Bug 183426

A buffer overflow bug exists in zoo which is triggered during archive creation.
 This issue is borderline a bug as it's really only a problem if someone is
creating a zoo archive on a directory full of files controlled by a local attacker.

Here is how to reproduce this issue:

mkdir `perl -e 'print "A"x254'`
cd `perl -e 'print "A"x254'`
mkdir `perl -e 'print "A"x254'`
cd `perl -e 'print "A"x254'`
touch feh
cd ../..
zoo a arch.zoo `perl -e 'print "A"x254 . "/" . "A"x254 . "/feh"'`


To fix this issue, in parse.c, line 42, Change the line:

strcpy (tempname, fname);

to

strncpy(tempname, fname, LFNAMESIZE);

Please note that there are probably countless other issues similar to this in
zoo.  I've not looked for any of them.