Eliminated an aliased metadata use-after-free in libarchive by Darren CarrerasEliminated an aliased metadata use-after-free in libarchive by Darren Carreras

Eliminated an aliased metadata use-after-free in libarchive

Darren Carreras

Darren Carreras

Problem libarchive's Mac metadata setter released entry-owned storage before copying the replacement. If a caller passed the current getter result, or an interior slice of it, back to the same entry, the copy read from freed memory.
Proof I built a deterministic Guard Malloc reproduction covering both exact-alias and interior-alias inputs. The failure was local, repeatable, and tied directly to replacement ordering.
Fix I changed the setter so the source bytes remain valid until the replacement copy is complete. The patch stayed narrowly scoped to the affected ownership path.
Regression safety I added exact-alias and interior-alias regression cases and ran the full project suite: 1,017 registered checks completed with no failures.
Outcome The fix merged upstream in libarchive pull request #3318. The complete patch, review discussion, and tests are public.
Like this project

Posted Aug 12, 2026

Merged an upstream memory-safety fix with a deterministic proof, exact and interior alias regressions, and 1,017 passing checks.