zip_file_set_comment() segmentation fault
**libzip Version**
1.11.3
**Describe the Bug**
by creating a zip archive, adding a bit of content and above all a comment, all is ok. But then
by executing this same sequence, the code crashes.
**Expected Behavior**
no crash
**Observed Behavior**
A clear and concise description of what actually happened.
**To Reproduce**
```c
#include <zip.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(void) {
int err;
zip_t *za;
zip_source_t *src;
za = zip_open("test.zip", ZIP_CREATE, &err);
if (!za) {
printf("open1 failed: %d\n", err);
return 1;
}
src = zip_source_buffer(za, "x", 1, 0);
if (!src || zip_file_add(za, "foo", src, ZIP_FL_OVERWRITE) < 0) {
printf("add1 failed\n");
return 1;
}
if (zip_file_set_comment(za, 0, "comment 1", (zip_uint16_t)sizeof("comment 1") - 1, 0) < 0) {
printf("set_comment1 failed\n");
return 1;
}
if (zip_close(za) < 0) {
printf("close1 failed\n");
return 1;
}
return 0;
}
```
compiling with asan (preferably with clang). on first run the zip archive is created succesfully, on second run asan crashes.
```shell
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1051894==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000038 (pc 0x71fde7f98659 bp 0x7ffcbe009dd0 sp 0x7ffcbe009568 T0)
==1051894==The signal is caused by a READ memory access.
==1051894==Hint: address points to the zero page.
#0 0x71fde7f98659 in __memcmp_avx2_movbe string/../sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S:415
#1 0x5e9d1882e82d in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/home/dcarlier/Contribs/php-src/test_zip_comment+0x4a82d) (BuildId: 18b93d3cd13501fb0df80f73db10d24b222760af)
#2 0x5e9d1882f0b0 in memcmp (/home/dcarlier/Contribs/php-src/test_zip_comment+0x4b0b0) (BuildId: 18b93d3cd13501fb0df80f73db10d24b222760af)
#3 0x71fde820a809 in zip_file_set_comment (/lib/x86_64-linux-gnu/libzip.so.5+0x7809) (BuildId: eeb2d43e1dcc0034c0a91416380c95bc2ee80388)
#4 0x5e9d188f88e9 in main /home/dcarlier/Contribs/php-src/a.c:21:9
#5 0x71fde7e2a574 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x71fde7e2a627 in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x5e9d188103a4 in _start (/home/dcarlier/Contribs/php-src/test_zip_comment+0x2c3a4) (BuildId: 18b93d3cd13501fb0df80f73db10d24b222760af)
==1051894==Register values:
rax = 0x00000000000001b8 rbx = 0x0000000000000009 rcx = 0x00006e1de67e0190 rdx = 0x0000000000000009
rdi = 0x0000000000000038 rsi = 0x00006e1de67e0190 rbp = 0x00007ffcbe009dd0 rsp = 0x00007ffcbe009568
r8 = 0x00000dc3bccfc033 r9 = 0x0000000000000002 r10 = 0xfafafafa0200fa01 r11 = 0x00000dc43ccf4033
r12 = 0x000071fde7f98360 r13 = 0xffffffffffffffc8 r14 = 0x00006e1de67e0190 r15 = 0x0000000000000038
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV string/../sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S:415 in __memcmp_avx2_movbe
==1051894==ABORTING
```
**Operating System**
Irrelevant
**Test Files**
**Additional context**
1 条评论