Blame SOURCES/CVE-2018-17828-singlez.patch

1550c8
diff --git a/bins/unzip-mem.c b/bins/unzip-mem.c
1550c8
index c45cb72..ff564a5 100644
1550c8
--- a/bins/unzip-mem.c
1550c8
+++ b/bins/unzip-mem.c
1550c8
@@ -88,10 +88,53 @@ static void zzip_mem_entry_pipe(ZZIP_MEM_DISK* disk,
1550c8
     }
1550c8
 }
1550c8
1550c8
+//Using hard-coded value on RHEL-7
1550c8
+#define MY_PATH_MAX 4096
1550c8
+
1550c8
+static inline void
1550c8
+remove_dotdotslash(char *path)
1550c8
+{
1550c8
+    /* Note: removing "../" from the path ALWAYS shortens the path, never adds to it! */
1550c8
+    char *dotdotslash;
1550c8
+    int warned = 0;
1550c8
+
1550c8
+    dotdotslash = path;
1550c8
+    while ((dotdotslash = strstr(dotdotslash, "../")) != NULL)
1550c8
+    {
1550c8
+        /*
1550c8
+         * Remove only if at the beginning of the pathname ("../path/name")
1550c8
+         * or when preceded by a slash ("path/../name"),
1550c8
+         * otherwise not ("path../name..")!
1550c8
+         */
1550c8
+        if (dotdotslash == path || dotdotslash[-1] == '/')
1550c8
+        {
1550c8
+            char *src, *dst;
1550c8
+            if (!warned)
1550c8
+            {
1550c8
+                /* Note: the first time through the pathname is still intact */
1550c8
+                fprintf(stderr, "Removing \"../\" path component(s) in %s\n", path);
1550c8
+                warned = 1;
1550c8
+            }
1550c8
+            /* We cannot use strcpy(), as there "The strings may not overlap" */
1550c8
+            for (src = dotdotslash+3, dst=dotdotslash; (*dst = *src) != '\0'; src++, dst++)
1550c8
+                ;
1550c8
+        }
1550c8
+        else
1550c8
+            dotdotslash +=3;	/* skip this instance to prevent infinite loop */
1550c8
+    }
1550c8
+}
1550c8
+
1550c8
 static void zzip_mem_entry_make(ZZIP_MEM_DISK* disk, 
1550c8
 				ZZIP_MEM_ENTRY* entry)
1550c8
 {
1550c8
-    FILE* file = fopen (entry->zz_name, "w");
1550c8
+    char name_stripped[MY_PATH_MAX+1];
1550c8
+    FILE* file;
1550c8
+
1550c8
+    strncpy(name_stripped, entry->zz_name, MY_PATH_MAX);
1550c8
+    name_stripped[MY_PATH_MAX]='\0';
1550c8
+    remove_dotdotslash(name_stripped);
1550c8
+    
1550c8
+    file = fopen (name_stripped, "wb");
1550c8
     if (file) { zzip_mem_entry_pipe (disk, entry, file); fclose (file); }
1550c8
     perror (entry->zz_name);
1550c8
     if (status < EXIT_WARNINGS) status = EXIT_WARNINGS;