diff options
author | Conrad Meyer <cem@FreeBSD.org> | 2018-07-28 00:55:57 +0000 |
---|---|---|
committer | Conrad Meyer <cem@FreeBSD.org> | 2018-07-28 00:55:57 +0000 |
commit | 032a8914c1034da8875307405dfd591a1b96137c (patch) | |
tree | 51a56e2b9dd24059563cdc546bfd354642e81b92 | |
parent | f7158da37f7f9080dee3f63349bbf9e4347df6e2 (diff) | |
download | src-test2-032a8914c1034da8875307405dfd591a1b96137c.tar.gz src-test2-032a8914c1034da8875307405dfd591a1b96137c.zip |
libarchive: Cherry-pick upstream 2c8c83b9
Relevant vendor changes:
Fix issue #948: out-of-bounds read in lha_read_data_none()
admbugs: 877
Security: CVE-2017-14503
Notes
Notes:
svn path=/vendor/libarchive/dist/; revision=336800
-rw-r--r-- | libarchive/archive_read_support_format_lha.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c index b8ef4ae10ece..95c99bb1f31e 100644 --- a/libarchive/archive_read_support_format_lha.c +++ b/libarchive/archive_read_support_format_lha.c @@ -701,6 +701,12 @@ archive_read_format_lha_read_header(struct archive_read *a, * Prepare variables used to read a file content. */ lha->entry_bytes_remaining = lha->compsize; + if (lha->entry_bytes_remaining < 0) { + archive_set_error(&a->archive, + ARCHIVE_ERRNO_FILE_FORMAT, + "Invalid LHa entry size"); + return (ARCHIVE_FATAL); + } lha->entry_offset = 0; lha->entry_crc_calculated = 0; |