starred/sharpcompress
1
0
Fork 0
mirror of https://github.com/adamhathcock/sharpcompress.git synced 2026-11-15 17:02:03 +00:00
Code Issues 975 Packages Projects Releases 25 Wiki Activity
2,996 Commits 103 Branches 116 Tags
release
Commit Graph

1676 Commits

Author SHA1 Message Date
Adam Hathcock
760eef37ab Merge commit from fork 
Fix GHSA-xmfm-xg76-qx62: bound decompression dictionary allocations
 2026-11-12 15:09:10 +00:00
Adam Hathcock
e9a6045c88 Merge commit from fork 
Prevent excessive allocations from forged 7z header fields
 2026-11-12 15:07:57 +00:00
Adam Hathcock
1ba0eaa629 Merge commit from fork 
Reject negative TAR entry sizes and overflowing seek offsets
 2026-11-12 15:07:09 +00:00
Adam Hathcock
24a13d3c38 Merge commit from fork 
Fix BZip2 streaming decoder hang on corrupted input
 2026-11-12 15:06:00 +00:00
Adam Hathcock
cecd8543a4 Bound decompression dictionaries with static size limits 2026-11-09 13:23:53 +00:00
Adam Hathcock
8ec2188ee0 Validate 7z header counts before allocation 
Bound nested metadata counts and coder properties by their backing data, validate file and stream consistency, and buffer decoded headers incrementally instead of reserving attacker-declared output sizes.

Add synchronous and asynchronous allocation regressions for GHSA-vwpg-q8vc-g6fg, including external metadata and valid bit-packed empty entries.
 2026-11-09 11:53:34 +00:00
Adam Hathcock
30586fdcc5 Validate full-width TAR binary sizes 
Combine the decoder and padding size bounds from advisory PR #1 with the checked seek offsets and sync/async regression coverage in PR #2.

Co-authored-by: 4nonym0us <2701409+4nonym0us@users.noreply.github.com>
 2026-11-09 11:34:11 +00:00
Adam Hathcock
46ba719daa Reject negative TAR entry sizes and overflowing seek offsets 2026-11-09 11:28:55 +00:00
Adam Hathcock
b85ccd28d8 Fix netstandard2.0/net48 build in writable archive key normalisation 
string.StartsWith(char) is not available on netstandard2.0 or net48,
so those targets failed to compile after 990186ac.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-09 11:20:50 +00:00
Adam Hathcock
fa3dff056a Reject stalled BZip2 decoder states after corruption 2026-11-09 11:16:14 +00:00
Adam Hathcock
990186acc5 Fix writable archive duplicate entry checks 2026-11-06 16:03:00 +00:00
Adam Hathcock
82cc8c98c4 Update .NET SDK to address AOT restore vulnerability 2026-11-06 09:24:18 +00:00
Adam Hathcock
9a04b51c0b Reject Deflate back-references beyond initialized history 2026-11-04 17:03:41 +00:00
Adam Hathcock
688f1f7036 Fix solid 7z Deflate entry extraction 2026-11-02 13:27:58 +00:00
Adam Hathcock
f63cd81a65 Reduce allocations in encrypted RAR reading 
Reuse bounded buffers and transform AES blocks in place. Remove per-block arrays and plaintext queues, avoid per-byte header allocations, and dispose owned crypto transforms.

Add encrypted RAR benchmarks, regression tests, and before/after profiling results. Full .NET 10 suite passes (2,446 tests); all library targets build and net48 tests compile.
 2026-10-20 10:43:28 +01:00
Adam Hathcock
e61a335d54 Reduce allocations in RAR5 password key derivation 
Reuse keyed HMAC state and digest buffers on modern .NET targets while preserving RAR5's three PBKDF2 snapshots. Add independent derivation checks and an allocation regression test.

