public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/unzip] main: Port several downstream patches from rhel
@ 2026-07-27 9:55 Jakub Martisko
0 siblings, 0 replies; only message in thread
From: Jakub Martisko @ 2026-07-27 9:55 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/unzip
Branch : main
Commit : 5787660118b7f462b8ff39151b773bf64fec6400
Author : Jakub Martisko <jamartis@redhat.com>
Date : 2026-07-27T11:44:42+02:00
Stats : +234/-1 in 5 file(s)
URL : https://src.fedoraproject.org/rpms/unzip/c/5787660118b7f462b8ff39151b773bf64fec6400?branch=main
Log:
Port several downstream patches from rhel
Fixes for:
- RHEL-86228, RHEL-45997
- Some coverity issues
- CVE-2022-0529 and CVE-2022-0530 (thanks Stewart Smith for head up
about these)
---
diff --git a/unzip-6.0-CVE-2022-0529-and-0530.patch b/unzip-6.0-CVE-2022-0529-and-0530.patch
new file mode 100644
index 0000000..2b84b96
--- /dev/null
+++ b/unzip-6.0-CVE-2022-0529-and-0530.patch
@@ -0,0 +1,170 @@
+From: Steven M. Schweda <sms@antinode.info>
+Subject: Fix for CVE-2022-0529 and CVE-2022-0530
+Bug-Debian: https://bugs.debian.org/1010355
+X-Debian-version: 6.0-27
+
+--- a/fileio.c
++++ b/fileio.c
+@@ -171,8 +171,10 @@
+ static ZCONST char Far FilenameTooLongTrunc[] =
+ "warning: filename too long--truncating.\n";
+ #ifdef UNICODE_SUPPORT
++ static ZCONST char Far UFilenameCorrupt[] =
++ "error: Unicode filename corrupt.\n";
+ static ZCONST char Far UFilenameTooLongTrunc[] =
+- "warning: Converted unicode filename too long--truncating.\n";
++ "warning: Converted Unicode filename too long--truncating.\n";
+ #endif
+ static ZCONST char Far ExtraFieldTooLong[] =
+ "warning: extra field too long (%d). Ignoring...\n";
+@@ -2361,16 +2363,30 @@
+ /* convert UTF-8 to local character set */
+ fn = utf8_to_local_string(G.unipath_filename,
+ G.unicode_escape_all);
+- /* make sure filename is short enough */
+- if (strlen(fn) >= FILNAMSIZ) {
+- fn[FILNAMSIZ - 1] = '\0';
++
++ /* 2022-07-22 SMS, et al. CVE-2022-0530
++ * Detect conversion failure, emit message.
++ * Continue with unconverted name.
++ */
++ if (fn == NULL)
++ {
+ Info(slide, 0x401, ((char *)slide,
+- LoadFarString(UFilenameTooLongTrunc)));
+- error = PK_WARN;
++ LoadFarString(UFilenameCorrupt)));
++ error = PK_ERR;
++ }
++ else
++ {
++ /* make sure filename is short enough */
++ if (strlen(fn) >= FILNAMSIZ) {
++ fn[FILNAMSIZ - 1] = '\0';
++ Info(slide, 0x401, ((char *)slide,
++ LoadFarString(UFilenameTooLongTrunc)));
++ error = PK_WARN;
++ }
++ /* replace filename with converted UTF-8 */
++ strcpy(G.filename, fn);
++ free(fn);
+ }
+- /* replace filename with converted UTF-8 */
+- strcpy(G.filename, fn);
+- free(fn);
+ }
+ # endif /* UNICODE_WCHAR */
+ if (G.unipath_filename != G.filename_full)
+--- a/process.c
++++ b/process.c
+@@ -222,6 +222,8 @@
+ "\nwarning: Unicode Path version > 1\n";
+ static ZCONST char Far UnicodeMismatchError[] =
+ "\nwarning: Unicode Path checksum invalid\n";
++ static ZCONST char Far UFilenameTooLongTrunc[] =
++ "warning: filename too long (P1) -- truncating.\n";
+ #endif
+
+
+@@ -1915,7 +1917,7 @@
+ Sets both local header and central header fields. Not terribly clever,
+ but it means that this procedure is only called in one place.
+
+- 2014-12-05 SMS.
++ 2014-12-05 SMS. (oCERT.org report.) CVE-2014-8141.
