NtfsHandler: backport 7-Zip 26.01 ClusterSizeLog bound (CVE-2026-48095) - #254
Open
tonghuaroot wants to merge 1 commit into
Open
tonghuaroot wants to merge 1 commit into
tonghuaroot wants to merge 1 commit into
Conversation
Upstream 7-Zip 26.01 tightened the ClusterSizeLog cap in the NTFS boot-sector parser from > 30 to > 21 so the shift exponent in GetCuSize() (BlockSizeLog + CompressionUnit, max +4) cannot reach 32 on a malicious image. With the prior > 30 bound the 32-bit shift was undefined behaviour and reduced the compression-unit buffer to 1 byte before a 256 MiB write followed. Disclosed as CVE-2026-48095. Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports the one-line bounds tightening landed in upstream 7-Zip 26.01 (released 2026-04-27) to address CVE-2026-48095 (GHSL-2026-140).
What changed upstream
7-Zip 26.01 changed
CPP/7zip/Archive/NtfsHandler.cppfrom:to:
The reason is that
GetCuSize()further down in the same file computes:With the old cap of 30, an NTFS image specifying
ClusterSizeLog = 28..30plusCompressionUnit = 4makes the shift exponent reach 32, which is undefined behaviour for a 32-bit shift in C/C++. On x86/x64 the count is masked to the low 5 bits, soGetCuSize()returns1and the compression-unit buffer is allocated as 1 byte before the subsequent read writes up to 256 MiB into it. The new cap of 21 leaves room for the maximumCompressionUnitof 4 so the exponent stays under 32.p7zip's
NtfsHandler.cppat line 123 still has the original> 30cap, so the same heap overflow is reachable from a crafted NTFS image when p7zip extracts it.Patch
Single line, byte-for-byte the same as upstream 26.01:
p7zip has a precedent of backporting CVE fixes one at a time (e.g. #239 for CVE-2021-3520).