Skip to content

Commit f0d3b57

Browse files
SumitJenaHCLSumitJenaHCL
authored
1 parent be6c44a commit f0d3b57

File tree

10 files changed

+736
-11
lines changed

10 files changed

+736
-11
lines changed

‎SPECS/libarchive/CVE-2025-5914.patch‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From 758e703c7b552032336ec49debd9323602e34b37 Mon Sep 17 00:00:00 2001
2+
From: SumitJenaHCL <[email protected]>
3+
Date: Thu, 26 Jun 2025 20:30:27 +0000
4+
Subject: [PATCH] Patch CVE-2025-5914
5+
6+
Upstream Patch Reference: https://github.com/libarchive/libarchive/pull/2598/commits/196029dd0a17cd17c916eada9085839032b76ec9
7+
---
8+
libarchive/archive_read_support_format_rar.c | 6 +++---
9+
1 file changed, 3 insertions(+), 3 deletions(-)
10+
11+
diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
12+
index cf448b0..c1c1690 100644
13+
--- a/libarchive/archive_read_support_format_rar.c
14+
+++ b/libarchive/archive_read_support_format_rar.c
15+
@@ -335,8 +335,8 @@ struct rar
16+
int found_first_header;
17+
char has_endarc_header;
18+
struct data_block_offsets *dbo;
19+
- unsigned int cursor;
20+
- unsigned int nodes;
21+
+ size_t cursor;
22+
+ size_t nodes;
23+
char filename_must_match;
24+
25+
/* LZSS members */
26+
@@ -1182,7 +1182,7 @@ archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset,
27+
int whence)
28+
{
29+
int64_t client_offset, ret;
30+
- unsigned int i;
31+
+ size_t i;
32+
struct rar *rar = (struct rar *)(a->format->data);
33+
34+
if (rar->compression_method == COMPRESS_METHOD_STORE)
35+
--
36+
2.45.2
37+

‎SPECS/libarchive/CVE-2025-5915.patch‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
From 70f9b100b509c1424b09d897cb9e85cac8b54405 Mon Sep 17 00:00:00 2001
2+
From: SumitJenaHCL <[email protected]>
3+
Date: Mon, 23 Jun 2025 17:34:07 +0000
4+
Subject: [PATCH] Patch CVE-2025-5915
5+
6+
Upstream Patch Reference: https://github.com/libarchive/libarchive/pull/2599
7+
---
8+
Makefile.am | 2 +
9+
libarchive/archive_read_support_format_rar.c | 17 ++++---
10+
libarchive/test/CMakeLists.txt | 1 +
11+
.../test/test_read_format_rar_overflow.c | 48 +++++++++++++++++++
12+
.../test/test_read_format_rar_overflow.rar.uu | 11 +++++
13+
5 files changed, 72 insertions(+), 7 deletions(-)
14+
create mode 100644 libarchive/test/test_read_format_rar_overflow.c
15+
create mode 100644 libarchive/test/test_read_format_rar_overflow.rar.uu
16+
17+
diff --git a/Makefile.am b/Makefile.am
18+
index a36126c..a4cc312 100644
19+
--- a/Makefile.am
20+
+++ b/Makefile.am
21+
@@ -517,6 +517,7 @@ libarchive_test_SOURCES= \
22+
libarchive/test/test_read_format_rar_encryption_header.c \
23+
libarchive/test/test_read_format_rar_filter.c \
24+
libarchive/test/test_read_format_rar_invalid1.c \
25+
+ libarchive/test/test_read_format_rar_overflow.c \
26+
libarchive/test/test_read_format_rar5.c \
27+
libarchive/test/test_read_format_raw.c \
28+
libarchive/test/test_read_format_tar.c \
29+
@@ -883,6 +884,7 @@ libarchive_test_EXTRA_DIST=\
30+
libarchive/test/test_read_format_rar_multivolume.part0003.rar.uu \
31+
libarchive/test/test_read_format_rar_multivolume.part0004.rar.uu \
32+
libarchive/test/test_read_format_rar_noeof.rar.uu \
33+
+ libarchive/test/test_read_format_rar_overflow.rar.uu \
34+
libarchive/test/test_read_format_rar_ppmd_lzss_conversion.rar.uu \
35+
libarchive/test/test_read_format_rar_ppmd_use_after_free.rar.uu \
36+
libarchive/test/test_read_format_rar_ppmd_use_after_free2.rar.uu \
37+
diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
38+
index ff1ea9c..bb06f76 100644
39+
--- a/libarchive/archive_read_support_format_rar.c
40+
+++ b/libarchive/archive_read_support_format_rar.c
41+
@@ -451,7 +451,7 @@ static int read_filter(struct archive_read *, int64_t *);
42+
static int rar_decode_byte(struct archive_read*, uint8_t *);
43+
static int execute_filter(struct archive_read*, struct rar_filter *,
44+
struct rar_virtual_machine *, size_t);
45+
-static int copy_from_lzss_window(struct archive_read *, void *, int64_t, int);
46+
+static int copy_from_lzss_window(struct archive_read *, uint8_t *, int64_t, int);
47+
static inline void vm_write_32(struct rar_virtual_machine*, size_t, uint32_t);
48+
static inline uint32_t vm_read_32(struct rar_virtual_machine*, size_t);
49+
50+
@@ -2929,7 +2929,7 @@ expand(struct archive_read *a, int64_t *end)
51+
}
52+
53+
if ((symbol = read_next_symbol(a, &rar->maincode)) < 0)
54+
- return (ARCHIVE_FATAL);
55+
+ goto bad_data;
56+
57+
if (symbol < 256)
58+
{
59+
@@ -2956,14 +2956,14 @@ expand(struct archive_read *a, int64_t *end)
60+
else
61+
{
62+
if (parse_codes(a) != ARCHIVE_OK)
63+
- return (ARCHIVE_FATAL);
64+
+ goto bad_data;
65+
continue;
66+
}
67+
}
68+
else if(symbol==257)
69+
{
70+
if (!read_filter(a, end))
71+
- return (ARCHIVE_FATAL);
72+
+ goto bad_data;
73+
continue;
74+
}
75+
else if(symbol==258)
76+
@@ -3048,7 +3048,7 @@ expand(struct archive_read *a, int64_t *end)
77+
{
78+
if ((lowoffsetsymbol =
79+
read_next_symbol(a, &rar->lowoffsetcode)) < 0)
80+
- return (ARCHIVE_FATAL);
81+
+ goto bad_data;
82+
if(lowoffsetsymbol == 16)
83+
{
84+
rar->numlowoffsetrepeats = 15;
85+
@@ -3096,7 +3096,7 @@ bad_data:
86+
}
87+
88+
static int
89+
-copy_from_lzss_window(struct archive_read *a, void *buffer,
90+
+copy_from_lzss_window(struct archive_read *a, uint8_t *buffer,
91+
int64_t startpos, int length)
92+
{
93+
int windowoffs, firstpart;
94+
@@ -3111,7 +3111,7 @@ copy_from_lzss_window(struct archive_read *a, void *buffer,
95+
}
96+
if (firstpart < length) {
97+
memcpy(buffer, &rar->lzss.window[windowoffs], firstpart);
98+
- memcpy(buffer, &rar->lzss.window[0], length - firstpart);
99+
+ memcpy(buffer + firstpart, &rar->lzss.window[0], length - firstpart);
100+
} else {
101+
memcpy(buffer, &rar->lzss.window[windowoffs], length);
102+
}
103+
