starred/sharpcompress
1
0
Fork 0
mirror of https://github.com/adamhathcock/sharpcompress.git synced 2026-11-15 17:02:03 +00:00
Code Issues 975 Packages Projects Releases 25 Wiki Activity
2,996 Commits 103 Branches 116 Tags
release
Commit Graph

2996 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Adam Hathcock
760eef37ab Merge commit from fork 
Fix GHSA-xmfm-xg76-qx62: bound decompression dictionary allocations
0.50.9 		2026-11-12 15:09:10 +00:00
Adam Hathcock
e9a6045c88 Merge commit from fork 
Prevent excessive allocations from forged 7z header fields
 2026-11-12 15:07:57 +00:00
Adam Hathcock
1ba0eaa629 Merge commit from fork 
Reject negative TAR entry sizes and overflowing seek offsets
 2026-11-12 15:07:09 +00:00
Adam Hathcock
24a13d3c38 Merge commit from fork 
Fix BZip2 streaming decoder hang on corrupted input
 2026-11-12 15:06:00 +00:00
Adam Hathcock
cecd8543a4 Bound decompression dictionaries with static size limits 2026-11-09 13:23:53 +00:00
Adam Hathcock
8ec2188ee0 Validate 7z header counts before allocation 
Bound nested metadata counts and coder properties by their backing data, validate file and stream consistency, and buffer decoded headers incrementally instead of reserving attacker-declared output sizes.

Add synchronous and asynchronous allocation regressions for GHSA-vwpg-q8vc-g6fg, including external metadata and valid bit-packed empty entries.
 2026-11-09 11:53:34 +00:00
Adam Hathcock
30586fdcc5 Validate full-width TAR binary sizes 
Combine the decoder and padding size bounds from advisory PR #1 with the checked seek offsets and sync/async regression coverage in PR #2.

Co-authored-by: 4nonym0us <2701409+4nonym0us@users.noreply.github.com>
 2026-11-09 11:34:11 +00:00
Adam Hathcock
46ba719daa Reject negative TAR entry sizes and overflowing seek offsets 2026-11-09 11:28:55 +00:00
Adam Hathcock
839dcb1ffb Merge pull request #1490 from adamhathcock/fix/legacy-startswith-char 
Fix netstandard2.0/net48 build in writable archive key normalisation
 2026-11-09 11:26:03 +00:00
Adam Hathcock
b85ccd28d8 Fix netstandard2.0/net48 build in writable archive key normalisation 
string.StartsWith(char) is not available on netstandard2.0 or net48,
so those targets failed to compile after 990186ac.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-09 11:20:50 +00:00
Adam Hathcock
fa3dff056a Reject stalled BZip2 decoder states after corruption 2026-11-09 11:16:14 +00:00
Adam Hathcock
54432058de Merge commit from fork 
Fix writable archive duplicate entry checks
 2026-11-07 09:56:57 +00:00
Adam Hathcock
990186acc5 Fix writable archive duplicate entry checks 2026-11-06 16:03:00 +00:00
Adam Hathcock
dfccc660db Merge pull request #1489 from adamhathcock/fix/build-and-tests 
Update .NET SDK to fix AOT restore
 2026-11-06 09:53:08 +00:00
Adam Hathcock
82cc8c98c4 Update .NET SDK to address AOT restore vulnerability 2026-11-06 09:24:18 +00:00
Adam Hathcock
ba6d1d369c Merge commit from fork 
Reject Deflate back-references beyond initialized history
 2026-11-06 09:09:38 +00:00
Adam Hathcock
9a04b51c0b Reject Deflate back-references beyond initialized history 2026-11-04 17:03:41 +00:00
Adam Hathcock
ef3a923211 use ODIC nuget workflow 0.50.8 2026-11-03 09:50:32 +00:00
Adam Hathcock
da5ac7528f Merge pull request #1488 from adamhathcock/fix/1485-solid-7z-deflate 
Fix solid 7z Deflate extraction corruption
 2026-11-03 09:25:49 +00:00
Adam Hathcock
d5014d3a1c fix legacy test 2026-11-02 16:11:45 +00:00
Adam Hathcock
688f1f7036 Fix solid 7z Deflate entry extraction 2026-11-02 13:27:58 +00:00
Adam Hathcock
b4af8afe66 Merge pull request #1464 from adamhathcock/fix/rar5-hmac-allocations 
Reduce allocations in RAR5 password key derivation
0.50.7 		2026-10-20 10:59:07 +01:00
Adam Hathcock
f63cd81a65 Reduce allocations in encrypted RAR reading 
Reuse bounded buffers and transform AES blocks in place. Remove per-block arrays and plaintext queues, avoid per-byte header allocations, and dispose owned crypto transforms.

