jeans/motioneyeos
jeans/motioneyeos
1
0
Fork 0
mirror of https://github.com/motioneye-project/motioneyeos.git synced 2025-07-29 14:16:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

package/p7zip: fix CVE-2016-9296

Browse Source 
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
André Hentschel 2020-04-11 15:36:14 +02:00 committed by Thomas Petazzoni
parent 37a5ffc275
commit f2047e3d00
2 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
package/p7zip/0001-CVE-2016-9296.patch Normal file
View File

@ -0,0 +1,25 @@
From: Robert Luberda <robert@debian.org>
Date: Sat, 19 Nov 2016 08:48:08 +0100
Subject: Fix nullptr dereference (CVE-2016-9296)
Patch taken from https://sourceforge.net/p/p7zip/bugs/185/
Signed-off-by: André Hentschel <nerv@dawncrow.de>
---
CPP/7zip/Archive/7z/7zIn.cpp | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/CPP/7zip/Archive/7z/7zIn.cpp b/CPP/7zip/Archive/7z/7zIn.cpp
index b0c6b98..7c6dde2 100644
--- a/CPP/7zip/Archive/7z/7zIn.cpp
+++ b/CPP/7zip/Archive/7z/7zIn.cpp
@@ -1097,7 +1097,8 @@ HRESULT CInArchive::ReadAndDecodePackedStreams(
if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i])
ThrowIncorrect();
}
- HeadersSize += folders.PackPositions[folders.NumPackStreams];
+ if (folders.PackPositions)
+ HeadersSize += folders.PackPositions[folders.NumPackStreams];
return S_OK;
}

3
package/p7zip/p7zip.mk
View File

@ -10,6 +10,9 @@ P7ZIP_SITE = http://downloads.sourceforge.net/project/p7zip/p7zip/$(P7ZIP_VERSIO
P7ZIP_LICENSE = LGPL-2.1+ with unRAR restriction P7ZIP_LICENSE = LGPL-2.1+ with unRAR restriction
P7ZIP_LICENSE_FILES = DOC/License.txt P7ZIP_LICENSE_FILES = DOC/License.txt
# 0001-CVE-2016-9296.patch
P7ZIP_IGNORE_CVES += CVE-2016-9296
# p7zip buildsystem is a mess: it plays dirty tricks with CFLAGS and # p7zip buildsystem is a mess: it plays dirty tricks with CFLAGS and
# CXXFLAGS, so we can't pass them. Instead, it accepts ALLFLAGS_C # CXXFLAGS, so we can't pass them. Instead, it accepts ALLFLAGS_C
# and ALLFLAGS_CPP as variables to pass the CFLAGS and CXXFLAGS. # and ALLFLAGS_CPP as variables to pass the CFLAGS and CXXFLAGS.