Summary: 
The flaw occurs when the source buffer passed to archive_entry_copy_mac_metadata() points to the internal Mac metadata buffer of the same archive_entry object. The function frees the internal buffer before copying from it, causing a UAF read during memcpy().

Requirements to exploit: An attacker need ability of reading and writing to a program using vulnarable libarchive entry API 

Component affected: https://github.com/libarchive/libarchive

Version affected: Commit hash 4840347 and previous versions. I didn't try on any release version. 

Patch Available: Yes

Version fixed: No release version has been confirmed fixed the flaw.But have a patch in upstream by PR #3318： https://github.com/libarchive/libarchive/pull/3318

Upstream coordination: Upstream was notified publicly through the following GitHub issue: https://github.com/libarchive/libarchive/issues/3313 And a fix was submitted and merged: https://github.com/libarchive/libarchive/pull/3318

Impact: A successful exploitation will make the program read wrong data from a freed buffer and then have logic problem. In addition, it probably can benefit chunk metadata leak for potential control flow hijack.

Embargo: No

Suggested public date: N/A, since the issue is already public.

Acknowledgement: Mr.Xin

Steps to reproduce:
1. Build the POC.c (source file is in the attachments): 
/usr/bin/clang -O1 -g \
 -fsanitize=address,undefined -fno-omit-frame-pointer \
 -I/path/to/libarchive/libarchive \
 /path/to/POC.c \
 /path/to/libarchive/LibBuilds/libarchive/libarchive.a \
 -lz -lbz2 -llzma -lzstd -lcrypto -lxml2 -lssl \
 -licui18n -licuuc -licudata -lm -lresolv \
 -o /output/path/POC_Executor

2. Run PoC
LLVM_SYMBOLIZER_BIN=/path/to/llvm-symbolizer
ASAN_OPTIONS="detect_leaks=0:halt_on_error=1:abort_on_error=1:symbolize=1:external_symbolizer_path=${LLVM_SYMBOLIZER_BIN}" \
 UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1 \
 /output/path/POC_Executor

Original report: https://github.com/libarchive/libarchive/issues/3313