Add encrypted RAR benchmarks, regression tests, and before/after profiling results. Full .NET 10 suite passes (2,446 tests); all library targets build and net48 tests compile.
 2026-10-20 10:43:28 +01:00
Adam Hathcock
e61a335d54 Reduce allocations in RAR5 password key derivation 
Reuse keyed HMAC state and digest buffers on modern .NET targets while preserving RAR5's three PBKDF2 snapshots. Add independent derivation checks and an allocation regression test.

Profiling on macOS ARM64 with .NET 10 reduced allocations by 99.96%, but showed slower throughput; Alpine-specific timing remains unverified. Full .NET 10 test suite passes.
 2026-10-20 10:10:29 +01:00
Adam Hathcock
542ed974d4 Merge pull request #1458 from adamhathcock/adam/release-fixes 
fixes for release
0.50.6 		2026-10-19 11:05:44 +01:00
Adam Hathcock
2168385f2e fixes for release 2026-10-19 10:52:07 +01:00
Adam Hathcock
2fe5f3a4e8 Merge commit from fork 
Reject truncated LZMA2 headers and prevent stalled decoding
 2026-10-19 10:27:41 +01:00
Adam Hathcock
7642f76f38 changes fixes to use pooled arrays 2026-10-19 10:10:09 +01:00
Adam Hathcock
4966fc186b Merge branch 'release' into fix/lzma2-truncated-header 
# Conflicts:
#	src/SharpCompress/Compressors/LZMA/LZ/LzOutWindow.cs
 2026-10-19 09:59:33 +01:00
Adam Hathcock
7fc5c0e565 Use pooled memory streams for temporary production buffers 2026-10-16 15:44:44 +01:00
Adam Hathcock
2369f10b63 Grow LZMA dictionary storage only as decoded history requires 2026-10-16 15:39:56 +01:00
Adam Hathcock
8a9b76dd44 Grow Shrink output from decoded bytes and stop at input EOF 2026-10-16 15:35:27 +01:00
Adam Hathcock
0860da8bc5 Buffer ARC LZW input incrementally and reject truncated entries 2026-10-16 15:34:07 +01:00
Adam Hathcock
9b0be6f984 Skip ZIP64 extensible data without size-driven allocations 2026-10-16 15:33:10 +01:00
Adam Hathcock
bc1ade2bbc Reject truncated LZMA2 headers and prevent stalled decoding 2026-10-16 15:23:57 +01:00
Adam Hathcock
cd9ce9ad94 Merge pull request #1443 from adamhathcock/fix/1441-sevenzip-libarchive-attributes 
Fix 7z writer attribute interoperability with libarchive
 2026-10-13 11:12:10 +01:00
Adam Hathcock
9aa94c4345 Merge pull request #1447 from adamhathcock/fix/pooled-buffer-lifetimes 
Fix pooled buffer ownership and exception-safe cleanup
 2026-10-13 10:55:50 +01:00
Adam Hathcock
b4a2e2a254 Protect earlier ADC and RAR rentals when later allocation fails 2026-10-13 10:34:14 +01:00
Adam Hathcock
b91671dfc3 Release partially constructed 7z decoder streams on failure 2026-10-13 10:31:15 +01:00
Adam Hathcock
bdb42df4dc Make raw LZMA setup and disposal exception-safe 2026-10-13 10:29:07 +01:00
Adam Hathcock
38e3222dc2 Release rewind buffers despite disposal failures and reject disposed reads 2026-10-13 10:26:09 +01:00
Adam Hathcock
b3fac7e04a Release owned Squeeze buffers and failed PPMd models 2026-10-13 10:24:19 +01:00
Adam Hathcock
46437bbbbc Return pooled memory stream blocks when construction fails 2026-10-13 10:21:45 +01:00
Adam Hathcock
b8f3a8695b Validate LZMA2 setup before renting and reject disposed writes 2026-10-13 10:09:14 +01:00
Adam Hathcock
c574364838 Fix pooled buffer ownership and exception-safe cleanup 2026-10-13 09:57:19 +01:00
Adam Hathcock
cd3a18bce4 Add public 7z writer attribute regression coverage 2026-10-13 09:23:23 +01:00
Adam Hathcock
9c6cfe886a Merge remote-tracking branch 'origin/release' into fix/1441-sevenzip-libarchive-attributes 2026-10-13 09:13:55 +01:00
Adam Hathcock
c7115ced3e Merge pull request #1444 from adamhathcock/fix/1440-sevenzip-directory-only 
Fix empty and directory-only 7z archive finalization
 2026-10-13 09:12:04 +01:00
Adam Hathcock
971a01e940 Merge pull request #1445 from adamhathcock/fix/1439-sevenzip-password-exceptions 
Expose public exceptions for encrypted 7z decoding failures
 2026-10-13 08:11:19 +01:00
Adam Hathcock
dcd2515598 Merge remote-tracking branch 'origin/release' into fix/1439-sevenzip-password-exceptions 
# Conflicts:
#	docs/API.md
 2026-10-12 17:10:32 +01:00