From da9fb16f3fd3c5b9ca5e4218bda883e483bc62d4 Mon Sep 17 00:00:00 2001
From: Pavol Sloboda <psloboda@redhat.com>
Date: Wed, 8 Apr 2026 13:49:55 +0200
Subject: [PATCH] Fix for CVE-2026-4424

Resolves: RHEL-157400
---
 libarchive-3.3.3-Fix-CVE-2026-4424.patch | 23 +++++++++++++++++++++++
 libarchive.spec                          |  3 +++
 2 files changed, 26 insertions(+)
 create mode 100644 libarchive-3.3.3-Fix-CVE-2026-4424.patch

diff --git a/libarchive-3.3.3-Fix-CVE-2026-4424.patch b/libarchive-3.3.3-Fix-CVE-2026-4424.patch
new file mode 100644
index 0000000..a1182a7
--- /dev/null
+++ b/libarchive-3.3.3-Fix-CVE-2026-4424.patch
@@ -0,0 +1,23 @@
+# This patch originally consisted of 3 hunks on the upstream:
+# https://github.com/libarchive/libarchive/pull/2898/changes/e1907c5832b6489c7b4198b0825f857c93a03c10
+# https://github.com/libarchive/libarchive/pull/2898/changes/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375
+# but only the first hunk needs to be backported since the
+# logic fix the second hunk provides does not need to be added
+# as the logic is still correct in the current version of libarchive (3.3.3)
+# thus the vulnerability in the code does not yet exist
+#
+# the third hunk of the patch is not needed either as the part of
+# the code which contains the vulnerability is not yet present in this version (3.3.3)
+diff -Naur libarchive-3.3.3/libarchive/archive_read_support_format_rar.c libarchive-3.3.3_patched/libarchive/archive_read_support_format_rar.c
+--- libarchive-3.3.3/libarchive/archive_read_support_format_rar.c	2018-09-02 08:05:18.000000000 +0200
++++ libarchive-3.3.3_patched/libarchive/archive_read_support_format_rar.c	2026-04-09 08:54:50.569789984 +0200
+@@ -2288,7 +2288,8 @@
+       return (r);
+   }
+ 
+-  if (!rar->dictionary_size || !rar->lzss.window)
++  if (!rar->dictionary_size || !rar->lzss.window ||
++      (unsigned int)(rar->lzss.mask + 1) < rar->dictionary_size)
+   {
+     /* Seems as though dictionary sizes are not used. Even so, minimize
+      * memory usage as much as possible.
diff --git a/libarchive.spec b/libarchive.spec
index 0067b06..c32ba48 100644
--- a/libarchive.spec
+++ b/libarchive.spec
@@ -27,6 +27,9 @@ Patch12:	%{name}-3.3.3-Fix-size-filed-in-pax-header.patch
 Patch13:	%{name}-3.3.3-Fix-CVE-2022-36227.patch
 Patch14:	%{name}-3.3.3-Fix-CVE-2025-5914.patch
 Patch15:	%{name}-3.3.3-skip-compression-level-1-check-on-s390x.patch
+# Source: https://github.com/libarchive/libarchive/pull/2898/changes/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375
+# and: https://github.com/libarchive/libarchive/pull/2898/changes/e1907c5832b6489c7b4198b0825f857c93a03c10
+Patch16:    %{name}-3.3.3-Fix-CVE-2026-4424.patch
 
 
 BuildRequires:  gcc