pete4abw / lrzip-next

Long Range Zip. Updated and Enhanced version of ckolivas' lrzip project. Lots of new features. Better compression. Actively maintained.
https://github.com/pete4abw/lrzip-next
GNU General Public License v2.0
50 stars 10 forks source link

Huanglei3 reported a bug in lrzip that is not duplicated here #131

Closed pete4abw closed 1 year ago

pete4abw commented 1 year ago

heap-buffer-overflow in libzpaq/libzpaq.cpp:1208:25 libzpaq::PostProcessor::write(int)

@huanglei3 , this type of POC work is counterproductive. Yes, lrzip crashes, but lrzip-next does not. See output below (your filenames have been renamed). But, of course, your file is borked, so lrzip-next does crash during decompression. But we use ZPAQ version 7.15.

$ lrzip-next -vvt huanglei3.poc
The following options are in effect for this INTEGRITY TEST.
Threading is ENABLED. Number of CPUs detected: 8
Detected 16,538,464,256 bytes ram
Nice Value: 19
Show Progress
Max Verbose
Test file integrity
Temporary Directory set as: /tmp/
Malloced 5,512,818,688 for tmp_outbuf
Detected lrzip version 0.6 file.
MD5 being used for integrity testing.
Validating file for consistency...[OK]
Detected lrzip version 0.6 file.
Decompressing...

Reading chunk_bytes at 24
Expected size: 6,036
Chunk byte width: 2
Reading eof flag at 25
EOF: 1
Reading expected chunksize at 26
Chunk size: 6,036
Reading stream 0 header at 29
Reading stream 1 header at 36
Reading ucomp header at 1,031
Fill_buffer stream 0 c_len 10 u_len 10 last_head 0
Starting thread 0 to decompress 10 bytes from stream 0
Thread 0 decompressed 10 bytes from stream 0
Taking decompressed data from thread 0
Reading ucomp header at 43
Fill_buffer stream 1 c_len 981 u_len 6,036 last_head 1,019
Starting thread 1 to decompress 981 bytes from stream 1
Reading ucomp header at 1,048
Fill_buffer stream 1 c_len 0 u_len 0 last_head 0
Skipping empty match block
ZPAQ Error: Empty PCOMP
huanglei3 commented 1 year ago

hi,when i install lrzip-next,i met some errors: checking libbz3.h presence... no checking for libbz3.h... no configure: error: libbz3.h not found. Install libbz3-dev

but no package libbz3-dev. install bzip3 first?

pete4abw commented 1 year ago

Yes, bzip3 library is a dependency, but my error message is NOT accurate! Thank you I will fix. Package libbzip3-dev is what you want.

pete4abw commented 1 year ago

Closed in #132