From 349f566e6e757458843fa164a0f0584280e1501e Mon Sep 17 00:00:00 2001 From: Changqing Li Date: Wed, 15 Aug 2018 16:20:53 +0800 Subject: [PATCH] unzip: fix CVE-2018-1000035 Upstream-Status: Backport CVE: CVE-2018-1000035 backport from unzip6.10c23 Signed-off-by: Changqing Li --- fileio.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fileio.c b/fileio.c index 36bfea3..7605a29 100644 --- a/fileio.c +++ b/fileio.c @@ -1582,6 +1582,8 @@ int UZ_EXP UzpPassword (pG, rcnt, pwbuf, size, zfn, efn) int r = IZ_PW_ENTERED; char *m; char *prompt; + char *ep; + char *zp; #ifndef REENTRANT /* tell picky compilers to shut up about "unused variable" warnings */ @@ -1590,9 +1592,12 @@ int UZ_EXP UzpPassword (pG, rcnt, pwbuf, size, zfn, efn) if (*rcnt == 0) { /* First call for current entry */ *rcnt = 2; - if ((prompt = (char *)malloc(2*FILNAMSIZ + 15)) != (char *)NULL) { - sprintf(prompt, LoadFarString(PasswPrompt), - FnFilter1(zfn), FnFilter2(efn)); + zp = FnFilter1( zfn); + ep = FnFilter2( efn); + prompt = (char *)malloc( /* Slightly too long (2* "%s"). */ + sizeof( PasswPrompt)+ strlen( zp)+ strlen( ep)); + if (prompt != (char *)NULL) { + sprintf(prompt, LoadFarString(PasswPrompt), zp, ep); m = prompt; } else m = (char *)LoadFarString(PasswPrompt2); -- 2.7.4