zgrep: fix an arbitrary-file-write vulnerability

Resolves: CVE-2022-1271

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -6,6 +6,3 @@ gzip-1.4.tar.xz
 /gzip-1.9.tar.xz
 /gzip-1.10.tar.xz
 /gzip-1.11.tar.xz
-/gzip-1.12.tar.xz
-/gzip-1.13.tar.xz
-/gzip-1.14.tar.xz

cve-2022-1271-part1.patch

@@ -0,0 +1,43 @@
+From dc9740df61e575e8c3148b7bd3c147a81ea00c7c Mon Sep 17 00:00:00 2001
+From: Lasse Collin <lasse.collin@tukaani.org>
+Date: Mon, 4 Apr 2022 23:52:49 -0700
+Subject: zgrep: avoid exploit via multi-newline file names
+
+* zgrep.in: The issue with the old code is that with multiple
+newlines, the N-command will read the second line of input,
+then the s-commands will be skipped because it's not the end
+of the file yet, then a new sed cycle starts and the pattern
+space is printed and emptied. So only the last line or two get
+escaped. This patch makes sed read all lines into the pattern
+space and then do the escaping.
+
+This vulnerability was discovered by:
+cleemy desu wayo working with Trend Micro Zero Day Initiative
+---
+ zgrep.in | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/zgrep.in b/zgrep.in
+index 345dae3..bdf7da2 100644
+--- a/zgrep.in
++++ b/zgrep.in
+@@ -222,9 +222,13 @@ do
+ '* | *'&'* | *'\'* | *'|'*)
+         i=$(printf '%s\n' "$i" |
+             sed '
+-              $!N
+-              $s/[&\|]/\\&/g
+-              $s/\n/\\n/g
++              :start
++              $!{
++                N
++                b start
++              }
++              s/[&\|]/\\&/g
++              s/\n/\\n/g
+             ');;
+       esac
+       sed_script="s|^|$i:|"
+-- 
+cgit v1.1
+

cve-2022-1271-part2.patch

@@ -0,0 +1,77 @@
+From d74a30d45c6834c8e9f87115197370fe86656d81 Mon Sep 17 00:00:00 2001
+From: Jim Meyering <meyering@fb.com>
+Date: Mon, 4 Apr 2022 23:52:49 -0700
+Subject: zgrep: add NEWS and tests for this exploitable bug
+
+* tests/zgrep-abuse: New file, based on PoC by cleemy desu wayo.
+* tests/Makefile.am (TESTS): Add it.
+* NEWS: Mention the exploit.
+The bug appears to have been present since the beginning.
+---
+ tests/Makefile.am |  1 +
+ tests/zgrep-abuse | 41 +++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 45 insertions(+)
+ create mode 100755 tests/zgrep-abuse
+
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index d09672e..5f148d6 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -36,6 +36,7 @@ TESTS =					\
+   z-suffix				\
+   zdiff					\
+   zgrep-f				\
++  zgrep-abuse				\
+   zgrep-context				\
+   zgrep-signal				\
+   znew-k
+diff --git a/tests/zgrep-abuse b/tests/zgrep-abuse
+new file mode 100755
+index 0000000..3e8a8f9
+--- /dev/null
++++ b/tests/zgrep-abuse
+@@ -0,0 +1,41 @@
++#!/bin/sh
++# Show how zgrep applied to a crafted file name may overwrite
++# a selected file with chosen content.  Fixed in gzip-1.12.
++
++# Copyright (C) 2022 Free Software Foundation, Inc.
++
++# This program is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <https://www.gnu.org/licenses/>.
++# limit so don't run it by default.
++
++. "${srcdir=.}/init.sh"; path_prepend_ ..
++
++: > z || framework_failure_
++echo test |gzip > 'z|
++p
++1s|.*|chosen-content|
++1w hacked
++etouch .\x2fhacked2
++d
++#
++#' || framework_failure_
++
++fail=0
++
++zgrep test z* > /dev/null
++
++# Before the fix, each of these would be created.
++test -f hacked && fail=1
++test -f hacked2 && fail=1
++
++Exit $fail
+-- 
+cgit v1.1
+

