Skip to content

7z: Add native Deflate64 (type 10) support using infback9 - #6058

Open
TrinityBerserker wants to merge 3 commits into
openwall:bleeding-jumbofrom
TrinityBerserker:feat/7z-native-deflate64-6056
Open

TrinityBerserker wants to merge 3 commits into
openwall:bleeding-jumbofrom
TrinityBerserker:feat/7z-native-deflate64-6056

Conversation

@TrinityBerserker

Copy link
Copy Markdown

This PR adds native Deflate64 (type 10) decompression support to the 7z format using the infback9 implementation from zlib. As discussed in #6056, this allows John to verify the CRC32 of Deflate64-compressed archives, eliminating the need for padding attacks and their associated false positives.

Changes:

  • Integrated infback9.c, infback9.h, inftree9.c, inftree9.h, inffix9.h, and inflate9.h into the JtR source tree.
  • Added back9_alloc/back9_free memory allocators and back9_in/back9_out callbacks.
  • Modified src/7z_common_plug.c to accept c_type == 10 and use inflateBack9 for decompression.
  • Added sanity checks on crc_len and packed_size to prevent DoS from malicious hashes.

Testing:

  • Created a password-protected .7z archive with Deflate64 (7z a -t7z -m0=Deflate64 -p"secret123").
  • Verified that John correctly cracks the password using the new decompression path.

Fixes #6056

@solardiz

solardiz commented Nov 6, 2026

Copy link
Copy Markdown
Member

28 failing checks, 3 successful (only gcc 16)

@TrinityBerserker

Copy link
Copy Markdown
Author

Thanks for checking the CI, @solardiz. The previous failures were due to the new objects (infback9.o, inftree9.o, infback9_shim.o) not being added to the Makefile.in and Makefile.legacy templates, which caused the build to fail in the CI's clean environments.

I've just pushed the fixes for the build system, along with the required zlib headers (zlib.h, zconf.h, zutil.h, gzguts.h). The build passes locally now.

Whenever you have a moment, could you approve the CI workflow so we can verify it against the test matrix? Thanks!

@solardiz

solardiz commented Nov 7, 2026

Copy link
Copy Markdown
Member

CI is happy. Now we need to hear from @magnumripper and we need to process all the rest of open PRs as well... which I have been failing at lately.

Also, I wonder if we could possibly want to move the added files to a subdirectory rather than having them right in src. Let's wait to hear from @magnumripper on this.

@TrinityBerserker

Copy link
Copy Markdown
Author

Thanks for checking the CI, @solardiz! I'm glad it's passing.

Regarding the file organization: I completely agree. Having those files in the root of src/ can get messy. If @magnumripper agrees, I can create a subdirectory (e.g., src/infback9/), move the zlib and infback9 files there, and update the Makefile.in and #include paths. Just let me know what you both decide and I'll implement it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7z: Add native decompression support for Deflate64 (type 10) in C core

2 participants