Re: libclamunrar library

Hi Sebastian,

Sorry for the delayed reply.

You're correct that there isn't much difference. At present we carry two pa=
tches on top of unrar v6.2.12. These are:

commit 2c90318c2da1fd8d16b64ac716ac92c393cf397e
Author: Micah Snyder <[email protected]>
Date:   Fri Sep 28 14:30:42 2018 -0400

    Patch UnRAR: allow skipping files in solid archives

    This is a cherry-pick of commit 24f225c21ffa77dbd4b2a3c0377b9b3f86547ce6

    Modification to unrar codebase allowing skipping of files within
    Solid archives when parsing in extraction mode, enabling us to skip
    encrypted files while still scanning metadata and potentially
    scanning unencrypted files later in the archive.

commit 71a54bd7b27273586f59dec5b17b47fe1d767e89
Author: Micah Snyder <[email protected]>
Date:   Wed Aug 23 10:06:59 2023 -0700

    Patch UnRAR: don't replace symlinks with directories

    UnRAR logic replaces directory symlinks found within archive file entry
    file paths with actual directories by deleting them after they're
    extracted.

    Unfortunately, this logic extends to deleting existing directories if y=
ou
    set the `DestName` instead of the `DestPath` in this API:

      rc =3D RARProcessFile(hArchive, RAR_EXTRACT, NULL, destFilePath);

    In the future UnRAR may change to disable the `LinksToDirs()` feature
    if using the `DestName` parameter. In the meantime, this commit
    completely disables it for our use case.

I don't know if these patches are still needed in the latest UnRAR.  But I =
think it's best if we keep a separate library from the upstream. That will =
let us continue to add our own patches as needed, in case a regression is f=
ound during our integration testing, or to support slightly different behav=
ior (as with the first patch to support scanning encrypted file metadata ev=
en if we can't decrypt the files).

Regards,
Micah


Micah Snyder (they/them)
ClamAV Development
Talos
Cisco Systems, Inc.

________________________________
From: clamav-devel <[email protected]> on behalf of Seb=
astian Andrzej Siewior via clamav-devel <[email protected]>
Sent: Saturday, June 29, 2024 7:20 AM
To: [email protected] <[email protected]>
Cc: Sebastian Andrzej Siewior <[email protected]>
Subject: [Clamav-devel] libclamunrar library

Hi,

I've been looking at the embedded libclamunrar library and it is almost
as shipped by upstream. Would there be a major problem if we could link
against the system library?
Debian wise I would still require the wrapper that we have to make the
usage optional but I would attempt to link against the system library
instead of the embedded which should make my life easier=85

Sebastian
_______________________________________________

clamav-devel mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/cl=
amav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
_______________________________________________

clamav-devel mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/cl=
amav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml