From aa81764252b58fddec7e614748dbace4fa80d333 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Wed, 20 Aug 2025 13:02:27 +0000 Subject: [PATCH] import UBI libarchive-3.3.3-6.el8_10 --- .../libarchive-3.3.3-Fix-CVE-2025-5914.patch | 42 +++++++++++++++++++ ...p-compression-level-1-check-on-s390x.patch | 32 ++++++++++++++ SPECS/libarchive.spec | 9 +++- 3 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 SOURCES/libarchive-3.3.3-Fix-CVE-2025-5914.patch create mode 100644 SOURCES/libarchive-3.3.3-skip-compression-level-1-check-on-s390x.patch diff --git a/SOURCES/libarchive-3.3.3-Fix-CVE-2025-5914.patch b/SOURCES/libarchive-3.3.3-Fix-CVE-2025-5914.patch new file mode 100644 index 0000000..f90b601 --- /dev/null +++ b/SOURCES/libarchive-3.3.3-Fix-CVE-2025-5914.patch @@ -0,0 +1,42 @@ +From 09685126fcec664e2b8ca595e1fc371bd494d209 Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann +Date: Sun, 11 May 2025 02:17:19 +0200 +Subject: [PATCH] rar: Fix double free with over 4 billion nodes (#2598) + +If a system is capable of handling 4 billion nodes in memory, a double +free could occur because of an unsigned integer overflow leading to a +realloc call with size argument of 0. Eventually, the client will +release that memory again, triggering a double free. + +Signed-off-by: Tobias Stoeckmann +--- + libarchive/archive_read_support_format_rar.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c +index 542532dd..197469b9 100644 +--- a/libarchive/archive_read_support_format_rar.c ++++ b/libarchive/archive_read_support_format_rar.c +@@ -335,8 +335,8 @@ struct rar + int found_first_header; + char has_endarc_header; + struct data_block_offsets *dbo; +- unsigned int cursor; +- unsigned int nodes; ++ size_t cursor; ++ size_t nodes; + char filename_must_match; + + /* LZSS members */ +@@ -1192,7 +1192,7 @@ archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset, + int whence) + { + int64_t client_offset, ret; +- unsigned int i; ++ size_t i; + struct rar *rar = (struct rar *)(a->format->data); + + if (rar->compression_method == COMPRESS_METHOD_STORE) +-- +2.50.1 + diff --git a/SOURCES/libarchive-3.3.3-skip-compression-level-1-check-on-s390x.patch b/SOURCES/libarchive-3.3.3-skip-compression-level-1-check-on-s390x.patch new file mode 100644 index 0000000..570725f --- /dev/null +++ b/SOURCES/libarchive-3.3.3-skip-compression-level-1-check-on-s390x.patch @@ -0,0 +1,32 @@ +From cd35cd9eef0416dbdf7448becce35c752fc3772a Mon Sep 17 00:00:00 2001 +From: Masahiro Matsuya +Date: Fri, 5 Jan 2024 11:33:12 +0900 +Subject: [PATCH] skip-compression-level-1-test-on-s390x + +--- + libarchive/test/test_write_filter_gzip.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libarchive/test/test_write_filter_gzip.c b/libarchive/test/test_write_filter_gzip.c +index 935fb51..b824a77 100644 +--- a/libarchive/test/test_write_filter_gzip.c ++++ b/libarchive/test/test_write_filter_gzip.c +@@ -226,10 +226,15 @@ DEFINE_TEST(test_write_filter_gzip) + assertEqualIntA(a, ARCHIVE_OK, archive_write_close(a)); + assertEqualInt(ARCHIVE_OK, archive_write_free(a)); + ++ /* experiencing same size with compression-level=1 on s390x with libarchve-3.3.3 ++ * related to issues/1515. ++ */ ++ #if !defined(__s390x__) + /* Level 1 really does result in larger data. */ + failure("Compression-level=1 wrote %d bytes; default wrote %d bytes", + (int)used2, (int)used1); + assert(used2 > used1); ++ #endif /* __s390x__ */ + + /* Basic gzip header tests */ + rbuff = (unsigned char *)buff; +-- +2.43.0 + diff --git a/SPECS/libarchive.spec b/SPECS/libarchive.spec index 536eef7..0067b06 100644 --- a/SPECS/libarchive.spec +++ b/SPECS/libarchive.spec @@ -2,7 +2,7 @@ Name: libarchive Version: 3.3.3 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A library for handling streaming archive formats License: BSD @@ -25,6 +25,8 @@ Patch11: libarchive-3.3.3-CVE-2021-31566.patch # Source: https://github.com/libarchive/libarchive/commit/b1b501161013296d19dfe9acb84a341c8a1755b9 Patch12: %{name}-3.3.3-Fix-size-filed-in-pax-header.patch Patch13: %{name}-3.3.3-Fix-CVE-2022-36227.patch +Patch14: %{name}-3.3.3-Fix-CVE-2025-5914.patch +Patch15: %{name}-3.3.3-skip-compression-level-1-check-on-s390x.patch BuildRequires: gcc @@ -232,6 +234,11 @@ run_testsuite %changelog +* Wed Aug 13 2025 Lukas Javorsky - 3.3.3-6 +- Resolves: CVE-2025-5914 +- Skip compression-level=1 size check on s390x. +- Related to https://github.com/libarchive/libarchive/issues/1515 + * Tue Dec 06 2022 Lukas Javorsky - 3.3.3-5 - Fix for CVE-2022-36227