From 7273d04803a1e5a482f26d8d0fbaf2b204a72168 Mon Sep 17 00:00:00 2001 From: Tim Kientzle Date: Sun, 1 Mar 2026 20:24:56 -0800 Subject: [PATCH] Reject filters when the block length is nonsensical Credit: Grzegorz Antoniak @antekone Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/7273d04803a1e5a482f26d8d0fbaf2b204a72168] CVE: CVE-2026-4111 Signed-off-by: Vijay Anusuri --- libarchive/archive_read_support_format_rar5.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c index 38979cb..867f0a8 100644 --- a/libarchive/archive_read_support_format_rar5.c +++ b/libarchive/archive_read_support_format_rar5.c @@ -2914,7 +2914,9 @@ static int parse_filter(struct archive_read* ar, const uint8_t* p) { if(block_length < 4 || block_length > 0x400000 || filter_type > FILTER_ARM || - !is_valid_filter_block_start(rar, block_start)) + !is_valid_filter_block_start(rar, block_start) || + (rar->cstate.window_size > 0 && + (ssize_t)block_length > rar->cstate.window_size >> 1)) { archive_set_error(&ar->archive, ARCHIVE_ERRNO_FILE_FORMAT, "Invalid filter encountered"); -- 2.25.1