XADMaster icon indicating copy to clipboard operation
XADMaster copied to clipboard

Only check RAR5 signature elsewhere on executables

Open aonez opened this issue 3 months ago • 0 comments

Previously the RAR5 signature was checked in all the available "header" bytes. This is prone to issues for example if a TAR contains some RAR5 files giving false detections and incomplete or failed extractions.

To fix this I'm just adding an executable signature check (MZ) before using all length or RAR5MaximumSFXHeader to check for the RAR5 signature.

I'm attaching some example files:

  • rar-v4.tar: contains a RAR4 file. Is detected as TAR and extracts the bare .rar file.
  • rar-v5.tar: contains a RAR5 file. Is detected as RAR5 and extracts the contents of the RAR inside the TAR.
  • parted-rar-v5.tar: contains a three parts RAR5 volume. Is detected as RAR5 and fails as tries to extract the first part found.

Did not tried but I'm assuming if the TAR file contains more files a part from the RAR5, and this one is detected, the other files will be dismissed.

Examples.zip

aonez avatar Jun 02 '24 09:06 aonez