FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=vendor%2Flibarchive 2026-07-07T10:58:25Z 2026-07-07T10:58:25Z Martin Matuska mm@FreeBSD.org 2026-07-07T10:36:51Z urn:sha1:77a6696abb6946edaa8cef0fcd9f666d3c69514b New features in 3.8.8: #2685 add support for reading encrypted zipx formats (bzip2, lzma, ppmd, xz, zstd) Bugfixes between 3.8.7 and 3.8.8: Core: #2905 Fix NULL pointer increment in archive_acl_from_text_nl #2927 archive_match: Prevent call stack overflow #2928 pathmatch: Treat anchors not special without flags #2942 fix `archive_entry_set_mode` & `archive_entry_set_perm` #2957 Fix a double-free in the link resolver #2971 Fix mem leaks found with ASAN-enabled test suites #2988 Fix buffer overrun and wrong output for NULL-name ACL entries #2998, §3009: archive_read: FATAL should be sticky for all API calls #3010 Date parsing: reject dates with numbers of more than 4 digits #3011 acl: parser out-of-bounds read #3012 pathmatch: heap buffer over-read #3036 cmdline: Use free+strdup instead of realloc+strcpy #3019 sparse: UAF in sparse_reset #3037 strmode: Remove strcpy usage #3040 Fix a number of unchecked memory allocations #3064 Fix libattr version returned in archive_version_details, as well as a leak #3083 Fix integer overflow in __archive_read_filter_ahead #3114 Fix OOB in `archive_read_open_filenames_w` on some systems #3146 read_disk: Check if off_t can overflow size_t #XXXX read: Fix memory corruption on filtered multi-volume archives Filters: #2526 compress: Fix SIGSEGV when appended before open #3033 filter: Remove unneeded strcpy calls #3050 bzip2: Support large in-memory archives #3054 filter: Fix mismatched filter function dispatch table entry in archive_write_add_filter.c #3073 zstd: Fix 32 bit platform endless loop and OOB access during bidding #3085 gzip: Support more large in-memory archives #3093 lz4: Improve truncated input stream detection #3100 lz4: Check `XXH32_init` result #3103 uu: Extend range checks to avoid 32 bit OOB #3115 gzip: Fix OOB in writer with huge filename #3132 lz4: Fix double-free on reallocation failure 7-ZIP reader and writer: #2923 sanity-check FilesInfo NumFiles before allocating entries #2929 Verify that Codec ID fits into 63 bit #2980 Sanity-check the number of files #2985 Harden SFX parser #3002 Clean up the failure path in `setup_decode_folder` #3006 Fix 32 bit heap overflow #3062 writer: free file->utf16name on symlink UTF-8 conversion failure #3067 Set error message in case of error #3074 Support streamable reading again #3099 Extend support for filtered input #3102 fix a number of issues in zstd detection #3119 Fix range check in get_pe_sfx_offset CAB reader: #2979 reader: Fix use of uninitialized values from Huffman table #3000 Harden the handling of invalid headers #3144 Improve truncation detection #3145 Properly limit maximum name length #3153 Fix multi volume parser CPIO reader and writer: #2984 reader: Validate pathname in record_hardlink #3043 reject oversized pathnames before read-ahead #3055 Fix UAF in error path #3095 Improve afio header detection #3158 Fix writer OOB read with very long filenames #3168 fix OOB read from int pathlength truncation in newc/binary writers iso9660 reader and writer: #2968 Fix `..` (dot dot) path normalization #2974 Fix OOB during Joliet ID generation #2978 Fix infinite loop in Joliet ID generation #2983 Fix joliet pathname overflow #3017 Fix NULL deref and Joliet ID overflow #3021 fix infinite loop on self-referencing CE entry #3029 Fix memory leaks on error paths #3045 bound duplicate identifier extension placement #3117 Fix null dereference in set_directory_record_rr mtree reader and writer: #2930 Fix time value parser truncation #2982 Fix hex parser #3007 Escape standard pathname matching characters #3008 Do not append '/' when basename is '.' #3018 NULL pointer deref during archive close #3032 Port iso9660 fix for `..` (dot dot) path normalization #3057 Fix null dereference for some corner cases RAR reader: #3015 avoid reading NEWSUB extended data during header parsing #3047 skip NEWSUB payloads without size cap #3048 reset low-distance state for new LZ tables #3087 Simplify FILE_ATTRIBUTE_DIRECTORY check #3105 Add missing bound check for staticdata RARv5 reader: #3004 FAIL if the decode table is > 2^16 #3081 Avoid dangling pointers in init_unpack #3091 skip unconsumed block bytes before ARCHIVE_RETRY #3121 fix signed integer underflow in bytes_remaining TAR reader and writer: #2991 Harden timestamp parsing #3038 Improve string safety in list_item_verbose #3052 Fix OOB with empty wide character directory names WARC reader and writer: #3061 writer: free hdr on _popul_ehdr overflow in _warc_header XAR reader and writer: #3013 Fix two UB (#3013) #3028 Free XAR xattr fstype metadata during cleanup #3030 Avoid integer overflows in number parsers #3032 Port iso9660 fix for `..