From 62178338250c2211cada46d01c57fc8cc76fcede Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 1 Feb 2018 22:05:39 +0200 Subject: [PATCH 1/6] Update to 0.13.67 --- zziplib.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/zziplib.spec b/zziplib.spec index 12fb2ab..5bb0f7b 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -1,11 +1,11 @@ Summary: Lightweight library to easily extract data from zip files Name: zziplib -Version: 0.13.62 -Release: 10%{?dist} +Version: 0.13.67 +Release: 1%{?dist} License: LGPLv2+ or MPLv1.1 Group: Applications/Archiving URL: http://zziplib.sourceforge.net/ -Source: http://dl.sf.net/zziplib/zziplib-%{version}.tar.bz2 +Source: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz Patch0: zziplib-0.13.59-multilib.patch BuildRequires: perl-interpreter BuildRequires: python @@ -100,6 +100,10 @@ install -p -m 0644 _config.h %{buildroot}%{_includedir}/zzip/_config.h %{_mandir}/man3/* %changelog +* Thu Feb 01 2018 Alexander Bokovoy - 0.13.67-1 +- Update release +- CVE-2018-6381 + * Thu Aug 03 2017 Fedora Release Engineering - 0.13.62-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild From 2f0499910ab48bdc4e7a8745b04b66480b417526 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 1 Feb 2018 23:04:31 +0200 Subject: [PATCH 2/6] Fix CVE 2018-6381 --- .gitignore | 1 + sources | 2 +- zziplib-0.13.67-CVE-2018-6381.patch | 28 +++++++++++++++++++ ...ib.patch => zziplib-0.13.67-multilib.patch | 10 +++---- zziplib.spec | 13 +++++---- 5 files changed, 42 insertions(+), 12 deletions(-) create mode 100644 zziplib-0.13.67-CVE-2018-6381.patch rename zziplib-0.13.59-multilib.patch => zziplib-0.13.67-multilib.patch (74%) diff --git a/.gitignore b/.gitignore index 575c8ca..e06560b 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ zziplib-0.13.49.tar.bz2 /zziplib-0.13.59.tar.bz2 /zziplib-0.13.60.tar.bz2 /zziplib-0.13.62.tar.bz2 +/v0.13.67.tar.gz diff --git a/sources b/sources index 77b7c33..0f2de80 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -5fe874946390f939ee8f4abe9624b96c zziplib-0.13.62.tar.bz2 +SHA512 (v0.13.67.tar.gz) = a34b801a18a2051aa3898a572508ffd327521b69878413af679b10f6a68b37e770651884ae611bf9c01ce14013c6a1e06adeadd3ef6219d4b9278f1b9e7a6459 diff --git a/zziplib-0.13.67-CVE-2018-6381.patch b/zziplib-0.13.67-CVE-2018-6381.patch new file mode 100644 index 0000000..d614558 --- /dev/null +++ b/zziplib-0.13.67-CVE-2018-6381.patch @@ -0,0 +1,28 @@ +From a803559fa9194be895422ba3684cf6309b6bb598 Mon Sep 17 00:00:00 2001 +From: Guido Draheim +Date: Thu, 1 Feb 2018 12:27:49 +0100 +Subject: [PATCH] merge CVE-2018-6381.patch from @jmoellers #12 + +--- + zzip/memdisk.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/zzip/memdisk.c b/zzip/memdisk.c +index cab883b..a85dab0 100644 +--- a/zzip/memdisk.c ++++ b/zzip/memdisk.c +@@ -210,6 +210,14 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZIP_DISK_ENTRY * entry) + item->zz_diskstart = zzip_disk_entry_get_diskstart(entry); + item->zz_filetype = zzip_disk_entry_get_filetype(entry); + ++ /* ++ * If the file is uncompressed, zz_csize and zz_usize should be the same ++ * If they are not, we cannot guarantee that either is correct, so ... ++ */ ++ if (item->zz_compr == ZZIP_IS_STORED && item->zz_csize != item->zz_usize) ++ { ++ goto error; ++ } + /* zz_comment and zz_name are empty strings if not present on disk */ + if (! item->zz_comment || ! item->zz_name) + { diff --git a/zziplib-0.13.59-multilib.patch b/zziplib-0.13.67-multilib.patch similarity index 74% rename from zziplib-0.13.59-multilib.patch rename to zziplib-0.13.67-multilib.patch index f4b7a98..169520b 100644 --- a/zziplib-0.13.59-multilib.patch +++ b/zziplib-0.13.67-multilib.patch @@ -1,6 +1,6 @@ -diff -Naupr zziplib-0.13.59.orig/zzip/_config.h zziplib-0.13.59/zzip/_config.h ---- zziplib-0.13.59.orig/zzip/_config.h 2010-02-14 22:29:34.000000000 +0100 -+++ zziplib-0.13.59/zzip/_config.h 2010-12-04 16:22:19.809534085 +0100 +diff -up ./x86_64-redhat-linux-gnu/zzip/_config.h.orig ./x86_64-redhat-linux-gnu/zzip/_config.h +--- ./x86_64-redhat-linux-gnu/zzip/_config.h.orig 2018-02-01 22:13:36.593910695 +0200 ++++ ./x86_64-redhat-linux-gnu/zzip/_config.h 2018-02-01 22:15:40.341476130 +0200 @@ -133,7 +133,11 @@ /* whether the system defaults to 32bit off_t but can do 64bit when requested @@ -14,7 +14,7 @@ diff -Naupr zziplib-0.13.59.orig/zzip/_config.h zziplib-0.13.59/zzip/_config.h /* Define to the sub-directory in which libtool stores uninstalled libraries. */ -@@ -178,8 +181,12 @@ +@@ -183,8 +187,12 @@ /* The number of bytes in type long */ #ifndef ZZIP_SIZEOF_LONG @@ -27,7 +27,7 @@ diff -Naupr zziplib-0.13.59.orig/zzip/_config.h zziplib-0.13.59/zzip/_config.h /* The number of bytes in type short */ #ifndef ZZIP_SIZEOF_SHORT -@@ -209,7 +216,11 @@ +@@ -219,7 +227,11 @@ #endif /* Number of bits in a file offset, on hosts where this is settable. */ diff --git a/zziplib.spec b/zziplib.spec index 5bb0f7b..49f773f 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -6,7 +6,8 @@ License: LGPLv2+ or MPLv1.1 Group: Applications/Archiving URL: http://zziplib.sourceforge.net/ Source: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz -Patch0: zziplib-0.13.59-multilib.patch +Patch0: zziplib-0.13.67-CVE-2018-6381.patch +Patch1: zziplib-0.13.67-multilib.patch BuildRequires: perl-interpreter BuildRequires: python BuildRequires: zip @@ -59,8 +60,6 @@ zziplib library. %prep %setup -q %patch0 -p1 -# Save the common patched _config.h file to overwrite the generated one -cp -a zzip/_config.h _config.h %build export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" @@ -71,13 +70,15 @@ export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" # Remove rpath on 64bit archs sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' */libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' */libtool +cd %{_host} +%apply_patch %{PATCH1} -p2 +cd .. + %{__make} %{?_smp_mflags} + %install make install DESTDIR=%{buildroot} -# Overwrite the platform specific _config.h with our own modified common one -rm -f %{buildroot}%{_includedir}/zzip/_config.h -install -p -m 0644 _config.h %{buildroot}%{_includedir}/zzip/_config.h %post -p /sbin/ldconfig From b3f86d446be1fa3f91492ab7673c4c083d6d1589 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 1 Feb 2018 23:14:35 +0200 Subject: [PATCH 3/6] Use predictable builddir --- zziplib.