packages/zziplib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!4 update zziplib and remove python2

Browse Source 
From: @weiwei_150212
Reviewed-by: @xiezhipeng1
Signed-off-by: @xiezhipeng1
This commit is contained in:
openeuler-ci-bot 2020-11-05 10:39:24 +08:00 committed by Gitee
commit 0c5427a1b6
6 changed files with 9 additions and 178 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
CVE-2018-16548-1.patch
View File

@ -1,76 +0,0 @@
From b6ce8a1ca9442f89fae3482921fadc928ecbbb05 Mon Sep 17 00:00:00 2001
From: jmoellers <josef.moellers@suse.com>
Date: Fri, 7 Sep 2018 11:32:04 +0200
Subject: [PATCH 1/3] Avoid memory leak from __zzip_parse_root_directory().
(cherry picked from commit 9411bde3e4a70a81ff3ffd256b71927b2d90dcbb)
https://github.com/gdraheim/zziplib/commit/9411bde3e4a70a81ff3ffd256b71927b2d90dcbb
Signed-off-by: Yufa Fang <fangyufa1@huawei.com>
---
zzip/zip.c | 36 ++++++++++++++++++++++++++++++++++--
1 files changed, 34 insertions(+), 2 deletions(-)
diff --git a/zzip/zip.c b/zzip/zip.c
index 14e2e06..8318463 100644
--- a/zzip/zip.c
+++ b/zzip/zip.c
@@ -472,9 +472,15 @@ __zzip_parse_root_directory(int fd,
} else
{
if (io->fd.seeks(fd, zz_rootseek + zz_offset, SEEK_SET) < 0)
+ {
+ free(hdr0);
return ZZIP_DIR_SEEK;
+ }
if (io->fd.read(fd, &dirent, sizeof(dirent)) < __sizeof(dirent))
+ {
+ free(hdr0);
return ZZIP_DIR_READ;
+ }
d = &dirent;
}
@@ -574,12 +580,38 @@ __zzip_parse_root_directory(int fd,
if (hdr_return)
*hdr_return = hdr0;
+ else
+ {
+ /* If it is not assigned to *hdr_return, it will never be free()'d */
+ free(hdr0);
+ /* Make sure we don't free it again in case of error */
+ hdr0 = NULL;
+ }
} /* else zero (sane) entries */
# ifndef ZZIP_ALLOW_MODULO_ENTRIES
- return (entries != zz_entries ? ZZIP_CORRUPTED : 0);
+ if (entries != zz_entries)
+ {
+ /* If it was assigned to *hdr_return, undo assignment */
+ if (p_reclen && hdr_return)
+ *hdr_return = NULL;
+ /* Free it, if it was not already free()'d */
+ if (hdr0 != NULL)
+ free(hdr0);
+ return ZZIP_CORRUPTED;
+ }
# else
- return ((entries & (unsigned)0xFFFF) != zz_entries ? ZZIP_CORRUPTED : 0);
+ if (((entries & (unsigned)0xFFFF) != zz_entries)
+ {
+ /* If it was assigned to *hdr_return, undo assignment */
+ if (p_reclen && hdr_return)
+ *hdr_return = NULL;
+ /* Free it, if it was not already free()'d */
+ if (hdr0 != NULL)
+ free(hdr0);
+ return ZZIP_CORRUPTED;
+ }
# endif
+ return 0;
}
/* ------------------------- high-level interface ------------------------- */
--
2.19.1

