Red Hat Bugzilla – Bug 138228
CAN-2004-1010 buffer overflow when creating archive containing very long filenames.
Last modified: 2007-11-30 17:07:04 EST
A buffer overflow has been found in zip which will lead to a buffer overflow when a user try to create a zip archive which contains very long filenames. See: http://lists.netsys.com/pipermail/full-disclosure/2004-November/028379.html This issue is going to affect RHEL2.1 as well.
Created attachment 106240 [details] Patch which fixes this issue.
Created attachment 106249 [details] New patch to fix the buffer overflow. This patch fixes a leak, I was not freeing a malloc'd variable in the previous one.
Patch from mailing list: diff -Nur zip-2.30/unix/unix.c zip-2.30.new/unix/unix.c --- zip-2.30/unix/unix.c 2004-11-05 14:22:42.957410560 +0100 +++ zip-2.30.new/unix/unix.c 2004-11-05 14:22:03.620390696 +0100 @@ -322,6 +322,9 @@ char name[FNMAX]; int len = strlen(f); + if (len >= FNMAX) + error("file name too long"); + if (f == label) { if (a != NULL) *a = label_mode;
*** Bug 138392 has been marked as a duplicate of this bug. ***
An errata has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2004-634.html