Blame SOURCES/unzip-zipbomb-part4.patch

a0bbf4
From 5e2efcd633a4a1fb95a129a75508e7d769e767be Mon Sep 17 00:00:00 2001
a0bbf4
From: Mark Adler <madler@alumni.caltech.edu>
a0bbf4
Date: Sun, 9 Feb 2020 20:36:28 -0800
a0bbf4
Subject: [PATCH] Fix bug in UZbunzip2() that incorrectly updated G.incnt.
a0bbf4
a0bbf4
The update assumed a full buffer, which is not always full. This
a0bbf4
could result in a false overlapped element detection when a small
a0bbf4
bzip2-compressed file was unzipped. This commit remedies that.
a0bbf4
---
a0bbf4
 extract.c | 2 +-
a0bbf4
 1 file changed, 1 insertion(+), 1 deletion(-)
a0bbf4
a0bbf4
diff --git a/extract.c b/extract.c
a0bbf4
index d9866f9..0cb7bfc 100644
a0bbf4
--- a/extract.c
a0bbf4
+++ b/extract.c
a0bbf4
@@ -3010,7 +3010,7 @@ __GDEF
a0bbf4
 #endif
a0bbf4
 
a0bbf4
     G.inptr = (uch *)bstrm.next_in;
a0bbf4
-    G.incnt = (G.inbuf + INBUFSIZ) - G.inptr;  /* reset for other routines */
a0bbf4
+    G.incnt -= G.inptr - G.inbuf;       /* reset for other routines */
a0bbf4
 
a0bbf4
 uzbunzip_cleanup_exit:
a0bbf4
     err = BZ2_bzDecompressEnd(&bstrm);