svn commit: r427480 - in branches/2016Q4/archivers/p7zip: . files

[Raphael Kubo da Costa]

Author: rakuco
Date: Thu Dec  1 09:19:09 2016
New Revision: 427480
URL: https://svnweb.freebsd.org/changeset/ports/427480

Log:
  MFH: r427417
  
  Import upstream patch to fix CVE-2016-9296
  
  Null pointer dereference can cause 7z to crash.
  
  PR:		214940
  Reported by:	Sevan Janiyan <venture37 at geeklan.co.uk>
  Security:	48e83187-b6e9-11e6-b6cf-5453ed2e2b49
  Security:	CVE-2016-9296
  
  Approved by:	ports-secteam (junovitch)

Added:
  branches/2016Q4/archivers/p7zip/files/patch-CPP_7zip_Archive_7z_7zIn.cpp
     - copied unchanged from r427417, head/archivers/p7zip/files/patch-CPP_7zip_Archive_7z_7zIn.cpp
Modified:
  branches/2016Q4/archivers/p7zip/Makefile
Directory Properties:
  branches/2016Q4/   (props changed)

Modified: branches/2016Q4/archivers/p7zip/Makefile
==============================================================================
--- branches/2016Q4/archivers/p7zip/Makefile	Thu Dec  1 09:17:38 2016	(r427479)
+++ branches/2016Q4/archivers/p7zip/Makefile	Thu Dec  1 09:19:09 2016	(r427480)
@@ -3,7 +3,7 @@
 
 PORTNAME=	p7zip
 PORTVERSION=	15.14
-PORTREVISION?=	1
+PORTREVISION?=	2
 CATEGORIES=	archivers
 MASTER_SITES=	SF
 DISTNAME=	${PORTNAME}_${DISTVERSION}_src_all

Copied: branches/2016Q4/archivers/p7zip/files/patch-CPP_7zip_Archive_7z_7zIn.cpp (from r427417, head/archivers/p7zip/files/patch-CPP_7zip_Archive_7z_7zIn.cpp)
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ branches/2016Q4/archivers/p7zip/files/patch-CPP_7zip_Archive_7z_7zIn.cpp	Thu Dec  1 09:19:09 2016	(r427480, copy of r427417, head/archivers/p7zip/files/patch-CPP_7zip_Archive_7z_7zIn.cpp)
@@ -0,0 +1,16 @@
+Fix for CVE-2016-9296.
+
+Obtained from: https://sourceforge.net/p/p7zip/bugs/185/
+Security: 48e83187-b6e9-11e6-b6cf-5453ed2e2b49
+--- CPP/7zip/Archive/7z/7zIn.cpp.orig	2016-11-30 09:35:06 UTC
++++ CPP/7zip/Archive/7z/7zIn.cpp
+@@ -1091,7 +1091,8 @@ HRESULT CInArchive::ReadAndDecodePackedS
+       if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i])
+         ThrowIncorrect();
+   }
+-  HeadersSize += folders.PackPositions[folders.NumPackStreams];
++  if (folders.PackPositions)
++    HeadersSize += folders.PackPositions[folders.NumPackStreams];
+   return S_OK;
+ }
+