CVE-2020-21674: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in libarchive version 3.4.1dev, specifically in the archive_string_append_from_wcs() function within archive_string.c. The vulnerability was identified and tracked as CVE-2020-21674, allowing remote attackers to potentially cause a denial of service or execute arbitrary code through specially crafted archive files (NVD, Debian Tracker).

The vulnerability occurs in the archive_string_append_from_wcs() function when processing archive files. The issue arises from improper buffer size calculation when growing the archive_string buffer, which doesn't ensure sufficient space for maximum-sized multibyte characters and null termination. This can lead to an out-of-bounds write in heap memory, potentially resulting in a crash or code execution (GitHub Issue).

The vulnerability could allow remote attackers to cause a denial of service condition through application crashes or potentially execute arbitrary code by exploiting the heap buffer overflow. The issue affects systems running the vulnerable version of libarchive, which is widely used for archive file handling in various applications (NVD).

The vulnerability can be triggered by processing specially crafted archive files. A proof-of-concept exploit has been demonstrated using a custom fuzzer, showing how the vulnerability leads to a heap-buffer-overflow when processing malformed input (GitHub Issue).

The vulnerability was fixed in a subsequent patch that ensures proper buffer allocation by using the maximum of either len * 2 or MB_CUR_MAX + 1 when growing the buffer. The fix was implemented through a commit that modified the buffer size calculation in archive_string_append_from_wcs() (GitHub Commit).