#880048 p7zip-full: out-of-bounds read in NArchive::NZip::CInArchive::FindCd(bool)

Package:
p7zip-full
Source:
p7zip
Description:
7z and 7za file archivers with high compression ratio
Submitter:
Jakub Wilk
Date:
2025-03-14 14:51:03 UTC
Severity:
normal
Tags:
#880048#3
Date:
2017-10-28 23:18:17 UTC
From:
To:
$ valgrind --trace-children=yes -q -- 7za t oob.zip > /dev/null
==6438== Invalid read of size 4
==6438==    at 0x184F13: NArchive::NZip::CInArchive::FindCd(bool) (ZipIn.cpp:1116)
==6438==    by 0x185B0C: NArchive::NZip::CInArchive::ReadVols() (ZipIn.cpp:1578)
==6438==    by 0x18AC28: NArchive::NZip::CInArchive::Open(IInStream*, unsigned long long const*, IArchiveOpenCallback*, CObjectVector<NArchive::NZip::CItemEx>&) (ZipIn.cpp:2135)
==6438==    by 0x17B3B5: NArchive::NZip::CHandler::Open(IInStream*, unsigned long long const*, IArchiveOpenCallback*) (ZipHandler.cpp:474)
==6438==    by 0x1E4121: CArc::OpenStream2(COpenOptions const&) (OpenArchive.cpp:1878)
==6438==    by 0x1E7AB6: CArc::OpenStream(COpenOptions const&) (OpenArchive.cpp:2901)
==6438==    by 0x1E802E: CArc::OpenStreamOrFile(COpenOptions&) (OpenArchive.cpp:2993)
==6438==    by 0x1E9177: CArchiveLink::Open(COpenOptions&) (OpenArchive.cpp:3169)
==6438==    by 0x1EA713: CArchiveLink::Open2(COpenOptions&, IOpenCallbackUI*) (OpenArchive.cpp:3292)
==6438==    by 0x1EAB16: CArchiveLink::Open3(COpenOptions&, IOpenCallbackUI*) (OpenArchive.cpp:3356)
==6438==    by 0x1D821D: Extract(CCodecs*, CObjectVector<COpenType> const&, CRecordVector<int> const&, CObjectVector<UString>&, CObjectVector<UString>&, NWildcard::CCensorNode const&, CExtractOptions const&, IOpenCallbackUI*, IExtractCallbackUI*, IHashCalc*, UString&, CDecompressStat&) (Extract.cpp:362)
==6438==    by 0x202D4E: Main2(int, char**) (Main.cpp:930)
==6438==  Address 0x4c64922 is 6 bytes after a block of size 20 alloc'd
==6438==    at 0x482F00C: operator new[](unsigned int) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==6438==    by 0x20F654: UString::operator=(UString const&) (MyString.cpp:1055)
==6438==    by 0x185275: NArchive::NZip::CVols::ParseArcName(IArchiveOpenVolumeCallback*) (ZipIn.cpp:1424)
==6438==    by 0x185A8B: NArchive::NZip::CInArchive::ReadVols() (ZipIn.cpp:1557)
==6438==    by 0x18AC28: NArchive::NZip::CInArchive::Open(IInStream*, unsigned long long const*, IArchiveOpenCallback*, CObjectVector<NArchive::NZip::CItemEx>&) (ZipIn.cpp:2135)
==6438==    by 0x17B3B5: NArchive::NZip::CHandler::Open(IInStream*, unsigned long long const*, IArchiveOpenCallback*) (ZipHandler.cpp:474)
==6438==    by 0x1E4121: CArc::OpenStream2(COpenOptions const&) (OpenArchive.cpp:1878)
==6438==    by 0x1E7AB6: CArc::OpenStream(COpenOptions const&) (OpenArchive.cpp:2901)
==6438==    by 0x1E802E: CArc::OpenStreamOrFile(COpenOptions&) (OpenArchive.cpp:2993)
==6438==    by 0x1E9177: CArchiveLink::Open(COpenOptions&) (OpenArchive.cpp:3169)
==6438==    by 0x1EA713: CArchiveLink::Open2(COpenOptions&, IOpenCallbackUI*) (OpenArchive.cpp:3292)
==6438==    by 0x1EAB16: CArchiveLink::Open3(COpenOptions&, IOpenCallbackUI*) (OpenArchive.cpp:3356)
...