From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED autolearn=ham autolearn_force=no version=3.4.2 Received: from inbox.vuxu.org (localhost [IPv6:::1]) by inbox.vuxu.org (OpenSMTPD) with ESMTP id 6435b7ee for ; Thu, 26 Dec 2019 13:57:39 +0000 (UTC) Content-Type: multipart/mixed; boundary="===============0952537296753642430==" MIME-Version: 1.0 Subject: [PR PATCH] unzip: fix CVE-2018-18384. To: ml@inbox.vuxu.org From: voidlinux-github@inbox.vuxu.org Reply-to: ml@inbox.vuxu.org Message-ID: Date: Thu, 26 Dec 2019 14:57:39 +0100 GitHub notification mails are now in MIME to allow UTF8. --===============0952537296753642430== MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlcmUgaXMgYSBuZXcgcHVsbCByZXF1ZXN0IGJ5IHRyYXZhbmtvciBhZ2FpbnN0IG1hc3RlciBv biB0aGUgdm9pZC1wYWNrYWdlcyByZXBvc2l0b3J5CgpodHRwczovL2dpdGh1Yi5jb20vdHJhdmFu a29yL3ZvaWQtcGFja2FnZXMgdW56aXAKaHR0cHM6Ly9naXRodWIuY29tL3ZvaWQtbGludXgvdm9p ZC1wYWNrYWdlcy9wdWxsLzE3Nzk2Cgp1bnppcDogZml4IENWRS0yMDE4LTE4Mzg0LgpBZGQgYnNk dW56aXAgYXMgYSBhbHRlcm5hdGl2ZSB0byB1bnppcC4KCkEgcGF0Y2ggZmlsZSBmcm9tIGh0dHBz Oi8vZ2l0aHViLmNvbS92b2lkLWxpbnV4L3ZvaWQtcGFja2FnZXMvcHVsbC8xNzc5Ni5wYXRjaCBp cyBhdHRhY2hlZA== --===============0952537296753642430== Content-Type: text/x-diff MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="github-pr-unzip-17796.patch" RnJvbSBkOTdiMjYzYThiYmFkOTJhYzM3NTBhNzVmYzZhZDlhMmFhMTZhZTA4IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiB0cmF2YW5rb3IgPHRyYXZhbmtvckB0dXRhLmlvPgpEYXRlOiBU aHUsIDI2IERlYyAyMDE5IDA2OjUwOjIyIC0wNzAwClN1YmplY3Q6IFtQQVRDSCAxLzNdIHVuemlw OiBmaXggQ1ZFLTIwMTgtMTgzODQuCgotLS0KIHNyY3BrZ3MvdW56aXAvcGF0Y2hlcy9DVkUtMjAx NC05OTEzLnBhdGNoIHwgMjggLS0tLS0tLS0tLS0tLS0tLQogc3JjcGtncy91bnppcC9wYXRjaGVz L3BhdGNoLWxpc3QuYy5kaWZmICAgfCA0MCArKysrKysrKysrKysrKysrKysrKysrLQogMiBmaWxl cyBjaGFuZ2VkLCAzOSBpbnNlcnRpb25zKCspLCAyOSBkZWxldGlvbnMoLSkKIGRlbGV0ZSBtb2Rl IDEwMDY0NCBzcmNwa2dzL3VuemlwL3BhdGNoZXMvQ1ZFLTIwMTQtOTkxMy5wYXRjaAoKZGlmZiAt LWdpdCBhL3NyY3BrZ3MvdW56aXAvcGF0Y2hlcy9DVkUtMjAxNC05OTEzLnBhdGNoIGIvc3JjcGtn cy91bnppcC9wYXRjaGVzL0NWRS0yMDE0LTk5MTMucGF0Y2gKZGVsZXRlZCBmaWxlIG1vZGUgMTAw NjQ0CmluZGV4IDAxMjRiMGQ2MmZjLi4wMDAwMDAwMDAwMAotLS0gYS9zcmNwa2dzL3VuemlwL3Bh dGNoZXMvQ1ZFLTIwMTQtOTkxMy5wYXRjaAorKysgL2Rldi9udWxsCkBAIC0xLDI4ICswLDAgQEAK LUZyb206ICJTdGV2ZW4gTS4gU2Nod2VkYSIgPHNtc0BhbnRpbm9kZS5pbmZvPgotU3ViamVjdDog Rml4IENWRS0yMDE0LTk5MTMsIGJ1ZmZlciBvdmVyZmxvdyBpbiB1bnppcAotQnVnOiBodHRwczov L3NvdXJjZWZvcmdlLm5ldC9wL2luZm96aXAvYnVncy8yNy8KLUJ1Zy1EZWJpYW46IGh0dHBzOi8v YnVncy5kZWJpYW4ub3JnLzg0NzQ4NQotQnVnLVVidW50dTogaHR0cHM6Ly9sYXVuY2hwYWQubmV0 L2J1Z3MvMzg3MzUwCi0KLS0tLSBsaXN0LmMKLSsrKyBsaXN0LmMKLUBAIC0zMzksNyArMzM5LDE4 IEBACi0gICAgICAgICAgICAgICAgIEcuY3JlYy5jb21wcmVzc2lvbl9tZXRob2QgPT0gRU5IREVG TEFURUQpIHsKLSAgICAgICAgICAgICAgICAgbWV0aGJ1Zls1XSA9IGR0eXBlWyhHLmNyZWMuZ2Vu ZXJhbF9wdXJwb3NlX2JpdF9mbGFnPj4xKSAmIDNdOwotICAgICAgICAgICAgIH0gZWxzZSBpZiAo bWV0aG51bSA+PSBOVU1fTUVUSE9EUykgewotLSAgICAgICAgICAgICAgICBzcHJpbnRmKCZtZXRo YnVmWzRdLCAiJTAzdSIsIEcuY3JlYy5jb21wcmVzc2lvbl9tZXRob2QpOwotKyAgICAgICAgICAg ICAgICAvKiAyMDEzLTAyLTI2IFNNUy4KLSsgICAgICAgICAgICAgICAgICogaHR0cDovL3NvdXJj ZWZvcmdlLm5ldC9wL2luZm96aXAvYnVncy8yNy8gIENWRS0yMDE0LTk5MTMuCi0rICAgICAgICAg ICAgICAgICAqIFVuZXhwZWN0ZWRseSBsYXJnZSBjb21wcmVzc2lvbiBtZXRob2RzIG92ZXJmbG93 Ci0rICAgICAgICAgICAgICAgICAqICZtZXRoYnVmW10uICBVc2UgdGhlIG9sZCwgdGhyZWUtZGln aXQgZGVjaW1hbCBmb3JtYXQKLSsgICAgICAgICAgICAgICAgICogZm9yIHZhbHVlcyB3aGljaCBm aXQuICBPdGhlcndpc2UsIHNhY3JpZmljZSB0aGUKLSsgICAgICAgICAgICAgICAgICogY29sb24s IGFuZCB1c2UgZm91ci1kaWdpdCBoZXhhZGVjaW1hbC4KLSsgICAgICAgICAgICAgICAgICovCi0r ICAgICAgICAgICAgICAgIGlmIChHLmNyZWMuY29tcHJlc3Npb25fbWV0aG9kIDw9IDk5OSkgewot KyAgICAgICAgICAgICAgICAgICAgc3ByaW50ZiggJm1ldGhidWZbIDRdLCAiJTAzdSIsIEcuY3Jl Yy5jb21wcmVzc2lvbl9tZXRob2QpOwotKyAgICAgICAgICAgICAgICB9IGVsc2UgewotKyAgICAg ICAgICAgICAgICAgICAgc3ByaW50ZiggJm1ldGhidWZbIDNdLCAiJTA0WCIsIEcuY3JlYy5jb21w cmVzc2lvbl9tZXRob2QpOwotKyAgICAgICAgICAgICAgICB9Ci0gICAgICAgICAgICAgfQotIAot ICNpZiAwICAgICAgIC8qIEdSUi9FdXJvOiAgYWRkIHRoaXM/ICovCmRpZmYgLS1naXQgYS9zcmNw a2dzL3VuemlwL3BhdGNoZXMvcGF0Y2gtbGlzdC5jLmRpZmYgYi9zcmNwa2dzL3VuemlwL3BhdGNo