7z.sfx: update to v26.04

[dscho]

This corresponds to the commit ac214735f38e (Merge branch 'readme',
2023-08-25) of
https://github.com/git-for-windows/7-Zip/commits/v26.04-VS2022-sfx
and the artifacts have been copied from the workflow run at
https://github.com/git-for-windows/7-Zip/actions/runs/37513329934.

This closes git-for-windows/git#6465.

The 26.04 release notes,
also published on
SourceForge,
state: "Some bugs and vulnerabilities were fixed." which is... terse. So I set GPT-6.1 Sol the task to reconstruct the release notes. Here is its output:

7-Zip 26.04 — reconstructed release notes

This is principally a parser-hardening and correctness release, not a new-format release. The following is reconstructed from the 26.03→26.04 source diff, rather than upstream’s one-line announcement.

Archive and disk-image handling

• NTFS images: Tightened validation of nonresident file attributes, including data-run encoding, physical cluster ranges, extent ordering and allocated-size consistency. Added stricter checks for LZNT1 compressed-stream chunks. These improve handling of malformed images; NTFS compression and sparse-file support already existed. Sources: runlists, compressed chunks, extent consistency.

• VHD images: Corrected read accounting and output-buffer positioning when differencing images obtain sectors from their parent image, including short parent reads. Reworked block-allocation-table sizing and calculation of the physical extent required by allocated blocks, their bitmaps and payloads. Sources: parent-sector reads, allocation-table handling.

• WIM reading: Added compression-method-specific chunk-size checks for XPRESS, LZX and LZMS. Uncompressed resources must declare matching packed and unpacked sizes. Strengthened validation of solid-resource chunk tables and substream boundaries, and added diagnostics for inconsistent filename, short-name and alternate-stream-name lengths or terminators. Sources: chunk sizes, resource sizes, solid resources, names.

• WIM writing: Corrected metadata for empty reparse-point directories. Ordinary empty directories retain an empty child-list terminator; empty reparse-point directories no longer receive a child list or its offset. The source explicitly documents matching DISM/imagex behavior. Source.

• ZIP64: Added rejection of central-directory sizes, offsets and end positions outside the signed 64-bit range, and invalid ZIP64 locator offsets. This prevents those values from reaching signed seek/base-offset calculations. Sources: range checks, locator validation.

• ISO images: Reject directory records that extend beyond their containing directory or cross a 2,048-byte block boundary. Validate zero padding through the end of a block. Also corrected opening-progress updates to report completed work rather than repeatedly changing the total. Source.

• CAB archives: Fixed single-volume folder processing when the advertised data-block count is zero: extraction no longer repeatedly rewinds to the first block. Existing tolerance of underreported block counts is preserved. Source.

• NSIS installers: Replaced repeated array deletion with one-pass compaction when removing duplicate file entries. This avoids quadratic duplicate-removal work for installers containing many repeated entries; it is not a claim that all NSIS processing is now linear. Source.

Decompression, checksums and integrations

• Multithreaded XZ decompression: Made the memory-limit calculation overflow-safe. Instead of multiplying the declared unpacked block size by twice the thread count, the check uses division and guards against a zero thread count. Source.

• Extraction checksums: Fixed directory entries being skipped before checksum bookkeeping. Directory names now contribute to extraction-time “data and names” totals as intended; this does not change file-content hashing algorithms. Sources: extraction callback, File Manager callback.

• External compression filters: Increased the minimum processing-buffer size from 4 KiB to 64 KiB for compatibility with filters requiring 64 KiB buffers. The default remains 2 MiB. Source.

• Standalone C SDK extractor: Ensure output files are closed even after a write failure, and set timestamps only after successful writing. Previously, the write-error path exited before closing the file. Source.

Security qualification: upstream explicitly says vulnerabilities were fixed, but does not identify them in the 26.04 changelog. The bounds and overflow changes above are concrete; assigning CVEs, exploitability or severity to them from this diff alone would be speculation.