Tim Kientzle [Sun, 19 Jun 2016 22:58:33 +0000 (15:58 -0700)]
Issue 719: Refuse to allocate a too-small PPMD7 context
Other parts of the PPMD7 code assume that the dictionary is
at least UNIT_SIZE (12 bytes). Enforce that assumption here
to avoid potential buffer under- and over-runs.
This was pointed out in a review of the original fix for Issue 719.
Tim Kientzle [Sun, 19 Jun 2016 21:34:37 +0000 (14:34 -0700)]
Issue 717: Fix integer overflow when computing location of volume descriptor
The multiplication here defaulted to 'int' but calculations
of file positions should always use int64_t. A simple cast
suffices to fix this since the base location is always 32 bits
for ISO, so multiplying by the sector size will never overflow
a 64-bit integer.
Tim Kientzle [Sun, 19 Jun 2016 21:21:42 +0000 (14:21 -0700)]
Issue 719: Fix for TALOS-CAN-154
A RAR file with an invalid zero dictionary size was not being
rejected, leading to a zero-sized allocation for the dictionary
storage which was then overwritten during the dictionary initialization.
Thanks to the Open Source and Threat Intelligence project at Cisco for
reporting this.
Tim Kientzle [Sun, 19 Jun 2016 21:14:09 +0000 (14:14 -0700)]
Issue #718: Fix TALOS-CAN-152
If a 7-Zip archive declares a rediculously large number of substreams,
it can overflow an internal counter, leading a subsequent memory
allocation to be too small for the substream data.
Thanks to the Open Source and Threat Intelligence project at Cisco
for reporting this issue.
Tim Kientzle [Thu, 16 Jun 2016 01:38:30 +0000 (18:38 -0700)]
Issue 553: Fix broken decryption for ZIP files.
Sometimes, decompressing was failing due to miscalculation of buffer
offsets, and hence causing a silent buffer overflow.
When a previous chunk decompression left some bytes in the decryption
buffer, it was not taken into account in determining space left in the
decompression buffer.
So, it could happen, that the decryption buffer is completely full,
but some bytes are not used yet. In such case, even though the buffer
is full, the code tried to decrypt more bytes behind it's boundary.
This CL resolves this issue by properly calculating the amount of
space left in the decompression buffer.
(This is an edited version of Tomasz Mikolajewski's pull request.)
Graham Percival [Mon, 13 Jun 2016 23:13:06 +0000 (16:13 -0700)]
Remove dead code in archive_entry_xattr_add_entry()
The code seems to be walking through the linked list beginning at
entry->xattr_head, but then it immediately sets xp to be something different.
This is 10-year old code; it was added in the first "POSIX.1e-style Extended
Attribute support" commit, on March 21 2006:
https://svnweb.freebsd.org/base/head/lib/libarchive/archive_entry.c?annotate=156961&pathrev=156961#l1387
Maxin B. John [Fri, 3 Jun 2016 11:09:30 +0000 (14:09 +0300)]
Makefile.am: Remove non-existing file
Fixes this build error:
CC libarchive/archive_write_set_format_gnutar.lo
make[1]: *** No rule to make target
'libarchive/archive_write_set_format_gnutar_filenames.c', needed by
'libarchive/archive_write_set_format_gnutar_filenames.lo'. Stop.
make[1]: Leaving directory '/home/maxin/clone/libarchive'
Makefile:2866: recipe for target 'all' failed
make: *** [all] Error 2
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Tim Kientzle [Wed, 1 Jun 2016 04:01:59 +0000 (21:01 -0700)]
Issue 682: Correctly write gnutar filenames of exactly 512 bytes
Previous code omitted the final zero byte for filenames and
linknames. This is usually okay since the final block is
padded with zero bytes, but if the filename exactly filled
the block, there would be no zero byte.
Tim Kientzle [Sat, 28 May 2016 18:50:39 +0000 (11:50 -0700)]
Issue 711: Be more careful about verifying filename lengths when writing ISO9660 archives
* Don't cast size_t to int, since this can lead to overflow
on machines where sizeof(int) < sizeof(size_t)
* Check a + b > limit by writing it as
a > limit || b > limit || a + b > limit
to avoid problems when a + b wraps around.
Tim Kientzle [Mon, 25 Apr 2016 03:41:12 +0000 (20:41 -0700)]
Default to Windows 7 SDK
Some of our current crypto bindings require the Win7 SDK.
Once we can rework those, this could reasonably be changed
to Win Vista or possibly Win Server 2003.
I'd like to completely remove support for WinXP and earlier.
Tim Kientzle [Mon, 25 Apr 2016 00:13:45 +0000 (17:13 -0700)]
Issue #656: Fix CVE-2016-1541, VU#862384
When reading OS X metadata entries in Zip archives that were stored
without compression, libarchive would use the uncompressed entry size
to allocate a buffer but would use the compressed entry size to limit
the amount of data copied into that buffer. Since the compressed
and uncompressed sizes are provided by data in the archive itself,
an attacker could manipulate these values to write data beyond
the end of the allocated buffer.
This fix provides three new checks to guard against such
manipulation and to make libarchive generally more robust when
handling this type of entry:
1. If an OS X metadata entry is stored without compression,
abort the entire archive if the compressed and uncompressed
data sizes do not match.
2. When sanity-checking the size of an OS X metadata entry,
abort this entry if either the compressed or uncompressed
size is larger than 4MB.
3. When copying data into the allocated buffer, check the copy
size against both the compressed entry size and uncompressed
entry size.
Tim Kientzle [Sun, 24 Apr 2016 22:16:10 +0000 (15:16 -0700)]
Ensure that cryptor, hmac, and xxhash always define at least one symbol. This prevents headaches with compilers and linkers that choke on empty object files.
Tim Kientzle [Sun, 10 Apr 2016 01:10:37 +0000 (18:10 -0700)]
Issue #655: Be more careful verifying sparse file reading
The old logic took a number of shortcuts; this now does a careful
comparison of the template used to generate the file with
the contents read back, verifying that the read blocks reflect
the expected pattern of zero and non-zero bytes and that the
expected number of holes actually appear.
This change introduces support for building on AIX via CMake. `gcc`
warning options are mapped to equivalent options in the `xlc` suite
where possible. The compiler is overridden to be `xlc_r` instead of
`cc` for thread-safe compilation and linking.
Signed-off-by: Eric N. Vander Weele <ericvw@gmail.com>
Tim Kientzle [Sun, 3 Apr 2016 18:03:22 +0000 (11:03 -0700)]
Issue 550: Fix out-of-bounds read in mtree.
The mtree parser scanned from the end of the string to identify
the filename when the filename is the last element of the line.
If the filename was the entire line, the logic would scan back
to before the start of the string.
The revised logic scans from the beginning of the string
and remembers the last separator position to locate the
trailing filename.
projects / thirdparty / libarchive.git / log
