Adam Hathcock
760eef37ab
Merge commit from fork
...
Fix GHSA-xmfm-xg76-qx62: bound decompression dictionary allocations
2026-11-12 15:09:10 +00:00
Adam Hathcock
e9a6045c88
Merge commit from fork
...
Prevent excessive allocations from forged 7z header fields
2026-11-12 15:07:57 +00:00
Adam Hathcock
1ba0eaa629
Merge commit from fork
...
Reject negative TAR entry sizes and overflowing seek offsets
2026-11-12 15:07:09 +00:00
Adam Hathcock
cecd8543a4
Bound decompression dictionaries with static size limits
2026-11-09 13:23:53 +00:00
Adam Hathcock
8ec2188ee0
Validate 7z header counts before allocation
...
Bound nested metadata counts and coder properties by their backing data, validate file and stream consistency, and buffer decoded headers incrementally instead of reserving attacker-declared output sizes.
Add synchronous and asynchronous allocation regressions for GHSA-vwpg-q8vc-g6fg, including external metadata and valid bit-packed empty entries.
2026-11-09 11:53:34 +00:00
Adam Hathcock
30586fdcc5
Validate full-width TAR binary sizes
...
Combine the decoder and padding size bounds from advisory PR #1 with the checked seek offsets and sync/async regression coverage in PR #2 .
Co-authored-by: 4nonym0us <2701409+4nonym0us@users.noreply.github.com >
2026-11-09 11:34:11 +00:00
Adam Hathcock
46ba719daa
Reject negative TAR entry sizes and overflowing seek offsets
2026-11-09 11:28:55 +00:00
Adam Hathcock
fa3dff056a
Reject stalled BZip2 decoder states after corruption
2026-11-09 11:16:14 +00:00
Adam Hathcock
990186acc5
Fix writable archive duplicate entry checks
2026-11-06 16:03:00 +00:00
Adam Hathcock
9a04b51c0b
Reject Deflate back-references beyond initialized history
2026-11-04 17:03:41 +00:00
Adam Hathcock
d5014d3a1c
fix legacy test
2026-11-02 16:11:45 +00:00
Adam Hathcock
688f1f7036
Fix solid 7z Deflate entry extraction
2026-11-02 13:27:58 +00:00
Adam Hathcock
f63cd81a65
Reduce allocations in encrypted RAR reading
...
Reuse bounded buffers and transform AES blocks in place. Remove per-block arrays and plaintext queues, avoid per-byte header allocations, and dispose owned crypto transforms.
Add encrypted RAR benchmarks, regression tests, and before/after profiling results. Full .NET 10 suite passes (2,446 tests); all library targets build and net48 tests compile.
2026-10-20 10:43:28 +01:00
Adam Hathcock
e61a335d54
Reduce allocations in RAR5 password key derivation
...
Reuse keyed HMAC state and digest buffers on modern .NET targets while preserving RAR5's three PBKDF2 snapshots. Add independent derivation checks and an allocation regression test.
Profiling on macOS ARM64 with .NET 10 reduced allocations by 99.96%, but showed slower throughput; Alpine-specific timing remains unverified. Full .NET 10 test suite passes.
2026-10-20 10:10:29 +01:00
Adam Hathcock
2168385f2e
fixes for release
2026-10-19 10:52:07 +01:00
Adam Hathcock
7642f76f38
changes fixes to use pooled arrays
2026-10-19 10:10:09 +01:00
Adam Hathcock
4966fc186b
Merge branch 'release' into fix/lzma2-truncated-header
...
# Conflicts:
# src/SharpCompress/Compressors/LZMA/LZ/LzOutWindow.cs
2026-10-19 09:59:33 +01:00
Adam Hathcock
2369f10b63
Grow LZMA dictionary storage only as decoded history requires
2026-10-16 15:39:56 +01:00
Adam Hathcock
8a9b76dd44
Grow Shrink output from decoded bytes and stop at input EOF
2026-10-16 15:35:27 +01:00
Adam Hathcock
0860da8bc5
Buffer ARC LZW input incrementally and reject truncated entries
2026-10-16 15:34:07 +01:00
Adam Hathcock
9b0be6f984
Skip ZIP64 extensible data without size-driven allocations
2026-10-16 15:33:10 +01:00
Adam Hathcock
bc1ade2bbc
Reject truncated LZMA2 headers and prevent stalled decoding
2026-10-16 15:23:57 +01:00
Adam Hathcock
cd9ce9ad94
Merge pull request #1443 from adamhathcock/fix/1441-sevenzip-libarchive-attributes
...
