Repository navigation
Reapply 7z next-header bounds validation to release - #1435
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The replayed validation is overflow-safe, consistent across sync and async paths, and has focused regression coverage.
0 open findings
What changed in this PR
Reapplies the 7z next-header bounds validation to the clean release stack. Merge after #1434.
Changes:
- Validates synchronous and asynchronous 7z header ranges before allocation.
- Adds malformed and exact-boundary regression coverage.
- Includes earlier stacked ZIP, RAR, and GZip recovery fixes.
| File | Description |
|---|---|
tests/SharpCompress.Test/Zip/ZipArchiveTests.cs |
Tests uppercase ZIP multipart discovery. |
tests/SharpCompress.Test/SevenZip/SevenZipHeaderValidationTests.cs |
Covers truncated and boundary-valid 7z headers. |
tests/SharpCompress.Test/Rar/RarEncryptedHeaderScanTests.cs |
Covers repeated encrypted-header scans and solid extraction. |
tests/SharpCompress.Test/GZip/GZipExtraFieldTests.cs |
Covers unsigned XLEN values across APIs. |
src/SharpCompress/Compressors/Deflate/ZlibBaseStream.cs |
Parses GZip XLEN as unsigned. |
src/SharpCompress/Common/SevenZip/ArchiveReader.cs |
Adds synchronous next-header bounds checking. |
src/SharpCompress/Common/SevenZip/ArchiveReader.Async.cs |
Adds asynchronous next-header bounds checking. |
src/SharpCompress/Common/Rar/Headers/RarHeaderFactory.cs |
Resets encryption state between scans. |
src/SharpCompress/Common/Rar/Headers/RarHeaderFactory.Async.cs |
Resets state for asynchronous scans. |
src/SharpCompress/Common/GZip/GZipFilePart.cs |
Corrects synchronous XLEN parsing. |
src/SharpCompress/Common/GZip/GZipFilePart.Async.cs |
Corrects asynchronous XLEN parsing. |
src/SharpCompress/Archives/Zip/ZipArchiveVolumeFactory.cs |
Normalizes multipart ZIP extensions. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…-gzip-reader-archive
…-7z-header-bounds
…der/archive tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rchive' into rebuild/release-06-7z-header-bounds
This was referenced Oct 9, 2026
This was referenced Oct 12, 2026
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reapplies #1430 to the clean
releasehistory after the accidental master merge was removed.Validate next-header bounds before allocation in synchronous and asynchronous 7z parsing, with malformed-header and valid-boundary regression coverage.
b026905d2f2730fd2071e903Review and merge order
Recovery PR 5 of 5. Depends on #1434. Merge that PR first.
All recovery PRs target
release. These branches are stacked, so this diff includes earlier recovery changes until the preceding PRs land. Review the replayed commit above for this PR's specific change. Merge in sequence using merge commits or fast-forward semantics to preserve shared ancestry; squash/rebase merging would require restacking the later branches.The RAR comment test correction (
e5c3ec6a) is already present in the clean base, so its checkpoint branch needs no separate PR. No master-only commits were replayed.Validation
Validated the completed recovery stack on .NET 10:
dotnet csharpier check .passed.Validation was performed on the final stack, not separately on every intermediate branch.