classification
Title: buffer overflow in Zipfile when wrinting more than 2gig file
Type: crash Stage: needs patch
Components: Library (Lib) Versions: Python 3.0, Python 2.4
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: amaury.forgeotdarc, segfault42 (2)
Priority: Keywords

Created on 2009-07-07 17:10 by segfault42, last changed 2009-09-01 23:44 by amaury.forgeotdarc.

Files
File name Uploaded Description Edit Remove
zipfile.py segfault42, 2009-07-07 17:10 zipfile.py lib
Messages (6)
msg90242 - (view) Author: (segfault42) Date: 2009-07-07 17:10
Hello, 

I have a problem with the librairy zipfile.py
Lib/zipfile.py?revision=73565&view=markup">http://svn.python.org/view/python/trunk/Lib/zipfile.py?revision=73565&view=markup


Zinfo structure limit the size of a file to an int max value with the
ZIP64_LIMIT value ( equal to "(1 << 31) - 1 " so to 2147483647 . 

The problem is happening when you write a big file in the line 1095 : 

self.fp.write(struct.pack("<lLL", zinfo.CRC, zinfo.compress_size,
                 zinfo.file_size))

zinfo.file_size is limited to a int  size and if you have a file bigger
than ZIP64_LIMIT you make a buffer overflow even if you set the flag
allowZip64 to true.
msg90243 - (view) Author: (segfault42) Date: 2009-07-07 17:14
look like issue 1182788
msg90261 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) Date: 2009-07-08 09:00
I don't see how it can be a buffer overflow. Or is it an exception
raised by the struct.pack function?
msg90282 - (view) Author: (segfault42) Date: 2009-07-08 21:01
yes it's zinfo.file_size which is bigger than the long specify in the 
struct.pack

There's must have a solution with the extra header because a lot of tools 
can zip big file and these zip file can be open by zipfile.py

it's easy to reproduice with a big file of 3 gig.

i think that the problem come from that the write methode do not take 
care of the flag allowZip64
msg92142 - (view) Author: (segfault42) Date: 2009-09-01 18:58
still no one to help on this problem ? is someone has some idea ?
msg92147 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) Date: 2009-09-01 23:44
I did reproduce the problem, but I'm sorry I don't have the time to fix 
it. However, I will review any proposed patch.
History
Date User Action Args
2009-09-01 23:44:13amaury.forgeotdarcsetmessages: + msg92147
stage: needs patch
2009-09-01 18:58:33segfault42setmessages: + msg92142
2009-07-08 21:01:38segfault42setmessages: + msg90282
2009-07-08 09:00:42amaury.forgeotdarcsetnosy: + amaury.forgeotdarc
messages: + msg90261
2009-07-07 17:14:30segfault42settype: crash
messages: + msg90243
2009-07-07 17:10:57segfault42create