webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-18 23:12:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

zlib: Add fix for CVE-2022-37434 fix

Browse Source 
https://www.openwall.com/lists/oss-security/2022/08/09/1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
This commit is contained in:
Peter Müller
2022-08-10 10:50:57 +00:00
parent c4fc6eb017
commit 59b95d4e26
2 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lfs/zlib
View File

@@ -78,8 +78,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
# Fix for CVE-2022-37434
# Apply fix for CVE-2022-37434 (and a fix for the fix)
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/zlib-CVE-2022-37434.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/zlib-CVE-2022-37434-fix.patch
cd $(DIR_APP) && CROSS_PREFIX=$(CROSS_PREFIX) ./configure --prefix=$(PREFIX) --shared
cd $(DIR_APP) && make $(MAKETUNING)

26
src/patches/zlib-CVE-2022-37434-fix.patch Normal file
View File

@@ -0,0 +1,26 @@
commit 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
Author: Mark Adler <fork@madler.net>
Date: Mon Aug 8 10:50:09 2022 -0700
Fix extra field processing bug that dereferences NULL state->head.
The recent commit to fix a gzip header extra field processing bug
introduced the new bug fixed here.
diff --git a/inflate.c b/inflate.c
index 7a72897..2a3c4fe 100644
--- a/inflate.c
+++ b/inflate.c
@@ -763,10 +763,10 @@ int flush;
copy = state->length;
if (copy > have) copy = have;
if (copy) {
- len = state->head->extra_len - state->length;
if (state->head != Z_NULL &&
state->head->extra != Z_NULL &&
- len < state->head->extra_max) {
+ (len = state->head->extra_len - state->length) <
+ state->head->extra_max) {
zmemcpy(state->head->extra + len, next,
len + copy > state->head->extra_max ?
state->head->extra_max - len : copy);