aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorConrad Meyer <cem@FreeBSD.org>2018-07-28 00:55:57 +0000
committerConrad Meyer <cem@FreeBSD.org>2018-07-28 00:55:57 +0000
commit032a8914c1034da8875307405dfd591a1b96137c (patch)
tree51a56e2b9dd24059563cdc546bfd354642e81b92
parentf7158da37f7f9080dee3f63349bbf9e4347df6e2 (diff)
downloadsrc-032a8914c1034da8875307405dfd591a1b96137c.tar.gz
src-032a8914c1034da8875307405dfd591a1b96137c.zip
libarchive: Cherry-pick upstream 2c8c83b9
Relevant vendor changes: Fix issue #948: out-of-bounds read in lha_read_data_none() admbugs: 877 Security: CVE-2017-14503
Notes
Notes: svn path=/vendor/libarchive/dist/; revision=336800
-rw-r--r--libarchive/archive_read_support_format_lha.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c
index b8ef4ae10ece..95c99bb1f31e 100644
--- a/libarchive/archive_read_support_format_lha.c
+++ b/libarchive/archive_read_support_format_lha.c
@@ -701,6 +701,12 @@ archive_read_format_lha_read_header(struct archive_read *a,
* Prepare variables used to read a file content.
*/
lha->entry_bytes_remaining = lha->compsize;
+ if (lha->entry_bytes_remaining < 0) {
+ archive_set_error(&a->archive,
+ ARCHIVE_ERRNO_FILE_FORMAT,
+ "Invalid LHa entry size");
+ return (ARCHIVE_FATAL);
+ }
lha->entry_offset = 0;
lha->entry_crc_calculated = 0;