[squeak-dev] Buffer overrun in ZipPlugin

Nicolas Cellier nicolas.cellier.aka.nice at gmail.com
Fri Mar 31 19:13:37 UTC 2017


Hi,
some remember that from time to time, especially when the ZipPlugin is
disabled, the DeflateStream fallback code is failing with a 'subscript is
out of bounds: 65537'

I have a reproducible example with quite a large file

    | zip file |
    zip := (FileStream fileNamed: 'snapshot.bin.gz') binary
contentsOfEntireFile asString.
    file := zip unzipped.
    file zipped unzipped = file

which gives me:

ByteString(Object)>>error:
ByteString(Object)>>errorSubscriptBounds:
ByteString(Object)>>at:
ByteString>>at:
ByteString>>byteAt:
GZipWriteStream(DeflateStream)>>updateHashAt:
GZipWriteStream(DeflateStream)>>insertStringAt:
GZipWriteStream(DeflateStream)>>deflateBlock:chainLength:goodMatch:
GZipWriteStream(ZipWriteStream)>>deflateBlock:chainLength:goodMatch:
GZipWriteStream(DeflateStream)>>deflateBlock
GZipWriteStream(DeflateStream)>>next:putAll:startingAt:
GZipWriteStream(DeflateStream)>>nextPutAll:
ByteString(String)>>zipped

When the plugin is enabled, the example works.
So I've been tracking the differences between DeflatePlugin and
DeflateStream fallback code for some times without success.

What if I add a bound check in the DeflatePlugin?
Then the plugin equally fails. I mean it reads past zipCollection bounds.

So there's something bad in the implementation.
Why does the example seem to work is still mysterious to me.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squeakfoundation.org/pipermail/squeak-dev/attachments/20170331/fe6bb8a9/attachment.html>


More information about the Squeak-dev mailing list