Imported Debian patch 1.3.5-10sarge2

diff --git a/debian/changelog b/debian/changelog
index 58cd01764b5e6b639025324c4fa3d1eb56e799ad..52d6a13cc7fa5870b0df1fa2e84d87ac2dd342ea 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+gzip (1.3.5-10sarge2) stable-security; urgency=high
+
+  * Non-maintainer upload by the Security Team:
+  * Fix several security problems discovered by Tavis Ormandy of Google:
+    - DoS through null pointer deference in the Huffman code (CVE-2006-4334)
+    - Out-of-bands stack write in LZH decompression code (CVE-2006-4335)
+    - Buffer overflow in pack code (CVE-2006-4336)
+    - Buffer overflow in LZH code (CVE-2006-4337)
+    - DoS through an infinite loop in LZH code (CVE-2006-4337)
+    (Patch by Thomas Biege of SuSe)
+
+ -- Moritz Muehlenhoff <jmm@debian.org>  Sun, 10 Sep 2006 21:01:47 +0000
+

 gzip (1.3.5-10sarge1) stable; urgency=low
 
   * merge patch from Matt Zimmerman for futex hang due to improper signal
 gzip (1.3.5-10sarge1) stable; urgency=low
 
   * merge patch from Matt Zimmerman for futex hang due to improper signal

diff --git a/gzip.info b/gzip.info
index 21a2d9f31ffdbbd5083728e070f3a4e4811e4d9e..ae999aec417ba89abaf708bf4e6e28c30bc7e56d 100644 (file)
--- a/gzip.info
+++ b/gzip.info
@@ -1,6 +1,13 @@
-This is gzip.info, produced by makeinfo version 4.2 from gzip.texi.
+This is gzip.info, produced by makeinfo version 4.7 from gzip.texi.

 
 

-This manual is for Gzip (version 1.3.5, 29 September 2002), and
+INFO-DIR-SECTION Utilities
+START-INFO-DIR-ENTRY
+* gzip: (gzip).        The gzip command for compressing files.
+END-INFO-DIR-ENTRY
+
+   This file documents the GNU `gzip' command for compressing files.
+
+   This manual is for Gzip (version 1.3.5, 10 September 2006), and

 documents commands for compressing and decompressing data.
 
    Copyright (C) 1998, 1999, 2001, 2002 Free Software Foundation, Inc.
 documents commands for compressing and decompressing data.
 
    Copyright (C) 1998, 1999, 2001, 2002 Free Software Foundation, Inc.


@@ -18,16 +25,6 @@ documents commands for compressing and decompressing data.
      (a) The FSF's Back-Cover Text is: "You have freedom to copy and
      modify this GNU Manual, like GNU software.  Copies published by
      the Free Software Foundation raise funds for GNU development."
      (a) The FSF's Back-Cover Text is: "You have freedom to copy and
      modify this GNU Manual, like GNU software.  Copies published by
      the Free Software Foundation raise funds for GNU development."

-   
-INFO-DIR-SECTION Individual utilities
-START-INFO-DIR-ENTRY
-* gzip: (gzip)Invoking gzip.                    Compress files.
-END-INFO-DIR-ENTRY
-
-INFO-DIR-SECTION Utilities
-START-INFO-DIR-ENTRY
-* Gzip: (gzip).                 The gzip command for compressing files.
-END-INFO-DIR-ENTRY

 
 \1f
 File: gzip.info,  Node: Top,  Up: (dir)
 
 \1f
 File: gzip.info,  Node: Top,  Up: (dir)


@@ -35,7 +32,9 @@ File: gzip.info,  Node: Top,  Up: (dir)
 Compressing Files
 *****************
 
 Compressing Files
 *****************
 

-This manual is for Gzip (version 1.3.5, 29 September 2002), and
+This file documents the GNU `gzip' command for compressing files.
+
+   This manual is for Gzip (version 1.3.5, 10 September 2006), and

 documents commands for compressing and decompressing data.
 
    Copyright (C) 1998, 1999, 2001, 2002 Free Software Foundation, Inc.
 documents commands for compressing and decompressing data.
 
    Copyright (C) 1998, 1999, 2001, 2002 Free Software Foundation, Inc.


@@ -53,7 +52,7 @@ documents commands for compressing and decompressing data.
      (a) The FSF's Back-Cover Text is: "You have freedom to copy and
      modify this GNU Manual, like GNU software.  Copies published by
      the Free Software Foundation raise funds for GNU development."
      (a) The FSF's Back-Cover Text is: "You have freedom to copy and
      modify this GNU Manual, like GNU software.  Copies published by
      the Free Software Foundation raise funds for GNU development."

