Post #4477314

In the early 90s, PKWare offered their Data Compression Library as a way to put basic compression into other applications. It uses a different algorithm from PKZIP. I encountered it because it's used by the proprietary recipe program that my mom used, and I've been recovering her database. Turns out it's had an input-controlled buffer overrun since, well, forever! The library itself won't produce streams with the property required to trigger it, but it also doesn't defend against them. But, because of the specifics of how its structs are laid out, it's probably not usefully exploitable. (The overrun stomps on a section of the input buffer that isn't likely to be used again.)