From 731d698377dbd1f5b1b90efeb8094602ed59fc40 Mon Sep 17 00:00:00 2001

From: Nils Bars <nils.bars@t-online.de>

Date: Mon, 17 Jan 2022 16:53:16 +0000

Subject: [PATCH] Fix null pointer dereference and use of uninitialized data

This fixes a bug that causes use of uninitialized heap data if `readbuf` fails

to read as many bytes as indicated by the extra field length attribute.

Furthermore, this fixes a null pointer dereference if an archive contains an

`EF_UNIPATH` extra field but does not have a filename set.

---

 fileio.c  | 5 ++++-

 process.c | 6 +++++-

 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/fileio.c b/fileio.c

index 6290824..95ea68b 100644

--- a/fileio.c

+++ b/fileio.c

@@ -2308,8 +2308,11 @@ int do_string(__G__ length, option)   /* return PK-type error code */

             seek_zipf(__G__ G.cur_zipfile_bufstart - G.extra_bytes +

                       (G.inptr-G.inbuf) + length);

         } else {

-            if (readbuf(__G__ (char *)G.extra_field, length) == 0)

+            unsigned bytes_read = readbuf(__G__ (char *)G.extra_field, length);

+            if (bytes_read == 0)

                 return PK_EOF;

+            if (bytes_read != length)

+                return PK_ERR;

             /* Looks like here is where extra fields are read */

             if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)

             {

diff --git a/process.c b/process.c

index d2a846e..cba2463 100644

--- a/process.c

+++ b/process.c

@@ -2064,10 +2064,14 @@ int getUnicodeData(__G__ ef_buf, ef_len)

           G.unipath_checksum = makelong(offset + ef_buf);

           offset += 4;

+          if (!G.filename_full) {

+            /* Check if we have a unicode extra section but no filename set */

+            return PK_ERR;

+          }

+

           /*

            * Compute 32-bit crc

            */

-

           chksum = crc32(chksum, (uch *)(G.filename_full),

                          strlen(G.filename_full));

-- 

2.25.1