From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED autolearn=ham autolearn_force=no version=3.4.2 Received: from inbox.vuxu.org (localhost [IPv6:::1]) by inbox.vuxu.org (OpenSMTPD) with ESMTP id 2127ea6d for ; Thu, 26 Dec 2019 14:13:50 +0000 (UTC) Content-Type: multipart/mixed; boundary="===============3401702622988934412==" MIME-Version: 1.0 Subject: Re: [PR PATCH] [Updated] unzip: fix CVE-2018-18384. To: ml@inbox.vuxu.org From: voidlinux-github@inbox.vuxu.org Reply-to: ml@inbox.vuxu.org In-Reply-To: References: Date: Thu, 26 Dec 2019 15:13:50 +0100 Message-ID: <20191226141350.WINakjhZCb8JB13AvSQ5Q_lXsngoetMwucaJ-PSm5I4@z> GitHub notification mails are now in MIME to allow UTF8. --===============3401702622988934412== MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlcmUgaXMgYW4gdXBkYXRlZCBwdWxsIHJlcXVlc3QgYnkgdHJhdmFua29yIGFnYWluc3QgbWFz dGVyIG9uIHRoZSB2b2lkLXBhY2thZ2VzIHJlcG9zaXRvcnkKCmh0dHBzOi8vZ2l0aHViLmNvbS90 cmF2YW5rb3Ivdm9pZC1wYWNrYWdlcyB1bnppcApodHRwczovL2dpdGh1Yi5jb20vdm9pZC1saW51 eC92b2lkLXBhY2thZ2VzL3B1bGwvMTc3OTYKCnVuemlwOiBmaXggQ1ZFLTIwMTgtMTgzODQuCkFk ZCBic2R1bnppcCBhcyBhIGFsdGVybmF0aXZlIHRvIHVuemlwLgoKQSBwYXRjaCBmaWxlIGZyb20g aHR0cHM6Ly9naXRodWIuY29tL3ZvaWQtbGludXgvdm9pZC1wYWNrYWdlcy9wdWxsLzE3Nzk2LnBh dGNoIGlzIGF0dGFjaGVk --===============3401702622988934412== Content-Type: text/x-diff MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="github-pr-unzip-17796.patch" RnJvbSA5YzE4NDViZTkzZDc1MmM0NjNkNzU2MTQzNGEzNThjMTlmYTI3MmM3IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiB0cmF2YW5rb3IgPHRyYXZhbmtvckB0dXRhLmlvPgpEYXRlOiBU aHUsIDI2IERlYyAyMDE5IDA2OjUwOjIyIC0wNzAwClN1YmplY3Q6IFtQQVRDSF0gdW56aXA6IGZp eCBDVkUtMjAxOC0xODM4NC4KCi0tLQogc3JjcGtncy91bnppcC9wYXRjaGVzL0NWRS0yMDE0LTk5 MTMucGF0Y2ggfCAyOCAtLS0tLS0tLS0tLS0tLS0tCiBzcmNwa2dzL3VuemlwL3BhdGNoZXMvcGF0 Y2gtbGlzdC5jLmRpZmYgICB8IDQwICsrKysrKysrKysrKysrKysrKysrKystCiBzcmNwa2dzL3Vu emlwL3RlbXBsYXRlICAgICAgICAgICAgICAgICAgICB8ICAyICstCiAzIGZpbGVzIGNoYW5nZWQs