Bug#774016: unar: null pointer dereference on corrupted ARJ file

[Jakub Wilk]

Package: unar
Version: 1.8.1-3+b1
Usertags: afl




$ unar crash.arj
crash.arj: ARJ
 limerick  (191 B)... Segmentation fault


This bug was found using American fuzzy lop:
https://packages.debian.org/experimental/afl

-- System Information:
Debian Release: 8.0
 APT prefers unstable
 APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages unar depends on:
ii  dpkg                  1.17.22
ii  gnustep-base-runtime  1.24.7-1
ii  libbz2-1.0            1.0.6-7+b2
ii  libc6                 2.19-13
ii  libgcc1               1:4.9.2-10
ii  libgnustep-base1.24   1.24.7-1
ii  libicu52              52.1-6
ii  libobjc4              4.9.2-10
ii  libstdc++6            4.9.2-10
ii  libwavpack1           4.70.0-1
ii  zlib1g                1:1.2.8.dfsg-2+b1

--
Jakub Wilk

unar dereferences null pointer when trying to unpack the attached (slightly corrupted) ARJ file:

crash.arj
Description: Binary data