Chrome · ThirdParty lmza_sdk
CVE-2026-110143
Uninitialized Memory in ThirdParty lmza_sdk
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.cthird_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patchthird_party/lzma_sdk/src/C/LzmaEnc.cthird_party/lzma_sdk/src/C/MtDec.cthird_party/lzma_sdk/src/C/LzmaDec.cthird_party/lzma_sdk/src/C/7zDec.cthird_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patchthird_party/lzma_sdk/crowbar.txtthird_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patchDEPSthird_party/lzma_sdk/src/C/7zVersion.hthird_party/lzma_sdk/src/C/Util/7z/7zMain.cthird_party/lzma_sdk/README.chromiumthird_party/lzma_sdk/src/C/DllSecur.cthird_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patchthird_party/lzma_sdk/src/C/XzDec.cthird_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patchthird_party/lzma_sdk/src/C/Compiler.hthird_party/lzma_sdk/src/C/7zTypes.hthird_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patchthird_party/lzma_sdk/src/C/Lzma2Enc.cthird_party/lzma_sdk/src/C/7zArcIn.cthird_party/lzma_sdk/src/C/CpuArch.hthird_party/lzma_sdk/src/DOC/lzma-sdk.txtthird_party/lzma_sdk/src/C/Bcj2Enc.cthird_party/lzma_sdk/src/C/Ppmd7Enc.c
Patch
From 9b45a44ca1e5403e597a818f28e9a0112c801c4a Mon Sep 17 00:00:00 2001 From: Jon Toohill <[email protected]> Date: Fri, 18 Sep 2026 12:08:47 -0700 Subject: [PATCH] Reland "Roll lzma_sdk to 26.03" This is a reland of commit 86040da08862ce1c3bdffa890fe17556a461e9de The MSan error is fixed in https://chromium-review.googlesource.com/c/chromium/src/+/8430439 (Fix uninitialized read in SevenZipReaderImpl::IsFolderEncrypted). Original change's description: > Roll lzma_sdk to 26.03 > > Bug: 554531101 > Change-Id: I2bbe69a10f299017141e709192c00eec6a6a6964 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8421547 > Reviewed-by: S Ganesh <[email protected]> > Auto-Submit: Jon Toohill <[email protected]> > Commit-Queue: Jon Toohill <[email protected]> > Cr-Commit-Position: refs/heads/main@{#1700371} Bug: 554531101 Change-Id: Iba3574b82f68c809c9911e06473629b66a6a6964 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8428624 Reviewed-by: S Ganesh <[email protected]> Auto-Submit: Jon Toohill <[email protected]> Commit-Queue: Jon Toohill <[email protected]> Cr-Commit-Position: refs/heads/main@{#1701001} --- diff --git a/third_party/lzma_sdk/README.chromium b/third_party/lzma_sdk/README.chromium index c724a30..a74fd81e 100644 --- a/third_party/lzma_sdk/README.chromium +++ b/third_party/lzma_sdk/README.chromium @@ -1,20 +1,20 @@ Name: LZMA SDK Short Name: lzma URL: http://www.7-zip.org/sdk.html -Version: 26.01 -Date: 2026-04-28 +Version: 26.03 +Date: 2026-09-03 Update Mechanism: Manual License: LZMA-SDK-9.22 License File: LICENSE Security Critical: yes Shipped: yes -CPEPrefix: cpe:2.3:a:7-zip:7-zip:26.01:*:*:*:*:*:*:* +CPEPrefix: cpe:2.3:a:7-zip:7-zip:26.03:*:*:*:*:*:*:* Description: -This contains a part of LZMA SDK 26.01. It builds only in single-threaded mode. +This contains a part of LZMA SDK 26.03. It builds only in single-threaded mode. Local Modifications: -The original code can be found at https://www.7-zip.org/a/lzma2601.7z. +The original code can be found at https://www.7-zip.org/a/lzma2603.7z. The 7z binaries are installed via a 3pp CIPD package into bin/ if Windows is specified as a target OS in the .gclient file. There are two subdirectories in diff --git a/third_party/lzma_sdk/crowbar.txt b/third_party/lzma_sdk/crowbar.txt index b48f113..e12b172 100644 --- a/third_party/lzma_sdk/crowbar.txt +++ b/third_party/lzma_sdk/crowbar.txt @@ -5,8 +5,8 @@ https://github.com/ip7z/7zip/releases/latest). 2. Find the download link for the "7zNNNN-src.tar.xz" asset, where "NNNN" is the - version number without a period (e.g., "7z2601-src.tar.xz" for version - 26.01). + version number without a period (e.g., "7z2603-src.tar.xz" for version + 26.03). 3. Create a CL for the file 3pp/7z/3pp.pb that updates the "download_url" field to the link discovered above and the "version" to the version chosen above, @@ -15,7 +15,7 @@ 4. After the 3pp system has generated new binaries from those sources, browse https://chrome-infra-packages.appspot.com/p/infra/3pp/tools/7z/windows-amd64 - to find the version tag for the new binaries; for example, "version:[email protected]". + to find the version tag for the new binaries; for example, "version:[email protected]". 5. Create a new git branch on which to work: git new-branch lzma @@ -25,14 +25,14 @@ 7. From the GitHub release chosen above, download the asset file matching the pattern "lzmaNNNN.7z" where "NNNN" is the version number without a period - (e.g., "lzma2601.7z" for version 26.01). + (e.g., "lzma2603.7z" for version 26.03). 8. Expand the archive into a subdirectory of third_party/lzma_sdk: - ( mkdir third_party/lzma_sdk/lzma2601 && cd third_party/lzma_sdk/lzma2601 \ - && ../bin/host_platform/7za x ~/Downloads/lzma2601.7z ) + ( mkdir third_party/lzma_sdk/lzma2603 && cd third_party/lzma_sdk/lzma2603 \ + && ../bin/host_platform/7za x ~/Downloads/lzma2603.7z ) 9. Convert line endings of the extracted text files: - find third_party/lzma_sdk/lzma2601 -name bin -prune -o -type f \ + find third_party/lzma_sdk/lzma2603 -name bin -prune -o -type f \ ! -name \*.ico -print0 | xargs -0 dos2unix 10. Delete the src/ directory: @@ -43,14 +43,14 @@ 12. Copy Asm/, C/, and DOC/lzma-sdk.txt from the extracted archive into src/. For example: - (cd third_party/lzma_sdk/lzma2601 && tar -cf - Asm DOC/lzma-sdk.txt C) | \ + (cd third_party/lzma_sdk/lzma2603 && tar -cf - Asm DOC/lzma-sdk.txt C) | \ (cd third_party/lzma_sdk/src && tar -xf -) 13. Delete the expanded archive. - rm -fr third_party/lzma_sdk/lzma2601 + rm -fr third_party/lzma_sdk/lzma2603 14. Create a git commit for the upstream files: - git add third_party/lzma_sdk/src && git ci -m "LZMA SDK 26.01" + git add third_party/lzma_sdk/src && git ci -m "LZMA SDK 26.03" 15. Create a new branch for patch application: git co -b patch_chain diff --git a/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch b/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch index 2dae914..b17f0b08 100644 --- a/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch +++ b/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch @@ -1,4 +1,4 @@ -From bd2e8db6a88bc03306d93555e13a4afd807a7008 Mon Sep 17 00:00:00 2001 +From 87e407ce248514b7282fb64068dbbe36a2914666 Mon Sep 17 00:00:00 2001 From: Greg Thompson <[email protected]> Date: Wed, 13 May 2026 14:17:24 +0200 Subject: [PATCH 1/6] Shorten segment names in Asm/x86/LzmaDecOpt.asm to make @@ -33,5 +33,5 @@ end -- -2.54.0.563.g4f69b47b94-goog +2.55.0.1082.g2b9226bbc0-goog diff --git a/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch b/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch index 27ddef49..3910e29 100644 --- a/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch +++ b/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch @@ -1,4 +1,4 @@ -From 1bedb0fcc70b860098ac847846ca4210d48364af Mon Sep 17 00:00:00 2001 +From 5c1a86dd6e763a2aea62161941631cc1c5391b78 Mon Sep 17 00:00:00 2001 From: Greg Thompson <[email protected]> Date: Wed, 13 May 2026 14:18:06 +0200 Subject: [PATCH 2/6] Fix undefined behavior in CpuArch.h flagged by UBSan @@ -9,10 +9,10 @@ 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/third_party/lzma_sdk/src/C/CpuArch.h b/third_party/lzma_sdk/src/C/CpuArch.h -index c682720874b98..e4560ae3fc22c 100644 +index e6698d881e3c3..c814d02cf6e30 100644 --- a/third_party/lzma_sdk/src/C/CpuArch.h +++ b/third_party/lzma_sdk/src/C/CpuArch.h -@@ -421,14 +421,18 @@ MY_CPU_64BIT means that processor can work with 64-bit registers. +@@ -433,14 +433,18 @@ MY_CPU_64BIT means that processor can work with 64-bit registers. #endif @@ -35,5 +35,5 @@ /* === ALIGNMENT on 32-bit arm and LDRD/STRD/LDM/STM instructions. Description of problems: -- -2.54.0.563.g4f69b47b94-goog +2.55.0.1082.g2b9226bbc0-goog diff --git a/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch b/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch index 426f83662..b32c16f 100644 --- a/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch +++ b/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch @@ -1,4 +1,4 @@ -From 5f9da78043867561259e529c6757d426232450b0 Mon Sep 17 00:00:00 2001 +From 36e620cabc2479857d810b4a7832dd97a2316dd1 Mon Sep 17 00:00:00 2001 From: Greg Thompson <[email protected]> Date: Wed, 13 May 2026 14:18:23 +0200 Subject: [PATCH 3/6] Add the ability to suppress CRC hardware acceleration for @@ -51,5 +51,5 @@ /* Call CrcGenerateTable one time before other CRC functions */ void Z7_FASTCALL CrcGenerateTable(void); -- -2.54.0.563.g4f69b47b94-goog +2.55.0.1082.g2b9226bbc0-goog diff --git a/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch b/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch index efb9d4b..4898220 100644 --- a/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch +++ b/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch @@ -1,4 +1,4 @@ -From 2e5a2dc2fd8c6d76f9cdbbefa809ec5a20c1dc5a Mon Sep 17 00:00:00 2001 +From 8697f3b4290df46d6ad2b39aed6b393826d3d26b Mon Sep 17 00:00:00 2001 From: Greg Thompson <[email protected]> Date: Wed, 13 May 2026 14:18:44 +0200 Subject: [PATCH 4/6] Fix compilation when <asm/hwcap.h> is unavailable (on @@ -25,5 +25,5 @@ #ifdef USE_HWCAP -- -2.54.0.563.g4f69b47b94-goog +2.55.0.1082.g2b9226bbc0-goog diff --git a/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch b/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch index 179429f..6d0a37d 100644 --- a/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch +++ b/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch @@ -1,4 +1,4 @@ -From a35b25d245fc0db0c52b6057ce3f02b48a64f5c4 Mon Sep 17 00:00:00 2001 +From fd8346b8856317ee310edba9548c31eb9c2cb80b Mon Sep 17 00:00:00 2001 From: Greg Thompson <[email protected]> Date: Wed, 13 May 2026 14:19:04 +0200 Subject: [PATCH 5/6] Extend the search range for 7z archive signature to @@ -9,7 +9,7 @@ 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c b/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c -index 9b5c1f9117668..c52e838f7f546 100644 +index 344aa735ea018..4ae429845bb8a 100644 --- a/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c +++ b/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c @@ -11,6 +11,10 @@ @@ -33,5 +33,5 @@ static BoolInt FindSignature(CSzFile *stream, UInt64 *resPos) { -- -2.54.0.563.g4f69b47b94-goog +2.55.0.1082.g2b9226bbc0-goog diff --git a/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch b/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch index 75a1e0a..e1bdcd0 100644 --- a/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch +++ b/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch @@ -1,4 +1,4 @@ -From 9e505a36e7769daeda1ca6287d457b67778b9a40 Mon Sep 17 00:00:00 2001 +From 0e1acc2158adf9cfdbbb8918b7cb187af8f519a5 Mon Sep 17 00:00:00 2001 From: Greg Thompson <[email protected]> Date: Wed, 13 May 2026 14:19:22 +0200 Subject: [PATCH 6/6] Remove AVX and SSE41 code in LzFind @@ -30,5 +30,5 @@ #ifdef USE_LZFIND_SATUR_SUB_128 -- -2.54.0.563.g4f69b47b94-goog +2.55.0.1082.g2b9226bbc0-goog diff --git a/third_party/lzma_sdk/src/C/7zArcIn.c b/third_party/lzma_sdk/src/C/7zArcIn.c index 