74 Commits
Author SHA1 Message Date
Tobias Stoeckmann 2615ba5cd5 libarchive_fe: Import FreeBSD's fnmatch
If system lacks fnmatch(3), use FreeBSD's fnmatch. It's adjusted for
increased compatibility, i.e. it uses strcoll instead of FreeBSD's
library internals and const char pointers where needed with latest
GNU/Linux toolchains.

FreeBSD source can be obtained here:

https://github.com/freebsd/freebsd-src/blob/dc36d6f9bb1753f3808552f3afd30eda9a7b206a/lib/libc/gen/fnmatch.c

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2026-06-22 20:32:23 +02:00
ZX41R 88b5efe09a Improve write-disk fuzzer coverage 2026-05-08 13:52:58 +00:00
Tobias Stoeckmann ab956a274e Move la_getline into libarchive_fe
This allows easier reuse of the getline implementation in other tools
like cpio (in upcoming commit).
2026-03-16 09:43:45 +01:00
ZUENS2020 0064032972 Fix OOB read in contrib/untar.c parseoct()
Reported-by: ZUENS2020
2026-03-11 21:36:49 +08:00
OwenSanzas 070062a166 Fix double-free in libarchive_linkify_fuzzer
The fuzzer fails to update entries[i] after archive_entry_linkify()
modifies the pointer (caching or swapping entries). This causes the
cleanup loop to free entries that were already freed via spare or
the drain loop, resulting in heap-use-after-free.

Fix: add entries[i] = entry after the linkify call to track ownership.
2026-03-05 19:03:46 +00:00
Leslie P. Polzer eb6f992ba1 Refactor all fuzzers to use shared fuzz_helpers.h
Complete the refactoring of all 25 fuzzers:
- Remove duplicate Buffer struct definitions from 15 format fuzzers
- Remove duplicate DataConsumer class from 7 API fuzzers
- Update consume_bytes() calls to match new signature
- All fuzzers now use shared helpers from fuzz_helpers.h

This eliminates ~1000 lines of duplicated code.
2025-12-22 04:53:06 +00:00
Leslie P. Polzer 544b07541b Refactor fuzzers: add shared header, remove system() call
- Add fuzz_helpers.h with shared Buffer, reader_callback, DataConsumer
- Replace system("rm -rf") with nftw-based remove_directory_tree()
- Refactor entry, tar, write_disk fuzzers to use shared helpers
- Reduces code duplication and improves maintainability
2025-12-22 04:26:57 +00:00
Leslie P. Polzer 5e88593708 Expand OSS-Fuzz integration: 1 → 25 fuzz targets
Add comprehensive fuzzing coverage for libarchive:

Format-specific fuzzers (13):
- tar, zip, 7zip, rar, rar5, xar, cab, lha, iso9660, cpio, warc, mtree, ar

Security-critical fuzzers (4):
- encryption: encrypted archive handling
- write_disk: extraction path traversal
- read_disk: filesystem traversal, symlinks
- entry: ACL functions (previously 0% coverage)

API fuzzers (7):
- write: archive creation
- linkify: hardlink detection (complexity 775, was 0%)
- match: inclusion/exclusion patterns
- string: encoding conversions (UTF-8, wide chars)
- seek: seekable archive operations
- roundtrip: write-then-read consistency
- filter: compression/decompression

Supporting files:
- 14 dictionaries with format-specific magic bytes
- 9 options files for complex fuzzers
- Updated build script with seed corpora generation

Targets previously uncovered functions:
- archive_entry_linkify (complexity 775)
- ACL functions (complexity 705-713)
- xar_read_header (was 10.11% coverage)

Expected coverage improvement: 74% → 85-95%
2025-12-22 04:08:26 +00:00
Alfred Neumayer 752df6abb7 libarchive & contrib: Build as static binary for the Android recovery
Adds a 'bsdtar-recovery' Android build target for use in Android recoveries
as a static binary, and fixes some build failures on the get-go.

Tested on halium-7.1, halium-9.0 & halium-13.0.

