CVE-2020-27350: debfile: integer overflow: Limit control size to 64 MiB

Like the code in arfile.cc, MemControlExtract also has buffer
overflows, in code allocating memory for parsing control files.

Specify an upper limit of 64 MiB for control files to both protect
against the Size overflowing (we allocate Size + 2 bytes), and
protect a bit against control files consisting only of zeroes.

2 files changed, 7 insertions, 0 deletions

diff --git a/test/integration/test-cve-2020-27350 b/test/integration/test-cve-2020-27350
index 336dc5b7e..f4bb79bcb 100755
--- a/test/integration/test-cve-2020-27350
+++ b/test/integration/test-cve-2020-27350
@@ -17,3 +17,6 @@ testequal "E: Long name to large: 67108865 bytes > 1048576 bytes" runapt ${APTTE
 
 ${APTTESTHELPERSBINDIR}/createdeb-cve-2020-27350 long-link long-link.deb
 testequal "E: Long name to large: 67108865 bytes > 1048576 bytes" runapt ${APTTESTHELPERSBINDIR}/extract-control long-link.deb control
+
+${APTTESTHELPERSBINDIR}/createdeb-cve-2020-27350 long-control long-control.deb
+testequal "E: Control file too large: 67108865 > 67108864 bytes" runapt ${APTTESTHELPERSBINDIR}/extract-control long-control.deb control
diff --git a/test/interactive-helper/createdeb-cve-2020-27350.cc b/test/interactive-helper/createdeb-cve-2020-27350.cc
index 7c58eb9df..af049d4e8 100644
--- a/test/interactive-helper/createdeb-cve-2020-27350.cc
+++ b/test/interactive-helper/createdeb-cve-2020-27350.cc
@@ -303,6 +303,10 @@ int main(int argc, char *argv[])
    {
       createdeb_bigtarfilelength(fd, 'K');
    }
+   else if (strcmp(mode, "long-control") == 0)
+   {
+      createdeb_bigtarfilelength(fd, '0');
+   }
    else if (strcmp(mode, "test") == 0)
    {
       createdeb_test(fd);