+ Added checks to ensure that enough data are available before calling
+ makeint64() or makelong(). Replaced various sizeof() values with
+ simple ("4" or "8") constants. (The Zip64 structures do not depend
+@@ -1947,7 +1949,7 @@
+
+ if (eb_id == EF_PKSZ64)
+ {
+- int offset = EB_HEADSIZE;
++ unsigned offset = EB_HEADSIZE;
+
+ if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
+ {
+@@ -2046,7 +2049,7 @@
+ }
+ if (eb_id == EF_UNIPATH) {
+
+- int offset = EB_HEADSIZE;
++ unsigned offset = EB_HEADSIZE;
+ ush ULen = eb_len - 5;
+ ulg chksum = CRCVAL_INITIAL;
+
+@@ -2504,16 +2507,17 @@
+ int state_dependent;
+ int wsize = 0;
+ int max_bytes = MB_CUR_MAX;
+- char buf[9];
++ char buf[ MB_CUR_MAX+ 1]; /* ("+1" not really needed?) */
+ char *buffer = NULL;
+ char *local_string = NULL;
++ size_t buffer_size; /* CVE-2022-0529 */
+
+ for (wsize = 0; wide_string[wsize]; wsize++) ;
+
+ if (max_bytes < MAX_ESCAPE_BYTES)
+ max_bytes = MAX_ESCAPE_BYTES;
+-
+- if ((buffer = (char *)malloc(wsize * max_bytes + 1)) == NULL) {
++ buffer_size = wsize * max_bytes + 1; /* Reused below. */
++ if ((buffer = (char *)malloc( buffer_size)) == NULL) {
+ return NULL;
+ }
+
+@@ -2551,8 +2555,28 @@
+ } else {
+ /* no MB for this wide */
+ /* use escape for wide character */
+- char *escape_string = wide_to_escape_string(wide_string[i]);
+- strcat(buffer, escape_string);
++ size_t buffer_len;
++ size_t escape_string_len;
++ char *escape_string;
++ int err_msg = 0;
++
++ escape_string = wide_to_escape_string(wide_string[i]);
++ buffer_len = strlen( buffer);
++ escape_string_len = strlen( escape_string);
++
++ /* Append escape string, as space allows. */
++ /* 2022-07-18 SMS, et al. CVE-2022-0529 */
++ if (escape_string_len > buffer_size- buffer_len- 1)
++ {
++ escape_string_len = buffer_size- buffer_len- 1;
++ if (err_msg == 0)
++ {
++ err_msg = 1;
++ Info(slide, 0x401, ((char *)slide,
++ LoadFarString( UFilenameTooLongTrunc)));
++ }
++ }
++ strncat( buffer, escape_string, escape_string_len);
+ free(escape_string);
+ }
+ }
+@@ -2604,9 +2628,18 @@
+ ZCONST char *utf8_string;
+ int escape_all;
+ {
+- zwchar *wide = utf8_to_wide_string(utf8_string);
+- char *loc = wide_to_local_string(wide, escape_all);
+- free(wide);
++ zwchar *wide;
++ char *loc = NULL;
++
++ wide = utf8_to_wide_string( utf8_string);
++
++ /* 2022-07-25 SMS, et al. CVE-2022-0530 */
++ if (wide != NULL)
++ {
++ loc = wide_to_local_string( wide, escape_all);
++ free( wide);
++ }
++
+ return loc;
+ }
+
diff --git a/unzip-6.0-RHEL-86228.patch b/unzip-6.0-RHEL-86228.patch
new file mode 100644
index 0000000..25c2fbb
--- /dev/null
+++ b/unzip-6.0-RHEL-86228.patch
@@ -0,0 +1,19 @@
+From: Roy Tam
+Subject: Handle Microsoft ZIP64 files by ignoring invalid "Total number of disks" field
+Origin: https://sourceforge.net/p/infozip/bugs/42/
+Bug: https://sourceforge.net/p/infozip/bugs/42/
+Bug-Debian: https://bugs.debian.org/1064000
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/2051952
+X-Debian-version: 6.0-29
+
+--- a/process.c
++++ b/process.c
+@@ -1281,7 +1281,7 @@
+ fprintf(stdout,"\nnumber of disks (ECR) %u, (ECLOC64) %lu\n",
+ G.ecrec.number_this_disk, ecloc64_total_disks); fflush(stdout);
