aboutsummaryrefslogtreecommitdiff
path: root/archival/libarchive/decompress_unlzma.c
diff options
context:
space:
mode:
authorDenys Vlasenko <vda.linux@googlemail.com>2017-10-27 15:37:03 +0200
committerDenys Vlasenko <vda.linux@googlemail.com>2017-10-27 15:37:03 +0200
commit9ac42c500586fa5f10a1f6d22c3f797df11b1f6b (patch)
treec4daa76e84cf809b38339f306555015632d1faca /archival/libarchive/decompress_unlzma.c
parent0402cb32df015d9372578e3db27db47b33d5c7b0 (diff)
downloadbusybox-w32-9ac42c500586fa5f10a1f6d22c3f797df11b1f6b.tar.gz
busybox-w32-9ac42c500586fa5f10a1f6d22c3f797df11b1f6b.tar.bz2
busybox-w32-9ac42c500586fa5f10a1f6d22c3f797df11b1f6b.zip
unlzma: fix SEGV, closes 10436
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to '')
-rw-r--r--archival/libarchive/decompress_unlzma.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c
index a9040877e..be4342414 100644
--- a/archival/libarchive/decompress_unlzma.c
+++ b/archival/libarchive/decompress_unlzma.c
@@ -450,8 +450,12 @@ unpack_lzma_stream(transformer_state_t *xstate)
450 IF_NOT_FEATURE_LZMA_FAST(string:) 450 IF_NOT_FEATURE_LZMA_FAST(string:)
451 do { 451 do {
452 uint32_t pos = buffer_pos - rep0; 452 uint32_t pos = buffer_pos - rep0;
453 if ((int32_t)pos < 0) 453 if ((int32_t)pos < 0) {
454 pos += header.dict_size; 454 pos += header.dict_size;
455 /* bug 10436 has an example file where this triggers: */
456 if ((int32_t)pos < 0)
457 goto bad;
458 }
455 previous_byte = buffer[pos]; 459 previous_byte = buffer[pos];
456 IF_NOT_FEATURE_LZMA_FAST(one_byte2:) 460 IF_NOT_FEATURE_LZMA_FAST(one_byte2:)
457 buffer[buffer_pos++] = previous_byte; 461 buffer[buffer_pos++] = previous_byte;