Subject: bug#78639: Uninitialised read in check_zipfile() (gzip 1.14)

From: Paul Eggert <[email-masked]>
Date: Fri, 30 May 2025 12:28:12 -0700

Thanks, I installed the attached additional patch.

From b1de0e782a291c46e26777005893eeca142e0490 Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Fri, 30 May 2025 12:23:42 -0700
Subject: [PATCH] gzip: fix another uninitialized read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This can occur if you define DYNALLOC.
Problem reported by Mohamed Maatallah <https://bugs.gnu.org/78639#13>.
* gzip.c (get_method): Don’t memcmp more bytes than were read.
Also, no need to do two memcmp’s now, or to check inptr.
---
 gzip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gzip.c b/gzip.c
index 913fafe..0231ffa 100644
--- a/gzip.c
+++ b/gzip.c
@@ -1609,7 +1609,7 @@ get_method (int in)
             header_bytes = inptr + 2*4; /* include crc and size */
         }
 
-    } else if (memcmp(magic, PKZIP_MAGIC, 2) == 0 && inptr == 2
+    } else if (4 <= insize
             && memcmp((char*)inbuf, PKZIP_MAGIC, 4) == 0) {
         /* To simplify the code, we support a zip file when alone only.
          * We are thus guaranteed that the entire local header fits in inbuf.
-- 
2.48.1