cve-2022-1271-part3.patch

@@ -0,0 +1,46 @@
+From c99f320d5c0fd98fe88d9cea5407eb7ad9d50e8a Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Mon, 4 Apr 2022 23:52:49 -0700
+Subject: zgrep: port to POSIX sed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* zgrep.in (res): When escaping the file name do not rely on GNU
+sed’s extension to POSIX with respect to s/.../\n/.  Instead, use
+features that should also work with AIX and/or Solaris sed.  This is
+simpler anyway, and would have prevented the recently-fixed bug.
+---
+ zgrep.in | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/zgrep.in b/zgrep.in
+index bdf7da2..6a16dd1 100644
+--- a/zgrep.in
++++ b/zgrep.in
+@@ -220,18 +220,11 @@ do
+       case $i in
+       (*'
+ '* | *'&'* | *'\'* | *'|'*)
+-        i=$(printf '%s\n' "$i" |
+-            sed '
+-              :start
+-              $!{
+-                N
+-                b start
+-              }
+-              s/[&\|]/\\&/g
+-              s/\n/\\n/g
+-            ');;
++          icolon=$(printf '%s\n' "$i:" |
++                     sed -e 's/[&\|]/\\&/g' -e '$!s/$/\\/');;
++      (*) icolon="$i:";;
+       esac
+-      sed_script="s|^|$i:|"
++      sed_script="s|^|$icolon|"
+ 
+       # Fail if grep or sed fails.
+       r=$(
+-- 
+cgit v1.1
+

gzip.spec

@@ -1,9 +1,9 @@
 Summary: GNU data compression program
 Name: gzip
-Version: 1.14
-Release: 1%{?dist}
+Version: 1.11
+Release: 3%{?dist}
 # info pages are under GFDL license
-License: GPL-3.0-or-later AND GFDL-1.3-only
+License: GPLv3+ and GFDL
 Source0: https://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
 Source1: https://www.gnu.org/licenses/fdl-1.3.txt
 
@@ -11,7 +11,10 @@ Source1: https://www.gnu.org/licenses/fdl-1.3.txt
 Source100: colorzgrep.csh
 Source101: colorzgrep.sh
 
-Patch1: s390_errno.patch
+Patch1: gnulib.patch
+Patch2: cve-2022-1271-part1.patch
+Patch3: cve-2022-1271-part2.patch
+Patch4: cve-2022-1271-part3.patch
 
 # Fixed in upstream code.
 # http://thread.gmane.org/gmane.comp.gnu.gzip.bugs/378
@@ -39,8 +42,9 @@ very commonly used data compression program.
 
 %prep
 %setup -q
-%patch 1 -p1
-
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
 cp %{SOURCE1} .
 autoreconf
 
@@ -50,17 +54,7 @@ export CPPFLAGS="-DHAVE_LSTAT"
 export CC="%{__cc}"
 export CPP="%{__cpp}"
 export CXX="%{__cxx}"
-%ifarch s390x
-
-#When the otpimizations are enabled, the huft test fails as of F44/gzip1.14
-#export CFLAGS="$RPM_OPT_FLAGS -Dalignas=_Alignas -DDFLTCC_LEVEL_MASK=0x7e"
-#use this in the next realease after gzip 1.13 export CFLAGS="$RPM_OPT_FLAGS -DDFLTCC_LEVEL_MASK=0x7e"
-#%configure --enable-dfltcc
-
 %configure
-%else
-%configure
-%endif
 make
 %check
 make check
@@ -91,51 +85,8 @@ install -p -m 644 %{SOURCE101} %{buildroot}%{profiledir}
 %{profiledir}/*
 
 %changelog
-* Thu Aug 14 2025 Jakub Martisko <jamartis@redhat.com> - 1.14-1
-- Rebase to gzip 1.14
-- There are some issues when the s390x optimizations are turned on - the hufts test fails
-- This will need some further investigation, for the time, I've disabled the optimizations
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.13-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.13-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.13-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Thu Feb 01 2024 Jakub Martisko <jamartis@redhat.com> - 1.13-1
-- Rebase to gzip 1.13
-- There's a bug on s390x: https://lists.gnu.org/archive/html/bug-gzip/2023-10/msg00000.html
-- Revert the s390x build options in the next release
-Resolves: rhbz#2232890
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Wed Aug 02 2023 Jakub Martisko <jamartis@redhat.com> - 1.12-6
-- Enbale the s390x optimizations
-Resolves: rhbz#2175699
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Thu Apr 13 2023 Lukáš Zaoral <lzaoral@redhat.com> - 1.12-4
-- migrate to SPDX license format
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Mon Apr 11 2022 Jakub Martisko <jamartis@redhat.com> - 1.12-1
-- Rebase to gzip 1.12
-Resolves: rhbz#2073133
+* Wed Apr 13 2022 Jakub Martisko <jamartis@redhat.com> - 1.11-3
+- fix an arbitrary-file-write vulnerability in zgrep
 Resolves: CVE-2022-1271
 
 * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.11-2

plans/all.fmf

@@ -1,6 +0,0 @@
-summary: Basic smoke test
-discover:
-    how: fmf
-    url: https://src.fedoraproject.org/tests/gzip.git
-execute:
-    how: tmt

s390_errno.patch

@@ -1,26 +0,0 @@
-From c76affb4551630ff661ac1c1ee99353a17eb16e1 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Fri, 30 May 2025 12:31:04 -0700
-Subject: gzip: fix s390x build failure
-
-Problem reported by Jakub Martisko <https://bugs.gnu.org/78618>.
-* dfltcc.c: Include errno.h.
----
- dfltcc.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/dfltcc.c b/dfltcc.c
-index 9f86581..8307a97 100644
---- a/dfltcc.c
-+++ b/dfltcc.c
-@@ -17,6 +17,7 @@
- 
- #include <config.h>
- 
-+#include <errno.h>
- #include <stdlib.h>
- 
- #ifdef HAVE_SYS_SDT_H
--- 
-cgit v1.2.3
-

sources

@@ -1 +1 @@
-SHA512 (gzip-1.14.tar.xz) = 82aef53188b3e69b51b7ddab5b8c44a11a5b73c0039b22a315a0c7d244694feab0146748add4265901eb1b4c0cee8a9eb69594995f098830d964091af97079c5
+SHA512 (gzip-1.11.tar.xz) = af297c173297d588722f4d0f140a2ae4d3ea3861464191772fb2e11e47be43644b5ae01ed63f0051d6eb4751666284de53e14c4dd9f0c1d25f61cf676fbf11f3

tests/.gitignore

@@ -0,0 +1,2 @@
+*.swp
+*.retry

tests/test-simple

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -ex
+
+# exercise installed gzip/gunzip programs
+echo "Bla" > bla.file
+cp bla.file bla.file.orig
+gzip bla.file
+gunzip bla.file.gz
+cmp bla.file bla.file.orig
+echo "hi"
+rm bla.file bla.file.orig

tests/test_simple.yml

@@ -0,0 +1,32 @@
+---
+- hosts: localhost
+  vars:
+  - artifacts: ./artifacts
+  tags:
+  - atomic
+  - classic
+  - container
+  remote_user: root
+  tasks:
+  - name: Create the folder where we will store the tests
+    action: file state=directory path={{ item }}
+            owner=root group=root
+    with_items:
+    - /usr/local/bin
+
+  - name: Install the test files
+    copy: src={{ item.file }} dest=/usr/local/bin/{{ item.dest }}
+           mode=0755
+    with_items:
+    - {file: test-simple, dest: test-simple }
+
+  - block:
+    - name: Execute the tests
+      shell: exec > /tmp/test.log && /usr/local/bin/test-simple 2>&1
+
+  - always:
+    - name: Pull out the logs
+      fetch:
+        dest: "{{ artifacts }}/"
+        src: "/tmp/test.log"
+        flat: yes

tests/tests.yml

@@ -0,0 +1 @@
+- include: test_simple.yml