CVE-2022-23596 (published 2022-02-01T12:15Z)

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/junrar/junrar
commit_details: repo_url: https://github.com/junrar/junrar
author: Gauthier Roebroeck
author_date: 2022-01-27 12:08:31+08:00
msg: fix: invalid subheader type would throw npe and make the extract loop

closes #73
repository: repo_url: https://github.com/junrar/junrar
repo_name: junrar/junrar
description: Plain Java unrar library
repo_language: Java
owner: junrar
file_changes: filename: Archive.java
change_type: ModificationType.MODIFY
diff: @@ -45,6 +45,7 @@ import com.github.junrar.rarfile.ProtectHeader;
 import com.github.junrar.rarfile.RARVersion;
 import com.github.junrar.rarfile.SignHeader;
 import com.github.junrar.rarfile.SubBlockHeader;
+import com.github.junrar.rarfile.SubBlockHeaderType;
 import com.github.junrar.rarfile.UnixOwnersHeader;
 import com.github.junrar.rarfile.UnrarHeadertype;
 import com.github.junrar.unpack.ComprDataIO;
@@ -449,7 +450,9 @@ public class Archive implements Closeable, Iterable<FileHeader> {
                             final SubBlockHeader subHead = new SubBlockHeader(blockHead,
                                 subHeadbuffer);
                             subHead.print();
-                            switch (subHead.getSubType()) {
+                            SubBlockHeaderType subType = subHead.getSubType();
+                            if (subType == null) break;
+                            switch (subType) {
                                 case MAC_HEAD: {
                                     final byte[] macHeaderbuffer = safelyAllocate(MacInfoHeader.MacInfoHeaderSize, MAX_HEADER_SIZE);
                                     rawData.readFully(macHeaderbuffer, macHeaderbuffer.length);

programming_language: Java
filename: AbnormalFilesTest.java
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,8 @@ public class AbnormalFilesTest {
     private static Stream<Arguments> provideFilesAndExpectedExceptionType() {
         return Stream.of(
             Arguments.of("abnormal/corrupt-header.rar", CorruptHeaderException.class),
-            Arguments.of("abnormal/mainHeaderNull.rar", BadRarArchiveException.class)
+            Arguments.of("abnormal/mainHeaderNull.rar", BadRarArchiveException.class),
+            Arguments.of("abnormal/loop.rar", CorruptHeaderException.class)
         );
     }
 }

programming_language: Java