Opened 6 months ago

Closed 6 months ago

#60396 closed defect (fixed)

unzip @6.0_3 erroneously detects a possible zip bomb

Reported by: udbraumann Owned by: gfiumara (Greg Fiumara)
Priority: Normal Milestone:
Component: ports Version:
Keywords: Cc:
Port: unzip

Description (last modified by udbraumann)

While upgrading R from 3.6.1_0 to 3.6.3_1 on my 10.5.8 PPC building stopped quite early:

...
:info:build make[2]: Entering directory `/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_math_R/R/work/R-3.6.3/share'
:info:build error: invalid zip file with overlapped components (possible zip bomb)
:info:build make[2]: *** [install-zoneinfo] Error 12
...

Looking a bit more into the details, I found that the only zip file inside the build folder is zoneinfo.zip residing inside /opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_math_R/R/work/R-3.6.3/src/extra/tzone.

Then, I checked what unzip I am regularly using:

$ which unzip
/opt/local/bin/unzip

I also made sure that this MacPort version is being used during R build and found

...
:info:configure checking for unzip... /opt/local/bin/unzip
...

Also, I checked what version is being installed:

$ sudo port installed unzip
The following ports are currently installed:
  unzip @6.0_2
  unzip @6.0_3 (active)

Then I put zoneinfo.zip into a separate folder to study what is so special here:

$ unzip zoneinfo.zip
Archive:  zoneinfo.zip
error: invalid zip file with overlapped components (possible zip bomb)

That indeed was the same message as above. But what about testing with unzip @6.0_2:

$ sudo port activate unzip@6.0_2
--->  Deactivating unzip @6.0_3
--->  Cleaning unzip
--->  Activating unzip @6.0_2
--->  Cleaning unzip 

And now once again with unzip @6.0_2:

$ unzip zoneinfo.zip
Archive:  zoneinfo.zip
   creating: zoneinfo/
  inflating: zoneinfo/Egypt
   creating: zoneinfo/Australia/
  inflating: zoneinfo/Australia/Currie
  inflating: zoneinfo/Australia/North
  inflating: zoneinfo/Australia/Yancowinna
  inflating: zoneinfo/Australia/Queensland
  inflating: zoneinfo/Australia/Brisbane
  inflating: zoneinfo/Australia/Melbourne
  inflating: zoneinfo/Australia/Eucla
  inflating: zoneinfo/Australia/Tasmania
  inflating: zoneinfo/Australia/Lindeman
  inflating: zoneinfo/Australia/Broken_Hill
  inflating: zoneinfo/Australia/Victoria
  inflating: zoneinfo/Australia/ACT
  inflating: zoneinfo/Australia/Canberra
  inflating: zoneinfo/Australia/Adelaide
  inflating: zoneinfo/Australia/Darwin
  inflating: zoneinfo/Australia/Lord_Howe
  inflating: zoneinfo/Australia/LHI
  inflating: zoneinfo/Australia/South
  inflating: zoneinfo/Australia/Sydney
  inflating: zoneinfo/Australia/Perth
  inflating: zoneinfo/Australia/West
  inflating: zoneinfo/Australia/NSW
  inflating: zoneinfo/Australia/Hobart
  inflating: zoneinfo/UCT
  inflating: zoneinfo/CET
   creating: zoneinfo/Europe/
  inflating: zoneinfo/Europe/Tirane
  inflating: zoneinfo/Europe/London
  inflating: zoneinfo/Europe/Zagreb
  inflating: zoneinfo/Europe/Ljubljana
  inflating: zoneinfo/Europe/Nicosia
  inflating: zoneinfo/Europe/Helsinki
  inflating: zoneinfo/Europe/Stockholm
  inflating: zoneinfo/Europe/Gibraltar
  inflating: zoneinfo/Europe/Sofia
  inflating: zoneinfo/Europe/Bucharest
  inflating: zoneinfo/Europe/Kirov
  inflating: zoneinfo/Europe/Jersey
  inflating: zoneinfo/Europe/Vilnius
  inflating: zoneinfo/Europe/Podgorica
  inflating: zoneinfo/Europe/Astrakhan
  inflating: zoneinfo/Europe/Minsk
  inflating: zoneinfo/Europe/Mariehamn
  inflating: zoneinfo/Europe/Zaporozhye
  inflating: zoneinfo/Europe/Brussels
  inflating: zoneinfo/Europe/Isle_of_Man
  inflating: zoneinfo/Europe/Vaduz
  inflating: zoneinfo/Europe/Athens
  inflating: zoneinfo/Europe/Volgograd
  inflating: zoneinfo/Europe/Ulyanovsk
  inflating: zoneinfo/Europe/Samara
  inflating: zoneinfo/Europe/Istanbul
  inflating: zoneinfo/Europe/Copenhagen
  inflating: zoneinfo/Europe/Guernsey
  inflating: zoneinfo/Europe/Belfast
  inflating: zoneinfo/Europe/Saratov
  inflating: zoneinfo/Europe/Rome
  inflating: zoneinfo/Europe/Monaco
  inflating: zoneinfo/Europe/Paris
  inflating: zoneinfo/Europe/Moscow
  inflating: zoneinfo/Europe/Vatican
  inflating: zoneinfo/Europe/Warsaw
  inflating: zoneinfo/Europe/Malta
  inflating: zoneinfo/Europe/Amsterdam
  inflating: zoneinfo/Europe/Simferopol
  inflating: zoneinfo/Europe/Dublin
  inflating: zoneinfo/Europe/Budapest
  inflating: zoneinfo/Europe/Busingen
  inflating: zoneinfo/Europe/Prague
  inflating: zoneinfo/Europe/Kaliningrad
  inflating: zoneinfo/Europe/Berlin
  inflating: zoneinfo/Europe/Andorra
  inflating: zoneinfo/Europe/Tiraspol
  inflating: zoneinfo/Europe/Sarajevo
  inflating: zoneinfo/Europe/Chisinau
  inflating: zoneinfo/Europe/Luxembourg
  inflating: zoneinfo/Europe/Zurich
  inflating: zoneinfo/Europe/Tallinn
  inflating: zoneinfo/Europe/Belgrade
  inflating: zoneinfo/Europe/Madrid
  inflating: zoneinfo/Europe/Kiev
  inflating: zoneinfo/Europe/Skopje
  inflating: zoneinfo/Europe/Riga
  inflating: zoneinfo/Europe/Vienna
  inflating: zoneinfo/Europe/Oslo
  inflating: zoneinfo/Europe/Lisbon
  inflating: zoneinfo/Europe/Bratislava
  inflating: zoneinfo/Europe/Uzhgorod
  inflating: zoneinfo/Europe/San_Marino
  inflating: zoneinfo/Poland
  inflating: zoneinfo/Kwajalein
  inflating: zoneinfo/EET
  inflating: zoneinfo/Portugal
  inflating: zoneinfo/MST
  inflating: zoneinfo/Universal
 extracting: zoneinfo/VERSION
   creating: zoneinfo/Pacific/
  inflating: zoneinfo/Pacific/Fakaofo
  inflating: zoneinfo/Pacific/Auckland
  inflating: zoneinfo/Pacific/Kwajalein
  inflating: zoneinfo/Pacific/Wallis
  inflating: zoneinfo/Pacific/Fiji
  inflating: zoneinfo/Pacific/Norfolk
  inflating: zoneinfo/Pacific/Samoa
  inflating: zoneinfo/Pacific/Port_Moresby
  inflating: zoneinfo/Pacific/Enderbury
  inflating: zoneinfo/Pacific/Ponape
  inflating: zoneinfo/Pacific/Niue
  inflating: zoneinfo/Pacific/Kiritimati
  inflating: zoneinfo/Pacific/Nauru
  inflating: zoneinfo/Pacific/Noumea
  inflating: zoneinfo/Pacific/Pohnpei
  inflating: zoneinfo/Pacific/Kosrae
  inflating: zoneinfo/Pacific/Guam
  inflating: zoneinfo/Pacific/Pago_Pago
  inflating: zoneinfo/Pacific/Rarotonga
  inflating: zoneinfo/Pacific/Tahiti
  inflating: zoneinfo/Pacific/Truk
  inflating: zoneinfo/Pacific/Johnston
  inflating: zoneinfo/Pacific/Bougainville
