A utility for unpacking zip files
Go to file
Matteo Croce 8804116fd0 fix obscure invalid memory access in zipinfo
zipinfo prints random garbage (and sometime crashes) when showing the usage:
run 1:
	miscellaneous options:
	  -h  print header line       -t  print totals for listed files or for all
	  -z  print zipfile comment   -T? print file times in sortable decimal format
	 ?-C  be case-insensitive  4l?????```??`????????????????????????????????

run 2:
	miscellaneous options:
	  -h  print header line       -t  print totals for listed files or for all
	  -z  print zipfile comment  `-T? print file times in sortable decimal format
	 ?-C? be case-insensitive   (null)  -x  exclude filenames that follow from listing

run 3:
	miscellaneous options:
	  -h  print header line       -t  print totals for listed files or for all
	  -z  print zipfile comment  ?-T? print file times in sortable decimal format
	 -Cv be case-insensitive   20 April 2009  -x  exclude filenames that follow from listing

run 4: segmentation fault

This happens because four '%c' modifiers are passed to sprintf, without
any corresponding argument.
This obviously generates a long list of compiler warnings, which are
ignored:

	In file included from unzip.h:720,
	                 from unzip.c:68:
	unzip.c: In function ‘usage’:
	unzpriv.h:1009:45: warning: format ‘%c’ expects argument of type ‘int’, but argument 3 has type ‘char *’ [-Wformat=]
	 1009 | #    define LoadFarString(x)        (char *)(x)
	      |                                             ^
	unzpriv.h:2728:61: note: in definition of macro ‘Info’
	 2728 |        (*G.message)((zvoid *)&G, (uch *)(buf), (ulg)sprintf sprf_arg, (flag))
	      |                                                             ^~~~~~~~
	unzip.c:2133:43: note: in expansion of macro ‘LoadFarString’
	 2133 |         Info(slide, flag, ((char *)slide, LoadFarString(ZipInfoUsageLine3),
	      |                                           ^~~~~~~~~~~~~
	unzpriv.h:1009:45: warning: format ‘%c’ expects a matching ‘int’ argument [-Wformat=]
	 1009 | #    define LoadFarString(x)        (char *)(x)
	      |                                             ^
	unzpriv.h:2728:61: note: in definition of macro ‘Info’
	 2728 |        (*G.message)((zvoid *)&G, (uch *)(buf), (ulg)sprintf sprf_arg, (flag))
	      |                                                             ^~~~~~~~
	unzip.c:2133:43: note: in expansion of macro ‘LoadFarString’
	 2133 |         Info(slide, flag, ((char *)slide, LoadFarString(ZipInfoUsageLine3),
	      |                                           ^~~~~~~~~~~~~
	unzpriv.h:1009:45: warning: format ‘%c’ expects a matching ‘int’ argument [-Wformat=]
	 1009 | #    define LoadFarString(x)        (char *)(x)
	      |                                             ^
	unzpriv.h:2728:61: note: in definition of macro ‘Info’
	 2728 |        (*G.message)((zvoid *)&G, (uch *)(buf), (ulg)sprintf sprf_arg, (flag))
	      |                                                             ^~~~~~~~
	unzip.c:2133:43: note: in expansion of macro ‘LoadFarString’
	 2133 |         Info(slide, flag, ((char *)slide, LoadFarString(ZipInfoUsageLine3),
	      |                                           ^~~~~~~~~~~~~
	unzpriv.h:1009:45: warning: format ‘%c’ expects a matching ‘int’ argument [-Wformat=]
	 1009 | #    define LoadFarString(x)        (char *)(x)
	      |                                             ^
	unzpriv.h:2728:61: note: in definition of macro ‘Info’
	 2728 |        (*G.message)((zvoid *)&G, (uch *)(buf), (ulg)sprintf sprf_arg, (flag))
	      |                                                             ^~~~~~~~
	unzip.c:2133:43: note: in expansion of macro ‘LoadFarString’
	 2133 |         Info(slide, flag, ((char *)slide, LoadFarString(ZipInfoUsageLine3),
	      |                                           ^~~~~~~~~~~~~
	unzpriv.h:1009:45: warning: format ‘%s’ expects a matching ‘char *’ argument [-Wformat=]
	 1009 | #    define LoadFarString(x)        (char *)(x)
	      |                                             ^
	unzpriv.h:2728:61: note: in definition of macro ‘Info’
	 2728 |        (*G.message)((zvoid *)&G, (uch *)(buf), (ulg)sprintf sprf_arg, (flag))
	      |                                                             ^~~~~~~~
	unzip.c:2133:43: note: in expansion of macro ‘LoadFarString’
	 2133 |         Info(slide, flag, ((char *)slide, LoadFarString(ZipInfoUsageLine3),
	      |                                           ^~~~~~~~~~~~~

Fix this by removing the '%c' modifiers.
Resolves: RHEL-60054

Signed-off-by: Matteo Croce <teknoraver@meta.com>
2024-09-25 17:13:37 +02:00
tests Add the gating tests 2022-01-05 08:49:46 +00:00
.gitignore RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
0001-Fix-CVE-2016-9844-rhbz-1404283.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
gating.yaml Add the gating tests 2022-01-05 08:49:46 +00:00
sources RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
STAGE1-unzip RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-alt-iconv-utf8-print.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-alt-iconv-utf8.patch fix obscure invalid memory access in zipinfo 2024-09-25 17:13:37 +02:00
unzip-6.0-attribs-overflow.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-bzip2-configure.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-caseinsensitive.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-close.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-configure.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-COVSCAN-fix-unterminated-string.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-cve-2014-8139.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-cve-2014-8140.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-cve-2014-8141.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-cve-2018-18384.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-cve-2018-1000035-heap-based-overflow.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-exec-shield.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-fix-recmatch.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-fix-warning-messages-on-big-files.patch Fix: Unzip Fails on Large Zip Files 2024-07-03 14:24:43 +02:00
unzip-6.0-format-secure.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-heap-overflow-infloop.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-manpage-fix.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-overflow-long-fsize.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-overflow.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-symlink.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-timestamp.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-valgrind.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-6.0-x-option.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-zipbomb-manpage.patch Allow the zipbomb detection to be disabled 2021-12-20 14:08:02 +01:00
unzip-zipbomb-part1.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-zipbomb-part2.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-zipbomb-part3.patch RHEL 9.0.0 Alpha bootstrap 2020-10-15 13:15:25 -07:00
unzip-zipbomb-part4.patch Add several patches dealing with the false positive zipbomb detection 2021-05-04 12:02:19 +02:00
unzip-zipbomb-part5.patch Add several patches dealing with the false positive zipbomb detection 2021-05-04 12:02:19 +02:00
unzip-zipbomb-part6.patch Add several patches dealing with the false positive zipbomb detection 2021-05-04 12:02:19 +02:00
unzip-zipbomb-switch.patch Allow the zipbomb detection to be disabled 2021-12-20 14:08:02 +01:00
unzip.spec fix obscure invalid memory access in zipinfo 2024-09-25 17:13:37 +02:00