dpkg -i crashes when .deb contains utf8 filenames

[Alkis Georgopoulos]

Binary package hint: dpkg

While creating some .deb packages, I noticed that dpkg -i crashes when the deb file contains some utf8 filename combinations.
It doesn't crash for all utf8 filenames, but only for some of them. I suspect a buffer overflow somewhere...

I attach a minimal .deb package which reproduces the problem; it only contains two directories and one empty file.

Ubuntu 9.04, dpkg version 1.14.24ubuntu1.

Stack dump:
alkisg@alkis:~/Public/Education/Λογισμικά/ΠΙ/dim-glossa-e-st/dim-glossa-e-st-base$ sudo dpkg -i ../dim-glossa-e-st-base_1.0_all.deb
Επιλογή προηγούμενου απεπιλεγμένου πακέτου dim-glossa-e-st-base.
(Ανάγνωση βάσης δεδομένων ... προς το παρόν εγκαταστάθηκαν 249153 αρχεία και κατάλογοι.)
Γίνεται αποσυμπίεση dim-glossa-e-st-base (από .../dim-glossa-e-st-base_1.0_all.deb) ...
*** stack smashing detected ***: dpkg terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7f4eda8]
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x0)[0xb7f4ed60]
dpkg[0x804dd9e]
dpkg[0x806699f]
dpkg[0x8059afb]
dpkg[0x804b5b0]
dpkg[0x8055fdd]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb7e67775]
dpkg[0x804ad31]
======= Memory map: ========
08048000-080a2000 r-xp 00000000 08:02 2953 /usr/bin/dpkg
080a3000-080a4000 r--p 0005a000 08:02 2953 /usr/bin/dpkg
080a4000-080a5000 rw-p 0005b000 08:02 2953 /usr/bin/dpkg
080a5000-08131000 rw-p 080a5000 00:00 0
08321000-0ccff000 rw-p 08321000 00:00 0 [heap]
b7421000-b742e000 r-xp 00000000 08:02 23752 /lib/libgcc_s.so.1
b742e000-b742f000 r--p 0000c000 08:02 23752 /lib/libgcc_s.so.1
b742f000-b7430000 rw-p 0000d000 08:02 23752 /lib/libgcc_s.so.1
b7430000-b7ca5000 rw-p b7430000 00:00 0
b7ca5000-b7caf000 r-xp 00000000 08:02 46551 /lib/tls/i686/cmov/libnss_files-2.9.so
b7caf000-b7cb0000 r--p 00009000 08:02 46551 /lib/tls/i686/cmov/libnss_files-2.9.so
b7cb0000-b7cb1000 rw-p 0000a000 08:02 46551 /lib/tls/i686/cmov/libnss_files-2.9.so
b7cb1000-b7cba000 r-xp 00000000 08:02 46553 /lib/tls/i686/cmov/libnss_nis-2.9.so
b7cba000-b7cbb000 r--p 00008000 08:02 46553 /lib/tls/i686/cmov/libnss_nis-2.9.so
b7cbb000-b7cbc000 rw-p 00009000 08:02 46553 /lib/tls/i686/cmov/libnss_nis-2.9.so
b7cbc000-b7cd1000 r-xp 00000000 08:02 39227 /lib/tls/i686/cmov/libnsl-2.9.so
b7cd1000-b7cd2000 r--p 00014000 08:02 39227 /lib/tls/i686/cmov/libnsl-2.9.so
b7cd2000-b7cd3000 rw-p 00015000 08:02 39227 /lib/tls/i686/cmov/libnsl-2.9.so
b7cd3000-b7cd5000 rw-p b7cd3000 00:00 0
b7cd5000-b7cdc000 r-xp 00000000 08:02 39228 /lib/tls/i686/cmov/libnss_compat-2.9.so
b7cdc000-b7cdd000 r--p 00006000 08:02 39228 /lib/tls/i686/cmov/libnss_compat-2.9.so
b7cdd000-b7cde000 rw-p 00007000 08:02 39228 /lib/tls/i686/cmov/libnss_compat-2.9.so
b7cf2000-b7cf4000 rw-p b7cf2000 00:00 0
b7cf5000-b7d25000 r--p 00000000 08:02 1022 /usr/share/locale/el/LC_MESSAGES/dpkg.mo
b7d25000-b7d64000 r--p 00000000 08:02 4873 /usr/lib/locale/el_GR.utf8/LC_CTYPE
b7d64000-b7e4f000 r--p 00000000 08:02 8201 /usr/lib/locale/el_GR.utf8/LC_COLLATE
b7e4f000-b7e51000 rw-p b7e4f000 00:00 0
b7e51000-b7fad000 r-xp 00000000 08:02 33220 /lib/tls/i686/cmov/libc-2.9.so
b7fad000-b7fae000 ---p 0015c000 08:02 33220 /lib/tls/i686/cmov/libc-2.9.so
b7fae000-b7fb0000 r--p 0015c000 08:02 33220 /lib/tls/i686/cmov/libc-2.9.so
b7fb0000-b7fb1000 rw-p 0015e000 08:02 33220 /lib/tls/i686/cmov/libc-2.9.so
b7fb1000-b7fb4000 rw-p b7fb1000 00:00 0
b7fb4000-b7fc9000 r-xp 00000000 08:02 46559 /lib/tls/i686/cmov/libpthread-2.9.so
b7fc9000-b7fca000 r--p 00014000 08:02 46559 /lib/tls/i686/cmov/libpthread-2.9.so
b7fca000-b7fcb000 rw-p 00015000 08:02 46559 /lib/tls/i686/cmov/libpthread-2.9.so
b7fcb000-b7fcd000 rw-p b7fcb000 00:00 0
b7fcf000-b7fd0000 rw-p b7fcf000 00:00 0
b7fd0000-b7fd1000 r--p 00000000 08:02 4884 /usr/lib/locale/el_GR.utf8/LC_NUMERIC
b7fd1000-b7fd2000 r--p 00000000 08:02 4933 /usr/lib/locale/el_GR.utf8/LC_TIME
b7fd2000-b7fd3000 r--p 00000000 08:02 5345 /usr/lib/locale/el_GR.utf8/LC_MONETARY
b7fd3000-b7fd4000 r--p 00000000 08:02 8261 /usr/lib/locale/el_GR.utf8/LC_MESSAGES/SYS_LC_MESSAGES
b7fd4000-b7fd5000 r--p 00000000 08:02 8262 /usr/lib/locale/el_GR.utf8/LC_PAPER
b7fd5000-b7fd6000 r--p 00000000 08:02 8303 /usr/lib/locale/el_GR.utf8/LC_NAME
b7fd6000-b7fd7000 r--p 00000000 08:02 99417 /usr/lib/locale/el_GR.utf8/LC_ADDRESS
b7fd7000-b7fd8000 r--p 00000000 08:02 99418 /usr/lib/locale/el_GR.utf8/LC_TELEPHONE
b7fd8000-b7fd9000 r--p 00000000 08:02 9090 /usr/lib/locale/el_GR.utf8/LC_MEASUREMENT
b7fd9000-b7fe0000 r--s 00000000 08:02 18625 /usr/lib/gconv/gconv-modules.cache
b7fe0000-b7fe1000 r--p 00000000 08:02 99419 /usr/lib/locale/el_GR.utf8/LC_IDENTIFICATION
b7fe1000-b7fe3000 rw-p b7fe1000 00:00 0
b7fe3000-b7fe4000 r-xp b7fe3000 00:00 0 [vdso]
b7fe4000-b8000000 r-xp 00000000 08:02 19326 /lib/ld-2.9.so
b8000000-b8001000 r--p 0001b000 08:02 19326 /lib/ld-2.9.so
b8001000-b8002000 rw-p 0001c000 08:02 19326 /lib/ld-2.9.so
bfbec000-bfc01000 rw-p bffeb000 00:00 0 [stack]
Aborted

[Raphaël Hertzog (hertzog)]

This problem is no longer reproducible with the latest dpkg. Closing the bug.