diff options
| author | Conrad Meyer <cem@FreeBSD.org> | 2018-07-28 00:59:59 +0000 |
|---|---|---|
| committer | Conrad Meyer <cem@FreeBSD.org> | 2018-07-28 00:59:59 +0000 |
| commit | 2f4a276414ab95cd735d7143f7110cb540be322b (patch) | |
| tree | 439591dffa4c0a508e084ced6ea66edf9be872cf /contrib | |
| parent | fc3bfe916e603950f509aeec656fa7112646971d (diff) | |
| parent | 032a8914c1034da8875307405dfd591a1b96137c (diff) | |
| download | src-2f4a276414ab95cd735d7143f7110cb540be322b.tar.gz src-2f4a276414ab95cd735d7143f7110cb540be322b.zip | |
MFV r336800: libarchive: Cherry-pick upstream 2c8c83b9
Relevant vendor changes:
Fix issue #948: out-of-bounds read in lha_read_data_none()
admbugs: 877
MFC after: 3 days
Security: CVE-2017-14503
Notes
Notes:
svn path=/head/; revision=336801
Diffstat (limited to 'contrib')
| -rw-r--r-- | contrib/libarchive/libarchive/archive_read_support_format_lha.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/contrib/libarchive/libarchive/archive_read_support_format_lha.c b/contrib/libarchive/libarchive/archive_read_support_format_lha.c index b8ef4ae10ece..95c99bb1f31e 100644 --- a/contrib/libarchive/libarchive/archive_read_support_format_lha.c +++ b/contrib/libarchive/libarchive/archive_read_support_format_lha.c @@ -701,6 +701,12 @@ archive_read_format_lha_read_header(struct archive_read *a, * Prepare variables used to read a file content. */ lha->entry_bytes_remaining = lha->compsize; + if (lha->entry_bytes_remaining < 0) { + archive_set_error(&a->archive, + ARCHIVE_ERRNO_FILE_FORMAT, + "Invalid LHa entry size"); + return (ARCHIVE_FATAL); + } lha->entry_offset = 0; lha->entry_crc_calculated = 0; |