High chrome Uninitialized Memory 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse of uninitialized variable in ThirdParty lmza_sdk
DescriptionUse of uninitialized variable in ThirdParty lmza_sdk
ComponentThirdParty lmza_sdk
Bug ClassUninitialized Memory
Tracker554531101
Fix commit9b45a44ca1e5 (chromium/src) +915/-512
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-13

Files Changed

  • third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c
  • third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch
  • third_party/lzma_sdk/src/C/LzmaEnc.c
  • third_party/lzma_sdk/src/C/MtDec.c
  • third_party/lzma_sdk/src/C/LzmaDec.c
  • third_party/lzma_sdk/src/C/7zDec.c
  • third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch
  • third_party/lzma_sdk/crowbar.txt
  • third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch
  • DEPS
  • third_party/lzma_sdk/src/C/7zVersion.h
  • third_party/lzma_sdk/src/C/Util/7z/7zMain.c
  • third_party/lzma_sdk/README.chromium
  • third_party/lzma_sdk/src/C/DllSecur.c
  • third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch
  • third_party/lzma_sdk/src/C/XzDec.c
  • third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch
  • third_party/lzma_sdk/src/C/Compiler.h
  • third_party/lzma_sdk/src/C/7zTypes.h
  • third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch
  • third_party/lzma_sdk/src/C/Lzma2Enc.c
  • third_party/lzma_sdk/src/C/7zArcIn.c
  • third_party/lzma_sdk/src/C/CpuArch.h
  • third_party/lzma_sdk/src/DOC/lzma-sdk.txt
  • third_party/lzma_sdk/src/C/Bcj2Enc.c
  • third_party/lzma_sdk/src/C/Ppmd7Enc.c
From 9b45a44ca1e5403e597a818f28e9a0112c801c4a Mon Sep 17 00:00:00 2001
From: Jon Toohill <jtoohill@google.com>
Date: Fri, 18 Sep 2026 12:08:47 -0700
Subject: [PATCH] Reland "Roll lzma_sdk to 26.03"

This is a reland of commit 86040da08862ce1c3bdffa890fe17556a461e9de

The MSan error is fixed in https://chromium-review.googlesource.com/c/chromium/src/+/8430439 (Fix uninitialized read in SevenZipReaderImpl::IsFolderEncrypted).

Original change's description:
> Roll lzma_sdk to 26.03
>
> Bug: 554531101
> Change-Id: I2bbe69a10f299017141e709192c00eec6a6a6964
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8421547
> Reviewed-by: S Ganesh <ganesh@chromium.org>
> Auto-Submit: Jon Toohill <jtoohill@google.com>
> Commit-Queue: Jon Toohill <jtoohill@google.com>
> Cr-Commit-Position: refs/heads/main@{#1700371}

Bug: 554531101
Change-Id: Iba3574b82f68c809c9911e06473629b66a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8428624
Reviewed-by: S Ganesh <ganesh@chromium.org>
Auto-Submit: Jon Toohill <jtoohill@google.com>
Commit-Queue: Jon Toohill <jtoohill@google.com>
Cr-Commit-Position: refs/heads/main@{#1701001}
---
diff --git a/third_party/lzma_sdk/README.chromium b/third_party/lzma_sdk/README.chromium
index c724a30..a74fd81e 100644
--- a/third_party/lzma_sdk/README.chromium
+++ b/third_party/lzma_sdk/README.chromium
@@ -1,20 +1,20 @@
 Name: LZMA SDK
 Short Name: lzma
 URL: http://www.7-zip.org/sdk.html
-Version: 26.01
-Date: 2026-04-28
+Version: 26.03
+Date: 2026-09-03
 Update Mechanism: Manual
 License: LZMA-SDK-9.22
 License File: LICENSE
 Security Critical: yes
 Shipped: yes
-CPEPrefix: cpe:2.3:a:7-zip:7-zip:26.01:*:*:*:*:*:*:*
+CPEPrefix: cpe:2.3:a:7-zip:7-zip:26.03:*:*:*:*:*:*:*
 
 Description:
-This contains a part of LZMA SDK 26.01. It builds only in single-threaded mode.
+This contains a part of LZMA SDK 26.03. It builds only in single-threaded mode.
 
