Attachment 144273 Details for Bug 220595 – Backported patch for releases after RHEL 2.1

[patch] Backported patch for releases after RHEL 2.1

lha-CVE-2006-433x-EL34-FC5.diff (text/plain), 3.65 KB, created by Lubomir Kundrak on 2006-12-22 12:40:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2006-12-22 12:40:17 UTC

Size: 3.65 KB

patch

obsolete

>diff -urp lha-114i.orig/src/huf.c lha-114i/src/huf.c
>--- lha-114i.orig/src/huf.c	2006-12-22 12:45:52.000000000 +0100
>+++ lha-114i/src/huf.c	2006-12-22 12:54:37.000000000 +0100
>@@ -332,7 +332,7 @@ read_pt_len(nn, nbit, i_special)
> 	}
> 	else {
> 		i = 0;
>-		while (i < n) {
>+		while (i < MIN(n, NPT)) {
> 			c = bitbuf >> (16 - 3);
> 			if (c == 7) {
> 				unsigned short  mask = 1 << (16 - 4);
>@@ -345,7 +345,7 @@ read_pt_len(nn, nbit, i_special)
> 			pt_len[i++] = c;
> 			if (i == i_special) {
> 				c = getbits(2);
>-				while (--c >= 0)
>+				while (--c >= 0 && i < NPT)
> 					pt_len[i++] = 0;
> 			}
> 		}
>@@ -370,7 +370,7 @@ read_c_len( /* void */ )
> 			c_table[i] = c;
> 	} else {
> 		i = 0;
>-		while (i < n) {
>+		while (i < MIN(n,NC)) {
> 			c = pt_table[bitbuf >> (16 - 8)];
> 			if (c >= NT) {
> 				unsigned short  mask = 1 << (16 - 9);
>@@ -380,7 +380,7 @@ read_c_len( /* void */ )
> 					else
> 						c = left[c];
> 					mask >>= 1;
>-				} while (c >= NT);
>+				} while (c >= NT && (mask || c != left[c])); /* CVE-2006-4338 */
> 			}
> 			fillbuf(pt_len[c]);
> 			if (c <= 2) {
>@@ -427,7 +427,7 @@ decode_c_st1( /*void*/ )
> 			else
> 				j = left[j];
> 			mask >>= 1;
>-		} while (j >= NC);
>+		} while (j >= NC && (mask || j != left[j])); /* CVE-2006-4338 */
> 		fillbuf(c_len[j] - 12);
> 	}
> 	return j;
>@@ -451,7 +451,7 @@ decode_p_st1( /* void */ )
> 			else
> 				j = left[j];
> 			mask >>= 1;
>-		} while (j >= np);
>+		} while (j >= np && (mask || j != left[j])); /* CVE-2006-4338 */
> 		fillbuf(pt_len[j] - 8);
> 	}
> 	if (j != 0)
>diff -urp lha-114i.orig/src/lha_macro.h lha-114i/src/lha_macro.h
>--- lha-114i.orig/src/lha_macro.h	2006-12-22 12:45:52.000000000 +0100
>+++ lha-114i/src/lha_macro.h	2006-12-22 12:51:37.000000000 +0100
>@@ -324,6 +324,8 @@ typedef short   				node;
> /* Individual macro define													*/
> /* ------------------------------------------------------------------------ */
> 
>+#define MIN(a,b) ((a) <= (b) ? (a) : (b))
>+
> /* from crcio.c */
> #define CRCPOLY			0xA001		/* CRC-16 */
> #define UPDATE_CRC(c)	crc = crctable[(crc ^ (c)) & 0xFF] ^ (crc >> CHAR_BIT)
>diff -urp lha-114i.orig/src/maketbl.c lha-114i/src/maketbl.c
>--- lha-114i.orig/src/maketbl.c	2006-12-22 12:45:52.000000000 +0100
>+++ lha-114i/src/maketbl.c	2006-12-22 12:51:01.000000000 +0100
>@@ -32,8 +32,15 @@ make_table(nchar, bitlen, tablebits, tab
> 	}
> 
> 	/* count */
>-	for (i = 0; i < nchar; i++)
>-		count[bitlen[i]]++;
>+	for (i = 0; i < nchar; i++) {
>+		if (bitlen[i] > 16) {
>+			/* CVE-2006-4335 */
>+			error("Bad table (case a)");
>+			exit(1);
>+		}
>+		else
>+			count[bitlen[i]]++;
>+	}
> 
> 	/* calculate first code */
> 	total = 0;
>@@ -41,8 +48,10 @@ make_table(nchar, bitlen, tablebits, tab
> 		start[i] = total;
> 		total += weight[i] * count[i];
> 	}
>-	if ((total & 0xffff) != 0)
>-		error("make_table()", "Bad table (5)\n");
>+	if ((total & 0xffff) != 0 || tablebits > 16) { /* 16 for weight below */
>+		error("make_table(): Bad table (case b)");
>+		exit(1);
>+	}
> 
> 	/* shift data for make table. */
> 	m = 16 - tablebits;
>@@ -53,7 +62,7 @@ make_table(nchar, bitlen, tablebits, tab
> 
> 	/* initialize */
> 	j = start[tablebits + 1] >> m;
>-	k = 1 << tablebits;
>+	k = MIN(1 << tablebits, 4096);
> 	if (j != 0)
> 		for (i = j; i < k; i++)
> 			table[i] = 0;
>@@ -66,12 +75,19 @@ make_table(nchar, bitlen, tablebits, tab
> 		l = start[k] + weight[k];
> 		if (k <= tablebits) {
> 			/* code in table */
>+			l = MIN(l, 4096);
> 			for (i = start[k]; i < l; i++)
> 				table[i] = j;
> 		}
> 		else {
> 			/* code not in table */
>-			p = &table[(i = start[k]) >> m];
>+			i = start[k];
>+			if ((i >> m) > 4096) {
>+				/* CVE-2006-4337 */
>+				error("Bad table (case c)");
>+				exit(1);
>+			}
>+			p = &table[i >> m];
> 			i <<= tablebits;
> 			n = k - tablebits;
> 			/* make tree (n length) */

Actions: View | Diff

Attachments on bug 220595: 144273 | 144274