Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remedy CVE-2018-12913 #329

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Conversation

iibclothier
Copy link

This was originally reported in #90 which was closed without any remediation.

This can be reproduced by downloading the POC from here:
https://github.com/Edward-L/my-cve-list/blob/master/miniz/dos-an-infinite-loop-miniz_tinfl-c-398.poc

Uncomment the assert in the miniz_tinfl.c line 494, build the project.

And then run the example3.exe as shown with debugger:

example3.exe d, "C:\Temp\dos-an-infinite-loop-miniz_tinfl-c-398.poc" "C:\Temp\Bad.txt"

Because the POC file used as the input is not a valid zip file, we should not be attempting to extract it. However, as a guard against other zip files that may be maliciously crafted, we've added the condition and throw an error if both sym2 and counter are zero.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant