search

CrackedPolishedBlackstoneBricksMC / voldeloom

Voldeloom But Weird
MIT License
21 stars 2 forks source link

Usage of `xz` #13

Open quat1024 opened 6 months ago

quat1024 commented 6 months ago

Voldeloom uses xz-java to unpack the "binpatches.pack.lzma" file present in Forge 1.6 and 1.7. In other news, the xz maintainer has apparently just outed themself as the type to add backdoors into binaries: https://www.openwall.com/lists/oss-security/2024/03/29/4

note that xz-java is a separate project and I don't think it uses the native xz binaries... but still. They're under the same organization and the same author commits to both. Switching to another lzma decompressing solution might be a good idea.

unascribed commented 6 months ago

The original LZMA library by the 7zip project is public domain and has a Java port. It's not available in a Maven repo, unfortunately.