Ckolivas Lrzip Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in Ckolivas Lrzip versions through 0.651. This issue arises in the command line argument parsing, specifically within the 'strtol_l.c' file, in the function '__GI_____strtol_l_internal'. The vulnerability is triggered by malformed input that is not properly validated before being processed, leading to a crash when the program attempts to read from a null memory address. This flaw requires local access to exploit.

Impact

Exploitation of this vulnerability causes a null pointer dereference, leading to a segmentation fault and a crash of the application.

Reproduction

The vulnerability can be reproduced by compiling Lrzip with AddressSanitizer enabled, and then executing the program with the '--level -2 -i' option followed by the path to a crafted input file that triggers the null pointer dereference. The application will crash, demonstrating the vulnerability.