ArHandler: backport 7-Zip 26.01 symbol table OOB read fix - #264
Open
tonghuaroot wants to merge 1 commit into
Open
ArHandler: backport 7-Zip 26.01 symbol table OOB read fix#264tonghuaroot wants to merge 1 commit into
tonghuaroot wants to merge 1 commit into
Conversation
Upstream 7-Zip 26.01 (released 2026-04-27) hardened the BSD-style ar symbol-table parse path and the Microsoft .lib second-linker file parse path in two ways: 1. BSD ar: the read of the 4-byte `namesSize` field from `p + namesStart` lacked a prior bound on `namesStart + 4 <= size`. The previous check `namesStart > size || namesStart + namesSize != size` was applied AFTER the read, so a crafted .a archive could produce a 4-byte OOB read of `p[namesStart..namesStart+3]` when `namesStart == size`. 26.01 adds the explicit pre-check `if (size - namesStart < 4) continue;` before the read. 2. GNU ar archive symbol table + Microsoft .lib second-linker file: index arithmetic `i * 4`, `i * 2`, `index * 4` is cast to `(size_t)` to prevent 32-bit integer overflow on 64-bit platforms where address arithmetic must use 64-bit width. With `numSymbols` near 2^30 and `numMembers` near 2^30, `i * 4` could wrap and address an unintended byte. Patch matches upstream 7-Zip 26.01 source. Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports two hardenings landed in upstream 7-Zip 26.01 (released 2026-04-27).
What changed upstream
1. BSD ar symbol table: 4-byte OOB read
p7zip reads
namesSizefromp + namesStartand only validates the buffer afterwards:```cpp
size_t namesStart = pos + tableSize;
UInt32 namesSize = Get32(p + namesStart, be); // <-- unchecked read
namesStart += 4;
if (namesStart > size || namesStart + namesSize != size)
continue;
```
26.01 adds an explicit pre-check so the 4-byte read is only performed when 4 bytes are available:
```cpp
size_t namesStart = pos + tableSize;
if (size - namesStart < 4)
continue;
UInt32 namesSize = Get32(p + namesStart, be);
namesStart += 4;
if (namesStart + namesSize != size)
continue;
```
2. GNU ar / Microsoft .lib: 32-bit index arithmetic
The symbol-table iteration uses bare
i * 4,i * 2, andindex * 4arithmetic which is performed in 32-bit and then implicitly widened on dereference. 26.01 casts the multiplicand to(size_t)so the math is done at pointer width on 64-bit platforms, removing the risk of wrap whennumSymbols/numMembersapproach 2^30.Patch
Three small hunks, byte-for-byte matching upstream 26.01.
Disclosure
I am not a native English speaker. AI tooling was used to polish the prose in this PR description. The fix itself is a direct backport from upstream 7-Zip 26.01 source; no design choices were made beyond matching upstream verbatim.