mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-01 13:18:36 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/unzip: patch CVE-2021-4217

Browse Source 
The patch is provided thanks to the Ubuntu community.

- CVE-2021-4217:
    A flaw was found in unzip. The vulnerability occurs due to improper
    handling of Unicode strings, which can lead to a null pointer
    dereference. This flaw allows an attacker to input a specially crafted
    zip file, leading to a crash or code execution.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2021-4217
 - https://launchpadlibrarian.net/580782282/0001-Fix-null-pointer-dereference-and-use-of-uninitialized-data.patch
 - https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: correct _IGNORE_CVES entry]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Thomas Perale
2026-06-02 22:24:43 +02:00
committed by Peter Korsgaard
parent 061d6b121b
commit 4e73a15a7b
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
package/unzip/0032-Fix-null-pointer-dereference-and-use-of-uninitialized-data.patch Normal file
View File

@@ -0,0 +1,57 @@
From 731d698377dbd1f5b1b90efeb8094602ed59fc40 Mon Sep 17 00:00:00 2001
From: Nils Bars <nils.bars@t-online.de>
Date: Mon, 17 Jan 2022 16:53:16 +0000
Subject: [PATCH] Fix null pointer dereference and use of uninitialized data
This fixes a bug that causes use of uninitialized heap data if `readbuf` fails
to read as many bytes as indicated by the extra field length attribute.
Furthermore, this fixes a null pointer dereference if an archive contains an
`EF_UNIPATH` extra field but does not have a filename set.
Upstream: https://launchpadlibrarian.net/580782282/0001-Fix-null-pointer-dereference-and-use-of-uninitialized-data.patch
CVE: CVE-2021-4217
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
fileio.c | 5 ++++-
process.c | 6 +++++-
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/fileio.c b/fileio.c
index 14460f3..1dc319e 100644
--- a/fileio.c
+++ b/fileio.c
@@ -2310,8 +2310,11 @@ int do_string(__G__ length, option) /* return PK-type error code */
seek_zipf(__G__ G.cur_zipfile_bufstart - G.extra_bytes +
(G.inptr-G.inbuf) + length);
} else {
- if (readbuf(__G__ (char *)G.extra_field, length) == 0)
+ unsigned bytes_read = readbuf(__G__ (char *)G.extra_field, length);
+ if (bytes_read == 0)
return PK_EOF;
+ if (bytes_read != length)
+ return PK_ERR;
/* Looks like here is where extra fields are read */
if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
{
diff --git a/process.c b/process.c
index 5f8f6c6..de843a5 100644
--- a/process.c
+++ b/process.c
@@ -2067,10 +2067,14 @@ int getUnicodeData(__G__ ef_buf, ef_len)
G.unipath_checksum = makelong(offset + ef_buf);
offset += 4;
+ if (!G.filename_full) {
+ /* Check if we have a unicode extra section but no filename set */
+ return PK_ERR;
+ }
+
/*
* Compute 32-bit crc
*/
-
chksum = crc32(chksum, (uch *)(G.filename_full),
strlen(G.filename_full));
--
2.25.1

3
package/unzip/unzip.mk
View File

@@ -51,6 +51,9 @@ UNZIP_IGNORE_CVES += CVE-2019-13232
# 0028-cve-2022-0529-and-cve-2022-0530.patch
UNZIP_IGNORE_CVES += CVE-2022-0529 CVE-2022-0530
# 0032-Fix-null-pointer-dereference-and-use-of-uninitialized-data.patch
UNZIP_IGNORE_CVES += CVE-2021-4217
# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when
# necessary, redefining it on the command line causes some warnings.
UNZIP_TARGET_CFLAGS = \