Profiling on macOS ARM64 with .NET 10 reduced allocations by 99.96%, but showed slower throughput; Alpine-specific timing remains unverified. Full .NET 10 test suite passes.
 2026-10-20 10:10:29 +01:00
Adam Hathcock
7642f76f38 changes fixes to use pooled arrays 2026-10-19 10:10:09 +01:00
Adam Hathcock
4966fc186b Merge branch 'release' into fix/lzma2-truncated-header 
# Conflicts:
#	src/SharpCompress/Compressors/LZMA/LZ/LzOutWindow.cs
 2026-10-19 09:59:33 +01:00
Adam Hathcock
7fc5c0e565 Use pooled memory streams for temporary production buffers 2026-10-16 15:44:44 +01:00
Adam Hathcock
2369f10b63 Grow LZMA dictionary storage only as decoded history requires 2026-10-16 15:39:56 +01:00
Adam Hathcock
8a9b76dd44 Grow Shrink output from decoded bytes and stop at input EOF 2026-10-16 15:35:27 +01:00
Adam Hathcock
0860da8bc5 Buffer ARC LZW input incrementally and reject truncated entries 2026-10-16 15:34:07 +01:00
Adam Hathcock
9b0be6f984 Skip ZIP64 extensible data without size-driven allocations 2026-10-16 15:33:10 +01:00
Adam Hathcock
bc1ade2bbc Reject truncated LZMA2 headers and prevent stalled decoding 2026-10-16 15:23:57 +01:00
Adam Hathcock
cd9ce9ad94 Merge pull request #1443 from adamhathcock/fix/1441-sevenzip-libarchive-attributes 
Fix 7z writer attribute interoperability with libarchive
 2026-10-13 11:12:10 +01:00
Adam Hathcock
b4a2e2a254 Protect earlier ADC and RAR rentals when later allocation fails 2026-10-13 10:34:14 +01:00
Adam Hathcock
b91671dfc3 Release partially constructed 7z decoder streams on failure 2026-10-13 10:31:15 +01:00
Adam Hathcock
bdb42df4dc Make raw LZMA setup and disposal exception-safe 2026-10-13 10:29:07 +01:00
Adam Hathcock
38e3222dc2 Release rewind buffers despite disposal failures and reject disposed reads 2026-10-13 10:26:09 +01:00
Adam Hathcock
b3fac7e04a Release owned Squeeze buffers and failed PPMd models 2026-10-13 10:24:19 +01:00
Adam Hathcock
46437bbbbc Return pooled memory stream blocks when construction fails 2026-10-13 10:21:45 +01:00
Adam Hathcock
b8f3a8695b Validate LZMA2 setup before renting and reject disposed writes 2026-10-13 10:09:14 +01:00
Adam Hathcock
c574364838 Fix pooled buffer ownership and exception-safe cleanup 2026-10-13 09:57:19 +01:00
Adam Hathcock
9c6cfe886a Merge remote-tracking branch 'origin/release' into fix/1441-sevenzip-libarchive-attributes 2026-10-13 09:13:55 +01:00
Adam Hathcock
c7115ced3e Merge pull request #1444 from adamhathcock/fix/1440-sevenzip-directory-only 
Fix empty and directory-only 7z archive finalization
 2026-10-13 09:12:04 +01:00
Adam Hathcock
dcd2515598 Merge remote-tracking branch 'origin/release' into fix/1439-sevenzip-password-exceptions 
# Conflicts:
#	docs/API.md
 2026-10-12 17:10:32 +01:00
Adam Hathcock
a147a7bc29 Merge pull request #1442 from adamhathcock/fix/release-pr-1436-followups 
pr 1436 followups
 2026-10-12 17:05:28 +01:00
Adam Hathcock
b924008b89 Return pooled tar header buffer only after parsing it 
TarHeader.ReadAsync returned the rented header block to ArrayPool before
reading the checksum, name, size and other fields from it. Under parallel
load another caller could rent the same array and overwrite it, which made
async tar reads fail intermittently with a bad checksum ("Cannot determine
compressed stream type") or "Unexpected EOF reading tar file".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 16:59:41 +01:00
Adam Hathcock
69e1477ee6 Expose public exceptions for encrypted 7z decoding failures 2026-10-12 15:29:40 +01:00
Adam Hathcock
7d7983e0f4 Fix 7z encryption detection for streamless files 2026-10-12 15:29:40 +01:00
Adam Hathcock
9332fb9c70 Fix empty and directory-only 7z archive finalization 2026-10-12 15:28:49 +01:00
Adam Hathcock
cda73d09bd Fix 7z attribute interoperability with libarchive 2026-10-12 15:27:44 +01:00
Adam Hathcock
eac609b35a Report truncated encrypted RAR data as InvalidFormatException asynchronously 
ReadExactAsync throws IncompleteArchiveException, so the async decrypt
path's EndOfStreamException catch never ran. On net48, EntryStream.Dispose
skips the entry through the async path, so its IncompleteArchiveException
replaced the InvalidFormatException from the synchronous read and failed
Rar_Multi_Reader_Encrypted. Sync and async now report truncated encrypted
data as InvalidFormatException.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 15:23:52 +01:00
Adam Hathcock
b07e6bc727 Validate fragmented GZip trailers asynchronously using inflater read-ahead 2026-10-10 15:40:39 +01:00
Adam Hathcock
b919aaab1f Validate GZip CRC and size during asynchronous stream disposal 2026-10-10 15:40:39 +01:00
Adam Hathcock
953ce61564 Consume both GZip header CRC bytes and reject truncated fields 2026-10-10 15:40:38 +01:00
Adam Hathcock
f888179583 Preserve DEFLATE read-ahead bytes after one-byte output and EOF 2026-10-10 15:40:37 +01:00
Adam Hathcock
fed1d884c7 Do not treat zero-length checksum reads as end of entry 2026-10-10 15:40:37 +01:00
Adam Hathcock
06fea02e64 Resolve RAR companion volumes with unambiguous case-insensitive fallback 2026-10-10 15:40:36 +01:00
Adam Hathcock
13ed208a2b Read ARJ headers and extended headers exactly 2026-10-10 15:40:36 +01:00