From 143e4ff083f31ae7d9234afd31c219fc72bfe033 Mon Sep 17 00:00:00 2001 From: Lucas Rayan Date: Mon, 19 Oct 2026 11:57:14 -0300 Subject: [PATCH] =?UTF-8?q?Depend=C3=AAncias:=20zip=209=20e=20ruzstd=200.9?= =?UTF-8?q?=20(RUSTSEC-2026-0368,=20RUSTSEC-2026-0344=20e=20afins)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 58 ++++++++----------------------- crates/guara-core/Cargo.toml | 4 +-- crates/guara-core/src/aff4.rs | 8 +++-- crates/guara-core/src/fs/btrfs.rs | 2 +- crates/guara-core/src/types.rs | 2 +- 5 files changed, 24 insertions(+), 50 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 63a5188..b48695b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -69,15 +69,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "arbitrary" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "argon2" version = "0.5.3" @@ -278,12 +269,6 @@ dependencies = [ "cfg-if", ] -[[package]] -name = "crossbeam-utils" -version = "0.8.23" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6" - [[package]] name = "crypto-common" version = "0.1.7" @@ -305,17 +290,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "derive_arbitrary" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac" -dependencies = [ - "proc-macro2", - "quote", - "syn 3.0.9", -] - [[package]] name = "digest" version = "0.10.7" @@ -853,9 +827,9 @@ dependencies = [ [[package]] name = "ruzstd" -version = "0.7.3" +version = "0.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fad02996bfc73da3e301efe90b1837be9ed8f4a462b6ed410aa35d00381de89f" +checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5" dependencies = [ "twox-hash", ] @@ -937,12 +911,6 @@ version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "199905e6153d6405f9728fe44daace35f8f837bbf830bb6e85fbd5828709a886" -[[package]] -name = "static_assertions" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" - [[package]] name = "strsim" version = "0.11.1" @@ -1044,13 +1012,15 @@ dependencies = [ [[package]] name = "twox-hash" -version = "1.6.3" +version = "2.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675" -dependencies = [ - "cfg-if", - "static_assertions", -] +checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2" + +[[package]] +name = "typed-path" +version = "0.12.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e" [[package]] name = "typenum" @@ -1178,16 +1148,16 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" [[package]] name = "zip" -version = "2.6.1" +version = "9.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1dcb24d0152526ae49b9b96c1dcf71850ca1e0b882e4e28ed898a93c41334744" +checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e" dependencies = [ - "arbitrary", "crc32fast", - "crossbeam-utils", "flate2", "indexmap", "memchr", + "nix", + "typed-path", "zopfli", ] diff --git a/crates/guara-core/Cargo.toml b/crates/guara-core/Cargo.toml index 178f1bc..a698e8f 100644 --- a/crates/guara-core/Cargo.toml +++ b/crates/guara-core/Cargo.toml @@ -20,9 +20,9 @@ flate2 = { version = "1", default-features = false, features = ["rust_backend"] thiserror = "2" tiny_http = "0.12" bzip2 = "0.6" -zip = { version = "2", default-features = false, features = ["deflate"] } +zip = { version = "9", default-features = false, features = ["deflate"] } snap = "1" -ruzstd = "0.7" +ruzstd = "0.9" lz4_flex = { version = "0.11", default-features = false, features = ["safe-decode", "safe-encode"] } aes = "0.8" hmac = "0.12" diff --git a/crates/guara-core/src/aff4.rs b/crates/guara-core/src/aff4.rs index d4efd9a..ef73631 100644 --- a/crates/guara-core/src/aff4.rs +++ b/crates/guara-core/src/aff4.rs @@ -298,10 +298,14 @@ impl Aff4Source { let mut entries = HashMap::new(); for i in 0..zip.len() { let f = zip.by_index_raw(i).map_err(|e| Error::msg(e.to_string()))?; + let name = f.name().map_err(zerr)?.into_owned(); + let data_start = f + .data_start() + .ok_or_else(|| Error::msg(format!("AFF4: entrada sem início de dados: {name}")))?; entries.insert( - f.name().to_string(), + name, Loc { - data_start: f.data_start(), + data_start, size: f.compressed_size(), }, ); diff --git a/crates/guara-core/src/fs/btrfs.rs b/crates/guara-core/src/fs/btrfs.rs index b0cc1f5..c5a5ac5 100644 --- a/crates/guara-core/src/fs/btrfs.rs +++ b/crates/guara-core/src/fs/btrfs.rs @@ -723,7 +723,7 @@ fn decode(codec: u8, raw: &[u8], ram: usize) -> Option> { } 2 => { use std::io::Read; - let mut dec = ruzstd::StreamingDecoder::new(raw).ok()?; + let mut dec = ruzstd::decoding::StreamingDecoder::new(raw).ok()?; let mut v = Vec::with_capacity(ram); dec.read_to_end(&mut v).ok()?; Some(v) diff --git a/crates/guara-core/src/types.rs b/crates/guara-core/src/types.rs index e1700a1..0e6ae00 100644 --- a/crates/guara-core/src/types.rs +++ b/crates/guara-core/src/types.rs @@ -170,7 +170,7 @@ impl Packed { } PackedCodec::Zstd => { let mut v = Vec::with_capacity(self.ram_len as usize); - ruzstd::StreamingDecoder::new(&raw[..]) + ruzstd::decoding::StreamingDecoder::new(&raw[..]) .map_err(|_| bad("zstd"))? .read_to_end(&mut v) .map_err(|_| bad("zstd"))?;