diff --git a/cve_bin_tool/checkers/__init__.py b/cve_bin_tool/checkers/__init__.py index 562c0744f3..1e918f4cb3 100644 --- a/cve_bin_tool/checkers/__init__.py +++ b/cve_bin_tool/checkers/__init__.py @@ -348,6 +348,7 @@ "zlib", "znc", "zsh", + "zstandard", ] VendorProductPair = collections.namedtuple("VendorProductPair", ["vendor", "product"]) diff --git a/cve_bin_tool/checkers/zstandard.py b/cve_bin_tool/checkers/zstandard.py new file mode 100644 index 0000000000..f392a793a4 --- /dev/null +++ b/cve_bin_tool/checkers/zstandard.py @@ -0,0 +1,22 @@ +# Copyright (C) 2023 Orange +# SPDX-License-Identifier: GPL-3.0-or-later + + +""" +CVE checker for zstandard: + +https://www.cvedetails.com/product/57378/Facebook-Zstandard.html?vendor_id=7758 + +""" + +from cve_bin_tool.checkers import Checker + + +class ZstandardChecker(Checker): + CONTAINS_PATTERNS: list[str] = [] + FILENAME_PATTERNS: list[str] = [] + VERSION_PATTERNS = [ + r"Frame requires too much memory for decoding[a-zA-Z :(#$'/\r\n]*([0-9]+\.[0-9]+\.[0-9]+)", + r"([0-9]+\.[0-9]+\.[0-9]+)[a-zA-Z0-9 -|<>/._=%:(#$'/\[\]\r\n]*Frame requires too much memory for decoding", + ] + VENDOR_PRODUCT = [("facebook", "zstandard")] diff --git a/test/condensed-downloads/libzstd-1.5.2-3.fc37.aarch64.rpm.tar.gz b/test/condensed-downloads/libzstd-1.5.2-3.fc37.aarch64.rpm.tar.gz new file mode 100644 index 0000000000..04228c1963 Binary files /dev/null and b/test/condensed-downloads/libzstd-1.5.2-3.fc37.aarch64.rpm.tar.gz differ diff --git a/test/condensed-downloads/libzstd1_1.3.8+dfsg-3+deb10u2_amd64.deb.tar.gz b/test/condensed-downloads/libzstd1_1.3.8+dfsg-3+deb10u2_amd64.deb.tar.gz new file mode 100644 index 0000000000..8b1ec5e72e Binary files /dev/null and b/test/condensed-downloads/libzstd1_1.3.8+dfsg-3+deb10u2_amd64.deb.tar.gz differ diff --git a/test/condensed-downloads/libzstd_1.4.5-2_x86_64.ipk.tar.gz b/test/condensed-downloads/libzstd_1.4.5-2_x86_64.ipk.tar.gz new file mode 100644 index 0000000000..b4c40f8a50 Binary files /dev/null and b/test/condensed-downloads/libzstd_1.4.5-2_x86_64.ipk.tar.gz differ diff --git a/test/test_data/zstandard.py b/test/test_data/zstandard.py new file mode 100644 index 0000000000..8e72e42570 --- /dev/null +++ b/test/test_data/zstandard.py @@ -0,0 +1,30 @@ +# Copyright (C) 2023 Orange +# SPDX-License-Identifier: GPL-3.0-or-later + +mapping_test_data = [ + { + "product": "zstandard", + "version": "1.4.0", + "version_strings": ["Frame requires too much memory for decoding/n1.4.0"], + } +] +package_test_data = [ + { + "url": "http://rpmfind.net/linux/fedora/linux/development/rawhide/Everything/aarch64/os/Packages/l/", + "package_name": "libzstd-1.5.2-3.fc37.aarch64.rpm", + "product": "zstandard", + "version": "1.5.2", + }, + { + "url": "http://ftp.fr.debian.org/debian/pool/main/libz/libzstd/", + "package_name": "libzstd1_1.3.8+dfsg-3+deb10u2_amd64.deb", + "product": "zstandard", + "version": "1.3.8", + }, + { + "url": "https://downloads.openwrt.org/releases/packages-19.07/x86_64/packages/", + "package_name": "libzstd_1.4.5-2_x86_64.ipk", + "product": "zstandard", + "version": "1.4.5", + }, +]