[gentoo-commits] gentoo-x86 commit in sys-freebsd/freebsd-ubin/files: freebsd-ubin-8.2-compress.patch

[gentoo-commits] gentoo-x86 commit in sys-freebsd/freebsd-ubin/files: freebsd-ubin-8.2-compress.patch

[Naohiro Aota (naota)]

naota       12/04/02 10:22:58

  Added:                freebsd-ubin-8.2-compress.patch
  Log:
  Add patch to fix CVE-2011-2895. #408887
  
  (Portage version: 2.2.0_alpha89/cvs/FreeBSD i386)

Revision  Changes    Path
1.1                  sys-freebsd/freebsd-ubin/files/freebsd-ubin-8.2-compress.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-freebsd/freebsd-ubin/files/freebsd-ubin-8.2-compress.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-freebsd/freebsd-ubin/files/freebsd-ubin-8.2-compress.patch?rev=1.1&content-type=text/plain

Index: freebsd-ubin-8.2-compress.patch
===================================================================
Index: usr.bin/compress/zopen.c
===================================================================
--- usr.bin/compress/zopen.c	(revision 225020)
+++ usr.bin/compress/zopen.c	(working copy)
@@ -486,7 +486,7 @@ zread(void *cookie, char *rbp, int num)
 	block_compress = maxbits & BLOCK_MASK;
 	maxbits &= BIT_MASK;
 	maxmaxcode = 1L << maxbits;
-	if (maxbits > BITS) {
+	if (maxbits > BITS || maxbits < 12) {
 		errno = EFTYPE;
 		return (-1);
 	}
@@ -513,17 +513,28 @@ zread(void *cookie, char *rbp, int num)
 			for (code = 255; code >= 0; code--)
 				tab_prefixof(code) = 0;
 			clear_flg = 1;
-			free_ent = FIRST - 1;
-			if ((code = getcode(zs)) == -1)	/* O, untimely death! */
-				break;
+			free_ent = FIRST;
+			oldcode = -1;
+			continue;
 		}
 		incode = code;
 
-		/* Special case for KwKwK string. */
+		/* Special case for kWkWk string. */
 		if (code >= free_ent) {
+			if (code > free_ent || oldcode == -1) {
+				/* Bad stream. */
+				errno = EINVAL;
+				return (-1);
+			}
 			*stackp++ = finchar;
 			code = oldcode;
 		}
+		/*
+		 * The above condition ensures that code < free_ent.
+		 * The construction of tab_prefixof in turn guarantees that
+		 * each iteration decreases code and therefore stack usage is
+		 * bound by 1 << BITS - 256.
+		 */
 
 		/* Generate output characters in reverse order. */
 		while (code >= 256) {
@@ -540,7 +551,7 @@ middle:		do {
 		} while (stackp > de_stack);
 
 		/* Generate the new entry. */
-		if ((code = free_ent) < maxmaxcode) {
+		if ((code = free_ent) < maxmaxcode && oldcode != -1) {
 			tab_prefixof(code) = (u_short) oldcode;
 			tab_suffixof(code) = finchar;
 			free_ent = code + 1;