termux-packages/packages/p7zip/3-CVE-2018-5996.patch

diff -Nur p7zip/CPP/7zip/Compress/Rar1Decoder.cpp CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.cpp
--- p7zip/CPP/7zip/Compress/Rar1Decoder.cpp	2015-09-02 02:04:52.000000000 +0800
+++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.cpp	2019-03-06 22:04:37.659374132 +0800
@@ -29,7 +29,7 @@
 };
 */
 
-CDecoder::CDecoder(): m_IsSolid(false) { }
+CDecoder::CDecoder(): m_IsSolid(false), _errorMode(false) { }
 
 void CDecoder::InitStructures()
 {
@@ -406,9 +406,14 @@
   InitData();
   if (!m_IsSolid)
   {
+    _errorMode = false;
     InitStructures();
     InitHuff();
   }
+
+  if (_errorMode)
+    return S_FALSE;
+
   if (m_UnpackSize > 0)
   {
     GetFlagsBuf();
@@ -477,9 +482,9 @@
     const UInt64 *inSize, const UInt64 *outSize, ICompressProgressInfo *progress)
 {
   try { return CodeReal(inStream, outStream, inSize, outSize, progress); }
-  catch(const CInBufferException &e) { return e.ErrorCode; }
-  catch(const CLzOutWindowException &e) { return e.ErrorCode; }
-  catch(...) { return S_FALSE; }
+  catch(const CInBufferException &e) { _errorMode = true; return e.ErrorCode; }
+  catch(const CLzOutWindowException &e) { _errorMode = true; return e.ErrorCode; }
+  catch(...) { _errorMode = true; return S_FALSE; }
 }
 
 STDMETHODIMP CDecoder::SetDecoderProperties2(const Byte *data, UInt32 size)
diff -Nur p7zip/CPP/7zip/Compress/Rar1Decoder.h CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.h
--- p7zip/CPP/7zip/Compress/Rar1Decoder.h	2014-12-21 20:44:00.000000000 +0800
+++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.h	2019-03-06 22:04:37.659374132 +0800
@@ -39,6 +39,7 @@
 
   Int64 m_UnpackSize;
   bool m_IsSolid;
+  bool _errorMode;
 
   UInt32 ReadBits(int numBits);
   HRESULT CopyBlock(UInt32 distance, UInt32 len);
diff -Nur p7zip/CPP/7zip/Compress/Rar2Decoder.cpp CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.cpp
--- p7zip/CPP/7zip/Compress/Rar2Decoder.cpp	2015-10-03 16:49:14.000000000 +0800
+++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.cpp	2019-03-06 22:04:37.659374132 +0800
@@ -80,7 +80,8 @@
 static const UInt32 kWindowReservSize = (1 << 22) + 256;
 
 CDecoder::CDecoder():
-  m_IsSolid(false)
+  m_IsSolid(false),
+  m_TablesOK(false)
 {
 }
 
@@ -100,6 +101,8 @@
 
 bool CDecoder::ReadTables(void)
 {
+  m_TablesOK = false;
+
   Byte levelLevels[kLevelTableSize];
   Byte newLevels[kMaxTableSize];
   m_AudioMode = (ReadBits(1) == 1);
@@ -170,6 +173,8 @@
   }
   
   memcpy(m_LastLevels, newLevels, kMaxTableSize);
+  m_TablesOK = true;
+
   return true;
 }
 
@@ -344,6 +349,9 @@
       return S_FALSE;
   }
 
+  if (!m_TablesOK)
+    return S_FALSE;
+
   UInt64 startPos = m_OutWindowStream.GetProcessedSize();
   while (pos < unPackSize)
   {
diff -Nur p7zip/CPP/7zip/Compress/Rar2Decoder.h CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.h
--- p7zip/CPP/7zip/Compress/Rar2Decoder.h	2015-06-19 18:52:06.000000000 +0800
+++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.h	2019-03-06 22:04:37.659374132 +0800
@@ -139,6 +139,7 @@
 
   UInt64 m_PackSize;
   bool m_IsSolid;
+  bool m_TablesOK;
 
   void InitStructures();
   UInt32 ReadBits(unsigned numBits);
diff -Nur p7zip/CPP/7zip/Compress/Rar3Decoder.cpp CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.cpp
--- p7zip/CPP/7zip/Compress/Rar3Decoder.cpp	2016-05-20 16:20:03.000000000 +0800
+++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.cpp	2019-03-06 22:04:37.659374132 +0800
@@ -92,7 +92,8 @@
   _writtenFileSize(0),
   _vmData(0),
   _vmCode(0),
-  m_IsSolid(false)
+  m_IsSolid(false),
+  _errorMode(false)
 {
   Ppmd7_Construct(&_ppmd);
 }
@@ -545,6 +546,9 @@
     return InitPPM();
   }
 
+  TablesRead = false;
+  TablesOK = false;
+
   _lzMode = true;
   PrevAlignBits = 0;
   PrevAlignCount = 0;
@@ -606,6 +610,9 @@
       }
     }
   }
+  if (InputEofError())
+    return S_FALSE;
+
   TablesRead = true;
 
   // original code has check here:
@@ -623,6 +630,9 @@
   RIF(m_LenDecoder.Build(&newLevels[kMainTableSize + kDistTableSize + kAlignTableSize]));
 
   memcpy(m_LastLevels, newLevels, kTablesSizesSum);
+
+  TablesOK = true;
+
   return S_OK;
 }
 
@@ -824,7 +834,12 @@
     PpmEscChar = 2;
     PpmError = true;
     InitFilters();
+    _errorMode = false;
   }
+
+  if (_errorMode)
+    return S_FALSE;
+
   if (!m_IsSolid || !TablesRead)
   {
     bool keepDecompressing;
@@ -838,6 +853,8 @@
     bool keepDecompressing;
     if (_lzMode)
     {
+      if (!TablesOK)
+        return S_FALSE;
       RINOK(DecodeLZ(keepDecompressing))
     }
     else
@@ -901,8 +918,8 @@
     _unpackSize = outSize ? *outSize : (UInt64)(Int64)-1;
     return CodeReal(progress);
   }
-  catch(const CInBufferException &e)  { return e.ErrorCode; }
-  catch(...) { return S_FALSE; }
+  catch(const CInBufferException &e)  { _errorMode = true; return e.ErrorCode; }
+  catch(...) { _errorMode = true; return S_FALSE; }
   // CNewException is possible here. But probably CNewException is caused
   // by error in data stream.
 }
diff -Nur p7zip/CPP/7zip/Compress/Rar3Decoder.h CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.h
--- p7zip/CPP/7zip/Compress/Rar3Decoder.h	2015-10-03 16:49:12.000000000 +0800
+++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.h	2019-03-06 22:04:37.659374132 +0800
@@ -192,6 +192,7 @@
   UInt32 _lastFilter;
 
   bool m_IsSolid;
+  bool _errorMode;
 
   bool _lzMode;
   bool _unsupportedFilter;
@@ -200,6 +201,7 @@
   UInt32 PrevAlignCount;
 
   bool TablesRead;
+  bool TablesOK;
 
   CPpmd7 _ppmd;
   int PpmEscChar;