Debian Bug report logs - #803503
libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Daniel Stender <debian@danielstender.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Fri, 30 Oct 2015 20:00:41 +0100

Source: strip-nondeterminism
Version: 0.013-1
Severity: normal

I've got an error here on dh_strip_nondeterminism, it's from the buildlog
of afl/1,94b-2 (unreleased), the tried-to-processed file is
debian/afl/usr/share/doc/afl/vuln_samples/unzip-t-mem-corruption.zip [1]:

<buildlog>
   dh_strip_nondeterminism
substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 113.
Use of uninitialized value in unpack at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 113.
IO error: reading local extra field : at /usr/bin/dh_strip_nondeterminism line 87.
Can't write to /tmp/dwjyFRebW6.zip at /usr/share/perl5/Archive/Zip/Archive.pm line 440.
Archive::Zip::Archive::overwrite(Archive::Zip::Archive=HASH(0xf9eb48)) called at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 160
File::StripNondeterminism::handlers::zip::normalize("debian/afl/usr/share/doc/afl/vuln_samples/unzip-t-mem-corrupt"...) called at /usr/bin/dh_strip_nondeterminism line 87
eval {...} called at /usr/bin/dh_strip_nondeterminism line 87
</buildlog>

Note: docs/vuln_samples/ is a special collection of files triggering vulnerabilities
(the filename already says it), maybe this shows something which could be improved.

Best,
DS

[1] https://packages.debian.org/sid/amd64/afl/filelist

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 4.2.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libfile-stripnondeterminism-perl depends on:
ii  libarchive-zip-perl  1.53-1
ii  perl                 5.20.2-6

libfile-stripnondeterminism-perl recommends no packages.

libfile-stripnondeterminism-perl suggests no packages.

-- no debconf information

Message #10 received at 803503@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 803503@bugs.debian.org

Cc: Daniel Stender <debian@danielstender.com>

Subject: Re: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Sat, 03 Sep 2016 20:09:05 +0100

tags 803503 + moreinfo
thanks

Hi Daniel,

> libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Do you still see this? I can't reproduce myself, but you mention that package
is unreleased so I can't really get started…

Ideally, as strip-nondeterminism as a testsuite now, you could add it directly
there (on a branch if it is failing, or directly on master if it passes).


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #17 received at 803503@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 803503@bugs.debian.org

Cc: Daniel Stender <debian@danielstender.com>

Subject: Re: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Tue, 11 Jul 2017 19:45:07 +0100

Hi Daniel,

> > "substr outside of string at […]/handlers/zip.pm"
[..]
> Do you still see this? I can't reproduce myself, but you mention that package
> is unreleased so I can't really get started…

Ping on this? :)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb, Debian Project Leader
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #22 received at 803503@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 803503@bugs.debian.org

Cc: Daniel Stender <debian@danielstender.com>

Subject: Re: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Fri, 20 Oct 2017 14:07:15 +0100

Chris Lamb wrote:

> > Do you still see this? I can't reproduce myself, but you mention that package
> > is unreleased so I can't really get started…

Gentle ping on this? :)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #27 received at 803503@bugs.debian.org (full text, mbox, reply):

From: Daniel Stender <debian@danielstender.com>

To: 803503@bugs.debian.org

Subject: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Mon, 29 Oct 2018 23:06:26 +0100

... sorry for the delay.

Yep, still there are messages on this (2.52b-4, just let the dh helper run over the docs package):

