Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

zlib ver. bump

Browse Source
This commit is contained in:
Rmys
2023-11-17 14:13:07 +03:00
parent dd8fda5bdb
commit 8f111c0bd8
5 changed files with 45 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/zlib/files/05796d3d8d55.patch
-24
View File
@@ -1,24 +0,0 @@
From 05796d3d8d5546cf1b4dfe2cd72ab746afae505d Mon Sep 17 00:00:00 2001
From: Mark Adler <madler@alumni.caltech.edu>
Date: Mon, 28 Mar 2022 18:34:10 -0700
Subject: [PATCH] Fix configure issue that discarded provided CC definition.
---
configure | 3 +++
1 file changed, 3 insertions(+)
diff --git a/configure b/configure
index 52ff4a04e..3fa3e8618 100755
--- a/configure
+++ b/configure
@@ -174,7 +174,10 @@ if test -z "$CC"; then
else
cc=${CROSS_PREFIX}cc
fi
+else
+ cc=${CC}
fi
+
cflags=${CFLAGS-"-O3"}
# to force the asm version use: CFLAGS="-O3 -DASMV" ./configure
case "$cc" in
system/base/zlib/files/e490ddad3091574a0c2e3b5a66a8fee9a7ab212f.diff
-21
View File
@@ -1,21 +0,0 @@
diff --git a/contrib/minizip/Makefile.am b/contrib/minizip/Makefile.am
index d343011eb..4f4661023 100644
--- a/contrib/minizip/Makefile.am
+++ b/contrib/minizip/Makefile.am
@@ -26,13 +26,15 @@ libminizip_la_LDFLAGS = $(AM_LDFLAGS) -version-info 1:0:0 -lz
minizip_includedir = $(includedir)/minizip
minizip_include_HEADERS = \
- crypt.h \
ioapi.h \
mztools.h \
unzip.h \
zip.h \
${iowin32_h}
+noinst_HEADERS = \
+ crypt.h
+
pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = minizip.pc
system/base/zlib/files/ec3df00224d4.patch
-51
View File
@@ -1,51 +0,0 @@
From ec3df00224d4b396e2ac6586ab5d25f673caa4c2 Mon Sep 17 00:00:00 2001
From: Mark Adler <madler@alumni.caltech.edu>
Date: Wed, 30 Mar 2022 11:14:53 -0700
Subject: [PATCH] Correct incorrect inputs provided to the CRC functions.
The previous releases of zlib were not sensitive to incorrect CRC
inputs with bits set above the low 32. This commit restores that
behavior, so that applications with such bugs will continue to
operate as before.
---
crc32.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/crc32.c b/crc32.c
index a1bdce5c2..451887bc7 100644
--- a/crc32.c
+++ b/crc32.c
@@ -630,7 +630,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
#endif /* DYNAMIC_CRC_TABLE */
/* Pre-condition the CRC */
- crc ^= 0xffffffff;
+ crc = (~crc) & 0xffffffff;
/* Compute the CRC up to a word boundary. */
while (len && ((z_size_t)buf & 7) != 0) {
@@ -749,7 +749,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
#endif /* DYNAMIC_CRC_TABLE */
/* Pre-condition the CRC */
- crc ^= 0xffffffff;
+ crc = (~crc) & 0xffffffff;
#ifdef W
@@ -1077,7 +1077,7 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
#ifdef DYNAMIC_CRC_TABLE
once(&made, make_crc_table);
#endif /* DYNAMIC_CRC_TABLE */
- return multmodp(x2nmodp(len2, 3), crc1) ^ crc2;
+ return multmodp(x2nmodp(len2, 3), crc1) ^ (crc2 & 0xffffffff);
}
/* ========================================================================= */
@@ -1112,5 +1112,5 @@ uLong crc32_combine_op(crc1, crc2, op)
uLong crc2;
uLong op;
{
- return multmodp(op, crc1) ^ crc2;
+ return multmodp(op, crc1) ^ (crc2 & 0xffffffff);
}
system/base/zlib/files/zlib-1.2.13-CVE-2023-45853.patch
+36
View File
@@ -0,0 +1,36 @@
From 73331a6a0481067628f065ffe87bb1d8f787d10c Mon Sep 17 00:00:00 2001
From: Hans Wennborg <hans@chromium.org>
Date: Fri, 18 Aug 2023 11:05:33 +0200
Subject: [PATCH] Reject overflows of zip header fields in minizip.
This checks the lengths of the file name, extra field, and comment
that would be put in the zip headers, and rejects them if they are
too long. They are each limited to 65535 bytes in length by the zip
format. This also avoids possible buffer overflows if the provided
fields are too long.
---
contrib/minizip/zip.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c
index 3d3d4cadd..0446109b2 100644
--- a/contrib/minizip/zip.c
+++ b/contrib/minizip/zip.c
@@ -1043,6 +1043,17 @@ extern int ZEXPORT zipOpenNewFileInZip4_64(zipFile file, const char* filename, c
return ZIP_PARAMERROR;
#endif
+ // The filename and comment length must fit in 16 bits.
+ if ((filename!=NULL) && (strlen(filename)>0xffff))
+ return ZIP_PARAMERROR;
+ if ((comment!=NULL) && (strlen(comment)>0xffff))
+ return ZIP_PARAMERROR;
+ // The extra field length must fit in 16 bits. If the member also requires
+ // a Zip64 extra block, that will also need to fit within that 16-bit
+ // length, but that will be checked for later.
+ if ((size_extrafield_local>0xffff) || (size_extrafield_global>0xffff))
+ return ZIP_PARAMERROR;
+
zi = (zip64_internal*)file;
if (zi->in_opened_file_inzip == 1)
system/base/zlib/pspec.xml
+9 -5
View File
@@ -12,13 +12,10 @@
<IsA>library</IsA>
<Summary>Standard (de)compression library</Summary>
<Description>Zlib is a general-purpose, patent-free, lossless data compression library which is used by many different programs.</Description>
<Archive sha1sum="5adfb4d9b29498efb58615f4cb1581568d839b4a" name="zlib-1.2.12.tar.gz" type="targz">https://github.com/madler/zlib/archive/refs/tags/v1.2.13.tar.gz</Archive>
<Archive sha1sum="ec117266e8202d7098ecd1a97aa34f5be77a281a" name="zlib-1.3.tar.gz" type="targz">https://github.com/madler/zlib/archive/refs/tags/v1.3.tar.gz</Archive>
<Patches>
<!-- <Patch level="1">zlib-1.2.5-minizip-fixuncrypt.patch</Patch> -->
<Patch level="1">dont-call-ldconfig.patch</Patch>
<!-- <Patch level="1">ec3df00224d4.patch</Patch> -->
<!-- <Patch level="1">05796d3d8d55.patch</Patch> -->
<Patch level="1">e490ddad3091574a0c2e3b5a66a8fee9a7ab212f.diff</Patch>
<Patch level="1">zlib-1.2.13-CVE-2023-45853.patch</Patch>
</Patches>
</Source>
@@ -93,6 +90,13 @@
</Package>
<History>
<Update release="14">
<Date>2023-11-17</Date>
<Version>1.3</Version>
<Comment>Version bump.</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="13">
<Date>2023-07-13</Date>
<Version>1.2.13</Version>