IDQwIGluc2VydGlvbnMoKyksIDMwIGRlbGV0aW9ucygtKQogZGVsZXRlIG1vZGUgMTAwNjQ0IHNy Y3BrZ3MvdW56aXAvcGF0Y2hlcy9DVkUtMjAxNC05OTEzLnBhdGNoCgpkaWZmIC0tZ2l0IGEvc3Jj cGtncy91bnppcC9wYXRjaGVzL0NWRS0yMDE0LTk5MTMucGF0Y2ggYi9zcmNwa2dzL3VuemlwL3Bh dGNoZXMvQ1ZFLTIwMTQtOTkxMy5wYXRjaApkZWxldGVkIGZpbGUgbW9kZSAxMDA2NDQKaW5kZXgg MDEyNGIwZDYyZmMuLjAwMDAwMDAwMDAwCi0tLSBhL3NyY3BrZ3MvdW56aXAvcGF0Y2hlcy9DVkUt MjAxNC05OTEzLnBhdGNoCisrKyAvZGV2L251bGwKQEAgLTEsMjggKzAsMCBAQAotRnJvbTogIlN0 ZXZlbiBNLiBTY2h3ZWRhIiA8c21zQGFudGlub2RlLmluZm8+Ci1TdWJqZWN0OiBGaXggQ1ZFLTIw MTQtOTkxMywgYnVmZmVyIG92ZXJmbG93IGluIHVuemlwCi1CdWc6IGh0dHBzOi8vc291cmNlZm9y Z2UubmV0L3AvaW5mb3ppcC9idWdzLzI3LwotQnVnLURlYmlhbjogaHR0cHM6Ly9idWdzLmRlYmlh bi5vcmcvODQ3NDg1Ci1CdWctVWJ1bnR1OiBodHRwczovL2xhdW5jaHBhZC5uZXQvYnVncy8zODcz NTAKLQotLS0tIGxpc3QuYwotKysrIGxpc3QuYwotQEAgLTMzOSw3ICszMzksMTggQEAKLSAgICAg ICAgICAgICAgICAgRy5jcmVjLmNvbXByZXNzaW9uX21ldGhvZCA9PSBFTkhERUZMQVRFRCkgewot ICAgICAgICAgICAgICAgICBtZXRoYnVmWzVdID0gZHR5cGVbKEcuY3JlYy5nZW5lcmFsX3B1cnBv c2VfYml0X2ZsYWc+PjEpICYgM107Ci0gICAgICAgICAgICAgfSBlbHNlIGlmIChtZXRobnVtID49 IE5VTV9NRVRIT0RTKSB7Ci0tICAgICAgICAgICAgICAgIHNwcmludGYoJm1ldGhidWZbNF0sICIl MDN1IiwgRy5jcmVjLmNvbXByZXNzaW9uX21ldGhvZCk7Ci0rICAgICAgICAgICAgICAgIC8qIDIw MTMtMDItMjYgU01TLgotKyAgICAgICAgICAgICAgICAgKiBodHRwOi8vc291cmNlZm9yZ2UubmV0 L3AvaW5mb3ppcC9idWdzLzI3LyAgQ1ZFLTIwMTQtOTkxMy4KLSsgICAgICAgICAgICAgICAgICog VW5leHBlY3RlZGx5IGxhcmdlIGNvbXByZXNzaW9uIG1ldGhvZHMgb3ZlcmZsb3cKLSsgICAgICAg ICAgICAgICAgICogJm1ldGhidWZbXS4gIFVzZSB0aGUgb2xkLCB0aHJlZS1kaWdpdCBkZWNpbWFs IGZvcm1hdAotKyAgICAgICAgICAgICAgICAgKiBmb3IgdmFsdWVzIHdoaWNoIGZpdC4gIE90aGVy d2lzZSwgc2FjcmlmaWNlIHRoZQotKyAgICAgICAgICAgICAgICAgKiBjb2xvbiwgYW5kIHVzZSBm b3VyLWRpZ2l0IGhleGFkZWNpbWFsLgotKyAgICAgICAgICAgICAgICAgKi8KLSsgICAgICAgICAg ICAgICAgaWYgKEcuY3JlYy5jb21wcmVzc2lvbl9tZXRob2QgPD0gOTk5KSB7Ci0rICAgICAgICAg ICAgICAgICAgICBzcHJpbnRmKCAmbWV0aGJ1ZlsgNF0sICIlMDN1IiwgRy5jcmVjLmNvbXByZXNz aW9uX21ldGhvZCk7Ci0rICAgICAgICAgICAgICAgIH0gZWxzZSB7Ci0rICAgICAgICAgICAgICAg