Skip to content

resource-safety: RAR decompression-ratio guard bypassed via junk files #523

Description

@forkwright

Finding

volume_set_size() (line 145) — the 'compressed size' denominator for the RAR decompression-ratio guard — sums the on-disk size of every file in the archive's directory whose extension matches .rar/.rNN with no magic-byte or volume-membership check, so an attacker padding the torrent dir with an unrelated large junk-extension file inflates the denominator and lets a real decompression bomb pass the max_decompression_ratio gate.

Evidence

crates/ergasia/src/extract/rar.rs:145. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).

Why this matters

Padding a torrent directory with junk-extension files inflates the compressed-size denominator, letting a genuine decompression bomb sail past the guard meant to stop it — a resource-exhaustion/disk-fill vector.

Desired correction

Derive the compressed denominator from the actual volume set unrar reports for this archive (open_for_listing volume membership) rather than a directory-wide extension glob; at minimum magic-byte-verify each file and correlate it to the archive's volume chain.

Done when: the defect's failure mode no longer reproduces and a regression test covers it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions