, 18 Aug 2023 11:05:33 +0200 +Subject: [PATCH] Reject overflows of zip header fields in minizip. + +This checks the lengths of the file name, extra field, and comment +that would be put in the zip headers, and rejects them if they are +too long. They are each limited to 65535 bytes in length by the zip +format. This also avoids possible buffer overflows if the provided +fields are too long. +--- + contrib/minizip/zip.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c +index 3d3d4ca..0446109 100644 +--- a/contrib/minizip/zip.c ++++ b/contrib/minizip/zip.c +@@ -1043,6 +1043,17 @@ extern int ZEXPORT zipOpenNewFileInZip4_64(zipFile file, const char* filename, c + return ZIP_PARAMERROR; + #endif + ++ // The filename and comment length must fit in 16 bits. ++ if ((filename!=NULL) && (strlen(filename)>0xffff)) ++ return ZIP_PARAMERROR; ++ if ((comment!=NULL) && (strlen(comment)>0xffff)) ++ return ZIP_PARAMERROR; ++ // The extra field length must fit in 16 bits. If the member also requires ++ // a Zip64 extra block, that will also need to fit within that 16-bit ++ // length, but that will be checked for later. ++ if ((size_extrafield_local>0xffff) || (size_extrafield_global>0xffff)) ++ return ZIP_PARAMERROR; ++ + zi = (zip64_internal*)file; + + if (zi->in_opened_file_inzip == 1) +-- +2.41.0.windows.3 + diff --git a/zlib.spec b/zlib.spec index 8cd5494..adb7d46 100644 --- a/zlib.spec +++ b/zlib.spec @@ -1,6 +1,6 @@ Name: zlib Version: 1.2.13 -Release: 1 +Release: 2 Summary: A lossless data-compression library License: zlib and Boost URL: http://www.zlib.net @@ -9,6 +9,7 @@ Source0: http://www.zlib.net/zlib-%{version}.tar.xz # Patch0 get from fedora Patch6000: backport-zlib-1.2.5-minizip-fixuncrypt.patch Patch6001: backport-fix-undefined-buffer-detected-by-oss-fuzz.patch +Patch6002: backport-CVE-2023-45853.patch Patch9000: zlib-Optimize-CRC32.patch Patch9001: zlib-1.2.11-SIMD.patch @@ -112,6 +113,9 @@ make test %{_libdir}/pkgconfig/minizip.pc %changelog +* Tue Oct 17 2023 liningjie - 1.2.13-2 +- DESC:Fix CVE-2023-45853 + * Thu Dec 29 2022 zhoupengcheng - 1.2.13-1 - update to zlib-1.2.13 - remove openEuler uncompiled patch : 0005-Accelerate-Adler32-using-arm64-SVE-instructions.patch