Re: [Full-disclosure] Unzip *ALL* verisons ;))

[Joachim Schipper <j.schipper@xxxxxxxxxx>]

On Mon, Dec 19, 2005 at 04:44:02PM +0000, c0ntex wrote:
> On 19/12/05, Joachim Schipper <j.schipper@xxxxxxxxxx> wrote
> 
> > I cannot reproduce this, either with "A" x 5000 or "A" x 20000. I tested
> > unzip-5.52 on Linux/i386-2.6 and OpenBSD/i386-3.8, and saw no error.
> >
> >                 Joachim
> 
> 
> 
> [c0ntex@ ~]$ unzip -v | head -1
> UnZip 5.32 of 3 November 1997, by Info-ZIP.  Maintained by Greg Roelofs.  Send
> [c0ntex@ ~]$
> [c0ntex@ ~]$ uname -a
> SunOS  5.8 Generic_117350-24 sun4u sparc SUNW,UltraAX-i2
> [c0ntex@ ~]$ unzip `perl -e 'print "A" x 50000'`
> Bus Error (core dumped)
> [c0ntex@ ~]$
> 
> 
> c0ntex@debauch:~$ unzip -v | head -1
> UnZip 5.52 of 28 February 2005, by Info-ZIP.  Maintained by C. Spieler.  Send
> c0ntex@debauch:~$ uname -a
> Linux debauch 2.4.27-2-386 #1 Mon May 16 16:47:51 JST 2005 i686 GNU/Linux
> c0ntex@debauch:~$ unzip `perl -e 'print "A" x 32000'`
> <snip>
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.ZIP.
> error:  zipfile probably corrupt (segmentation violation)
> c0ntex@debauch:~$
> 
> 
> [c0ntex@linuxbox tmp]$ unzip -v | head -1
> UnZip 5.51 of 22 May 2004, by Info-ZIP.  Maintained by C. Spieler.  Send
> [c0ntex@linuxbox tmp]$ uname -a
> Linux linuxbox 2.6.12 #2 Wed Jul 13 10:19:26 BST 2005 i686 i686 i386 GNU/Linux
> [c0ntex@linuxbox tmp]$ unzip `perl -e 'print "A" x 50000'`
> Segmentation fault
> [c0ntex@linuxbox tmp]$

Oops, sorry, should have taken a better look.

Segfault observed with UnZip-5.52 in gdb with "A" x 50000 on Linux-2.6
and OpenBSD-3.8, both on i386. Without gdb, Linux segfaults too but
OpenBSD just hangs (might be my choice of numbers or payload, but it's
pretty consistent that "A" x 32000 does nothing and "A" x 33000 hangs).

I did not investigate further, sorry for the bother!

                Joachim
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/