Change-Id: I9b656e7016d4bf21517e2edb18f2a7733edc6982
2025-12-04 06:34:21 +01:00
Dustin L. Howett 619e22cae7 WIP: remove WinCrypt support
I am debating whether to remove the checks for bcrypt as well (it is
supported on all versions of Windows currently targeted.)

fixes https://github.com/libarchive/libarchive/issues/2595
2025-09-22 16:05:17 -05:00
Tim Kientzle 96f76577d3 Rename err.h to avoid conflict with system header
Depending on header search path ordering, we can easily
confuse libarchive_fe/err.h with the system header.
Rename ours to lafe_err.h to avoid the confusion.
Rename libarchive_fe/err.c to match.
2025-09-13 12:30:03 -07:00
Tim Kientzle ab4d21e4cb Merge pull request #2707 from fdegros/close_range_support
Avoid leaking file descriptors into subprocesses
2025-08-20 11:18:45 -07:00
Dag-Erling Smørgrav a335429c5e Drop support for readdir_r()
There has never been a good reason to prefer it over readdir(), and it
has now been marked obsolete in POSIX-1.2024.
2025-08-01 17:07:17 +02:00
François Degros 64bcf69ef8 Use closefrom() or close_range() when possible
To avoid leaking file descriptors into subprocesses.

Fixes: https://github.com/libarchive/libarchive/issues/2520
2025-07-31 15:03:22 +10:00
Mostyn Bramley-Moore ead8cd69bd contrib/psota-benchmark/tcp.sh is a bash script
I am unsure if this is still used, but it fails to run in Bourne shell.
2025-05-18 12:58:31 +02:00
Zhaofeng LiandDustin L. Howett c26f037745 bsdtar: Support --mtime and --clamp-mtime (#2601)
Hi,

This PR adds support for setting a forced mtime on all written files
(`--mtime` and `--clamp-mtime`) in bsdtar.

The end goal will be to support all functionalities in
<https://reproducible-builds.org/docs/archives/#full-example>, namely
`--sort` and disabling other attributes (atime, ctime, etc.).

Fixes #971.

## History

- [v1](https://github.com/zhaofengli/libarchive/tree/forced-mtime-v1):
Added `archive_read_disk_set_forced_mtime` in libarchive. As a result,
it was only applied when reading from the filesystem and not from other
archives.
- [v2](https://github.com/zhaofengli/libarchive/tree/forced-mtime-v2):
Refactored to apply the forced mtime in `archive_write`.
- v3 (current): Reduced libarchive change to exposing
`archive_parse_date`, moved clamping logic into bsdtar.

---------

Signed-off-by: Zhaofeng Li <hello@zhaofeng.li>
Co-authored-by: Dustin L. Howett <dustin@howett.net>
2025-05-15 14:08:14 +02:00
Lukas Javorsky 95c386317f Remove unnecessary sharutils dependency (#2571)
Resolves issue: #2570
2025-04-08 20:23:27 -07:00
Mostyn Bramley-Moore 819a50a043 Remove liblzmadec remnants (#2436)
It looks like support for this library was removed in 2016, but we still
had some unused cmake code and a dead preprocessor block.
2024-12-15 23:14:57 +01:00
Julian Uy 819c5b01a9 Check for tcgetattr / tcsetattr before using it for readpassphrase implementation (#2424)
This is mainly for non-cygwin newlib platforms that don't have tcgetattr
/ tcsetattr implemented
2024-12-06 07:58:58 -08:00
Tim KientzleandMartin Matuška bbc74679cd contrib/untar.c: cleanup (#2112)
This reworks PR #1613 (commit a902fcd4), addressing the same issues as that
earlier PR, but in a simpler and more portable fashion.

Co-authored-by: Martin Matuška <martin@matuska.org>
2024-04-07 23:43:05 +02:00
Mostyn Bramley-Moore d1231a7ea7 Add support for PCRE2 (#2031)
The original PCRE is now end-of-life, and no longer actively maintained.

Implements #2013.
2023-12-09 23:56:53 +01:00
Brooks Davis 7dde502899 VCSid removal (#2017)
The libarchive source tree is littered with `__FBSDID("$FreeBSD.*")` and
'$FreeBSD$' tags left over from extracting it from FreeBSD's Subversion
repo. They never made sense for a git repo as git doesn't expand them
and FreeBSD has now removed `$FreeBSD$` from most local source files so
these stand out.

In addition to `__FBSDID` I've removed `__RCSID` which was used once for
a `$NetBSD$` expansion. There might be more of a case to be made for
preserving this one as a diff-reduction measure, but it seems mostly
pointless.

