[pkgsrc/trunk]: pkgsrc/archivers/lz4 Fix potential memory corruption with neg...

[kim <kim%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/2bbaa38cf0e6
branches:  trunk
changeset: 456722:2bbaa38cf0e6
user:      kim <kim%pkgsrc.org@localhost>
date:      Fri Aug 06 05:08:50 2021 +0000

description:
Fix potential memory corruption with negative memmove() size

Addresses CVE-2021-3520

Ref: https://github.com/lz4/lz4/pull/972

diffstat:

 archivers/lz4/Makefile                |   3 ++-
 archivers/lz4/distinfo                |   3 ++-
 archivers/lz4/patches/patch-lib_lz4.c |  20 ++++++++++++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diffs (51 lines):

diff -r 967f1fe8352e -r 2bbaa38cf0e6 archivers/lz4/Makefile
--- a/archivers/lz4/Makefile    Fri Aug 06 04:05:25 2021 +0000
+++ b/archivers/lz4/Makefile    Fri Aug 06 05:08:50 2021 +0000
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.22 2021/06/03 06:55:00 nia Exp $
+# $NetBSD: Makefile,v 1.23 2021/08/06 05:08:50 kim Exp $
 
 DISTNAME=      lz4-1.9.3
+PKGREVISION=   1
 CATEGORIES=    archivers
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=lz4/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}
diff -r 967f1fe8352e -r 2bbaa38cf0e6 archivers/lz4/distinfo
--- a/archivers/lz4/distinfo    Fri Aug 06 04:05:25 2021 +0000
+++ b/archivers/lz4/distinfo    Fri Aug 06 05:08:50 2021 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.19 2020/11/19 10:36:57 adam Exp $
+$NetBSD: distinfo,v 1.20 2021/08/06 05:08:50 kim Exp $
 
 SHA1 (lz4-1.9.3.tar.gz) = 5a19554ef404a609123b756ddcbbb677df838f05
 RMD160 (lz4-1.9.3.tar.gz) = b933c4794c0b9634e453dba5875bf1b1b0b79e70
@@ -6,4 +6,5 @@
 Size (lz4-1.9.3.tar.gz) = 320958 bytes
 SHA1 (patch-Makefile.inc) = 55d576430ed1a160709a56e104edc14cad88e5a9
 SHA1 (patch-lib_Makefile) = 8eda2146522bd2d5e418916fd99fb201810cb36d
+SHA1 (patch-lib_lz4.c) = 3bf75be43d585a613e56a21c1e7bdfff541371f4
 SHA1 (patch-programs_Makefile) = 671728182325f03164eb898d9d846fd2aa4353f7
diff -r 967f1fe8352e -r 2bbaa38cf0e6 archivers/lz4/patches/patch-lib_lz4.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/archivers/lz4/patches/patch-lib_lz4.c     Fri Aug 06 05:08:50 2021 +0000
@@ -0,0 +1,20 @@
+$NetBSD: patch-lib_lz4.c,v 1.1 2021/08/06 05:08:50 kim Exp $
+
+Fix potential memory corruption with negative memmove() size
+Ref: https://github.com/lz4/lz4/pull/972
+
+Addresses CVE-2021-3520
+
+https://github.com/lz4/lz4/commit/7a966c1511816b53ac93aa2f2a2ff97e036a4a60.patch
+
+--- lib/lz4.c
++++ lib/lz4.c
+@@ -1749,7 +1749,7 @@ LZ4_decompress_generic(
+                  const size_t dictSize         /* note : = 0 if noDict */
+                  )
+ {
+-    if (src == NULL) { return -1; }
++    if ((src == NULL) || (outputSize < 0)) { return -1; }
+ 
+     {   const BYTE* ip = (const BYTE*) src;
+         const BYTE* const iend = ip + srcSize;