-   
+

 * Menu:
 
 * Overview::           Preliminary information.
 * Menu:
 
 * Overview::           Preliminary information.


@@ -69,10 +68,10 @@ documents commands for compressing and decompressing data.
 \1f
 File: gzip.info,  Node: Overview,  Next: Sample,  Up: Top
 
 \1f
 File: gzip.info,  Node: Overview,  Next: Sample,  Up: Top
 

-Overview
-********
+1 Overview
+**********

 
 

-   `gzip' reduces the size of the named files using Lempel-Ziv coding
+`gzip' reduces the size of the named files using Lempel-Ziv coding

 (LZ77).  Whenever possible, each file is replaced by one with the
 extension `.gz', while keeping the same ownership modes, access and
 modification times.  (The default extension is `-gz' for VMS, `z' for
 (LZ77).  Whenever possible, each file is replaced by one with the
 extension `.gz', while keeping the same ownership modes, access and
 modification times.  (The default extension is `-gz' for VMS, `z' for


@@ -157,10 +156,10 @@ Format Specification version 1.3, Internet RFC 1951
 \1f
 File: gzip.info,  Node: Sample,  Next: Invoking gzip,  Prev: Overview,  Up: Top
 
 \1f
 File: gzip.info,  Node: Sample,  Next: Invoking gzip,  Prev: Overview,  Up: Top
 

-Sample Output
-*************
+2 Sample Output
+***************

 
 

-   Here are some realistic examples of running `gzip'.
+Here are some realistic examples of running `gzip'.

 
    This is the output of the command `gzip -h':
 
 
    This is the output of the command `gzip -h':
 


@@ -199,10 +198,10 @@ destroying the original:
 \1f
 File: gzip.info,  Node: Invoking gzip,  Next: Advanced usage,  Prev: Sample,  Up: Top
 
 \1f
 File: gzip.info,  Node: Invoking gzip,  Next: Advanced usage,  Prev: Sample,  Up: Top
 

-Invoking `gzip'
-***************
+3 Invoking `gzip'
+*****************

 
 

-   The format for running the `gzip' program is:
+The format for running the `gzip' program is:

 
      gzip OPTION ...
 
 
      gzip OPTION ...
 


@@ -305,6 +304,15 @@ Invoking `gzip'
      descend into the directory and compress all the files it finds
      there (or decompress them in the case of `gunzip').
 
      descend into the directory and compress all the files it finds
      there (or decompress them in the case of `gunzip').
 

+`--rsyncable'
+     While compressing, synchronize the output occasionally based on the
+     input.  This increases size by less than 1 percent most cases, but
+     means that the `rsync' program can take advantage of similarities
+     in the uncompressed input when syncronizing two files compressed
+     with this flag.  `gunzip' cannot tell the difference between a
+     compressed file created with this option, and one created without
+     it.
+

 `--suffix SUF'
 `-S SUF'
      Use suffix `SUF' instead of `.gz'. Any suffix can be given, but
 `--suffix SUF'
 `-S SUF'
      Use suffix `SUF' instead of `.gz'. Any suffix can be given, but


@@ -345,13 +353,13 @@ Invoking `gzip'
 \1f
 File: gzip.info,  Node: Advanced usage,  Next: Environment,  Prev: Invoking gzip,  Up: Top
 
 \1f
 File: gzip.info,  Node: Advanced usage,  Next: Environment,  Prev: Invoking gzip,  Up: Top
 

-Advanced usage
-**************
+4 Advanced usage
+****************

 
 

-   Multiple compressed files can be concatenated. In this case,
-`gunzip' will extract all members at once. If one member is damaged,
-other members might still be recovered after removal of the damaged
-member. Better compression can be usually obtained if all members are
+Multiple compressed files can be concatenated. In this case, `gunzip'
+will extract all members at once. If one member is damaged, other
+members might still be recovered after removal of the damaged member.
+Better compression can be usually obtained if all members are

 decompressed and then recompressed in a single step.
 
    This is an example of concatenating `gzip' files:
 decompressed and then recompressed in a single step.
 
