1. Security related fixes:
a) fixed a crash in unrar.dll library caused by excessive function
recursion;
b) additional output filtering in console RAR to prevent abusing
special characters in file names or archive comment to hide
information from users;
c) to prevent performance degradation and excessive memory use,
extraction command doesn't restore missing volumes using REV files
if total number of volumes exceeds 4096 or number of missing
volumes exceeds 1024.
Click on REV file in WinRAR or use the command line mode "RC"
command to avoid this limit;
d) hard link extraction is blocked by default if hard link target
includes symlinks. It prevents linking to a file in symlinked folder
and potentially overwriting such file.
By default WinRAR doesn't create symlinks pointing outside of
destination folder. So overwriting a file outside of destination
folder was possible only if such symlink had been created
in the destination folder by another tool before starting extraction;
e) existing symlinks are removed before overwriting to prevent
utilizing link chains to create a file outside of destination path.
Such link chains allowed to create a file outside of destination path
in RAR versions for Unix, but not in WinRAR;
f) Mark of the Web data wasn't set for extracted symbolic or hard links
unless a link target matched one of extensions specified
in "Propagate mark of the Web" option. If this option was set to
"For all files", both link itself and its target properly received
Mark of the Web.
We are thankful to Mohammad Ebrahim, Wolvsec @ University of Michigan,
for reporting items a) - d), to Landon Peng (Lunbun LLC) working with
TrendAI Zero Day Initiative, also as to Tong Liu (Lyutoon), for reporting
item e) independently and to Muhammad Awais for reporting item f).
2. New -lim switch sets the approximate limit to disk write,
memory usage and run time for RAR and WinRAR in the command line mode.
Processing is aborted with exit code 15 if this limit is exceeded.
3. Data initialization takes less time when recovering a large number
of missing RAR volumes using REV volumes.
4. If both -cp and -rr switches are specified in the same command,
WinRAR prefers value from -rr switch. Previously it used the recovery
record size stored in the profile.
Download snel uw 40 dagen gratis probeerversie van RAR of WinRAR!
Download de testversie Disclaimer