Your message dated Fri, 25 Apr 2025 21:51:50 +0000
with message-id <[email protected]>
and subject line Bug#1093629: fixed in zip 3.0-15
has caused the Debian Bug report #1093629,
regarding zip: Two bugfixes and a dep8 test
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1093629: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1093629
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: zip
Version: 3.0-14ubuntu2
Severity: wishlist
Tags: patch
X-Debbugs-Cc: [email protected], [email protected]
Hello there,
With the activation of _FORTIFY_SOURCE=3 in Ubuntu last year, zip has seen a
few problems come into light.
Please find attached a debdiff fixing them, along with the addition of a small
dep8 test making sure they don't regress.
Thanks
Skia
diff -Nru zip-3.0/debian/changelog zip-3.0/debian/changelog
--- zip-3.0/debian/changelog 2024-07-24 17:44:00.000000000 +0200
+++ zip-3.0/debian/changelog 2025-01-20 16:09:04.000000000 +0100
@@ -1,3 +1,16 @@
+zip (3.0-15) unstable; urgency=medium
+
+ [ Shengjing Zhu ]
+ * d/p/13-buffer-overflow.patch: Fix buffer overflow when filename contains
+ unicode characters (LP: #2062535)
+
+ [ Florent 'Skia' Jacquet ]
+ * d/p/14-buffer-overflow.patch:
+ Fix buffer overflow when invoked with `-T -TT` (LP: #2093024)
+ * d/tests: Add a basic dep8 test for these two bug fixes.
+
+ -- Florent 'Skia' Jacquet <[email protected]> Mon, 20 Jan 2025
16:09:04 +0100
+
zip (3.0-14) unstable; urgency=medium
* Use https in all Bug-Debian fields.
diff -Nru zip-3.0/debian/patches/13-buffer-overflow.patch
zip-3.0/debian/patches/13-buffer-overflow.patch
--- zip-3.0/debian/patches/13-buffer-overflow.patch 1970-01-01
01:00:00.000000000 +0100
+++ zip-3.0/debian/patches/13-buffer-overflow.patch 2025-01-20
16:01:00.000000000 +0100
@@ -0,0 +1,23 @@
+From: Shengjing Zhu <[email protected]>
+Date: Wed, 6 Nov 2024 17:27:11 +0800
+Subject: Fix buffer overflow when filename contains unicode characters
+
+Bug-Ubuntu: https://launchpad.net/bugs/2062535
+Origin: https://src.fedoraproject.org/rpms/zip/raw/f41/f/buffer_overflow.patch
+---
+ fileio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fileio.c b/fileio.c
+index 1847e62..5a2959d 100644
+--- a/fileio.c
++++ b/fileio.c
+@@ -3502,7 +3502,7 @@ zwchar *local_to_wide_string(local_string)
+ if ((wc_string = (wchar_t *)malloc((wsize + 1) * sizeof(wchar_t))) == NULL)
{
+ ZIPERR(ZE_MEM, "local_to_wide_string");
+ }
+- wsize = mbstowcs(wc_string, local_string, strlen(local_string) + 1);
++ wsize = mbstowcs(wc_string, local_string, wsize + 1);
+ wc_string[wsize] = (wchar_t) 0;
+
+ /* in case wchar_t is not zwchar */
diff -Nru zip-3.0/debian/patches/14-buffer-overflow.patch
zip-3.0/debian/patches/14-buffer-overflow.patch
--- zip-3.0/debian/patches/14-buffer-overflow.patch 1970-01-01
01:00:00.000000000 +0100
+++ zip-3.0/debian/patches/14-buffer-overflow.patch 2025-01-20
16:01:28.000000000 +0100
@@ -0,0 +1,19 @@
+Description: Fix buffer overflow when using '-T -TT'
+ `strlen(unzip_path) + strlen(zipname) + " " + "'" + "'" + '\0'`
+ The additional space required in the `cmd` buffer is 4, not 3.
