[BusyBox] bug#1265: gunzip hangs on some truncated/corrupted .gz files

[Matthias Lang]

Package: busybox
Version: 0.60.3
Severity: normal

The busybox gunzip code hangs on several different types of files,
including truncated .gz files and files which aren't real .gz
files. Example:

   >hexdump contrived.gz
   000000 1f 8b 08 08 00 00 00 00 00 00 63

   >gunzip -c contrived.gz                       (real gunzip 1.3.2)
   gunzip: contrived.gz: unexpected end of file

   >busybox-0.60.3/busybox gunzip -c contrived.gz 
   (hangs forever)

This is caused by busybox gunzip ignoring EOF in several places, for
instance in unzip.c:

      if ((flags & orig_name) != 0) {
              while (fgetc(in_file) != 0);    /* null */
      }

I haven't written a patch---I'm not sure that the hanging behaviour is
a conscious design tradeoff.

Matt

---
http://www.corelatus.com