zip2john "malloc(): corrupted top size" on Arch Linux

[antkss]

[solardiz]

Thank you for reporting this @antkss! What version of Arch Linux package is that, and what CPU architecture are you running it on? Can you reproduce the issue after building latest code from this repo? Can you share a ZIP file that would let us reproduce the issue (if you have or can create a file that isn't security-sensitive)?

I took a look at https://aur.archlinux.org/packages/john-git and the git revision mentioned in there is quite recent, so if you're using the latest package then probably we still have the bug in here.

Plain text version of your screenshot for easier searching and email:

as@thongapple$ zip2john a.zip
malloc(): corrupted top size
zsh: IOT instruction (core dumped)  zip2john a.zip

(please prefer copy-paste of text over screenshots)

[solardiz]

@antkss Please complete this bug report. At the very least, we need john --list=build-info from you.

[claudioandre-br]

I took a look at the zip2john file.

IMO, without an example zip file or a "good" analysis done remotely using the core dump, it is impossible to identify or solve the problem.

[solardiz]

@claudioandre-br I think we need version info first. It is possible that @antkss ran code that's way out of date. We did have such bugs in there in the past, now fixed.

[antkss]

@solardiz my john version here:
john-1.9.0.jumbo1-11
as@~🍎 uname -a
Linux archlinuz 6.12.12-2-clear-lts #1 SMP PREEMPT Sat, 08 Feb 2025 04:45:43 +0000 x86_64 GNU/Linux

[antkss]

vuln.zip

[antkss]

john-build-info.txt
thank you for your response

[claudioandre-br]

A recent version of JtR can handle the vuln.zip file without errors.

$ john-the-ripper.zip2john vuln.zip 
vuln.zip/writeup_bai[...]

BTW: Jumbo 1 for zip files is a bad idea.

[solardiz]

@antkss Thank you! So that's a package of our previous release 1.9.0-jumbo-1 and we did fix relevant bugs since. The current Arch Linux package of john over that link I found above appears to use our recent git tree (mentions a commit from January 2025). So are you running an outdated Arch Linux package? Can you upgrade to their latest package?