@@ -3266,6 +3266,9 @@ parse_filter(struct archive_read *a, const uint8_t *bytes, uint16_t length, uint
104+
else
105+
blocklength = prog ? prog->oldfilterlength : 0;
106+
107+
+ if (blocklength > rar->dictionary_size)
108+
+ return 0;
109+
+
110+
registers[3] = PROGRAM_SYSTEM_GLOBAL_ADDRESS;
111+
registers[4] = blocklength;
112+
registers[5] = prog ? prog->usagecount : 0;
113+
diff --git a/libarchive/test/CMakeLists.txt b/libarchive/test/CMakeLists.txt
114+
index 314c972..74d2abd 100644
115+
--- a/libarchive/test/CMakeLists.txt
116+
+++ b/libarchive/test/CMakeLists.txt
117+
@@ -161,6 +161,7 @@ IF(ENABLE_TEST)
118+
test_read_format_rar_encryption_partially.c
119+
test_read_format_rar_invalid1.c
120+
test_read_format_rar_filter.c
121+
+ test_read_format_rar_overflow.c
122+
test_read_format_rar5.c
123+
test_read_format_raw.c
124+
test_read_format_tar.c
125+
diff --git a/libarchive/test/test_read_format_rar_overflow.c b/libarchive/test/test_read_format_rar_overflow.c
126+
new file mode 100644
127+
index 0000000..b39ed6b
128+
--- /dev/null
129+
+++ b/libarchive/test/test_read_format_rar_overflow.c
130+
@@ -0,0 +1,48 @@
131+
+/*-
132+
+ * Copyright (c) 2003-2025 Tim Kientzle
133+
+ * All rights reserved.
134+
+ *
135+
+ * Redistribution and use in source and binary forms, with or without
136+
+ * modification, are permitted provided that the following conditions
137+
+ * are met:
138+
+ * 1. Redistributions of source code must retain the above copyright
139+
+ * notice, this list of conditions and the following disclaimer.
140+
+ * 2. Redistributions in binary form must reproduce the above copyright
141+
+ * notice, this list of conditions and the following disclaimer in the
142+
+ * documentation and/or other materials provided with the distribution.
143+
+ *
144+
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
145+
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
146+
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
147+
+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
148+
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
149+
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
150+
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
151+
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
152+
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
153+
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
154+
+ */
155+
+#include "test.h"
156+
+
157+
+DEFINE_TEST(test_read_format_rar_overflow)
158+
+{
159+
+ struct archive *a;
160+
+ struct archive_entry *ae;
161+
+ const char reffile[] = "test_read_format_rar_overflow.rar";
162+
+ const void *buff;
163+
+ size_t size;
164+
+ int64_t offset;
165+
+
166+
+ extract_reference_file(reffile);
167+
+ assert((a = archive_read_new()) != NULL);
168+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_support_filter_all(a));
169+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_all(a));
170+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_open_filename(a, reffile, 1024));
171+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_next_header(a, &ae));
172+
+ assertEqualInt(48, archive_entry_size(ae));
173+
+ /* The next call should reproduce Issue #2565 */
174+
+ assertEqualIntA(a, ARCHIVE_FATAL, archive_read_data_block(a, &buff, &size, &offset));
175+
+
176+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));
177+
+ assertEqualInt(ARCHIVE_OK, archive_read_free(a));
178+
+}
179+
diff --git a/libarchive/test/test_read_format_rar_overflow.rar.uu b/libarchive/test/test_read_format_rar_overflow.rar.uu
180+
new file mode 100644
181+
index 0000000..48fd3fd
182+
--- /dev/null
183+
+++ b/libarchive/test/test_read_format_rar_overflow.rar.uu
184+
@@ -0,0 +1,11 @@
185+
+begin 644 test_read_format_rar_overflow.rar
186+
+M4F%R(1H'`,($=```(0`@`0``,`````(````````````S`0``````,`"_B%_:
187+
+MZ?^[:7``?S!!,`@P,KB@,T@RN33)MTEB@5Z3<`DP`K35`.0P63@P<,Q&0?#,
188+
+MA##,,",S,(@P,#,@##`&,#":(3`!,#"(`9HPS,,S13`P,#`P,*`PHPS,,S1A
189+
+M,!,!,#","9H@S12D#$PP!C`P`*'F03":,,T8H`@\,/DPJS!/,"30,#`3N%LP
190+
+MCQ6:S3"!,#LP22<-,$5%B"5B$S!)(&*>G#+@!`E`%0ODC])62=DO,)BYJX'P
191+
+M=/LPZ3!!008?%S`P,#`P,#`P,#`P,#`P,#`P,#`P2$PP,#`P03!(,#`P,#`&
192+
+M,`7),#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P
193+
+-,#`P,#`P,#`P,#`P,```
194+
+`
195+
+end
196+
--
197+
2.45.2
198+

