Implement basic writer support

[jkorany]

Implementing the minimum needed support for creating an archive via the LZMA SDK

[dryrunsecurity]

This pull request contains a TOCTOU symlink vulnerability in CArchiveExtractCallback::GetStream (ext/lzma_sdk_wrapper/archive_callbacks.cpp lines 126–137) where a non-atomic check-delete-create sequence when handling existing files allows a local attacker with write access to the extraction directory to replace the target with a symlink and cause arbitrary file overwrite.

TOCTOU Symlink Attack during Extraction in ext/lzma_sdk_wrapper/archive_callbacks.cpp

Vulnerability

TOCTOU Symlink Attack during Extraction

Description

The C++ extraction implementation in CArchiveExtractCallback::GetStream uses a non-atomic sequence (Check-Delete-Create) to handle existing files, which creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. A local attacker with write access to the extraction directory could exploit this window by replacing the target file with a symbolic link pointing to an arbitrary location on the filesystem, leading to an arbitrary file overwrite.

ruby_lzma_gem/ext/lzma_sdk_wrapper/archive_callbacks.cpp

Lines 126 to 137 in 77449a1

	NFind::CFileInfo fi;
	if (fi.Find(fullPath))
	{
	if (!NDir::DeleteFileAlways(fullPath))
	{
	return E_FAIL;
	}
	}
	}
	if (!_outFileStreamSpec->Create_ALWAYS(fullPath))
	{

---

All finding details can be found in the DryRun Security Dashboard.

[krippee]

LGTM!