    This is an example of concatenating `gzip' files:


@@ -397,10 +405,10 @@ replacement.
 \1f
 File: gzip.info,  Node: Environment,  Next: Tapes,  Prev: Advanced usage,  Up: Top
 
 \1f
 File: gzip.info,  Node: Environment,  Next: Tapes,  Prev: Advanced usage,  Up: Top
 

-Environment
-***********
+5 Environment
+*************

 
 

-   The environment variable `GZIP' can hold a set of default options for
+The environment variable `GZIP' can hold a set of default options for

 `gzip'.  These options are interpreted first and can be overwritten by
 explicit command line parameters.  For example:
 
 `gzip'.  These options are interpreted first and can be overwritten by
 explicit command line parameters.  For example:
 


@@ -414,17 +422,16 @@ avoid a conflict with the symbol set for invocation of the program.
 \1f
 File: gzip.info,  Node: Tapes,  Next: Problems,  Prev: Environment,  Up: Top
 
 \1f
 File: gzip.info,  Node: Tapes,  Next: Problems,  Prev: Environment,  Up: Top
 

-Using `gzip' on tapes
-*********************
+6 Using `gzip' on tapes
+***********************

 
 

-   When writing compressed data to a tape, it is generally necessary to
-pad the output with zeroes up to a block boundary. When the data is
-read and the whole block is passed to `gunzip' for decompression,
-`gunzip' detects that there is extra trailing garbage after the
-compressed data and emits a warning by default if the garbage contains
-nonzero bytes. You have to use the `--quiet' option to suppress the
-warning. This option can be set in the `GZIP' environment variable, as
-in:
+When writing compressed data to a tape, it is generally necessary to pad
+the output with zeroes up to a block boundary. When the data is read and
+the whole block is passed to `gunzip' for decompression, `gunzip'
+detects that there is extra trailing garbage after the compressed data
+and emits a warning by default if the garbage contains nonzero bytes.
+You have to use the `--quiet' option to suppress the warning. This
+option can be set in the `GZIP' environment variable, as in:

 
      for sh:    GZIP="-q"  tar -xfz --block-compress /dev/rst0
      for csh:   (setenv GZIP "-q"; tar -xfz --block-compress /dev/rst0)
 
      for sh:    GZIP="-q"  tar -xfz --block-compress /dev/rst0
      for csh:   (setenv GZIP "-q"; tar -xfz --block-compress /dev/rst0)


@@ -437,10 +444,10 @@ of `tar') is used for reading and writing compressed data on tapes.
 \1f
 File: gzip.info,  Node: Problems,  Next: Copying This Manual,  Prev: Tapes,  Up: Top
 
 \1f
 File: gzip.info,  Node: Problems,  Next: Copying This Manual,  Prev: Tapes,  Up: Top
 

-Reporting Bugs
-**************
+7 Reporting Bugs
+****************

 
 

-   If you find a bug in `gzip', please send electronic mail to
+If you find a bug in `gzip', please send electronic mail to

 <bug-gzip@gnu.org>.  Include the version number, which you can find by
 running `gzip -V'.  Also include in your message the hardware and
 operating system, the compiler used to compile `gzip', a description of
 <bug-gzip@gnu.org>.  Include the version number, which you can find by
 running `gzip -V'.  Also include in your message the hardware and
 operating system, the compiler used to compile `gzip', a description of


@@ -449,8 +456,8 @@ the bug behavior, and the input to `gzip' that triggered the bug.
 \1f
 File: gzip.info,  Node: Copying This Manual,  Next: Concept Index,  Prev: Problems,  Up: Top
 
 \1f
 File: gzip.info,  Node: Copying This Manual,  Next: Concept Index,  Prev: Problems,  Up: Top
 

-Copying This Manual
-*******************
+Appendix A Copying This Manual
+******************************

 
 * Menu:
 
 
 * Menu:
 


@@ -459,13 +466,14 @@ Copying This Manual
 \1f
 File: gzip.info,  Node: GNU Free Documentation License,  Up: Copying This Manual
 
 \1f
 File: gzip.info,  Node: GNU Free Documentation License,  Up: Copying This Manual
 

-GNU Free Documentation License
-==============================
+A.1 GNU Free Documentation License
+==================================

 
                         Version 1.1, March 2000
 
                         Version 1.1, March 2000

+

      Copyright (C) 2000 Free Software Foundation, Inc.
      59 Temple Place, Suite 330, Boston, MA  02111-1307, USA
      Copyright (C) 2000 Free Software Foundation, Inc.
      59 Temple Place, Suite 330, Boston, MA  02111-1307, USA

-     
+

      Everyone is permitted to copy and distribute verbatim copies
      of this license document, but changing it is not allowed.
 