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/zziplib.spec b/zziplib.spec index 49f773f..cac827c 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -66,11 +66,12 @@ export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" %configure \ --disable-static \ --enable-sdl \ - --enable-frame-pointer + --enable-frame-pointer \ + --enable-builddir=_builddir # Remove rpath on 64bit archs sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' */libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' */libtool -cd %{_host} +cd _builddir %apply_patch %{PATCH1} -p2 cd .. From 2e3781089ce0f3b7ddf56194a40646576f2e40a2 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 1 Feb 2018 23:46:11 +0200 Subject: [PATCH 4/6] Only use patched _config.h on non i686 and armv7hl --- zziplib.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/zziplib.spec b/zziplib.spec index cac827c..e0bdcb6 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -71,9 +71,13 @@ export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" # Remove rpath on 64bit archs sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' */libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' */libtool +# Only patch generated _config.h on non-i686 and armv7hl +# These platforms have a correct _config.h already +%ifnarch i686 armv7hl cd _builddir %apply_patch %{PATCH1} -p2 cd .. +%endif %{__make} %{?_smp_mflags} From 35ae27c25816f0d905260f24f7ca454954e99b1b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 14 Feb 2018 18:36:14 +0200 Subject: [PATCH 5/6] Update to 0.13.68 Fixes #1543942 --- .gitignore | 1 + sources | 1 + zziplib-0.13.67-CVE-2018-6381.patch | 28 ---------------------------- zziplib.spec | 12 +++++++----- 4 files changed, 9 insertions(+), 33 deletions(-) delete mode 100644 zziplib-0.13.67-CVE-2018-6381.patch diff --git a/.gitignore b/.gitignore index e06560b..d01db63 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ zziplib-0.13.49.tar.bz2 /zziplib-0.13.60.tar.bz2 /zziplib-0.13.62.tar.bz2 /v0.13.67.tar.gz +/v0.13.68.tar.gz diff --git a/sources b/sources index 0f2de80..b483c7c 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (v0.13.67.tar.gz) = a34b801a18a2051aa3898a572508ffd327521b69878413af679b10f6a68b37e770651884ae611bf9c01ce14013c6a1e06adeadd3ef6219d4b9278f1b9e7a6459 +SHA512 (v0.13.68.tar.gz) = e8a9976242acc04064ec239b9b929228370a946e5bd37092adcc1bda14605710a3850d39795d1937b609d1ab9a9a1998152f8c88b2dccc387ac6ec774d9cfce9 diff --git a/zziplib-0.13.67-CVE-2018-6381.patch b/zziplib-0.13.67-CVE-2018-6381.patch deleted file mode 100644 index d614558..0000000 --- a/zziplib-0.13.67-CVE-2018-6381.patch +++ /dev/null @@ -1,28 +0,0 @@ -From a803559fa9194be895422ba3684cf6309b6bb598 Mon Sep 17 00:00:00 2001 -From: Guido Draheim -Date: Thu, 1 Feb 2018 12:27:49 +0100 -Subject: [PATCH] merge CVE-2018-6381.patch from @jmoellers #12 - ---- - zzip/memdisk.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/zzip/memdisk.c b/zzip/memdisk.c -index cab883b..a85dab0 100644 ---- a/zzip/memdisk.c -+++ b/zzip/memdisk.c -@@ -210,6 +210,14 @@ zzip_mem_entry_new(ZZIP_DISK * disk, ZZIP_DISK_ENTRY * entry) - item->zz_diskstart = zzip_disk_entry_get_diskstart(entry); - item->zz_filetype = zzip_disk_entry_get_filetype(entry); - -+ /* -+ * If the file is uncompressed, zz_csize and zz_usize should be the same -+ * If they are not, we cannot guarantee that either is correct, so ... -+ */ -+ if (item->zz_compr == ZZIP_IS_STORED && item->zz_csize != item->zz_usize) -+ { -+ goto error; -+ } - /* zz_comment and zz_name are empty strings if not present on disk */ - if (! item->zz_comment || ! item->zz_name) - { diff --git a/zziplib.spec b/zziplib.spec index e0bdcb6..bc72d64 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -1,13 +1,12 @@ Summary: Lightweight library to easily extract data from zip files Name: zziplib -Version: 0.13.67 +Version: 0.13.68 Release: 1%{?dist} License: LGPLv2+ or MPLv1.1 Group: Applications/Archiving URL: http://zziplib.sourceforge.net/ Source: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz -Patch0: zziplib-0.13.67-CVE-2018-6381.patch -Patch1: zziplib-0.13.67-multilib.patch +Patch0: zziplib-0.13.67-multilib.patch BuildRequires: perl-interpreter BuildRequires: python BuildRequires: zip @@ -59,7 +58,6 @@ zziplib library. %prep %setup -q -%patch0 -p1 %build export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" @@ -75,7 +73,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' */libtool # These platforms have a correct _config.h already %ifnarch i686 armv7hl cd _builddir -%apply_patch %{PATCH1} -p2 +%apply_patch %{PATCH0} -p2 cd .. %endif @@ -106,6 +104,10 @@ make install DESTDIR=%{buildroot} %{_mandir}/man3/* %changelog +* Wed Feb 14 2018 Alexander Bokovoy - 0.13.68-1 +- 0.13.68 +- Fixes: #1543942 (CVE-2018-6484) + * Thu Feb 01 2018 Alexander Bokovoy - 0.13.67-1 - Update release - CVE-2018-6381 From e2f8fc27c4fb4f04dc3e5aa04c1ffd6aa034af76 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 4 Sep 2018 11:02:14 +0300 Subject: [PATCH 6/6] Update to 0.13.69 --- sources | 1 + zziplib-0.13.67-multilib.patch | 42 ---------------------------------- zziplib-0.13.69-multilib.patch | 31 +++++++++++++++++++++++++ zziplib.spec | 28 ++++++++++++++++++++--- 4 files changed, 57 insertions(+), 45 deletions(-) delete mode 100644 zziplib-0.13.67-multilib.patch create mode 100644 zziplib-0.13.69-multilib.patch diff --git a/sources b/sources index b483c7c..c461259 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (v0.13.67.tar.gz) = a34b801a18a2051aa3898a572508ffd327521b69878413af679b10f6a68b37e770651884ae611bf9c01ce14013c6a1e06adeadd3ef6219d4b9278f1b9e7a6459 SHA512 (v0.13.68.tar.gz) = e8a9976242acc04064ec239b9b929228370a946e5bd37092adcc1bda14605710a3850d39795d1937b609d1ab9a9a1998152f8c88b2dccc387ac6ec774d9cfce9 +SHA512 (v0.13.69.tar.gz) = ade026289737f43ca92a8746818d87dd7618d473dbce159546ce9071c9e4cbe164a6b1c9efff16efb7aa0327b2ec6b34f3256c6bda19cd6e325703fffc810ef0 diff --git a/zziplib-0.13.67-multilib.patch b/zziplib-0.13.67-multilib.patch deleted file mode 100644 index 169520b..0000000 --- a/zziplib-0.13.67-multilib.patch +++ /dev/null @@ -1,42 +0,0 @@ -diff -up ./x86_64-redhat-linux-gnu/zzip/_config.h.orig ./x86_64-redhat-linux-gnu/zzip/_config.h ---- ./x86_64-redhat-linux-gnu/zzip/_config.h.orig 2018-02-01 22:13:36.593910695 +0200 -+++ ./x86_64-redhat-linux-gnu/zzip/_config.h 2018-02-01 22:15:40.341476130 +0200 -@@ -133,7 +133,11 @@ - - /* whether the system defaults to 32bit off_t but can do 64bit when requested - */ --/* #undef LARGEFILE_SENSITIVE */ -+#if __WORDSIZE == 32 -+#ifndef ZZIP_LARGEFILE_SENSITIVE -+#define ZZIP_LARGEFILE_SENSITIVE 1 -+#endif -+#endif - - /* Define to the sub-directory in which libtool stores uninstalled libraries. - */ -@@ -183,8 +187,12 @@ - - /* The number of bytes in type long */ - #ifndef ZZIP_SIZEOF_LONG -+#if __WORDSIZE == 32 -+#define ZZIP_SIZEOF_LONG 4 -+#elif __WORDSIZE == 64 - #define ZZIP_SIZEOF_LONG 8 - #endif -+#endif - - /* The number of bytes in type short */ - #ifndef ZZIP_SIZEOF_SHORT -@@ -219,7 +227,11 @@ - #endif - - /* Number of bits in a file