<cut>
make[1]: Entering directory '/<<PKGBUILDDIR>>'
dh_strip_nondeterminism
        Using 1540827893 as canonical time
        Normalizing debian/afl/usr/share/doc/afl/buildinfo_amd64.gz using File::StripNondeterminism::handlers::gzip
        Using 1540827893 as canonical time
        Normalizing debian/afl-clang/usr/share/doc/afl-clang/buildinfo_amd64.gz using File::StripNondeterminism::handlers::gzip
debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/msie-zlib-dos.png: invalid length in '^@2,u' header at /usr/share/perl5/File/StripNondeterminism/handlers/png.pm line 130.
substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 155.
Use of uninitialized value in unpack at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 155.
IO error: reading local extra field :
 at /usr/bin/dh_strip_nondeterminism line 90.
Can't write to /tmp/rXEyUsKJcD.zip
 at /usr/share/perl5/Archive/Zip/Archive.pm line 439.
        Archive::Zip::Archive::overwrite(Archive::Zip::Archive=HASH(0x55800895e938)) called at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 218
        File::StripNondeterminism::handlers::zip::normalize("debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/unzip-t-mem"...) called at /usr/bin/dh_strip_nondeterminism line 90
        eval {...} called at /usr/bin/dh_strip_nondeterminism line 90
        Using 1540827893 as canonical time
        Normalizing debian/afl-doc/usr/share/afl/testcases/images/png/not_kitty_alpha.png using File::StripNondeterminism::handlers::png
        Normalizing debian/afl-doc/usr/share/afl/testcases/images/png/not_kitty.png using File::StripNondeterminism::handlers::png
        Normalizing debian/afl-doc/usr/share/afl/testcases/images/png/not_kitty_icc.png using File::StripNondeterminism::handlers::png
        Normalizing debian/afl-doc/usr/share/afl/testcases/images/png/not_kitty_gamma.png using File::StripNondeterminism::handlers::png
        Normalizing debian/afl-doc/usr/share/afl/testcases/archives/common/ar/small_archive.a using File::StripNondeterminism::handlers::ar
        Normalizing debian/afl-doc/usr/share/afl/testcases/archives/common/zip/small_archive.zip using File::StripNondeterminism::handlers::zip
        Normalizing debian/afl-doc/usr/share/afl/testcases/archives/common/gzip/small_archive.gz using File::StripNondeterminism::handlers::gzip
        Normalizing debian/afl-doc/usr/share/afl/testcases/archives/common/cpio/small_archive.cpio using File::StripNondeterminism::handlers::cpio
        Normalized debian/afl-doc/usr/share/afl/testcases/archives/common/cpio/small_archive.cpio
        Normalizing debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/msie-png-mem-leak.png using File::StripNondeterminism::handlers::png
        Normalizing debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/msie-zlib-dos.png using File::StripNondeterminism::handlers::png
        Normalizing debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/unzip-t-mem-corruption.zip using File::StripNondeterminism::handlers::zip
        Normalizing debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/lesspipe-cpio-bad-write.cpio using File::StripNondeterminism::handlers::cpio
        Normalized debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/lesspipe-cpio-bad-write.cpio
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
</cut>

However, like said, the vuln_samples shipped by this package might contain non standard files, so you might
close this bug report if this occurrence doesn't matter.

DS

-- 
4096R/DF5182C8 (stender@debian.org)
http://www.danielstender.com/

Message #32 received at 803503@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Daniel Stender <debian@danielstender.com>, 803503@bugs.debian.org

Subject: Re: Bug#803503: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Tue, 30 Oct 2018 01:15:58 -0400

[Message part 1 (text/plain, inline)]

Hi Daniel,

> Yep, still there are messages on this (2.52b-4, just let the dh helper 
> run over the docs package):

So, why you `-Nafl-doc` instead of letting it print the warning
messages…?

Or, rather, are we corrupting the .png file here...? If not, we can
just silence this warning to close this issue, no? We can't trust
this header anyway...

Anyway, can confirm this and I am attaching the
docs/vuln_samples/msie-zlib-dos.png file for posterity:

   dh_strip_nondeterminism
	Using 1540845961 as canonical time
        […]
debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/msie-zlib-dos.png: invalid length in '2,u' header at /usr/share/perl5/File/StripNondeterminism/handlers/png.pm line 130.
substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 155.
Use of uninitialized value in unpack at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 155.
IO error: reading local extra field :  
 at /usr/bin/dh_strip_nondeterminism line 90.
Can't write to /tmp/rHhftxVN2q.zip 
 at /usr/share/perl5/Archive/Zip/Archive.pm line 439.
	Archive::Zip::Archive::overwrite(Archive::Zip::Archive=HASH(0x55d6b2580c40)) called at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm line 218
	File::StripNondeterminism::handlers::zip::normalize("debian/afl-doc/usr/share/doc/afl-doc/vuln_samples/unzip-t-mem"...) called at /usr/bin/dh_strip_nondeterminism line 90
	eval {...} called at /usr/bin/dh_strip_nondeterminism line 90
        […]

