diffoscope/137+205 ADT test failure in Focal/Jammy

[Stefan Bader]

This is a scripted bug report about ADT failures while running diffoscope tests for linux/5.15.0-118.128 on jammy. Whether this is caused by the dep8 tests of the tested source or the kernel has yet to be determined.

Testing failed on:
    amd64: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/amd64/d/diffoscope/20240715_144859_b412e@/log.gz
    arm64: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/arm64/d/diffoscope/20240715_145621_d1d37@/log.gz
    armhf: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/armhf/d/diffoscope/20240715_150424_b81fc@/log.gz
    ppc64el: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/ppc64el/d/diffoscope/20240715_145431_a31e6@/log.gz
    s390x: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/s390x/d/diffoscope/20240715_145415_8c37f@/log.gz

[Stefan Bader (smb)]

I was investigating this for 20.04/Focal but assuming this is the same for 22.04/Jammy. The logs show 4 subtests around zip files failing. The in the details for the failures one sees this:

raise BadZipFile(f"Overlapped entries: {zinfo.orig_filename!r} (possible zip bomb)")

This correlates with a recent (Jul-09) update for python3.8 and 3.10:

  * SECURITY UPDATE: zipbomb DoS attack
    - debian/patches/CVE-2024-0450.patch: raise BadZipFile when trying
      to read an entry that overlaps with other entry or central
      directory.
    - CVE-2024-0450

The test files in diffoscope seem to trigger this and bail.