#27 Buffer overflow with handcrafted zip file

[Gabe Gorelick]

See https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/387350 for more details, but the summary is that a specially crafted zip file will cause a buffer overflow in list.c. This is not a major security concern though, as it only causes a single byte overflow in the bss region not near any control structures. Still, it is something that should be fixed.

[Gabe Gorelick]

File that will cause the overflow

[Steven Schweda]

Thanks (belated) for the report. UnZip version 6.1c (beta) and later
should include a fix for this. Now, values less than 1000 are displayed
as before, using a three-digit decimal format, "Unk:ddd", but larger
values are displayed using a four-digit hexadecimal format, "UnkXXXX".
(This avoids spoiling the report format for the would-be wider values.)