3 ms·
If libarchive is also backdoored, would that allow specifically crafted http gzip encoded responses to do bad things?
by buildbot 3y ago
If libarchive is also backdoored, would that allow specifically crafted http gzip encoded responses to do bad things?
- nicolas_17 3y agoWhat software is using libarchive to decode HTTP responses?
- buildbot 3y agoI don't know, way outside my domain. Possibly none I guess?
- giantrobot 3y agoFreeBSD's archive tools are built on top of libarchive IIRC. Not sure about the other BSDs.
- mattbee 3y agoWell for one, the Powershell script I just wrote to build all the 3rd-party library dependencies for a video game. tar.exe was added to Windows this January, sourced from libarchive: https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows https://learn.microsoft.com/en-us/virtualization/community/t... Unlike the GNU tar I'm used to, it's actually a "full fat" command line archiving tool, compressing & decompressing zip, xz, bz2 on the command-line - really handy :-O
- duskwuff 3y agoNo. There's no good reason HTTP response decoding would ever be implemented in terms of libarchive; using libz directly is simpler and supports some use cases (like streaming reads) which libarchive doesn't.