Vulnerabilities in programs that process archive files

[wanderer]

I'm not sure if and how this may affect TC but i'm reporting it, just in case...

http://it.slashdot.org/it/08/03/18/1724245.shtml

http://www.f-secure.com/weblog/archives/00001404.html

https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html

[ghisler(Author)]

I have seen this too (on Heise.de). So far I have tested the ZIP and TAR unpackers, and will test the others too. There is no problem with the unpack functions themselves. The ZIP64 header read function sometimes reads beyond the allocated header buffer and causes an access violation, but this isn't a security problem. I will fix that in TC 7.5. The ppmd packer can get into an infinite loop when it reaches the end of the file, but it can be aborted with the Abort button. This isn't a security hole either, so it will be fixed in TC 7.5 too. The TAR packer has no problems at all with the tested files.

[wanderer]

Great. Thanks for the update.

[m^2]

I think that plugin authors should also check these archives.