michael@241: Security Fix
michael@241: 
michael@241: Index: gzip.c
michael@241: --- gzip.c.orig	2009-09-26 20:56:02 +0200
michael@241: +++ gzip.c	2009-10-07 07:59:53 +0200
michael@241: @@ -168,7 +168,7 @@
michael@241:  DECLARE(uch, inbuf,  INBUFSIZ +INBUF_EXTRA);
michael@241:  DECLARE(uch, outbuf, OUTBUFSIZ+OUTBUF_EXTRA);
michael@241:  DECLARE(ush, d_buf,  DIST_BUFSIZE);
michael@241: -DECLARE(uch, window, 2L*WSIZE);
michael@241: +DECLARE(uch, window, 2L*WSIZE + 4096); /* enlarge to avoid crashs due to peeking beyond the buffer end */
michael@241:  #ifndef MAXSEG_64K
michael@241:      DECLARE(ush, tab_prefix, 1L<<BITS);
michael@241:  #else
michael@241: 
michael@241: -----------------------------------------------------------------------------
michael@241: 
michael@241: Security Fixes 
michael@241: - OOB write        (CVE-2006-4335)
michael@241: - Buffer underflow (CVE-2006-4336)
michael@241: - Buffer overflow  (CVE-2006-4337)
michael@241: - Infinite loop    (CVE-2006-4338)
michael@241: 
michael@241: Index: gzip.h
michael@241: --- gzip.h.orig	2009-09-26 20:43:28 +0200
michael@241: +++ gzip.h	2009-10-07 07:59:53 +0200
michael@241: @@ -223,6 +223,8 @@
michael@241:  extern int to_stdout;      /* output to stdout (-c) */
michael@241:  extern int save_orig_name; /* set if original name must be saved */
michael@241:  
michael@241: +#define MIN(a,b) ((a) <= (b) ? (a) : (b))
michael@241: +
michael@241:  #define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(0))
michael@241:  #define try_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(1))
michael@241:  
michael@241: Index: unlzh.c
michael@241: --- unlzh.c.orig	2009-09-26 20:20:40 +0200
michael@241: +++ unlzh.c	2009-10-07 07:59:53 +0200
michael@241: @@ -141,12 +141,17 @@
michael@241:      unsigned i, k, len, ch, jutbits, avail, nextcode, mask;
michael@241:  
michael@241:      for (i = 1; i <= 16; i++) count[i] = 0;
michael@241: -    for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++;
michael@241: +    for (i = 0; i < (unsigned)nchar; i++) {
michael@241: +        if (bitlen[i] > 16)
michael@241: +            error("Bad table\n");
michael@241: +        else
michael@241: +            count[bitlen[i]]++;
michael@241: +    }
michael@241:  
michael@241:      start[1] = 0;
michael@241:      for (i = 1; i <= 16; i++)
michael@241:  	start[i + 1] = start[i] + (count[i] << (16 - i));
michael@241: -    if ((start[17] & 0xffff) != 0)
michael@241: +    if ((start[17] & 0xffff) != 0 || tablebits > 16) /* 16 for weight below */
michael@241:        gzip_error ("Bad table\n");
michael@241:  
michael@241:      jutbits = 16 - tablebits;
michael@241: @@ -161,15 +166,15 @@
michael@241:  
michael@241:      i = start[tablebits + 1] >> jutbits;
michael@241:      if (i != 0) {
michael@241: -	k = 1 << tablebits;
michael@241: -	while (i != k) table[i++] = 0;
michael@241: +	k = MIN(1 << tablebits, DIST_BUFSIZE);
michael@241: +	while (i < k) table[i++] = 0;
michael@241:      }
michael@241:  
michael@241:      avail = nchar;
michael@241:      mask = (unsigned) 1 << (15 - tablebits);
michael@241:      for (ch = 0; ch < (unsigned)nchar; ch++) {
michael@241:  	if ((len = bitlen[ch]) == 0) continue;
michael@241: -	nextcode = start[len] + weight[len];
michael@241: +	nextcode = MIN(start[len] + weight[len], DIST_BUFSIZE);
michael@241:  	if (len <= (unsigned)tablebits) {
michael@241:  	    if ((unsigned) 1 << tablebits < nextcode)
michael@241:  	      gzip_error ("Bad table\n");
michael@241: @@ -212,7 +217,7 @@
michael@241:  	for (i = 0; i < 256; i++) pt_table[i] = c;
michael@241:      } else {
michael@241:  	i = 0;
michael@241: -	while (i < n) {
michael@241: +	while (i < MIN(n,NPT)) {
michael@241:  	    c = bitbuf >> (BITBUFSIZ - 3);
michael@241:  	    if (c == 7) {
michael@241:  		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
michael@241: @@ -224,7 +229,7 @@
michael@241:  	    pt_len[i++] = c;
michael@241:  	    if (i == i_special) {
michael@241:  		c = getbits(2);
michael@241: -		while (--c >= 0) pt_len[i++] = 0;
michael@241: +		while (--c >= 0 && i < NPT) pt_len[i++] = 0;
michael@241:  	    }
michael@241:  	}
michael@241:  	while (i < nn) pt_len[i++] = 0;