` (dot dot) path normalization #3041 Fix writer OOB accesses with fflags #3060 fix fflags_text leak in file_free ZIP reader and writer: #2981 Limit the LZMA initialization to 64MiB memory (#2981) #2993 Don't try to write overlong pathnames (#2993) #2996 Reject empty pathnames in ZIP writer (#2996) Obtained from: libarchive Vendor commit: 7219b0134d771dc4b51bf86b4d01761b87398b1b 2026-04-13T13:29:20Z Martin Matuska mm@FreeBSD.org 2026-04-13T13:22:49Z urn:sha1:f2cd95a372000681bafe284df6ba857d5c2541c2 Important bugfixes between 3.8.6 and 3.8.7: #2871 libarchive: fix handling of option failures #2897 iso9660: fix undefined behavior #2898 RAR: fix LZSS window size mismatch after PPMd block #2900 CAB: fix NULL pointer dereference during skip #2911 libarchive: do not continue with truncated numbers #2919 CAB: Fix Heap OOB Write in CAB LZX decoder #2934 iso9660: fix posibble heap buffer overflow on 32-bit systems #2939 cpio: Fix -R memory leak #2947 libarchive: lzop and grzip filter support Important bugfixes between 3.8.5 and 3.8.6: #2860 bsdunzip: fix ISO week year and Gregorian year confusion #2864 7zip: ix SEGV in check_7zip_header_in_sfx via ELF offset validation #2875 7zip: fix out-of-bounds access on ELF 64-bit header #2877 RAR5 reader: fix infinite loop in rar5 decompression #2878 mtree reader: Fix file descriptor leak in mtree parser cleanup (CWE-775) #2892 RAR5 reader: fix potential memory leak #2893 RAR5: fix SIGSEGV when archive_read_support_format_rar5 is called twice #2895 CAB reader: fix memory leak on repeated calls to archive_read_support_format_cab Obtained from: libarchive Vendor commit: ded82291ab41d5e355831b96b0e1ff49e24d8939 2025-10-16T17:41:19Z Martin Matuska mm@FreeBSD.org 2025-10-16T17:36:33Z urn:sha1:8f38cbcd9c4a4f27bdccf2e75a7e20026cff5181 Important bugfixes: #2477 tar writer: fix replacing a regular file with a dir for ARCHIVE_EXTRACT_SAFE_WRITES #2659 lib: improve filter process handling #2664 zip writer: fix a memory leak if write callback error early #2665 lib: archive_read_data: handle sparse holes at end of file correctly #2668 7zip: Fix out of boundary access #2670 zip writer: fix writing with ZSTD compression #2672 lib: fix error checking in writing files #2678 zstd write filter: enable Zstandard's checksum feature #2679 lib: handle possible errors from system calls #2707 lib: avoid leaking file descriptors into subprocesses #2713 RAR5 reader: fix multiple issues in extra field parsing function #2716 RAR5 reader: early fail when file declares data for a dir entry #2717 bsdtar: Allow filename to have CRLF endings #2719 tar reader: fix checking the result of the strftime (CVE-2025-25724) #2737 tar reader: fix an infinite loop when parsing V headers #2742 lib: parse_date: handle dates in 2038 and beyond if time_t is big enough Obtained from: libarchive Vendor commit: 7f53fce04e4e672230f4eb80b219af17975e4f83 Security: CVE-2025-25724 2025-05-20T10:47:29Z Martin Matuska mm@FreeBSD.org 2025-05-20T10:43:26Z urn:sha1:b0ea71a8555c0b726319dc2a618cc6d17a4fa4f1 New features: #2088 7-zip reader: improve self-extracting archive detection #2137 zip writer: added XZ, LZMA, ZSTD and BZIP2 support #2403 zip writer: added LZMA + RISCV BCJ filter #2601 bsdtar: support --mtime and --clamp-mtime #2602 libarchive: mbedtls 3.x compatibility Security fixes: #2422 tar reader: Handle truncation in the middle of a GNU long linkname CVE-2024-57970 #2532 tar reader: fix unchecked return value in list_item_verbose() CVE-2025-25724 #2532 unzip: fix null pointer dereference CVE-2025-1632 #2568 warc: prevent signed integer overflow #2584 rar: do not skip past EOF while reading #2588 tar: fix overflow in build_ustar_entry #2598 rar: fix double free with over 4 billion nodes #2599 rar: fix heap-buffer-overflow Important bugfixes: #2399 7-zip reader: add SPARC filter support for non-LZMA compressors #2405 tar reader: ignore ustar size when pax size is present #2435 tar writer: fix bug when -s/a/b/ used more than once with b flag #2459 7-zip reader: add POWERPC filter support for non-LZMA compressors #2519 libarchive: handle ARCHIVE_FILTER_LZOP in