Bug 252930 – www-client/httrack bundles code from unzip

• Status: RESOLVED INVALID
• Product: Gentoo Linux

[Description Diego Elio Pettenò (RETIRED) 2008-12-29 01:50:16 UTC]

Might be vulnerable to GLSA 200804-06?

[Comment 1 Gef 2010-05-29 11:54:19 UTC]

From ${WORKDIR}/httrack-3.43.7/src/minizip/ChangeLogUnzip:
---8<---------8<---------8<---------8<---------8<---------8<------
Change in 1.00: (10 sept 03)
- rename to 1.00
- cosmetic code change
---8<---------8<---------8<---------8<---------8<---------8<------

This stuff is really old, but doesn't seem to share anything with unzip codebase; it uses zlib to implement unzip'ing capabilities.

[Comment 2 Gef 2010-05-29 12:04:13 UTC]

Silly me:

--8<----8<----8<----8<----8<--
/* Decryption code comes from crypt.c by Info-ZIP but has been greatly reduced in terms of
compatibility with older software. The following is from the original crypt.c. Code
woven in by Terry Thorsen 1/2003.
*/
/*
  Copyright (c) 1990-2000 Info-ZIP.  All rights reserved.

[Comment 3 Pacho Ramos 2012-02-11 14:26:45 UTC]

This should probably be reported to upstream

[Comment 4 Xavier Roche 2012-02-11 15:29:39 UTC]

I do not think there is a vulnerability there ; the real compression/decompression is done through the system's zlib, not in this code.

The unzip.c source in src/minizip is only a frontend to handle zip files (ie. get the entry in the central directory, and pipe the compressed data to zlib routines).

[Comment 5 Pacho Ramos 2012-02-14 09:34:12 UTC]

I am not sure if we would need to unbundle it then

[Comment 6 Xavier Roche 2012-02-14 17:49:57 UTC]

No, there is no bug here. Can be closed safely.

[Comment 7 Pacho Ramos 2012-02-15 11:37:16 UTC]

Thanks for feedback