Potential Vulnerability in Cloned Code

[tabudz]

Summary

Our tool detected a potential vulnerability in unrar/unrar/recvol5.cpp which was cloned from aawc/unrar but did not receive the security patch applied. The original issue was reported and fixed under https://nvd.nist.gov/vuln/detail/cve-2017-20006.

Proposed Fix

Apply the same patch as the one in aawc/unrar to eliminate the vulnerability.

Reference

https://nvd.nist.gov/vuln/detail/cve-2017-20006
aawc/unrar@0ff832d

[kanryu]

Thank you for reporting the security vulnerability. :)
Although this project is now closed, we will make an exception for this issue.
However, we will use unrar's official meticulous implementation instead of the automatic fix you created.

[kanryu]

I made it! :)