uboot: (firmwareOdroidC2/C4) don't invoke patch tool, use patches = [] instead
https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/setup.sh#L948 this can do it nicely. Signed-off-by: Anton Arapov <anton@deadbeef.mx>
This commit is contained in:
commit
56de2bcd43
30691 changed files with 3076956 additions and 0 deletions
47
pkgs/tools/archivers/unzip/CVE-2014-8139.diff
Normal file
47
pkgs/tools/archivers/unzip/CVE-2014-8139.diff
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=971984&action=diff&context=patch&collapsed=&headers=1&format=raw
|
||||
|
||||
--- unzip60/extract.c 2010-04-03 14:41:55 -0500
|
||||
+++ unzip60/extract.c 2014-12-03 15:33:35 -0600
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
|
||||
+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
|
||||
|
||||
See the accompanying file LICENSE, version 2009-Jan-02 or later
|
||||
(the contents of which are also included in unzip.h) for terms of use.
|
||||
@@ -298,6 +298,8 @@
|
||||
#ifndef SFX
|
||||
static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
|
||||
EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
|
||||
+ static ZCONST char Far TooSmallEFlength[] = "bad extra-field entry:\n \
|
||||
+ EF block length (%u bytes) invalid (< %d)\n";
|
||||
static ZCONST char Far InvalidComprDataEAs[] =
|
||||
" invalid compressed data for EAs\n";
|
||||
# if (defined(WIN32) && defined(NTSD_EAS))
|
||||
@@ -2023,7 +2025,8 @@
|
||||
ebID = makeword(ef);
|
||||
ebLen = (unsigned)makeword(ef+EB_LEN);
|
||||
|
||||
- if (ebLen > (ef_len - EB_HEADSIZE)) {
|
||||
+ if (ebLen > (ef_len - EB_HEADSIZE))
|
||||
+ {
|
||||
/* Discovered some extra field inconsistency! */
|
||||
if (uO.qflag)
|
||||
Info(slide, 1, ((char *)slide, "%-22s ",
|
||||
@@ -2032,6 +2035,16 @@
|
||||
ebLen, (ef_len - EB_HEADSIZE)));
|
||||
return PK_ERR;
|
||||
}
|
||||
+ else if (ebLen < EB_HEADSIZE)
|
||||
+ {
|
||||
+ /* Extra block length smaller than header length. */
|
||||
+ if (uO.qflag)
|
||||
+ Info(slide, 1, ((char *)slide, "%-22s ",
|
||||
+ FnFilter1(G.filename)));
|
||||
+ Info(slide, 1, ((char *)slide, LoadFarString(TooSmallEFlength),
|
||||
+ ebLen, EB_HEADSIZE));
|
||||
+ return PK_ERR;
|
||||
+ }
|
||||
|
||||
switch (ebID) {
|
||||
case EF_OS2:
|
||||
26
pkgs/tools/archivers/unzip/CVE-2014-8140.diff
Normal file
26
pkgs/tools/archivers/unzip/CVE-2014-8140.diff
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=969621&action=diff
|
||||
(unzip60/ path prefix added)
|
||||
|
||||
--- unzip60/extract.c 2009-03-14 02:32:52.000000000 +0100
|
||||
+++ unzip60/extract.c 2014-12-05 22:43:13.000000000 +0100
|
||||
@@ -2221,10 +2234,17 @@ static int test_compr_eb(__G__ eb, eb_si
|
||||
if (compr_offset < 4) /* field is not compressed: */
|
||||
return PK_OK; /* do nothing and signal OK */
|
||||
|
||||
+ /* Return no/bad-data error status if any problem is found:
|
||||
+ * 1. eb_size is too small to hold the uncompressed size
|
||||
+ * (eb_ucsize). (Else extract eb_ucsize.)
|
||||
+ * 2. eb_ucsize is zero (invalid). 2014-12-04 SMS.
|
||||
+ * 3. eb_ucsize is positive, but eb_size is too small to hold
|
||||
+ * the compressed data header.
|
||||
+ */
|
||||
if ((eb_size < (EB_UCSIZE_P + 4)) ||
|
||||
- ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L &&
|
||||
- eb_size <= (compr_offset + EB_CMPRHEADLEN)))
|
||||
- return IZ_EF_TRUNC; /* no compressed data! */
|
||||
+ ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) ||
|
||||
+ ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
|
||||
+ return IZ_EF_TRUNC; /* no/bad compressed data! */
|
||||
|
||||
if (
|
||||
#ifdef INT_16BIT
|
||||
136
pkgs/tools/archivers/unzip/CVE-2014-8141.diff
Normal file
136
pkgs/tools/archivers/unzip/CVE-2014-8141.diff
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=969625&action=diff
|
||||
(unzip60/ path prefix added)
|
||||
|
||||
--- unzip60/process.c 2009-03-06 02:25:10.000000000 +0100
|
||||
+++ unzip60/process.c 2014-12-05 22:42:39.000000000 +0100
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
- Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
|
||||
+ Copyright (c) 1990-2014 Info-ZIP. All rights reserved.
|
||||
|
||||
See the accompanying file LICENSE, version 2009-Jan-02 or later
|
||||
(the contents of which are also included in unzip.h) for terms of use.
|
||||
@@ -1888,48 +1888,82 @@ int getZip64Data(__G__ ef_buf, ef_len)
|
||||
and a 4-byte version of disk start number.
|
||||
Sets both local header and central header fields. Not terribly clever,
|
||||
but it means that this procedure is only called in one place.
|
||||
+
|
||||
+ 2014-12-05 SMS.
|
||||
+ Added checks to ensure that enough data are available before calling
|
||||
+ makeint64() or makelong(). Replaced various sizeof() values with
|
||||
+ simple ("4" or "8") constants. (The Zip64 structures do not depend
|
||||
+ on our variable sizes.) Error handling is crude, but we should now
|
||||
+ stay within the buffer.
|
||||
---------------------------------------------------------------------------*/
|
||||
|
||||
+#define Z64FLGS 0xffff
|
||||
+#define Z64FLGL 0xffffffff
|
||||
+
|
||||
if (ef_len == 0 || ef_buf == NULL)
|
||||
return PK_COOL;
|
||||
|
||||
Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
|
||||
ef_len));
|
||||
|
||||
- while (ef_len >= EB_HEADSIZE) {
|
||||
+ while (ef_len >= EB_HEADSIZE)
|
||||
+ {
|
||||
eb_id = makeword(EB_ID + ef_buf);
|
||||
eb_len = makeword(EB_LEN + ef_buf);
|
||||
|
||||
- if (eb_len > (ef_len - EB_HEADSIZE)) {
|
||||
- /* discovered some extra field inconsistency! */
|
||||
+ if (eb_len > (ef_len - EB_HEADSIZE))
|
||||
+ {
|
||||
+ /* Extra block length exceeds remaining extra field length. */
|
||||
Trace((stderr,
|
||||
"getZip64Data: block length %u > rest ef_size %u\n", eb_len,
|
||||
ef_len - EB_HEADSIZE));
|
||||
break;
|
||||
}
|
||||
- if (eb_id == EF_PKSZ64) {
|
||||
-
|
||||
+ if (eb_id == EF_PKSZ64)
|
||||
+ {
|
||||
int offset = EB_HEADSIZE;
|
||||
|
||||
- if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
|
||||
- G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
|
||||
- offset += sizeof(G.crec.ucsize);
|
||||
+ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
|
||||
+ {
|
||||
+ if (offset+ 8 > ef_len)
|
||||
+ return PK_ERR;
|
||||
+
|
||||
+ G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
|
||||
+ offset += 8;
|
||||
}
|
||||
- if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
|
||||
- G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
|
||||
- offset += sizeof(G.crec.csize);
|
||||
+
|
||||
+ if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
|
||||
+ {
|
||||
+ if (offset+ 8 > ef_len)
|
||||
+ return PK_ERR;
|
||||
+
|
||||
+ G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
|
||||
+ offset += 8;
|
||||
}
|
||||
- if (G.crec.relative_offset_local_header == 0xffffffff){
|
||||
+
|
||||
+ if (G.crec.relative_offset_local_header == Z64FLGL)
|
||||
+ {
|
||||
+ if (offset+ 8 > ef_len)
|
||||
+ return PK_ERR;
|
||||
+
|
||||
G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
|
||||
- offset += sizeof(G.crec.relative_offset_local_header);
|
||||
+ offset += 8;
|
||||
}
|
||||
- if (G.crec.disk_number_start == 0xffff){
|
||||
+
|
||||
+ if (G.crec.disk_number_start == Z64FLGS)
|
||||
+ {
|
||||
+ if (offset+ 4 > ef_len)
|
||||
+ return PK_ERR;
|
||||
+
|
||||
G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
|
||||
- offset += sizeof(G.crec.disk_number_start);
|
||||
+ offset += 4;
|
||||
}
|
||||
+#if 0
|
||||
+ break; /* Expect only one EF_PKSZ64 block. */
|
||||
+#endif /* 0 */
|
||||
}
|
||||
|
||||
- /* Skip this extra field block */
|
||||
+ /* Skip this extra field block. */
|
||||
ef_buf += (eb_len + EB_HEADSIZE);
|
||||
ef_len -= (eb_len + EB_HEADSIZE);
|
||||
}
|
||||
--- unzip60/fileio.c 2009-04-20 02:03:44.000000000 +0200
|
||||
+++ unzip60/fileio.c 2014-12-05 22:44:16.000000000 +0100
|
||||
@@ -176,6 +176,8 @@ static ZCONST char Far FilenameTooLongTr
|
||||
#endif
|
||||
static ZCONST char Far ExtraFieldTooLong[] =
|
||||
"warning: extra field too long (%d). Ignoring...\n";
|
||||
+static ZCONST char Far ExtraFieldCorrupt[] =
|
||||
+ "warning: extra field (type: 0x%04x) corrupt. Continuing...\n";
|
||||
|
||||
#ifdef WINDLL
|
||||
static ZCONST char Far DiskFullQuery[] =
|
||||
@@ -2295,7 +2297,12 @@ int do_string(__G__ length, option) /*
|
||||
if (readbuf(__G__ (char *)G.extra_field, length) == 0)
|
||||
return PK_EOF;
|
||||
/* Looks like here is where extra fields are read */
|
||||
- getZip64Data(__G__ G.extra_field, length);
|
||||
+ if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
|
||||
+ {
|
||||
+ Info(slide, 0x401, ((char *)slide,
|
||||
+ LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
|
||||
+ error = PK_WARN;
|
||||
+ }
|
||||
#ifdef UNICODE_SUPPORT
|
||||
G.unipath_filename = NULL;
|
||||
if (G.UzO.U_flag < 2) {
|
||||
42
pkgs/tools/archivers/unzip/CVE-2014-9636.diff
Normal file
42
pkgs/tools/archivers/unzip/CVE-2014-9636.diff
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
From 190040ebfcf5395a6ccedede2cc9343d34f0a108 Mon Sep 17 00:00:00 2001
|
||||
From: mancha <mancha1 AT zoho DOT com>
|
||||
Date: Wed, 11 Feb 2015
|
||||
Subject: Info-ZIP UnZip buffer overflow
|
||||
|
||||
By carefully crafting a corrupt ZIP archive with "extra fields" that
|
||||
purport to have compressed blocks larger than the corresponding
|
||||
uncompressed blocks in STORED no-compression mode, an attacker can
|
||||
trigger a heap overflow that can result in application crash or
|
||||
possibly have other unspecified impact.
|
||||
|
||||
This patch ensures that when extra fields use STORED mode, the
|
||||
"compressed" and uncompressed block sizes match.
|
||||
|
||||
---
|
||||
extract.c | 8 ++++++++
|
||||
1 file changed, 8 insertions(+)
|
||||
|
||||
--- a/extract.c
|
||||
+++ b/extract.c
|
||||
@@ -2217,6 +2217,7 @@ static int test_compr_eb(__G__ eb, eb_si
|
||||
ulg eb_ucsize;
|
||||
uch *eb_ucptr;
|
||||
int r;
|
||||
+ ush method;
|
||||
|
||||
if (compr_offset < 4) /* field is not compressed: */
|
||||
return PK_OK; /* do nothing and signal OK */
|
||||
@@ -2226,6 +2227,13 @@ static int test_compr_eb(__G__ eb, eb_si
|
||||
eb_size <= (compr_offset + EB_CMPRHEADLEN)))
|
||||
return IZ_EF_TRUNC; /* no compressed data! */
|
||||
|
||||
+ method = makeword(eb + (EB_HEADSIZE + compr_offset));
|
||||
+ if ((method == STORED) &&
|
||||
+ (eb_size - compr_offset - EB_CMPRHEADLEN != eb_ucsize))
|
||||
+ return PK_ERR; /* compressed & uncompressed
|
||||
+ * should match in STORED
|
||||
+ * method */
|
||||
+
|
||||
if (
|
||||
#ifdef INT_16BIT
|
||||
(((ulg)(extent)eb_ucsize) != eb_ucsize) ||
|
||||
29
pkgs/tools/archivers/unzip/CVE-2014-9913.patch
Normal file
29
pkgs/tools/archivers/unzip/CVE-2014-9913.patch
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
From: "Steven M. Schweda" <sms@antinode.info>
|
||||
Subject: Fix CVE-2014-9913, buffer overflow in unzip
|
||||
Bug: https://sourceforge.net/p/infozip/bugs/27/
|
||||
Bug-Debian: https://bugs.debian.org/847485
|
||||
Bug-Ubuntu: https://launchpad.net/bugs/387350
|
||||
X-Debian-version: 6.0-21
|
||||
|
||||
--- a/list.c
|
||||
+++ b/list.c
|
||||
@@ -339,7 +339,18 @@
|
||||
G.crec.compression_method == ENHDEFLATED) {
|
||||
methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3];
|
||||
} else if (methnum >= NUM_METHODS) {
|
||||
- sprintf(&methbuf[4], "%03u", G.crec.compression_method);
|
||||
+ /* 2013-02-26 SMS.
|
||||
+ * http://sourceforge.net/p/infozip/bugs/27/ CVE-2014-9913.
|
||||
+ * Unexpectedly large compression methods overflow
|
||||
+ * &methbuf[]. Use the old, three-digit decimal format
|
||||
+ * for values which fit. Otherwise, sacrifice the
|
||||
+ * colon, and use four-digit hexadecimal.
|
||||
+ */
|
||||
+ if (G.crec.compression_method <= 999) {
|
||||
+ sprintf( &methbuf[ 4], "%03u", G.crec.compression_method);
|
||||
+ } else {
|
||||
+ sprintf( &methbuf[ 3], "%04X", G.crec.compression_method);
|
||||
+ }
|
||||
}
|
||||
|
||||
#if 0 /* GRR/Euro: add this? */
|
||||
66
pkgs/tools/archivers/unzip/CVE-2015-7696.diff
Normal file
66
pkgs/tools/archivers/unzip/CVE-2015-7696.diff
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
From 68efed87fabddd450c08f3112f62a73f61d493c9 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Stodulka <pstodulk@redhat.com>
|
||||
Date: Mon, 14 Sep 2015 18:23:17 +0200
|
||||
Subject: [PATCH 1/2] upstream fix for heap overflow
|
||||
|
||||
https://bugzilla.redhat.com/attachment.cgi?id=1073002
|
||||
---
|
||||
crypt.c | 12 +++++++++++-
|
||||
1 file changed, 11 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/crypt.c b/crypt.c
|
||||
index 784e411..a8975f2 100644
|
||||
--- a/crypt.c
|
||||
+++ b/crypt.c
|
||||
@@ -465,7 +465,17 @@ int decrypt(__G__ passwrd)
|
||||
GLOBAL(pInfo->encrypted) = FALSE;
|
||||
defer_leftover_input(__G);
|
||||
for (n = 0; n < RAND_HEAD_LEN; n++) {
|
||||
- b = NEXTBYTE;
|
||||
+ /* 2012-11-23 SMS. (OUSPG report.)
|
||||
+ * Quit early if compressed size < HEAD_LEN. The resulting
|
||||
+ * error message ("unable to get password") could be improved,
|
||||
+ * but it's better than trying to read nonexistent data, and
|
||||
+ * then continuing with a negative G.csize. (See
|
||||
+ * fileio.c:readbyte()).
|
||||
+ */
|
||||
+ if ((b = NEXTBYTE) == (ush)EOF)
|
||||
+ {
|
||||
+ return PK_ERR;
|
||||
+ }
|
||||
h[n] = (uch)b;
|
||||
Trace((stdout, " (%02x)", h[n]));
|
||||
}
|
||||
--
|
||||
2.4.6
|
||||
|
||||
|
||||
From bd8a743ee0a77e65ad07ef4196c4cd366add3f26 Mon Sep 17 00:00:00 2001
|
||||
From: Kamil Dudka <kdudka@redhat.com>
|
||||
Date: Mon, 14 Sep 2015 18:24:56 +0200
|
||||
Subject: [PATCH 2/2] fix infinite loop when extracting empty bzip2 data
|
||||
|
||||
---
|
||||
extract.c | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/extract.c b/extract.c
|
||||
index 7134bfe..29db027 100644
|
||||
--- a/extract.c
|
||||
+++ b/extract.c
|
||||
@@ -2733,6 +2733,12 @@ __GDEF
|
||||
int repeated_buf_err;
|
||||
bz_stream bstrm;
|
||||
|
||||
+ if (G.incnt <= 0 && G.csize <= 0L) {
|
||||
+ /* avoid an infinite loop */
|
||||
+ Trace((stderr, "UZbunzip2() got empty input\n"));
|
||||
+ return 2;
|
||||
+ }
|
||||
+
|
||||
#if (defined(DLL) && !defined(NO_SLIDE_REDIR))
|
||||
if (G.redirect_slide)
|
||||
wsize = G.redirect_size, redirSlide = G.redirect_buffer;
|
||||
--
|
||||
2.4.6
|
||||
|
||||
36
pkgs/tools/archivers/unzip/CVE-2015-7697.diff
Normal file
36
pkgs/tools/archivers/unzip/CVE-2015-7697.diff
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
From bd150334fb4084f5555a6be26b015a0671cb5b74 Mon Sep 17 00:00:00 2001
|
||||
From: Kamil Dudka <kdudka@redhat.com>
|
||||
Date: Tue, 22 Sep 2015 18:52:23 +0200
|
||||
Subject: [PATCH] extract: prevent unsigned overflow on invalid input
|
||||
|
||||
Suggested-by: Stefan Cornelius
|
||||
---
|
||||
extract.c | 11 ++++++++++-
|
||||
1 file changed, 10 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/extract.c b/extract.c
|
||||
index 29db027..b9ae667 100644
|
||||
--- a/extract.c
|
||||
+++ b/extract.c
|
||||
@@ -1257,8 +1257,17 @@ static int extract_or_test_entrylist(__G__ numchunk,
|
||||
if (G.lrec.compression_method == STORED) {
|
||||
zusz_t csiz_decrypted = G.lrec.csize;
|
||||
|
||||
- if (G.pInfo->encrypted)
|
||||
+ if (G.pInfo->encrypted) {
|
||||
+ if (csiz_decrypted <= 12) {
|
||||
+ /* handle the error now to prevent unsigned overflow */
|
||||
+ Info(slide, 0x401, ((char *)slide,
|
||||
+ LoadFarStringSmall(ErrUnzipNoFile),
|
||||
+ LoadFarString(InvalidComprData),
|
||||
+ LoadFarStringSmall2(Inflate)));
|
||||
+ return PK_ERR;
|
||||
+ }
|
||||
csiz_decrypted -= 12;
|
||||
+ }
|
||||
if (G.lrec.ucsize != csiz_decrypted) {
|
||||
Info(slide, 0x401, ((char *)slide,
|
||||
LoadFarStringSmall2(WrnStorUCSizCSizDiff),
|
||||
--
|
||||
2.5.2
|
||||
|
||||
28
pkgs/tools/archivers/unzip/CVE-2016-9844.patch
Normal file
28
pkgs/tools/archivers/unzip/CVE-2016-9844.patch
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
From: "Steven M. Schweda" <sms@antinode.info>
|
||||
Subject: Fix CVE-2016-9844, buffer overflow in zipinfo
|
||||
Bug-Debian: https://bugs.debian.org/847486
|
||||
Bug-Ubuntu: https://launchpad.net/bugs/1643750
|
||||
X-Debian-version: 6.0-21
|
||||
|
||||
--- a/zipinfo.c
|
||||
+++ b/zipinfo.c
|
||||
@@ -1921,7 +1921,18 @@
|
||||
ush dnum=(ush)((G.crec.general_purpose_bit_flag>>1) & 3);
|
||||
methbuf[3] = dtype[dnum];
|
||||
} else if (methnum >= NUM_METHODS) { /* unknown */
|
||||
- sprintf(&methbuf[1], "%03u", G.crec.compression_method);
|
||||
+ /* 2016-12-05 SMS.
