[Bug 10431] New: Bzip2 decompression crashes

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=10431

            Bug ID: 10431
           Summary: Bzip2 decompression crashes
           Product: Busybox
           Version: 1.27.x
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Other
          Assignee: unassigned at busybox.net
          Reporter: ariel at twistlock.com
                CC: busybox-cvs at busybox.net
  Target Milestone: ---

Created attachment 7291
  --> https://bugs.busybox.net/attachment.cgi?id=7291&action=edit
Crash 1

Hi,

While fuzzing busybox I found a vulnerability in the bzip2 decompression code
(archival/libarchive/decompress_bunzip2.c line 513). This is likely a write
access violation, I did not try to exploit this so I don't know how bad it is.
Leads to a crash at least.

Attached are two crash files and the fuzzer info. I tested these on the current
git master and with versions 1.17.2 and 1.16.0.

Please let me know if this is the right place to report possibly security
related issues

-- 
You are receiving this mail because:
You are on the CC list for the bug.