 Local Modifications:
-The original code can be found at https://www.7-zip.org/a/lzma2601.7z.
+The original code can be found at https://www.7-zip.org/a/lzma2603.7z.
 
 The 7z binaries are installed via a 3pp CIPD package into bin/ if Windows is
 specified as a target OS in the .gclient file. There are two subdirectories in
diff --git a/third_party/lzma_sdk/crowbar.txt b/third_party/lzma_sdk/crowbar.txt
index b48f113..e12b172 100644
--- a/third_party/lzma_sdk/crowbar.txt
+++ b/third_party/lzma_sdk/crowbar.txt
@@ -5,8 +5,8 @@
    https://github.com/ip7z/7zip/releases/latest).
 
 2. Find the download link for the "7zNNNN-src.tar.xz" asset, where "NNNN" is the
-   version number without a period (e.g., "7z2601-src.tar.xz" for version
-   26.01).
+   version number without a period (e.g., "7z2603-src.tar.xz" for version
+   26.03).
 
 3. Create a CL for the file 3pp/7z/3pp.pb that updates the "download_url" field
    to the link discovered above and the "version" to the version chosen above,
@@ -15,7 +15,7 @@
 
 4. After the 3pp system has generated new binaries from those sources, browse
    https://chrome-infra-packages.appspot.com/p/infra/3pp/tools/7z/windows-amd64
-   to find the version tag for the new binaries; for example, "version:3@26.01".
+   to find the version tag for the new binaries; for example, "version:3@26.03".
 
 5. Create a new git branch on which to work:
    git new-branch lzma
@@ -25,14 +25,14 @@
 
 7. From the GitHub release chosen above, download the asset file matching the
    pattern "lzmaNNNN.7z" where "NNNN" is the version number without a period
-   (e.g., "lzma2601.7z" for version 26.01).
+   (e.g., "lzma2603.7z" for version 26.03).
 
 8. Expand the archive into a subdirectory of third_party/lzma_sdk:
-   ( mkdir third_party/lzma_sdk/lzma2601 && cd third_party/lzma_sdk/lzma2601 \
-       && ../bin/host_platform/7za x ~/Downloads/lzma2601.7z )
+   ( mkdir third_party/lzma_sdk/lzma2603 && cd third_party/lzma_sdk/lzma2603 \
+       && ../bin/host_platform/7za x ~/Downloads/lzma2603.7z )
 
 9. Convert line endings of the extracted text files:
-   find third_party/lzma_sdk/lzma2601 -name bin -prune -o -type f \
+   find third_party/lzma_sdk/lzma2603 -name bin -prune -o -type f \
        ! -name \*.ico -print0 | xargs -0 dos2unix
 
 10. Delete the src/ directory:
@@ -43,14 +43,14 @@
 
 12. Copy Asm/, C/, and DOC/lzma-sdk.txt from the extracted archive into src/.
     For example:
-    (cd third_party/lzma_sdk/lzma2601 && tar -cf - Asm DOC/lzma-sdk.txt C) | \
+    (cd third_party/lzma_sdk/lzma2603 && tar -cf - Asm DOC/lzma-sdk.txt C) | \
         (cd third_party/lzma_sdk/src && tar -xf -)
 
 13. Delete the expanded archive.
-    rm -fr third_party/lzma_sdk/lzma2601
+    rm -fr third_party/lzma_sdk/lzma2603
 
 14. Create a git commit for the upstream files:
-    git add third_party/lzma_sdk/src && git ci -m "LZMA SDK 26.01"
+    git add third_party/lzma_sdk/src && git ci -m "LZMA SDK 26.03"
 
 15. Create a new branch for patch application:
     git co -b patch_chain
diff --git a/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch b/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch
index 2dae914..b17f0b08 100644
--- a/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch
+++ b/third_party/lzma_sdk/patches/0001-Shorten-segment-names-in-Asm-x86-LzmaDecOpt.asm-to-m.patch
@@ -1,4 +1,4 @@
-From bd2e8db6a88bc03306d93555e13a4afd807a7008 Mon Sep 17 00:00:00 2001
+From 87e407ce248514b7282fb64068dbbe36a2914666 Mon Sep 17 00:00:00 2001
 From: Greg Thompson <grt@chromium.org>
 Date: Wed, 13 May 2026 14:17:24 +0200
 Subject: [PATCH 1/6] Shorten segment names in Asm/x86/LzmaDecOpt.asm to make
@@ -33,5 +33,5 @@
  
