ar mishandles files bigger than 2GB

[Jeffrey Walton]

On Tue, Jan 3, 2012 at 4:30 AM, Francois Gouget <fgouget@codeweavers.com> wrote:
>
> I created a bug concerning this issue (#652887) but my understanding is
> that patches should be sent here for discussion and to get them applied.
> I apologize if I'm mistaken.
>
> In any case, here's the first patch in the 5 patch series fixing this
> issue. Let me know if I should also send the others here. The patches
> are also attached to the bug:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652887
>
>
> So one of the first problems in handling files bigger than 2GB is that
> in the BFD library we use a long to write the size as a string to the
> archive element header. On a 32bit platform this results in a negative
> or truncated file size even though support for large files is enabled.
>
> So this first patch encapsulates writing the size header field in the
> _bfd_ar_sizepad() function.
This might have security related implications also. Are there any CVE
associated with it?

Jeff