  inflating: zoneinfo/Pacific/Chuuk
  inflating: zoneinfo/Pacific/Pitcairn
  inflating: zoneinfo/Pacific/Chatham
  inflating: zoneinfo/Pacific/Galapagos
  inflating: zoneinfo/Pacific/Tarawa
  inflating: zoneinfo/Pacific/Marquesas
  inflating: zoneinfo/Pacific/Palau
  inflating: zoneinfo/Pacific/Saipan
  inflating: zoneinfo/Pacific/Honolulu
  inflating: zoneinfo/Pacific/Guadalcanal
  inflating: zoneinfo/Pacific/Wake
  inflating: zoneinfo/Pacific/Midway
  inflating: zoneinfo/Pacific/Tongatapu
  inflating: zoneinfo/Pacific/Gambier
  inflating: zoneinfo/Pacific/Funafuti
  inflating: zoneinfo/Pacific/Yap
  inflating: zoneinfo/Pacific/Easter
  inflating: zoneinfo/Pacific/Majuro
  inflating: zoneinfo/Pacific/Efate
  inflating: zoneinfo/Pacific/Apia
   creating: zoneinfo/Atlantic/
  inflating: zoneinfo/Atlantic/Cape_Verde
  inflating: zoneinfo/Atlantic/Azores
  inflating: zoneinfo/Atlantic/South_Georgia
  inflating: zoneinfo/Atlantic/Madeira
  inflating: zoneinfo/Atlantic/Bermuda
  inflating: zoneinfo/Atlantic/Faeroe
  inflating: zoneinfo/Atlantic/Stanley
  inflating: zoneinfo/Atlantic/Canary
  inflating: zoneinfo/Atlantic/Reykjavik
  inflating: zoneinfo/Atlantic/Jan_Mayen
  inflating: zoneinfo/Atlantic/Faroe
  inflating: zoneinfo/Atlantic/St_Helena
   creating: zoneinfo/Asia/
  inflating: zoneinfo/Asia/Chongqing
  inflating: zoneinfo/Asia/Ust-Nera
  inflating: zoneinfo/Asia/Samarkand
  inflating: zoneinfo/Asia/Saigon
  inflating: zoneinfo/Asia/Bishkek
  inflating: zoneinfo/Asia/Nicosia
  inflating: zoneinfo/Asia/Ho_Chi_Minh
  inflating: zoneinfo/Asia/Manila
  inflating: zoneinfo/Asia/Jakarta
  inflating: zoneinfo/Asia/Omsk
  inflating: zoneinfo/Asia/Krasnoyarsk
  inflating: zoneinfo/Asia/Aqtau
  inflating: zoneinfo/Asia/Thimbu
  inflating: zoneinfo/Asia/Karachi
  inflating: zoneinfo/Asia/Beirut
  inflating: zoneinfo/Asia/Kuching
  inflating: zoneinfo/Asia/Dushanbe
  inflating: zoneinfo/Asia/Famagusta
  inflating: zoneinfo/Asia/Seoul
  inflating: zoneinfo/Asia/Pontianak
  inflating: zoneinfo/Asia/Anadyr
  inflating: zoneinfo/Asia/Ulan_Bator
  inflating: zoneinfo/Asia/Tokyo
  inflating: zoneinfo/Asia/Jerusalem
  inflating: zoneinfo/Asia/Dili
  inflating: zoneinfo/Asia/Ujung_Pandang
  inflating: zoneinfo/Asia/Tomsk
  inflating: zoneinfo/Asia/Taipei
  inflating: zoneinfo/Asia/Tel_Aviv
  inflating: zoneinfo/Asia/Brunei
  inflating: zoneinfo/Asia/Amman
  inflating: zoneinfo/Asia/Dubai
  inflating: zoneinfo/Asia/Aqtobe
  inflating: zoneinfo/Asia/Aden
  inflating: zoneinfo/Asia/Tehran
  inflating: zoneinfo/Asia/Yerevan
  inflating: zoneinfo/Asia/Makassar
  inflating: zoneinfo/Asia/Baghdad
  inflating: zoneinfo/Asia/Tbilisi
  inflating: zoneinfo/Asia/Jayapura
  inflating: zoneinfo/Asia/Qatar
  inflating: zoneinfo/Asia/Damascus
  inflating: zoneinfo/Asia/Chungking
  inflating: zoneinfo/Asia/Harbin
  inflating: zoneinfo/Asia/Ashgabat
  inflating: zoneinfo/Asia/Choibalsan
  inflating: zoneinfo/Asia/Istanbul
  inflating: zoneinfo/Asia/Sakhalin
  inflating: zoneinfo/Asia/Vladivostok
  inflating: zoneinfo/Asia/Kuwait
  inflating: zoneinfo/Asia/Bangkok
  inflating: zoneinfo/Asia/Atyrau
  inflating: zoneinfo/Asia/Macao
  inflating: zoneinfo/Asia/Yekaterinburg
  inflating: zoneinfo/Asia/Qyzylorda
  inflating: zoneinfo/Asia/Riyadh
  inflating: zoneinfo/Asia/Baku
  inflating: zoneinfo/Asia/Calcutta
  inflating: zoneinfo/Asia/Oral
  inflating: zoneinfo/Asia/Pyongyang
  inflating: zoneinfo/Asia/Urumqi
  inflating: zoneinfo/Asia/Singapore
  inflating: zoneinfo/Asia/Phnom_Penh
  inflating: zoneinfo/Asia/Novokuznetsk
  inflating: zoneinfo/Asia/Kamchatka
  inflating: zoneinfo/Asia/Bahrain
  inflating: zoneinfo/Asia/Colombo
  inflating: zoneinfo/Asia/Ashkhabad
  inflating: zoneinfo/Asia/Muscat
  inflating: zoneinfo/Asia/Irkutsk
  inflating: zoneinfo/Asia/Hebron
  inflating: zoneinfo/Asia/Ulaanbaatar
  inflating: zoneinfo/Asia/Chita
  inflating: zoneinfo/Asia/Kolkata
  inflating: zoneinfo/Asia/Yangon
  inflating: zoneinfo/Asia/Srednekolymsk
  inflating: zoneinfo/Asia/Macau
  inflating: zoneinfo/Asia/Qostanay
  inflating: zoneinfo/Asia/Kuala_Lumpur
  inflating: zoneinfo/Asia/Dhaka
  inflating: zoneinfo/Asia/Magadan
  inflating: zoneinfo/Asia/Almaty
  inflating: zoneinfo/Asia/Kabul
  inflating: zoneinfo/Asia/Vientiane
  inflating: zoneinfo/Asia/Dacca
  inflating: zoneinfo/Asia/Katmandu
  inflating: zoneinfo/Asia/Rangoon
  inflating: zoneinfo/Asia/Gaza
  inflating: zoneinfo/Asia/Tashkent
  inflating: zoneinfo/Asia/Kathmandu
  inflating: zoneinfo/Asia/Hong_Kong
  inflating: zoneinfo/Asia/Hovd
  inflating: zoneinfo/Asia/Novosibirsk
  inflating: zoneinfo/Asia/Thimphu
  inflating: zoneinfo/Asia/Khandyga
  inflating: zoneinfo/Asia/Kashgar
  inflating: zoneinfo/Asia/Barnaul
  inflating: zoneinfo/Asia/Shanghai
  inflating: zoneinfo/Asia/Yakutsk
  inflating: zoneinfo/GB-Eire
  inflating: zoneinfo/GMT
   creating: zoneinfo/Brazil/
  inflating: zoneinfo/Brazil/DeNoronha
  inflating: zoneinfo/Brazil/Acre
  inflating: zoneinfo/Brazil/East
  inflating: zoneinfo/Brazil/West
   creating: zoneinfo/Etc/
  inflating: zoneinfo/Etc/UCT
  inflating: zoneinfo/Etc/Universal
  inflating: zoneinfo/Etc/GMT-9
  inflating: zoneinfo/Etc/GMT
  inflating: zoneinfo/Etc/GMT+6
  inflating: zoneinfo/Etc/GMT+10
  inflating: zoneinfo/Etc/GMT-8
  inflating: zoneinfo/Etc/GMT-2
  inflating: zoneinfo/Etc/GMT-7
  inflating: zoneinfo/Etc/GMT+8
  inflating: zoneinfo/Etc/GMT+7
  inflating: zoneinfo/Etc/GMT+1
  inflating: zoneinfo/Etc/GMT-13
  inflating: zoneinfo/Etc/GMT-0
  inflating: zoneinfo/Etc/GMT+12
  inflating: zoneinfo/Etc/Greenwich
  inflating: zoneinfo/Etc/Zulu
  inflating: zoneinfo/Etc/UTC
  inflating: zoneinfo/Etc/GMT-12
  inflating: zoneinfo/Etc/GMT-3
  inflating: zoneinfo/Etc/GMT-6
  inflating: zoneinfo/Etc/GMT+2
  inflating: zoneinfo/Etc/GMT-10
  inflating: zoneinfo/Etc/GMT+9
  inflating: zoneinfo/Etc/GMT+3
  inflating: zoneinfo/Etc/GMT+4
  inflating: zoneinfo/Etc/GMT+5
  inflating: zoneinfo/Etc/GMT-5
  inflating: zoneinfo/Etc/GMT-4
  inflating: zoneinfo/Etc/GMT-11
  inflating: zoneinfo/Etc/GMT-1
  inflating: zoneinfo/Etc/GMT0
  inflating: zoneinfo/Etc/GMT-14
  inflating: zoneinfo/Etc/GMT+0
  inflating: zoneinfo/Etc/GMT+11
  inflating: zoneinfo/Navajo
  inflating: zoneinfo/iso3166.tab
  inflating: zoneinfo/Hongkong
   creating: zoneinfo/Arctic/
  inflating: zoneinfo/Arctic/Longyearbyen
  inflating: zoneinfo/GMT-0
  inflating: zoneinfo/Iran
  inflating: zoneinfo/WET
  inflating: zoneinfo/Greenwich
  inflating: zoneinfo/ROK
  inflating: zoneinfo/Zulu
  inflating: zoneinfo/UTC
  inflating: zoneinfo/EST
  inflating: zoneinfo/PRC
   creating: zoneinfo/Indian/
  inflating: zoneinfo/Indian/Maldives
  inflating: zoneinfo/Indian/Mauritius
  inflating: zoneinfo/Indian/Antananarivo
  inflating: zoneinfo/Indian/Kerguelen
  inflating: zoneinfo/Indian/Comoro
  inflating: zoneinfo/Indian/Mayotte
  inflating: zoneinfo/Indian/Chagos
  inflating: zoneinfo/Indian/Reunion
  inflating: zoneinfo/Indian/Christmas
  inflating: zoneinfo/Indian/Cocos
  inflating: zoneinfo/Indian/Mahe
  inflating: zoneinfo/MST7MDT
  inflating: zoneinfo/Japan
  inflating: zoneinfo/Iceland
  inflating: zoneinfo/zone.tab
  inflating: zoneinfo/Jamaica
  inflating: zoneinfo/Singapore
  inflating: zoneinfo/HST
  inflating: zoneinfo/NZ
   creating: zoneinfo/US/
  inflating: zoneinfo/US/Indiana-Starke
  inflating: zoneinfo/US/Samoa
  inflating: zoneinfo/US/Pacific
  inflating: zoneinfo/US/Aleutian
  inflating: zoneinfo/US/East-Indiana
  inflating: zoneinfo/US/Michigan
  inflating: zoneinfo/US/Arizona
  inflating: zoneinfo/US/Hawaii
  inflating: zoneinfo/US/Mountain
  inflating: zoneinfo/US/Pacific-New
  inflating: zoneinfo/US/Eastern
  inflating: zoneinfo/US/Central
  inflating: zoneinfo/US/Alaska
   creating: zoneinfo/Chile/
  inflating: zoneinfo/Chile/Continental
  inflating: zoneinfo/Chile/EasterIsland
  inflating: zoneinfo/GB
  inflating: zoneinfo/CST6CDT
  inflating: zoneinfo/Eire
  inflating: zoneinfo/Turkey
  inflating: zoneinfo/NZ-CHAT
   creating: zoneinfo/Canada/
  inflating: zoneinfo/Canada/Pacific
  inflating: zoneinfo/Canada/Atlantic
  inflating: zoneinfo/Canada/Newfoundland
  inflating: zoneinfo/Canada/Yukon
  inflating: zoneinfo/Canada/Saskatchewan
  inflating: zoneinfo/Canada/Mountain
  inflating: zoneinfo/Canada/Eastern
  inflating: zoneinfo/Canada/Central
   creating: zoneinfo/America/
  inflating: zoneinfo/America/Guadeloupe
  inflating: zoneinfo/America/Guyana
  inflating: zoneinfo/America/Knox_IN
  inflating: zoneinfo/America/Rio_Branco
  inflating: zoneinfo/America/Cambridge_Bay
  inflating: zoneinfo/America/Menominee
  inflating: zoneinfo/America/Anchorage
  inflating: zoneinfo/America/Kralendijk
  inflating: zoneinfo/America/Grenada
  inflating: zoneinfo/America/Monterrey
  inflating: zoneinfo/America/Cuiaba
  inflating: zoneinfo/America/Regina
  inflating: zoneinfo/America/Toronto
  inflating: zoneinfo/America/Cayman
  inflating: zoneinfo/America/Miquelon
  inflating: zoneinfo/America/Pangnirtung
  inflating: zoneinfo/America/Dominica
  inflating: zoneinfo/America/Martinique
  inflating: zoneinfo/America/Bahia_Banderas
  inflating: zoneinfo/America/Porto_Velho
