summaryrefslogtreecommitdiff
path: root/libarchive
Commit message (Collapse)AuthorAgeFilesLines
...
* | | | | Hide internal symbols on platforms that support visibility annotations (see ↵Yuri Gribov2022-07-272-0/+4
| |/ / / |/| | | | | | | | | | | discussion in gh-1017).
* | | | Merge pull request #1753 from bungeman/check_size_attributeTim Kientzle2022-07-244-0/+107
|\ \ \ \ | | | | | | | | | | Validate entry_bytes_remaining in pax_attribute
| * | | | Validate entry_bytes_remaining in pax_attributeBen Wagner2022-07-244-0/+107
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `size` attribute may contain a negative or too large value. Check the range of the `entry_bytes_remaining` in `pax_attribute` the same way as `header_common`. The test which is added passes both with and without this change in a normal debug build. It is necessary to run with `-fsanitize=undefined` to see that the undefined behavior is avoided. Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48467
* | | | libarchive: Handle a `calloc` returning NULL (fixes #1754)obiwac2022-07-221-0/+8
|/ / /
* | | Fixed issue #1743: Changed sprintf to safer snprintfSean McBride2022-06-2222-76/+76
| | | | | | | | | | | | | | | | | | Also changed a few vsprintf to vsnprintf. Most cases were trivial, one private function was changed to take the buffer length, one case required some fancy arithmetic.
* | | Merge pull request #1729 from bog-dan-ro/fix_comiple_androidMartin Matuška2022-06-191-0/+4
|\ \ \ | | | | | | | | Fix compile on Android
| * | | Fix compile on AndroidBogDan Vatra2022-05-161-0/+4
| | |/ | |/| | | | | | | Fixes: #890
* | | Merge pull request #1732 from asuka-mio/masterMartin Matuška2022-06-191-1/+2
|\ \ \ | |_|/ |/| | Bionic c deprecates readdir_r too
| * | Bionic c deprecates readdir_r tootarsin2022-05-211-1/+2
| |/ | | | | | | * See https://android.googlesource.com/platform/bionic/+/f19af37b5ee6cd5283683195d692fe3f713db2a5
* | Merge pull request #1724 from elieux-contrib/wincrypto-sha256-384-512-fixMartin Matuška2022-05-291-8/+8
|\ \ | | | | | | archive_digest: Use correct providers with Windows Crypto
| * | archive_digest: Use correct providers with Windows CryptoDavid Macek2022-04-171-8/+8
| |/ | | | | | | | | | | | | | | | | | | | | | | | | Trying to use SHA256, SHA384 or SHA512 with mtree when linked against Windows Crypto would result in silent failure. The call to `CryptCreateHash` would fail with 0x80090008. The docs[1] say that these algorithms require a different crypto provider, so let's make that a parameter for `win_crypto_init` and choose at the call site along with the algorithm. [1] https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id Signed-off-by: David Macek <david.macek.0@gmail.com>
* | archive_write_open.3, archive_read_open.3: endsGaël PORTAY2022-05-121-0/+1
|/
* Libarchive 3.6.2devMartin Matuska2022-04-082-3/+3
|
* Release 3.6.1Martin Matuska2022-04-081-1/+1
|
* archive_digest: check return value of EVP_DigestInit()Emil Velikov2022-04-051-6/+12
| | | | | | | | | | | | The function returns 0 on error, which is seemingly very common with OpenSSL 3.0 and rmd160. Just error check the lot, so we don't get even more random failures with future releases of OpenSSL. Fixes #1549 Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
* RAR reader: fix heap-use-after-free in run_filters()Martin Matuska2022-04-031-0/+17
| | | | | OSS-Fuzz issue 46279 Fixes #1715
* ISO reader: fix possible heap buffer overflow in read_children()Martin Matuska2022-03-301-1/+2
| | | | | OSS-Fuzz issue: 38764 Fixes #1685
* ZIP reader: fix possible out-of-bounds read in zipx_lzma_alone_init()Tim Kientzle2022-03-241-1/+1
| | | | Fixes #1672
* Add macro for dirfd() on HP-UX because no full POSIX.1-2008 coverage existsMichael Osipov2022-03-111-1/+6
| | | | | HP-UX does neither provide a function nor a macro. This solution based on an issue with vim: https://github.com/vim/vim/issues/6838
* Remove the unused variable `detected_bytes`Ken Matsui2022-03-051-4/+1
|
* Fix use of At mdoc(7) macroMateusz Piotrowski2022-03-041-1/+1
|
* RAR reader: fix null-dereference in RAR (v4) filter codeMartin Matuska2022-02-191-4/+9
| | | | | | Add safety check to run_filters() and fix return codes Reported-by: OSS-Fuzz #44843
* 7zip reader: style fixes after 3962d596dMartin Matuska2022-02-191-6/+9
|
* Merge pull request #1670 from bradking/include-platform-firstMartin Matuška2022-02-192-2/+4
|\ | | | | windows: include archive_platform.h first in blake2s sources
| * windows: include archive_platform.h first in blake2s sourcesBrad King2022-02-162-2/+4
| | | | | | | | | | | | | | | | Move the inclusion added by commit 90978db1 (windows: make sure we use the right calling convention for libc, 2021-10-13, v3.6.0~39^2~1) to be first. This is our convention in all other `.c` sources. It ensures that our configured `_WIN32_WINNT` value is defined before including any system headers.