ZXMvcGF0Y2gtbGlzdC5jLmRpZmYKaW5kZXggNDMzOTZmZTA2ODQuLmUwOTYxZWM5ZjEzIDEwMDY0 NAotLS0gYS9zcmNwa2dzL3VuemlwL3BhdGNoZXMvcGF0Y2gtbGlzdC5jLmRpZmYKKysrIGIvc3Jj cGtncy91bnppcC9wYXRjaGVzL3BhdGNoLWxpc3QuYy5kaWZmCkBAIC0xLDEwICsxLDMyIEBACi0k TmV0QlNEOiBwYXRjaC1saXN0LmMsdiAxLjEgMjAxNS8wMS8wNiAxNDoxMjo0NSB3aXogRXhwICQK KyROZXRCU0Q6IHBhdGNoLWxpc3QuYyx2IDEuMyAyMDE5LzA3LzE1IDE0OjA4OjAzIG5pYSBFeHAg JAogCitjaHVuayAxOgorQ1ZFLTIwMTgtMTgzODQgZml4IGZyb20KK2h0dHBzOi8vc291cmNlZm9y Z2UubmV0L3AvaW5mb3ppcC9idWdzLzUzLworYW5kCitodHRwczovL3NvdXJjZXMuZGViaWFuLm9y Zy9wYXRjaGVzL3VuemlwLzYuMC0yNC8wNy1pbmNyZWFzZS1zaXplLW9mLWNmYWN0b3JzdHIucGF0 Y2gvCisKK2NodW5rIDI6CiBCaWctaGFtbWVyIGZpeCBmb3IKIGh0dHA6Ly9zZWNsaXN0cy5vcmcv b3NzLXNlYy8yMDE0L3E0LzQ5NwogCitjaHVuayAzOgorQ1ZFLTIwMTQtOTkxMyBmaXggZnJvbQor aHR0cHM6Ly9wZW9wbGUuZGViaWFuLm9yZy9+c2FudmlsYS91bnppcC9jdmUtMjAxNC05OTEzL2N2 ZS0yMDE0LTk5MTMtdW56aXAtYnVmZmVyLW92ZXJmbG93LnR4dAordmlhCitodHRwOi8vd3d3Lmlu Zm8temlwLm9yZy9waHBCQjMvdmlld3RvcGljLnBocD9mPTcmdD01MjkKKwogLS0tIGxpc3QuYy5v cmlnCTIwMDktMDItMDggMTc6MTE6MzQuMDAwMDAwMDAwICswMDAwCiArKysgbGlzdC5jCitAQCAt OTcsNyArOTcsNyBAQCBpbnQgbGlzdF9maWxlcyhfX0cpICAgIC8qIHJldHVybiBQSy10eXBlCisg eworICAgICBpbnQgZG9fdGhpc19maWxlPUZBTFNFLCBjZmFjdG9yLCBlcnJvciwgZXJyb3JfaW5f YXJjaGl2ZT1QS19DT09MOworICNpZm5kZWYgV0lORExMCistICAgIGNoYXIgc2duLCBjZmFjdG9y c3RyWzEwXTsKKysgICAgY2hhciBzZ24sIGNmYWN0b3JzdHJbMTJdOworICAgICBpbnQgbG9uZ2hk cj0odU8udmZsYWc+MSk7CisgI2VuZGlmCisgICAgIGludCBkYXRlX2Zvcm1hdDsKIEBAIC0xMTYs NyArMTE2LDcgQEAgaW50IGxpc3RfZmlsZXMoX19HKSAgICAvKiByZXR1cm4gUEstdHlwZQogICAg ICB1bGcgYWNsX3NpemUsIHRvdF9hY2xzaXplPTBMLCB0b3RfYWNsZmlsZXM9MEw7CiAgI2VuZGlm CkBAIC0xNCwzICszNiwxOSBAQCBodHRwOi8vc2VjbGlzdHMub3JnL29zcy1zZWMvMjAxNC9xNC80 OTcKICAgICAgc3RhdGljIFpDT05TVCBjaGFyIGR0eXBlW109Ik5YRlMiOyAgLyogc2VlIHppX3No b3J0KCkgKi8KICAgICAgc3RhdGljIFpDT05TVCBjaGFyIEZhciBtZXRob2RbTlVNX01FVEhPRFMr MV1bOF0gPQogICAgICAgICAgeyJTdG9yZWQiLCAiU2hydW5rIiwgIlJlZHVjZTEiLCAiUmVkdWNl MiIsICJSZWR1Y2UzIiwgIlJlZHVjZTQiLAorQEAgLTMzOSw3ICszMzksMTQgQEAgaW50IGxpc3Rf