  end
 -- 
-2.54.0.563.g4f69b47b94-goog
+2.55.0.1082.g2b9226bbc0-goog
 
diff --git a/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch b/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch
index 27ddef49..3910e29 100644
--- a/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch
+++ b/third_party/lzma_sdk/patches/0002-Fix-undefined-behavior-in-CpuArch.h-flagged-by-UBSan.patch
@@ -1,4 +1,4 @@
-From 1bedb0fcc70b860098ac847846ca4210d48364af Mon Sep 17 00:00:00 2001
+From 5c1a86dd6e763a2aea62161941631cc1c5391b78 Mon Sep 17 00:00:00 2001
 From: Greg Thompson <grt@chromium.org>
 Date: Wed, 13 May 2026 14:18:06 +0200
 Subject: [PATCH 2/6] Fix undefined behavior in CpuArch.h flagged by UBSan
@@ -9,10 +9,10 @@
  1 file changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/third_party/lzma_sdk/src/C/CpuArch.h b/third_party/lzma_sdk/src/C/CpuArch.h
-index c682720874b98..e4560ae3fc22c 100644
+index e6698d881e3c3..c814d02cf6e30 100644
 --- a/third_party/lzma_sdk/src/C/CpuArch.h
 +++ b/third_party/lzma_sdk/src/C/CpuArch.h
-@@ -421,14 +421,18 @@ MY_CPU_64BIT means that processor can work with 64-bit registers.
+@@ -433,14 +433,18 @@ MY_CPU_64BIT means that processor can work with 64-bit registers.
  #endif
  
  
@@ -35,5 +35,5 @@
  /* === ALIGNMENT on 32-bit arm and LDRD/STRD/LDM/STM instructions.
    Description of problems:
 -- 
-2.54.0.563.g4f69b47b94-goog
+2.55.0.1082.g2b9226bbc0-goog
 
diff --git a/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch b/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch
index 426f83662..b32c16f 100644
--- a/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch
+++ b/third_party/lzma_sdk/patches/0003-Add-the-ability-to-suppress-CRC-hardware-acceleratio.patch
@@ -1,4 +1,4 @@
-From 5f9da78043867561259e529c6757d426232450b0 Mon Sep 17 00:00:00 2001
+From 36e620cabc2479857d810b4a7832dd97a2316dd1 Mon Sep 17 00:00:00 2001
 From: Greg Thompson <grt@chromium.org>
 Date: Wed, 13 May 2026 14:18:23 +0200
 Subject: [PATCH 3/6] Add the ability to suppress CRC hardware acceleration for
@@ -51,5 +51,5 @@
  /* Call CrcGenerateTable one time before other CRC functions */
  void Z7_FASTCALL CrcGenerateTable(void);
 -- 
-2.54.0.563.g4f69b47b94-goog
+2.55.0.1082.g2b9226bbc0-goog
 
diff --git a/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch b/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch
index efb9d4b..4898220 100644
--- a/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch
+++ b/third_party/lzma_sdk/patches/0004-Fix-compilation-when-asm-hwcap.h-is-unavailable-on-F.patch
@@ -1,4 +1,4 @@
-From 2e5a2dc2fd8c6d76f9cdbbefa809ec5a20c1dc5a Mon Sep 17 00:00:00 2001
+From 8697f3b4290df46d6ad2b39aed6b393826d3d26b Mon Sep 17 00:00:00 2001
 From: Greg Thompson <grt@chromium.org>
 Date: Wed, 13 May 2026 14:18:44 +0200
 Subject: [PATCH 4/6] Fix compilation when <asm/hwcap.h> is unavailable (on
@@ -25,5 +25,5 @@
  #ifdef USE_HWCAP
  
 -- 
-2.54.0.563.g4f69b47b94-goog
+2.55.0.1082.g2b9226bbc0-goog
 
diff --git a/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch b/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch
index 179429f..6d0a37d 100644
--- a/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch
+++ b/third_party/lzma_sdk/patches/0005-Extend-the-search-range-for-7z-archive-signature-to-.patch
@@ -1,4 +1,4 @@
-From a35b25d245fc0db0c52b6057ce3f02b48a64f5c4 Mon Sep 17 00:00:00 2001
+From fd8346b8856317ee310edba9548c31eb9c2cb80b Mon Sep 17 00:00:00 2001
 From: Greg Thompson <grt@chromium.org>
 Date: Wed, 13 May 2026 14:19:04 +0200
 Subject: [PATCH 5/6] Extend the search range for 7z archive signature to
@@ -9,7 +9,7 @@
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c b/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c
-index 9b5c1f9117668..c52e838f7f546 100644
+index 344aa735ea018..4ae429845bb8a 100644
 --- a/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c
 +++ b/third_party/lzma_sdk/src/C/Util/SfxSetup/SfxSetup.c
 @@ -11,6 +11,10 @@
@@ -33,5 +33,5 @@
  static BoolInt FindSignature(CSzFile *stream, UInt64 *resPos)
  {
 -- 
-2.54.0.563.g4f69b47b94-goog
+2.55.0.1082.g2b9226bbc0-goog
 
diff --git a/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch b/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch
index 75a1e0a..e1bdcd0 100644
--- a/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch
+++ b/third_party/lzma_sdk/patches/0006-Remove-AVX-and-SSE41-code-in-LzFind.patch
@@ -1,4 +1,4 @@
-From 9e505a36e7769daeda1ca6287d457b67778b9a40 Mon Sep 17 00:00:00 2001
+From 0e1acc2158adf9cfdbbb8918b7cb187af8f519a5 Mon Sep 17 00:00:00 2001
 From: Greg Thompson <grt@chromium.org>
 Date: Wed, 13 May 2026 14:19:22 +0200
 Subject: [PATCH 6/6] Remove AVX and SSE41 code in LzFind
@@ -30,5 +30,5 @@
  #ifdef USE_LZFIND_SATUR_SUB_128
  
 -- 
-2.54.0.563.g4f69b47b94-goog
+2.55.0.1082.g2b9226bbc0-goog
 
diff --git a/third_party/lzma_sdk/src/C/7zArcIn.c b/third_party/lzma_sdk/src/C/7zArcIn.c
index 4dc3ba10..f6f6e7c 100644
--- a/third_party/lzma_sdk/src/C/7zArcIn.c
+++ b/third_party/lzma_sdk/src/C/7zArcIn.c
@@ -11,7 +11,7 @@
 #include "CpuArch.h"
 
 #define MY_ALLOC(T, p, size, alloc) \
-  { if ((p = (T *)ISzAlloc_Alloc(alloc, (size) * sizeof(T))) == NULL) return SZ_ERROR_MEM; }
+  { if ((p = (T *)ISzAlloc_Alloc(alloc, (size_t)(size) * sizeof(T))) == NULL) return SZ_ERROR_MEM; }
 
 #define MY_ALLOC_ZE(T, p, size, alloc) \
   { if ((size) == 0) p = NULL; else MY_ALLOC(T, p, size, alloc) }
@@ -22,8 +22,6 @@
 #define MY_ALLOC_ZE_AND_CPY(to, size, from, alloc) \
   { if ((size) == 0) to = NULL; else { MY_ALLOC_AND_CPY(to, size, from, alloc) } }
 
-#define k7zMajorVersion 0
-
 enum EIdEnum
 {
   k7zIdEnd,
@@ -52,15 +50,13 @@
   k7zIdEncodedHeader,
   k7zIdStartPos,
   k7zIdDummy
-  // k7zNtSecure,
-  // k7zParent,
-  // k7zIsReal
 };
 
 const Byte k7zSignature[k7zSignatureSize] = {'7', 'z', 0xBC, 0xAF, 0x27, 0x1C};
 
 #define SzBitUi32s_INIT(p) { (p)->Defs = NULL; (p)->Vals = NULL; }
 
+Z7_FORCE_INLINE
 static SRes SzBitUi32s_Alloc(CSzBitUi32s *p, size_t num, ISzAllocPtr alloc)
 {
   if (num == 0)
@@ -76,6 +72,7 @@
   return SZ_OK;
 }
 
+Z7_FORCE_INLINE
 static void SzBitUi32s_Free(CSzBitUi32s *p, ISzAllocPtr alloc)
 {
   ISzAlloc_Free(alloc, p->Defs); p->Defs = NULL;
@@ -84,13 +81,14 @@
 
