DOS ain't dead - CRITICAL OFF-by-32-KiB-BUG

CRITICAL OFF-by-32-KiB-BUG (Users)

posted by DOS386, 27.03.2013, 09:10

There is an "interesting" random BUG occurring rarely (maybe cca 1% per 100 MiB processed) when decompressing encrypted 7-ZIP archives. In the output file, a 4 MiB block is off by 32 KiB like this:

POSITION GOOD BAD -------- ---- --- x - 12 MiB meh999(32 KiB) meh999(32 KiB) (OK, but see below) x - 32 KiB meh888(32 KiB) meh888(32 KiB) (OK) x (16 MiB aligned) meh0(32 KiB) meh1(32 KiB) (lost 32 KiB block !!!) x + 32 KiB meh1(32 KiB) meh2(32 KiB) (off by 32 KiB) x + 64 KiB meh2(32 KiB) meh3(32 KiB) (off by 32 KiB) ... ... ... ... x + 4 MiB - 64 KiB meh126(32 KiB) meh127(32 KiB) (off by 32 KiB) x + 4 MiB - 32 KiB meh127(32 KiB) meh999(32 KiB) (repeating old stuff !!!) x + 4 MiB meh777(32 KiB) meh777(32 KiB) (OK)

Actually it's the same BUG I had already reported some 1'000'000's years ago and suspected it to be a FreeDOS BUG. Recently I could reproduce it 2 more times with EDR-DOS and 7-ZIP 9.20, so

- The good news is that it is NOT a FreeDOS BUG :-)

- The malicious news is that there is a critical BUG in 7-ZIP or HX :-(

Maybe it's related to the other random 7-ZIP rarely occurring (with same probability?) BUG during creation of encrypted 7-ZIP archives raising a Page Fault in Ring0.

7-ZIP brews a broken output file and boasts "Everything os OK". So either the CRC32 check is broken ("condition is always true", of course the bad file has a bad CRC32 too) or the BUG occurs "between" the CRC32 check and writing the data into the filesystem (note: cluster size was 4 KiB, not 32 KiB). But extracting again the very same way gives a good file.

It's unknown whether the BUG also occurs:

- If the archive isn't encrypted
- In Windaube
- With all those DGJPP ports of 7-ZIP (or at least those that do run at all)

---
This is a LOGITECH mouse driver, but some software expect here
the following string:*** This is Copyright 1983 Microsoft ***

Post reply

Complete thread:

CRITICAL OFF-by-32-KiB-BUG - DOS386, 27.03.2013, 09:10 (Users)
- CRITICAL OFF-by-32-KiB-BUG - RayeR, 28.03.2013, 02:16
  - CRITICAL OFF-by-32-KiB-BUG - DOS386, 29.03.2013, 09:26
    - CRITICAL OFF-by-32-KiB-BUG - RayeR, 29.03.2013, 11:02
      - CRITICAL OFF-by-32-KiB-BUG - DOS386, 29.03.2013, 11:19
        CRITICAL OFF-by-32-KiB-BUG (threads) - DOS386, 31.03.2013, 17:42
        CRITICAL OFF-by-32-KiB-BUG (threads) - RayeR, 03.04.2013, 12:35
        CRITICAL OFF-by-32-KiB-BUG (threads) - Zyzzle, 04.04.2013, 04:17
        CRITICAL OFF-by-32-KiB-BUG (threads) - RayeR, 04.04.2013, 13:51
        CRITICAL OFF-by-32-KiB-BUG (threads) - DOS386, 04.04.2013, 04:37
- CRITICAL OFF-by-32-KiB-BUG - Rugxulo, 05.04.2013, 19:15
  - CRITICAL OFF-by-32-KiB-BUG | Eric | LZMA2 - DOS386, 10.04.2013, 12:00