|
 |
11c328 |
From 75525dbdf9b7ed003e343c42710e8b13f73a7607 Mon Sep 17 00:00:00 2001
|
|
|
11c328 |
From: Ondrej Dubaj <odubaj@redhat.com>
|
|
|
11c328 |
Date: Thu, 23 Jan 2020 15:08:13 +0100
|
|
|
11c328 |
Subject: [PATCH] Fix buffer underflows in the zipfile extension associated
|
|
|
11c328 |
with zero-length or NULL filename in the ZIP archive. But report on the
|
|
|
11c328 |
mailing list by Yongheng and Rui.
|
|
|
11c328 |
|
|
|
11c328 |
---
|
|
|
11c328 |
ext/misc/zipfile.c | 14 +++++++++-----
|
|
|
11c328 |
test/zipfile.test | 13 +++++++++++++
|
|
|
11c328 |
2 files changed, 22 insertions(+), 5 deletions(-)
|
|
|
11c328 |
|
|
|
11c328 |
diff --git a/ext/misc/zipfile.c b/ext/misc/zipfile.c
|
|
|
11c328 |
index e6141ef..7fd4074 100644
|
|
|
11c328 |
--- a/ext/misc/zipfile.c
|
|
|
11c328 |
+++ b/ext/misc/zipfile.c
|
|
|
11c328 |
@@ -1433,8 +1433,8 @@ static int zipfileGetMode(
|
|
|
11c328 |
** identical, ignoring any trailing '/' character in either path. */
|
|
|
11c328 |
static int zipfileComparePath(const char *zA, const char *zB, int nB){
|
|
|
11c328 |
int nA = (int)strlen(zA);
|
|
|
11c328 |
- if( zA[nA-1]=='/' ) nA--;
|
|
|
11c328 |
- if( zB[nB-1]=='/' ) nB--;
|
|
|
11c328 |
+ if( nA>0 && zA[nA-1]=='/' ) nA--;
|
|
|
11c328 |
+ if( nB>0 && zB[nB-1]=='/' ) nB--;
|
|
|
11c328 |
if( nA==nB && memcmp(zA, zB, nA)==0 ) return 0;
|
|
|
11c328 |
return 1;
|
|
|
11c328 |
}
|
|
|
11c328 |
@@ -1628,11 +1628,15 @@ static int zipfileUpdate(
|
|
|
11c328 |
** '/'. This appears to be required for compatibility with info-zip
|
|
|
11c328 |
** (the unzip command on unix). It does not create directories
|
|
|
11c328 |
** otherwise. */
|
|
|
11c328 |
- if( zPath[nPath-1]!='/' ){
|
|
|
11c328 |
+ if( nPath<=0 || zPath[nPath-1]!='/' ){
|
|
|
11c328 |
zFree = sqlite3_mprintf("%s/", zPath);
|
|
|
11c328 |
- if( zFree==0 ){ rc = SQLITE_NOMEM; }
|
|
|
11c328 |
zPath = (const char*)zFree;
|
|
|
11c328 |
- nPath = (int)strlen(zPath);
|
|
|
11c328 |
+ if( zFree==0 ){
|
|
|
11c328 |
+ rc = SQLITE_NOMEM;
|
|
|
11c328 |
+ nPath = 0;
|
|
|
11c328 |
+ }else{
|
|
|
11c328 |
+ nPath = (int)strlen(zPath);
|
|
|
11c328 |
+ }
|
|
|
11c328 |
}
|
|
|
11c328 |
}
|
|
|
11c328 |
|
|
|
11c328 |
diff --git a/test/zipfile.test b/test/zipfile.test
|
|
|
11c328 |
index e4b8088..9f07c0a 100644
|
|
|
11c328 |
--- a/test/zipfile.test
|
|
|
11c328 |
+++ b/test/zipfile.test
|
|
|
11c328 |
@@ -821,4 +821,17 @@ do_execsql_test 14.10 {
|
|
|
11c328 |
PRAGMA integrity_check;
|
|
|
11c328 |
} {3 ok}
|
|
|
11c328 |
|
|
|
11c328 |
+# 2019-12-26 More problems in zipfile from the Yongheng and Rui fuzzer
|
|
|
11c328 |
+#
|
|
|
11c328 |
+do_execsql_test 15.10 {
|
|
|
11c328 |
+ DROP TABLE IF EXISTS t1;
|
|
|
11c328 |
+ CREATE VIRTUAL TABLE t1 USING zipfile(null);
|
|
|
11c328 |
+ REPLACE INTO t1 VALUES(null,null,0,null,null,null,null);
|
|
|
11c328 |
+} {}
|
|
|
11c328 |
+do_execsql_test 15.20 {
|
|
|
11c328 |
+ DROP TABLE IF EXISTS t2;
|
|
|
11c328 |
+ CREATE VIRTUAL TABLE t2 USING zipfile(null);
|
|
|
11c328 |
+ REPLACE INTO t2 values(null,null,null,null,null,10,null);
|
|
|
11c328 |
+} {}
|
|
|
11c328 |
+
|
|
|
11c328 |
finish_test
|
|
|
11c328 |
--
|
|
|
11c328 |
2.19.1
|
|
|
11c328 |
|