This builds and tests pass except for
libarchive_test_read_disk_directory_traversals which failed on master as
well.
2023-11-20 17:41:49 -08:00
Martin Matuska ee8f5db73e contrib/archivetest: add raw archive support and print file modes 2023-08-22 14:08:14 +02:00
Samuel Marks a902fcd4ad contrib/unter: use vendor-dependent number format for size_t (#1613)
Use BUF_SIZE constant instead of explicit number
2023-07-26 09:04:06 +02:00
AtariDreams 1496157890 Correct assignment to r when checking for result of reading archive data (#1929)
It is impossible for if (r == ARCHIVE_FATAL) to be true otherwise.
2023-07-24 00:10:10 +02:00
Steve Lhomme 480ba376a6 Fix bcrypt detection on UNIX cross-compilation
The Windows SDK uses an uppercase on the B, but mingw-w64 doesn't.
The autoconf detection already uses a lowercase bcrypt.
2023-07-14 00:28:32 +02:00
Rose 013aef1275 Update autotools and fix warnings (#1815)
We do not need to check TIME_WITH_SYS_TIME anymore. We can check
HAVE_SYS_TIME_H and not bother checking for C99.
2023-01-09 15:18:30 +01:00
Rosen Penev 0348e24bab replace time64 functions with normal ones (#1830)
Otherwise there are 32/64-bit pointer conversions going on. In Windows
since MSVC2005, time_t has been 64-bit. MinGW needs a hack to get 64-bit
time_t.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2023-01-09 15:15:55 +01:00
Martin Matuska 9e52796150 untar.c: style fixes 2022-02-07 10:48:51 +01:00
Martin Matuška c9788f9b70 Merge pull request #1170 from kidandcat/patch-1
Windows support for contrib/untar
2022-02-07 00:59:09 +01:00
Jairo 9d1c5db643 Update untar.c 2022-02-07 00:13:18 +01:00
Jairo d67c6ea36d Update untar.c 2022-02-07 00:11:02 +01:00
Samanta Navarro a80614384e Fix typos
Typos found with codespell
2021-06-01 11:26:14 +00:00
Martin Matuska c6d1d7ceb0 Bump minor version in contrib/libarchive.spec 2020-12-04 15:41:18 +01:00
Adam Korczynski 71092e3cb7 Moved oss-fuzz files from oss-fuzz to Libarchives repository 2020-05-06 12:35:59 +01:00
Adam Korczynski 85c5a82c02 Moved the corpus file to the contrib dir 2020-04-25 17:19:29 +01:00
Martin Matuska 25565e1e25 contrib/archivetest: fix compilation under MinGW 2020-01-22 16:06:25 +01:00
Ingo Schwarze 79d841ff93 Minor corrections to the formatting of manual page.
Found with mandoc -Tlint; fixing the following messages:

WARNING: bad NAME section content
WARNING: missing comma before name
WARNING: new sentence, new line
WARNING: parenthesis in function name
WARNING: skipping no-space macro
WARNING: skipping paragraph macro
WARNING: unusual Xr order
WARNING: unusual Xr punctuation
STYLE: no blank before trailing delimiter
STYLE: possible typo in section name
STYLE: trailing delimiter
STYLE: whitespace at end of input line

For the meaning of the messages, see:
https://man.openbsd.org/mandoc#DIAGNOSTICS
2019-09-21 09:23:10 +02:00
Martin Matuska 614110e76d 3.4.0 2019-06-11 21:53:23 +02:00
Martin Matuska b899e5ee0c Update specfile to a version usable on copr 2019-06-10 23:27:33 +02:00
Martin Matuska b5818e39e1 contrib/archivetest: report archive_error_string() on error 2019-05-20 13:24:59 +02:00
Martin Matuska 116cf2c71d contrib/archivetest: add help, support stdin, quiet mode and data skip mode 2019-05-17 12:04:20 +02:00
Martin Matuska ccd2553510 Add contrib/archivetest.c utility to test archives with libarchive 2019-05-16 15:36:41 +02:00
Jairo 7befaaf3c3 Windows support 2019-04-15 09:42:24 +02:00
Markus Elfring 429189f00d Bug #1128: Deletion of unnecessary checks before calls of the function “free”
The function “free” is documented in the way that no action shall occur for
a passed null pointer. It is therefore not needed that a function caller
repeats a corresponding check.
https://stackoverflow.com/questions/18775608/free-a-null-pointer-anyway-or-check-first

This issue was fixed by using the software “Coccinelle 1.0.7”.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
2019-02-04 18:38:18 +01:00
Anthony Brandon 285503f27a Android.mk: update libarchive sources
Remove non existent file and add missing file the list of libarchive
sources in Android.mk.

Signed-off-by: Anthony Brandon <anthony@amarulasolutions.com>
2018-06-21 13:39:35 +02:00
Sean Purcell cd63bdcda5 Fix alphabetical order, other small fixes 2017-05-15 23:06:49 -04:00
Sean Purcell f59fec0254 Add Zstandard write support 2017-05-15 23:06:48 -04:00
Sean Purcell 26838cf5c1 Add Zstandard read support 2017-05-15 23:06:47 -04:00
Martin Matuska 30e1b7efd4 Remove support for liblzmadec and use FindLibLZMA
Closes #806
2016-10-26 00:39:46 +02:00