bzip2, branch master

bzip2recover: Use snprintf to build the output file name

2026-06-30T09:48:14+00:00

The per-block output file name is built in outFileName[BZ_MAX_FILENAME] with sprintf(split, "rec%5d", wrBlock+1). split is an interior pointer into outFileName, past any leading directory component of the input file name, so the bytes written here come right after attacker-influenced path data. The write is currently safe only by way of two non-local invariants: the input file name is rejected up front once strlen(argv[1]) reaches BZ_MAX_FILENAME-20, and the number of blocks is limited by BZ_MAX_HANDLED_BLOCKS so the formatted value stays at five digits. The comment on BZ_MAX_HANDLED_BLOCKS explicitly invites raising it, which would silently eat into that 20 byte margin. Bound the write with snprintf() using the space left after the directory prefix (BZ_MAX_FILENAME - ofs) so it can no longer overrun outFileName regardless of those invariants. This also removes the deprecated sprintf(), which recent compilers flag under -Wdeprecated-declarations. For valid input the result is unchanged: the "rec%5d" prefix always fits, so snprintf() writes exactly the same bytes. https://sourceware.org/bugzilla/show_bug.cgi?id=29280

bzip2recover: Check argc >= 1 && argv[0] != NULL

2026-06-21T22:37:44+00:00

main() initialises progName by copying argv[0] with strncpy before argc is examined. When the program is started with an empty argument vector (argc == 0 and argv[0] == NULL), for example through execve(path, (char*[]){ NULL }, envp), this dereferences a NULL pointer and bzip2recover crashes with SIGSEGV before any argument checking happens. Guard the use of argv[0] and fall back to a hard coded "bzip2recover" string, mirroring the fix already applied to bzip2.c in commit af79253677ad ("bzip2.c: Check argc >= 1 && argv[0] != NULL").

bzip2recover: bsClose bsWr on early EOF

2026-06-11T21:19:53+00:00

When getting an early EOF bsWr is never closed so any buffered output is leaked and never flushed out to the file.

bzip2recover: bsClose bsIn before exit

2026-06-11T21:16:46+00:00

This makes sure to cleanup all the memory used and opened file descriptors. With this fix valgrind shows no more "leaked" file descriptors or memory when run with --leak-check=full --show-leak-kinds=all --track-fds=yes on a valid bzip2 file.

bzip2recover: Fix getc EOF errno handling

2026-06-11T21:11:29+00:00

Posix getc requires setting errno on read error. But it isn't required to clear errno when reporting EOF. So explicitly set errno to zero before calling getc to make sure we see the difference between a read error and a regular EOF.

bzip2recover: Add one more wraparound sanity check

2026-06-11T21:09:45+00:00

Make sure the end of the current block is actually larger than the start of the current block. Then check the difference is big enough. This prevents a possible unsigned underflow.

bzip2recover: Use standard %llu format specifier

2026-06-11T20:00:23+00:00

Update the format specifier for unsigned long long in bzip2recover.c to use the standard %llu instead of %Lu. Modern compilers (such as Clang) emit a format warning when using the non-standard %Lu modifier. Fixes: bzip2recover.c:376:59: warning: length modifier 'L' results in undefined behavior or no effect with 'u' conversion specifier [-Wformat] 376 | fprintf ( stderr, " block %d runs from " MaybeUInt64_FMT | ^~~~~~~~~~~~~~~ bzip2recover.c:40:29: note: expanded from macro 'MaybeUInt64_FMT' 40 | # define MaybeUInt64_FMT "%Lu" | ~^~ bzip2recover.c:376:59: note: did you mean to use 'll'? Signed-off-by: Josef Schlehofer

bzip2recover: Make sure to not process more than BZ_MAX_HANDLED_BLOCKS

2026-05-28T14:53:21+00:00

There is an off-by-one in the check before calling tooManyBlocks. This causes the scanning loop to run one more time and cause a possible read or write one past the global bStart, bEnd, rbStart and rbEnd buffers. There are no known exploits of this issue and you will need to compile with something like gcc -fsanitize=address (ASAN AddressSanitizer) to observe the faulty read/write. This has been assigned CVE-2026-42250.

bzip2.c: Check argc >= 1 && argv[0] != NULL

2025-06-19T19:07:31+00:00

This should never happen, but if there is no, or a NULL argv[0] then use a hard coded string "bzip2" when calling copyFileName to define progNameReally. https://sourceware.org/bugzilla/show_bug.cgi?id=33046

bzlib.h: Move #includes outside extern "C" {...}

2025-06-15T12:51:05+00:00

This helps C++ compilers that come with their own standard library headers that don't expect to be included inside of extern "C" {...}. https://sourceware.org/bugzilla/show_bug.cgi?id=32812