From 6782e35b01a89c8f55b435fc04bf3fac4629c3c1 Mon Sep 17 00:00:00 2001 From: Christian Schneider Date: Thu, 14 Jan 2016 13:54:31 +0100 Subject: [PATCH] Updated bzip2 from version 1.0.5 to 1.0.6 - See issue #13 - version 1.0.6 fixes a potential security vulnerability (CVE-2010-0405) - Added comments about modifications - Added bzip2 LICENSE file --- contrib/bzip2/LICENSE | 42 +++++++++++++++++++++++++++++++++++ contrib/bzip2/blocksort.c | 4 ++-- contrib/bzip2/bzlib.c | 30 +++++++++++++------------ contrib/bzip2/bzlib.h | 4 ++-- contrib/bzip2/bzlib_private.h | 6 ++--- contrib/bzip2/compress.c | 4 ++-- contrib/bzip2/crctable.c | 4 ++-- contrib/bzip2/decompress.c | 30 +++++++++++++++++++++---- contrib/bzip2/huffman.c | 4 ++-- contrib/bzip2/randtable.c | 4 ++-- 10 files changed, 99 insertions(+), 33 deletions(-) create mode 100644 contrib/bzip2/LICENSE diff --git a/contrib/bzip2/LICENSE b/contrib/bzip2/LICENSE new file mode 100644 index 0000000..cc61417 --- /dev/null +++ b/contrib/bzip2/LICENSE @@ -0,0 +1,42 @@ + +-------------------------------------------------------------------------- + +This program, "bzip2", the associated library "libbzip2", and all +documentation, are copyright (C) 1996-2010 Julian R Seward. All +rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + +2. The origin of this software must not be misrepresented; you must + not claim that you wrote the original software. If you use this + software in a product, an acknowledgment in the product + documentation would be appreciated but is not required. + +3. Altered source versions must be plainly marked as such, and must + not be misrepresented as being the original software. + +4. The name of the author may not be used to endorse or promote + products derived from this software without specific prior written + permission. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS +OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY +DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE +GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Julian Seward, jseward@bzip.org +bzip2/libbzip2 version 1.0.6 of 6 September 2010 + +-------------------------------------------------------------------------- diff --git a/contrib/bzip2/blocksort.c b/contrib/bzip2/blocksort.c index bd2dec1..d0d662c 100644 --- a/contrib/bzip2/blocksort.c +++ b/contrib/bzip2/blocksort.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/contrib/bzip2/bzlib.c b/contrib/bzip2/bzlib.c index 31a3db5..377c8f9 100644 --- a/contrib/bzip2/bzlib.c +++ b/contrib/bzip2/bzlib.c @@ -8,8 +8,9 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward + Changes made by schnaader for Precomp to avoid compiler errors Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -165,7 +166,7 @@ int BZ_API(BZ2_bzCompressInit) if (strm->bzalloc == NULL) strm->bzalloc = default_bzalloc; if (strm->bzfree == NULL) strm->bzfree = default_bzfree; - s = (EState*)BZALLOC( sizeof(EState) ); + s = (EState*)BZALLOC( sizeof(EState) ); // schnaader: changed to avoid -fpermissive if (s == NULL) return BZ_MEM_ERROR; s->strm = strm; @@ -174,6 +175,7 @@ int BZ_API(BZ2_bzCompressInit) s->ftab = NULL; n = 100000 * blockSize100k; + // schnaader: changed to avoid -fpermissive s->arr1 = (UInt32*)BZALLOC( n * sizeof(UInt32) ); s->arr2 = (UInt32*)BZALLOC( (n+BZ_N_OVERSHOOT) * sizeof(UInt32) ); s->ftab = (UInt32*)BZALLOC( 65537 * sizeof(UInt32) ); @@ -362,7 +364,7 @@ Bool handle_compress ( bz_stream* strm ) { Bool progress_in = False; Bool progress_out = False; - EState* s = (EState*)strm->state; + EState* s = (EState*)strm->state; // schnaader: changed to avoid -fpermissive while (True) { @@ -409,7 +411,7 @@ int BZ_API(BZ2_bzCompress) ( bz_stream *strm, int action ) Bool progress; EState* s; if (strm == NULL) return BZ_PARAM_ERROR; - s = (EState*)strm->state; + s = (EState*)strm->state; // schnaader: changed to avoid -fpermissive if (s == NULL) return BZ_PARAM_ERROR; if (s->strm != strm) return BZ_PARAM_ERROR; @@ -469,7 +471,7 @@ int BZ_API(BZ2_bzCompressEnd) ( bz_stream *strm ) { EState* s; if (strm == NULL) return BZ_PARAM_ERROR; - s = (EState*)strm->state; + s = (EState*)strm->state; // schnaader: changed to avoid -fpermissive if (s == NULL) return BZ_PARAM_ERROR; if (s->strm != strm) return BZ_PARAM_ERROR; @@ -505,7 +507,7 @@ int BZ_API(BZ2_bzDecompressInit) if (strm->bzalloc == NULL) strm->bzalloc = default_bzalloc; if (strm->bzfree == NULL) strm->bzfree = default_bzfree; - s = (DState*)BZALLOC( sizeof(DState) ); + s = (DState*)BZALLOC( sizeof(DState) ); // schnaader: changed to avoid -fpermissive if (s == NULL) return BZ_MEM_ERROR; s->strm = strm; strm->state = s; @@ -684,7 +686,7 @@ Bool unRLE_obuf_to_output_FAST ( DState* s ) /*---------------------------------------------------*/ -Int32 BZ2_indexIntoF ( Int32 indx, Int32 *cftab ) +Int32 BZ2_indexIntoF ( Int32 indx, Int32 *cftab ) // schnaader: changed to satisfy the linker { Int32 nb, na, mid; nb = 0; @@ -810,7 +812,7 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm ) Bool corrupt; DState* s; if (strm == NULL) return BZ_PARAM_ERROR; - s = (DState*)strm->state; + s = (DState*)strm->state; // schnaader: changed to avoid -fpermissive if (s == NULL) return BZ_PARAM_ERROR; if (s->strm != strm) return BZ_PARAM_ERROR; @@ -863,7 +865,7 @@ int BZ_API(BZ2_bzDecompressEnd) ( bz_stream *strm ) { DState* s; if (strm == NULL) return BZ_PARAM_ERROR; - s = (DState*)strm->state; + s = (DState*)strm->state; // schnaader: changed to avoid -fpermissive if (s == NULL) return BZ_PARAM_ERROR; if (s->strm != strm) return BZ_PARAM_ERROR; @@ -934,7 +936,7 @@ BZFILE* BZ_API(BZ2_bzWriteOpen) if (ferror(f)) { BZ_SETERR(BZ_IO_ERROR); return NULL; }; - bzf = (bzFile*)malloc ( sizeof(bzFile) ); + bzf = (bzFile*)malloc ( sizeof(bzFile) ); // schnaader: changed to avoid -fpermissive if (bzf == NULL) { BZ_SETERR(BZ_MEM_ERROR); return NULL; }; @@ -982,7 +984,7 @@ void BZ_API(BZ2_bzWrite) { BZ_SETERR(BZ_OK); return; }; bzf->strm.avail_in = len; - bzf->strm.next_in = (char*)buf; + bzf->strm.next_in = (char*)buf; // schnaader: changed to avoid -fpermissive while (True) { bzf->strm.avail_out = BZ_MAX_UNUSED; @@ -1107,7 +1109,7 @@ BZFILE* BZ_API(BZ2_bzReadOpen) if (ferror(f)) { BZ_SETERR(BZ_IO_ERROR); return NULL; }; - bzf = (bzFile*)malloc ( sizeof(bzFile) ); + bzf = (bzFile*)malloc ( sizeof(bzFile) ); // schnaader: changed to avoid -fpermissive if (bzf == NULL) { BZ_SETERR(BZ_MEM_ERROR); return NULL; }; @@ -1179,7 +1181,7 @@ int BZ_API(BZ2_bzRead) { BZ_SETERR(BZ_OK); return 0; }; bzf->strm.avail_out = len; - bzf->strm.next_out = (char*)buf; + bzf->strm.next_out = (char*)buf; // schnaader: changed to avoid -fpermissive while (True) { diff --git a/contrib/bzip2/bzlib.h b/contrib/bzip2/bzlib.h index c5b75d6..8277123 100644 --- a/contrib/bzip2/bzlib.h +++ b/contrib/bzip2/bzlib.h @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/contrib/bzip2/bzlib_private.h b/contrib/bzip2/bzlib_private.h index 2342787..5d0217f 100644 --- a/contrib/bzip2/bzlib_private.h +++ b/contrib/bzip2/bzlib_private.h @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -36,7 +36,7 @@ /*-- General stuff. --*/ -#define BZ_VERSION "1.0.5, 10-Dec-2007" +#define BZ_VERSION "1.0.6, 6-Sept-2010" typedef char Char; typedef unsigned char Bool; diff --git a/contrib/bzip2/compress.c b/contrib/bzip2/compress.c index 8c80a07..caf7696 100644 --- a/contrib/bzip2/compress.c +++ b/contrib/bzip2/compress.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/contrib/bzip2/crctable.c b/contrib/bzip2/crctable.c index 215687b..1fea7e9 100644 --- a/contrib/bzip2/crctable.c +++ b/contrib/bzip2/crctable.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/contrib/bzip2/decompress.c b/contrib/bzip2/decompress.c index 6015ef2..703d03d 100644 --- a/contrib/bzip2/decompress.c +++ b/contrib/bzip2/decompress.c @@ -8,9 +8,10 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward - + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward + Changes made by schnaader for Precomp to avoid compiler errors + Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -209,13 +210,14 @@ Int32 BZ2_decompress ( DState* s ) s->blockSize100k -= BZ_HDR_0; if (s->smallDecompress) { + // schnaader: changed to avoid -fpermissive s->ll16 = (UInt16*)BZALLOC( s->blockSize100k * 100000 * sizeof(UInt16) ); s->ll4 = (UChar*)BZALLOC( ((1 + s->blockSize100k * 100000) >> 1) * sizeof(UChar) ); if (s->ll16 == NULL || s->ll4 == NULL) RETURN(BZ_MEM_ERROR); } else { - s->tt = (UInt32*)BZALLOC( s->blockSize100k * 100000 * sizeof(Int32) ); + s->tt = (UInt32*)BZALLOC( s->blockSize100k * 100000 * sizeof(Int32) ); // schnaader: changed to avoid -fpermissive if (s->tt == NULL) RETURN(BZ_MEM_ERROR); } @@ -381,6 +383,13 @@ Int32 BZ2_decompress ( DState* s ) es = -1; N = 1; do { + /* Check that N doesn't get too big, so that es doesn't + go negative. The maximum value that can be + RUNA/RUNB encoded is equal to the block size (post + the initial RLE), viz, 900k, so bounding N at 2 + million should guard against overflow without + rejecting any legitimate inputs. */ + if (N >= 2*1024*1024) RETURN(BZ_DATA_ERROR); if (nextSym == BZ_RUNA) es = es + (0+1) * N; else if (nextSym == BZ_RUNB) es = es + (1+1) * N; N = N * 2; @@ -485,15 +494,28 @@ Int32 BZ2_decompress ( DState* s ) RETURN(BZ_DATA_ERROR); /*-- Set up cftab to facilitate generation of T^(-1) --*/ + /* Check: unzftab entries in range. */ + for (i = 0; i <= 255; i++) { + if (s->unzftab[i] < 0 || s->unzftab[i] > nblock) + RETURN(BZ_DATA_ERROR); + } + /* Actually generate cftab. */ s->cftab[0] = 0; for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1]; for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1]; + /* Check: cftab entries in range. */ for (i = 0; i <= 256; i++) { if (s->cftab[i] < 0 || s->cftab[i] > nblock) { /* s->cftab[i] can legitimately be == nblock */ RETURN(BZ_DATA_ERROR); } } + /* Check: cftab entries non-descending. */ + for (i = 1; i <= 256; i++) { + if (s->cftab[i-1] > s->cftab[i]) { + RETURN(BZ_DATA_ERROR); + } + } s->state_out_len = 0; s->state_out_ch = 0; diff --git a/contrib/bzip2/huffman.c b/contrib/bzip2/huffman.c index 87e79e3..2283fdb 100644 --- a/contrib/bzip2/huffman.c +++ b/contrib/bzip2/huffman.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/contrib/bzip2/randtable.c b/contrib/bzip2/randtable.c index 068b763..6d62459 100644 --- a/contrib/bzip2/randtable.c +++ b/contrib/bzip2/randtable.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.5 of 10 December 2007 - Copyright (C) 1996-2007 Julian Seward + bzip2/libbzip2 version 1.0.6 of 6 September 2010 + Copyright (C) 1996-2010 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file.