diff options
| author | Jim Meyering <meyering@redhat.com> | 2010-01-10 17:13:01 +0100 |
|---|---|---|
| committer | Jim Meyering <meyering@redhat.com> | 2010-01-20 15:00:28 +0100 |
| commit | a3db5806d012082b9e25cc36d09f19cd736a468f (patch) | |
| tree | 67d4151bdd227052ff1b58d348c7fe37d2d04de8 | |
| parent | 6fac6053f2ba1d8a914962e0b369d258e9f74c6f (diff) | |
| download | gzip-a3db5806d012082b9e25cc36d09f19cd736a468f.tar.gz | |
gzip -d: do not clobber stack for valid input on x86_64
* unlzw.c (unlzw): Avoid integer overflow.
Aki Helin reported the segfault along with an input to trigger the bug.
* NEWS (Bug fixes): Mention it.
| -rw-r--r-- | NEWS | 5 | ||||
| -rw-r--r-- | THANKS | 1 | ||||
| -rw-r--r-- | unlzw.c | 3 |
3 files changed, 8 insertions, 1 deletions
@@ -4,6 +4,11 @@ GNU gzip NEWS -*- outline -*- ** Bug fixes + gzip -d could segfault and/or clobber the stack, possibly leading to + arbitrary code execution. This affects x86_64 but not 32-bit systems. + This fixes CVE-2010-0001. + For more details, see http://bugzilla.redhat.com/554418 + gzip -d would fail with a CRC error for some valid inputs. So far, the only valid input known to exhibit this failure was compressed "from FAT filesystem (MS-DOS, OS/2, NT)". In addition, @@ -97,6 +97,7 @@ Harald Hanche-Olsen hanche@ams.sunysb.edu Darrel R. Hankerson hankedr@mail.auburn.edu Mark Hanning-Lee markhl@romeo.caltech.edu Lars Hecking st000002@hrz1.hrz.th-darmstadt.de +Aki Helin aki.helin@iki.fi Ruediger Helsch ruediger@ramz.ing.tu-bs.de Mark C. Henderson mch@sqwest.wimsey.bc.ca Karl Heuer karl@kelp.boston.ma.us @@ -240,7 +240,8 @@ int unlzw(in, out) int o; resetbuf: - e = insize-(o = (posbits>>3)); + o = posbits >> 3; + e = o <= insize ? insize - o : 0; for (i = 0 ; i < e ; ++i) { inbuf[i] = inbuf[i+o]; |