ZmlsZXMoX19HKSAgICAvKiByZXR1cm4gUEstdHlwZQorICAgICAgICAgICAgICAgICBHLmNyZWMu Y29tcHJlc3Npb25fbWV0aG9kID09IEVOSERFRkxBVEVEKSB7CisgICAgICAgICAgICAgICAgIG1l dGhidWZbNV0gPSBkdHlwZVsoRy5jcmVjLmdlbmVyYWxfcHVycG9zZV9iaXRfZmxhZz4+MSkgJiAz XTsKKyAgICAgICAgICAgICB9IGVsc2UgaWYgKG1ldGhudW0gPj0gTlVNX01FVEhPRFMpIHsKKy0g ICAgICAgICAgICAgICAgc3ByaW50ZigmbWV0aGJ1Zls0XSwgIiUwM3UiLCBHLmNyZWMuY29tcHJl c3Npb25fbWV0aG9kKTsKKysgICAgICAgICAgICAgICAgLyogRml4IGZvciBDVkUtMjAxNC05OTEz LCBzaW1pbGFyIHRvIENWRS0yMDE2LTk4NDQuCisrICAgICAgICAgICAgICAgICAqIFVzZSB0aGUg b2xkIGRlY2ltYWwgZm9ybWF0IG9ubHkgZm9yIHZhbHVlcyB3aGljaCBmaXQuCisrICAgICAgICAg ICAgICAgICAqLworKyAgICAgICAgICAgICAgICBpZiAoRy5jcmVjLmNvbXByZXNzaW9uX21ldGhv ZCA8PSA5OTkpIHsKKysgICAgICAgICAgICAgICAgICAgIHNwcmludGYoICZtZXRoYnVmWyA0XSwg IiUwM3UiLCBHLmNyZWMuY29tcHJlc3Npb25fbWV0aG9kKTsKKysgICAgICAgICAgICAgICAgfSBl bHNlIHsKKysgICAgICAgICAgICAgICAgICAgIHNwcmludGYoICZtZXRoYnVmWyAzXSwgIiUwNFgi LCBHLmNyZWMuY29tcHJlc3Npb25fbWV0aG9kKTsKKysgICAgICAgICAgICAgICAgfQorICAgICAg ICAgICAgIH0KKyAKKyAjaWYgMCAgICAgICAvKiBHUlIvRXVybzogIGFkZCB0aGlzPyAqLwoKRnJv bSAzYzAzMDM5MjdmMTE3NDIzZTJiZjAwNWYyYTRlYThlMWMwZGNjMmRkIE1vbiBTZXAgMTcgMDA6 MDA6MDAgMjAwMQpGcm9tOiB0cmF2YW5rb3IgPHRyYXZhbmtvckB0dXRhLmlvPgpEYXRlOiBUaHUs IDI2IERlYyAyMDE5IDA2OjUyOjUzIC0wNzAwClN1YmplY3Q6IFtQQVRDSCAyLzNdIHVuemlwOiBh ZGQgdW56aXAgYXMgYW4gdW56aXAgYWx0ZXJuYXRpdmUuCgotLS0KIHNyY3BrZ3MvdW56aXAvdGVt cGxhdGUgfCA2ICsrKysrLQogMSBmaWxlIGNoYW5nZWQsIDUgaW5zZXJ0aW9ucygrKSwgMSBkZWxl dGlvbigtKQoKZGlmZiAtLWdpdCBhL3NyY3BrZ3MvdW56aXAvdGVtcGxhdGUgYi9zcmNwa2dzL3Vu emlwL3RlbXBsYXRlCmluZGV4IGVjNzI2ZWEyMzliLi41MzM4MTYxZTQ0YiAxMDA2NDQKLS0tIGEv c3JjcGtncy91bnppcC90ZW1wbGF0ZQorKysgYi9zcmNwa2dzL3VuemlwL3RlbXBsYXRlCkBAIC0x LDcgKzEsNyBAQAogIyBUZW1wbGF0ZSBmaWxlIGZvciAndW56aXAnCiBwa2duYW1lPXVuemlwCiB2 ZXJzaW9uPTYuMAotcmV2aXNpb249MTIKK3JldmlzaW9uPTEzCiB3cmtzcmM9dW56aXA2MAogbWFr ZWRlcGVuZHM9ImJ6aXAyLWRldmVsIgogc2hvcnRfZGVzYz0iTGlzdCwgdGVzdCBhbmQgZXh0cmFj dCBjb21wcmVzc2VkIGZpbGVzIGluIGEgWklQIGFyY2hpdmUiCkBAIC0xMSw2ICsxMSwxMCBAQCBo b21lcGFnZT0iaHR0cDovL2luZm96aXAuc2YubmV0LyIKIGRpc3RmaWxlcz0iJHtTT1VSQ0VGT1JH