10140 2016-08-15 02:28:36 +0000 The output is strange when using unzip to extract zip file 2016-09-09 16:04:21 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.2 x86 Multiple VERIFIED DUPLICATE 9551 Medium+ normal 2.2 M3 1 yi.zhao edwin.plauchu.camacho benjamin.esquivel edwin.plauchu.camacho jose.perez.carranza meta.mr.watcher meta.watcher sgw yi.zhao --- Regression (Used to work) No (bug/feature does not impact docs) oldest_to_newest 65179 0 3355 yi.zhao 2016-08-15 02:28:36 +0000 Created attachment 3355 zip file for testing Git rev: master/e274a5167ea2e495355bd1382b1388d047b845d7 When using unzip to extract a zip file, the output is very strange: ######################################### # unzip tst_unzip_file.zip Archive: %s creating: tst_unzip.dir/ creating: tst_unzip.dir/d.0/ %8sing: %-22s %s%s %8sing: %-22s %s%s creating: tst_unzip.dir/d.0/d.1/ %8sing: %-22s %s%s %8sing: %-22s %s%s %8sing: %-22s %s%s creating: tst_unzip.dir/d.0/d.1/d.2/ %8sing: %-22s %s%s %8sing: %-22s %s%s %8sing: %-22s %s%s %8sing: %-22s %s%s ######################################### I did a quick check and found this issue was introduced by the following commit: commit 763a3d424bccf559a8d6add3dc1f2746c82f2933 Author: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Date: Fri May 27 15:29:21 2016 -0500 unzip: fix security issues This patch avoids unzip fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9551] (From OE-Core rev: 2dd1c02fbc7492002df9030f50710e242369e8b2) After I revert this patch, the output looks correct: ######################################### # unzip tst_unzip_file.zip Archive: tst_unzip_file.zip creating: tst_unzip.dir/ creating: tst_unzip.dir/d.0/ extracting: tst_unzip.dir/d.0/f.2 extracting: tst_unzip.dir/d.0/f.1 creating: tst_unzip.dir/d.0/d.1/ extracting: tst_unzip.dir/d.0/d.1/f.2 extracting: tst_unzip.dir/d.0/d.1/f.1 extracting: tst_unzip.dir/d.0/d.1/f.0 creating: tst_unzip.dir/d.0/d.1/d.2/ extracting: tst_unzip.dir/d.0/d.1/d.2/f.2 extracting: tst_unzip.dir/d.0/d.1/d.2/f.1 extracting: tst_unzip.dir/d.0/d.1/d.2/f.0 extracting: tst_unzip.dir/d.0/f.0 ######################################### The zip file for testing is attached. 65184 1 ross.burton 2016-08-15 09:35:29 +0000 Jussi, can team FI fix the broken security fix? 65259 2 jku 2016-08-17 08:07:50 +0000 Wow, the unzip macros are truly special... but I don't think the approach can be made to work: +-# define LoadFarString(x) (char *)(x) ++# define LoadFarString(x) "%s",(char *)(x) LoadFarString is used in 1500 locations, most of them in situations where the sprintf format string is already used. Example: Info(slide, 0x201, ((char *)slide, LoadFarString(SymLnkWarnInvalid), FnFilter1(linkfname))) with this Info implementation define Info(buf,flag,sprf_arg) fputs((char *)(sprintf sprf_arg, (buf)), stdout); ends up calling sprintf like this: sprintf ((char *)slide, LoadFarString(SymLnkWarnInvalid), FnFilter1(linkfname)) Changing LoadFarSting() definition like in the patch will end up printing literal "%s" as filename. 