|
||||
+ * https://launchpad.net/bugs/1643750
|
||||
+ * Unexpectedly large compression methods overflow
|
||||
+ * &methbuf[]. Use the old, three-digit decimal format
|
||||
+ * for values which fit. Otherwise, sacrifice the "u",
|
||||
+ * and use four-digit hexadecimal.
|
||||
+ */
|
||||
+ if (G.crec.compression_method <= 999) {
|
||||
+ sprintf( &methbuf[ 1], "%03u", G.crec.compression_method);
|
||||
+ } else {
|
||||
+ sprintf( &methbuf[ 0], "%04X", G.crec.compression_method);
|
||||
+ }
|
||||
}
|
||||
|
||||
for (k = 0; k < 15; ++k)
|
||||
35
pkgs/tools/archivers/unzip/CVE-2018-18384.patch
Normal file
35
pkgs/tools/archivers/unzip/CVE-2018-18384.patch
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
--- unzip60/list.c
|
||||
+++ unzip60/list.c
|
||||
@@ -97,7 +97,7 @@ int list_files(__G) /* return PK-type
|
||||
{
|
||||
int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL;
|
||||
#ifndef WINDLL
|
||||
- char sgn, cfactorstr[10];
|
||||
+ char sgn, cfactorstr[1+10+1+1]; /* <sgn><int>%NUL */
|
||||
int longhdr=(uO.vflag>1);
|
||||
#endif
|
||||
int date_format;
|
||||
@@ -389,9 +389,9 @@ int list_files(__G) /* return PK-type
|
||||
}
|
||||
#else /* !WINDLL */
|
||||
if (cfactor == 100)
|
||||
- sprintf(cfactorstr, LoadFarString(CompFactor100));
|
||||
+ snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactor100));
|
||||
else
|
||||
- sprintf(cfactorstr, LoadFarString(CompFactorStr), sgn, cfactor);
|
||||
+ snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactorStr), sgn, cfactor);
|
||||
if (longhdr)
|
||||
Info(slide, 0, ((char *)slide, LoadFarString(LongHdrStats),
|
||||
FmZofft(G.crec.ucsize, "8", "u"), methbuf,
|
||||
@@ -471,9 +471,9 @@ int list_files(__G) /* return PK-type
|
||||
|
||||
#else /* !WINDLL */
|
||||
if (cfactor == 100)
|
||||
- sprintf(cfactorstr, LoadFarString(CompFactor100));
|
||||
+ snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactor100));
|
||||
else
|
||||
- sprintf(cfactorstr, LoadFarString(CompFactorStr), sgn, cfactor);
|
||||
+ snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactorStr), sgn, cfactor);
|
||||
if (longhdr) {
|
||||
Info(slide, 0, ((char *)slide, LoadFarString(LongFileTrailer),
|
||||
FmZofft(tot_ucsize, "8", "u"), FmZofft(tot_csize, "8", "u"),
|
||||
81
pkgs/tools/archivers/unzip/default.nix
Normal file
81
pkgs/tools/archivers/unzip/default.nix
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
{ lib, stdenv, fetchurl
|
||||
, bzip2
|
||||
, enableNLS ? false, libnatspec
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "unzip";
|
||||
version = "6.0";
|
||||
|
||||
src = fetchurl {
|
||||
url = "mirror://sourceforge/infozip/unzip${lib.replaceStrings ["."] [""] version}.tar.gz";
|
||||
sha256 = "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83";
|
||||
};
|
||||
|
||||
hardeningDisable = [ "format" ];
|
||||
|
||||
patchFlags = [ "-p1" "-F3" ];
|
||||
|
||||
patches = [
|
||||
./CVE-2014-8139.diff
|
||||
./CVE-2014-8140.diff
|
||||
./CVE-2014-8141.diff
|
||||
./CVE-2014-9636.diff
|
||||
./CVE-2015-7696.diff
|
||||
./CVE-2015-7697.diff
|
||||
./CVE-2014-9913.patch