offset, on hosts where this is settable. */ --/* #undef _FILE_OFFSET_BITS */ -+#if __WORDSIZE == 32 -+#ifndef ZZIP__FILE_OFFSET_BITS -+#define ZZIP__FILE_OFFSET_BITS 64 -+#endif -+#endif - - /* Define for large files, on AIX-style hosts. */ - /* #undef _LARGE_FILES */ diff --git a/zziplib-0.13.69-multilib.patch b/zziplib-0.13.69-multilib.patch new file mode 100644 index 0000000..24cf64b --- /dev/null +++ b/zziplib-0.13.69-multilib.patch @@ -0,0 +1,31 @@ +diff -up ./_builddir/zzip/_config.h.orig ./_builddir/zzip/_config.h +--- ./_builddir/zzip/_config.h.orig 2018-07-23 09:11:59.971840954 +0300 ++++ ./_builddir/zzip/_config.h 2018-07-23 09:12:07.438731527 +0300 +@@ -139,6 +139,11 @@ + /* whether the system defaults to 32bit off_t but can do 64bit when requested + */ + /* #undef LARGEFILE_SENSITIVE */ ++#if __WORDSIZE == 32 ++#ifndef ZZIP_LARGEFILE_SENSITIVE ++#define ZZIP_LARGEFILE_SENSITIVE 1 ++#endif ++#endif + + /* Define to the sub-directory where libtool stores uninstalled libraries. */ + #ifndef ZZIP_LT_OBJDIR +@@ -197,6 +202,15 @@ + /* The number of bytes in type short */ + /* #undef SIZEOF_SHORT */ + ++/* The number of bytes in type long */ ++#ifndef ZZIP_SIZEOF_LONG ++#if __WORDSIZE == 32 ++#define ZZIP_SIZEOF_LONG 4 ++#elif __WORDSIZE == 64 ++#define ZZIP_SIZEOF_LONG 8 ++#endif ++#endif ++ + /* Define to 1 if you have the ANSI C header files. */ + #ifndef ZZIP_STDC_HEADERS + #define ZZIP_STDC_HEADERS 1 diff --git a/zziplib.spec b/zziplib.spec index bc72d64..f03f9b9 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -1,14 +1,16 @@ Summary: Lightweight library to easily extract data from zip files Name: zziplib -Version: 0.13.68 +Version: 0.13.69 Release: 1%{?dist} License: LGPLv2+ or MPLv1.1 Group: Applications/Archiving URL: http://zziplib.sourceforge.net/ Source: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz -Patch0: zziplib-0.13.67-multilib.patch +Patch0: zziplib-0.13.69-multilib.patch +BuildRequires: gcc BuildRequires: perl-interpreter -BuildRequires: python +BuildRequires: python2 +BuildRequires: python2-rpm-macros BuildRequires: zip BuildRequires: xmlto BuildRequires: zlib-devel @@ -58,9 +60,12 @@ zziplib library. %prep %setup -q +# Force py2 for the build +find . -name '*.py' | xargs sed -i 's@#! /usr/bin/python@#! %__python2@g;s@#! /usr/bin/env python@#! %__python2@g' %build export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" +export PYTHON=%__python2 %configure \ --disable-static \ --enable-sdl \ @@ -104,10 +109,27 @@ make install DESTDIR=%{buildroot} %{_mandir}/man3/* %changelog +* Tue Sep 4 2018 Alexander Bokovoy - 0.13.69-1 +- Update to 0.13.69 release +- Fixes: #1545819 (CVE-2018-6869, CVE-2018-6484) +- Fixes: #1598246 (CVE-2018-6541) +- Fixes: #1554673 (CVE-2018-7727) +- Use versioned python executables everywhere + +* Sat Jul 14 2018 Fedora Release Engineering - 0.13.68-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Sun Mar 18 2018 Iryna Shcherbina - 0.13.68-2 +- Update Python 2 dependency declarations to new packaging standards + (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) + * Wed Feb 14 2018 Alexander Bokovoy - 0.13.68-1 - 0.13.68 - Fixes: #1543942 (CVE-2018-6484) +* Fri Feb 09 2018 Fedora Release Engineering - 0.13.67-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Thu Feb 01 2018 Alexander Bokovoy - 0.13.67-1 - Update release - CVE-2018-6381