francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
64 lines
2.3 KiB
Diff
64 lines
2.3 KiB
Diff
From 633f61e2eaf6530cf7e53c702c06de1b7a840fa7 Mon Sep 17 00:00:00 2001
|
|
From: Vrushti Dabhi <vdabhi@cisco.com>
|
|
Date: Thu, 27 Nov 2025 01:36:55 -0800
|
|
Subject: [PATCH] Fix out-of-bounds read in ZIP archive processing
|
|
(CVE-2022-47069)
|
|
|
|
Add bounds checking and replace unsafe pointer arithmetic with index-based
|
|
access in FindCd() to prevent out-of-bounds read when processing malformed
|
|
ZIP archives.
|
|
|
|
Testing:
|
|
- Verified fix using steps mentioned at [1], trace not observed.
|
|
- Validated against known malicious ZIP samples [1]
|
|
- Changes merged in upstream p7zip via [2]
|
|
|
|
CVE: CVE-2022-47069
|
|
Upstream-Status: Pending
|
|
|
|
References:
|
|
[1] https://sourceforge.net/p/p7zip/bugs/241/
|
|
[2] https://github.com/p7zip-project/p7zip/commit/d7a903ff13c2
|
|
[3] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-47069
|
|
|
|
Signed-off-by: Vrushti Dabhi <vdabhi@cisco.com>
|
|
---
|
|
CPP/7zip/Archive/Zip/ZipIn.cpp | 10 ++++++----
|
|
1 file changed, 6 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/CPP/7zip/Archive/Zip/ZipIn.cpp b/CPP/7zip/Archive/Zip/ZipIn.cpp
|
|
index c71c40f..84213b4 100644
|
|
--- a/CPP/7zip/Archive/Zip/ZipIn.cpp
|
|
+++ b/CPP/7zip/Archive/Zip/ZipIn.cpp
|
|
@@ -1095,11 +1095,11 @@ HRESULT CInArchive::FindCd(bool checkOffsetMode)
|
|
|
|
if (i >= kEcd64Locator_Size)
|
|
{
|
|
- const Byte *locatorPtr = buf + i - kEcd64Locator_Size;
|
|
- if (Get32(locatorPtr) == NSignature::kEcd64Locator)
|
|
+ const size_t locatorIndex = i - kEcd64Locator_Size;
|
|
+ if (Get32(buf + locatorIndex) == NSignature::kEcd64Locator)
|
|
{
|
|
CLocator locator;
|
|
- locator.Parse(locatorPtr + 4);
|
|
+ locator.Parse(buf + locatorIndex + 4);
|
|
if ((cdInfo.ThisDisk == locator.NumDisks - 1 || cdInfo.ThisDisk == 0xFFFF)
|
|
&& locator.Ecd64Disk < locator.NumDisks)
|
|
{
|
|
@@ -1110,9 +1110,11 @@ HRESULT CInArchive::FindCd(bool checkOffsetMode)
|
|
// we try relative backward reading.
|
|
|
|
UInt64 absEcd64 = endPos - bufSize + i - (kEcd64Locator_Size + kEcd64_FullSize);
|
|
+
|
|
+ if (locatorIndex >= kEcd64_FullSize)
|
|
if (checkOffsetMode || absEcd64 == locator.Ecd64Offset)
|
|
{
|
|
- const Byte *ecd64 = locatorPtr - kEcd64_FullSize;
|
|
+ const Byte *ecd64 = buf + locatorIndex - kEcd64_FullSize;
|
|
if (Get32(ecd64) == NSignature::kEcd64)
|
|
{
|
|
UInt64 mainEcd64Size = Get64(ecd64 + 4);
|
|
--
|
|
2.35.6
|
|
|