{"action":"created","issue":{"url":"https://api.github.com/repos/gdraheim/zziplib/issues/16","repository_url":"https://api.github.com/repos/gdraheim/zziplib","labels_url":"https://api.github.com/repos/gdraheim/zziplib/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/gdraheim/zziplib/issues/16/comments","events_url":"https://api.github.com/repos/gdraheim/zziplib/issues/16/events","html_url":"https://github.com/gdraheim/zziplib/issues/16","id":293591334,"number":16,"title":"Bus error when handling disk64_trailer in __zzip_fetch_disk_trailer (src/zzip/zip.c)","user":{"login":"ProbeFuzzer","id":35150299,"avatar_url":"https://avatars3.githubusercontent.com/u/35150299?v=4","gravatar_id":"","url":"https://api.github.com/users/ProbeFuzzer","html_url":"https://github.com/ProbeFuzzer","followers_url":"https://api.github.com/users/ProbeFuzzer/followers","following_url":"https://api.github.com/users/ProbeFuzzer/following{/other_user}","gists_url":"https://api.github.com/users/ProbeFuzzer/gists{/gist_id}","starred_url":"https://api.github.com/users/ProbeFuzzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ProbeFuzzer/subscriptions","organizations_url":"https://api.github.com/users/ProbeFuzzer/orgs","repos_url":"https://api.github.com/users/ProbeFuzzer/repos","events_url":"https://api.github.com/users/ProbeFuzzer/events{/privacy}","received_events_url":"https://api.github.com/users/ProbeFuzzer/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/gdraheim/zziplib/milestones/1","html_url":"https://github.com/gdraheim/zziplib/milestone/1","labels_url":"https://api.github.com/repos/gdraheim/zziplib/milestones/1/labels","id":3087695,"number":1,"title":"v0.13.68 next release","description":"to be published in next release v0.13.68","creator":{"login":"gdraheim","id":959453,"avatar_url":"https://avatars1.githubusercontent.com/u/959453?v=4","gravatar_id":"","url":"https://api.github.com/users/gdraheim","html_url":"https://github.com/gdraheim","followers_url":"https://api.github.com/users/gdraheim/followers","following_url":"https://api.github.com/users/gdraheim/following{/other_user}","gists_url":"https://api.github.com/users/gdraheim/gists{/gist_id}","starred_url":"https://api.github.com/users/gdraheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdraheim/subscriptions","organizations_url":"https://api.github.com/users/gdraheim/orgs","repos_url":"https://api.github.com/users/gdraheim/repos","events_url":"https://api.github.com/users/gdraheim/events{/privacy}","received_events_url":"https://api.github.com/users/gdraheim/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":3,"state":"open","created_at":"2018-02-04T22:40:16Z","updated_at":"2018-02-05T19:40:20Z","due_on":"2018-02-20T08:00:00Z","closed_at":null},"comments":3,"created_at":"2018-02-01T16:17:31Z","updated_at":"2018-02-05T19:40:20Z","closed_at":"2018-02-05T19:40:20Z","author_association":"NONE","body":"On latest version (0.13.67) and master branch of zziplib:\r\nthere is a bus error caused by loading of misaligned address when handling disk64_trailer local entries in __zzip_fetch_disk_trailer function of src/zzip/zip.c, which could be triggered by the POC below.\r\n\r\nThe issue happens since the struct zzip_disk_trailer \"orig\" (line 336) could be manipulated by a crafted zip file, resulting in a misaligned memory access and bus error. Note that the issue is in libzip and may affect downstream programs. This issue is different from CVE-2018-6484, and arises when invoking a different function.\r\n\r\n    336                         zzip_disk64_trailer_localentries(orig);\r\n    337                     trailer->zz_finalentries =\r\n    338                         zzip_disk64_trailer_finalentries(orig);\r\n\r\nTo reproduce the issue, run: ./unzzip -p $POC\r\nhttps://github.com/ProbeFuzzer/poc/blob/master/zziplib/zziplib_0-13-67_unzzip_memory-aligment-errors___zzip_fetch_disk_trailer.zip\r\n\r\nmaster/src/zzip/zip.c:336:25: runtime error: load of misaligned address 0x7f1d4f853036 for type 'uint64_t', which requires 8 byte alignment\r\n0x7f1d4f853036: note: pointer points here\r\n 03 dd e5 69 50 5a  50 4b 03 dd e5 69 50 5a  50 4b 06 14 00 0b 00 06  14 00 00 00 00 00 00 00  61 55\r\n             ^ "},"comment":{"url":"https://api.github.com/repos/gdraheim/zziplib/issues/comments/363197718","html_url":"https://github.com/gdraheim/zziplib/issues/16#issuecomment-363197718","issue_url":"https://api.github.com/repos/gdraheim/zziplib/issues/16","id":363197718,"user":{"login":"gdraheim","id":959453,"avatar_url":"https://avatars1.githubusercontent.com/u/959453?v=4","gravatar_id":"","url":"https://api.github.com/users/gdraheim","html_url":"https://github.com/gdraheim","followers_url":"https://api.github.com/users/gdraheim/followers","following_url":"https://api.github.com/users/gdraheim/following{/other_user}","gists_url":"https://api.github.com/users/gdraheim/gists{/gist_id}","starred_url":"https://api.github.com/users/gdraheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdraheim/subscriptions","organizations_url":"https://api.github.com/users/gdraheim/orgs","repos_url":"https://api.github.com/users/gdraheim/repos","events_url":"https://api.github.com/users/gdraheim/events{/privacy}","received_events_url":"https://api.github.com/users/gdraheim/received_events","type":"User","site_admin":false},"created_at":"2018-02-05T19:40:20Z","updated_at":"2018-02-05T19:40:20Z","author_association":"OWNER","body":"checking back with v0.13.67 where the testcase does actually show a bus error.\r\n\r\nAs the testcase is fine now, it was probably fixed by some other patch. => fixed"}}
{"actor":{"display_login":"gdraheim"}}