Add feature to support compressed archives #31
Conversation
cgzones
force-pushed
the
archives
branch
3 times, most recently
from
a148b33 to
854f60b
Compare
| @@ -427,6 +442,48 @@ fn parse_bytes(bytes: &[u8], file: &Path) -> Result<Vec<Binary>, ParseError> { | |||
| #[cfg(not(feature = "macho"))] | |||
| Object::Mach(_) => Err(ParseError::Unimplemented("MachO")), | |||
| Object::Archive(archive) => Ok(parse_archive(&archive, file, bytes)), | |||
There was a problem hiding this comment.
Object::Archive should be under new feature as well.
There was a problem hiding this comment.
Should it though?
The reason for guarding the archive extraction code under a new and by default disabled feature is the underlying usage of the C written library libarchive. This has two consequences: The shared library needs to be installed at runtime (also at compile time, buts that's irrelevant for users) and the code might contain memory corruption bugs (potentially resulting in code execution) due to being written in C. libarchive is fuzzed by OSS-Fuzz, which limits the risks a bit though.
The unix archive code from goblin is written in pure Rust and thus does not have these disadvantages and does not introduce new dependencies.
So I would argue the unix archive support should be always enabled, independent from whether compressed archive support is enabled.
| @@ -65,6 +66,7 @@ name = "checksec" | |||
| path = "src/main.rs" | |||
|
|
|||
| [features] | |||
| archives = ["compress-tools"] | |||
There was a problem hiding this comment.
would prefer non-plural "archive" for feature instead.
Add a new feature "archives" to support scanning (compresses) archives.
Extracting archives is done via the create compress-tools, which uses
the C library libarchive. Thus in order to build and run checksec
installing libarchive is required.
$ checksec -f /var/cache/apt/archives/xterm_376-1_amd64.deb
ELF64: | Canary: true CFI: false SafeStack: false Fortify: Partial Fortified: 3 Fortifiable: 1 NX: true PIE: Full Relro: Full RPATH: None RUNPATH: None | File: /var/cache/apt/archives/xterm_376-1_amd64.deb➔data.tar.xz➔./usr/bin/resize
ELF64: | Canary: true CFI: false SafeStack: false Fortify: Partial Fortified: 8 Fortifiable: 11 NX: true PIE: Full Relro: Full RPATH: None RUNPATH: None | File: /var/cache/apt/archives/xterm_376-1_amd64.deb➔data.tar.xz➔./usr/bin/xterm
Add a new feature "archives" to support scanning (compresses) archives. Extracting archives is done via the create compress-tools, which uses the C library libarchive. Thus in order to build and run checksec installing libarchive is required.