29 files changed, 43 insertions, 57 deletions

diff --git a/archival/libarchive/common.c b/archival/libarchive/common.c
index 389cb7856..25c7bddad 100644
--- a/archival/libarchive/common.c
+++ b/archival/libarchive/common.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/data_align.c b/archival/libarchive/data_align.c
index a6b84a440..f61fdd93f 100644
--- a/archival/libarchive/data_align.c
+++ b/archival/libarchive/data_align.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
index e658444e0..d3a6df5e8 100644
--- a/archival/libarchive/data_extract_all.c
+++ b/archival/libarchive/data_extract_all.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/data_extract_to_command.c b/archival/libarchive/data_extract_to_command.c
index 5d8769382..1114a95cb 100644
--- a/archival/libarchive/data_extract_to_command.c
+++ b/archival/libarchive/data_extract_to_command.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/data_extract_to_stdout.c b/archival/libarchive/data_extract_to_stdout.c
index f849f3b42..520041329 100644
--- a/archival/libarchive/data_extract_to_stdout.c
+++ b/archival/libarchive/data_extract_to_stdout.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/data_skip.c b/archival/libarchive/data_skip.c
index 588167f01..1a608227e 100644
--- a/archival/libarchive/data_skip.c
+++ b/archival/libarchive/data_skip.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/decompress_bunzip2.c b/archival/libarchive/decompress_bunzip2.c
index 803702f75..bec89edd3 100644
--- a/archival/libarchive/decompress_bunzip2.c
+++ b/archival/libarchive/decompress_bunzip2.c
@@ -1,14 +1,14 @@
 /* vi: set sw=4 ts=4: */
-/* Small bzip2 deflate implementation, by Rob Landley (rob@landley.net).
-
-   Based on bzip2 decompression code by Julian R Seward (jseward@acm.org),
-   which also acknowledges contributions by Mike Burrows, David Wheeler,
-   Peter Fenwick, Alistair Moffat, Radford Neal, Ian H. Witten,
-   Robert Sedgewick, and Jon L. Bentley.
-
-   Licensed under GPLv2 or later, see file LICENSE in this source tree.
-*/
-
+/*
+ * Small bzip2 deflate implementation, by Rob Landley (rob@landley.net).
+ *
+ * Based on bzip2 decompression code by Julian R Seward (jseward@acm.org),
+ * which also acknowledges contributions by Mike Burrows, David Wheeler,
+ * Peter Fenwick, Alistair Moffat, Radford Neal, Ian H. Witten,
+ * Robert Sedgewick, and Jon L. Bentley.
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
 /*
         Size and speed optimizations by Manuel Novoa III  (mjn3@codepoet.org).
 
@@ -38,7 +38,6 @@
 
         Manuel
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
@@ -157,15 +156,15 @@ static unsigned get_bits(bunzip_data *bd, int bits_wanted)
 static int get_next_block(bunzip_data *bd)
 {
         struct group_data *hufGroup;
-        int dbufCount, dbufSize, groupCount, *base, *limit, selector,
-                i, j, runPos, symCount, symTotal, nSelectors, byteCount[256];
-        int runCnt = runCnt; /* for compiler */
+        int groupCount, *base, *limit, selector,
+                i, j, symCount, symTotal, nSelectors, byteCount[256];
         uint8_t uc, symToByte[256], mtfSymbol[256], *selectors;
         uint32_t *dbuf;
         unsigned origPtr, t;
+        unsigned dbufCount, runPos;
+        unsigned runCnt = runCnt; /* for compiler */
 
         dbuf = bd->dbuf;
-        dbufSize = bd->dbufSize;
         selectors = bd->selectors;
 
 /* In bbox, we are ok with aborting through setjmp which is set up in start_bunzip */
@@ -188,7 +187,7 @@ static int get_next_block(bunzip_data *bd)
            it didn't actually work. */
         if (get_bits(bd, 1)) return RETVAL_OBSOLETE_INPUT;
         origPtr = get_bits(bd, 24);
-        if ((int)origPtr > dbufSize) return RETVAL_DATA_ERROR;
+        if (origPtr > bd->dbufSize) return RETVAL_DATA_ERROR;
 
         /* mapping table: if some byte values are never used (encoding things
            like ascii text), the compression code removes the gaps to have fewer
@@ -436,7 +435,14 @@ static int get_next_block(bunzip_data *bd)
                            symbols, but a run of length 0 doesn't mean anything in this
                            context).  Thus space is saved. */
                         runCnt += (runPos << nextSym); /* +runPos if RUNA; +2*runPos if RUNB */
-                        if (runPos < dbufSize) runPos <<= 1;
+//The 32-bit overflow of runCnt wasn't yet seen, but probably can happen.
+//This would be the fix (catches too large count way before it can overflow):
+//                      if (runCnt > bd->dbufSize) {
+//                              dbg("runCnt:%u > dbufSize:%u RETVAL_DATA_ERROR",
+//                                              runCnt, bd->dbufSize);
+//                              return RETVAL_DATA_ERROR;
+//                      }
+                        if (runPos < bd->dbufSize) runPos <<= 1;
                         goto end_of_huffman_loop;
                 }
 
