832160 - JAR/ZIP crash [@nsZipArchive::BuildSynthetics]

Status: RESOLVED DUPLICATE of bug 832162

(Core :: Networking: JAR, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

This crash happened while fuzzing the JAR/ZIP parser.

./modules/libjar/nsZipArchive.cpp:628

      for (uint16_t dirlen = namelen - 1; dirlen > 0; dirlen--)
      {
        if (name[dirlen-1] != '/')
          continue;

To reproduce load the testcase like:

jar:file:///Users/cdiehl/Desktop/testcase.jar!/

Tested with m-c changeset: 119051:ff2e30afa205

Comment 1

[Christoph Diehl [:posidron]]

Attachment: testcase

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Crashing on non-null, need to determine if this is exploitable.

Comment 3

[Jason Duell]

Attachment: v1: skip if directory name length == 0

Taras: I can't say I even know what the buildsynthetics code is for, but this patch avoids it from trying to reference name[-1], which is causing the crash.

with the patch I no longer crash, and instead see a listing of the JAR file's contents (attack.js and attack2.js).

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Exactly the same fix as bug 832162, and also I think this check needs to be done in a different place, as described in my feedback to the patch for bug 832162.