ICAgICBzcHJpbnRmKCAmbWV0aGJ1ZlsgM10sICIlMDRYIiwgRy5jcmVjLmNvbXByZXNzaW9uX21l dGhvZCk7Ci0rICAgICAgICAgICAgICAgIH0KLSAgICAgICAgICAgICB9Ci0gCi0gI2lmIDAgICAg ICAgLyogR1JSL0V1cm86ICBhZGQgdGhpcz8gKi8KZGlmZiAtLWdpdCBhL3NyY3BrZ3MvdW56aXAv cGF0Y2hlcy9wYXRjaC1saXN0LmMuZGlmZiBiL3NyY3BrZ3MvdW56aXAvcGF0Y2hlcy9wYXRjaC1s aXN0LmMuZGlmZgppbmRleCA0MzM5NmZlMDY4NC4uZTA5NjFlYzlmMTMgMTAwNjQ0Ci0tLSBhL3Ny Y3BrZ3MvdW56aXAvcGF0Y2hlcy9wYXRjaC1saXN0LmMuZGlmZgorKysgYi9zcmNwa2dzL3Vuemlw L3BhdGNoZXMvcGF0Y2gtbGlzdC5jLmRpZmYKQEAgLTEsMTAgKzEsMzIgQEAKLSROZXRCU0Q6IHBh dGNoLWxpc3QuYyx2IDEuMSAyMDE1LzAxLzA2IDE0OjEyOjQ1IHdpeiBFeHAgJAorJE5ldEJTRDog cGF0Y2gtbGlzdC5jLHYgMS4zIDIwMTkvMDcvMTUgMTQ6MDg6MDMgbmlhIEV4cCAkCiAKK2NodW5r IDE6CitDVkUtMjAxOC0xODM4NCBmaXggZnJvbQoraHR0cHM6Ly9zb3VyY2Vmb3JnZS5uZXQvcC9p bmZvemlwL2J1Z3MvNTMvCithbmQKK2h0dHBzOi8vc291cmNlcy5kZWJpYW4ub3JnL3BhdGNoZXMv dW56aXAvNi4wLTI0LzA3LWluY3JlYXNlLXNpemUtb2YtY2ZhY3RvcnN0ci5wYXRjaC8KKworY2h1 bmsgMjoKIEJpZy1oYW1tZXIgZml4IGZvcgogaHR0cDovL3NlY2xpc3RzLm9yZy9vc3Mtc2VjLzIw MTQvcTQvNDk3CiAKK2NodW5rIDM6CitDVkUtMjAxNC05OTEzIGZpeCBmcm9tCitodHRwczovL3Bl b3BsZS5kZWJpYW4ub3JnL35zYW52aWxhL3VuemlwL2N2ZS0yMDE0LTk5MTMvY3ZlLTIwMTQtOTkx My11bnppcC1idWZmZXItb3ZlcmZsb3cudHh0Cit2aWEKK2h0dHA6Ly93d3cuaW5mby16aXAub3Jn L3BocEJCMy92aWV3dG9waWMucGhwP2Y9NyZ0PTUyOQorCiAtLS0gbGlzdC5jLm9yaWcJMjAwOS0w Mi0wOCAxNzoxMTozNC4wMDAwMDAwMDAgKzAwMDAKICsrKyBsaXN0LmMKK0BAIC05Nyw3ICs5Nyw3 IEBAIGludCBsaXN0X2ZpbGVzKF9fRykgICAgLyogcmV0dXJuIFBLLXR5cGUKKyB7CisgICAgIGlu dCBkb190aGlzX2ZpbGU9RkFMU0UsIGNmYWN0b3IsIGVycm9yLCBlcnJvcl9pbl9hcmNoaXZlPVBL X0NPT0w7CisgI2lmbmRlZiBXSU5ETEwKKy0gICAgY2hhciBzZ24sIGNmYWN0b3JzdHJbMTBdOwor KyAgICBjaGFyIHNnbiwgY2ZhY3RvcnN0clsxMl07CisgICAgIGludCBsb25naGRyPSh1Ty52Zmxh Zz4xKTsKKyAjZW5kaWYKKyAgICAgaW50IGRhdGVfZm9ybWF0OwogQEAgLTExNiw3ICsxMTYsNyBA QCBpbnQgbGlzdF9maWxlcyhfX0cpICAgIC8qIHJldHVybiBQSy10eXBlCiAgICAgIHVsZyBhY2xf c2l6ZSwgdG90X2FjbHNpemU9MEwsIHRvdF9hY2xmaWxlcz0wTDsKICAjZW5kaWYKQEAgLTE0LDMg