libarchive 3.8.8 (CVE-2026-14164) [stable/4.1]#453
Merged
Conversation
Vendor import of libarchive 3.8.8, which fixes CVE-2026-14164, a double-free in the RAR5 reader (archive_read_support_format_rar5.c) that could crash applications parsing a crafted RAR5 archive. Keep MidnightBSD's stripped file set (Windows-only sources, CMake, autotools, and CI files) deleted, and preserve the local iconv patch in archive_string.c that extends the ICONV_SET_ILSEQ_INVALID workaround to __MidnightBSD__ as well as __FreeBSD__. AI-Assisted-by: Claude Opus 4.8 Signed-off-by: Lucas Holt <luke@foolishgames.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
libarchive 3.8.8 de-constified parse_option() to char** and added new Windows-attribute -> fflags mapping code in the 7zip and RAR5 readers that assigns string literals to char* variables. Under MidnightBSD's strict build flags (-Werror -Wwrite-strings -Wcast-qual) these discard qualifiers and break buildworld. Backport the upstream fixes verbatim (already on libarchive master, post 3.8.8): restore const on the option name/value pointers in archive_options.c, and make the read-only fflags[] string pointers const in archive_read_support_format_7zip.c and archive_read_support_format_rar5.c. No functional change; the affected strings are only ever read. AI-Assisted-by: Claude Opus 4.8 Signed-off-by: Lucas Holt <luke@foolishgames.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> (cherry picked from commit 5c3c324)
Signed-off-by: Lucas Holt <luke@foolishgames.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of the libarchive 3.8.8 update (#451) to stable/4.1.
libarchive 3.8.8 fixes CVE-2026-14164, a high-severity double-free in the
RAR5 reader (
archive_read_support_format_rar5.c) that could crashapplications parsing a crafted RAR5 archive (CVSS 7.5, network/DoS).
Changes
vendor/libarchive/dist/3.8.8intocontrib/libarchive.ICONV_SET_ILSEQ_INVALIDextended to__MidnightBSD__inarchive_string.c).5c3c324666):const-correct
parse_option()inarchive_options.cand the newWindows-attribute
fflags[]mapping in the 7zip and RAR5 readers. Nofunctional change.
UPDATINGnote added.No build-glue (Makefile) changes needed: the new
libarchive_fe/lafe_fnmatch.cis compiled only when
HAVE_FNMATCHis undefined, and MidnightBSD has nativefnmatch(3).Testing
Targeted
make buildenvbuild oflib/libarchiveandbsdtar/bsdcpio/bsdunzip/bsdcaton amd64 — all compile and link cleanly.Relates to #450.
Security: CVE-2026-14164
AI-Assisted-by: Claude Opus 4.8