Skip to content

fix: exclude oversize El Torito [BOOT] entry during iso extraction - #135

Merged
max-lvs merged 1 commit into
linuxdeepin:release/eaglefrom
LiHua000:release/eagle
Sep 16, 2026
Merged

max-lvs merged 1 commit into
linuxdeepin:release/eaglefrom
LiHua000:release/eagle

Conversation

@LiHua000

@LiHua000 LiHua000 commented Sep 16, 2026

Copy link
Copy Markdown
Contributor
  • Scan 7z l -slt before extraction and exclude only [BOOT] entries larger than 4GiB-1 (the FAT32 single file limit)
  • Parse only Path/Folder/Size so it works with both old p7zip and new 7-Zip
  • Fall back to no exclusion when the scan fails; small [BOOT] entries are kept

Log: Fix making bootable USB from large ISO images whose El Torito [BOOT] entry exceeds the FAT32 file size limit

Bug: https://pms.uniontech.com/bug-view-377229.html

Please do not send pull requests to the linuxdeepin/*

see https://github.com/linuxdeepin/developer-center/wiki/Contribution-Guidelines-for-Developers

Thanks!

Summary by Sourcery

Exclude oversized El Torito boot entries during ISO extraction while retaining compatible fallback behavior.

Bug Fixes:

  • Prevent ISO extraction failures by excluding only El Torito [BOOT] files that exceed the FAT32 single-file size limit.

Enhancements:

  • Support [BOOT] entry detection across old p7zip and new 7-Zip output formats while preserving normal extraction when scanning is unavailable or entries are within the limit.

Chores:

  • Update SPDX copyright years and dependency metadata.

@sourcery-ai

sourcery-ai Bot commented Sep 16, 2026

Copy link
Copy Markdown

Reviewer's Guide

The extraction path now performs a pre-extraction 7z technical listing, filters only oversized [BOOT] files beyond FAT32’s 4 GiB − 1-byte limit, and passes targeted -x! exclusions to extraction while falling back safely when scanning is unavailable or fails.

Sequence diagram for selective oversized El Torito entry exclusion

sequenceDiagram
    participant SevenZip
    participant ListProcess as 7z listing process
    participant ExtractProcess as 7z extraction process

    SevenZip->>ListProcess: start(l, -slt, archive)
    ListProcess-->>SevenZip: Path / Folder / Size output
    SevenZip->>SevenZip: parseOversizeBootPaths(sltOutput)
    alt oversized [BOOT] files found
        SevenZip->>ExtractProcess: extract archive with -x![BOOT]/path
    else scan fails or no oversized files
        SevenZip->>ExtractProcess: extract archive without exclusions
    end
    ExtractProcess-->>SevenZip: extraction result
Loading

File-Level Changes

Change Details Files
Detect oversized synthetic El Torito boot files before extraction and exclude only those that cannot fit on FAT32.
  • Run 7z/p7zip in technical-list mode before extraction.
  • Parse Path, Folder, and Size fields across old and new 7-Zip output formats.
  • Identify file entries under [BOOT]/ exceeding 4 GiB − 1 and add targeted extraction exclusions.
  • Preserve prior behavior when scanning fails or entries are within the FAT32 limit.
src/libdbm/util/sevenzip.cpp
src/libdbm/util/sevenzip.h
Expose the archive-list parser for focused unit testing and document the scan/exclusion fallback behavior.
  • Add a public static parser API and a private archive-scanning helper.
  • Include QStringList declarations required by the new APIs.
src/libdbm/util/sevenzip.h

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨

@LiHua000
LiHua000 force-pushed the release/eagle branch 2 times, most recently from ae31a5d to abe6b86 Compare September 16, 2026 02:45
@github-actions

Copy link
Copy Markdown
  • 检测到敏感词export变动
详情
    {
    "export": {
        ".reuse/dep5": {
            "a": [
                "Files: src/tools/exportPot src/tools/importPo src/tools/importPo.bat"
            ],
            "b": [
                "Files: src/tools/exportPot src/tools/exportPot.bat src/tools/importPo src/tools/importPo.bat"
            ]
        }
    }
}

- Scan `7z l -slt` before extraction and exclude only [BOOT] entries larger than 4GiB-1 (the FAT32 single file limit)
- Parse only Path/Folder/Size so it works with both old p7zip and new 7-Zip
- Fall back to no exclusion when the scan fails; small [BOOT] entries are kept