 #define SzBitUi64s_INIT(p) { (p)->Defs = NULL; (p)->Vals = NULL; }
 
+Z7_FORCE_INLINE
 static void SzBitUi64s_Free(CSzBitUi64s *p, ISzAllocPtr alloc)
 {
   ISzAlloc_Free(alloc, p->Defs); p->Defs = NULL;
   ISzAlloc_Free(alloc, p->Vals); p->Vals = NULL;
 }
 
-
+Z7_NO_INLINE
 static void SzAr_Init(CSzAr *p)
 {
   p->NumPackStreams = 0;
@@ -110,23 +108,22 @@
   p->RangeLimit = 0;
 }
 
+Z7_NO_INLINE
 static void SzAr_Free(CSzAr *p, ISzAllocPtr alloc)
 {
   ISzAlloc_Free(alloc, p->PackPositions);
   SzBitUi32s_Free(&p->FolderCRCs, alloc);
- 
   ISzAlloc_Free(alloc, p->FoCodersOffsets);
   ISzAlloc_Free(alloc, p->FoStartPackStreamIndex);
   ISzAlloc_Free(alloc, p->FoToCoderUnpackSizes);
   ISzAlloc_Free(alloc, p->FoToMainUnpackSizeIndex);
   ISzAlloc_Free(alloc, p->CoderUnpackSizes);
-  
   ISzAlloc_Free(alloc, p->CodersData);
 
   SzAr_Init(p);
 }
 
-
+Z7_NO_INLINE
 void SzArEx_Init(CSzArEx *p)
 {
   SzAr_Init(&p->db);
@@ -150,6 +147,7 @@
   SzBitUi64s_INIT(&p->CTime)
 }
 
+Z7_NO_INLINE
 void SzArEx_Free(CSzArEx *p, ISzAllocPtr alloc)
 {
   ISzAlloc_Free(alloc, p->UnpackPositions);
@@ -172,15 +170,6 @@
 }
 
 
-static int TestSignatureCandidate(const Byte *testBytes)
-{
-  unsigned i;
-  for (i = 0; i < k7zSignatureSize; i++)
-    if (testBytes[i] != k7zSignature[i])
-      return 0;
-  return 1;
-}
-
 #define SzData_CLEAR(p) { (p)->Data = NULL; (p)->Size = 0; }
 
 #define SZ_READ_BYTE_SD_NOCHECK(_sd_, dest) \
@@ -199,14 +188,9 @@
 #define SKIP_DATA(sd, size) { sd->Size -= (size_t)(size); sd->Data += (size_t)(size); }
 #define SKIP_DATA2(sd, size) { sd.Size -= (size_t)(size); sd.Data += (size_t)(size); }
 
-#define SZ_READ_32(dest) if (sd.Size < 4) return SZ_ERROR_ARCHIVE; \
-   dest = GetUi32(sd.Data); SKIP_DATA2(sd, 4);
-
 static Z7_NO_INLINE SRes ReadNumber(CSzData *sd, UInt64 *value)
 {
-  Byte firstByte, mask;
-  unsigned i;
-  UInt32 v;
+  unsigned firstByte, mask, i, v;
 
   SZ_READ_BYTE(firstByte)
   if ((firstByte & 0x80) == 0)
@@ -223,18 +207,18 @@
   SZ_READ_BYTE(mask)
   *value = v | ((UInt32)mask << 8);
   mask = 0x20;
-  for (i = 2; i < 8; i++)
+  for (i = 2 * 8; i < 8 * 8; i += 8)
   {
-    Byte b;
+    unsigned b;
     if ((firstByte & mask) == 0)
     {
       const UInt64 highPart = (unsigned)firstByte & (unsigned)(mask - 1);
-      *value |= (highPart << (8 * i));
+      *value |= (highPart << i);
       return SZ_OK;
     }
-    SZ_READ_BYTE(b)
-    *value |= ((UInt64)b << (8 * i));
     mask >>= 1;
+    SZ_READ_BYTE(b)
+    *value |= ((UInt64)b << i);
   }
   return SZ_OK;
 }
@@ -242,7 +226,7 @@
 
 static Z7_NO_INLINE SRes SzReadNumber32(CSzData *sd, UInt32 *value)
 {
... (file diff truncated)
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.