Add test for CVE-2004-0797

CVE-2004-0797[0] occured when an error was detected but no action
was taken --- that is, execution was allowed to continue.

One of the tests for CVE-2005-2096 actually hit the code path that
was fixed in the patch for CVE-2004-0797.

This occured because all the fuzzing was done on zlib 1.2.1, and
zlib 1.2.2 fixed this bug but not the 2005 CVEs. It was detected by
running the test cases against zlib 1.2.2.

The relevant bits of the zlib 1.2.2 patch are [1] and [2].

[0] http://www.kb.cert.org/vuls/id/238678
[1] 7a6955760b (diff-154f1240658ec1e9f5c90024002d749aR437)
[2] 7a6955760b (diff-327188edf18799ffbb5a51cc69f797e8R864)

Signed-off-by: Daniel Axtens <dja@axtens.net>
This commit is contained in:
Daniel Axtens 2015-04-29 16:20:37 +10:00 committed by Hans Kristian Rosbach
parent f246b9310d
commit a54d505bda
4 changed files with 3 additions and 2 deletions

View File

@ -1,7 +1,8 @@
Makefile.in: template for Unix Makefile
CVE-2003-0107.c:
CVE-2002-0059 :
CVE-2002-0059 :
CVE-2004-0797 :
CVE-2005-1849 :
CVE-2005-2096 : test cases for the relevant CVEs

View File

@ -1,7 +1,7 @@
#!/bin/bash
TESTDIR="$(dirname "$0")"
CVEs="CVE-2002-0059 CVE-2005-1849 CVE-2005-2096"
CVEs="CVE-2002-0059 CVE-2004-0797 CVE-2005-1849 CVE-2005-2096"
for CVE in $CVEs; do
fail=0