diff --git a/unzip-6.0-CVE-2022-0529-and-0530.patch b/unzip-6.0-CVE-2022-0529-and-0530.patch deleted file mode 100644 index 2b84b96..0000000 --- a/unzip-6.0-CVE-2022-0529-and-0530.patch +++ /dev/null @@ -1,170 +0,0 @@ -From: Steven M. Schweda -Subject: Fix for CVE-2022-0529 and CVE-2022-0530 -Bug-Debian: https://bugs.debian.org/1010355 -X-Debian-version: 6.0-27 - ---- a/fileio.c -+++ b/fileio.c -@@ -171,8 +171,10 @@ - static ZCONST char Far FilenameTooLongTrunc[] = - "warning: filename too long--truncating.\n"; - #ifdef UNICODE_SUPPORT -+ static ZCONST char Far UFilenameCorrupt[] = -+ "error: Unicode filename corrupt.\n"; - static ZCONST char Far UFilenameTooLongTrunc[] = -- "warning: Converted unicode filename too long--truncating.\n"; -+ "warning: Converted Unicode filename too long--truncating.\n"; - #endif - static ZCONST char Far ExtraFieldTooLong[] = - "warning: extra field too long (%d). Ignoring...\n"; -@@ -2361,16 +2363,30 @@ - /* convert UTF-8 to local character set */ - fn = utf8_to_local_string(G.unipath_filename, - G.unicode_escape_all); -- /* make sure filename is short enough */ -- if (strlen(fn) >= FILNAMSIZ) { -- fn[FILNAMSIZ - 1] = '\0'; -+ -+ /* 2022-07-22 SMS, et al. CVE-2022-0530 -+ * Detect conversion failure, emit message. -+ * Continue with unconverted name. -+ */ -+ if (fn == NULL) -+ { - Info(slide, 0x401, ((char *)slide, -- LoadFarString(UFilenameTooLongTrunc))); -- error = PK_WARN; -+ LoadFarString(UFilenameCorrupt))); -+ error = PK_ERR; -+ } -+ else -+ { -+ /* make sure filename is short enough */ -+ if (strlen(fn) >= FILNAMSIZ) { -+ fn[FILNAMSIZ - 1] = '\0'; -+ Info(slide, 0x401, ((char *)slide, -+ LoadFarString(UFilenameTooLongTrunc))); -+ error = PK_WARN; -+ } -+ /* replace filename with converted UTF-8 */ -+ strcpy(G.filename, fn); -+ free(fn); - } -- /* replace filename with converted UTF-8 */ -- strcpy(G.filename, fn); -- free(fn); - } - # endif /* UNICODE_WCHAR */ - if (G.unipath_filename != G.filename_full) ---- a/process.c -+++ b/process.c -@@ -222,6 +222,8 @@ - "\nwarning: Unicode Path version > 1\n"; - static ZCONST char Far UnicodeMismatchError[] = - "\nwarning: Unicode Path checksum invalid\n"; -+ static ZCONST char Far UFilenameTooLongTrunc[] = -+ "warning: filename too long (P1) -- truncating.\n"; - #endif - - -@@ -1915,7 +1917,7 @@ - Sets both local header and central header fields. Not terribly clever, - but it means that this procedure is only called in one place. - -- 2014-12-05 SMS. -+ 2014-12-05 SMS. (oCERT.org report.) CVE-2014-8141. - Added checks to ensure that enough data are available before calling - makeint64() or makelong(). Replaced various sizeof() values with - simple ("4" or "8") constants. (The Zip64 structures do not depend -@@ -1947,7 +1949,7 @@ - - if (eb_id == EF_PKSZ64) - { -- int offset = EB_HEADSIZE; -+ unsigned offset = EB_HEADSIZE; - - if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL)) - { -@@ -2046,7 +2049,7 @@ - } - if (eb_id == EF_UNIPATH) { - -- int offset = EB_HEADSIZE; -+ unsigned offset = EB_HEADSIZE; - ush ULen = eb_len - 5; - ulg chksum = CRCVAL_INITIAL; - -@@ -2504,16 +2507,17 @@ - int state_dependent; - int wsize = 0; - int max_bytes = MB_CUR_MAX; -- char buf[9]; -+ char buf[ MB_CUR_MAX+ 1]; /* ("+1" not really needed?) */ - char *buffer = NULL; - char *local_string = NULL; -+ size_t buffer_size; /* CVE-2022-0529 */ - - for (wsize = 0; wide_string[wsize]; wsize++) ; - - if (max_bytes < MAX_ESCAPE_BYTES) - max_bytes = MAX_ESCAPE_BYTES; -- -- if ((buffer = (char *)malloc(wsize * max_bytes + 1)) == NULL) { -+ buffer_size = wsize * max_bytes + 1; /* Reused below. */ -+ if ((buffer = (char *)malloc( buffer_size)) == NULL) { - return NULL; - } - -@@ -2551,8 +2555,28 @@ - } else { - /* no MB for this wide */ - /* use escape for wide character */ -- char *escape_string = wide_to_escape_string(wide_string[i]); -- strcat(buffer, escape_string); -+ size_t buffer_len; -+ size_t escape_string_len; -+ char *escape_string; -+ int err_msg = 0; -+ -+ escape_string = wide_to_escape_string(wide_string[i]); -+ buffer_len = strlen( buffer); -+ escape_string_len = strlen( escape_string); -+ -+ /* Append escape string, as space allows. */ -+ /* 2022-07-18 SMS, et al. CVE-2022-0529 */ -+ if (escape_string_len > buffer_size- buffer_len- 1) -+ { -+ escape_string_len = buffer_size- buffer_len- 1; -+ if (err_msg == 0) -+ { -+ err_msg = 1; -+ Info(slide, 0x401, ((char *)slide, -+ LoadFarString( UFilenameTooLongTrunc))); -+ } -+ } -+ strncat( buffer, escape_string, escape_string_len); - free(escape_string); - } - } -@@ -2604,9 +2628,18 @@ - ZCONST char *utf8_string; - int escape_all; - { -- zwchar *wide = utf8_to_wide_string(utf8_string); -- char *loc = wide_to_local_string(wide, escape_all); -- free(wide); -+ zwchar *wide; -+ char *loc = NULL; -+ -+ wide = utf8_to_wide_string( utf8_string); -+ -+ /* 2022-07-25 SMS, et al. CVE-2022-0530 */ -+ if (wide != NULL) -+ { -+ loc = wide_to_local_string( wide, escape_all); -+ free( wide); -+ } -+ - return loc; - } - diff --git a/unzip-6.0-RHEL-86228.patch b/unzip-6.0-RHEL-86228.patch deleted file mode 100644 index 25c2fbb..0000000 --- a/unzip-6.0-RHEL-86228.patch +++ /dev/null @@ -1,19 +0,0 @@ -From: Roy Tam -Subject: Handle Microsoft ZIP64 files by ignoring invalid "Total number of disks" field -Origin: https://sourceforge.net/p/infozip/bugs/42/ -Bug: https://sourceforge.net/p/infozip/bugs/42/ -Bug-Debian: https://bugs.debian.org/1064000 -Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/2051952 -X-Debian-version: 6.0-29 - ---- a/process.c -+++ b/process.c -@@ -1281,7 +1281,7 @@ - fprintf(stdout,"\nnumber of disks (ECR) %u, (ECLOC64) %lu\n", - G.ecrec.number_this_disk, ecloc64_total_disks); fflush(stdout); - #endif -- if ((G.ecrec.number_this_disk != 0xFFFF) && -+ if ((G.ecrec.number_this_disk != 0xFFFF) && ecloc64_total_disks && - (G.ecrec.number_this_disk != ecloc64_total_disks - 1)) { - /* Note: For some unknown reason, the developers at PKWARE decided to - store the "zip64 total disks" value as a counter starting from 1, diff --git a/unzip-6.0-fix-warning-messages-on-big-files.patch b/unzip-6.0-fix-warning-messages-on-big-files.patch deleted file mode 100644 index 55a115a..0000000 --- a/unzip-6.0-fix-warning-messages-on-big-files.patch +++ /dev/null @@ -1,15 +0,0 @@ -From: "Steven M. Schweda" -Subject: Fix lame code in fileio.c -Bug-Debian: https://bugs.debian.org/929502 -X-Debian-version: 6.0-23 - ---- a/fileio.c -+++ b/fileio.c -@@ -2477,6 +2477,7 @@ - */ - return (((zusz_t)sig[7]) << 56) - + (((zusz_t)sig[6]) << 48) -+ + (((zusz_t)sig[5]) << 40) - + (((zusz_t)sig[4]) << 32) - + (zusz_t)((((ulg)sig[3]) << 24) - + (((ulg)sig[2]) << 16) diff --git a/unzip-6.0-sast.patch b/unzip-6.0-sast.patch deleted file mode 100644 index 71b7cb9..0000000 --- a/unzip-6.0-sast.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/envargs.c 2005-03-04 03:23:38.000000000 +0100 -+++ b/envargs.c 2024-11-26 13:17:22.289650230 +0100 -@@ -118,7 +118,7 @@ - - /* remove escape characters */ - while ((argstart = MBSCHR(argstart, '\\')) != (char *)NULL) { -- strcpy(argstart, argstart + 1); -+ memmove(argstart, argstart + 1, strlen(argstart + 1) + 1); - if (*argstart) - ++argstart; - } diff --git a/unzip.spec b/unzip.spec index ed8ee48..479a80f 100644 --- a/unzip.spec +++ b/unzip.spec @@ -6,7 +6,7 @@ Summary: A utility for unpacking zip files Name: unzip Version: 6.0 -Release: 71%{?dist} +Release: 69%{?dist} License: Info-ZIP Source: http://downloads.sourceforge.net/infozip/unzip60.tar.gz @@ -75,15 +75,6 @@ Patch34: unzip-zipbomb-switch.patch Patch35: unzip-gnu89-build.patch Patch36: unzip-6.0-wcstombs-fortify.patch - -Patch37: unzip-6.0-fix-warning-messages-on-big-files.patch -Patch38: unzip-6.0-sast.patch -Patch39: unzip-6.0-RHEL-86228.patch -#From Debian -Patch40: unzip-6.0-CVE-2022-0529-and-0530.patch - - - URL: http://infozip.sourceforge.net BuildRequires: make BuildRequires: bzip2-devel, gcc @@ -138,10 +129,6 @@ a zip archive. %patch -P34 -p1 %patch -P35 -p1 %patch -P36 -p1 -%patch -P37 -p1 -%patch -P38 -p1 -%patch -P39 -p1 -%patch -P40 -p1 %build # IZ_HAVE_UXUIDGID is needed for right functionality of unzip -X @@ -160,14 +147,6 @@ make -f unix/Makefile prefix=$RPM_BUILD_ROOT%{_prefix} MANDIR=$RPM_BUILD_ROOT%{_ %{_mandir}/*/* %changelog -* Wed Jul 22 2026 Jakub Martisko - 6.0-71 -- Port some RHEL downstream patches to fedora -- Fixes for RHEL-86228, RHEL-45997 + some issues found by coverity and other scans -- Fixes for CVE-2022-0529 and 2022-0530 (Thanks Stewart Smith for the Heads up about these) - -* Fri Jul 17 2026 Fedora Release Engineering - 6.0-70 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - * Sat Jan 17 2026 Fedora Release Engineering - 6.0-69 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild