Repository navigation
Arcana v1.0.6
This release fixes the problems found while writing the format documentation (doc/formats), with a regression test for each fix.
Security and integrity
- ZIP: the WinZip AES authentication code is now checked, so modified encrypted data is reported instead of extracted
- 7z: AES key derivation limited to 2^24 rounds (as 7-Zip): a crafted archive can no longer make Arcana hash for hours
- ISO 9660: crafted images (directory loops, huge lengths, bad Rock Ridge entries) give a clean error instead of a crash
- .Z and SZDD: extraction can no longer overwrite the archive itself
Fixes
- ZIP: passwords with accented characters now work with 7-Zip and other tools (note: AES archives created by earlier Arcana versions with such a password must be opened with the old version)
- ZIP: creation with a password no longer loads files in memory and supports ZIP64 (files over 4 GB, more than 65535 entries)
- RAR: a wrong password on an archive with encrypted headers is reported; listing works with encrypted headers; RAR 4 empty files are extracted
- Zstandard: .tar.zst files made with "tar --zstd" or through a pipe are read; several frames and skippable frames; detection by content
- Unix compress (.Z): files with CLEAR codes (compress -b 10 to -b 16) decode correctly
- CAB: cabinets created by Arcana are accepted by 7-Zip
- WIM: rare LZX uncompressed blocks decoded correctly
- Self-extracting executables: a ZIP stored inside the image is found
- ISO 9660: deep Rock Ridge directories (rr_moved) are put back in place
Tests and documentation
- 36 new regression samples (137 in total with the corpus), generators in test/tools/samples
- Technical documentation of every format in doc/formats, with the list of remaining known issues