      Everyone is permitted to copy and distribute verbatim copies
      of this license document, but changing it is not allowed.
 


@@ -815,10 +823,10 @@ GNU Free Documentation License
      you may choose any version ever published (not as a draft) by the
      Free Software Foundation.
 
      you may choose any version ever published (not as a draft) by the
      Free Software Foundation.
 

-ADDENDUM: How to use this License for your documents
-----------------------------------------------------
+A.1.1 ADDENDUM: How to use this License for your documents
+----------------------------------------------------------

 
 

-   To use this License in a document you have written, include a copy of
+To use this License in a document you have written, include a copy of

 the License in the document and put the following copyright and license
 notices just after the title page:
 
 the License in the document and put the following copyright and license
 notices just after the title page:
 


@@ -844,34 +852,36 @@ permit their use in free software.
 \1f
 File: gzip.info,  Node: Concept Index,  Prev: Copying This Manual,  Up: Top
 
 \1f
 File: gzip.info,  Node: Concept Index,  Prev: Copying This Manual,  Up: Top
 

-Concept Index
-*************
+Appendix B Concept Index
+************************

 
 

+\0\b[index\0\b]

 * Menu:
 
 * Menu:
 

-* bugs:                                  Problems.
-* concatenated files:                    Advanced usage.
-* Environment:                           Environment.
+* bugs:                                  Problems.              (line 6)
+* concatenated files:                    Advanced usage.        (line 6)
+* Environment:                           Environment.           (line 6)

 * FDL, GNU Free Documentation License:   GNU Free Documentation License.
 * FDL, GNU Free Documentation License:   GNU Free Documentation License.

-* invoking:                              Invoking gzip.
-* options:                               Invoking gzip.
-* overview:                              Overview.
-* sample:                                Sample.
-* tapes:                                 Tapes.
+                                                                (line 6)
+* invoking:                              Invoking gzip.         (line 6)
+* options:                               Invoking gzip.         (line 6)
+* overview:                              Overview.              (line 6)
+* sample:                                Sample.                (line 6)
+* tapes:                                 Tapes.                 (line 6)

 
 
 \1f
 Tag Table:
 
 
 \1f
 Tag Table:

-Node: Top\7f1258
-Node: Overview\7f2630
-Node: Sample\7f7390
-Node: Invoking gzip\7f9051
-Node: Advanced usage\7f14032
-Node: Environment\7f15621
-Node: Tapes\7f16189
-Node: Problems\7f17203
-Node: Copying This Manual\7f17661
-Node: GNU Free Documentation License\7f17877
-Node: Concept Index\7f37741
+Node: Top\7f1170
+Node: Overview\7f2609
+Node: Sample\7f7370
+Node: Invoking gzip\7f9032
+Node: Advanced usage\7f14463
+Node: Environment\7f16053
+Node: Tapes\7f16622
+Node: Problems\7f17637
+Node: Copying This Manual\7f18096
+Node: GNU Free Documentation License\7f18334
+Node: Concept Index\7f38211

 \1f
 End Tag Table
 \1f
 End Tag Table

diff --git a/inflate.c b/inflate.c
index 429716cef4e356f3bb33b4ecd594b7f5de8afa9d..cfb0d57b5eb883ddf37d248d7779e011382f2a61 100644 (file)
--- a/inflate.c
+++ b/inflate.c
@@ -337,7 +337,7 @@ int *m;                 /* maximum lookup bits, returns actual */
   {
     *t = (struct huft *)NULL;
     *m = 0;
   {
     *t = (struct huft *)NULL;
     *m = 0;

-    return 0;
+    return 2;

   }
 
 
   }
 
 

diff --git a/stamp-vti b/stamp-vti
index 6996ff75214b52e1a93e522c7fe7320868992f7a..8f612b65d0a3bcb0e6b3f412ab7f451bc921472d 100644 (file)
--- a/stamp-vti
+++ b/stamp-vti
@@ -1,4 +1,4 @@
-@set UPDATED 29 September 2002
-@set UPDATED-MONTH September 2002
+@set UPDATED 10 September 2006
+@set UPDATED-MONTH September 2006

 @set EDITION 1.3.5
 @set VERSION 1.3.5
 @set EDITION 1.3.5
 @set VERSION 1.3.5

diff --git a/unlzh.c b/unlzh.c
index b1c6ac675a318948b5a5bf82da7dd50c10a083cc..7a88fee6294c3fde0b00bbef1c8fe7531481df2f 100644 (file)
--- a/unlzh.c
+++ b/unlzh.c
@@ -69,11 +69,7 @@ local void make_table OF((int nchar, uch bitlen[],
 #define NT (CODE_BIT + 3)
 #define PBIT 4  /* smallest integer such that (1U << PBIT) > NP */
 #define TBIT 5  /* smallest integer such that (1U << TBIT) > NT */
 #define NT (CODE_BIT + 3)
 #define PBIT 4  /* smallest integer such that (1U << PBIT) > NP */
 #define TBIT 5  /* smallest integer such that (1U << TBIT) > NT */

-#if NT > NP
-# define NPT NT
-#else
-# define NPT NP
-#endif
+#define NPT (1<<TBIT)

 
 /* local ush left[2 * NC - 1]; */
 /* local ush right[2 * NC - 1]; */
 
 /* local ush left[2 * NC - 1]; */
 /* local ush right[2 * NC - 1]; */


@@ -179,6 +175,8 @@ local void make_table(nchar, bitlen, tablebits, table)
        if ((len = bitlen[ch]) == 0) continue;
        nextcode = start[len] + weight[len];
        if (len <= (unsigned)tablebits) {
        if ((len = bitlen[ch]) == 0) continue;
        nextcode = start[len] + weight[len];
        if (len <= (unsigned)tablebits) {

+           if (nextcode > 1 << tablebits)
+               error("Bad table\n");

            for (i = start[len]; i < nextcode; i++) table[i] = ch;
        } else {
            k = start[len];
            for (i = start[len]; i < nextcode; i++) table[i] = ch;
        } else {
            k = start[len];


@@ -223,6 +221,8 @@ local void read_pt_len(nn, nbit, i_special)
            if (c == 7) {
                mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
                while (mask & bitbuf) {  mask >>= 1;  c++;  }
            if (c == 7) {
                mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
                while (mask & bitbuf) {  mask >>= 1;  c++;  }

+               if (c > 16)
+                   error("Bad table\n");

            }
            fillbuf((c < 7) ? 3 : c - 3);
            pt_len[i++] = c;
            }
            fillbuf((c < 7) ? 3 : c - 3);
            pt_len[i++] = c;

diff --git a/unpack.c b/unpack.c
index 00dae749f62a6a12a929bc7c05f8cfa3dced3ef6..b1f3ef3836ce72eae0a2ada17a3302990080d8e9 100644 (file)
--- a/unpack.c
+++ b/unpack.c
@@ -97,6 +97,7 @@ local void read_tree()
     int len;  /* bit length */
     int base; /* base offset for a sequence of leaves */
     int n;
     int len;  /* bit length */
     int base; /* base offset for a sequence of leaves */
     int n;

+    int max_leaves;

 
     /* Read the original input size, MSB first */
     orig_len = 0;
 
     /* Read the original input size, MSB first */
     orig_len = 0;


@@ -109,11 +110,15 @@ local void read_tree()
 
     /* Get the number of leaves at each bit length */
     n = 0;
 
     /* Get the number of leaves at each bit length */
     n = 0;

+    max_leaves = 1;

     for (len = 1; len <= max_len; len++) {
        leaves[len] = (int)get_byte();
     for (len = 1; len <= max_len; len++) {
        leaves[len] = (int)get_byte();

+       if (leaves[len] > max_leaves - (len == max_len))
+           error("too many leaves in Huffman tree");
+       max_leaves = (max_leaves - leaves[len] + 1) * 2 - 1;

        n += leaves[len];
     }
        n += leaves[len];
     }

-    if (n > LITERALS) {
+    if (n >= LITERALS) {

        error("too many leaves in Huffman tree");
     }
     Trace((stderr, "orig_len %lu, max_len %d, leaves %d\n",
        error("too many leaves in Huffman tree");
     }
     Trace((stderr, "orig_len %lu, max_len %d, leaves %d\n",

diff --git a/version.texi b/version.texi
index 6996ff75214b52e1a93e522c7fe7320868992f7a..8f612b65d0a3bcb0e6b3f412ab7f451bc921472d 100644 (file)
--- a/version.texi
+++ b/version.texi
@@ -1,4 +1,4 @@
-@set UPDATED 29 September 2002
-@set UPDATED-MONTH September 2002
+@set UPDATED 10 September 2006
+@set UPDATED-MONTH September 2006

 @set EDITION 1.3.5
 @set VERSION 1.3.5
 @set EDITION 1.3.5
 @set VERSION 1.3.5