Bug#1142906: unzip: heap buffer overflow WRITE in memextract() STORED path [CAN-2026-2034442]

Akhil Koul <[email protected]> Thu, 30 Jul 2026 12:51:56 -0400

Newsgroups	gmane.linux.debian.devel.bugs.rc
Message-ID	<CAK9eeqVZrbh-qe=FOwY4LrVowDq=hwRv_Ba56pgycQThHE5xBQ@mail.gmail.com>

Hi Paul,

  The PoC zip is completely synthetic — I crafted it from scratch to
trigger the specific code path. It's not based on a real VMS zip file.
The key elements are just: version_made_by with VMS host byte (0x02),
and an EF_IZVMS extra field (ID

  0x000C) with cmptype=BCDEFL and a STORED method byte inside, where
csiz > usiz.

  Happy to test your patch against it once it's ready.

  Akhil

On Thu, Jul 30, 2026 at 12:27 PM Paul Marquess
<[email protected]> wrote:
>
> I have a tentative patch done for this . Just need to find a VMS person to review it.
>
>