+ #endif
+- if ((G.ecrec.number_this_disk != 0xFFFF) &&
++ if ((G.ecrec.number_this_disk != 0xFFFF) && ecloc64_total_disks &&
+ (G.ecrec.number_this_disk != ecloc64_total_disks - 1)) {
+ /* Note: For some unknown reason, the developers at PKWARE decided to
+ store the "zip64 total disks" value as a counter starting from 1,
diff --git a/unzip-6.0-fix-warning-messages-on-big-files.patch b/unzip-6.0-fix-warning-messages-on-big-files.patch
new file mode 100644
index 0000000..55a115a
--- /dev/null
+++ b/unzip-6.0-fix-warning-messages-on-big-files.patch
@@ -0,0 +1,15 @@
+From: "Steven M. Schweda" <sms@antinode.info>
+Subject: Fix lame code in fileio.c
+Bug-Debian: https://bugs.debian.org/929502
+X-Debian-version: 6.0-23
+
+--- a/fileio.c
++++ b/fileio.c
+@@ -2477,6 +2477,7 @@
+ */
+ return (((zusz_t)sig[7]) << 56)
+ + (((zusz_t)sig[6]) << 48)
++ + (((zusz_t)sig[5]) << 40)
+ + (((zusz_t)sig[4]) << 32)
+ + (zusz_t)((((ulg)sig[3]) << 24)
+ + (((ulg)sig[2]) << 16)
diff --git a/unzip-6.0-sast.patch b/unzip-6.0-sast.patch
new file mode 100644
index 0000000..71b7cb9
--- /dev/null
+++ b/unzip-6.0-sast.patch
@@ -0,0 +1,11 @@
+--- a/envargs.c 2005-03-04 03:23:38.000000000 +0100
++++ b/envargs.c 2024-11-26 13:17:22.289650230 +0100
+@@ -118,7 +118,7 @@
+
+ /* remove escape characters */
+ while ((argstart = MBSCHR(argstart, '\\')) != (char *)NULL) {
+- strcpy(argstart, argstart + 1);
++ memmove(argstart, argstart + 1, strlen(argstart + 1) + 1);
+ if (*argstart)
+ ++argstart;
+ }
diff --git a/unzip.spec b/unzip.spec
index 3510559..ed8ee48 100644
--- a/unzip.spec
+++ b/unzip.spec
@@ -6,7 +6,7 @@
Summary: A utility for unpacking zip files
Name: unzip
Version: 6.0
-Release: 70%{?dist}
+Release: 71%{?dist}
License: Info-ZIP
Source: http://downloads.sourceforge.net/infozip/unzip60.tar.gz
@@ -75,6 +75,15 @@ Patch34: unzip-zipbomb-switch.patch
Patch35: unzip-gnu89-build.patch
Patch36: unzip-6.0-wcstombs-fortify.patch
+
+Patch37: unzip-6.0-fix-warning-messages-on-big-files.patch
+Patch38: unzip-6.0-sast.patch
+Patch39: unzip-6.0-RHEL-86228.patch
+#From Debian
+Patch40: unzip-6.0-CVE-2022-0529-and-0530.patch
+
+
+
URL: http://infozip.sourceforge.net
BuildRequires: make
BuildRequires: bzip2-devel, gcc
@@ -129,6 +138,10 @@ a zip archive.
%patch -P34 -p1
%patch -P35 -p1
%patch -P36 -p1
+%patch -P37 -p1
+%patch -P38 -p1
+%patch -P39 -p1
+%patch -P40 -p1
%build
# IZ_HAVE_UXUIDGID is needed for right functionality of unzip -X
@@ -147,6 +160,11 @@ make -f unix/Makefile prefix=$RPM_BUILD_ROOT%{_prefix} MANDIR=$RPM_BUILD_ROOT%{_
%{_mandir}/*/*
%changelog
+* Wed Jul 22 2026 Jakub Martisko <jamartis@redhat.com> - 6.0-71
+- Port some RHEL downstream patches to fedora
+- Fixes for RHEL-86228, RHEL-45997 + some issues found by coverity and other scans
+- Fixes for CVE-2022-0529 and 2022-0530 (Thanks Stewart Smith for the Heads up about these)
+
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 6.0-70
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-27 9:55 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-27 9:55 [rpms/unzip] main: Port several downstream patches from rhel Jakub Martisko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox