| Anonymous | Login | Signup for a new account | 11-10-2008 10:49 PST |
| Main | My View | View Issues | Change Log | Docs |
| Viewing Issue Simple Details [ Jump to Notes ] | [ View Advanced ] [ Issue History ] [ Print ] | ||||||||
| ID | Category | Severity | Reproducibility | Date Submitted | Last Update | ||||
| 0000411 | [BusyBox] Other | minor | always | 08-31-05 10:40 | 09-01-05 01:29 | ||||
| Reporter | avati | View Status | public | ||||||
| Assigned To | BusyBox | ||||||||
| Priority | normal | Resolution | fixed | ||||||
| Status | closed | Product Version | 1.00 | ||||||
| Summary | 0000411: byte overflow in decompress_unzip.c | ||||||||
| Description |
in function inflate_gunzip() in archival/libunarchive/decompress_unzip.c just after calling inflate_unzip() there is this line: count = bytebuffer_size - bytebuffer_offset; if (count < 8) { ... but count is a char (1 byte) i hit a situation where bytebuffer_size - bytebuffer_offset was 2305 and gzip was complaining 'Short read' (there is a bb_xread_all in the 'if' condition which tries to read from in-fd which has already eof'd) count being 1 byte interpreted 2305 as 7 and wrongly entered the 'if' as far as functionality is concerned this happens _after_ the actual un-gzip and only the trailers are affected (which tar happily neglects as it knows its boundry limit).. but the code is bad and results in wrong exit status, which affected my script.. have attached a small diff which changes the char to int.. the fix most likely is fixing the symptom and not the root cause, or maybe the root cause itself. |
||||||||
| Additional Information | diff attached | ||||||||
| Attached Files |
|
||||||||
|
|
|||||||||
| Copyright © 2000 - 2006 Mantis Group |