Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:GA
libarchive.9088
CVE-2017-14503.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2017-14503.patch of Package libarchive.9088
commit 2c8c83b9731ff822fad6cc8c670ea5519c366a14 Author: Joerg Sonnenberger <joerg@bec.de> Date: Thu Jul 19 21:14:53 2018 +0200 Reject LHA archive entries with negative size. Index: libarchive-3.1.2/libarchive/archive_read_support_format_lha.c =================================================================== --- libarchive-3.1.2.orig/libarchive/archive_read_support_format_lha.c +++ libarchive-3.1.2/libarchive/archive_read_support_format_lha.c @@ -737,6 +737,12 @@ archive_read_format_lha_read_header(stru * Prepare variables used to read a file content. */ lha->entry_bytes_remaining = lha->compsize; + if (lha->entry_bytes_remaining < 0) { + archive_set_error(&a->archive, + ARCHIVE_ERRNO_FILE_FORMAT, + "Invalid LHa entry size"); + return (ARCHIVE_FATAL); + } lha->entry_offset = 0; lha->entry_crc_calculated = 0; Index: libarchive-3.1.2/libarchive/archive_read_support_format_iso9660.c =================================================================== --- libarchive-3.1.2.orig/libarchive/archive_read_support_format_iso9660.c +++ libarchive-3.1.2/libarchive/archive_read_support_format_iso9660.c @@ -409,7 +409,8 @@ static int next_entry_seek(struct archiv struct file_info **); static struct file_info * parse_file_info(struct archive_read *a, - struct file_info *parent, const unsigned char *isodirrec); + struct file_info *parent, const unsigned char *isodirrec, + size_t reclen); static int parse_rockridge(struct archive_read *a, struct file_info *file, const unsigned char *start, const unsigned char *end); @@ -1020,7 +1021,7 @@ read_children(struct archive_read *a, st if (*(p + DR_name_len_offset) == 1 && *(p + DR_name_offset) == '\001') continue; - child = parse_file_info(a, parent, p); + child = parse_file_info(a, parent, p, b - p); if (child == NULL) { __archive_read_consume(a, skip_size); return (ARCHIVE_FATAL); @@ -1110,7 +1111,7 @@ choose_volume(struct archive_read *a, st */ seenJoliet = iso9660->seenJoliet;/* Save flag. */ iso9660->seenJoliet = 0; - file = parse_file_info(a, NULL, block); + file = parse_file_info(a, NULL, block, vd->size); if (file == NULL) return (ARCHIVE_FATAL); iso9660->seenJoliet = seenJoliet; @@ -1142,7 +1143,7 @@ choose_volume(struct archive_read *a, st return (ARCHIVE_FATAL); } iso9660->seenJoliet = 0; - file = parse_file_info(a, NULL, block); + file = parse_file_info(a, NULL, block, vd->size); if (file == NULL) return (ARCHIVE_FATAL); iso9660->seenJoliet = seenJoliet; @@ -1747,7 +1748,7 @@ archive_read_format_iso9660_cleanup(stru */ static struct file_info * parse_file_info(struct archive_read *a, struct file_info *parent, - const unsigned char *isodirrec) + const unsigned char *isodirrec, size_t reclen) { struct iso9660 *iso9660; struct file_info *file, *filep; @@ -1761,7 +1762,11 @@ parse_file_info(struct archive_read *a, iso9660 = (struct iso9660 *)(a->format->data); - dr_len = (size_t)isodirrec[DR_length_offset]; + if (reclen == 0 || reclen < (dr_len = (size_t)isodirrec[DR_length_offset])) { + archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, + "Invalid directory record length"); + return (NULL); + } name_len = (size_t)isodirrec[DR_name_len_offset]; location = archive_le32dec(isodirrec + DR_extent_offset); fsize = toi(isodirrec + DR_size_offset, DR_size_size);
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor