homepage

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: buffer overflow in Zipfile when wrinting more than 2gig file
Type: behavior Stage: resolved
Components: Library (Lib) Versions: Python 3.2, Python 3.3, Python 2.7
process
Status: closed Resolution: duplicate
Dependencies: Superseder: zipfile writes incorrect local file header for large files in zip64
View: 9720
Assigned To: Nosy List: Paul, amaury.forgeotdarc, enlavin, lambacck, nadeem.vawda, segfault42
Priority: normal Keywords:

Created on 2009年07月07日 17:10 by segfault42, last changed 2022年04月11日 14:56 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
zipfile.py segfault42, 2009年07月07日 17:10 zipfile.py lib
Messages (11)
msg90242 - (view) Author: (segfault42) Date: 2009年07月07日 17:10
Hello, 
I have a problem with the librairy zipfile.py
http://svn.python.org/view/python/trunk/Lib/zipfile.py?revision=73565&view=markup
Zinfo structure limit the size of a file to an int max value with the
ZIP64_LIMIT value ( equal to "(1 << 31) - 1 " so to 2147483647 . 
The problem is happening when you write a big file in the line 1095 : 
self.fp.write(struct.pack("<lLL", zinfo.CRC, zinfo.compress_size,
 zinfo.file_size))
zinfo.file_size is limited to a int size and if you have a file bigger
than ZIP64_LIMIT you make a buffer overflow even if you set the flag
allowZip64 to true.
msg90243 - (view) Author: (segfault42) Date: 2009年07月07日 17:14
look like issue 1182788 
msg90261 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) * (Python committer) Date: 2009年07月08日 09:00
I don't see how it can be a buffer overflow. Or is it an exception
raised by the struct.pack function?
msg90282 - (view) Author: (segfault42) Date: 2009年07月08日 21:01
yes it's zinfo.file_size which is bigger than the long specify in the 
struct.pack
There's must have a solution with the extra header because a lot of tools 
can zip big file and these zip file can be open by zipfile.py
it's easy to reproduice with a big file of 3 gig.
i think that the problem come from that the write methode do not take 
care of the flag allowZip64
msg92142 - (view) Author: (segfault42) Date: 2009年09月01日 18:58
still no one to help on this problem ? is someone has some idea ?
msg92147 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) * (Python committer) Date: 2009年09月01日 23:44
I did reproduce the problem, but I'm sorry I don't have the time to fix 
it. However, I will review any proposed patch.
msg121826 - (view) Author: Chris Lambacher (lambacck) * Date: 2010年11月21日 01:20
This should be closed as a dup of #1182788 which the OP identified as being the same bug and which is now fixed due to the implementation. of ZIP64.
msg146505 - (view) Author: Paul (Paul) Date: 2011年10月27日 16:47
This is a problem with python2.7 as well. A change in struct between python2.6 and 2.7 raises an exception on overflow instead of silently allowing it. This prevents zipping any file larger than 4.5G. This exception concurs when writing the 32-bit headers (which are not used on large files anyway)
The patch should be simple. Just wrap line 1100: 
...struct.pack("<LLL",...
with a try: except: to revert to the old behavior. Alternatively, check if size is bigger than ZIP64_LIMIT and set to anything less than ZIP64_LIMIT.
msg146527 - (view) Author: Paul (Paul) Date: 2011年10月27日 22:26
I attempted to "re-allow overflow" in the struct(...) call by replacing `zinfo.file_size` with `ZIP64_LIMIT % zinfo.file_size` in zipfile.py, and successfully produced a compressed file from a 10G file, but the resulting compressed file could not be uncompressed and was deemed "invalid" by any unzip util I tried.
msg146911 - (view) Author: Miguel Hernández Martos (enlavin) Date: 2011年11月03日 09:26
I think it's a dup of http://bugs.python.org/issue9720 
That issue has a patch that allows the generation of zip files with >2GB files.
msg146922 - (view) Author: Nadeem Vawda (nadeem.vawda) * (Python committer) Date: 2011年11月03日 12:17
Marking as duplicate.
History
Date User Action Args
2022年04月11日 14:56:50adminsetgithub: 50683
2011年11月03日 12:17:17nadeem.vawdasetstatus: open -> closed
superseder: zipfile writes incorrect local file header for large files in zip64
messages: + msg146922

type: crash -> behavior
resolution: duplicate
stage: needs patch -> resolved
2011年11月03日 09:26:36enlavinsetnosy: + enlavin
messages: + msg146911
2011年10月27日 22:26:37Paulsetmessages: + msg146527
2011年10月27日 22:17:33pitrousetversions: + Python 3.2, Python 3.3, - Python 2.4, Python 3.0
2011年10月27日 16:49:35ezio.melottisetnosy: + nadeem.vawda
2011年10月27日 16:47:49Paulsetnosy: + Paul

messages: + msg146505
versions: + Python 2.7
2010年11月21日 01:20:39lambaccksetnosy: + lambacck
messages: + msg121826
2009年09月01日 23:44:13amaury.forgeotdarcsetmessages: + msg92147
stage: needs patch
2009年09月01日 18:58:33segfault42setmessages: + msg92142
2009年07月08日 21:01:38segfault42setmessages: + msg90282
2009年07月08日 09:00:42amaury.forgeotdarcsetnosy: + amaury.forgeotdarc
messages: + msg90261
2009年07月07日 17:14:30segfault42settype: crash
messages: + msg90243
2009年07月07日 17:10:57segfault42create

AltStyle によって変換されたページ (->オリジナル) /