[BUG]A carefully crafted RAR archive can trigger an infinite loop while parsing. about junrar HOT 10 CLOSED

How did you find out, if I may ask?

Hi @gotson, We found this sample using a testing technique called fuzzing.

from junrar.

Thanks, i manage to reproduce in the tests, will have a look.

from junrar.

Hi @gotson , are you willing to help us to request a CVE ID through GitHub Security Advisories for this bug, which can cause Denial of Service. You can follow this tutorial to manage your bug fixing and alert any downstream dependencies of the issue so they can patch immediately if using the broken release. Thanks for your help!

Thanks, it's a new process to me, but that's actually a good idea.

from junrar.

How did you find out, if I may ask?

from junrar.

It doesn't seem the provided file is even a rar file, no ?

unrar t loop-913d3158487310b1b4b74086ab888f5ed56a8493                                                Thu Jan 27 11:36:52 2022

UNRAR 6.10 freeware      Copyright (c) 1993-2022 Alexander Roshal

Corrupt header is found
Main archive header is corrupt

Testing archive loop-913d3158487310b1b4b74086ab888f5ed56a8493

Unexpected end of archive
No files to extract

from junrar.

Hi @gotson , this infinite loop PoC file we provided here is indeed a broken RAR file. We use fuzzing to iteratively mutate some valid RAR files to test the junrar.

from junrar.

🎉 This issue has been resolved in version 7.4.1 🎉

The release is available on:

• v7.4.1
• GitHub release

Your semantic-release bot 📦🚀

from junrar.

Hi @gotson , are you willing to help us to request a CVE ID through GitHub Security Advisories for this bug, which can cause Denial of Service. You can follow this tutorial to manage your bug fixing and alert any downstream dependencies of the issue so they can patch immediately if using the broken release. Thanks for your help!

from junrar.

Hi @gotson , I found some files which can also trigger this infinite loop. I have tested these on the latest version (7.5.0)
loops.zip.

from junrar.

Hi @gotson , I found some files which can also trigger this infinite loop. I have tested these on the latest version (7.5.0) loops.zip.

Please open a new issue.

from junrar.