From 640e340574bb053202bdf80a3af339550c13b4c0 Mon Sep 17 00:00:00 2001 From: Pavol Sloboda Date: Wed, 15 Jul 2026 14:45:40 +0200 Subject: [PATCH] Added the other part of the fix for CVE-2026-14164 so libarchive does not fail ungracefully (SIGSEGV) when the rar5 issue described in CVE-2026-14164 occurs Related: RHEL-190437 --- 0007-Fix-CVE-2026-14164.patch | 22 --------------- 0007-Fix-CVE-2026-14164_part1.patch | 44 +++++++++++++++++++++++++++++ 0008-Fix-CVE-2026-14164_part2.patch | 24 ++++++++++++++++ libarchive.spec | 9 ++++-- 4 files changed, 75 insertions(+), 24 deletions(-) delete mode 100644 0007-Fix-CVE-2026-14164.patch create mode 100644 0007-Fix-CVE-2026-14164_part1.patch create mode 100644 0008-Fix-CVE-2026-14164_part2.patch diff --git a/0007-Fix-CVE-2026-14164.patch b/0007-Fix-CVE-2026-14164.patch deleted file mode 100644 index b141334..0000000 --- a/0007-Fix-CVE-2026-14164.patch +++ /dev/null @@ -1,22 +0,0 @@ -# Patch sources from libarchive upstream -# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61 - -diff -Naur libarchive-3.7.7/libarchive/archive_read_support_format_rar5.c libarchive-3.7.7_patched/libarchive/archive_read_support_format_rar5.c ---- libarchive-3.7.7/libarchive/archive_read_support_format_rar5.c 2024-10-13 10:11:23.000000000 +0200 -+++ libarchive-3.7.7_patched/libarchive/archive_read_support_format_rar5.c 2026-06-30 16:12:48.145167461 +0200 -@@ -2487,12 +2487,12 @@ - free(rar->cstate.window_buf); - free(rar->cstate.filtered_buf); - -+ rar->cstate.window_buf = NULL; -+ rar->cstate.filtered_buf = NULL; -+ - if(rar->cstate.window_size > 0) { - rar->cstate.window_buf = calloc(1, rar->cstate.window_size); - rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); -- } else { -- rar->cstate.window_buf = NULL; -- rar->cstate.filtered_buf = NULL; - } - - clear_data_ready_stack(rar); diff --git a/0007-Fix-CVE-2026-14164_part1.patch b/0007-Fix-CVE-2026-14164_part1.patch new file mode 100644 index 0000000..dcdccda --- /dev/null +++ b/0007-Fix-CVE-2026-14164_part1.patch @@ -0,0 +1,44 @@ +diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c +index 2c5a31d7c1..683e35e065 100644 +--- a/libarchive/archive_read_support_format_rar5.c ++++ b/libarchive/archive_read_support_format_rar5.c +@@ -2561,7 +2561,7 @@ static int rar5_read_header(struct archive_read *a, + return ret; + } + +-static void init_unpack(struct rar5* rar) { ++static int init_unpack(struct rar5* rar) { + rar->file.calculated_crc32 = 0; + init_window_mask(rar); + +@@ -2570,7 +2570,11 @@ static void init_unpack(struct rar5* rar) { + + if(rar->cstate.window_size > 0) { + rar->cstate.window_buf = calloc(1, rar->cstate.window_size); ++ if(rar->cstate.window_buf == NULL) ++ return ARCHIVE_FATAL; + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); ++ if(rar->cstate.filtered_buf == NULL) ++ return ARCHIVE_FATAL; + } else { + rar->cstate.window_buf = NULL; + rar->cstate.filtered_buf = NULL; +@@ -2586,6 +2590,7 @@ static void init_unpack(struct rar5* rar) { + memset(&rar->cstate.dd, 0, sizeof(rar->cstate.dd)); + memset(&rar->cstate.ldd, 0, sizeof(rar->cstate.ldd)); + memset(&rar->cstate.rd, 0, sizeof(rar->cstate.rd)); ++ return ARCHIVE_OK; + } + + static void update_crc(struct rar5* rar, const uint8_t* p, size_t to_read) { +@@ -3881,7 +3886,8 @@ static int do_uncompress_file(struct archive_read* a) { + /* Don't perform full context reinitialization if we're + * processing a solid archive. */ + if(!rar->main.solid || !rar->cstate.window_buf) { +- init_unpack(rar); ++ if((ret = init_unpack(rar)) != ARCHIVE_OK) ++ return ret; + } + + rar->cstate.initialized = 1; + diff --git a/0008-Fix-CVE-2026-14164_part2.patch b/0008-Fix-CVE-2026-14164_part2.patch new file mode 100644 index 0000000..03380e5 --- /dev/null +++ b/0008-Fix-CVE-2026-14164_part2.patch @@ -0,0 +1,24 @@ +diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c +index 683e35e065..1f8f8f4359 100644 +--- a/libarchive/archive_read_support_format_rar5.c ++++ b/libarchive/archive_read_support_format_rar5.c +@@ -2568,6 +2568,9 @@ static int init_unpack(struct rar5* rar) { + free(rar->cstate.window_buf); + free(rar->cstate.filtered_buf); + ++ rar->cstate.window_buf = NULL; ++ rar->cstate.filtered_buf = NULL; ++ + if(rar->cstate.window_size > 0) { + rar->cstate.window_buf = calloc(1, rar->cstate.window_size); + if(rar->cstate.window_buf == NULL) +@@ -2575,9 +2578,6 @@ static int init_unpack(struct rar5* rar) { + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); + if(rar->cstate.filtered_buf == NULL) + return ARCHIVE_FATAL; +- } else { +- rar->cstate.window_buf = NULL; +- rar->cstate.filtered_buf = NULL; + } + + clear_data_ready_stack(rar); diff --git a/libarchive.spec b/libarchive.spec index 6b640ed..4cb910f 100644 --- a/libarchive.spec +++ b/libarchive.spec @@ -2,7 +2,7 @@ Name: libarchive Version: 3.7.7 -Release: 9%{?dist} +Release: 10%{?dist} Summary: A library for handling streaming archive formats # Licenses: @@ -55,8 +55,10 @@ Patch0005: 0005-Infinite-loop-in-Rar5-decompression.patch # Source: https://github.com/libarchive/libarchive/pull/2898/changes/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375 # and: https://github.com/libarchive/libarchive/pull/2898/changes/e1907c5832b6489c7b4198b0825f857c93a03c10 Patch0006: 0006-Fix-CVE-2026-4424.patch +# Source: https://github.com/libarchive/libarchive/commit/620bdafa26843ea4b86d97962ad972c5ec0a7986 +Patch0007: 0007-Fix-CVE-2026-14164_part1.patch # Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61 -Patch0007: 0007-Fix-CVE-2026-14164.patch +Patch0008: 0008-Fix-CVE-2026-14164_part2.patch %description Libarchive is a programming library that can create and read several different @@ -266,6 +268,9 @@ run_testsuite %changelog +* Wed Jul 15 2026 Pavol Sloboda - 3.7.7-10 +- Related: CVE-2026-14164 + * Tue Jun 30 2026 Pavol Sloboda - 3.7.7-9 - Resolves: CVE-2026-14164