Subject: gzip buffer overflow found
To: None <current-users@netbsd.org>
From: Jeremy C. Reed <reed@reedmedia.net>
List: current-users
Date: 01/18/2001 18:46:34
This is some notes from some research. I still need to send-pr these if
applicable. This is 1.5.1_ALPHA (i386).

Seg faults with 99999-character long argument.

gzip via zmore (zmore runs "gzip -cdfq")

Program terminated with signal 11, Segmentation fault.
#0  0x805a7a2 in ?? ()
(gdb) bt
#0  0x805a7a2 in ?? ()
#1  0x8048db7 in ?? ()
#2  0x8048acd in ?? ()
#3  0x80481bd in ?? ()

Built with debugging:

Program terminated with signal 11, Segmentation fault.
#0  0x805a7a2 in strcpy ()
(gdb) bt
#0  0x805a7a2 in strcpy ()
#1  0x80a7100 in ifname ()
#2  0x8048db7 in treat_file ()
#3  0x8048acd in main ()
#4  0x80481bd in ___start ()

How do I look at this backtrace to find out where the trouble routine is?

(Of course, maybe the 18 strcpy()'s in gzip.c should be checked, replaced,
fixed.)

   Jeremy C. Reed
   http://www.reedmedia.net/