Log: Fix making bootable USB from large ISO images whose El Torito [BOOT] entry exceeds the FAT32 file size limit

Bug: https://pms.uniontech.com/bug-view-377229.html
@github-actions

Copy link
Copy Markdown
  • 检测到敏感词export变动
详情
    {
    "export": {
        ".reuse/dep5": {
            "a": [
                "Files: src/tools/exportPot src/tools/importPo src/tools/importPo.bat"
            ],
            "b": [
                "Files: src/tools/exportPot src/tools/exportPot.bat src/tools/importPo src/tools/importPo.bat"
            ]
        }
    }
}

@deepin-ci-robot

Copy link
Copy Markdown

deepin pr auto review

🤖 AI 代码审查报告

总体评分: 93 分 (通过阈值: 70分)

Pass


📊 总体评价

项目 结果
审查结论 代码审查通过
评分详情 总体评分 93 分,大于 70 分通过阈值,代码质量符合要求。本次变更修复了大ISO镜像中El Torito [BOOT]条目超过FAT32文件大小限制导致提取失败的问题,实现逻辑清晰,注释完整,无安全漏洞。

🔍 详细分析

1. 语法逻辑 ✅

评价: 良好 ✅ 通过

潜在问题:

  1. src/libdbm/util/sevenzip.cpp:112 - waitForStarted(-1) 和 waitForFinished(-1) 使用无限超时,可能导致进程挂起时应用无响应

建议: 建议为 waitForStarted 和 waitForFinished 设置合理的超时时间(如30秒),超时后回退到无排除模式,避免应用无限期阻塞


2. 代码质量 ✅

评价: 优秀 ✅ 通过

潜在问题:

  1. src/libdbm/util/sevenzip.cpp:82 - for (QString line : lines) 按值拷贝每个QString对象,应使用 const QString & 避免不必要的拷贝

建议: 将 for (QString line : lines) 改为 for (const QString &line : lines),避免不必要的字符串拷贝


3. 代码性能 ✅

评价: 优秀 ✅ 通过

潜在问题:

  1. src/libdbm/util/sevenzip.cpp:82 - 不必要的QString拷贝,虽对7z输出影响较小但仍可优化
  2. src/libdbm/util/sevenzip.cpp:112 - waitForFinished(-1) 无限超时阻塞调用,存在边缘情况下的性能风险

建议: 1.使用 const QString & 避免拷贝 2.设置合理超时时间替代无限等待


4. 代码安全 🔒

评价: 优秀 ✅ 通过

🔐 存在 0 个安全漏洞

📊 漏洞对比统计:新增漏洞 0 个,减少漏洞 0 个,持平 0 个

安全漏洞详情:
✅ 未发现安全漏洞

建议: 无安全漏洞。代码使用QProcess参数列表方式执行命令(非shell),无命令注入风险;路径来自ISO内部结构解析,仅用于7z排除模式,无路径遍历风险;使用QString管理内存,无缓冲区溢出风险;日志仅输出文件路径,无敏感信息泄露。


💡 改进建议代码示例

// 优化1: 避免不必要的QString拷贝
const QStringList lines = sltOutput.split(QLatin1Char('\n'));
for (const QString &line : lines) {  // 使用 const 引用
    if (line.endsWith(QLatin1Char('\r')))
        // 注意: line 为 const 时不能调用 chop()
        // 可改为: const QString trimmed = line.endsWith('\r') ? line.left(line.size()-1) : line;
        ...
}

// 优化2: 设置合理超时时间
static const int kScanTimeoutMs = 30000;  // 30秒超时
if (!listProcess.waitForStarted(kScanTimeoutMs) || !listProcess.waitForFinished(kScanTimeoutMs)) {
    qWarning() << "scan iso failed, skip [BOOT] exclusion:" << listProcess.errorString();
    return result;
}

本报告由 AI 代码审查工具自动生成

@deepin-ci-robot

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: LiHua000, max-lvs

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@LiHua000

Copy link
Copy Markdown
Contributor Author

/merge

@deepin-bot

deepin-bot Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

This pr cannot be merged! (status: unstable)

@max-lvs
max-lvs merged commit 1f514c2 into linuxdeepin:release/eagle Sep 16, 2026
16 of 17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants