Files
nixpkgs/pkgs/tools/compression/gzip/CVE-2026-41992.patch
Michael Daniels a7a6bd99a2 gzip: security fixes
Fixes #536998
2026-07-01 17:48:42 -04:00

36 lines
1.1 KiB
Diff
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Wed, 15 Apr 2026 12:00:17 -0700
Subject: gzip: dont mishandle .lzh after .Z
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Problem reported by Michał Majchrowicz.
* unlzh.c (read_c_len): Clear left and right when n == 0.
---
unlzh.c | 6 ++++++
1 file changed, 6 insertions(+)
(limited to 'unlzh.c')
diff --git a/unlzh.c b/unlzh.c
index 3320196..a6cf109 100644
--- a/unlzh.c
+++ b/unlzh.c
@@ -232,6 +232,12 @@ read_c_len ()
c = getbits(CBIT);
for (i = 0; i < NC; i++) c_len[i] = 0;
for (i = 0; i < 4096; i++) c_table[i] = c;
+
+ /* Needed in case LEFT and RIGHT are reused from a previous
+ LZW decompression. It may be overkill to clear all of both
+ arrays, but nobody has had time to analyze this carefully. */
+ memzero(left, (2 * NC - 1) * sizeof *left);
+ memzero(right, (2 * NC - 1) * sizeof *left);
} else {
i = 0;
while (i < n) {
--
cgit v1.3