michael@241: @@ -244,7 +249,7 @@
michael@241:  	for (i = 0; i < 4096; i++) c_table[i] = c;
michael@241:      } else {
michael@241:  	i = 0;
michael@241: -	while (i < n) {
michael@241: +	while (i < MIN(n,NC)) {
michael@241:  	    c = pt_table[bitbuf >> (BITBUFSIZ - 8)];
michael@241:  	    if (c >= NT) {
michael@241:  		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8);
michael@241: @@ -252,14 +257,14 @@
michael@241:  		    if (bitbuf & mask) c = right[c];
michael@241:  		    else               c = left [c];
michael@241:  		    mask >>= 1;
michael@241: -		} while (c >= NT);
michael@241: +		} while (c >= NT && (mask || c != left[c]));
michael@241:  	    }
michael@241:  	    fillbuf((int) pt_len[c]);
michael@241:  	    if (c <= 2) {
michael@241:  		if      (c == 0) c = 1;
michael@241:  		else if (c == 1) c = getbits(4) + 3;
michael@241:  		else             c = getbits(CBIT) + 20;
michael@241: -		while (--c >= 0) c_len[i++] = 0;
michael@241: +		while (--c >= 0 && i < NC) c_len[i++] = 0;
michael@241:  	    } else c_len[i++] = c - 2;
michael@241:  	}
michael@241:  	while (i < NC) c_len[i++] = 0;
michael@241: @@ -288,7 +293,7 @@
michael@241:  	    if (bitbuf & mask) j = right[j];
michael@241:  	    else               j = left [j];
michael@241:  	    mask >>= 1;
michael@241: -	} while (j >= NC);
michael@241: +	} while (j >= NC && (mask || j != left[j]));
michael@241:      }
michael@241:      fillbuf((int) c_len[j]);
michael@241:      return j;
michael@241: @@ -305,7 +310,7 @@
michael@241:  	    if (bitbuf & mask) j = right[j];
michael@241:  	    else               j = left [j];
michael@241:  	    mask >>= 1;
michael@241: -	} while (j >= NP);
michael@241: +	} while (j >= NP && (mask || j != left[j]));
michael@241:      }
michael@241:      fillbuf((int) pt_len[j]);
michael@241:      if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));
michael@241: @@ -352,7 +357,7 @@
michael@241:      while (--j >= 0) {
michael@241:  	buffer[r] = buffer[i];
michael@241:  	i = (i + 1) & (DICSIZ - 1);
michael@241: -	if (++r == count) return r;
michael@241: +	if (++r >= count) return r;
michael@241:      }
michael@241:      for ( ; ; ) {
michael@241:  	c = decode_c();
michael@241: @@ -362,14 +367,14 @@
michael@241:  	}
michael@241:  	if (c <= UCHAR_MAX) {
michael@241:  	    buffer[r] = c;
michael@241: -	    if (++r == count) return r;
michael@241: +	    if (++r >= count) return r;
michael@241:  	} else {
michael@241:  	    j = c - (UCHAR_MAX + 1 - THRESHOLD);
michael@241:  	    i = (r - decode_p() - 1) & (DICSIZ - 1);
michael@241:  	    while (--j >= 0) {
michael@241:  		buffer[r] = buffer[i];
michael@241:  		i = (i + 1) & (DICSIZ - 1);
michael@241: -		if (++r == count) return r;
michael@241: +		if (++r >= count) return r;
michael@241:  	    }
michael@241:  	}
michael@241:      }
michael@241: Index: unpack.c
michael@241: --- unpack.c.orig	2009-09-26 20:43:28 +0200
michael@241: +++ unpack.c	2009-10-07 07:59:53 +0200
michael@241: @@ -22,7 +22,6 @@
michael@241:  #include "gzip.h"
michael@241:  #include "crypt.h"
michael@241:  
michael@241: -#define MIN(a,b) ((a) <= (b) ? (a) : (b))
michael@241:  /* The arguments must not have side effects. */
michael@241:  
michael@241:  #define MAX_BITLEN 25
michael@241: @@ -146,7 +145,7 @@
michael@241:  	/* Remember where the literals of this length start in literal[] : */
michael@241:  	lit_base[len] = base;
michael@241:  	/* And read the literals: */
michael@241: -	for (n = leaves[len]; n > 0; n--) {
michael@241: +	for (n = leaves[len]; n > 0 && base < LITERALS; n--) {
michael@241:  	    literal[base++] = (uch)get_byte();
michael@241:  	}
michael@241:      }
michael@241: @@ -182,7 +181,7 @@
michael@241:      prefixp = &prefix_len[1<<peek_bits];
michael@241:      for (len = 1; len <= peek_bits; len++) {
michael@241:  	int prefixes = leaves[len] << (peek_bits-len); /* may be 0 */
michael@241: -	while (prefixes--) *--prefixp = (uch)len;
michael@241: +	while (prefixes-- && prefixp > prefix_len) *--prefixp = (uch)len;
michael@241:      }
michael@241:      /* The length of all other codes is unknown: */
michael@241:      while (prefixp > prefix_len) *--prefixp = 0;