From d103fd1ec42c77781729e41654cf5d6dc59b0d4f Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 10 Aug 2026 04:40:31 -0400 Subject: [PATCH] import UBI libarchive-3.5.3-11.el9_8 --- ...chive-3.5.3-Fix-CVE-2026-14164_part1.patch | 44 +++++++++++++++++++ ...chive-3.5.3-Fix-CVE-2026-14164_part2.patch | 23 ++++++++++ SPECS/libarchive.spec | 12 ++++- 3 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part1.patch create mode 100644 SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part2.patch diff --git a/SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part1.patch b/SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part1.patch new file mode 100644 index 0000000..dcdccda --- /dev/null +++ b/SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part1.patch @@ -0,0 +1,44 @@ +diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c +index 2c5a31d7c1..683e35e065 100644 +--- a/libarchive/archive_read_support_format_rar5.c ++++ b/libarchive/archive_read_support_format_rar5.c +@@ -2561,7 +2561,7 @@ static int rar5_read_header(struct archive_read *a, + return ret; + } + +-static void init_unpack(struct rar5* rar) { ++static int init_unpack(struct rar5* rar) { + rar->file.calculated_crc32 = 0; + init_window_mask(rar); + +@@ -2570,7 +2570,11 @@ static void init_unpack(struct rar5* rar) { + + if(rar->cstate.window_size > 0) { + rar->cstate.window_buf = calloc(1, rar->cstate.window_size); ++ if(rar->cstate.window_buf == NULL) ++ return ARCHIVE_FATAL; + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); ++ if(rar->cstate.filtered_buf == NULL) ++ return ARCHIVE_FATAL; + } else { + rar->cstate.window_buf = NULL; + rar->cstate.filtered_buf = NULL; +@@ -2586,6 +2590,7 @@ static void init_unpack(struct rar5* rar) { + memset(&rar->cstate.dd, 0, sizeof(rar->cstate.dd)); + memset(&rar->cstate.ldd, 0, sizeof(rar->cstate.ldd)); + memset(&rar->cstate.rd, 0, sizeof(rar->cstate.rd)); ++ return ARCHIVE_OK; + } + + static void update_crc(struct rar5* rar, const uint8_t* p, size_t to_read) { +@@ -3881,7 +3886,8 @@ static int do_uncompress_file(struct archive_read* a) { + /* Don't perform full context reinitialization if we're + * processing a solid archive. */ + if(!rar->main.solid || !rar->cstate.window_buf) { +- init_unpack(rar); ++ if((ret = init_unpack(rar)) != ARCHIVE_OK) ++ return ret; + } + + rar->cstate.initialized = 1; + diff --git a/SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part2.patch b/SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part2.patch new file mode 100644 index 0000000..18576fc --- /dev/null +++ b/SOURCES/libarchive-3.5.3-Fix-CVE-2026-14164_part2.patch @@ -0,0 +1,23 @@ +diff -Naur libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c +--- libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c 2026-07-16 14:03:13.630225900 +0200 ++++ libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c 2026-07-16 14:04:51.393140499 +0200 +@@ -2340,6 +2340,9 @@ + free(rar->cstate.window_buf); + free(rar->cstate.filtered_buf); + ++ rar->cstate.window_buf = NULL; ++ rar->cstate.filtered_buf = NULL; ++ + if(rar->cstate.window_size > 0) { + rar->cstate.window_buf = calloc(1, rar->cstate.window_size); + if(rar->cstate.window_buf == NULL) +@@ -2347,9 +2350,6 @@ + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); + if(rar->cstate.filtered_buf == NULL) + return ARCHIVE_FATAL; +- } else { +- rar->cstate.window_buf = NULL; +- rar->cstate.filtered_buf = NULL; + } + + rar->cstate.write_ptr = 0; diff --git a/SPECS/libarchive.spec b/SPECS/libarchive.spec index 25695df..6d4e8de 100644 --- a/SPECS/libarchive.spec +++ b/SPECS/libarchive.spec @@ -2,7 +2,7 @@ Name: libarchive Version: 3.5.3 -Release: 9%{?dist} +Release: 11%{?dist} Summary: A library for handling streaming archive formats License: BSD @@ -27,6 +27,10 @@ Patch7: %{name}-3.5.3-Fix-CVE-2026-4111.patch Patch8: %{name}-3.5.3-Fix-CVE-2026-4424.patch # Source: https://github.com/libarchive/libarchive/pull/2934/changes/889a228b71f2b1fab8dc5610f6c43ac0e9b92160 Patch9: %{name}-3.5.3-Fix-CVE-2026-5121.patch +# Source: https://github.com/libarchive/libarchive/commit/620bdafa26843ea4b86d97962ad972c5ec0a7986 +Patch10: %{name}-3.5.3-Fix-CVE-2026-14164_part1.patch +# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61 +Patch11: %{name}-3.5.3-Fix-CVE-2026-14164_part2.patch BuildRequires: automake @@ -234,6 +238,12 @@ run_testsuite %changelog +* Thu Jul 16 2026 Pavol Sloboda - 3.5.3-11 +- Related: CVE-2026-14164 + +* Tue Jun 30 2026 Pavol Sloboda - 3.5.3-10 +- Resolves: CVE-2026-14164 + * Thu Apr 09 2026 Pavol Sloboda - 3.5.3-9 - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121