svn commit: r382523 - in head/archivers/libzip: . files

[Max Brazhnikov]

Author: makc
Date: Sat Mar 28 16:48:15 2015
New Revision: 382523
URL: https://svnweb.freebsd.org/changeset/ports/382523
QAT: https://qat.redports.org/buildarchive/r382523/

Log:
  archivers/libzip:
  - Add patch to fix CVE-2015-2331: ZIP Integer Overflow [1]
  - Add CPE
  
  PR:		198913 [1]
  Reported by:	Sevan Janiyan

Added:
  head/archivers/libzip/files/patch-lib_zip__dirent.c   (contents, props changed)
Modified:
  head/archivers/libzip/Makefile

Modified: head/archivers/libzip/Makefile
==============================================================================
--- head/archivers/libzip/Makefile	Sat Mar 28 16:32:33 2015	(r382522)
+++ head/archivers/libzip/Makefile	Sat Mar 28 16:48:15 2015	(r382523)
@@ -3,16 +3,18 @@
 
 PORTNAME=	libzip
 PORTVERSION=	0.11.2
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	archivers devel
 MASTER_SITES=	http://www.nih.at/libzip/
 
 MAINTAINER=	makc at FreeBSD.org
 COMMENT=	C library for reading, creating, and modifying ZIP archives
 
+CPE_VENDOR=	nih
+
 GNU_CONFIGURE=	yes
 MAKE_ENV=	LC_ALL="C"
-USES=		libtool pathfix tar:xz
+USES=		cpe libtool pathfix tar:xz
 USE_LDCONFIG=	yes
 INSTALL_TARGET=	install-strip
 

Added: head/archivers/libzip/files/patch-lib_zip__dirent.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/archivers/libzip/files/patch-lib_zip__dirent.c	Sat Mar 28 16:48:15 2015	(r382523)
@@ -0,0 +1,14 @@
+CVE-2015-2331: ZIP Integer Overflow
+Upstream commit: http://hg.nih.at/libzip/rev/9f11d54f692e
+
+--- lib/zip_dirent.c.orig	2013-11-28 16:57:10 UTC
++++ lib/zip_dirent.c
+@@ -110,7 +110,7 @@ _zip_cdir_new(zip_uint64_t nentry, struc
+ 
+     if (nentry == 0)
+ 	cd->entry = NULL;
+-    else if ((cd->entry=(struct zip_entry *)malloc(sizeof(*(cd->entry))*(size_t)nentry)) == NULL) {
++    else if ((nentry > SIZE_MAX/sizeof(*(cd->entry))) || (cd->entry=(struct zip_entry *)malloc(sizeof(*(cd->entry))*(size_t)nentry)) == NULL) {
+ 	_zip_error_set(error, ZIP_ER_MEMORY, 0);
+ 	free(cd);
+ 	return NULL;