+Forwarded: no
+Author: Florent 'Skia' Jacquet <[email protected]>
+Bug-Ubuntu: https://launchpad.net/bugs/2093024
+Last-Update: 2025-01-17
+
+--- a/zip.c
++++ b/zip.c
+@@ -1437,7 +1437,7 @@ local void check_zipfile(zipname, zippat
+ /* Replace first {} with archive name. If no {} append name to string. */
+ here = strstr(unzip_path, "{}");
+
+- if ((cmd = malloc(strlen(unzip_path) + strlen(zipname) + 3)) == NULL) {
++ if ((cmd = malloc(strlen(unzip_path) + strlen(zipname) + 4)) == NULL) {
+ ziperr(ZE_MEM, "building command string for testing archive");
+ }
+
diff -Nru zip-3.0/debian/patches/series zip-3.0/debian/patches/series
--- zip-3.0/debian/patches/series 2024-07-24 17:44:00.000000000 +0200
+++ zip-3.0/debian/patches/series 2025-01-20 16:01:28.000000000 +0100
@@ -10,3 +10,5 @@
10-remove-build-date.patch
11-typo-it-is-ambiguities-not-amgibuities.patch
12-fix-build-with-gcc-14.patch
+13-buffer-overflow.patch
+14-buffer-overflow.patch
diff -Nru zip-3.0/debian/tests/control zip-3.0/debian/tests/control
--- zip-3.0/debian/tests/control 1970-01-01 01:00:00.000000000 +0100
+++ zip-3.0/debian/tests/control 2025-01-20 16:01:28.000000000 +0100
@@ -0,0 +1 @@
+Tests: smoke
diff -Nru zip-3.0/debian/tests/smoke zip-3.0/debian/tests/smoke
--- zip-3.0/debian/tests/smoke 1970-01-01 01:00:00.000000000 +0100
+++ zip-3.0/debian/tests/smoke 2025-01-20 16:01:28.000000000 +0100
@@ -0,0 +1,10 @@
+#!/usr/bin/sh
+
+set -e
+
+cd /tmp
+touch Ünicøde
+zip unicode.zip Ünicøde
+
+touch other
+zip ls-verified.zip other -T -TT "ls"
--- End Message ---
--- Begin Message ---
Source: zip
Source-Version: 3.0-15
Done: Santiago Vila <[email protected]>
We believe that the bug you reported is fixed in the latest version of
zip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Santiago Vila <[email protected]> (supplier of updated zip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 25 Apr 2025 22:55:00 +0200
Source: zip
Architecture: source
Version: 3.0-15
Distribution: unstable
Urgency: medium
Maintainer: Santiago Vila <[email protected]>
Changed-By: Santiago Vila <[email protected]>
Closes: 903196 1005943 1077054 1092811 1093629
Changes:
zip (3.0-15) unstable; urgency=medium
.
* Add debian/source/lintian-overrides for *.a files.
* Fix manpage typo: RISC OS/2 -> OS/2. Closes: #1092811.
* Fix buffer overflow when filename contains unicode characters.
Closes: #1077054, #1093629.
* Fix buffer overflow when using '-T -TT'. Closes: #903196, #1093629.
This is CVE-2018-13410. CVE note: Negligible security impact, would
involve that a untrusted party controls the -TT value.
* Fix symlink update detection. Closes: #1005943.
* Add Vcs-Git and Vcs-Browser fields.
* Update Standards-Version.
* Add debian/salsa-ci.yml.
Checksums-Sha1:
cc6549439ec4ab30e1a04729cc3d0fb22b648ba7 1439 zip_3.0-15.dsc
f98e04fd7b5cb0162d921f516358ac507814d7c2 10692 zip_3.0-15.debian.tar.xz
74fd1a949eebf70dfc6d69c172e0a4a8d844368f 4918 zip_3.0-15_source.buildinfo
Checksums-Sha256:
1cee3f25b904023d12c46e55628a79328ce21e47e32737358b3cd99233b5bc6d 1439
zip_3.0-15.dsc
6dc1711c67640e8d1dee867ff53e84387ddb980c40885bd088ac98c330bffce9 10692
zip_3.0-15.debian.tar.xz
2223f20d91ef323d639954d89994f3368083df343189323a836b73094599de61 4918
zip_3.0-15_source.buildinfo
Files:
8ac72e7c3b11ac827f0b1e1cb58770da 1439 utils optional zip_3.0-15.dsc
99f46dbcd62fa7f4a8b49236fa695376 10692 utils optional zip_3.0-15.debian.tar.xz
4ee7d2f6b3a9e09e49c3030aa5dbe046 4918 utils optional
zip_3.0-15_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmgMAPAACgkQQc5/C58b
izKmRAf+Py7ur++p7Taeb7rOFu6l3/KPznjjW7eRsmixHVCmB33hqPPsXN+T1vwA
JM1mOJFw4igiRs4JMGIzaFXrw0mwXBoEUMW/0g6PiTiR3seWak73qbard1RmgjAQ
+DJ0Wd77WY7CpoQWPEF4oORDs5Ia77bfrdzHJxTJHVjwgxzWzJUXB1kg0r+shtW2
eFIYayFpVJydFEmCRzlC1oQrelhSmSMPiv1kXBtKzCURNuioowiW8Gh0fZsIq8KD
fPMF+cfKJeLYs+vgBmoZGQzXoZkBSylMdEjLL0K1rTdzh51948ZzzgnPzWxmExua
MZTPBG8EOBXUmZ2MHrvKt1NcK/5QcQ==
=9sE8
-----END PGP SIGNATURE-----
pgpYw4emWlLcD.pgp
Description: PGP signature
--- End Message ---
