#52825: fix: detect cyclic link entries during asar path resolution
Merged
Created: Aug 15, 2026, 4:52:02 PM
Merged: Aug 16, 2026, 6:10:28 AM
4 comments
Target: main
Archive::GetFileInfo and the GetNodeFromPath/GetFilesNode pair follow ASAR link entries with no cycle detection or recursion limit, so an archive whose header contains a self-referential or mutually-referential link resolves forever, overflows the stack, and crashes the process.
- Bound link resolution with a depth cap (
kMaxLinkDepth) threaded throughArchive::GetFileInfoandGetNodeFromPath/GetFilesNode; exceeding it fails the lookup like any other missing entry instead of recursing. - Add regression coverage with self-link, two-node-cycle, and directory-link-cycle fixtures.
Notes: Fixed a crash when resolving a path inside a malformed ASAR archive that contains cyclic link entries.
Backports
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron