Unrar 0.0.1 Memory Corruption

[Rio Sherri <rio.sherri () fshnstudent info>]

# Title : Unrar 0.0.1 Memory Corruption
# Date : 05/09/2016
# Author : R-73eN
# Tested on : Linux VM 2.6.38-8-generic #42-Ubuntu SMP Mon Apr 11 03:31:50
UTC 2011 i686 i686 i386 GNU/Linux
# Software : https://github.com/defiant-labs/unrar-free

root@VM:~/unrar-free/src# unrar --version
unrar 0.0.1
root@VM:~/unrar-free/src# gdb --args ./unrar ~/test.rar
GNU gdb (Ubuntu/Linaro 7.2-1ubuntu11) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html
>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /root/unrar-free/src/unrar...done.
(gdb) run
Starting program: /root/unrar-free/src/unrar /root/test.rar

unrar 0.0.1  Copyright (C) 2004  Ben Asselstine, Jeroen Dekkers


Extracting from /root/test.rar


Program received signal SIGSEGV, Segmentation fault.
0x08050e2e in DecodeNumber (Deco=0x8066c20) at unrarlib.c:1653
1653  if (N < Deco->DecodeLen[8])


The document that crashes the unrar is attached.

Attachment: unrar vulnerability.txt
Description:

Attachment: crash.rar
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/