Package: unzip
Version: 3.0-11+b1
Dear Maintainer,
I would like to report a security bug to zipnote binary of zip package
(zipinfo).
A segfault during the write operation with zipnote version 3.0
How to reproduce the bug :
1 - zipnote crash00.zip > note
2 - zipnote -w crash00.zip < note
The execution trace show a memcpy with the wrong size :
######################################
free(0x559aff234480)
= <void>
free(0x559aff2343a0)
= <void>
fclose(0x559aff234150)
= 0
ftello64(0x559aff233280, 1, 0, 0x559aff233010)
= 124
malloc(1)
= 0x559aff234480
memcpy(0x559aff234480, "", 0)
= 0x559aff234480
memcpy(0x559aff234480,
"mples/UT\005\0\177\0\0\0\0\0\0\0\0\0\0\301\0\0\0\0\0\0\0\036\003\n"...,
18446744073709551605 <no return ...>
--- SIGSEGV (Segmentation fault) ---
######################################
I stay available if you need more informations.
Best regards.
The version of zipnote :
'''''''''''''''''''''''''''''''''''''
$ zipnote -v
Copyright (c) 1990-2008 Info-ZIP - Type 'zipnote "-L"' for software license.
This is ZipNote 3.0 (July 5th 2008), by Info-ZIP.
Currently maintained by E. Gordon. Please send bug reports to
the authors using the web page at www.info-zip.org; see README for details.
Latest sources and executables are at ftp://ftp.info-zip.org/pub/infozip,
as of above date; see http://www.info-zip.org/ for other sites.
Compiled with gcc 6.3.0 20170221 for Unix (Linux ELF).
ZipNote special compilation options:
[none]
The version of debian :
'''''''''''''''''''''''''''''''''''''
Linux 4.19.0-5-cloud-amd64 #1 SMP Debian 4.19.37-5+deb10u2 (2019-08-08) x86_64
GNU/Linux
The file :
'''''''''''''''''''''''''''''''''''''
$ hexdump -C crash00.zip
00000000 50 4b 03 04 0a 00 00 00 0a 00 3c 69 25 50 00 00 |PK........<i%P..|
00000010 00 00 00 00 00 1c 00 94 00 00 09 00 02 00 2d 00 |..............-.|
00000020 32 6d 70 6c 65 73 2f 55 54 09 00 03 74 26 12 5e |2mples/UT...t&.^|
00000030 82 26 12 5e 75 78 0b 00 01 04 e9 03 00 00 04 e9 |.&.^ux..........|
00000040 03 00 00 50 4b 01 02 1e 03 0a 00 00 00 00 00 3c |...PK..........<|
00000050 69 25 50 00 00 00 00 00 00 00 00 ff ff ff ff 29 |i%P............)|
00000060 00 18 00 00 00 00 00 00 00 10 00 ed 4f 00 00 00 |............O...|
00000070 00 65 78 61 6d 70 6c 65 73 2f 55 54 05 00 03 74 |.examples/UT...t|
00000080 26 12 5e 90 6c 0b 00 01 04 e9 03 00 00 04 e9 03 |&.^.l...........|
00000090 00 00 50 4b 05 06 00 00 00 00 01 00 1f 00 4f 00 |..PK..........O.|
000000a0 f5 bf 8d 2c e3 83 9b 2c e3 83 9d 2c e3 82 bb 2c |...,...,...,...,|
000000b0 2c e3 83 9f 2c e3 83 8f 40 e3 83 98 2c 2c 2c e3 |,...,...@...,,,.|
000000c0 83 8a 5d 3d 5b 21 21 e3 82 a6 5d 2b 21 e3 82 a6 |..]=[!!...]+!...|
000000d0 2b e3 82 a6 2e e3 82 a6 29 5b e3 82 a2 2b 3d e3 |+.......)[...+=.|
000000e0 82 a6 2b e3 83 8a 2b e3 83 98 2b e3 83 8d 2b e3 |..+...+...+...+.|
000000f0 83 9b 2b e3 99 8c 2b e3 82 a2 2b e3 83 8d 2b e3 |..+...+...+...+.|
00000100 00 00 50 4b 01 02 1e 03 0a 00 00 00 00 00 3c 69 |..PK..........<i|
00000110 25 50 00 00 00 00 00 00 00 00 ff ff ff ff 29 00 |%P............).|
00000120 18 00 00 00 00 00 00 00 10 00 ed 43 00 00 00 00 |...........C....|
00000130 65 78 61 6d 70 6c 65 73 00 00 04 e9 03 00 00 50 |examples.......P|
00000140 4b 05 06 00 00 00 00 01 00 01 00 4f 00 f5 83 8d |K..........O....|
00000150 2c e3 83 9b 2c e3 83 8c 2c e3 82 bb 2c 2c e3 83 |,...,...,...,,..|
00000160 9f 2c e3 83 8f 2c e3 83 98 2c 2c 2c e3 83 8a 5d |.,...,...,,,...]|
00000170 3d 5b 21 21 e3 82 a6 5d 2b 21 e3 82 a6 2b e3 82 |=[!!...]+!...+..|
00000180 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 |................|
*
000001c0 00 01 03 03 03 03 03 03 00 00 00 1b 69 25 50 00 |............i%P.|
000001d0 00 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d |.===============|
000001e0 3d 3d 3d 3d 3d 00 00 00 00 00 00 00 00 ff eb 78 |=====..........x|
000001f0 0b 00 01 04 e9 03 00 00 04 e9 03 00 01 50 4b 05 |.............PK.|
00000200 06 00 ef 50 4b 01 03 00 00 04 e9 03 00 01 50 4b |...PK.........PK|
00000210 05 06 00 00 00 00 01 00 02 00 74 26 00 00 43 00 |..........t&..C.|
00000220 00 00 a7 00 40 20 28 5b 2c e3 82 a6 2c 2c 2c 2c |....@ ([,...,,,,|
00000230 e3 82 bf 5d 3d 5b 5d 2b 7b 7d 2c 5b e3 83 8d 2c |...]=[]+{},[...,|
00000240 e3 83 9b 3e e3 83 8c 2c e3 82 bb 2c 2c e3 83 9f |...>...,...,,...|
00000250 2c e3 83 8f 2c e3 83 98 2c 2c 2c e3 83 8a 5d 3d |,...,...,,,...]=|
00000260 5b 21 21 e3 82 a6 5d 2b 21 e3 82 a6 2b e3 82 a6 |[!!...]+!...+...|
00000270 2e e3 82 a6 29 5b e3 82 a2 2b 3d e3 82 a6 2b e3 |....)[...+=...+.|
00000280 83 8a 2b e3 83 98 2b e3 83 8d 2b e3 83 9b 2b e3 |..+...+...+...+.|
00000290 83 8c 2b e3 82 a2 2b e3 00 00 00 00 00 00 00 00 |..+...+.........|
000002a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000002c0 80 00 00 00 00 00 00 00 00 00 00 00 00 00 |..............|
000002ce
