diff options
Diffstat (limited to 'main/busybox/CVE-2021-42374.patch')
| -rw-r--r-- | main/busybox/CVE-2021-42374.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/main/busybox/CVE-2021-42374.patch b/main/busybox/CVE-2021-42374.patch new file mode 100644 index 00000000000..000ea4eb4f0 --- /dev/null +++ b/main/busybox/CVE-2021-42374.patch @@ -0,0 +1,45 @@ +From 0a79496ff649bd4b426b14a2a8810e84c3dccb34 Mon Sep 17 00:00:00 2001 +From: Denys Vlasenko <vda.linux@googlemail.com> +Date: Tue, 15 Jun 2021 15:07:57 +0200 +Subject: [PATCH] unlzma: fix a case where we could read before beginning of + buffer + +CVE-2021-42374 + +Testcase: + + 21 01 01 00 00 00 00 00 e7 01 01 01 ef 00 df b6 + 00 17 02 10 11 0f ff 00 16 00 00 + +Unfortunately, the bug is not reliably causing a segfault, +the behavior depends on what's in memory before the buffer. + +function old new delta +unpack_lzma_stream 2762 2768 +6 + +Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com> +(cherry picked from commit 04f052c56ded5ab6a904e3a264a73dc0412b2e78) +--- + archival/libarchive/decompress_unlzma.c | 5 ++++- + testsuite/unlzma.tests | 17 +++++++++++++---- + testsuite/unlzma_issue_3.lzma | Bin 0 -> 27 bytes + 3 files changed, 17 insertions(+), 5 deletions(-) + create mode 100644 testsuite/unlzma_issue_3.lzma + +diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c +index 0744f231a..fb5aac8fe 100644 +--- a/archival/libarchive/decompress_unlzma.c ++++ b/archival/libarchive/decompress_unlzma.c +@@ -290,8 +290,11 @@ unpack_lzma_stream(transformer_state_t *xstate) + uint32_t pos; + + pos = buffer_pos - rep0; +- if ((int32_t)pos < 0) ++ if ((int32_t)pos < 0) { + pos += header.dict_size; ++ if ((int32_t)pos < 0) ++ goto bad; ++ } + match_byte = buffer[pos]; + do { + int bit; |