aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches/libarchive-CVE-2013-0211.patch
blob: b024a7d4a86176103dd9f1b5e0d57a9394ba928a (about) (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
Description: Fix CVE-2013-0211: read buffer overflow on 64-bit systems
Origin: upstream
Bug-Debian: http://bugs.debian.org/703957
Forwarded: not-needed

--- libarchive-3.0.4.orig/libarchive/archive_write.c
+++ libarchive-3.0.4/libarchive/archive_write.c
@@ -665,8 +665,13 @@ static ssize_t
 _archive_write_data(struct archive *_a, const void *buff, size_t s)
 {
 	struct archive_write *a = (struct archive_write *)_a;
+	const size_t max_write = INT_MAX;
+
 	archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC,
 	    ARCHIVE_STATE_DATA, "archive_write_data");
+	/* In particular, this catches attempts to pass negative values. */
+	if (s > max_write)
+		s = max_write;
 	archive_clear_error(&a->archive);
 	return ((a->format_write_data)(a, buff, s));
 }
2ad16c0714ce62949ef39db673aa2b607c41e3'>guix-install.sh: Cosmetically tweak non-interactive output....Tobias Geerinckx-Rice 2022-10-16guix-install.sh: Warn if we suspect dodgy automation....Tobias Geerinckx-Rice 2022-10-16guix-install.sh: Treat all uncaught errors as fatal....Tobias Geerinckx-Rice 2022-10-16guix-install.sh: Suggest what to do if fetching OpenPGP key(s) fails....Tobias Geerinckx-Rice 2022-10-16guix-install.sh: Time out fetching OpenPGP keys....Tobias Geerinckx-Rice 2022-10-11guix-install.sh: Restore compatibility with "yes" invocation....Maxim Cournoyer 2022-10-07guix-install.sh: Add Bash prompt customization option....Maxim Cournoyer 2022-10-07guix-install.sh: Introduce 'die' utility function....Maxim Cournoyer 2022-10-07guix-install.sh: Improve prompt_yes_no procedure....Maxim Cournoyer 2022-07-04etc/guix-install.sh: Check for profile from 'guix home'....Philip McGrath 2022-07-04etc/guix-install.sh: Initialize XDG base directories....Philip McGrath 2021-11-07guix-install.sh: Undo some bugs introduced by shellcheck....Tobias Geerinckx-Rice 2021-09-29guix-install.sh: Don't swallow wget errors....Tobias Geerinckx-Rice