4dc3ba10..f6f6e7c 100644 --- a/third_party/lzma_sdk/src/C/7zArcIn.c +++ b/third_party/lzma_sdk/src/C/7zArcIn.c @@ -11,7 +11,7 @@ #include "CpuArch.h" #define MY_ALLOC(T, p, size, alloc) \ - { if ((p = (T *)ISzAlloc_Alloc(alloc, (size) * sizeof(T))) == NULL) return SZ_ERROR_MEM; } + { if ((p = (T *)ISzAlloc_Alloc(alloc, (size_t)(size) * sizeof(T))) == NULL) return SZ_ERROR_MEM; } #define MY_ALLOC_ZE(T, p, size, alloc) \ { if ((size) == 0) p = NULL; else MY_ALLOC(T, p, size, alloc) } @@ -22,8 +22,6 @@ #define MY_ALLOC_ZE_AND_CPY(to, size, from, alloc) \ { if ((size) == 0) to = NULL; else { MY_ALLOC_AND_CPY(to, size, from, alloc) } } -#define k7zMajorVersion 0 - enum EIdEnum { k7zIdEnd, @@ -52,15 +50,13 @@ k7zIdEncodedHeader, k7zIdStartPos, k7zIdDummy - // k7zNtSecure, - // k7zParent, - // k7zIsReal }; const Byte k7zSignature[k7zSignatureSize] = {'7', 'z', 0xBC, 0xAF, 0x27, 0x1C}; #define SzBitUi32s_INIT(p) { (p)->Defs = NULL; (p)->Vals = NULL; } +Z7_FORCE_INLINE static SRes SzBitUi32s_Alloc(CSzBitUi32s *p, size_t num, ISzAllocPtr alloc) { if (num == 0) @@ -76,6 +72,7 @@ return SZ_OK; } +Z7_FORCE_INLINE static void SzBitUi32s_Free(CSzBitUi32s *p, ISzAllocPtr alloc) { ISzAlloc_Free(alloc, p->Defs); p->Defs = NULL; @@ -84,13 +81,14 @@ #define SzBitUi64s_INIT(p) { (p)->Defs = NULL; (p)->Vals = NULL; } +Z7_FORCE_INLINE static void SzBitUi64s_Free(CSzBitUi64s *p, ISzAllocPtr alloc) { ISzAlloc_Free(alloc, p->Defs); p->Defs = NULL; ISzAlloc_Free(alloc, p->Vals); p->Vals = NULL; } - +Z7_NO_INLINE static void SzAr_Init(CSzAr *p) { p->NumPackStreams = 0; @@ -110,23 +108,22 @@ p->RangeLimit = 0; } +Z7_NO_INLINE static void SzAr_Free(CSzAr *p, ISzAllocPtr alloc) { ISzAlloc_Free(alloc, p->PackPositions); SzBitUi32s_Free(&p->FolderCRCs, alloc); - ISzAlloc_Free(alloc, p->FoCodersOffsets); ISzAlloc_Free(alloc, p->FoStartPackStreamIndex); ISzAlloc_Free(alloc, p->FoToCoderUnpackSizes); ISzAlloc_Free(alloc, p->FoToMainUnpackSizeIndex); ISzAlloc_Free(alloc, p->CoderUnpackSizes); - ISzAlloc_Free(alloc, p->CodersData); SzAr_Init(p); } - +Z7_NO_INLINE void SzArEx_Init(CSzArEx *p) { SzAr_Init(&p->db); @@ -150,6 +147,7 @@ SzBitUi64s_INIT(&p->CTime) } +Z7_NO_INLINE void SzArEx_Free(CSzArEx *p, ISzAllocPtr alloc) { ISzAlloc_Free(alloc, p->UnpackPositions); @@ -172,15 +170,6 @@ } -static int TestSignatureCandidate(const Byte *testBytes) -{ - unsigned i; - for (i = 0; i < k7zSignatureSize; i++) - if (testBytes[i] != k7zSignature[i]) - return 0; - return 1; -} - #define SzData_CLEAR(p) { (p)->Data = NULL; (p)->Size = 0; } #define SZ_READ_BYTE_SD_NOCHECK(_sd_, dest) \ @@ -199,14 +188,9 @@ #define SKIP_DATA(sd, size) { sd->Size -= (size_t)(size); sd->Data += (size_t)(size); } #define SKIP_DATA2(sd, size) { sd.Size -= (size_t)(size); sd.Data += (size_t)(size); } -#define SZ_READ_32(dest) if (sd.Size < 4) return SZ_ERROR_ARCHIVE; \ - dest = GetUi32(sd.Data); SKIP_DATA2(sd, 4); - static Z7_NO_INLINE SRes ReadNumber(CSzData *sd, UInt64 *value) { - Byte firstByte, mask; - unsigned i; - UInt32 v; + unsigned firstByte, mask, i, v; SZ_READ_BYTE(firstByte) if ((firstByte & 0x80) == 0) @@ -223,18 +207,18 @@ SZ_READ_BYTE(mask) *value = v | ((UInt32)mask << 8); mask = 0x20; - for (i = 2; i < 8; i++) + for (i = 2 * 8; i < 8 * 8; i += 8) { - Byte b; + unsigned b; if ((firstByte & mask) == 0) { const UInt64 highPart = (unsigned)firstByte & (unsigned)(mask - 1); - *value |= (highPart << (8 * i)); + *value |= (highPart << i); return SZ_OK; } - SZ_READ_BYTE(b) - *value |= ((UInt64)b << (8 * i)); mask >>= 1; + SZ_READ_BYTE(b) + *value |= ((UInt64)b << i); } return SZ_OK; } @@ -242,7 +226,7 @@ static Z7_NO_INLINE SRes SzReadNumber32(CSzData *sd, UInt32 *value) { ... (file diff truncated)
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page