From a1870f4807a75663a085c9f5e92870fa7554f0ad Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Sun, 8 Apr 2018 20:45:16 +0200 Subject: unlzma: fix segfault on bad archive function old new delta unpack_lzma_stream 2647 2653 +6 Signed-off-by: Denys Vlasenko --- archival/libarchive/decompress_unlzma.c | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'archival/libarchive/decompress_unlzma.c') diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c index be4342414..80a453806 100644 --- a/archival/libarchive/decompress_unlzma.c +++ b/archival/libarchive/decompress_unlzma.c @@ -11,6 +11,13 @@ #include "libbb.h" #include "bb_archive.h" +#if 0 +# define dbg(...) bb_error_msg(__VA_ARGS__) +#else +# define dbg(...) ((void)0) +#endif + + #if ENABLE_FEATURE_LZMA_FAST # define speed_inline ALWAYS_INLINE # define size_inline @@ -417,6 +424,10 @@ unpack_lzma_stream(transformer_state_t *xstate) for (; num_bits2 != LZMA_NUM_ALIGN_BITS; num_bits2--) rep0 = (rep0 << 1) | rc_direct_bit(rc); rep0 <<= LZMA_NUM_ALIGN_BITS; + if ((int32_t)rep0 < 0) { + dbg("%d rep0:%d", __LINE__, rep0); + goto bad; + } prob3 = p + LZMA_ALIGN; } i2 = 1; -- cgit v1.2.3