diff options
| author | Denys Vlasenko | 2018-04-08 20:45:16 +0200 |
|---|---|---|
| committer | Denys Vlasenko | 2018-04-08 20:45:16 +0200 |
| commit | a1870f4807a75663a085c9f5e92870fa7554f0ad (patch) | |
| tree | 7293c35ce6a4df9941c827e59c9b10708be0034e /archival | |
| parent | 38ccd6af8abbafff98d458a1c62909acfc09a514 (diff) | |
| download | busybox-a1870f4807a75663a085c9f5e92870fa7554f0ad.zip busybox-a1870f4807a75663a085c9f5e92870fa7554f0ad.tar.gz | |
unlzma: fix segfault on bad archive
function old new delta
unpack_lzma_stream 2647 2653 +6
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'archival')
| -rw-r--r-- | archival/libarchive/decompress_unlzma.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c index be43424..80a4538 100644 --- a/archival/libarchive/decompress_unlzma.c +++ b/archival/libarchive/decompress_unlzma.c @@ -11,6 +11,13 @@ #include "libbb.h" #include "bb_archive.h" +#if 0 +# define dbg(...) bb_error_msg(__VA_ARGS__) +#else +# define dbg(...) ((void)0) +#endif + + #if ENABLE_FEATURE_LZMA_FAST # define speed_inline ALWAYS_INLINE # define size_inline @@ -417,6 +424,10 @@ unpack_lzma_stream(transformer_state_t *xstate) for (; num_bits2 != LZMA_NUM_ALIGN_BITS; num_bits2--) rep0 = (rep0 << 1) | rc_direct_bit(rc); rep0 <<= LZMA_NUM_ALIGN_BITS; + if ((int32_t)rep0 < 0) { + dbg("%d rep0:%d", __LINE__, rep0); + goto bad; + } prob3 = p + LZMA_ALIGN; } i2 = 1; |