  inflating: zoneinfo/America/Nassau
  inflating: zoneinfo/America/Vancouver
  inflating: zoneinfo/America/Juneau
  inflating: zoneinfo/America/Swift_Current
  inflating: zoneinfo/America/Virgin
  inflating: zoneinfo/America/New_York
  inflating: zoneinfo/America/Montevideo
  inflating: zoneinfo/America/Boa_Vista
  inflating: zoneinfo/America/Halifax
  inflating: zoneinfo/America/Detroit
  inflating: zoneinfo/America/St_Vincent
  inflating: zoneinfo/America/Inuvik
  inflating: zoneinfo/America/Ojinaga
  inflating: zoneinfo/America/Santa_Isabel
  inflating: zoneinfo/America/Lower_Princes
  inflating: zoneinfo/America/St_Johns
  inflating: zoneinfo/America/Scoresbysund
  inflating: zoneinfo/America/Managua
  inflating: zoneinfo/America/Indianapolis
  inflating: zoneinfo/America/Recife
  inflating: zoneinfo/America/Winnipeg
  inflating: zoneinfo/America/Bahia
  inflating: zoneinfo/America/Thunder_Bay
  inflating: zoneinfo/America/Goose_Bay
  inflating: zoneinfo/America/Aruba
  inflating: zoneinfo/America/Port_of_Spain
  inflating: zoneinfo/America/Noronha
  inflating: zoneinfo/America/Santo_Domingo
  inflating: zoneinfo/America/St_Barthelemy
   creating: zoneinfo/America/Argentina/
  inflating: zoneinfo/America/Argentina/La_Rioja
  inflating: zoneinfo/America/Argentina/San_Luis
  inflating: zoneinfo/America/Argentina/San_Juan
  inflating: zoneinfo/America/Argentina/Buenos_Aires
  inflating: zoneinfo/America/Argentina/Jujuy
  inflating: zoneinfo/America/Argentina/Salta
  inflating: zoneinfo/America/Argentina/Catamarca
  inflating: zoneinfo/America/Argentina/Tucuman
  inflating: zoneinfo/America/Argentina/Rio_Gallegos
  inflating: zoneinfo/America/Argentina/Cordoba
  inflating: zoneinfo/America/Argentina/ComodRivadavia
  inflating: zoneinfo/America/Argentina/Mendoza
  inflating: zoneinfo/America/Argentina/Ushuaia
  inflating: zoneinfo/America/Puerto_Rico
   creating: zoneinfo/America/Kentucky/
  inflating: zoneinfo/America/Kentucky/Monticello
  inflating: zoneinfo/America/Kentucky/Louisville
  inflating: zoneinfo/America/Fort_Wayne
  inflating: zoneinfo/America/Santiago
  inflating: zoneinfo/America/Guayaquil
  inflating: zoneinfo/America/Araguaina
  inflating: zoneinfo/America/Merida
  inflating: zoneinfo/America/Resolute
  inflating: zoneinfo/America/Buenos_Aires
  inflating: zoneinfo/America/Hermosillo
  inflating: zoneinfo/America/Blanc-Sablon
  inflating: zoneinfo/America/Cayenne
   creating: zoneinfo/America/North_Dakota/
  inflating: zoneinfo/America/North_Dakota/Center
  inflating: zoneinfo/America/North_Dakota/Beulah
  inflating: zoneinfo/America/North_Dakota/New_Salem
  inflating: zoneinfo/America/Edmonton
  inflating: zoneinfo/America/Godthab
  inflating: zoneinfo/America/Panama
  inflating: zoneinfo/America/Montreal
  inflating: zoneinfo/America/Campo_Grande
  inflating: zoneinfo/America/Santarem
  inflating: zoneinfo/America/Coral_Harbour
  inflating: zoneinfo/America/Dawson
  inflating: zoneinfo/America/Nipigon
  inflating: zoneinfo/America/Rankin_Inlet
  inflating: zoneinfo/America/Adak
  inflating: zoneinfo/America/Antigua
  inflating: zoneinfo/America/Jujuy
  inflating: zoneinfo/America/El_Salvador
  inflating: zoneinfo/America/Fort_Nelson
  inflating: zoneinfo/America/Sitka
  inflating: zoneinfo/America/Belize
  inflating: zoneinfo/America/Maceio
  inflating: zoneinfo/America/Yakutat
  inflating: zoneinfo/America/Sao_Paulo
  inflating: zoneinfo/America/Rosario
  inflating: zoneinfo/America/Jamaica
  inflating: zoneinfo/America/Ensenada
  inflating: zoneinfo/America/Glace_Bay
  inflating: zoneinfo/America/Shiprock
  inflating: zoneinfo/America/Cancun
  inflating: zoneinfo/America/Caracas
  inflating: zoneinfo/America/Fortaleza
  inflating: zoneinfo/America/Matamoros
  inflating: zoneinfo/America/Catamarca
  inflating: zoneinfo/America/Guatemala
  inflating: zoneinfo/America/Curacao
  inflating: zoneinfo/America/La_Paz
  inflating: zoneinfo/America/Denver
  inflating: zoneinfo/America/Tegucigalpa
  inflating: zoneinfo/America/Anguilla
  inflating: zoneinfo/America/Punta_Arenas
  inflating: zoneinfo/America/Manaus
  inflating: zoneinfo/America/Bogota
  inflating: zoneinfo/America/Nome
  inflating: zoneinfo/America/Lima
  inflating: zoneinfo/America/Asuncion
  inflating: zoneinfo/America/Danmarkshavn
  inflating: zoneinfo/America/Tortola
  inflating: zoneinfo/America/Havana
  inflating: zoneinfo/America/Moncton
  inflating: zoneinfo/America/Boise
  inflating: zoneinfo/America/Thule
  inflating: zoneinfo/America/Rainy_River
  inflating: zoneinfo/America/Cordoba
  inflating: zoneinfo/America/Whitehorse
  inflating: zoneinfo/America/Marigot
  inflating: zoneinfo/America/Paramaribo
  inflating: zoneinfo/America/Costa_Rica
  inflating: zoneinfo/America/Grand_Turk
  inflating: zoneinfo/America/Mexico_City
  inflating: zoneinfo/America/Dawson_Creek
  inflating: zoneinfo/America/St_Thomas
  inflating: zoneinfo/America/Chicago
  inflating: zoneinfo/America/Creston
  inflating: zoneinfo/America/Phoenix
  inflating: zoneinfo/America/Mazatlan
  inflating: zoneinfo/America/Chihuahua
  inflating: zoneinfo/America/Montserrat
  inflating: zoneinfo/America/Louisville
  inflating: zoneinfo/America/Atikokan
   creating: zoneinfo/America/Indiana/
  inflating: zoneinfo/America/Indiana/Marengo
  inflating: zoneinfo/America/Indiana/Indianapolis
  inflating: zoneinfo/America/Indiana/Vincennes
  inflating: zoneinfo/America/Indiana/Vevay
  inflating: zoneinfo/America/Indiana/Winamac
  inflating: zoneinfo/America/Indiana/Petersburg
  inflating: zoneinfo/America/Indiana/Tell_City
  inflating: zoneinfo/America/Indiana/Knox
  inflating: zoneinfo/America/Atka
  inflating: zoneinfo/America/Iqaluit
  inflating: zoneinfo/America/Tijuana
  inflating: zoneinfo/America/Eirunepe
  inflating: zoneinfo/America/Port-au-Prince
  inflating: zoneinfo/America/Metlakatla
  inflating: zoneinfo/America/Mendoza
  inflating: zoneinfo/America/Barbados
  inflating: zoneinfo/America/Belem
  inflating: zoneinfo/America/St_Kitts
  inflating: zoneinfo/America/St_Lucia
  inflating: zoneinfo/America/Los_Angeles
  inflating: zoneinfo/America/Yellowknife
  inflating: zoneinfo/America/Porto_Acre
  inflating: zoneinfo/EST5EDT
   creating: zoneinfo/Africa/
  inflating: zoneinfo/Africa/Monrovia
  inflating: zoneinfo/Africa/Bissau
  inflating: zoneinfo/Africa/Kinshasa
  inflating: zoneinfo/Africa/Bamako
  inflating: zoneinfo/Africa/Ouagadougou
  inflating: zoneinfo/Africa/Lubumbashi
  inflating: zoneinfo/Africa/Mogadishu
  inflating: zoneinfo/Africa/Ndjamena
  inflating: zoneinfo/Africa/Ceuta
  inflating: zoneinfo/Africa/Nairobi
  inflating: zoneinfo/Africa/Malabo
  inflating: zoneinfo/Africa/Blantyre
  inflating: zoneinfo/Africa/Tripoli
  inflating: zoneinfo/Africa/Lagos
  inflating: zoneinfo/Africa/Bangui
  inflating: zoneinfo/Africa/Addis_Ababa
  inflating: zoneinfo/Africa/Accra
  inflating: zoneinfo/Africa/Maseru
  inflating: zoneinfo/Africa/Algiers
  inflating: zoneinfo/Africa/Lusaka
  inflating: zoneinfo/Africa/Abidjan
  inflating: zoneinfo/Africa/Nouakchott
  inflating: zoneinfo/Africa/Luanda
  inflating: zoneinfo/Africa/Maputo
  inflating: zoneinfo/Africa/Johannesburg
  inflating: zoneinfo/Africa/Mbabane
  inflating: zoneinfo/Africa/Windhoek
  inflating: zoneinfo/Africa/Dakar
  inflating: zoneinfo/Africa/Douala
  inflating: zoneinfo/Africa/Juba
  inflating: zoneinfo/Africa/Banjul
  inflating: zoneinfo/Africa/Dar_es_Salaam
  inflating: zoneinfo/Africa/Porto-Novo
  inflating: zoneinfo/Africa/Asmera
  inflating: zoneinfo/Africa/El_Aaiun
  inflating: zoneinfo/Africa/Conakry
  inflating: zoneinfo/Africa/Brazzaville
  inflating: zoneinfo/Africa/Tunis
  inflating: zoneinfo/Africa/Lome
  inflating: zoneinfo/Africa/Asmara
  inflating: zoneinfo/Africa/Timbuktu
  inflating: zoneinfo/Africa/Casablanca
  inflating: zoneinfo/Africa/Freetown
  inflating: zoneinfo/Africa/Bujumbura
  inflating: zoneinfo/Africa/Niamey
  inflating: zoneinfo/Africa/Cairo
  inflating: zoneinfo/Africa/Harare
  inflating: zoneinfo/Africa/Kigali
  inflating: zoneinfo/Africa/Kampala
  inflating: zoneinfo/Africa/Sao_Tome
  inflating: zoneinfo/Africa/Khartoum
  inflating: zoneinfo/Africa/Djibouti
  inflating: zoneinfo/Africa/Gaborone
  inflating: zoneinfo/Africa/Libreville
  inflating: zoneinfo/Israel
  inflating: zoneinfo/MET
   creating: zoneinfo/Mexico/
  inflating: zoneinfo/Mexico/BajaNorte
  inflating: zoneinfo/Mexico/BajaSur
  inflating: zoneinfo/Mexico/General
  inflating: zoneinfo/Libya
  inflating: zoneinfo/GMT0
  inflating: zoneinfo/ROC
   creating: zoneinfo/Antarctica/
  inflating: zoneinfo/Antarctica/Davis
  inflating: zoneinfo/Antarctica/Palmer
  inflating: zoneinfo/Antarctica/Vostok
  inflating: zoneinfo/Antarctica/Syowa
  inflating: zoneinfo/Antarctica/DumontDUrville
  inflating: zoneinfo/Antarctica/Mawson
  inflating: zoneinfo/Antarctica/Rothera
  inflating: zoneinfo/Antarctica/Casey
  inflating: zoneinfo/Antarctica/Troll
  inflating: zoneinfo/Antarctica/Macquarie
  inflating: zoneinfo/Antarctica/South_Pole
  inflating: zoneinfo/Antarctica/McMurdo
  inflating: zoneinfo/GMT+0
  inflating: zoneinfo/PST8PDT
  inflating: zoneinfo/Cuba
  inflating: zoneinfo/W-SU

Phew! Not a bomb!

So, now it is up to you to find out what makes unzip @6.0_3 believe this zoneinfo.zip (see attached) is a possibly a bomb. My guess is the remarkable regularity of the time zone files with respect to GMT:

$ ls zoneinfo/Etc/GMT*
zoneinfo/Etc/GMT	zoneinfo/Etc/GMT+6	zoneinfo/Etc/GMT-14
zoneinfo/Etc/GMT+0	zoneinfo/Etc/GMT+7	zoneinfo/Etc/GMT-2
zoneinfo/Etc/GMT+1	zoneinfo/Etc/GMT+8	zoneinfo/Etc/GMT-3
zoneinfo/Etc/GMT+10	zoneinfo/Etc/GMT+9	zoneinfo/Etc/GMT-4
zoneinfo/Etc/GMT+11	zoneinfo/Etc/GMT-0	zoneinfo/Etc/GMT-5
zoneinfo/Etc/GMT+12	zoneinfo/Etc/GMT-1	zoneinfo/Etc/GMT-6
zoneinfo/Etc/GMT+2	zoneinfo/Etc/GMT-10	zoneinfo/Etc/GMT-7
zoneinfo/Etc/GMT+3	zoneinfo/Etc/GMT-11	zoneinfo/Etc/GMT-8
zoneinfo/Etc/GMT+4	zoneinfo/Etc/GMT-12	zoneinfo/Etc/GMT-9
zoneinfo/Etc/GMT+5	zoneinfo/Etc/GMT-13	zoneinfo/Etc/GMT0

Hope you or someone upstream can find a fix. It is interesting that apparently no one else came across this building problem concerning R so far, but maybe the MacOS built-in /usr/bin/unzip is preferred on the buildbots (I on my old but spry 10.5.8 PPC have /usr/bin/unzip 5.52 as of 2005).

Attachments (2)

zoneinfo.zip (405.8 KB) - added by udbraumann 6 months ago.
-rw-r--r-- 1 macports admin 415587 Sep 24 2019 zoneinfo.zip
25-fix-false-overlapped-components-detection-on-32-bit-systems.patch (2.0 KB) - added by gfiumara (Greg Fiumara) 6 months ago.

Download all attachments as: .zip

Change History (7)

Changed 6 months ago by udbraumann

Attachment: zoneinfo.zip added

-rw-r--r-- 1 macports admin 415587 Sep 24 2019 zoneinfo.zip

comment:1 Changed 6 months ago by udbraumann

Description: modified (diff)
Keywords: R zoneinfo.zip added

comment:2 Changed 6 months ago by mf2k (Frank Schima)

Cc: greg@… removed
Keywords: R zoneinfo.zip removed
Owner: set to gfiumara
Status: newassigned

comment:3 Changed 6 months ago by gfiumara (Greg Fiumara)

The patches for CVE-2019-13232 (Zip bombs) were applied in unzip @6.0_3 two weeks ago. I suspect they are the culprit. The file in question expands correctly with unzip @6.0_3 under macOS 10.15.4. I suspect it's related to this 32-bit issue, that is fixed in the attached patch.

Comments on the patch seem to indicate that this is a result of bad build parameters. We are only enabling LARGE_FILE_SUPPORT on x86_64, which was the primary change two weeks ago. I think we need to either add this patch or enable LARGE_FILE_SUPPORT everywhere if it's supported everywhere (sizeof(off_t) or sizeof(long) >= 8).

Changed 6 months ago by gfiumara (Greg Fiumara)

comment:4 Changed 6 months ago by gfiumara (Greg Fiumara)

I pulled out a 10.5.8 PPC machine and LARGE_FILE_SUPPORT is indeed supported. Enabling it fixes this issue. Sending a PR shortly.

comment:5 Changed 6 months ago by gfiumara (Greg Fiumara)

Resolution: fixed
Status: assignedclosed

In 80c2441dd24977dd6a004127cc79f53ec380c1e0/macports-ports (master):

unzip: Enable LARGE_FILE_SUPPORT for 32-bit build

LARGE_FILE_SUPPORT is supported as long as sizeof(off_t) >= 8 or
sizeof(long) >= 8, which is true going back to at least 10.5.

Closes: #60396

Note: See TracTickets for help on using tickets.