#65 buffer overflow detected during attempted recovery of zip

[David Durgee]

I am encountering the above problem attempting to recover a damaged zip file. I have attached the log of the command. The crash dump is:

zip error: Interrupted (aborting)

*** buffer overflow detected ***: zip terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777f5)[0x7fd954fcd7f5]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7fd95506f21c]
/lib/x86_64-linux-gnu/libc.so.6(+0x117220)[0x7fd95506d220]
/lib/x86_64-linux-gnu/libc.so.6(+0x116789)[0x7fd95506c789]
/lib/x86_64-linux-gnu/libc.so.6(_IO_default_xsputn+0x80)[0x7fd954fd16c0]
/lib/x86_64-linux-gnu/libc.so.6(_IO_vfprintf+0x139b)[0x7fd954fa451b]
/lib/x86_64-linux-gnu/libc.so.6(__vsprintf_chk+0x84)[0x7fd95506c814]
/lib/x86_64-linux-gnu/libc.so.6(__sprintf_chk+0x7d)[0x7fd95506c76d]
zip[0x40dfac]
zip[0x40e73d]
zip[0x40fbf2]
zip[0x4042d1]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fd954f76840]
zip[0x408529]
======= Memory map: ========
00400000-0042c000 r-xp 00000000 08:0f 210985                             /usr/bin/zip
0062c000-0062d000 r--p 0002c000 08:0f 210985                             /usr/bin/zip
0062d000-0062f000 rw-p 0002d000 08:0f 210985                             /usr/bin/zip
0062f000-0067e000 rw-p 00000000 00:00 0 
00aea000-00bca000 rw-p 00000000 00:00 0                                  [heap]
7fd954a68000-7fd954a7e000 r-xp 00000000 08:0f 53681                      /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd954a7e000-7fd954c7d000 ---p 00016000 08:0f 53681                      /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd954c7d000-7fd954c7e000 rw-p 00015000 08:0f 53681                      /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd954c7e000-7fd954f56000 r--p 00000000 08:0f 217396                     /usr/lib/locale/locale-archive
7fd954f56000-7fd955116000 r-xp 00000000 08:0f 53667                      /lib/x86_64-linux-gnu/libc-2.23.so
7fd955116000-7fd955316000 ---p 001c0000 08:0f 53667                      /lib/x86_64-linux-gnu/libc-2.23.so
7fd955316000-7fd95531a000 r--p 001c0000 08:0f 53667                      /lib/x86_64-linux-gnu/libc-2.23.so
7fd95531a000-7fd95531c000 rw-p 001c4000 08:0f 53667                      /lib/x86_64-linux-gnu/libc-2.23.so
7fd95531c000-7fd955320000 rw-p 00000000 00:00 0 
7fd955320000-7fd95532f000 r-xp 00000000 08:0f 53624                      /lib/x86_64-linux-gnu/libbz2.so.1.0.4
7fd95532f000-7fd95552e000 ---p 0000f000 08:0f 53624                      /lib/x86_64-linux-gnu/libbz2.so.1.0.4
7fd95552e000-7fd95552f000 r--p 0000e000 08:0f 53624                      /lib/x86_64-linux-gnu/libbz2.so.1.0.4
7fd95552f000-7fd955530000 rw-p 0000f000 08:0f 53624                      /lib/x86_64-linux-gnu/libbz2.so.1.0.4
7fd955530000-7fd955556000 r-xp 00000000 08:0f 53805                      /lib/x86_64-linux-gnu/ld-2.23.so
7fd955732000-7fd955736000 rw-p 00000000 00:00 0 
7fd955754000-7fd955755000 rw-p 00000000 00:00 0 
7fd955755000-7fd955756000 r--p 00025000 08:0f 53805                      /lib/x86_64-linux-gnu/ld-2.23.so
7fd955756000-7fd955757000 rw-p 00026000 08:0f 53805                      /lib/x86_64-linux-gnu/ld-2.23.so
7fd955757000-7fd955758000 rw-p 00000000 00:00 0 
7ffef9866000-7ffef9887000 rw-p 00000000 00:00 0                          [stack]
7ffef9963000-7ffef9966000 r--p 00000000 00:00 0                          [vvar]
7ffef9966000-7ffef9968000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

dhdurgee@DG41TY /media/dhdurgee/0403-0201 $ 

I have attempted to find another tool to recover this zip on linux without success. Please let me know how to recover this data.

[David Durgee]

Another point for you, I attempted to report this bug by the link http://www.info-zip.org/zip-bug.html but it results in an error about an empty README or some such.

[Ed Gordon]

We'll take a look at the zip-bug page.

What version of Zip and what OS was the buffer overflow on? If you downloaded Zip, where did you get it? What command line did you use to create this? What can you tell us about the file being recovered (big, small, type)? If you can provide an example, without any sensitive data and small, that recreates the issue that would be very helpful. It's possible the latest beta fixed this issue already.

[Danilo Spinella]

Hi! We at openSUSE also are experiencing similar errors when using FORTIFY_SOURCE=3. You can try by compiling zip using -DFORTIFY_SOURCE=3 and using the following command line:

$ touch α.txt
$ zip a.zip α.txt

openSUSE bug for reference: https://bugzilla.suse.com/show_bug.cgi?id=1200712