* | Merge pull request #1668 from mgorny/missing-zlibMartin Matuška2022-02-193-11/+30
|\ \ | | | | | | Fix some test failures when building --without-zlib
| * | Handle missing zlib in test_read_format_zip_7z_deflateMichał Górny2022-02-121-6/+25
| | |
| * | Fix expected error messages in test_read_format_zip_winzip_aes*Michał Górny2022-02-122-5/+5
| |/ | | | | | | | | Fix expected error messages when libarchive is compiled --without-zlib, in order to fix test failures.
* | code reviewcielavenir2022-02-191-7/+7
| |
* | Fix 7z PPMD reading beyond boundarycielavenir2022-02-181-8/+22
| |
* | RAR reader: fix heap-use-after-free in RAR (v4) filter codeMartin Matuska2022-02-161-17/+29
| | | | | | | | | | | | | | | | Rework function expand() to process integer passed by reference and return an archive error code. Fixes: 01a2d329dfc7 (support rar filters) Reported-by: OSS-Fuzz #44547
* | tests: reduce sample size for RAR filter testMartin Matuska2022-02-142-26653/+2102
| |
* | Libarchive 3.6.1devMartin Matuska2022-02-142-3/+3
|/
* Release 3.6.0v3.6.0Martin Matuska2022-02-091-1/+1
|
* Libarchive 3.6.0devMartin Matuska2022-02-082-3/+3
|
* Merge pull request #1657 from kientzle/ReorganizeTestCodeMartin Matuška2022-02-087-7/+0
|\ | | | | Reorganize test code a bit
| * Reorganize test code a bitTim Kientzle2022-02-017-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A few guiding principles: * Each test source file includes ONLY "test.h" to make it easy to create new tests. * Each test suite has a "test.h" that includes "test_util/test_common.h" to get access to all the common testing utility functions. So "test_common.h" is then responsible for including any smaller headers that declare specific pieces of shared test functionality. I've also pulled some test filtering logic that was _only_ used in test_main.c into that file, and repurposed "test_utils.[ch]" for common utility code. (Eventually, a lot of the assertion helpers currently in "test_main.c" should probably be organized into one or more source files of their own.)
* | Merge pull request #1664 from juikim/masterMartin Matuška2022-02-081-0/+8
|\ \ | | | | | | Enable LZMA support for FreeBSD
| * | Enable LZMA support for FreeBSDJung-uk Kim2022-02-071-0/+8
| | | | | | | | | | | | All supported FreeBSD releases have LZMA by default.
* | | Merge pull request #1493 from antekone/rar5_ossfuzz_30459Martin Matuška2022-02-083-0/+36
|\ \ \ | |/ / |/| | RAR5 reader: add more checks for invalid extraction parameters
| * | RAR5 reader: add more checks for invalid extraction parametersGrzegorz Antoniak2022-02-083-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some specially crafted files declare invalid extraction parameters that can confuse the RAR5 reader. One of the arguments is the declared window size parameter that the archive file can declare for each file stored in the archive. Some crafted files declare window size equal to 0, which is clearly wrong. This commit adds additional safety checks decreasing the tolerance of the RAR5 format. This commit also contains OSSFuzz sample #30459.
* | | Fix typo in libarchive/archive_read_support_filter_lzop.cYounes El-karama2022-02-071-1/+1
|/ / | | | | Extra "dot" in line 176 of libarchive/archive_read_support_filter_lzop.c
* | RAR5 reader: fix invalid memory access in some filesGrzegorz Antoniak2022-02-063-6/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RAR5 reader uses several variables to manage the window buffer during extraction: the buffer itself (`window_buf`), the current size of the window buffer (`window_size`), and a helper variable (`window_mask`) that is used to constrain read and write offsets to the window buffer. Some specially crafted files can force the unpacker to update the `window_mask` variable to a value that is out of sync with current buffer size. If the `window_mask` will be bigger than the actual buffer size, then an invalid access operation can happen (SIGSEGV). This commit ensures that if the `window_size` and `window_mask` will be changed, the window buffer will be reallocated to the proper size, so no invalid memory operation should be possible. This commit contains a test file from OSSFuzz #30442.
* | Merge pull request #1448 from arichardson/add-test-slow-hostMartin Matuška2022-02-061-1/+1
|\ \ | | | | | | Reduce test_write_format_7zip_large_lzma1 buffer size
| * | Reduce test_write_format_7zip_large_lzma1 buffer sizeAlex Richardson2021-03-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some of the test_write_format_7zip_large take longer than 10 minutes to run on QEMU-RISC-V and therefore time out when run as part of the FreeBSD test suite. This is even more noticeable when running on a CHERI-enabled QEMU since the emulation of tagged memory makes it run slower. On my local machine the impact is not as extreme, but test_write_format_7zip_large_lzma1 takes 375ms when TEST_SLOW_HOST is set and 8.2 seconds normally (i.e. 22 times slower). The other alternative would be to skip these tests when not running on real hardware, but it seems to me that compressing a smaller amount of random data is preferable.
* | | Merge pull request #1655 from alexey-pelykh/fix-android_lf-includeMartin Matuška2022-02-062-2/+2
|\ \ \ | | | | | | | | Include android_lf.h only for libarchive sources
| * | | Include android_lf.h only for libarchive sourcesAlexey Pelykh2022-01-232-2/+2
| | | |
* | | | zip: fix possible endless loop if reading a truncated zstd archiveMartin Matuska2022-02-051-0/+9
| | | | | | | | | | | | | | | | The fix is analogous to the behavior in case of bzip2 compression.
* | | | Merge pull request #1518 from ghost/zip-zstdMartin Matuška2022-02-054-0/+381
|\ \ \ \ | | | | | | | | | | ZIP reader: added support for Zstd decompression
| * | | | Add offset variable to zip_read_data_zipx_zstdjo620kix2021-03-311-0/+2
| | | | |
View Lorry Controller Status