‎SPECS/libarchive/CVE-2025-5916.patch‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
From 4793899f023f9c4af26c4a31a80610a633ff548e Mon Sep 17 00:00:00 2001
2+
From: SumitJenaHCL <[email protected]>
3+
Date: Thu, 26 Jun 2025 07:25:44 +0000
4+
Subject: [PATCH] Patch CVE-2025-5916
5+
6+
Upstream Patch Reference: https://github.com/libarchive/libarchive/pull/2568/commits/bce70c4c26864df2a8d6953e7db6e4b156253508
7+
---
8+
Makefile.am | 1 +
9+
libarchive/archive_read_support_format_warc.c | 7 ++++--
10+
libarchive/test/test_read_format_warc.c | 24 +++++++++++++++++++
11+
.../test_read_format_warc_incomplete.warc.uu | 10 ++++++++
12+
4 files changed, 40 insertions(+), 2 deletions(-)
13+
create mode 100644 libarchive/test/test_read_format_warc_incomplete.warc.uu
14+
15+
diff --git a/Makefile.am b/Makefile.am
16+
index 544608d..0189f55 100644
17+
--- a/Makefile.am
18+
+++ b/Makefile.am
19+
@@ -911,6 +911,7 @@ libarchive_test_EXTRA_DIST=\
20+
libarchive/test/test_read_format_ustar_filename_eucjp.tar.Z.uu \
21+
libarchive/test/test_read_format_ustar_filename_koi8r.tar.Z.uu \
22+
libarchive/test/test_read_format_warc.warc.uu \
23+
+ libarchive/test/test_read_format_warc_incomplete.warc.uu \
24+
libarchive/test/test_read_format_zip.zip.uu \
25+
libarchive/test/test_read_format_zip_7075_utf8_paths.zip.uu \
26+
libarchive/test/test_read_format_zip_7z_deflate.zip.uu \
27+
diff --git a/libarchive/archive_read_support_format_warc.c b/libarchive/archive_read_support_format_warc.c
28+
index 2732996..19cf5a3 100644
29+
--- a/libarchive/archive_read_support_format_warc.c
30+
+++ b/libarchive/archive_read_support_format_warc.c
31+
@@ -379,7 +379,8 @@ start_over:
32+
case LAST_WT:
33+
default:
34+
/* consume the content and start over */
35+
- _warc_skip(a);
36+
+ if (_warc_skip(a) < 0)
37+
+ return (ARCHIVE_FATAL);
38+
goto start_over;
39+
}
40+
return (ARCHIVE_OK);
41+
@@ -432,7 +433,9 @@ _warc_skip(struct archive_read *a)
42+
{
43+
struct warc_s *w = a->format->data;
44+
45+
- __archive_read_consume(a, w->cntlen + 4U/*\r\n\r\n separator*/);
46+
+ if (__archive_read_consume(a, w->cntlen) < 0 ||
47+
+ __archive_read_consume(a, 4U/*\r\n\r\n separator*/) < 0)
48+
+ return (ARCHIVE_FATAL);
49+
w->cntlen = 0U;
50+
w->cntoff = 0U;
51+
return (ARCHIVE_OK);
52+
diff --git a/libarchive/test/test_read_format_warc.c b/libarchive/test/test_read_format_warc.c
53+
index 658ab8a..8a6d178 100644
54+
--- a/libarchive/test/test_read_format_warc.c
55+
+++ b/libarchive/test/test_read_format_warc.c
56+
@@ -80,3 +80,27 @@ DEFINE_TEST(test_read_format_warc)
57+
assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));
58+
assertEqualInt(ARCHIVE_OK, archive_read_free(a));
59+
}
60+
+
61+
+DEFINE_TEST(test_read_format_warc_incomplete)
62+
+{
63+
+ const char reffile[] = "test_read_format_warc_incomplete.warc";
64+
+ struct archive_entry *ae;
65+
+ struct archive *a;
66+
+
67+
+ extract_reference_file(reffile);
68+
+ assert((a = archive_read_new()) != NULL);
69+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_support_filter_all(a));
70+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_all(a));
71+
+ assertEqualIntA(a, ARCHIVE_OK,
72+
+ archive_read_open_filename(a, reffile, 10240));
73+
+
74+
+ /* Entry cannot be parsed */
75+
+ assertEqualIntA(a, ARCHIVE_FATAL, archive_read_next_header(a, &ae));
76+
+
77+
+ /* Verify archive format. */
78+
+ assertEqualIntA(a, ARCHIVE_FILTER_NONE, archive_filter_code(a, 0));
79+
+
80+
+ /* Verify closing and resource freeing */
81+
+ assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));
82+
+ assertEqualInt(ARCHIVE_OK, archive_read_free(a));
83+
+}
84+
diff --git a/libarchive/test/test_read_format_warc_incomplete.warc.uu b/libarchive/test/test_read_format_warc_incomplete.warc.uu
85+
new file mode 100644
86+
index 0000000..b91b97e
87+
--- /dev/null
88+
+++ b/libarchive/test/test_read_format_warc_incomplete.warc.uu
89+
@@ -0,0 +1,10 @@
90+
+begin 644 test_read_format_warc_incomplete.warc
91+
+M5T%20R\Q+C`-"E=!4D,M5'EP93H@8V]N=F5R<VEO;@T*5T%20RU$871E.B`R
92+
+M,#(U+3`S+3,P5#$U.C`P.C0P6@T*0V]N=&5N="U,96YG=&@Z(#DR,C,S-S(P
93+
+M,S8X-30W-S4X,#<-"@T*5T%20R\Q+C`-"E=!4D,M5'EP93H@<F5S;W5R8V4-
94+
+M"E=!4D,M5&%R9V5T+55223H@9FEL93HO+W)E861M92YT>'0-"E=!4D,M1&%T
95+
+M93H@,C`R-2TP,RTS,%0Q-3HP,#HT,%H-"D-O;G1E;G0M5'EP93H@=&5X="]P
96+
+M;&%I;@T*0V]N=&5N="U,96YG=&@Z(#,X#0H-"E1H92!R96%D;64N='AT('-H
97+
+4;W5L9"!N;W0@8F4@=FES:6)L90H`
98+
+`
99+
+end
100+
--
101+
2.45.2
102+