Fix 7z writer attribute interoperability with libarchive
2026-10-13 11:12:10 +01:00
Adam Hathcock
b91671dfc3
Release partially constructed 7z decoder streams on failure
2026-10-13 10:31:15 +01:00
Adam Hathcock
bdb42df4dc
Make raw LZMA setup and disposal exception-safe
2026-10-13 10:29:07 +01:00
Adam Hathcock
38e3222dc2
Release rewind buffers despite disposal failures and reject disposed reads
2026-10-13 10:26:09 +01:00
Adam Hathcock
b3fac7e04a
Release owned Squeeze buffers and failed PPMd models
2026-10-13 10:24:19 +01:00
Adam Hathcock
46437bbbbc
Return pooled memory stream blocks when construction fails
2026-10-13 10:21:45 +01:00
Adam Hathcock
b8f3a8695b
Validate LZMA2 setup before renting and reject disposed writes
2026-10-13 10:09:14 +01:00
Adam Hathcock
c574364838
Fix pooled buffer ownership and exception-safe cleanup
2026-10-13 09:57:19 +01:00
Adam Hathcock
cd3a18bce4
Add public 7z writer attribute regression coverage
2026-10-13 09:23:23 +01:00
Adam Hathcock
9c6cfe886a
Merge remote-tracking branch 'origin/release' into fix/1441-sevenzip-libarchive-attributes
2026-10-13 09:13:55 +01:00
Adam Hathcock
c7115ced3e
Merge pull request #1444 from adamhathcock/fix/1440-sevenzip-directory-only
...
Fix empty and directory-only 7z archive finalization
2026-10-13 09:12:04 +01:00
Adam Hathcock
dcd2515598
Merge remote-tracking branch 'origin/release' into fix/1439-sevenzip-password-exceptions
...
# Conflicts:
# docs/API.md
2026-10-12 17:10:32 +01:00
Adam Hathcock
a147a7bc29
Merge pull request #1442 from adamhathcock/fix/release-pr-1436-followups
...
pr 1436 followups
2026-10-12 17:05:28 +01:00
Adam Hathcock
68401dc86b
Fix formatting and span import in streamless 7z tests
2026-10-12 16:43:34 +01:00
Adam Hathcock
c9f69470ad
Refactor offset and size reading to use BinaryPrimitives
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-10-12 16:08:45 +01:00
Adam Hathcock
69e1477ee6
Expose public exceptions for encrypted 7z decoding failures
2026-10-12 15:29:40 +01:00
Adam Hathcock
7d7983e0f4
Fix 7z encryption detection for streamless files
2026-10-12 15:29:40 +01:00
Adam Hathcock
9332fb9c70
Fix empty and directory-only 7z archive finalization
2026-10-12 15:28:49 +01:00
Adam Hathcock
cda73d09bd
Fix 7z attribute interoperability with libarchive
2026-10-12 15:27:44 +01:00
Adam Hathcock
eac609b35a
Report truncated encrypted RAR data as InvalidFormatException asynchronously
...
ReadExactAsync throws IncompleteArchiveException, so the async decrypt
path's EndOfStreamException catch never ran. On net48, EntryStream.Dispose
skips the entry through the async path, so its IncompleteArchiveException
replaced the InvalidFormatException from the synchronous read and failed
Rar_Multi_Reader_Encrypted. Sync and async now report truncated encrypted
data as InvalidFormatException.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-12 15:23:52 +01:00
Adam Hathcock
b07e6bc727
Validate fragmented GZip trailers asynchronously using inflater read-ahead
2026-10-10 15:40:39 +01:00
Adam Hathcock
b919aaab1f
Validate GZip CRC and size during asynchronous stream disposal
2026-10-10 15:40:39 +01:00
Adam Hathcock
953ce61564
Consume both GZip header CRC bytes and reject truncated fields
2026-10-10 15:40:38 +01:00
Adam Hathcock
f888179583
Preserve DEFLATE read-ahead bytes after one-byte output and EOF
2026-10-10 15:40:37 +01:00
Adam Hathcock
fed1d884c7
Do not treat zero-length checksum reads as end of entry
2026-10-10 15:40:37 +01:00
Adam Hathcock
06fea02e64
Resolve RAR companion volumes with unambiguous case-insensitive fallback
2026-10-10 15:40:36 +01:00
Adam Hathcock
13ed208a2b
Read ARJ headers and extended headers exactly
2026-10-10 15:40:36 +01:00
Adam Hathcock
2a68ec7257
Read ARC entry headers fully on fragmented streams
2026-10-10 15:40:35 +01:00
