HomeFreeBSD

MFV r313071:

Description

MFV r313071:
Sync libarchive with vendor

Vendor changes (relevant to FreeBSD):

  • support extracting NFSv4 ACLs from Solaris tar archives
  • bugfixes and optimizations in the ACL code
  • multiple fixes in the test suite
  • typo and other small bugfixes

Security fixes:

  • cab reader: endless loop when parsing MSZIP signature (OSS-Fuzz 335)
  • LHA reader: heap-buffer-overflow in lha_read_file_header_1() (CVE-2017-5601)
  • LZ4 reader: null-pointer dereference in lz4_filter_read_legacy_stream() (OSS-Fuzz 453)
  • mtree reader: heap-buffer-overflow in detect_form() (OSS-Fuzz 421, 443)
  • WARC reader: heap-buffer-overflow in xstrpisotime() (OSS-Fuzz 382, 458)

Memory leak fixes:

  • ACL support: free memory allocated by acl_get_qualifier()
  • disk writer: missing free in create_filesystem_object()
  • file reader: fd leak (Coverity 1016755)
  • gnutar writer: fix free in archive_write_gnutar_header() (Coverity 101675)
  • iso 9660 reader: missing free in parse_file_info() (partial Coverity 1016754)
  • program reader: missing free in __archive_read_program()
  • program writer: missing free in __archive_write_program_free()
  • xar reader: missing free in xar_cleanup()
  • xar reader: missing frees in expat_xmlattr_setup() (Coverity 1229979-1229981)
  • xar writer: missing free in file_free()
  • zip reader: missing free in zip_read_local_file_header()

MFC after: 1 week
X-MFC with: 310866, 310868, 310870, 311899

Details

Provenance
mmAuthored on
Parents
rS313073: MFC r312728
Branches
Unknown
Tags
Unknown