zip buffer overflow detected with umlaut o (ö) in the filename

Bug #2070098 reported by John Allsup
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
zip (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

# Umlaut o in filename causes buffer overflow error.
# This is in 24.04. Problem does not occur with binary from
# 22.04 run on same 24.04 system.
# Tested on two separate installs of 24.04 (One Thinkpad T470s, one Thinkpad T450)
# I have tried apt-get install --reinstall

# Example
$ touch ö
$ zip -9r o.zip ö
*** buffer overflow detected ***: terminated

zip error: Interrupted (aborting)

ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: zip 3.0-13build1
ProcVersionSignature: Ubuntu 6.8.0-35.35-generic 6.8.4
Uname: Linux 6.8.0-35-generic x86_64
ApportVersion: 2.28.1-0ubuntu3
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Sat Jun 22 13:09:57 2024
InstallationDate: Installed on 2024-03-05 (109 days ago)
InstallationMedia: Kubuntu 23.10 "Mantic Minotaur" - Release amd64 (20231010)
ProcEnviron:
 LANG=en_GB.UTF-8
 LANGUAGE=en_GB:en
 PATH=(custom, no user)
 SHELL=/bin/bash
 XDG_RUNTIME_DIR=<set>
SourcePackage: zip
UpgradeStatus: Upgraded to noble on 2024-05-12 (41 days ago)

Revision history for this message
John Allsup (chalisque) wrote :
Revision history for this message
John Allsup (chalisque) wrote :

hash of the zip binary with this issue
8a3e81e6e12455d417a00df7b99d06b6bc203d7fd293af8e6ee7b88d4a60cb08 /usr/bin/zip

Revision history for this message
John Allsup (chalisque) wrote :

This bug report was generated on a Thinkpad T470s that was initially installed with 23.10 and then upgraded to 24.04. The same bug occurs on a Thinkpad T450 that was a clean install from a 24.04 ISO.

Revision history for this message
John Allsup (chalisque) wrote :

If I get the source via apt-get source, and build locally using make unix/Makefile generic_gcc, this bug does not occur.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in zip (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.