* [wrynose][PATCH] libarchive: fix CVE-2026-14164
@ 2026-07-27 7:34 daniel.turull
2026-08-16 9:32 ` Paul Barker
0 siblings, 1 reply; 3+ messages in thread
From: daniel.turull @ 2026-07-27 7:34 UTC (permalink / raw)
To: openembedded-core; +Cc: Daniel Turull
From: Daniel Turull <daniel.turull@ericsson.com>
Backport patch to fix CVE-2026-14164.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-14164
Upstream fix:
https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8
Tested with ptest:
Before: PASSED: 5, FAILED: 0, SKIPPED: 0
After: PASSED: 5, FAILED: 0, SKIPPED: 0
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
.../libarchive/CVE-2026-14164.patch | 53 +++++++++++++++++++
.../libarchive/libarchive_3.8.7.bb | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
new file mode 100644
index 0000000000..b734fc448f
--- /dev/null
+++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
@@ -0,0 +1,53 @@
+From edbac77e8e544286fe7581bc398781c949ee5a22 Mon Sep 17 00:00:00 2001
+From: "Dustin L. Howett" <dustin@howett.net>
+Date: Sun, 24 May 2026 12:43:00 -0500
+Subject: [PATCH] Merge pull request #3071 from stoeckmann/rar5_doublefree
+
+rar5: Avoid dangling pointers in init_unpack
+(cherry picked from commit 42453cf16255800726b4efedab25138639ceef20)
+
+Conflicts Resolved:
+
+libarchive/archive_read_support_format_rar5.c (1 conflict):
+- The stable branch's init_unpack() already unconditionally NULLs
+ rar->cstate.window_buf and rar->cstate.filtered_buf right after free()
+ (the core CVE fix), but still retained the redundant else-branch that
+ re-NULLed them when window_size <= 0. Removed that dead else-branch to
+ match the upstream fix, and omitted upstream's added
+ `if(...== NULL) return ARCHIVE_FATAL;` calloc failure checks, since
+ init_unpack() is void-returning in this stable version and predates
+ that hardening.
+
+Assisted-by: kiro:claude-sonnet-5
+
+Changes from upstream commit f774f03b40cb:
+ - libarchive/archive_read_support_format_rar5.c: adapted from upstream
+
+CVE: CVE-2026-14164
+Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8]
+
+Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
+---
+ libarchive/archive_read_support_format_rar5.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c
+index 63dd97b3..271aa0cb 100644
+--- a/libarchive/archive_read_support_format_rar5.c
++++ b/libarchive/archive_read_support_format_rar5.c
+@@ -2568,12 +2568,12 @@ static void init_unpack(struct rar5* rar) {
+ free(rar->cstate.window_buf);
+ free(rar->cstate.filtered_buf);
+
++ rar->cstate.window_buf = NULL;
++ rar->cstate.filtered_buf = NULL;
++
+ if(rar->cstate.window_size > 0) {
+ rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
+ rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
+- } else {
+- rar->cstate.window_buf = NULL;
+- rar->cstate.filtered_buf = NULL;
+ }
+
+ clear_data_ready_stack(rar);
diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
index e8c3a3bfe3..ecb13a6772 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
@@ -31,6 +31,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv"
SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \
file://run-ptest \
+ file://CVE-2026-14164.patch \
"
UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [wrynose][PATCH] libarchive: fix CVE-2026-14164
2026-07-27 7:34 [wrynose][PATCH] libarchive: fix CVE-2026-14164 daniel.turull
@ 2026-08-16 9:32 ` Paul Barker
2026-08-17 7:41 ` Daniel Turull
0 siblings, 1 reply; 3+ messages in thread
From: Paul Barker @ 2026-08-16 9:32 UTC (permalink / raw)
To: daniel.turull, openembedded-core
On Mon, 2026-07-27 at 09:34 +0200, daniel.turull@ericsson.com wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Backport patch to fix CVE-2026-14164.
>
> References:
> https://nvd.nist.gov/vuln/detail/CVE-2026-14164
>
> Upstream fix:
> https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8
>
> Tested with ptest:
> Before: PASSED: 5, FAILED: 0, SKIPPED: 0
> After: PASSED: 5, FAILED: 0, SKIPPED: 0
>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
> .../libarchive/CVE-2026-14164.patch | 53 +++++++++++++++++++
> .../libarchive/libarchive_3.8.7.bb | 1 +
> 2 files changed, 54 insertions(+)
> create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
>
> diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
> new file mode 100644
> index 0000000000..b734fc448f
> --- /dev/null
> +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
> @@ -0,0 +1,53 @@
> +From edbac77e8e544286fe7581bc398781c949ee5a22 Mon Sep 17 00:00:00 2001
> +From: "Dustin L. Howett" <dustin@howett.net>
> +Date: Sun, 24 May 2026 12:43:00 -0500
> +Subject: [PATCH] Merge pull request #3071 from stoeckmann/rar5_doublefree
> +
> +rar5: Avoid dangling pointers in init_unpack
> +(cherry picked from commit 42453cf16255800726b4efedab25138639ceef20)
> +
> +Conflicts Resolved:
> +
> +libarchive/archive_read_support_format_rar5.c (1 conflict):
> +- The stable branch's init_unpack() already unconditionally NULLs
> + rar->cstate.window_buf and rar->cstate.filtered_buf right after free()
> + (the core CVE fix), but still retained the redundant else-branch that
> + re-NULLed them when window_size <= 0. Removed that dead else-branch to
> + match the upstream fix, and omitted upstream's added
> + `if(...== NULL) return ARCHIVE_FATAL;` calloc failure checks, since
> + init_unpack() is void-returning in this stable version and predates
> + that hardening.
> +
> +Assisted-by: kiro:claude-sonnet-5
> +
> +Changes from upstream commit f774f03b40cb:
> + - libarchive/archive_read_support_format_rar5.c: adapted from upstream
> +
> +CVE: CVE-2026-14164
> +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8]
> +
> +Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> +---
> + libarchive/archive_read_support_format_rar5.c | 6 +++---
> + 1 file changed, 3 insertions(+), 3 deletions(-)
> +
> +diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c
> +index 63dd97b3..271aa0cb 100644
> +--- a/libarchive/archive_read_support_format_rar5.c
> ++++ b/libarchive/archive_read_support_format_rar5.c
> +@@ -2568,12 +2568,12 @@ static void init_unpack(struct rar5* rar) {
> + free(rar->cstate.window_buf);
> + free(rar->cstate.filtered_buf);
> +
> ++ rar->cstate.window_buf = NULL;
> ++ rar->cstate.filtered_buf = NULL;
> ++
> + if(rar->cstate.window_size > 0) {
> + rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
> + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
> +- } else {
> +- rar->cstate.window_buf = NULL;
> +- rar->cstate.filtered_buf = NULL;
> + }
> +
> + clear_data_ready_stack(rar);
Hi Daniel,
The above fix didn't make sense to me, so I looked in to the CVE. The
initial report [1] says:
The issue occurs when parsing a valid RAR5 archive that exercises
the filter path. During decompression, rar->cstate.filtered_buf can
be assigned to a filter output buffer. Later, when libarchive
processes a subsequent file and reinitializes the unpacking state,
init_unpack() frees the existing filtered_buf but does not clear the
pointer.
If the following allocation fails, init_unpack() returns
ARCHIVE_FATAL while rar->cstate.filtered_buf still contains a
dangling pointer. When the caller later releases the archive object,
rar5_cleanup() frees the same pointer again, resulting in a
double-free.
[1]: https://github.com/libarchive/libarchive/issues/3069
The `return ARCHIVE_FATAL` paths are not present in libarchive 3.8.7, so
the function can't return between while rar->cstate.filtered_buf is
still a dangling pointer.
Let me know if you agree with that analysis, if so then perhaps we can
handle this via CVE_STATUS.
Best regards,
--
Paul Barker
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [wrynose][PATCH] libarchive: fix CVE-2026-14164
2026-08-16 9:32 ` Paul Barker
@ 2026-08-17 7:41 ` Daniel Turull
0 siblings, 0 replies; 3+ messages in thread
From: Daniel Turull @ 2026-08-17 7:41 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org, paul@pbarker.dev
On Sun, 2026-08-16 at 10:32 +0100, Paul Barker wrote:
> On Mon, 2026-07-27 at 09:34 +0200, daniel.turull@ericsson.com wrote:
> > From: Daniel Turull <daniel.turull@ericsson.com>
> >
> > Backport patch to fix CVE-2026-14164.
