zziplib: load of misaligned address in memdisk.c

Description:
zziplib is an intentionally lightweight library that offers the ability to easily extract data from files archived in a single zip file.

A fuzz on it discovered the load of a misaligned address. It can cause undefined behavior.

The complete ASan output:

# unzzipcat-mem $FILE
/tmp/portage/dev-libs/zziplib-0.13.62-r1/work/zziplib-0.13.62/zzip/memdisk.c:250:33: runtime error: load of misaligned address 0x00000295d17d for type 'uint16_t' (aka 'unsigned short'), which requires 2 byte alignment
0x00000295d17d: note: pointer points here
 5a 45 93 58 75 70 0b  00 00 61 64 0a 50 4b 01  02 1e 03 0a 00 00 00 00  ff ff ff ff 42 00 00 00  b1
             ^ 
/tmp/portage/dev-libs/zziplib-0.13.62-r1/work/zziplib-0.13.62/zzip/memdisk.c:256:22: runtime error: load of misaligned address 0x00000295d17f for type 'uint16_t' (aka 'unsigned short'), which requires 2 byte alignment
0x00000295d17f: note: pointer points here
 93 58 75 70 0b  00 00 61 64 0a 50 4b 01  02 1e 03 0a 00 00 00 00  ff ff ff ff 42 00 00 00  b1 01 00
             ^

Affected version:
0.13.62

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00160-zziplib-misalignedadd-memdisk_c

Timeline:
2017-01-17: bug discovered and poked upstream
2017-02-09: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.

Permalink:
https://blogs.gentoo.org/ago/2017/02/09/zziplib-load-of-misaligned-address-in-memdisk-c

This entry was posted in advisories, security. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.