|
||||
./CVE-2016-9844.patch
|
||||
./CVE-2018-18384.patch
|
||||
./dont-hardcode-cc.patch
|
||||
(fetchurl {
|
||||
url = "https://github.com/madler/unzip/commit/41beb477c5744bc396fa1162ee0c14218ec12213.patch";
|
||||
name = "CVE-2019-13232-1.patch";
|
||||
sha256 = "04jzd6chg9fw4l5zadkfsrfm5llrd7vhd1dgdjjd29nrvkrjyn14";
|
||||
})
|
||||
(fetchurl {
|
||||
url = "https://github.com/madler/unzip/commit/47b3ceae397d21bf822bc2ac73052a4b1daf8e1c.patch";
|
||||
name = "CVE-2019-13232-2.patch";
|
||||
sha256 = "0iy2wcjyvzwrjk02iszwcpg85fkjxs1bvb9isvdiywszav4yjs32";
|
||||
})
|
||||
(fetchurl {
|
||||
url = "https://github.com/madler/unzip/commit/6d351831be705cc26d897db44f878a978f4138fc.patch";
|
||||
name = "CVE-2019-13232-3.patch";
|
||||
sha256 = "1jvs7dkdqs97qnsqc6hk088alhv8j4c638k65dbib9chh40jd7pf";
|
||||
})
|
||||
] ++ lib.optional enableNLS
|
||||
(fetchurl {
|
||||
url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/unzip/files/unzip-6.0-natspec.patch?id=56bd759df1d0c750a065b8c845e93d5dfa6b549d";
|
||||
name = "unzip-6.0-natspec.patch";
|
||||
sha256 = "67ab260ae6adf8e7c5eda2d1d7846929b43562943ec4aff629bd7018954058b1";
|
||||
});
|
||||
|
||||
nativeBuildInputs = [ bzip2 ];
|
||||
buildInputs = [ bzip2 ] ++ lib.optional enableNLS libnatspec;
|
||||
|
||||
makefile = "unix/Makefile";
|
||||
|
||||
NIX_LDFLAGS = "-lbz2" + lib.optionalString enableNLS " -lnatspec";
|
||||
|
||||
buildFlags = [
|
||||
"generic"
|
||||
"D_USE_BZ2=-DUSE_BZIP2"
|
||||
"L_BZ2=-lbz2"
|
||||
];
|
||||
|
||||
preConfigure = ''
|
||||
sed -i -e 's@CF="-O3 -Wall -I. -DASM_CRC $(LOC)"@CF="-O3 -Wall -I. -DASM_CRC -DLARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 $(LOC)"@' unix/Makefile
|
||||
'';
|
||||
|
||||
installFlags = [
|
||||
"prefix=${placeholder "out"}"
|
||||
];
|
||||
|
||||
setupHook = ./setup-hook.sh;
|
||||
|
||||
meta = {
|
||||
homepage = "http://www.info-zip.org";
|
||||
description = "An extraction utility for archives compressed in .zip format";
|
||||
license = lib.licenses.free; # http://www.info-zip.org/license.html
|
||||
platforms = lib.platforms.all;
|
||||
};
|
||||
}
|
||||
14
pkgs/tools/archivers/unzip/dont-hardcode-cc.patch
Normal file
14
pkgs/tools/archivers/unzip/dont-hardcode-cc.patch
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
--- a/unix/Makefile
|
||||
+++ b/unix/Makefile
|
||||
@@ -42,9 +42,9 @@
|
||||
# such as -DDOSWILD).
|
||||
|
||||
# UnZip flags
|
||||
-CC = cc# try using "gcc" target rather than changing this (CC and LD
|
||||
+CC ?= cc# try using "gcc" target rather than changing this (CC and LD
|
||||
LD = $(CC)# must match, else "unresolved symbol: ___main" is possible)
|
||||
-AS = as
|
||||
+AS ?= as
|
||||
LOC = $(D_USE_BZ2) $(LOCAL_UNZIP)
|
||||
AF = $(LOC)
|
||||
CFLAGS = -O
|
||||
5
pkgs/tools/archivers/unzip/setup-hook.sh
Normal file
5
pkgs/tools/archivers/unzip/setup-hook.sh
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
unpackCmdHooks+=(_tryUnzip)
|
||||
_tryUnzip() {
|
||||
if ! [[ "$curSrc" =~ \.zip$ ]]; then return 1; fi
|
||||
unzip -qq "$curSrc"
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue