REDHAT-BUG-2521767: Buffer Overflow
A stack-based buffer overflow exists in file-roller's parseprogressline() functions in the 7z and RAR archive backends (src/fr-command-7z.c and src/fr-command-rar.c). When processing output from the 7z or rar subprocess, file paths from archive entries are copied with strcpy() into fixed-size stack buffers (4196 and 4096 bytes) without length validation. An archive containing a file entry with a path longer than these buffers causes a stack buffer overflow when the user opens or extracts the archive in file-roller, resulting in denial of service (process termination). Practical code execution is considered difficult on hardened builds with stack canaries, PIE, and ASLR.
Reported upstream as https://gitlab.gnome.org/GNOME/file-roller/-/issues/327 by Yukihiro Nakamura. Fixed upstream in commit ffb76dc866342cef6a4914873faaa880d14d5aa4 ("Check line length when parsing command output"), first released in file-roller 44.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
file-rollerto a version that resolves this vulnerability.Fixed in 44.7Patch ffb76dc866342cef6a4914873faaa880d14d5aa4 - Compensating control
Avoid opening or extracting untrusted 7z/RAR archives in file-roller to prevent triggering the stack buffer overflow denial of service (process termination) in parse_progress_line() for src/fr-command-7z.c and src/fr-command-rar.c.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of file-roller are exposed when they open or extract a 7z or RAR archive containing an entry with an excessively long file path. The vulnerable parsing occurs in the 7z and RAR archive backends.
What does an attacker need to exploit it?
An attacker needs to provide a crafted 7z or RAR archive with a file-entry path longer than the fixed parsing buffers. The user must then cause file-roller to process the archive by opening or extracting it.
What is the likely impact on hardened systems?
The reported practical impact is denial of service through file-roller process termination. Code execution is considered difficult on builds using stack canaries, PIE, and ASLR.
What version includes the upstream fix?
The fix was first released in file-roller 44.7. The upstream change checks line length while parsing command output.