archive_read_append_filter #2539 libarchive: add missing seeker function to archive_read_open_FILE() #2544 gzip: allow setting the original filename for gzip compressed files #2564 libarchive: improve lseek handling #2582 rar: support large headers on 32 bit systems #2587 bsdtar: don't hardlink negative inode files together #2596 rar: support large headers on 32 bit systems #2606 libarchive: support @-prefixed Unix epoch timestamps as date strings Obtained from: libarchive Vendor commit: 70ff28fcf04ec129a1d064f96e49aa57fcc90e37 CVE: CVE-2024-57970, CVE-2025-1632, CVE-2025-25724 2024-09-14T09:48:57Z Martin Matuska mm@FreeBSD.org 2024-09-14T09:40:31Z urn:sha1:2022efa03048f4b6b5cef39bdd900d61dd484734 Security fixes: #2158 rpm: calculate huge header sizes correctly #2160 util: fix out of boundary access in mktemp functions #2168 uu: stop processing if lines are too long #2174 lzop: prevent integer overflow #2172 rar4: protect copy_from_lzss_window_to_unp() (CVE-2024-20696) #2175 unzip: unify EOF handling #2179 rar4: fix out of boundary access with large files #2203 rar4: fix OOB access with unicode filenames #2210 rar4: add boundary checks to rgb filter #2248 rar4: fix OOB in delta filter #2249 rar4: fix OOB in audio filter #2256 fix multiple vulnerabilities identified by SAST #2258 cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing #2265 rar5: clear 'data ready' cache on window buffer reallocs #2269 rar4: fix CVE-2024-26256 (CVE-2024-26256) Important bugfixes: #2150 xar: fix another infinite loop and expat error handling #2173 shar: check strdup return value #2161 lha: fix integer truncation on 32-bit systems #2245 7zip: fix issue when skipping first file in 7zip archive that is a multiple of 65536 bytes #2259 rar5: don't try to read rediculously long names #2290 ar: fix archive entries having no type Obtained from: libarchive Vendor commit: 12ecf8418ab3595d66cdea1abadcea8b6a9d288b CVE: CVE-2024-20696, CVE-2024-26256 2024-04-11T13:48:20Z Martin Matuska mm@FreeBSD.org 2024-04-11T13:37:34Z urn:sha1:a509d68f27b9f114b876bbe3b9caa9d0ee0c5606 New features: #1941 uudecode filter: support file name and file mode in raw mode #1943 7-zip reader: translate Windows permissions into UNIX permissions #1962 zstd filter now supports the "long" write option #2012 add trailing letter b to bsdtar(1) substitute pattern #2031 PCRE2 support #2054 add support for long options "--group" and "--owner" to tar(1) Security fixes: #2101 Fix possible vulnerability in tar error reporting introduced in f27c173 Important bugfixes: #1974 ISO9660: preserve the natural order of links #2105 rar5: fix infinite loop if during rar5 decompression the last block produced no data #2027 xz filter: fix incorrect eof at the end of an lzip member #2043 zip: fix end-of-data marker processing when decompressing zip archives Obtained from: libarchive Libarchive commit: 4fcc02d906cca4b9e21a78a833f1142a2689ec52 2023-07-18T07:58:47Z Martin Matuska mm@FreeBSD.org 2023-07-18T07:58:47Z urn:sha1:14b646f7c3f709cd0de2d59db3691273bc8d6d16 Important changes (relevant to FreeBSD): #1840 year 2038 fix for pax archives on platforms with 64-bit time_t #1873 bsdunzip ported to libarchive from FreeBSD #1894 read support for zstd compression in 7zip archives #1918 ARM64 filter support in 7zip archives Obtained from: libarchive Libarchive commit: ee45796171324519f0c0bfd012018dd099296336 Libarchive tag: v3.7.0 2020-02-11T23:48:03Z Martin Matuska mm@FreeBSD.org 2020-02-11T23:48:03Z urn:sha1:8185c4ae244f9a52ad987b36e7d6300500054d00 Libarchive 3.4.2 Relevant vendor changes: PR #1289: atomic extraction support (bsdtar -x --safe-writes) PR #1308: big endian fix for UTF16 support in LHA reader PR #1326: reject RAR5 files that declare invalid header flags Issue #987: fix support 7z archive entries with Delta filter Issue #1317: fix compression output buffer handling in XAR writer Issue #1319: fix uname or gname longer than 32 characters in pax writer Issue #1325: fix use after free when archiving hardlinks in ISO9660 or XAR Use localtime_r() and gmtime_r() instead of localtime() and gmtime() 2016-12-30T01:34:06Z Martin Matuska mm@FreeBSD.org 2016-12-30T01:34:06Z urn:sha1:79b08f16f5ddb1d3863d84ec051211a8b0b082d9 Vendor bugfixes: PR #843: Fix memory leak of struct archive_entry in cpio/cpio.c PR #851: Spelling fixes Fix two protoypes in manual page archive_read_disk.3 2016-05-11T10:19:44Z Martin Matuska mm@FreeBSD.org 2016-05-11T10:19:44Z urn:sha1:4e579f6c9425c995106fbf72667f4ec7e5d5db85