Attachment 144274 Details for Bug 220595 – Backported patch for RHEL 2.1 release

[patch] Backported patch for RHEL 2.1 release

lha-CVE-2006-433x-EL2_1.diff (text/plain), 3.65 KB, created by Lubomir Kundrak on 2006-12-22 12:42:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2006-12-22 12:42:53 UTC

Size: 3.65 KB

patch

obsolete

>diff -urp lha-1.00.orig/src/huf.c lha-1.00/src/huf.c
>--- lha-1.00.orig/src/huf.c	2006-12-22 13:07:28.000000000 +0100
>+++ lha-1.00/src/huf.c	2006-12-22 13:19:22.000000000 +0100
>@@ -233,7 +233,7 @@ short i_special;
> 		for (i = 0; i < 256; i++) pt_table[i] = c;
> 	} else {
> 		i = 0;
>-		while (i < n) {
>+		while (i < MIN(n, NPT)) {
> 			c = bitbuf >> (16 - 3);
> 			if (c == 7) {
> 				unsigned short mask = 1 << (16 - 4);
>@@ -243,7 +243,7 @@ short i_special;
> 			pt_len[i++] = c;
> 			if (i == i_special) {
> 				c = getbits(2);
>-				while (--c >= 0) pt_len[i++] = 0;
>+				while (--c >= 0 && i < NPT) pt_len[i++] = 0;
> 			}
> 		}
> 		while (i < nn) pt_len[i++] = 0;
>@@ -262,7 +262,7 @@ static void read_c_len(void)
> 		for (i = 0; i < 4096; i++) c_table[i] = c;
> 	} else {
> 		i = 0;
>-		while (i < n) {
>+		while (i < MIN(n,NC)) {
> 			c = pt_table[bitbuf >> (16 - 8)];
> 			if (c >= NT) {
> 				unsigned short mask = 1 << (16 - 9);
>@@ -270,7 +270,7 @@ static void read_c_len(void)
> 					if (bitbuf & mask) c = right[c];
> 					else               c = left [c];
> 					mask >>= 1;
>-				} while (c >= NT);
>+				} while (c >= NT && (mask || c != left[c])); /* CVE-2006-4338 */
> 			}
> 			fillbuf(pt_len[c]);
> 			if (c <= 2) {
>@@ -304,7 +304,7 @@ unsigned short decode_c_st1(void)
> 			if (bitbuf & mask) j = right[j];
> 			else               j = left [j];
> 			mask >>= 1;
>-		} while (j >= NC);
>+		} while (j >= NC && (mask || j != left[j])); /* CVE-2006-4338 */
> 		fillbuf(c_len[j] - 12);
> 	}
> 	return j;
>@@ -322,7 +322,7 @@ unsigned short decode_p_st1(void)
> 			if (bitbuf & mask) j = right[j];
> 			else               j = left [j];
> 			mask >>= 1;
>-		} while (j >= NP);
>+		} while (j >= NP && (mask || j != left[j])); /* CVE-2006-4338 */
> 		fillbuf(pt_len[j] - 8);
> 	}
> 	if (j != 0) j = (1 << (j - 1)) + getbits(j - 1);
>diff -urp lha-1.00.orig/src/maketbl.c lha-1.00/src/maketbl.c
>--- lha-1.00.orig/src/maketbl.c	2006-12-22 13:07:28.000000000 +0100
>+++ lha-1.00/src/maketbl.c	2006-12-22 13:15:26.000000000 +0100
>@@ -72,7 +72,15 @@ unsigned short table[];
> 	}
> 
> /* count */
>-	for (i = 0; i < nchar; i++) count[bitlen[i]]++;
>+	for (i = 0; i < nchar; i++) {
>+		if (bitlen[i] > 16) {
>+			/* CVE-2006-4335 */
>+			error("Bad table (case a)");
>+			exit(1);
>+		}
>+		else
>+			count[bitlen[i]]++;
>+	}
> 
> /* calculate first code */
> 	total = 0;
>@@ -80,8 +88,10 @@ unsigned short table[];
> 		start[i] = total;
> 		total += weight[i] * count[i];
> 	}
>-	if ((total & 0xffff) != 0)
>-	  error("Bad table (5)\n");
>+	if ((total & 0xffff) != 0 || tablebits > 16) { /* 16 for weight below */
>+		error("make_table(): Bad table (case b)");
>+		exit(1);
>+	}
> 
> /* shift data for make table. */
> 	m = 16 - tablebits;
>@@ -92,7 +102,7 @@ unsigned short table[];
> 
> /* initialize */
> 	j = start[tablebits + 1] >> m;
>-	k = 1 << tablebits;
>+	k = MIN(1 << tablebits, 4096);
> 	if (j != 0)
> 		for (i = j; i < k; i++) table[i] = 0;
> 
>@@ -103,10 +113,17 @@ unsigned short table[];
> 		l = start[k] + weight[k];
> 		if (k <= tablebits) {
> 		/* code in table */
>+			l = MIN(l, 4096);
> 			for (i = start[k]; i < l; i++) table[i] = j;
> 		} else {
> 		/* code not in table */
>-			p = &table[(i = start[k]) >> m];
>+			i = start[k];
>+			if ((i >> m) > 4096) {
>+				/* CVE-2006-4337 */
>+				error("Bad table (case c)");
>+				exit(1);
>+			}
>+			p = &table[i >> m];
> 			i <<= tablebits;
> 			n = k - tablebits;
> 		/* make tree (n length) */
>diff -urp lha-1.00.orig/src/slidehuf.h lha-1.00/src/slidehuf.h
>--- lha-1.00.orig/src/slidehuf.h	2006-12-22 13:07:28.000000000 +0100
>+++ lha-1.00/src/slidehuf.h	2006-12-22 13:21:17.000000000 +0100
>@@ -7,6 +7,8 @@
> #include <stdio.h>
> #include <errno.h>
> 
>+#define MIN(a,b) ((a) <= (b) ? (a) : (b))
>+
> #if defined(__STDC__) || defined(AIX)
> #include <limits.h>
> #else

Actions: View | Diff

Attachments on bug 220595: 144273 | 144274