Version in base suite: 6.2.6-1 Base version: unrar-nonfree_6.2.6-1 Target version: unrar-nonfree_6.2.6-1+deb12u1 Base file: /srv/ftp-master.debian.org/ftp/pool/non-free/u/unrar-nonfree/unrar-nonfree_6.2.6-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/non-free/u/unrar-nonfree/unrar-nonfree_6.2.6-1+deb12u1.dsc changelog | 6 ++ patches/0015-CVE-2023-40477.patch | 106 ++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 113 insertions(+) diff -Nru unrar-nonfree-6.2.6/debian/changelog unrar-nonfree-6.2.6/debian/changelog --- unrar-nonfree-6.2.6/debian/changelog 2023-02-23 03:31:56.000000000 +0000 +++ unrar-nonfree-6.2.6/debian/changelog 2023-08-26 07:27:26.000000000 +0000 @@ -1,3 +1,9 @@ +unrar-nonfree (1:6.2.6-1+deb12u1) bookworm; urgency=medium + + * Fix CVE-2023-40477 + + -- YOKOTA Hiroshi Sat, 26 Aug 2023 16:27:26 +0900 + unrar-nonfree (1:6.2.6-1) unstable; urgency=medium * New upstream version 6.2.6 diff -Nru unrar-nonfree-6.2.6/debian/patches/0015-CVE-2023-40477.patch unrar-nonfree-6.2.6/debian/patches/0015-CVE-2023-40477.patch --- unrar-nonfree-6.2.6/debian/patches/0015-CVE-2023-40477.patch 1970-01-01 00:00:00.000000000 +0000 +++ unrar-nonfree-6.2.6/debian/patches/0015-CVE-2023-40477.patch 2023-08-26 07:27:26.000000000 +0000 @@ -0,0 +1,106 @@ +From: YOKOTA Hiroshi +Date: Fri, 21 Jul 2023 00:33:42 +0900 +Subject: CVE-2023-40477 + +--- + getbits.cpp | 8 ++++---- + pathfn.cpp | 2 +- + recvol3.cpp | 11 +++++++++-- + secpassword.cpp | 8 ++++---- + 4 files changed, 18 insertions(+), 11 deletions(-) + +diff --git a/getbits.cpp b/getbits.cpp +index 8805f27..5d5ad2b 100644 +--- a/getbits.cpp ++++ b/getbits.cpp +@@ -5,11 +5,11 @@ BitInput::BitInput(bool AllocBuffer) + ExternalBuffer=false; + if (AllocBuffer) + { +- // getbits*() attempt to read data from InAddr, ... InAddr+3 positions. +- // So let's allocate 3 additional bytes for situation, when we need to ++ // getbits*() attempt to read data from InAddr, ... InAddr+4 positions. ++ // So let's allocate 4 additional bytes for situation, when we need to + // read only 1 byte from the last position of buffer and avoid a crash +- // from access to next 3 bytes, which contents we do not need. +- size_t BufSize=MAX_SIZE+3; ++ // from access to next 4 bytes, which contents we do not need. ++ size_t BufSize=MAX_SIZE+4; + InBuf=new byte[BufSize]; + + // Ensure that we get predictable results when accessing bytes in area +diff --git a/pathfn.cpp b/pathfn.cpp +index 49d16a8..7a54354 100644 +--- a/pathfn.cpp ++++ b/pathfn.cpp +@@ -746,7 +746,7 @@ static void GenArcName(wchar *ArcName,size_t MaxSize,const wchar *GenerateMask,u + // Here we ensure that we have enough 'N' characters to fit all digits + // of archive number. We'll replace them by actual number later + // in this function. +- if (NCount255) ++ if (P[0]<=0 || P[1]<=0 || P[2]<=0 || P[1]+P[2]>255 || P[0]+P[2]-1>255) + continue; + if (RecVolNumber!=0 && RecVolNumber!=P[1] || FileNumber!=0 && FileNumber!=P[2]) + { +@@ -238,7 +238,14 @@ bool RecVolumes3::Restore(CommandData *Cmd,const wchar *Name,bool Silent) + wcsncpyz(PrevName,CurName,ASIZE(PrevName)); + File *NewFile=new File; + NewFile->TOpen(CurName); +- SrcFile[FileNumber+P[0]-1]=NewFile; ++ ++ // This check is redundant taking into account P[I]>255 and P[0]+P[2]-1>255 ++ // checks above. Still we keep it here for better clarity and security. ++ int SrcPos=FileNumber+P[0]-1; ++ if (SrcPos<0 || SrcPos>=ASIZE(SrcFile)) ++ continue; ++ SrcFile[SrcPos]=NewFile; ++ + FoundRecVolumes++; + + if (RecFileSize==0) +diff --git a/secpassword.cpp b/secpassword.cpp +index 42ed47d..08da549 100644 +--- a/secpassword.cpp ++++ b/secpassword.cpp +@@ -70,7 +70,7 @@ void SecPassword::Clean() + { + PasswordSet=false; + if (Password.size()>0) +- cleandata(&Password[0],Password.size()); ++ cleandata(&Password[0],Password.size()*sizeof(Password[0])); + } + + +@@ -141,7 +141,7 @@ size_t SecPassword::Length() + wchar Plain[MAXPASSWORD]; + Get(Plain,ASIZE(Plain)); + size_t Length=wcslen(Plain); +- cleandata(Plain,ASIZE(Plain)); ++ cleandata(Plain,sizeof(Plain)); + return Length; + } + +@@ -156,8 +156,8 @@ bool SecPassword::operator == (SecPassword &psw) + Get(Plain1,ASIZE(Plain1)); + psw.Get(Plain2,ASIZE(Plain2)); + bool Result=wcscmp(Plain1,Plain2)==0; +- cleandata(Plain1,ASIZE(Plain1)); +- cleandata(Plain2,ASIZE(Plain2)); ++ cleandata(Plain1,sizeof(Plain1)); ++ cleandata(Plain2,sizeof(Plain2)); + return Result; + } + diff -Nru unrar-nonfree-6.2.6/debian/patches/series unrar-nonfree-6.2.6/debian/patches/series --- unrar-nonfree-6.2.6/debian/patches/series 2023-02-23 03:31:56.000000000 +0000 +++ unrar-nonfree-6.2.6/debian/patches/series 2023-08-26 07:27:26.000000000 +0000 @@ -12,3 +12,4 @@ 0012-Add-PHONY-target.patch 0013-Add-newline-after-error-message-Closes-774166.patch 0014-Compiler-warning-fix.patch +0015-CVE-2023-40477.patch