As an aside, this made me check:

  https://codesearch.debian.net/search?q=override_dh_strip_nondeterminism&perpkg=1 

:)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

[msie-zlib-dos.png (image/png, attachment)]

Message #37 received at 803503@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Daniel Stender <debian@danielstender.com>, 803503@bugs.debian.org

Subject: Re: Bug#803503: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Fri, 02 Nov 2018 04:42:03 -0400

Chris Lamb wrote:

> > Yep, still there are messages on this (2.52b-4, just let the dh helper 
> > run over the docs package):
> 
> So, why you `-Nafl-doc` instead of letting it print the warning
> messages…?
> 
> Or, rather, are we corrupting the .png file here...? If not, we can
> just silence this warning to close this issue, no? We can't trust
> this header anyway...

Gentle ping on this?

As I mention, we are detecting this case, so the only real fix
would be to not print such warnings or this is not a bug in the
first place.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #42 received at 803503@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 803503@bugs.debian.org, Daniel Stender <debian@danielstender.com>

Subject: Re: Bug#803503: libfile-stripnondeterminism-perl: substr outside of string at /usr/share/perl5/File/StripNondeterminism/handlers/zip.pm

Date: Fri, 09 Nov 2018 11:01:42 -0500

tags 803503 + pending
thanks

Chris Lamb wrote:

> As I mention, we are detecting this case, so the only real fix
> would be to not print such warnings or this is not a bug in the
> first place.

I sincerely apologise for this but actually we weren't detecting
that case. I was getting confused by some of the output. And to
think I was about to close this as wontfix...

Anyway, to clarify, we are already handling the .png case (msie-
zlib-dos.png) but not the .zip case (unzip-t-mem-corruption.zip).

However, I have now fixed this in Git, pending upload:

  https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/e5f5008eef0dbff52a5855c1c06bf729236a6684

  lib/File/StripNondeterminism/handlers/zip.pm |  25 +++++++++++++------------
  t/fixtures/zip/bug_803503.zip.in             | Bin 0 -> 344 bytes
  t/fixtures/zip/bug_803503.zip.out            |   1 +
  3 files changed, 14 insertions(+), 12 deletions(-)

Thanks again for your patience.


Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #49 received at 803503-close@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 803503-close@bugs.debian.org

Subject: Bug#803503: fixed in strip-nondeterminism 0.45.0-1

Date: Sun, 11 Nov 2018 16:49:58 +0000

Source: strip-nondeterminism
Source-Version: 0.45.0-1

We believe that the bug you reported is fixed in the latest version of
strip-nondeterminism, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 803503@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated strip-nondeterminism package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 11 Nov 2018 17:42:30 +0100
Source: strip-nondeterminism
Binary: libfile-stripnondeterminism-perl strip-nondeterminism dh-strip-nondeterminism
Architecture: source all
Version: 0.45.0-1
Distribution: unstable
Urgency: medium
Maintainer: Reproducible builds folks <reproducible-builds@lists.alioth.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description:
 dh-strip-nondeterminism - file non-deterministic information stripper — Debhelper add-on
 libfile-stripnondeterminism-perl - file non-deterministic information stripper — Perl module
 strip-nondeterminism - file non-deterministic information stripper — stand-alone tool
Closes: 803503
Changes:
 strip-nondeterminism (0.45.0-1) unstable; urgency=medium
 .
   * Move to SemVer <https://semver.org/> versioning scheme.
   * Catch invalid ZIP "local" field lengths; we were previously inherently
     blindly the value supplied in the ZIP file. Thanks to Daniel Stender for
     the report. (Closes: #803503)
Checksums-Sha1:
 9428438784982f59ccf71d9c5089500fce9b98e4 2540 strip-nondeterminism_0.45.0-1.dsc
 392e1fb602fad7abac0c43d4615d454f183691b6 224058 strip-nondeterminism_0.45.0.orig.tar.bz2
 8a9fb385cc81b753878d8fdc1778e54690afc1d9 30764 strip-nondeterminism_0.45.0-1.debian.tar.xz
 bb5cb13b6d3fca4b841d7feff7b3f9733f844c89 12444 dh-strip-nondeterminism_0.45.0-1_all.deb
 b6851cc9e42f4977ecec84b129cc39bfb1101f00 20512 libfile-stripnondeterminism-perl_0.45.0-1_all.deb
 57f5ef38c93930f5beff9d86678ba84b928fb713 12704 strip-nondeterminism_0.45.0-1_all.deb
 23b6f3ee9f798de8dafe13ccede690b7181210aa 6464 strip-nondeterminism_0.45.0-1_amd64.buildinfo
Checksums-Sha256:
 4a9b9ee3570aeceece423d38944edd674f85a94ca7acb9aa40df0cf931b73b7f 2540 strip-nondeterminism_0.45.0-1.dsc
 7c29bff8be0efa6d155d23469c13cc96336406bff1dee58d521f9e8037c868ca 224058 strip-nondeterminism_0.45.0.orig.tar.bz2
 823c61fa7e555c45acf854721850845cbbfc64233d754ebdf6ce8b8aa90ecdcd 30764 strip-nondeterminism_0.45.0-1.debian.tar.xz
 5a503a160a39835c5ead95aa8b8d9192cfd3e0454ef1c29c08b31409230f4687 12444 dh-strip-nondeterminism_0.45.0-1_all.deb
 25ce999117b69610cd5f201ef3b1dd73efaf7484b6105d67579c303693dd350a 20512 libfile-stripnondeterminism-perl_0.45.0-1_all.deb
 394de2c4b0a4f189c185729e673f6d8bed54470593defc86535c2b33a831af9f 12704 strip-nondeterminism_0.45.0-1_all.deb
 ea0ef93b61d1dec8cb90e7245b440d1d1f8a71428b32df6d991b8ba7f8dd1e38 6464 strip-nondeterminism_0.45.0-1_amd64.buildinfo
Files:
 173142e8687e56787c8e343864d8f46b 2540 devel optional strip-nondeterminism_0.45.0-1.dsc
 e9249e2975c8408e5320e60ba8bd8f30 224058 devel optional strip-nondeterminism_0.45.0.orig.tar.bz2
 f311783a473b8fd38a98f1fc95ab4dd9 30764 devel optional strip-nondeterminism_0.45.0-1.debian.tar.xz
 9bf7300269e07c4b4f7984808a181259 12444 devel optional dh-strip-nondeterminism_0.45.0-1_all.deb
 e37781d290e69b5d09933e9765970daf 20512 perl optional libfile-stripnondeterminism-perl_0.45.0-1_all.deb
 e14a4dc4f297e0110583e8ecc693629a 12704 devel optional strip-nondeterminism_0.45.0-1_all.deb
 31422d98b430e7313eba1dd83a3403c4 6464 devel optional strip-nondeterminism_0.45.0-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAlvoXFcACgkQHpU+J9Qx
HliFUQ/+OJDkvYIl6urhmWUXv4LBMwHxVreEdOQn/ofK5KCJnkfX9Er9ETgRRihj
SekboVj9UmnndxL6z5U+6+Jn0rLhpEsaarxb7tSfrEBUVvnXKSpEOZ6pnFzS8CKV
jA+e0dU2a9Z2aXlpYBQCtn/7eB8T+liavhRkZfi5HecGv6rkA8efj0jxviMAJOvB
8wC5I2M7NIe4el4R2CE/qsTkFDOaeRypqkWnlsa5zD4YOxyRxwGyqQjuNRK4a7wS
MixI5qmrZcUbsTy8emr3fdhs1OpRiWOSBglJA9+uXJZLX7vVUldf0HcgvITkD5Rg
VKOAKG7y9HXwH9Y+6hmAK57iF7UAXLzuTOPF/Td/Xo1j6kAqBBWwoiITolLIth3o
Tk+CkYz2MdhRdrnNEoTTV/l03JY0u+CELPHJuIhL9Ji2y/UHhgeDOp8WSh8HBvKi
aUVLNmDWbHmQTcv59CyzcDky6RRqy9/3uU8UYLhrrULJVXvZHk/WiljDY8keUOYK
WzJ6q78Cko+Cus/spIm72/cnj6Nl6Zn1nRGmJI8tcmo3bO/o23Tn9OtfCv6dyC6s
+bGPZVSttriSb8UGNfrCQcQY6w3qknQsjfd46mYsEynt4p0/SBWClSXZ4SMGgikx
HVMawWSPu+qXW7lhOtIrlP7sESpoDlPpL7P9N1jkNuN7r83Voe4=
=lwu4
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.