From ed1f098e4d1714291d78fcc42973b56bd2183f7b Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 10 Aug 2026 07:27:11 -0400 Subject: [PATCH] import UBI libarchive-3.7.7-10.el10_2 --- 0007-Fix-CVE-2026-14164_part1.patch | 44 +++++++++++++++++++++++++++++ 0008-Fix-CVE-2026-14164_part2.patch | 24 ++++++++++++++++ libarchive.spec | 12 +++++++- 3 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 0007-Fix-CVE-2026-14164_part1.patch create mode 100644 0008-Fix-CVE-2026-14164_part2.patch diff --git a/0007-Fix-CVE-2026-14164_part1.patch b/0007-Fix-CVE-2026-14164_part1.patch new file mode 100644 index 0000000..dcdccda --- /dev/null +++ b/0007-Fix-CVE-2026-14164_part1.patch @@ -0,0 +1,44 @@ +diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c +index 2c5a31d7c1..683e35e065 100644 +--- a/libarchive/archive_read_support_format_rar5.c ++++ b/libarchive/archive_read_support_format_rar5.c +@@ -2561,7 +2561,7 @@ static int rar5_read_header(struct archive_read *a, + return ret; + } + +-static void init_unpack(struct rar5* rar) { ++static int init_unpack(struct rar5* rar) { + rar->file.calculated_crc32 = 0; + init_window_mask(rar); + +@@ -2570,7 +2570,11 @@ static void init_unpack(struct rar5* rar) { + + if(rar->cstate.window_size > 0) { + rar->cstate.window_buf = calloc(1, rar->cstate.window_size); ++ if(rar->cstate.window_buf == NULL) ++ return ARCHIVE_FATAL; + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); ++ if(rar->cstate.filtered_buf == NULL) ++ return ARCHIVE_FATAL; + } else { + rar->cstate.window_buf = NULL; + rar->cstate.filtered_buf = NULL; +@@ -2586,6 +2590,7 @@ static void init_unpack(struct rar5* rar) { + memset(&rar->cstate.dd, 0, sizeof(rar->cstate.dd)); + memset(&rar->cstate.ldd, 0, sizeof(rar->cstate.ldd)); + memset(&rar->cstate.rd, 0, sizeof(rar->cstate.rd)); ++ return ARCHIVE_OK; + } + + static void update_crc(struct rar5* rar, const uint8_t* p, size_t to_read) { +@@ -3881,7 +3886,8 @@ static int do_uncompress_file(struct archive_read* a) { + /* Don't perform full context reinitialization if we're + * processing a solid archive. */ + if(!rar->main.solid || !rar->cstate.window_buf) { +- init_unpack(rar); ++ if((ret = init_unpack(rar)) != ARCHIVE_OK) ++ return ret; + } + + rar->cstate.initialized = 1; + diff --git a/0008-Fix-CVE-2026-14164_part2.patch b/0008-Fix-CVE-2026-14164_part2.patch new file mode 100644 index 0000000..03380e5 --- /dev/null +++ b/0008-Fix-CVE-2026-14164_part2.patch @@ -0,0 +1,24 @@ +diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c +index 683e35e065..1f8f8f4359 100644 +--- a/libarchive/archive_read_support_format_rar5.c ++++ b/libarchive/archive_read_support_format_rar5.c +@@ -2568,6 +2568,9 @@ static int init_unpack(struct rar5* rar) { + free(rar->cstate.window_buf); + free(rar->cstate.filtered_buf); + ++ rar->cstate.window_buf = NULL; ++ rar->cstate.filtered_buf = NULL; ++ + if(rar->cstate.window_size > 0) { + rar->cstate.window_buf = calloc(1, rar->cstate.window_size); + if(rar->cstate.window_buf == NULL) +@@ -2575,9 +2578,6 @@ static int init_unpack(struct rar5* rar) { + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); + if(rar->cstate.filtered_buf == NULL) + return ARCHIVE_FATAL; +- } else { +- rar->cstate.window_buf = NULL; +- rar->cstate.filtered_buf = NULL; + } + + clear_data_ready_stack(rar); diff --git a/libarchive.spec b/libarchive.spec index 8b62a75..4cb910f 100644 --- a/libarchive.spec +++ b/libarchive.spec @@ -2,7 +2,7 @@ Name: libarchive Version: 3.7.7 -Release: 8%{?dist} +Release: 10%{?dist} Summary: A library for handling streaming archive formats # Licenses: @@ -55,6 +55,10 @@ Patch0005: 0005-Infinite-loop-in-Rar5-decompression.patch # Source: https://github.com/libarchive/libarchive/pull/2898/changes/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375 # and: https://github.com/libarchive/libarchive/pull/2898/changes/e1907c5832b6489c7b4198b0825f857c93a03c10 Patch0006: 0006-Fix-CVE-2026-4424.patch +# Source: https://github.com/libarchive/libarchive/commit/620bdafa26843ea4b86d97962ad972c5ec0a7986 +Patch0007: 0007-Fix-CVE-2026-14164_part1.patch +# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61 +Patch0008: 0008-Fix-CVE-2026-14164_part2.patch %description Libarchive is a programming library that can create and read several different @@ -264,6 +268,12 @@ run_testsuite %changelog +* Wed Jul 15 2026 Pavol Sloboda - 3.7.7-10 +- Related: CVE-2026-14164 + +* Tue Jun 30 2026 Pavol Sloboda - 3.7.7-9 +- Resolves: CVE-2026-14164 + * Wed Apr 08 2026 Pavol Sloboda - 3.7.7-8 - Resolves: CVE-2026-4424