422118 - (cpni-zip) Crash reading malformed zip [@nsZipArchive::BuildFileList]

Status: RESOLVED FIXED

Description

[Daniel Veditz [:dveditz]]

Malformed zip directories can crash us. Appears safe, we read outside our buffer and die with an access violation, but in order to snoop on data in other owned buffers it would have to match up exactly with a ZIP "central directory" structure which is extremely unlikely.

Comment 1

[Martijn Wargers (dead)]

Created attachment 308642 [details]
zip file that seems to crash

This seems to be a zip file that seems to crash Mozilla when trying to open it.

Comment 2

[Martijn Wargers (dead)]

Created attachment 308643 [details]
script used to open the zip file

I used this script to open the zip file with.

Comment 3

[Daniel Veditz [:dveditz]]

Martijn's crash: bp-45371582-ef91-11dc-91a2-001a4bd46e84

I think that's probably the same as mine because my patched version doesn't crash on it, but a stock FF does.

You don't need to go through the rigamaroll of your script, though, it's enough to simply open the jar:
  jar:https://bugzilla.mozilla.org/attachment.cgi?id=308642!/
(requires setting network.jar.open-unsafe-types to true, or changing type of attachment to application/java-archive which I'll do for the bug)

Comment 4

[Daniel Veditz [:dveditz]]

Created attachment 308664 [details]
invalid (overlong) extralen and commentlen

Comment 5

[Daniel Veditz [:dveditz]]

testcase: in address bar enter
  jar:https://bugzilla.mozilla.org/attachment.cgi?id=308664!/

Comment 6

[Daniel Veditz [:dveditz]]

Created attachment 308672 [details] [diff] [review]
patch WIP (1.8 branch version)

This fixes the above testcases but "work in progress" because there are other crashes in this testsuite covered by this bug.

Comment 7

[Daniel Veditz [:dveditz]]

Created attachment 309512 [details]
testcase2

Second testcase, trying to view "!/fakerealsize.txt" will crash 1.8. Doesn't seem to crash trunk though.

Comment 8

[Daniel Veditz [:dveditz]]

That is, the testcase URL is
  jar:https://bugzilla.mozilla.org/attachment.cgi?id=309512!/fakerealsize.txt

Comment 9

[Daniel Veditz [:dveditz]]

Created attachment 309575 [details] [diff] [review]
Fix both problems (1.8 branch)

Comment 10

[Daniel Veditz [:dveditz]]

Created attachment 309577 [details] [diff] [review]
same for trunk

Comment 11

[Daniel Veditz [:dveditz]]

Requesting blocking FF3 -- CPNI is going to release their testsuite and it would be nicer to say "we don't crash" than to have to explain "trust us, they're safe crashes".

Comment 12

[Daniel Veditz [:dveditz]]

The advisory has been released
https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html

Comment 13

[Daniel Veditz [:dveditz]]

Fix checked in on trunk

Comment 14

[Daniel Veditz [:dveditz]]

Comment on attachment 309575 [details] [diff] [review]
Fix both problems (1.8 branch)

approved for 1.8.1.14, a=dveditz for release-drivers

Comment 15

[Al Billings [:abillings]]

Verified fixed for 1.8 with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15pre) Gecko/2008061005 BonEcho/2.0.0.15pre.