From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED autolearn=ham autolearn_force=no version=3.4.2 Received: from inbox.vuxu.org (localhost [IPv6:::1]) by inbox.vuxu.org (OpenSMTPD) with ESMTP id 847ef53f for ; Thu, 26 Dec 2019 14:13:17 +0000 (UTC) Content-Type: multipart/mixed; boundary="===============5500850243632075439==" MIME-Version: 1.0 Subject: Re: [PR PATCH] [Updated] unzip: fix CVE-2018-18384. To: ml@inbox.vuxu.org From: voidlinux-github@inbox.vuxu.org Reply-to: ml@inbox.vuxu.org In-Reply-To: References: Date: Thu, 26 Dec 2019 15:13:17 +0100 Message-ID: <20191226141317.AyT4SuLV2VaBleOB6_5EzRkx5Sagwl5yuOXeumhU0YQ@z> GitHub notification mails are now in MIME to allow UTF8. --===============5500850243632075439== MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlcmUgaXMgYW4gdXBkYXRlZCBwdWxsIHJlcXVlc3QgYnkgdHJhdmFua29yIGFnYWluc3QgbWFz dGVyIG9uIHRoZSB2b2lkLXBhY2thZ2VzIHJlcG9zaXRvcnkKCmh0dHBzOi8vZ2l0aHViLmNvbS90 cmF2YW5rb3Ivdm9pZC1wYWNrYWdlcyB1bnppcApodHRwczovL2dpdGh1Yi5jb20vdm9pZC1saW51 eC92b2lkLXBhY2thZ2VzL3B1bGwvMTc3OTYKCnVuemlwOiBmaXggQ1ZFLTIwMTgtMTgzODQuCkFk ZCBic2R1bnppcCBhcyBhIGFsdGVybmF0aXZlIHRvIHVuemlwLgoKQSBwYXRjaCBmaWxlIGZyb20g aHR0cHM6Ly9naXRodWIuY29tL3ZvaWQtbGludXgvdm9pZC1wYWNrYWdlcy9wdWxsLzE3Nzk2LnBh dGNoIGlzIGF0dGFjaGVk --===============5500850243632075439== Content-Type: text/x-diff MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="github-pr-unzip-17796.patch" RnJvbSBkOTdiMjYzYThiYmFkOTJhYzM3NTBhNzVmYzZhZDlhMmFhMTZhZTA4IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiB0cmF2YW5rb3IgPHRyYXZhbmtvckB0dXRhLmlvPgpEYXRlOiBU aHUsIDI2IERlYyAyMDE5IDA2OjUwOjIyIC0wNzAwClN1YmplY3Q6IFtQQVRDSF0gdW56aXA6IGZp eCBDVkUtMjAxOC0xODM4NC4KCi0tLQogc3JjcGtncy91bnppcC9wYXRjaGVzL0NWRS0yMDE0LTk5 MTMucGF0Y2ggfCAyOCAtLS0tLS0tLS0tLS0tLS0tCiBzcmNwa2dzL3VuemlwL3BhdGNoZXMvcGF0 