Submitted By: Oliver Brakmann <obrakmann at gmx.net>

Date: 2006-02-26

Initial Package Version: Unzip 5.52

Upstream Status: Unknown

Origin: Ubuntu patch to unzip <http://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_5.52-3ubuntu2.2.diff.gz>

Description: Fixes CVE-2005-2475 and CVE-2005-4667

--- unzip-5.52.orig/unix/unix.c

+++ unzip-5.52/unix/unix.c

@@ -1042,6 +1042,16 @@

     ush z_uidgid[2];

     int have_uidgid_flg;

+/*---------------------------------------------------------------------------

+    Change the file permissions from default ones to those stored in the

+    zipfile.

+  ---------------------------------------------------------------------------*/

+        

+#ifndef NO_CHMOD

+    if (fchmod(fileno(G.outfile), 0xffff & G.pInfo->file_attr))

+        perror("chmod (file attributes) error");

+#endif

+

     fclose(G.outfile);

 /*---------------------------------------------------------------------------

@@ -1151,16 +1161,6 @@

 #endif /* ?AOS_VS */

     }

-/*---------------------------------------------------------------------------

-    Change the file permissions from default ones to those stored in the

-    zipfile.

-  ---------------------------------------------------------------------------*/

-

-#ifndef NO_CHMOD

-    if (chmod(G.filename, filtattr(__G__ G.pInfo->file_attr)))

-        perror("chmod (file attributes) error");

-#endif

-

 } /* end function close_outfile() */

 #endif /* !MTS */

--- unzip-5.52.orig/unzpriv.h

+++ unzip-5.52/unzpriv.h

@@ -2271,17 +2274,18 @@

  *               (char *)(sprintf sprf_arg, (buf))) == EOF)

  */

 #ifndef Info   /* may already have been defined for redirection */

+#  define wsizesnprintf(buf, ...) snprintf (buf, WSIZE-1, __VA_ARGS__)

 #  ifdef FUNZIP

 #    define Info(buf,flag,sprf_arg) \

-     fprintf((flag)&1? stderr : stdout, (char *)(sprintf sprf_arg, (buf)))

+     fputs((char *)(wsizesnprintf sprf_arg, (buf)), (flag)&1? stderr : stdout)

 #  else

 #    ifdef INT_SPRINTF  /* optimized version for "int sprintf()" flavour */

 #      define Info(buf,flag,sprf_arg) \

-       (*G.message)((zvoid *)&G, (uch *)(buf), (ulg)sprintf sprf_arg, (flag))

+       (*G.message)((zvoid *)&G, (uch *)(buf), (ulg)wsizesnprintf sprf_arg, (flag))

 #    else          /* generic version, does not use sprintf() return value */

 #      define Info(buf,flag,sprf_arg) \

        (*G.message)((zvoid *)&G, (uch *)(buf), \

-                     (ulg)(sprintf sprf_arg, strlen((char *)(buf))), (flag))

+                     (ulg)(wsizesnprintf sprf_arg, strlen((char *)(buf))), (flag))

 #    endif

 #  endif

 #endif /* !Info */