Out of bounds read and signed integer overflow in libarchive
I recently wrote about a large number of bugs and potential security issues in libarchive. The release 3.2.0 missed one fix for an out of bounds read in the rar parser. Also I discovered one additional signed integer overflow issue with ubsan. Both issues are now fixed in libarchive 3.2.1.
All issues were discovered with the help of american fuzzy lop.
Out of bounds heap read in RAR parser
Sample rar file
CVE-2015-8934
Signed integer overflow in ISO parser
Sample ISO file
CVE-2016-5844
Also a couple of other security issues in libarchive were found by Cisco.
With the release of version 3.2.1 I consider libarchive to be reasonably robust against fuzzing. I've tested all supported file formats and fuzzed each one with afl/asan for at least one day. Of course that doesn't mean that no security issues are left - but the easy to find ones should be wiped out.
All issues were discovered with the help of american fuzzy lop.
Out of bounds heap read in RAR parser
Sample rar file
CVE-2015-8934
Signed integer overflow in ISO parser
Sample ISO file
CVE-2016-5844
Also a couple of other security issues in libarchive were found by Cisco.
With the release of version 3.2.1 I consider libarchive to be reasonably robust against fuzzing. I've tested all supported file formats and fuzzed each one with afl/asan for at least one day. Of course that doesn't mean that no security issues are left - but the easy to find ones should be wiped out.
Trackbacks
No Trackbacks
Comments
Display comments as Linear | Threaded