> >
> > References:
> >
> > https://nvd.nist.gov/vuln/detail/CVE-2026-14164
> >
> > Upstream fix:
> >
> > https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8
> >
> > Tested with ptest:
> > Before: PASSED: 5, FAILED: 0, SKIPPED: 0
> > After: PASSED: 5, FAILED: 0, SKIPPED: 0
> >
> > Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> > ---
> > .../libarchive/CVE-2026-14164.patch | 53 +++++++++++++++++++
> > .../libarchive/libarchive_3.8.7.bb | 1 +
> > 2 files changed, 54 insertions(+)
> > create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
> >
> > diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch b/meta/recipes-
> > extended/libarchive/libarchive/CVE-2026-14164.patch
> > new file mode 100644
> > index 0000000000..b734fc448f
> > --- /dev/null
> > +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch
> > @@ -0,0 +1,53 @@
> > +From edbac77e8e544286fe7581bc398781c949ee5a22 Mon Sep 17 00:00:00 2001
> > +From: "Dustin L. Howett" <dustin@howett.net>
> > +Date: Sun, 24 May 2026 12:43:00 -0500
> > +Subject: [PATCH] Merge pull request #3071 from stoeckmann/rar5_doublefree
> > +
> > +rar5: Avoid dangling pointers in init_unpack
> > +(cherry picked from commit 42453cf16255800726b4efedab25138639ceef20)
> > +
> > +Conflicts Resolved:
> > +
> > +libarchive/archive_read_support_format_rar5.c (1 conflict):
> > +- The stable branch's init_unpack() already unconditionally NULLs
> > + rar->cstate.window_buf and rar->cstate.filtered_buf right after free()
> > + (the core CVE fix), but still retained the redundant else-branch that
> > + re-NULLed them when window_size <= 0. Removed that dead else-branch to
> > + match the upstream fix, and omitted upstream's added
> > + `if(...== NULL) return ARCHIVE_FATAL;` calloc failure checks, since
> > + init_unpack() is void-returning in this stable version and predates
> > + that hardening.
> > +
> > +Assisted-by: kiro:claude-sonnet-5
> > +
> > +Changes from upstream commit f774f03b40cb:
> > + - libarchive/archive_read_support_format_rar5.c: adapted from upstream
> > +
> > +CVE: CVE-2026-14164
> > +Upstream-Status: Backport
> > [https://github.com/libarchive/lib
> > archive%2Fcommit%2Ff774f03b40cb109348e5c6d52b59c864e3cfa8e8&data=05%7C02%7Cdaniel.turull%40erics
> > son.com%7C8fb93b3eadb44ed7b3dd08defb795ae2%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C63922469
> > 5802503711%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsI
> > kFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=U8k1wVVScu7YauxaGlz9h40KSnrjx7%2F1HbKc76cYj7U
> > %3D&reserved=0]
> > +
> > +Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> > +---
> > + libarchive/archive_read_support_format_rar5.c | 6 +++---
> > + 1 file changed, 3 insertions(+), 3 deletions(-)
> > +
> > +diff --git a/libarchive/archive_read_support_format_rar5.c
> > b/libarchive/archive_read_support_format_rar5.c
> > +index 63dd97b3..271aa0cb 100644
> > +--- a/libarchive/archive_read_support_format_rar5.c
> > ++++ b/libarchive/archive_read_support_format_rar5.c
> > +@@ -2568,12 +2568,12 @@ static void init_unpack(struct rar5* rar) {
> > + free(rar->cstate.window_buf);
> > + free(rar->cstate.filtered_buf);
> > +
> > ++ rar->cstate.window_buf = NULL;
> > ++ rar->cstate.filtered_buf = NULL;
> > ++
> > + if(rar->cstate.window_size > 0) {
> > + rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
> > + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
> > +- } else {
> > +- rar->cstate.window_buf = NULL;
> > +- rar->cstate.filtered_buf = NULL;
> > + }
> > +
> > + clear_data_ready_stack(rar);
>
> Hi Daniel,
>
> The above fix didn't make sense to me, so I looked in to the CVE. The
> initial report [1] says:
>
> The issue occurs when parsing a valid RAR5 archive that exercises
> the filter path. During decompression, rar->cstate.filtered_buf can
> be assigned to a filter output buffer. Later, when libarchive
> processes a subsequent file and reinitializes the unpacking state,
> init_unpack() frees the existing filtered_buf but does not clear the
> pointer.
>
> If the following allocation fails, init_unpack() returns
> ARCHIVE_FATAL while rar->cstate.filtered_buf still contains a
> dangling pointer. When the caller later releases the archive object,
> rar5_cleanup() frees the same pointer again, resulting in a
> double-free.
>
> [1]:
> https://github.com/libarchive/libarchive/issues/3069
>
> The `return ARCHIVE_FATAL` paths are not present in libarchive 3.8.7, so
> the function can't return between while rar->cstate.filtered_buf is
> still a dangling pointer.
>
> Let me know if you agree with that analysis, if so then perhaps we can
> handle this via CVE_STATUS.
I agree with your analysis. I was just focused that the backport was similar at the patch pointed in
the CVE information. I'll send a v2 with CVE_STATUS fixed-version with your reasoning for both
scarthgap and wrynose
Thanks
Daniel
>
> Best regards,
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-17 7:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-27 7:34 [wrynose][PATCH] libarchive: fix CVE-2026-14164 daniel.turull
2026-08-16 9:32 ` Paul Barker
2026-08-17 7:41 ` Daniel Turull
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.