04f052c56
Denys Vlasenko
2021-06-15
Subject
unlzma: fix a case where we could read before beginning of buffer
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
archival/libarchive/decompress_unlzma.c+4 -1
| @@ -290,8 +290,11 @@ unpack_lzma_stream(transformer_state_t *xstate) | |
| uint32_t pos; | |
| pos = buffer_pos - rep0; | |
| - | if ((int32_t)pos < 0) |
| + | if ((int32_t)pos < 0) { |
| pos += header.dict_size; | |
| + | if ((int32_t)pos < 0) |
| + | goto bad; |
| + | } |
| match_byte = buffer[pos]; | |
| do { | |
| int bit; | |
testsuite/unlzma.tests+13 -4
| @@ -8,14 +8,23 @@ | |
| # Damaged encrypted streams | |
| testing "unlzma (bad archive 1)" \ | |
| - | "unlzma <unlzma_issue_1.lzma >/dev/null; echo \$?" \ |
| - | "1 |
| + | "unlzma <unlzma_issue_1.lzma 2>&1 >/dev/null; echo \$?" \ |
| + | "unlzma: corrupted data |
| + | 1 |
| " "" "" | |
| # Damaged encrypted streams | |
| testing "unlzma (bad archive 2)" \ | |
| - | "unlzma <unlzma_issue_2.lzma >/dev/null; echo \$?" \ |
| - | "1 |
| + | "unlzma <unlzma_issue_2.lzma 2>&1 >/dev/null; echo \$?" \ |
| + | "unlzma: corrupted data |
| + | 1 |
| + | " "" "" |
| + | |
| + | # Damaged encrypted streams |
| + | testing "unlzma (bad archive 3)" \ |
| + | "unlzma <unlzma_issue_3.lzma 2>&1 >/dev/null; echo \$?" \ |
| + | "unlzma: corrupted data |
| + | 1 |
| " "" "" | |
| exit $FAILCOUNT | |
?+0 -0