KzM2LDE5IEBAIGh0dHA6Ly9zZWNsaXN0cy5vcmcvb3NzLXNlYy8yMDE0L3E0LzQ5NwogICAgICBz dGF0aWMgWkNPTlNUIGNoYXIgZHR5cGVbXT0iTlhGUyI7ICAvKiBzZWUgemlfc2hvcnQoKSAqLwog ICAgICBzdGF0aWMgWkNPTlNUIGNoYXIgRmFyIG1ldGhvZFtOVU1fTUVUSE9EUysxXVs4XSA9CiAg ICAgICAgICB7IlN0b3JlZCIsICJTaHJ1bmsiLCAiUmVkdWNlMSIsICJSZWR1Y2UyIiwgIlJlZHVj ZTMiLCAiUmVkdWNlNCIsCitAQCAtMzM5LDcgKzMzOSwxNCBAQCBpbnQgbGlzdF9maWxlcyhfX0cp ICAgIC8qIHJldHVybiBQSy10eXBlCisgICAgICAgICAgICAgICAgIEcuY3JlYy5jb21wcmVzc2lv bl9tZXRob2QgPT0gRU5IREVGTEFURUQpIHsKKyAgICAgICAgICAgICAgICAgbWV0aGJ1Zls1XSA9 IGR0eXBlWyhHLmNyZWMuZ2VuZXJhbF9wdXJwb3NlX2JpdF9mbGFnPj4xKSAmIDNdOworICAgICAg ICAgICAgIH0gZWxzZSBpZiAobWV0aG51bSA+PSBOVU1fTUVUSE9EUykgeworLSAgICAgICAgICAg ICAgICBzcHJpbnRmKCZtZXRoYnVmWzRdLCAiJTAzdSIsIEcuY3JlYy5jb21wcmVzc2lvbl9tZXRo b2QpOworKyAgICAgICAgICAgICAgICAvKiBGaXggZm9yIENWRS0yMDE0LTk5MTMsIHNpbWlsYXIg dG8gQ1ZFLTIwMTYtOTg0NC4KKysgICAgICAgICAgICAgICAgICogVXNlIHRoZSBvbGQgZGVjaW1h bCBmb3JtYXQgb25seSBmb3IgdmFsdWVzIHdoaWNoIGZpdC4KKysgICAgICAgICAgICAgICAgICov CisrICAgICAgICAgICAgICAgIGlmIChHLmNyZWMuY29tcHJlc3Npb25fbWV0aG9kIDw9IDk5OSkg eworKyAgICAgICAgICAgICAgICAgICAgc3ByaW50ZiggJm1ldGhidWZbIDRdLCAiJTAzdSIsIEcu Y3JlYy5jb21wcmVzc2lvbl9tZXRob2QpOworKyAgICAgICAgICAgICAgICB9IGVsc2UgeworKyAg ICAgICAgICAgICAgICAgICAgc3ByaW50ZiggJm1ldGhidWZbIDNdLCAiJTA0WCIsIEcuY3JlYy5j b21wcmVzc2lvbl9tZXRob2QpOworKyAgICAgICAgICAgICAgICB9CisgICAgICAgICAgICAgfQor IAorICNpZiAwICAgICAgIC8qIEdSUi9FdXJvOiAgYWRkIHRoaXM/ICovCmRpZmYgLS1naXQgYS9z cmNwa2dzL3VuemlwL3RlbXBsYXRlIGIvc3JjcGtncy91bnppcC90ZW1wbGF0ZQppbmRleCBlYzcy NmVhMjM5Yi4uYzAxZmNhMjI3NjggMTAwNjQ0Ci0tLSBhL3NyY3BrZ3MvdW56aXAvdGVtcGxhdGUK KysrIGIvc3JjcGtncy91bnppcC90ZW1wbGF0ZQpAQCAtMSw3ICsxLDcgQEAKICMgVGVtcGxhdGUg ZmlsZSBmb3IgJ3VuemlwJwogcGtnbmFtZT11bnppcAogdmVyc2lvbj02LjAKLXJldmlzaW9uPTEy CityZXZpc2lvbj0xMwogd3Jrc3JjPXVuemlwNjAKIG1ha2VkZXBlbmRzPSJiemlwMi1kZXZlbCIK IHNob3J0X2Rlc2M9Ikxpc3QsIHRlc3QgYW5kIGV4dHJhY3QgY29tcHJlc3NlZCBmaWxlcyBpbiBh IFpJUCBhcmNoaXZlIgo= --===============3401702622988934412==--