‎SPECS/libarchive/CVE-2025-5917.patch‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
From d6e69750b8472476381401830c06b4f17332f380 Mon Sep 17 00:00:00 2001
2+
From: SumitJenaHCL <[email protected]>
3+
Date: Mon, 23 Jun 2025 12:30:00 +0000
4+
Subject: [PATCH] Patch CVE-2025-5917
5+
6+
Upstream Patch Reference: https://github.com/libarchive/libarchive/commit/7c02cde37a63580cd1859183fbbd2cf04a89be85
7+
---
8+
libarchive/archive_write_set_format_pax.c | 4 ++--
9+
1 file changed, 2 insertions(+), 2 deletions(-)
10+
11+
diff --git a/libarchive/archive_write_set_format_pax.c b/libarchive/archive_write_set_format_pax.c
12+
index 6e35f70..b2ba959 100644
13+
--- a/libarchive/archive_write_set_format_pax.c
14+
+++ b/libarchive/archive_write_set_format_pax.c
15+
@@ -1571,7 +1571,7 @@ build_ustar_entry_name(char *dest, const char *src, size_t src_length,
16+
const char *filename, *filename_end;
17+
char *p;
18+
int need_slash = 0; /* Was there a trailing slash? */
19+
- size_t suffix_length = 99;
20+
+ size_t suffix_length = 98; /* 99 - 1 for trailing slash */
21+
size_t insert_length;
22+
23+
/* Length of additional dir element to be added. */
24+
@@ -1623,7 +1623,7 @@ build_ustar_entry_name(char *dest, const char *src, size_t src_length,
25+
/* Step 2: Locate the "prefix" section of the dirname, including
26+
* trailing '/'. */
27+
prefix = src;
28+
- prefix_end = prefix + 155;
29+
+ prefix_end = prefix + 154 /* 155 - 1 for trailing / */;
30+
if (prefix_end > filename)
31+
prefix_end = filename;
32+
while (prefix_end > prefix && *prefix_end != '/')
33+
--
34+
2.45.2
35+

0 commit comments

Comments
 (0)