Eliminated an aliased metadata use-after-free in libarchive by Darren CarrerasEliminated an aliased metadata use-after-free in libarchive by Darren Carreras
Eliminated an aliased metadata use-after-free in libarchive
Problem
libarchive's Mac metadata setter released entry-owned storage before copying the replacement. If a caller passed the current getter result, or an interior slice of it, back to the same entry, the copy read from freed memory.
Proof
I built a deterministic Guard Malloc reproduction covering both exact-alias and interior-alias inputs. The failure was local, repeatable, and tied directly to replacement ordering.
Fix
I changed the setter so the source bytes remain valid until the replacement copy is complete. The patch stayed narrowly scoped to the affected ownership path.
Regression safety
I added exact-alias and interior-alias regression cases and ran the full project suite: 1,017 registered checks completed with no failures.
Outcome
The fix merged upstream in libarchive pull request #3318. The complete patch, review discussion, and tests are public.