Bug 1191136

Similar buffer overflow related to printing of compression method was reported in:

https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/387350

Affected code is:

  sprintf(&methbuf[4], "%03u", G.crec.compression_method);

Fixed in upcoming 6.1 using:

                /* 2013-02-26 SMS.
                 * http://sourceforge.net/tracker/?func=detail
                 *  &aid=2861648&group_id=118012&atid=679786
                 * Unexpectedly large compression methods overflow
                 * &methbuf[].  Use the old, three-digit decimal format
                 * for values which fit.  Otherwise, sacrifice the
                 * colon, and use four-digit hexadecimal.
                 */
                if (G.crec.compression_method <= 999) {
                    sprintf( &methbuf[ 4], "%03u", G.crec.compression_method);
                } else {
                    sprintf( &methbuf[ 3], "%04X", G.crec.compression_method);
                }

Mentioned SF.net bug may have further discussion:

http://sourceforge.net/tracker/?func=detail&aid=2861648&group_id=118012&atid=679786

SF.net is currently inaccessible.

unzip-6.0-19.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/unzip-6.0-19.fc21

unzip-6.0-16.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/unzip-6.0-16.fc20

unzip-6.0-17.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/unzip-6.0-17.fc20

unzip-6.0-20.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/unzip-6.0-20.fc21

Package unzip-6.0-17.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing unzip-6.0-17.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-1993/unzip-6.0-17.fc20
then log in and leave karma (feedback).

unzip-6.0-20.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

unzip-6.0-17.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

(In reply to Tomas Hoger from comment #0)
> Issue was reported upstream:
> 
> http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=432

...

> Upstream bug includes proposed fix.

Just for posterity, the fix proposed in the above forum is to extended cfactorstr[] size from cfactorstr[10] to cfactorstr[12].  However, upstream unzip610c15 only extends it to cfactorstr[11], which is insufficient.

(In reply to Tomas Hoger from comment #0)
> Description of problem:
> 
> Issue was reported upstream:
> 
> http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=432

The originating Debian bug report is:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741384

(In reply to Tomas Hoger from comment #9)
> Just for posterity, the fix proposed in the above forum is to extended
> cfactorstr[] size from cfactorstr[10] to cfactorstr[12].  However, upstream
> unzip610c15 only extends it to cfactorstr[11], which is insufficient.

Upstream unzip610c16s uses cfactorstr[12].  Referenced beta versions are available here:

http://antinode.info/ftp/info-zip/

This problem was about insufficiently sized cfactorstr[] stack-based buffer, which could be overflown when large cfactor value is printed to it using:

sprintf(cfactorstr, LoadFarString(CompFactorStr), sgn, cfactor);

where CompFactorStr format string is:

   static ZCONST char Far CompFactorStr[] = "%c%d%%";

(In reply to Tomas Hoger from comment #1)
> Similar buffer overflow related to printing of compression method was
> reported in:
> 
> https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/387350
> 
> Affected code is:
> 
>   sprintf(&methbuf[4], "%03u", G.crec.compression_method);

This issue now got CVE-2014-9913 assigned - see bug 1401865.  Additionally, similar flaw was found in zi_short() in zipinfo.c - see CVE-2016-9844 / bug 1401864.

> Mentioned SF.net bug may have further discussion:
> 
> http://sourceforge.net/tracker/?func=detail&aid=2861648&group_id=118012&atid=679786
> 
> SF.net is currently inaccessible.

A new link for the above upstream bug report is:

https://sourceforge.net/p/infozip/bugs/27/