latest bzip2 reports crc errors incorrectly

Manually reverting to a previous version of /lib/x86_64-linux-gnu/libbz2.so.1.0.4 corrects the issue for me.

Reference: http://changelogs.ubuntu.com/changelogs/pool/main/b/bzip2/bzip2_1.0.6-8.1ubuntu0.1/changelog

Status changed to 'Confirmed' because the bug affects multiple users.

Bug is also present with other Nvidia Jetson packages.
https://devtalk.nvidia.com/default/topic/1056381/jetson-agx-xavier/jetpack-4-2-xavier-install-failed/post/5355851/?offset=4#5355865

Hi,

Thanks for report this issue.
I added a comment in commit fix that caused this regression in upstream project: https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc

Soon they update there with some notes we can look for a fix. For now, as you already did, please try downgrade to the previous version. Also, if possible, could you please test it using upstream version?

We apologize for the inconvenience.

Please see the discussion and analysis of the issue on the bzip2-devel mailinglist: https://sourceware.org/ml/bzip2-devel/2019-q2/msg00024.html

There is a proposed workaround patch for decompression of the (buggy lbzip2 compressed) files:
https://sourceware.org/ml/bzip2-devel/2019-q2/msg00031.html

Testing of that patch is highly appreciated.

The attachment "Proposed workaround. Still under analysis. Testing appreciated." seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

Filled respective bug in Debian as well as per https://bugs.debian.org/931278

I did test the patch suggested and can confirm that it fixes the issue.

Hey @Mark, Thanks for provide these tests (https://sourceware.org/git/?p=bzip2-tests.git;a=summary). I ran our internal regression tests on the version patched and also the tests you provided. Our tests passed, but yours fails (believe is the same you mentioned in Debian-bug).

See bellow:

!!! 1 .bz files did not decompressed/recompressed correctly.

Testing detection of bad input data...

Processing ./go/compress/fail-issue5747.bz2.bad
  Trying to decompress...

bzip2: Data integrity error when decompressing.
  Trying to decompress (small)...

bzip2: Data integrity error when decompressing.
Processing ./lbzip2/cve.bz2.bad
  Trying to decompress...

bzip2: Data integrity error when decompressing.
  Trying to decompress (small)...

bzip2: Data integrity error when decompressing.
Processing ./lbzip2/cve2.bz2.bad
  Trying to decompress...

bzip2: Data integrity error when decompressing.
  Trying to decompress (small)...

bzip2: Data integrity error when decompressing.
Processing ./lbzip2/overrun.bz2.bad
  Trying to decompress...

bzip2: Data integrity error when decompressing.
  Trying to decompress (small)...

bzip2: Data integrity error when decompressing.
Processing ./lbzip2/void.bz2.bad
  Trying to decompress...
  Trying to decompress (small)...
Processing ./lbzip2/crc1.bz2.bad
  Trying to decompress...

bzip2: Data integrity error when decompressing.
  Trying to decompress (small)...

bzip2: Data integrity error when decompressing.
Processing ./lbzip2/crc2.bz2.bad
  Trying to decompress...

bzip2: Data integrity error when decompressing.
  Trying to decompress (small)...

bzip2: Data integrity error when decompressing.
Processing ./lbzip2/overrun2.bz2.bad
  Trying to decompress...

bzip2: Data integrity error when decompressing.
  Trying to decompress (small)...

bzip2: Data integrity error when decompressing.

Correctly found all bad file data integrity errors.

Bad results, look for !!! in the logs above

Yes, there was one testcase that wasn't handled by the patch.
There is an updated patch that handles both the original file and the new testcase.
https://sourceware.org/ml/bzip2-devel/2019-q3/msg00007.html

Thanks a lot @Mark for the quick fix!

:)

This bug was fixed in the package bzip2 - 1.0.6-8ubuntu0.2

---------------
bzip2 (1.0.6-8ubuntu0.2) xenial-security; urgency=medium

  * SECURITY REGRESSION: bzip2 update for CVE-2019-12900 causes some files raises
    incorrect CRC error. (LP: #1834494)
    - debian/patches/Accept-as-many-selectors-as-selectors*.patch

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 04 Jul 2019 09:27:38 -0300

This bug was fixed in the package bzip2 - 1.0.6-9ubuntu0.19.04.1

---------------
bzip2 (1.0.6-9ubuntu0.19.04.1) disco-security; urgency=medium

  * SECURITY REGRESSION: bzip2 update for CVE-2019-12900 causes some files raises
    incorrect CRC error. (LP: #1834494)
    - debian/patches/Accept-as-many-selectors-as-selectors*.patch

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 04 Jul 2019 09:50:14 -0300

This bug was fixed in the package bzip2 - 1.0.6-9ubuntu0.18.10.1

---------------
bzip2 (1.0.6-9ubuntu0.18.10.1) cosmic-security; urgency=medium

  * SECURITY REGRESSION: bzip2 update for CVE-2019-12900 causes some files raises
    incorrect CRC error. (LP: #1834494)
    - debian/patches/Accept-as-many-selectors-as-selectors*.patch

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 04 Jul 2019 09:40:45 -0300

This bug was fixed in the package bzip2 - 1.0.6-8.1ubuntu0.2

---------------
bzip2 (1.0.6-8.1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY REGRESSION: bzip2 update for CVE-2019-12900 causes some files raises
    incorrect CRC error. (LP: #1834494)
    - debian/patches/Accept-as-many-selectors-as-selectors*.patch

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 04 Jul 2019 09:35:36 -0300