unzip security update leads to extracting errors

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Freenode.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/1513293/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

Thank you for your bug report. There was a recent security update to unzip
https://launchpad.net/ubuntu/+source/unzip/6.0-9ubuntu1.4

could you try reverting it to the previous version (https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+build/6987027/+files/unzip_6.0-9ubuntu1.3_amd64.deb) and see if that resolves your issue?

Is there any chance you could add a small example of problematic file to the bug (is the issue specific your SVN backups or impacting other zips as well?)

Thanks for your help. I am sorry that (for obvious reasons) I cannot submit my code base.

I can guess that the problem could be due to the SVN repo file structure creating conditions which cause the error - at least that is what the symptoms suggest to me. If you would like me to create a new SVN repo, I might be able to do this, but I am assuming that you would know how to do this too. I am using SVN through Netbeans (although I think my repo was created on an earlier version of SVN than the one prebundled with the version of Netbeans I am using).

A quick look at the SVN plugin in my version of Netbeans contains the following information:

Version: 1.37.1.42.1
Source: NetBeans IDE 8.0.2 (Build 201411181905).

I do not archive anything else - I use the archiving utility primarily for the encryption.

No worry about not sharing your archive, could you try if installing the old version fixes your issue though?

I'm having the same issue with unzip-6.0-9ubuntu1.4.
Downgrading to 6.0-9ubuntu1.3 resolves it.

thanks, that seems a regression with the unzip security update then

Thanks for reporting this issue.

Is anyone able to give me an example of a problematic zip file, either in this bug, or in private?

Ummm... it looks like a novice needs someone to hold his hand...

I tried to find out how to revert to an earlier version, but I have had no luck as yet. I would like to do what Sebastien asked of me, but I want to tread carefully so as not to break my Ubuntu. I imagine that very few things would frustrate me more, and I don't want these frustrations to escape my imagination.

Owen, to see which versions of unzip can be easily installed, run: apt-cache show unzip | grep ^Version

Then use apt-get install unzip=version --- replace the "version" with an older version number.

On my system it looks like:
$ apt-cache show unzip | grep ^Version
Version: 6.0-9ubuntu1.4
Version: 6.0-9ubuntu1
$ sudo apt-get install unzip=6.0-9ubuntu1
Reading package lists... Done
Building dependency tree
Reading state information... Done
...
The following packages will be DOWNGRADED:
  unzip
0 upgraded, 0 newly installed, 1 downgraded, 0 to remove and 22 not upgraded.
Need to get 193 kB of archives.
After this operation, 5,120 B disk space will be freed.
Do you want to continue? [Y/n]
...
Setting up unzip (6.0-9ubuntu1) ...

Once you're done with your testing, a new 'apt-get upgrade' should bring your unzip back to the newest.

Thanks

Thanks Seth. I'll give it a go, and hopefully I'll get back with the news we're both hoping for...

Well, that was quite easy. After I reverted unzip, I successfully extracted the code base, and checked out the most recent revision.

Thumbs up!

Owen, thanks; any chance you could create a new svn repo, do whatever it is you do to create the zip file, and see if that recreates the issue? We can't find a zip file that demonstrates any issues and having one would help.

Thanks

I created the attached zip file containing a new svn repo. The password to this archive is UnzipBug.

On my computer I found that unzip gave up as reported. I then reverted as instructed by Seth and found that the problem did not appear.

I hope the problem is reproducible.

Thanks, I can reproduce the issue with the zipfile in attachment #13. The issue is caused by the 16-fix-integer-underflow-csiz-decrypted patch breaking support for 0-byte files because "if (csiz_decrypted <= 12)" should be "if (csiz_decrypted < 12)".

I'll prepare a regression fix. Thanks!

This bug was fixed in the package unzip - 6.0-17ubuntu1.2

---------------
unzip (6.0-17ubuntu1.2) wily-security; urgency=medium

  * debian/patches/16-fix-integer-underflow-csiz-decrypted: updated to fix
    regression in handling 0-byte files (LP: #1513293)

 -- Marc Deslauriers <email address hidden> Mon, 09 Nov 2015 09:08:12 -0600

This bug was fixed in the package unzip - 6.0-13ubuntu3.2

---------------
unzip (6.0-13ubuntu3.2) vivid-security; urgency=medium

  * debian/patches/16-fix-integer-underflow-csiz-decrypted: updated to fix
    regression in handling 0-byte files (LP: #1513293)

 -- Marc Deslauriers <email address hidden> Mon, 09 Nov 2015 09:14:34 -0600

This bug was fixed in the package unzip - 6.0-9ubuntu1.5

---------------
unzip (6.0-9ubuntu1.5) trusty-security; urgency=medium

  * debian/patches/16-fix-integer-underflow-csiz-decrypted: updated to fix
    regression in handling 0-byte files (LP: #1513293)

 -- Marc Deslauriers <email address hidden> Mon, 09 Nov 2015 09:16:57 -0600

This bug was fixed in the package unzip - 6.0-4ubuntu2.5

---------------
unzip (6.0-4ubuntu2.5) precise-security; urgency=medium

  * debian/patches/16-fix-integer-underflow-csiz-decrypted: updated to fix
    regression in handling 0-byte files (LP: #1513293)

 -- Marc Deslauriers <email address hidden> Mon, 09 Nov 2015 09:17:52 -0600

This bug was fixed in the package unzip - 6.0-19ubuntu2

---------------
unzip (6.0-19ubuntu2) xenial; urgency=medium

  * debian/patches/16-fix-integer-underflow-csiz-decrypted: updated to fix
    regression in handling 0-byte files (LP: #1513293)

 -- Marc Deslauriers <email address hidden> Mon, 09 Nov 2015 08:51:17 -0600