diff options
| author | Xin LI <delphij@FreeBSD.org> | 2015-05-14 22:35:26 +0000 |
|---|---|---|
| committer | Xin LI <delphij@FreeBSD.org> | 2015-05-14 22:35:26 +0000 |
| commit | a85f1b1ac565ab642710abc7f761d1f4159cdcb3 (patch) | |
| tree | 29b37031c3ac21558c9aa58a41f6fab6255b8f41 /contrib | |
| parent | 253396a378c6755ca7c32307c74aa1ed7c71d92c (diff) | |
| parent | 5361c268d41ce92a3a5ff27d26edf986a3bf85d8 (diff) | |
| download | src-a85f1b1ac565ab642710abc7f761d1f4159cdcb3.tar.gz src-a85f1b1ac565ab642710abc7f761d1f4159cdcb3.zip | |
MFV r282927,r282928,r282930 (kientzle):
Don't segfault when reading malformed cpio archives.
MFC after: 3 days
Notes
Notes:
svn path=/head/; revision=282932
Diffstat (limited to 'contrib')
| -rw-r--r-- | contrib/libarchive/libarchive/archive_read.c | 2 | ||||
| -rw-r--r-- | contrib/libarchive/libarchive/archive_read_support_format_cpio.c | 22 |
2 files changed, 16 insertions, 8 deletions
diff --git a/contrib/libarchive/libarchive/archive_read.c b/contrib/libarchive/libarchive/archive_read.c index c7f4da16da41..9513729172a9 100644 --- a/contrib/libarchive/libarchive/archive_read.c +++ b/contrib/libarchive/libarchive/archive_read.c @@ -1395,6 +1395,8 @@ __archive_read_filter_consume(struct archive_read_filter * filter, { int64_t skipped; + if (request < 0) + return ARCHIVE_FATAL; if (request == 0) return 0; diff --git a/contrib/libarchive/libarchive/archive_read_support_format_cpio.c b/contrib/libarchive/libarchive/archive_read_support_format_cpio.c index d9c77e4ebef9..8038af892926 100644 --- a/contrib/libarchive/libarchive/archive_read_support_format_cpio.c +++ b/contrib/libarchive/libarchive/archive_read_support_format_cpio.c @@ -198,7 +198,7 @@ static int archive_read_format_cpio_read_data(struct archive_read *, static int archive_read_format_cpio_read_header(struct archive_read *, struct archive_entry *); static int archive_read_format_cpio_skip(struct archive_read *); -static int be4(const unsigned char *); +static int64_t be4(const unsigned char *); static int find_odc_header(struct archive_read *); static int find_newc_header(struct archive_read *); static int header_bin_be(struct archive_read *, struct cpio *, @@ -213,7 +213,7 @@ static int header_afiol(struct archive_read *, struct cpio *, struct archive_entry *, size_t *, size_t *); static int is_octal(const char *, size_t); static int is_hex(const char *, size_t); -static int le4(const unsigned char *); +static int64_t le4(const unsigned char *); static int record_hardlink(struct archive_read *a, struct cpio *cpio, struct archive_entry *entry); @@ -864,8 +864,11 @@ header_bin_le(struct archive_read *a, struct cpio *cpio, /* Read fixed-size portion of header. */ h = __archive_read_ahead(a, bin_header_size, NULL); - if (h == NULL) + if (h == NULL) { + archive_set_error(&a->archive, 0, + "End of file trying to read next cpio header"); return (ARCHIVE_FATAL); + } /* Parse out binary fields. */ header = (const unsigned char *)h; @@ -900,8 +903,11 @@ header_bin_be(struct archive_read *a, struct cpio *cpio, /* Read fixed-size portion of header. */ h = __archive_read_ahead(a, bin_header_size, NULL); - if (h == NULL) + if (h == NULL) { + archive_set_error(&a->archive, 0, + "End of file trying to read next cpio header"); return (ARCHIVE_FATAL); + } /* Parse out binary fields. */ header = (const unsigned char *)h; @@ -944,17 +950,17 @@ archive_read_format_cpio_cleanup(struct archive_read *a) return (ARCHIVE_OK); } -static int +static int64_t le4(const unsigned char *p) { - return ((p[0]<<16) + (p[1]<<24) + (p[2]<<0) + (p[3]<<8)); + return ((p[0] << 16) + (((int64_t)p[1]) << 24) + (p[2] << 0) + (p[3] << 8)); } -static int +static int64_t be4(const unsigned char *p) { - return ((p[0]<<24) + (p[1]<<16) + (p[2]<<8) + (p[3])); + return ((((int64_t)p[0]) << 24) + (p[1] << 16) + (p[2] << 8) + (p[3])); } /* |