@@ -446,14 +452,15 @@ static int get_next_block(bunzip_data *bd)
                    literal used is the one at the head of the mtfSymbol array.) */
                 if (runPos != 0) {
                         uint8_t tmp_byte;
-                        if (dbufCount + runCnt > dbufSize) {
-                                dbg("dbufCount:%d+runCnt:%d %d > dbufSize:%d RETVAL_DATA_ERROR",
-                                                dbufCount, runCnt, dbufCount + runCnt, dbufSize);
+                        if (dbufCount + runCnt > bd->dbufSize) {
+                                dbg("dbufCount:%u+runCnt:%u %u > dbufSize:%u RETVAL_DATA_ERROR",
+                                                dbufCount, runCnt, dbufCount + runCnt, bd->dbufSize);
                                 return RETVAL_DATA_ERROR;
                         }
                         tmp_byte = symToByte[mtfSymbol[0]];
                         byteCount[tmp_byte] += runCnt;
-                        while (--runCnt >= 0) dbuf[dbufCount++] = (uint32_t)tmp_byte;
+                        while ((int)--runCnt >= 0)
+                                dbuf[dbufCount++] = (uint32_t)tmp_byte;
                         runPos = 0;
                 }
 
@@ -467,7 +474,7 @@ static int get_next_block(bunzip_data *bd)
                    first symbol in the mtf array, position 0, would have been handled
                    as part of a run above.  Therefore 1 unused mtf position minus
                    2 non-literal nextSym values equals -1.) */
-                if (dbufCount >= dbufSize) return RETVAL_DATA_ERROR;
+                if (dbufCount >= bd->dbufSize) return RETVAL_DATA_ERROR;
                 i = nextSym - 1;
                 uc = mtfSymbol[i];
 