56
CVE-2018-16548-2.patch
View File

@ -1,56 +0,0 @@
From e8d90fe7525c177f0c28f6843f2a25da2e6e5045 Mon Sep 17 00:00:00 2001
From: jmoellers <josef.moellers@suse.com>
Date: Fri, 7 Sep 2018 11:49:28 +0200
Subject: [PATCH 2/3] Avoid memory leak from __zzip_parse_root_directory().
(cherry picked from commit d2e5d5c53212e54a97ad64b793a4389193fec687)
https://github.com/gdraheim/zziplib/commit/d2e5d5c53212e54a97ad64b793a4389193fec687
Signed-off-by: Yufa Fang <fangyufa1@huawei.com>
---
zzip/zip.c | 25 ++-----------------------
1 file changed, 2 insertions(+), 23 deletions(-)
diff --git a/zzip/zip.c b/zzip/zip.c
index 8318463..79fd9ad 100644
--- a/zzip/zip.c
+++ b/zzip/zip.c
@@ -584,34 +584,13 @@ __zzip_parse_root_directory(int fd,
{
/* If it is not assigned to *hdr_return, it will never be free()'d */
free(hdr0);
- /* Make sure we don't free it again in case of error */
- hdr0 = NULL;
}
} /* else zero (sane) entries */
# ifndef ZZIP_ALLOW_MODULO_ENTRIES
- if (entries != zz_entries)
- {
- /* If it was assigned to *hdr_return, undo assignment */
- if (p_reclen && hdr_return)
- *hdr_return = NULL;
- /* Free it, if it was not already free()'d */
- if (hdr0 != NULL)
- free(hdr0);
- return ZZIP_CORRUPTED;
- }
+ return (entries != zz_entries) ? ZZIP_CORRUPTED : 0;
# else
- if (((entries & (unsigned)0xFFFF) != zz_entries)
- {
- /* If it was assigned to *hdr_return, undo assignment */
- if (p_reclen && hdr_return)
- *hdr_return = NULL;
- /* Free it, if it was not already free()'d */
- if (hdr0 != NULL)
- free(hdr0);
- return ZZIP_CORRUPTED;
- }
+ return ((entries & (unsigned)0xFFFF) != zz_entries) ? ZZIP_CORRUPTED : 0;
# endif
- return 0;
}
/* ------------------------- high-level interface ------------------------- */
--
2.19.1

28
CVE-2018-16548-3.patch
View File

@ -1,28 +0,0 @@
From a37ce0d441050356efc5fcaa48e1cdcf21a6b8e1 Mon Sep 17 00:00:00 2001
From: jmoellers <josef.moellers@suse.com>
Date: Fri, 7 Sep 2018 13:55:35 +0200
Subject: [PATCH 3/3] One more free() to avoid memory leak.
(cherry picked from commit 0e1dadb05c1473b9df2d7b8f298dab801778ef99)
https://github.com/gdraheim/zziplib/commit/0e1dadb05c1473b9df2d7b8f298dab801778ef99
Signed-off-by: Yufa Fang <fangyufa1@huawei.com>
---
zzip/zip.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/zzip/zip.c b/zzip/zip.c
index 79fd9ad..f97a40a 100644
--- a/zzip/zip.c
+++ b/zzip/zip.c
@@ -586,6 +586,8 @@ __zzip_parse_root_directory(int fd,
free(hdr0);
}
} /* else zero (sane) entries */
+ else
+ free(hdr0);
# ifndef ZZIP_ALLOW_MODULO_ENTRIES
return (entries != zz_entries) ? ZZIP_CORRUPTED : 0;
# else
--
2.19.1

BIN
v0.13.69.tar.gz
View File

Binary file not shown.

BIN
v0.13.71.tar.gz Normal file
View File

Binary file not shown.

27
zziplib.spec
View File

@ -3,19 +3,14 @@ sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' */libtoo
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' */libtool
Name: zziplib
Version: 0.13.69
Release: 5
Version: 0.13.71
Release: 1
Summary: Lightweight library for zip compression
License: LGPLv2+ or MPLv1.1
URL: http://zziplib.sourceforge.net
Source0: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz
Patch6000: CVE-2018-16548-1.patch
Patch6001: CVE-2018-16548-2.patch
Patch6002: CVE-2018-16548-3.patch
Patch6003: CVE-2018-17828.patch
BuildRequires: perl-interpreter python2 python2-rpm-macros zip xmlto
BuildRequires: perl-interpreter zip xmlto
BuildRequires: zlib-devel SDL-devel pkgconfig autoconf automake gcc make
Provides: zziplib-utils
@ -47,23 +42,16 @@ This package includes help documentation and manuals related to zziplib.
%prep
%setup -q
%patch6000 -p1
%patch6001 -p1
%patch6002 -p1
%patch6003 -p1
find . -name '*.py' | xargs sed -i 's@#! /usr/bin/python@#! %__python2@g;s@#! /usr/bin/env python@#! %__python2@g'
sed -i -e 's:docs ::g' Makefile.am
%build
export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing"
export PYTHON=%__python2
%configure --disable-static --enable-sdl --enable-frame-pointer --enable-builddir=_builddir
%disable_rpath
%make_build
%install
%make_install
rm -rf docs/Make* docs/zziplib-manpages.ar
find %{buildroot} -type f -name "*.la" -delete -print
%post -p /sbin/ldconfig
@ -86,6 +74,9 @@ export PYTHON=%__python2
%{_mandir}/man3/*
%changelog
* Tue Nov 3 2020 tianwei <tianwei12@huawei.com> - 0.13.71-1
- update to 0.13.71 and remove python2
* Fri Feb 14 2020 chengquan <chengquan3@huawei.com> - 0.13.36-5
- Add necessary BuildRequires