Package: nsis Version: 3.08-2 Severity: important Tags: upstream All current versions of makensis (which is part of the nsis package) crash when the total size of the installed files exceeds 2 GiB and compression option /SOLID is set. I tested both the nsis package which is part of Debian bullseye and a newer locally built version.
The crash is caused by an 32 bit integer overflow, at least in Source/mmap.cpp. I observer SIGBUS, SIGSEGV and mmap related error messages, depending on the files which were to be installed. The bug can be avoided by removing /SOLID, so instead of whole file compression only the single installed files get compressed, but that results in a larger installer. Fixing the bug would require lots of code changes, mainly replacing "int" by "unsigned int" (which would have a limit at 4 GiB) or "size_t". A check for integer overflow and aborting with an reasonable error message would be easier to implement. -- System Information: Debian Release: 11.3 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable'), (499, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.10.0-13-cloud-amd64 (SMP w/4 CPU threads) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages nsis depends on: ii libc6 2.31-13+deb11u3 ii libgcc-s1 10.2.1-6 ii libstdc++6 10.2.1-6 ii nsis-common 3.08-2 ii zlib1g 1:1.2.11.dfsg-2+deb11u1 nsis recommends no packages. Versions of packages nsis suggests: ii mingw-w64 8.0.0-1 pn nsis-doc <none> pn nsis-pluginapi <none> ii wine [wine] 5.0.3-3 -- no debconf information