diff --git a/archival/libarchive/decompress_gunzip.c b/archival/libarchive/decompress_gunzip.c
index 74d364379..14a901792 100644
--- a/archival/libarchive/decompress_gunzip.c
+++ b/archival/libarchive/decompress_gunzip.c
@@ -32,7 +32,6 @@
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include <setjmp.h>
 #include "libbb.h"
 #include "bb_archive.h"
diff --git a/archival/libarchive/decompress_uncompress.c b/archival/libarchive/decompress_uncompress.c
index 034ed502d..1517559c6 100644
--- a/archival/libarchive/decompress_uncompress.c
+++ b/archival/libarchive/decompress_uncompress.c
@@ -1,10 +1,10 @@
 /* vi: set sw=4 ts=4: */
-/* uncompress for busybox -- (c) 2002 Robert Griebl
+/*
+ * uncompress for busybox -- (c) 2002 Robert Griebl
  *
  * based on the original compress42.c source
  * (see disclaimer below)
  */
-
 /* (N)compress42.c - File compression ala IEEE Computer, Mar 1992.
  *
  * Authors:
@@ -21,9 +21,7 @@
  * marc@suse.de : a small security fix for a buffer overflow
  *
  * [... History snipped ...]
- *
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c
index a9040877e..be4342414 100644
--- a/archival/libarchive/decompress_unlzma.c
+++ b/archival/libarchive/decompress_unlzma.c
@@ -450,8 +450,12 @@ unpack_lzma_stream(transformer_state_t *xstate)
  IF_NOT_FEATURE_LZMA_FAST(string:)
                         do {
                                 uint32_t pos = buffer_pos - rep0;
-                                if ((int32_t)pos < 0)
+                                if ((int32_t)pos < 0) {
                                         pos += header.dict_size;
+                                        /* bug 10436 has an example file where this triggers: */
+                                        if ((int32_t)pos < 0)
+                                                goto bad;
+                                }
                                 previous_byte = buffer[pos];
  IF_NOT_FEATURE_LZMA_FAST(one_byte2:)
                                 buffer[buffer_pos++] = previous_byte;
diff --git a/archival/libarchive/filter_accept_all.c b/archival/libarchive/filter_accept_all.c
index c33f7d3e3..5a0ee9c60 100644
--- a/archival/libarchive/filter_accept_all.c
+++ b/archival/libarchive/filter_accept_all.c
@@ -4,7 +4,6 @@
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/filter_accept_list.c b/archival/libarchive/filter_accept_list.c
index a2d4b23e9..32f806574 100644
--- a/archival/libarchive/filter_accept_list.c
+++ b/archival/libarchive/filter_accept_list.c
@@ -4,7 +4,6 @@
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/filter_accept_list_reassign.c b/archival/libarchive/filter_accept_list_reassign.c
index b9acfbc05..826c5c29d 100644
--- a/archival/libarchive/filter_accept_list_reassign.c
+++ b/archival/libarchive/filter_accept_list_reassign.c
@@ -1,10 +1,9 @@
 /* vi: set sw=4 ts=4: */
 /*
- *  Copyright (C) 2002 by Glenn McGrath
+ * Copyright (C) 2002 by Glenn McGrath
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/filter_accept_reject_list.c b/archival/libarchive/filter_accept_reject_list.c
index 248374941..939e626fa 100644
--- a/archival/libarchive/filter_accept_reject_list.c
+++ b/archival/libarchive/filter_accept_reject_list.c
@@ -4,7 +4,6 @@
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/find_list_entry.c b/archival/libarchive/find_list_entry.c
index 56032c65a..37726bd3d 100644
--- a/archival/libarchive/find_list_entry.c
+++ b/archival/libarchive/find_list_entry.c
@@ -4,7 +4,6 @@
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include <fnmatch.h>
 #include "libbb.h"
 #include "bb_archive.h"
diff --git a/archival/libarchive/get_header_ar.c b/archival/libarchive/get_header_ar.c
index c66bb3ee7..1809ec396 100644
--- a/archival/libarchive/get_header_ar.c
+++ b/archival/libarchive/get_header_ar.c
@@ -1,9 +1,9 @@
 /* vi: set sw=4 ts=4: */
-/* Copyright 2001 Glenn McGrath.
+/*
+ * Copyright 2001 Glenn McGrath.
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 #include "ar.h"
diff --git a/archival/libarchive/get_header_cpio.c b/archival/libarchive/get_header_cpio.c
index badd4a841..75fc6a406 100644
--- a/archival/libarchive/get_header_cpio.c
+++ b/archival/libarchive/get_header_cpio.c
@@ -1,9 +1,9 @@
 /* vi: set sw=4 ts=4: */
-/* Copyright 2002 Laurence Anderson
+/*
+ * Copyright 2002 Laurence Anderson
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/get_header_tar.c b/archival/libarchive/get_header_tar.c
index c7e3bc16e..aeb54190f 100644
--- a/archival/libarchive/get_header_tar.c
+++ b/archival/libarchive/get_header_tar.c
@@ -1,5 +1,6 @@
 /* vi: set sw=4 ts=4: */
-/* Licensed under GPLv2 or later, see file LICENSE in this source tree.
+/*
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  *
  * FIXME:
  *    In privileged mode if uname and gname map to a uid and gid then use the
@@ -10,7 +11,6 @@
  *    Opengroup's ustar interchange format,
  *    http://www.opengroup.org/onlinepubs/007904975/utilities/pax.html
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/get_header_tar_bz2.c b/archival/libarchive/get_header_tar_bz2.c
index 78f78a858..c021720ac 100644
--- a/archival/libarchive/get_header_tar_bz2.c
+++ b/archival/libarchive/get_header_tar_bz2.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/get_header_tar_gz.c b/archival/libarchive/get_header_tar_gz.c
index b11f503dc..793b161a1 100644
--- a/archival/libarchive/get_header_tar_gz.c
+++ b/archival/libarchive/get_header_tar_gz.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/get_header_tar_lzma.c b/archival/libarchive/get_header_tar_lzma.c
index d228cbc13..15d10adb8 100644
--- a/archival/libarchive/get_header_tar_lzma.c
+++ b/archival/libarchive/get_header_tar_lzma.c
@@ -5,7 +5,6 @@
  *
  * Licensed under GPLv2, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/get_header_tar_xz.c b/archival/libarchive/get_header_tar_xz.c
index 7bf3b3b56..852c989ce 100644
--- a/archival/libarchive/get_header_tar_xz.c
+++ b/archival/libarchive/get_header_tar_xz.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/header_verbose_list.c b/archival/libarchive/header_verbose_list.c
index 87dd82136..be5140f8b 100644
--- a/archival/libarchive/header_verbose_list.c
+++ b/archival/libarchive/header_verbose_list.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/init_handle.c b/archival/libarchive/init_handle.c
index dcba6666f..4c64dac58 100644
--- a/archival/libarchive/init_handle.c
+++ b/archival/libarchive/init_handle.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/open_transformer.c b/archival/libarchive/open_transformer.c
index 7d912152c..0160a64fe 100644
--- a/archival/libarchive/open_transformer.c
+++ b/archival/libarchive/open_transformer.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/seek_by_jump.c b/archival/libarchive/seek_by_jump.c
index 4fcd99ac8..232d97e53 100644
--- a/archival/libarchive/seek_by_jump.c
+++ b/archival/libarchive/seek_by_jump.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/seek_by_read.c b/archival/libarchive/seek_by_read.c
index c0fde9660..df2346354 100644
--- a/archival/libarchive/seek_by_read.c
+++ b/archival/libarchive/seek_by_read.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/unpack_ar_archive.c b/archival/libarchive/unpack_ar_archive.c
index 0bc030349..4f9f89874 100644
--- a/archival/libarchive/unpack_ar_archive.c
+++ b/archival/libarchive/unpack_ar_archive.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"
 #include "ar.h"
diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
index 9994f4d94..33e487bf9 100644
--- a/archival/libarchive/unsafe_prefix.c
+++ b/archival/libarchive/unsafe_prefix.c
@@ -2,7 +2,6 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-
 #include "libbb.h"
 #include "bb_archive.h"