34 lines
1.0 KiB
Diff
34 lines
1.0 KiB
Diff
From 99462cac1c6581bce36fe17fd1f430cbe114f0af Mon Sep 17 00:00:00 2001
|
|
From: Valentin Lefebvre <valentin.lefebvre@suse.com>
|
|
Date: Wed, 20 Sep 2023 12:04:56 +0200
|
|
Subject: [PATCH] mmappend.c: pre-check header trailer magic
|
|
|
|
* Avoid potential ASAN:SIGSEGV invalid memory access by pre-check the header
|
|
trailer magic.
|
|
* CVE-2020-18770
|
|
|
|
Signed-off-by: Valentin Lefebvre <valentin.lefebvre@suse.com>
|
|
|
|
---
|
|
zzip/mmapped.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/zzip/mmapped.c b/zzip/mmapped.c
|
|
index 8af18f4..49990e6 100644
|
|
--- a/zzip/mmapped.c
|
|
+++ b/zzip/mmapped.c
|
|
@@ -269,7 +269,9 @@ zzip_disk_entry_to_file_header(ZZIP_DISK * disk, struct zzip_disk_entry *entry)
|
|
return 0;
|
|
}
|
|
___ struct zzip_file_header *file_header = (void *) ptr;
|
|
- if (zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC)
|
|
+ if (file_header != 'P' || /* quick pre-check for trailer magic */
|
|
+ zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC)
|
|
+
|
|
{
|
|
errno = EBADMSG;
|
|
return 0;
|
|
--
|
|
2.40.1
|
|
|