Vulnerability: libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
Vulnerability ID: CVE-2019-1000019
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2019-02-04
File: libarchive/archive_read_support_format_7zip.c
Commit message: 7zip: fix crash when parsing certain archives

Fuzzing with CRCs disabled revealed that a call to get_uncompressed_data()
would sometimes fail to return at least 'minimum' bytes. This can cause
the crc32() invocation in header_bytes to read off into invalid memory.

A specially crafted archive can use this to cause a crash.

An ASAN trace is below, but ASAN is not required - an uninstrumented
binary will also crash.

==7719==ERROR: AddressSanitizer: SEGV on unknown address 0x631000040000 (pc 0x7fbdb3b3ec1d bp 0x7ffe77a51310 sp 0x7ffe77a51150 T0)
==7719==The signal is caused by a READ memory access.
    #0 0x7fbdb3b3ec1c in crc32_z (/lib/x86_64-linux-gnu/libz.so.1+0x2c1c)
    #1 0x84f5eb in header_bytes (/tmp/libarchive/bsdtar+0x84f5eb)
    #2 0x856156 in read_Header (/tmp/libarchive/bsdtar+0x856156)
    #3 0x84e134 in slurp_central_directory (/tmp/libarchive/bsdtar+0x84e134)
    #4 0x849690 in archive_read_format_7zip_read_header (/tmp/libarchive/bsdtar+0x849690)
    #5 0x5713b7 in _archive_read_next_header2 (/tmp/libarchive/bsdtar+0x5713b7)
    #6 0x570e63 in _archive_read_next_header (/tmp/libarchive/bsdtar+0x570e63)
    #7 0x6f08bd in archive_read_next_header (/tmp/libarchive/bsdtar+0x6f08bd)
    #8 0x52373f in read_archive (/tmp/libarchive/bsdtar+0x52373f)
    #9 0x5257be in tar_mode_x (/tmp/libarchive/bsdtar+0x5257be)
    #10 0x51daeb in main (/tmp/libarchive/bsdtar+0x51daeb)
    #11 0x7fbdb27cab96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #12 0x41dd09 in _start (/tmp/libarchive/bsdtar+0x41dd09)

This was primarly done with afl and FairFuzz. Some early corpus entries
may have been generated by qsym.
Commit author: Daniel Axtens

Vulnerable version (before fix):
 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size, 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) { 		/* Copy mode. */  		/* 		 * Note: '1' here is a performance optimization. 		 * Recall that the decompression layer returns a count of 		 * available bytes; asking for more than that forces the 		 * decompressor to combine reads by copying data. 		 */ 		*buff = __archive_read_ahead(a, 1, &bytes_avail); 		if (bytes_avail <= 0) { 			archive_set_error(&a->archive, 			    ARCHIVE_ERRNO_FILE_FORMAT,

Fixed version (after fix):
 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size, 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) { 		/* Copy mode. */  		*buff = __archive_read_ahead(a, minimum, &bytes_avail); 		if (bytes_avail <= 0) { 			archive_set_error(&a->archive, 			    ARCHIVE_ERRNO_FILE_FORMAT,

Patch:
patch: @@ -2964,13 +2964,7 @@ get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
 		/* Copy mode. */
 
-		/*
-		 * Note: '1' here is a performance optimization.
-		 * Recall that the decompression layer returns a count of
-		 * available bytes; asking for more than that forces the
-		 * decompressor to combine reads by copying data.
-		 */
-		*buff = __archive_read_ahead(a, 1, &bytes_avail);
+		*buff = __archive_read_ahead(a, minimum, &bytes_avail);
 		if (bytes_avail <= 0) {
 			archive_set_error(&a->archive,
 			    ARCHIVE_ERRNO_FILE_FORMAT,
path: libarchive/archive_read_support_format_7zip.c