RV9TSVRFfS9pbmZvemlwLyR7cGtnbmFtZX02MC50YXIuZ3oiCiBjaGVja3N1bT0wMzZkOTY5OTE2 NDZkMDQ0OWVkMGFhOTUyZTRmYmUyMWI0NzZjZTk5NGFiYzI3NmU0OWQzMGU2ODY3MDhiZDM3CiAK K2FsdGVybmF0aXZlcz0iCisgdW56aXA6dW56aXA6L3Vzci9iaW4vdW56aXAKKyB1bnppcDp1bnpp cC4xOi91c3Ivc2hhcmUvbWFuL21hbjEvdW56aXAuMSIKKwogZG9fYnVpbGQoKSB7CiAJQ0ZMQUdT Kz0iIC1EX0ZJTEVfT0ZGU0VUX0JJVFM9NjQgLURXSUxEX1NUT1BfQVRfRElSIC1ETEFSR0VfRklM RV9TVVBQT1JUIFwKIAkJLURVTklDT0RFX1NVUFBPUlQgLURVTklDT0RFX1dDSEFSIC1EVVRGOF9N QVlCRV9OQVRJVkUgXAoKRnJvbSBhMGQ1NjBiMDhjMDVkNjVkZTgyZTVkNDI0MjYxMDMyZDRjOGFj OTZmIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiB0cmF2YW5rb3IgPHRyYXZhbmtvckB0 dXRhLmlvPgpEYXRlOiBUaHUsIDI2IERlYyAyMDE5IDA2OjUzOjI0IC0wNzAwClN1YmplY3Q6IFtQ QVRDSCAzLzNdIGJzZHVuemlwOiBhZGQgYnNkdW56aXAgYXMgYW4gdW56aXAgYWx0ZXJuYXRpdmUu CgotLS0KIHNyY3BrZ3MvYnNkdW56aXAvdGVtcGxhdGUgfCA2ICsrKysrLQogMSBmaWxlIGNoYW5n ZWQsIDUgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQoKZGlmZiAtLWdpdCBhL3NyY3BrZ3Mv YnNkdW56aXAvdGVtcGxhdGUgYi9zcmNwa2dzL2JzZHVuemlwL3RlbXBsYXRlCmluZGV4IGRkMDIz ODZiM2UwLi5mODUxZWExZmRmMiAxMDA2NDQKLS0tIGEvc3JjcGtncy9ic2R1bnppcC90ZW1wbGF0 ZQorKysgYi9zcmNwa2dzL2JzZHVuemlwL3RlbXBsYXRlCkBAIC0xLDcgKzEsNyBAQAogIyBUZW1w bGF0ZSBmaWxlIGZvciAnYnNkdW56aXAnCiBwa2duYW1lPWJzZHVuemlwCiB2ZXJzaW9uPTIwMTYw MTE1Ci1yZXZpc2lvbj0xCityZXZpc2lvbj0yCiBidWlsZF9zdHlsZT1nbnUtbWFrZWZpbGUKIG1h a2VkZXBlbmRzPSJsaWJhcmNoaXZlLWRldmVsIgogc2hvcnRfZGVzYz0iTGliYXJjaGl2ZSgzKS11 dGlsaXppbmcgdW56aXAgaW1wbGVtZW50YXRpb24gZnJvbSBGcmVlQlNEIgpAQCAtMTEsNiArMTEs MTAgQEAgaG9tZXBhZ2U9Imh0dHBzOi8vZ2l0aHViLmNvbS9zb21hc2lzL2JzZHVuemlwIgogZGlz dGZpbGVzPSJodHRwczovL2dpdGh1Yi5jb20vc29tYXNpcy9ic2R1bnppcC9hcmNoaXZlLyR7dmVy c2lvbn0udGFyLmd6IgogY2hlY2tzdW09MDZjNTJjNzdmYTUxODczMjY2NWFhMmRhYTczZjM2NGNk MjQ3MGE1ZDQ3YTgzYzljNzlmODZmMjA3Y2YzZWNjMQogCithbHRlcm5hdGl2ZXM9IgorIHVuemlw OnVuemlwOi91c3IvYmluL2JzZHVuemlwCisgdW56aXA6dW56aXAuMTovdXNyL3NoYXJlL21hbi9t YW4xL2JzZHVuemlwLjEiCisKIHBvc3RfaW5zdGFsbCgpIHsKIAl2bGljZW5zZSBMSUNFTlNFCiB9 Cg== --===============0952537296753642430==--