{"action":"created","issue":{"url":"https://api.github.com/repos/libarchive/libarchive/issues/717","repository_url":"https://api.github.com/repos/libarchive/libarchive","labels_url":"https://api.github.com/repos/libarchive/libarchive/issues/717/labels{/name}","comments_url":"https://api.github.com/repos/libarchive/libarchive/issues/717/comments","events_url":"https://api.github.com/repos/libarchive/libarchive/issues/717/events","html_url":"https://github.com/libarchive/libarchive/issues/717","id":161015498,"number":717,"title":"signed integer overflow in iso parser","user":{"login":"hannob","id":990588,"avatar_url":"https://avatars.githubusercontent.com/u/990588?v=3","gravatar_id":"","url":"https://api.github.com/users/hannob","html_url":"https://github.com/hannob","followers_url":"https://api.github.com/users/hannob/followers","following_url":"https://api.github.com/users/hannob/following{/other_user}","gists_url":"https://api.github.com/users/hannob/gists{/gist_id}","starred_url":"https://api.github.com/users/hannob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hannob/subscriptions","organizations_url":"https://api.github.com/users/hannob/orgs","repos_url":"https://api.github.com/users/hannob/repos","events_url":"https://api.github.com/users/hannob/events{/privacy}","received_events_url":"https://api.github.com/users/hannob/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/libarchive/libarchive/milestones/2","html_url":"https://github.com/libarchive/libarchive/milestones/3.2.1","labels_url":"https://api.github.com/repos/libarchive/libarchive/milestones/2/labels","id":1680425,"number":2,"title":"3.2.1","description":"Security and bug fix release.\r\n","creator":{"login":"kientzle","id":1398793,"avatar_url":"https://avatars.githubusercontent.com/u/1398793?v=3","gravatar_id":"","url":"https://api.github.com/users/kientzle","html_url":"https://github.com/kientzle","followers_url":"https://api.github.com/users/kientzle/followers","following_url":"https://api.github.com/users/kientzle/following{/other_user}","gists_url":"https://api.github.com/users/kientzle/gists{/gist_id}","starred_url":"https://api.github.com/users/kientzle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kientzle/subscriptions","organizations_url":"https://api.github.com/users/kientzle/orgs","repos_url":"https://api.github.com/users/kientzle/repos","events_url":"https://api.github.com/users/kientzle/events{/privacy}","received_events_url":"https://api.github.com/users/kientzle/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":9,"state":"open","created_at":"2016-04-03T18:16:23Z","updated_at":"2016-06-20T03:47:44Z","due_on":"2016-06-18T07:00:00Z","closed_at":null},"comments":2,"created_at":"2016-06-18T09:18:16Z","updated_at":"2016-06-28T14:10:22Z","closed_at":"2016-06-20T03:45:09Z","body":"The attached malformed iso file (packed as zip, because github limits attachment file types) will cause a signed integer overflow when passed to \"bsdtar -tf [infile]\" (tested with libarchive 3.2.0). This can be seen with undefined behavior sanitizer (compile with -fsanitize=undefined in CFLAGS/LDFLAGS).\r\n\r\nubsan error:\r\nlibarchive/archive_read_support_format_iso9660.c:1094:32: runtime error: signed integer overflow: 8388631 * 2048 cannot be represented in type 'int'\r\n\r\nThis was found with the help of american fuzzy lop.\r\n[libarchive-signed-int-overflow.zip](https://github.com/libarchive/libarchive/files/321672/libarchive-signed-int-overflow.zip)\r\n"},"comment":{"url":"https://api.github.com/repos/libarchive/libarchive/issues/comments/229060543","html_url":"https://github.com/libarchive/libarchive/issues/717#issuecomment-229060543","issue_url":"https://api.github.com/repos/libarchive/libarchive/issues/717","id":229060543,"user":{"login":"petterreinholdtsen","id":731031,"avatar_url":"https://avatars.githubusercontent.com/u/731031?v=3","gravatar_id":"","url":"https://api.github.com/users/petterreinholdtsen","html_url":"https://github.com/petterreinholdtsen","followers_url":"https://api.github.com/users/petterreinholdtsen/followers","following_url":"https://api.github.com/users/petterreinholdtsen/following{/other_user}","gists_url":"https://api.github.com/users/petterreinholdtsen/gists{/gist_id}","starred_url":"https://api.github.com/users/petterreinholdtsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petterreinholdtsen/subscriptions","organizations_url":"https://api.github.com/users/petterreinholdtsen/orgs","repos_url":"https://api.github.com/users/petterreinholdtsen/repos","events_url":"https://api.github.com/users/petterreinholdtsen/events{/privacy}","received_events_url":"https://api.github.com/users/petterreinholdtsen/received_events","type":"User","site_admin":false},"created_at":"2016-06-28T14:10:22Z","updated_at":"2016-06-28T14:10:22Z","body":"According to the Debian security issue tracker, this is https://security-tracker.debian.org/tracker/CVE-2016-5844 ."}}
{"actor":{"display_login":"petterreinholdtsen"}}