svn commit: r418576 - in head/archivers/p7zip: . files

[Raphael Kubo da Costa]

Author: rakuco
Date: Fri Jul 15 11:25:07 2016
New Revision: 418576
URL: https://svnweb.freebsd.org/changeset/ports/418576

Log:
  Add patches for CVE-2016-2334 and CVE-2016-2335.
  
  While here, use PORTREVISION?= instead of PORTREVISION= to avoid needlessly
  bumping PORTREVISION in archivers/p7zip-codec-rar.
  
  PR:		211114
  Submitted by:	Piotr Kubaj <pkubaj at anongoth.pl>
  MFH:		2016Q3
  Security:	a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49
  Security:	d706a3a3-4a7c-11e6-97f7-5453ed2e2b49

Added:
  head/archivers/p7zip/files/patch-CPP_7zip_Archive_HfsHandler.cpp   (contents, props changed)
  head/archivers/p7zip/files/patch-CPP_7zip_Archive_Udf_UdfIn.cpp   (contents, props changed)
Modified:
  head/archivers/p7zip/Makefile

Modified: head/archivers/p7zip/Makefile
==============================================================================
--- head/archivers/p7zip/Makefile	Fri Jul 15 11:23:23 2016	(r418575)
+++ head/archivers/p7zip/Makefile	Fri Jul 15 11:25:07 2016	(r418576)
@@ -3,6 +3,7 @@
 
 PORTNAME=	p7zip
 PORTVERSION=	15.14
+PORTREVISION?=	1
 CATEGORIES=	archivers
 MASTER_SITES=	SF
 DISTNAME=	${PORTNAME}_${DISTVERSION}_src_all

Added: head/archivers/p7zip/files/patch-CPP_7zip_Archive_HfsHandler.cpp
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/archivers/p7zip/files/patch-CPP_7zip_Archive_HfsHandler.cpp	Fri Jul 15 11:25:07 2016	(r418576)
@@ -0,0 +1,25 @@
+Patch for CVE-2016-2334.
+
+Obtained from: https://sourceforge.net/p/p7zip/discussion/383043/thread/9d0fb86b/
+--- CPP/7zip/Archive/HfsHandler.cpp.orig	Fri Jun 19 06:52:08 2015
++++ CPP/7zip/Archive/HfsHandler.cpp	Mon May 23 20:37:42 2016
+@@ -987,7 +987,9 @@ HRESULT CDatabase::LoadCatalog(const CFork &fork, cons
+       item.GroupID = Get32(r + 0x24);
+       item.AdminFlags = r[0x28];
+       item.OwnerFlags = r[0x29];
++      */
+       item.FileMode = Get16(r + 0x2A);
++      /*
+       item.special.iNodeNum = Get16(r + 0x2C); // or .linkCount
+       item.FileType = Get32(r + 0x30);
+       item.FileCreator = Get32(r + 0x34);
+@@ -1571,6 +1573,9 @@ HRESULT CHandler::ExtractZlibFile(
+       blockSize = (UInt32)rem;
+ 
+     UInt32 size = GetUi32(tableBuf + i * 8 + 4);
++
++    if (size > buf.Size() || size > kCompressionBlockSize + 1)
++        return S_FALSE;
+ 
+     RINOK(ReadStream_FALSE(inStream, buf, size));
+ 

Added: head/archivers/p7zip/files/patch-CPP_7zip_Archive_Udf_UdfIn.cpp
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/archivers/p7zip/files/patch-CPP_7zip_Archive_Udf_UdfIn.cpp	Fri Jul 15 11:25:07 2016	(r418576)
@@ -0,0 +1,18 @@
+Patch for CVE-2016-2335.
+
+Obtained from: https://sourceforge.net/p/p7zip/discussion/383043/thread/9d0fb86b/
+--- CPP/7zip/Archive/Udf/UdfIn.cpp.orig	Fri Nov 20 15:40:08 2015
++++ CPP/7zip/Archive/Udf/UdfIn.cpp	Mon May 23 20:37:46 2016
+@@ -389,7 +389,11 @@ HRESULT CInArchive::ReadFileItem(int volIndex, int fsI
+     return S_FALSE;
+   CFile &file = Files.Back();
+   const CLogVol &vol = LogVols[volIndex];
+-  CPartition &partition = Partitions[vol.PartitionMaps[lad.Location.PartitionRef].PartitionIndex];
++  unsigned partitionRef = lad.Location.PartitionRef;
++
++  if (partitionRef >= vol.PartitionMaps.Size())
++  	return S_FALSE;
++  CPartition &partition = Partitions[vol.PartitionMaps[partitionRef].PartitionIndex];
+ 
+   UInt32 key = lad.Location.Pos;
+   UInt32 value;