>Number:         8573
>Category:       bin
>Synopsis:       'ar' falls over on debian packages.
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct  6 17:35:00 1999
>Last-Modified:
>Originator:     Chris Demetriou
>Organization:
Things that make you go "HMM!"
>Release:        1.4.x (head of 1.4-branch as of about a month ago)
>Environment:
NetBSD/i386 running 1.4.x, that's all you really need to know.
>Description:
Our 'ar' seems to be Unhappy with debian packages.  It seg-faults.
RedHat Linux's ar works, as does Solaris 2.6 (sparc) /usr/ccs/bin/ar.
>How-To-Repeat:
FTP a debian package archive, and then run 'ar tv' on it.

Known to cause the problem is the x2x_1.27-5.deb package which
can be found via http://www.debian.org/Packages/stable/x11/x2x.html
on one of various mirrors.  I downloaded my copy of the package
from:

ftp://ftp.debian.org/debian/dists/stable/main/binary-i386/x11/x2x_1.27-5.deb

Then run 'file' on it, and note that file claims it's an 'ar' archive.
run 'ar tv' on it, and watch the seg-fault.

Run 'ar tv' (or 'ar xv') on it on RedHat Linux 6.0 (i386) or
Solaris 2.6 (sparc) and note that the right thing (not a seg fault 8-)
happens.  As reported by solaris, the contents of the file look like:

rw-r--r--     0/     0      4 Oct  4 14:05 1998 debian-binary
rw-r--r--     0/     0    833 Oct  4 14:05 1998 control.tar.gz
rw-r--r--     0/     0  16225 Oct  4 14:05 1998 data.tar.gz

RedHat 6.0 on i386 seems to agree, modulo white space.

>Fix:
unknown
>Audit-Trail:
>Unformatted: