sec: RUSTSEC-2026-0429, a zip archive that aborts the process on extract #574
Loading…
Reference in a new issue
No description provided.
Delete branch "sec/zip-extract-abort"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The repo-wide audit is red on every open PR because of a new advisory, RUSTSEC-2026-0429.
ZipArchive::extractsizes a symlink target's buffer from the size the archive declares, so a 112-byte archive aborts the process. It is fixed inzip9.What changes
zipextract?wai/wai-quantum-desktoptauri-plugin-updaterwai/wai-rsc2pa, behindc2pa_emitc2pa0.91.7aac/aac-rsopen_board_format0.1.1, its newest release, asks for ^8.6by_indexandread_to_endjouleclaw/jouleclaw-rscandle-core0.8.4openpaycandle-core0.8.4, held there byburn0.17jouledesk/jouledesk-rswebrtc-sys-build0.3.18webrtc-sys-buildcan't move on its own: its next releases change which libwebrtc it downloads, so it moves withlivekit.The
c2pamove also takeselliptic-curve0.14, sowai-rsholds nocrypto-bigint0.5.A correction in the allow list: the comment over the older
zipentries said nothing in this tree extracts an archive. The updater did, and the build script still does. The comment and those entries' reasons now say that nothing that runs here extracts one.What ran
scripts/check-advisories.py: 60 lockfiles, 20 allowed advisories, exit 0.c2pa_emittests, both CI steps: 9 passed, and 2 withlive_metering. Noopensslin the graph.wai breakingagainst the merge base: no unacknowledged change.Not run outside CI: the desktop app with the new lockfile, and any Windows build.
zipis only compiled for Windows there, so this PR's Windows leg is the first to compile against 9.x. A localc2pa_emitcheck adds no new warnings from library code.🤖 Generated with Claude Code
`ZipArchive::extract` sizes a symlink target's buffer from the size the archive declares, so a 112-byte archive aborts the process. Fixed in zip 9. The audit went red on every open PR when the advisory was published. Two lockfiles move: wai-quantum-desktop: tauri-plugin-updater 2.14.0 -> 2.14.1. Its source is unchanged; it asks for zip 9. This was the only copy that runs `extract` in a shipped program, on Windows, on an update package whose signature has already been checked. wai-rs: c2pa 0.90 -> 0.91, behind `c2pa_emit`. This also takes elliptic-curve 0.14, so the workspace holds no crypto-bigint 0.5. Four copies stay, each read at its call site and allowed at its exact version: open_board_format and candle-core never call `extract`, and webrtc-sys-build calls it in a build script, on its own download. The build crate's next releases change which libwebrtc it downloads, so it moves with livekit. The comment over the older zip entries said nothing in this tree extracts an archive. It was wrong: the updater did, and the build script does. It now says what is true. Co-Authored-By: Claude Opus 5.5 <[email protected]>