Skip to content

Remove LZX decompression support

Richard Hughes requested to merge wip/hughsie/remove-lzx into master

Remove support for LZX-compressed archives. I've never seen one in the wild that was not an artificial test-case.

The decompression code is scary low level C that has not had any security auditing other than by the fuzzer (which found plenty of memory-safety bugs).

At this point the code is borderline useless at best, and could be a security exploit at worst.

Merge request reports