65302 3 benjamin.esquivel 2016-08-18 15:11:42 +0000 bug 9551 got reopened to fix this problem. *** This bug has been marked as a duplicate of bug 9551 *** 66007 4 jose.perez.carranza 2016-09-09 16:04:21 +0000 verified as duplicate 3355 2016-08-15 02:28:36 +0000 2016-08-15 02:28:36 +0000 zip file for testing tst_unzip_file.zip application/zip 2296 yi.zhao UEsDBAoAAAAAAI9VDEkAAAAAAAAAAAAAAAAOABwAdHN0X3VuemlwLmRpci9VVAkAAw04rVcNOK1X dXgLAAEEAAAAAAQAAAAAUEsDBAoAAAAAAI9VDEkAAAAAAAAAAAAAAAASABwAdHN0X3VuemlwLmRp ci9kLjAvVVQJAAMNOK1XDTitV3V4CwABBAAAAAAEAAAAAFBLAwQKAAAAAACPVQxJAAAAAAAAAAAA AAAAFQAcAHRzdF91bnppcC5kaXIvZC4wL2YuMlVUCQADDTitVw04rVd1eAsAAQQAAAAABAAAAABQ SwMECgAAAAAAj1UMSQAAAAAAAAAAAAAAABUAHAB0c3RfdW56aXAuZGlyL2QuMC9mLjFVVAkAAw04 rVcNOK1XdXgLAAEEAAAAAAQAAAAAUEsDBAoAAAAAAI9VDEkAAAAAAAAAAAAAAAAWABwAdHN0X3Vu emlwLmRpci9kLjAvZC4xL1VUCQADDTitVw04rVd1eAsAAQQAAAAABAAAAABQSwMECgAAAAAAj1UM SQAAAAAAAAAAAAAAABkAHAB0c3RfdW56aXAuZGlyL2QuMC9kLjEvZi4yVVQJAAMNOK1XDTitV3V4 CwABBAAAAAAEAAAAAFBLAwQKAAAAAACPVQxJAAAAAAAAAAAAAAAAGQAcAHRzdF91bnppcC5kaXIv ZC4wL2QuMS9mLjFVVAkAAw04rVcNOK1XdXgLAAEEAAAAAAQAAAAAUEsDBAoAAAAAAI9VDEkAAAAA AAAAAAAAAAAZABwAdHN0X3VuemlwLmRpci9kLjAvZC4xL2YuMFVUCQADDTitVw04rVd1eAsAAQQA AAAABAAAAABQSwMECgAAAAAAj1UMSQAAAAAAAAAAAAAAABoAHAB0c3RfdW56aXAuZGlyL2QuMC9k LjEvZC4yL1VUCQADDTitVw04rVd1eAsAAQQAAAAABAAAAABQSwMECgAAAAAAj1UMSQAAAAAAAAAA AAAAAB0AHAB0c3RfdW56aXAuZGlyL2QuMC9kLjEvZC4yL2YuMlVUCQADDTitVw04rVd1eAsAAQQA AAAABAAAAABQSwMECgAAAAAAj1UMSQAAAAAAAAAAAAAAAB0AHAB0c3RfdW56aXAuZGlyL2QuMC9k LjEvZC4yL2YuMVVUCQADDTitVw04rVd1eAsAAQQAAAAABAAAAABQSwMECgAAAAAAj1UMSQAAAAAA AAAAAAAAAB0AHAB0c3RfdW56aXAuZGlyL2QuMC9kLjEvZC4yL2YuMFVUCQADDTitVw04rVd1eAsA AQQAAAAABAAAAABQSwMECgAAAAAAj1UMSQAAAAAAAAAAAAAAABUAHAB0c3RfdW56aXAuZGlyL2Qu MC9mLjBVVAkAAw04rVcNOK1XdXgLAAEEAAAAAAQAAAAAUEsBAh4DCgAAAAAAj1UMSQAAAAAAAAAA AAAAAA4AGAAAAAAAAAAQAO1BAAAAAHRzdF91bnppcC5kaXIvVVQFAAMNOK1XdXgLAAEEAAAAAAQA AAAAUEsBAh4DCgAAAAAAj1UMSQAAAAAAAAAAAAAAABIAGAAAAAAAAAAQAO1BSAAAAHRzdF91bnpp cC5kaXIvZC4wL1VUBQADDTitV3V4CwABBAAAAAAEAAAAAFBLAQIeAwoAAAAAAI9VDEkAAAAAAAAA AAAAAAAVABgAAAAAAAAAAACkgZQAAAB0c3RfdW56aXAuZGlyL2QuMC9mLjJVVAUAAw04rVd1eAsA AQQAAAAABAAAAABQSwECHgMKAAAAAACPVQxJAAAAAAAAAAAAAAAAFQAYAAAAAAAAAAAApIHjAAAA dHN0X3VuemlwLmRpci9kLjAvZi4xVVQFAAMNOK1XdXgLAAEEAAAAAAQAAAAAUEsBAh4DCgAAAAAA j1UMSQAAAAAAAAAAAAAAABYAGAAAAAAAAAAQAO1BMgEAAHRzdF91bnppcC5kaXIvZC4wL2QuMS9V VAUAAw04rVd1eAsAAQQAAAAABAAAAABQSwECHgMKAAAAAACPVQxJAAAAAAAAAAAAAAAAGQAYAAAA AAAAAAAApIGCAQAAdHN0X3VuemlwLmRpci9kLjAvZC4xL2YuMlVUBQADDTitV3V4CwABBAAAAAAE AAAAAFBLAQIeAwoAAAAAAI9VDEkAAAAAAAAAAAAAAAAZABgAAAAAAAAAAACkgdUBAAB0c3RfdW56 aXAuZGlyL2QuMC9kLjEvZi4xVVQFAAMNOK1XdXgLAAEEAAAAAAQAAAAAUEsBAh4DCgAAAAAAj1UM SQAAAAAAAAAAAAAAABkAGAAAAAAAAAAAAKSBKAIAAHRzdF91bnppcC5kaXIvZC4wL2QuMS9mLjBV VAUAAw04rVd1eAsAAQQAAAAABAAAAABQSwECHgMKAAAAAACPVQxJAAAAAAAAAAAAAAAAGgAYAAAA AAAAABAA7UF7AgAAdHN0X3VuemlwLmRpci9kLjAvZC4xL2QuMi9VVAUAAw04rVd1eAsAAQQAAAAA BAAAAABQSwECHgMKAAAAAACPVQxJAAAAAAAAAAAAAAAAHQAYAAAAAAAAAAAApIHPAgAAdHN0X3Vu emlwLmRpci9kLjAvZC4xL2QuMi9mLjJVVAUAAw04rVd1eAsAAQQAAAAABAAAAABQSwECHgMKAAAA AACPVQxJAAAAAAAAAAAAAAAAHQAYAAAAAAAAAAAApIEmAwAAdHN0X3VuemlwLmRpci9kLjAvZC4x L2QuMi9mLjFVVAUAAw04rVd1eAsAAQQAAAAABAAAAABQSwECHgMKAAAAAACPVQxJAAAAAAAAAAAA AAAAHQAYAAAAAAAAAAAApIF9AwAAdHN0X3VuemlwLmRpci9kLjAvZC4xL2QuMi9mLjBVVAUAAw04 rVd1eAsAAQQAAAAABAAAAABQSwECHgMKAAAAAACPVQxJAAAAAAAAAAAAAAAAFQAYAAAAAAAAAAAA pIHUAwAAdHN0X3VuemlwLmRpci9kLjAvZi4wVVQFAAMNOK1XdXgLAAEEAAAAAAQAAAAAUEsFBgAA AAANAA0AvwQAACMEAAAAAA==