summaryrefslogtreecommitdiff
path: root/unzip/unzip-6.0-cve-2018-1000035-heap-based-overflow.patch
blob: 8ca713865c46754032dba35196557ae7a79995f5 (plain)
    1 --- a/fileio.c	2014-12-05 05:06:05 -0600
    2 +++ b/fileio.c	2017-11-14 01:06:28 -0600
    3 @@ -1,5 +1,5 @@
    4  /*
    5 -  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
    6 +  Copyright (c) 1990-2017 Info-ZIP.  All rights reserved.
    7  
    8    See the accompanying file LICENSE, version 2009-Jan-02 or later
    9    (the contents of which are also included in unzip.h) for terms of use.
   10 @@ -1582,6 +1582,8 @@
   11      int r = IZ_PW_ENTERED;
   12      char *m;
   13      char *prompt;
   14 +    char *ep;
   15 +    char *zp;
   16  
   17  #ifndef REENTRANT
   18      /* tell picky compilers to shut up about "unused variable" warnings */
   19 @@ -1590,9 +1592,12 @@
   20  
   21      if (*rcnt == 0) {           /* First call for current entry */
   22          *rcnt = 2;
   23 -        if ((prompt = (char *)malloc(2*FILNAMSIZ + 15)) != (char *)NULL) {
   24 -            sprintf(prompt, LoadFarString(PasswPrompt),
   25 -                    FnFilter1(zfn), FnFilter2(efn));
   26 +        zp = FnFilter1( zfn);
   27 +        ep = FnFilter2( efn);
   28 +        prompt = (char *)malloc(        /* Slightly too long (2* "%s"). */
   29 +         sizeof( PasswPrompt)+ strlen( zp)+ strlen( ep));
   30 +        if (prompt != (char *)NULL) {
   31 +            sprintf(prompt, LoadFarString(PasswPrompt), zp, ep);
   32              m = prompt;
   33          } else
   34              m = (char *)LoadFarString(PasswPrompt2);

Generated by cgit