Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

unzip: Unify EOF handling #2175

Merged
merged 1 commit into from
May 9, 2024
Merged

Conversation

stoeckmann
Copy link
Contributor

If EOF is encountered while reading the new filename after choosing 'r', avoid out of boundary access and usage of undefined memory content by treating it the same way as if the question itself was not answered.

If EOF is encountered while reading the new filename after choosing
'r', avoid out of boundary access and usage of undefined memory content
by treating it the same way as if the question itself was not answered.
@stoeckmann
Copy link
Contributor Author

Proof of Concept:

  1. Create a file
touch file.txt
  1. Create an archive containing this file
bsdtar -acf archive.zip file.txt
  1. Extract archive and only answer r without giving a new name
echo r | bsdunzip archive.zip

You can see output like

Archive:  archive.zip
replace file.txt? [y]es, [n]o, [A]ll, [N]one, [r]ename: New name:  extracting: ӯV

The actual file name is pretty random, depending on the underlying system.

@mmatuska mmatuska merged commit dd8f50c into libarchive:master May 9, 2024
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants