diff options
| author | Denys Vlasenko <vda.linux@googlemail.com> | 2017-10-27 15:37:03 +0200 |
|---|---|---|
| committer | Denys Vlasenko <vda.linux@googlemail.com> | 2017-10-27 15:37:03 +0200 |
| commit | 9ac42c500586fa5f10a1f6d22c3f797df11b1f6b (patch) | |
| tree | c4daa76e84cf809b38339f306555015632d1faca /archival/libarchive/decompress_unlzma.c | |
| parent | 0402cb32df015d9372578e3db27db47b33d5c7b0 (diff) | |
| download | busybox-w32-9ac42c500586fa5f10a1f6d22c3f797df11b1f6b.tar.gz busybox-w32-9ac42c500586fa5f10a1f6d22c3f797df11b1f6b.tar.bz2 busybox-w32-9ac42c500586fa5f10a1f6d22c3f797df11b1f6b.zip | |
unlzma: fix SEGV, closes 10436
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to '')
| -rw-r--r-- | archival/libarchive/decompress_unlzma.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c index a9040877e..be4342414 100644 --- a/archival/libarchive/decompress_unlzma.c +++ b/archival/libarchive/decompress_unlzma.c | |||
| @@ -450,8 +450,12 @@ unpack_lzma_stream(transformer_state_t *xstate) | |||
| 450 | IF_NOT_FEATURE_LZMA_FAST(string:) | 450 | IF_NOT_FEATURE_LZMA_FAST(string:) |
| 451 | do { | 451 | do { |
| 452 | uint32_t pos = buffer_pos - rep0; | 452 | uint32_t pos = buffer_pos - rep0; |
| 453 | if ((int32_t)pos < 0) | 453 | if ((int32_t)pos < 0) { |
| 454 | pos += header.dict_size; | 454 | pos += header.dict_size; |
| 455 | /* bug 10436 has an example file where this triggers: */ | ||
| 456 | if ((int32_t)pos < 0) | ||
| 457 | goto bad; | ||
| 458 | } | ||
| 455 | previous_byte = buffer[pos]; | 459 | previous_byte = buffer[pos]; |
| 456 | IF_NOT_FEATURE_LZMA_FAST(one_byte2:) | 460 | IF_NOT_FEATURE_LZMA_FAST(one_byte2:) |
| 457 | buffer[buffer_pos++] = previous_byte; | 461 | buffer[buffer_pos++] = previous_byte; |