Y2gtbGlzdC5jLmRpZmYgICB8IDQwICsrKysrKysrKysrKysrKysrKysrKystCiAyIGZpbGVzIGNo YW5nZWQsIDM5IGluc2VydGlvbnMoKyksIDI5IGRlbGV0aW9ucygtKQogZGVsZXRlIG1vZGUgMTAw NjQ0IHNyY3BrZ3MvdW56aXAvcGF0Y2hlcy9DVkUtMjAxNC05OTEzLnBhdGNoCgpkaWZmIC0tZ2l0 IGEvc3JjcGtncy91bnppcC9wYXRjaGVzL0NWRS0yMDE0LTk5MTMucGF0Y2ggYi9zcmNwa2dzL3Vu emlwL3BhdGNoZXMvQ1ZFLTIwMTQtOTkxMy5wYXRjaApkZWxldGVkIGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDEyNGIwZDYyZmMuLjAwMDAwMDAwMDAwCi0tLSBhL3NyY3BrZ3MvdW56aXAvcGF0Y2hl cy9DVkUtMjAxNC05OTEzLnBhdGNoCisrKyAvZGV2L251bGwKQEAgLTEsMjggKzAsMCBAQAotRnJv bTogIlN0ZXZlbiBNLiBTY2h3ZWRhIiA8c21zQGFudGlub2RlLmluZm8+Ci1TdWJqZWN0OiBGaXgg Q1ZFLTIwMTQtOTkxMywgYnVmZmVyIG92ZXJmbG93IGluIHVuemlwCi1CdWc6IGh0dHBzOi8vc291 cmNlZm9yZ2UubmV0L3AvaW5mb3ppcC9idWdzLzI3LwotQnVnLURlYmlhbjogaHR0cHM6Ly9idWdz LmRlYmlhbi5vcmcvODQ3NDg1Ci1CdWctVWJ1bnR1OiBodHRwczovL2xhdW5jaHBhZC5uZXQvYnVn cy8zODczNTAKLQotLS0tIGxpc3QuYwotKysrIGxpc3QuYwotQEAgLTMzOSw3ICszMzksMTggQEAK LSAgICAgICAgICAgICAgICAgRy5jcmVjLmNvbXByZXNzaW9uX21ldGhvZCA9PSBFTkhERUZMQVRF RCkgewotICAgICAgICAgICAgICAgICBtZXRoYnVmWzVdID0gZHR5cGVbKEcuY3JlYy5nZW5lcmFs X3B1cnBvc2VfYml0X2ZsYWc+PjEpICYgM107Ci0gICAgICAgICAgICAgfSBlbHNlIGlmIChtZXRo bnVtID49IE5VTV9NRVRIT0RTKSB7Ci0tICAgICAgICAgICAgICAgIHNwcmludGYoJm1ldGhidWZb NF0sICIlMDN1IiwgRy5jcmVjLmNvbXByZXNzaW9uX21ldGhvZCk7Ci0rICAgICAgICAgICAgICAg IC8qIDIwMTMtMDItMjYgU01TLgotKyAgICAgICAgICAgICAgICAgKiBodHRwOi8vc291cmNlZm9y Z2UubmV0L3AvaW5mb3ppcC9idWdzLzI3LyAgQ1ZFLTIwMTQtOTkxMy4KLSsgICAgICAgICAgICAg ICAgICogVW5leHBlY3RlZGx5IGxhcmdlIGNvbXByZXNzaW9uIG1ldGhvZHMgb3ZlcmZsb3cKLSsg ICAgICAgICAgICAgICAgICogJm1ldGhidWZbXS4gIFVzZSB0aGUgb2xkLCB0aHJlZS1kaWdpdCBk ZWNpbWFsIGZvcm1hdAotKyAgICAgICAgICAgICAgICAgKiBmb3IgdmFsdWVzIHdoaWNoIGZpdC4g IE90aGVyd2lzZSwgc2FjcmlmaWNlIHRoZQotKyAgICAgICAgICAgICAgICAgKiBjb2xvbiwgYW5k IHVzZSBmb3VyLWRpZ2l0IGhleGFkZWNpbWFsLgotKyAgICAgICAgICAgICAgICAgKi8KLSsgICAg