{"action":"closed","issue":{"url":"https://api.github.com/repos/gdraheim/zziplib/issues/17","repository_url":"https://api.github.com/repos/gdraheim/zziplib","labels_url":"https://api.github.com/repos/gdraheim/zziplib/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/gdraheim/zziplib/issues/17/comments","events_url":"https://api.github.com/repos/gdraheim/zziplib/issues/17/events","html_url":"https://github.com/gdraheim/zziplib/issues/17","id":293591362,"number":17,"title":"Bus error when handling (root seek of disk64_trailer) in zzip_disk_findfirst (src/zzip/mmapped.c) ","user":{"login":"ProbeFuzzer","id":35150299,"avatar_url":"https://avatars3.githubusercontent.com/u/35150299?v=4","gravatar_id":"","url":"https://api.github.com/users/ProbeFuzzer","html_url":"https://github.com/ProbeFuzzer","followers_url":"https://api.github.com/users/ProbeFuzzer/followers","following_url":"https://api.github.com/users/ProbeFuzzer/following{/other_user}","gists_url":"https://api.github.com/users/ProbeFuzzer/gists{/gist_id}","starred_url":"https://api.github.com/users/ProbeFuzzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ProbeFuzzer/subscriptions","organizations_url":"https://api.github.com/users/ProbeFuzzer/orgs","repos_url":"https://api.github.com/users/ProbeFuzzer/repos","events_url":"https://api.github.com/users/ProbeFuzzer/events{/privacy}","received_events_url":"https://api.github.com/users/ProbeFuzzer/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/gdraheim/zziplib/milestones/1","html_url":"https://github.com/gdraheim/zziplib/milestone/1","labels_url":"https://api.github.com/repos/gdraheim/zziplib/milestones/1/labels","id":3087695,"number":1,"title":"v0.13.68 next release","description":"to be published in next release v0.13.68","creator":{"login":"gdraheim","id":959453,"avatar_url":"https://avatars1.githubusercontent.com/u/959453?v=4","gravatar_id":"","url":"https://api.github.com/users/gdraheim","html_url":"https://github.com/gdraheim","followers_url":"https://api.github.com/users/gdraheim/followers","following_url":"https://api.github.com/users/gdraheim/following{/other_user}","gists_url":"https://api.github.com/users/gdraheim/gists{/gist_id}","starred_url":"https://api.github.com/users/gdraheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdraheim/subscriptions","organizations_url":"https://api.github.com/users/gdraheim/orgs","repos_url":"https://api.github.com/users/gdraheim/repos","events_url":"https://api.github.com/users/gdraheim/events{/privacy}","received_events_url":"https://api.github.com/users/gdraheim/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":1,"state":"open","created_at":"2018-02-04T22:40:16Z","updated_at":"2018-02-05T19:35:08Z","due_on":"2018-02-20T08:00:00Z","closed_at":null},"comments":5,"created_at":"2018-02-01T16:17:35Z","updated_at":"2018-02-05T19:35:08Z","closed_at":"2018-02-05T19:35:07Z","author_association":"NONE","body":"On latest version (0.13.67) and master branch of zziplib:\r\nthere is a bus error (when handling seek of disk64_trailer) caused by loading of misaligned address in zzip_disk_findfirst function of src/zzip/mmapped.c, which could be triggered by the POC below. Note that this issue is different from https://github.com/gdraheim/zziplib/issues/15.\r\n\r\nThe issue happens since the pointer \"trailer\" (line 444) could be manipulated by a crafted zip file, resulting in a misaligned memory access and bus error. Note that the issue is in libzip and may affect downstream programs. The POC is as small as 100 bytes.\r\n\r\n    444             zzip_size_t rootseek = zzip_disk64_trailer_get_rootseek(trailer);\r\n\r\nTo reproduce the issue, run: ./unzip-mem -p $POC\r\nThe POC could be downloaded at: https://github.com/ProbeFuzzer/poc/blob/master/zziplib/zziplib_0-13-67_unzip-mem_memory-alignment-errors_zzip_disk_findfirst_64.zip\r\n\r\nmaster/src/zzip/mmapped.c:444:25: runtime error: load of misaligned address 0x7f798f31e163 for type 'uint64_t', which requires 8 byte alignment\r\n0x7f798f31e163: note: pointer points here\r\n 71  00 00 00 3d 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00\r\n              ^ "}}
{"actor":{"display_login":"gdraheim"}}