Crash in wxZipInputStream Topic is solved

[ttn]

Hi.

I have a zip file, which is corrupted in some way (it is attached). It can be un-zipped via Windows Explorer, but a "zip -T" on Ubuntu
results in a report that the file is corrupt. That is OK.

My problem is that it results in a crash in wxZipInputStream::OpenEntry(...). I would have expected it to report a fail
or something instead.

Here is a snippet of code showing the problem:

Code: Select all

  wxFileInputStream* inputStream = new wxFileInputStream("C:\\tmp\\EjectInsert.Xcyto10.zip");
  wxZipInputStream*  zipStream   = new wxZipInputStream(*inputStream);
  bool ok = zipStream->IsOk();
  wxZipEntry* pNext = zipStream->GetNextEntry();

  if (ok && pNext!=NULL && zipStream->OpenEntry(*pNext))   // <--- crash in OpenEntry(...)
  {
    // More stuff
  }

The crash occurs in the memcpy of wxZipHeader:

Code: Select all

wxZipHeader::wxZipHeader(const char* data, size_t size)
  : m_size(size),
    m_pos(0),
    m_ok(true)
{
    wxCHECK_RET(size <= sizeof(m_data), wxT("buffer too small"));
    memcpy(m_data, data, size);   // <--- m_data is not large enough, is not allocated or a stray pointer?
}

It is as such OK that it can not open the zip entry, but it should return e.g. false (but not crash). I see no other way of more checking
before calling OpenEntry, so I can not do any test and avoid the crash.

Message from Visual Studio when crash occurs:

Code: Select all

Exception thrown at 0x00007FFE4671172B (vcruntime140d.dll) in RoadRunner.exe: 0xC0000005: Access violation reading location 0x00000201736FCC11.

My setup is:
Windows 10 64-bit
Visual Studio Professional 2015 (all code compiled as 64 bit).
wxWidgets 3.1.0


Attached zip file is not zipped using wxWidgets - coming from un-controlled source

/Torben

[DavidHart]

Hi,

I get the same error message with 'zip -T', though (debian's) 'unzip' succeeds.

My wxGTK program, 4Pane, can read and manipulate zip files and copes with your one without a problem. It reads into a memory buffer, first using a wxStreamBuffer.

Code: Select all

wxFFileInputStream in(filepath);
wxStreamBuffer streambuf((wxInputStream&)in, wxStreamBuffer::read);
size_t size = in.GetSize();

// It's ugly, but the easiest way I've found to get the data from the streambuffer to a memorybuffer
// is by using an intermediate char[]
delete m_membuf;
m_membuf = new wxMemoryBuffer(size);
m_membuf->AppendData(buf, size);
delete[] buf;

// When you want to use the data:
wxZipEntryPtr entry;
wxMemoryInputStream meminstream(m_membuf->GetData(), m_membuf->GetDataLen());
wxZipInputStream zip(meminstream);
...

It might be worth altering your code to use an intermediate buffer of some sort.

Regards,

David

[ttn]

Hi David.

I tried like you to read the whole zip file into a memory buffer (and actually also making the memory buffer much larger
than needed).

It did not change anything.

Note: It does not always fail. At my PC it typically has failed every second attempt. But I have experienced it only
failed after almost 10 attempts. So I think it depends on how the actual memory allocation around the m_data pointer is
in class wxZipHeader (it also depends on my code and your code).

But thanks for the input; I could easily have lived with that if it worked.

/Torben.

[ONEEYEMAN]

Hi,
Can you compile and try David's code "as is"?

Thank you.

[DavidHart]

I see what you mean. It just crashed for me on attempt 9. I can't think of a solution in user-code either, but if you do find one please post it here!

Ideally it should be fixed in wxZipInputStream and I suggest you report the bug on trac, attaching the faulty zip.

[ttn]

Trying to register at the https://trac.wxwidgets.org link, but it does not seem to be easy.

First my suggested username ttn was rejected, then it started claiming that my password was empty (it did clear the password field
itself).

Now I think I am banned due to 3 or more attempts to register

I will have to try again later.

/Torben

[ONEEYEMAN]

Hi,
You could try to send an email to wx-dev, asking to pull the ban due to registration problem explaining the situation.
Also explain that you were trying to register to submit a ticket referencing this thread.

Thank you.

[ttn]

Tried to send an E-mail to [email protected]

Got the message:
We're writing to let you know that the group you tried to contact (wx-dev) may not exist, or you may not have permission to post messages to the group. A few more details on why you weren't able to post: ...


I actually succeed last evening back home to register with user name trindkaer; but I never got the E-mail with the needed
token to confirm my E-mail address (though tried several re-send af E-mail etc.)

I am giving up - sorry

The wxWidgets forum here is superb, but the tickets system

[ONEEYEMAN]

Hi,
Sending an e-mail to the wx-dev ML requires registration.
Just send an e-mail to [email protected] and then re-send you original after successful registration.

About a week ago there was an issue with someone else registration email to trac.
Please don't give up. It is 1-time only registration after all and if you continue working with the library it will help you in the future.

Thank you.

[ttn]

Ticket has been made:

https://trac.wxwidgets.org/ticket/17947

[PB]

Just for the future reference, the issue is fixed (in the master branch only so far): https://github.com/wxWidgets/wxWidgets/ ... 91685e38ae