Commit 72fb35fde for clamav.net

commit 72fb35fde10f0e056d59f8ef47fdfb6e317485b5
Author: Val S. <valsnyde@cisco.com>
Date:   Fri Aug 7 13:50:23 2026 -0400

    libclamunrar: Reject paths in NTFS stream names (#88)

    Portable UnRAR releases before 7.13 allow Windows NTFS alternate
    data stream names to contain path separators. When ClamAV extracts
    a crafted RAR archive for scanning, such a stream name can escape
    the temporary scan directory and create or overwrite a file writable
    by the scanner process.

    Reject forward and backward slashes in both the RAR2/4 and RAR5
    stream handlers, matching the upstream fix for CVE-2025-8088.

    Reported by Yazdan Soltani as affecting ClamAV.

    CLAM-3035

diff --git a/libclamunrar/win32stm.cpp b/libclamunrar/win32stm.cpp
index 3b77d2a45..7631f16df 100644
--- a/libclamunrar/win32stm.cpp
+++ b/libclamunrar/win32stm.cpp
@@ -46,7 +46,8 @@ void ExtractStreams20(Archive &Arc,const wchar *FileName)
   else
     wcsncpyz(StreamName,FileName,ASIZE(StreamName));
   if (wcslen(StreamName)+strlen(Arc.StreamHead.StreamName)>=ASIZE(StreamName) ||
-      Arc.StreamHead.StreamName[0]!=':')
+      Arc.StreamHead.StreamName[0]!=':' ||
+      strpbrk(Arc.StreamHead.StreamName,"\\/")!=NULL)
   {
     uiMsg(UIERROR_STREAMBROKEN,Arc.FileName,FileName);
     ErrHandler.SetErrorCode(RARX_CRC);
@@ -117,7 +118,7 @@ void ExtractStreams(Archive &Arc,const wchar *FileName,bool TestMode)

   wchar StreamName[NM];
   GetStreamNameNTFS(Arc,StreamName,ASIZE(StreamName));
-  if (*StreamName!=':')
+  if (*StreamName!=':' || wcspbrk(StreamName,L"\\/")!=NULL)
   {
     uiMsg(UIERROR_STREAMBROKEN,Arc.FileName,FileName);
     ErrHandler.SetErrorCode(RARX_CRC);