gentoo-ebuilds/net-dialup/lrzsz/files/lrzsz-0.12.20-fix-integer-overflow.patch
Christopher Fore 9d72a7601e
net-dialup/lrzsz: Fix information leak
- Patch taken from Fedora (check patch file for link)
- Seems to still be affected by https://bugs.gentoo.org/836585
  - Tests pass otherwise ("All tests OK.")

Bug: https://bugs.gentoo.org/797247
Signed-off-by: Christopher Fore <csfore@posteo.net>
Closes: https://github.com/gentoo/gentoo/pull/37927
Signed-off-by: Viorel Munteanu <ceamac@gentoo.org>
2024-08-03 09:02:01 +03:00

23 lines
672 B
Diff

https://src.fedoraproject.org/rpms/lrzsz/blob/rawhide/f/lrzsz-0.12.20.patch
https://bugs.gentoo.org/797247
diff -urN lrzsz-0.12.20/src/zm.c lrzsz-0.12.20.new/src/zm.c
--- lrzsz-0.12.20/src/zm.c Tue Dec 29 09:48:38 1998
+++ lrzsz-0.12.20.new/src/zm.c Tue Oct 8 12:46:58 2002
@@ -431,10 +431,12 @@
VPRINTF(3,("zsdata: %lu %s", (unsigned long) length,
Zendnames[(frameend-ZCRCE)&3]));
crc = 0;
- do {
- zsendline(*buf); crc = updcrc((0377 & *buf), crc);
- buf++;
- } while (--length>0);
+
+ for( ; length; length--) {
+ zsendline(*buf); crc = updcrc((0377 & *buf), crc);
+ buf++;
+ }
+
xsendline(ZDLE); xsendline(frameend);
crc = updcrc(frameend, crc);