2 files changed, 23 insertions, 14 deletions

diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c
index 80a453806..446319e7b 100644
--- a/archival/libarchive/decompress_unlzma.c
+++ b/archival/libarchive/decompress_unlzma.c
@@ -224,6 +224,7 @@ unpack_lzma_stream(transformer_state_t *xstate)
         rc_t *rc;
         int i;
         uint8_t *buffer;
+        uint32_t buffer_size;
         uint8_t previous_byte = 0;
         size_t buffer_pos = 0, global_pos = 0;
         int len = 0;
@@ -253,7 +254,8 @@ unpack_lzma_stream(transformer_state_t *xstate)
         if (header.dict_size == 0)
                 header.dict_size++;
 
-        buffer = xmalloc(MIN(header.dst_size, header.dict_size));
+        buffer_size = MIN(header.dst_size, header.dict_size);
+        buffer = xmalloc(buffer_size);
 
         {
                 int num_probs;
@@ -464,7 +466,10 @@ unpack_lzma_stream(transformer_state_t *xstate)
                                 if ((int32_t)pos < 0) {
                                         pos += header.dict_size;
                                         /* bug 10436 has an example file where this triggers: */
-                                        if ((int32_t)pos < 0)
+                                        //if ((int32_t)pos < 0)
+                                        //      goto bad;
+                                        /* more stringent test (see unzip_bad_lzma_1.zip): */
+                                        if (pos >= buffer_size)
                                                 goto bad;
                                 }
                                 previous_byte = buffer[pos];
@@ -493,6 +498,12 @@ unpack_lzma_stream(transformer_state_t *xstate)
                 IF_DESKTOP(total_written += buffer_pos;)
                 if (transformer_write(xstate, buffer, buffer_pos) != (ssize_t)buffer_pos) {
  bad:
+                        /* One of our users, bbunpack(), expects _us_ to emit
+                         * the error message (since it's the best place to give
+                         * potentially more detailed information).
+                         * Do not fail silently.
+                         */
+                        bb_error_msg("corrupted data");
                         total_written = -1; /* failure */
                 }
                 rc_free(rc);
diff --git a/archival/libarchive/get_header_ar.c b/archival/libarchive/get_header_ar.c
index 93e071c9f..adcde46d5 100644
--- a/archival/libarchive/get_header_ar.c
+++ b/archival/libarchive/get_header_ar.c
@@ -34,10 +34,6 @@ char FAST_FUNC get_header_ar(archive_handle_t *archive_handle)
                 char raw[60];
                 struct ar_header formatted;
         } ar;
-#if ENABLE_FEATURE_AR_LONG_FILENAMES
-        static char *ar_long_names;
-        static unsigned ar_long_name_size;
-#endif
 
         /* dont use xread as we want to handle the error ourself */
         if (read(archive_handle->src_fd, ar.raw, 60) != 60) {
@@ -81,10 +77,10 @@ char FAST_FUNC get_header_ar(archive_handle_t *archive_handle)
                          * stores long filename for multiple entries, they are stored
                          * in static variable long_names for use in future entries
                          */
-                        ar_long_name_size = size;
-                        free(ar_long_names);
-                        ar_long_names = xzalloc(size + 1);
-                        xread(archive_handle->src_fd, ar_long_names, size);
+                        archive_handle->ar__long_name_size = size;
+                        free(archive_handle->ar__long_names);
+                        archive_handle->ar__long_names = xzalloc(size + 1);
+                        xread(archive_handle->src_fd, archive_handle->ar__long_names, size);
                         archive_handle->offset += size;
                         /* Return next header */
                         return get_header_ar(archive_handle);
@@ -107,13 +103,13 @@ char FAST_FUNC get_header_ar(archive_handle_t *archive_handle)
                 unsigned long_offset;
 
                 /* The number after the '/' indicates the offset in the ar data section
-                 * (saved in ar_long_names) that contains the real filename */
+                 * (saved in ar__long_names) that contains the real filename */
                 long_offset = read_num(&ar.formatted.name[1], 10,
                                        sizeof(ar.formatted.name) - 1);
-                if (long_offset >= ar_long_name_size) {
+                if (long_offset >= archive_handle->ar__long_name_size) {
                         bb_error_msg_and_die("can't resolve long filename");
                 }
-                typed->name = xstrdup(ar_long_names + long_offset);
+                typed->name = xstrdup(archive_handle->ar__long_names + long_offset);
         } else
 #endif
         {
@@ -127,8 +123,10 @@ char FAST_FUNC get_header_ar(archive_handle_t *archive_handle)
                 archive_handle->action_header(typed);
 #if ENABLE_DPKG || ENABLE_DPKG_DEB
                 if (archive_handle->dpkg__sub_archive) {
-                        while (archive_handle->dpkg__action_data_subarchive(archive_handle->dpkg__sub_archive) == EXIT_SUCCESS)
+                        struct archive_handle_t *sa = archive_handle->dpkg__sub_archive;
+                        while (archive_handle->dpkg__action_data_subarchive(sa) == EXIT_SUCCESS)
                                 continue;
+                        create_symlinks_from_list(sa->symlink_placeholders);
                 } else
 #endif
                         archive_handle->action_data(archive_handle);