Skip to content

Commit fe39a9f

Browse files
CBL-Mariner-Botazurelinux-securityarchana25-ms
authored
Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch libarchive for CVE-2026-5121, CVE-2026-4426, CVE-2026-4424 [HIGH] - branch 3.0-dev" #16779
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>
1 parent 3bac90c commit fe39a9f

8 files changed

Lines changed: 1453 additions & 11 deletions

File tree

‎SPECS/libarchive/CVE-2026-4424.patch‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
From ec6707deeda82a585bac6ec2b8d64a8a5924c985 Mon Sep 17 00:00:00 2001
2+
From: elhananhaenel <elhanan.haenel@mail.huji.ac.il>
3+
Date: Sat, 7 Mar 2026 22:32:09 +0200
4+
Subject: [PATCH 1/2] rar: fix LZSS window size mismatch after PPMd block
5+
6+
When a PPMd-compressed block updates dictionary_size, the LZSS window
7+
from a prior block is not reallocated. The allocation guard only checks
8+
if dictionary_size is zero or the window pointer is NULL, not whether
9+
the existing window is large enough. This allows copy_from_lzss_window()
10+
to read past the allocated buffer.
11+
12+
Fix the guard to also check whether the current window is undersized.
13+
Add bounds checks in copy_from_lzss_window() and parse_filter() as
14+
defense in depth.
15+
---
16+
libarchive/archive_read_support_format_rar.c | 11 +++++++++--
17+
1 file changed, 9 insertions(+), 2 deletions(-)
18+
19+
diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
20+
index bb06f76..bc3f7d7 100644
21+
--- a/libarchive/archive_read_support_format_rar.c
22+
+++ b/libarchive/archive_read_support_format_rar.c
23+
@@ -2503,7 +2503,8 @@ parse_codes(struct archive_read *a)
24+
return (r);
25+
}
26+
27+
- if (!rar->dictionary_size || !rar->lzss.window)
28+
+ if (!rar->dictionary_size || !rar->lzss.window ||
29+
+ (rar->lzss.mask + 1) < rar->dictionary_size)
30+
{
31+
/* Seems as though dictionary sizes are not used. Even so, minimize
32+
* memory usage as much as possible.
33+
@@ -3104,6 +3105,11 @@ copy_from_lzss_window(struct archive_read *a, uint8_t *buffer,
34+
35+
windowoffs = lzss_offset_for_position(&rar->lzss, startpos);
36+
firstpart = lzss_size(&rar->lzss) - windowoffs;
37+
+ if (length > lzss_size(&rar->lzss)) {
38+
+ archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
39+
+ "Bad RAR file data");
40+
+ return (ARCHIVE_FATAL);
41+
+ }
42+
if (firstpart < 0) {
43+
archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
44+
"Bad RAR file data");
45+
@@ -3266,7 +3272,8 @@ parse_filter(struct archive_read *a, const uint8_t *bytes, uint16_t length, uint
46+
else
47+
blocklength = prog ? prog->oldfilterlength : 0;
48+
49+
- if (blocklength > rar->dictionary_size)
50+
+ if (blocklength > rar->dictionary_size ||
51+
+ blocklength > (uint32_t)(rar->lzss.mask + 1))
52+
return 0;
53+
54+
registers[3] = PROGRAM_SYSTEM_GLOBAL_ADDRESS;
55+
--
56+
2.45.4
57+
58+
59+
From 5fc14fd997dea3838ed49005b6e03241cb82f390 Mon Sep 17 00:00:00 2001
60+
From: elhananhaenel <elhanan.haenel@mail.huji.ac.il>
61+
Date: Sun, 8 Mar 2026 15:29:46 +0200
62+
Subject: [PATCH 2/2] Fix -Wsign-compare: cast mask+1 to unsigned int
63+
64+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
65+
Upstream-reference: https://github.com/libarchive/libarchive/commit/762b30011a932c6ab988fd8664899a07eb6b7657.patch
66+
---
67+
libarchive/archive_read_support_format_rar.c | 2 +-
68+
1 file changed, 1 insertion(+), 1 deletion(-)
69+
70+
diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
71+
index bc3f7d7..ee02cf9 100644
72+
--- a/libarchive/archive_read_support_format_rar.c
73+
+++ b/libarchive/archive_read_support_format_rar.c
74+
@@ -2504,7 +2504,7 @@ parse_codes(struct archive_read *a)
75+
}
76+
77+
if (!rar->dictionary_size || !rar->lzss.window ||
78+
- (rar->lzss.mask + 1) < rar->dictionary_size)
79+
+ (unsigned int)(rar->lzss.mask + 1) < rar->dictionary_size)
80+
{
81+
/* Seems as though dictionary sizes are not used. Even so, minimize
82+
* memory usage as much as possible.
83+
--
84+
2.45.4
85+

‎SPECS/libarchive/CVE-2026-4426.patch‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
From b02edc81ab3947b0b9fc18fd5a6b127a6e0f447c Mon Sep 17 00:00:00 2001
2+
From: elhananhaenel <elhanan.haenel@mail.huji.ac.il>
3+
Date: Sat, 7 Mar 2026 22:14:23 +0200
4+
Subject: [PATCH 1/2] iso9660: validate pz_log2_bs in parse_rockridge_ZF1()
5+
6+
The zisofs block size exponent (pz_log2_bs) read from the Rock Ridge ZF
7+
extension entry is used directly in shift expressions without validation.
8+
The zisofs specification only permits values 15, 16, or 17 (corresponding
9+
to 32K, 64K, and 128K block sizes).
10+
11+
When pz_log2_bs >= 64 on 64-bit systems (or >= 32 on 32-bit), the
12+
expression (size_t)1UL << pz_log2_bs is undefined behavior per C11
13+
6.5.7. On 32-bit systems, a large exponent also causes the block pointer
14+
allocation size computation (ceil + 1) * 4 to overflow to zero, leading
15+
to a heap buffer overflow write after malloc(0).
16+
17+
Fix: reject any pz_log2_bs outside the range [15, 17] by disabling
18+
zisofs for the entry (file->pz = 0), which prevents the zisofs
19+
decompression path from executing.
20+
21+
Found by fuzzing with ASAN/UBSAN.
22+
---
23+
libarchive/archive_read_support_format_iso9660.c | 15 ++++++++++-----
24+
1 file changed, 10 insertions(+), 5 deletions(-)
25+
26+
diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c
27+
index baf265f..8dfeb88 100644
28+
--- a/libarchive/archive_read_support_format_iso9660.c
29+
+++ b/libarchive/archive_read_support_format_iso9660.c
30+
@@ -2756,11 +2756,16 @@ parse_rockridge_ZF1(struct file_info *file, const unsigned char *data,
31+
{
32+
33+
if (data[0] == 0x70 && data[1] == 0x7a && data_length == 12) {
34+
- /* paged zlib */
35+
- file->pz = 1;
36+
- file->pz_log2_bs = data[3];
37+
- file->pz_uncompressed_size = archive_le32dec(&data[4]);
38+
- }
39+
+ /* paged zlib */
40+
+ file->pz = 1;
41+
+ file->pz_log2_bs = data[3];
42+
+ if (file->pz_log2_bs < 15 || file->pz_log2_bs > 17) {
43+
+ /* Invalid block size exponent; disable zisofs. */
44+
+ file->pz = 0;
45+
+ return;
46+
+ }
47+
+ file->pz_uncompressed_size = archive_le32dec(&data[4]);
48+
+ }
49+
}
50+
51+
static void
52+
--
53+
2.45.4
54+
55+
56+
From f3299fa94765152bdc40ddfee4ec0052921ea0f9 Mon Sep 17 00:00:00 2001
57+
From: elhananhaenel <elhanan.haenel@mail.huji.ac.il>
58+
Date: Sun, 8 Mar 2026 15:33:50 +0200
59+
Subject: [PATCH 2/2] Add TODO comment for future error propagation
60+
61+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
62+
Upstream-reference: https://github.com/libarchive/libarchive/commit/071e2e1c5981372d40482995ba83c98c8b595418.patch
63+
---
64+
libarchive/archive_read_support_format_iso9660.c | 5 ++++-
65+
1 file changed, 4 insertions(+), 1 deletion(-)
66+
67+
diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c
68+
index 8dfeb88..28d868b 100644
69+
--- a/libarchive/archive_read_support_format_iso9660.c
70+
+++ b/libarchive/archive_read_support_format_iso9660.c
71+
@@ -2760,7 +2760,10 @@ parse_rockridge_ZF1(struct file_info *file, const unsigned char *data,
72+
file->pz = 1;
73+
file->pz_log2_bs = data[3];
74+
if (file->pz_log2_bs < 15 || file->pz_log2_bs > 17) {
75+
- /* Invalid block size exponent; disable zisofs. */
76+
+ /* TODO: Return an error here instead of silently
77+
+ * disabling zisofs. That requires propagating an
78+
+ * error return through parse_rockridge() and its
79+
+ * callers. */
80+
file->pz = 0;
81+
return;
82+
}
83+
--
84+
2.45.4
85+

0 commit comments

Comments
 (0)