rpms/libarchive
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Added the other part of the fix for CVE-2026-14164 so libarchive does

Browse Source 
not fail ungracefully (SIGSEGV) when the rar5 issue described in
CVE-2026-14164 occurs

Related: RHEL-190435
This commit is contained in:
Pavol Sloboda 2026-07-16 14:13:20 +02:00
parent 178c5dc75f
commit 07918d4140
3 changed files with 58 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
libarchive-3.5.3-Fix-CVE-2026-14164_part1.patch Normal file
View File

@ -0,0 +1,44 @@
diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c
index 2c5a31d7c1..683e35e065 100644
--- a/libarchive/archive_read_support_format_rar5.c
+++ b/libarchive/archive_read_support_format_rar5.c
@@ -2561,7 +2561,7 @@ static int rar5_read_header(struct archive_read *a,
return ret;
}
-static void init_unpack(struct rar5* rar) {
+static int init_unpack(struct rar5* rar) {
rar->file.calculated_crc32 = 0;
init_window_mask(rar);
@@ -2570,7 +2570,11 @@ static void init_unpack(struct rar5* rar) {
if(rar->cstate.window_size > 0) {
rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
+ if(rar->cstate.window_buf == NULL)
+ return ARCHIVE_FATAL;
rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
+ if(rar->cstate.filtered_buf == NULL)
+ return ARCHIVE_FATAL;
} else {
rar->cstate.window_buf = NULL;
rar->cstate.filtered_buf = NULL;
@@ -2586,6 +2590,7 @@ static void init_unpack(struct rar5* rar) {
memset(&rar->cstate.dd, 0, sizeof(rar->cstate.dd));
memset(&rar->cstate.ldd, 0, sizeof(rar->cstate.ldd));
memset(&rar->cstate.rd, 0, sizeof(rar->cstate.rd));
+ return ARCHIVE_OK;
}
static void update_crc(struct rar5* rar, const uint8_t* p, size_t to_read) {
@@ -3881,7 +3886,8 @@ static int do_uncompress_file(struct archive_read* a) {
/* Don't perform full context reinitialization if we're
* processing a solid archive. */
if(!rar->main.solid || !rar->cstate.window_buf) {
- init_unpack(rar);
+ if((ret = init_unpack(rar)) != ARCHIVE_OK)
+ return ret;
}
rar->cstate.initialized = 1;

13
libarchive-3.5.3-Fix-CVE-2026-14164.patch → libarchive-3.5.3-Fix-CVE-2026-14164_part2.patch
View File

@ -1,10 +1,7 @@
# Patch sources from libarchive upstream
# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
diff -Naur libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c
--- libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c 2022-02-08 09:44:39.000000000 +0100
+++ libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c 2026-06-30 15:28:28.055651344 +0200
@@ -2340,12 +2340,12 @@
--- libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c 2026-07-16 14:03:13.630225900 +0200
+++ libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c 2026-07-16 14:04:51.393140499 +0200
@@ -2340,6 +2340,9 @@
free(rar->cstate.window_buf);
free(rar->cstate.filtered_buf);
@ -13,7 +10,11 @@ diff -Naur libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c libarc
+
if(rar->cstate.window_size > 0) {
rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
if(rar->cstate.window_buf == NULL)
@@ -2347,9 +2350,6 @@
rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
if(rar->cstate.filtered_buf == NULL)
return ARCHIVE_FATAL;
- } else {
- rar->cstate.window_buf = NULL;
- rar->cstate.filtered_buf = NULL;

9
libarchive.spec
View File

@ -2,7 +2,7 @@
Name: libarchive
Version: 3.5.3
Release: 10%{?dist}
Release: 11%{?dist}
Summary: A library for handling streaming archive formats
License: BSD
@ -27,8 +27,10 @@ Patch7: %{name}-3.5.3-Fix-CVE-2026-4111.patch
Patch8: %{name}-3.5.3-Fix-CVE-2026-4424.patch
# Source: https://github.com/libarchive/libarchive/pull/2934/changes/889a228b71f2b1fab8dc5610f6c43ac0e9b92160
Patch9: %{name}-3.5.3-Fix-CVE-2026-5121.patch
# Source: https://github.com/libarchive/libarchive/commit/620bdafa26843ea4b86d97962ad972c5ec0a7986
Patch10: %{name}-3.5.3-Fix-CVE-2026-14164_part1.patch
# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
Patch10: %{name}-3.5.3-Fix-CVE-2026-14164.patch
Patch11: %{name}-3.5.3-Fix-CVE-2026-14164_part2.patch
BuildRequires: automake
@ -236,6 +238,9 @@ run_testsuite
%changelog
* Thu Jul 16 2026 Pavol Sloboda <psloboda@redhat.com> - 3.5.3-11
- Related: CVE-2026-14164
* Tue Jun 30 2026 Pavol Sloboda <psloboda@redhat.com> - 3.5.3-10
- Resolves: CVE-2026-14164