ICAgICAgICAgICAgaWYgKEcuY3JlYy5jb21wcmVzc2lvbl9tZXRob2QgPD0gOTk5KSB7Ci0rICAg ICAgICAgICAgICAgICAgICBzcHJpbnRmKCAmbWV0aGJ1ZlsgNF0sICIlMDN1IiwgRy5jcmVjLmNv bXByZXNzaW9uX21ldGhvZCk7Ci0rICAgICAgICAgICAgICAgIH0gZWxzZSB7Ci0rICAgICAgICAg ICAgICAgICAgICBzcHJpbnRmKCAmbWV0aGJ1ZlsgM10sICIlMDRYIiwgRy5jcmVjLmNvbXByZXNz aW9uX21ldGhvZCk7Ci0rICAgICAgICAgICAgICAgIH0KLSAgICAgICAgICAgICB9Ci0gCi0gI2lm IDAgICAgICAgLyogR1JSL0V1cm86ICBhZGQgdGhpcz8gKi8KZGlmZiAtLWdpdCBhL3NyY3BrZ3Mv dW56aXAvcGF0Y2hlcy9wYXRjaC1saXN0LmMuZGlmZiBiL3NyY3BrZ3MvdW56aXAvcGF0Y2hlcy9w YXRjaC1saXN0LmMuZGlmZgppbmRleCA0MzM5NmZlMDY4NC4uZTA5NjFlYzlmMTMgMTAwNjQ0Ci0t LSBhL3NyY3BrZ3MvdW56aXAvcGF0Y2hlcy9wYXRjaC1saXN0LmMuZGlmZgorKysgYi9zcmNwa2dz L3VuemlwL3BhdGNoZXMvcGF0Y2gtbGlzdC5jLmRpZmYKQEAgLTEsMTAgKzEsMzIgQEAKLSROZXRC U0Q6IHBhdGNoLWxpc3QuYyx2IDEuMSAyMDE1LzAxLzA2IDE0OjEyOjQ1IHdpeiBFeHAgJAorJE5l dEJTRDogcGF0Y2gtbGlzdC5jLHYgMS4zIDIwMTkvMDcvMTUgMTQ6MDg6MDMgbmlhIEV4cCAkCiAK K2NodW5rIDE6CitDVkUtMjAxOC0xODM4NCBmaXggZnJvbQoraHR0cHM6Ly9zb3VyY2Vmb3JnZS5u ZXQvcC9pbmZvemlwL2J1Z3MvNTMvCithbmQKK2h0dHBzOi8vc291cmNlcy5kZWJpYW4ub3JnL3Bh dGNoZXMvdW56aXAvNi4wLTI0LzA3LWluY3JlYXNlLXNpemUtb2YtY2ZhY3RvcnN0ci5wYXRjaC8K KworY2h1bmsgMjoKIEJpZy1oYW1tZXIgZml4IGZvcgogaHR0cDovL3NlY2xpc3RzLm9yZy9vc3Mt c2VjLzIwMTQvcTQvNDk3CiAKK2NodW5rIDM6CitDVkUtMjAxNC05OTEzIGZpeCBmcm9tCitodHRw czovL3Blb3BsZS5kZWJpYW4ub3JnL35zYW52aWxhL3VuemlwL2N2ZS0yMDE0LTk5MTMvY3ZlLTIw MTQtOTkxMy11bnppcC1idWZmZXItb3ZlcmZsb3cudHh0Cit2aWEKK2h0dHA6Ly93d3cuaW5mby16 aXAub3JnL3BocEJCMy92aWV3dG9waWMucGhwP2Y9NyZ0PTUyOQorCiAtLS0gbGlzdC5jLm9yaWcJ MjAwOS0wMi0wOCAxNzoxMTozNC4wMDAwMDAwMDAgKzAwMDAKICsrKyBsaXN0LmMKK0BAIC05Nyw3 ICs5Nyw3IEBAIGludCBsaXN0X2ZpbGVzKF9fRykgICAgLyogcmV0dXJuIFBLLXR5cGUKKyB7Cisg ICAgIGludCBkb190aGlzX2ZpbGU9RkFMU0UsIGNmYWN0b3IsIGVycm9yLCBlcnJvcl9pbl9hcmNo aXZlPVBLX0NPT0w7CisgI2lmbmRlZiBXSU5ETEwKKy0gICAgY2hhciBzZ24sIGNmYWN0b3JzdHJb