Attachment 1980377 Details for Bug 2227130 – Patch to fix zipbomb zip64 data descriptor detection.

[patch] Patch to fix zipbomb zip64 data descriptor detection.

file_2227130.txt (text/plain), 1.33 KB, created by Colin Cross on 2023-07-28 05:21:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Colin Cross

Created: 2023-07-28 05:21:05 UTC

Size: 1.33 KB

patch

obsolete

>diff -ur unzip60/extract.c unzip60.bak/extract.c
>--- unzip60/extract.c	2023-07-26 13:45:24.026733389 -0700
>+++ unzip60.bak/extract.c	2023-07-26 13:46:12.758998098 -0700
>@@ -2188,7 +2212,9 @@
>          */
> #       define SIG 0x08074b50
> #       define LOW 0xffffffff
>+#       define Z64FLGL 0xffffffff
>         uch buf[12];
>+        int lrec_zip64 = G.lrec.csize == Z64FLGL || G.lrec.ucsize == Z64FLGL;
>         unsigned shy = 12 - readbuf((char *)buf, 12);
>         ulg crc = shy ? 0 : makelong(buf);
>         ulg clen = shy ? 0 : makelong(buf + 4);
>@@ -2198,12 +2224,12 @@
>              (clen == SIG &&                    /* if not SIG, no signature */
>               ((G.lrec.csize & LOW) != SIG ||   /* if not SIG, have signature */
>                (ulen == SIG &&                  /* if not SIG, no signature */
>-                (G.pInfo->zip64 ? G.lrec.csize >> 32 : G.lrec.ucsize) != SIG
>+                (lrec_zip64 ? G.lrec.csize >> 32 : G.lrec.ucsize) != SIG
>                 /* if not SIG, have signature */
>                 )))))
>           /* skip four more bytes to account for signature */
>           shy += 4 - readbuf((char *)buf, 4);
>-        if (G.pInfo->zip64)
>+        if (lrec_zip64)
>           shy += 8 - readbuf((char *)buf, 8); /* skip eight more for ZIP64 */
>         if (shy)
>           error = PK_ERR;

Actions: View | Diff

Attachments on bug 2227130: 1980377