rpms/gzip
7
0
Fork 0
Code Issues Pull Requests Releases Activity

New version of the CVE-2026-41992 patch

Browse Source 
Resolves: RHEL-233021
This commit is contained in:
Jakub Martisko 2026-08-18 16:18:48 +02:00
parent ebaa58e2b0
commit fb8699708c
2 changed files with 25 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
CVE-2026-41992.patch
View File

@ -15,22 +15,22 @@ Problem reported by Michał Majchrowicz.
3 files changed, 11 insertions(+)
diff --git a/unlzh.c b/unlzh.c
index 3320196..a6cf109 100644
index 2522764..c3e92ff 100644
--- a/unlzh.c
+++ b/unlzh.c
@@ -232,6 +232,12 @@ read_c_len ()
c = getbits(CBIT);
for (i = 0; i < NC; i++) c_len[i] = 0;
for (i = 0; i < 4096; i++) c_table[i] = c;
@@ -313,6 +307,12 @@ decode_p ()
local void huf_decode_start()
{
+ /* Needed in case LEFT and RIGHT are reused from a previous
+ LZW decompression. It may be overkill to clear all of both
+ arrays, but nobody has had time to analyze this carefully. */
+ memzero (left, (2 * NC - 1) * sizeof *left);
+ memzero (right, (2 * NC - 1) * sizeof *right);
+
+ /* Needed in case LEFT and RIGHT are reused from a previous
+ LZW decompression. It may be overkill to clear all of both
+ arrays, but nobody has had time to analyze this carefully. */
+ memzero(left, (2 * NC - 1) * sizeof *left);
+ memzero(right, (2 * NC - 1) * sizeof *left);
} else {
i = 0;
while (i < n) {
init_getbits(); blocksize = 0;
}
--
cgit v1.3

15
gzip.spec
View File

@ -1,7 +1,7 @@
Summary: The GNU data compression program
Name: gzip
Version: 1.9
Release: 14%{?dist}
Release: 15%{?dist}
# info pages are under GFDL license
License: GPLv3+ and GFDL
Group: Applications/File
@ -30,7 +30,11 @@ Patch11: cve-2022-1271-part3.patch
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
Patch12: CVE-2026-41991.patch
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
# Regarding the following two links:
# The second one reverts the first one and then applies the changes,
# since the first one is not being used here, the reverting part has been removed
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
#http://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d
Patch13: CVE-2026-41992.patch
# Fixed in upstream code.
@ -132,7 +136,12 @@ fi
%{profiledir}/*
%changelog
* Tue Apr 19 2022 Jakub Martisko <jamartis@redhat.com> - 1.9-14
* Tue Aug 18 2026 Jakub Martisko <jamartis@redhat.com> - 1.9-15
- Fix the wrong date in the previous changelog message
- There's an updated version of the CVE-2026-41992 fix
Resolves: CVE-2026-41992
* Fri Aug 14 2026 Jakub Martisko <jamartis@redhat.com> - 1.9-14
- Fix an issue with a temporary file creations when mktemp is missing (41991)
- Fix a global buffer overflow vulnerability in the LZH decompression logic (41992)
Resolves: CVE-2026-41991