MTBdOworKyAgICBjaGFyIHNnbiwgY2ZhY3RvcnN0clsxMl07CisgICAgIGludCBsb25naGRyPSh1 Ty52ZmxhZz4xKTsKKyAjZW5kaWYKKyAgICAgaW50IGRhdGVfZm9ybWF0OwogQEAgLTExNiw3ICsx MTYsNyBAQCBpbnQgbGlzdF9maWxlcyhfX0cpICAgIC8qIHJldHVybiBQSy10eXBlCiAgICAgIHVs ZyBhY2xfc2l6ZSwgdG90X2FjbHNpemU9MEwsIHRvdF9hY2xmaWxlcz0wTDsKICAjZW5kaWYKQEAg LTE0LDMgKzM2LDE5IEBAIGh0dHA6Ly9zZWNsaXN0cy5vcmcvb3NzLXNlYy8yMDE0L3E0LzQ5Nwog ICAgICBzdGF0aWMgWkNPTlNUIGNoYXIgZHR5cGVbXT0iTlhGUyI7ICAvKiBzZWUgemlfc2hvcnQo KSAqLwogICAgICBzdGF0aWMgWkNPTlNUIGNoYXIgRmFyIG1ldGhvZFtOVU1fTUVUSE9EUysxXVs4 XSA9CiAgICAgICAgICB7IlN0b3JlZCIsICJTaHJ1bmsiLCAiUmVkdWNlMSIsICJSZWR1Y2UyIiwg IlJlZHVjZTMiLCAiUmVkdWNlNCIsCitAQCAtMzM5LDcgKzMzOSwxNCBAQCBpbnQgbGlzdF9maWxl cyhfX0cpICAgIC8qIHJldHVybiBQSy10eXBlCisgICAgICAgICAgICAgICAgIEcuY3JlYy5jb21w cmVzc2lvbl9tZXRob2QgPT0gRU5IREVGTEFURUQpIHsKKyAgICAgICAgICAgICAgICAgbWV0aGJ1 Zls1XSA9IGR0eXBlWyhHLmNyZWMuZ2VuZXJhbF9wdXJwb3NlX2JpdF9mbGFnPj4xKSAmIDNdOwor ICAgICAgICAgICAgIH0gZWxzZSBpZiAobWV0aG51bSA+PSBOVU1fTUVUSE9EUykgeworLSAgICAg ICAgICAgICAgICBzcHJpbnRmKCZtZXRoYnVmWzRdLCAiJTAzdSIsIEcuY3JlYy5jb21wcmVzc2lv bl9tZXRob2QpOworKyAgICAgICAgICAgICAgICAvKiBGaXggZm9yIENWRS0yMDE0LTk5MTMsIHNp bWlsYXIgdG8gQ1ZFLTIwMTYtOTg0NC4KKysgICAgICAgICAgICAgICAgICogVXNlIHRoZSBvbGQg ZGVjaW1hbCBmb3JtYXQgb25seSBmb3IgdmFsdWVzIHdoaWNoIGZpdC4KKysgICAgICAgICAgICAg ICAgICovCisrICAgICAgICAgICAgICAgIGlmIChHLmNyZWMuY29tcHJlc3Npb25fbWV0aG9kIDw9 IDk5OSkgeworKyAgICAgICAgICAgICAgICAgICAgc3ByaW50ZiggJm1ldGhidWZbIDRdLCAiJTAz dSIsIEcuY3JlYy5jb21wcmVzc2lvbl9tZXRob2QpOworKyAgICAgICAgICAgICAgICB9IGVsc2Ug eworKyAgICAgICAgICAgICAgICAgICAgc3ByaW50ZiggJm1ldGhidWZbIDNdLCAiJTA0WCIsIEcu Y3JlYy5jb21wcmVzc2lvbl9tZXRob2QpOworKyAgICAgICAgICAgICAgICB9CisgICAgICAgICAg ICAgfQorIAorICNpZiAwICAgICAgIC8qIEdSUi9FdXJvOiAgYWRkIHRoaXM/ICovCg== --===============5500850243632075439==--