From 633f61e2eaf6530cf7e53c702c06de1b7a840fa7 Mon Sep 17 00:00:00 2001 From: Vrushti Dabhi Date: Thu, 27 Nov 2025 01:36:55 -0800 Subject: [PATCH] Fix out-of-bounds read in ZIP archive processing (CVE-2022-47069) Add bounds checking and replace unsafe pointer arithmetic with index-based access in FindCd() to prevent out-of-bounds read when processing malformed ZIP archives. Testing: - Verified fix using steps mentioned at [1], trace not observed. - Validated against known malicious ZIP samples [1] - Changes merged in upstream p7zip via [2] CVE: CVE-2022-47069 Upstream-Status: Pending References: [1] https://sourceforge.net/p/p7zip/bugs/241/ [2] https://github.com/p7zip-project/p7zip/commit/d7a903ff13c2 [3] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-47069 Signed-off-by: Vrushti Dabhi --- CPP/7zip/Archive/Zip/ZipIn.cpp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/CPP/7zip/Archive/Zip/ZipIn.cpp b/CPP/7zip/Archive/Zip/ZipIn.cpp index c71c40f..84213b4 100644 --- a/CPP/7zip/Archive/Zip/ZipIn.cpp +++ b/CPP/7zip/Archive/Zip/ZipIn.cpp @@ -1095,11 +1095,11 @@ HRESULT CInArchive::FindCd(bool checkOffsetMode) if (i >= kEcd64Locator_Size) { - const Byte *locatorPtr = buf + i - kEcd64Locator_Size; - if (Get32(locatorPtr) == NSignature::kEcd64Locator) + const size_t locatorIndex = i - kEcd64Locator_Size; + if (Get32(buf + locatorIndex) == NSignature::kEcd64Locator) { CLocator locator; - locator.Parse(locatorPtr + 4); + locator.Parse(buf + locatorIndex + 4); if ((cdInfo.ThisDisk == locator.NumDisks - 1 || cdInfo.ThisDisk == 0xFFFF) && locator.Ecd64Disk < locator.NumDisks) { @@ -1110,9 +1110,11 @@ HRESULT CInArchive::FindCd(bool checkOffsetMode) // we try relative backward reading. UInt64 absEcd64 = endPos - bufSize + i - (kEcd64Locator_Size + kEcd64_FullSize); + + if (locatorIndex >= kEcd64_FullSize) if (checkOffsetMode || absEcd64 == locator.Ecd64Offset) { - const Byte *ecd64 = locatorPtr - kEcd64_FullSize; + const Byte *ecd64 = buf + locatorIndex - kEcd64_FullSize; if (Get32(ecd64) == NSignature::kEcd64) { UInt64 mainEcd64Size = Get64(ecd64 + 4); -- 2.35.6