Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.

Fabian Yamaguchi reported a read buffer overflow flaw in libarchive on 64-bit systems where sizeof(sizet) is equal to 8. In the archivewritezipdata() function in libarchive/archivewritesetformatzip.c, the "s" parameter is of type sizet (64 bit, unsigned) and is cast to a 64 bit signed integer. If "s" is larger than MAXINT, it will not be set to "zip->remainingdatabytes" even though it is larger than "zip->remainingdatabytes", which leads to a buffer overflow when calling deflate().

This can lead to a segfault in an application that uses libarchive to create ZIP archives.